@1agh/maude 0.48.0 → 0.49.1

package/apps/studio/sync/workspace-signin.ts

@@ -0,0 +1,301 @@
+// "Sign in to workspace" — Cloud Phase 3 Task 3.
+//
+// The Phase-2 hub can authenticate a PERSON (`POST /auth/login` → a scoped,
+// expiring peer token). This is the client half: the flow that turns "my
+// teammate sent me an address" into a working, synced project without the
+// person ever seeing the word "token".
+//
+// The vocabulary rule is not cosmetic (DDR-193 §5). The persona this product
+// lives or dies by is the invited teammate who has never used git. Every string
+// on this path says "sign in", "workspace", "project" — never token, never
+// repository, never OAuth. A flow that says "paste your bearer token" has
+// already told that person the product is not for them.
+//
+// TOKEN CUSTODY (unchanged from DDR-054 / the phase-29 A2 finding, and the
+// reason this file reuses hub-link.ts rather than writing its own storage):
+//
+//   • the health probe is TOKENLESS — a lookalike address must never receive a
+//     credential;
+//   • the password goes ONLY to the address the user typed, once, and is never
+//     stored anywhere, in memory or on disk, after the request;
+//   • what IS stored is the minted peer token, in `~/.config/maude/hubs.json`
+//     at mode 0600, keyed by normalized URL — the same store `maude design
+//     link` writes, so a project opened later just works.
+//
+// The token now EXPIRES (Phase 2), which changes one thing for the client: a
+// sync failure can mean "your session ran out" rather than "something broke",
+// and the honest response is to ask the person to sign in again rather than to
+// silently retry forever.
+
+import { saveHubCredential } from './hub-link.ts';
+import { normalizeUrl } from './hubs-config.ts';
+
+const PROBE_TIMEOUT_MS = 4000;
+const LOGIN_TIMEOUT_MS = 15_000;
+
+export interface SignInResult {
+  status: number;
+  json:
+    | {
+        ok: true;
+        url: string;
+        /** Plain-words identity for the UI header — never a token. */
+        user: { email: string; role: string };
+        /** ms-epoch. The UI surfaces "signed in until <date>", not a raw number. */
+        expiresAt: number | null;
+        version: string | null;
+      }
+    | { ok: false; error: string; reason?: SignInFailure };
+}
+
+export type SignInFailure =
+  | 'bad-address'
+  | 'unreachable'
+  | 'not-a-maude-workspace'
+  | 'bad-credentials'
+  | 'rate-limited'
+  | 'save-failed'
+  | 'server-error';
+
+export interface SignInInput {
+  url?: unknown;
+  email?: unknown;
+  password?: unknown;
+}
+
+/** Injected in tests. */
+export interface SignInDeps {
+  fetchImpl?: typeof fetch;
+  save?: (normUrl: string, token: string) => void;
+}
+
+/**
+ * Address → reachability → sign in → credential stored. One call, because the
+ * person doing this is not debugging a network stack; they were sent a link.
+ */
+export async function signInToWorkspace(
+  input: SignInInput,
+  deps: SignInDeps = {}
+): Promise<SignInResult> {
+  const doFetch = deps.fetchImpl ?? fetch;
+  const save = deps.save ?? saveHubCredential;
+
+  if (typeof input.url !== 'string' || !input.url.trim()) {
+    return fail(400, 'Enter the workspace address your team sent you.', 'bad-address');
+  }
+  if (typeof input.email !== 'string' || !input.email.trim()) {
+    return fail(400, 'Enter your email address.', 'bad-credentials');
+  }
+  if (typeof input.password !== 'string' || input.password === '') {
+    return fail(400, 'Enter your password.', 'bad-credentials');
+  }
+
+  let norm: string;
+  try {
+    norm = normalizeUrl(input.url.trim());
+    const parsed = new URL(norm);
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+      return fail(400, 'The workspace address must start with http:// or https://.', 'bad-address');
+    }
+  } catch {
+    return fail(400, "That doesn't look like a workspace address.", 'bad-address');
+  }
+
+  // 1. TOKENLESS reachability probe. Also tells us it is a Maude workspace at
+  //    all, so a typo'd address fails here with a sentence a person can act on
+  //    instead of failing later as a mysterious auth error.
+  const probe = await probe200(doFetch, `${norm}/health`, PROBE_TIMEOUT_MS);
+  if (!probe.reached) {
+    return fail(
+      502,
+      "Couldn't reach that workspace. Check the address, or ask whoever invited you whether it's online.",
+      'unreachable'
+    );
+  }
+  if (!probe.isMaude) {
+    return fail(
+      502,
+      "That address answered, but it isn't a Maude workspace. Double-check the link you were sent.",
+      'not-a-maude-workspace'
+    );
+  }
+
+  // 2. Sign in. The password goes to this address once and is never retained.
+  let res: Response;
+  try {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), LOGIN_TIMEOUT_MS);
+    try {
+      res = await doFetch(`${norm}/auth/login`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: input.email.trim(), password: input.password }),
+        signal: ctrl.signal,
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+  } catch {
+    return fail(502, "Couldn't reach that workspace to sign in.", 'unreachable');
+  }
+
+  if (res.status === 401) {
+    // The hub deliberately cannot tell us WHICH part was wrong (it refuses to be
+    // a user-existence oracle), so neither can we. Saying "wrong password" when
+    // the account may not exist would be a guess presented as fact.
+    return fail(401, 'That email and password combination was not accepted.', 'bad-credentials');
+  }
+  if (res.status === 429) {
+    return fail(429, 'Too many attempts. Wait a minute and try again.', 'rate-limited');
+  }
+  if (!res.ok) {
+    return fail(502, 'The workspace refused the sign-in. Try again shortly.', 'server-error');
+  }
+
+  let body: {
+    token?: unknown;
+    expiresAt?: unknown;
+    user?: { email?: unknown; role?: unknown };
+  };
+  try {
+    body = (await res.json()) as typeof body;
+  } catch {
+    return fail(502, 'The workspace sent an unexpected reply.', 'server-error');
+  }
+  if (typeof body.token !== 'string' || !body.token) {
+    return fail(502, 'The workspace sent an unexpected reply.', 'server-error');
+  }
+
+  // 3. Persist ONLY the minted token, 0600, in the shared credential store.
+  try {
+    save(norm, body.token);
+  } catch {
+    return fail(500, "Couldn't save the workspace connection on this computer.", 'save-failed');
+  }
+
+  return {
+    status: 200,
+    json: {
+      ok: true,
+      url: norm,
+      user: {
+        email: typeof body.user?.email === 'string' ? body.user.email : String(input.email).trim(),
+        role: typeof body.user?.role === 'string' ? body.user.role : 'member',
+      },
+      expiresAt: typeof body.expiresAt === 'number' ? body.expiresAt : null,
+      version: probe.version,
+    },
+  };
+}
+
+function fail(status: number, error: string, reason: SignInFailure): SignInResult {
+  return { status, json: { ok: false, error, reason } };
+}
+
+async function probe200(
+  doFetch: typeof fetch,
+  url: string,
+  timeoutMs: number
+): Promise<{ reached: boolean; isMaude: boolean; version: string | null }> {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+  try {
+    const res = await doFetch(url, { signal: ctrl.signal });
+    if (!res.ok) return { reached: true, isMaude: false, version: null };
+    try {
+      const j = (await res.json()) as { ok?: unknown; version?: unknown };
+      // A Maude hub's /health always carries `ok`. Anything else answered on
+      // that path is some other service.
+      const isMaude = j?.ok === true;
+      return {
+        reached: true,
+        isMaude,
+        version: typeof j?.version === 'string' ? j.version : null,
+      };
+    } catch {
+      return { reached: true, isMaude: false, version: null };
+    }
+  } catch {
+    return { reached: false, isMaude: false, version: null };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// ---------------------------------------------------------------- disclosure
+
+/**
+ * What the operator of a workspace can see and do — DDR-054's trust model, made
+ * visible to the person it concerns.
+ *
+ * DDR-079 disclosed TSX-sync via a terminal banner. In a workspace the affected
+ * human may never open a terminal: invitees run Maude Desktop and nothing else.
+ * So the disclosure moves to where they are. The banner stays for terminal
+ * users; it is no longer the only disclosure (DDR-192 §6).
+ *
+ * Written as data rather than JSX so the same sentences appear in the desktop
+ * panel, the web onboarding, and the docs without three drifting copies — and
+ * so a test can assert the honest ones are still present.
+ */
+export interface DisclosureItem {
+  /** Short label for the row. */
+  title: string;
+  /** One plain sentence. No jargon, no hedging. */
+  detail: string;
+  /** `sees` = the operator can read it · `cannot` = they can't · `you` = you control it. */
+  kind: 'sees' | 'cannot' | 'you';
+}
+
+export function workspaceDisclosure({
+  operator,
+  aiAvailable,
+}: {
+  /** Who runs this workspace, in words: "your team", "Maude Cloud", a hostname. */
+  operator: string;
+  /** Whether this machine has a Claude subscription wired up (DDR-123). */
+  aiAvailable: boolean;
+}): DisclosureItem[] {
+  return [
+    {
+      kind: 'sees',
+      title: 'Your designs',
+      detail: `${operator} stores every canvas in this project, including its full edit history.`,
+    },
+    {
+      kind: 'sees',
+      title: 'Who is working, and when',
+      detail: `${operator} can see which files you open and when you are editing.`,
+    },
+    {
+      kind: 'sees',
+      title: 'Comments and annotations',
+      detail:
+        'Anything you write on a canvas is stored in the workspace, not just on your machine.',
+    },
+    {
+      kind: 'cannot',
+      title: 'Nothing else on this computer',
+      detail:
+        'Only this project folder syncs. Other files, other projects, and the rest of your disk are never read.',
+    },
+    {
+      kind: 'cannot',
+      title: 'Your designs are never run on their servers',
+      detail:
+        'Canvases render here, on your machine. The workspace stores and syncs them — it never executes them.',
+    },
+    {
+      kind: aiAvailable ? 'you' : 'cannot',
+      title: 'AI runs on your own subscription',
+      detail: aiAvailable
+        ? 'Claude runs locally under your own subscription. Your prompts do not pass through the workspace.'
+        : 'AI is off because this computer has no Claude subscription connected. Everything else works normally.',
+    },
+    {
+      kind: 'you',
+      title: 'You can leave with everything',
+      detail:
+        'One click exports the whole project — designs and media — in a form that opens without Maude.',
+    },
+  ];
+}

package/apps/studio/test/assets-s3.test.ts

@@ -0,0 +1,249 @@
+// Cloud Phase 3 Task 2 — the S3/R2 asset lane.
+//
+// Exercised against a live in-process S3-shaped server rather than MinIO: the
+// properties worth proving are content-addressing, verification of bytes
+// received from a semi-trusted hub, and never failing a local save because a
+// bucket was unreachable. None of those need a storage vendor.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+
+import { createServer, type Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+// The HUB's independent SigV4 implementation — imported to pin the two against
+// each other, exactly as the doc-namespace grammars are pinned.
+import { signRequest as hubSignRequest } from '../../hub/src/s3.mjs';
+import {
+  createAssetMirror,
+  type S3Config,
+  s3ConfigFromEnv,
+  sha8,
+  sha8FromAssetPath,
+  signRequest,
+  verifyAssetBytes,
+} from '../assets-s3.ts';
+
+let server: Server;
+let store: Map<string, Uint8Array>;
+let seenAuth: string[];
+let cfg: S3Config;
+
+beforeAll(async () => {
+  store = new Map();
+  seenAuth = [];
+  server = createServer((req, res) => {
+    seenAuth.push(req.headers.authorization ?? '');
+    const key = decodeURIComponent(
+      new URL(req.url ?? '/', 'http://x').pathname.replace('/maude-assets/', '')
+    );
+    if (req.method === 'PUT') {
+      const chunks: Buffer[] = [];
+      req.on('data', (c) => chunks.push(c));
+      req.on('end', () => {
+        store.set(key, new Uint8Array(Buffer.concat(chunks)));
+        res.writeHead(200).end();
+      });
+      return;
+    }
+    if (req.method === 'HEAD') {
+      res.writeHead(store.has(key) ? 200 : 404).end();
+      return;
+    }
+    if (req.method === 'GET') {
+      const body = store.get(key);
+      if (!body) {
+        res.writeHead(404).end();
+        return;
+      }
+      res.writeHead(200).end(Buffer.from(body));
+      return;
+    }
+    res.writeHead(405).end();
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
+  cfg = {
+    endpoint: `http://127.0.0.1:${(server.address() as AddressInfo).port}`,
+    bucket: 'maude-assets',
+    accessKeyId: 'AKIAEXAMPLE',
+    secretAccessKey: 'secret',
+    region: 'auto',
+  };
+});
+
+afterAll(async () => {
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+});
+
+const bytesFor = (s: string) => new TextEncoder().encode(s);
+const assetPath = (b: Uint8Array, ext = 'png') => `assets/${sha8(b)}.${ext}`;
+
+describe('content addressing', () => {
+  test('sha8 is stable and differs for different bytes', () => {
+    const a = bytesFor('hello');
+    expect(sha8(a)).toBe(sha8(new Uint8Array(a)));
+    expect(sha8(a)).not.toBe(sha8(bytesFor('hellp')));
+    expect(sha8(a)).toMatch(/^[0-9a-f]{8}$/);
+  });
+
+  test('sha8FromAssetPath accepts content-addressed paths and refuses others', () => {
+    expect(sha8FromAssetPath('assets/deadbeef.png')).toBe('deadbeef');
+    expect(sha8FromAssetPath('assets/deadbeef')).toBe('deadbeef');
+    expect(sha8FromAssetPath('assets/deadbeef.mp4')).toBe('deadbeef');
+    // The shapes the REAL corpus contains beyond saveAsset's own output — a
+    // dotted sidecar and hash+label ingested footage. A stricter pattern
+    // classified these as "not content addressed", which made the mirror
+    // refuse legitimate assets as unverifiable.
+    expect(sha8FromAssetPath('assets/deadbeef.photo.json')).toBe('deadbeef');
+    expect(sha8FromAssetPath('assets/deadbeef.footage.json')).toBe('deadbeef');
+    expect(sha8FromAssetPath('assets/deadbeef-cloud.mp4')).toBe('deadbeef');
+    expect(sha8FromAssetPath('assets/deadbeef-cloud.srt')).toBe('deadbeef');
+    // Legacy / hand-placed / traversal shapes are not content-addressed. The
+    // 8 hex chars must be a COMPLETE token — `deadbeef1` is a different name.
+    expect(sha8FromAssetPath('assets/my-photo.png')).toBe(null);
+    expect(sha8FromAssetPath('assets/DEADBEEF.png')).toBe(null);
+    expect(sha8FromAssetPath('assets/deadbeef1.png')).toBe(null);
+    expect(sha8FromAssetPath('assets/deadbeefcafe.png')).toBe(null);
+    expect(sha8FromAssetPath('assets/sub/deadbeef.png')).toBe(null);
+    expect(sha8FromAssetPath('../assets/deadbeef.png')).toBe(null);
+    expect(sha8FromAssetPath('')).toBe(null);
+  });
+
+  test('verifyAssetBytes is the check that makes a semi-trusted hub usable', () => {
+    const bytes = bytesFor('the real image');
+    const path = assetPath(bytes);
+    expect(verifyAssetBytes(path, bytes)).toBe(true);
+    // ...including the labelled and sidecar shapes.
+    expect(verifyAssetBytes(`assets/${sha8(bytes)}-cloud.mp4`, bytes)).toBe(true);
+    expect(verifyAssetBytes(`assets/${sha8(bytes)}.photo.json`, bytes)).toBe(true);
+    // Substituted content under the same name — the attack DDR-054 describes.
+    expect(verifyAssetBytes(path, bytesFor('malicious replacement'))).toBe(false);
+    // A path with no content address cannot be verified, so it is not trusted.
+    expect(verifyAssetBytes('assets/logo.png', bytes)).toBe(false);
+  });
+});
+
+describe('config', () => {
+  test('an unconfigured lane is the default, not an error', () => {
+    expect(s3ConfigFromEnv({})).toBe(null);
+    // Partial config must not half-enable the lane.
+    expect(s3ConfigFromEnv({ MAUDE_S3_BUCKET: 'b', MAUDE_S3_ENDPOINT: 'e' })).toBe(null);
+    const mirror = createAssetMirror(null);
+    expect(mirror.configured).toBe(false);
+  });
+
+  test('a full env set configures it, trailing slash trimmed, region defaulted', () => {
+    const resolved = s3ConfigFromEnv({
+      MAUDE_S3_ENDPOINT: 'https://acct.r2.cloudflarestorage.com/',
+      MAUDE_S3_BUCKET: 'maude-assets',
+      MAUDE_S3_ACCESS_KEY_ID: 'AKIA',
+      MAUDE_S3_SECRET_ACCESS_KEY: 'secret',
+    });
+    expect(resolved?.endpoint).toBe('https://acct.r2.cloudflarestorage.com');
+    expect(resolved?.region).toBe('auto');
+  });
+});
+
+describe('SigV4 — pinned against the hub implementation', () => {
+  test('studio and hub sign the same request identically', () => {
+    // Two independent implementations in two independently-built packages. If
+    // they drift, one of them is wrong against real R2 and nobody would notice
+    // until a deploy.
+    const shared = {
+      endpoint: 'https://acct.r2.cloudflarestorage.com',
+      bucket: 'maude-assets',
+      accessKeyId: 'AKIAEXAMPLE',
+      secretAccessKey: 'wJalrXUtnFEMI',
+      region: 'auto',
+    };
+    const now = new Date('2026-07-28T20:30:00Z');
+    for (const key of ['assets/deadbeef.png', 'assets/a b+c!.png', 'assets/ünïcode.png']) {
+      for (const body of [null, bytesFor('payload')]) {
+        const mine = signRequest(shared, { method: 'PUT', key, body, now });
+        const theirs = hubSignRequest(shared, { method: 'PUT', key, body, now });
+        expect(mine.headers.authorization).toBe(theirs.headers.authorization);
+        expect(mine.url).toBe(theirs.url);
+      }
+    }
+  });
+
+  test('the payload is signed, so different bytes give a different signature', () => {
+    const now = new Date('2026-07-28T20:30:00Z');
+    const a = signRequest(cfg, { method: 'PUT', key: 'assets/x.png', body: bytesFor('a'), now });
+    const b = signRequest(cfg, { method: 'PUT', key: 'assets/x.png', body: bytesFor('b'), now });
+    expect(a.headers.authorization).not.toBe(b.headers.authorization);
+  });
+});
+
+describe('the mirror, against a live S3-shaped server', () => {
+  test('push then pull round-trips, and every request is signed', async () => {
+    const mirror = createAssetMirror(cfg);
+    const bytes = bytesFor('a small png, pretend');
+    const rel = assetPath(bytes);
+
+    expect(await mirror.push(rel, bytes)).toBe(true);
+    expect(await mirror.has(rel)).toBe(true);
+    const pulled = await mirror.pull(rel);
+    expect(pulled).not.toBe(null);
+    expect([...(pulled ?? [])]).toEqual([...bytes]);
+
+    expect(seenAuth.length).toBeGreaterThan(0);
+    expect(seenAuth.every((a) => a.startsWith('AWS4-HMAC-SHA256 Credential='))).toBe(true);
+  });
+
+  test('push is idempotent — content addressing means a re-push is a no-op', async () => {
+    const mirror = createAssetMirror(cfg);
+    const bytes = bytesFor('idempotent content');
+    const rel = assetPath(bytes);
+    expect(await mirror.push(rel, bytes)).toBe(true);
+    const sizeAfterFirst = store.size;
+    expect(await mirror.push(rel, bytes)).toBe(true);
+    expect(store.size).toBe(sizeAfterFirst);
+  });
+
+  test('a missing object pulls as null, not an error', async () => {
+    const mirror = createAssetMirror(cfg);
+    expect(await mirror.pull('assets/00000000.png')).toBe(null);
+    expect(await mirror.has('assets/00000000.png')).toBe(false);
+  });
+
+  test('SUBSTITUTED bytes are REFUSED — the hub cannot swap an asset', async () => {
+    // Plant content under a name it does not hash to, exactly as a compromised
+    // or malicious hub would. The pull must refuse rather than write it to disk,
+    // where it would poison every peer that later mirrors from us.
+    const honest = bytesFor('the real asset');
+    const rel = assetPath(honest);
+    store.set(rel, bytesFor('malicious replacement of the same length!!'));
+
+    const warnings: string[] = [];
+    const mirror = createAssetMirror(cfg, { log: { warn: (m: string) => warnings.push(m) } });
+    expect(await mirror.pull(rel)).toBe(null);
+    expect(warnings.join(' ')).toMatch(/does not hash to its own name/);
+  });
+
+  test('an unreachable bucket NEVER fails the caller — it returns false', async () => {
+    // The local file is already on disk and in git; the bucket is the redundant
+    // copy. Throwing here would turn a network blip into a failed save.
+    const dead = createAssetMirror(
+      { ...cfg, endpoint: 'http://127.0.0.1:1' },
+      { log: { warn: () => {} } }
+    );
+    expect(await dead.push('assets/deadbeef.png', bytesFor('x'))).toBe(false);
+    expect(await dead.pull('assets/deadbeef.png')).toBe(null);
+    expect(await dead.has('assets/deadbeef.png')).toBe(false);
+  });
+
+  test('a non-2xx response is handled like a miss, not a crash', async () => {
+    const mirror = createAssetMirror(
+      { ...cfg, bucket: 'wrong-bucket' },
+      { log: { warn: () => {} } }
+    );
+    expect(await mirror.pull('assets/deadbeef.png')).toBe(null);
+  });
+
+  test('the unconfigured mirror answers safely for every verb', async () => {
+    const mirror = createAssetMirror(null);
+    expect(await mirror.push('assets/deadbeef.png', bytesFor('x'))).toBe(false);
+    expect(await mirror.pull('assets/deadbeef.png')).toBe(null);
+    expect(await mirror.has('assets/deadbeef.png')).toBe(false);
+    expect(mirror.describe).toBe('none');
+  });
+});

package/apps/studio/test/canvas-origin-gate.test.ts

@@ -62,6 +62,13 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
       for (const p of [
         '/_config',
         '/_sync-status',
+        // Cloud Phase 3 Task 3 — the sign-in handler RECEIVES A PASSWORD, and
+        // the disclosure route is main-origin UI chrome. Both are absent from
+        // CANVAS_SAFE_API and from startCanvasServer's route map, so a GET
+        // 403s at the gate rather than 405-ing from the handler — which is what
+        // proves the route is unreachable on this origin at all.
+        '/_api/workspace/sign-in',
+        '/_api/workspace/disclosure',
         '/_api/export',
         // feature-background-export-notification-center — the background job
         // routes carry the same privileged data class as /_api/export (job