@1agh/maude 0.51.1 → 0.52.0

package/apps/studio/sync/hubs-config.ts

@@ -12,6 +12,17 @@ import { join } from 'node:path';
 export interface HubRecord {
   token: string;
   linkedAt: number;
+  /**
+   * The role the workspace vouched for at sign-in (Cloud Phase 25 C2).
+   *
+   * Stored so a viewer is known to be a viewer at BOOT, before any request is
+   * made — the alternative is discovering it from the first refusal, which
+   * means showing somebody an editor and taking it away.
+   *
+   * Absent means `member`: every credential written before this shipped was
+   * write-capable, and nobody is demoted by an upgrade.
+   */
+  role?: string;
 }
 
 export interface HubsConfig {
@@ -74,6 +85,27 @@ function warnIfWorldOrGroupReadable(path: string): void {
   }
 }
 
+/**
+ * Is the credential for `url` a READ-ONLY one? (Cloud Phase 25 C2)
+ *
+ * Answered from the role the workspace vouched for at sign-in, so the app
+ * knows at BOOT rather than discovering it from the first refused write —
+ * which would mean showing somebody an editor and then taking it away.
+ *
+ * Unknown, unreadable, or absent all answer FALSE, matching every credential
+ * written before this shipped. This flag decides what the UI OFFERS; it is
+ * never the thing that stops a write. That is the cell (Phase 25 C1) and the
+ * gate in http.ts, both of which hold whatever this returns.
+ */
+export function isHubReadOnly(url: string): boolean {
+  try {
+    const record = loadHubsConfig().hubs[normalizeUrl(url)];
+    return record?.role === 'viewer';
+  } catch {
+    return false;
+  }
+}
+
 /** Look up a token for `url`. Returns null when no entry exists. */
 export function getHubToken(url: string): string | null {
   try {

package/apps/studio/sync/workspace-signin.ts

@@ -67,7 +67,7 @@ export interface SignInInput {
 /** Injected in tests. */
 export interface SignInDeps {
   fetchImpl?: typeof fetch;
-  save?: (normUrl: string, token: string) => void;
+  save?: (normUrl: string, token: string, role?: string) => void;
 }
 
 /**
@@ -181,9 +181,13 @@ export async function signInToWorkspace(
     return fail(502, 'The workspace sent an unexpected reply.', 'server-error');
   }
 
-  // 3. Persist ONLY the minted token, 0600, in the shared credential store.
+  // 3. Persist ONLY the minted token, 0600, in the shared credential store —
+  //    plus the role the workspace vouched for (Cloud Phase 25 C2), so a
+  //    viewer is known to be one at BOOT. Learning it from the first refusal
+  //    instead means showing somebody an editor and then taking it away.
+  const vouchedRole = typeof body.user?.role === 'string' ? body.user.role : 'member';
   try {
-    save(norm, body.token);
+    save(norm, body.token, vouchedRole);
   } catch {
     return fail(500, "Couldn't save the workspace connection on this computer.", 'save-failed');
   }
@@ -195,7 +199,7 @@ export async function signInToWorkspace(
       url: norm,
       user: {
         email: typeof body.user?.email === 'string' ? body.user.email : String(input.email).trim(),
-        role: typeof body.user?.role === 'string' ? body.user.role : 'member',
+        role: vouchedRole,
       },
       expiresAt: typeof body.expiresAt === 'number' ? body.expiresAt : null,
       version: probe.version,

package/apps/studio/test/_helpers.ts

@@ -63,9 +63,11 @@ export async function bootServer(
     stdout: 'pipe',
     stderr: 'pipe',
   });
-  // Wait up to 3 s for the server to bind.
+  // Wait up to 10 s for the server to bind — the first spawn cold-compiles the
+  // whole studio TS, which under parallel test load regularly blows a 3 s
+  // budget (the flaky "server did not start" class of failure).
   const start = Date.now();
-  while (Date.now() - start < 3000) {
+  while (Date.now() - start < 10000) {
     try {
       const r = await fetch(`http://localhost:${port}/_health`, {
         signal: AbortSignal.timeout(200),
@@ -85,7 +87,7 @@ export async function bootServer(
     await Bun.sleep(50);
   }
   proc.kill();
-  throw new Error(`server did not start on port ${port} within 3 s`);
+  throw new Error(`server did not start on port ${port} within 10 s`);
 }
 
 export async function killProc(proc: Subprocess) {

package/apps/studio/test/canvas-create-api.test.ts

@@ -163,17 +163,23 @@ describe('/_api/canvas — POST round-trip', () => {
     }
   });
 
-  test('rejects a video-comp with an empty clips[] (400) and a traversal src (400)', async () => {
+  test('accepts an empty clips[] as the greenfield "New video" (201) and rejects a traversal src (400)', async () => {
     const { root } = makeSandbox();
     const port = nextPort();
     const proc = await bootServer(root, port);
     try {
+      // enhanced-video-editing Task 20 — empty clips[] scaffolds an editable
+      // empty comp (drop-first cut building), no longer a 400.
       const empty = await fetch(`http://localhost:${port}/_api/canvas`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ name: 'Empty', kind: 'video-comp', clips: [] }),
       });
-      expect(empty.status).toBe(400);
+      expect(empty.status).toBe(201);
+      const created = (await empty.json()) as { file?: string };
+      const tsx = await Bun.file(`${root}/${created.file}`).text();
+      expect(tsx).toContain('Drop clips on the timeline');
+      expect(tsx).toContain('<VideoComp');
       const bad = await fetch(`http://localhost:${port}/_api/canvas`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },

package/apps/studio/test/canvas-origin-gate.test.ts

@@ -88,6 +88,18 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
         '/_api/edit-attr',
         // DDR-148 — raw canvas source for the Timeline parser is MAIN-ORIGIN
         // ONLY (the untrusted canvas iframe must never read project source).
+        // Cloud Phase 23 C3 — the Maude Cloud lane holds the PERSONAL TOKEN
+        // and can write linkedHub + a hub credential. Absent from
+        // CANVAS_SAFE_API and from startCanvasServer's routes; the security
+        // pass confirmed that by reading, which is exactly the kind of fact
+        // that should be pinned rather than re-read (validate 2026-07-30).
+        '/_api/cloud/status',
+        '/_api/cloud/projects',
+        '/_api/cloud/signin/start',
+        '/_api/cloud/signin/poll',
+        '/_api/cloud/signout',
+        '/_api/cloud/attach',
+        '/_api/cloud/attach/code',
         '/_api/canvas-source',
         // DDR-148 — Timeline drag-to-retime is a source-write, MAIN-ORIGIN ONLY.
         '/_api/retime-sequence',
@@ -101,6 +113,14 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
         '/_api/insert-sequence',
         // DDR-150 P5 — z-order reorder is a source-write, MAIN-ORIGIN ONLY.
         '/_api/reorder-sequence',
+        // enhanced-video-editing Phase 2 — the parametric clip-verb door (speed ·
+        // trim · split · transition · layer-order · set-text · to-overlay · …) is
+        // a source-write, MAIN-ORIGIN ONLY; the layer-order verb rides this route
+        // and does NOT widen the canvas surface (security review 2026-07-30).
+        '/_api/clip-edit',
+        // enhanced-video-editing Task 7 — the filmstrip/waveform cache holds
+        // dataURL frames of local footage; MAIN-ORIGIN ONLY + DNS-rebinding guard.
+        '/_api/timeline-media',
         // DDR-150 dogfood — array-src replace is a source-write, MAIN-ORIGIN ONLY.
         '/_api/edit-array-src',
         // DDR-150 dogfood — clip hide/show is a source-write, MAIN-ORIGIN ONLY.

package/apps/studio/test/clip-addressing.test.ts

@@ -687,9 +687,11 @@ describe('assembleCompSource — refs → comp (DDR-150 P4 Task 12)', () => {
     const { clips, compName, durationInFrames } = enumerateClips('/abs/MyReel.tsx', tsx, 'reel');
     expect(compName).toBe('Comp');
     expect(clips.map((c) => c.mediaSrc)).toEqual(['assets/a.mp4', 'assets/b.mp4']);
-    // …laid back-to-back (cursor advances by each duration)…
-    expect(clips[0]!.from).toBe(0);
-    expect(clips[1]!.from).toBe(60);
+    // …as series beats butted back-to-back (enhanced-video-editing Task 20:
+    // the storyline is a <TransitionSeries> now — beats carry no `from`, the
+    // series computes their offsets)…
+    expect(clips[0]!.tag).toBe('TransitionSeries.Sequence');
+    expect(clips[0]!.durationInFrames).toBe(60);
     expect(clips[1]!.durationInFrames).toBe(40);
     // …with durable <Sequence name> identity so hand-edits land right.
     expect(clips.map((c) => c.stableId)).toEqual(['name:clip-1', 'name:clip-2']);
@@ -705,9 +707,8 @@ describe('assembleCompSource — refs → comp (DDR-150 P4 Task 12)', () => {
       { src: 'assets/music.mp3', mediaKind: 'audio' },
     ]);
     expect(tsx).toContain('<Audio src="assets/music.mp3" />');
-    expect(tsx).toContain(
-      `import { AbsoluteFill, Sequence, OffthreadVideo, Audio } from 'remotion';`
-    );
+    expect(tsx).toContain(`import { TransitionSeries } from '@remotion/transitions';`);
+    expect(tsx).toContain(`import { AbsoluteFill, OffthreadVideo, Audio } from 'remotion';`);
     // total driven by the video clip's duration (audio doesn't extend it).
     expect(enumerateClips('/abs/R.tsx', tsx, 'reel').durationInFrames).toBe(90);
   });