@adonis-agora/durable 1.0.0-rc.2 → 1.0.0-rc.21

package/dist/providers/dashboard_provider.d.ts

@@ -30,40 +30,67 @@ import type { ApplicationService } from '@adonisjs/core/types';
  * - `POST /api/bulk/:action`          -> bulk retry/cancel every run matching a filter
  * - `GET  /api/health`                -> worker-group health (compact shape)
  * - `GET  /api/workers`               -> worker-group health (full heartbeats; SPA)
- * - `GET  /api/topology`              -> this deployment's durable role
+ * - `GET  /api/topology`              -> this deployment's durable topology
  * - `GET  /api/compat`                -> fleet health / protocol-compatibility panel
+ * - `GET  /api/consoles`              -> the other Agora consoles this viewer may open (switcher)
+ * - `GET  /api/consoles/search?q=`    -> search across those consoles (and this one)
  * - `GET  /api/openapi.json`          -> the machine-readable API contract (OpenAPI 3.1)
  */
 export default class DashboardProvider {
     protected app: ApplicationService;
     constructor(app: ApplicationService);
-    /** Warn once so a throwing `login`/`session` hook doesn't spam the logs on every failed attempt. */
-    private warnedOnHookThrow;
     private warnedOnAuthorizeThrow;
-    /** Login-attempt timestamps per client address — a simple sliding window (10/min) so a brute
-     *  force can't hammer the host's `login` hook at line rate. In-memory per instance: a cluster
-     *  multiplies the budget by pod count, which still reduces the attack by orders of magnitude. */
-    private readonly loginAttempts;
-    /** True (and reply 429) when this address exhausted its login window. */
-    private loginRateLimited;
+    /** Each request's `authorize` verdict, read again for the console's tenant scope. */
+    private readonly decisions;
+    /** Each request's resolved tenant scope. */
+    private readonly scopes;
     /** SSE connections currently open, per client address (and in total) — see streamRun. */
     private readonly sseByAddress;
     private sseTotal;
     /**
      * Captures the engine's `capability.unavailable` / `protocol.incompatible` diagnostics events so the
      * `/compat` health panel can render each blocked run's structured delta + the live-fleet compat view
-     * (design §7.6, §10). Store-role only — attached in {@link boot}; a `tenant` pod owns no engine.
+     * (design §7.6, §10). Store-topology only — attached in {@link boot}; a `tenant` pod owns no engine.
      */
     private readonly diagnostics;
     /** Detach handle for the diagnostics subscription, released on {@link shutdown}. */
     private detachDiagnostics;
-    /** This process's event counters for `GET /metrics` (store roles; a tenant pod has no engine). */
+    /** This process's event counters for `GET /metrics` (store topologies; a tenant pod has no engine). */
     private metricsCollector;
-    /** The active durable role (`standalone` when no `durable` config is present — today's default). */
-    private durableRole;
+    /** The active durable topology (`standalone` when no `durable` config is present — today's default). */
+    private durableTopology;
     boot(): Promise<void>;
+    /**
+     * The console's read/control port, resolved per request (see {@link registerRoutes}). With tenancy
+     * on and a request at hand, it is confined to the tenants this viewer may see (see
+     * {@link consoleTenantScope}); the process counters, which span every tenant, are then left out
+     * unless the viewer sees every tenant.
+     */
+    private consoleDeps;
+    /** Whether tenancy is on for durable (config/durable.ts `tenancy`, else config/context.ts). */
+    private tenancyOn;
+    /**
+     * The tenants this viewer may see in the console, once per request, or `undefined` with tenancy
+     * off. `authorize` may grant `tenants` (`'*'` or a list); otherwise it is the viewer's own active
+     * tenant. A `?tenant=` pick outside the grant is answered with nothing and audited.
+     */
+    private consoleTenantScope;
+    private registerDevTools;
+    private registerDurableDevToolsInto;
+    private registerConsole;
+    /**
+     * What the console's "Organization" control shows: off (tenancy off), `none` (a viewer with no
+     * tenant), `fixed` (one tenant), or `pick` (several, or every tenant with `all`).
+     */
+    private tenantPicker;
     private attachDiagnostics;
     private registerRoutes;
+    /**
+     * The console-shell fields of the page's data block: the switcher, ⌘K search (whenever a console
+     * registry exists — this console registers its own search), the signed-in viewer and the
+     * sign-out (the host's option, else the one an account console announced on the registry).
+     */
+    private shellFields;
     /** Mount the React SPA at `config.path` plus its hashed asset bundle. */
     private registerSpaRoutes;
     /**
@@ -76,43 +103,25 @@ export default class DashboardProvider {
     private streamRun;
     private compatSource;
     private fleetTransport;
-    /**
-     * Mount the built-in `dashboardAuth` endpoints under `basePath`. All are public (no guard): they
-     * create/destroy the session the {@link enforce} guard checks for.
-     *
-     * - `GET  <base>/login`  -> the server-rendered login page (Mode B only).
-     * - `POST <base>/login`  -> verifies credentials via the host `login` hook and mints the cookie.
-     * - `POST <base>/session` -> Mode A: verifies the HOST APP's own auth (off the raw request) via the
-     *    `session` hook and mints the cookie. No body — the hook reads whatever it needs off `request`.
-     *    `204` on success, uniform `401` on denial. Mirrors `@dudousxd/nestjs-durable-dashboard`'s
-     *    `DurableAuthController.session` and `client/console-session.ts`'s `mintDurableConsoleSession`.
-     * - `GET  <base>/logout` -> clears the cookie and redirects to the login page (Mode B) or the
-     *    dashboard root (Mode A only). A plain `GET` (idempotent, only ever destroys the caller's own
-     *    session) so a simple `<a href>` works.
-     */
-    private registerAuthRoutes;
     /** Record one mutating console action (see DashboardAuditEntry). Never throws into the request. */
     private audit;
+    /** Hand one audit entry to the host's sink, or the default logger line. Never throws. */
+    private recordAudit;
     /** Route a handler 500's detail to the app logger (the client only ever sees a generic body). */
     private logServerError;
     private warnAuthorizeThrow;
-    private warnHookThrow;
+    /** The once-per-boot warning for a console with no `authorize` (open in dev, 403 in production). */
+    private warnNoAuthorize;
     /**
-     * Run the guards for a dashboard resource. Composes the existing `authorize` hook (bearer
-     * token/custom) with the optional `dashboardAuth` session guard — BOTH must pass:
+     * Run `authorize` for a dashboard resource. On a denial:
      *
-     * 1. `authorize` denies -> the built-in (or host-customised) access-denied PAGE for a `page`
-     *    request, JSON for an `api` request. `reason: 'unauthenticated'` is a `401`
-     *    (`{ error: 'unauthorized' }`); `false`, `{ allowed: false }`, `reason: 'forbidden'` or a
-     *    throwing hook is a `403` (`{ error: 'forbidden' }`). A hook that already answered the request
-     *    (a redirect, a body) keeps its answer.
-     * 2. `dashboardAuth` configured AND no valid session -> for a `page` request, redirect `302` to
-     *    the login page (Mode B) carrying a sanitized `returnTo`, or the `401` "open this console
-     *    from your app" page (Mode A only, no login page to redirect to); for an `api` request, a
-     *    plain `401 { error: 'unauthorized', auth: { modes } }` — the `modes` list lets the SPA's
-     *    client (`durable-client.ts`) decide whether to offer the login page.
+     * - `{ redirectTo }`: a `page` request is redirected there (`302`); an `api` request gets
+     *   `401 { error: 'unauthenticated', redirectTo }`;
+     * - `reason: 'unauthenticated'`: `401` (the access-denied page, or `{ error: 'unauthenticated' }`);
+     * - anything else (`false`, `{ allowed: false }`, a throw): `403` (the access-denied page, or
+     *   `{ error: 'forbidden' }`).
      *
-     * When `dashboardAuth` is unconfigured only step 1 runs.
+     * A hook that already answered the request (a redirect, a body) keeps its answer.
      * Returns `false` (and has already written the response) when the request must short-circuit.
      */
     private enforce;
@@ -123,16 +132,8 @@ export default class DashboardProvider {
      * redirect keeps it; the provider never overwrites a `location` header.
      */
     private denyPage;
-    private readSessionCookie;
-    private writeSessionCookie;
     shutdown(): Promise<void>;
 }
-/**
- * Whether something already answered this request: a redirect (`location` header — the signal the
- * `authorize` contract has always honoured) or a body queued on the response. The body check reads
- * AdonisJS's `response.hasLazyBody` structurally so a plain-object `ctx` double in a unit test
- * (which has neither) still works.
- */
 /** Whether this request can change state (everything but GET/HEAD/OPTIONS). Exported for tests. */
 export declare function isMutatingMethod(ctx: HttpContext): boolean;
 /**
@@ -143,8 +144,10 @@ export declare function isMutatingMethod(ctx: HttpContext): boolean;
  * cross-subdomain POST caller, and strict beats sorry here.
  */
 export declare function crossSiteRequest(ctx: HttpContext): boolean;
-/** Role convention (see enforce): no roles = full access; with roles, mutating needs operator/admin. */
-export declare function sessionCanMutate(session: {
-    roles: string[];
-}): boolean;
+/**
+ * Who a mutating console action is attributed to: the signed-in user (`ctx.auth.user`'s `email`,
+ * `name` or `id`, read structurally — this package does not depend on `@adonisjs/auth`), `'bearer'`
+ * for a caller with an `Authorization` header and no user, else `'anonymous'`.
+ */
+export declare function auditActor(ctx: HttpContext): string;
 //# sourceMappingURL=dashboard_provider.d.ts.map

package/dist/providers/dashboard_provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard_provider.d.ts","sourceRoot":"","sources":["../../providers/dashboard_provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAqB,MAAM,sBAAsB,CAAC;AAiFlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACxB,SAAS,CAAC,GAAG,EAAE,kBAAkB;IAA7C,YAAsB,GAAG,EAAE,kBAAkB,EAAI;IAEjD,oGAAoG;IACpG,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,sBAAsB,CAAS;IAEvC;;qGAEiG;IACjG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+B;IAE7D,yEAAyE;IACzE,OAAO,CAAC,gBAAgB;IAkBxB,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAK;IAErB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE,oFAAoF;IACpF,OAAO,CAAC,iBAAiB,CAA6B;IACtD,kGAAkG;IAClG,OAAO,CAAC,gBAAgB,CAAiC;IAEzD,oGAAoG;IACpG,OAAO,CAAC,WAAW;IAIb,IAAI,kBAgBT;YAEa,iBAAiB;IAiB/B,OAAO,CAAC,cAAc;IA+KtB,yEAAyE;IACzE,OAAO,CAAC,iBAAiB;IAgDzB;;;;;;OAMG;YACW,SAAS;YA6CT,YAAY;YAWZ,cAAc;IAQ5B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kBAAkB;IAyF1B,mGAAmG;IACnG,OAAO,CAAC,KAAK;IAiCb,iGAAiG;YACnF,cAAc;YAWd,kBAAkB;YAQlB,aAAa;IAQ3B;;;;;;;;;;;;;;;;;OAiBG;YACW,OAAO;IA0ErB;;;;;OAKG;YACW,QAAQ;IAuBtB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,kBAAkB;IAapB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAK9B;CACF;AAED;;;;;GAKG;AACH,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAG1D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAU1D;AAED,wGAAwG;AACxG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAMtE"}
+{"version":3,"file":"dashboard_provider.d.ts","sourceRoot":"","sources":["../../providers/dashboard_provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAqB,MAAM,sBAAsB,CAAC;AA8FlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACxB,SAAS,CAAC,GAAG,EAAE,kBAAkB;IAA7C,YAAsB,GAAG,EAAE,kBAAkB,EAAI;IAEjD,OAAO,CAAC,sBAAsB,CAAS;IAEvC,qFAAqF;IACrF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+C;IACzE,4CAA4C;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkD;IAEzE,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAK;IAErB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE,oFAAoF;IACpF,OAAO,CAAC,iBAAiB,CAA6B;IACtD,uGAAuG;IACvG,OAAO,CAAC,gBAAgB,CAAiC;IAEzD,wGAAwG;IACxG,OAAO,CAAC,eAAe;IAIjB,IAAI,kBA6BT;IAED;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAwBnB,+FAA+F;IAC/F,OAAO,CAAC,SAAS;IAIjB;;;;OAIG;YACW,kBAAkB;YA6ClB,gBAAgB;YAoBhB,2BAA2B;YAqB3B,eAAe;IAyC7B;;;OAGG;YACW,YAAY;YAwCZ,iBAAiB;IAmB/B,OAAO,CAAC,cAAc;IAwNtB;;;;OAIG;YACW,WAAW;IAgBzB,yEAAyE;IACzE,OAAO,CAAC,iBAAiB;IAuDzB;;;;;;OAMG;YACW,SAAS;YA6CT,YAAY;YAWZ,cAAc;IAQ5B,mGAAmG;IACnG,OAAO,CAAC,KAAK;IAab,yFAAyF;IACzF,OAAO,CAAC,WAAW;IAInB,iGAAiG;YACnF,cAAc;YAWd,kBAAkB;IAQhC,oGAAoG;YACtF,eAAe;IAS7B;;;;;;;;;;;OAWG;YACW,OAAO;IA8CrB;;;;;OAKG;YACW,QAAQ;IAsBhB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAK9B;CACF;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAG1D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAU1D;AAwBD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAUnD"}