@agent-native/dispatch 0.18.0 → 0.19.0

package/dist/server/lib/vault-store.js

@@ -1,4 +1,5 @@
 import crypto from "node:crypto";
+import { getDbExec } from "@agent-native/core/db";
 import { and, desc, eq, isNull, or, sql } from "@agent-native/core/db/schema";
 import { ssrfSafeFetch } from "@agent-native/core/extensions/url-safety";
 import { deleteAppSecret, listAppSecretsForScope, writeAppSecret, } from "@agent-native/core/secrets";
@@ -27,6 +28,12 @@ function ctxScope(table, ctx) {
     }
     return or(eq(table.ownerEmail, ctx.ownerEmail), eq(table.orgId, ctx.orgId));
 }
+/** Scope an approval operation to the active tenant, never just the owner email. */
+function tenantScope(table, ctx) {
+    if (ctx.orgId)
+        return eq(table.orgId, ctx.orgId);
+    return and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId));
+}
 /** Build a ctx that scopes to a specific row's owner/org (used when a
  * request approver acts on behalf of the original requester so the
  * created secret lands in the request's org). */
@@ -85,6 +92,42 @@ export function isTrustedEnvVarSyncAgentUrl(agentUrl) {
 function scopedFilter(table) {
     return ctxScope(table, requireVaultCtx());
 }
+/**
+ * Shared vault values and grants are organization administration data. Keep
+ * the member path available for request creation and safe key metadata, but
+ * fail closed before a member can read or mutate a raw secret.
+ */
+export async function assertCanManageVault() {
+    const orgId = currentOrgId();
+    if (!orgId)
+        return;
+    const email = currentOwnerEmail().trim().toLowerCase();
+    let role = null;
+    try {
+        const result = await getDbExec().execute({
+            sql: "SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1",
+            args: [orgId, email],
+        });
+        role = result.rows[0]?.role;
+    }
+    catch {
+        // coercion-ok: unknown membership is treated as unauthorized below.
+        // A failed membership check must not become an authorization bypass.
+    }
+    if (role !== "owner" && role !== "admin") {
+        throw new Error("Only organization owners and admins can manage the workspace vault.");
+    }
+}
+export async function canManageVault() {
+    try {
+        await assertCanManageVault();
+        return true;
+    }
+    catch {
+        // coercion-ok: the UI must treat an authorization lookup failure as no access.
+        return false;
+    }
+}
 function normalizeCredentialKey(value) {
     return value.trim();
 }
@@ -108,6 +151,7 @@ export async function getVaultAccessSettings() {
     };
 }
 export async function setVaultAccessSettings(input) {
+    await assertCanManageVault();
     const scope = vaultAccessScope();
     const next = { mode: parseVaultAccessMode(input.mode) };
     if (scope.scope === "org") {
@@ -144,6 +188,7 @@ export async function recordVaultAudit(input) {
     });
 }
 export async function listVaultAudit(limit = 50) {
+    await assertCanManageVault();
     const db = getDb();
     return db
         .select()
@@ -154,6 +199,7 @@ export async function listVaultAudit(limit = 50) {
 }
 // ─── Secrets ──────────────────────────────────────────────────────
 export async function listSecrets() {
+    await assertCanManageVault();
     const db = getDb();
     return db
         .select()
@@ -161,7 +207,23 @@ export async function listSecrets() {
         .where(scopedFilter(schema.vaultSecrets))
         .orderBy(desc(schema.vaultSecrets.updatedAt));
 }
+/** Safe metadata for app creation and integration readiness checks. */
+export async function listSecretOptions() {
+    const db = getDb();
+    return db
+        .select({
+        id: schema.vaultSecrets.id,
+        name: schema.vaultSecrets.name,
+        credentialKey: schema.vaultSecrets.credentialKey,
+        provider: schema.vaultSecrets.provider,
+        description: schema.vaultSecrets.description,
+    })
+        .from(schema.vaultSecrets)
+        .where(scopedFilter(schema.vaultSecrets))
+        .orderBy(desc(schema.vaultSecrets.updatedAt));
+}
 export async function getSecret(secretId, ctx) {
+    await assertCanManageVault();
     const db = getDb();
     const [row] = await db
         .select()
@@ -171,6 +233,7 @@ export async function getSecret(secretId, ctx) {
     return row ?? null;
 }
 export async function createSecret(input, ctx = requireVaultCtx()) {
+    await assertCanManageVault();
     const db = getDb();
     const timestamp = now();
     const credentialKey = normalizeCredentialKey(input.credentialKey);
@@ -246,6 +309,7 @@ export async function createSecret(input, ctx = requireVaultCtx()) {
     return created;
 }
 export async function updateSecret(secretId, input, ctx = requireVaultCtx()) {
+    await assertCanManageVault();
     const db = getDb();
     const existing = await getSecret(secretId, ctx);
     if (!existing)
@@ -328,6 +392,7 @@ export async function updateSecret(secretId, input, ctx = requireVaultCtx()) {
     return updated;
 }
 export async function deleteSecret(secretId, ctx = requireVaultCtx()) {
+    await assertCanManageVault();
     const db = getDb();
     const existing = await getSecret(secretId, ctx);
     if (!existing)
@@ -360,6 +425,7 @@ export async function deleteSecret(secretId, ctx = requireVaultCtx()) {
 }
 // ─── Grants ──────────────────────────────────────────────────────
 export async function listGrants(filter) {
+    await assertCanManageVault();
     const db = getDb();
     const conditions = [scopedFilter(schema.vaultGrants)];
     if (filter?.secretId) {
@@ -375,6 +441,7 @@ export async function listGrants(filter) {
         .orderBy(desc(schema.vaultGrants.updatedAt));
 }
 export async function getGrant(grantId, ctx = requireVaultCtx()) {
+    await assertCanManageVault();
     const db = getDb();
     const [row] = await db
         .select()
@@ -384,6 +451,7 @@ export async function getGrant(grantId, ctx = requireVaultCtx()) {
     return row ?? null;
 }
 export async function createGrant(secretId, appId, ctx = requireVaultCtx()) {
+    await assertCanManageVault();
     const db = getDb();
     const secret = await getSecret(secretId, ctx);
     if (!secret)
@@ -453,6 +521,7 @@ export async function createGrant(secretId, appId, ctx = requireVaultCtx()) {
     return getGrant(grantId);
 }
 export async function grantSecretsToApp(secretIds, appId, ctx = requireVaultCtx()) {
+    await assertCanManageVault();
     const access = await getVaultAccessSettings();
     const uniqueSecretIds = Array.from(new Set(secretIds));
     if (access.mode === "all-apps") {
@@ -481,6 +550,7 @@ export async function grantSecretsToApp(secretIds, appId, ctx = requireVaultCtx(
     return { appId, accessMode: access.mode, created, skipped };
 }
 export async function revokeGrant(grantId, ctx = requireVaultCtx()) {
+    await assertCanManageVault();
     const db = getDb();
     const grant = await getGrant(grantId, ctx);
     if (!grant)
@@ -613,6 +683,7 @@ export async function cleanupSyncedCredentialKeysIfUnused(ctx, candidateKeys) {
 }
 // ─── Sync ──────────────────────────────────────────────────────
 export async function syncGrantsToApp(appId, ctx = requireVaultCtx()) {
+    await assertCanManageVault();
     const db = getDb();
     const access = await getVaultAccessSettings();
     const agents = await discoverAgents("dispatch");
@@ -736,7 +807,13 @@ export async function syncGrantsToApp(appId, ctx = requireVaultCtx()) {
 // ─── Requests ──────────────────────────────────────────────────────
 export async function listRequests(filter) {
     const db = getDb();
-    const conditions = [scopedFilter(schema.vaultRequests)];
+    const ctx = requireVaultCtx();
+    const isAdmin = await canManageVault();
+    const conditions = [
+        isAdmin
+            ? ctxScope(schema.vaultRequests, ctx)
+            : eq(schema.vaultRequests.ownerEmail, ctx.ownerEmail),
+    ];
     if (filter?.status) {
         conditions.push(eq(schema.vaultRequests.status, filter.status));
     }
@@ -755,6 +832,15 @@ export async function getRequest(requestId, ctx = requireVaultCtx()) {
         .limit(1);
     return row ?? null;
 }
+async function getRequestForTenant(requestId, ctx) {
+    const db = getDb();
+    const [row] = await db
+        .select()
+        .from(schema.vaultRequests)
+        .where(and(eq(schema.vaultRequests.id, requestId), tenantScope(schema.vaultRequests, ctx)))
+        .limit(1);
+    return row ?? null;
+}
 export async function createRequest(input) {
     const db = getDb();
     const timestamp = now();
@@ -784,8 +870,9 @@ export async function createRequest(input) {
     return getRequest(requestId);
 }
 export async function approveRequest(requestId, secretValue, secretName, ctx = requireVaultCtx()) {
+    await assertCanManageVault();
     const db = getDb();
-    const request = await getRequest(requestId, ctx);
+    const request = await getRequestForTenant(requestId, ctx);
     if (!request)
         throw new Error("Request not found");
     const timestamp = now();
@@ -804,10 +891,10 @@ export async function approveRequest(requestId, secretValue, secretName, ctx = r
         status: "applying",
         updatedAt: timestamp,
     })
-        .where(and(eq(schema.vaultRequests.id, requestId), ctxScope(schema.vaultRequests, ctx), or(eq(schema.vaultRequests.status, "pending"), and(eq(schema.vaultRequests.status, "applying"), sql `${schema.vaultRequests.updatedAt} < ${staleApplyingBefore}`))))
+        .where(and(eq(schema.vaultRequests.id, requestId), tenantScope(schema.vaultRequests, ctx), or(eq(schema.vaultRequests.status, "pending"), and(eq(schema.vaultRequests.status, "applying"), sql `${schema.vaultRequests.updatedAt} < ${staleApplyingBefore}`))))
         .returning();
     if (claimed.length === 0) {
-        const current = await getRequest(requestId, ctx);
+        const current = await getRequestForTenant(requestId, ctx);
         if (current?.status === "applying") {
             throw new Error("Vault request is already being applied");
         }
@@ -840,7 +927,7 @@ export async function approveRequest(requestId, secretValue, secretName, ctx = r
         await db
             .update(schema.vaultRequests)
             .set({ status: "pending", updatedAt: now() })
-            .where(and(eq(schema.vaultRequests.id, requestId), ctxScope(schema.vaultRequests, ctx), eq(schema.vaultRequests.status, "applying")));
+            .where(and(eq(schema.vaultRequests.id, requestId), tenantScope(schema.vaultRequests, ctx), eq(schema.vaultRequests.status, "applying")));
         throw error;
     }
     await db
@@ -851,18 +938,19 @@ export async function approveRequest(requestId, secretValue, secretName, ctx = r
         reviewedAt: timestamp,
         updatedAt: now(),
     })
-        .where(and(eq(schema.vaultRequests.id, requestId), ctxScope(schema.vaultRequests, ctx), eq(schema.vaultRequests.status, "applying")));
+        .where(and(eq(schema.vaultRequests.id, requestId), tenantScope(schema.vaultRequests, ctx), eq(schema.vaultRequests.status, "applying")));
     await recordVaultAudit({
         action: "request.approved",
         appId: claimedRequest.appId,
         summary: `Approved ${claimedRequest.credentialKey} for ${claimedRequest.appId} (requested by ${claimedRequest.requestedBy})`,
         metadata: { requestId, reviewer },
     });
-    return getRequest(requestId, ctx);
+    return getRequestForTenant(requestId, ctx);
 }
 export async function denyRequest(requestId, reason, ctx = requireVaultCtx()) {
+    await assertCanManageVault();
     const db = getDb();
-    const request = await getRequest(requestId, ctx);
+    const request = await getRequestForTenant(requestId, ctx);
     if (!request)
         throw new Error("Request not found");
     const timestamp = now();
@@ -875,10 +963,10 @@ export async function denyRequest(requestId, reason, ctx = requireVaultCtx()) {
         reviewedAt: timestamp,
         updatedAt: timestamp,
     })
-        .where(and(eq(schema.vaultRequests.id, requestId), ctxScope(schema.vaultRequests, ctx), eq(schema.vaultRequests.status, "pending")))
+        .where(and(eq(schema.vaultRequests.id, requestId), tenantScope(schema.vaultRequests, ctx), eq(schema.vaultRequests.status, "pending")))
         .returning();
     if (claimed.length === 0) {
-        return getRequest(requestId, ctx);
+        return getRequestForTenant(requestId, ctx);
     }
     const claimedRequest = claimed[0];
     await recordVaultAudit({
@@ -887,13 +975,13 @@ export async function denyRequest(requestId, reason, ctx = requireVaultCtx()) {
         summary: `Denied ${claimedRequest.credentialKey} for ${claimedRequest.appId} (requested by ${claimedRequest.requestedBy})`,
         metadata: { requestId, reviewer, reason },
     });
-    return getRequest(requestId, ctx);
+    return getRequestForTenant(requestId, ctx);
 }
 export async function listIntegrationsCatalog() {
     const access = await getVaultAccessSettings();
     const agents = await discoverAgents("dispatch");
-    const grants = await listGrants();
-    const secrets = await listSecrets();
+    const grants = (await canManageVault()) ? await listGrants() : [];
+    const secrets = await listSecretOptions();
     const secretByKey = new Map(secrets.map((s) => [s.credentialKey, s]));
     const results = [];
     for (const agent of agents) {
@@ -955,9 +1043,10 @@ export async function listIntegrationsCatalog() {
 }
 // ─── Vault Overview (for dashboard) ──────────────────────────────
 export async function listVaultOverview() {
+    const isAdmin = await canManageVault();
     const [secrets, grants, requests, access] = await Promise.all([
-        listSecrets(),
-        listGrants(),
+        listSecretOptions(),
+        isAdmin ? listGrants() : Promise.resolve([]),
         listRequests(),
         getVaultAccessSettings(),
     ]);
@@ -965,8 +1054,12 @@ export async function listVaultOverview() {
     return {
         accessMode: access.mode,
         secretCount: secrets.length,
-        activeGrantCount: access.mode === "all-apps" ? secrets.length : manualGrantCount,
-        manualGrantCount,
+        activeGrantCount: access.mode === "all-apps"
+            ? secrets.length
+            : isAdmin
+                ? manualGrantCount
+                : 0,
+        manualGrantCount: isAdmin ? manualGrantCount : 0,
         pendingRequestCount: requests.filter((r) => r.status === "pending").length,
     };
 }