@assembly-js/app-foundation 0.0.55 → 0.1.0

package/CHANGELOG.md

@@ -14,6 +14,16 @@ A foundation update reads the sections between an app's version and the target:
 from every bullet except `[guidance]`, agent work from the check scripts those `[action]`
 bullets ship. Write `[fix]`, `[behavior]` and `[action]` bullets for the app's owner.
 
+A patch release never changes what an app's build requires; a minor release may add or change a
+`bin/check-*.mjs` script. CI fails a PR that changes a check script without a minor bump over main.
+
+## 0.1.0
+- [fix] Signed-in sessions in Safari keep working after the hour-long sign-in expires, instead of leaving the user signed out.
+- [action] An app with a hand-written silent-renewal route still signs Safari users out an hour after they sign in; the build now flags that route, and it moves to the foundation's handler.
+
+## 0.0.56
+- [new] The client-call scan now marks each finding as gated only when every page or route that can load its file requires a staff user. Nothing in the app changes.
+
 ## 0.0.55
 - [new] Add a scan the platform can run on demand to find calls that use a signed-in viewer's access to the platform API from pages and routes clients can open. Nothing in the app changes and no file is added to it.
 

package/bin/check-reexchange-route.mjs

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+// Fails the build when the app's silent-renewal route is a hand-written copy
+// instead of the package's handler. The copies predate the Safari fallback
+// (a bearer returned in the body for browsers that refuse the partitioned
+// cookie), so an app carrying one signs its Safari users out after the first
+// hour. Dependency-free on purpose: it runs inside the generated app's sandbox
+// before any deps beyond Node exist.
+//
+// An app with no such route passes; check-proxy-csrf owns the missing-route
+// finding.
+//
+// A hit is a warning on an ordinary turn and fails the build with --strict
+// (the update acceptance), on a platform update turn, or when
+// ASSEMBLY_TURN_BASELINE_SHA says this turn changed the route.
+import { existsSync, readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { join } from 'node:path';
+
+const ROOT = process.cwd();
+const STRICT = process.argv.includes('--strict') || process.env.ASSEMBLY_UPDATE_TURN === '1';
+const TURN_BASELINE_ENV = 'ASSEMBLY_TURN_BASELINE_SHA';
+
+const ROUTE_FILE = 'app/api/assembly-reexchange/route.ts';
+const PACKAGE_HANDLER = /createAssemblyReexchangeHandler\s*\(/;
+// A comment mentioning the factory must not satisfy the check.
+const COMMENT_LINE = /^\s*(\/\/|\*|\/\*)/;
+
+if (!existsSync(join(ROOT, ROUTE_FILE))) process.exit(0);
+const usesPackageHandler = readFileSync(join(ROOT, ROUTE_FILE), 'utf8')
+  .split('\n')
+  .some((line) => !COMMENT_LINE.test(line) && PACKAGE_HANDLER.test(line));
+if (usesPackageHandler) process.exit(0);
+
+const fatal = STRICT || changedThisTurn();
+const out = fatal ? console.error : console.warn;
+out('');
+out(
+  fatal
+    ? `check-reexchange-route: ${ROUTE_FILE} is not the package handler:`
+    : `check-reexchange-route: ${ROUTE_FILE} is not the package handler (pre-existing; this build is not failed for it):`,
+);
+out('');
+out('A hand-written renewal route does not return the bearer in the response body, so Safari');
+out('sessions end after the first hour. Replace the whole file with exactly this:');
+out('');
+out("  import { createAssemblyReexchangeHandler } from '@assembly-js/app-foundation/server';");
+out('');
+out('  export const POST = createAssemblyReexchangeHandler();');
+out('');
+out('Do not add logic to the route; the handler owns the CSRF check and the renewal.');
+if (fatal) process.exit(1);
+
+function changedThisTurn() {
+  const baseline = (process.env[TURN_BASELINE_ENV] ?? '').trim();
+  if (!baseline) return false;
+  const listings = [
+    { args: ['diff', '--name-only', `${baseline}..HEAD`], parse: (line) => line },
+    { args: ['status', '--porcelain', '--untracked-files=all'], parse: (line) => line.slice(3).split(' -> ').pop() },
+  ];
+  for (const { args, parse } of listings) {
+    const result = spawnSync('git', args, { cwd: ROOT, encoding: 'utf8' });
+    if (result.status !== 0) return true;
+    const files = result.stdout.split('\n').map((line) => parse(line).trim());
+    if (files.includes(ROUTE_FILE)) return true;
+  }
+  return false;
+}

package/bin/foundation-exports.mjs

@@ -14,7 +14,8 @@
 // automation caller (an app), never a viewer. makeTestActionContext builds a fake context for
 // tests that no request can reach. getClientAccessScope, getInternalUserAccess,
 // requireCompanyScope, getInstalledAppIds and isAppInstalled take a client as an argument;
-// none of them returns one.
+// none of them returns one. createAssemblyReexchangeHandler returns a route handler that
+// renews the bearer cookie; it never hands out a client.
 export const NON_CLIENT_EXPORTS = new Set([
   'APP_CSRF_HEADER', 'AUTH_UNAVAILABLE_CODE', 'ActionContext', 'ActionError',
   'ActionErrorStatus', 'AirtableFieldSchema', 'AirtableFormattedField',
@@ -39,7 +40,8 @@ export const NON_CLIENT_EXPORTS = new Set([
   'automationActionRoute', 'badRequest', 'bootstrapPortalOrigin', 'buildMimeMessage',
   'canAccessClient', 'canAccessCompanies', 'classifyExchangeFailure',
   'clearClientNotifications', 'collectHeaders', 'collectXhrResponseHeaders',
-  'cookielessReexchangeHeaders', 'cookiesAreBlocked', 'createAssemblyProxy', 'cronRoute',
+  'cookielessReexchangeHeaders', 'cookiesAreBlocked', 'createAssemblyProxy',
+  'createAssemblyReexchangeHandler', 'cronRoute',
   'decodeBearer', 'expandClientsByCompany', 'extractPdfText', 'fetchSessionFlags',
   'findResource', 'formatAirtableRecords', 'getAirtableTableSchema', 'getCapturedRecords',
   'getClientAccessScope', 'getCookielessBearer', 'getDownloadUrl', 'getInstalledAppIds', 'getIntegration',

package/bin/scan-client-calls.mjs

@@ -39,7 +39,7 @@ import {
   wrapperName,
 } from './scan-routes.mjs';
 
-export const SCANNER_VERSION = 1;
+export const SCANNER_VERSION = 2;
 
 export const CLASS_BREAKS = 'BREAKS';
 export const CLASS_CLEAN = 'CLEAN';
@@ -878,15 +878,20 @@ export function createAnalysis(root) {
   return { root, files, ts, read, facts: factsFor, classifyEntries: () => classifyEntries(ts, root, files, read) };
 }
 
-// Maps every file an entry can load to the byte-smallest entry that loads it.
+// Maps every file to the byte-smallest entry that loads it (`entry`) and to every entry that
+// does (`entries`): a file shared with an ungated entry stays exposed however the others are gated.
 function reachFrom(analysis, entries) {
   const reach = new Map();
   for (const entry of entries) {
+    const visited = new Set();
     const queue = [entry];
     while (queue.length) {
       const file = queue.pop();
-      if (reach.has(file)) continue;
-      reach.set(file, entry);
+      if (visited.has(file)) continue;
+      visited.add(file);
+      const seen = reach.get(file);
+      if (seen) seen.entries.add(entry);
+      else reach.set(file, { entry, entries: new Set([entry]) });
       queue.push(...analysis.facts(file).imports);
     }
   }
@@ -904,14 +909,16 @@ export function projectClientReachable(analysis, allowlist = CLIENT_SAFE_SDK_MET
   const reach = reachFrom(analysis, entries);
   const findings = [];
   const unresolved = [];
-  for (const [file, entry] of reach) {
+  const gatedSet = new Set(gatedEntries);
+  for (const [file, { entry, entries: reaching }] of reach) {
+    const gated = [...reaching].every((e) => gatedSet.has(e));
     const { calls, defeaters } = analysis.facts(file);
     for (const c of calls) {
       if (c.provenance === PROVENANCE_VIEWER && !allowed.has(c.method)) {
-        findings.push({ file, line: c.line, method: c.method, provenance: c.provenance, entry });
+        findings.push({ file, line: c.line, method: c.method, provenance: c.provenance, entry, gated });
       }
     }
-    for (const d of defeaters) unresolved.push({ file, line: d.line, reason: d.reason, entry });
+    for (const d of defeaters) unresolved.push({ file, line: d.line, reason: d.reason, entry, gated });
   }
   sortFindings(findings);
   sortFindings(unresolved);

package/dist/reexchange.d.ts

@@ -0,0 +1,2 @@
+import { NextRequest, NextResponse } from 'next/server';
+export declare function createAssemblyReexchangeHandler(): (req: NextRequest) => Promise<NextResponse>;

package/dist/reexchange.js

@@ -0,0 +1,53 @@
+// The app's silent bearer renewal route. It lives in the package rather than in
+// each app because it is security-critical code an agent must never re-author;
+// an app's route file only calls createAssemblyReexchangeHandler.
+import { NextResponse } from 'next/server';
+import { APP_CSRF_HEADER, BEARER_IN_BODY_HEADER, isSessionExchangeEnabled, serializeBearerCookie, serializeCookieProbe, } from './session-exchange.js';
+import { mintBearerFromSessionToken } from './mint-bearer.js';
+// The only header any route may read a session token from.
+const SESSION_TOKEN_HEADER = 'x-assembly-token';
+// When the 60-minute bearer expires, the client posts the current
+// (bridge-kept-fresh) session token here; we re-run the /session exchange
+// server-side and set a fresh HttpOnly bearer cookie, so the original call
+// retries with no page reload. The proxy matcher excludes this route so its
+// stale-cookie clear can't race the fresh cookie, which is why CSRF is enforced
+// here instead.
+export function createAssemblyReexchangeHandler() {
+    return async function POST(req) {
+        // Dormant unless the exchange is enabled — legacy (exchange-off) apps never
+        // re-exchange; they keep using the raw session token per request.
+        if (!isSessionExchangeEnabled()) {
+            return NextResponse.json({ error: 'Not found' }, { status: 404 });
+        }
+        // A cross-site request cannot set the custom header without a CORS
+        // preflight, which this app never grants.
+        if (!req.headers.has(APP_CSRF_HEADER)) {
+            return new NextResponse(null, { status: 403 });
+        }
+        const token = req.headers.get(SESSION_TOKEN_HEADER);
+        if (!token) {
+            return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+        const minted = await mintBearerFromSessionToken(token);
+        if (!minted.ok) {
+            // The fresh session token also failed to exchange — the parent (Cognito)
+            // session is gone, or the exchange is unavailable. Either way there is no
+            // bearer to set, so signal expiry and let the client retry.
+            return NextResponse.json({ error: 'Unauthorized', code: 'token_expired' }, { status: 401, headers: { 'x-assembly-token-expired': '1' } });
+        }
+        // A caller that has proven its browser drops the cookie cannot receive the
+        // bearer any other way, so hand it back in the body. Gated on the caller
+        // asking, so a cookie-capable browser's response never carries a bearer a
+        // script could read.
+        const wantsBearerInBody = req.headers.has(BEARER_IN_BODY_HEADER);
+        const response = NextResponse.json(wantsBearerInBody ? { ok: true, bearer: minted.bearer } : { ok: true });
+        const maxAge = Math.max(0, Math.floor((minted.bearerExpiresAt - Date.now()) / 1_000));
+        // headers.append, not response.cookies.set, which keys by name and would
+        // collapse the clear and the set of the same-named cookie. The legacy
+        // unpartitioned record is cleared so it can't shadow the fresh bearer.
+        response.headers.append('Set-Cookie', serializeBearerCookie('', 0, false));
+        response.headers.append('Set-Cookie', serializeBearerCookie(minted.bearer, maxAge, true));
+        response.headers.append('Set-Cookie', serializeCookieProbe(true));
+        return response;
+    };
+}

package/dist/server.d.ts

@@ -15,6 +15,7 @@ export * from './notifications.js';
 export * from './cron.js';
 export * from './replace-rows.js';
 export * from './proxy.js';
+export * from './reexchange.js';
 export * from './pdf.js';
 export * from './api-errors.js';
 export * from './params.js';

package/dist/server.js

@@ -19,6 +19,7 @@ export * from './notifications.js';
 export * from './cron.js';
 export * from './replace-rows.js';
 export * from './proxy.js';
+export * from './reexchange.js';
 // Lazy-loads its parser, so importing the barrel costs a route nothing until it parses a PDF.
 export * from './pdf.js';
 // Returns NextResponse, so route handlers only — but nothing here reads a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.0.55",
+  "version": "0.1.0",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [
@@ -31,7 +31,7 @@
   },
   "scripts": {
     "build": "tsc && tsc-alias",
-    "test": "npm run build && bun test --path-ignore-patterns='**/proxy.test.ts' && bun test ./src/proxy.test.ts && tsc -p tsconfig.replace-rows.json",
+    "test": "npm run build && bun test --path-ignore-patterns='**/proxy.test.ts' --path-ignore-patterns='**/reexchange.test.ts' && bun test ./src/proxy.test.ts && bun test ./src/reexchange.test.ts && tsc -p tsconfig.replace-rows.json",
     "prepublishOnly": "npm run build && npm run verify:dist && npm run verify:bin",
     "verify:dist": "node scripts/verify-dist-resolves.mjs",
     "verify:bin": "node scripts/verify-bin.mjs"