@automagik/omni 2.260430.1 → 2.260430.2

package/dist/index.js

@@ -113980,7 +113980,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260430.1",
+  version: "2.260430.2",
   description: "LLM-optimized CLI for Omni",
   type: "module",
   bin: {

package/dist/server/index.js

@@ -224556,7 +224556,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package8 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.260430.1",
+    version: "2.260430.2",
     type: "module",
     exports: {
       ".": {
@@ -240566,7 +240566,7 @@ async function verifySignature3(opts) {
   if (!ok) {
     return { status: "invalid", reason: "signature does not verify under registered pubkey" };
   }
-  return { status: "verified", hostId: host.id };
+  return { status: "verified", hostId: host.id, hostScopes: host.scopes };
 }
 function pathFromRequest(url) {
   return `${url.pathname}${url.search}`;
@@ -240603,7 +240603,7 @@ var init_genie_signature = __esm(() => {
       now: Date.now(),
       findHost: async (id) => {
         const host = await services.genieHosts.findById(id);
-        return host ? { id: host.id, pubkey: host.pubkey, revokedAt: host.revokedAt } : null;
+        return host ? { id: host.id, pubkey: host.pubkey, revokedAt: host.revokedAt, scopes: host.scopes ?? ["*"] } : null;
       }
     });
     if (outcome.status === "invalid") {
@@ -240622,6 +240622,9 @@ var init_genie_signature = __esm(() => {
     }
     if (outcome.status === "verified" && outcome.hostId) {
       c.set("signedBy", outcome.hostId);
+      if (outcome.hostScopes) {
+        c.set("signedByScopes", outcome.hostScopes);
+      }
       services.genieHosts.touchLastSeen(outcome.hostId).catch((err) => {
         log58.warn("touchLastSeen failed (non-fatal)", { hostId: outcome.hostId, err: String(err) });
       });
@@ -241341,9 +241344,12 @@ var init_scope_enforcer = __esm(() => {
     }
     const method = c.req.method.toUpperCase();
     const path3 = c.req.path;
+    const signedBy = c.get("signedBy");
+    const signedByScopes = c.get("signedByScopes");
     const wildcard = ApiKeyService.scopeAllows(apiKey.scopes, "*");
+    let requiredScope;
     if (!wildcard) {
-      const requiredScope = findRequiredScope(method, path3);
+      requiredScope = findRequiredScope(method, path3);
       if (!requiredScope) {
         log60.warn(`DENIED: key=${apiKey.id} route=${method} ${path3} required=UNMAPPED`);
         return c.json({
@@ -241363,6 +241369,31 @@ var init_scope_enforcer = __esm(() => {
         }, 403);
       }
     }
+    if (signedBy && signedByScopes) {
+      const hostWildcard = ApiKeyService.scopeAllows(signedByScopes, "*");
+      if (!hostWildcard) {
+        const needed = requiredScope ?? findRequiredScope(method, path3);
+        if (!needed) {
+          log60.warn(`DENIED: signedBy=${signedBy} route=${method} ${path3} required=UNMAPPED`);
+          return c.json({
+            error: {
+              code: "FORBIDDEN",
+              message: "Insufficient permissions. Route not mapped in scope policy."
+            }
+          }, 403);
+        }
+        if (!ApiKeyService.scopeAllows(signedByScopes, needed)) {
+          log60.warn(`DENIED: signedBy=${signedBy} route=${method} ${path3} required=${needed} host-scopes=${signedByScopes.join(",")}`);
+          return c.json({
+            error: {
+              code: "FORBIDDEN",
+              message: `Insufficient permissions for signing host. Required scope: ${needed}`,
+              host: signedBy
+            }
+          }, 403);
+        }
+      }
+    }
     const body = await safeReadJsonBody(c);
     const targets = extractLockTargets(method, path3, body);
     const instanceResult = enforceInstanceAllowlist(apiKey, targets.instance);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/omni",
-  "version": "2.260430.1",
+  "version": "2.260430.2",
   "description": "LLM-optimized CLI for Omni",
   "type": "module",
   "bin": {
@@ -50,15 +50,15 @@
     "qrcode-terminal": "^0.12.0"
   },
   "devDependencies": {
-    "@omni/api": "2.260429.5",
-    "@omni/channel-discord": "2.260429.5",
-    "@omni/channel-gupshup": "2.260429.5",
-    "@omni/channel-sdk": "2.260429.5",
-    "@omni/channel-slack": "2.260429.5",
-    "@omni/channel-telegram": "2.260429.5",
-    "@omni/channel-whatsapp": "2.260429.5",
-    "@omni/core": "2.260429.5",
-    "@omni/sdk": "2.260429.5",
+    "@omni/api": "2.260430.1",
+    "@omni/channel-discord": "2.260430.1",
+    "@omni/channel-gupshup": "2.260430.1",
+    "@omni/channel-sdk": "2.260430.1",
+    "@omni/channel-slack": "2.260430.1",
+    "@omni/channel-telegram": "2.260430.1",
+    "@omni/channel-whatsapp": "2.260430.1",
+    "@omni/core": "2.260430.1",
+    "@omni/sdk": "2.260430.1",
     "@types/node": "^22.10.3",
     "@types/qrcode-terminal": "^0.12.2",
     "typescript": "^5.7.3"