@bevel-software/platform-core-backend 0.4.1 → 0.5.1

package/dist/modules/groups/index.d.ts

@@ -0,0 +1,7 @@
+export { GroupIndexService, groupsWorkspaceId } from './groups.service.js';
+export { GroupProvisionService, GroupProvisionError, groupAccessMd, personalAccessMd, } from './group-provision.service.js';
+export { JoinRequestsService, type JoinRequest } from './join-requests.service.js';
+export { pendingProposals, type JoinProposal } from './join-proposals.js';
+export { createGroupsRoutes } from './groups.routes.js';
+export type { IGroupIndexService, GroupCatalogEntry, GroupSummary, ResolvedPrincipals, ResolvedReaders, } from './groups.contract.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/groups/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/groups/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,GACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,KAAK,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,eAAe,GAChB,MAAM,sBAAsB,CAAC"}

package/dist/modules/groups/index.js

@@ -0,0 +1,6 @@
+export { GroupIndexService, groupsWorkspaceId } from './groups.service.js';
+export { GroupProvisionService, GroupProvisionError, groupAccessMd, personalAccessMd, } from './group-provision.service.js';
+export { JoinRequestsService } from './join-requests.service.js';
+export { pendingProposals } from './join-proposals.js';
+export { createGroupsRoutes } from './groups.routes.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/groups/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/groups/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,GACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAoB,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAqB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/modules/groups/join-proposals.d.ts

@@ -0,0 +1,53 @@
+import { type Verb } from '../access/access-control.service.js';
+/**
+ * What a join branch is PROPOSING, relative to the default branch.
+ *
+ * A join request is a change request whose branch edits one group's
+ * `access.md`. Rather than treating that change request as an all-or-nothing
+ * merge, the group's managers see its individual proposals — "grant Ali read",
+ * "grant GTM Team write" — and answer them one at a time. Approving a proposal
+ * writes THAT ONE grant onto the default branch through the ordinary access
+ * mutation path; the branch is never merged, so nothing else it happens to
+ * contain can ride along, and a change request naming five people can be
+ * answered with two yeses and three ignores.
+ *
+ * A proposal is any (principal, verb) GRANT the branch's copy of the file
+ * carries that the default branch's copy does not. Deliberately:
+ *
+ *  - grants only. A `deny` entry is not something to "accept", and a branch
+ *    that REMOVES an existing grant proposes nothing — it is a revocation,
+ *    which is not what this surface is for. Both are simply invisible here,
+ *    and both leave the branch as a normal change request in the review UI.
+ *  - every verb, not just `read`. A branch asking for `write` must be visible
+ *    AS a write request rather than hiding behind "asked to join"; and the
+ *    subset test that retires a request has to cover everything the file can
+ *    express, or a request proposing `write` would never settle.
+ *
+ * When the list comes back EMPTY the branch adds nothing the default branch
+ * does not already grant — its proposals have all been accepted (or were
+ * never anything) — and the change request has no reason to stay open.
+ */
+export interface JoinProposal {
+    verb: Verb;
+    /** Canonical identity — lowercased email, or canonical role name. */
+    id: string;
+    principal: {
+        kind: 'user';
+        email: string;
+        displayName: string;
+    } | {
+        kind: 'role';
+        role: string;
+    };
+    /** How to name this principal in the UI. */
+    label: string;
+}
+/**
+ * The grants `branchText` adds over `defaultText` — the proposals a manager
+ * can accept. Empty ⇒ the branch's rules are a subset of the default's.
+ *
+ * `path` is only used to label parse errors; both texts are the same file at
+ * two refs.
+ */
+export declare function pendingProposals(branchText: string | null, defaultText: string | null, path: string): JoinProposal[];
+//# sourceMappingURL=join-proposals.d.ts.map

package/dist/modules/groups/join-proposals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"join-proposals.d.ts","sourceRoot":"","sources":["../../../src/modules/groups/join-proposals.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,IAAI,EACV,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,IAAI,CAAC;IACX,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EACL;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GACpD;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACnC,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;CACf;AAgCD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,IAAI,EAAE,MAAM,GACX,YAAY,EAAE,CA0BhB"}

package/dist/modules/groups/join-proposals.js

@@ -0,0 +1,67 @@
+import { KNOWN_VERBS, parseAccessFile, } from '../access/access-control.service.js';
+/** Canonical identity of an entry, for set comparison across the two files. */
+function identityOf(entry) {
+    return entry.kind === 'user' ? `user:${entry.email}` : `role:${entry.role}`;
+}
+/**
+ * Folder rules from one copy of an `access.md`, per verb, grants only.
+ *
+ * A file that fails to parse yields NO grants. On the branch side that means
+ * a malformed proposal offers nothing to accept (fail-closed). On the default
+ * side it means every branch grant looks incoming — which is the safe
+ * direction too: the manager is shown proposals to consider rather than
+ * having them silently swallowed by an unreadable baseline.
+ */
+function grantsByVerb(text, path) {
+    const out = new Map();
+    for (const verb of KNOWN_VERBS)
+        out.set(verb, new Map());
+    if (text === null)
+        return out;
+    const parsed = parseAccessFile(text, path);
+    if (!parsed.ok)
+        return out;
+    for (const verb of KNOWN_VERBS) {
+        const byId = out.get(verb);
+        for (const entry of parsed.file.entries[verb]) {
+            if (entry.deny)
+                continue;
+            byId.set(identityOf(entry), entry);
+        }
+    }
+    return out;
+}
+/**
+ * The grants `branchText` adds over `defaultText` — the proposals a manager
+ * can accept. Empty ⇒ the branch's rules are a subset of the default's.
+ *
+ * `path` is only used to label parse errors; both texts are the same file at
+ * two refs.
+ */
+export function pendingProposals(branchText, defaultText, path) {
+    const branch = grantsByVerb(branchText, path);
+    const base = grantsByVerb(defaultText, path);
+    const out = [];
+    for (const verb of KNOWN_VERBS) {
+        const baseIds = base.get(verb);
+        for (const [id, entry] of branch.get(verb)) {
+            if (baseIds.has(id))
+                continue;
+            out.push(entry.kind === 'user'
+                ? {
+                    verb,
+                    id,
+                    principal: { kind: 'user', email: entry.email, displayName: entry.displayName },
+                    label: entry.displayName,
+                }
+                : {
+                    verb,
+                    id,
+                    principal: { kind: 'role', role: entry.displayRole },
+                    label: entry.displayRole,
+                });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=join-proposals.js.map

package/dist/modules/groups/join-proposals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"join-proposals.js","sourceRoot":"","sources":["../../../src/modules/groups/join-proposals.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,eAAe,GAGhB,MAAM,qCAAqC,CAAC;AAyC7C,+EAA+E;AAC/E,SAAS,UAAU,CAAC,KAAkB;IACpC,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,IAAmB,EAAE,IAAY;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkC,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,WAAW;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAC9B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,IAAI,KAAK,CAAC,IAAI;gBAAE,SAAS;YACzB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAyB,EACzB,WAA0B,EAC1B,IAAY;IAEZ,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QAChC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC9B,GAAG,CAAC,IAAI,CACN,KAAK,CAAC,IAAI,KAAK,MAAM;gBACnB,CAAC,CAAC;oBACE,IAAI;oBACJ,EAAE;oBACF,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;oBAC/E,KAAK,EAAE,KAAK,CAAC,WAAW;iBACzB;gBACH,CAAC,CAAC;oBACE,IAAI;oBACJ,EAAE;oBACF,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE;oBACpD,KAAK,EAAE,KAAK,CAAC,WAAW;iBACzB,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/modules/groups/join-requests.service.d.ts

@@ -0,0 +1,81 @@
+import { type AuthUser, type ChangeRequest, type IWorkflowService } from '@bevel-software/platform-shared';
+import { type WorkspaceService } from '../workspace/workspace.service.js';
+import { type JoinProposal } from './join-proposals.js';
+/** One open join change request, with what it still proposes. */
+export interface JoinRequest {
+    number: number;
+    branch: string;
+    requesterName: string;
+    createdAt: string;
+    /** Grants the branch adds over the default branch. Never empty (see below). */
+    proposals: JoinProposal[];
+}
+/**
+ * Join requests as PROPOSALS, and the reconciliation that retires them.
+ *
+ * The lifecycle has no state of its own — it is derived, every time, from two
+ * copies of one file:
+ *
+ *   open        the branch's `access.md` grants something the default's does not
+ *   settled     it does not
+ *
+ * so "approve" is not an operation on the request at all. A manager grants a
+ * principal through the ordinary access path (the same lock + commit every
+ * other access edit uses, gated the same way), the default branch gains that
+ * entry, and the proposal stops being pending because the diff no longer
+ * contains it. When the last one goes, the change request has nothing left to
+ * say and is rejected, its branch deleted.
+ *
+ * That reconciliation runs LAZILY on every listing as well as on demand, so a
+ * grant made anywhere — this banner, the Manage-access dialog, a hand edit —
+ * settles the request that asked for it. Nothing has to remember to.
+ */
+export declare class JoinRequestsService {
+    private readonly workspaceService;
+    private readonly workflow;
+    constructor(workspaceService: WorkspaceService, workflow: IWorkflowService);
+    /**
+     * Open join requests for `group`, each carrying only its still-pending
+     * proposals. Requests with none left are reconciled away (rejected, branch
+     * deleted) and omitted.
+     *
+     * `actor` is who the reconciliation acts as — a manager of the group, since
+     * rejecting a change request requires write on everything it touches.
+     */
+    list(group: string, folder: string, crs: ChangeRequest[], actor: AuthUser): Promise<JoinRequest[]>;
+    /**
+     * Re-check ONE request and settle it if nothing is pending. Returns whether
+     * it was settled. Called right after a grant so the banner updates in the
+     * same round-trip instead of waiting for the next listing.
+     */
+    reconcile(group: string, folder: string, cr: ChangeRequest, actor: AuthUser): Promise<boolean>;
+    /**
+     * Close a request whose proposals have all landed, and delete its branch.
+     *
+     * Rejecting rather than merging is the point: the grants are already on the
+     * default branch, so merging would replay a diff that is now empty of
+     * meaning while dragging along anything else the branch carries. The branch
+     * goes too — it exists only to hold a proposal that no longer exists.
+     *
+     * Best-effort by contract: this runs inside a listing, and a request that
+     * cannot be closed right now must not take the listing down with it. The
+     * next pass tries again.
+     */
+    private settle;
+    /**
+     * The file at one branch, or null when it is absent/unreadable there.
+     *
+     * Every read runs against the DEFAULT branch's clone at `origin/<branch>`,
+     * so one workspace answers for every request and a join branch never needs
+     * a clone of its own. `readFileAtRef` takes a REPO-relative path (the KB
+     * dir is the repo root there).
+     */
+    private readAt;
+    /**
+     * Refresh remote-tracking refs before reading them. Throttled inside, and
+     * best-effort: a request pushed seconds ago is worth one fetch, but a fetch
+     * failure must degrade to "read what we have" rather than empty the list.
+     */
+    private refresh;
+}
+//# sourceMappingURL=join-requests.service.d.ts.map

package/dist/modules/groups/join-requests.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"join-requests.service.d.ts","sourceRoot":"","sources":["../../../src/modules/groups/join-requests.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAChG,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE1E,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,gBAAgB;IAG7C;;;;;;;OAOG;IACG,IAAI,CACR,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,aAAa,EAAE,EACpB,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,WAAW,EAAE,CAAC;IA2BzB;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,aAAa,EACjB,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC,OAAO,CAAC;IAcnB;;;;;;;;;;;OAWG;YACW,MAAM;IAgCpB;;;;;;;OAOG;YACW,MAAM;IAYpB;;;;OAIG;YACW,OAAO;CAKtB"}

package/dist/modules/groups/join-requests.service.js

@@ -0,0 +1,135 @@
+import { DEFAULT_BRANCH, isJoinBranchFor, } from '@bevel-software/platform-shared';
+import { workspaceIdForBranch } from '../workspace/workspace.service.js';
+import { pendingProposals } from './join-proposals.js';
+/**
+ * Join requests as PROPOSALS, and the reconciliation that retires them.
+ *
+ * The lifecycle has no state of its own — it is derived, every time, from two
+ * copies of one file:
+ *
+ *   open        the branch's `access.md` grants something the default's does not
+ *   settled     it does not
+ *
+ * so "approve" is not an operation on the request at all. A manager grants a
+ * principal through the ordinary access path (the same lock + commit every
+ * other access edit uses, gated the same way), the default branch gains that
+ * entry, and the proposal stops being pending because the diff no longer
+ * contains it. When the last one goes, the change request has nothing left to
+ * say and is rejected, its branch deleted.
+ *
+ * That reconciliation runs LAZILY on every listing as well as on demand, so a
+ * grant made anywhere — this banner, the Manage-access dialog, a hand edit —
+ * settles the request that asked for it. Nothing has to remember to.
+ */
+export class JoinRequestsService {
+    workspaceService;
+    workflow;
+    constructor(workspaceService, workflow) {
+        this.workspaceService = workspaceService;
+        this.workflow = workflow;
+    }
+    /**
+     * Open join requests for `group`, each carrying only its still-pending
+     * proposals. Requests with none left are reconciled away (rejected, branch
+     * deleted) and omitted.
+     *
+     * `actor` is who the reconciliation acts as — a manager of the group, since
+     * rejecting a change request requires write on everything it touches.
+     */
+    async list(group, folder, crs, actor) {
+        await this.refresh();
+        const accessPath = `${folder}/access.md`;
+        const baseText = await this.readAt(DEFAULT_BRANCH, accessPath);
+        const out = [];
+        for (const cr of crs) {
+            if (cr.state !== 'open' || !isJoinBranchFor(cr.branch, group))
+                continue;
+            const proposals = pendingProposals(await this.readAt(cr.branch, accessPath), baseText, accessPath);
+            if (proposals.length === 0) {
+                await this.settle(cr, actor);
+                continue;
+            }
+            out.push({
+                number: cr.number,
+                branch: cr.branch,
+                requesterName: cr.appAuthor?.name ?? 'Someone',
+                createdAt: cr.createdAt,
+                proposals,
+            });
+        }
+        return out.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+    }
+    /**
+     * Re-check ONE request and settle it if nothing is pending. Returns whether
+     * it was settled. Called right after a grant so the banner updates in the
+     * same round-trip instead of waiting for the next listing.
+     */
+    async reconcile(group, folder, cr, actor) {
+        if (cr.state !== 'open' || !isJoinBranchFor(cr.branch, group))
+            return false;
+        await this.refresh();
+        const accessPath = `${folder}/access.md`;
+        const proposals = pendingProposals(await this.readAt(cr.branch, accessPath), await this.readAt(DEFAULT_BRANCH, accessPath), accessPath);
+        if (proposals.length > 0)
+            return false;
+        await this.settle(cr, actor);
+        return true;
+    }
+    /**
+     * Close a request whose proposals have all landed, and delete its branch.
+     *
+     * Rejecting rather than merging is the point: the grants are already on the
+     * default branch, so merging would replay a diff that is now empty of
+     * meaning while dragging along anything else the branch carries. The branch
+     * goes too — it exists only to hold a proposal that no longer exists.
+     *
+     * Best-effort by contract: this runs inside a listing, and a request that
+     * cannot be closed right now must not take the listing down with it. The
+     * next pass tries again.
+     */
+    async settle(cr, actor) {
+        const wsId = workspaceIdForBranch(DEFAULT_BRANCH);
+        try {
+            await this.workflow.rejectChangeRequest(cr.number, actor, cr.state, cr.authorId ?? null, cr.base, wsId);
+        }
+        catch (err) {
+            console.warn(`[groups] could not close settled join request #${cr.number}: ${err instanceof Error ? err.message : String(err)}`);
+            return;
+        }
+        try {
+            await this.workflow.deleteBranch(wsId, cr.branch, actor);
+        }
+        catch (err) {
+            // The request is closed either way; a leftover branch is cosmetic and
+            // the author can still delete it themselves.
+            console.warn(`[groups] closed join request #${cr.number} but could not delete "${cr.branch}": ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    /**
+     * The file at one branch, or null when it is absent/unreadable there.
+     *
+     * Every read runs against the DEFAULT branch's clone at `origin/<branch>`,
+     * so one workspace answers for every request and a join branch never needs
+     * a clone of its own. `readFileAtRef` takes a REPO-relative path (the KB
+     * dir is the repo root there).
+     */
+    async readAt(branch, repoRelPath) {
+        try {
+            return await this.workspaceService.readFileAtRef(workspaceIdForBranch(DEFAULT_BRANCH), `origin/${branch}`, repoRelPath);
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Refresh remote-tracking refs before reading them. Throttled inside, and
+     * best-effort: a request pushed seconds ago is worth one fetch, but a fetch
+     * failure must degrade to "read what we have" rather than empty the list.
+     */
+    async refresh() {
+        await this.workspaceService
+            .ensureRemotesFetched(workspaceIdForBranch(DEFAULT_BRANCH))
+            .catch(() => undefined);
+    }
+}
+//# sourceMappingURL=join-requests.service.js.map

package/dist/modules/groups/join-requests.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"join-requests.service.js","sourceRoot":"","sources":["../../../src/modules/groups/join-requests.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,eAAe,GAIhB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAyB,MAAM,mCAAmC,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAqB,MAAM,qBAAqB,CAAC;AAY1E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,mBAAmB;IAEX;IACA;IAFnB,YACmB,gBAAkC,EAClC,QAA0B;QAD1B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,aAAQ,GAAR,QAAQ,CAAkB;IAC1C,CAAC;IAEJ;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CACR,KAAa,EACb,MAAc,EACd,GAAoB,EACpB,KAAe;QAEf,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,GAAG,MAAM,YAAY,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAkB,EAAE,CAAC;QAC9B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,EAAE,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;gBAAE,SAAS;YACxE,MAAM,SAAS,GAAG,gBAAgB,CAChC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EACxC,QAAQ,EACR,UAAU,CACX,CAAC;YACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC7B,SAAS;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,aAAa,EAAE,EAAE,CAAC,SAAS,EAAE,IAAI,IAAI,SAAS;gBAC9C,SAAS,EAAE,EAAE,CAAC,SAAS;gBACvB,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CACb,KAAa,EACb,MAAc,EACd,EAAiB,EACjB,KAAe;QAEf,IAAI,EAAE,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5E,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,GAAG,MAAM,YAAY,CAAC;QACzC,MAAM,SAAS,GAAG,gBAAgB,CAChC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EACxC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,EAC7C,UAAU,CACX,CAAC;QACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,MAAM,CAAC,EAAiB,EAAE,KAAe;QACrD,MAAM,IAAI,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CACrC,EAAE,CAAC,MAAM,EACT,KAAK,EACL,EAAE,CAAC,KAAK,EACR,EAAE,CAAC,QAAQ,IAAI,IAAI,EACnB,EAAE,CAAC,IAAI,EACP,IAAI,CACL,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,kDAAkD,EAAE,CAAC,MAAM,KACzD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,6CAA6C;YAC7C,OAAO,CAAC,IAAI,CACV,iCAAiC,EAAE,CAAC,MAAM,0BAA0B,EAAE,CAAC,MAAM,MAC3E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,WAAmB;QACtD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAC9C,oBAAoB,CAAC,cAAc,CAAC,EACpC,UAAU,MAAM,EAAE,EAClB,WAAW,CACZ,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,OAAO;QACnB,MAAM,IAAI,CAAC,gBAAgB;aACxB,oBAAoB,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;aAC1D,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/dist/modules/secrets-vault/secrets-vault.routes.d.ts

@@ -16,6 +16,26 @@ export interface SecretsVaultRoutesDeps {
     /** Public base URL of the SPA — where the OAuth callback lands the browser. */
     publicFrontendUrl: string;
 }
+/**
+ * Is this a SAME-ORIGIN path we're willing to bounce the browser back to after a
+ * sign-in? The callback builds `${publicFrontendUrl}${dest}#…`, so anything that
+ * survives this check gets concatenated onto our own origin — which makes every
+ * rule here an open-redirect rule, not a formatting preference:
+ *  - must start with a single `/` — `//evil.com` is a protocol-relative URL and
+ *    `https://evil.com` an absolute one; both would leave our origin entirely.
+ *  - no `\` — WHATWG folds a backslash to a slash for http(s), so `/\evil.com`
+ *    is `//evil.com` by another spelling.
+ *  - no `#` — the callback appends its own fragment; a caller-supplied one would
+ *    swallow the `#authorized=…`/`#error=…` the landing page reads.
+ *  - no CR/LF — never let a caller-controlled string reach a `Location` header
+ *    with a line break in it (response splitting).
+ *  - ≤512 chars — a signed `state` rides in the provider's authorize URL, and
+ *    some providers cap its length; this keeps the round-trip inside every
+ *    budget without needing to know each provider's limit.
+ * Exported for the route tests: this predicate IS the security boundary, so it
+ * is pinned by a unit table rather than only exercised end-to-end.
+ */
+export declare function isSafeReturnPath(returnTo: unknown): returnTo is string;
 /**
  * Authenticated Secrets Vault CRUD + OAuth start. Every route is scoped to
  * `req.userId` — secrets are private per user. Mounted behind the JWT middleware.

package/dist/modules/secrets-vault/secrets-vault.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-vault.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-vault.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAML,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,kBAAkB,EAAmC,MAAM,0CAA0C,CAAC;AAEpH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,4BAA4B,CAAC;AAEpC,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,oBAAoB,CAAC;IACnC,2FAA2F;IAC3F,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,uFAAuF;IACvF,aAAa,EAAE,cAAc,CAAC;IAC9B,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAMD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAoZrF;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CA6B3F"}
+{"version":3,"file":"secrets-vault.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/secrets-vault.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAML,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,kBAAkB,EAAmC,MAAM,0CAA0C,CAAC;AAEpH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAE5E,OAAO,4BAA4B,CAAC;AAEpC,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,oBAAoB,CAAC;IACnC,2FAA2F;IAC3F,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,uFAAuF;IACvF,aAAa,EAAE,cAAc,CAAC;IAC9B,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,GAAG,QAAQ,IAAI,MAAM,CAUtE;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAmarF;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAkC3F"}

package/dist/modules/secrets-vault/secrets-vault.routes.js

@@ -8,6 +8,34 @@ import '../auth/auth.middleware.js'; // Express Request augmentation (req.userId
 function redirectUriFor(publicBackendUrl) {
     return `${publicBackendUrl}/api/secrets/oauth/callback`;
 }
+/**
+ * Is this a SAME-ORIGIN path we're willing to bounce the browser back to after a
+ * sign-in? The callback builds `${publicFrontendUrl}${dest}#…`, so anything that
+ * survives this check gets concatenated onto our own origin — which makes every
+ * rule here an open-redirect rule, not a formatting preference:
+ *  - must start with a single `/` — `//evil.com` is a protocol-relative URL and
+ *    `https://evil.com` an absolute one; both would leave our origin entirely.
+ *  - no `\` — WHATWG folds a backslash to a slash for http(s), so `/\evil.com`
+ *    is `//evil.com` by another spelling.
+ *  - no `#` — the callback appends its own fragment; a caller-supplied one would
+ *    swallow the `#authorized=…`/`#error=…` the landing page reads.
+ *  - no CR/LF — never let a caller-controlled string reach a `Location` header
+ *    with a line break in it (response splitting).
+ *  - ≤512 chars — a signed `state` rides in the provider's authorize URL, and
+ *    some providers cap its length; this keeps the round-trip inside every
+ *    budget without needing to know each provider's limit.
+ * Exported for the route tests: this predicate IS the security boundary, so it
+ * is pinned by a unit table rather than only exercised end-to-end.
+ */
+export function isSafeReturnPath(returnTo) {
+    return (typeof returnTo === 'string' &&
+        returnTo.length <= 512 &&
+        returnTo.startsWith('/') &&
+        !returnTo.startsWith('//') &&
+        !returnTo.includes('\\') &&
+        !returnTo.includes('#') &&
+        !/[\r\n]/.test(returnTo));
+}
 /**
  * Authenticated Secrets Vault CRUD + OAuth start. Every route is scoped to
  * `req.userId` — secrets are private per user. Mounted behind the JWT middleware.
@@ -15,7 +43,14 @@ function redirectUriFor(publicBackendUrl) {
 export function createSecretsVaultRoutes(deps) {
     const { secretsVault, toolManualService, accessControl } = deps;
     const router = express.Router();
-    const defaultWs = workspaceIdForBranch(DEFAULT_BRANCH);
+    // A FUNCTION, not a constant. Routers are constructed at boot, and on a
+    // deployment configured through the setup screen the branch model does not
+    // exist yet at that moment — `DEFAULT_BRANCH` is still ''. The live binding
+    // updates when setup applies the model, but only reads INSIDE a function
+    // body see it; a construction-time capture would keep handing an empty
+    // workspace id to the access resolver until the next restart ("Invalid
+    // workspace ID" on every /secrets/tools call).
+    const defaultWs = () => workspaceIdForBranch(DEFAULT_BRANCH);
     // The vault key = the exact key UTCP looks the var up under (doubles underscores
     // in the manual namespace), so storage and resolution agree for snake_case ids.
     const varKey = (manualName, varName) => utcpNamespacedKey(manualName, varName);
@@ -134,7 +169,7 @@ export function createSecretsVaultRoutes(deps) {
                 path: m.path,
                 type: m.type,
                 setup: m.setup ?? null,
-                canWrite: await accessControl.canWrite(defaultWs, email, m.path),
+                canWrite: await accessControl.canWrite(defaultWs(), email, m.path),
                 variables: (m.variables ?? []).map((v) => {
                     const key = varKey(m.name, v.name);
                     const st = statusByKey.get(key);
@@ -252,7 +287,7 @@ export function createSecretsVaultRoutes(deps) {
             if (found.variable.scope !== 'admin') {
                 return void res.status(422).json({ error: 'This variable is set by each user, not the tool owner.' });
             }
-            if (!(await accessControl.canWrite(defaultWs, email, found.manual.path))) {
+            if (!(await accessControl.canWrite(defaultWs(), email, found.manual.path))) {
                 return void res.status(403).json({ error: 'You need write access to this tool to set its shared secrets.' });
             }
             const body = req.body ?? {};
@@ -309,7 +344,7 @@ export function createSecretsVaultRoutes(deps) {
             if (!found.variable.oauth) {
                 return void res.status(422).json({ error: 'This variable is not an OAuth sign-in.' });
             }
-            if (!(await accessControl.canWrite(defaultWs, email, found.manual.path))) {
+            if (!(await accessControl.canWrite(defaultWs(), email, found.manual.path))) {
                 return void res.status(403).json({ error: 'You need write access to this tool to set its client secret.' });
             }
             const clientSecret = (req.body ?? {}).clientSecret;
@@ -335,7 +370,9 @@ export function createSecretsVaultRoutes(deps) {
     });
     // Start sign-in for a tool's OAuth-backed variable. Provisions the caller's row
     // from the owner-set secret and returns the provider consent URL; the callback
-    // bounces back to /connect (via `r` in the signed state).
+    // bounces back to wherever the flow started (via `r` in the signed state) — an
+    // optional `{ returnTo }` body when the caller asks for a specific page, else
+    // /connect, which is where every caller came from before `returnTo` existed.
     router.post('/secrets/tools/:slug/vars/:var/oauth/start', async (req, res) => {
         const userId = req.userId;
         const email = req.userEmail;
@@ -363,11 +400,17 @@ export function createSecretsVaultRoutes(deps) {
                 // on the next sign-in. The secret/clientId/addresses stay owner-pinned.
                 scopes: found.variable.oauth.scopes,
             });
+            // The return path is signed INTO the state (HMAC-SHA256) rather than kept
+            // in a query param or a cookie: the callback arrives un-authenticated from
+            // the provider, so the state is the only thing it can trust. An absent or
+            // unsafe `returnTo` falls back to the legacy `'connect'` marker, which
+            // keeps a body-less start byte-identical to what it produced before.
+            const returnTo = (req.body ?? {}).returnTo;
             const state = signState(deps.stateSecret, {
                 u: userId,
                 i: id,
                 n: randomBytes(8).toString('hex'),
-                r: 'connect',
+                r: isSafeReturnPath(returnTo) ? returnTo : 'connect',
             });
             const consentUrl = new URL(url);
             consentUrl.searchParams.set('state', state);
@@ -386,7 +429,7 @@ export function createSecretsVaultRoutes(deps) {
             const found = await findManualVar(email, req.params.slug, req.params.var);
             if (!found)
                 return void res.status(404).json({ error: 'Tool or variable not found' });
-            if (!(await accessControl.canWrite(defaultWs, email, found.manual.path))) {
+            if (!(await accessControl.canWrite(defaultWs(), email, found.manual.path))) {
                 return void res.status(403).json({ error: 'You need write access to this tool to remove its shared secrets.' });
             }
             await secretsVault.removeShared(varKey(found.manual.name, found.variable.name));
@@ -426,16 +469,21 @@ export function createSecretsVaultPublicRoutes(deps) {
         const code = typeof req.query.code === 'string' ? req.query.code : '';
         const stateRaw = typeof req.query.state === 'string' ? req.query.state : '';
         // The landing page depends on where the flow started (the `r` field in the
-        // signed state): a tool-var sign-in returns to /connect, the standalone
-        // Secrets page to /secrets. Pre-verification errors can't know `r`, so they
-        // fall back to /secrets.
+        // signed state): an explicit same-origin path returns there, the legacy
+        // `'connect'` marker to /connect, the standalone Secrets page to /secrets.
+        // Pre-verification errors can't know `r`, so they fall back to /secrets.
         const back = (frag, dest = '/secrets') => res.redirect(`${deps.publicFrontendUrl}${dest}#${frag}`);
         if (!code || !stateRaw)
             return void back(`error=${encodeURIComponent('Invalid OAuth callback.')}`);
         const state = verifyState(deps.stateSecret, stateRaw);
         if (!state)
             return void back(`error=${encodeURIComponent('OAuth state mismatch.')}`);
-        const dest = state.r === 'connect' ? '/connect' : '/secrets';
+        // Re-validated HERE even though `r` was validated on the way in and is
+        // HMAC-signed: this is the line that concatenates a stored string onto our
+        // public origin and hands it to the browser as a `Location`. Defense in
+        // depth — the check costs nothing, and it means an open redirect would need
+        // BOTH the signing key and a validation bug, not either one.
+        const dest = isSafeReturnPath(state.r) ? state.r : state.r === 'connect' ? '/connect' : '/secrets';
         try {
             await secretsVault.completeOAuth(state.u, state.i, code, redirectUriFor(deps.publicBackendUrl));
             back(`authorized=${encodeURIComponent(state.i)}`, dest);