@bongos/core 1.19.1076 → 1.19.1078

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1076",
+  "version": "1.19.1078",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1076",
+      "version": "1.19.1078",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1076",
+  "version": "1.19.1078",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7849,5 +7849,17 @@
       "id": "1003898",
       "text": "The dev box's removal is written up in one decision record (ADR 0346), and the 20 older records that described it now point there. The live guides, the design mockups and the README no longer tell anyone to use a dev box."
     }
+  ],
+  "1.19.1077": [
+    {
+      "id": "1004357",
+      "text": "A project's hall on one of our addresses can no longer read the sign-in of a hub builder who visits it. Hub sign-in cookies now stay on the exact address that set them. builders. and status. still sign you in automatically thr"
+    }
+  ],
+  "1.19.1078": [
+    {
+      "id": "1003813",
+      "text": "The store now has a durable record of who owns which module and at which version, so install and update can check it. Free and bundled modules use the same record; nothing charges money yet."
+    }
   ]
 }

package/src/bongos/auth.js

@@ -69,7 +69,14 @@ const MAX_AUTH_TOKEN_CANDIDATES = 6;
 // in the wild, so the list is three long, not two (task 1003704). The server
 // SETS only the head; routes/auth.js clears the tail on the next write. Part 4
 // (task 1003706) retires the tail behind a test of its absence.
-const SESSION_COOKIE_NAMES = Object.freeze(['bongos_session', 'gds_session', 'pms_session']);
+//
+// The head is `__Host-bongos_session` (task 1004357, ADR 0145 Finding 1): a
+// browser only accepts a `__Host-` cookie that is Secure, Path=/ and carries NO
+// Domain attribute, so the prefix itself guarantees the session never reaches a
+// project hall on another subdomain. A browser refuses a `__Host-` cookie over
+// plain http, so localhost dev keeps setting `bongos_session` (host-only there
+// too) — routes/auth.js picks between the first two by the request's scheme.
+const SESSION_COOKIE_NAMES = Object.freeze(['__Host-bongos_session', 'bongos_session', 'gds_session', 'pms_session']);
 
 function extractTokens(req) {
   const out = [];

package/src/bongos/middleware/rate-limit.js

@@ -157,7 +157,7 @@ function pruneAndCount(bucket, now, windowMs) {
 // Deliberately duplicated from SESSION_COOKIE_NAMES in src/bongos/auth.js rather
 // than imported: this middleware is dependency-free by design. The copy is pinned
 // against the real list by tests/session_rename_fallback.mjs (task 1003704).
-const SESSION_COOKIE_RES = ['bongos_session', 'gds_session', 'pms_session']
+const SESSION_COOKIE_RES = ['__Host-bongos_session', 'bongos_session', 'gds_session', 'pms_session']
   .map((n) => new RegExp('(?:^|;\\s*)' + n + '=([^;]+)'));
 
 function extractSessionKey(req) {

package/src/bongos/module-entitlements.js

@@ -0,0 +1,127 @@
+// src/bongos/module-entitlements.js — the entitlement record: who holds which
+// module, at which version (task 1003813, ADR 0338 D1; table core_259).
+//
+// This is the ONE place install, update and the telemetry signals ask "does this
+// holder own this module?" — the store checks it before it serves a tarball. It is
+// the record of ownership, not of payment: a grant needs no money to have moved,
+// so free and core-bundled modules hold an entitlement through the same rows a
+// paid one will (area 8 writes source 'purchase' + payment_ref when it lands).
+//
+// Rules the functions enforce, from ADR 0338 D2:
+//   - ownership is per MODULE, the acquired version moves forward under it, so an
+//     update never asks for a second purchase;
+//   - a delist never reaches this table — only revokeEntitlement ends a hold (the
+//     refund path, task 1003789), and it keeps the row rather than deleting it.
+//
+// Every function takes { db } (a pg Pool or anything with query()) so tests run
+// against a fake client, the way module-store.js does.
+
+const { parseVersion, cmp } = require('../module-loader/semver');
+const { KEY_RE } = require('../module-loader/manifest-schema');
+
+const HOLDER_KINDS = ['builder', 'instance'];
+const SOURCES = ['free', 'core', 'grant', 'purchase'];
+
+const COLS = `id, module_key, holder_kind, holder_ref, source, payment_ref, version,
+  acquired_at, granted_by, granted_at, revoked_at, revoked_reason`;
+
+function poolOf(db) { return db || require('./pool').pool; }
+
+// A bad argument is a programming error in the caller, not a user error: throw.
+function assertHolder(moduleKey, holderKind, holderRef) {
+  if (!KEY_RE.test(String(moduleKey))) throw new Error('entitlement: a bad module key');
+  if (!HOLDER_KINDS.includes(holderKind)) throw new Error(`entitlement: holder_kind must be one of ${HOLDER_KINDS.join(', ')}`);
+  if (typeof holderRef !== 'string' || !holderRef.length) throw new Error('entitlement: holder_ref is required');
+}
+
+// Give a holder a module. Idempotent: granting a holder that already holds it is a
+// no-op that returns the existing row (an earlier source is never rewritten), and
+// granting one whose hold was revoked lifts the revocation on the same row.
+// `source: 'purchase'` is area 8's to use; nothing here checks a payment.
+async function grantEntitlement({ moduleKey, holderKind, holderRef, source, grantedBy = null, paymentRef = null }, { db } = {}) {
+  assertHolder(moduleKey, holderKind, holderRef);
+  if (!SOURCES.includes(source)) throw new Error(`entitlement: source must be one of ${SOURCES.join(', ')}`);
+  const pool = poolOf(db);
+  const { rows: [fresh] } = await pool.query(
+    `INSERT INTO module_entitlements (module_key, holder_kind, holder_ref, source, payment_ref, granted_by)
+     VALUES ($1, $2, $3, $4, $5, $6)
+     ON CONFLICT (module_key, holder_kind, holder_ref) DO NOTHING
+     RETURNING ${COLS}`,
+    [moduleKey, holderKind, holderRef, source, paymentRef, grantedBy]);
+  if (fresh) return { entitlement: fresh, created: true };
+  const { rows: [held] } = await pool.query(
+    `UPDATE module_entitlements
+        SET revoked_at = NULL, revoked_reason = NULL, source = $4, payment_ref = $5,
+            granted_by = $6, granted_at = now()
+      WHERE module_key = $1 AND holder_kind = $2 AND holder_ref = $3 AND revoked_at IS NOT NULL
+      RETURNING ${COLS}`,
+    [moduleKey, holderKind, holderRef, source, paymentRef, grantedBy]);
+  if (held) return { entitlement: held, created: false, reinstated: true };
+  const { rows: [same] } = await pool.query(
+    `SELECT ${COLS} FROM module_entitlements WHERE module_key = $1 AND holder_kind = $2 AND holder_ref = $3`,
+    [moduleKey, holderKind, holderRef]);
+  return { entitlement: same, created: false };
+}
+
+// Record the exact version a holder acquired. Refuses a holder with no live
+// entitlement (nothing is handed over without one) and a version older than the
+// one already held (an update moves forward; a rollback is a separate act, so it
+// must be asked for with allowDowngrade).
+async function recordAcquired({ moduleKey, holderKind, holderRef, version, allowDowngrade = false }, { db } = {}) {
+  assertHolder(moduleKey, holderKind, holderRef);
+  const wanted = parseVersion(String(version));
+  if (!wanted) throw new Error('entitlement: version must be exact X.Y.Z');
+  const pool = poolOf(db);
+  const { rows: [cur] } = await pool.query(
+    `SELECT ${COLS} FROM module_entitlements
+      WHERE module_key = $1 AND holder_kind = $2 AND holder_ref = $3`,
+    [moduleKey, holderKind, holderRef]);
+  if (!cur || cur.revoked_at) return { ok: false, code: 'not_entitled' };
+  const held = cur.version && parseVersion(cur.version);
+  if (held && !allowDowngrade && cmp(wanted, held) < 0) return { ok: false, code: 'version_older_than_held' };
+  const { rows: [row] } = await pool.query(
+    `UPDATE module_entitlements SET version = $2, acquired_at = now()
+      WHERE id = $1 AND revoked_at IS NULL
+      RETURNING ${COLS}`,
+    [cur.id, version]);
+  return row ? { ok: true, entitlement: row } : { ok: false, code: 'not_entitled' };
+}
+
+// End a hold. Only the refund path calls this (task 1003789); a delist must not.
+// The row stays, stamped with when and why.
+async function revokeEntitlement({ moduleKey, holderKind, holderRef, reason }, { db } = {}) {
+  assertHolder(moduleKey, holderKind, holderRef);
+  if (typeof reason !== 'string' || !reason.trim()) throw new Error('entitlement: a revocation needs a reason');
+  const { rows: [row] } = await poolOf(db).query(
+    `UPDATE module_entitlements SET revoked_at = now(), revoked_reason = $4
+      WHERE module_key = $1 AND holder_kind = $2 AND holder_ref = $3 AND revoked_at IS NULL
+      RETURNING ${COLS}`,
+    [moduleKey, holderKind, holderRef, reason.trim()]);
+  return row ? { ok: true, entitlement: row } : { ok: false, code: 'not_entitled' };
+}
+
+// The question the store asks before it serves: does this holder hold this module
+// right now? `entitled` is false for no row and for a revoked row; the row itself
+// comes back either way so the caller can say WHY.
+async function checkEntitlement({ moduleKey, holderKind, holderRef }, { db } = {}) {
+  assertHolder(moduleKey, holderKind, holderRef);
+  const { rows: [row] } = await poolOf(db).query(
+    `SELECT ${COLS} FROM module_entitlements
+      WHERE module_key = $1 AND holder_kind = $2 AND holder_ref = $3`,
+    [moduleKey, holderKind, holderRef]);
+  return { entitled: !!row && !row.revoked_at, entitlement: row || null };
+}
+
+// Everything one holder holds (live and revoked), newest grant first.
+async function listEntitlements({ holderKind, holderRef }, { db } = {}) {
+  assertHolder('x', holderKind, holderRef);
+  const { rows } = await poolOf(db).query(
+    `SELECT ${COLS} FROM module_entitlements
+      WHERE holder_kind = $1 AND holder_ref = $2 ORDER BY granted_at DESC, id DESC`,
+    [holderKind, holderRef]);
+  return rows;
+}
+
+module.exports = {
+  grantEntitlement, recordAcquired, revokeEntitlement, checkEntitlement, listEntitlements,
+};