@bongos/core 1.19.417 → 1.19.419

package/modules/hall-ui/public/settings-sessions.js

@@ -0,0 +1,119 @@
+// modules/hall-ui/public/settings-sessions.js — the "Active sessions" panel on
+// /builders/settings (task 1003341, ADR 0206).
+//
+// WHY. A session refreshes for another 24 hours every time it is used, so one a
+// builder has forgotten about never expires; before this panel, killing a leaked
+// CLI token meant asking an Archon, because the only revoke endpoints were
+// admin-gated. This is the surface for the own-scoped remedy: see everywhere you
+// are signed in, end one, or end all of them.
+//
+// Its own file rather than more of settings.js — that file sits close to the
+// 1500-line size ratchet, and this panel is self-contained: it shares nothing
+// with the rest of the page but the `window.OTB` toolkit and the generated API
+// client, both of which are globals loaded before it.
+
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const { escapeHtml, $, fmtDate } = window.OTB;
+  const toast = (msg) => window.OTB.toast(msg);
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+
+  const toAuth = () => window.location.assign(`${API}/auth/web/start`);
+
+  // The words a person recognises, not the column value. `source` is the same
+  // three-value set the session-scope registry declares.
+  const SOURCE_LABELS = { cli: 'Terminal', web: 'Browser', box: 'Dev box' };
+  const sourceLabel = (s) => SOURCE_LABELS[s] || 'Session';
+
+  // "3 minutes ago" beats a timestamp for the one question this panel exists to
+  // answer: is anything using this session that is not me, right now?
+  function ago(iso) {
+    const then = new Date(iso).getTime();
+    if (!Number.isFinite(then)) return 'unknown';
+    const mins = Math.max(0, Math.round((Date.now() - then) / 60000));
+    if (mins < 1) return 'just now';
+    if (mins < 60) return `${mins} minute${mins === 1 ? '' : 's'} ago`;
+    const hours = Math.round(mins / 60);
+    if (hours < 48) return `${hours} hour${hours === 1 ? '' : 's'} ago`;
+    return `${Math.round(hours / 24)} days ago`;
+  }
+
+  function rowHtml(s) {
+    const badge = s.current ? '<span class="sessions-row__badge">this session</span>' : '';
+    const agent = s.user_agent ? `<span class="sessions-row__agent">${escapeHtml(s.user_agent)}</span>` : '';
+    return `<div class="sessions-row" data-id="${escapeHtml(s.id)}">
+      <div class="sessions-row__main">
+        <strong>${escapeHtml(sourceLabel(s.source))}</strong>${badge}
+        ${agent}
+        <span class="sessions-row__when">last used ${escapeHtml(ago(s.last_used_at))} · signed in ${escapeHtml(fmtDate(s.created_at))}</span>
+      </div>
+      <button type="button" class="settings-btn settings-btn--quiet sessions-row__end">End session</button>
+    </div>`;
+  }
+
+  async function render() {
+    const list = $('#sessions-list');
+    const res = await api.request('GET', `${API}/me/sessions`);
+    if (res.status === 401) { toAuth(); return; }
+    if (!res.ok) throw new Error((res.data && res.data.message) || `HTTP ${res.status}`);
+    const sessions = (res.data && res.data.sessions) || [];
+    list.innerHTML = sessions.length
+      ? sessions.map(rowHtml).join('')
+      : '<p class="settings-card__hint">No other sessions.</p>';
+    for (const btn of list.querySelectorAll('.sessions-row__end')) {
+      btn.addEventListener('click', () => endOne(btn));
+    }
+  }
+
+  async function endOne(btn) {
+    const row = btn.closest('.sessions-row');
+    const id = row.getAttribute('data-id');
+    const isCurrent = !!row.querySelector('.sessions-row__badge');
+    if (isCurrent && !window.confirm('That is the session you are using right now. Ending it signs you out of this page.')) return;
+    btn.disabled = true;
+    try {
+      const res = await api.request('POST', `${API}/me/sessions/revoke`, { body: { session_id: id } });
+      if (res.status === 401) { toAuth(); return; }
+      if (!res.ok) throw new Error((res.data && res.data.message) || `HTTP ${res.status}`);
+      if (isCurrent) { toAuth(); return; }
+      toast('Session ended.');
+      await render();
+    } catch (err) {
+      btn.disabled = false;
+      toast(`Could not end that session: ${err.message}`);
+    }
+  }
+
+  // Sign out everywhere ends THIS browser session too — that is what "everywhere"
+  // means, and the whole point when a token has leaked — so it confirms first and
+  // then sends the builder back to sign-in rather than leaving a dead page up.
+  async function endAll() {
+    const btn = $('#sessions-revoke-all');
+    if (!window.confirm('End every session, including this one? You will need to sign in again, and any CLI token will need re-issuing.')) return;
+    btn.disabled = true;
+    try {
+      const res = await api.request('POST', `${API}/me/sessions/revoke-all`, { body: {} });
+      if (!res.ok && res.status !== 401) throw new Error((res.data && res.data.message) || `HTTP ${res.status}`);
+      toAuth();
+    } catch (err) {
+      btn.disabled = false;
+      toast(`Could not sign out everywhere: ${err.message}`);
+    }
+  }
+
+  async function setup() {
+    try {
+      await render();
+      $('#sessions-scroll').hidden = false;
+      $('#sessions-revoke-all').addEventListener('click', endAll);
+    } catch (err) {
+      // Its own try/catch, like every other section: a failing endpoint hides this
+      // panel rather than taking the settings page down with it.
+      toast(`Could not load your sessions: ${err.message}`);
+    }
+  }
+
+  setup();
+})();

package/modules/hall-ui/public/settings.css

@@ -319,6 +319,31 @@ input.display-name-input {
   margin: 6px 0;
 }
 
+/* ---- Active sessions (task 1003341) — one row per live session, the current
+   one badged so nobody ends the page they are reading. ---- */
+.sessions-row {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 10px;
+  padding: 10px 0;
+  border-bottom: 1px solid var(--border);
+}
+.sessions-row:last-child { border-bottom: 0; }
+.sessions-row__main { display: flex; flex-wrap: wrap; align-items: baseline; gap: 8px; min-width: 0; }
+.sessions-row__agent,
+.sessions-row__when { color: var(--ink-soft); font-size: 13px; }
+.sessions-row__agent { overflow-wrap: anywhere; }
+.sessions-row__when { flex-basis: 100%; }
+.sessions-row__badge {
+  font-size: 12px;
+  padding: 1px 7px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  color: var(--ink-soft);
+}
+
 /* ---- Image key (task 1013) — the "we cover it" / "action needed" banner
    uses the shared semantic status tokens. ---- */
 .artkey-banner {

package/modules/hall-ui/public/settings.html

@@ -145,6 +145,25 @@
               <p class="section-note">Tokens refresh on use; re-issuing never signs you out anywhere else.</p>
             </section>
 
+            <!-- ACTIVE SESSIONS — see and kill your own sessions without an
+                 Archon (task 1003341, ADR 0206). Rendered by settings-sessions.js
+                 against GET /api/bongos/me/sessions. -->
+            <section class="scroll" id="sessions-scroll" aria-labelledby="sessions-h" data-group="access" hidden>
+              <h2 id="sessions-h" class="scroll__h">Active sessions</h2>
+              <p class="scroll__lede">
+                Every place you are currently signed in — this browser, your terminal,
+                any dev box. A session refreshes for another 24 hours each time it is
+                used, so one you have forgotten about can stay alive indefinitely. If a
+                token has leaked, end it here.
+              </p>
+              <div id="sessions-list" class="sessions-list" aria-live="polite"></div>
+              <div class="settings-card">
+                <button type="button" class="settings-btn" id="sessions-revoke-all">Sign out everywhere</button>
+                <span class="settings-card__hint">ends every session including this one — you will be asked to sign in again.</span>
+              </div>
+              <p class="section-note">Ending a session takes effect immediately; the token stops working on its very next request.</p>
+            </section>
+
             <!-- IMAGE KEY — per-builder Gemini key (task 1013 / ADR 0073).
                  GET/PUT/DELETE /api/bongos/me/art-key/own. Write-only (set/replace/
                  remove); the full key is never shown again after save (masked,
@@ -342,5 +361,8 @@
 <!-- #807: shared dev-box panel — loaded before settings.js so OTBBoxPanel exists. -->
 <script src="/builders/box-panel.js?v=2026-06-14-domutils"></script>
 <script src="/builders/settings.js?v=2026-07-10-regroup"></script>
+<!-- task 1003341: the Active sessions panel. Its own file rather than more of
+     settings.js, which sits close to the 1500-line size ratchet. -->
+<script src="/builders/settings-sessions.js?v=2026-08-29-sessions"></script>
 </body>
 </html>

package/modules/platform-identity/account-visibility.js

@@ -0,0 +1,58 @@
+// modules/platform-identity/account-visibility.js — THE effective-visibility
+// predicate for a platform account, published in both forms so a route and a
+// query cannot drift (ADR 0202 D4; the ADR 0182 `publishableSql` precedent).
+//
+// WHAT IT ANSWERS: "may the world see that this account exists at all?" —
+// profile_state = 'active' (consent: a hub session has touched the account,
+// ADR 0171 D3) AND account_visibility = 'public' (existence: the privacy-spec
+// D1 axis). Both floors, ANDed, in one place.
+//
+// WHY ITS OWN FILE. ADR 0202 D4 requires connections to consume ONE shared
+// reader rather than grow a connections-flavoured variant — "adding a second
+// predicate is the drift ADR 0194 D7 exists to prevent". The reader the ADR
+// names belongs to task 1002967, which has not shipped; platform-identity.js is
+// already at the file-size ratchet. So the definition lands here, alone and
+// tiny, and 1002967 ADOPTS it rather than writing a second one.
+//
+// WHAT IT IS NOT. Not a rollup gate: hide_stats suppresses NUMBERS, not
+// existence, and is applied by the rollup readers (ADR 0171 D2), never here.
+// Not authority: an account being visible confers nothing (ADR 0016).
+//
+// Fail-closed: a missing/absent account row is invisible, never visible
+// (ADR 0192 §6 / ADR 0194 §2).
+'use strict';
+
+// The JS twin. `account` is any row carrying profile_state + account_visibility;
+// anything falsy (absent row, unreadable account) answers false.
+function isAccountVisible(account) {
+  if (!account) return false;
+  return account.profile_state === 'active' && account.account_visibility === 'public';
+}
+
+// The SAME predicate as a SQL fragment, for the reads that filter in the
+// database. `alias` qualifies the columns for a joined query (e.g.
+// accountVisibleSql('pa')); omit it for an unaliased single-table query.
+function accountVisibleSql(alias) {
+  // The alias is INTERPOLATED, so it is the one thing here that could carry SQL.
+  // Callers pass a literal, but a helper that builds SQL should refuse anything
+  // that is not a bare identifier rather than trust every future caller.
+  if (alias && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(alias))) {
+    throw new Error('accountVisibleSql: alias must be a bare SQL identifier');
+  }
+  const q = alias ? `${alias}.` : '';
+  return `(${q}profile_state = 'active' AND ${q}account_visibility = 'public')`;
+}
+
+// The CONSENT floor on its own — active, without the existence axis. A private
+// account is still a real participant in its OWN scope: ADR 0202 D4 §2 says its
+// connections appear in its own list and in the counterparty's own list, and an
+// incoming request must name who is asking or it cannot be decided. Those
+// own-scope reads floor on this; every PUBLIC read floors on accountVisibleSql.
+function accountActiveSql(alias) {
+  if (alias && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(alias))) {
+    throw new Error('accountActiveSql: alias must be a bare SQL identifier');
+  }
+  return `(${alias ? `${alias}.` : ''}profile_state = 'active')`;
+}
+
+module.exports = { isAccountVisible, accountVisibleSql, accountActiveSql };