@bongos/core 1.24.4 → 1.24.6

package/clients/bongos-client/index.mjs

@@ -183,6 +183,8 @@ export function createClient(opts = {}) {
       getAuthGoogleCallback: (args) => request("GET", "/auth/google/callback", { hasBody: false }, args),
       // GET /auth/google/start — rank: public — GET /auth/google/start
       getAuthGoogleStart: (args) => request("GET", "/auth/google/start", { hasBody: false }, args),
+      // GET /auth/link/github/start — rank: public — GET /auth/link/github/start
+      getAuthLinkGithubStart: (args) => request("GET", "/auth/link/github/start", { hasBody: false }, args),
       // POST /auth/logout — rank: any-builder — POST /auth/logout
       postAuthLogout: (args) => request("POST", "/auth/logout", { hasBody: true }, args),
       // POST /auth/revoke — rank: archon — POST /auth/revoke
@@ -193,6 +195,8 @@ export function createClient(opts = {}) {
       getAuthWebAdmissionStatus: (args) => request("GET", "/auth/web/admission-status", { hasBody: false }, args),
       // GET /auth/web/callback — rank: public — GET /auth/web/callback
       getAuthWebCallback: (args) => request("GET", "/auth/web/callback", { hasBody: false }, args),
+      // GET /auth/web/callback/link — rank: public — GET /auth/web/callback/link
+      getAuthWebCallbackLink: (args) => request("GET", "/auth/web/callback/link", { hasBody: false }, args),
       // GET /auth/web/handoff — rank: public — GET /auth/web/handoff
       getAuthWebHandoff: (args) => request("GET", "/auth/web/handoff", { hasBody: false }, args),
       // GET /auth/web/start — rank: public — GET /auth/web/start
@@ -851,6 +855,8 @@ export function createClient(opts = {}) {
       postMeSessionsRevokeAll: (args) => request("POST", "/me/sessions/revoke-all", { hasBody: true }, args),
       // GET /me/sign-in-methods — rank: any-builder — GET /me/sign-in-methods
       getMeSignInMethods: (args) => request("GET", "/me/sign-in-methods", { hasBody: false }, args),
+      // DELETE /me/sign-in-methods/{provider} — rank: any-builder — DELETE /me/sign-in-methods/:provider
+      deleteMeSignInMethodsProvider: (args) => request("DELETE", "/me/sign-in-methods/{provider}", { hasBody: false }, args),
       // GET /me/skill-prefs — rank: any-builder — GET /me/skill-prefs
       getMeSkillPrefs: (args) => request("GET", "/me/skill-prefs", { hasBody: false }, args),
       // PATCH /me/skill-prefs — rank: any-builder — PATCH /me/skill-prefs

package/docs/adr/0396-google-sign-in-a-stand-in-login-and-a-browser-approved-cli-sign-in.md

@@ -50,3 +50,11 @@ Decision 8's two refusals are lifted, without ever sending a minted key to a cor
 - **People read the handle.** The hall's admission queue shows `ana`, not `~ana`.
 
 Credits, ranks and community pages needed no change: the hub's check-in and rollup already take a negative key. Still open: a hall's command-line sign-in (`/sso/device/*`) is GitHub's device flow, so a Google-only person signs in to a hall in the browser; engineering work still needs GitHub (task 1004997).
+
+## Amendment — linking GitHub and Google, both ways (task 1004995)
+
+- **A link is a sign-in with the other account, made while signed in.** Link Google rides the Google sign-in with a flag in the host-only state cookie (Google matches redirect URIs exactly). Link GitHub uses its own callback, `/auth/web/callback/link`, a subdirectory of the registered GitHub callback, which GitHub accepts, so the owner's GitHub app needs no change. Both answers land on `/account#aWaysIn`.
+- **Never a merge.** A way in that already reaches another person, or a GitHub account with its own builder row here, is refused and the page says so: "That GitHub account already has its own account here, so it was not linked." Both accounts may hold credits and history, and joining them is not the server's decision.
+- **Removing.** Never the last way in. And never GitHub from an account born with it: that account's key is its GitHub id, so a GitHub sign-in would still reach it and the removal would be a lie. A person who joined with Google may remove a linked GitHub, and then shows their stand-in again from their next sign-in.
+- **Every GitHub sign-in on the hub finds the person first** (the ADR 0393 carry-over, closed): the web and device sign-ins ask the hub who the GitHub id reaches and use that key. A project's command-line sign-in (`/sso/device/poll`) cannot tell whether the project takes a minted key, so for a GitHub account linked to someone who joined with Google it says to sign in in the browser.
+- **Matching emails suggest, never join.** This amends decision 3's "emails are never looked up" in one place only: on a first Google sign-in, if another account's GitHub way in shows the address Google verified, the person is offered "Sign in with GitHub" (then link Google from the account page) or "Make a new account with Google". Only the provider's name crosses; no account is named or joined. The hub keeps the GitHub address it sees at sign-in (GitHub's public address) for this alone.

package/docs/api/openapi.json

@@ -2173,6 +2173,27 @@
         "security": []
       }
     },
+    "/auth/link/github/start": {
+      "get": {
+        "operationId": "get_auth_link_github_start",
+        "tags": [
+          "auth"
+        ],
+        "summary": "GET /auth/link/github/start",
+        "description": "an OAuth entry point that gates itself: with no live session it sends the person to /account, so only a signed-in person ever links (ADR 0396).\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/auth-link.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
     "/auth/logout": {
       "post": {
         "operationId": "post_auth_logout",
@@ -2364,6 +2385,27 @@
         "security": []
       }
     },
+    "/auth/web/callback/link": {
+      "get": {
+        "operationId": "get_auth_web_callback_link",
+        "tags": [
+          "auth"
+        ],
+        "summary": "GET /auth/web/callback/link",
+        "description": "the OAuth callback for linking; the state cookie + code are the bearer, and the live session cookie names the person (no session: /account).\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/auth-link.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
     "/auth/web/handoff": {
       "get": {
         "operationId": "get_auth_web_handoff",
@@ -4162,7 +4204,7 @@
           "claims"
         ],
         "summary": "POST /claims/batch",
-        "description": "Atomic multi-claim. Body: { task_ids: [n,n,n], worktree_name?: string }. All-or-nothing: if any single task fails (already claimed, not ready, or touches conflict with another active claim OR another task in the batch), the whole transaction rolls back and we return 409 with a structured failures[] enumerating every problem found in one pass. rank: any-builder — atomic multi-claim; same Xenos row-level filter applies. V3.R13 (task 237): same newcomer gate as POST /claims — a fresh builder can't sneak around the \"one claim at a time\" rule by batching.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "Atomic multi-claim. Body: { task_ids: [n,n,n], worktree_name?: string }. All-or-nothing: if any single task fails (already claimed, not ready, or touches conflict with another active claim OR another task in the batch), the whole transaction rolls back and we return 409 with a structured failures[] enumerating every problem found in one pass. rank: any-builder — atomic multi-claim; same Xenos row-level filter applies. V3.R13 (task 237): same newcomer gate as POST /claims — a fresh builder can't sneak around the \"one claim at a time\" rule by batching. task 1005005: and the same gateOneActiveClaimPerSession as POST /claims, in the same order, so a session already holding a claim in this tree cannot batch more work into it. It reads the SESSION's existing active claims (the batch's own rows do not exist yet), keyed on the body's worktree_name — the caller's tree, which a batch also uses as its row-name prefix. A bind_session:false batch (the hall) has no session and passes, as on /claims.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/lifecycle/routes/claims.js",
         "requestBody": {
@@ -15999,7 +16041,7 @@
           "me"
         ],
         "summary": "GET /me/sign-in-methods",
-        "description": "the ways the caller's OWN account signs in (task 1004992, ADR 0393): GitHub, Google, or both, with the address each provider vouched for. Keyed on the authenticated github_id (the person key); the provider's user id never crosses. A system:* principal has no platform account: [].\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "the ways the caller's OWN account signs in (task 1004992, ADR 0393): GitHub, Google, or both, with the address each provider vouched for. Keyed on the authenticated github_id (the person key); the provider's user id never crosses. A system:* principal has no platform account: []. Each method carries `unlink_refused` (null, 'last_way_in' or 'born_with') so the page can say why a Remove is missing (task 1004995).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/platform-identity/routes/profile.js",
         "responses": {
@@ -16030,6 +16072,58 @@
         ]
       }
     },
+    "/me/sign-in-methods/{provider}": {
+      "delete": {
+        "operationId": "delete_me_sign_in_methods_provider",
+        "tags": [
+          "me"
+        ],
+        "summary": "DELETE /me/sign-in-methods/:provider",
+        "description": "remove one way in from the caller's OWN account (task 1004995), keyed on the authenticated person key. Never the last way in, and never GitHub from an account born with it (its key is its GitHub id). Adding a way in is a sign-in, so it lives with the sign-in routes, not here.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/profile.js",
+        "parameters": [
+          {
+            "name": "provider",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `provider`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DeleteMeSignInMethodsProviderResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me/skill-prefs": {
       "get": {
         "operationId": "get_me_skill_prefs",
@@ -29998,6 +30092,17 @@
           "views"
         ]
       },
+      "DeleteMeSignInMethodsProviderResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "ok"
+        ]
+      },
       "DeleteMemoryFileResponse": {
         "type": "object",
         "properties": {
@@ -40436,9 +40541,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 636,
-  "x-schema-count": 686,
+  "x-endpoint-count": 639,
+  "x-schema-count": 687,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 441,
+  "x-response-schemas": 442,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 636 endpoints across 105 route files.
+> **Generated from the live route files** — the route file is authoritative. 639 endpoints across 106 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -78,7 +78,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 |---|---|---|---|---|
 | GET | `/api/bongos/audit-log` | `metic+archon` | — | GET /api/bongos/audit-log?limit=&offset=&builder_id=&method= Paginated, newest-first. |
 
-## `auth` (19)
+## `auth` (21)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -94,11 +94,13 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/auth/discord/unlink` | `any-builder` | — | unlink your OWN Discord. |
 | GET | `/api/bongos/auth/google/callback` | `public` | — | OAuth callback; the state cookie + code are the bearer. |
 | GET | `/api/bongos/auth/google/start` | `public` | — | entry into the Google OAuth handshake; identity establishment only. |
+| GET | `/api/bongos/auth/link/github/start` | `public` | — | an OAuth entry point that gates itself: with no live session it sends the person to /account, so only a signed-in person ever links (ADR … |
 | POST | `/api/bongos/auth/logout` | `any-builder` | — | own session, no rank gate (a Xenos can log themselves out). |
 | POST | `/api/bongos/auth/revoke` | `archon` | `session_id` | POST /auth/revoke — V3.R38 / task 259. |
 | POST | `/api/bongos/auth/revoke-all` | `archon` | `builder_id` | POST /auth/revoke-all — V3.R38 / task 259. |
 | GET | `/api/bongos/auth/web/admission-status` | `public` | — | GET /auth/web/admission-status?login=X — the probe renderAccessPendingPage polls (task 1002097). |
 | GET | `/api/bongos/auth/web/callback` | `public` | — | OAuth callback; the state cookie + code are the bearer. |
+| GET | `/api/bongos/auth/web/callback/link` | `public` | — | the OAuth callback for linking; the state cookie + code are the bearer, and the live session cookie names the person (no session: <redacted> |
 | GET | `/api/bongos/auth/web/handoff` | `public` | — | GET /auth/web/handoff?code=&return= — the far side of the one-time session handoff (task 1004357). |
 | GET | `/api/bongos/auth/web/start` | `public` | — | /auth/web — browser flow (used by the /builders page). |
 
@@ -525,7 +527,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/market-watch/ask` | `any-builder` | — | every member reads their own card; nobody else's (isMember in gate()). |
 | POST | `/api/bongos/market-watch/ask/answer` | `any-builder` | `week_of`, `picks`, `names`, `nothing`, `builder_id` | a member answers for themselves only (isMember in gate()). |
 
-## `me` (54)
+## `me` (55)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -576,6 +578,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/me/sessions/revoke` | `any-builder` | `session_id` | POST /api/bongos/me/sessions/revoke — kill ONE of the caller's own sessions. |
 | POST | `/api/bongos/me/sessions/revoke-all` | `any-builder` | validated | POST /api/bongos/me/sessions/revoke-all — sign out everywhere. |
 | GET | `/api/bongos/me/sign-in-methods` | `any-builder` | — | the ways the caller's OWN account signs in (task 1004992, ADR 0393): GitHub, Google, or both, with the address each provider vouched for. |
+| DELETE | `/api/bongos/me/sign-in-methods/:provider` | `any-builder` | — | remove one way in from the caller's OWN account (task 1004995), keyed on the authenticated person key. |
 | GET | `/api/bongos/me/skill-prefs` | `any-builder` | — | Per-builder skill model preferences (V3.R85 / task 304, migration 037). |
 | PATCH | `/api/bongos/me/skill-prefs` | `any-builder` | _undocumented_ | PATCH a partial set of skill overrides. |
 | GET | `/api/bongos/me/sound-prefs` | `any-builder` | — | Per-builder per-sound on/off preferences (V3.R91 / task 786, migration 075). |