@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.11

package/dist/identity/sessions.js

@@ -1,8 +1,23 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { randomBytes, randomUUID } from "node:crypto";
+import { Inject, Injectable } from "@nestjs/common";
 import { errors as joseErrors, jwtVerify, SignJWT } from "jose";
 import { sql } from "kysely";
 import { ACCESS_TOKEN_TTL_MAX_SECONDS } from "../config/schema.js";
 import { ApiError } from "../errors.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { KEYRING, REDIS } from "../infra/tokens.js";
 import { ACCOUNT_COLUMNS, toAccount } from "./accounts.js";
 import { sha256Hex } from "./hash.js";
 /** 旧 refresh token 在被轮换后多久内重放视为并发刷新（不吊销会话）。 */
@@ -24,27 +39,31 @@ class UnknownKidError extends Error {
  * Web 会话服务：短期 access token（HS256 JWT，密钥由主密钥环派生）+ PG 中可吊销、一次一换的 refresh token。
  * 吊销会在 Redis 写 `capk:revoked-sid:<sid>`（TTL 覆盖任何配置下 access token 的最长剩余寿命），使所有副本立即拒绝该会话的 access token；
  * 验证 access token 时还会读 PG 的 `sessions.revoked_at`，Redis 丢数据也不会让已吊销的会话复活。
- * 框架无关，由调用方注入依赖。
+ * Token lifetimes are `auth.accessTokenTtlSeconds` / `auth.refreshTokenTtlDays`, read per session.
  */
-export class SessionService {
+let SessionService = class SessionService {
     db;
+    txHost;
     redis;
-    opts;
+    config;
     keys;
-    constructor(db, redis, keyring, opts) {
+    constructor(db, txHost, redis, keyring, config) {
         this.db = db;
+        this.txHost = txHost;
         this.redis = redis;
-        this.opts = opts;
+        this.config = config;
         this.keys = keyring.deriveKey(ACCESS_KEY_INFO);
     }
     /**
-     * 新建会话。传入 `trx` 时会话行在调用方的事务里写入（如初始化、凭邀请注册：与账号同一事务，
-     * 失败整体回滚）；Cookie 由调用方在提交之后再设置。
+     * Creates a session, in the context's transaction when there is one (setup and invitation
+     * signup write it with the account, rolled back together); the caller sets the cookies after the
+     * commit.
      */
-    async create(accountId, meta, trx) {
+    async create(accountId, meta) {
         const id = randomUUID();
         const refreshToken = newRefreshToken();
-        const row = await (trx ?? this.db)
+        const refreshTtlDays = this.config.get().auth.refreshTokenTtlDays;
+        const row = await this.db
             .insertInto("sessions")
             .values({
             id,
@@ -52,12 +71,50 @@ export class SessionService {
             refresh_hash: sha256Hex(refreshToken),
             user_agent: meta.userAgent ?? null,
             ip: meta.ip ?? null,
-            expires_at: sql `now() + make_interval(days => ${this.opts.refreshTtlDays})`,
+            expires_at: sql `now() + make_interval(days => ${refreshTtlDays})`,
+            current_org_id: await this.startingOrg(accountId),
         })
             .returning(["expires_at"])
             .executeTakeFirstOrThrow();
         return this.issue(id, accountId, refreshToken, row.expires_at);
     }
+    /**
+     * The org a new session starts in: the account's last chosen one while it is still a member of it
+     * (and the org is not deleted), else its only org when it has exactly one, else none (the web
+     * app then asks to choose or create one).
+     */
+    async startingOrg(accountId) {
+        const orgs = await this.db
+            .selectFrom("memberships as m")
+            .innerJoin("orgs as o", "o.id", "m.org_id")
+            .innerJoin("accounts as a", "a.id", "m.account_id")
+            .select(["m.org_id as orgId", "a.last_org_id as lastOrgId"])
+            .where("m.account_id", "=", accountId)
+            .where("o.deleted_at", "is", null)
+            .execute();
+        const last = orgs.find((o) => o.orgId === o.lastOrgId);
+        if (last)
+            return last.orgId;
+        return orgs.length === 1 ? (orgs[0]?.orgId ?? null) : null;
+    }
+    /**
+     * Read-only: of several refresh tokens (a cookie header carrying the legacy and the `Path=/`
+     * cookie), the first that is the current token of a live session, if any. Choosing before
+     * rotating keeps a stale token from tripping replay detection on a still valid session.
+     */
+    async pickCurrentRefresh(candidates) {
+        if (candidates.length === 0)
+            return undefined;
+        const rows = await this.db
+            .selectFrom("sessions")
+            .select("refresh_hash")
+            .where("refresh_hash", "in", candidates.map((c) => sha256Hex(c)))
+            .where("revoked_at", "is", null)
+            .where("expires_at", ">", sql `now()`)
+            .execute();
+        const live = new Set(rows.map((r) => r.refresh_hash));
+        return candidates.find((c) => live.has(sha256Hex(c)));
+    }
     async refresh(refreshToken, meta) {
         const oldHash = sha256Hex(refreshToken);
         const next = newRefreshToken();
@@ -236,37 +293,45 @@ export class SessionService {
     async switchCurrentOrg(sessionId, accountId, orgId) {
         if (orgId === null)
             return this.setCurrentOrg(sessionId, null);
-        await this.db.transaction().execute(async (t) => {
-            // 加锁顺序与移出成员一致：先组织行、再成员关系行（sessions.current_org_id 的外键检查也会锁组织行，
-            // 若先锁成员关系，会与持有组织行锁的移出成员互相等待而死锁）
-            const org = await t
-                .selectFrom("orgs")
-                .select("id")
-                .where("id", "=", orgId)
-                .where("deleted_at", "is", null)
+        await this.switchIn(sessionId, accountId, orgId);
+    }
+    async switchIn(sessionId, accountId, orgId) {
+        // 加锁顺序与移出成员一致：先组织行、再成员关系行（sessions.current_org_id 的外键检查也会锁组织行，
+        // 若先锁成员关系，会与持有组织行锁的移出成员互相等待而死锁）
+        const org = await this.db
+            .selectFrom("orgs")
+            .select("id")
+            .where("id", "=", orgId)
+            .where("deleted_at", "is", null)
+            .forShare()
+            .executeTakeFirst();
+        const m = org &&
+            (await this.db
+                .selectFrom("memberships")
+                .select("role")
+                .where("org_id", "=", orgId)
+                .where("account_id", "=", accountId)
                 .forShare()
-                .executeTakeFirst();
-            const m = org &&
-                (await t
-                    .selectFrom("memberships")
-                    .select("role")
-                    .where("org_id", "=", orgId)
-                    .where("account_id", "=", accountId)
-                    .forShare()
-                    .executeTakeFirst());
-            if (!m)
-                throw new ApiError("org.not_found", "Organization not found");
-            const r = await t
-                .updateTable("sessions")
-                .set({ current_org_id: orgId })
-                .where("id", "=", sessionId)
-                .where("revoked_at", "is", null)
-                .where("expires_at", ">", sql `now()`)
-                .executeTakeFirst();
-            if (r.numUpdatedRows === 0n) {
-                throw new ApiError("auth.session_revoked", "Session has been revoked");
-            }
-        });
+                .executeTakeFirst());
+        if (!m)
+            throw new ApiError("org.not_found", "Organization not found");
+        // remembered for the next sign-in; the account row before the session row, the order a
+        // password change takes (account, then its sessions)
+        await this.db
+            .updateTable("accounts")
+            .set({ last_org_id: orgId })
+            .where("id", "=", accountId)
+            .execute();
+        const r = await this.db
+            .updateTable("sessions")
+            .set({ current_org_id: orgId })
+            .where("id", "=", sessionId)
+            .where("revoked_at", "is", null)
+            .where("expires_at", ">", sql `now()`)
+            .executeTakeFirst();
+        if (r.numUpdatedRows === 0n) {
+            throw new ApiError("auth.session_revoked", "Session has been revoked");
+        }
     }
     /** 有效（未吊销且未过期）的会话；否则返回 undefined。 */
     async get(sessionId) {
@@ -287,7 +352,7 @@ export class SessionService {
     };
     async issue(sessionId, accountId, refreshToken, refreshExpiresAt) {
         const iat = Math.floor(Date.now() / 1000);
-        const exp = iat + this.opts.accessTtlSeconds;
+        const exp = iat + this.config.get().auth.accessTokenTtlSeconds;
         const accessToken = await new SignJWT({ sid: sessionId })
             .setProtectedHeader({ alg: "HS256", kid: this.keys.currentId })
             .setSubject(accountId)
@@ -303,4 +368,16 @@ export class SessionService {
             refreshExpiresAt,
         };
     }
-}
+};
+__decorate([
+    Transactional()
+], SessionService.prototype, "switchIn", null);
+SessionService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(REDIS)),
+    __param(3, Inject(KEYRING)),
+    __param(4, Inject(KernelConfigService))
+], SessionService);
+export { SessionService };

package/dist/identity/settings.d.ts

@@ -1,7 +1,9 @@
-import type { Logger } from "@capybara-hq/plugin-sdk";
-import type { Transaction } from "kysely";
 import { z } from "zod";
-import type { KernelDatabase, KernelDb } from "../db/kernel-schema.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import type { KernelLogger } from "../log.js";
+import { SuperAdminLock } from "./super-admin.js";
 /** 沙箱 cpu（核）与内存（MB）覆盖的范围（C19）。 */
 export declare const SANDBOX_CPU_RANGE: {
     readonly min: 0.25;
@@ -18,19 +20,33 @@ export declare const SANDBOX_LIMIT_OVERRIDE: z.ZodObject<{
 }, z.core.$strict>;
 export type SandboxLimitOverride = z.infer<typeof SANDBOX_LIMIT_OVERRIDE>;
 /**
- * One organization's sub-agent limits (sub-agents spec §8.2): any of the three `subagents.*`
- * values, within the same bounds; the ones not given use the deployment's config.
+ * One organization's sub-agent limits (sub-agents spec §8.2, agent map spec §6): any of the
+ * `subagents.*` values, within the same bounds (0 for dispatches or tokens: no limit); the ones not
+ * given use the deployment's config.
  */
 export declare const SUBAGENT_LIMIT_OVERRIDE: z.ZodObject<{
-    maxConcurrentPerRun: z.ZodOptional<z.ZodNumber>;
+    maxDepth: z.ZodOptional<z.ZodNumber>;
+    maxConcurrentPerConversation: z.ZodOptional<z.ZodNumber>;
     maxDispatchesPerRun: z.ZodOptional<z.ZodNumber>;
     maxTokensPerRun: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 export type SubagentLimitOverride = z.infer<typeof SUBAGENT_LIMIT_OVERRIDE>;
+/** The deployment setting key of the platform default theme (themes spec §7). */
+export declare const UI_THEME_SETTING = "uiTheme";
+/**
+ * The platform default theme (themes spec §7): a `platform_themes` id, or null for the built-in
+ * theme. Only a platform-owned theme whose effective scope is `all` can be set (checked by
+ * {@link SettingsService.update}); every reader goes through {@link readUiTheme} or
+ * {@link SettingsService.get}, both parsing with this schema.
+ */
+export declare const UiThemeSetting: z.ZodObject<{
+    id: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type UiTheme = z.infer<typeof UiThemeSetting>;
 export declare const DEPLOYMENT_SETTINGS: z.ZodObject<{
     orgCreation: z.ZodDefault<z.ZodEnum<{
         anyone: "anyone";
-        enterprise_admin: "enterprise_admin";
+        super_admin: "super_admin";
     }>>;
     runConcurrencyOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodNumber>>;
     priceCurrency: z.ZodDefault<z.ZodString>;
@@ -39,7 +55,8 @@ export declare const DEPLOYMENT_SETTINGS: z.ZodObject<{
         memoryMb: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>>;
     subagentLimitOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
-        maxConcurrentPerRun: z.ZodOptional<z.ZodNumber>;
+        maxDepth: z.ZodOptional<z.ZodNumber>;
+        maxConcurrentPerConversation: z.ZodOptional<z.ZodNumber>;
         maxDispatchesPerRun: z.ZodOptional<z.ZodNumber>;
         maxTokensPerRun: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>>;
@@ -51,6 +68,10 @@ export declare const DEPLOYMENT_SETTINGS: z.ZodObject<{
         allow: "allow";
         deny: "deny";
     }>>;
+    orgMarketplaceBrowse: z.ZodDefault<z.ZodBoolean>;
+    uiTheme: z.ZodDefault<z.ZodObject<{
+        id: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type DeploymentSettings = z.infer<typeof DEPLOYMENT_SETTINGS>;
 /**
@@ -64,7 +85,7 @@ export type DeploymentSettings = z.infer<typeof DEPLOYMENT_SETTINGS>;
 export declare const DEPLOYMENT_SETTINGS_PATCH: z.ZodObject<{
     orgCreation: z.ZodOptional<z.ZodEnum<{
         anyone: "anyone";
-        enterprise_admin: "enterprise_admin";
+        super_admin: "super_admin";
     }>>;
     runConcurrencyOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodNumber>>>;
     priceCurrency: z.ZodOptional<z.ZodString>;
@@ -73,7 +94,8 @@ export declare const DEPLOYMENT_SETTINGS_PATCH: z.ZodObject<{
         memoryMb: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>>>;
     subagentLimitOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodObject<{
-        maxConcurrentPerRun: z.ZodOptional<z.ZodNumber>;
+        maxDepth: z.ZodOptional<z.ZodNumber>;
+        maxConcurrentPerConversation: z.ZodOptional<z.ZodNumber>;
         maxDispatchesPerRun: z.ZodOptional<z.ZodNumber>;
         maxTokensPerRun: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>>>;
@@ -85,37 +107,61 @@ export declare const DEPLOYMENT_SETTINGS_PATCH: z.ZodObject<{
         allow: "allow";
         deny: "deny";
     }>>;
+    orgMarketplaceBrowse: z.ZodOptional<z.ZodBoolean>;
+    uiTheme: z.ZodOptional<z.ZodObject<{
+        id: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type DeploymentSettingsPatch = z.infer<typeof DEPLOYMENT_SETTINGS_PATCH>;
 /**
  * 读某个组织的沙箱限额覆盖（创建沙箱、组织设置页用）；每次实时读 PG，多副本下改动立即生效。
  * 只解析这个组织的那一条：没有设置、组织不在其中、或这一条存量值非法 → undefined；别的组织的条目非法不影响它。
  */
-export declare function readSandboxLimitOverride(db: KernelDb, orgId: string): Promise<SandboxLimitOverride | undefined>;
+export declare function readSandboxLimitOverride(db: KernelSchemaDb, orgId: string): Promise<SandboxLimitOverride | undefined>;
 /**
  * One organization's sub-agent limit override, read live from PG (so a change applies on every
  * replica at once); in the caller's transaction when one is given. Only this organization's entry
  * is parsed: no setting, no entry, or an invalid stored entry → undefined.
  */
-export declare function readSubagentLimitOverride(db: KernelDb | Transaction<KernelDatabase>, orgId: string): Promise<SubagentLimitOverride | undefined>;
+export declare function readSubagentLimitOverride(db: KernelSchemaDb, orgId: string): Promise<SubagentLimitOverride | undefined>;
 /**
  * When orgs may not create their own connectors / skills (deployment setting `customConnectors` /
- * `customSkills` is `deny`, C22) throws `catalog.custom_disabled`: install from the enterprise
+ * `customSkills` is `deny`, C22) throws `catalog.custom_disabled`: install from the platform
  * catalog only. Reads PG live every time (can read in the caller's transaction); an invalid stored
  * value counts as allow.
  */
-export declare function assertCustomAllowed(db: KernelDb | Transaction<KernelDatabase>, key: "customConnectors" | "customSkills"): Promise<void>;
-/** 部署级设置：每个键一行，读时缺省用默认值。 */
+export declare function assertCustomAllowed(db: KernelSchemaDb, key: "customConnectors" | "customSkills"): Promise<void>;
+/**
+ * The deployment setting `orgMarketplaceBrowse`, read live from PG (in the caller's transaction
+ * when there is one); missing or invalid -> the default, true.
+ */
+export declare function readOrgMarketplaceBrowse(db: KernelSchemaDb): Promise<boolean>;
+/**
+ * The platform default theme setting, read live from PG (in the caller's transaction when there is
+ * one) and parsed with {@link UiThemeSetting}: missing or invalid -> `{ id: null }`. `lock`: the
+ * row is read FOR SHARE, so a concurrent write of the setting (which holds it FOR UPDATE) waits for
+ * the caller's transaction, and the reverse.
+ */
+export declare function readUiTheme(db: KernelSchemaDb, opts?: {
+    lock?: boolean;
+}): Promise<UiTheme>;
+/** Deployment settings: one row per key, defaults for missing keys. */
 export declare class SettingsService {
     private readonly db;
-    private readonly log?;
-    constructor(db: KernelDb, log?: Pick<Logger, "warn"> | undefined);
+    readonly txHost: TransactionHost;
+    private readonly adminLock;
+    private readonly log;
+    constructor(db: KernelDb, txHost: TransactionHost, adminLock: SuperAdminLock, log: Pick<KernelLogger, "warn">);
     /**
-     * 读全部设置；传 `trx` 时在该事务内读（调用方已持有事务连接时不再占用池里的第二个连接）。
-     * 逐个键校验：库里某个键的值非法时该键用默认值并 warn 点名，其余合法的键照常生效；
-     * 不认识的键（如新版本写入的）忽略。
+     * Reads every setting, in the context's transaction when there is one (a caller holding a
+     * transaction connection does not take a second one from the pool). Each key is validated on
+     * its own: an invalid stored value falls back to the default with a warning naming the key, the
+     * valid keys apply; unknown keys (written by a newer version) are ignored.
      */
-    get(trx?: Transaction<KernelDatabase>): Promise<DeploymentSettings>;
-    /** 更新设置：事务内取企业管理员锁并复核发起人仍是活跃企业管理员（否则 `forbidden`）。 */
-    update(patch: DeploymentSettingsPatch, actorAccountId: string, actorTokenId?: string): Promise<DeploymentSettings>;
+    get(): Promise<DeploymentSettings>;
+    /** Updates settings under the super admin lock, re-checking the actor (else `forbidden`). */
+    update(patch: DeploymentSettingsPatch, actorAccountId: string, actorTokenId?: string, 
+    /** Merged into the audit detail (the Platform tool's `via: "agent"`). */
+    auditDetail?: Record<string, unknown>): Promise<DeploymentSettings>;
+    private write;
 }