@codemem/server 0.35.1 → 0.36.0

package/dist/index.js

@@ -1858,13 +1858,12 @@ async function maybeGrantDefaultSpaceOnJoin(opts) {
 	const scopeId = preferences.default_space_scope_id?.trim();
 	if (!scopeId) return null;
 	if (scopeId !== defaultSpaceScopeIdForGroup(opts.groupId)) return null;
-	const defaultScope = (await coordinatorListScopesAction({
+	if (((await coordinatorListScopesAction({
 		groupId: opts.groupId,
 		includeInactive: false,
 		remoteUrl: opts.config.syncCoordinatorUrl || null,
 		adminSecret: opts.config.syncCoordinatorAdminSecret || null
-	})).find((scope) => scope.scope_id === scopeId) ?? null;
-	if (!defaultScope || defaultScope.kind !== "team_default") return null;
+	})).find((scope) => scope.scope_id === scopeId) ?? null)?.kind !== "team_default") return null;
 	return await coordinatorGrantScopeMembershipAction({
 		groupId: opts.groupId,
 		scopeId,
@@ -3107,9 +3106,14 @@ var PEERS_QUERY = `
 * honor scoped-sync wire features such as explicit `scope_id` parameters
 * and `/v1/status` `authorized_scopes` enumeration.
 *
-* Unsigned headers are fine here: the server is computing what it is
-* willing to do, not granting access. Per-scope authorization is enforced
-* separately via the membership cache when a scope_id is actually used.
+* Threat model: this header is intentionally only a best-effort capability
+* advertisement. It is not signed, so an authenticated paired peer — or a
+* bootstrap worker presenting a valid grant on `/v1/status` — can claim
+* `scoped` support and cause status to enumerate the scopes that caller is
+* already authorized to see. That is metadata disclosure inside the paired-peer
+* or bootstrap-grant trust boundary, not data authorization. Every scoped data
+* path still requires signed requests and checks membership before returning
+* scope contents.
 */
 function negotiatedSyncCapability(c) {
 	return negotiateSyncCapability(LOCAL_SYNC_CAPABILITY, normalizeSyncCapability(c.req.header(SYNC_CAPABILITY_HEADER) ?? null));
@@ -3157,10 +3161,8 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			}
 			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			if (!auth.ok) {
-				if (bootstrapAttempted) {
-					const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
-					console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant_present=${grantPresent} path=${c.req.path}`);
-				}
+				const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
+				if (bootstrapAttempted && grantPresent) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant_present=${grantPresent} path=${c.req.path}`);
 				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
 				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason, true), 401);
 			}
@@ -3268,10 +3270,8 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			}
 			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			if (!auth.ok) {
-				if (bootstrapAttempted) {
-					const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
-					console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant_present=${grantPresent} path=${c.req.path}`);
-				}
+				const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
+				if (bootstrapAttempted && grantPresent) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant_present=${grantPresent} path=${c.req.path}`);
 				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
 				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason, true), 401);
 			}