@codemem/server 0.35.2 → 0.36.1

package/dist/index.js

@@ -556,37 +556,14 @@ function queryBool(value) {
 }
 //#endregion
 //#region src/routes/memory.ts
-function cleanOwnershipValue(value) {
-	if (typeof value !== "string") return null;
-	const trimmed = value.trim();
-	return trimmed ? trimmed : null;
-}
-function buildOwnershipContext(store) {
-	const claimedPeerIds = new Set(store.sameActorPeerIds());
-	return {
-		actorId: store.actorId,
-		claimedPeerIds,
-		deviceId: store.deviceId,
-		legacyActorIds: new Set(Array.from(claimedPeerIds, (peerId) => `legacy-sync:${peerId}`))
-	};
-}
-function memoryOwnedBySelf(row, ownership, metadata = fromJson(row.metadata_json ?? null)) {
-	const meta = metadata;
-	const actorId = cleanOwnershipValue(row.actor_id) ?? cleanOwnershipValue(meta.actor_id);
-	if (actorId === ownership.actorId) return true;
-	const deviceId = cleanOwnershipValue(row.origin_device_id) ?? cleanOwnershipValue(meta.origin_device_id);
-	if (deviceId === ownership.deviceId) return true;
-	if (deviceId && ownership.claimedPeerIds.has(deviceId)) return true;
-	if (actorId && ownership.legacyActorIds.has(actorId)) return true;
-	return false;
-}
-function serializeMemoryRow(ownership, row) {
+function serializeMemoryRow(ownedBySelf, row) {
 	const metadata = fromJson(row.metadata_json ?? null);
+	const owned_by_self = ownedBySelf(row);
 	return {
 		...row,
 		kind: canonicalMemoryKind(row.kind ?? null, row.metadata_json),
 		metadata_json: metadata,
-		owned_by_self: memoryOwnedBySelf(row, ownership, metadata)
+		owned_by_self
 	};
 }
 /**
@@ -642,11 +619,7 @@ function normalizeScope(raw) {
 	if (value === "mine" || value === "theirs") return value;
 }
 function buildViewerMemoryFilters(store, filters) {
-	return buildFilterClausesWithContext(filters, {
-		actorId: store.actorId,
-		deviceId: store.deviceId,
-		enforceScopeVisibility: true
-	});
+	return buildFilterClausesWithContext(filters, store.ownershipFilterContext());
 }
 function countVisibleMemoryRows(store, filters) {
 	const filterResult = buildViewerMemoryFilters(store, filters);
@@ -729,8 +702,8 @@ function queryMemoryPage(store, options) {
 			 WHERE ${where}
 			 ORDER BY memory_items.created_at DESC
 			 LIMIT ? OFFSET ?`).all(...filterResult.params, options.limit + 1, options.offset);
-	const ownership = buildOwnershipContext(store);
-	return rows.map((row) => serializeMemoryRow(ownership, row));
+	const ownedBySelf = store.buildOwnershipPredicate();
+	return rows.map((row) => serializeMemoryRow(ownedBySelf, row));
 }
 function isSummaryLikeMemory$1(item) {
 	return isSummaryLikeMemory({
@@ -1010,7 +983,7 @@ function memoryRoutes(getStore) {
 		if (!store.get(memoryId)) return c.json({ error: "memory not found" }, 404);
 		const row = drizzle(store.db, { schema }).select().from(schema.memoryItems).where(eq(schema.memoryItems.id, memoryId)).get();
 		if (!row) return c.json({ error: "memory not found" }, 404);
-		if (!memoryOwnedBySelf(row, buildOwnershipContext(store))) return c.json({ error: "memory not owned by this device" }, 403);
+		if (!store.memoryOwnedBySelf(row)) return c.json({ error: "memory not owned by this device" }, 403);
 		if (Number(row.active ?? 1) === 0 || row.deleted_at != null) return c.json({ status: "ok" });
 		try {
 			store.forget(memoryId);
@@ -1858,13 +1831,12 @@ async function maybeGrantDefaultSpaceOnJoin(opts) {
 	const scopeId = preferences.default_space_scope_id?.trim();
 	if (!scopeId) return null;
 	if (scopeId !== defaultSpaceScopeIdForGroup(opts.groupId)) return null;
-	const defaultScope = (await coordinatorListScopesAction({
+	if (((await coordinatorListScopesAction({
 		groupId: opts.groupId,
 		includeInactive: false,
 		remoteUrl: opts.config.syncCoordinatorUrl || null,
 		adminSecret: opts.config.syncCoordinatorAdminSecret || null
-	})).find((scope) => scope.scope_id === scopeId) ?? null;
-	if (!defaultScope || defaultScope.kind !== "team_default") return null;
+	})).find((scope) => scope.scope_id === scopeId) ?? null)?.kind !== "team_default") return null;
 	return await coordinatorGrantScopeMembershipAction({
 		groupId: opts.groupId,
 		scopeId,
@@ -3107,9 +3079,14 @@ var PEERS_QUERY = `
 * honor scoped-sync wire features such as explicit `scope_id` parameters
 * and `/v1/status` `authorized_scopes` enumeration.
 *
-* Unsigned headers are fine here: the server is computing what it is
-* willing to do, not granting access. Per-scope authorization is enforced
-* separately via the membership cache when a scope_id is actually used.
+* Threat model: this header is intentionally only a best-effort capability
+* advertisement. It is not signed, so an authenticated paired peer — or a
+* bootstrap worker presenting a valid grant on `/v1/status` — can claim
+* `scoped` support and cause status to enumerate the scopes that caller is
+* already authorized to see. That is metadata disclosure inside the paired-peer
+* or bootstrap-grant trust boundary, not data authorization. Every scoped data
+* path still requires signed requests and checks membership before returning
+* scope contents.
 */
 function negotiatedSyncCapability(c) {
 	return negotiateSyncCapability(LOCAL_SYNC_CAPABILITY, normalizeSyncCapability(c.req.header(SYNC_CAPABILITY_HEADER) ?? null));
@@ -3157,10 +3134,8 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			}
 			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			if (!auth.ok) {
-				if (bootstrapAttempted) {
-					const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
-					console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant_present=${grantPresent} path=${c.req.path}`);
-				}
+				const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
+				if (bootstrapAttempted && grantPresent) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant_present=${grantPresent} path=${c.req.path}`);
 				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
 				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason, true), 401);
 			}
@@ -3268,10 +3243,8 @@ function syncProtocolRoutes(getStore, opts = {}) {
 			}
 			if (isSyncAuthStoreBusy(auth)) return syncAuthStoreBusyResponse(c);
 			if (!auth.ok) {
-				if (bootstrapAttempted) {
-					const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
-					console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant_present=${grantPresent} path=${c.req.path}`);
-				}
+				const grantPresent = Boolean((c.req.header("X-Codemem-Bootstrap-Grant") ?? "").trim());
+				if (bootstrapAttempted && grantPresent) console.warn(`[sync] bootstrap grant auth failed: reason=${auth.reason} grant_present=${grantPresent} path=${c.req.path}`);
 				const wireReason = bootstrapAttempted ? "bootstrap_grant_invalid" : auth.reason;
 				return (preauthChecked ? null : rateLimitedResponse(c, c.req.path, false)) ?? c.json(unauthorizedPayload(wireReason, true), 401);
 			}