@cortexkit/common-auth 0.11.2 → 0.11.3

package/dist/store/pool.d.ts

@@ -33,6 +33,10 @@ export interface OpenPoolStoreOptions {
      * provider call or write, checked again under the locks and at commit.
      * Nothing makes such a row bound except `replace`, which starts a new
      * credential epoch and drops what was observed about the old one.
+     * An interrupted add's state-only orphan is recovered only when its stamp
+     * binds the stored and incoming material, including a supplied identity and
+     * an API key's endpoint/header. Otherwise add refuses `unbound-credential`
+     * without writing; `remove(id)` explicitly discards the orphan.
      */
     requireCredentialStamps?: boolean;
     /** Injected clock for leases, refresh stamps and `addedAt`. */

package/dist/store/rows.d.ts

@@ -46,7 +46,7 @@ export type RowToggleOptions = Pick<RowOperationOptions, 'onFailure' | 'extraLoc
 export interface RemoveView {
     /**
      * The row as loaded; undefined when the roster no longer holds the id and
-     * only its state-file entry is left (a removal interrupted between writes).
+     * only its state-file entry is left (an add or removal interrupted between writes).
      */
     row: PoolRow | undefined;
     /** The config file as read under the store locks. */
@@ -70,7 +70,8 @@ export type RemoveResult = {
     /**
      * `removed`: the roster row was dropped (and its state entry, if any).
      * `completed`: only a state-file entry was left, by a removal interrupted
-     * between its config and state writes, and it is now dropped.
+     * between its config and state writes or an add interrupted before its
+     * config write, and it is now dropped.
      */
     outcome: 'removed' | 'completed';
 };

package/dist/store/rows.js

@@ -5,7 +5,7 @@ import { DUPLICATE_IDENTITY_REASON, disableIdentityDuplicates, disableIn, enable
 import { notReadyError, readPool, runOperation, withTransaction, } from './mutate.js';
 import { acceptProviderState, mergedProviderState, planProviderStateIn, providerStateCoverage, replacementProviderState, } from './provider-state.js';
 import { readRow, refusal, requireBound, rowLockSpec, unknownRow, } from './runtime.js';
-import { boundProviderStateDigest, CREDENTIAL_STAMP_KEY, credentialProblem, fingerprintOf, idProblem, isCredentialEpoch, isRecord, nextAddEpochIn, PROVIDER_STATE_KEY, rosterRowFor, rotationStamp, rowLockKey, stampFor, stateFieldsFor, storedCredential, } from './schema.js';
+import { boundProviderStateDigest, buildRawRows, CREDENTIAL_STAMP_KEY, credentialDigest, credentialProblem, dispatchDigest, fingerprintOf, idProblem, isCredentialEpoch, isRecord, nextAddEpochIn, POOL_KEY, PROVIDER_STATE_KEY, parseStamp, providerStateDigest, rosterRowFor, rotationStamp, rowLockKey, stampFor, stateFieldsFor, storedCredential, } from './schema.js';
 import { applyTransition, bindReplacement, TRANSITION_STAMP_KEY, } from './torn.js';
 /** Fields of a state entry that belong to the credential it replaces. */
 const CREDENTIAL_STATE_FIELDS = [
@@ -203,6 +203,74 @@ function identityMismatch(operation, id) {
 function keyChanged(operation, id) {
     return refusal(operation, id, 'row-key-changed', `row ${id}'s wire identity changed while its lock was being taken`, true);
 }
+/**
+ * A strict replay may finish a state-first add, but must not replace what the
+ * interrupted write stamped. Load the orphan against its stamped descriptor
+ * using the ordinary row/stamp machinery, then compare the caller's material.
+ * The roster has no endpoint or identity yet, so neither can be inferred from
+ * the incoming add. Refusal happens before even repairing other torn rows.
+ */
+function matchingInterruptedAdd(rt, tx, input, incoming) {
+    const { id, credential, identity } = input;
+    if (!rt.ctx.requireCredentialStamps ||
+        tx.rosterRow(id) ||
+        !hasStateAccount(tx.state, id))
+        return undefined;
+    const refuse = () => {
+        throw refusal('add', id, 'unbound-credential', `orphan ${id} cannot be bound to this add's material; remove it explicitly before adding different material`);
+    };
+    const account = tx.stateAccount(id);
+    const stamp = parseStamp(account?.[CREDENTIAL_STAMP_KEY]);
+    if (!stamp?.binding || stamp.dispatch === undefined || stamp.replace)
+        return refuse();
+    if (credential.type === 'api' &&
+        (stamp.binding.baseURL === undefined ||
+            stamp.binding.authHeader === undefined))
+        return refuse();
+    const descriptor = credential.type === 'api'
+        ? {
+            ...credential,
+            baseURL: stamp.binding.baseURL,
+            authHeader: stamp.binding.authHeader,
+        }
+        : credential;
+    const [orphan] = buildRawRows({
+        accounts: [
+            rosterRowFor({
+                id,
+                credential: descriptor,
+                identity: stamp.binding.identity,
+                addedAt: 0,
+            }),
+        ],
+        [POOL_KEY]: {
+            rows: { [id]: { credentialEpoch: nextAddEpochIn(tx.config, id) } },
+        },
+    }, tx.state, rt.ctx.codec, rt.ctx.providerState);
+    if (!orphan?.credential || orphan.invalid || orphan.stamp !== 'bound')
+        return refuse();
+    if (identity !== undefined && identity !== orphan.identity)
+        return refuse();
+    if (credentialDigest(credential) !== stamp.digest)
+        return refuse();
+    if (credential.type === 'api') {
+        if (credential.baseURL.trim() !== stamp.binding.baseURL)
+            return refuse();
+        if ((credential.authHeader ?? 'authorization-bearer') !==
+            stamp.binding.authHeader)
+            return refuse();
+    }
+    else if (dispatchDigest(credential) !== stamp.dispatch)
+        return refuse();
+    // Provider-state coverage is separate from credential stamp status. Keep
+    // the interrupted write's value, but never complete a changed bound value.
+    if (stamp.providerState !== undefined && orphan.providerState === undefined)
+        return refuse();
+    if (incoming !== undefined &&
+        providerStateDigest(rt.ctx.providerState, incoming) !== stamp.providerState)
+        return refuse();
+    return orphan;
+}
 export async function addRow(rt, input, options = {}) {
     assertNotInsideHook('add');
     const { ctx } = rt;
@@ -220,9 +288,13 @@ export async function addRow(rt, input, options = {}) {
         for (const extra of options.extraLocks ?? [])
             await locks.acquire(extra);
         return withTransaction(ctx, locks, progress, { operation: 'add', rowId: id }, async (tx) => {
+            const orphan = matchingInterruptedAdd(rt, tx, input, incoming);
+            if (!orphan)
+                await tx.completeTorn();
             const rows = tx.rows();
             const fingerprint = fingerprintOf(credential);
-            const same = rows.find((row) => row.invalid === undefined && row.fingerprint === fingerprint);
+            const same = !orphan &&
+                rows.find((row) => row.invalid === undefined && row.fingerprint === fingerprint);
             if (same) {
                 // Re-adding a secret whose stamp is not proved would rotate it in
                 // and keep the identity and quota recorded beside it, making that
@@ -286,10 +358,13 @@ export async function addRow(rt, input, options = {}) {
             const credentialEpoch = nextAddEpochIn(tx.config, id);
             if (!isCredentialEpoch(credentialEpoch))
                 throw refusal('add', id, 'id-removed', `id ${id} has held every credential epoch and is not reused; add the credential under another id`);
+            const addedIdentity = orphan?.identity ?? identity;
             tx.roster().push(rosterRowFor({
                 id,
                 credential,
-                ...(identity !== undefined ? { identity } : {}),
+                ...(addedIdentity !== undefined
+                    ? { identity: addedIdentity }
+                    : {}),
                 ...(label !== undefined ? { label } : {}),
                 addedAt: ctx.now(),
             }));
@@ -298,17 +373,24 @@ export async function addRow(rt, input, options = {}) {
                 needsFirstReading: credential.type === 'oauth',
             });
             let outcome = 'added';
-            if (identity !== undefined && credential.type === 'oauth') {
+            if (addedIdentity !== undefined && credential.type === 'oauth') {
                 // Same account, different credential: kept on disk, disabled.
                 const holder = rows.find((row) => row.invalid === undefined &&
                     row.type === 'oauth' &&
                     row.enabled &&
-                    row.identity === identity);
+                    row.identity === addedIdentity);
                 if (holder) {
                     disableIn(tx, id, DUPLICATE_IDENTITY_REASON);
                     outcome = 'added-disabled';
                 }
             }
+            if (orphan?.credential) {
+                // The state half is already durable and proved. A config-only
+                // completion preserves the credential, stamp and provider state
+                // byte for byte; a crash leaves either this orphan or a whole row.
+                await tx.commitConfig();
+                return { id, outcome, credential: orphan.credential };
+            }
             // The credential is written first. A crash before the config write
             // then leaves a state entry no roster row names, which no reader
             // loads and `remove` drops; written the other way round, the new
@@ -322,7 +404,7 @@ export async function addRow(rt, input, options = {}) {
             });
             await tx.commitConfig();
             return { id, outcome, credential: stored };
-        });
+        }, { completeTorn: false });
     });
     if (credential.type === 'oauth' &&
         (result.outcome === 'added' || result.outcome === 'completed'))

package/dist/store/torn.js

@@ -186,6 +186,12 @@ export function tornStamps(config, state, codec, options = {}) {
         }
         else if (stamp.credentialEpoch === epoch &&
             stamp.binding.identity === row.identity) {
+            // The lineage digest alone misses an access-token or expiry edit. A
+            // strict store must not repair the config from a transition whose stamp
+            // no longer describes the credential; the row stays unbound instead.
+            if (options.requireCredentialStamps &&
+                stamp.dispatch !== dispatchDigest(row.credential))
+                continue;
             const transition = stampedTransition(account[CREDENTIAL_STAMP_KEY]);
             if (transition &&
                 entryIn(config, row.id)?.[TRANSITION_MARK_KEY] !== transition.mark)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/common-auth",
-  "version": "0.11.2",
+  "version": "0.11.3",
   "description": "Shared code for the CortexKit auth plugins: account pool, quota and routing, commands and auth menu, OpenCode 2 hooks, Claustrum custody, and plumbing (loopback RPC, file locks, logger, sidebar state, TUI preferences and build).",
   "license": "MIT",
   "repository": {