@cotal-ai/auth 0.157.9 → 0.158.1

package/dist/service.js

@@ -90,6 +90,8 @@ import { authorizeRemoteManagerGoalIndexScan, completeRemoteManagerGoalIndexScan
 import { authorizeRemoteManagerAdmin } from "./manager-admin-authorization.js";
 import { authorizeRemoteManagerParticipation } from "./manager-participation-authorization.js";
 import { authorizeRemoteManagerMaintenance, completeRemoteManagerMaintenance } from "./manager-maintenance.js";
+import { deregisterUserEndpoint } from "./endpoint-deregister.js";
+import { parseRemoteEndpointDeregisterRequest } from "@cotal-ai/core";
 import { validateRetainedManagedAgent } from "./continuity.js";
 import { reconstructRemoteManagerServeGrant, remoteManagerServeGrantFromCluster, remoteManagerSurface } from "./manager-contract.js";
 import { authorityBarrierGrants, authorityWriterGrants, openAuthorityClient, openSupervisedConnectReader, platformReadinessGrants, remoteManagerIssuerGrants, remoteManagerRegistrationProof, registrationExecutorGrants, servedRunRequestSubjects, servedRunCancelRequestSubject, servedSpawnRequestSubjects, serviceCalloutWriterGrants, serviceHostDiscoveryGrants } from "./authority-client.js";
@@ -1361,6 +1363,10 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
             }
             throw new EpEnvelopeError("conflict", `ending the platform supervisor of ${owner} lost repeated CAS attempts on ${key}; retry`);
         },
+        deregisterEndpoint: async (request, granter) => {
+            refuseIfFenced();
+            return deregisterUserEndpoint({ request, granter, space, server, auth: issuerAuth(), observeGate: observeManagerGate, onConnection });
+        },
         maintainRemoteManager: async (holder) => {
             refuseIfFenced();
             const { owner } = holder;
@@ -2624,6 +2630,7 @@ async function startAuthContext(o) {
             ownerSecret,
             authorizeActor,
             managerServiceAuthority: plane.issueManagerServiceAuthority,
+            deregisterEndpoint: plane.deregisterEndpoint,
             maintainRemoteManager: plane.maintainRemoteManager,
             validateRetainedAgent: plane.validateRetainedAgent,
             verifyManagedAgentEnrollment: plane.verifyManagedAgentEnrollment,
@@ -2823,6 +2830,7 @@ async function startAuthContext(o) {
             return await invokeCommand(readerNc, space, await resolveService(readerNc, space, "manager", caller, { instanceId, commands: ["status"] }), "status", undefined, {});
         };
         const service = {
+            deregisterEndpoint: (request, granter) => { refuseUnlessReady(); return plane.deregisterEndpoint(request, granter); },
             url,
             ...(publicUrl !== undefined ? { publicUrl } : {}),
             cap,
@@ -3105,6 +3113,7 @@ const ROUTES = new Map([
     ],
     ["/exchange", (req, res, ctx) => handleExchange(req, res, ctx, LOOPBACK_POLICY)],
     ["/manager-service-authority", (req, res, ctx) => handleManagerServiceAuthority(req, res, ctx, LOOPBACK_POLICY)],
+    ["/endpoint-deregister", (req, res, ctx) => handleEndpointDeregister(req, res, ctx, LOOPBACK_POLICY)],
     ["/manager-instances", (req, res, ctx) => handleManagerInstances(req, res, ctx, LOOPBACK_POLICY)],
     [SERVICE_ENDPOINT_AUTHORITY_PATH, (req, res, ctx) => handleServiceEndpointAuthority(req, res, ctx, LOOPBACK_POLICY)],
     [SERVICE_ENDPOINT_HOST_PATH, (req, res, ctx) => handleServiceEndpointHost(req, res, ctx, LOOPBACK_POLICY)],
@@ -3872,9 +3881,50 @@ async function handleServiceEndpointAuthority(req, res, ctx, policy) {
         return send(res, 503, { error: "service endpoint authority did not complete; the request may be bound, so retain its request identity" }, noStore);
     }
 }
-/** The typed manager authority exchange, served on both faces. The face's policy decides whether the
- *  loopback capability is demanded; on the public face the verified IdP JWT is the proof, and the
- *  dispatcher reads the caller's scope from the ledger either way. */
+/** Same-account human removal. Operator authority exists only on the trusted in-process door. */
+async function handleEndpointDeregister(req, res, ctx, policy) {
+    if (req.method !== "POST")
+        return send(res, 405, { error: "POST only" });
+    if (req.headers.origin !== undefined)
+        return send(res, 403, { error: "browser-origin requests are not served here" });
+    if (!/^application\/json\b/.test(req.headers["content-type"] ?? ""))
+        return send(res, 415, { error: "content-type must be application/json" });
+    if (policy.requireCapability && req.headers.authorization !== `Bearer ${ctx.cap}`)
+        return refuseCapability(res, ctx, "missing/invalid exchange capability");
+    const peer = policy.peerKey(req), throttled = policy.throttled(ctx, peer);
+    let body;
+    try {
+        const raw = await readJsonBody(req);
+        if (!raw || typeof raw !== "object" || Array.isArray(raw) || Object.keys(raw).sort().join(",") !== "idpToken,request" ||
+            !("idpToken" in raw) || typeof raw.idpToken !== "string" || !raw.idpToken)
+            return send(res, 400, { error: "endpoint deregistration needs only { idpToken, request }" });
+        body = raw;
+        parseRemoteEndpointDeregisterRequest(body.request);
+    }
+    catch (error) {
+        if (error instanceof RequestBodyError)
+            return sendRequestError(res, error);
+        return send(res, error instanceof EpEnvelopeError && error.code === "unimplemented" ? 422 : 400, { error: "invalid endpoint deregistration request" });
+    }
+    let owner;
+    try {
+        const verified = await verifyIdpToken(body.idpToken, ctx.bridgeIdp);
+        owner = deriveOwnerForIdpSubject(ctx.ownerSecret, ctx.bridgeIdp.issuer, verified.sub);
+        const row = findInteractiveActor(ctx.dir, owner, "cli");
+        if (!row || !(row.scope ?? []).includes("supervise"))
+            throw new Error("endpoint deregistration requires the current cli supervise grant");
+    }
+    catch {
+        return refuseExchange(res, ctx, policy, peer, throttled, "endpoint deregistration proof or current grant refused", 403, { error: "endpoint deregistration proof or current grant refused" });
+    }
+    try {
+        return send(res, 200, await ctx.deregisterEndpoint(body.request, { kind: "owner", owner }), { "cache-control": "no-store" });
+    }
+    catch {
+        return send(res, 503, { error: "endpoint deregistration did not return a confirmed result; inspect the same registration before another request" });
+    }
+}
+/** Authenticated manager issuance and maintenance on the selected exchange face. */
 export async function handleManagerServiceAuthority(req, res, ctx, policy) {
     if (req.method !== "POST")
         return send(res, 405, { error: "POST only" });
@@ -4074,6 +4124,7 @@ function makePublicHandler(ctx, policy, bundle) {
         ],
         ["/exchange", (req, res, c) => handleExchange(req, res, c, policy)],
         ["/manager-service-authority", (req, res, c) => handleManagerServiceAuthority(req, res, c, policy)],
+        ["/endpoint-deregister", (req, res, c) => handleEndpointDeregister(req, res, c, policy)],
         ["/manager-instances", (req, res, c) => handleManagerInstances(req, res, c, policy)],
         [SERVICE_ENDPOINT_AUTHORITY_PATH, (req, res, c) => handleServiceEndpointAuthority(req, res, c, policy)],
         [SERVICE_ENDPOINT_HOST_PATH, (req, res, c) => handleServiceEndpointHost(req, res, c, policy)],