@cotal-ai/auth 0.62.0 → 0.64.0

package/dist/service.js

@@ -59,7 +59,7 @@ import { resolve } from "node:path";
 import { connect, credsAuthenticator } from "@nats-io/transport-node";
 import { jetstreamManager } from "@nats-io/jetstream";
 import { Kvm } from "@nats-io/kv";
-import { contractRefToHex, contractStoreContext, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, authorizeServeGrant, invokeCommand, resolveService, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, SERVICE_READY, writeServiceStatus } from "@cotal-ai/core";
+import { contractRefToHex, contractStoreContext, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, acceptedReadGrant, actorLedgerSource, connectionAcceptedToken, importNativeSubjectPermissions, mintGeneration, parseActorLedgerSource, writeAcceptedRow, authorizeServeGrant, invokeCommand, resolveService, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, SERVICE_READY, writeServiceStatus } from "@cotal-ai/core";
 import { findCotalRoot, loadManagerInstanceIdentity, userAuthStateDir, workspaceSecretStore, createAuthInstanceIdentity, loadAuthInstanceIdentity } from "@cotal-ai/workspace";
 import { decodeJwt } from "jose";
 import { deriveOwnerForIdpSubject, platformControlOwner } from "./derive.js";
@@ -70,15 +70,15 @@ import { PUBLIC_EXCHANGE_VIEWS } from "./token.js";
 import { grantCoordinates, verifySessionRedemption } from "./session-redemption.js";
 import { pinnedJwksResolver } from "./issuer.js";
 import { calloutPermissions } from "./permissions.js";
-import { admitRemoteRun, authorizeRemoteManagerRenewal, authorizeRemoteRunAttempt, issueRemoteManagerAuthority, parseRemoteRunAdmissionRequest, parseRemoteRunAttemptRequest } from "./manager-authority.js";
+import { admitRemoteRun, authorizeRemoteManagerRenewal, authorizeRemoteRunAttempt, issueRemoteManagerAuthority, observedRunRequest, parseRemoteRunAdmissionRequest, parseRemoteRunAttemptRequest } from "./manager-authority.js";
 import { authorizeRemoteRetainedAgentValidation, completeRemoteRetainedAgentValidation, remoteManagerCurrentRegistrationProof } from "./retained-manager-validation.js";
 import { authorizeRemoteManagedAgentEnrollment, authorizeRemoteManagedAgentPrepareRetirement, authorizeRemoteManagedAgentRuntimeCreate, authorizeRemoteManagedAgentRuntimeStatus } from "./managed-agent-enrollment.js";
 import { authorizeRemoteManagerGoalIndexScan, completeRemoteManagerGoalIndexScan } from "./manager-goal-index.js";
 import { authorizeRemoteManagerAdmin } from "./manager-admin-authorization.js";
 import { authorizeRemoteManagerMaintenance, completeRemoteManagerMaintenance } from "./manager-maintenance.js";
 import { validateRetainedManagedAgent } from "./continuity.js";
-import { reconstructRemoteManagerServeGrant, remoteManagerServeGrantFromCluster } from "./manager-contract.js";
-import { authorityBarrierGrants, authorityWriterGrants, openAuthorityClient, openSupervisedConnectReader, platformReadinessGrants, remoteManagerIssuerGrants, remoteManagerRegistrationProof, authRegistrationExecutorGrants } from "./authority-client.js";
+import { reconstructRemoteManagerServeGrant, remoteManagerServeGrantFromCluster, remoteManagerSurface } from "./manager-contract.js";
+import { authorityBarrierGrants, authorityWriterGrants, openAuthorityClient, openSupervisedConnectReader, platformReadinessGrants, remoteManagerIssuerGrants, remoteManagerRegistrationProof, authRegistrationExecutorGrants, servedRunRequestSubjects } from "./authority-client.js";
 import { authorizeConnectCredential } from "./connect-reader.js";
 import { ensureRootCredential } from "./root-credential.js";
 import { activateLifecycleAtUid, observeGate, openLifecycleRegistry, readLifecycleHeadForOperation } from "./lifecycle-registry.js";
@@ -93,7 +93,7 @@ import { makeDrainRepairers } from "./drain-repair.js";
 import { joinOrStartRetirement, openAuthAdminListener } from "./auth-admin.js";
 import { AUTH_SERVICE_ENDPOINT, authClusterArtifacts, authContractArtifactValues } from "./auth-service-contract.js";
 import { drainTargetForEndpoint, openAdmissionMediator } from "./admission-mediator.js";
-import { AGENT_BEARER_TTL_SEC, findInteractiveActor, findManagedActor, ledgerAclResolver, ledgerAuthorizeAgentExchange, ledgerAuthorizeConnect, ledgerAuthorizeGrant, } from "./ledger.js";
+import { AGENT_BEARER_TTL_SEC, findInteractiveActor, findManagedActor, findActorUnified, ledgerAclResolver, ledgerActorSourceIsLive, ledgerAuthorizeAgentExchange, ledgerAuthorizeConnect, ledgerAuthorizeGrant, } from "./ledger.js";
 import { AUTH_PROVIDER_NAME, clearAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, spaceIssuer, } from "./store.js";
 /** JWKS max-age seconds — the cache contract's knob. Exported so a rotation tool can compute the
  *  retire floor (max-age + max bearer TTL) from it. */
@@ -121,6 +121,7 @@ const PUBLIC_FAILED_PER_MIN = 30; // per-PEER refused-exchange window (rolling m
 const PUBLIC_PEER_BUCKETS_MAX = 1024; // bounded LRU of per-peer failure buckets
 const PUBLIC_MAX_IN_FLIGHT = 64; // global concurrent-admission cap on the public listener
 const PUBLIC_DEADLINE_MS = 10_000; // hard wall-clock deadline per public request
+const OBSERVED_RUN_REQUEST_WINDOW_MS = 5 * 60_000; // how long an observed served resume or answer can still be forwarded
 /** Package-internal policy step for the hosted retirement requester. The HTTP production door calls
  * this after deriving the owner and manager actors; broker-free smokes exercise the same decision. */
 export function authorizeRemoteManagerRetirement(args) {
@@ -431,21 +432,21 @@ export async function openAuthAuthorityPlane(opts) {
     const fileArm = ledgerAuthorizeConnect(opts.dir);
     const recordsJsm = await jetstreamManager(remoteIssuer.nc);
     const loadLocalManager = opts.localManager ?? (() => undefined);
-    // Standing renewal re-derives the serve surface from the REGISTERED service spec at the gate's
-    // registration revision: spec (leader read) -> closure manifest -> root document, each verified
-    // against its content digest. The request never selects the surface.
+    // Standing renewal and a served resume or answer read the manager surface from the REGISTERED
+    // service spec at the gate's registration revision: spec (leader read) -> closure manifest -> root
+    // document, each verified against its content digest. The request never selects the surface.
     const registeredManagerCluster = async (owner, instanceId, observed) => {
         const rec = await readSvcRecordLeader(recordsJsm, space, recordSpecKey(RECORD_KINDS.svc, ["manager", instanceId]));
         if (!rec || "deleted" in rec || rec.revision !== observed.registrationRevision)
-            throw new EpEnvelopeError("failed-precondition", "manager-service renewal found no service spec at the gate's registration revision");
+            throw new EpEnvelopeError("failed-precondition", "found no manager service spec at the gate's registration revision");
         const spec = parseServiceSpec(rec.value, { endpoint: "manager" });
         if (spec.owner !== owner)
-            throw new EpEnvelopeError("permission-denied", "manager-service renewal spec belongs to another owner");
+            throw new EpEnvelopeError("permission-denied", "the manager service spec belongs to another owner");
         const store = await contractStoreContext(remoteIssuer.nc, space);
         const read = async (digest) => {
             const bytes = await fetchContractArtifact(store, contractRefToHex(digest));
             if (!bytes)
-                throw new EpEnvelopeError("failed-precondition", `manager-service renewal cannot read registered contract artifact ${digest}`);
+                throw new EpEnvelopeError("failed-precondition", `cannot read registered manager contract artifact ${digest}`);
             return JSON.parse(new TextDecoder().decode(bytes));
         };
         for (const closure of spec.clusterDigests) {
@@ -454,7 +455,7 @@ export async function openAuthAuthorityPlane(opts) {
             if (verifyClusterRoot(root, document).urn === "ai.cotal.manager")
                 return document;
         }
-        throw new EpEnvelopeError("failed-precondition", "manager-service renewal spec registers no manager cluster");
+        throw new EpEnvelopeError("failed-precondition", "the manager service spec registers no manager cluster");
     };
     const managerGate = async (owner, instanceId) => {
         const localManager = loadLocalManager();
@@ -532,6 +533,47 @@ export async function openAuthAuthorityPlane(opts) {
         if (fatalReason !== undefined)
             throw new EpEnvelopeError("unavailable", `the auth service for space "${space}" is momentarily unavailable (it detected a fault and is restarting); retry shortly`);
     };
+    // The issuer window's signer: the data account's signing key, the same `hostAuth` shape the run
+    // admission builds.
+    const issuerAuth = () => ({
+        space,
+        operator: { seed: "", jwt: "" },
+        account: { pub: dataAccount.pub, seed: "", jwt: "", signingSeed: dataAccount.signingSeed, signingPub: "" },
+        sys: { pub: "", jwt: "" },
+    });
+    // The source check the issuing host resolves with: an actor-ledger row is attested here, from the
+    // ledger this service owns; every other coordinate goes to core's check (SPEC 13.15).
+    const composedSourceIsLive = (session) => (source) => parseActorLedgerSource(source) ? Promise.resolve(ledgerActorSourceIsLive(opts.dir)(source)) : session.sourceIsLive(source);
+    // A served resume or answer is issued only for a request this host saw its caller publish, only
+    // once, and only for what that request's envelope asked (SPEC 14.8): the forward's coordinates
+    // are the manager's word. The manager forwards from inside the handler serving the request, so an
+    // observation older than the window has no forward left to bind; the window also bounds the table.
+    const observedRunRequests = new Map();
+    for (const subject of servedRunRequestSubjects(space))
+        remoteIssuer.nc.subscribe(subject, {
+            callback: (_err, msg) => {
+                const now = Date.now();
+                for (const [seen, { expires }] of observedRunRequests) {
+                    if (expires > now)
+                        break;
+                    observedRunRequests.delete(seen);
+                }
+                const request = observedRunRequest(msg.subject, msg.data);
+                if (request === undefined)
+                    return;
+                // Re-inserting keeps the table in expiry order, which the prune above stops on.
+                observedRunRequests.delete(msg.subject);
+                observedRunRequests.set(msg.subject, { expires: now + OBSERVED_RUN_REQUEST_WINDOW_MS, request });
+            },
+        });
+    const takeObservedRunRequest = async (subject) => {
+        // The broker queued the request to this connection before the manager could read it, and a
+        // flush returns only after this connection has read everything its server queued before it.
+        await remoteIssuer.nc.flush();
+        const observed = observedRunRequests.get(subject);
+        observedRunRequests.delete(subject);
+        return observed !== undefined && observed.expires > Date.now() ? observed.request : undefined;
+    };
     return {
         authorizeConnect: async (t) => {
             refuseIfFenced();
@@ -549,6 +591,40 @@ export async function openAuthAuthorityPlane(opts) {
             if (verdict !== "candidate")
                 throw new Error(`manager instance ${instanceId} is ${verdict} at the permission mint`);
         },
+        issueUserCaller: async ({ t, connId, mint }) => {
+            refuseIfFenced();
+            const owner = assertDerivedOwnerToken(t.owner);
+            const actor = t.act.actor;
+            const uid = assertLifecycleToken(t.act.lifecycleUid ?? "", "lifecycleUid");
+            const acceptedToken = connectionAcceptedToken(connId);
+            return withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, async (session) => {
+                // The row this connection's nonce names, read the way the client reads it.
+                const existing = await session.nc.request(acceptedReadGrant(space, acceptedToken), new Uint8Array(0), { timeout: 3000 });
+                const code = existing.headers?.code ?? 0;
+                const status = existing.headers?.get("Status") ?? "";
+                const missing = code === 404 || status.startsWith("404");
+                if (!missing && (code >= 400 || status !== ""))
+                    throw new Error(`callout permissions: the accepted-row read for this connection failed (${code || status})`);
+                if (missing) {
+                    const generation = mintGeneration();
+                    const perms = mint({ generation, acceptedToken });
+                    const ref = { space, owner, actor, uid, generation };
+                    const prepared = await session.store.stage({
+                        version: 1, ref, sources: [actorLedgerSource(space, owner, actor, uid)], permissions: importNativeSubjectPermissions(perms),
+                    });
+                    await session.store.release(prepared, async () => { });
+                    await writeAcceptedRow(session.accepted, acceptedToken, ref);
+                    return perms;
+                }
+                const row = JSON.parse(new TextDecoder().decode(existing.data));
+                const ref = row.ref;
+                if (row.version !== 1 || ref === undefined || ref.space !== space || ref.owner !== owner || ref.actor !== actor || ref.uid !== uid)
+                    throw new Error("callout permissions: this connection's accepted row names another issued reference; reconnect under a new nonce");
+                const perms = mint({ generation: ref.generation, acceptedToken });
+                await session.store.confirm(ref, importNativeSubjectPermissions(perms));
+                return perms;
+            });
+        },
         verifySession: async (principal, claim) => {
             refuseIfFenced();
             return verifySessionRedemption({
@@ -996,7 +1072,7 @@ export async function openAuthAuthorityPlane(opts) {
                             return gate.observe();
                         },
                         issued: session.store,
-                        sourceIsLive: (source) => session.sourceIsLive(source),
+                        sourceIsLive: composedSourceIsLive(session),
                         admissions: await new Kvm(admitterNc).open(admissionBucket(space)),
                     });
                 }
@@ -1011,7 +1087,19 @@ export async function openAuthAuthorityPlane(opts) {
             requireManagerAuthorityHolder(holder, String(request?.instanceId), 'manager run attempt needs scope "supervise"; spawn/admin do not imply it');
             const req = parseRemoteRunAttemptRequest(request);
             const recordsKv = await openRecordsBucket(remoteIssuer.nc, space);
-            const grant = await authorizeRemoteRunAttempt({
+            const authorize = (session) => authorizeRemoteRunAttempt({
+                ...(session ? { issued: session.store, sourceIsLive: composedSourceIsLive(session) } : {}),
+                isLiveManagedActor: (owner, actor, lifecycleUid) => {
+                    const row = findActorUnified(opts.dir, owner, actor);
+                    return row?.kind === "managed-agent" && row.lifecycleUid === lifecycleUid;
+                },
+                takeObserved: takeObservedRunRequest,
+                registeredCommand: async (instanceId, registrationRevision, command) => {
+                    const registered = remoteManagerSurface(await registeredManagerCluster(owner, instanceId, { registrationRevision }))[command];
+                    if (registered === undefined)
+                        throw new EpEnvelopeError("failed-precondition", `the registered manager cluster declares no ${command}`);
+                    return registered;
+                },
                 request,
                 owner,
                 space,
@@ -1025,7 +1113,15 @@ export async function openAuthAuthorityPlane(opts) {
                 readAdmission: (runId) => readRunAdmission(recordsJsm, space, "manager", runId),
                 readRunStatus: async (runId) => (await readRunRecord(recordsKv, "manager", runId))?.status?.value,
                 checkpointWaiting: async (token) => (await readCheckpointStatus(recordsKv, { endpoint: "manager", token }))?.value.state === "waiting",
+                checkpointSettled: async (token) => {
+                    const status = (await readCheckpointStatus(recordsKv, { endpoint: "manager", token }))?.value;
+                    return status?.state === "resumed" && status.settledAnswerId !== undefined;
+                },
             });
+            // A served resume or answer resolves its caller's issuance, which needs one issuer window.
+            const grant = req.attempt?.served !== undefined || req.operator?.served !== undefined
+                ? await withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, (session) => authorize(session))
+                : await authorize();
             const hostAuth = {
                 space,
                 operator: { seed: "", jwt: "" },
@@ -1378,7 +1474,7 @@ async function startAuthContext(o) {
             space,
             token: { key: issuer.localKeySet(), issuer: issuer.issuer },
             authorizeActor: plane.authorizeConnect,
-            permissionsFor: calloutPermissions(ledgerAclResolver(dir), plane.authorizeManagerCaller, plane.verifySession),
+            permissionsFor: calloutPermissions(ledgerAclResolver(dir), plane.authorizeManagerCaller, plane.verifySession, plane.issueUserCaller),
             log: (l) => console.error(l),
         });
         // The subscription must be ON the broker before readiness is signaled — an `up` that recorded a