@frockbot/cloudflare 0.7.294 → 0.7.295

package/deployment-config/README.md

@@ -121,9 +121,13 @@ the local Worker, and every generated config overrides it from the profile.
 
 Some fields keep a placeholder rather than nothing: wrangler's validator refuses a `services` entry with no target and a `vectorize` entry with no index even in a config it never deploys, so the app Worker's two services and its Vectorize binding, and the admin portal's one service, all say `named-by-deployment-config`. Nothing reads those values — `wrangler dev --env development` and the `e2e` harness resolve their own environments, and the generator writes the deployment's own names. A bucket or database name is left out entirely, because wrangler does not ask for one.
 
-`adminEmails` is in the schema and in no generated config. It is the
-`FROCKBOT_ADMIN_EMAILS` secret the installer sets; the hosted deployment already
-carries it as a repository secret, which is why `hosted.json` omits it.
+`adminEmails` and `adminUserIds` are in the schema and in no generated config.
+They are the `FROCKBOT_ADMIN_EMAILS` and `FROCKBOT_ADMIN_USER_IDS` secrets the
+installer sets; the hosted deployment already carries the first as a repository
+secret, which is why `hosted.json` omits it. An email makes an admin only once
+the auth Package's provider verified it, so a deployment whose people have no
+email names its admins by User id; `frockbot-deployment-config secrets` carries
+`FROCKBOT_ADMIN_USER_IDS` like any other optional secret.
 
 ## Brand
 

package/deployment-config/profile-schema.generated.ts

@@ -181,13 +181,23 @@ export const DEPLOYMENT_PROFILE_SCHEMA_V1 = {
     },
     adminEmails: {
       description:
-        "The deployment's admins: they bypass admission, and a debug Turn may act as one of them. The debug surface itself is gated on `DEBUG_TOKEN`. The installer sets it as the Worker secret `FROCKBOT_ADMIN_EMAILS`; no generated config carries it, which is why the hosted profile leaves it to the repository secret it already has.",
+        "The deployment's admins: they bypass admission, and a debug Turn may act as one of them. The debug surface itself is gated on `DEBUG_TOKEN`. Only a verified email counts. The installer sets it as the Worker secret `FROCKBOT_ADMIN_EMAILS`; no generated config carries it, which is why the hosted profile leaves it to the repository secret it already has.",
       type: "array",
       minItems: 1,
       items: {
         $ref: "#/$defs/email",
       },
     },
+    adminUserIds: {
+      description:
+        "Admins by User id, beside `adminEmails`, for a deployment whose people have no verified email: an id here is an admin exactly as a verified email on `adminEmails` is. The installer sets it as the Worker secret `FROCKBOT_ADMIN_USER_IDS`; no generated config carries it.",
+      type: "array",
+      minItems: 1,
+      items: {
+        type: "string",
+        pattern: "^[^,\\s]+$",
+      },
+    },
     d1DatabaseId: {
       description:
         "The `AUTH_DB` database. Required by the `better-auth` Package unless the deploy supplies it with `--d1-database-id`, which is how a disposable stage names a database it creates in the same job.",

package/deployment-config/profile.schema.json

@@ -164,13 +164,22 @@
       }
     },
     "adminEmails": {
-      "description": "The deployment's admins: they bypass admission, and a debug Turn may act as one of them. The debug surface itself is gated on `DEBUG_TOKEN`. The installer sets it as the Worker secret `FROCKBOT_ADMIN_EMAILS`; no generated config carries it, which is why the hosted profile leaves it to the repository secret it already has.",
+      "description": "The deployment's admins: they bypass admission, and a debug Turn may act as one of them. The debug surface itself is gated on `DEBUG_TOKEN`. Only a verified email counts. The installer sets it as the Worker secret `FROCKBOT_ADMIN_EMAILS`; no generated config carries it, which is why the hosted profile leaves it to the repository secret it already has.",
       "type": "array",
       "minItems": 1,
       "items": {
         "$ref": "#/$defs/email"
       }
     },
+    "adminUserIds": {
+      "description": "Admins by User id, beside `adminEmails`, for a deployment whose people have no verified email: an id here is an admin exactly as a verified email on `adminEmails` is. The installer sets it as the Worker secret `FROCKBOT_ADMIN_USER_IDS`; no generated config carries it.",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "string",
+        "pattern": "^[^,\\s]+$"
+      }
+    },
     "d1DatabaseId": {
       "description": "The `AUTH_DB` database. Required by the `better-auth` Package unless the deploy supplies it with `--d1-database-id`, which is how a disposable stage names a database it creates in the same job.",
       "type": "string",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frockbot/cloudflare",
-  "version": "0.7.294",
+  "version": "0.7.295",
   "private": false,
   "license": "MIT",
   "type": "module",
@@ -23,12 +23,12 @@
     "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.access.json && tsc --noEmit -p test/tsconfig.json && tsc --noEmit -p e2e/tsconfig.json"
   },
   "dependencies": {
-    "@frockbot/app": "0.7.294",
-    "@frockbot/applets": "0.7.294",
-    "@frockbot/computer": "0.7.294",
-    "@frockbot/core": "0.7.294",
-    "@frockbot/frock-compose": "0.7.294",
-    "@frockbot/providers": "0.7.294",
+    "@frockbot/app": "0.7.295",
+    "@frockbot/applets": "0.7.295",
+    "@frockbot/computer": "0.7.295",
+    "@frockbot/core": "0.7.295",
+    "@frockbot/frock-compose": "0.7.295",
+    "@frockbot/providers": "0.7.295",
     "@rive-app/flutter-native-wasm": "44.0.0",
     "agents": "0.24.0",
     "ai": "^7.0.107",

package/src/admin-identities.ts

@@ -13,14 +13,38 @@ export interface GatewayIdentityV1 {
   mode: "better-auth" | "development";
 }
 
+/**
+ * The deployment's administrators by User id, as `FROCKBOT_ADMIN_USER_IDS`
+ * spells them: comma-separated and trimmed. A User id is opaque, so it is
+ * compared exactly. It is how a deployment whose people have no email names
+ * an admin.
+ */
+export function adminUserIdsV1(value: string | undefined): ReadonlySet<string> {
+  return new Set(
+    (value ?? "")
+      .split(",")
+      .map((id) => id.trim())
+      .filter((id) => id.length > 0),
+  );
+}
+
+/** The two allowlists, as the deployment's secrets carry them. */
+export interface DeploymentAdminsV1 {
+  emails?: string;
+  userIds?: string;
+}
+
 export function isDeploymentAdminV1(
   identity: GatewayIdentityV1,
-  configuredEmails: string | undefined,
+  configured: DeploymentAdminsV1,
 ): boolean {
   if (identity.mode === "development" && identity.id === DEVELOPMENT_USER_ID) {
     return true;
   }
-  const emails = adminEmailsV1(configuredEmails);
+  const userIds = adminUserIdsV1(configured.userIds);
+  // A development id is whatever `?as_user=` said, so only a signed-in one counts.
+  if (identity.mode === "better-auth" && userIds.has(identity.id)) return true;
+  const emails = adminEmailsV1(configured.emails);
   if (
     identity.emailVerified === true &&
     identity.email &&
@@ -28,5 +52,7 @@ export function isDeploymentAdminV1(
   ) {
     return true;
   }
-  return identity.mode === "development" && emails.size === 0;
+  return (
+    identity.mode === "development" && emails.size === 0 && userIds.size === 0
+  );
 }

package/src/contracts.ts

@@ -785,8 +785,9 @@ export interface GatewayDependencies {
   admitAccount(
     identity: AdmissionIdentityV1,
   ): Promise<AccountAdmissionDecisionV1>;
-  /** Raw deployment secret; only the derived `isAdmin` boolean reaches clients. */
+  /** Raw deployment secrets; only the derived `isAdmin` boolean reaches clients. */
   adminEmails?: string;
+  adminUserIds?: string;
   applicationHashFor(userId: string): Promise<string>;
   botStateFor(userId: string): UserBotStateBinding;
   userConfigurationFor(userId: string): UserConfigurationBinding;

package/src/gateway.ts

@@ -435,7 +435,10 @@ async function identifyRequest(
         emailVerified: session?.user.emailVerified === true,
         mode: development.userId ? "development" : "better-auth",
       },
-      dependencies.adminEmails,
+      {
+        emails: dependencies.adminEmails,
+        userIds: dependencies.adminUserIds,
+      },
     );
   // Every authenticated request asks, so pausing an account takes effect on
   // its next request rather than at its next sign-in. An admin is never

package/src/index.ts

@@ -163,6 +163,7 @@ import {
 import {
   DEVELOPMENT_USER_ID,
   isDeploymentAdminV1,
+  type DeploymentAdminsV1,
 } from "./admin-identities.js";
 import type { DebugGatewaySurface } from "./debug.js";
 import type { BotDebugQueryV1 } from "@frockbot/app/shell/debug-protocol";
@@ -369,6 +370,8 @@ interface Env {
   MACHINE_TOKEN_SECRET?: string;
   ALLOW_DEVELOPMENT_AUTH?: string;
   FROCKBOT_ADMIN_EMAILS?: string;
+  /** Admins by User id, for a deployment whose people have no email. */
+  FROCKBOT_ADMIN_USER_IDS?: string;
   ALLOWED_CLIENT_ORIGINS?: string;
   /** Authorizes `/api/debug/*`. Absent disables the surface entirely. */
   DEBUG_TOKEN?: string;
@@ -432,7 +435,7 @@ function debugSurface(env: Env): DebugGatewaySurface {
       (await getAgentByName(env.VOICE_ASSISTANTS, userId)).debugSnapshot(),
     isAdminUser: async (userId) => {
       // The auth Package's store is the durable identity source. The path's
-      // User id is never trusted on its own: it must resolve to a stored email,
+      // User id is never trusted on its own: it must resolve to a stored identity,
       // and that identity is evaluated by the same allowlist policy as the
       // signed-in gateway. A Package that stores nothing resolves nothing, so
       // the one write on this surface is refused rather than granted on the
@@ -447,7 +450,7 @@ function debugSurface(env: Env): DebugGatewaySurface {
             emailVerified: identity.emailVerified,
             mode: "better-auth",
           },
-          env.FROCKBOT_ADMIN_EMAILS,
+          deploymentAdmins(env),
         )
       );
     },
@@ -841,6 +844,13 @@ async function admitAccount(
   );
 }
 
+function deploymentAdmins(env: Env): DeploymentAdminsV1 {
+  return {
+    emails: env.FROCKBOT_ADMIN_EMAILS,
+    userIds: env.FROCKBOT_ADMIN_USER_IDS,
+  };
+}
+
 async function storedAdmissionIdentity(
   env: Env,
   userId: string,
@@ -860,7 +870,7 @@ async function storedAdmissionIdentity(
         emailVerified: identity.emailVerified,
         mode: "better-auth",
       },
-      env.FROCKBOT_ADMIN_EMAILS,
+      deploymentAdmins(env),
     ),
   };
 }
@@ -930,7 +940,8 @@ async function mayCreateIdentity(
         emailVerified: candidate.emailVerified,
         mode: "better-auth",
       },
-      env.FROCKBOT_ADMIN_EMAILS,
+      // No User exists yet, so only the email list can name one.
+      { emails: env.FROCKBOT_ADMIN_EMAILS },
     )
   ) {
     return true;
@@ -2754,6 +2765,9 @@ export default {
           ...(env.FROCKBOT_ADMIN_EMAILS
             ? { adminEmails: env.FROCKBOT_ADMIN_EMAILS }
             : {}),
+          ...(env.FROCKBOT_ADMIN_USER_IDS
+            ? { adminUserIds: env.FROCKBOT_ADMIN_USER_IDS }
+            : {}),
           applicationHashFor: async () => env.DEFAULT_APPLICATION_HASH,
           botStateFor: (userId) =>
             runtimeExports.UserBotState({ props: { userId } }),

package/src/production-secrets.ts

@@ -221,6 +221,12 @@ export const OPTIONAL_PRODUCTION_SECRETS_V1: readonly OptionalProductionSecretV1
       degraded:
         "nobody can administer beta access, so admission stays closed and only accounts already granted access can sign in",
     },
+    {
+      name: "FROCKBOT_ADMIN_USER_IDS",
+      why: "Admins by User id, beside `FROCKBOT_ADMIN_EMAILS`, for a deployment whose people have no verified email.",
+      degraded:
+        "only a verified email on `FROCKBOT_ADMIN_EMAILS` makes an admin",
+    },
     {
       name: "DEBUG_TOKEN",
       why: "Authorizes the read-only `/api/debug` operator surface.",