@gmickel/gno 1.27.1 → 1.29.0

package/src/serve/doc-events.ts

@@ -25,46 +25,87 @@ export interface DocumentEventBusState {
   retryMs: number;
 }
 
+export interface DocumentEventStreamAuthorization {
+  authorizationEpoch: string;
+  isAuthorizationEpochCurrent: () => boolean;
+  onClose?: () => void;
+  signal?: AbortSignal;
+}
+
+interface DocumentEventSubscriber {
+  authorization: DocumentEventStreamAuthorization;
+  closed: boolean;
+  controller: ReadableStreamDefaultController<Uint8Array>;
+  keepaliveTimer: ReturnType<typeof setInterval> | null;
+  removeAbortListener: (() => void) | null;
+}
+
 const encoder = new TextEncoder();
 const EVENT_RETRY_MS = 2_000;
 const KEEPALIVE_MS = 15_000;
+const POLICY_CHANGED_FRAME = encoder.encode(
+  `retry: ${EVENT_RETRY_MS}\nevent: egress-policy-changed\ndata: {"error":{"code":"EGRESS_POLICY_CHANGED","message":"Collection policy changed; retry"}}\n\n`
+);
 
 export class DocumentEventBus {
-  readonly #controllers = new Set<
-    ReadableStreamDefaultController<Uint8Array>
-  >();
-
-  createResponse(): Response {
-    const controllers = this.#controllers;
-    let streamController: ReadableStreamDefaultController<Uint8Array> | null =
-      null;
-    let keepaliveTimer: ReturnType<typeof setInterval> | null = null;
+  readonly #subscribers = new Set<DocumentEventSubscriber>();
+  readonly #keepaliveMs: number;
+
+  constructor(options: { keepaliveMs?: number } = {}) {
+    this.#keepaliveMs = options.keepaliveMs ?? KEEPALIVE_MS;
+  }
+
+  createResponse(
+    authorization: DocumentEventStreamAuthorization = {
+      authorizationEpoch: "unrestricted",
+      isAuthorizationEpochCurrent: () => true,
+    }
+  ): Response {
+    let subscriber: DocumentEventSubscriber | null = null;
     const stream = new ReadableStream<Uint8Array>({
-      start(controller) {
-        streamController = controller;
-        controllers.add(controller);
+      start: (controller) => {
+        subscriber = {
+          authorization,
+          closed: false,
+          controller,
+          keepaliveTimer: null,
+          removeAbortListener: null,
+        };
+        this.#subscribers.add(subscriber);
+        if (!authorization.isAuthorizationEpochCurrent()) {
+          this.#invalidateSubscriber(subscriber);
+          return;
+        }
         controller.enqueue(
           encoder.encode(`retry: ${EVENT_RETRY_MS}\n: connected\n\n`)
         );
-        keepaliveTimer = setInterval(() => {
-          try {
-            controller.enqueue(encoder.encode(": keepalive\n\n"));
-          } catch {
-            if (keepaliveTimer) {
-              clearInterval(keepaliveTimer);
+        subscriber.keepaliveTimer = setInterval(
+          () => {
+            if (!authorization.isAuthorizationEpochCurrent()) {
+              this.#invalidateSubscriber(subscriber);
+              return;
             }
-            controllers.delete(controller);
-          }
-        }, KEEPALIVE_MS);
-      },
-      cancel() {
-        if (keepaliveTimer) {
-          clearInterval(keepaliveTimer);
-        }
-        if (streamController) {
-          controllers.delete(streamController);
+            try {
+              controller.enqueue(encoder.encode(": keepalive\n\n"));
+            } catch {
+              this.#closeSubscriber(subscriber);
+            }
+          },
+          this.#keepaliveMs
+        );
+        if (authorization.signal) {
+          const onAbort = (): void => this.#closeSubscriber(subscriber);
+          authorization.signal.addEventListener("abort", onAbort, {
+            once: true,
+          });
+          subscriber.removeAbortListener = () =>
+            authorization.signal?.removeEventListener("abort", onAbort);
+          if (authorization.signal.aborted) onAbort();
         }
       },
+      cancel: () => {
+        this.#closeSubscriber(subscriber, false);
+      },
     });
 
     return new Response(stream, {
@@ -81,30 +122,60 @@ export class DocumentEventBus {
       `event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`
     );
 
-    for (const controller of this.#controllers) {
+    for (const subscriber of this.#subscribers) {
+      if (!subscriber.authorization.isAuthorizationEpochCurrent()) {
+        this.#invalidateSubscriber(subscriber);
+        continue;
+      }
       try {
-        controller.enqueue(payload);
+        subscriber.controller.enqueue(payload);
       } catch {
-        this.#controllers.delete(controller);
+        this.#closeSubscriber(subscriber);
       }
     }
   }
 
   close(): void {
-    for (const controller of this.#controllers) {
-      try {
-        controller.close();
-      } catch {
-        // Best-effort shutdown.
-      }
+    for (const subscriber of this.#subscribers) {
+      this.#closeSubscriber(subscriber);
     }
-    this.#controllers.clear();
   }
 
   getState(): DocumentEventBusState {
     return {
-      connectedClients: this.#controllers.size,
+      connectedClients: this.#subscribers.size,
       retryMs: EVENT_RETRY_MS,
     };
   }
+
+  #invalidateSubscriber(subscriber: DocumentEventSubscriber | null): void {
+    if (!subscriber || subscriber.closed) return;
+    try {
+      subscriber.controller.enqueue(POLICY_CHANGED_FRAME);
+    } catch {
+      // The stream may already be cancelled.
+    }
+    this.#closeSubscriber(subscriber);
+  }
+
+  #closeSubscriber(
+    subscriber: DocumentEventSubscriber | null,
+    closeController = true
+  ): void {
+    if (!subscriber || subscriber.closed) return;
+    subscriber.closed = true;
+    if (subscriber.keepaliveTimer) {
+      clearInterval(subscriber.keepaliveTimer);
+    }
+    subscriber.removeAbortListener?.();
+    this.#subscribers.delete(subscriber);
+    if (closeController) {
+      try {
+        subscriber.controller.close();
+      } catch {
+        // Best-effort stream shutdown.
+      }
+    }
+    subscriber.authorization.onClose?.();
+  }
 }

package/src/serve/public/components/CollectionEgressCheckPanel.tsx

@@ -0,0 +1,411 @@
+import { Loader2Icon, ScanSearchIcon } from "lucide-react";
+import { useEffect, useMemo, useState } from "react";
+
+import { apiFetch } from "../hooks/use-api";
+import { Button } from "./ui/button";
+
+type Action =
+  | "clip_write"
+  | "export"
+  | "publish"
+  | "remote_inference"
+  | "retrieve"
+  | "serve";
+type Destination = "lan" | "local_process" | "loopback" | "remote";
+type ContentClass =
+  | "attachment"
+  | "audit_log"
+  | "capsule"
+  | "embedding"
+  | "metadata"
+  | "retrieval_trace"
+  | "snippet"
+  | "source";
+
+interface CheckResult {
+  allowedCollections: string[];
+  mode: "complete" | "denied" | "partial";
+  decision: {
+    allowed: boolean;
+    reason: string;
+  };
+  disclosure: null | {
+    code: "EGRESS_PARTIAL_RESULT";
+    omittedCount: number;
+    omittedCollections: string[];
+  };
+  omittedCollections: Array<{ collection: string; reason: string }>;
+  remediation: null | { message: string };
+}
+
+interface CollectionEgressCheckPanelProps {
+  availableCollections: readonly string[];
+  collection: string;
+  effectivePolicy: "lan" | "local_only" | "remote";
+  source: "config_default" | "explicit";
+}
+
+const selectClass =
+  "h-8 rounded-md border border-border/20 bg-muted/10 px-2 font-mono text-[11px] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-secondary";
+
+export function CollectionEgressCheckPanel({
+  availableCollections,
+  collection,
+  effectivePolicy,
+  source,
+}: CollectionEgressCheckPanelProps) {
+  const [action, setAction] = useState<Action>("export");
+  const [destinationZone, setDestinationZone] = useState<Destination>("remote");
+  const [contentClass, setContentClass] =
+    useState<ContentClass>("retrieval_trace");
+  const [authenticated, setAuthenticated] = useState(true);
+  const [authorized, setAuthorized] = useState(true);
+  const [partialResults, setPartialResults] = useState<"deny" | "explicit">(
+    "deny"
+  );
+  const [collectionSearch, setCollectionSearch] = useState("");
+  const [selectedCollections, setSelectedCollections] = useState<string[]>([
+    collection,
+  ]);
+  const [checking, setChecking] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [result, setResult] = useState<CheckResult | null>(null);
+  const collectionOptions = useMemo(
+    () =>
+      [...new Set([collection, ...availableCollections])].sort((left, right) =>
+        left.localeCompare(right)
+      ),
+    [availableCollections, collection]
+  );
+  const visibleCollections = useMemo(() => {
+    const query = collectionSearch.trim().toLowerCase();
+    return query
+      ? collectionOptions.filter((name) => name.toLowerCase().includes(query))
+      : collectionOptions;
+  }, [collectionOptions, collectionSearch]);
+  const partialAvailable = selectedCollections.length > 1;
+
+  useEffect(() => {
+    setSelectedCollections([collection]);
+    setCollectionSearch("");
+    setPartialResults("deny");
+    setResult(null);
+    setError(null);
+  }, [collection]);
+
+  useEffect(() => {
+    if (!partialAvailable && partialResults === "explicit") {
+      setPartialResults("deny");
+    }
+  }, [partialAvailable, partialResults]);
+
+  const toggleCollection = (name: string, checked: boolean): void => {
+    setSelectedCollections((current) => {
+      if (checked) {
+        return current.includes(name) || current.length >= 64
+          ? current
+          : [...current, name];
+      }
+      return current.length === 1
+        ? current
+        : current.filter((candidate) => candidate !== name);
+    });
+    setResult(null);
+  };
+
+  const check = async () => {
+    setChecking(true);
+    setError(null);
+    const response = await apiFetch<CheckResult>("/api/egress/check", {
+      method: "POST",
+      body: JSON.stringify({
+        action,
+        caller: {
+          authenticated,
+          operationAuthorized: authorized,
+        },
+        collections: selectedCollections,
+        contentClass,
+        destinationZone,
+        partialResults:
+          selectedCollections.length > 1 ? partialResults : "deny",
+      }),
+    });
+    setChecking(false);
+    if (response.error || !response.data) {
+      setResult(null);
+      setError(response.error ?? "Policy check failed");
+      return;
+    }
+    setResult(response.data);
+  };
+
+  return (
+    <section
+      aria-labelledby="egress-check-title"
+      className="space-y-3 border-border/15 border-t px-6 py-5"
+    >
+      <div className="flex items-start justify-between gap-4">
+        <div>
+          <h3
+            className="flex items-center gap-2 font-medium text-[13px]"
+            id="egress-check-title"
+          >
+            <ScanSearchIcon className="size-3.5 text-secondary/70" />
+            Check a boundary
+          </h3>
+          <p className="mt-1 text-muted-foreground/50 text-xs">
+            Exact, content-free explanation before an action runs.
+          </p>
+        </div>
+        <p className="text-right font-mono text-[10px] text-muted-foreground/50">
+          {effectivePolicy} / {source}
+        </p>
+      </div>
+
+      <div className="grid gap-2 md:grid-cols-3">
+        <label className="space-y-1 text-[10px] text-muted-foreground/60 uppercase">
+          Action
+          <select
+            className={`${selectClass} w-full`}
+            disabled={checking}
+            onChange={(event) => setAction(event.target.value as Action)}
+            value={action}
+          >
+            {[
+              "retrieve",
+              "serve",
+              "publish",
+              "remote_inference",
+              "export",
+              "clip_write",
+            ].map((value) => (
+              <option key={value} value={value}>
+                {value}
+              </option>
+            ))}
+          </select>
+        </label>
+        <label className="space-y-1 text-[10px] text-muted-foreground/60 uppercase">
+          Destination
+          <select
+            className={`${selectClass} w-full`}
+            disabled={checking}
+            onChange={(event) =>
+              setDestinationZone(event.target.value as Destination)
+            }
+            value={destinationZone}
+          >
+            {["local_process", "loopback", "lan", "remote"].map((value) => (
+              <option key={value} value={value}>
+                {value}
+              </option>
+            ))}
+          </select>
+        </label>
+        <label className="space-y-1 text-[10px] text-muted-foreground/60 uppercase">
+          Content class
+          <select
+            className={`${selectClass} w-full`}
+            disabled={checking}
+            onChange={(event) =>
+              setContentClass(event.target.value as ContentClass)
+            }
+            value={contentClass}
+          >
+            {[
+              "source",
+              "snippet",
+              "metadata",
+              "attachment",
+              "embedding",
+              "capsule",
+              "audit_log",
+              "retrieval_trace",
+            ].map((value) => (
+              <option key={value} value={value}>
+                {value}
+              </option>
+            ))}
+          </select>
+        </label>
+      </div>
+
+      <fieldset className="space-y-2 rounded-md border border-border/20 bg-muted/5 p-3">
+        <legend className="px-1 font-mono text-[10px] text-muted-foreground/60 uppercase">
+          Collection scope
+        </legend>
+        <label
+          className="block space-y-1 text-[10px] text-muted-foreground/60 uppercase"
+          htmlFor="egress-collection-search"
+        >
+          Search collections
+          <input
+            className={`${selectClass} block w-full normal-case`}
+            id="egress-collection-search"
+            disabled={checking}
+            onChange={(event) => setCollectionSearch(event.target.value)}
+            placeholder="Filter existing collections"
+            type="search"
+            value={collectionSearch}
+          />
+        </label>
+        <div
+          aria-label="Collections included in the check"
+          className="grid max-h-28 gap-1 overflow-y-auto sm:grid-cols-2"
+          role="group"
+        >
+          {visibleCollections.map((name) => {
+            const checked = selectedCollections.includes(name);
+            return (
+              <label
+                className="flex min-w-0 items-center gap-2 rounded px-1.5 py-1 text-xs hover:bg-muted/20"
+                key={name}
+              >
+                <input
+                  checked={checked}
+                  disabled={
+                    checking || (checked && selectedCollections.length === 1)
+                  }
+                  onChange={(event) =>
+                    toggleCollection(name, event.target.checked)
+                  }
+                  type="checkbox"
+                />
+                <span className="truncate font-mono" title={name}>
+                  {name}
+                </span>
+                {name === collection ? (
+                  <span className="ml-auto text-[9px] text-muted-foreground/45 uppercase">
+                    current
+                  </span>
+                ) : null}
+              </label>
+            );
+          })}
+          {visibleCollections.length === 0 ? (
+            <p className="text-muted-foreground/50 text-xs">
+              No matching collections.
+            </p>
+          ) : null}
+        </div>
+        <p className="text-[10px] text-muted-foreground/50">
+          {selectedCollections.length} selected · maximum 64
+        </p>
+      </fieldset>
+
+      <div className="flex flex-wrap items-center gap-x-5 gap-y-2 text-xs">
+        <label className="flex items-center gap-2">
+          <input
+            checked={authenticated}
+            disabled={checking}
+            onChange={(event) => setAuthenticated(event.target.checked)}
+            type="checkbox"
+          />
+          Authenticated
+        </label>
+        <label className="flex items-center gap-2">
+          <input
+            checked={authorized}
+            disabled={checking}
+            onChange={(event) => setAuthorized(event.target.checked)}
+            type="checkbox"
+          />
+          Operation authorized
+        </label>
+        <label className="flex items-center gap-2">
+          Partial mode
+          <select
+            className={selectClass}
+            disabled={checking || !partialAvailable}
+            onChange={(event) =>
+              setPartialResults(event.target.value as "deny" | "explicit")
+            }
+            value={partialResults}
+          >
+            <option value="deny">deny</option>
+            <option value="explicit">explicit</option>
+          </select>
+        </label>
+        {!partialAvailable ? (
+          <span className="text-[10px] text-muted-foreground/50">
+            Explicit partial results require at least two collections.
+          </span>
+        ) : null}
+        <Button
+          className="ml-auto text-xs"
+          disabled={checking}
+          onClick={() => void check()}
+          size="sm"
+          type="button"
+          variant="outline"
+        >
+          {checking ? <Loader2Icon className="size-3 animate-spin" /> : null}
+          Explain
+        </Button>
+      </div>
+
+      {error ? (
+        <p className="text-destructive text-xs" role="alert">
+          {error}
+        </p>
+      ) : null}
+      {result ? (
+        <output
+          aria-live="polite"
+          className="block rounded-md border border-border/20 bg-muted/10 p-3 text-xs"
+        >
+          <p className="font-mono">
+            {result.mode} · {result.decision.reason}
+          </p>
+          <p className="mt-1 text-muted-foreground/60">
+            Omitted: {result.disclosure?.omittedCount ?? 0}
+          </p>
+          <div className="mt-2 grid gap-2 sm:grid-cols-2">
+            <div>
+              <p className="font-mono text-[10px] text-muted-foreground/50 uppercase">
+                Allowed collections
+              </p>
+              {result.allowedCollections.length > 0 ? (
+                <ul className="mt-1 space-y-0.5 font-mono">
+                  {result.allowedCollections.map((name) => (
+                    <li key={name}>{name}</li>
+                  ))}
+                </ul>
+              ) : (
+                <p className="mt-1 text-muted-foreground/50">None</p>
+              )}
+            </div>
+            <div>
+              <p className="font-mono text-[10px] text-muted-foreground/50 uppercase">
+                Omitted collections
+              </p>
+              {result.omittedCollections.length > 0 ? (
+                <ul className="mt-1 space-y-0.5 font-mono">
+                  {result.omittedCollections.map((item) => (
+                    <li key={item.collection}>
+                      {item.collection} · {item.reason}
+                    </li>
+                  ))}
+                </ul>
+              ) : (
+                <p className="mt-1 text-muted-foreground/50">None</p>
+              )}
+            </div>
+          </div>
+          {result.disclosure ? (
+            <p className="mt-2 font-mono text-[10px] text-muted-foreground/60">
+              {result.disclosure.code}:{" "}
+              {result.disclosure.omittedCollections.join(", ")}
+            </p>
+          ) : null}
+          {result.remediation ? (
+            <p className="mt-1 text-muted-foreground/70">
+              {result.remediation.message}
+            </p>
+          ) : null}
+        </output>
+      ) : null}
+    </section>
+  );
+}

package/src/serve/public/components/CollectionEgressPolicyEditor.tsx

@@ -0,0 +1,78 @@
+import { ShieldCheckIcon } from "lucide-react";
+
+export type CollectionEgressPolicy = "local_only" | "lan" | "remote";
+
+interface CollectionEgressPolicyEditorProps {
+  confirmed: boolean;
+  onConfirmedChange: (confirmed: boolean) => void;
+  onPolicyChange: (policy: CollectionEgressPolicy) => void;
+  policy: CollectionEgressPolicy;
+  relaxed: boolean;
+  revision: number;
+  source: "explicit" | "config_default";
+}
+
+export function CollectionEgressPolicyEditor({
+  confirmed,
+  onConfirmedChange,
+  onPolicyChange,
+  policy,
+  relaxed,
+  revision,
+  source,
+}: CollectionEgressPolicyEditorProps) {
+  return (
+    <section className="grid gap-x-5 gap-y-3 px-6 py-5 lg:grid-cols-[180px_minmax(0,1fr)]">
+      <div className="space-y-1">
+        <div className="flex items-center gap-2">
+          <ShieldCheckIcon className="size-3.5 text-secondary/70" />
+          <h3 className="font-medium text-[13px]">Data boundary</h3>
+        </div>
+        <p className="text-muted-foreground/50 text-xs leading-relaxed">
+          Controls where source and derived content may travel.
+        </p>
+      </div>
+      <div className="space-y-3">
+        <label
+          className="block font-mono text-[10px] text-muted-foreground/60 uppercase tracking-[0.1em]"
+          htmlFor="collection-egress-policy"
+        >
+          Collection policy
+        </label>
+        <select
+          className="h-9 w-full rounded-md border border-border/20 bg-muted/10 px-3 font-mono text-xs focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-secondary"
+          id="collection-egress-policy"
+          onChange={(event) =>
+            onPolicyChange(event.target.value as CollectionEgressPolicy)
+          }
+          value={policy}
+        >
+          <option value="local_only">Local only</option>
+          <option value="lan">Authenticated LAN</option>
+          <option value="remote">Authenticated remote</option>
+        </select>
+        <p className="text-muted-foreground/45 text-xs">
+          Source: <span className="font-mono">{source}</span> · revision{" "}
+          <span className="font-mono">{revision}</span>
+        </p>
+        {relaxed ? (
+          <div className="rounded-md border border-secondary/25 bg-secondary/6 p-3">
+            <label className="flex cursor-pointer items-start gap-2.5 text-xs">
+              <input
+                checked={confirmed}
+                className="mt-0.5 size-4 accent-[var(--secondary)]"
+                onChange={(event) => onConfirmedChange(event.target.checked)}
+                type="checkbox"
+              />
+              <span>
+                I confirm this expands where collection content may travel. The
+                confirmation applies only to revision {revision} and target{" "}
+                {policy}.
+              </span>
+            </label>
+          </div>
+        ) : null}
+      </div>
+    </section>
+  );
+}