@happyvertical/smrt-reports 0.49.3 → 0.49.4

package/README.md

@@ -224,7 +224,17 @@ state; it redacts lock owners, raw errors, and tenant-fanout identifiers. Pass a
 that context; the result then distinguishes a current, stale, or read-triggered
 refresh. `previewReportRefresh()` and `applyReportRefresh()` require an
 application action host to authorize and audit the caller before a durable
-report-refresh job is queued. Only a registered `SmrtReportCollection` can
+report-refresh job is queued. Manual refresh hosts must also return a versioned,
+non-secret `executionAuthority` binding. Each worker process registers the named
+host with `registerReportRefreshExecutionAuthorityHost()`; the task checks the
+persisted tenant binding, resolves current membership and permission, and records
+an allowed or denied execution audit immediately before refresh. Every enqueue
+path also receives a `DurableJobPayloadSigner`, and every worker registers it
+with `registerReportRefreshJobIntegritySigner()`. This authenticates the task
+target, trigger, tenant scope, authority reference, and payload across storage;
+the signing key is never persisted. Scheduled and on-change maintenance jobs
+remain system-authority jobs and do not carry an initiating user, but their job
+payloads use the same integrity boundary. Only a registered `SmrtReportCollection` can
 synchronously refresh a stale read, and only when its TTL policy is positive and
 not manual.
 

package/dist/index.d.ts

@@ -13,7 +13,10 @@ import { DataQueryRequest } from '@happyvertical/smrt-types';
 import { DataQueryResult } from '@happyvertical/smrt-types';
 import { DataQuerySchema } from '@happyvertical/smrt-types';
 import { DataQuerySort } from '@happyvertical/smrt-types';
+import { DurableJobPayloadIntegrity } from '@happyvertical/smrt-jobs';
+import { DurableJobPayloadSigner } from '@happyvertical/smrt-jobs';
 import { EventEmitter } from 'node:events';
+import { JobExecutionContext } from '@happyvertical/smrt-jobs';
 import { SmrtCollection } from '@happyvertical/smrt-core';
 import { SmrtJob } from '@happyvertical/smrt-jobs';
 import { SmrtListOptions } from '@happyvertical/smrt-core';
@@ -70,6 +73,7 @@ export declare function applyReportExport(descriptor: ReportAdapterDescriptor, r
 export declare function applyReportRefresh(reportCtor: ReportCtor, options: ApplyReportRefreshOptions): Promise<AppliedReportRefresh>;
 
 export declare interface ApplyReportRefreshOptions extends PreviewReportRefreshOptions {
+    jobIntegritySigner?: DurableJobPayloadSigner;
     queue?: string;
     priority?: number;
     timeout?: number;
@@ -147,6 +151,8 @@ export declare interface EnqueueReportRefreshOptions extends ReportRefreshJobArg
     timeout?: number;
     maxAttempts?: number;
     tenantJobCap?: number;
+    /** Server-only signer; register the same key in every worker process. */
+    integritySigner?: DurableJobPayloadSigner;
 }
 
 export declare function ensureReportRefreshSchedules(options: EnsureReportSchedulesOptions): Promise<void>;
@@ -232,8 +238,12 @@ export declare function queryReportMaterializedRows(reportCtor: new (...args: an
 
 export declare function refreshReport(reportCtor: ReportCtor_2, options?: ReportRefreshOptions): Promise<ReportRefreshResult>;
 
+export declare function registerReportRefreshExecutionAuthorityHost(hostId: string, host: ReportRefreshExecutionAuthorityHost): () => void;
+
 export declare function registerReportRefreshInterceptor(options: ReportRefreshInterceptorOptions): () => boolean;
 
+export declare function registerReportRefreshJobIntegritySigner(signer: DurableJobPayloadSigner): () => void;
+
 export declare function report(options: ReportOptions): <T extends abstract new (...args: any[]) => any>(ctor: T) => T;
 
 export declare const REPORT_LOCKS_TABLE = "_smrt_report_locks";
@@ -521,6 +531,15 @@ export declare interface ReportDrilldownQuery {
     inherits: Array<'principal' | 'tenant' | 'report-definition' | 'field-policy'>;
 }
 
+export declare interface ReportExecutionPrincipalReference {
+    version: 1;
+    actorUserId: string;
+    tenantId: string | null;
+    onBehalfOfUserId?: string | null;
+    actsAsProfileId?: string | null;
+    agentClass?: string | null;
+}
+
 export declare interface ReportExportActionContext {
     phase: 'preview' | 'apply';
     reportClassName: string;
@@ -824,8 +843,12 @@ export declare interface ReportRefreshActionDescriptor {
 
 /** Authority and audit stay with the application action host, not reports. */
 export declare interface ReportRefreshActionHost {
-    authorize(context: ReportRefreshActionContext): Promise<void> | void;
-    audit(context: ReportRefreshActionContext): Promise<void> | void;
+    authorize(context: ReportRefreshActionContext, authority?: ReportRefreshExecutionAuthority): Promise<void> | void;
+    audit(context: ReportRefreshActionContext, authority?: ReportRefreshExecutionAuthority): Promise<void> | void;
+    /** Capture only a non-secret identity reference for worker-time reauthorization. */
+    executionAuthority?(context: ReportRefreshActionContext): ReportRefreshExecutionAuthority | Promise<ReportRefreshExecutionAuthority>;
+    /** Server-only signer shared with report worker processes. */
+    jobIntegritySigner?(context: ReportRefreshActionContext): DurableJobPayloadSigner | Promise<DurableJobPayloadSigner>;
 }
 
 export declare interface ReportRefreshConfig {
@@ -860,6 +883,31 @@ export declare interface ReportRefreshDescriptor {
     action: ReportRefreshActionDescriptor;
 }
 
+export declare interface ReportRefreshExecutionAuditEvent extends ReportRefreshExecutionAuthorityContext {
+    outcome: 'allowed' | 'denied';
+    principal: ReportExecutionPrincipalReference;
+    reason?: string;
+}
+
+export declare interface ReportRefreshExecutionAuthority {
+    version: 1;
+    hostId: string;
+    principal: ReportExecutionPrincipalReference;
+}
+
+export declare interface ReportRefreshExecutionAuthorityContext {
+    phase: 'execute';
+    reportClass: string;
+    mode: ReportRefreshMode;
+    trigger: ReportRefreshTrigger;
+    tenantId: string | null;
+}
+
+export declare interface ReportRefreshExecutionAuthorityHost {
+    authorize(principal: Readonly<ReportExecutionPrincipalReference>, context: Readonly<ReportRefreshExecutionAuthorityContext>): Promise<void> | void;
+    audit(event: Readonly<ReportRefreshExecutionAuditEvent>): Promise<void> | void;
+}
+
 export declare interface ReportRefreshInterceptorOptions {
     db: DatabaseInterface;
     reports: ReportCtor_3[];
@@ -869,6 +917,7 @@ export declare interface ReportRefreshInterceptorOptions {
     timeout?: number;
     tenantJobCap?: number;
     name?: string;
+    integritySigner?: DurableJobPayloadSigner;
 }
 
 export declare interface ReportRefreshJobArgs {
@@ -881,6 +930,8 @@ export declare interface ReportRefreshJobArgs {
     adapterType?: SqlAdapterType;
     changedRows?: Record<string, unknown>[];
     _scheduleId?: string;
+    executionAuthority?: ReportRefreshExecutionAuthority;
+    integrity?: DurableJobPayloadIntegrity;
 }
 
 export declare interface ReportRefreshJobHandle {
@@ -1011,6 +1062,7 @@ export declare interface ReportScheduleRunnerConfig {
     id?: string;
     pollInterval?: number;
     batchSize?: number;
+    integritySigner?: DurableJobPayloadSigner;
 }
 
 export declare interface ReportScheduleRunnerEvents {
@@ -1051,6 +1103,11 @@ declare interface SavedViewInput {
 
 export declare function scopeKeyForTenant(tenantId: string | null | undefined): string;
 
+/** Worker target whose authority requirement cannot be downgraded by job args. */
+export declare class SmrtPrincipalReportRefreshTask extends SmrtReportRefreshTask {
+    run(args?: ReportRefreshJobArgs, context?: JobExecutionContext): Promise<unknown>;
+}
+
 export declare class SmrtReport extends SmrtObject {
     static readonly _isReportBase: true;
     refreshedAt: Date | null;
@@ -1108,7 +1165,7 @@ export declare class SmrtReportRefreshTask extends SmrtObject {
     mode: ReportRefreshMode;
     trigger: ReportRefreshTrigger;
     args: ReportRefreshJobArgs;
-    run(args?: ReportRefreshJobArgs): Promise<unknown>;
+    run(args?: ReportRefreshJobArgs, context?: JobExecutionContext): Promise<unknown>;
 }
 
 export declare class SmrtReportRun extends SmrtObject {

package/dist/index.js

@@ -2,7 +2,7 @@ import { aggregate, avg, count, day, getRuntimeReportOptions, groupBy, hour, max
 import { buildReportDefinition, compileReportDefinition, compileReportSpec, getReportGroupingColumns } from "./compiler.js";
 import { REPORT_LOCKS_TABLE, REPORT_REFRESH_TASKS_TABLE, REPORT_RUNS_TABLE, REPORT_RUNTIME_TABLES, REPORT_SCHEDULER_TABLES, REPORT_SCHEDULES_TABLE, REPORT_WATERMARKS_TABLE, SmrtReportLock, SmrtReportLockCollection, SmrtReportRun, SmrtReportRunCollection, SmrtReportSchedule, SmrtReportScheduleCollection, SmrtReportWatermark, SmrtReportWatermarkCollection, assertReportTablesReady, scopeKeyForTenant } from "./state.js";
 import { refreshReport, reportRowIdentity } from "./refresh.js";
-import { ReportScheduleRunner, SmrtReportRefreshTask, enqueueReportRefresh, ensureReportRefreshSchedules, registerReportRefreshInterceptor } from "./scheduler.js";
+import { ReportScheduleRunner, SmrtPrincipalReportRefreshTask, SmrtReportRefreshTask, enqueueReportRefresh, ensureReportRefreshSchedules, registerReportRefreshExecutionAuthorityHost, registerReportRefreshInterceptor, registerReportRefreshJobIntegritySigner } from "./scheduler.js";
 import { bucketExpr, buildAggregate } from "./aggregate.js";
 import { DataQueryValidationError, ObjectRegistry, SmrtCollection, SmrtObject, createDataQueryFingerprint, normalizeDataQueryRequest, normalizeDataQueryResult } from "@happyvertical/smrt-core";
 import { toSnakeCase } from "@happyvertical/smrt-core/utils";
@@ -159,8 +159,12 @@ async function previewReportRefresh(reportCtor, options) {
 async function applyReportRefresh(reportCtor, options) {
 	const mode = await actionMode(reportCtor, options.mode);
 	const action = actionContext$1(reportCtor, "apply", mode, options.refreshAction);
-	await options.host.authorize(action);
-	await options.host.audit(action);
+	const executionAuthority = await options.host.executionAuthority?.(action);
+	if (!executionAuthority) throw new Error("Manual report refresh requires execution-time authority");
+	await options.host.authorize(action, executionAuthority);
+	await options.host.audit(action, executionAuthority);
+	const integritySigner = options.jobIntegritySigner ?? await options.host.jobIntegritySigner?.(action);
+	if (!integritySigner) throw new Error("Report refresh queue requires a durable job integrity signer");
 	const tenantId = lifecycleTenantId(reportCtor);
 	const enqueue = () => enqueueReportRefresh({
 		db: options.db,
@@ -168,11 +172,13 @@ async function applyReportRefresh(reportCtor, options) {
 		mode,
 		trigger: "manual",
 		tenantId,
+		executionAuthority,
 		queue: options.queue,
 		priority: options.priority,
 		timeout: options.timeout,
 		maxAttempts: options.maxAttempts,
-		tenantJobCap: options.tenantJobCap
+		tenantJobCap: options.tenantJobCap,
+		integritySigner
 	});
 	return {
 		phase: "apply",
@@ -1509,6 +1515,6 @@ function validateReportExportArtifact(descriptor, artifact, now = /* @__PURE__ *
 	};
 }
 //#endregion
-export { REPORT_LOCKS_TABLE, REPORT_REFRESH_TASKS_TABLE, REPORT_RUNS_TABLE, REPORT_RUNTIME_TABLES, REPORT_SCHEDULER_TABLES, REPORT_SCHEDULES_TABLE, REPORT_WATERMARKS_TABLE, ReportScheduleRunner, ReportSurfaceValidationError, SmrtReport, SmrtReportCollection, SmrtReportLock, SmrtReportLockCollection, SmrtReportRefreshTask, SmrtReportRun, SmrtReportRunCollection, SmrtReportSchedule, SmrtReportScheduleCollection, SmrtReportWatermark, SmrtReportWatermarkCollection, aggregate, applyReportExport, applyReportRefresh, assertReportTablesReady, avg, bucketExpr, buildAggregate, buildReportAdapterDescriptor, buildReportDefinition, buildReportDrilldownQuery, compileReportDefinition, compileReportSpec, count, createReportExportPageRequest, createReportExportRequest, createReportExportSnapshot, day, enqueueReportRefresh, ensureReportRefreshSchedules, getReportGroupingColumns, getReportLifecycle, getRuntimeReportOptions, groupBy, hour, max, migrateReportSavedView, min, minute, month, normalizeReportSavedView, previewReportExport, previewReportRefresh, quarter, queryReportMaterializedRows, refreshReport, registerReportRefreshInterceptor, report, reportDefinitionFingerprint, reportMaterializedRowKey, reportRefreshOutcome, reportRowIdentity, restoreReportSavedView, scopeKeyForTenant, splitReportFilterScopes, sum, validateReportExportArtifact, validateReportExportExecution, validateReportExportRequest, verifyReportExportSnapshot, week, year };
+export { REPORT_LOCKS_TABLE, REPORT_REFRESH_TASKS_TABLE, REPORT_RUNS_TABLE, REPORT_RUNTIME_TABLES, REPORT_SCHEDULER_TABLES, REPORT_SCHEDULES_TABLE, REPORT_WATERMARKS_TABLE, ReportScheduleRunner, ReportSurfaceValidationError, SmrtPrincipalReportRefreshTask, SmrtReport, SmrtReportCollection, SmrtReportLock, SmrtReportLockCollection, SmrtReportRefreshTask, SmrtReportRun, SmrtReportRunCollection, SmrtReportSchedule, SmrtReportScheduleCollection, SmrtReportWatermark, SmrtReportWatermarkCollection, aggregate, applyReportExport, applyReportRefresh, assertReportTablesReady, avg, bucketExpr, buildAggregate, buildReportAdapterDescriptor, buildReportDefinition, buildReportDrilldownQuery, compileReportDefinition, compileReportSpec, count, createReportExportPageRequest, createReportExportRequest, createReportExportSnapshot, day, enqueueReportRefresh, ensureReportRefreshSchedules, getReportGroupingColumns, getReportLifecycle, getRuntimeReportOptions, groupBy, hour, max, migrateReportSavedView, min, minute, month, normalizeReportSavedView, previewReportExport, previewReportRefresh, quarter, queryReportMaterializedRows, refreshReport, registerReportRefreshExecutionAuthorityHost, registerReportRefreshInterceptor, registerReportRefreshJobIntegritySigner, report, reportDefinitionFingerprint, reportMaterializedRowKey, reportRefreshOutcome, reportRowIdentity, restoreReportSavedView, scopeKeyForTenant, splitReportFilterScopes, sum, validateReportExportArtifact, validateReportExportExecution, validateReportExportRequest, verifyReportExportSnapshot, week, year };
 
 //# sourceMappingURL=index.js.map