@hotmeshio/long-tail 0.23.1 → 0.24.0

package/build/api/tasks.js

@@ -41,6 +41,24 @@ exports.getProcess = getProcess;
 exports.getTask = getTask;
 const taskService = __importStar(require("../services/task"));
 const escalationService = __importStar(require("../services/escalation"));
+const helpers_1 = require("./escalations/helpers");
+const capabilities_1 = require("../modules/capabilities");
+/**
+ * How a caller sees task rows. A builder, and the person a run was started by
+ * or runs as, see the whole row; anyone else sees it without the run's input
+ * (`envelope`), output (`data`) and `metadata`. An in-process call (no auth)
+ * sees whole rows.
+ */
+async function taskViewFor(auth) {
+    if (!auth?.userId || (await (0, capabilities_1.mayBuild)(auth)))
+        return (task) => task;
+    return (task) => {
+        if (task.initiated_by === auth.userId || task.executing_as === auth.userId)
+            return task;
+        const { envelope: _envelope, data: _data, metadata: _metadata, ...rest } = task;
+        return rest;
+    };
+}
 /**
  * Create a task record.
  *
@@ -104,10 +122,10 @@ async function createTask(input, auth) {
  * @param input.offset — pagination offset (default: 0)
  * @returns `{ status: 200, data: { tasks, total } }`
  */
-async function listTasks(input) {
+async function listTasks(input, auth) {
     try {
-        const result = await taskService.listTasks(input);
-        return { status: 200, data: result };
+        const [result, view] = await Promise.all([taskService.listTasks(input), taskViewFor(auth)]);
+        return { status: 200, data: { ...result, tasks: result.tasks.map(view) } };
     }
     catch (err) {
         return { status: 500, error: err.message };
@@ -153,12 +171,17 @@ async function listProcesses(input) {
  * @param input.originId — root process origin ID
  * @returns `{ status: 200, data: { origin_id, tasks, escalations } }`
  */
-async function getProcess(input) {
+async function getProcess(input, auth) {
     try {
-        const [tasks, escalations] = await Promise.all([
+        const [rows, all, view] = await Promise.all([
             taskService.getProcessTasks(input.originId),
             escalationService.getEscalationsByOriginId(input.originId),
+            taskViewFor(auth),
         ]);
+        const tasks = rows.map(view);
+        // With a caller, only the escalations that caller may read.
+        const scope = auth?.userId ? await (0, helpers_1.getEscalationReadScope)(auth.userId) : null;
+        const escalations = scope ? all.filter((e) => (0, helpers_1.scopeAdmits)(scope, auth.userId, e)) : all;
         return {
             status: 200,
             data: { origin_id: input.originId, tasks, escalations },
@@ -174,13 +197,13 @@ async function getProcess(input) {
  * @param input.id — task UUID
  * @returns `{ status: 200, data: <task record> }` or 404
  */
-async function getTask(input) {
+async function getTask(input, auth) {
     try {
         const task = await taskService.getTask(input.id);
         if (!task) {
             return { status: 404, error: 'Task not found' };
         }
-        return { status: 200, data: task };
+        return { status: 200, data: (await taskViewFor(auth))(task) };
     }
     catch (err) {
         return { status: 500, error: err.message };

package/build/api/workflows/input-lookups.js

@@ -57,7 +57,7 @@ async function getWorkflowInputLookups(input, auth) {
             return { status: 404, error: 'Workflow config not found' };
         }
         const user = auth.userId ? await userService.getUser(auth.userId) : null;
-        if (!(0, invocation_access_1.canInvokeWorkflow)(config, user?.roles ?? [], auth.role)) {
+        if (!(0, invocation_access_1.canInvokeWorkflow)(config, user?.roles ?? [])) {
             return { status: 403, error: 'Not authorized to invoke this workflow' };
         }
         const lookups = await (0, knowledge_1.resolveLookupRefs)(config.input_lookups ?? []);

package/build/api/workflows/invocable.js

@@ -88,9 +88,9 @@ async function listInvocableWorkflows(auth) {
         ]);
         const roles = user?.roles ?? [];
         const workflows = configs
-            .filter((c) => (0, invocation_access_1.canInvokeWorkflow)(c, roles, auth.role))
+            .filter((c) => (0, invocation_access_1.canInvokeWorkflow)(c, roles))
             .map((c) => ({ ...c, tier: tierOf(c) }));
-        if ((0, invocation_access_1.hasGlobalInvocationAccess)(roles, auth.role)) {
+        if ((0, invocation_access_1.hasGlobalInvocationAccess)(roles)) {
             const registered = new Set(configs.map((c) => c.workflow_type));
             for (const [name, { taskQueue }] of (0, registry_1.getRegisteredWorkers)()) {
                 if (registered.has(name) || registry_1.SYSTEM_WORKFLOWS.has(name))

package/build/api/workflows/invocation.js

@@ -62,7 +62,7 @@ function isResolveError(err) {
  */
 async function invokeWorkflow(input, auth) {
     try {
-        await (0, workflow_invocation_1.checkInvocationRoles)(input.type, auth.userId, auth.role);
+        await (0, workflow_invocation_1.authorizeInvocation)({ workflowType: input.type, userId: auth.userId, executeAs: input.execute_as });
         const config = await configService.getWorkflowConfig(input.type);
         const violation = await (0, input_validation_1.checkInvokeInput)(config, input.data, input.metadata);
         if (violation)

package/build/api/yaml-workflows/deploy.d.ts

@@ -1,3 +1,11 @@
+import type { LTYamlWorkflowRecord } from '../../types/yaml-workflow';
+/**
+ * A compiled workflow's tool steps run with lt-system authority. Deploying or
+ * activating one needs the caller to be able to call every built-in tool it
+ * uses: automation never does more than its author may. Null when allowed;
+ * without a caller (in-process), allowed.
+ */
+export declare function deployRefusal(wf: LTYamlWorkflowRecord, auth: LTApiAuth | undefined): Promise<LTApiResult | null>;
 import type { LTApiResult, LTApiAuth } from '../../types/sdk';
 /**
  * Deploy a YAML workflow and all sibling workflows sharing its app_id namespace.
@@ -11,7 +19,7 @@ import type { LTApiResult, LTApiAuth } from '../../types/sdk';
  */
 export declare function deployYamlWorkflow(input: {
     id: string;
-}): Promise<LTApiResult>;
+}, auth?: LTApiAuth): Promise<LTApiResult>;
 /**
  * Activate a previously deployed YAML workflow and its app_id siblings.
  *
@@ -24,7 +32,7 @@ export declare function deployYamlWorkflow(input: {
  */
 export declare function activateYamlWorkflow(input: {
     id: string;
-}): Promise<LTApiResult>;
+}, auth?: LTApiAuth): Promise<LTApiResult>;
 /**
  * Invoke an active YAML workflow, executing its DAG pipeline.
  *

package/build/api/yaml-workflows/deploy.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.deployRefusal = deployRefusal;
 exports.deployYamlWorkflow = deployYamlWorkflow;
 exports.activateYamlWorkflow = activateYamlWorkflow;
 exports.invokeYamlWorkflow = invokeYamlWorkflow;
@@ -42,6 +43,32 @@ const yamlDb = __importStar(require("../../services/yaml-workflow/db"));
 const yamlDeployer = __importStar(require("../../services/yaml-workflow/deployer"));
 const yamlWorkers = __importStar(require("../../services/yaml-workflow/workers"));
 const invoke_1 = require("../../services/yaml-workflow/invoke");
+const workflow_invocation_1 = require("../../services/workflow-invocation");
+const capabilities_1 = require("../../modules/capabilities");
+const tools_1 = require("../mcp/tools");
+/**
+ * A compiled workflow's tool steps run with lt-system authority. Deploying or
+ * activating one needs the caller to be able to call every built-in tool it
+ * uses: automation never does more than its author may. Null when allowed;
+ * without a caller (in-process), allowed.
+ */
+async function deployRefusal(wf, auth) {
+    if (!auth?.userId)
+        return null;
+    const access = (0, capabilities_1.capabilityAccess)({ userId: auth.userId });
+    // A deploy publishes every workflow sharing the app id, so every one is checked.
+    const siblings = await yamlDb.listYamlWorkflowsByAppId(wf.app_id);
+    const steps = [wf, ...siblings.filter((w) => w.id !== wf.id)].flatMap((w) => w.activity_manifest ?? []);
+    for (const step of steps) {
+        if (step.tool_source !== 'mcp' || !step.mcp_server_id || !step.mcp_tool_name)
+            continue;
+        const builtin = await (0, tools_1.builtinServerFor)(step.mcp_server_id);
+        if (builtin && !(await access((0, tools_1.builtinToolGate)(builtin, step.mcp_tool_name)))) {
+            return { status: 403, error: `Forbidden: this workflow calls ${step.mcp_tool_name}, which is not available to you` };
+        }
+    }
+    return null;
+}
 const helpers_1 = require("./helpers");
 /**
  * Deploy a YAML workflow and all sibling workflows sharing its app_id namespace.
@@ -53,12 +80,15 @@ const helpers_1 = require("./helpers");
  * @param input.id — UUID of the workflow to deploy
  * @returns `{ status: 200, data: YamlWorkflow }` the refreshed workflow record after deployment
  */
-async function deployYamlWorkflow(input) {
+async function deployYamlWorkflow(input, auth) {
     try {
         const wf = await yamlDb.getYamlWorkflow(input.id);
         if (!wf) {
             return { status: 404, error: 'YAML workflow not found' };
         }
+        const refused = await deployRefusal(wf, auth);
+        if (refused)
+            return refused;
         // Compute the next app-level version for the namespace.
         // Each deploy increments regardless of individual tool versions —
         // adding a second tool (v1 of itself) to an app already at v1 produces app v2.
@@ -99,12 +129,15 @@ async function deployYamlWorkflow(input) {
  * @param input.id — UUID of the workflow to activate
  * @returns `{ status: 200, data: YamlWorkflow }` the refreshed workflow record after activation
  */
-async function activateYamlWorkflow(input) {
+async function activateYamlWorkflow(input, auth) {
     try {
         const wf = await yamlDb.getYamlWorkflow(input.id);
         if (!wf) {
             return { status: 404, error: 'YAML workflow not found' };
         }
+        const refused = await deployRefusal(wf, auth);
+        if (refused)
+            return refused;
         if (wf.status !== 'deployed' && wf.status !== 'active') {
             return { status: 400, error: 'Workflow must be deployed before activation' };
         }
@@ -151,6 +184,11 @@ async function invokeYamlWorkflow(input, auth) {
         if (wf.status !== 'active') {
             return { status: 400, error: 'Workflow must be active to invoke' };
         }
+        if (input.execute_as) {
+            if (!auth?.userId)
+                return { status: 403, error: 'execute_as requires an authenticated caller' };
+            await (0, workflow_invocation_1.assertMayActAs)(auth.userId, input.execute_as);
+        }
         const result = await (0, invoke_1.invokeYamlWorkflow)(wf, {
             data: input.data,
             sync: input.sync,
@@ -161,6 +199,8 @@ async function invokeYamlWorkflow(input, auth) {
         return { status: 200, data: result };
     }
     catch (err) {
+        if (err instanceof workflow_invocation_1.InvocationError)
+            return { status: err.statusCode, error: err.message };
         if ((0, helpers_1.isNotFoundError)(err)) {
             return { status: 404, error: 'YAML workflow not found' };
         }

package/build/lib/db/schemas/038_oauth_server.sql

@@ -0,0 +1,46 @@
+-- Migration 038: OAuth authorization server for /mcp
+--
+-- MCP clients register, a person consents to a grant, and the client holds a
+-- refresh token for that grant. Access tokens are self-contained JWTs and are
+-- never stored. Codes and refresh tokens are stored as SHA-256 hashes.
+
+CREATE TABLE IF NOT EXISTS lt_oauth_clients (
+  client_id     TEXT PRIMARY KEY,
+  client_name   TEXT,
+  redirect_uris TEXT[] NOT NULL,
+  created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- A grant is one person's consent for one client. The policy is the rights
+-- the person chose (a preset today); the scope is its coarse summary.
+CREATE TABLE IF NOT EXISTS lt_oauth_grants (
+  id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id    UUID NOT NULL REFERENCES lt_users(id) ON DELETE CASCADE,
+  client_id  TEXT NOT NULL REFERENCES lt_oauth_clients(client_id) ON DELETE CASCADE,
+  policy     JSONB NOT NULL,
+  scope      TEXT NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  revoked_at TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS idx_lt_oauth_grants_user ON lt_oauth_grants (user_id);
+
+CREATE TABLE IF NOT EXISTS lt_oauth_codes (
+  code_hash      TEXT PRIMARY KEY,
+  grant_id       UUID NOT NULL REFERENCES lt_oauth_grants(id) ON DELETE CASCADE,
+  redirect_uri   TEXT NOT NULL,
+  code_challenge TEXT NOT NULL,
+  resource       TEXT,
+  expires_at     TIMESTAMPTZ NOT NULL,
+  used_at        TIMESTAMPTZ
+);
+
+CREATE TABLE IF NOT EXISTS lt_oauth_refresh_tokens (
+  token_hash TEXT PRIMARY KEY,
+  grant_id   UUID NOT NULL REFERENCES lt_oauth_grants(id) ON DELETE CASCADE,
+  expires_at TIMESTAMPTZ NOT NULL,
+  used_at    TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_lt_oauth_refresh_tokens_grant ON lt_oauth_refresh_tokens (grant_id);

package/build/lib/events/browser-view.d.ts

@@ -0,0 +1,15 @@
+import type { LTEvent } from '../../types';
+/** Escalation event fields a browser needs to route a refresh and follow a claim. */
+export declare const BROWSER_ESCALATION_FIELDS: readonly ["id", "type", "subtype", "status", "priority", "role", "assigned_to", "assigned_until", "workflow_id", "workflow_type", "origin_id", "task_id", "parent_id", "resolved_at", "claimed_at", "bulk", "from_role", "to_role", "reassigned_from"];
+export interface BrowserViewer {
+    builder: boolean;
+}
+/** The event as this viewer receives it. */
+export declare function eventForViewer(event: LTEvent, viewer: BrowserViewer): LTEvent;
+/**
+ * Rewrite one serialized event for a viewer who is not a builder. A payload
+ * that is not an event is withheld (null).
+ */
+export declare function payloadForViewer(payload: Buffer, viewer: BrowserViewer): Buffer | null;
+/** Whether a person is a builder, looked up lazily to keep lib free of an import cycle. */
+export declare function viewerFor(userId: string | null | undefined): Promise<BrowserViewer>;

package/build/lib/events/browser-view.js

@@ -0,0 +1,101 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BROWSER_ESCALATION_FIELDS = void 0;
+exports.eventForViewer = eventForViewer;
+exports.payloadForViewer = payloadForViewer;
+exports.viewerFor = viewerFor;
+/**
+ * What a browser receives of an event. Builders receive events whole. Anyone
+ * else receives enough to route and refresh: escalation events keep their
+ * routing fields, and every other event arrives without `data` and
+ * `milestones`. Full records are read through the scoped API, by id.
+ *
+ * Server-side consumers (agent triggers, callbacks) are unaffected: this view
+ * applies only where events leave for a browser.
+ */
+const ESCALATION_SUBJECT = 'system.escalation.';
+/** Escalation event fields a browser needs to route a refresh and follow a claim. */
+exports.BROWSER_ESCALATION_FIELDS = [
+    'id', 'type', 'subtype', 'status', 'priority', 'role',
+    'assigned_to', 'assigned_until', 'workflow_id', 'workflow_type',
+    'origin_id', 'task_id', 'parent_id', 'resolved_at', 'claimed_at',
+    'bulk', 'from_role', 'to_role', 'reassigned_from',
+];
+/** The event as this viewer receives it. */
+function eventForViewer(event, viewer) {
+    if (viewer.builder)
+        return event;
+    const { data, milestones: _milestones, ...rest } = event;
+    if (typeof event.type === 'string' && event.type.startsWith(ESCALATION_SUBJECT) && data) {
+        const kept = {};
+        for (const key of exports.BROWSER_ESCALATION_FIELDS) {
+            if (data[key] !== undefined)
+                kept[key] = data[key];
+        }
+        return { ...rest, data: kept };
+    }
+    return rest;
+}
+/**
+ * Rewrite one serialized event for a viewer who is not a builder. A payload
+ * that is not an event is withheld (null).
+ */
+function payloadForViewer(payload, viewer) {
+    if (viewer.builder)
+        return payload;
+    let event;
+    try {
+        event = JSON.parse(payload.toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (!event || typeof event !== 'object' || typeof event.type !== 'string')
+        return null;
+    return Buffer.from(JSON.stringify(eventForViewer(event, viewer)), 'utf8');
+}
+/** Whether a person is a builder, looked up lazily to keep lib free of an import cycle. */
+async function viewerFor(userId) {
+    if (!userId)
+        return { builder: false };
+    try {
+        const { mayBuild } = await Promise.resolve().then(() => __importStar(require('../../modules/capabilities')));
+        return { builder: await mayBuild({ userId }) };
+    }
+    catch {
+        return { builder: false };
+    }
+}

package/build/lib/events/nats-ws-filter.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The browser's half of a NATS connection, as the WebSocket proxy forwards
+ * it. A browser only subscribes, so the proxy authenticates the connection
+ * itself and lets the browser read, never publish:
+ *
+ * - CONNECT is rewritten to carry the server's credential (the browser is
+ *   never given it), keeping the client's other options.
+ * - PUB and HPUB are dropped with their payloads.
+ * - SUB, UNSUB, PING and PONG pass through unchanged.
+ *
+ * The NATS client protocol is line-oriented (`OP args\r\n`), and a publish is
+ * followed by a payload of a declared size. Operations can span WebSocket
+ * frames, so the filter keeps whatever it has not yet seen whole.
+ */
+export declare class NatsClientFilter {
+    private readonly authToken;
+    private pending;
+    /** Payload bytes (plus the trailing CRLF) of a dropped publish still to skip. */
+    private skip;
+    private failed;
+    constructor(authToken: string | null);
+    /** Whether the stream was malformed; the proxy closes the connection. */
+    get malformed(): boolean;
+    /** The bytes to forward upstream for one chunk from the browser. */
+    feed(chunk: Buffer): Buffer;
+    /** The line to forward, or null to drop it. */
+    private filterLine;
+    private rewriteConnect;
+}

package/build/lib/events/nats-ws-filter.js

@@ -0,0 +1,94 @@
+"use strict";
+/**
+ * The browser's half of a NATS connection, as the WebSocket proxy forwards
+ * it. A browser only subscribes, so the proxy authenticates the connection
+ * itself and lets the browser read, never publish:
+ *
+ * - CONNECT is rewritten to carry the server's credential (the browser is
+ *   never given it), keeping the client's other options.
+ * - PUB and HPUB are dropped with their payloads.
+ * - SUB, UNSUB, PING and PONG pass through unchanged.
+ *
+ * The NATS client protocol is line-oriented (`OP args\r\n`), and a publish is
+ * followed by a payload of a declared size. Operations can span WebSocket
+ * frames, so the filter keeps whatever it has not yet seen whole.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NatsClientFilter = void 0;
+const CRLF = Buffer.from('\r\n');
+const MAX_LINE = 64 * 1024;
+class NatsClientFilter {
+    constructor(authToken) {
+        this.authToken = authToken;
+        this.pending = Buffer.alloc(0);
+        /** Payload bytes (plus the trailing CRLF) of a dropped publish still to skip. */
+        this.skip = 0;
+        this.failed = false;
+    }
+    /** Whether the stream was malformed; the proxy closes the connection. */
+    get malformed() {
+        return this.failed;
+    }
+    /** The bytes to forward upstream for one chunk from the browser. */
+    feed(chunk) {
+        if (this.failed)
+            return Buffer.alloc(0);
+        this.pending = this.pending.length ? Buffer.concat([this.pending, chunk]) : chunk;
+        const out = [];
+        for (;;) {
+            if (this.skip > 0) {
+                const n = Math.min(this.skip, this.pending.length);
+                this.pending = this.pending.subarray(n);
+                this.skip -= n;
+                if (this.skip > 0)
+                    break;
+            }
+            const end = this.pending.indexOf(CRLF);
+            if (end === -1) {
+                if (this.pending.length > MAX_LINE)
+                    this.failed = true;
+                break;
+            }
+            const line = this.pending.subarray(0, end).toString('utf8');
+            this.pending = this.pending.subarray(end + CRLF.length);
+            const forwarded = this.filterLine(line);
+            if (this.failed)
+                return Buffer.alloc(0);
+            if (forwarded !== null)
+                out.push(Buffer.from(`${forwarded}\r\n`, 'utf8'));
+        }
+        return Buffer.concat(out);
+    }
+    /** The line to forward, or null to drop it. */
+    filterLine(line) {
+        const space = line.indexOf(' ');
+        const op = (space === -1 ? line : line.slice(0, space)).toUpperCase();
+        const args = space === -1 ? '' : line.slice(space + 1);
+        if (op === 'CONNECT')
+            return this.rewriteConnect(args);
+        if (op === 'PUB' || op === 'HPUB') {
+            // PUB <subject> [reply] <size>; HPUB <subject> [reply] <header size> <total size>
+            const size = Number(args.trim().split(/\s+/).pop());
+            if (!Number.isInteger(size) || size < 0) {
+                this.failed = true;
+                return null;
+            }
+            this.skip = size + CRLF.length;
+            return null;
+        }
+        return line;
+    }
+    rewriteConnect(json) {
+        let options;
+        try {
+            options = JSON.parse(json);
+        }
+        catch {
+            this.failed = true;
+            return null;
+        }
+        const { auth_token: _token, user: _user, pass: _pass, jwt: _jwt, nkey: _nkey, sig: _sig, ...rest } = options;
+        return `CONNECT ${JSON.stringify(this.authToken ? { ...rest, auth_token: this.authToken } : rest)}`;
+    }
+}
+exports.NatsClientFilter = NatsClientFilter;

package/build/lib/events/nats-ws-proxy.d.ts

@@ -25,4 +25,6 @@ export declare function deriveWsUrlFromRequest(req: {
 export declare function attachNatsWsProxy(server: HttpServer, target: string, options?: {
     basePath?: string;
     onWsUrlDerived?: (url: string) => void;
+    /** The NATS server credential, written into each browser's CONNECT by the proxy. */
+    authToken?: string | null;
 }): void;

package/build/lib/events/nats-ws-proxy.js

@@ -5,6 +5,10 @@ exports.deriveWsUrlFromRequest = deriveWsUrlFromRequest;
 exports.attachNatsWsProxy = attachNatsWsProxy;
 const ws_1 = require("ws");
 const logger_1 = require("../logger");
+const nats_ws_filter_1 = require("./nats-ws-filter");
+const nats_ws_server_filter_1 = require("./nats-ws-server-filter");
+const browser_view_1 = require("./browser-view");
+const nats_ws_ticket_1 = require("./nats-ws-ticket");
 /** Default path for the NATS WebSocket proxy endpoint. */
 exports.NATS_WS_PROXY_PATH = '/nats-ws';
 /**
@@ -36,8 +40,21 @@ function attachNatsWsProxy(server, target, options = {}) {
     const proxyPath = `${basePath}${exports.NATS_WS_PROXY_PATH}`;
     const wss = new ws_1.WebSocketServer({ noServer: true });
     let derived = false;
-    server.on('upgrade', (req, socket, head) => {
-        if (req.url !== proxyPath)
+    server.on('upgrade', async (req, socket, head) => {
+        const url = new URL(req.url ?? '/', 'http://proxy');
+        if (url.pathname !== proxyPath)
+            return;
+        // Only a signed-in person, holding the ticket the credentials route issued.
+        const userId = (0, nats_ws_ticket_1.verifyNatsWsTicket)(url.searchParams.get(nats_ws_ticket_1.NATS_WS_TICKET_PARAM));
+        if (!userId) {
+            socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
+            socket.destroy();
+            return;
+        }
+        // Decided once per connection: a builder receives events whole, anyone
+        // else receives the browser view (lib/events/browser-view.ts).
+        const viewer = await (0, browser_view_1.viewerFor)(userId);
+        if (socket.destroyed)
             return;
         // Derive the public wsUrl from the first request's headers
         if (!derived && options.onWsUrlDerived) {
@@ -46,14 +63,31 @@ function attachNatsWsProxy(server, target, options = {}) {
         }
         wss.handleUpgrade(req, socket, head, (clientWs) => {
             const upstream = new ws_1.WebSocket(target);
+            // The browser reads; the proxy holds the credential and drops its publishes.
+            const filter = new nats_ws_filter_1.NatsClientFilter(options.authToken ?? null);
+            const inbound = viewer.builder ? null : new nats_ws_server_filter_1.NatsServerFilter((payload) => (0, browser_view_1.payloadForViewer)(payload, viewer));
             upstream.on('open', () => {
                 clientWs.on('message', (data) => {
-                    if (upstream.readyState === ws_1.WebSocket.OPEN)
-                        upstream.send(data);
+                    const chunk = Buffer.isBuffer(data) ? data : Buffer.from(data);
+                    const forward = filter.feed(chunk);
+                    if (filter.malformed) {
+                        clientWs.close();
+                        return;
+                    }
+                    if (forward.length && upstream.readyState === ws_1.WebSocket.OPEN)
+                        upstream.send(forward);
                 });
                 upstream.on('message', (data) => {
-                    if (clientWs.readyState === ws_1.WebSocket.OPEN)
+                    if (clientWs.readyState !== ws_1.WebSocket.OPEN)
+                        return;
+                    if (!inbound) {
                         clientWs.send(data);
+                        return;
+                    }
+                    const chunk = Buffer.isBuffer(data) ? data : Buffer.from(data);
+                    const forward = inbound.feed(chunk);
+                    if (forward.length)
+                        clientWs.send(forward);
                 });
             });
             const close = () => {

package/build/lib/events/nats-ws-server-filter.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The server's half of a browser's NATS connection, as the WebSocket proxy
+ * forwards it. Message payloads (MSG and HMSG) pass through `rewrite`, which
+ * returns the payload to deliver or null to withhold the message; protocol
+ * lines (INFO, PING, PONG, +OK, -ERR) pass unchanged.
+ *
+ * Operations can span WebSocket frames, so the filter keeps whatever it has
+ * not yet seen whole.
+ */
+export declare class NatsServerFilter {
+    private readonly rewrite;
+    private pending;
+    constructor(rewrite: (payload: Buffer) => Buffer | null);
+    /** The bytes to forward to the browser for one chunk from the server. */
+    feed(chunk: Buffer): Buffer;
+}