@hotmeshio/long-tail 0.23.2 → 0.24.1

package/build/lib/events/nats-ws-filter.js

@@ -0,0 +1,109 @@
+"use strict";
+/**
+ * The browser's half of a NATS connection, as the WebSocket proxy forwards
+ * it. A browser only subscribes, so the proxy authenticates the connection
+ * itself and lets the browser read, never publish:
+ *
+ * - CONNECT is rewritten to carry the server's credential (the browser is
+ *   never given it), keeping the client's other options.
+ * - SUB, UNSUB, PING and PONG are forwarded, rebuilt from their parsed fields.
+ * - Any other operation, PUB and HPUB included, marks the stream malformed
+ *   and the proxy closes the connection.
+ *
+ * The filter reads lines as nats-server does: fields split on spaces or tabs,
+ * and a line ends at LF with or without a preceding CR. Operations can span
+ * WebSocket frames, so the filter keeps whatever it has not yet seen whole.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NatsClientFilter = void 0;
+const LF = 0x0a;
+const MAX_LINE = 64 * 1024;
+const FIELD_DELIMITER = /[ \t]+/;
+/** The operation name and its argument text. */
+const OPERATION = /^[ \t]*([^ \t]+)[ \t]*(.*)$/s;
+/** Control characters other than tab never appear inside a client line. */
+const CONTROL_CHARACTER = /[\x00-\x08\x0a-\x1f\x7f]/;
+/** Client operations forwarded, with the number of fields each takes. */
+const ALLOWED_OPS = {
+    SUB: { min: 2, max: 3 },
+    UNSUB: { min: 1, max: 2 },
+    PING: { min: 0, max: 0 },
+    PONG: { min: 0, max: 0 },
+};
+class NatsClientFilter {
+    constructor(authToken) {
+        this.authToken = authToken;
+        this.pending = Buffer.alloc(0);
+        this.failed = false;
+    }
+    /** Whether the stream was malformed; the proxy closes the connection. */
+    get malformed() {
+        return this.failed;
+    }
+    /** The bytes to forward upstream for one chunk from the browser. */
+    feed(chunk) {
+        if (this.failed)
+            return Buffer.alloc(0);
+        this.pending = this.pending.length ? Buffer.concat([this.pending, chunk]) : chunk;
+        const out = [];
+        for (;;) {
+            const end = this.pending.indexOf(LF);
+            if (end === -1) {
+                if (this.pending.length > MAX_LINE)
+                    return this.fail();
+                break;
+            }
+            const raw = this.pending.subarray(0, end > 0 && this.pending[end - 1] === 0x0d ? end - 1 : end);
+            this.pending = this.pending.subarray(end + 1);
+            const forwarded = this.filterLine(raw.toString('utf8'));
+            if (this.failed)
+                return Buffer.alloc(0);
+            if (forwarded !== null)
+                out.push(Buffer.from(`${forwarded}\r\n`, 'utf8'));
+        }
+        return Buffer.concat(out);
+    }
+    fail() {
+        this.failed = true;
+        this.pending = Buffer.alloc(0);
+        return Buffer.alloc(0);
+    }
+    /** The line to forward, or null to forward nothing. */
+    filterLine(line) {
+        if (CONTROL_CHARACTER.test(line)) {
+            this.failed = true;
+            return null;
+        }
+        const match = OPERATION.exec(line);
+        if (!match)
+            return null;
+        const op = match[1].toUpperCase();
+        const rest = match[2];
+        if (op === 'CONNECT')
+            return this.rewriteConnect(rest);
+        const shape = ALLOWED_OPS[op];
+        const fields = rest === '' ? [] : rest.split(FIELD_DELIMITER).filter(Boolean);
+        if (!shape || fields.length < shape.min || fields.length > shape.max) {
+            this.failed = true;
+            return null;
+        }
+        return [op, ...fields].join(' ');
+    }
+    rewriteConnect(json) {
+        let options;
+        try {
+            options = JSON.parse(json);
+        }
+        catch {
+            this.failed = true;
+            return null;
+        }
+        if (!options || typeof options !== 'object' || Array.isArray(options)) {
+            this.failed = true;
+            return null;
+        }
+        const { auth_token: _token, user: _user, pass: _pass, jwt: _jwt, nkey: _nkey, sig: _sig, ...rest } = options;
+        return `CONNECT ${JSON.stringify(this.authToken ? { ...rest, auth_token: this.authToken } : rest)}`;
+    }
+}
+exports.NatsClientFilter = NatsClientFilter;

package/build/lib/events/nats-ws-proxy.d.ts

@@ -18,6 +18,11 @@ export declare function deriveWsUrlFromRequest(req: {
  * through an ALB or reverse proxy). This handler upgrades the connection
  * and bridges bidirectionally to the internal NATS WS target.
  *
+ * A connection needs an unspent ticket for an active account. The holder's
+ * account is rechecked every NATS_WS_RECHECK_SECONDS; a deactivation or a
+ * change in builder access closes the connection, and the dashboard
+ * reconnects with fresh credentials.
+ *
  * The proxy auto-derives the public `wsUrl` from the first incoming
  * request's headers, respecting `X-Forwarded-Proto` and `X-Forwarded-Host`
  * so the correct `wss://` scheme is used behind TLS-terminating load balancers.
@@ -25,4 +30,6 @@ export declare function deriveWsUrlFromRequest(req: {
 export declare function attachNatsWsProxy(server: HttpServer, target: string, options?: {
     basePath?: string;
     onWsUrlDerived?: (url: string) => void;
+    /** The NATS server credential, written into each browser's CONNECT by the proxy. */
+    authToken?: string | null;
 }): void;

package/build/lib/events/nats-ws-proxy.js

@@ -5,6 +5,11 @@ exports.deriveWsUrlFromRequest = deriveWsUrlFromRequest;
 exports.attachNatsWsProxy = attachNatsWsProxy;
 const ws_1 = require("ws");
 const logger_1 = require("../logger");
+const nats_ws_filter_1 = require("./nats-ws-filter");
+const nats_ws_server_filter_1 = require("./nats-ws-server-filter");
+const config_1 = require("../../modules/config");
+const browser_view_1 = require("./browser-view");
+const nats_ws_ticket_1 = require("./nats-ws-ticket");
 /** Default path for the NATS WebSocket proxy endpoint. */
 exports.NATS_WS_PROXY_PATH = '/nats-ws';
 /**
@@ -19,6 +24,31 @@ function deriveWsUrlFromRequest(req, basePath = '') {
     const host = req.headers['x-forwarded-host'] || req.headers.host || 'localhost';
     return `${scheme}://${host}${basePath}${exports.NATS_WS_PROXY_PATH}`;
 }
+/** The path and ticket of an upgrade's request target; null when it does not parse. */
+function upgradeTarget(requestTarget) {
+    try {
+        const url = new URL(requestTarget ?? '/', 'http://proxy');
+        return { pathname: url.pathname, ticket: url.searchParams.get(nats_ws_ticket_1.NATS_WS_TICKET_PARAM) };
+    }
+    catch {
+        return null;
+    }
+}
+function refuseUpgrade(socket) {
+    socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
+    socket.destroy();
+}
+/** Whether the holder's account still stands as it did when the connection opened. */
+async function holderUnchanged(userId, viewer) {
+    try {
+        const now = await (0, browser_view_1.holderView)(userId);
+        return !!now && now.builder === viewer.builder;
+    }
+    catch (err) {
+        logger_1.loggerRegistry.warn(`[lt-nats-ws-proxy] holder recheck failed: ${err?.message}`);
+        return false;
+    }
+}
 /**
  * Attach a WebSocket proxy to an HTTP server that bridges browser
  * connections to an internal NATS WebSocket endpoint.
@@ -27,6 +57,11 @@ function deriveWsUrlFromRequest(req, basePath = '') {
  * through an ALB or reverse proxy). This handler upgrades the connection
  * and bridges bidirectionally to the internal NATS WS target.
  *
+ * A connection needs an unspent ticket for an active account. The holder's
+ * account is rechecked every NATS_WS_RECHECK_SECONDS; a deactivation or a
+ * change in builder access closes the connection, and the dashboard
+ * reconnects with fresh credentials.
+ *
  * The proxy auto-derives the public `wsUrl` from the first incoming
  * request's headers, respecting `X-Forwarded-Proto` and `X-Forwarded-Host`
  * so the correct `wss://` scheme is used behind TLS-terminating load balancers.
@@ -34,10 +69,19 @@ function deriveWsUrlFromRequest(req, basePath = '') {
 function attachNatsWsProxy(server, target, options = {}) {
     const basePath = options.basePath || '';
     const proxyPath = `${basePath}${exports.NATS_WS_PROXY_PATH}`;
-    const wss = new ws_1.WebSocketServer({ noServer: true });
+    const wss = new ws_1.WebSocketServer({ noServer: true, maxPayload: config_1.config.NATS_WS_MAX_PAYLOAD_BYTES });
     let derived = false;
-    server.on('upgrade', (req, socket, head) => {
-        if (req.url !== proxyPath)
+    const admit = async (req, socket, head, ticketParam) => {
+        // Only a signed-in person, holding an unspent ticket the credentials route issued.
+        const ticket = (0, nats_ws_ticket_1.verifyNatsWsTicket)(ticketParam);
+        if (!ticket || !(await (0, nats_ws_ticket_1.spendNatsWsTicket)(ticket)))
+            return refuseUpgrade(socket);
+        // Decided per connection: a builder receives events whole, anyone else
+        // receives the browser view (lib/events/browser-view.ts).
+        const viewer = await (0, browser_view_1.holderView)(ticket.userId);
+        if (!viewer)
+            return refuseUpgrade(socket);
+        if (socket.destroyed)
             return;
         // Derive the public wsUrl from the first request's headers
         if (!derived && options.onWsUrlDerived) {
@@ -46,20 +90,45 @@ function attachNatsWsProxy(server, target, options = {}) {
         }
         wss.handleUpgrade(req, socket, head, (clientWs) => {
             const upstream = new ws_1.WebSocket(target);
+            // The browser reads; the proxy holds the credential and refuses its publishes.
+            const filter = new nats_ws_filter_1.NatsClientFilter(options.authToken ?? null);
+            const inbound = viewer.builder ? null : new nats_ws_server_filter_1.NatsServerFilter((payload) => (0, browser_view_1.payloadForViewer)(payload, viewer));
             upstream.on('open', () => {
                 clientWs.on('message', (data) => {
-                    if (upstream.readyState === ws_1.WebSocket.OPEN)
-                        upstream.send(data);
+                    const chunk = Buffer.isBuffer(data) ? data : Buffer.from(data);
+                    const forward = filter.feed(chunk);
+                    if (filter.malformed) {
+                        close();
+                        return;
+                    }
+                    if (forward.length && upstream.readyState === ws_1.WebSocket.OPEN)
+                        upstream.send(forward);
                 });
                 upstream.on('message', (data) => {
-                    if (clientWs.readyState === ws_1.WebSocket.OPEN)
+                    if (clientWs.readyState !== ws_1.WebSocket.OPEN)
+                        return;
+                    if (!inbound) {
                         clientWs.send(data);
+                        return;
+                    }
+                    const chunk = Buffer.isBuffer(data) ? data : Buffer.from(data);
+                    const forward = inbound.feed(chunk);
+                    if (forward.length)
+                        clientWs.send(forward);
                 });
             });
+            const recheck = setInterval(() => {
+                holderUnchanged(ticket.userId, viewer).then((unchanged) => {
+                    if (!unchanged)
+                        close();
+                });
+            }, config_1.config.NATS_WS_RECHECK_SECONDS * 1000);
+            recheck.unref();
             const close = () => {
+                clearInterval(recheck);
                 if (clientWs.readyState === ws_1.WebSocket.OPEN)
                     clientWs.close();
-                if (upstream.readyState === ws_1.WebSocket.OPEN)
+                if (upstream.readyState === ws_1.WebSocket.OPEN || upstream.readyState === ws_1.WebSocket.CONNECTING)
                     upstream.close();
             };
             clientWs.on('close', close);
@@ -73,6 +142,16 @@ function attachNatsWsProxy(server, target, options = {}) {
                 close();
             });
         });
+    };
+    server.on('upgrade', (req, socket, head) => {
+        // A target that does not parse is not this proxy's; other listeners may take it.
+        const upgrade = upgradeTarget(req.url);
+        if (!upgrade || upgrade.pathname !== proxyPath)
+            return;
+        admit(req, socket, head, upgrade.ticket).catch((err) => {
+            logger_1.loggerRegistry.error(`[lt-nats-ws-proxy] upgrade failed: ${err?.message}`);
+            socket.destroy();
+        });
     });
     logger_1.loggerRegistry.info(`[lt-nats-ws-proxy] active: ${proxyPath} -> ${target}`);
 }

package/build/lib/events/nats-ws-server-filter.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The server's half of a browser's NATS connection, as the WebSocket proxy
+ * forwards it. Message payloads (MSG and HMSG) pass through `rewrite`, which
+ * returns the payload to deliver or null to withhold the message; protocol
+ * lines (INFO, PING, PONG, +OK, -ERR) pass unchanged.
+ *
+ * Operations can span WebSocket frames, so the filter keeps whatever it has
+ * not yet seen whole.
+ */
+export declare class NatsServerFilter {
+    private readonly rewrite;
+    private pending;
+    constructor(rewrite: (payload: Buffer) => Buffer | null);
+    /** The bytes to forward to the browser for one chunk from the server. */
+    feed(chunk: Buffer): Buffer;
+}

package/build/lib/events/nats-ws-server-filter.js

@@ -0,0 +1,56 @@
+"use strict";
+/**
+ * The server's half of a browser's NATS connection, as the WebSocket proxy
+ * forwards it. Message payloads (MSG and HMSG) pass through `rewrite`, which
+ * returns the payload to deliver or null to withhold the message; protocol
+ * lines (INFO, PING, PONG, +OK, -ERR) pass unchanged.
+ *
+ * Operations can span WebSocket frames, so the filter keeps whatever it has
+ * not yet seen whole.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NatsServerFilter = void 0;
+const CRLF = Buffer.from('\r\n');
+class NatsServerFilter {
+    constructor(rewrite) {
+        this.rewrite = rewrite;
+        this.pending = Buffer.alloc(0);
+    }
+    /** The bytes to forward to the browser for one chunk from the server. */
+    feed(chunk) {
+        this.pending = this.pending.length ? Buffer.concat([this.pending, chunk]) : chunk;
+        const out = [];
+        for (;;) {
+            const end = this.pending.indexOf(CRLF);
+            if (end === -1)
+                break;
+            const line = this.pending.subarray(0, end).toString('utf8');
+            const space = line.indexOf(' ');
+            const op = (space === -1 ? line : line.slice(0, space)).toUpperCase();
+            if (op !== 'MSG' && op !== 'HMSG') {
+                out.push(this.pending.subarray(0, end + CRLF.length));
+                this.pending = this.pending.subarray(end + CRLF.length);
+                continue;
+            }
+            // MSG <subject> <sid> [reply] <size>
+            // HMSG <subject> <sid> [reply] <header size> <total size>
+            const args = line.slice(space + 1).trim().split(/\s+/);
+            const total = Number(args[args.length - 1]);
+            const headerSize = op === 'HMSG' ? Number(args[args.length - 2]) : 0;
+            const start = end + CRLF.length;
+            const need = start + total + CRLF.length;
+            if (this.pending.length < need)
+                break;
+            const headers = this.pending.subarray(start, start + headerSize);
+            const body = this.rewrite(this.pending.subarray(start + headerSize, start + total));
+            this.pending = this.pending.subarray(need);
+            if (body === null)
+                continue;
+            const prefix = args.slice(0, op === 'HMSG' ? -2 : -1).join(' ');
+            const sizes = op === 'HMSG' ? `${headerSize} ${headerSize + body.length}` : `${body.length}`;
+            out.push(Buffer.from(`${op} ${prefix} ${sizes}\r\n`, 'utf8'), headers, body, CRLF);
+        }
+        return Buffer.concat(out);
+    }
+}
+exports.NatsServerFilter = NatsServerFilter;

package/build/lib/events/nats-ws-ticket.d.ts

@@ -0,0 +1,19 @@
+/**
+ * A browser's pass to the NATS WebSocket proxy, in place of the NATS server
+ * credential. It names the person in `sub` and carries no `userId`, so it
+ * authenticates nothing but the proxy upgrade. Each ticket admits one
+ * upgrade: the dashboard fetches a fresh one for every connection attempt.
+ */
+export declare const NATS_WS_TICKET_TYPE = "nats-ws+jwt";
+export declare const NATS_WS_TICKET_PARAM = "ticket";
+export interface NatsWsTicket {
+    userId: string;
+    jti: string;
+    /** Expiry, in seconds since the epoch. */
+    exp: number;
+}
+export declare function signNatsWsTicket(userId: string): string | null;
+/** The claims of a valid ticket; null for anything else. Does not spend it. */
+export declare function verifyNatsWsTicket(ticket: string | null | undefined): NatsWsTicket | null;
+/** Spend a verified ticket. False when it was already spent. */
+export declare function spendNatsWsTicket(ticket: NatsWsTicket): Promise<boolean>;

package/build/lib/events/nats-ws-ticket.js

@@ -0,0 +1,63 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NATS_WS_TICKET_PARAM = exports.NATS_WS_TICKET_TYPE = void 0;
+exports.signNatsWsTicket = signNatsWsTicket;
+exports.verifyNatsWsTicket = verifyNatsWsTicket;
+exports.spendNatsWsTicket = spendNatsWsTicket;
+const crypto_1 = require("crypto");
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const db_1 = require("../db");
+const config_1 = require("../../modules/config");
+/**
+ * A browser's pass to the NATS WebSocket proxy, in place of the NATS server
+ * credential. It names the person in `sub` and carries no `userId`, so it
+ * authenticates nothing but the proxy upgrade. Each ticket admits one
+ * upgrade: the dashboard fetches a fresh one for every connection attempt.
+ */
+exports.NATS_WS_TICKET_TYPE = 'nats-ws+jwt';
+exports.NATS_WS_TICKET_PARAM = 'ticket';
+/** Record the ticket as spent, and drop expired records. True only for its first use. */
+const SPEND_TICKET = `
+  WITH expired AS (
+    DELETE FROM lt_nats_ws_tickets WHERE expires_at < NOW()
+  )
+  INSERT INTO lt_nats_ws_tickets (jti, expires_at)
+  VALUES ($1, to_timestamp($2))
+  ON CONFLICT (jti) DO NOTHING
+  RETURNING jti`;
+function signNatsWsTicket(userId) {
+    if (!config_1.config.JWT_SECRET)
+        return null;
+    return jsonwebtoken_1.default.sign({}, config_1.config.JWT_SECRET, {
+        algorithm: 'HS256',
+        header: { alg: 'HS256', typ: exports.NATS_WS_TICKET_TYPE },
+        subject: userId,
+        jwtid: (0, crypto_1.randomUUID)(),
+        expiresIn: config_1.config.NATS_WS_TICKET_TTL_SECONDS,
+    });
+}
+/** The claims of a valid ticket; null for anything else. Does not spend it. */
+function verifyNatsWsTicket(ticket) {
+    if (!ticket || !config_1.config.JWT_SECRET)
+        return null;
+    try {
+        const decoded = jsonwebtoken_1.default.verify(ticket, config_1.config.JWT_SECRET, { algorithms: ['HS256'], complete: true });
+        if (decoded.header.typ !== exports.NATS_WS_TICKET_TYPE)
+            return null;
+        const { sub, jti, exp } = decoded.payload;
+        if (typeof sub !== 'string' || typeof jti !== 'string' || typeof exp !== 'number')
+            return null;
+        return { userId: sub, jti, exp };
+    }
+    catch {
+        return null;
+    }
+}
+/** Spend a verified ticket. False when it was already spent. */
+async function spendNatsWsTicket(ticket) {
+    const { rowCount } = await (0, db_1.getPool)().query(SPEND_TICKET, [ticket.jti, ticket.exp]);
+    return rowCount === 1;
+}

package/build/lib/events/socketio.d.ts

@@ -4,7 +4,16 @@ import type { LTEvent, LTEventAdapter } from '../../types';
  * Callback to verify a Socket.IO handshake token.
  * Return `true` to allow the connection, `false` to reject.
  */
-export type SocketIOAuthenticator = (token: string) => boolean | Promise<boolean>;
+/**
+ * Verifies a socket's token. Returning the person (`{ userId }`) lets delivery
+ * follow their capabilities; `true` admits the socket with the browser view
+ * (lib/events/browser-view.ts).
+ */
+export type SocketIOAuthenticator = (token: string) => boolean | {
+    userId: string;
+} | Promise<boolean | {
+    userId: string;
+}>;
 /**
  * Socket.IO event adapter for browser clients.
  *

package/build/lib/events/socketio.js

@@ -4,6 +4,7 @@ exports.SocketIOEventAdapter = void 0;
 const socket_io_1 = require("socket.io");
 const logger_1 = require("../logger");
 const matching_1 = require("./matching");
+const browser_view_1 = require("./browser-view");
 /**
  * Socket.IO event adapter for browser clients.
  *
@@ -73,6 +74,8 @@ class SocketIOEventAdapter {
                     if (!valid) {
                         return next(new Error('Authentication failed'));
                     }
+                    if (typeof valid === 'object')
+                        socket.data.ltUserId = valid.userId;
                     next();
                 }
                 catch {
@@ -86,6 +89,9 @@ class SocketIOEventAdapter {
             // switches the socket from broadcast to scoped delivery.
             const patterns = new Set();
             socket.data.ltPatterns = patterns;
+            // Until the lookup answers, the socket receives the browser view.
+            socket.data.ltViewer = { builder: false };
+            (0, browser_view_1.viewerFor)(socket.data.ltUserId).then((viewer) => { socket.data.ltViewer = viewer; });
             socket.on('lt.subscribe', (pattern) => {
                 if (typeof pattern === 'string' && pattern.length > 0 && pattern.length <= 256) {
                     patterns.add(pattern);
@@ -107,14 +113,15 @@ class SocketIOEventAdapter {
         const channel = `lt.events.${event.type}`;
         for (const socket of this.io.of('/').sockets.values()) {
             const patterns = socket.data.ltPatterns;
+            const delivered = (0, browser_view_1.eventForViewer)(event, socket.data.ltViewer ?? { builder: false });
             if (!patterns || patterns.size === 0) {
-                // Legacy scope: a socket with no registered patterns gets everything.
-                socket.emit(channel, event);
+                // Legacy scope: a socket with no registered patterns gets every subject.
+                socket.emit(channel, delivered);
                 continue;
             }
             for (const pattern of patterns) {
                 if ((0, matching_1.subjectMatchesPattern)(channel, pattern)) {
-                    socket.emit(channel, event);
+                    socket.emit(channel, delivered);
                     break;
                 }
             }

package/build/lib/http/index.d.ts

@@ -0,0 +1,27 @@
+import express from 'express';
+/**
+ * The single module that imports the HTTP framework.
+ *
+ * Routes, middleware, adapters and the standalone server take routers,
+ * handler types and body/static middleware from here. Long Tail runs both
+ * as its own server and as a guest on a host's Express instance (NestJS,
+ * Express), so the framework dependency has exactly one owner.
+ */
+export { Router } from 'express';
+export type { Application, ErrorRequestHandler, NextFunction, Request, RequestHandler, Response, } from 'express';
+type JsonBodyOptions = Parameters<typeof express.json>[0];
+type StaticFilesOptions = Parameters<typeof express.static>[1];
+/** A new application. Only the standalone server owns one; embedded mode uses the host's. */
+export declare function createApp(): express.Application;
+/** JSON body parsing. A body the host already parsed is left as is. */
+export declare function jsonBody(options?: JsonBodyOptions): express.RequestHandler;
+/** Static file serving from `root`. */
+export declare function serveStatic(root: string, options?: StaticFilesOptions): express.RequestHandler;
+/**
+ * Non-credentialed CORS for public endpoints: any origin may call them, and
+ * preflight requests are answered here.
+ */
+export declare function allowAnyOrigin(methods?: string[]): express.RequestHandler;
+type FormBodyOptions = Parameters<typeof express.urlencoded>[0];
+/** URL-encoded form body parsing. A body the host already parsed is left as is. */
+export declare function formBody(options?: FormBodyOptions): express.RequestHandler;

package/build/lib/http/index.js

@@ -0,0 +1,55 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Router = void 0;
+exports.createApp = createApp;
+exports.jsonBody = jsonBody;
+exports.serveStatic = serveStatic;
+exports.allowAnyOrigin = allowAnyOrigin;
+exports.formBody = formBody;
+const express_1 = __importDefault(require("express"));
+/**
+ * The single module that imports the HTTP framework.
+ *
+ * Routes, middleware, adapters and the standalone server take routers,
+ * handler types and body/static middleware from here. Long Tail runs both
+ * as its own server and as a guest on a host's Express instance (NestJS,
+ * Express), so the framework dependency has exactly one owner.
+ */
+var express_2 = require("express");
+Object.defineProperty(exports, "Router", { enumerable: true, get: function () { return express_2.Router; } });
+/** A new application. Only the standalone server owns one; embedded mode uses the host's. */
+function createApp() {
+    return (0, express_1.default)();
+}
+/** JSON body parsing. A body the host already parsed is left as is. */
+function jsonBody(options) {
+    return express_1.default.json(options);
+}
+/** Static file serving from `root`. */
+function serveStatic(root, options) {
+    return express_1.default.static(root, options);
+}
+/**
+ * Non-credentialed CORS for public endpoints: any origin may call them, and
+ * preflight requests are answered here.
+ */
+function allowAnyOrigin(methods = ['GET', 'POST']) {
+    const allowMethods = [...methods, 'OPTIONS'].join(', ');
+    return (req, res, next) => {
+        res.setHeader('Access-Control-Allow-Origin', '*');
+        res.setHeader('Access-Control-Allow-Methods', allowMethods);
+        res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type, MCP-Protocol-Version');
+        if (req.method === 'OPTIONS') {
+            res.status(204).end();
+            return;
+        }
+        next();
+    };
+}
+/** URL-encoded form body parsing. A body the host already parsed is left as is. */
+function formBody(options = { extended: false }) {
+    return express_1.default.urlencoded(options);
+}

package/build/modules/auth.d.ts

@@ -1,4 +1,4 @@
-import { Request, RequestHandler } from 'express';
+import { Request, RequestHandler } from '../lib/http';
 import type { AuthPayload, LTAuthAdapter } from '../types';
 export type { AuthPayload, LTAuthAdapter };
 declare global {
@@ -40,34 +40,25 @@ export declare class JwtAuthAdapter implements LTAuthAdapter {
  */
 export declare function createAuthMiddleware(adapter: LTAuthAdapter): RequestHandler;
 export declare const requireAuth: RequestHandler;
+/**
+ * `requireAuth` without the SSO fallback: only a credential the request
+ * carries itself (the configured adapter, else a Bearer JWT or bot key).
+ * For endpoints a cross-site page must not reach through the host's cookie.
+ */
+export declare const requireCredentialAuth: RequestHandler;
 /**
  * Replace the auth adapter used by `requireAuth`.
  * Call before starting the server.
  */
 export declare function setAuthAdapter(adapter: LTAuthAdapter): void;
-/**
- * Middleware that requires admin access. Must be placed AFTER requireAuth.
- *
- * Checks isSuperAdmin() via the database first, then falls back to the
- * JWT `role` claim for stateless admin checks. Returns 403 otherwise.
- */
-export declare const requireAdmin: RequestHandler;
-/**
- * Middleware that requires builder access. Must be placed AFTER requireAuth.
- *
- * Builders are superadmin or users with the 'engineer' role.
- * This is the backend equivalent of the dashboard's `isBuilder` check.
- */
-export declare const requireBuilder: RequestHandler;
-/**
- * Middleware that requires role-management access. Must be placed AFTER requireAuth.
- *
- * Grants access to superadmins, admin-type users, and engineers — the backend
- * equivalent of the dashboard's `isBuilder || isOps`. Ops (admin type) manage
- * users and roles; builders (superadmin, engineer) are a superset. This is the
- * gate for reading and writing role definitions.
- */
-export declare const requireRoleManager: RequestHandler;
+/** Admin access: admin or superadmin claim, or a superadmin in the database. */
+export declare const requireAdmin: RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
+/** Builder access: superadmin or the 'engineer' role. Backend twin of the dashboard's `isBuilder`. */
+export declare const requireBuilder: RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
+/** Role-management access: admin access or the 'engineer' role. Backend twin of `isBuilder || isOps`. */
+export declare const requireRoleManager: RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
+/** Reads of one workflow run (`:workflowId`): builder access, or the person who started it or it runs as. */
+export declare const requireWorkflowReader: RequestHandler;
 /**
  * Generate a JWT token. Utility for tests and token provisioning.
  */