@inetafrica/open-claudia 3.4.23 → 3.5.0

package/core/grants.js

@@ -25,6 +25,13 @@ const { atomicWriteFileSync, readJsonWithFallback } = require("./fsutil");
 // maps a proposed action onto the same ladder and refuses anything above.
 const CAPABILITIES = ["read", "act", "destructive"];
 
+// Destructive is never a standing permission: every destructive run gets its
+// own owner card. grant() refuses it, and a legacy `destructive` record still
+// on disk counts as `act` — the owner plainly trusted that person to act, but
+// a destructive run keeps asking. The file itself is left untouched.
+const STANDING_CEILING = "act";
+const DESTRUCTIVE_REFUSAL = "Destructive actions always ask; no standing permission.";
+
 const ALL_ROOMS = "*";
 
 function nowIso() { return new Date().toISOString(); }
@@ -39,6 +46,78 @@ function normalizeCapability(capability) {
   return CAPABILITIES.includes(c) ? c : "read";
 }
 
+function grantError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+// Logged once per record per process, so a busy room doesn't flood the audit.
+const noted = new Set();
+function noteOnce(kind, g, extra = {}) {
+  const key = `${kind}:${g && g.id}`;
+  if (noted.has(key)) return;
+  noted.add(key);
+  try {
+    require("./audit").log(kind, {
+      id: g && g.id,
+      principal: principalKey(g && g.principal && g.principal.adapter, g && g.principal && g.principal.channelId),
+      room: g && g.room,
+      ...extra,
+    });
+  } catch (e) { /* best effort */ }
+}
+
+// The capability a stored grant actually confers.
+function effectiveCapability(g) {
+  const stored = normalizeCapability(g && g.capability);
+  if (capabilityRank(stored) <= capabilityRank(STANDING_CEILING)) return stored;
+  noteOnce("grant.destructive-downgraded", g, { effective: STANDING_CEILING });
+  return STANDING_CEILING;
+}
+
+// Senders that are not one identifiable person. A grant to any of them would
+// cover whoever hides behind them, so they are refused. Telegram gives
+// messages sent on behalf of a chat (Bot API `sender_chat`) a fake `from`,
+// and each of these ids is shared by EVERY such sender in every group.
+const TELEGRAM_STAND_IN_SENDERS = new Map([
+  ["1087968824", "an anonymous group admin"],        // @GroupAnonymousBot
+  ["136817688", "someone posting as a channel"],     // @Channel_Bot
+  ["777000", "a channel post forwarded by Telegram"], // Telegram service account
+]);
+
+// The bot's own ids, from the operator's config (never the token itself).
+function botSelfIds(adapter) {
+  let cfg = {};
+  try { cfg = require("./config").config || {}; } catch (e) { return []; }
+  const ids = [];
+  if (adapter === "telegram") ids.push(String(cfg.TELEGRAM_BOT_TOKEN || "").split(":")[0].trim());
+  if (adapter === "kazee" || adapter === "spaces") ids.push(String(cfg.KAZEE_BOT_USER_ID || "").trim());
+  return ids.filter(Boolean);
+}
+
+// null when (adapter, sender) is one verifiable person; otherwise who it is
+// instead, for the refusal message. `room` is the `<surface>:<id>` key.
+function principalRefusal({ adapter, senderId, room = "" } = {}) {
+  const a = String(adapter || "").trim().toLowerCase();
+  const s = String(senderId || "").trim();
+  if (!a || !s) return "a sender with no id";
+  if (botSelfIds(a).includes(s)) return "the bot itself";
+  if (a === "telegram") {
+    if (TELEGRAM_STAND_IN_SENDERS.has(s)) return TELEGRAM_STAND_IN_SENDERS.get(s);
+    // Telegram people have positive numeric ids; groups and channels negative.
+    if (!/^\d+$/.test(s)) return "a group or channel rather than a person";
+  }
+  if (a === "spaces" && s.startsWith("unknown-actor:")) return "an unidentified Spaces actor";
+  // An adapter that lost the sender falls back to the room id (Kazee does);
+  // only a Telegram DM legitimately has sender id == chat id.
+  const r = String(room || "");
+  if (a !== "telegram" && r.startsWith(`${a}:`) && r.slice(a.length + 1) === s) {
+    return "the room itself (no sender id)";
+  }
+  return null;
+}
+
 // Rooms are keyed `<surface>:<id>`, matching core/identity.conversationKeyFor
 // so a caller can hand us a conversation key directly.
 function roomKey(surface, roomId) {
@@ -72,48 +151,87 @@ function isLive(grant, at = Date.now()) {
   return true;
 }
 
-// The deterministic lookup that replaces the LLM as the gate. Returns the
-// strongest live grant for this principal in this room, preferring a grant
-// issued for this exact room over an all-rooms grant, so a narrow room grant
-// can never be weakened by a broad one and vice versa.
-function resolve({ adapter, senderId, room }) {
+// Every live grant for this principal that reaches this room. Records for a
+// principal that could not be granted today (anonymous, the bot itself) are
+// ignored rather than honoured.
+function matchingGrants({ adapter, senderId, room }) {
   const principal = principalKey(adapter, senderId);
+  if (!principal) return [];
   const target = String(room || "");
-  if (!principal) return null;
   const at = Date.now();
-  const candidates = load().filter((g) =>
-    isLive(g, at)
-    && principalKey(g.principal?.adapter, g.principal?.channelId) === principal
-    && (g.room === target || g.room === ALL_ROOMS));
-  if (!candidates.length) return null;
-  candidates.sort((a, b) => {
-    // Exact room beats all-rooms; then the stronger capability wins.
-    const exact = (b.room === target) - (a.room === target);
-    if (exact) return exact;
-    return capabilityRank(b.capability) - capabilityRank(a.capability);
+  return load().filter((g) => {
+    if (!isLive(g, at)) return false;
+    if (principalKey(g.principal?.adapter, g.principal?.channelId) !== principal) return false;
+    if (g.room !== target && g.room !== ALL_ROOMS) return false;
+    const refusal = principalRefusal({ adapter: g.principal?.adapter, senderId: g.principal?.channelId, room: g.room });
+    if (refusal) { noteOnce("grant.unverifiable-ignored", g, { refusal }); return false; }
+    return true;
   });
-  return candidates[0];
 }
 
-// True when this principal may take an action at `needed` strength in `room`.
+// The record as it applies now: a legacy destructive grant reads as `act`.
+function asEffective(g) {
+  const effective = effectiveCapability(g);
+  return effective === normalizeCapability(g.capability) ? g : { ...g, capability: effective, storedCapability: g.capability };
+}
+
+// Among grants that all answer the question: a standing grant before a
+// turn-limited one (never burn a "just this once" while a standing grant
+// covers it), then the exact room before all-rooms (the audit names the most
+// specific record), then the newest.
+function preference(target) {
+  return (a, b) => ((a.turnsRemaining != null) - (b.turnsRemaining != null))
+    || ((b.room === target) - (a.room === target))
+    || String(b.grantedAt || "").localeCompare(String(a.grantedAt || ""));
+}
+
+function strongestFirst(target) {
+  const prefer = preference(target);
+  return (a, b) => (capabilityRank(effectiveCapability(b)) - capabilityRank(effectiveCapability(a))) || prefer(a, b);
+}
+
+// The deterministic lookup that replaces the LLM as the gate. Grants add up:
+// the effective grant is the STRONGEST live match, so an exact-room grant
+// never weakens an all-rooms one or the other way round. To take access
+// away, revoke; a narrower grant does not.
+function resolve({ adapter, senderId, room }) {
+  const candidates = matchingGrants({ adapter, senderId, room });
+  if (!candidates.length) return null;
+  candidates.sort(strongestFirst(String(room || "")));
+  return asEffective(candidates[0]);
+}
+
+// True when this principal may take an action at `needed` strength in `room`:
+// some matching grant is strong enough and its scope covers the subject.
+// Destructive never passes — no standing grant confers it.
 // Owners never reach here — they are resolved before any grant lookup.
 function allows({ adapter, senderId, room, needed = "read", subject = null }) {
-  const grant = resolve({ adapter, senderId, room });
-  if (!grant) return { ok: false, reason: "no_grant", grant: null };
-  if (capabilityRank(grant.capability) < capabilityRank(needed)) {
-    return { ok: false, reason: "capability_too_low", grant };
+  const target = String(room || "");
+  const candidates = matchingGrants({ adapter, senderId, room });
+  if (!candidates.length) return { ok: false, reason: "no_grant", grant: null };
+  const strong = candidates.filter((g) => capabilityRank(effectiveCapability(g)) >= capabilityRank(needed));
+  if (!strong.length) {
+    candidates.sort(strongestFirst(target));
+    return { ok: false, reason: "capability_too_low", grant: asEffective(candidates[0]) };
   }
-  const scope = Array.isArray(grant.scope) ? grant.scope : [];
   // An empty scope means "anything within this capability" — a scoped grant
   // only covers the subjects it names.
-  if (scope.length && subject && !scope.includes(String(subject))) {
-    return { ok: false, reason: "out_of_scope", grant };
+  const covers = (g) => {
+    const scope = Array.isArray(g.scope) ? g.scope : [];
+    return !scope.length || !subject || scope.includes(String(subject));
+  };
+  const covering = strong.filter(covers);
+  if (!covering.length) {
+    strong.sort(preference(target));
+    return { ok: false, reason: "out_of_scope", grant: asEffective(strong[0]) };
   }
-  return { ok: true, reason: "granted", grant };
+  covering.sort(preference(target));
+  return { ok: true, reason: "granted", grant: asEffective(covering[0]) };
 }
 
 // Only an owner may call this — enforced by the caller, which holds the turn
-// context needed to know who is asking.
+// context needed to know who is asking. Refuses destructive (never standing)
+// and any principal that is not one identifiable person.
 function grant({
   adapter,
   senderId,
@@ -130,6 +248,13 @@ function grant({
   if (!principal) throw new Error("adapter and senderId are required");
   const target = allRooms ? ALL_ROOMS : String(room || "");
   if (!target) throw new Error("room is required unless allRooms is set");
+  if (capabilityRank(normalizeCapability(capability)) > capabilityRank(STANDING_CEILING)) {
+    throw grantError("GRANT_DESTRUCTIVE_REFUSED", DESTRUCTIVE_REFUSAL);
+  }
+  const refusal = principalRefusal({ adapter, senderId, room });
+  if (refusal) {
+    throw grantError("GRANT_PRINCIPAL_UNVERIFIABLE", `No standing permission for ${refusal} — a grant needs one identifiable person.`);
+  }
   const grants = load();
   // Re-granting the same pair replaces rather than stacks, so revoking one
   // record can never leave a weaker duplicate behind still granting access.
@@ -203,12 +328,16 @@ function listForRoom(room, { includeExpired = false } = {}) {
 
 module.exports = {
   CAPABILITIES,
+  STANDING_CEILING,
+  DESTRUCTIVE_REFUSAL,
   ALL_ROOMS,
   GRANTS_FILE,
   roomKey,
   principalKey,
+  principalRefusal,
   capabilityRank,
   normalizeCapability,
+  effectiveCapability,
   isLive,
   resolve,
   allows,

package/core/handlers.js

@@ -1928,13 +1928,19 @@ register({
 
     const live = grants.list();
     if (live.length === 0) {
-      return send("No capability grants yet.\n\nA grant is what lets a non-owner act: it covers ONE person in ONE room, so trusting someone in one group never trusts them elsewhere. Make one from an approval card (\"Always — here\" / \"Always — everywhere\").");
+      return send("No capability grants yet.\n\nA grant is what lets a non-owner act: it covers ONE person in ONE room, so trusting someone in one group never trusts them elsewhere. Make one from an approval card (\"Always — here\" / \"Always — everywhere\"). Destructive actions always ask; they can't be granted.");
     }
     const lines = live.map((g) => {
       const where = g.room === grants.ALL_ROOMS ? "everywhere" : g.room;
       const until = g.expiresAt ? ` · until ${g.expiresAt.slice(0, 10)}` : "";
       const turns = g.turnsRemaining != null ? ` · ${g.turnsRemaining} turn(s) left` : "";
-      return `🔑 [${g.id}] ${g.principal.adapter}:${g.principal.channelId} → ${g.capability} in ${where}${until}${turns}`;
+      // Legacy records: a destructive grant confers act only (destructive
+      // always asks); one for an anonymous or unverifiable sender is ignored.
+      const capability = grants.effectiveCapability(g);
+      const legacy = grants.normalizeCapability(g.capability) !== capability ? ` (stored as ${g.capability}; destructive always asks)` : "";
+      const refusal = grants.principalRefusal({ adapter: g.principal.adapter, senderId: g.principal.channelId, room: g.room });
+      const ignored = refusal ? ` — ignored: ${refusal}` : "";
+      return `🔑 [${g.id}] ${g.principal.adapter}:${g.principal.channelId} → ${capability}${legacy} in ${where}${until}${turns}${ignored}`;
     });
     return send(`Capability grants (${live.length}):\n\n${lines.join("\n")}\n\n/grants revoke <id> · /grants revoke-all <adapter>:<senderId>\nFile: ${grants.GRANTS_FILE}`);
   },