@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/packages/identity/src/frontend/auth-portal/shared/desktop-identity-bridge.js

@@ -0,0 +1,207 @@
+(function () {
+  function getInvoke() {
+    try {
+      return window.__TAURI__?.core?.invoke
+        || window.parent?.__TAURI__?.core?.invoke
+        || null;
+    } catch {
+      return null;
+    }
+  }
+
+  var invoke = getInvoke();
+  if (!invoke) return;
+
+  var APP_ID = 'local-studio';
+  var SESSION_ACCOUNT = 'identity_session';
+  var originalFetch = window.fetch.bind(window);
+
+  async function callIdentity(payload) {
+    var raw = await invoke('identity_bridge', {
+      requestJson: JSON.stringify(payload || {}),
+    });
+    var body = typeof raw === 'string' ? JSON.parse(raw) : raw;
+    if (!body || body.ok === false) {
+      throw new Error(body?.error || 'identity_request_failed');
+    }
+    return body;
+  }
+
+  async function getSessionId() {
+    return await invoke('secure_store_get', {
+      appId: APP_ID,
+      account: SESSION_ACCOUNT,
+    });
+  }
+
+  async function setSessionId(sessionId) {
+    await invoke('secure_store_set', {
+      appId: APP_ID,
+      account: SESSION_ACCOUNT,
+      value: String(sessionId || ''),
+    });
+  }
+
+  async function clearSessionId() {
+    try {
+      await invoke('secure_store_delete', {
+        appId: APP_ID,
+        account: SESSION_ACCOUNT,
+      });
+    } catch {}
+  }
+
+  function jsonResponse(body, status) {
+    return new Response(JSON.stringify(body), {
+      status: status || 200,
+      headers: { 'content-type': 'application/json' },
+    });
+  }
+
+  function parseBody(init) {
+    if (!init?.body) return {};
+    try {
+      return typeof init.body === 'string' ? JSON.parse(init.body) : {};
+    } catch {
+      return {};
+    }
+  }
+
+  function notifyAuthenticated(body) {
+    try {
+      window.parent?.postMessage({
+        type: 'agentsam:desktop-identity',
+        authenticated: true,
+        user: body?.user || null,
+      }, '*');
+    } catch {}
+  }
+
+  window.fetch = async function packagedIdentityFetch(input, init) {
+    var url;
+    try {
+      url = new URL(typeof input === 'string' ? input : input.url, window.location.href);
+    } catch {
+      return originalFetch(input, init);
+    }
+
+    if (url.pathname === '/api/company') {
+      return jsonResponse({
+        name: 'AgentSam',
+        tagline: 'Instant Access',
+        logoUrl: '/shared/agentsam-mark.svg',
+        authBgColor: '#050508',
+      });
+    }
+
+    if (url.pathname === '/api/auth/login') {
+      try {
+        var loginBody = parseBody(init);
+        var login = await callIdentity({
+          op: 'login',
+          email: loginBody.email,
+          password: loginBody.password,
+          next: loginBody.next || '/agentsam',
+        });
+        await setSessionId(login.session_id);
+        notifyAuthenticated(login);
+        return jsonResponse({ ok: true, user: login.user, redirect: '/agentsam' });
+      } catch (error) {
+        return jsonResponse({ ok: false, error: error?.message || String(error) }, 401);
+      }
+    }
+
+    if (url.pathname === '/api/auth/signup') {
+      try {
+        var signupBody = parseBody(init);
+        var signup = await callIdentity({
+          op: 'signup',
+          email: signupBody.email,
+          password: signupBody.password,
+          displayName: signupBody.name || signupBody.displayName || signupBody.display_name,
+          next: signupBody.next || '/agentsam',
+        });
+        await setSessionId(signup.session_id);
+        notifyAuthenticated(signup);
+        return jsonResponse({ ok: true, user: signup.user, redirect: '/agentsam' });
+      } catch (error) {
+        return jsonResponse({ ok: false, error: error?.message || String(error) }, 400);
+      }
+    }
+
+    if (url.pathname === '/api/auth/password-reset/request') {
+      try {
+        var requestBody = parseBody(init);
+        var requested = await callIdentity({
+          op: 'reset_request',
+          email: requestBody.email,
+        });
+        return jsonResponse(requested);
+      } catch (error) {
+        return jsonResponse({ ok: false, error: error?.message || String(error) }, 400);
+      }
+    }
+
+    if (url.pathname === '/api/auth/password-reset/confirm') {
+      try {
+        var resetBody = parseBody(init);
+        var reset = await callIdentity({
+          op: 'reset_confirm',
+          email: resetBody.email,
+          code: resetBody.code,
+          password: resetBody.password,
+          confirm_password: resetBody.confirm_password || resetBody.confirmPassword || resetBody.confirm,
+        });
+        return jsonResponse(reset);
+      } catch (error) {
+        return jsonResponse({ ok: false, error: error?.message || String(error) }, 400);
+      }
+    }
+
+    if (url.pathname === '/api/auth/logout') {
+      var sessionId = await getSessionId();
+      if (sessionId) {
+        try {
+          await callIdentity({ op: 'logout', session_id: sessionId });
+        } catch {}
+      }
+      await clearSessionId();
+      return jsonResponse({ ok: true });
+    }
+
+    return originalFetch(input, init);
+  };
+
+  function localizeAuthLinks() {
+    var map = {
+      '/auth/login': './login.html',
+      '/auth/signup': './signup.html',
+      '/auth/reset': './reset.html',
+    };
+    document.querySelectorAll('a[href]').forEach(function (link) {
+      var href = link.getAttribute('href');
+      if (!href) return;
+      var base = href.split('?')[0];
+      if (map[base]) {
+        var query = href.indexOf('?') >= 0 ? href.slice(href.indexOf('?')) : '';
+        link.setAttribute('href', map[base] + query);
+      }
+    });
+
+    // Provider OAuth belongs to installed provider adapters. Do not render
+    // decorative/dead login buttons in the packaged native surface.
+    ['googleSignIn', 'githubSignIn', 'cloudflareSignIn'].forEach(function (id) {
+      var link = document.getElementById(id);
+      if (link) link.style.display = 'none';
+    });
+    var backupToggle = document.getElementById('backupCodeToggle');
+    if (backupToggle) {
+      var backupPrompt = backupToggle.closest('p');
+      if (backupPrompt) backupPrompt.style.display = 'none';
+      else backupToggle.style.display = 'none';
+    }
+  }
+
+  window.addEventListener('DOMContentLoaded', localizeAuthLinks);
+  window.__AGENTSAM_DESKTOP_IDENTITY__ = true;
+})();

package/packages/identity/src/index.js

@@ -44,14 +44,55 @@ export {
 
 export * from './core/index.js';
 export * from './core/constants.js';
+export {
+  IDENTITY_ROUTE_IDS,
+  REQUIRED_AUTH_ROUTE_IDS,
+  defineRouteProjection,
+  createRouteRegistry,
+  projectionFromAppManifest,
+} from './contracts/routes.js';
+export {
+  IDENTITY_STORE_SCHEMA_VERSION,
+  IDENTITY_PACKS,
+  IdentityRoutingError,
+  IdentitySchemaError,
+} from './contracts/identity-store.js';
+export {
+  resolvePostAuthDestination,
+  beginLoginRedirect,
+  resolveMountForPath,
+  mountRequiresAuth,
+  pathMatchesMount,
+} from './server/post-auth.js';
+export { verifyAppAuthContract, verifyAppPackage } from './app/verify-app.js';
 export { DEFAULT_COMPANY_ID, DEFAULT_COMPANY_SLUG, normalizeCompanyRow } from './contracts/company.js';
+export {
+  buildOAuthConsentView,
+  normalizeOAuthConsentCompany,
+  normalizeOAuthConsentResource,
+  normalizeOAuthConsentClient,
+  normalizeOAuthConsentScope,
+} from './oauth/consent-view.js';
 export * from './contracts/auth-config.js';
 export { createPasswordResetService } from './recovery/password-reset.js';
 export {
   finalizeInboundOAuth,
   registerFinalizeInboundOAuth,
 } from './oauth/callback.js';
+export {
+  resolveOAuthCredentialLane,
+  resolveIamPlatformCredentials,
+  requireIamPlatformCredentials,
+} from './oauth/credentials.js';
+export {
+  handleGoogleDesktopExchangeRequest,
+  resolveGoogleExchangeSecret,
+} from './oauth/google-desktop-exchange.js';
 export { createCloudflareD1Adapter } from './adapters/cloudflare-d1/index.js';
+export {
+  createSqliteIdentityAdapter,
+  applySqliteIdentityMigrations,
+} from './adapters/sqlite/index.js';
 export { createIdentityService } from './server/identity-service.js';
 export { handleIdentityWorkerRequest } from './server/worker-router.js';
 

package/packages/identity/src/migrations/0001_identity_core.sql

@@ -1,5 +1,20 @@
 -- AgentSam Identity — customer D1 core (portable, boring, growable)
 -- Timestamps: INTEGER unixepoch seconds (AGENTS.md §2)
+--
+-- SSOT: `accounts` is the account row of record.
+-- `auth_users` is the login principal (1:1 with accounts.id in this portable scaffold).
+-- `account_identities` is IdP linkage only (provider + subject → accounts.id) — never the account SSOT.
+
+CREATE TABLE IF NOT EXISTS accounts (
+  id TEXT PRIMARY KEY NOT NULL,
+  email TEXT NOT NULL COLLATE NOCASE,
+  display_name TEXT,
+  status TEXT NOT NULL DEFAULT 'active',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_accounts_email ON accounts(email);
 
 CREATE TABLE IF NOT EXISTS auth_users (
   id TEXT PRIMARY KEY NOT NULL,
@@ -9,7 +24,8 @@ CREATE TABLE IF NOT EXISTS auth_users (
   salt TEXT,
   status TEXT NOT NULL DEFAULT 'active',
   created_at INTEGER NOT NULL,
-  updated_at INTEGER NOT NULL
+  updated_at INTEGER NOT NULL,
+  FOREIGN KEY (id) REFERENCES accounts(id)
 );
 
 CREATE UNIQUE INDEX IF NOT EXISTS idx_auth_users_email ON auth_users(email);
@@ -31,6 +47,7 @@ CREATE TABLE IF NOT EXISTS auth_sessions (
 CREATE INDEX IF NOT EXISTS idx_auth_sessions_user_expires
   ON auth_sessions(user_id, expires_at);
 
+-- IdP linkage only — points at accounts (SSOT), not a substitute for accounts.
 CREATE TABLE IF NOT EXISTS account_identities (
   id TEXT PRIMARY KEY NOT NULL,
   account_id TEXT NOT NULL,
@@ -39,7 +56,7 @@ CREATE TABLE IF NOT EXISTS account_identities (
   email TEXT,
   created_at INTEGER NOT NULL,
   updated_at INTEGER NOT NULL,
-  FOREIGN KEY (account_id) REFERENCES auth_users(id)
+  FOREIGN KEY (account_id) REFERENCES accounts(id)
 );
 
 CREATE UNIQUE INDEX IF NOT EXISTS idx_account_identities_provider_subject

package/packages/identity/src/migrations/0003_accounts_ssot.sql

@@ -0,0 +1,20 @@
+-- Additive upgrade: accounts as SSOT for scaffolds that already applied an older 0001.
+-- Safe to re-run. New scaffolds get accounts from 0001_identity_core.sql directly.
+--
+-- account_identities remains IdP linkage only (provider + subject → accounts.id).
+
+CREATE TABLE IF NOT EXISTS accounts (
+  id TEXT PRIMARY KEY NOT NULL,
+  email TEXT NOT NULL COLLATE NOCASE,
+  display_name TEXT,
+  status TEXT NOT NULL DEFAULT 'active',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_accounts_email ON accounts(email);
+
+-- Backfill from auth_users (1:1 portable scaffold).
+INSERT OR IGNORE INTO accounts (id, email, display_name, status, created_at, updated_at)
+SELECT id, email, display_name, COALESCE(status, 'active'), created_at, updated_at
+FROM auth_users;

package/packages/identity/src/migrations/README.md

@@ -14,13 +14,16 @@ wrangler d1 execute <database_name> --remote --file=migrations/0001_identity_cor
 
 `agentsam identity init` copies this migration into the customer project automatically.
 
+Existing scaffolds missing `accounts`: also apply `0003_accounts_ssot.sql`.
+
 ## Tables
 
 | Table | Purpose |
 |-------|---------|
-| `auth_users` | Login identity (`au_*` ids) |
+| `accounts` | **Account SSOT** — row of record (`au_*` ids shared with auth_users in portable scaffold) |
+| `auth_users` | Login principal (password hash, 1:1 with accounts.id) |
 | `auth_sessions` | Browser sessions |
-| `account_identities` | OAuth provider linkage |
+| `account_identities` | IdP linkage only (provider + subject → accounts.id) — **not** the account SSOT |
 | `oauth_states` | PKCE/state for OAuth start |
 | `password_reset_tokens` | Reset flow (grow when wired) |
 | `company` | Branding SSOT — name, logo, colors, support info (`GET /api/company`) |

package/packages/identity/src/oauth/README.md

@@ -3,15 +3,17 @@
 | Lane | Env vars | When |
 |------|----------|------|
 | **IAM platform (default)** | `IAM_CLIENT_ID` + `IAM_CLIENT_SECRET` | Minted at install/build for every customer worker |
-| Developer Google | `GOOGLE_CLIENT_ID` + `GOOGLE_CLIENT_SECRET` | Takes `/api/oauth/google/start` when set |
+| Developer Google (web) | `GOOGLE_CLIENT_ID` + `GOOGLE_CLIENT_SECRET` | Takes `/api/oauth/google/start` when set |
+| Google Desktop / CLI | `GOOGLE_DESKTOP_CLIENT_ID` (+ optional `GOOGLE_DESKTOP_CLIENT_SECRET`) | `POST /api/oauth/google/desktop-exchange` (loopback PKCE) |
 | Developer GitHub | `GITHUB_CLIENT_ID` + `GITHUB_CLIENT_SECRET` | Takes `/api/oauth/github/start` when set |
+| Cloudflare sign-in | `CLOUDFLARE_OAUTH_CLIENT_ID` (+ optional secret) | Takes `/api/oauth/cloudflare/start` when set |
 
 Optional: `IAM_ORIGIN` (default `https://inneranimalmedia.com`).
 
 ## Secrets law
 
-- `IAM_CLIENT_ID` / `GOOGLE_CLIENT_ID` / `GITHUB_CLIENT_ID` — plaintext Wrangler vars (public by OAuth design).
-- `*_CLIENT_SECRET` — **Wrangler secrets only** — never plaintext in `wrangler.toml`.
+- `IAM_CLIENT_ID` / `GOOGLE_CLIENT_ID` / `GOOGLE_DESKTOP_CLIENT_ID` / `GITHUB_CLIENT_ID` / `CLOUDFLARE_OAUTH_CLIENT_ID` — plaintext Wrangler vars (public by OAuth design).
+- `*_CLIENT_SECRET` — **Wrangler secrets only** — never plaintext in `wrangler.toml`. Desktop clients normally have **no** secret.
 
 ```bash
 npx wrangler secret put IAM_CLIENT_SECRET
@@ -21,12 +23,20 @@ npx wrangler secret put IAM_CLIENT_SECRET
 
 These routes live in the **customer** worker (`handleIdentityWorkerRequest`):
 
-1. `/api/oauth/iam/start` → redirects to IAM AS (requires minted `IAM_CLIENT_*`)
-2. `/api/oauth/google/start` → BYOK Google if `GOOGLE_*` set, else IAM if minted, else 503
-3. `/api/oauth/github/start` → same for GitHub
-4. Callback: `/api/oauth/iam/callback` (IAM lane) or `/api/oauth/{google|github}/callback` (BYOK)
+1. `/api/oauth/inneranimalmedia/start` → redirects to IAM AS (requires minted `IAM_CLIENT_*`)
+   - Legacy alias: `/api/oauth/iam/start`
+2. `/api/oauth/google/start` → BYOK Google if `GOOGLE_*` set, else platform lane if minted, else 503
+3. `/api/oauth/google/desktop-exchange` → CLI/desktop PKCE broker (`GOOGLE_DESKTOP_CLIENT_ID`; loopback only)
+4. `/api/oauth/github/start` → same for GitHub
+5. `/api/oauth/cloudflare/start` → Cloudflare sign-in when `CLOUDFLARE_OAUTH_CLIENT_ID` set
+6. Callback: `/api/oauth/inneranimalmedia/callback` (platform lane) or `/api/oauth/{google|github|cloudflare}/callback` (BYOK)
+   - Legacy alias: `/api/oauth/iam/callback`
 
-Register IAM redirect URI: `https://<customer-host>/api/oauth/iam/callback`
+Register platform redirect URI on the IAM client:
+
+`https://<customer-host>/api/oauth/inneranimalmedia/callback`
+
+(Keep the legacy `/api/oauth/iam/callback` registered during migration.)
 
 ## IAM authorization server endpoints (issuer)
 
@@ -43,6 +53,7 @@ OIDC scopes: `openid profile email` (not a bespoke `identity:*` namespace).
 ## Code
 
 - `credentials.js` — lane resolution
+- `google-desktop-exchange.js` — desktop PKCE token broker
 - `providers/iam/` — IAM AS client (`getIamAuthUrl`, `exchangeIamCode`, `fetchIamProfile`)
 - `iam-platform.js` — customer-worker start/callback wiring (uses `providers/iam/`)
 - `pkce.js` — shared PKCE helpers