@integrity-labs/cloud-broker 0.7.10 → 0.7.12

package/README.md

@@ -39,7 +39,9 @@ See the PRDs ([AWS](../../docs/prds/aws-ephemeral-access.md), [GCP](../../docs/p
 
 ### Supabase
 
-Credentials returned are a short-lived **Supabase JWT** (+ `supabase_url`, `db_host`, `project_ref`), not a cloud IAM token. The agent uses it for PostgREST (`Authorization: Bearer …`) or `psql` via the session pooler.
+Since ENG-7326 the agent **holds no credential**: it queries Supabase through server-side proxy tools that run the call under the grant's scope. `supabase_rest` (PostgREST, read + write) is the primary path; `supabase_query` runs read-only SQL. The operator stores, on the enrolment, the project's REST api_key (a **new-format `sb_secret_…` key** - legacy anon/service_role keys are disabled) and/or a scoped read-only Postgres connection string; the broker injects whichever the call needs at exec time. The scope (`allowed_tables` / `read_only`) is enforced at the broker, independent of RLS.
+
+The legacy `supabase_get_credentials` still mints a short-lived Supabase JWT for direct PostgREST/`psql` use, but the proxy tools are preferred (they never hand the agent a secret, and they don't depend on RLS to enforce scope).
 
 | Tool | Purpose |
 |---|---|
@@ -47,12 +49,15 @@ Credentials returned are a short-lived **Supabase JWT** (+ `supabase_url`, `db_h
 | `supabase_preview_request` | Dry-run a candidate request. Writes nothing. |
 | `supabase_request_access` | Mint or queue a grant. `service_role` always routes to a human approver; privileged internal roles (`postgres`, `supabase_admin`, …) are hard-denied. |
 | `supabase_poll_grant` | Single-shot status check. Escape hatch. |
-| `supabase_get_credentials` | Fetch the JWT + connection details for an active grant. |
-| `supabase_release_access` | Voluntarily release a grant before TTL. Idempotent. **Note:** the JWT is stateless — release marks the grant revoked but the token stays valid until its `exp`. |
+| `supabase_describe` | Inspect what an **active grant** can do (role, allowed schemas/tables, read_only, and whether server-side SQL is enrolled) before querying. |
+| `supabase_rest` | **Primary.** Call the project's PostgREST API (read + write) server-side under the grant's scope. The broker injects the api_key; the agent holds nothing. `rpc/` is blocked. |
+| `supabase_query` | Run **read-only SQL** server-side under the grant's scoped DB role (READ ONLY transaction + statement timeout). For system tables / joins REST can't express. Requires a DB connection string on the enrolment. |
+| `supabase_get_credentials` | **Legacy.** Fetch a short-lived Supabase JWT + connection details for an active grant (direct PostgREST/`psql`). Prefer the proxy tools. |
+| `supabase_release_access` | Voluntarily release a grant before TTL. Idempotent. (For the legacy JWT path the token stays valid until its `exp`.) |
 | `supabase_check_approval_channel` | Pre-flight Slack channel reachability for the project's approval channel. |
 | `supabase_list_projects` | Live inventory of enrolled Supabase projects. |
 
-See **[`docs/runbooks/supabase-broker-enrollment.md`](../../docs/runbooks/supabase-broker-enrollment.md)** for operator enrollment, the `augmented` JWT-claim → RLS-policy enforcement guide, and the policy-ceiling shape.
+See **[`docs/runbooks/supabase-broker-enrollment.md`](../../docs/runbooks/supabase-broker-enrollment.md)** for operator enrollment (storing the REST api_key + DB connection string), the policy-ceiling shape, and the legacy `augmented` JWT-claim → RLS-policy enforcement guide.
 
 ## Environment
 
@@ -180,27 +185,28 @@ supabase_request_access({
   ttl_seconds: 900,
   reason: "read the agents + runs tables to answer the user's status question"
 })
-// → { "grant_id": "...", "status": "active", "secret_ref": "supabase:jwt:<grant_id>", "expires_at": "..." }
+// → { "grant_id": "...", "status": "active", "expires_at": "..." }
 //    `service_role` or write access (read_only:false, unless the project allows writes)
 //    returns "pending" instead and pages a human approver.
 
-// 4. Fetch the JWT + connection details.
-supabase_get_credentials({ grant_id: "..." })
-// → { "grant_id": "...", "expires_at": "...",
-//     "credentials": { "access_token": "<JWT>", "supabase_url": "https://<ref>.supabase.co",
-//                      "db_host": "aws-0-<region>.pooler.supabase.com", "project_ref": "<ref>" } }
-//
-//    REST (PostgREST):
-//      curl "$supabase_url/rest/v1/agents?select=*" \
-//        -H "apikey: <JWT>" -H "Authorization: Bearer <JWT>"
-//    psql (session pooler):
-//      psql "postgresql://postgres.<project_ref>:<JWT>@<db_host>:5432/postgres"
+// 4. Learn your scope (recommended - also tells you if server-side SQL is enrolled).
+supabase_describe({ grant_id: "..." })
+// → { role, allowed_schemas, allowed_tables, read_only, sql_query: { available, ... } }
 
-// 5. (Optional) release early.
+// 5. Query. You hold NO credential - the broker runs the call server-side and injects the key.
+//    REST (primary, read + write):
+supabase_rest({ grant_id: "...", method: "GET", path: "agents?select=*&limit=10" })
+// → { ok: true, status: 200, body: [ ... ] }
+//    Read-only SQL (system tables / joins REST can't express; needs a DB connection string enrolled):
+supabase_query({ grant_id: "...", sql: "select count(*) from runs" })
+// → { ok: true, rows: [{ count: 42 }], row_count: 1 }
+//    Both return { ok: false, error_code } on a denial - branch on error_code, don't treat it as a tool failure.
+
+// 6. (Optional) release early.
 supabase_release_access({ grant_id: "..." })
 ```
 
-The grant's scope (`allowed_schemas` / `allowed_tables` / `read_only`) is carried in the JWT's `augmented` claim and is **only enforced if the project's RLS policies read that claim** — see the [enrollment runbook](../../docs/runbooks/supabase-broker-enrollment.md#enforcing-the-grant-scope-with-rls) for the policy patterns. Same `pending` / direct-chat-push resolution semantics as AWS.
+With the proxy tools the grant's scope (`allowed_tables` / `read_only`) is enforced **at the broker** - read-only grants reject writes, calls outside `allowed_tables` are denied, and `rpc/` is blocked - independent of RLS. (For the legacy `supabase_get_credentials` JWT path, scope instead rides the JWT's `augmented` claim and is only enforced if the project's RLS policies read it - see the [enrollment runbook](../../docs/runbooks/supabase-broker-enrollment.md#enforcing-the-grant-scope-with-rls) for those policy patterns.) Same `pending` / direct-chat-push resolution semantics as AWS.
 
 ## Running locally
 

package/dist/index.js

@@ -20987,10 +20987,41 @@ var StdioServerTransport = class {
 
 // src/turn-initiator-marker.ts
 import { readFileSync } from "fs";
+import { dirname, join } from "path";
 var TURN_INITIATOR_MAX_AGE_MS = 5 * 60 * 1e3;
+var TURN_INITIATOR_LEDGER_FILENAME = ".turn-initiator-ledger.json";
+function readTurnInitiatorFromLedger(file, maxAgeMs) {
+  const ledgerFile = join(dirname(file), TURN_INITIATOR_LEDGER_FILENAME);
+  let entries;
+  try {
+    const parsed = JSON.parse(readFileSync(ledgerFile, "utf8"));
+    if (!parsed || parsed.v !== 1 || !Array.isArray(parsed.entries)) return "no-ledger";
+    entries = parsed.entries;
+  } catch {
+    return "no-ledger";
+  }
+  const now = Date.now();
+  const fresh = entries.filter(
+    (e) => e && typeof e.channel === "string" && e.channel && typeof e.sender_id === "string" && e.sender_id && typeof e.ts === "number" && Number.isFinite(e.ts) && now - e.ts >= 0 && now - e.ts <= maxAgeMs
+  );
+  if (fresh.length === 1) {
+    const e = fresh[0];
+    return { channel: e.channel, sender_id: e.sender_id };
+  }
+  if (fresh.length >= 2) {
+    process.stderr.write(
+      `turn-initiator: ambiguous (${fresh.length} fresh senders), withholding initiator
+`
+    );
+    return null;
+  }
+  return "no-ledger";
+}
 function readTurnInitiator(maxAgeMs = TURN_INITIATOR_MAX_AGE_MS) {
   const file = process.env["AGT_TURN_INITIATOR_FILE"];
   if (!file) return null;
+  const fromLedger = readTurnInitiatorFromLedger(file, maxAgeMs);
+  if (fromLedger !== "no-ledger") return fromLedger;
   try {
     const raw = readFileSync(file, "utf8");
     const m = JSON.parse(raw);
@@ -21380,6 +21411,16 @@ var BrokerClient = class {
       { query: this.agentId ? { agent_id: this.agentId } : void 0 }
     );
   }
+  supabaseRest(args) {
+    return this.request(
+      "POST",
+      `/supabase/grants/${encodeURIComponent(args.grant_id)}/rest`,
+      {
+        query: this.agentId ? { agent_id: this.agentId } : void 0,
+        body: { method: args.method, path: args.path, ...args.body !== void 0 ? { body: args.body } : {} }
+      }
+    );
+  }
 };
 
 // src/inventory.ts
@@ -21613,6 +21654,12 @@ var supabaseQuerySchema = external_exports.object({
 var supabaseDescribeSchema = external_exports.object({
   grant_id: external_exports.string().uuid("grant_id must be a UUID")
 });
+var supabaseRestSchema = external_exports.object({
+  grant_id: external_exports.string().uuid("grant_id must be a UUID"),
+  method: external_exports.enum(["GET", "HEAD", "POST", "PATCH", "PUT", "DELETE"]).describe("HTTP method. Writes require a non-read-only grant."),
+  path: external_exports.string().min(1, "path is required").describe('PostgREST-relative path, e.g. "orders?select=*&limit=10". Do NOT include /rest/v1/.'),
+  body: external_exports.unknown().optional().describe("JSON body for POST/PATCH/PUT.")
+});
 var supabaseDescribeScopeShape = supabaseDescribeScopeSchema.shape;
 var supabasePreviewRequestShape = supabasePreviewRequestSchema.shape;
 var supabaseRequestAccessShape = supabaseRequestAccessSchema.shape;
@@ -21623,11 +21670,12 @@ var supabaseCheckApprovalChannelShape = supabaseCheckApprovalChannelSchema.shape
 var supabaseListProjectsShape = supabaseListProjectsSchema.shape;
 var supabaseQueryShape = supabaseQuerySchema.shape;
 var supabaseDescribeShape = supabaseDescribeSchema.shape;
+var supabaseRestShape = supabaseRestSchema.shape;
 
 // package.json
 var package_default = {
   name: "@integrity-labs/cloud-broker",
-  version: "0.7.10",
+  version: "0.7.12",
   description: "Cloud Access Broker \u2014 MCP server that mints scoped, TTL-bounded cloud credentials per agent task. Ships AWS support (aws_request_access, aws_poll_grant, aws_release_access, aws_describe_scope, aws_preview_request, aws_get_credentials \u2014 STS AssumeRole under the hood); GCP, Azure, and Cloudflare land alongside in the same package as the broker grows.",
   type: "module",
   bin: {
@@ -22131,6 +22179,19 @@ server.tool(
     }
   }
 );
+server.tool(
+  "supabase_rest",
+  'Call a Supabase project\'s REST (PostgREST) API for an ACTIVE grant - the primary way to read AND write your app data. You do NOT hold a key; the broker injects the project api_key and runs the call server-side under your grant\'s scope. Args: { grant_id, method (GET/HEAD/POST/PATCH/PUT/DELETE), path, body? }. `path` is PostgREST-relative - e.g. "orders?select=*&limit=10", "orders?id=eq.7" - do NOT include /rest/v1/ or the host. Filtering/ordering/pagination use PostgREST query syntax. For writes, pass the row(s) as `body` (POST=insert, PATCH=update with a filter in path, DELETE=delete with a filter in path). Returns on success { grant_id, ok: true, status, body } where body is the PostgREST JSON (rows for reads, the affected rows for writes). On a denial returns { ok: false, error_code, error }: READ_ONLY (your grant is read-only - writes rejected), SCOPE_DENIED (table not in your grant\'s allowed tables, or rpc/ blocked), BAD_REQUEST (bad method/path), REST_NOT_CONFIGURED (no api_key enrolled - tell the user to ask their operator), GRANT_NOT_ACTIVE / GRANT_EXPIRED / GRANT_RELEASED, or EXECUTION_ERROR. A 4xx from PostgREST itself comes back as { ok:false, status, body } with the upstream error in body. Call supabase_describe first to see your allowed tables and whether REST is available. rpc/ calls are not permitted. Use supabase_query for raw SQL / system tables instead.' + NO_DIRECT_SUPABASE_HTTP_BLOCK,
+  supabaseRestShape,
+  async (args) => {
+    try {
+      const result = await broker.supabaseRest(args);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      return { content: [{ type: "text", text: formatBrokerError(err) }], isError: true };
+    }
+  }
+);
 var transport = new StdioServerTransport();
 await server.connect(transport);
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/cloud-broker",
-  "version": "0.7.10",
+  "version": "0.7.12",
   "description": "Cloud Access Broker — MCP server that mints scoped, TTL-bounded cloud credentials per agent task. Ships AWS support (aws_request_access, aws_poll_grant, aws_release_access, aws_describe_scope, aws_preview_request, aws_get_credentials — STS AssumeRole under the hood); GCP, Azure, and Cloudflare land alongside in the same package as the broker grows.",
   "type": "module",
   "bin": {