@ixo/oracle-runtime-workers 0.22.0 → 0.24.0

package/src/shell/app.ts

@@ -1,3 +1,15 @@
+import {
+  ActionProposalWireSchema,
+  TopicReceiptReferencesSchema,
+  BeginTopicStepSchema,
+  BeginTopicStepResultSchema,
+} from '@ixo/ixo-transaction/topic-proposals';
+import {
+  ActionProposalClaimSchema,
+  ActionProposalIdSchema,
+  ActionProposalReconcileSchema,
+} from '@ixo/ixo-transaction/action-proposals';
+import { ActionProposalConflict } from '../action-proposals/store';
 import {
   authenticateChannel,
   assertActiveChannelBindingCached,
@@ -65,6 +77,23 @@ import {
   type FeedbackShellOptions,
 } from '../feedback/submit';
 import { z } from 'zod';
+import { parseOutcome } from '@ixo/action-protocol';
+
+async function equalOutcomeKeys(
+  provided: string | null,
+  expected: string | undefined,
+): Promise<boolean> {
+  if (!provided || !expected || expected.length < 32 || provided.length > 512)
+    return false;
+  const digest = async (value: string) =>
+    new Uint8Array(
+      await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value)),
+    );
+  const [a, b] = await Promise.all([digest(provided), digest(expected)]);
+  let difference = 0;
+  for (let i = 0; i < a.length; i++) difference |= (a[i] ?? 0) ^ (b[i] ?? 0);
+  return difference === 0;
+}
 
 const DebugEventBody = z.object({
   type: z
@@ -217,6 +246,7 @@ export function rateLimitKey(
     | 'user'
     | 'poll'
     | 'channel'
+    | 'action'
     | 'artifact'
     | 'socket'
     | 'status'
@@ -424,6 +454,38 @@ export function createShell(
     );
   });
 
+  app.use('/api/internal/actions/outcomes', limitBody(64 * 1024));
+  app.post('/api/internal/actions/outcomes', async (c) => {
+    if (
+      c.env.HUB_ACTIONS_ENABLED !== 'true' ||
+      !(await equalOutcomeKeys(
+        c.req.header('x-auth-hub-outcome-key') ?? null,
+        c.env.AUTH_HUB_ACTION_OUTCOME_KEY,
+      ))
+    )
+      return c.json({ code: 'unauthorized' }, 401);
+    const body = await c.req.raw.text();
+    if (body.length > 64_000) return c.json({ code: 'request_too_large' }, 413);
+    try {
+      const outcome = parseOutcome(JSON.parse(body));
+      await userStub(c.env, outcome.ownerDid).recordHubActionOutcome(outcome);
+      return c.json({
+        accepted: true,
+        eventId: outcome.eventId,
+        accountId: outcome.reference.accountId,
+        actionId: outcome.reference.id,
+        revision: outcome.authorizedRevision,
+        digest: outcome.authorizedDigest,
+        sequence: outcome.sequence,
+      });
+    } catch (error) {
+      console.warn(
+        `[hub-actions] outcome refused: ${error instanceof Error ? error.message : String(error)}`,
+      );
+      return c.json({ code: 'outcome_refused' }, 409);
+    }
+  });
+
   app.post('/channels/turn', async (c) => {
     try {
       if (parseChannelServiceDids(c.env.CHANNEL_SERVICE_DID).length === 0)
@@ -478,6 +540,8 @@ export function createShell(
           outcome.status,
         );
       const result = outcome.result;
+      if (result.actionOutcomes?.length || result.hubActionOutcomes?.length)
+        await assertActiveChannelBindingCached(identity, c.env);
       return c.json(
         result,
         ['queued', 'running', 'recovering'].includes(result.status) ? 202 : 200,
@@ -538,8 +602,15 @@ export function createShell(
     if (!limiter) return next();
     const auth = c.get('auth') as AuthResult | undefined;
     if (!auth) return next();
+    // The chat lists' status poll and the card routes (Portal's review
+    // page) each have their own bucket: polling a card or the run list
+    // while chatting must not push turns into 429.
     const scope =
-      c.req.method === 'GET' && c.req.path === '/runs/active' ? 'poll' : 'user';
+      c.req.method === 'GET' && c.req.path === '/runs/active'
+        ? 'poll'
+        : c.req.path.startsWith('/action-proposals/')
+          ? 'action'
+          : 'user';
     const { success } = await limiter.limit({
       key: rateLimitKey(c.env, scope, auth.userDid),
     });
@@ -555,6 +626,129 @@ export function createShell(
     return next();
   });
 
+  // What the owner object answers a proposal command with: the card; a
+  // conflict (the card or the authority it was sealed on changed: the Portal
+  // re-reads and retries, 409); or an authority read that failed and may
+  // succeed later (503, with a generic message).
+  const ProposalReply = z.discriminatedUnion('ok', [
+    z.object({ ok: z.literal(true), proposal: ActionProposalWireSchema }),
+    z.object({
+      ok: z.literal(false),
+      error: z.string(),
+      kind: z.enum(['conflict', 'unavailable']).default('conflict'),
+    }),
+  ]);
+  const refusalStatus = (kind: 'conflict' | 'unavailable') =>
+    kind === 'unavailable' ? 503 : 409;
+
+  app.get('/action-proposals/:proposalId', async (c) => {
+    c.header('Cache-Control', 'private, no-store');
+    c.header('Vary', 'Authorization');
+    const parsed = ActionProposalIdSchema.safeParse(c.req.param('proposalId'));
+    if (!parsed.success) return c.json({ error: 'Invalid proposal ID' }, 400);
+    const identity = identityOf(c.get('auth'), c.req.raw.headers);
+    const proposal = await userStub(c.env, identity.userDid).actionProposal(
+      identity,
+      parsed.data,
+    );
+    if (!proposal) return c.json({ error: 'Proposal not found' }, 404);
+    const result = ProposalReply.parse(JSON.parse(proposal));
+    return result.ok
+      ? c.json({ proposal: result.proposal })
+      : c.json({ error: result.error }, refusalStatus(result.kind));
+  });
+  for (const operation of ['claim', 'reject', 'revoke', 'reconcile'] as const) {
+    app.post(
+      `/action-proposals/:proposalId/${operation}`,
+      limitBody(4096),
+      async (c) => {
+        c.header('Cache-Control', 'private, no-store');
+        c.header('Vary', 'Authorization');
+        const id = ActionProposalIdSchema.safeParse(c.req.param('proposalId'));
+        const body = await c.req.json().catch(() => null);
+        const parsed = (
+          operation === 'reconcile'
+            ? z.union([
+                ActionProposalReconcileSchema,
+                TopicReceiptReferencesSchema,
+              ])
+            : ActionProposalClaimSchema
+        ).safeParse(body);
+        if (!id.success || !parsed.success)
+          return c.json({ error: 'Invalid proposal command' }, 400);
+        const identity = identityOf(c.get('auth'), c.req.raw.headers);
+        try {
+          const command =
+            operation === 'reconcile'
+              ? 'v' in parsed.data
+                ? {
+                    kind: 'topic-reconcile' as const,
+                    input: TopicReceiptReferencesSchema.parse(parsed.data),
+                  }
+                : {
+                    kind: operation,
+                    ...ActionProposalReconcileSchema.parse(parsed.data),
+                  }
+              : {
+                  kind: operation,
+                  ...ActionProposalClaimSchema.parse(parsed.data),
+                };
+          const proposal = await userStub(
+            c.env,
+            identity.userDid,
+          ).actionProposal(identity, id.data, command);
+          if (!proposal) return c.json({ error: 'Proposal not found' }, 404);
+          const result = ProposalReply.parse(JSON.parse(proposal));
+          return result.ok
+            ? c.json({ proposal: result.proposal })
+            : c.json({ error: result.error }, refusalStatus(result.kind));
+        } catch (error) {
+          if (
+            error instanceof ActionProposalConflict ||
+            (error instanceof Error && error.name === 'ActionProposalConflict')
+          )
+            return c.json({ error: error.message }, 409);
+          throw error;
+        }
+      },
+    );
+  }
+
+  app.post(
+    '/action-proposals/:proposalId/begin-step',
+    limitBody(4096),
+    async (c) => {
+      c.header('Cache-Control', 'private, no-store');
+      c.header('Vary', 'Authorization');
+      const id = ActionProposalIdSchema.safeParse(c.req.param('proposalId'));
+      const body = BeginTopicStepSchema.safeParse(
+        await c.req.json().catch(() => null),
+      );
+      if (!id.success || !body.success)
+        return c.json({ error: 'Invalid topic step command' }, 400);
+      const identity = identityOf(c.get('auth'), c.req.raw.headers);
+      const raw = await userStub(c.env, identity.userDid).beginTopicStep(
+        identity,
+        id.data,
+        body.data,
+      );
+      if (!raw) return c.json({ error: 'Proposal not found' }, 404);
+      const response = z
+        .discriminatedUnion('ok', [
+          z.object({ ok: z.literal(true), result: BeginTopicStepResultSchema }),
+          z.object({
+            ok: z.literal(false),
+            error: z.string(),
+            kind: z.enum(['conflict', 'unavailable']).default('conflict'),
+          }),
+        ])
+        .parse(JSON.parse(raw));
+      return response.ok
+        ? c.json(response.result)
+        : c.json({ error: response.error }, refusalStatus(response.kind));
+    },
+  );
+
   // --- sessions ----------------------------------------------------------------
   app.post('/sessions', async (c) => {
     const identity = identityOf(c.get('auth'), c.req.raw.headers);