@k2b/cloud 0.13.0 → 0.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@k2b/cloud",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Application platform library for independently deployed Hono and SolidJS services behind a dynamic gateway.",
   "license": "AGPL-3.0-or-later",
   "repository": {
@@ -99,7 +99,7 @@
     "@tailwindcss/typography": "0.5.20",
     "@k2b/nessi": "0.12.1",
     "@k2b/ssr": "0.14.0",
-    "@k2b/ui": "0.6.0",
+    "@k2b/ui": "0.6.1",
     "@k2b/stdlib": "0.26.0",
     "@k2b/sync": "6.5.0",
     "@nats-io/transport-node": "3.4.0",

package/src/browser/app-approval.ts

@@ -215,6 +215,12 @@ const connect = async (options: {
         throw new AppApprovalClientError("INVALID_RESPONSE");
       return result;
     },
+    /** Hands this device's push token to the Cloud. Older Clouds answer HTTP 400. */
+    push: async (device: AppApprovalDevice, token: string, signal?: AbortSignal) => {
+      const result = await command(device, { operation: "push", token }, signal);
+      if (!("state" in result) || result.state !== "updated") throw new AppApprovalClientError("INVALID_RESPONSE");
+      return result;
+    },
     revoke: async (device: AppApprovalDevice, signal?: AbortSignal) => {
       const result = await command(device, { operation: "revoke" }, signal);
       if (!("state" in result) || result.state !== "revoked") throw new AppApprovalClientError("INVALID_RESPONSE");

package/src/contracts/app-approval.ts

@@ -53,6 +53,8 @@ export const AppDeviceMutationSchema = z.discriminatedUnion("operation", [
 export const AppDeviceCommandSchema = z.discriminatedUnion("operation", [
   z.object({ operation: z.literal("pending") }).strict(),
   z.object({ operation: z.literal("revoke") }).strict(),
+  /** Stores the authenticator's opaque push token for sign-in wake-ups on this device. */
+  z.object({ operation: z.literal("push"), token: z.string().regex(/^[A-Za-z0-9_-]{43}$/) }).strict(),
   z
     .object({
       operation: z.literal("decide"),
@@ -91,6 +93,7 @@ export const appDeviceProofMessage = (proof: AppDeviceProof): string => {
     proof.expiresAt,
     c.operation,
     ...(c.operation === "decide" ? [c.requestId, c.challenge, c.comparison, c.decision] : []),
+    ...(c.operation === "push" ? [c.token] : []),
   ]);
 };
 export const appPairingProofMessage = (issuer: string, claim: Omit<z.infer<typeof AppPairingClaimSchema>, "signature">): string =>
@@ -182,7 +185,7 @@ export const AppDeviceResponseSchema = z.union([
       pollAfterSeconds: z.number().positive(),
     })
     .strict(),
-  z.object({ state: z.enum(["approved", "denied", "revoked"]) }).strict(),
+  z.object({ state: z.enum(["approved", "denied", "revoked", "updated"]) }).strict(),
 ]);
 export const AppLoginStartResultSchema = z
   .object({ requestId: Id, browserSecret: Secret, comparison: Comparison, expiresAt: DateTime, pollAfterSeconds: z.number().positive() })

package/src/services/app-approval.ts

@@ -145,6 +145,19 @@ export type AppLoginDecisionHints = {
   /** Settles on the first hint for this request, or when `signal` aborts. */
   wait(requestId: string, signal: AbortSignal): Promise<void>;
 };
+/** Best-effort sign-in wake-ups through the trusted authenticator; returns the HTTP status. */
+export type AppLoginPushSender = (appOrigin: string, body: { token: string; cloudOrigin: string; requestRef: string }) => Promise<number>;
+export const fetchPushSender: AppLoginPushSender = async (appOrigin, body) => {
+  const response = await fetch(`${appOrigin}/push/notify`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    redirect: "error",
+    signal: AbortSignal.timeout(5_000),
+  });
+  await response.body?.cancel();
+  return response.status;
+};
 const log = logger("app-approval");
 const decisionTopic = lazySync((sync) =>
   sync.topic<null>({
@@ -193,6 +206,7 @@ export const createAppApprovalService = (
   db: SQL = sql,
   configuration = (requireEnabled = true) => readAppApprovalConfig(db, requireEnabled),
   hints: AppLoginDecisionHints = syncLoginDecisionHints,
+  push: AppLoginPushSender = fetchPushSender,
 ) => {
   const config = async (requireEnabled = true) => {
     const value = await configuration(requireEnabled);
@@ -245,6 +259,24 @@ export const createAppApprovalService = (
     return device;
   };
 
+  /** Runs after the login commit and never delays or fails it. The body names only
+   * this Cloud and the request id; a 410 means the phone's subscription is gone. */
+  const wake = async (cfg: AppApprovalConfig, userId: string, requestId: string) => {
+    try {
+      const rows = await db<{ push_token: string }[]>`SELECT DISTINCT push_token FROM auth.app_devices
+        WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND revoked_at IS NULL AND push_token IS NOT NULL LIMIT ${limits.devicesPerAccount}`;
+      await Promise.all(
+        rows.map(async ({ push_token: token }) => {
+          const status = await push(cfg.appOrigin, { token, cloudOrigin: cfg.issuer, requestRef: requestId });
+          if (status === 410)
+            await db`UPDATE auth.app_devices SET push_token=NULL WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND push_token=${token}`;
+        }),
+      );
+    } catch (error) {
+      log.warn("App login push wake-up failed", { error: error instanceof Error ? error.name : "UnknownError" });
+    }
+  };
+
   return {
     config,
     cleanup,
@@ -399,6 +431,7 @@ export const createAppApprovalService = (
         challenge = secret(),
         code = comparison(),
         expiresAt = future(limits.loginSeconds);
+      let owner: string | undefined;
       await db.begin(async (tx) => {
         const candidates = await tx<
           AccountRow[]
@@ -422,7 +455,10 @@ export const createAppApprovalService = (
         // public shape and a decoy pending transaction; no account enumeration.
         await tx`INSERT INTO auth.app_logins(id,issuer,user_id,auth_epoch,category,browser_hash,challenge,comparison,expires_at)
           VALUES (${id}::uuid,${cfg.issuer},${candidate?.id ?? null}::uuid,${candidate?.auth_epoch ?? null},${category},${hash(browserSecret)},${challenge},${code},${expiresAt})`;
+        owner = candidate?.id;
       });
+      // Not awaited: decoy and real requests answer alike, and push is only a wake-up.
+      if (owner) void wake(cfg, owner, id);
       return { requestId: id, browserSecret, comparison: code, expiresAt: iso(expiresAt), pollAfterSeconds: limits.pollSeconds };
     },
     deviceCommand: async (request: AppDeviceRequest) => {
@@ -448,6 +484,10 @@ export const createAppApprovalService = (
         if (!used.length) return reject("CONFLICT", 409);
         await tx`UPDATE auth.app_devices SET last_used_at=now() WHERE id=${device.id}::uuid`;
         const command = proof.command;
+        if (command.operation === "push") {
+          await tx`UPDATE auth.app_devices SET push_token=${command.token} WHERE id=${device.id}::uuid`;
+          return { state: "updated" as const };
+        }
         if (command.operation === "revoke") {
           await tx`UPDATE auth.app_devices SET revoked_at=now() WHERE id=${device.id}::uuid`;
           await record(tx, "device.revoke", device.user_id, device.id);

package/src/shared/markdown/extensions/info-blocks.ts

@@ -11,6 +11,10 @@
  * `:::warning Before deleting`.
  *
  * Supported types: note, info, success, warning, danger
+ *
+ * `notices: "minimal"` renders only the tone colour: no icon and no automatic
+ * label. The type name stays available to screen readers, and an explicit
+ * title is still shown.
  */
 
 import { NOTICE_CARD_CLASSES, NOTICE_CARD_ICONS, type NoticeTone } from "@k2b/ui";
@@ -50,7 +54,9 @@ const renderInlineContent = (content: string): string => {
     .replace(/\n/g, "<br>");
 };
 
-export function infoBlocksExtension(): MarkedExtension {
+export type NoticeStyle = "card" | "minimal";
+
+export function infoBlocksExtension(notices: NoticeStyle = "card"): MarkedExtension {
   return {
     extensions: [
       {
@@ -78,9 +84,14 @@ export function infoBlocksExtension(): MarkedExtension {
           const blockType = token.blockType as BlockType;
           const config = blockConfig[blockType];
           const content = escapeHtml(token.content as string);
-          const title = escapeHtml((token.title as string | undefined) ?? config.label);
           const renderedContent = renderInlineContent(content);
 
+          if (notices === "minimal") {
+            const title = token.title ? `<p class="${NOTICE_CARD_CLASSES.title}">${escapeHtml(token.title as string)}</p>` : "";
+            return `<aside class="${NOTICE_CARD_CLASSES.root}" data-tone="${config.tone}" role="note"><span class="sr-only">${config.label}: </span>${title}<div class="${NOTICE_CARD_CLASSES.body}">${renderedContent}</div></aside>`;
+          }
+
+          const title = escapeHtml((token.title as string | undefined) ?? config.label);
           return `<aside class="${NOTICE_CARD_CLASSES.root}" data-tone="${config.tone}">
   <div class="${NOTICE_CARD_CLASSES.inner}">
     <i class="${NOTICE_CARD_ICONS[config.tone]} ${NOTICE_CARD_CLASSES.icon}" aria-hidden="true"></i>

package/src/shared/markdown/index.ts

@@ -11,7 +11,7 @@ import { markdownClient } from "./client";
 import { codeExtension } from "./extensions/code";
 import { guidedHelpExtension } from "./extensions/guided-help";
 import { imagesExtension } from "./extensions/images";
-import { infoBlocksExtension } from "./extensions/info-blocks";
+import { infoBlocksExtension, type NoticeStyle } from "./extensions/info-blocks";
 import { katexExtension } from "./extensions/katex";
 import { linksExtension } from "./extensions/links";
 import { markExtension } from "./extensions/mark";
@@ -22,7 +22,7 @@ import { taskListExtension } from "./extensions/task-list";
 // Create a configured marked instance
 type MarkdownProfile = "content" | "help";
 
-const createMarked = (profile: MarkdownProfile = "content") => {
+const createMarked = (profile: MarkdownProfile = "content", notices: NoticeStyle = "card") => {
   const marked = new Marked();
 
   marked.use({
@@ -32,7 +32,7 @@ const createMarked = (profile: MarkdownProfile = "content") => {
 
   // Apply extensions in order
   // Note: katexExtension must come before codeExtension to handle ```math blocks
-  marked.use(infoBlocksExtension());
+  marked.use(infoBlocksExtension(notices));
   marked.use(taskListExtension());
   marked.use(tablesExtension());
   marked.use(linksExtension({ internalTarget: profile === "help" ? "_self" : "_blank" }));
@@ -48,8 +48,16 @@ const createMarked = (profile: MarkdownProfile = "content") => {
 };
 
 const marked = createMarked();
+const minimalNoticeMarked = createMarked("content", "minimal");
 const helpMarked = createMarked("help");
 
+export type MarkdownRenderOptions = {
+  /** `"minimal"` shows notices as tone colour only; the type name stays for screen readers. */
+  notices?: NoticeStyle;
+};
+
+const markedFor = (options: MarkdownRenderOptions): Marked => (options.notices === "minimal" ? minimalNoticeMarked : marked);
+
 const sanitizeRenderedHtml = (html: string): string =>
   sanitizeHtml(html, {
     allowedTags: [
@@ -91,6 +99,7 @@ const sanitizeRenderedHtml = (html: string): string =>
       "*": ["aria-hidden", "aria-label", "class", "data-help-icon", "data-tone", "id", "title"],
       a: ["href", "name", "rel", "target", "title"],
       annotation: ["encoding"],
+      aside: [{ name: "role", multiple: false, values: ["note"] }],
       code: ["class"],
       div: ["class", "data-block-name", "style"],
       img: ["alt", "class", "height", "loading", "src", "title", "width", "style"],
@@ -146,10 +155,10 @@ const sanitizeRenderedHtml = (html: string): string =>
  * @see MarkdownView component for displaying the rendered HTML
  * @see initMarkdownEnhancements for client-side Mermaid support
  */
-export function renderMarkdown(content: string): string {
+export function renderMarkdown(content: string, options: MarkdownRenderOptions = {}): string {
   if (!content || typeof content !== "string") return "";
 
-  const html = marked.parse(content);
+  const html = markedFor(options).parse(content);
   if (typeof html !== "string") return "";
 
   return sanitizeRenderedHtml(html);
@@ -158,10 +167,10 @@ export function renderMarkdown(content: string): string {
 /**
  * Render markdown to HTML synchronously.
  */
-export function renderMarkdownSync(content: string): string {
+export function renderMarkdownSync(content: string, options: MarkdownRenderOptions = {}): string {
   if (!content || typeof content !== "string") return "";
 
-  const html = marked.parse(content);
+  const html = markedFor(options).parse(content);
   if (typeof html !== "string") return "";
 
   return sanitizeRenderedHtml(html);