@k2b/cloud 0.38.0 → 0.40.0

package/src/services/known-browsers.ts

@@ -0,0 +1,312 @@
+import { type SQL, sql } from "bun";
+import type { Context } from "hono";
+import { getCookie, setCookie } from "hono/cookie";
+import { z } from "zod";
+import { env } from "../config/env";
+import { APP_LOGIN_CONTEXT_BROWSERS, APP_LOGIN_CONTEXT_OSES } from "../contracts/app-approval";
+import { type BrowserCode, type OsCode, truncateUtf8 } from "../server/request-context";
+import { logger } from "./logging";
+
+export const SIGN_IN_METHODS = [
+  "password",
+  "passkey",
+  "email_code",
+  "cloud_login",
+  "password_reset",
+  "expired_password",
+  "admin_token",
+] as const;
+export type SignInMethod = (typeof SIGN_IN_METHODS)[number];
+export type NewBrowserSignInNotice = {
+  browserId: string;
+  userId: string;
+  firstName: string | null;
+  browser: BrowserCode;
+  os: OsCode;
+  country: string | null;
+  city: string | null;
+  signedInAt: string;
+  method: SignInMethod;
+  device: string | null;
+  locale: string | null;
+};
+export type NewBrowserSignInNotifier = (notice: NewBrowserSignInNotice) => Promise<unknown>;
+const log = logger("known-browsers");
+const noticeSnapshot = z.object({
+  browser: z.enum(APP_LOGIN_CONTEXT_BROWSERS),
+  os: z.enum(APP_LOGIN_CONTEXT_OSES),
+  country: z
+    .string()
+    .regex(/^[A-Z]{2}$/)
+    .nullable(),
+  city: z.string().max(96).nullable(),
+  signedInAt: z.string().datetime(),
+  method: z.enum(SIGN_IN_METHODS),
+  device: z.string().min(1).max(80).nullable(),
+  locale: z.string().min(1).max(35).nullable(),
+});
+
+/** The greeting name, as the notice carries it: trimmed and at most 100 characters; profile names have no length limit. */
+export const noticeFirstName = (name: string | null | undefined): string | null =>
+  Array.from(name?.trim() ?? "")
+    .slice(0, 100)
+    .join("")
+    .trim() || null;
+
+export const KNOWN_BROWSER_LIMITS = {
+  retentionDays: 90,
+  browsersPerAccount: 100,
+  countriesPerAccount: 50,
+  introDays: 14,
+  noticeBatch: 100,
+  cleanupBatch: 1000,
+  cleanupBatchesPerRun: 10,
+} as const;
+const DAY_MS = 86_400_000;
+const cutoffAt = (now: Date) => new Date(now.getTime() - KNOWN_BROWSER_LIMITS.retentionDays * DAY_MS);
+const cookieName = (development: boolean) => (development ? "cloud_browser" : "__Host-cloud_browser");
+const validCookie = (value: string | undefined): value is string =>
+  value !== undefined && value.length === 43 && /^[A-Za-z0-9_-]{43}$/.test(value);
+
+export const readBrowserCookie = (c: Context, development = env.IS_DEVELOPMENT): string | null => {
+  const value = getCookie(c, cookieName(development));
+  return validCookie(value) ? value : null;
+};
+export const newBrowserCookie = (): string => Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString("base64url");
+export const setBrowserCookie = (c: Context, value: string, development = env.IS_DEVELOPMENT): void => {
+  setCookie(c, cookieName(development), value, {
+    httpOnly: true,
+    secure: !development,
+    sameSite: "Strict",
+    path: "/",
+    maxAge: KNOWN_BROWSER_LIMITS.retentionDays * 86_400,
+  });
+};
+
+/** SHA-256 over canonical UUID text followed immediately by the cookie text; stored as raw bytea. */
+export const browserHash = (userId: string, cookie: string): Buffer =>
+  new Bun.CryptoHasher("sha256").update(userId.toLowerCase()).update(cookie).digest();
+
+type SignIn = {
+  userId: string;
+  cookie: string;
+  firstName: string | null;
+  method: SignInMethod;
+  device: string | null;
+  locale: string | null;
+  browser: BrowserCode;
+  os: OsCode;
+  country: string | null;
+  city: string | null;
+  now: Date;
+  announce: boolean;
+};
+
+/** Caller holds the existing session issuance lock on this account's auth.users row. */
+export const rememberSignIn = async (tx: SQL, input: SignIn): Promise<NewBrowserSignInNotice | null> => {
+  const { userId, cookie, browser, os, now } = input;
+  const country = input.country?.length === 2 && /^[A-Z]{2}$/.test(input.country) ? input.country : null;
+  const city = input.city === null ? null : truncateUtf8(input.city, 96);
+  const cutoff = cutoffAt(now);
+  const [row] = await tx<{ id: string; first_seen_at: Date }[]>`
+    INSERT INTO auth.known_browsers (user_id, browser_hash, browser, os, country, city, first_seen_at, last_seen_at)
+    VALUES (${userId}::uuid, ${browserHash(userId, cookie)}, ${browser}, ${os}, ${country}, ${city}, ${now}, ${now})
+    ON CONFLICT (user_id, browser_hash) DO UPDATE SET
+      browser = EXCLUDED.browser, os = EXCLUDED.os, country = EXCLUDED.country, city = EXCLUDED.city,
+      last_seen_at = EXCLUDED.last_seen_at,
+      first_seen_at = CASE WHEN known_browsers.last_seen_at <= ${cutoff} THEN EXCLUDED.first_seen_at ELSE known_browsers.first_seen_at END,
+      notified_at = CASE WHEN known_browsers.last_seen_at <= ${cutoff} THEN NULL ELSE known_browsers.notified_at END
+    RETURNING id, first_seen_at
+  `;
+  await tx`
+    DELETE FROM auth.known_browsers WHERE user_id = ${userId}::uuid AND (
+      last_seen_at <= ${cutoff} OR id IN (
+        SELECT id FROM auth.known_browsers WHERE user_id = ${userId}::uuid
+        ORDER BY last_seen_at DESC, id DESC OFFSET ${KNOWN_BROWSER_LIMITS.browsersPerAccount}
+      )
+    )
+  `;
+  if (country) {
+    await tx`
+      INSERT INTO auth.sign_in_countries (user_id, country, last_seen_at) VALUES (${userId}::uuid, ${country}, ${now})
+      ON CONFLICT (user_id, country) DO UPDATE SET last_seen_at = EXCLUDED.last_seen_at
+    `;
+    await tx`
+      DELETE FROM auth.sign_in_countries WHERE user_id = ${userId}::uuid AND (
+        last_seen_at <= ${cutoff} OR country IN (
+          SELECT country FROM auth.sign_in_countries WHERE user_id = ${userId}::uuid
+          ORDER BY last_seen_at DESC, country OFFSET ${KNOWN_BROWSER_LIMITS.countriesPerAccount}
+        )
+      )
+    `;
+    await tx`UPDATE auth.device_trust_state SET geoip_since = ${now} WHERE id = true AND geoip_since IS NULL`;
+  }
+  if (!row || row.first_seen_at.getTime() !== now.getTime()) return null;
+  if (!input.announce || (await trustState(tx, now)).introActive) {
+    await tx`UPDATE auth.known_browsers SET notified_at = ${now}, notice = NULL, notice_attempted_at = NULL WHERE id = ${row.id}::uuid`;
+    return null;
+  }
+  const snapshot = {
+    browser,
+    os,
+    country,
+    city,
+    signedInAt: now.toISOString(),
+    method: input.method,
+    device: input.method === "cloud_login" && input.device ? truncateUtf8(input.device, 80) : null,
+    locale: input.locale && input.locale.length <= 35 ? input.locale : null,
+  };
+  await tx`UPDATE auth.known_browsers SET notified_at = NULL, notice = ${JSON.stringify(snapshot)}::text::jsonb, notice_attempted_at = NULL WHERE id = ${row.id}::uuid`;
+  return { ...snapshot, browserId: row.id, userId, firstName: input.firstName };
+};
+
+/** A failed handoff stays pending. Only the error class enters logs. */
+export const announceNewBrowser = async (
+  notify: NewBrowserSignInNotifier,
+  notice: NewBrowserSignInNotice,
+  db: SQL = sql,
+): Promise<boolean> => {
+  try {
+    await notify(notice);
+    await db`UPDATE auth.known_browsers SET notified_at = now(), notice = NULL, notice_attempted_at = NULL WHERE id = ${notice.browserId}::uuid AND notified_at IS NULL`;
+    return true;
+  } catch (error) {
+    log.warn("New-browser notice failed", { error: error instanceof Error ? error.name : "UnknownError" });
+    // The next batch starts with notices tried least recently, so failing ones cannot hold back the others.
+    try {
+      await db`UPDATE auth.known_browsers SET notice_attempted_at = now() WHERE id = ${notice.browserId}::uuid AND notified_at IS NULL`;
+    } catch {
+      // Without the mark the notice keeps its place in the queue; it stays pending either way.
+    }
+    return false;
+  }
+};
+
+export const maintainNotices = async (
+  db: SQL,
+  notify: NewBrowserSignInNotifier,
+  { signal, batchSize = KNOWN_BROWSER_LIMITS.noticeBatch }: { signal?: AbortSignal; batchSize?: number } = {},
+): Promise<number> => {
+  if (!Number.isSafeInteger(batchSize) || batchSize < 1) throw new Error("New-browser notices require a positive batch size");
+  signal?.throwIfAborted();
+  const rows = await db<{ id: string; user_id: string; notice: unknown; given_name: string | null }[]>`
+    SELECT kb.id, kb.user_id, kb.notice, u.given_name FROM auth.known_browsers kb JOIN auth.users u ON u.id = kb.user_id
+    WHERE kb.notified_at IS NULL AND kb.notice IS NOT NULL AND kb.last_seen_at > ${cutoffAt(new Date())}
+    ORDER BY kb.notice_attempted_at NULLS FIRST, kb.first_seen_at, kb.id LIMIT ${batchSize}
+  `;
+  let handedOver = 0;
+  for (const row of rows) {
+    signal?.throwIfAborted();
+    const parsed = noticeSnapshot.safeParse(row.notice);
+    if (!parsed.success) {
+      await db`UPDATE auth.known_browsers SET notified_at = now(), notice = NULL, notice_attempted_at = NULL WHERE id = ${row.id}::uuid AND notified_at IS NULL`;
+      log.warn("Invalid new-browser notice discarded", { error: "InvalidSnapshot" });
+      continue;
+    }
+    if (
+      await announceNewBrowser(
+        notify,
+        { ...parsed.data, browserId: row.id, userId: row.user_id, firstName: noticeFirstName(row.given_name) },
+        db,
+      )
+    )
+      handedOver++;
+  }
+  return handedOver;
+};
+
+export const findBrowser = async (
+  db: SQL,
+  { userId, cookie, now }: { userId?: string | null; cookie: string | null; now: Date },
+): Promise<{ firstSeenAt: Date } | null> => {
+  const id = userId ?? crypto.randomUUID();
+  const [row] = await db<{ first_seen_at: Date }[]>`
+    SELECT first_seen_at FROM auth.known_browsers
+    WHERE user_id = ${id}::uuid AND browser_hash = ${browserHash(id, cookie ?? newBrowserCookie())} AND last_seen_at > ${cutoffAt(now)}
+  `;
+  return userId && cookie && row ? { firstSeenAt: row.first_seen_at } : null;
+};
+
+export const countrySeen = async (
+  db: SQL,
+  { userId, country, now }: { userId?: string | null; country: string | null; now: Date },
+): Promise<boolean> => {
+  const [row] = await db<{ present: boolean }[]>`
+    SELECT EXISTS (SELECT 1 FROM auth.sign_in_countries
+      WHERE user_id = ${userId ?? crypto.randomUUID()}::uuid AND country = ${country} AND last_seen_at > ${cutoffAt(now)}) AS present
+  `;
+  return Boolean(userId && row?.present);
+};
+
+/** Both country facts use the same retention window and one query, including decoys. */
+export const countryHistory = async (
+  db: SQL,
+  { userId, country, now }: { userId?: string | null; country: string | null; now: Date },
+): Promise<{ seen: boolean; any: boolean }> => {
+  const [row] = await db<{ seen: boolean; any: boolean }[]>`
+    SELECT COALESCE(bool_or(country = ${country}), false) AS seen, count(*) > 0 AS "any"
+    FROM auth.sign_in_countries WHERE user_id = ${userId ?? crypto.randomUUID()}::uuid AND last_seen_at > ${cutoffAt(now)}
+  `;
+  return { seen: Boolean(userId && row?.seen), any: Boolean(userId && row?.any) };
+};
+
+export const trustState = async (
+  db: SQL,
+  now: Date,
+): Promise<{ startedAt: Date | null; geoipSince: Date | null; introActive: boolean }> => {
+  const [row] = await db<{ started_at: Date; geoip_since: Date | null }[]>`
+    SELECT started_at, geoip_since FROM auth.device_trust_state WHERE id = true
+  `;
+  return {
+    startedAt: row?.started_at ?? null,
+    geoipSince: row?.geoip_since ?? null,
+    introActive: !row || now.getTime() < row.started_at.getTime() + KNOWN_BROWSER_LIMITS.introDays * DAY_MS,
+  };
+};
+
+export const cleanup = async (
+  db: SQL,
+  {
+    now = new Date(),
+    signal,
+    batchSize = KNOWN_BROWSER_LIMITS.cleanupBatch,
+    maxBatches = KNOWN_BROWSER_LIMITS.cleanupBatchesPerRun,
+  }: { now?: Date; signal?: AbortSignal; batchSize?: number; maxBatches?: number } = {},
+): Promise<{ browsers: number; countries: number }> => {
+  if (!Number.isSafeInteger(batchSize) || batchSize < 1 || !Number.isSafeInteger(maxBatches) || maxBatches < 0)
+    throw new Error("Known-browser cleanup requires a positive batch size and a non-negative batch count");
+  const cutoff = cutoffAt(now);
+  const counts = { browsers: 0, countries: 0 };
+  // Cleanup never waits for a sign-in: rows a sign-in holds are skipped (waiting could deadlock with its own
+  // eviction of the account's other expired rows), and the outer cutoff re-checks a row refreshed meanwhile.
+  // A short batch can therefore mean such a skip; the next run continues the backlog. The batch is a
+  // materialized CTE because a locking LIMIT subquery inside IN (...) may run more than once and exceed it.
+  for (let batch = 0; batch < maxBatches && !signal?.aborted; batch++) {
+    const rows = await db`
+      WITH batch AS MATERIALIZED (
+        SELECT id FROM auth.known_browsers WHERE last_seen_at <= ${cutoff} ORDER BY last_seen_at LIMIT ${batchSize}
+        FOR UPDATE SKIP LOCKED
+      )
+      DELETE FROM auth.known_browsers kb USING batch
+      WHERE kb.id = batch.id AND kb.last_seen_at <= ${cutoff} RETURNING kb.id
+    `;
+    counts.browsers += rows.length;
+    if (rows.length < batchSize) break;
+  }
+  for (let batch = 0; batch < maxBatches && !signal?.aborted; batch++) {
+    const rows = await db`
+      WITH batch AS MATERIALIZED (
+        SELECT user_id, country FROM auth.sign_in_countries WHERE last_seen_at <= ${cutoff} ORDER BY last_seen_at LIMIT ${batchSize}
+        FOR UPDATE SKIP LOCKED
+      )
+      DELETE FROM auth.sign_in_countries sc USING batch
+      WHERE sc.user_id = batch.user_id AND sc.country = batch.country AND sc.last_seen_at <= ${cutoff} RETURNING sc.user_id
+    `;
+    counts.countries += rows.length;
+    if (rows.length < batchSize) break;
+  }
+  return counts;
+};
+
+/** Core-internal persistence and maintenance; no request surface. */
+export const knownBrowsers = { findBrowser, countrySeen, countryHistory, trustState, cleanup, maintainNotices };

package/src/services/login-address-store.ts

@@ -0,0 +1,51 @@
+import { timingSafeEqual } from "node:crypto";
+import { z } from "zod";
+import { requestCacheRedis } from "./request-cache-redis";
+
+const AddressProofSchema = z.object({ salt: z.string().regex(/^[a-f0-9]{32}$/), digest: z.string().regex(/^[a-f0-9]{64}$/) }).strict();
+export type AppLoginAddressProof = z.infer<typeof AddressProofSchema>;
+export type AppLoginAddressStore = {
+  remember(requestId: string, proof: AppLoginAddressProof, expiresAt: Date): Promise<void>;
+  read(requestIds: string[]): Promise<Map<string, AppLoginAddressProof>>;
+  forget(requestId: string): Promise<void>;
+};
+export const appLoginAddressKey = (requestId: string) => `cloud:app-login-address:${requestId}`;
+const digest = (salt: string, prefix: string) => new Bun.CryptoHasher("sha256").update(Buffer.from(salt, "hex")).update(prefix).digest();
+export const appLoginAddressProof = (prefix: string): AppLoginAddressProof => {
+  const salt = Buffer.from(crypto.getRandomValues(new Uint8Array(16))).toString("hex");
+  return { salt, digest: digest(salt, prefix).toString("hex") };
+};
+export const appLoginAddressMatches = (proof: AppLoginAddressProof, prefix: string): boolean => {
+  const parsed = AddressProofSchema.safeParse(proof);
+  return parsed.success && timingSafeEqual(Buffer.from(parsed.data.digest, "hex"), digest(parsed.data.salt, prefix));
+};
+
+/** Fail-fast cache client; service callers catch every failure after their SQL commit. */
+export const valkeyAppLoginAddressStore: AppLoginAddressStore = {
+  remember: async (requestId, proof, expiresAt) => {
+    await (await requestCacheRedis()).send("SET", [
+      appLoginAddressKey(requestId),
+      JSON.stringify(proof),
+      "PXAT",
+      String(expiresAt.getTime()),
+    ]);
+  },
+  read: async (requestIds) => {
+    const proofs = new Map<string, AppLoginAddressProof>();
+    if (!requestIds.length) return proofs;
+    const values = await (await requestCacheRedis()).mget(...requestIds.map(appLoginAddressKey));
+    for (const [index, value] of values.entries()) {
+      if (!value) continue;
+      try {
+        const parsed = AddressProofSchema.safeParse(JSON.parse(value));
+        if (parsed.success) proofs.set(requestIds[index]!, parsed.data);
+      } catch {
+        // Invalid cache entries are absent hints, never sign-in failures.
+      }
+    }
+    return proofs;
+  },
+  forget: async (requestId) => {
+    await (await requestCacheRedis()).del(appLoginAddressKey(requestId));
+  },
+};

package/src/services/login-context.ts

@@ -0,0 +1,118 @@
+import {
+  APP_APPROVAL_LIMITS,
+  type AppDeviceInbox,
+  type AppDeviceInboxWithChanges,
+  type AppLoginContext,
+  AppLoginContextSchema,
+  type AppPendingLogin,
+} from "../contracts/app-approval";
+import { truncateUtf8 } from "../server/request-context/geoip";
+import { KNOWN_BROWSER_LIMITS } from "./known-browsers";
+
+export type AppLoginRequestContext = Pick<AppLoginContext, "browser" | "os" | "country" | "city" | "network"> & {
+  cookie: string | null;
+  prefix: string | null;
+};
+export type LoginContextInput = {
+  request?: AppLoginRequestContext;
+  browser: { firstSeenAt: Date } | null;
+  countries: { seen: boolean; any: boolean };
+  trust: { introActive: boolean; geoipSince: Date | null };
+  now: Date;
+};
+
+/** Core's only level rule. Descriptions and same-network hints do not affect it. */
+export const loginContextLevel = (input: {
+  introActive: boolean;
+  knownBrowser: boolean;
+  newCountry: boolean;
+  anyCountry: boolean;
+}): AppLoginContext["level"] => {
+  if (input.introActive) return "info";
+  if (input.knownBrowser) return input.newCountry ? "hint" : "info";
+  return input.newCountry && input.anyCountry ? "warn" : "hint";
+};
+
+/** JSONB adds a space after each colon and comma. Two bytes per entry bound
+ * both separators, including nested objects/arrays, without counting punctuation in strings. */
+export const loginContextStorageBytes = (value: unknown): number => {
+  const separators = (item: unknown): number => {
+    if (!item || typeof item !== "object") return 0;
+    const values = Object.values(item);
+    return 2 * values.length + values.reduce<number>((sum, entry) => sum + separators(entry), 0);
+  };
+  return new TextEncoder().encode(JSON.stringify(value)).length + separators(value);
+};
+
+/** Never store sameNetwork. Oversized or invalid context cannot prevent a sign-in. */
+export const boundLoginContext = (input: AppLoginContext): AppLoginContext | null => {
+  const { sameNetwork: _transient, ...context } = input;
+  if (loginContextStorageBytes(context) > 512) {
+    context.city = null;
+    context.network = null;
+  }
+  if (loginContextStorageBytes(context) > 512) return null;
+  const parsed = AppLoginContextSchema.safeParse(context);
+  return parsed.success ? parsed.data : null;
+};
+
+export const buildLoginContext = ({ request, browser, countries, trust, now }: LoginContextInput): AppLoginContext | null => {
+  const country = request?.country ?? null;
+  const newCountry = country !== null && trust.geoipSince !== null && !countries.seen;
+  const name = (value: string | null | undefined) =>
+    value
+      ? truncateUtf8(
+          value
+            .replace(/[\p{Cc}\p{Zl}\p{Zp}]/gu, " ")
+            .replace(/\p{Cf}/gu, "")
+            .replace(/\s+/gu, " ")
+            .trim(),
+          96,
+        ) || null
+      : null;
+  return boundLoginContext({
+    level: loginContextLevel({ introActive: trust.introActive, knownBrowser: browser !== null, newCountry, anyCountry: countries.any }),
+    browser: request?.browser ?? "other",
+    os: request?.os ?? "other",
+    country,
+    city: name(request?.city),
+    network: name(request?.network),
+    history: trust.introActive
+      ? null
+      : {
+          knownSince: browser?.firstSeenAt.toISOString() ?? null,
+          newCountry,
+          countriesSince:
+            trust.geoipSince && now.getTime() - trust.geoipSince.getTime() < KNOWN_BROWSER_LIMITS.retentionDays * 86_400_000
+              ? trust.geoipSince.toISOString()
+              : null,
+        },
+  });
+};
+
+type LoginListResponse = AppDeviceInbox | AppDeviceInboxWithChanges | { requests: AppPendingLogin[]; pollAfterSeconds: number };
+/** Keep every login: trim Actions first, then device changes, then context from the last login backwards.
+ * Trimmed changes stay pending and show once the inbox has room.
+ * Return a copy so callers and tests can retain the original snapshot. */
+export const trimAppLoginResponse = <T extends LoginListResponse>(response: T, budget: number = APP_APPROVAL_LIMITS.bodyBytes): T => {
+  const result = { ...response };
+  const bytes = () => new TextEncoder().encode(JSON.stringify(result)).length;
+  if ("logins" in result) {
+    result.actions = [...result.actions];
+    result.logins = result.logins.map((login) => ({ ...login }));
+    while (result.actions.length && bytes() > budget) {
+      result.actions.pop();
+      result.moreActions++;
+    }
+    if ("changes" in result) {
+      result.changes = [...result.changes];
+      while (result.changes.length && bytes() > budget) {
+        result.changes.pop();
+        result.moreChanges++;
+      }
+    }
+  } else result.requests = result.requests.map((login) => ({ ...login }));
+  const logins = "logins" in result ? result.logins : result.requests;
+  for (let index = logins.length - 1; index >= 0 && bytes() > budget; index--) delete logins[index]!.context;
+  return result;
+};

package/src/services/mandates/index.ts

@@ -1,6 +1,7 @@
 import { err, fail, ok, type PageParams, type Paginated, paginate, type Result } from "@k2b/stdlib";
 import { type SQL, sql } from "bun";
 import { z } from "zod";
+import type { CapabilityActionPolicy } from "../../contracts/capabilities";
 import { CapabilityAppIdSchema } from "../../contracts/capabilities";
 import { isAccountCategoryAllowed } from "../account-category-policy";
 import { audit } from "../audit";
@@ -626,6 +627,7 @@ export const validateMandateIssueAuthority = async (
     operation: string;
     actionApproval?: "none" | "approved";
     input?: unknown;
+    capabilityPolicy?: CapabilityActionPolicy;
     capabilityApproval?: "none" | "rememberable" | "always";
     expectedRevision?: number;
     requestId?: string;
@@ -687,6 +689,7 @@ export const validateMandateIssueAuthority = async (
       actionApproval: input.actionApproval ?? "none",
       input: input.input,
       capabilityApproval: input.capabilityApproval,
+      capabilityPolicy: input.capabilityPolicy,
     })
   ) {
     return denyMandateIssue(err.forbidden(MANDATE_POLICY_DENIED_MESSAGE));

package/src/services/mandates/policy.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { CapabilityAppIdSchema, CapabilityLocalIdSchema } from "../../contracts/capabilities";
+import { type CapabilityActionPolicy, CapabilityAppIdSchema, CapabilityLocalIdSchema } from "../../contracts/capabilities";
 
 export const MANDATE_POLICY_VERSION = 1 as const;
 export const MANDATE_POLICY_MAX_IDENTIFIERS = 100;
@@ -201,6 +201,7 @@ export const mandatePolicyAllows = (
     operation: string;
     actionApproval: "none" | "approved";
     input?: unknown;
+    capabilityPolicy?: CapabilityActionPolicy;
     capabilityApproval?: "none" | "rememberable" | "always";
   },
 ): boolean => {
@@ -239,7 +240,11 @@ export const mandatePolicyAllows = (
       )
     )
       return false;
-    if (kind === "action" && input.capabilityApproval !== "none" && input.capabilityApproval !== "rememberable") return false;
+    if (kind === "action") {
+      if (input.capabilityPolicy) {
+        if (!("silent" in input.capabilityPolicy) || input.capabilityPolicy.routines === false) return false;
+      } else if (input.capabilityApproval !== "none" && input.capabilityApproval !== "rememberable") return false;
+    }
   }
   if (!input.operation.startsWith("capability.action.run:")) return true;
   if (policy.actions === "deny") return false;
@@ -250,13 +255,20 @@ export const mandatePolicyAllows = (
 /** Discovery ignores fixed inputs: at least one unattended call must fit the policy. */
 export const mandatePolicyCanPermitCapability = (
   policy: MandatePolicyV1,
-  input: { appId: string; capabilityId: string; kind: "query" | "action"; approval?: "none" | "rememberable" | "always" },
+  input: {
+    appId: string;
+    capabilityId: string;
+    kind: "query" | "action";
+    capabilityPolicy?: CapabilityActionPolicy;
+    approval?: "none" | "rememberable" | "always";
+  },
 ): boolean => {
   const call = {
     appId: input.appId,
     operation: `capability.${input.kind === "query" ? "query" : "action.run"}:${input.capabilityId}`,
     actionApproval: "none" as const,
     capabilityApproval: input.approval,
+    capabilityPolicy: input.capabilityPolicy,
   };
   if (policy.grants === undefined) return mandatePolicyAllows(policy, call);
   return policy.grants.some(

package/src/services/notifications/browser.ts

@@ -7,6 +7,7 @@ import { isSafeNotificationTargetHref } from "../../contracts/notification-types
 import { type BrowserPushSubscription, BrowserPushSubscriptionSchema } from "../../contracts/user-notifications";
 import { decryptSecret, encryptSecret } from "../secrets";
 import { coreSettings } from "../settings/api";
+import { SettingUnreadableError } from "../settings/store";
 import { type NotificationDestination, registerNotificationChannel } from "./channels";
 import { NOTIFICATION_PREVIEW_LIMIT } from "./preview";
 import { sendPinnedWebPush } from "./web-push-transport";
@@ -76,10 +77,16 @@ const ensureVapidConfig = (): Promise<{ publicKey: string; privateKey: string }>
   vapidConfigPromise = sql
     .begin(async (tx) => {
       await tx`SELECT pg_advisory_xact_lock(hashtextextended('notifications:web-push-vapid', 0))`;
-      let [publicKey, privateKey] = await Promise.all([
-        coreSettings.get<string>("notifications.web_push_public_key"),
-        coreSettings.get<string>("notifications.web_push_private_key"),
-      ]);
+      const keys = ["notifications.web_push_public_key", "notifications.web_push_private_key"] as const;
+      const states = await Promise.all(keys.map((key) => coreSettings.read<string>(key)));
+      for (const [index, state] of states.entries()) {
+        if (state.stored === "unreadable") {
+          const key = keys[index]!;
+          console.warn(`[notifications] cannot read setting "${key}"; keeping stored VAPID keys unchanged`);
+          throw new SettingUnreadableError(key);
+        }
+      }
+      let [publicKey, privateKey] = states.map((state) => state.value);
       if (!publicKey || !privateKey) {
         const generated = webpush.generateVAPIDKeys();
         publicKey = generated.publicKey;
@@ -240,7 +247,11 @@ unregisterDriver = registerNotificationChannel(browserDriver);
 export const browserNotifications = {
   start: async (): Promise<void> => {
     unregisterDriver ??= registerNotificationChannel(browserDriver);
-    await ensureWebPushConfigured();
+    try {
+      await ensureWebPushConfigured();
+    } catch (error) {
+      if (!(error instanceof SettingUnreadableError)) throw error;
+    }
   },
   stop: (): void => {
     unregisterDriver?.();

package/src/services/notifications/email-frame.ts

@@ -8,7 +8,7 @@ const sanitizeContent = (content: string): string => sanitizeHtml(content, { all
 // sanitize-html decodes entities before escaping &, < and > again. Decode only
 // those escapes once, so literal entity text is not recursively interpreted.
 const htmlText = (html: string): string =>
-  sanitizeContent(html.replace(/<br\b[^>]*>|<\/(?:p|pre|blockquote|div|h[1-6]|li|tr|td|th|ul|ol|table)>/gi, " "))
+  sanitizeContent(html.replace(/<(?:br|hr)\b[^>]*>|<\/(?:p|pre|blockquote|div|h[1-6]|li|tr|td|th|ul|ol|table)>/gi, " "))
     .replace(/&(amp|lt|gt);/g, (entity) => (entity === "&amp;" ? "&" : entity === "&lt;" ? "<" : ">"))
     .replace(/\s+/g, " ")
     .trim();

package/src/services/oauth-tokens.ts

@@ -86,6 +86,18 @@ const mapServiceAccount = (row: ServiceAccountActorRow): ServiceAccount => ({
   createdAt: new Date(row.service_account_created_at).toISOString(),
 });
 
+/** A user access token is current only while its `auth_epoch` claim equals the account's live epoch. */
+export const isOAuthTokenEpochCurrent = (payload: JWTPayload, liveEpoch: unknown): boolean => {
+  const claim = payload.auth_epoch;
+  return (
+    typeof claim === "number" &&
+    Number.isSafeInteger(claim) &&
+    claim >= 0 &&
+    (typeof liveEpoch === "number" || typeof liveEpoch === "bigint" || typeof liveEpoch === "string") &&
+    String(liveEpoch) === String(claim)
+  );
+};
+
 /** Resolve the live OAuth client/principal, then check current account-category policy. */
 export const resolveOAuthTokenActor = async (
   payload: JWTPayload,
@@ -136,13 +148,14 @@ export const resolveOAuthTokenActor = async (
   if (!userId && !uid) return null;
   const predicate = userId ? sql`u.id = ${userId}::uuid` : sql`u.uid = ${uid}`;
   const rows = await query<Record<string, unknown>[]>`
-    SELECT ${userProjectionSql(groupsAdmin)}
+    SELECT u.auth_epoch, ${userProjectionSql(groupsAdmin)}
     FROM oauth.clients c
     JOIN auth.users u ON ${predicate}
     ${userProjectionJoin()}
     WHERE c.client_id = ${clientId}
   `;
-  const user = rows[0] ? buildProjectedUser(rows[0]) : null;
+  if (!rows[0] || !isOAuthTokenEpochCurrent(payload, rows[0].auth_epoch)) return null;
+  const user = buildProjectedUser(rows[0]);
   if (!user || isAccountExpired(user.accountExpires)) return null;
   if (!(await isAccountCategoryAllowed(user, query))) return null;
   return { kind: "user", payload, user, scopes };
@@ -206,4 +219,5 @@ export const clearOAuthVerifierCachesForTest = (): void => {
 
 export const oauthTokens = {
   verifyAccessToken,
+  resolveOAuthTokenActor,
 };