@k2b/cloud 0.39.0 → 0.40.0

package/src/api/me.ts

@@ -4,7 +4,8 @@
  * third-party management lives in the accounts admin app.
  */
 
-import { err, fail, ok } from "@k2b/stdlib";
+import { err, fail, ok, type Result } from "@k2b/stdlib";
+import { sql } from "bun";
 import { type Context, Hono, type MiddlewareHandler } from "hono";
 import { createMiddleware } from "hono/factory";
 import { describeRoute } from "hono-openapi";
@@ -40,6 +41,7 @@ import {
 import { CapabilityAppIdSchema } from "../contracts/capabilities";
 import { type AuthContext, auth, getLocale, getTimeZone, jsonResponse, rateLimit, requiresAuth, respond, v } from "../server";
 import { APP_SESSION_FORBIDDEN } from "../server/middleware/auth";
+import { noTransform } from "../server/middleware/no-transform";
 import {
   accountLifecycle,
   accountsAppService as accountsService,
@@ -51,8 +53,11 @@ import {
   webauthn,
 } from "../services";
 import { MandatePolicyV1Schema } from "../services/mandates";
+import { ConfirmedBrowserSignInError, requireConfirmedBrowserSignIn } from "../services/session/recent";
 import { coreSettings } from "../services/settings/api";
 
+import { lastingAccessApiMessages } from "./lasting-access-messages";
+import { createMePanelConsentRoutes } from "./me-panel-consent";
 import { createMeRailRoutes } from "./me-rail";
 import { createMeWebVitalsRoutes } from "./me-web-vitals";
 
@@ -67,19 +72,10 @@ const toAccountsActor = (user: AuthContext["Variables"]["user"]) => ({
 const webOnly = (c: Context) => c.json(APP_SESSION_FORBIDDEN, 403);
 
 /**
- * Guards the endpoints that manage how the account is authenticated: passkeys,
- * API keys, the password, and account deletion.
- *
- * `auth.requireUser()` is not enough for these. A personal API key acts as
- * its user, so it passes that check — and could then enrol a passkey, which is
- * a full account takeover, or mint further keys that outlive the revocation of
- * the one that was leaked. No scope in the vocabulary means "may add an
- * authenticator", so a credential must not reach these endpoints at all.
- *
- * A credential may still *read* its account's passkeys and keys; only the
- * mutations are gated. Browser sessions and user-issued OAuth access tokens
- * both resolve to a `user` actor and are unaffected. The mobile app's session
- * is rejected too: whatever it created would outlive removing the phone.
+ * Guards passkey and key removal, password changes, and account deletion.
+ * Browser sessions and user OAuth actors may perform these actions; personal
+ * API keys and mobile app sessions may not. Adding keys and sign-in methods
+ * requires a confirmed browser sign-in through the separate creation gate.
  */
 const requireDirectUserActor = createMiddleware<AuthContext>(async (c, next) => {
   if (c.get("actor")?.kind !== "user") {
@@ -95,6 +91,27 @@ const requireDirectUserActor = createMiddleware<AuthContext>(async (c, next) =>
   return next();
 });
 
+const requireBrowserSignIn = createMiddleware<AuthContext>(async (c, next) => {
+  if (!(await auth.browserSignIn(c))) {
+    return c.json(
+      { code: "BROWSER_SIGN_IN_REQUIRED", message: lastingAccessApiMessages.resolve([getLocale(c)]).t.browserSignInRequired },
+      403,
+    );
+  }
+  return next();
+});
+
+const lastingAccessMessage = (c: Context<AuthContext>, code: "REAUTHENTICATE" | "FORBIDDEN") => {
+  const { t } = lastingAccessApiMessages.resolve([getLocale(c)]);
+  return code === "REAUTHENTICATE" ? t.reauthenticate : t.forbidden;
+};
+
+/** The creation services fail with these codes only when the browser sign-in does not confirm the write. */
+const localizeLastingAccessResult = <T>(c: Context<AuthContext>, result: Result<T>): Result<T> =>
+  !result.ok && (result.error.code === "REAUTHENTICATE" || result.error.code === "FORBIDDEN")
+    ? fail({ ...result.error, message: lastingAccessMessage(c, result.error.code) })
+    : result;
+
 const ExtendAccountResponseSchema = z.object({
   message: z.string(),
   newExpiry: z.string().datetime().optional(),
@@ -194,11 +211,13 @@ const NotificationHistoryQuerySchema = z.object({
 });
 const mandateRoutes = createMeMandateRoutes();
 const app = new Hono<AuthContext>()
+  .use("/notifications/history/*", noTransform())
   .use(rateLimit())
   .use(auth.requireRole("authenticated"))
   .use(auth.requireUser())
   .route("/", mandateRoutes)
   .route("/", createMeRailRoutes())
+  .route("/", createMePanelConsentRoutes())
   .route("/", createMeWebVitalsRoutes())
 
   .get(
@@ -540,7 +559,7 @@ const app = new Hono<AuthContext>()
 
   .post(
     "/passkeys/registration/start",
-    requireDirectUserActor,
+    requireBrowserSignIn,
     describeRoute({
       tags: ["Me"],
       summary: "Start passkey registration",
@@ -549,15 +568,28 @@ const app = new Hono<AuthContext>()
       responses: {
         200: jsonResponse(z.unknown(), "Passkey registration options"),
         401: jsonResponse(ErrorResponseSchema, "Authentication required"),
-        403: jsonResponse(ErrorResponseSchema, "Not permitted for API keys or other credentials"),
+        403: jsonResponse(ErrorResponseSchema, "Confirmed browser sign-in required (BROWSER_SIGN_IN_REQUIRED or REAUTHENTICATE)"),
       },
     }),
-    async (c) => respond(c, webauthn.beginRegistration({ user: c.get("user") })),
+    async (c) => {
+      const signIn = await auth.browserSignIn(c);
+      if (!signIn) throw new Error("Browser sign-in gate was not applied");
+      try {
+        await requireConfirmedBrowserSignIn(sql, signIn, (code) => {
+          throw new ConfirmedBrowserSignInError(code);
+        });
+      } catch (error) {
+        if (error instanceof ConfirmedBrowserSignInError)
+          return c.json({ code: error.code, message: lastingAccessMessage(c, error.code) }, 403);
+        throw error;
+      }
+      return respond(c, webauthn.beginRegistration({ user: c.get("user") }));
+    },
   )
 
   .post(
     "/passkeys/registration/verify",
-    requireDirectUserActor,
+    requireBrowserSignIn,
     describeRoute({
       tags: ["Me"],
       summary: "Verify passkey registration",
@@ -567,20 +599,26 @@ const app = new Hono<AuthContext>()
         201: jsonResponse(WebAuthnPasskeySchema, "Passkey created"),
         400: jsonResponse(ErrorResponseSchema, "Passkey registration failed"),
         401: jsonResponse(ErrorResponseSchema, "Authentication required"),
-        403: jsonResponse(ErrorResponseSchema, "Not permitted for API keys or other credentials"),
+        403: jsonResponse(ErrorResponseSchema, "Confirmed browser sign-in required (BROWSER_SIGN_IN_REQUIRED or REAUTHENTICATE)"),
       },
     }),
     v("json", CreateWebAuthnPasskeySchema),
     async (c) =>
       respond(
         c,
-        () => {
+        async () => {
           const data = c.req.valid("json");
-          return webauthn.finishRegistration({
-            user: c.get("user"),
-            name: data.name,
-            response: data.response as never,
-          });
+          const browserSignIn = await auth.browserSignIn(c);
+          if (!browserSignIn) throw new Error("Browser sign-in gate was not applied");
+          return localizeLastingAccessResult(
+            c,
+            await webauthn.finishRegistration({
+              browserSignIn,
+              user: c.get("user"),
+              name: data.name,
+              response: data.response as never,
+            }),
+          );
         },
         201,
       ),
@@ -611,7 +649,7 @@ const app = new Hono<AuthContext>()
 
   .post(
     "/api-keys",
-    requireDirectUserActor,
+    requireBrowserSignIn,
     describeRoute({
       tags: ["Me"],
       summary: "Create current user API key",
@@ -622,7 +660,10 @@ const app = new Hono<AuthContext>()
         201: jsonResponse(CreateUserApiKeyResponseSchema, "API key created"),
         400: jsonResponse(ErrorResponseSchema, "Failed to create API key"),
         401: jsonResponse(ErrorResponseSchema, "Authentication required"),
-        403: jsonResponse(ErrorResponseSchema, "Credential not permitted or models-only API turned off"),
+        403: jsonResponse(
+          ErrorResponseSchema,
+          "Confirmed browser sign-in required (BROWSER_SIGN_IN_REQUIRED or REAUTHENTICATE), or models-only API turned off",
+        ),
       },
     }),
     v("json", CreateUserApiKeySchema),
@@ -638,12 +679,18 @@ const app = new Hono<AuthContext>()
                 "Models-only API keys are turned off. An administrator can turn on the OpenAI-compatible API in the AI settings.",
               ),
             );
-          return serviceAccountCredentials.createUserApiToken({
-            access: data.access,
-            user,
-            name: data.name,
-            expiresAt: data.expiresAt ?? null,
-          });
+          const browserSignIn = await auth.browserSignIn(c);
+          if (!browserSignIn) throw new Error("Browser sign-in gate was not applied");
+          return localizeLastingAccessResult(
+            c,
+            await serviceAccountCredentials.createUserApiToken({
+              browserSignIn,
+              access: data.access,
+              user,
+              name: data.name,
+              expiresAt: data.expiresAt ?? null,
+            }),
+          );
         },
         201,
       ),

package/src/api/search.ts

@@ -12,6 +12,7 @@ import {
   UniversalSearchDataSchema,
 } from "../contracts";
 import { type AuthContext, auth, expectUserBackedActor, jsonResponse, preferredLocale, requiresAuth, v } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 import { logger } from "../services";
 import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { searchInvocationOperation } from "../services/identity/invocation-operations";
@@ -103,7 +104,8 @@ type AppOutcome = { appId: string; status: SearchProviderStatus; items: SearchIt
 export const createSearchRoutes = (dependencies: SearchRouteDependencies = {}) => {
   const registry = dependencies.listCapabilities ?? listCapabilities;
   const fetchProvider = dependencies.fetch ?? globalThis.fetch;
-  return new Hono<AuthContext>().use(dependencies.authenticate ?? auth.requireRole("authenticated")).get(
+  const router = new Hono<AuthContext>().use("/search/*", noTransform());
+  return router.use(dependencies.authenticate ?? auth.requireRole("authenticated")).get(
     "/search",
     describeRoute({
       tags: ["Search"],

package/src/api/sync-ops.ts

@@ -2,6 +2,7 @@ import { Hono, type MiddlewareHandler } from "hono";
 import { readBoundedJson } from "../_internal/bounded-json";
 import { getApp, listApps } from "../_internal/registry";
 import { type AuthContext, auth, rejectReservedWorkloadCredential } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { syncInvocationOperation } from "../services/identity/invocation-operations";
 import { normalizeInvocationRequestId, signInvocationToken } from "../services/identity/invocation-token";
@@ -19,6 +20,7 @@ type Dependencies = {
 /** Core owns the credential-bearing hop; targets receive only an operation-bound invocation. */
 export const createSyncOpsProxyRoutes = (dependencies: Dependencies = {}) =>
   new Hono<AuthContext>()
+    .use("*", noTransform())
     .use(dependencies.authenticate ?? auth.requireRole("admin"))
     .use(rejectReservedWorkloadCredential)
     .use(auth.requireOAuthScope("admin"))

package/src/api/widgets.ts

@@ -20,6 +20,7 @@ import {
   widgetKey,
 } from "../contracts/widgets";
 import { type AuthContext, auth, preferredLocale, rejectReservedWorkloadCredential } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 import { WIDGET_SETTINGS_PARAM, WIDGET_SETTINGS_PARAM_MAX_LENGTH, WIDGET_SIZE_PARAM } from "../server/widget-request";
 import { CLOUD_INVOCATION_TOKEN_TTL_SECONDS } from "../services/identity/constants";
 import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
@@ -299,6 +300,8 @@ export const createWidgetRoutes = (dependencies: WidgetRouteDependencies = {}) =
 
   return (
     new Hono<AuthContext>()
+      .use("/widgets/v1", noTransform())
+      .use("/widgets/v1/*", noTransform())
       .use(dependencies.authenticate ?? auth.requireRole("authenticated"))
       .use(rejectReservedWorkloadCredential)
       .use(auth.requireOAuthScope("read", "admin"))