@k2b/cloud 0.39.0 → 0.41.0

package/src/services/login-context.ts

@@ -0,0 +1,118 @@
+import {
+  APP_APPROVAL_LIMITS,
+  type AppDeviceInbox,
+  type AppDeviceInboxWithChanges,
+  type AppLoginContext,
+  AppLoginContextSchema,
+  type AppPendingLogin,
+} from "../contracts/app-approval";
+import { truncateUtf8 } from "../server/request-context/geoip";
+import { KNOWN_BROWSER_LIMITS } from "./known-browsers";
+
+export type AppLoginRequestContext = Pick<AppLoginContext, "browser" | "os" | "country" | "city" | "network"> & {
+  cookie: string | null;
+  prefix: string | null;
+};
+export type LoginContextInput = {
+  request?: AppLoginRequestContext;
+  browser: { firstSeenAt: Date } | null;
+  countries: { seen: boolean; any: boolean };
+  trust: { introActive: boolean; geoipSince: Date | null };
+  now: Date;
+};
+
+/** Core's only level rule. Descriptions and same-network hints do not affect it. */
+export const loginContextLevel = (input: {
+  introActive: boolean;
+  knownBrowser: boolean;
+  newCountry: boolean;
+  anyCountry: boolean;
+}): AppLoginContext["level"] => {
+  if (input.introActive) return "info";
+  if (input.knownBrowser) return input.newCountry ? "hint" : "info";
+  return input.newCountry && input.anyCountry ? "warn" : "hint";
+};
+
+/** JSONB adds a space after each colon and comma. Two bytes per entry bound
+ * both separators, including nested objects/arrays, without counting punctuation in strings. */
+export const loginContextStorageBytes = (value: unknown): number => {
+  const separators = (item: unknown): number => {
+    if (!item || typeof item !== "object") return 0;
+    const values = Object.values(item);
+    return 2 * values.length + values.reduce<number>((sum, entry) => sum + separators(entry), 0);
+  };
+  return new TextEncoder().encode(JSON.stringify(value)).length + separators(value);
+};
+
+/** Never store sameNetwork. Oversized or invalid context cannot prevent a sign-in. */
+export const boundLoginContext = (input: AppLoginContext): AppLoginContext | null => {
+  const { sameNetwork: _transient, ...context } = input;
+  if (loginContextStorageBytes(context) > 512) {
+    context.city = null;
+    context.network = null;
+  }
+  if (loginContextStorageBytes(context) > 512) return null;
+  const parsed = AppLoginContextSchema.safeParse(context);
+  return parsed.success ? parsed.data : null;
+};
+
+export const buildLoginContext = ({ request, browser, countries, trust, now }: LoginContextInput): AppLoginContext | null => {
+  const country = request?.country ?? null;
+  const newCountry = country !== null && trust.geoipSince !== null && !countries.seen;
+  const name = (value: string | null | undefined) =>
+    value
+      ? truncateUtf8(
+          value
+            .replace(/[\p{Cc}\p{Zl}\p{Zp}]/gu, " ")
+            .replace(/\p{Cf}/gu, "")
+            .replace(/\s+/gu, " ")
+            .trim(),
+          96,
+        ) || null
+      : null;
+  return boundLoginContext({
+    level: loginContextLevel({ introActive: trust.introActive, knownBrowser: browser !== null, newCountry, anyCountry: countries.any }),
+    browser: request?.browser ?? "other",
+    os: request?.os ?? "other",
+    country,
+    city: name(request?.city),
+    network: name(request?.network),
+    history: trust.introActive
+      ? null
+      : {
+          knownSince: browser?.firstSeenAt.toISOString() ?? null,
+          newCountry,
+          countriesSince:
+            trust.geoipSince && now.getTime() - trust.geoipSince.getTime() < KNOWN_BROWSER_LIMITS.retentionDays * 86_400_000
+              ? trust.geoipSince.toISOString()
+              : null,
+        },
+  });
+};
+
+type LoginListResponse = AppDeviceInbox | AppDeviceInboxWithChanges | { requests: AppPendingLogin[]; pollAfterSeconds: number };
+/** Keep every login: trim Actions first, then device changes, then context from the last login backwards.
+ * Trimmed changes stay pending and show once the inbox has room.
+ * Return a copy so callers and tests can retain the original snapshot. */
+export const trimAppLoginResponse = <T extends LoginListResponse>(response: T, budget: number = APP_APPROVAL_LIMITS.bodyBytes): T => {
+  const result = { ...response };
+  const bytes = () => new TextEncoder().encode(JSON.stringify(result)).length;
+  if ("logins" in result) {
+    result.actions = [...result.actions];
+    result.logins = result.logins.map((login) => ({ ...login }));
+    while (result.actions.length && bytes() > budget) {
+      result.actions.pop();
+      result.moreActions++;
+    }
+    if ("changes" in result) {
+      result.changes = [...result.changes];
+      while (result.changes.length && bytes() > budget) {
+        result.changes.pop();
+        result.moreChanges++;
+      }
+    }
+  } else result.requests = result.requests.map((login) => ({ ...login }));
+  const logins = "logins" in result ? result.logins : result.requests;
+  for (let index = logins.length - 1; index >= 0 && bytes() > budget; index--) delete logins[index]!.context;
+  return result;
+};

package/src/services/mandates/index.ts

@@ -1,6 +1,7 @@
 import { err, fail, ok, type PageParams, type Paginated, paginate, type Result } from "@k2b/stdlib";
 import { type SQL, sql } from "bun";
 import { z } from "zod";
+import type { CapabilityActionPolicy } from "../../contracts/capabilities";
 import { CapabilityAppIdSchema } from "../../contracts/capabilities";
 import { isAccountCategoryAllowed } from "../account-category-policy";
 import { audit } from "../audit";
@@ -626,6 +627,7 @@ export const validateMandateIssueAuthority = async (
     operation: string;
     actionApproval?: "none" | "approved";
     input?: unknown;
+    capabilityPolicy?: CapabilityActionPolicy;
     capabilityApproval?: "none" | "rememberable" | "always";
     expectedRevision?: number;
     requestId?: string;
@@ -687,6 +689,7 @@ export const validateMandateIssueAuthority = async (
       actionApproval: input.actionApproval ?? "none",
       input: input.input,
       capabilityApproval: input.capabilityApproval,
+      capabilityPolicy: input.capabilityPolicy,
     })
   ) {
     return denyMandateIssue(err.forbidden(MANDATE_POLICY_DENIED_MESSAGE));

package/src/services/mandates/policy.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { CapabilityAppIdSchema, CapabilityLocalIdSchema } from "../../contracts/capabilities";
+import { type CapabilityActionPolicy, CapabilityAppIdSchema, CapabilityLocalIdSchema } from "../../contracts/capabilities";
 
 export const MANDATE_POLICY_VERSION = 1 as const;
 export const MANDATE_POLICY_MAX_IDENTIFIERS = 100;
@@ -201,6 +201,7 @@ export const mandatePolicyAllows = (
     operation: string;
     actionApproval: "none" | "approved";
     input?: unknown;
+    capabilityPolicy?: CapabilityActionPolicy;
     capabilityApproval?: "none" | "rememberable" | "always";
   },
 ): boolean => {
@@ -239,7 +240,11 @@ export const mandatePolicyAllows = (
       )
     )
       return false;
-    if (kind === "action" && input.capabilityApproval !== "none" && input.capabilityApproval !== "rememberable") return false;
+    if (kind === "action") {
+      if (input.capabilityPolicy) {
+        if (!("silent" in input.capabilityPolicy) || input.capabilityPolicy.routines === false) return false;
+      } else if (input.capabilityApproval !== "none" && input.capabilityApproval !== "rememberable") return false;
+    }
   }
   if (!input.operation.startsWith("capability.action.run:")) return true;
   if (policy.actions === "deny") return false;
@@ -250,13 +255,20 @@ export const mandatePolicyAllows = (
 /** Discovery ignores fixed inputs: at least one unattended call must fit the policy. */
 export const mandatePolicyCanPermitCapability = (
   policy: MandatePolicyV1,
-  input: { appId: string; capabilityId: string; kind: "query" | "action"; approval?: "none" | "rememberable" | "always" },
+  input: {
+    appId: string;
+    capabilityId: string;
+    kind: "query" | "action";
+    capabilityPolicy?: CapabilityActionPolicy;
+    approval?: "none" | "rememberable" | "always";
+  },
 ): boolean => {
   const call = {
     appId: input.appId,
     operation: `capability.${input.kind === "query" ? "query" : "action.run"}:${input.capabilityId}`,
     actionApproval: "none" as const,
     capabilityApproval: input.approval,
+    capabilityPolicy: input.capabilityPolicy,
   };
   if (policy.grants === undefined) return mandatePolicyAllows(policy, call);
   return policy.grants.some(

package/src/services/notifications/email-frame.ts

@@ -8,7 +8,7 @@ const sanitizeContent = (content: string): string => sanitizeHtml(content, { all
 // sanitize-html decodes entities before escaping &, < and > again. Decode only
 // those escapes once, so literal entity text is not recursively interpreted.
 const htmlText = (html: string): string =>
-  sanitizeContent(html.replace(/<br\b[^>]*>|<\/(?:p|pre|blockquote|div|h[1-6]|li|tr|td|th|ul|ol|table)>/gi, " "))
+  sanitizeContent(html.replace(/<(?:br|hr)\b[^>]*>|<\/(?:p|pre|blockquote|div|h[1-6]|li|tr|td|th|ul|ol|table)>/gi, " "))
     .replace(/&(amp|lt|gt);/g, (entity) => (entity === "&amp;" ? "&" : entity === "&lt;" ? "<" : ">"))
     .replace(/\s+/g, " ")
     .trim();

package/src/services/oauth-tokens.ts

@@ -86,6 +86,18 @@ const mapServiceAccount = (row: ServiceAccountActorRow): ServiceAccount => ({
   createdAt: new Date(row.service_account_created_at).toISOString(),
 });
 
+/** A user access token is current only while its `auth_epoch` claim equals the account's live epoch. */
+export const isOAuthTokenEpochCurrent = (payload: JWTPayload, liveEpoch: unknown): boolean => {
+  const claim = payload.auth_epoch;
+  return (
+    typeof claim === "number" &&
+    Number.isSafeInteger(claim) &&
+    claim >= 0 &&
+    (typeof liveEpoch === "number" || typeof liveEpoch === "bigint" || typeof liveEpoch === "string") &&
+    String(liveEpoch) === String(claim)
+  );
+};
+
 /** Resolve the live OAuth client/principal, then check current account-category policy. */
 export const resolveOAuthTokenActor = async (
   payload: JWTPayload,
@@ -136,13 +148,14 @@ export const resolveOAuthTokenActor = async (
   if (!userId && !uid) return null;
   const predicate = userId ? sql`u.id = ${userId}::uuid` : sql`u.uid = ${uid}`;
   const rows = await query<Record<string, unknown>[]>`
-    SELECT ${userProjectionSql(groupsAdmin)}
+    SELECT u.auth_epoch, ${userProjectionSql(groupsAdmin)}
     FROM oauth.clients c
     JOIN auth.users u ON ${predicate}
     ${userProjectionJoin()}
     WHERE c.client_id = ${clientId}
   `;
-  const user = rows[0] ? buildProjectedUser(rows[0]) : null;
+  if (!rows[0] || !isOAuthTokenEpochCurrent(payload, rows[0].auth_epoch)) return null;
+  const user = buildProjectedUser(rows[0]);
   if (!user || isAccountExpired(user.accountExpires)) return null;
   if (!(await isAccountCategoryAllowed(user, query))) return null;
   return { kind: "user", payload, user, scopes };
@@ -206,4 +219,5 @@ export const clearOAuthVerifierCachesForTest = (): void => {
 
 export const oauthTokens = {
   verifyAccessToken,
+  resolveOAuthTokenActor,
 };

package/src/services/panel-context-consent.ts

@@ -0,0 +1,58 @@
+import { type SQL, sql } from "bun";
+import { CapabilityAppIdSchema } from "../contracts/capabilities";
+
+type ConsentAnswer = { allowed: boolean; revision: number };
+export class PanelConsentCancelled extends Error {
+  constructor() {
+    super("The request was cancelled before the panel consent was saved");
+  }
+}
+
+/**
+ * Core owns the table; platform requests read without a process-wide cache. Missing is distinct from denied. Reads
+ * take a share lock, so a page rendered while a save is in flight sees that save's outcome, not the answer before it.
+ */
+export const createPanelContextConsentService = (db: SQL = sql) => ({
+  async get(userId: string, provider: string): Promise<ConsentAnswer | null> {
+    CapabilityAppIdSchema.parse(provider);
+    const [row] = await db<ConsentAnswer[]>`
+      SELECT allowed, revision FROM auth.panel_context_consent WHERE user_id = ${userId}::uuid AND provider = ${provider}
+      FOR SHARE
+    `;
+    return row ?? null;
+  },
+  async list(userId: string, providers: string[]): Promise<Record<string, ConsentAnswer>> {
+    if (!providers.length) return {};
+    for (const provider of providers) CapabilityAppIdSchema.parse(provider);
+    const rows = await db<({ provider: string } & ConsentAnswer)[]>`
+      SELECT provider, allowed, revision FROM auth.panel_context_consent
+      WHERE user_id = ${userId}::uuid AND provider IN ${db(providers)}
+      FOR SHARE
+    `;
+    return Object.fromEntries(rows.map(({ provider, allowed, revision }) => [provider, { allowed, revision }]));
+  },
+  /**
+   * Compare-and-set on the revision the client read. A save whose request was cancelled (the browser gave up or
+   * left) is rolled back before commit, so no answer lands after its page stopped waiting.
+   */
+  async set(userId: string, provider: string, allowed: boolean, revision: number, signal?: AbortSignal): Promise<ConsentAnswer | null> {
+    CapabilityAppIdSchema.parse(provider);
+    return db.begin(async (tx) => {
+      await tx`SET LOCAL statement_timeout = '5s'`;
+      const [row] = await tx<ConsentAnswer[]>`
+      INSERT INTO auth.panel_context_consent (user_id, provider, allowed, revision)
+      SELECT ${userId}::uuid, ${provider}, ${allowed}, 1
+      WHERE ${revision} = 0 OR EXISTS (
+        SELECT 1 FROM auth.panel_context_consent WHERE user_id = ${userId}::uuid AND provider = ${provider}
+      )
+      ON CONFLICT (user_id, provider) DO UPDATE SET
+        allowed = EXCLUDED.allowed, revision = auth.panel_context_consent.revision + 1, updated_at = now()
+      WHERE auth.panel_context_consent.revision = ${revision}
+      RETURNING allowed, revision
+    `;
+      if (signal?.aborted) throw new PanelConsentCancelled();
+      return row ?? null;
+    });
+  },
+});
+export const panelContextConsent = createPanelContextConsentService();

package/src/services/pdf/markdown.ts

@@ -1,4 +1,5 @@
 import { markdownInfoBlocks, markdownLinkReference, renderMarkdownLink } from "@k2b/ui";
+import { decodeHTML } from "entities";
 import { Marked, Renderer, type Tokens } from "marked";
 import postcss from "postcss";
 import {
@@ -165,6 +166,161 @@ a.k2b-reference { padding: .05em .3em; border-radius: .3em; background: #eeeff2;
 .k2b-reference__icon, .k2b-text-link__external { display: none; }
 `;
 
+/**
+ * Break-anywhere lowers table column width to one character, splitting even
+ * short numbers. Cells keep words whole; long runs get explicit break points.
+ */
+const TABLE_CELL_PRINT_CSS = `
+th, td { overflow-wrap: break-word; word-break: normal; }
+`;
+
+// Up to 20 characters covers nearly every real word, including German
+// compounds and IBAN-like values below that length. Longer URLs, code, hashes
+// or paths need a 10-character step: even nine columns fit the document
+// preset's narrowest row (about 90 table characters). A 20-character step
+// clipped six columns of long inline code that fitted before this protection.
+const MAX_WHOLE_CELL_RUN = 20;
+const CELL_RUN_BREAK_STEP = 10;
+
+// References (including semicolonless ones) and literal code points are raw
+// pieces. Decode for whitespace and grapheme boundaries, but preserve spelling.
+// Limit names to 32 characters, the longest HTML reference name.
+const CHARACTER_REFERENCE = /&(?:#[xX][0-9a-fA-F]+|#[0-9]+|[A-Za-z][A-Za-z0-9]{0,31});?/gu;
+const GRAPHEMES = new Intl.Segmenter(undefined, { granularity: "grapheme" });
+
+const runUnits = (pieces: { raw: string; decoded: string }[]): string[] => {
+  const decoded = pieces.map((piece) => piece.decoded).join("");
+  const ends = new Set(Array.from(GRAPHEMES.segment(decoded), ({ index, segment }) => index + segment.length));
+  const units: string[] = [];
+  let at = 0;
+  let unit = "";
+  // A boundary must end both a grapheme and a raw piece, even if it decodes
+  // to several graphemes (such as &ampx or an unknown reference-like name).
+  for (const piece of pieces) {
+    unit += piece.raw;
+    at += piece.decoded.length;
+    if (ends.has(at)) {
+      units.push(unit);
+      unit = "";
+    }
+  }
+  return units;
+};
+
+// Inline formatting does not end a run: `aaa**bbb**ccc` prints one unbroken
+// word. Any other element, such as <br>, <wbr>, an image, a span, or a
+// block, starts a new run, so a short value beside it never breaks.
+const INLINE_FORMATTING = new Set([
+  "a",
+  "b",
+  "code",
+  "del",
+  "em",
+  "i",
+  "ins",
+  "kbd",
+  "mark",
+  "s",
+  "samp",
+  "small",
+  "strong",
+  "sub",
+  "sup",
+  "u",
+  "var",
+]);
+
+// Graphics and formulas keep their own layout. In raw-text and RCDATA elements
+// a <wbr> would be literal text, not markup.
+const SKIPPED_IN_CELLS = new Set([
+  "svg",
+  "math",
+  "style",
+  "script",
+  "textarea",
+  "title",
+  "xmp",
+  "iframe",
+  "noembed",
+  "noframes",
+  "noscript",
+]);
+
+const breakLongCellRuns = (html: string): string => {
+  let skippedDepth = 0;
+  let buffer = "";
+  // Units of the run that the previous text node in the cell ended with.
+  let carried = 0;
+  const pieces = new RegExp(`(${CHARACTER_REFERENCE.source})|.`, "gsu");
+  const breakText = (text: string): string => {
+    let output = "";
+    let run: { raw: string; decoded: string }[] = [];
+    const flushRun = () => {
+      const units = runUnits(run);
+      run = [];
+      const start = carried;
+      carried += units.length;
+      // A run that continues in a later text node is counted when it gets
+      // there; earlier nodes stay as written, so at most 30 units stay whole.
+      if (carried <= MAX_WHOLE_CELL_RUN) {
+        output += units.join("");
+        return;
+      }
+      output += units
+        .map((unit, index) => ((start + index) % CELL_RUN_BREAK_STEP === 0 && start + index > 0 ? `<wbr>${unit}` : unit))
+        .join("");
+    };
+    for (const [raw, reference] of text.matchAll(pieces)) {
+      const decoded = reference === undefined ? raw : decodeHTML(raw);
+      // Literal and referenced whitespace end runs, except no-break characters.
+      if (/^[^\S\u00a0\u2007\u202f\ufeff]+$/u.test(decoded)) {
+        flushRun();
+        carried = 0;
+        output += raw;
+      } else {
+        run.push({ raw, decoded });
+      }
+    }
+    flushRun();
+    return output;
+  };
+
+  return new HTMLRewriter()
+    .on("td *, th *", {
+      element(element) {
+        if (INLINE_FORMATTING.has(element.tagName)) return;
+        carried = 0;
+        // Void elements and self-closing foreign elements have no end tag. HTML
+        // ignores the self-closing flag elsewhere: <textarea/> still opens raw text.
+        if (!element.canHaveContent) return;
+        const skipped = SKIPPED_IN_CELLS.has(element.tagName);
+        if (skipped) skippedDepth += 1;
+        // One end tag handler per element: a second registration would replace this one.
+        element.onEndTag(() => {
+          carried = 0;
+          if (skipped) skippedDepth -= 1;
+        });
+      },
+    })
+    .on("td, th", {
+      element() {
+        carried = 0;
+      },
+      text(chunk) {
+        if (skippedDepth) return;
+        // HTMLRewriter may split one text node (even an entity) into chunks.
+        buffer += chunk.text;
+        if (chunk.lastInTextNode) {
+          chunk.replace(breakText(buffer), { html: true });
+          buffer = "";
+        } else {
+          chunk.remove();
+        }
+      },
+    })
+    .transform(html);
+};
+
 const byteLength = (value: string): number => new TextEncoder().encode(value).byteLength;
 
 const escapeHtml = (value: string): string =>
@@ -258,7 +414,9 @@ export const buildPresetPdfHtml = (input: BuildPresetPdfHtmlInput): string => {
   const suppliedCustomCss = input.customCss?.trim() ?? "";
   const customCss = suppliedCustomCss ? validateCustomCss(input.customCss ?? "") : "";
   const presetCss = templateId ? TEMPLATE_CSS[templateId] : customCss ? "" : TEMPLATE_CSS.document;
-  const baseCss = [presetCss, INFO_BLOCK_PRINT_CSS, LINK_PRINT_CSS, input.css ? styleText(input.css) : ""].filter(Boolean).join("\n");
+  const baseCss = [presetCss, INFO_BLOCK_PRINT_CSS, LINK_PRINT_CSS, TABLE_CELL_PRINT_CSS, input.css ? styleText(input.css) : ""]
+    .filter(Boolean)
+    .join("\n");
   const stylesheet = `${baseCss}${baseCss && customCss ? `\n/* Custom CSS overrides */\n` : ""}${customCss}`;
   return `<!doctype html>
 <html lang="en">
@@ -268,7 +426,7 @@ export const buildPresetPdfHtml = (input: BuildPresetPdfHtmlInput): string => {
 <meta http-equiv="Content-Security-Policy" content="default-src 'none'; base-uri 'none'; connect-src 'none'; font-src 'none'; form-action 'none'; frame-src 'none'; img-src 'none'; media-src 'none'; object-src 'none'; script-src 'none'; style-src 'unsafe-inline'">
 <style>${stylesheet}</style>
 </head>
-<body><main class="markdown-document">${input.html}</main></body>
+<body><main class="markdown-document">${breakLongCellRuns(input.html)}</main></body>
 </html>`;
 };
 

package/src/services/service-account-credentials.ts

@@ -11,6 +11,7 @@ import {
   type StandaloneServiceAccountKind,
   serviceAccounts,
 } from "./service-accounts";
+import { ConfirmedBrowserSignInError, requireConfirmedBrowserSignIn } from "./session/recent";
 
 export type ServiceAccountCredentialStatus = "active" | "revoked";
 export type ServiceAccountCredentialKind = "api_token";
@@ -388,10 +389,27 @@ export const createApiToken = async (params: {
 
 export const createUserApiToken = async (params: {
   user: User;
+  browserSignIn: { userId: string; sid: string };
   access?: "full" | "models";
   name: string;
   expiresAt?: string | null;
 }): Promise<Result<{ credential: ServiceAccountCredential; token: string }>> => {
+  const confirmSignIn = async (db: SQL): Promise<ReturnType<typeof fail> | null> => {
+    if (params.browserSignIn.userId !== params.user.id) return fail(err.forbidden("The browser sign-in belongs to another account."));
+    try {
+      await requireConfirmedBrowserSignIn(db, params.browserSignIn, (code) => {
+        throw new ConfirmedBrowserSignInError(code);
+      });
+      return null;
+    } catch (error) {
+      if (error instanceof ConfirmedBrowserSignInError) return fail({ code: error.code, status: 403, message: error.message });
+      throw error;
+    }
+  };
+
+  // Checked before the key holder is created and again where the key is written.
+  const early = await confirmSignIn(sql);
+  if (early) return early;
   const serviceAccountResult = await getOrCreateUserDelegatedServiceAccount({
     userId: params.user.id,
     createdBy: params.user.id,
@@ -399,6 +417,9 @@ export const createUserApiToken = async (params: {
   if (!serviceAccountResult.ok) return fail(serviceAccountResult.error);
 
   return sql.begin(async (tx) => {
+    const rejected = await confirmSignIn(tx);
+    if (rejected) return rejected;
+
     const result = await insertApiToken(tx, {
       serviceAccountId: serviceAccountResult.data.id,
       name: params.name,