@k2b/cloud 0.41.0 → 0.42.0

package/src/api/widgets.ts

@@ -1,8 +1,9 @@
+import type { SQL } from "bun";
 import { type Context, Hono, type MiddlewareHandler } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { z } from "zod";
 import { readBoundedJson } from "../_internal/bounded-json";
-import { type DashboardWidget, listWidgets } from "../_internal/registry";
+import { type DashboardWidget, type listApps, listWidgets } from "../_internal/registry";
 import { parseWidgetSettings } from "../_internal/widget-settings";
 import {
   type DashboardWidgetSize,
@@ -20,12 +21,16 @@ import {
   widgetKey,
 } from "../contracts/widgets";
 import { type AuthContext, auth, preferredLocale, rejectReservedWorkloadCredential } from "../server";
+import { AppAccessDeniedError, appAccessDeniedBody } from "../server/middleware/app-access";
 import { noTransform } from "../server/middleware/no-transform";
 import { WIDGET_SETTINGS_PARAM, WIDGET_SETTINGS_PARAM_MAX_LENGTH, WIDGET_SIZE_PARAM } from "../server/widget-request";
+import { appAccessAuthority } from "../services/app-access";
+import { discoverableAppEntries } from "../services/app-discovery";
 import { CLOUD_INVOCATION_TOKEN_TTL_SECONDS } from "../services/identity/constants";
 import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { widgetInvocationOperation } from "../services/identity/invocation-operations";
-import { normalizeInvocationRequestId, signInvocationToken } from "../services/identity/invocation-token";
+import { normalizeInvocationRequestId } from "../services/identity/invocation-token";
+import { issueInvocationToken as signInvocationToken } from "../services/identity/issue-invocation";
 import { withActiveIdentitySigner } from "../services/identity/key-ring";
 import { logger } from "../services/logging";
 import { LOCALE_HEADER } from "../shared/locale";
@@ -35,6 +40,7 @@ type WidgetRouteDependencies = {
   listWidgets?: typeof listWidgets;
   fetch?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
   authenticate?: MiddlewareHandler<AuthContext>;
+  listApps?: typeof listApps;
   signInvocation?: typeof signInvocationToken;
   withActiveSigner?: typeof withActiveIdentitySigner;
   timeoutMs?: number;
@@ -196,17 +202,21 @@ export const createWidgetRoutes = (dependencies: WidgetRouteDependencies = {}) =
     widget: DashboardWidget,
     requestId: string | undefined,
     signer: Parameters<Parameters<typeof withActiveIdentitySigner>[1]>[0],
+    db: SQL,
   ) =>
-    signInvocation({
-      targetAppId: widget.appId,
-      callingAppId: "core",
-      operation: widgetInvocationOperation(widget.widgetId),
-      schemaHash: null,
-      authority: invocationAuthorityFromRequest(auth.getAuthority(c)),
-      requestId,
-      signer,
-      issuer: signer.issuer,
-    });
+    signInvocation(
+      {
+        targetAppId: widget.appId,
+        callingAppId: "core",
+        operation: widgetInvocationOperation(widget.widgetId),
+        schemaHash: null,
+        authority: invocationAuthorityFromRequest(auth.getAuthority(c)),
+        requestId,
+        signer,
+        issuer: signer.issuer,
+      },
+      { db, groupsAdmin: signer.groupsAdmin },
+    );
 
   const stream = async (c: Context<AuthContext>, entries: WidgetEntry[], requestId: string | undefined) => {
     const streamDeadline = AbortSignal.timeout(WIDGET_STREAM_DEADLINE_MS);
@@ -221,8 +231,10 @@ export const createWidgetRoutes = (dependencies: WidgetRouteDependencies = {}) =
         tokens = await waitWithin(
           withActiveSigner(
             "invocation",
-            (signer) =>
-              Promise.all(startBounded(entries, WIDGET_CONCURRENCY, async (entry) => sign(c, entry.widget, requestId, signer), signing)),
+            (signer, db) =>
+              Promise.all(
+                startBounded(entries, WIDGET_CONCURRENCY, async (entry) => sign(c, entry.widget, requestId, signer, db), signing),
+              ),
             { signal: signing, timeoutMs },
           ),
           signing,
@@ -316,7 +328,10 @@ export const createWidgetRoutes = (dependencies: WidgetRouteDependencies = {}) =
         let requested = new Map<string, DashboardWidgetSize | undefined>();
         try {
           const keys = new Set<string>();
-          const declared = await waitWithin(registry(), setup);
+          const declared = await waitWithin(
+            registry().then((entries) => discoverableAppEntries(appAccessAuthority(c), entries, dependencies.listApps)),
+            setup,
+          );
           const declaredKeys = new Set(declared.map((widget) => widgetKey(widget.appId, widget.widgetId)));
           requested = new Map((c.req.queries("widget") ?? []).map((value) => parseRequestedWidget(value, declaredKeys)));
           widgets = declared.filter((widget) => {
@@ -351,7 +366,10 @@ export const createWidgetRoutes = (dependencies: WidgetRouteDependencies = {}) =
           const setup = AbortSignal.any([c.req.raw.signal, AbortSignal.timeout(timeoutMs)]);
           let declared: DashboardWidget[];
           try {
-            declared = await waitWithin(registry(), setup);
+            declared = await waitWithin(
+              registry().then((entries) => discoverableAppEntries(appAccessAuthority(c), entries, dependencies.listApps)),
+              setup,
+            );
           } catch {
             log.warn("Widget registry unavailable", { reason: setup.aborted ? "deadline_exceeded" : "operation_failed" });
             return c.json({ message: "Widget registry is currently unavailable" }, 503);
@@ -372,12 +390,17 @@ export const createWidgetRoutes = (dependencies: WidgetRouteDependencies = {}) =
         const requestId = normalizeInvocationRequestId(c.req.header("x-request-id"));
         let phase: WidgetPhase = "registry";
         try {
-          const widget = (await waitWithin(registry(), signal)).find((entry) => entry.appId === appId && entry.widgetId === widgetId);
+          const widget = (
+            await waitWithin(
+              registry().then((entries) => discoverableAppEntries(appAccessAuthority(c), entries, dependencies.listApps)),
+              signal,
+            )
+          ).find((entry) => entry.appId === appId && entry.widgetId === widgetId);
           if (!widget) return c.json({ message: "Widget not found" }, 404);
 
           phase = "signing";
           const signed = await waitWithin(
-            withActiveSigner("invocation", (signer) => sign(c, widget, requestId, signer), { signal, timeoutMs }),
+            withActiveSigner("invocation", (signer, db) => sign(c, widget, requestId, signer, db), { signal, timeoutMs }),
             signal,
           );
 
@@ -405,6 +428,7 @@ export const createWidgetRoutes = (dependencies: WidgetRouteDependencies = {}) =
                 : "Widget is unavailable";
           return Response.json({ message }, { status: 502 });
         } catch (error) {
+          if (error instanceof AppAccessDeniedError) return Response.json(appAccessDeniedBody(error.app), { status: 403 });
           const isTimeout = timeout.aborted || (error instanceof Error && error.name === "TimeoutError");
           const reason: WidgetRejectionReason = isTimeout ? "deadline_exceeded" : signal.aborted ? "request_cancelled" : "operation_failed";
           logRejection({ appId, widgetId }, phase, reason);

package/src/approvals/Approvals.tsx

@@ -179,9 +179,11 @@ function BandDecision(props: {
       <Button size="sm" variant="ghost" disabled={props.busy} onClick={() => props.decide({ approved: false })}>
         {t().reject}
       </Button>
-      <Button size="sm" variant="primary" loading={props.busy} onClick={() => props.decide({ approved: true })}>
-        {t().approve}
-      </Button>
+      <Show when={!(props.item.review && "contentRef" in props.item.review && props.item.review.contentRef)}>
+        <Button size="sm" variant="primary" loading={props.busy} onClick={() => props.decide({ approved: true })}>
+          {t().approve}
+        </Button>
+      </Show>
     </div>
   );
 }

package/src/browser/CloudResourceSearch.browser-harness.tsx

@@ -1,6 +1,12 @@
+import { LocaleProvider } from "@k2b/ui";
+import { render } from "solid-js/web";
 import { appAccentStyle } from "../ssr/app-appearance";
 import { createGlobalSearchHost } from "../ssr/global-search-host";
+import { platformMessages } from "../ssr/platform-messages";
+import ShellRuntime from "../ssr/ShellRuntime.island";
+import type { ShellData } from "../ssr/shell-data";
 import { openCloudResourcePicker } from "./resource-picker";
+import { openGlobalSearch } from "./search";
 
 /**
  * Opens the real global search, or with `?picker` the resource picker, for a browser test that answers
@@ -8,7 +14,53 @@ import { openCloudResourcePicker } from "./resource-picker";
  */
 const params = new URLSearchParams(location.search);
 const app = params.get("app") ?? undefined;
-if (params.has("picker")) {
+if (params.has("launcher")) {
+  // Invented authorized shell data, rendered by the real ShellRuntime and global-search host.
+  // Role filtering itself is covered at Layout's SSR seam; this harness does not simulate authentication.
+  const locale = document.documentElement.lang || "en";
+  const de = locale === "de";
+  const data: ShellData = {
+    apps: [
+      { id: "tools", label: de ? "Werkzeuge" : "Tools", iconClass: "ti ti-tools", href: "/tools", match: "/tools", defaultVisible: false },
+      ...(params.has("admin")
+        ? [
+            {
+              id: "admin",
+              label: platformMessages.resolve([locale]).t.admin,
+              iconClass: "ti ti-settings",
+              href: "/admin",
+              match: "/admin",
+              defaultVisible: false,
+            },
+          ]
+        : []),
+    ],
+    searchLinks: {
+      tools: [
+        { label: "Tools", href: "/tools", keywords: ["utilities", "werkzeuge"] },
+        { label: "QR Code", href: "/tools/qr", keywords: ["qr"] },
+      ],
+    },
+    legalLinks: [],
+    theme: "light",
+  };
+  const script = document.createElement("script");
+  script.id = "cloud-shell-data";
+  script.type = "application/json";
+  script.textContent = JSON.stringify(data);
+  document.body.append(script);
+  const host = document.createElement("div");
+  document.body.append(host);
+  render(
+    () => (
+      <LocaleProvider locale={locale}>
+        <ShellRuntime commands={{ searchResources: !params.has("public") }} />
+      </LocaleProvider>
+    ),
+    host,
+  );
+  openGlobalSearch(app ? { scope: { appId: app, label: app } } : { query: params.get("q") ?? "" });
+} else if (params.has("picker")) {
   // The page shell renders `<body class="k2b-ui app-accent-scope" style="…">` for an app page.
   const style = appAccentStyle(params.get("accent") ?? undefined);
   if (style) {

package/src/browser/CloudResourceSearch.tsx

@@ -51,15 +51,6 @@ const isLinkableCommand = (command: PaletteCommand) => typeof command.action !==
 
 const itemKey = (item: SearchItem) => `${item.ref.type}:${item.ref.id}`;
 const URL_BASE = "https://cloud.invalid";
-const groupByApp = (items: SearchItem[]) => {
-  const groups = new Map<string, SearchItem[]>();
-  for (const item of items) {
-    const group = groups.get(item.appId) ?? [];
-    group.push(item);
-    groups.set(item.appId, group);
-  }
-  return [...groups.values()].flat();
-};
 
 export default function CloudResourceSearch(props: CloudResourceSearchProps) {
   const locale = useLocale();
@@ -236,9 +227,7 @@ export default function CloudResourceSearch(props: CloudResourceSearchProps) {
   /** Rows of the run for the current input; anything older is visible but cannot be chosen. */
   const freshResults = () => current() && shownRun();
   const results = createMemo(() =>
-    canSearch()
-      ? [...groupByApp(navigation()), ...shownBlocks().flatMap((block) => filterCloudResourceSearchItems(block.items, props))]
-      : [],
+    canSearch() ? [...navigation(), ...shownBlocks().flatMap((block) => filterCloudResourceSearchItems(block.items, props))] : [],
   );
   const searchContext = () => JSON.stringify([desiredUrl(), commandMode(), commandQuery()]);
   /**
@@ -460,6 +449,7 @@ export default function CloudResourceSearch(props: CloudResourceSearchProps) {
     }
   };
   const updateCaret = () => setCaret(inputRef.selectionStart ?? input().length);
+  const isApp = (item: SearchItem) => navigation().some((link) => link === item && link.kind === "app");
   const previewMetadata = () => (previewItem()?.metadata ?? []).filter((entry) => entry.label.trim() && entry.value.trim()).slice(0, 5);
 
   return (
@@ -670,7 +660,7 @@ export default function CloudResourceSearch(props: CloudResourceSearchProps) {
                           <i class={item.icon ?? item.appIcon} aria-hidden="true" />
                           <span class="cloud-resource-search__result-copy">
                             <span>{item.title}</span>
-                            <small>{item.preview ?? item.appName}</small>
+                            <small>{isApp(item) ? t().app : (item.preview ?? item.appName)}</small>
                           </span>
                           <Show when={commandFor(item)?.shortcut}>{(shortcut) => <Kbd keys={shortcut()} />}</Show>
                           <Show when={props.selectionMode && selectedKey() === itemKey(item)}>

package/src/browser/PanelLeaveNotice.tsx

@@ -0,0 +1,18 @@
+import { Button, NoticeCard } from "@k2b/ui";
+import { Show } from "solid-js";
+import { platformMessages } from "../ssr/platform-messages";
+
+export default function PanelLeaveNotice(props: { blocked: boolean; locale: string; resume: () => void }) {
+  const t = () => platformMessages.resolve([props.locale]).t;
+  return (
+    <Show when={props.blocked}>
+      <div role="status" data-cloud-panel-leave="blocked">
+        <NoticeCard tone="warning" title={t().panelLeaveBlocked} detail={t().panelLeaveDetail}>
+          <Button variant="ghost" onClick={props.resume}>
+            {t().panelLeaveResume}
+          </Button>
+        </NoticeCard>
+      </div>
+    </Show>
+  );
+}

package/src/browser/navigation-search.ts

@@ -3,49 +3,102 @@ import type { SearchItem } from "../api/search/schemas";
 import type { AppMeta } from "../contracts/app";
 
 /** UI-only rows. The synthetic ref is a row key, never a readable resource. */
-export type NavigationSearchItem = SearchItem & { keywords?: readonly string[] };
+export type NavigationSearchItem = SearchItem & { keywords?: readonly string[]; kind?: "app" };
 
 export const navigationSearchItems = (
-  apps: readonly Pick<AppMeta, "id" | "name" | "icon" | "searchLinks">[],
+  apps: readonly (Pick<AppMeta, "id" | "name" | "icon" | "searchLinks"> & { nav?: Pick<NonNullable<AppMeta["nav"]>, "href"> })[],
   visibleAppIds: readonly string[],
 ): NavigationSearchItem[] => {
   const visible = new Set(visibleAppIds);
   return apps
     .filter((app) => visible.has(app.id))
-    .flatMap((app) =>
-      (app.searchLinks ?? []).map((link) => ({
-        appId: app.id,
-        appName: app.name,
-        appIcon: app.icon,
-        ref: { type: "cloud.navigation", id: `${app.id}:${link.href}` },
-        readable: false,
-        title: link.label,
-        preview: link.description,
-        href: link.href,
-        icon: link.icon ?? app.icon,
-        priority: 0,
-        keywords: link.keywords,
-      })),
-    );
+    .flatMap((app) => {
+      const entryLinks = app.searchLinks?.filter((link) => link.href === app.nav?.href) ?? [];
+      const links = [
+        ...(app.nav
+          ? [
+              {
+                label: app.name,
+                href: app.nav.href,
+                icon: app.icon,
+                kind: "app" as const,
+                keywords: entryLinks.flatMap((link) => [link.label, ...(link.keywords ?? [])]),
+              },
+            ]
+          : []),
+        ...(app.searchLinks ?? []),
+      ];
+      return links.map(
+        (link): NavigationSearchItem => ({
+          appId: app.id,
+          appName: app.name,
+          appIcon: app.icon,
+          ref: { type: "cloud.navigation", id: `${app.id}:${link.href}` },
+          readable: false,
+          title: link.label,
+          preview: "description" in link ? link.description : undefined,
+          href: link.href,
+          icon: link.icon ?? app.icon,
+          priority: 0,
+          keywords: link.keywords,
+          kind: "kind" in link ? link.kind : undefined,
+        }),
+      );
+    });
+};
+
+const normalize = (text: string) => text.trim().toLowerCase().replace(/\s+/g, " ");
+
+/** Compare individual names/aliases, never their combined length or number. */
+const appMatchRank = (item: NavigationSearchItem, query: string): number => {
+  const names = [item.title, ...(item.keywords ?? [])].map(normalize);
+  if (names.includes(query)) return 0;
+  const words = query.split(" ");
+  if (names.some((name) => words.every((word) => name.split(/[^\p{L}\p{N}]+/u).some((part) => part.startsWith(word))))) return 1;
+  if (names.some((name) => words.every((word) => name.includes(word)))) return 2;
+  // Whole-name typos only, at least 80% similarity. No short abbreviations or description fuzzing globally.
+  if (query.length < 4) return Infinity;
+  const closest = fuzzy.closest(query, names, { maxDistance: query.length >= 8 ? 2 : 1 });
+  return closest && closest.similarity >= 0.8 ? 3 + closest.distance / 10 : Infinity;
 };
 
 export const matchNavigationSearchItems = (
   items: readonly NavigationSearchItem[],
   input: { query: string; tags: readonly string[]; appId?: string | null; requireReader?: boolean },
 ): NavigationSearchItem[] => {
-  const query = input.query.trim().toLowerCase();
+  const query = normalize(input.query);
   if (input.requireReader || input.tags.length > 0 || (!input.appId && query.length < 2)) return [];
+  const seen = new Set<string>();
+  const uniqueTarget = (item: NavigationSearchItem) => {
+    if (seen.has(item.href)) return false;
+    seen.add(item.href);
+    return true;
+  };
   if (input.appId) {
-    const scoped = items.filter((item) => item.appId === input.appId);
+    // App contexts keep browsing their static pages; app launchers belong to global navigation only.
+    const scoped = items.filter((item) => item.appId === input.appId && item.kind !== "app");
     return query
       ? fuzzy
           .filter(query, scoped, { key: (item) => [item.title, item.preview ?? "", ...(item.keywords ?? [])].join(" ") })
           .map((hit) => hit.item)
-      : scoped;
+          .filter(uniqueTarget)
+      : scoped.filter(uniqueTarget);
   }
-  const words = query.split(/\s+/);
-  return items.filter((item) => {
-    const text = [item.title, item.preview ?? "", ...(item.keywords ?? [])].join(" ").toLowerCase();
-    return words.every((word) => text.includes(word));
-  });
+  const words = query.split(" ");
+  // Deduplicate only this global view. A cross-app page still belongs to its declaring app's own scope.
+  const appTargets = new Set(items.filter((item) => item.kind === "app").map((item) => item.href));
+  return items
+    .filter((item) => item.kind === "app" || !appTargets.has(item.href))
+    .flatMap((item) => {
+      const rank =
+        item.kind === "app"
+          ? appMatchRank(item, query)
+          : words.every((word) => [item.title, item.preview ?? "", ...(item.keywords ?? [])].join(" ").toLowerCase().includes(word))
+            ? 2
+            : Infinity;
+      return Number.isFinite(rank) ? [{ item, rank }] : [];
+    })
+    .sort((a, b) => a.rank - b.rank)
+    .map(({ item }) => item)
+    .filter(uniqueTarget);
 };

package/src/browser/panel-leave.ts

@@ -0,0 +1,69 @@
+/** Internal same-origin collection; no composer content crosses the provider boundary. */
+const LEAVE = "cloud.panel.before-leave";
+const CHECK = "cloud.panel.has-leave-guard";
+type LeaveDecision = { allowed: boolean };
+
+/** Ordinary same-origin links handled by the panel host; explicit browser actions stay native. */
+export function panelLinkDestination(event: MouseEvent): URL | undefined {
+  if (event.defaultPrevented || event.button !== 0 || event.metaKey || event.ctrlKey || event.altKey || event.shiftKey) return;
+  const anchor = event.target instanceof Element ? event.target.closest<HTMLAnchorElement>("a[href]") : null;
+  if (!anchor || (anchor.target && anchor.target !== "_self") || anchor.hasAttribute("download")) return;
+  const url = new URL(anchor.getAttribute("href")!, document.baseURI);
+  if (url.origin !== location.origin) return;
+  if (url.pathname === location.pathname && url.search === location.search && url.hash) return;
+  return url;
+}
+
+/**
+ * Register before enabling editing. Return true only when all provider work is recoverable.
+ * A veto keeps the current frame. Saving and retry belong to the provider; no transition is queued.
+ */
+export function onPanelBeforeLeave(guard: () => boolean): () => void {
+  const collect = (event: Event) => {
+    const decision = (event as CustomEvent<LeaveDecision>).detail;
+    try {
+      // Only explicit synchronous true permits leaving; throws and accidental Promises fail closed.
+      if (guard() !== true) decision.allowed = false;
+    } catch {
+      decision.allowed = false;
+    }
+  };
+  const registered = (event: Event) => event.preventDefault();
+  // Islands start independently: editing and its links must be protected before PanelRuntime loads too.
+  const click = (event: MouseEvent) => {
+    if (window.parent === window || !document.querySelector("[data-cloud-panel-page]")) return;
+    const url = panelLinkDestination(event);
+    if (!url) return;
+    event.preventDefault();
+    window.parent.postMessage({ type: "cloud.panel.navigate", v: 1, href: url.href }, location.origin);
+  };
+  window.addEventListener(LEAVE, collect);
+  window.addEventListener(CHECK, registered);
+  document.addEventListener("click", click);
+  return () => {
+    window.removeEventListener(LEAVE, collect);
+    window.removeEventListener(CHECK, registered);
+    document.removeEventListener("click", click);
+  };
+}
+
+export function hasPanelLeaveGuard(): boolean {
+  return !window.dispatchEvent(new Event(CHECK, { cancelable: true }));
+}
+
+export function panelCanLeave(target: Window): boolean {
+  // A cross-origin navigation already destroyed the provider document and its guards.
+  // It cannot participate in this same-origin contract or keep the host's slot trapped.
+  try {
+    void target.document;
+  } catch {
+    return true;
+  }
+  const decision: LeaveDecision = { allowed: true };
+  try {
+    target.dispatchEvent(new CustomEvent<LeaveDecision>(LEAVE, { detail: decision }));
+    return decision.allowed;
+  } catch {
+    return false;
+  }
+}

package/src/browser/panel-messages.ts

@@ -1,5 +1,17 @@
 const isRecord = (value: unknown): value is Record<string, unknown> => typeof value === "object" && value !== null && !Array.isArray(value);
 
+export function isPanelNavigateMessage(value: unknown): value is { type: "cloud.panel.navigate"; v: 1; href: string } {
+  return (
+    isRecord(value) &&
+    Reflect.ownKeys(value).length === 3 &&
+    value.type === "cloud.panel.navigate" &&
+    value.v === 1 &&
+    typeof value.href === "string" &&
+    value.href.length <= 8192 &&
+    /^https?:\/\//.test(value.href)
+  );
+}
+
 export function isPanelReadyMessage(value: unknown, provider: string): value is { type: "cloud.panel.ready"; v: 1; provider: string } {
   return (
     isRecord(value) &&