@k2b/cloud 0.41.0 → 0.42.0

package/src/server/middleware/app-access.ts

@@ -0,0 +1,312 @@
+import type { Context, MiddlewareHandler } from "hono";
+import { Hono } from "hono";
+import { createMiddleware } from "hono/factory";
+import { TrieRouter } from "hono/router/trie-router";
+import type { WSEvents } from "hono/ws";
+import { getApp } from "../../_internal/registry";
+import type { AppMeta } from "../../contracts/app";
+import { appAccessAuthority, canUseApp } from "../../services/app-access";
+import { recordAppAccessDenied } from "../../services/app-access-metrics";
+import { createLoginRedirectUrl } from "../../shared/redirect";
+import { type AuthContext, auth, type RequestAuthority } from "./auth";
+
+type AccessApp = Pick<AppMeta, "id" | "access"> & { name?: string };
+export const APP_ACCESS_RECHECK_MS = 50_000;
+export const APP_ACCESS_CHECK_TIMEOUT_MS = 10_000;
+const connections = new Set<() => void>();
+/** app.start() closes sockets and SSE before draining the process's shared services. */
+export const stopAppAccessConnections = (): void => {
+  for (const close of [...connections]) close();
+};
+
+export const appAccessDeniedBody = (app: AccessApp) => ({
+  code: "app_access_denied" as const,
+  app: app.id,
+  message: `You cannot use ${app.name ?? app.id}. ${app.access?.kind === "grants" ? "Ask someone who manages access to this app." : "Ask your Cloud administrator about access."}`,
+});
+
+export class AppAccessDeniedError extends Error {
+  readonly code = "app_access_denied";
+  constructor(readonly app: AccessApp) {
+    super(appAccessDeniedBody(app).message);
+  }
+}
+
+/** Public paths bypass this gate only; the route still owns its authentication. */
+export const appPublicRouteMatcher = (app: AccessApp): ((path: string) => boolean) => {
+  const router = new TrieRouter<boolean>();
+  for (const path of app.access?.publicRoutes ?? []) router.add("ALL", path, true);
+  return (path) => router.match("ALL", path)[0].length > 0;
+};
+
+/** Resolve afresh rather than reuse the original Context's authentication cache. */
+export const appAccessRevalidator = (c: Context<AuthContext>, app: AccessApp): (() => Promise<boolean>) => {
+  const original = appAccessAuthority(c);
+  const sessionToken = c.get("sessionToken");
+  const sessionKind = c.get("sessionKind");
+  const samePrincipal = (current: RequestAuthority): boolean => {
+    if (!original || current.accessSubject.type !== original.accessSubject.type) return false;
+    if (
+      current.accessSubject.type === "user" &&
+      original.accessSubject.type === "user" &&
+      current.accessSubject.userId !== original.accessSubject.userId
+    )
+      return false;
+    if (
+      current.accessSubject.type === "service_account" &&
+      original.accessSubject.type === "service_account" &&
+      current.accessSubject.serviceAccountId !== original.accessSubject.serviceAccountId
+    )
+      return false;
+    if (current.credentialKind !== original.credentialKind || current.actor.kind !== original.actor.kind) return false;
+    if (current.actor.kind === "user" && original.actor.kind === "user") return current.actor.user.id === original.actor.user.id;
+    return (
+      current.actor.kind === "service_account" &&
+      original.actor.kind === "service_account" &&
+      current.actor.serviceAccount.id === original.actor.serviceAccount.id &&
+      current.actor.credentialId === original.actor.credentialId
+    );
+  };
+  return async () => {
+    if (!original || original.credentialKind === "invocation") return false;
+    let allowed = false;
+    const probe = new Hono<AuthContext>()
+      .onError((error) => {
+        throw error;
+      })
+      .use(auth.requireRole("*"))
+      .all("*", async (fresh) => {
+        const authority = appAccessAuthority(fresh);
+        if (!authority || !samePrincipal(authority)) return fresh.body(null, 401);
+        if (
+          original.credentialKind === "session" &&
+          (fresh.get("sessionToken") !== sessionToken || fresh.get("sessionKind") !== sessionKind)
+        )
+          return fresh.body(null, 401);
+        // A stream retains its initial domain context. Reconnect on changed scopes so
+        // neither a narrowed key nor an empty-scope personal key keeps stale authority.
+        if (JSON.stringify([...new Set(authority.scopes)].sort()) !== JSON.stringify([...new Set(original.scopes)].sort()))
+          return fresh.body(null, 401);
+        allowed = await canUseApp(authority, app);
+        return fresh.body(null, 204);
+      });
+    await probe.fetch(new Request(c.req.url, { headers: c.req.raw.headers }));
+    return allowed;
+  };
+};
+
+type WatchOptions = {
+  check: () => Promise<boolean>;
+  denied: () => void;
+  subscribe: (changed: () => void) => () => void;
+  intervalMs?: number;
+  timeoutMs?: number;
+};
+
+/** One check in flight, coalesced invalidations, and a deadline that fails closed. */
+export const watchAppAccess = (options: WatchOptions): (() => void) => {
+  let stopped = false;
+  let checking = false;
+  let again = false;
+  let deadline: ReturnType<typeof setTimeout> | undefined;
+  let unsubscribe = () => {};
+  const stop = () => {
+    if (stopped) return;
+    stopped = true;
+    clearInterval(timer);
+    clearTimeout(deadline);
+    unsubscribe();
+  };
+  const deny = () => {
+    if (stopped) return;
+    stop();
+    options.denied();
+  };
+  const check = async () => {
+    if (stopped) return;
+    if (checking) {
+      again = true;
+      return;
+    }
+    checking = true;
+    deadline = setTimeout(deny, options.timeoutMs ?? APP_ACCESS_CHECK_TIMEOUT_MS);
+    try {
+      if (!(await options.check())) deny();
+    } catch {
+      deny();
+    } finally {
+      clearTimeout(deadline);
+      checking = false;
+      if (again && !stopped) {
+        again = false;
+        void check();
+      }
+    }
+  };
+  const timer = setInterval(() => void check(), options.intervalMs ?? APP_ACCESS_RECHECK_MS);
+  timer.unref?.();
+  unsubscribe = options.subscribe(() => void check());
+  // Close the race between the handshake's check and subscribing to changes.
+  void check();
+  return stop;
+};
+
+const subscribeApp = async (appId: string): Promise<(changed: () => void) => () => void> => {
+  const { subscribeAppAccessChanged } = await import("../../events/app-access");
+  return (changed) => subscribeAppAccessChanged(appId, changed);
+};
+
+/** Used by shared live updates and custom sockets; close always releases the watcher. */
+export const guardAppAccessSocket = async (c: Context<AuthContext>, appId: string, events: WSEvents): Promise<WSEvents> => {
+  let app: AccessApp | null;
+  try {
+    app = await getApp(appId);
+  } catch {
+    app = null;
+  }
+  if (app && (!app.access || appPublicRouteMatcher(app)(c.req.path))) return events;
+  const authority = appAccessAuthority(c);
+  if (!app || !(await canUseApp(authority, app))) {
+    if (app) recordAppAccessDenied(app.id);
+    return { onOpen: (_event, ws) => ws.close(1008, "app_access_denied") };
+  }
+  const revalidate = appAccessRevalidator(c, app);
+  const subscribe = await subscribeApp(appId);
+  let stop: (() => void) | undefined;
+  let denied = false;
+  let shutdown = () => {};
+  return {
+    ...events,
+    onOpen: (event, ws) => {
+      shutdown = () => {
+        stop?.();
+        connections.delete(shutdown);
+        denied = true;
+        ws.close(1012, "server_restarting");
+      };
+      connections.add(shutdown);
+      stop = watchAppAccess({
+        check: revalidate,
+        subscribe,
+        denied: () => {
+          connections.delete(shutdown);
+          denied = true;
+          ws.close(1008, "app_access_denied");
+        },
+      });
+      return events.onOpen?.(event, ws);
+    },
+    onMessage: (event, ws) => {
+      if (!denied) return events.onMessage?.(event, ws);
+    },
+    onClose: (event, ws) => {
+      connections.delete(shutdown);
+      stop?.();
+      return events.onClose?.(event, ws);
+    },
+    onError: (event, ws) => {
+      connections.delete(shutdown);
+      stop?.();
+      ws.close(1011, "app_access_check_failed");
+      return events.onError?.(event, ws);
+    },
+  };
+};
+
+const guardSse = async (c: Context<AuthContext>, app: AccessApp, response: Response): Promise<Response> => {
+  if (!response.body) return response;
+  const subscribe = await subscribeApp(app.id);
+  const reader = response.body.getReader();
+  let ended = false;
+  let stop = () => {};
+  let streamController: ReadableStreamDefaultController<Uint8Array> | undefined;
+  const abort = () => {
+    if (!ended) streamController?.close();
+    finish();
+  };
+  const finish = () => {
+    if (ended) return;
+    ended = true;
+    stop();
+    connections.delete(abort);
+    c.req.raw.signal.removeEventListener("abort", abort);
+    void reader.cancel().catch(() => {});
+  };
+  const body = new ReadableStream<Uint8Array>({
+    start(controller) {
+      streamController = controller;
+      connections.add(abort);
+      stop = watchAppAccess({
+        check: appAccessRevalidator(c, app),
+        subscribe,
+        denied: () => {
+          if (ended) return;
+          controller.enqueue(new TextEncoder().encode(`event: error\ndata: ${JSON.stringify(appAccessDeniedBody(app))}\n\n`));
+          controller.close();
+          finish();
+        },
+      });
+      c.req.raw.signal.addEventListener("abort", abort, { once: true });
+      if (c.req.raw.signal.aborted) {
+        controller.close();
+        finish();
+      }
+    },
+    async pull(controller) {
+      try {
+        const item = await reader.read();
+        if (ended) return;
+        if (item.done) {
+          controller.close();
+          finish();
+        } else controller.enqueue(item.value);
+      } catch (error) {
+        if (!ended) {
+          controller.error(error);
+          finish();
+        }
+      }
+    },
+    cancel: finish,
+  });
+  return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+};
+
+/** Framework gate: install after static and internal invocation mounts, before every app-owned handler. */
+export const requireAppAccess = (
+  app: AccessApp,
+  renderDenied: (c: Context<AuthContext>, message: string) => Promise<Response>,
+): MiddlewareHandler<AuthContext> => {
+  const isPublic = appPublicRouteMatcher(app);
+  return createMiddleware<AuthContext>(async (c, next) => {
+    if (!app.access || isPublic(c.req.path)) return next();
+    let resolved: RequestAuthority | null = null;
+    await auth.requireRole("*")(c, async () => {
+      resolved = appAccessAuthority(c);
+    });
+    const browser =
+      c.req.method === "GET" && c.req.header("accept")?.includes("text/html") && c.req.header("upgrade")?.toLowerCase() !== "websocket";
+    if (!resolved) {
+      // Let the established mobile launch flow renew an app session.
+      if (browser && c.req.path.startsWith("/pwa/")) {
+        const url = new URL(c.req.url);
+        return c.redirect(
+          url.searchParams.has("pwa_launch")
+            ? "/pwa/?pwa=unavailable"
+            : `/pwa/_auth/session/launch?to=${encodeURIComponent(url.pathname + url.search)}`,
+        );
+      }
+      return browser ? c.redirect(createLoginRedirectUrl(c.req.url)) : c.json({ message: "Authentication required" }, 401);
+    }
+    if (!(await canUseApp(resolved, app))) {
+      recordAppAccessDenied(app.id);
+      c.header("Cache-Control", "private, no-store");
+      const body = appAccessDeniedBody(app);
+      const response = browser ? await renderDenied(c, body.message) : c.json(body, 403);
+      response.headers.set("Cache-Control", "private, no-store");
+      return response;
+    }
+    await next();
+    if (c.res.headers.get("content-type")?.toLowerCase().startsWith("text/event-stream")) c.res = await guardSse(c, app, c.res);
+  });
+};

package/src/server/middleware/auth.ts

@@ -394,7 +394,7 @@ const requireOAuthScope = (...requiredScopes: string[]) =>
     return c.json({ code: "FORBIDDEN", message: `OAuth scope ${requiredScopes.join(" or ")} is required` }, 403);
   });
 
-const getAuthority = (c: Context<AuthContext>): RequestAuthority => {
+const getAuthority = <E extends AuthContext>(c: Context<E>): RequestAuthority => {
   const actor = c.get("actor");
   const accessSubject = c.get("accessSubject");
   const credentialKind = c.get("credentialKind");

package/src/server/middleware/invocation.ts

@@ -1,7 +1,12 @@
 import type { Context, MiddlewareHandler } from "hono";
 import { createMiddleware } from "hono/factory";
+import { getApp } from "../../_internal/registry";
+import type { AppMeta } from "../../contracts/app";
+import { canUseApp } from "../../services/app-access";
+import { recordAppAccessDenied } from "../../services/app-access-metrics";
 import { type ResolvedInvocationAuthority, resolveInvocationAuthority } from "../../services/identity/invocation-actor";
 import { type CloudInvocationClaims, isInvocationJwtCandidate, verifyInvocationToken } from "../../services/identity/invocation-token";
+import { appAccessDeniedBody } from "./app-access";
 import type { AuthContext } from "./auth";
 
 export type InvocationExpectation = {
@@ -11,6 +16,7 @@ export type InvocationExpectation = {
 };
 
 type InvocationMiddlewareDependencies = {
+  getApp?: (appId: string) => Promise<Pick<AppMeta, "id" | "access"> | null>;
   verify?: typeof verifyInvocationToken;
   resolve?: typeof resolveInvocationAuthority;
 };
@@ -47,6 +53,11 @@ export const requireInvocation = (
     if (!claims) return reject(c);
     const authority = await (dependencies.resolve ?? resolveInvocationAuthority)(claims);
     if (!authority) return reject(c);
+    const app = await (dependencies.getApp ?? getApp)(expectation.targetAppId).catch(() => null);
+    if (!app || !(await canUseApp(authority, app))) {
+      if (app) recordAppAccessDenied(app.id);
+      return c.json(appAccessDeniedBody(app ?? { id: expectation.targetAppId }), 403);
+    }
     if (claims.schema_hash !== expectation.schemaHash) {
       return c.json({ code: "SCHEMA_MISMATCH", message: "The invocation schema no longer matches the target" }, 409);
     }

package/src/server/middleware/rate-limit.ts

@@ -2,7 +2,7 @@ import type { Context, MiddlewareHandler } from "hono";
 import { createMiddleware } from "hono/factory";
 import type { MessageResponse } from "../../contracts/shared";
 import * as settings from "../../services/settings";
-import { clientIp } from "../client-ip";
+import { clientIp, clientIpBucket } from "../client-ip";
 import { ratelimit } from "../ratelimit";
 import { type AuthContext, auth } from "./auth";
 
@@ -81,13 +81,13 @@ const getLimiter = (limitPerSecond: number, windowSecs: number) => {
 };
 
 const resolveIdentifier = async (c: Context<AuthContext>, keyBy: RateLimitConfig["keyBy"]): Promise<string> => {
-  if (keyBy === "ip") return `ip:${clientIp(c)}`;
+  if (keyBy === "ip") return clientIpBucket(clientIp(c));
 
   const token = auth.session.getToken(c);
-  if (!token) return `ip:${clientIp(c)}`;
+  if (!token) return clientIpBucket(clientIp(c));
 
   const userId = await auth.session.getRequestSubject(c, token);
-  if (!userId) return `ip:${clientIp(c)}`;
+  if (!userId) return clientIpBucket(clientIp(c));
 
   return `user:${userId}`;
 };

package/src/server/services/access.ts

@@ -655,12 +655,18 @@ export const listUsersWithAccess = async (params: {
 
 /**
  * Resolve display names for access entries.
- * Populates the displayName field based on principal type, and the
- * serviceAccountKind field for service-account principals.
+ * Missing principals and audiences have no displayName; render with principalLabel.
+ * Includes serviceAccountKind for existing service-account principals.
  */
 export const resolveDisplayNames = async <T extends { principal: Principal }>(
   entries: T[],
-): Promise<(T & { displayName: string; avatarHash?: string | null; serviceAccountKind?: ServiceAccountKind })[]> => {
+): Promise<
+  (Omit<T, "displayName" | "avatarHash" | "serviceAccountKind"> & {
+    displayName?: string;
+    avatarHash?: string | null;
+    serviceAccountKind?: ServiceAccountKind;
+  })[]
+> => {
   const userIds = entries.filter((e) => e.principal.type === "user").map((e) => (e.principal as { type: "user"; userId: string }).userId);
 
   const groupIds = entries
@@ -709,30 +715,28 @@ export const resolveDisplayNames = async <T extends { principal: Principal }>(
   }
 
   return entries.map((entry) => {
-    let displayName: string;
+    let displayName: string | undefined;
     let avatarHash: string | null | undefined;
     let serviceAccountKind: ServiceAccountKind | undefined;
     switch (entry.principal.type) {
       case "user": {
         const user = userNames.get(entry.principal.userId);
-        displayName = user?.displayName ?? "Unknown User";
+        displayName = user?.displayName;
         avatarHash = user?.avatarHash ?? null;
         break;
       }
       case "group":
-        displayName = groupNames.get(entry.principal.groupId) ?? "Unknown Group";
+        displayName = groupNames.get(entry.principal.groupId);
         break;
       case "service_account": {
         const serviceAccount = serviceAccountsById.get(entry.principal.serviceAccountId);
-        displayName = serviceAccount?.name ?? "Unknown Service Account";
+        displayName = serviceAccount?.name;
         serviceAccountKind = serviceAccount?.kind;
         break;
       }
       case "authenticated":
-        displayName = "All users (incl. guests)";
         break;
       case "public":
-        displayName = "Public";
         break;
     }
     return { ...entry, displayName, avatarHash, serviceAccountKind };

package/src/server/services/index.ts

@@ -32,9 +32,7 @@ export {
   updateAccess,
 } from "./access";
 export { freeipa } from "./freeipa";
-export type { GeoPlace, GeoService } from "./geo";
 
-export { geo, geoService } from "./geo";
 export { paginateItems } from "./pagination";
 export { services } from "./services";
 

package/src/server/services/services.ts

@@ -1,12 +1,10 @@
 import { err, fail, isServiceError, ok, okMany, paginate, password, svg, tryCatch, unwrap } from "@k2b/stdlib";
 import * as access from "./access";
 import { freeipa } from "./freeipa";
-import { geo } from "./geo";
 
 export const services = {
   access,
   freeipa,
-  geo,
   images: { generateFallback: svg.generateAvatar, parseWebpDataUrl: svg.parseWebpDataUrl },
   password,
   result: { ok, okMany, fail, err, unwrap, paginate, tryCatch, isServiceError },

package/src/services/accounts/posix.ts

@@ -132,8 +132,8 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
   const readConfig = async (connection = db): Promise<LinuxIdentityConfiguration> => {
     // Provisioning must not use a stale cache after an operator disables or changes the range.
     const [row] = await connection<{ value: string }[]>`SELECT value FROM settings.entries WHERE key = ${CONFIG_KEY}`;
-    const raw = row ? await decryptValue(row.value) : JSON.stringify(DEFAULT_LINUX_IDENTITY_CONFIGURATION);
     try {
+      const raw = row ? await decryptValue(row.value) : JSON.stringify(DEFAULT_LINUX_IDENTITY_CONFIGURATION);
       return LinuxIdentityConfigurationSchema.parse(typeof raw === "string" ? JSON.parse(raw) : raw);
     } catch {
       throw new PosixError("invalid_configuration", 400);
@@ -304,15 +304,21 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
   };
 
   const service = {
-    async configuration(actor: Actor) {
+    async configuration(actor: Actor): Promise<LinuxIdentityConfiguration & { unreadable?: boolean }> {
       requireAdmin(actor);
-      return readConfig();
+      try {
+        return { ...(await readConfig()), unreadable: false };
+      } catch (error) {
+        // Provisioning still fails on this row. Administration alone may display the default for recovery.
+        if (!(error instanceof PosixError) || error.code !== "invalid_configuration") throw error;
+        return { ...DEFAULT_LINUX_IDENTITY_CONFIGURATION, unreadable: true };
+      }
     },
     async overview(actor: Actor, after: string | null = null, filters: { search?: string; scope?: "ready" | "all" } = {}) {
       requireAdmin(actor);
       const result = await rows(db, null, after, filters);
       const items = result.slice(0, POSIX_PAGE_SIZE).map(candidate);
-      return { config: await readConfig(), items, nextCursor: result.length > POSIX_PAGE_SIZE ? items.at(-1)!.id : null };
+      return { config: await service.configuration(actor), items, nextCursor: result.length > POSIX_PAGE_SIZE ? items.at(-1)!.id : null };
     },
     async get(actor: Actor, id: string) {
       requireAdmin(actor);
@@ -320,7 +326,7 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
       if (!row) throw new PosixError("user_not_found", 404);
       return { config: await readConfig(), user: candidate(row) };
     },
-    async configure(actor: Actor, input: LinuxIdentityConfiguration) {
+    async configure(actor: Actor, input: LinuxIdentityConfiguration, options?: { replaceUnreadable?: boolean }) {
       requireAdmin(actor);
       const parsed = LinuxIdentityConfigurationSchema.safeParse(input);
       if (!parsed.success) throw new PosixError("invalid_configuration", 400);
@@ -328,9 +334,17 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
       await db.begin(async (tx) => {
         // Same order as provisioning; settings write upgrades this lock in the same transaction.
         await lock(tx);
+        if (options?.replaceUnreadable !== true) {
+          try {
+            await readConfig(tx);
+          } catch (error) {
+            if (error instanceof PosixError && error.code === "invalid_configuration")
+              throw new settings.SettingUnreadableError(CONFIG_KEY);
+            throw error;
+          }
+        }
         if (parsed.data.enabled) await checkRange(tx, parsed.data, ranges);
-        // complete value from explicit admin input; nothing is merged over a read (#1303)
-        await settings.set(CONFIG_KEY, JSON.stringify(parsed.data), tx, { replaceUnreadable: true });
+        await settings.set(CONFIG_KEY, JSON.stringify(parsed.data), tx, { replaceUnreadable: options?.replaceUnreadable === true });
         await audit.record(
           {
             action: "accounts.linux.configure",

package/src/services/allowed-network-fetch.ts

@@ -2,6 +2,7 @@ import { type ClientRequest, request as httpRequest, type IncomingMessage, type
 import { request as httpsRequest } from "node:https";
 import { type NetworkAllowlist, networkAddressFamily, normalizeNetworkHostname } from "../shared/network-address";
 import { type NetworkLookup, pinnedNetworkLookup, resolveAllowedNetworkAddresses } from "./network-security";
+import { awaitNetworkOperation } from "./network-transport";
 
 type RequestFactory = (options: RequestOptions, callback: (response: IncomingMessage) => void) => ClientRequest;
 type AllowedNetworkFetchDeps = {
@@ -25,18 +26,19 @@ export const createAllowedNetworkFetch =
     if (url.username || url.password) throw new TypeError("Network target must not include user information");
     const signal = request.signal;
     signal.throwIfAborted();
-    const addresses = await new Promise<Awaited<ReturnType<typeof resolveAllowedNetworkAddresses>>>((resolve, reject) => {
-      const abort = () => reject(signal.reason);
-      signal.addEventListener("abort", abort, { once: true });
-      (deps.resolve ?? resolveAllowedNetworkAddresses)(url.hostname, allowlist, deps.lookup)
-        .then(resolve, reject)
-        .finally(() => signal.removeEventListener("abort", abort));
-      if (signal.aborted) abort();
-    });
+    const addresses = await awaitNetworkOperation(
+      (deps.resolve ?? resolveAllowedNetworkAddresses)(
+        url.hostname,
+        allowlist,
+        deps.lookup,
+        Number(url.port || (url.protocol === "https:" ? 443 : 80)),
+      ),
+      signal,
+    );
     signal.throwIfAborted();
     // A body of known size goes out with Content-Length; only a caller's stream (in init or an input Request) is chunked.
     const streamed = init?.body != null ? init.body instanceof ReadableStream : input instanceof Request && input.body !== null;
-    const payload = request.body && !streamed ? new Uint8Array(await request.arrayBuffer()) : undefined;
+    const payload = request.body && !streamed ? new Uint8Array(await awaitNetworkOperation(request.arrayBuffer(), signal)) : undefined;
     signal.throwIfAborted();
     return new Promise<Response>((resolve, reject) => {
       const headers = new Headers(request.headers);
@@ -125,7 +127,11 @@ export const createAllowedNetworkFetch =
               });
           try {
             resolve(new Response(body, { status, statusText: incoming.statusMessage, headers: responseHeaders }));
-            if (empty) incoming.resume();
+            if (empty) {
+              incoming.destroy();
+              outgoing.destroy();
+              cleanup();
+            }
           } catch (error) {
             fail(error instanceof Error ? error : new Error(String(error)));
           }

package/src/services/app-access-metrics.ts

@@ -0,0 +1,24 @@
+import { logger } from "./logging";
+import { requestCacheRedis } from "./request-cache-redis";
+
+const KEY = "cloud:app-access:denied";
+let lastFailureLog = -Infinity;
+
+/** Count denied entry/invocation attempts, never discovery filtering or audit rows. Call only for registered app IDs. */
+export const recordAppAccessDenied = (appId: string): void => {
+  void requestCacheRedis()
+    .then((redis) => redis.send("HINCRBY", [KEY, appId, "1"]))
+    .catch(() => {
+      if (Date.now() - lastFailureLog < 60_000) return;
+      lastFailureLog = Date.now();
+      logger("app-access").warn("Application access denial metrics are unavailable");
+    });
+};
+
+/** The metric collector reads only the current registry's bounded set of app labels. */
+export const readAppAccessDenials = async (appIds: readonly string[]): Promise<{ app: string; count: number }[]> => {
+  if (!appIds.length) return [];
+  const values: unknown = await (await requestCacheRedis()).send("HMGET", [KEY, ...appIds]);
+  if (!Array.isArray(values)) throw new Error("Invalid application access metrics response");
+  return appIds.map((app, index) => ({ app, count: Number(values[index] ?? 0) }));
+};