@k2b/cloud 0.42.0 → 0.44.0

package/src/api/app-access.ts

@@ -0,0 +1,85 @@
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+import { appAccessManagementPath } from "../_internal/app-access-path";
+import { getApp } from "../_internal/registry";
+import type { AppMeta } from "../contracts/app";
+import type { AppAccessDeclaration } from "../contracts/app-access";
+import { PrincipalSchema } from "../contracts/shared";
+import { type AuthContext, auth } from "../server/middleware/auth";
+import { v } from "../server/middleware/validator";
+import { AppAccessManagementError, changeAppAccess, readAppAccess } from "../services/app-access-management";
+
+// One UUID principal, level and action; the 4 KiB envelope also bounds malformed JSON.
+export const APP_ACCESS_CHANGE_MAX_BYTES = 4096;
+const repairQuery = v("query", z.object({ repair: z.literal("1").optional() }));
+const permission = z.enum(["read", "admin"]);
+export const AppAccessChangeSchema = z.discriminatedUnion("action", [
+  z.object({ action: z.literal("grant"), principal: PrincipalSchema, permission }).strict(),
+  z
+    .object({ action: z.literal("update"), accessId: z.union([z.string().uuid(), z.literal("inherited-authenticated")]), permission })
+    .strict(),
+  z.object({ action: z.literal("revoke"), accessId: z.union([z.string().uuid(), z.literal("inherited-authenticated")]) }).strict(),
+]);
+const base = () =>
+  new Hono<AuthContext>()
+    .use("*", async (c, next) => {
+      c.header("Cache-Control", "private, no-store");
+      await next();
+    })
+    .use("*", auth.requireRole("authenticated"))
+    .onError((error, c) => {
+      if (error instanceof AppAccessManagementError) return c.json({ code: error.code, message: error.message }, error.status);
+      if (error instanceof HTTPException) return error.getResponse();
+      throw error;
+    });
+
+/** Mounted by the framework before the app-use gate; management still requires its own current grant. */
+export const createOwnedAppAccessRoutes = (app: AppMeta, canManage?: AppAccessDeclaration["canManage"]) =>
+  base()
+    .get("/", async (c) => c.json(await readAppAccess({ app, authority: auth.getAuthority(c), canManage })))
+    .post("/", bodyLimit({ maxSize: APP_ACCESS_CHANGE_MAX_BYTES }), v("json", AppAccessChangeSchema), async (c) =>
+      c.json(
+        await changeAppAccess({
+          app,
+          authority: auth.getAuthority(c),
+          canManage,
+          change: c.req.valid("json"),
+          requestId: c.req.header("x-request-id"),
+        }),
+      ),
+    );
+
+/** Stable Core URL. Managers continue at the owning app; administrators explicitly choose repair. */
+export const createAppAccessRoutes = () =>
+  base()
+    .get("/:appId", repairQuery, async (c) => {
+      const appId = c.req.param("appId");
+      if (!appId) return c.json({ message: "App not found" }, 404);
+      const app = await getApp(appId);
+      if (!app) return c.json({ message: "App not found" }, 404);
+      if (app.access?.kind !== "grants")
+        throw new AppAccessManagementError("APP_ACCESS_FIXED", "This application uses a fixed access rule.", 409);
+      if (c.req.query("repair") !== "1") return c.redirect(appAccessManagementPath(app), 307);
+      return c.json(await readAppAccess({ app, authority: auth.getAuthority(c), repair: true }));
+    })
+    .post("/:appId", repairQuery, bodyLimit({ maxSize: APP_ACCESS_CHANGE_MAX_BYTES }), v("json", AppAccessChangeSchema), async (c) => {
+      const appId = c.req.param("appId");
+      if (!appId) return c.json({ message: "App not found" }, 404);
+      const app = await getApp(appId);
+      if (!app) return c.json({ message: "App not found" }, 404);
+      if (app.access?.kind !== "grants")
+        throw new AppAccessManagementError("APP_ACCESS_FIXED", "This application uses a fixed access rule.", 409);
+      if (c.req.query("repair") !== "1") return c.redirect(appAccessManagementPath(app), 307);
+      return c.json(
+        await changeAppAccess({
+          app,
+          authority: auth.getAuthority(c),
+          repair: true,
+          change: c.req.valid("json"),
+          requestId: c.req.header("x-request-id"),
+        }),
+      );
+    });
+export type AppAccessApi = ReturnType<typeof createAppAccessRoutes>;

package/src/api/app-approval.ts

@@ -27,9 +27,10 @@ import {
   type createAppApprovalService,
 } from "../services/app-approval";
 import { type NewBrowserSignInNotifier, readBrowserCookie } from "../services/known-browsers";
-import { SessionAppDeviceInactiveError, SessionEpochChangedError } from "../services/session";
+import { SessionAccountMismatchError, SessionAppDeviceInactiveError, SessionEpochChangedError } from "../services/session";
 import { appNameIn } from "../ssr/runtime";
 import { createDeviceActions } from "./app-approval-actions";
+import { accountMismatchResponse } from "./auth/account-mismatch";
 
 const PairingIdSchema = z.object({ pairingId: z.string().uuid() }).strict();
 const DevicePageSchema = z.object({ after: z.string().uuid().optional() }).strict();
@@ -56,6 +57,7 @@ export const createAppApprovalRoutes = (
     .use("/device", noTransform())
     .use("/device/*", noTransform())
     .onError((error, c) => {
+      if (error instanceof SessionAccountMismatchError) return accountMismatchResponse(c);
       if (error instanceof AppApprovalError) return c.json({ code: error.code, message: error.code }, error.status);
       if (error instanceof HTTPException && error.status < 500) return c.json({ code: "INVALID_REQUEST" }, error.status);
       // Never include SQL, pairing secrets, signature bodies or keys in errors.

package/src/api/app-event-delivery.ts

@@ -0,0 +1,51 @@
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+import { z } from "zod";
+import type { CompiledCapabilities } from "../_internal/capabilities";
+import { AppEventEnvelopeSchema, appEventSubscriptionId } from "../contracts/app-events";
+import { deliverAppEvent } from "../events/app-events";
+import { REQUEST_IDLE_TIMEOUT_SECONDS, setRequestTimeout } from "../server/request-timeout";
+import { verifyAppEventInvocation } from "../services/identity/invocation-token";
+
+const DeliveryInput = z
+  .object({ envelope: AppEventEnvelopeSchema, subscriptionId: z.string().max(400), attempt: z.number().int().min(1).max(8) })
+  .strict();
+export const createAppEventDeliveryRoutes = (compiled: CompiledCapabilities, verify = verifyAppEventInvocation) =>
+  new Hono().use(bodyLimit({ maxSize: 8192 })).post("/deliver", async (c) => {
+    const payload: unknown = await c.req.json().catch(() => null);
+    const parsed = DeliveryInput.safeParse(payload);
+    if (!parsed.success) return c.json({ code: "schema_mismatch" }, 422);
+    const { envelope, subscriptionId, attempt } = parsed.data;
+    const token = c.req.header("authorization")?.match(/^Bearer (\S+)$/i)?.[1];
+    if (!token || !(await verify(token, { appId: compiled.manifest.appId, subscriptionId, eventId: envelope.id, payload })))
+      return c.json({ code: "unauthorized" }, 401);
+    const sub = compiled.subscribes.get(envelope.type);
+    if (
+      !sub ||
+      sub.manifest.version !== envelope.version ||
+      subscriptionId !== appEventSubscriptionId(compiled.manifest.appId, envelope.type, envelope.version)
+    )
+      return c.json({ code: "subscription_removed" }, 410);
+    if (envelope.place) return c.json({ code: "resource_events_unsupported" }, 410);
+    if (!sub.definition.schema.safeParse(envelope.data).success) return c.json({ code: "schema_mismatch" }, 422);
+    const signal = AbortSignal.any([c.req.raw.signal, AbortSignal.timeout(30000)]);
+    let onAbort: () => void = () => {};
+    const aborted = new Promise<never>((_, reject) => {
+      onAbort = () => reject(signal.reason);
+      signal.addEventListener("abort", onAbort, { once: true });
+      if (signal.aborted) onAbort();
+    });
+    setRequestTimeout(c, 40);
+    try {
+      await Promise.race([
+        deliverAppEvent({ compiled, subscriptionId, envelope, context: { subscriptionId, eventId: envelope.id, attempt, signal } }),
+        aborted,
+      ]);
+      return c.json({ done: true });
+    } catch {
+      return c.json({ code: signal.aborted && signal.reason?.name === "TimeoutError" ? "handler_timeout" : "handler_failed" }, 503);
+    } finally {
+      signal.removeEventListener("abort", onAbort);
+      setRequestTimeout(c, REQUEST_IDLE_TIMEOUT_SECONDS);
+    }
+  });

package/src/api/app-events.ts

@@ -0,0 +1,123 @@
+import { sql } from "bun";
+import { Hono, type MiddlewareHandler } from "hono";
+import { describeRoute } from "hono-openapi";
+import { z } from "zod";
+import { AppDetailsSchema } from "../contracts/app-details";
+import { AppEventEnvelopeSchema } from "../contracts/app-events";
+import { CapabilityQualifiedIdSchema } from "../contracts/capabilities";
+import { type AuthContext, auth, expectUserBackedActor, getLocale, v } from "../server";
+import { AppAccessManagementError } from "../services/app-access-management";
+import { appDetails } from "../services/app-details";
+import { appEventShape, appEventShapeId, recordedAppEventShape } from "../services/app-event-shapes";
+import { appEventBroker } from "../services/app-events";
+
+const App = z.string().regex(/^[a-z][a-z0-9-]{0,79}$/);
+const Filter = z.object({
+  app: App.optional(),
+  state: z.enum(["pending", "retrying", "done", "failed", "cancelled"]).optional(),
+  eventType: CapabilityQualifiedIdSchema.optional(),
+  offset: z.coerce.number().int().min(0).default(0),
+  limit: z.coerce.number().int().min(1).max(100).default(50),
+});
+export const createAppEventRoutes = (
+  authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin"),
+  service = appEventBroker,
+  details = appDetails,
+) =>
+  new Hono<AuthContext>()
+    .use(authenticate)
+    .use(auth.requireOAuthScope("admin"))
+    .get(
+      "/apps/:appId",
+      describeRoute({ tags: ["App events"], summary: "Inspect one application's access, events and notifications" }),
+      v("param", z.object({ appId: App })),
+      async (c) => {
+        try {
+          const result = await details(c.req.valid("param").appId, { authority: auth.getAuthority(c), locale: getLocale(c) });
+          return result ? c.json(AppDetailsSchema.parse(result)) : c.json({ code: "app_not_found" }, 404);
+        } catch (error) {
+          if (error instanceof AppAccessManagementError) return c.json({ code: error.code, message: error.message }, error.status);
+          throw error;
+        }
+      },
+    )
+    .get("/catalog", describeRoute({ tags: ["App events"], summary: "List declared event types and subscribers" }), async (c) =>
+      c.json(await service.catalog(getLocale(c))),
+    )
+    .get(
+      "/subscriptions",
+      describeRoute({ tags: ["App events"], summary: "Inspect declared subscriptions and delivery counts" }),
+      v("query", z.object({ app: App.optional() })),
+      async (c) => c.json(await service.subscriptions(c.req.valid("query").app)),
+    )
+    .get("/deliveries", describeRoute({ tags: ["App events"], summary: "List app event deliveries" }), v("query", Filter), async (c) =>
+      c.json(await service.deliveries(c.req.valid("query"))),
+    )
+    .post(
+      "/deliveries/:id/redeliver",
+      describeRoute({ tags: ["App events"], summary: "Retry one delivery preserving its event ID" }),
+      v("param", z.object({ id: z.uuid() })),
+      async (c) => {
+        const user = expectUserBackedActor(c);
+        const result = await service.redeliver(c.req.valid("param").id, {
+          userId: user.id,
+          uid: user.uid,
+          provider: user.provider,
+          roles: user.roles,
+        });
+        return result ? c.json(result) : c.json({ code: "not_redeliverable" }, 409);
+      },
+    )
+    .post("/status/acknowledge", describeRoute({ tags: ["App events"], summary: "Acknowledge a reconciled retention gap" }), async (c) => {
+      const user = expectUserBackedActor(c);
+      const result = await service.acknowledgeGap({ userId: user.id, uid: user.uid, provider: user.provider, roles: user.roles });
+      return result ? c.json(result) : c.json({ code: "no_gap_detected" }, 409);
+    })
+    .get(
+      "/status",
+      describeRoute({ tags: ["App events"], summary: "Read broker progress, retention gaps and rejected-event metadata" }),
+      async (c) => c.json(await service.status()),
+    )
+    .get(
+      "/record/:eventType",
+      describeRoute({ tags: ["App events"], summary: "Record schema-only JSONL fixtures; no stored event values are returned" }),
+      v("param", z.object({ eventType: CapabilityQualifiedIdSchema })),
+      v("query", z.object({ shapeOnly: z.literal("true"), limit: z.coerce.number().int().min(1).max(100).default(10) })),
+      async (c) => {
+        const { eventType } = c.req.valid("param");
+        const { limit } = c.req.valid("query");
+        const catalog = await service.catalog();
+        const rows = await sql<
+          { version: number; envelope: { data: unknown } }[]
+        >`SELECT version, envelope FROM events.app_events WHERE type=${eventType} AND state='accepted' ORDER BY seq DESC LIMIT ${limit}`;
+        try {
+          const shapes = new Map<string, { version: number; shape: ReturnType<typeof recordedAppEventShape> }>();
+          for (const row of rows) {
+            const shape = recordedAppEventShape(row.envelope.data);
+            shapes.set(JSON.stringify([row.version, shape]), { version: row.version, shape });
+          }
+          const lines = [...shapes.values()].map((row) => {
+            const declaration = catalog.events.find((event) => event.type === eventType && event.version === row.version);
+            if (!declaration) throw new Error("shape_unavailable");
+            return JSON.stringify(
+              AppEventEnvelopeSchema.parse({
+                id: appEventShapeId(eventType, row.version, row.shape),
+                type: eventType,
+                version: row.version,
+                source: eventType.split(".")[0],
+                time: "2000-01-01T00:00:00.000Z",
+                subject: { type: declaration.subject, id: "00000000-0000-4000-8000-000000000001" },
+                ...(declaration.place ? { place: { type: declaration.place, id: "00000000-0000-4000-8000-000000000001" } } : {}),
+                data: appEventShape(declaration.dataSchema, 0, row.shape),
+              }),
+            );
+          });
+          return c.body(lines.length ? lines.join("\n") + "\n" : "", 200, {
+            "content-type": "application/x-ndjson",
+            "cache-control": "no-store",
+          });
+        } catch {
+          return c.json({ code: "shape_unavailable", message: "A deterministic fixture cannot be generated for this declaration." }, 422);
+        }
+      },
+    );

package/src/api/app-resource-access.ts

@@ -0,0 +1,48 @@
+import { type Context, Hono } from "hono";
+import { bindAppAccessRequest } from "../_internal/app-access-request";
+import { hasLocalResourceAppAccess } from "../_internal/app-access-resources";
+import { getApp } from "../_internal/registry";
+import type { AppMeta } from "../contracts/app";
+import { type AuthContext, auth, type RequestAuthority } from "../server/middleware/auth";
+import { rateLimit } from "../server/middleware/rate-limit";
+import { canUseApp } from "../services/app-access";
+import { resolveInvocationAuthority } from "../services/identity/invocation-actor";
+import { isInvocationJwtCandidate, verifyAppAccessProbe } from "../services/identity/invocation-token";
+
+/** Framework-only endpoint, mounted before the app gate to avoid recursive entry checks. */
+export const createResourceAppAccessRoutes = (app: Pick<AppMeta, "id" | "access">) => {
+  const router = new Hono<AuthContext>();
+  if (app.access?.kind === "resources")
+    router.post("/check", auth.readOnly, async (c) => {
+      c.header("Cache-Control", "private, no-store");
+      const token = c.req.header("authorization")?.match(/^Bearer (\S+)$/i)?.[1];
+      if (!token || !isInvocationJwtCandidate(token)) return c.body(null, 401);
+      const claims = await verifyAppAccessProbe(token, app.id);
+      if (!claims) return c.body(null, 401);
+      if (!hasLocalResourceAppAccess(app.id)) return c.body(null, 403);
+      const authority = await resolveInvocationAuthority(claims);
+      if (!authority) return c.body(null, 401);
+      return c.body(null, (await canUseApp(bindAppAccessRequest(authority, c.req.raw), app)) ? 204 : 403);
+    });
+  if (app.id === "core")
+    router.post(
+      "/apps/:appId",
+      auth.readOnly,
+      async (c, next) => {
+        c.header("Cache-Control", "private, no-store");
+        const token = c.req.header("authorization")?.match(/^Bearer (\S+)$/i)?.[1];
+        if (token && isInvocationJwtCandidate(token)) return c.body(null, 401);
+        await next();
+      },
+      auth.requireRole("authenticated"),
+      rateLimit(),
+      (c) => answerCoreProbe(c, auth.getAuthority(c)),
+    );
+  return router;
+};
+
+const answerCoreProbe = async (c: Context<AuthContext>, authority: RequestAuthority): Promise<Response> => {
+  const target = await getApp(c.req.param("appId") ?? "");
+  if (!target || target.access?.kind !== "resources") return c.body(null, 404);
+  return c.body(null, (await canUseApp(bindAppAccessRequest(authority, c.req.raw), target)) ? 204 : 403);
+};

package/src/api/auth/account-mismatch.ts

@@ -0,0 +1,24 @@
+import { i18n } from "@k2b/stdlib";
+import type { Context } from "hono";
+import { getLocale } from "../../server/locale";
+
+const messages = i18n.define({
+  baseLocale: "en",
+  messages: {
+    en: {
+      recovery: "Use another sign-in method to confirm your identity. To recover an account, sign out first.",
+      mismatch: "Sign in with the account already open in this browser. If your session expired, open the sign-in page and start again.",
+    },
+    de: {
+      recovery: "Bestätige deine Identität mit einer anderen Anmeldemethode. Zur Kontowiederherstellung melde dich zuerst ab.",
+      mismatch:
+        "Melde dich mit dem Konto an, das in diesem Browser geöffnet ist. Falls deine Sitzung abgelaufen ist, öffne die Anmeldeseite und beginne erneut.",
+    },
+  },
+});
+
+export const accountMismatchResponse = (c: Context) =>
+  c.json({ code: "ACCOUNT_MISMATCH", message: messages.resolve([getLocale(c)]).t.mismatch }, 403);
+
+export const confirmationRecoveryResponse = (c: Context) =>
+  c.json({ code: "CONFIRMATION_METHOD_UNAVAILABLE", message: messages.resolve([getLocale(c)]).t.recovery }, 403);

package/src/api/auth.ts

@@ -4,15 +4,18 @@ import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import { env } from "../config";
 import { ChangeExpiredPasswordSchema } from "../contracts";
+import { coreUserEventPublisher } from "../events/core-user-created";
 import { type AuthContext, auth, getLocale, jsonResponse, rateLimit, respond, v } from "../server";
 import { accounts, audit, authFlows, getFreeIpaConfig, logger, webauthn } from "../services";
 import { isAccountCategoryAllowed } from "../services/account-category-policy";
 import type { AuthNotificationSender } from "../services/auth-flows/notification-sender";
 import { legalConsent } from "../services/legal-consent";
-import { SessionEpochChangedError } from "../services/session";
+import { SessionAccountMismatchError, SessionEpochChangedError } from "../services/session";
 import * as categorySettings from "../services/settings";
 import { publicCloudOrigin } from "../shared/app-url";
 
+import { accountMismatchResponse, confirmationRecoveryResponse } from "./auth/account-mismatch";
+
 const log = logger("auth");
 
 import { ErrorResponseSchema, MessageResponseSchema } from "../contracts";
@@ -33,7 +36,19 @@ const jsonError = (c: Context, message: string, status: 400 | 401 | 500 | 503) =
 /** Authentication routes: login, logout. */
 export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
   new Hono<AuthContext>()
+    .onError((error, c) => {
+      if (error instanceof SessionAccountMismatchError) return accountMismatchResponse(c);
+      throw error;
+    })
     .use(rateLimit())
+    .use(async (c, next) => {
+      if (
+        c.req.header("X-Cloud-Reauthenticate") === "1" &&
+        ["/admin-login", "/change-expired-password", "/password-reset/complete"].some((path) => c.req.path.endsWith(path))
+      )
+        return confirmationRecoveryResponse(c);
+      return next();
+    })
     .post(
       "/legal-consent",
       describeRoute({ tags: ["Auth"], summary: "Explicitly accept terms after sign-in; unlock the pending session" }),
@@ -301,7 +316,7 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         tags: ["Auth"],
         summary: "Complete password reset",
         description:
-          "Use a one-time reset token to first sign the account out everywhere, including unpairing Cloud Login and mobile app phones, then set the password, sign out everywhere again and create the new browser session. If signing out everywhere fails before the change, the password stays unchanged; if it fails after the change, no session is issued. Both answer 500, and a new reset link is required. signOutOthersFailed is false whenever a session is issued.",
+          "Use a one-time reset token to first sign the account out everywhere, including unpairing Cloud Login and mobile app devices, then set the password, sign out everywhere again and create the new browser session. If signing out everywhere fails before the change, the password stays unchanged; if it fails after the change, no session is issued. Both answer 500, and a new reset link is required. signOutOthersFailed is false whenever a session is issued.",
         responses: {
           200: jsonResponse(PasswordChangeAuthResponseSchema, "Password reset completed and session created"),
           400: jsonResponse(ErrorResponseSchema, "Password reset failed"),
@@ -399,14 +414,22 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         // prior `DO NOTHING` could log into a pre-existing `uid='admin'` row that
         // was locally demoted (non-admin local user, or even an IPA row named
         // admin), silently bypassing the intent of the emergency endpoint.
-        await sql`
+        await sql.begin(async (tx) => {
+          const [created] = await tx<{ id: string; inserted: boolean }[]>`
         INSERT INTO auth.users (uid, provider, profile, admin, given_name, sn, display_name)
         VALUES ('admin', 'local', 'user', true, 'Admin', '', 'Admin')
         ON CONFLICT (uid) DO UPDATE SET
           provider = 'local',
           profile = 'user',
           admin = true
+        RETURNING id, (xmax = 0) AS inserted
       `;
+          if (created?.inserted)
+            await coreUserEventPublisher().publish(tx, "user.created", {
+              subject: created.id,
+              data: { userId: created.id, provider: "local" },
+            });
+        });
 
         const user = await accounts.users.get({ uid: "admin" });
         if (!user) return jsonError(c, "Failed to resolve admin user.", 500);