@k2b/cloud 0.42.0 → 0.44.0

package/src/services/geo/service.ts

@@ -1,4 +1,5 @@
 import type { z } from "zod";
+import type { AppPwaActor } from "../../app-pwa/contracts";
 import type { AccessSubject, CapabilityExecutionContext, RequestActor } from "../../contracts";
 import {
   GeoAutocompleteDataSchema,
@@ -26,17 +27,27 @@ import { createGeoRouteService } from "./route-service";
 import { type GeoConfig, geoPlan, readGeoConfig } from "./settings";
 
 export type GeoContext = Partial<Pick<CapabilityExecutionContext, "actor" | "accessSubject" | "locale" | "signal" | "requestId">>;
+/** Internal, narrow App-PWA autocomplete adapter; never a RequestActor or capability caller. */
+export type AppPwaGeoContext = { actor: AppPwaActor; locale?: string; signal?: AbortSignal; requestId?: string };
+type GeoCallContext = GeoContext | AppPwaGeoContext;
 export const geoIdentity = (context: GeoContext): { actor: RequestActor; accessSubject: AccessSubject } => {
   const { actor, accessSubject } = context;
   if (
     !actor ||
     !accessSubject ||
-    !(actor.kind === "user" ? actor.user?.id : actor.serviceAccount?.id) ||
+    !(actor.kind === "user" ? actor.user?.id : actor.kind === "service_account" ? actor.serviceAccount?.id : undefined) ||
     !(accessSubject.type === "user" ? accessSubject.userId : accessSubject.serviceAccountId)
   )
     throw new GeoError("GEO_FORBIDDEN");
   return { actor, accessSubject };
 };
+const geoCallIdentity = (context: GeoCallContext): { actor: RequestActor | AppPwaActor; accessSubject: AccessSubject } => {
+  if (context.actor?.kind === "device" || context.actor?.kind === "visit") {
+    if (!context.actor.ownerUserId) throw new GeoError("GEO_FORBIDDEN");
+    return { actor: context.actor, accessSubject: { type: "user", userId: context.actor.ownerUserId } };
+  }
+  return geoIdentity({ actor: context.actor, accessSubject: "accessSubject" in context ? context.accessSubject : undefined });
+};
 const bound = (name: string, value: number, min: number, max: number, integer = false) => {
   if (!Number.isFinite(value) || value > max || value < min || (integer && !Number.isInteger(value)))
     limitExceeded(name, value < min ? min : max, value);
@@ -81,14 +92,21 @@ export const createGeoService = (
     monthlyCredits: settings.monthlyCredits,
     personDailyCredits: settings.personDailyCredits,
   });
-  const recordTransition = async (event: "monthly_budget_exhausted" | "provider_key_rejected", timezone: string, context: GeoContext) => {
-    const identity = geoIdentity(context);
+  const recordTransition = async (
+    event: "monthly_budget_exhausted" | "provider_key_rejected" | "route_cost_overrun",
+    timezone: string,
+    context: GeoCallContext,
+    metadata?: Record<string, number>,
+  ) => {
+    const identity = geoCallIdentity(context);
     try {
-      await ledger.recordTransition(event, timezone, { ...context, ...identity }, now());
+      await ledger.recordTransition(event, timezone, { ...context, ...identity }, now(), metadata);
+      return true;
     } catch {
       // The transaction rolls back the dedup row too, allowing the next refusal to record it.
       // Preserve the original recovery details and paid/unknown costs on audit outages.
       console.error("[geo] Audit transition could not be recorded", { event });
+      return false;
     }
   };
   const configured = async (context: GeoContext) => {
@@ -100,7 +118,7 @@ export const createGeoService = (
   const paid = async <T>(
     fn: GeoFunction,
     input: unknown,
-    context: GeoContext,
+    context: GeoCallContext,
     settings: GeoConfig,
     schema: z.ZodType<T>,
     request: (signal: AbortSignal) => Promise<T>,
@@ -108,7 +126,7 @@ export const createGeoService = (
     cacheInput = input,
     empty: (value: T) => boolean = () => false,
   ): Promise<T> => {
-    const identity = geoIdentity(context);
+    const identity = geoCallIdentity(context);
     const locale = context.locale ?? "en";
     const key = geoCacheKey(fn, cacheInput, locale);
     const hit = await cache.get(key, schema);
@@ -169,29 +187,37 @@ export const createGeoService = (
       await release();
     }
   };
+  const autocomplete = async (input: GeoAutocompleteInput, context: GeoCallContext) => {
+    geoCallIdentity(context);
+    const settings = await config();
+    if (!settings.apiKey.trim()) throw new GeoError("GEO_NOT_CONFIGURED");
+    const value = parse(GeoAutocompleteInputSchema, input);
+    bound("text", value.text.length, 3, 300);
+    bound("text", value.text.trim().length, 3, 300);
+    bound("limit", value.limit ?? 5, 1, 5, true);
+    country(value.countryCode);
+    area(value.area);
+    return paid(
+      "autocomplete",
+      value,
+      context,
+      settings,
+      GeoAutocompleteDataSchema,
+      (signal) => adapter.autocomplete(value, settings.apiKey, context.locale ?? "en", signal),
+      value.limit,
+      { ...value, limit: value.limit ?? 5 },
+      (result) => !result.suggestions.length,
+    );
+  };
   const routes = createGeoRouteService({ configured, adapter, cache, bucket, ledger, now, recordTransition });
   return {
     ...routes,
-    async autocomplete(input: GeoAutocompleteInput, context: GeoContext) {
-      const settings = await configured(context);
-      const value = parse(GeoAutocompleteInputSchema, input);
-      bound("text", value.text.length, 3, 300);
-      bound("text", value.text.trim().length, 3, 300);
-      bound("limit", value.limit ?? 5, 1, 5, true);
-      country(value.countryCode);
-      area(value.area);
-      return paid(
-        "autocomplete",
-        value,
-        context,
-        settings,
-        GeoAutocompleteDataSchema,
-        (signal) => adapter.autocomplete(value, settings.apiKey, context.locale ?? "en", signal),
-        value.limit,
-        { ...value, limit: value.limit ?? 5 },
-        (result) => !result.suggestions.length,
-      );
+    autocomplete: async (input: GeoAutocompleteInput, context: GeoContext) => {
+      geoIdentity(context);
+      return autocomplete(input, context);
     },
+    // Only the App-PWA service calls this after locking the pairing and optional visit authority.
+    autocompleteForAppPwa: (input: GeoAutocompleteInput, context: AppPwaGeoContext) => autocomplete(input, context),
     async geocode(input: GeoGeocodeInput, context: GeoContext) {
       const settings = await configured(context);
       const value = parse(GeoGeocodeInputSchema, input);

package/src/services/identity/core-origin.ts

@@ -0,0 +1,12 @@
+import { env } from "../../config/env";
+import { publicCloudOrigin } from "../../shared/app-url";
+import { get } from "../settings";
+
+export const coreOrigin = async (internal = false): Promise<string> => {
+  const configured = env.CLOUD_CORE_INTERNAL_ORIGIN;
+  if (internal && !configured) throw new Error("CLOUD_CORE_INTERNAL_ORIGIN is required for internal Core requests");
+  const origin = configured || publicCloudOrigin(await get<string>("app.url"));
+  const url = new URL(origin);
+  if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error("CLOUD_CORE_INTERNAL_ORIGIN must use http or https");
+  return url.origin;
+};

package/src/services/identity/index.ts

@@ -8,7 +8,7 @@ export {
   CLOUD_SESSION_TOKEN_TYPE,
 } from "./constants";
 export { type ResolvedInvocationAuthority, resolveInvocationAuthority } from "./invocation-actor";
-export { invocationAuthorityFromRequest } from "./invocation-authority";
+export { authorityFromParentInvocation, invocationAuthorityFromRequest, matchesInvocationSubject } from "./invocation-authority";
 export { capabilityInvocationOperation, searchInvocationOperation, widgetInvocationOperation } from "./invocation-operations";
 export {
   type CloudInvocationClaims,
@@ -36,6 +36,7 @@ export {
   withActiveIdentitySigner,
 } from "./key-ring";
 export { identityMetrics } from "./metrics";
+export { isNestedSourceCurrent, type NestedInvocationLease, nestedInvocationLeases } from "./nested-invocation";
 export { createIdentityPublicRoutes } from "./routes";
 export {
   type CloudSessionClaims,

package/src/services/identity/invocation-actor.ts

@@ -3,9 +3,11 @@ import type { RequestActor } from "../../server/middleware/auth";
 import type { AccessSubject } from "../../server/services/access";
 import { isAccountCategoryAllowed } from "../account-category-policy";
 import { isAccountExpired } from "../account-model";
+import { isServiceAccountOAuthAuthorityCurrent } from "../oauth-tokens";
 import type { ServiceAccount } from "../service-accounts";
 import { buildProjectedUser, loadCurrentUser, userProjectionJoin, userProjectionSql, withoutAdminRole } from "../session/user";
 import type { CloudInvocationClaims } from "./invocation-token";
+import { isNestedSourceCurrent, nestedInvocationLeases } from "./nested-invocation";
 import { getIdentityRuntimeConfig } from "./runtime-config";
 
 type ServiceAccountRow = Record<string, unknown> & {
@@ -32,9 +34,13 @@ export type InvocationPrincipalClaims = Pick<
   CloudInvocationClaims,
   | "sub"
   | "principal_type"
+  | "access_subject_type"
+  | "access_subject_id"
   | "session_kind"
   | "scopes"
   | "credential_id"
+  | "oauth_client_id"
+  | "credential_expires_at"
   | "exp"
   | "act"
   | "credential_kind"
@@ -44,6 +50,7 @@ export type InvocationPrincipalClaims = Pick<
   | "mandate_revision"
   | "workload_type"
   | "workload_id"
+  | "parent_invocation_id"
 >;
 
 const provenance = (claims: InvocationPrincipalClaims): NonNullable<RequestActor["delegation"]> => ({
@@ -51,6 +58,7 @@ const provenance = (claims: InvocationPrincipalClaims): NonNullable<RequestActor
   callingAppId: claims.act.sub.slice("app:".length),
   credentialKind: claims.credential_kind,
   invocationId: claims.jti,
+  ...(claims.parent_invocation_id ? { parentInvocationId: claims.parent_invocation_id } : {}),
   requestId: claims.request_id ?? null,
   ...(claims.mandate_id
     ? {
@@ -80,10 +88,29 @@ export const resolveInvocationAuthority = async (
   query: typeof sql = sql,
   groupsAdminOverride?: string[],
 ): Promise<ResolvedInvocationAuthority | null> => {
+  if (claims.parent_invocation_id) {
+    const lease = await nestedInvocationLeases.read(claims.parent_invocation_id).catch(() => null);
+    if (!lease || `app:${lease.appId}` !== claims.act.sub) return null;
+    if (lease.proof && !(await isNestedSourceCurrent(lease.proof, claims).catch(() => false))) return null;
+    if (claims.mandate_id) {
+      // Policy was checked under Core's issuance transaction; admission also
+      // checks the parent's current mandate state and subject.
+      const [mandate] = await query<{ id: string }[]>`
+        SELECT id FROM auth.mandates
+        WHERE id = ${claims.mandate_id}::uuid AND revision = ${claims.mandate_revision}
+          AND state = 'active' AND confirmed_at IS NOT NULL
+          AND (expires_at IS NULL OR expires_at > now())
+          AND subject_kind = ${claims.principal_type}
+          AND COALESCE(subject_user_id, subject_service_account_id) = ${claims.sub}::uuid
+      `;
+      if (!mandate) return null;
+    }
+  }
   const groupsAdmin = groupsAdminOverride ?? (await getIdentityRuntimeConfig()).groupsAdmin;
   const delegation = provenance(claims);
 
   if (claims.principal_type === "user") {
+    if (claims.access_subject_type !== "user" || claims.access_subject_id !== claims.sub) return null;
     const current = await loadCurrentUser({ userId: claims.sub, groupsAdmin }, query);
     if (!current || isAccountExpired(current.accountExpires)) return null;
     if (!(await isAccountCategoryAllowed(current, query))) return null;
@@ -125,15 +152,36 @@ export const resolveInvocationAuthority = async (
   if (serviceAccount.kind === "user_delegated" && (!delegatedUser || isAccountExpired(delegatedUser.accountExpires))) return null;
   if (delegatedUser && !(await isAccountCategoryAllowed(delegatedUser, query))) return null;
 
-  const actor: RequestActor = {
+  if (
+    claims.access_subject_type !== (delegatedUser ? "user" : "service_account") ||
+    claims.access_subject_id !== (delegatedUser?.id ?? serviceAccount.id)
+  )
+    return null;
+
+  const actor: Extract<RequestActor, { kind: "service_account" }> = {
     kind: "service_account",
     serviceAccount,
     delegatedUser,
     scopes: [...claims.scopes],
     credentialId: claims.credential_id ?? null,
-    credentialExpiresAt: new Date(claims.exp * 1_000).toISOString(),
+    oauthClientId: claims.oauth_client_id ?? null,
+    credentialExpiresAt: new Date(
+      Math.min(claims.exp * 1_000, claims.credential_expires_at ? Date.parse(claims.credential_expires_at) : Infinity),
+    ).toISOString(),
     delegation,
   };
+  if (
+    claims.oauth_client_id &&
+    !(await isServiceAccountOAuthAuthorityCurrent(
+      {
+        serviceAccountId: serviceAccount.id,
+        clientId: claims.oauth_client_id,
+        expiresAt: actor.credentialExpiresAt,
+      },
+      { query, groupsAdmin },
+    ))
+  )
+    return null;
   const accessSubject: AccessSubject = delegatedUser
     ? { type: "user", userId: delegatedUser.id, delegatedByServiceAccountId: serviceAccount.id }
     : { type: "service_account", serviceAccountId: serviceAccount.id };

package/src/services/identity/invocation-authority.ts

@@ -1,5 +1,5 @@
 import type { RequestAuthority } from "../../server/middleware/auth";
-import type { InvocationAuthority } from "./invocation-token";
+import type { CloudInvocationClaims, InvocationAuthority } from "./invocation-token";
 
 export const invocationAuthorityFromRequest = (authority: RequestAuthority): InvocationAuthority => {
   if (authority.credentialKind === "invocation") {
@@ -35,6 +35,8 @@ export const invocationAuthorityFromRequest = (authority: RequestAuthority): Inv
       delegated_user_id: actor.delegatedUser.id,
       credential_kind: authority.credentialKind,
       ...(actor.credentialId ? { credential_id: actor.credentialId } : {}),
+      ...(actor.oauthClientId ? { oauth_client_id: actor.oauthClientId } : {}),
+      ...(actor.credentialExpiresAt ? { credential_expires_at: actor.credentialExpiresAt } : {}),
       scopes: [...new Set(authority.scopes)].sort(),
     };
   }
@@ -49,6 +51,41 @@ export const invocationAuthorityFromRequest = (authority: RequestAuthority): Inv
     access_subject_id: actor.serviceAccount.id,
     credential_kind: authority.credentialKind,
     ...(actor.credentialId ? { credential_id: actor.credentialId } : {}),
+    ...(actor.oauthClientId ? { oauth_client_id: actor.oauthClientId } : {}),
+    ...(actor.credentialExpiresAt ? { credential_expires_at: actor.credentialExpiresAt } : {}),
     scopes: [...new Set(authority.scopes)].sort(),
   };
 };
+
+/** A principal or delegation change cannot turn an existing invocation into new authority. */
+export const matchesInvocationSubject = (parent: CloudInvocationClaims, current: RequestAuthority): boolean => {
+  const actor = current.actor;
+  const subject = current.accessSubject;
+  return (
+    (actor.kind === "user" ? actor.user.id : actor.serviceAccount.id) === parent.sub &&
+    actor.kind === parent.principal_type &&
+    subject.type === parent.access_subject_type &&
+    (subject.type === "user" ? subject.userId : subject.serviceAccountId) === parent.access_subject_id
+  );
+};
+
+/** Copy only authority fields, preserving every ceiling. Never relabel an invocation as a session. */
+export const authorityFromParentInvocation = (parent: CloudInvocationClaims): InvocationAuthority => ({
+  sub: parent.sub,
+  principal_type: parent.principal_type,
+  access_subject_type: parent.access_subject_type,
+  access_subject_id: parent.access_subject_id,
+  ...(parent.delegated_user_id ? { delegated_user_id: parent.delegated_user_id } : {}),
+  credential_kind: parent.credential_kind,
+  ...(parent.session_kind ? { session_kind: parent.session_kind } : {}),
+  ...(parent.credential_id ? { credential_id: parent.credential_id } : {}),
+  scopes: [...parent.scopes],
+  ...(parent.mandate_id
+    ? {
+        mandate_id: parent.mandate_id,
+        mandate_revision: parent.mandate_revision,
+        workload_type: parent.workload_type,
+        workload_id: parent.workload_id,
+      }
+    : {}),
+});