@k2b/cloud 0.43.0 → 0.44.0

package/src/server/middleware/auth.ts

@@ -2,6 +2,7 @@ import type { Context, Env, MiddlewareHandler } from "hono";
 import { createMiddleware } from "hono/factory";
 import { matchedRoutes } from "hono/route";
 import { findTargetHandler } from "hono/utils/handler";
+import { bindAppAccessRequest } from "../../_internal/app-access-request";
 import { measureServerPhase } from "../../_internal/server-timing";
 import {
   AI_INFERENCE_SCOPE,
@@ -58,6 +59,8 @@ export type ServiceAccountRequestActor =
       delegatedUser: User;
       scopes: string[];
       credentialId?: string | null;
+      /** Public OAuth client identifier; safe to retain, never the bearer token. */
+      oauthClientId?: string | null;
       credentialExpiresAt?: string | null;
       delegation?: InvocationProvenance;
     }
@@ -67,6 +70,8 @@ export type ServiceAccountRequestActor =
       delegatedUser: null;
       scopes: string[];
       credentialId?: string | null;
+      /** Public OAuth client identifier; safe to retain, never the bearer token. */
+      oauthClientId?: string | null;
       credentialExpiresAt?: string | null;
       delegation?: InvocationProvenance;
     };
@@ -248,6 +253,7 @@ const loadAuthenticatedActorUncached = async (
       delegatedUser: authResult.delegatedUser,
       scopes: authResult.scopes,
       credentialId: null,
+      oauthClientId: authResult.oauthClientId,
       credentialExpiresAt: typeof authResult.payload.exp === "number" ? new Date(authResult.payload.exp * 1_000).toISOString() : null,
     };
     c.set("actor", actor);
@@ -482,13 +488,21 @@ const getAuthority = <E extends AuthContext>(c: Context<E>): RequestAuthority =>
   const accessSubject = c.get("accessSubject");
   const credentialKind = c.get("credentialKind");
   if (!actor || !accessSubject || !credentialKind) throw new Error("Request authority has not been resolved");
-  return {
-    actor,
-    accessSubject,
-    credentialKind,
-    scopes: [...(c.get("credentialScopes") ?? [])],
-    ...(c.get("credentialProof") ? { credentialProof: c.get("credentialProof") } : {}),
-  };
+  return bindAppAccessRequest(
+    {
+      actor,
+      accessSubject,
+      credentialKind,
+      scopes: [...(c.get("credentialScopes") ?? [])],
+      ...(c.get("credentialProof") ? { credentialProof: c.get("credentialProof") } : {}),
+    },
+    c.req.raw,
+    credentialKind === "session"
+      ? c.get("sessionToken")
+      : credentialKind !== "invocation"
+        ? (session.getBearerToken(c) ?? undefined)
+        : undefined,
+  );
 };
 
 /**

package/src/server/middleware/index.ts

@@ -4,6 +4,7 @@ export {
   type AuthContext,
   auth,
   type InvocationProvenance,
+  isRequestCredentialCurrent,
   type RequestActor,
   type RequestAuthority,
   type RequestCredentialKind,

package/src/server/middleware/invocation.ts

@@ -1,5 +1,6 @@
 import type { Context, MiddlewareHandler } from "hono";
 import { createMiddleware } from "hono/factory";
+import { bindAppAccessRequest } from "../../_internal/app-access-request";
 import { getApp } from "../../_internal/registry";
 import type { AppMeta } from "../../contracts/app";
 import { canUseApp } from "../../services/app-access";
@@ -53,6 +54,7 @@ export const requireInvocation = (
     if (!claims) return reject(c);
     const authority = await (dependencies.resolve ?? resolveInvocationAuthority)(claims);
     if (!authority) return reject(c);
+    bindAppAccessRequest(authority, c.req.raw);
     const app = await (dependencies.getApp ?? getApp)(expectation.targetAppId).catch(() => null);
     if (!app || !(await canUseApp(authority, app))) {
       if (app) recordAppAccessDenied(app.id);

package/src/server/public-storage.ts

@@ -0,0 +1,106 @@
+import { objectStoreBackend } from "../_internal/object-store-config";
+import { validateObjectKey } from "../_internal/object-store-key";
+import { get } from "../services/settings";
+import { clientIpBucket } from "./client-ip";
+import { ratelimit } from "./ratelimit";
+
+const notFound = () => new Response(null, { status: 404, headers: { "Cache-Control": "no-store" } });
+
+/** Platform-owned anonymous delivery. Never accepts a bucket, private prefix or listing. */
+export const servePublicStorage = async (request: Request, clientAddress = "unknown"): Promise<Response> => {
+  let path: string;
+  try {
+    // Validate before application decoding; Bun has already resolved transport
+    // dot segments. The S3 key below always starts in the public area.
+    const raw = request.url.replace(/^[a-z]+:\/\/[^/]+/i, "").split(/[?#]/, 1)[0] ?? "";
+    if (/[\\]|%(?:2e|2f|5c)/i.test(raw)) return notFound();
+    const match = /^\/public\/storage\/([a-z][a-z0-9-]{0,79})\/(.+)$/.exec(raw);
+    if (!match || match[1] === "storage") return notFound();
+    const area = `public/${match[1]}/`;
+    path = area + validateObjectKey(decodeURIComponent(match[2] ?? ""), area);
+  } catch {
+    return notFound();
+  }
+  if (request.method !== "GET" && request.method !== "HEAD") return notFound();
+  try {
+    const perSecond = Math.max(1, Math.floor(await get<number>("security.rate_limit_per_second")));
+    const budget = await ratelimit({ id: "public-storage", limit: perSecond }).check(clientIpBucket(clientAddress));
+    if (budget.limited)
+      return new Response("Rate limit exceeded.", {
+        status: 429,
+        headers: { "Cache-Control": "no-store", "Retry-After": String(Math.max(1, Math.ceil(budget.resetIn / 1000))) },
+      });
+    const { client, limit } = await objectStoreBackend();
+    const stat = await client.stat(path);
+    if (stat.size > limit) return notFound();
+    const headers = new Headers({
+      "Content-Type": stat.type || "application/octet-stream",
+      "Content-Length": String(stat.size),
+      ETag: stat.etag,
+      "Last-Modified": stat.lastModified.toUTCString(),
+      "Cache-Control": "public, max-age=300",
+      "X-Content-Type-Options": "nosniff",
+      // Apply to every type, including mislabelled or future active formats.
+      "Content-Security-Policy": "sandbox; default-src 'none'; frame-ancestors 'none'",
+    });
+    const essence = stat.type.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+    const inline =
+      /^(?:image\/(?:png|jpeg|gif|webp|avif|bmp|x-icon)|audio\/(?:mpeg|ogg|wav|webm|mp4)|video\/(?:mp4|webm|ogg)|text\/plain)$/;
+    if (!inline.test(essence)) headers.set("Content-Disposition", "attachment");
+    const ifNoneMatch = request.headers.get("if-none-match");
+    const modifiedSince = request.headers.get("if-modified-since");
+    if (
+      ifNoneMatch
+        ? ifNoneMatch.split(",").some((value) => value.trim() === stat.etag || value.trim() === "*")
+        : modifiedSince && stat.lastModified.getTime() <= Date.parse(modifiedSince)
+    ) {
+      headers.delete("Content-Length");
+      return new Response(null, { status: 304, headers });
+    }
+    if (request.method === "HEAD") return new Response(null, { headers });
+    const reader = client.file(path).stream().getReader();
+    let size = 0;
+    const abort = () => {
+      void reader.cancel(request.signal.reason).catch(() => {});
+    };
+    request.signal.addEventListener("abort", abort, { once: true });
+    const release = () => {
+      request.signal.removeEventListener("abort", abort);
+      reader.releaseLock();
+    };
+    if (request.signal.aborted) abort();
+    const stream = new ReadableStream<Uint8Array>(
+      {
+        async pull(controller) {
+          try {
+            const next = await reader.read();
+            if (next.done) {
+              release();
+              controller.close();
+              return;
+            }
+            size += next.value.byteLength;
+            if (size > limit) throw new RangeError("Public object exceeds the configured size limit.");
+            controller.enqueue(next.value);
+          } catch (error) {
+            await reader.cancel(error).catch(() => {});
+            release();
+            controller.error(error);
+          }
+        },
+        async cancel(reason) {
+          try {
+            await reader.cancel(reason);
+          } finally {
+            release();
+          }
+        },
+      },
+      { highWaterMark: 0 },
+    );
+    return new Response(stream, { headers });
+  } catch (error) {
+    if (error instanceof Error && "code" in error && ["NoSuchKey", "NotFound", "ENOENT"].includes(String(error.code))) return notFound();
+    return new Response("Storage is unavailable.", { status: 503, headers: { "Cache-Control": "no-store" } });
+  }
+};

package/src/server/services/access.ts

@@ -5,6 +5,7 @@ import { accessMessages } from "../../access/messages";
 import { recursiveGroupIdsSubquery } from "../../services/accounts/group-sql";
 import { toPgUuidArray } from "../../services/postgres";
 import type { ServiceAccountKind } from "../../services/service-accounts";
+import type { RequestAuthority } from "../middleware/auth";
 
 export type AccessDb = typeof sql;
 
@@ -305,6 +306,13 @@ export const deleteAccess = async (params: { id: string }, db: AccessDb = sql):
  * Each app implements this to connect their resources to auth.access.
  */
 export type ResourceAccessAdapter<TResourceId = string> = {
+  /**
+   * Whether any resource in this adapter has an effective read/write/admin right.
+   * Use an existence query, never enumerate resources. Preserve domain eligibility,
+   * principal semantics, resource binding and credential ceilings. Use db and signal.
+   * Optional for existing adapters; required when selected by appAccess.resources().
+   */
+  hasAnyRight?: (subject: AccessSubject, context: { authority: RequestAuthority; db: AccessDb; signal: AbortSignal }) => Promise<boolean>;
   /** Get all access entries for a resource */
   list: (resourceId: TResourceId) => Promise<AccessEntry[]>;
   /** Add an access entry to a resource */

package/src/services/accounts/app.ts

@@ -8,6 +8,8 @@ import type {
   EntityListItem,
   GroupMember,
   MutationResult,
+  ServiceAccountKind,
+  ServiceAccountStatus,
   User,
   UserProfile,
   UserProvider,
@@ -1253,6 +1255,8 @@ export const accountsAppService = {
       profile?: UserProfile;
       userIds?: string[];
       groupIds?: string[];
+      serviceAccountKinds?: ServiceAccountKind[];
+      serviceAccountStatus?: ServiceAccountStatus;
       excludeUserIds?: string[];
       excludeGroupIds?: string[];
       excludeServiceAccountIds?: string[];
@@ -1284,6 +1288,8 @@ export const accountsAppService = {
         profile: config.profile,
         userIds: config.userIds,
         groupIds: config.groupIds,
+        serviceAccountKinds: config.serviceAccountKinds,
+        serviceAccountStatus: config.serviceAccountStatus,
         excludeUserIds: config.excludeUserIds,
         excludeGroupIds: config.excludeGroupIds,
         excludeServiceAccountIds: config.excludeServiceAccountIds,

package/src/services/accounts/entities.ts

@@ -2,7 +2,7 @@ import { sql } from "bun";
 import type { EntityKind, EntityListItem, UserProfile, UserProvider } from "../../contracts/shared";
 import { getFreeIpaConfig } from "../freeipa-config";
 import { escapeLikePattern, toPgTextArray, toPgUuidArray } from "../postgres";
-import type { ServiceAccountKind } from "../service-accounts";
+import type { ServiceAccountKind, ServiceAccountStatus } from "../service-accounts";
 import { buildBaseGroup, personalOwnerJoin } from "./base-group";
 import { buildBaseUser } from "./base-user";
 import { buildManagedGroupScopeCondition, recursiveGroupIdsSubquery } from "./group-sql";
@@ -21,6 +21,8 @@ export type EntityListParams = {
   profile?: UserProfile;
   userIds?: string[];
   groupIds?: string[];
+  serviceAccountKinds?: ServiceAccountKind[];
+  serviceAccountStatus?: ServiceAccountStatus;
   excludeUserIds?: string[];
   excludeGroupIds?: string[];
   excludeServiceAccountIds?: string[];
@@ -472,6 +474,13 @@ export const list = async (
     (params.excludeServiceAccountIds?.length ?? 0) === 0
       ? sql`TRUE`
       : sql`(kind <> 'service_account' OR id <> ALL(${toPgUuidArray(params.excludeServiceAccountIds ?? [])}::uuid[]))`;
+  const serviceAccountKindsCondition =
+    (params.serviceAccountKinds?.length ?? 0) === 0
+      ? sql`TRUE`
+      : sql`(kind <> 'service_account' OR service_account_kind = ANY(${toPgTextArray(params.serviceAccountKinds ?? [])}::text[]))`;
+  const serviceAccountStatusCondition = params.serviceAccountStatus
+    ? sql`(kind <> 'service_account' OR status = ${params.serviceAccountStatus})`
+    : sql`TRUE`;
   const userMemberOfGroupCondition =
     (params.userMemberOfGroupIds?.length ?? 0) === 0
       ? sql`TRUE`
@@ -491,6 +500,8 @@ export const list = async (
     AND ${excludeUserCondition}
     AND ${excludeGroupCondition}
     AND ${excludeServiceAccountCondition}
+    AND ${serviceAccountKindsCondition}
+    AND ${serviceAccountStatusCondition}
     AND ${userMemberOfGroupCondition}
     AND ${personalCondition}
     AND (
@@ -649,9 +660,9 @@ export const list = async (
     OFFSET ${offset}
   `;
 
+  // A page past the end has no rows to carry the window count; the total still counts every match.
   let total = rows.length > 0 ? Number(rows[0]!.total) : 0;
-  if (params.visibility.type === "directory_shares" && !rows.length && page > 1)
-    total = (await list({ ...params, page: 1, perPage: 1 })).total;
+  if (!rows.length && page > 1) total = (await list({ ...params, page: 1, perPage: 1 })).total;
   return {
     items: rows.map((row) => {
       const entity = mapEntityRow(row);

package/src/services/accounts/groups.ts

@@ -86,7 +86,9 @@ const listCanonical = async (params: {
     OFFSET ${offset}
   `;
 
-  const total = rows.length > 0 ? Number((rows[0] as Record<string, unknown>).total) : 0;
+  // A page past the end has no rows to carry the window count; the total still counts every match.
+  let total = rows.length > 0 ? Number((rows[0] as Record<string, unknown>).total) : 0;
+  if (!rows.length && page > 1) total = (await listCanonical({ ...params, page: 1, perPage: 1 })).total;
   return {
     groups: rows.map(buildBaseGroup),
     total,

package/src/services/accounts/identities.ts

@@ -207,22 +207,74 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
     if ((input.kind !== "users" && input.kind !== "groups") || typeof input.name !== "string" || !input.name || input.name.includes("\0"))
       throw new AccountIdentityError("invalid_identity_lookup", 400);
   };
+  const reconcileIdentity = async (
+    input: { kind: "users" | "groups"; provider: UserProvider; name: string; identityId?: string; signal?: AbortSignal },
+    state: AccountIdentityAvailability,
+  ): Promise<AccountIdentityReconciliation> => {
+    validateLookup(input);
+    if (input.provider !== "local" && input.provider !== "ipa") throw new AccountIdentityError("invalid_identity_lookup", 400);
+    if (input.identityId !== undefined) cursor(input.identityId);
+    if (input.signal?.aborted) return { state: "unknown", reason: "provider_unavailable" };
+    if (input.provider === "ipa") {
+      if (!state.freeipaEnabled) return { state: "unknown", reason: "provider_disabled" };
+      return upstreamIdentity(input);
+    }
+    const result = await readLocalIdentity(input);
+    return input.signal?.aborted ? { state: "unknown", reason: "provider_unavailable" } : result;
+  };
   return {
+    /** Trusted application provisioning only; no profile, grants, credentials, or administrator impersonation. */
+    async provisioningUsers(input: { provider?: UserProvider; id?: string; after?: string }) {
+      if (input.provider !== undefined && input.provider !== "local" && input.provider !== "ipa")
+        throw new AccountIdentityError("invalid_provider", 400);
+      const id = cursor(input.id);
+      const after = cursor(input.after);
+      const state = await availability();
+      const [localAllowed, ipaAllowed] = await Promise.all([
+        isAccountCategoryAllowed({ provider: "local", profile: "user" }, db),
+        isAccountCategoryAllowed({ provider: "ipa", profile: "user" }, db),
+      ]);
+      const rows = await db<
+        {
+          id: string;
+          provider: UserProvider;
+          uid: string;
+          managed_by: UserProvider | null;
+          uid_number: number | null;
+          primary_gid_number: number | null;
+        }[]
+      >`SELECT u.id,u.provider,u.uid,p.managed_by,p.uid_number,p.primary_gid_number
+        FROM auth.users u LEFT JOIN auth.user_posix p ON p.user_id=u.id
+        WHERE u.provider IN ('local','ipa') AND (${input.provider ?? null}::text IS NULL OR u.provider=${input.provider ?? null})
+          AND u.profile='user'
+          AND (u.account_expires IS NULL OR u.account_expires>now())
+          AND (${id}::uuid IS NULL OR u.id=${id}::uuid)
+          AND (${after}::uuid IS NULL OR u.id>${after}::uuid)
+        ORDER BY u.id LIMIT ${PAGE_SIZE + 1}`;
+      const source = page(rows);
+      const items = source.items
+        .filter((row) => (row.provider === "local" ? localAllowed : ipaAllowed && state.freeipaEnabled))
+        .map((row) => ({
+          id: row.id,
+          provider: row.provider,
+          username: row.uid,
+          posix:
+            row.managed_by === row.provider && positiveId(row.uid_number) && positiveId(row.primary_gid_number)
+              ? { uidNumber: row.uid_number, primaryGidNumber: row.primary_gid_number }
+              : null,
+        }));
+      return { items, nextCursor: source.nextCursor, availability: state };
+    },
     async reconcile(
       actor: RequestActor,
       input: { kind: "users" | "groups"; provider: UserProvider; name: string; identityId?: string; signal?: AbortSignal },
     ): Promise<AccountIdentityReconciliation> {
       const { state } = await requireAdmin(actor);
-      validateLookup(input);
-      if (input.provider !== "local" && input.provider !== "ipa") throw new AccountIdentityError("invalid_identity_lookup", 400);
-      if (input.identityId !== undefined) cursor(input.identityId);
-      if (input.signal?.aborted) return { state: "unknown", reason: "provider_unavailable" };
-      if (input.provider === "ipa") {
-        if (!state.freeipaEnabled) return { state: "unknown", reason: "provider_disabled" };
-        return upstreamIdentity(input);
-      }
-      const result = await readLocalIdentity(input);
-      return input.signal?.aborted ? { state: "unknown", reason: "provider_unavailable" } : result;
+      return reconcileIdentity(input, state);
+    },
+    /** Trusted provisioning services use the same live identity check as administrator provisioning. */
+    async provisioningIdentity(input: { kind: "users"; provider: UserProvider; name: string; identityId: string; signal?: AbortSignal }) {
+      return reconcileIdentity(input, await availability());
     },
     /** Trusted application jobs only; this read does not authorize an HTTP caller or a filesystem mutation. */
     async localLifecycle(input: { kind: "users" | "groups"; identityId: string; name: string }) {

package/src/services/accounts/users.ts

@@ -4,7 +4,7 @@ import { freeipa } from "../../server/services";
 import { createAuthLoginUrl } from "../../shared/redirect";
 import { isAccountCategoryAllowed } from "../account-category-policy";
 import type { AuditActor } from "../audit";
-import { getFreeIpaConfig } from "../freeipa-config";
+import { getFreeIpaAdminGroups, getFreeIpaConfig } from "../freeipa-config";
 import { getServiceIpaSession } from "../ipa/service-account";
 import { toPgTextArray, toPgUuidArray } from "../postgres";
 import { providers } from "../providers";
@@ -168,11 +168,12 @@ const buildUser = (row: DbRow, groupsAdmin: string[]): User => {
   };
 };
 
-export const get = async (params: { id: string } | { uid: string }): Promise<User | null> => {
-  const whereClause = "id" in params ? sql`u.id = ${params.id}` : sql`u.uid = ${params.uid}`;
-  const userIdExpr = "id" in params ? sql`${params.id}` : sql`u.id`;
-  const { groupsAdmin } = await getFreeIpaConfig();
-  const rows = await sql<DbRow[]>`
+export const get = async (params: { id: string } | { uid: string }, options: { db?: SQL } = {}): Promise<User | null> => {
+  const db = options.db ?? sql;
+  const whereClause = "id" in params ? db`u.id = ${params.id}` : db`u.uid = ${params.uid}`;
+  const userIdExpr = "id" in params ? db`${params.id}` : db`u.id`;
+  const groupsAdmin = options.db ? await getFreeIpaAdminGroups(db) : (await getFreeIpaConfig()).groupsAdmin;
+  const rows = await db<DbRow[]>`
     SELECT u.*,
       ${userIpaDataColumns()},
       CASE

package/src/services/app-access.ts

@@ -1,9 +1,10 @@
 import { type SQL, sql } from "bun";
 import type { Context } from "hono";
+import { RESOURCE_ACCESS_TIMEOUT_MS, resourceAppAccess } from "../_internal/app-access-resources";
 import type { AppMeta } from "../contracts/app";
 import { AppAccessRuleSchema, type FixedAppAccessRule } from "../contracts/app-access";
 import { userFromActor } from "../server/actor";
-import type { AuthContext, RequestAuthority } from "../server/middleware/auth";
+import { type AuthContext, auth, type RequestAuthority } from "../server/middleware/auth";
 import { buildAccessPrincipalCondition } from "../server/services/access";
 import { logger } from "./logging";
 import { toPgTextArray } from "./postgres";
@@ -17,7 +18,7 @@ export const appAccessAuthority = <E extends AuthContext>(c: Context<E>): Reques
   const accessSubject = c.get("accessSubject");
   const credentialKind = c.get("credentialKind");
   if (!actor || !accessSubject || !credentialKind) return null;
-  return { actor, accessSubject, credentialKind, scopes: c.get("credentialScopes") ?? [] };
+  return auth.getAuthority(c);
 };
 
 const credentialAllows = (authority: RequestAuthority, appId: string): boolean => {
@@ -65,6 +66,7 @@ export const evaluateAppAccess = (authority: RequestAuthority | null, app: Acces
   const parsed = AppAccessRuleSchema.safeParse(app.access);
   if (!parsed.success) return false;
   const rule = parsed.data;
+  if (rule.kind === "resources") return false; // Asynchronous adapter decision only.
   if (rule.kind !== "grants") return fixedAllows(authority, rule);
   if (!state?.configured) return !!rule.until && fixedAllows(authority, rule.until);
   return state.permission === "read" || state.permission === "admin";
@@ -74,21 +76,34 @@ let lastFailureLog = -Infinity;
 const reportFailure = () => {
   if (Date.now() - lastFailureLog < 60_000) return;
   lastFailureLog = Date.now();
-  logger("app-access").error("Application access could not be resolved; configurable applications are unavailable");
+  logger("app-access").error("Application access could not be resolved; affected applications are unavailable");
 };
 
 /**
- * One authoritative SQL read for all configurable apps. No grant cache: revocation applies on the next request.
+ * One authoritative SQL read for all configurable lists; resource rules query the owning adapters.
+ * No cross-request grant cache: revocation applies on the next request.
  * Pass the reserved transaction as `db` when checking access inside a guarded operation.
+ * A supplied `signal` replaces the default resource budget; the caller must bound it.
  */
 export const usableAppIds = async (
   authority: RequestAuthority | null,
   apps: readonly AccessApp[],
-  options: { db?: SQL } = {},
+  options: { db?: SQL; signal?: AbortSignal } = {},
 ): Promise<Set<string>> => {
   const db = options.db ?? sql;
   const allowed = new Set(apps.filter((app) => app.access?.kind !== "grants" && evaluateAppAccess(authority, app)).map((app) => app.id));
   if (!authority) return allowed;
+  let resourceSignal = options.signal;
+  // Sequential: one existence probe in flight per decision, no resource enumeration.
+  for (const app of apps) {
+    if (app.access?.kind !== "resources" || !credentialAllows(authority, app.id)) continue;
+    resourceSignal ??= AbortSignal.timeout(RESOURCE_ACCESS_TIMEOUT_MS);
+    try {
+      if (await resourceAppAccess(authority, app, { ...options, signal: resourceSignal })) allowed.add(app.id);
+    } catch {
+      if (!options.signal?.aborted) reportFailure();
+    }
+  }
   const configurable = apps.filter((app) => app.access?.kind === "grants" && credentialAllows(authority, app.id));
   if (configurable.length === 0) return allowed;
   try {
@@ -119,5 +134,8 @@ export const usableAppIds = async (
   return allowed;
 };
 
-export const canUseApp = async (authority: RequestAuthority | null, app: AccessApp, options: { db?: SQL } = {}): Promise<boolean> =>
-  (await usableAppIds(authority, [app], options)).has(app.id);
+export const canUseApp = async (
+  authority: RequestAuthority | null,
+  app: AccessApp,
+  options: { db?: SQL; signal?: AbortSignal } = {},
+): Promise<boolean> => (await usableAppIds(authority, [app], options)).has(app.id);