@k2b/cloud 0.43.0 → 0.45.0

package/src/services/app-events.ts

@@ -0,0 +1,92 @@
+import type { TopicDeadLetter, TopicInventoryEntry } from "@k2b/sync";
+import { type SQL, sql } from "bun";
+import { lazySync } from "../_internal/process-sync";
+import { getCapability, listCapabilities } from "../_internal/registry";
+import type { AppEventEnvelope } from "../contracts/app-events";
+import type { CapabilityRegistryEntry } from "../contracts/registry";
+import { appEventTopic } from "../events/app-event-delivery";
+import { createEventAcceptance } from "./app-events/accept";
+import { createEventAdministration } from "./app-events/admin";
+import { createDeclarationSync } from "./app-events/declarations";
+import { createEventDelivery } from "./app-events/deliver";
+import type { signAppEventInvocation } from "./identity/invocation-token";
+import { logger } from "./logging";
+
+export { APP_EVENT_DELIVERY_ATTEMPTS, APP_EVENT_DELIVERY_BACKOFF_MS } from "./app-events/deliver";
+
+const log = logger("app-events:broker");
+const topicInventory = lazySync((sync) => () => sync.listTopics({ idPrefix: "cloud:app-events" }));
+type BrokerDependencies = {
+  db?: SQL;
+  registry?: () => Promise<CapabilityRegistryEntry[]>;
+  getApp?: typeof getCapability;
+  fetch?: typeof fetch;
+  sign?: typeof signAppEventInvocation;
+  deadLetters?: (after?: string) => Promise<TopicDeadLetter<AppEventEnvelope>[]>;
+  streams?: () => AsyncIterable<Pick<TopicInventoryEntry, "id" | "firstSequence">>;
+};
+const message = (error: unknown): string => (error instanceof Error ? error.message : String(error)).slice(0, 1000);
+
+export const createAppEventBroker = (dependencies: BrokerDependencies = {}) => {
+  const db = dependencies.db ?? sql;
+  const registry = dependencies.registry ?? listCapabilities;
+  const declarations = createDeclarationSync(db, registry);
+  const admin = createEventAdministration(db, {
+    registry,
+    deadLetters: dependencies.deadLetters ?? ((after) => appEventTopic().deadLetters.list({ limit: 100, after })),
+    streams: dependencies.streams ?? (() => topicInventory()()),
+  });
+  const acceptance = createEventAcceptance(db, declarations.reconcileSubscriptions);
+  const delivery = createEventDelivery(db, dependencies.getApp ?? getCapability, declarations.reconcileSubscriptions, dependencies);
+  return { ...declarations, ...acceptance, ...delivery, ...admin };
+};
+
+export const appEventBroker = createAppEventBroker();
+export const startAppEventBroker = async (): Promise<() => Promise<void>> => {
+  const worker = await appEventTopic().process(
+    {
+      consumer: "core-app-events-v1",
+      start: "earliest",
+      concurrency: 1,
+      recoverDeadLetters: true,
+      delivery: { maxAttempts: 8, backoffMs: [1000, 5000, 30000, 120000, 600000, 1800000, 3600000], maxInFlight: 1 },
+    },
+    async (event) => {
+      try {
+        await appEventBroker.accept(event.data, event.sequence, event.attempt);
+      } catch (error) {
+        if (event.attempt >= 8) {
+          await appEventBroker.markSeen(event.sequence);
+        }
+        throw error;
+      }
+    },
+  );
+  let stopping = false;
+  let active: Promise<void> | null = null;
+  let tickCount = 0;
+  const run = () => {
+    if (stopping || active) return;
+    active = (async () => {
+      await appEventBroker.work();
+      if (++tickCount % 60 === 0) {
+        await appEventBroker.checkGap();
+        await appEventBroker.retain();
+      }
+    })()
+      .catch((error) => log.error("App event broker pass failed", { error: message(error) }))
+      .finally(() => {
+        active = null;
+      });
+  };
+  const timer = setInterval(run, 1000);
+  timer.unref();
+  run();
+  return async () => {
+    stopping = true;
+    clearInterval(timer);
+    worker.stop();
+    await worker.drain();
+    await active;
+  };
+};

package/src/services/config-conflict.ts

@@ -0,0 +1,11 @@
+export class ConfigConflict extends Error {
+  readonly code = "conflict";
+  constructor(
+    readonly current: unknown,
+    readonly changedBy: { id: string; name: string } | null,
+    readonly changedAt: string,
+    readonly key?: string,
+  ) {
+    super("This configuration changed. Read the current version before saving.");
+  }
+}

package/src/services/core-user-events.ts

@@ -0,0 +1 @@
+export { coreUserEvents, coreUserEventTypes } from "../events/core-user-created";

package/src/services/freeipa-config.ts

@@ -1,6 +1,8 @@
 import { X509Certificate } from "node:crypto";
+import type { SQL } from "bun";
 import { setFreeIpaTlsResolver } from "../server/services/freeipa/tls";
 import { coreSettings } from "./settings/api";
+import { readKeyState, SettingUnreadableError } from "./settings/store";
 
 const MAX_CA_CERT_BYTES = 256 * 1024;
 const PEM_CERTIFICATE_PATTERN = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
@@ -82,6 +84,13 @@ const normalizeStringList = (value: unknown, fallback: string[] = []): string[]
   return normalized.length > 0 ? normalized : fallback;
 };
 
+/** Read the role mapping on the caller's connection during authorization. */
+export const getFreeIpaAdminGroups = async (db: SQL): Promise<string[]> => {
+  const state = await readKeyState("freeipa.groups.admin", db);
+  if (state.stored === "unreadable") throw new SettingUnreadableError("freeipa.groups.admin");
+  return normalizeStringList(state.value, ["admins"]);
+};
+
 /**
  * Read the full FreeIPA config snapshot from settings (Redis cache-aside +
  * Postgres fallback). Always returns within Redis-TTL fresh data — no hidden

package/src/services/geo/ledger.ts

@@ -1,4 +1,5 @@
 import { type SQL, sql } from "bun";
+import type { AppPwaActor } from "../../app-pwa/contracts";
 import type { AccessSubject, CapabilityExecutionContext } from "../../contracts";
 import { audit } from "../audit";
 import { GeoError } from "./errors";
@@ -102,7 +103,7 @@ export const createGeoLedger = (db: SQL = sql) => ({
   async recordTransition(
     event: "provider_key_rejected" | "monthly_budget_exhausted" | "route_cost_overrun",
     timezone: string,
-    context: Pick<CapabilityExecutionContext, "actor"> & Partial<Pick<CapabilityExecutionContext, "requestId">>,
+    context: { actor: CapabilityExecutionContext["actor"] | AppPwaActor; requestId?: string },
     now: Date,
     metadata: Record<string, number> = {},
   ) {
@@ -114,21 +115,38 @@ export const createGeoLedger = (db: SQL = sql) => ({
           : await tx`INSERT INTO geo.audit_transitions(event,period) VALUES(${event},${period}) ON CONFLICT DO NOTHING RETURNING event`;
       if (!inserted.length) return;
       const actor =
-        context.actor.kind === "user"
-          ? {
-              userId: context.actor.user.id,
-              uid: context.actor.user.uid,
-              provider: context.actor.user.provider,
-              roles: context.actor.user.roles,
-            }
-          : { uid: `service-account:${context.actor.serviceAccount.id}`, provider: "service_account", roles: context.actor.scopes };
+        context.actor.kind === "device" || context.actor.kind === "visit"
+          ? null
+          : context.actor.kind === "user"
+            ? {
+                userId: context.actor.user.id,
+                uid: context.actor.user.uid,
+                provider: context.actor.user.provider,
+                roles: context.actor.user.roles,
+              }
+            : { uid: `service-account:${context.actor.serviceAccount.id}`, provider: "service_account", roles: context.actor.scopes };
       await audit.record(
         {
           action: `core.geo.${event}`,
           outcome: event === "monthly_budget_exhausted" ? "denied" : "failed",
           actor,
           requestId: context.requestId,
-          metadata: { period, ...metadata },
+          metadata: {
+            period,
+            ...metadata,
+            ...(context.actor.kind === "device" || context.actor.kind === "visit"
+              ? {
+                  appId: context.actor.appId,
+                  subject: { type: "user", userId: context.actor.ownerUserId },
+                  via: {
+                    kind: context.actor.kind,
+                    appId: context.actor.appId,
+                    deviceId: context.actor.deviceId,
+                    ...(context.actor.kind === "visit" ? { visitId: context.actor.visitId } : {}),
+                  },
+                }
+              : {}),
+          },
         },
         tx,
       );

package/src/services/geo/service.ts

@@ -1,4 +1,5 @@
 import type { z } from "zod";
+import type { AppPwaActor } from "../../app-pwa/contracts";
 import type { AccessSubject, CapabilityExecutionContext, RequestActor } from "../../contracts";
 import {
   GeoAutocompleteDataSchema,
@@ -26,17 +27,27 @@ import { createGeoRouteService } from "./route-service";
 import { type GeoConfig, geoPlan, readGeoConfig } from "./settings";
 
 export type GeoContext = Partial<Pick<CapabilityExecutionContext, "actor" | "accessSubject" | "locale" | "signal" | "requestId">>;
+/** Internal, narrow App-PWA autocomplete adapter; never a RequestActor or capability caller. */
+export type AppPwaGeoContext = { actor: AppPwaActor; locale?: string; signal?: AbortSignal; requestId?: string };
+type GeoCallContext = GeoContext | AppPwaGeoContext;
 export const geoIdentity = (context: GeoContext): { actor: RequestActor; accessSubject: AccessSubject } => {
   const { actor, accessSubject } = context;
   if (
     !actor ||
     !accessSubject ||
-    !(actor.kind === "user" ? actor.user?.id : actor.serviceAccount?.id) ||
+    !(actor.kind === "user" ? actor.user?.id : actor.kind === "service_account" ? actor.serviceAccount?.id : undefined) ||
     !(accessSubject.type === "user" ? accessSubject.userId : accessSubject.serviceAccountId)
   )
     throw new GeoError("GEO_FORBIDDEN");
   return { actor, accessSubject };
 };
+const geoCallIdentity = (context: GeoCallContext): { actor: RequestActor | AppPwaActor; accessSubject: AccessSubject } => {
+  if (context.actor?.kind === "device" || context.actor?.kind === "visit") {
+    if (!context.actor.ownerUserId) throw new GeoError("GEO_FORBIDDEN");
+    return { actor: context.actor, accessSubject: { type: "user", userId: context.actor.ownerUserId } };
+  }
+  return geoIdentity({ actor: context.actor, accessSubject: "accessSubject" in context ? context.accessSubject : undefined });
+};
 const bound = (name: string, value: number, min: number, max: number, integer = false) => {
   if (!Number.isFinite(value) || value > max || value < min || (integer && !Number.isInteger(value)))
     limitExceeded(name, value < min ? min : max, value);
@@ -84,10 +95,10 @@ export const createGeoService = (
   const recordTransition = async (
     event: "monthly_budget_exhausted" | "provider_key_rejected" | "route_cost_overrun",
     timezone: string,
-    context: GeoContext,
+    context: GeoCallContext,
     metadata?: Record<string, number>,
   ) => {
-    const identity = geoIdentity(context);
+    const identity = geoCallIdentity(context);
     try {
       await ledger.recordTransition(event, timezone, { ...context, ...identity }, now(), metadata);
       return true;
@@ -107,7 +118,7 @@ export const createGeoService = (
   const paid = async <T>(
     fn: GeoFunction,
     input: unknown,
-    context: GeoContext,
+    context: GeoCallContext,
     settings: GeoConfig,
     schema: z.ZodType<T>,
     request: (signal: AbortSignal) => Promise<T>,
@@ -115,7 +126,7 @@ export const createGeoService = (
     cacheInput = input,
     empty: (value: T) => boolean = () => false,
   ): Promise<T> => {
-    const identity = geoIdentity(context);
+    const identity = geoCallIdentity(context);
     const locale = context.locale ?? "en";
     const key = geoCacheKey(fn, cacheInput, locale);
     const hit = await cache.get(key, schema);
@@ -176,29 +187,37 @@ export const createGeoService = (
       await release();
     }
   };
+  const autocomplete = async (input: GeoAutocompleteInput, context: GeoCallContext) => {
+    geoCallIdentity(context);
+    const settings = await config();
+    if (!settings.apiKey.trim()) throw new GeoError("GEO_NOT_CONFIGURED");
+    const value = parse(GeoAutocompleteInputSchema, input);
+    bound("text", value.text.length, 3, 300);
+    bound("text", value.text.trim().length, 3, 300);
+    bound("limit", value.limit ?? 5, 1, 5, true);
+    country(value.countryCode);
+    area(value.area);
+    return paid(
+      "autocomplete",
+      value,
+      context,
+      settings,
+      GeoAutocompleteDataSchema,
+      (signal) => adapter.autocomplete(value, settings.apiKey, context.locale ?? "en", signal),
+      value.limit,
+      { ...value, limit: value.limit ?? 5 },
+      (result) => !result.suggestions.length,
+    );
+  };
   const routes = createGeoRouteService({ configured, adapter, cache, bucket, ledger, now, recordTransition });
   return {
     ...routes,
-    async autocomplete(input: GeoAutocompleteInput, context: GeoContext) {
-      const settings = await configured(context);
-      const value = parse(GeoAutocompleteInputSchema, input);
-      bound("text", value.text.length, 3, 300);
-      bound("text", value.text.trim().length, 3, 300);
-      bound("limit", value.limit ?? 5, 1, 5, true);
-      country(value.countryCode);
-      area(value.area);
-      return paid(
-        "autocomplete",
-        value,
-        context,
-        settings,
-        GeoAutocompleteDataSchema,
-        (signal) => adapter.autocomplete(value, settings.apiKey, context.locale ?? "en", signal),
-        value.limit,
-        { ...value, limit: value.limit ?? 5 },
-        (result) => !result.suggestions.length,
-      );
+    autocomplete: async (input: GeoAutocompleteInput, context: GeoContext) => {
+      geoIdentity(context);
+      return autocomplete(input, context);
     },
+    // Only the App-PWA service calls this after locking the pairing and optional visit authority.
+    autocompleteForAppPwa: (input: GeoAutocompleteInput, context: AppPwaGeoContext) => autocomplete(input, context),
     async geocode(input: GeoGeocodeInput, context: GeoContext) {
       const settings = await configured(context);
       const value = parse(GeoGeocodeInputSchema, input);

package/src/services/identity/core-origin.ts

@@ -0,0 +1,12 @@
+import { env } from "../../config/env";
+import { publicCloudOrigin } from "../../shared/app-url";
+import { get } from "../settings";
+
+export const coreOrigin = async (internal = false): Promise<string> => {
+  const configured = env.CLOUD_CORE_INTERNAL_ORIGIN;
+  if (internal && !configured) throw new Error("CLOUD_CORE_INTERNAL_ORIGIN is required for internal Core requests");
+  const origin = configured || publicCloudOrigin(await get<string>("app.url"));
+  const url = new URL(origin);
+  if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error("CLOUD_CORE_INTERNAL_ORIGIN must use http or https");
+  return url.origin;
+};

package/src/services/identity/invocation-actor.ts

@@ -3,6 +3,7 @@ import type { RequestActor } from "../../server/middleware/auth";
 import type { AccessSubject } from "../../server/services/access";
 import { isAccountCategoryAllowed } from "../account-category-policy";
 import { isAccountExpired } from "../account-model";
+import { isServiceAccountOAuthAuthorityCurrent } from "../oauth-tokens";
 import type { ServiceAccount } from "../service-accounts";
 import { buildProjectedUser, loadCurrentUser, userProjectionJoin, userProjectionSql, withoutAdminRole } from "../session/user";
 import type { CloudInvocationClaims } from "./invocation-token";
@@ -38,6 +39,8 @@ export type InvocationPrincipalClaims = Pick<
   | "session_kind"
   | "scopes"
   | "credential_id"
+  | "oauth_client_id"
+  | "credential_expires_at"
   | "exp"
   | "act"
   | "credential_kind"
@@ -155,15 +158,30 @@ export const resolveInvocationAuthority = async (
   )
     return null;
 
-  const actor: RequestActor = {
+  const actor: Extract<RequestActor, { kind: "service_account" }> = {
     kind: "service_account",
     serviceAccount,
     delegatedUser,
     scopes: [...claims.scopes],
     credentialId: claims.credential_id ?? null,
-    credentialExpiresAt: new Date(claims.exp * 1_000).toISOString(),
+    oauthClientId: claims.oauth_client_id ?? null,
+    credentialExpiresAt: new Date(
+      Math.min(claims.exp * 1_000, claims.credential_expires_at ? Date.parse(claims.credential_expires_at) : Infinity),
+    ).toISOString(),
     delegation,
   };
+  if (
+    claims.oauth_client_id &&
+    !(await isServiceAccountOAuthAuthorityCurrent(
+      {
+        serviceAccountId: serviceAccount.id,
+        clientId: claims.oauth_client_id,
+        expiresAt: actor.credentialExpiresAt,
+      },
+      { query, groupsAdmin },
+    ))
+  )
+    return null;
   const accessSubject: AccessSubject = delegatedUser
     ? { type: "user", userId: delegatedUser.id, delegatedByServiceAccountId: serviceAccount.id }
     : { type: "service_account", serviceAccountId: serviceAccount.id };

package/src/services/identity/invocation-authority.ts

@@ -35,6 +35,8 @@ export const invocationAuthorityFromRequest = (authority: RequestAuthority): Inv
       delegated_user_id: actor.delegatedUser.id,
       credential_kind: authority.credentialKind,
       ...(actor.credentialId ? { credential_id: actor.credentialId } : {}),
+      ...(actor.oauthClientId ? { oauth_client_id: actor.oauthClientId } : {}),
+      ...(actor.credentialExpiresAt ? { credential_expires_at: actor.credentialExpiresAt } : {}),
       scopes: [...new Set(authority.scopes)].sort(),
     };
   }
@@ -49,6 +51,8 @@ export const invocationAuthorityFromRequest = (authority: RequestAuthority): Inv
     access_subject_id: actor.serviceAccount.id,
     credential_kind: authority.credentialKind,
     ...(actor.credentialId ? { credential_id: actor.credentialId } : {}),
+    ...(actor.oauthClientId ? { oauth_client_id: actor.oauthClientId } : {}),
+    ...(actor.credentialExpiresAt ? { credential_expires_at: actor.credentialExpiresAt } : {}),
     scopes: [...new Set(authority.scopes)].sort(),
   };
 };