@livedesk/hub 0.1.58 → 0.1.59

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/hub",
-  "version": "0.1.58",
+  "version": "0.1.59",
   "description": "VuvoDesk local Hub API and browser frame bridge",
   "type": "module",
   "main": "src/server.js",

package/src/auth/workspace-access.js

@@ -0,0 +1,176 @@
+const WORKSPACE_ROLES = new Set(['owner', 'operator']);
+const WORKSPACE_KINDS = new Set(['personal', 'team']);
+const WORKSPACE_PLANS = new Set(['free', 'ltd', 'pro', 'team']);
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+function boundedText(value, maxLength = 160) {
+  return String(value ?? '').replace(/[\r\n\t]/g, ' ').trim().slice(0, maxLength);
+}
+
+export class WorkspaceAccessError extends Error {
+  constructor(code, { status = 403, cause = null } = {}) {
+    super(String(code || 'workspace-access-denied'), cause ? { cause } : undefined);
+    this.name = 'WorkspaceAccessError';
+    this.code = String(code || 'workspace-access-denied');
+    this.status = Number(status) || 403;
+  }
+}
+
+export function normalizeRequestedWorkspaceId(value) {
+  const workspaceId = boundedText(value);
+  if (!workspaceId) return '';
+  if (!UUID_PATTERN.test(workspaceId)) {
+    throw new WorkspaceAccessError('workspace-id-invalid', { status: 400 });
+  }
+  return workspaceId;
+}
+
+export function normalizeWorkspaceAccess(value, { userId = '', verifiedAt = Date.now() } = {}) {
+  const source = Array.isArray(value) ? value[0] : value;
+  const workspaceId = boundedText(source?.workspace_id ?? source?.workspaceId);
+  const role = boundedText(source?.role, 32).toLowerCase();
+  const kind = boundedText(source?.workspace_kind ?? source?.workspaceKind ?? source?.kind, 32).toLowerCase();
+  const planValue = boundedText(source?.plan, 32).toLowerCase();
+  const reason = boundedText(source?.reason, 160);
+  const ok = source?.ok !== false
+    && Boolean(workspaceId)
+    && WORKSPACE_ROLES.has(role)
+    && WORKSPACE_KINDS.has(kind);
+  if (!ok) {
+    throw new WorkspaceAccessError(reason || 'workspace-access-denied');
+  }
+  const normalizedUserId = boundedText(userId);
+  if (kind === 'personal' && normalizedUserId && workspaceId !== normalizedUserId) {
+    throw new WorkspaceAccessError('personal-workspace-owner-mismatch');
+  }
+  const membershipRevision = Number(source?.membership_revision ?? source?.membershipRevision ?? 0);
+  const deviceLimit = Number(source?.device_limit ?? source?.deviceLimit);
+  const memberLimit = Number(source?.member_limit ?? source?.memberLimit);
+  return Object.freeze({
+    ok: true,
+    userId: normalizedUserId,
+    workspaceId,
+    workspaceName: boundedText(source?.workspace_name ?? source?.workspaceName ?? source?.name, 120),
+    workspaceKind: kind,
+    role,
+    membershipRevision: Number.isSafeInteger(membershipRevision) && membershipRevision >= 0
+      ? membershipRevision
+      : 0,
+    plan: WORKSPACE_PLANS.has(planValue) ? planValue : 'free',
+    entitlementStatus: boundedText(source?.entitlement_status ?? source?.entitlementStatus ?? source?.status, 32).toLowerCase() || 'inactive',
+    deviceLimit: Number.isSafeInteger(deviceLimit) && deviceLimit >= 0 ? deviceLimit : null,
+    memberLimit: Number.isSafeInteger(memberLimit) && memberLimit >= 0 ? memberLimit : 1,
+    commercialUse: source?.commercial_use === true || source?.commercialUse === true,
+    verifiedAt: Math.max(0, Number(verifiedAt) || Date.now())
+  });
+}
+
+export async function resolveWorkspaceAccess({
+  accessToken,
+  requestedWorkspaceId = '',
+  userId = '',
+  supabaseUrl,
+  supabasePublishableKey,
+  fetchResponse,
+  timeoutMs
+}) {
+  const token = boundedText(accessToken, 8192);
+  if (!token) throw new WorkspaceAccessError('supabase-access-token-required', { status: 401 });
+  const workspaceId = normalizeRequestedWorkspaceId(requestedWorkspaceId);
+  if (typeof fetchResponse !== 'function') {
+    throw new WorkspaceAccessError('workspace-access-verifier-unavailable', { status: 500 });
+  }
+  let response;
+  try {
+    response = await fetchResponse(
+      `${String(supabaseUrl || '').replace(/\/+$/, '')}/rest/v1/rpc/get_livedesk_workspace_access`,
+      {
+        method: 'POST',
+        headers: {
+          apikey: String(supabasePublishableKey || ''),
+          Authorization: `Bearer ${token}`,
+          'Content-Type': 'application/json',
+          Accept: 'application/json'
+        },
+        body: JSON.stringify({ p_workspace_id: workspaceId || null })
+      },
+      timeoutMs
+    );
+  } catch (cause) {
+    throw new WorkspaceAccessError('workspace-access-provider-unavailable', { status: 502, cause });
+  }
+  if (response.status === 401 || response.status === 403) {
+    throw new WorkspaceAccessError('workspace-access-not-authenticated', { status: 401 });
+  }
+  if (!response.ok) {
+    throw new WorkspaceAccessError(`workspace-access-query-failed:${response.status}`, { status: 502 });
+  }
+  const payload = await response.json().catch(() => null);
+  return normalizeWorkspaceAccess(payload, { userId });
+}
+
+export function workspaceRoleCanControl(role) {
+  return WORKSPACE_ROLES.has(boundedText(role, 32).toLowerCase());
+}
+
+export function operatorRequestAllowed(method, pathname) {
+  const normalizedMethod = boundedText(method, 16).toUpperCase() || 'GET';
+  const path = boundedText(pathname, 512).split('?')[0];
+  if (normalizedMethod === 'GET') {
+    return path === '/api/health'
+      || path === '/api/runtime/status'
+      || path === '/api/auth/status'
+      || path === '/api/remote/status'
+      || path === '/api/hub/status'
+      || path === '/api/hub/devices'
+      || path === '/api/remote/devices'
+      || path === '/api/remote/license'
+      || path === '/api/remote/wall-preferences'
+      || /^\/api\/remote\/(?:frames|atlas|input|audio)\/ws$/.test(path)
+      || /^\/api\/remote\/devices\/[^/]+(?:\/(?:thumbnail|live\/frame))?$/.test(path);
+  }
+  if (normalizedMethod === 'DELETE' && path === '/api/auth/session') return true;
+  if (normalizedMethod === 'PATCH' && path === '/api/remote/wall-preferences') return true;
+  if (normalizedMethod !== 'POST') return false;
+  return path === '/api/auth/session'
+    || path === '/api/remote/frames'
+    || /^\/api\/remote\/devices\/[^/]+\/(?:input|clipboard)$/.test(path)
+    || /^\/api\/remote\/devices\/[^/]+\/thumbnail\/request$/.test(path)
+    || /^\/api\/remote\/devices\/[^/]+\/live\/(?:start|stop|pause|resume)$/.test(path)
+    || /^\/api\/remote\/devices\/[^/]+\/audio\/(?:start|stop)$/.test(path);
+}
+
+export function workspaceRoleCanRequest(role, method, pathname) {
+  const normalizedRole = boundedText(role, 32).toLowerCase();
+  return normalizedRole === 'owner'
+    || (normalizedRole === 'operator' && operatorRequestAllowed(method, pathname));
+}
+
+export function workspaceEntitlementCanRequest(access, method, pathname) {
+  const workspaceKind = boundedText(
+    access?.workspaceKind ?? access?.workspace_kind ?? access?.kind,
+    32
+  ).toLowerCase();
+  const entitlementStatus = boundedText(
+    access?.entitlementStatus ?? access?.entitlement_status ?? access?.status,
+    32
+  ).toLowerCase();
+  const plan = boundedText(access?.plan, 32).toLowerCase();
+  if (workspaceKind !== 'team' || (plan === 'team' && entitlementStatus === 'active')) return true;
+  const normalizedMethod = boundedText(method, 16).toUpperCase() || 'GET';
+  const path = boundedText(pathname, 512).split('?')[0];
+  return (normalizedMethod === 'GET' && (
+    path === '/api/health'
+    || path === '/api/runtime/status'
+    || path === '/api/auth/status'
+    || path === '/api/remote/license'
+  ))
+    || (normalizedMethod === 'POST' && path === '/api/remote/license/sync')
+    || (normalizedMethod === 'DELETE' && path === '/api/auth/session');
+}
+
+export const workspaceAccessContract = Object.freeze({
+  roles: Object.freeze([...WORKSPACE_ROLES]),
+  kinds: Object.freeze([...WORKSPACE_KINDS]),
+  plans: Object.freeze([...WORKSPACE_PLANS])
+});