@mccaskie-labs/workbench-config 0.1.22 → 0.1.24

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @mccaskie-labs/workbench-config
 
+## 0.1.24
+
+### Patch Changes
+
+- The database manifest gains sign-in: `createSessions`, `safeReturnPath` and `sameOrigin` (workbench-supabase 0.3.0), the optional `SESSION_SECRET`, two rules (sign-in through the app's own endpoints; session writes same-origin) and the probes `database.sign-in` and `database.session-cookie`.
+
+## 0.1.23
+
+### Patch Changes
+
+- Probes for the sign-in kit. `email`: `email.account.kit-clean`, `email.account.sign-in-code`, `email.hook.unsigned-refused`, `email.hook.signed-refused-action` and `email.brand.logo-public`. `database`: `database.plain-error`.
+
 ## 0.1.22
 
 ### Patch Changes

package/capabilities/database.json

@@ -12,7 +12,10 @@
       "createServerClient",
       "createUserClient",
       "createServiceClient",
-      "WorkbenchSupabaseError"
+      "WorkbenchSupabaseError",
+      "createSessions",
+      "safeReturnPath",
+      "sameOrigin"
     ],
     "tools": [
       "sb_project_create",
@@ -56,6 +59,17 @@
         "production"
       ],
       "description": "The sb_secret_ key, only for code that must bypass RLS (createServiceClient); written by cf_worker_secret_put source=supabase_secret, always two-step"
+    },
+    {
+      "name": "SESSION_SECRET",
+      "required": false,
+      "secret": true,
+      "environments": [
+        "development",
+        "staging",
+        "production"
+      ],
+      "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
     }
   ],
   "actions": [
@@ -142,6 +156,20 @@
       "text": "Keep Supabase's sign-in settings at the Workbench baseline (workbench-config VENDOR_SETTINGS), or record a project's change in vendor-settings.json with a reason. Control applies it with vendor_settings_apply and checks it every day.",
       "enforced_by": "control",
       "probe": "database.vendor-settings"
+    },
+    {
+      "id": "database.sign-in-server-side",
+      "kind": "must",
+      "text": "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.",
+      "enforced_by": "review",
+      "probe": "database.sign-in"
+    },
+    {
+      "id": "database.session-writes-same-origin",
+      "kind": "must",
+      "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
+      "enforced_by": "review",
+      "probe": "database.session-cookie"
     }
   ],
   "examples": [
@@ -202,6 +230,28 @@
       "expect": "pass",
       "cost_hint_usd": 0,
       "note": "vendor_settings_apply check_only reports that both databases match the baseline, the Send Email hook included"
+    },
+    {
+      "id": "database.plain-error",
+      "half": "runtime",
+      "expect": "pass",
+      "smoke": true,
+      "cost_hint_usd": 0,
+      "note": "plainError and plainAuthError (workbench-supabase) turn a raw database error and an email_exists auth error into plain words that name the app and never say whether an account exists"
+    },
+    {
+      "id": "database.sign-in",
+      "half": "runtime",
+      "expect": "pass",
+      "cost_hint_usd": 0,
+      "note": "Ask for a code, read it from the captured sign-in email, type it, and get a session that reads the user's own rows; a wrong code gets the plain line"
+    },
+    {
+      "id": "database.session-cookie",
+      "half": "runtime",
+      "expect": "pass",
+      "cost_hint_usd": 0,
+      "note": "The session cookie is __Host-, Secure, HttpOnly, SameSite=Lax and sealed; a cross-site write is refused; sign-out clears it with every attribute"
     }
   ]
 }

package/capabilities/email.json

@@ -57,6 +57,11 @@
     { "id": "email.send.dev-key-recipient-refused", "half": "runtime", "expect": "refused_as_expected", "refusal": "recipient_not_allowed", "cost_hint_usd": 0 },
     { "id": "email.send.sender-not-allowed", "half": "runtime", "expect": "refused_as_expected", "refusal": "sender_not_allowed", "cost_hint_usd": 0 },
     { "id": "email.capture-refused-in-staging", "half": "runtime", "expect": "pass", "cost_hint_usd": 0, "note": "createMailer with transport capture and WORKBENCH_ENV=staging throws invalid_config" },
-    { "id": "email.send.new-sender", "half": "runtime", "expect": "pass", "cost_hint_usd": 0.00035, "note": "Runs after the Control drill's gw_sender_add step; skipped without it" }
+    { "id": "email.send.new-sender", "half": "runtime", "expect": "pass", "cost_hint_usd": 0.00035, "note": "Runs after the Control drill's gw_sender_add step; skipped without it" },
+    { "id": "email.account.kit-clean", "half": "runtime", "expect": "pass", "smoke": true, "cost_hint_usd": 0, "note": "emailKitProblems over the app's catalogue (ACCOUNT_EMAILS), strings and brand.json returns []; runs in the Worker and sends nothing" },
+    { "id": "email.account.sign-in-code", "half": "runtime", "expect": "pass", "cost_hint_usd": 0.00035, "note": "renderTemplate account_sign_in_code with the app's brand.json, sent to Robert through the Gateway; check the logo, colours and code, and that there is no link. Not in the daily smoke run" },
+    { "id": "email.hook.unsigned-refused", "half": "runtime", "expect": "refused_as_expected", "refusal": "unauthorised", "smoke": true, "cost_hint_usd": 0, "note": "POST /auth/send-email from outside with no signature answers 401, not a sign-in redirect: proves the Access path bypass and the handler. Needs no secret" },
+    { "id": "email.hook.signed-refused-action", "half": "runtime", "expect": "refused_as_expected", "refusal": "refused", "cost_hint_usd": 0, "note": "A request signed with SEND_EMAIL_HOOK_SECRET for email_action_type recovery answers 422 and sends nothing; skipped while the Worker has no hook secret" },
+    { "id": "email.brand.logo-public", "half": "runtime", "expect": "pass", "smoke": true, "cost_hint_usd": 0, "note": "GET brand.json's logo.url from outside with no sign-in answers 200 with an image content type" }
   ]
 }

package/dist/capabilities.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const MANIFEST_VERSION: "2216125e22d4";
+export declare const MANIFEST_VERSION: "ecc54c728515";
 export declare const capabilities: {
     readonly ai: {
         readonly $schema: "./schema.json";
@@ -422,7 +422,7 @@ export declare const capabilities: {
         readonly status: "built";
         readonly surfaces: {
             readonly tools: readonly ["sb_project_create", "sb_migration_apply", "sb_migration_rollback", "sb_query", "sb_project_delete", "cf_worker_secret_put", "vendor_settings_apply"];
-            readonly package: readonly ["supabaseConfig", "createBrowserClient", "createServerClient", "createUserClient", "createServiceClient", "WorkbenchSupabaseError"];
+            readonly package: readonly ["supabaseConfig", "createBrowserClient", "createServerClient", "createUserClient", "createServiceClient", "WorkbenchSupabaseError", "createSessions", "safeReturnPath", "sameOrigin"];
         };
         readonly config: readonly [{
             readonly name: "SUPABASE_URL";
@@ -442,6 +442,12 @@ export declare const capabilities: {
             readonly secret: true;
             readonly environments: readonly ["staging", "production"];
             readonly description: "The sb_secret_ key, only for code that must bypass RLS (createServiceClient); written by cf_worker_secret_put source=supabase_secret, always two-step";
+        }, {
+            readonly name: "SESSION_SECRET";
+            readonly required: false;
+            readonly secret: true;
+            readonly environments: readonly ["development", "staging", "production"];
+            readonly description: "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in";
         }];
         readonly actions: readonly [{
             readonly tool: "sb_project_create";
@@ -513,6 +519,18 @@ export declare const capabilities: {
             readonly text: "Keep Supabase's sign-in settings at the Workbench baseline (workbench-config VENDOR_SETTINGS), or record a project's change in vendor-settings.json with a reason. Control applies it with vendor_settings_apply and checks it every day.";
             readonly enforced_by: "control";
             readonly probe: "database.vendor-settings";
+        }, {
+            readonly id: "database.sign-in-server-side";
+            readonly kind: "must";
+            readonly text: "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.";
+            readonly enforced_by: "review";
+            readonly probe: "database.sign-in";
+        }, {
+            readonly id: "database.session-writes-same-origin";
+            readonly kind: "must";
+            readonly text: "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.";
+            readonly enforced_by: "review";
+            readonly probe: "database.session-cookie";
         }];
         readonly examples: readonly [{
             readonly id: "database.example.user-client";
@@ -563,6 +581,25 @@ export declare const capabilities: {
             readonly expect: "pass";
             readonly cost_hint_usd: 0;
             readonly note: "vendor_settings_apply check_only reports that both databases match the baseline, the Send Email hook included";
+        }, {
+            readonly id: "database.plain-error";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly smoke: true;
+            readonly cost_hint_usd: 0;
+            readonly note: "plainError and plainAuthError (workbench-supabase) turn a raw database error and an email_exists auth error into plain words that name the app and never say whether an account exists";
+        }, {
+            readonly id: "database.sign-in";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly cost_hint_usd: 0;
+            readonly note: "Ask for a code, read it from the captured sign-in email, type it, and get a session that reads the user's own rows; a wrong code gets the plain line";
+        }, {
+            readonly id: "database.session-cookie";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly cost_hint_usd: 0;
+            readonly note: "The session cookie is __Host-, Secure, HttpOnly, SameSite=Lax and sealed; a cross-site write is refused; sign-out clears it with every attribute";
         }];
     };
     readonly email: {
@@ -771,6 +808,41 @@ export declare const capabilities: {
             readonly expect: "pass";
             readonly cost_hint_usd: 0.00035;
             readonly note: "Runs after the Control drill's gw_sender_add step; skipped without it";
+        }, {
+            readonly id: "email.account.kit-clean";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly smoke: true;
+            readonly cost_hint_usd: 0;
+            readonly note: "emailKitProblems over the app's catalogue (ACCOUNT_EMAILS), strings and brand.json returns []; runs in the Worker and sends nothing";
+        }, {
+            readonly id: "email.account.sign-in-code";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly cost_hint_usd: 0.00035;
+            readonly note: "renderTemplate account_sign_in_code with the app's brand.json, sent to Robert through the Gateway; check the logo, colours and code, and that there is no link. Not in the daily smoke run";
+        }, {
+            readonly id: "email.hook.unsigned-refused";
+            readonly half: "runtime";
+            readonly expect: "refused_as_expected";
+            readonly refusal: "unauthorised";
+            readonly smoke: true;
+            readonly cost_hint_usd: 0;
+            readonly note: "POST /auth/send-email from outside with no signature answers 401, not a sign-in redirect: proves the Access path bypass and the handler. Needs no secret";
+        }, {
+            readonly id: "email.hook.signed-refused-action";
+            readonly half: "runtime";
+            readonly expect: "refused_as_expected";
+            readonly refusal: "refused";
+            readonly cost_hint_usd: 0;
+            readonly note: "A request signed with SEND_EMAIL_HOOK_SECRET for email_action_type recovery answers 422 and sends nothing; skipped while the Worker has no hook secret";
+        }, {
+            readonly id: "email.brand.logo-public";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly smoke: true;
+            readonly cost_hint_usd: 0;
+            readonly note: "GET brand.json's logo.url from outside with no sign-in answers 200 with an image content type";
         }];
     };
     readonly "email-inbound": {

package/dist/capabilities.gen.js

@@ -1,6 +1,6 @@
 // Generated by `npm run capabilities:build` from capabilities/*.json. Do not edit.
 // check:capabilities fails in Checks when this file is stale.
-export const MANIFEST_VERSION = "2216125e22d4";
+export const MANIFEST_VERSION = "ecc54c728515";
 export const capabilities = {
     "ai": {
         "$schema": "./schema.json",
@@ -629,7 +629,10 @@ export const capabilities = {
                 "createServerClient",
                 "createUserClient",
                 "createServiceClient",
-                "WorkbenchSupabaseError"
+                "WorkbenchSupabaseError",
+                "createSessions",
+                "safeReturnPath",
+                "sameOrigin"
             ]
         },
         "config": [
@@ -664,6 +667,17 @@ export const capabilities = {
                     "production"
                 ],
                 "description": "The sb_secret_ key, only for code that must bypass RLS (createServiceClient); written by cf_worker_secret_put source=supabase_secret, always two-step"
+            },
+            {
+                "name": "SESSION_SECRET",
+                "required": false,
+                "secret": true,
+                "environments": [
+                    "development",
+                    "staging",
+                    "production"
+                ],
+                "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
             }
         ],
         "actions": [
@@ -750,6 +764,20 @@ export const capabilities = {
                 "text": "Keep Supabase's sign-in settings at the Workbench baseline (workbench-config VENDOR_SETTINGS), or record a project's change in vendor-settings.json with a reason. Control applies it with vendor_settings_apply and checks it every day.",
                 "enforced_by": "control",
                 "probe": "database.vendor-settings"
+            },
+            {
+                "id": "database.sign-in-server-side",
+                "kind": "must",
+                "text": "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.",
+                "enforced_by": "review",
+                "probe": "database.sign-in"
+            },
+            {
+                "id": "database.session-writes-same-origin",
+                "kind": "must",
+                "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
+                "enforced_by": "review",
+                "probe": "database.session-cookie"
             }
         ],
         "examples": [
@@ -810,6 +838,28 @@ export const capabilities = {
                 "expect": "pass",
                 "cost_hint_usd": 0,
                 "note": "vendor_settings_apply check_only reports that both databases match the baseline, the Send Email hook included"
+            },
+            {
+                "id": "database.plain-error",
+                "half": "runtime",
+                "expect": "pass",
+                "smoke": true,
+                "cost_hint_usd": 0,
+                "note": "plainError and plainAuthError (workbench-supabase) turn a raw database error and an email_exists auth error into plain words that name the app and never say whether an account exists"
+            },
+            {
+                "id": "database.sign-in",
+                "half": "runtime",
+                "expect": "pass",
+                "cost_hint_usd": 0,
+                "note": "Ask for a code, read it from the captured sign-in email, type it, and get a session that reads the user's own rows; a wrong code gets the plain line"
+            },
+            {
+                "id": "database.session-cookie",
+                "half": "runtime",
+                "expect": "pass",
+                "cost_hint_usd": 0,
+                "note": "The session cookie is __Host-, Secure, HttpOnly, SameSite=Lax and sealed; a cross-site write is refused; sign-out clears it with every attribute"
             }
         ]
     },
@@ -1073,6 +1123,46 @@ export const capabilities = {
                 "expect": "pass",
                 "cost_hint_usd": 0.00035,
                 "note": "Runs after the Control drill's gw_sender_add step; skipped without it"
+            },
+            {
+                "id": "email.account.kit-clean",
+                "half": "runtime",
+                "expect": "pass",
+                "smoke": true,
+                "cost_hint_usd": 0,
+                "note": "emailKitProblems over the app's catalogue (ACCOUNT_EMAILS), strings and brand.json returns []; runs in the Worker and sends nothing"
+            },
+            {
+                "id": "email.account.sign-in-code",
+                "half": "runtime",
+                "expect": "pass",
+                "cost_hint_usd": 0.00035,
+                "note": "renderTemplate account_sign_in_code with the app's brand.json, sent to Robert through the Gateway; check the logo, colours and code, and that there is no link. Not in the daily smoke run"
+            },
+            {
+                "id": "email.hook.unsigned-refused",
+                "half": "runtime",
+                "expect": "refused_as_expected",
+                "refusal": "unauthorised",
+                "smoke": true,
+                "cost_hint_usd": 0,
+                "note": "POST /auth/send-email from outside with no signature answers 401, not a sign-in redirect: proves the Access path bypass and the handler. Needs no secret"
+            },
+            {
+                "id": "email.hook.signed-refused-action",
+                "half": "runtime",
+                "expect": "refused_as_expected",
+                "refusal": "refused",
+                "cost_hint_usd": 0,
+                "note": "A request signed with SEND_EMAIL_HOOK_SECRET for email_action_type recovery answers 422 and sends nothing; skipped while the Worker has no hook secret"
+            },
+            {
+                "id": "email.brand.logo-public",
+                "half": "runtime",
+                "expect": "pass",
+                "smoke": true,
+                "cost_hint_usd": 0,
+                "note": "GET brand.json's logo.url from outside with no sign-in answers 200 with an image content type"
             }
         ]
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
   "license": "UNLICENSED",
   "type": "module",