@nacre.work/api 0.16.0 → 0.17.0

package/dist/server.js

@@ -5,7 +5,7 @@ import { createHash, randomUUID, timingSafeEqual } from 'node:crypto';
 import { URL } from 'node:url';
 import { logger, MetadataError, MultipartError, multipartBoundary, parseMultipart, queryAudit, parseFilters, parseMetadata, PROTECTED_RESOURCE_PATH, JWKS_PATH, AUTHORIZATION_SERVER_PATH, AUTHORIZE_PATH, CODE_TTL_MS, REGISTER_PATH, TOKEN_PATH, authorizationServerMetadata, consentRedirect, generateClientId, generateCode, redirectAllowed, verifierMatches, ADMIN_PREFIX, adminRoutes, withAuditSinks, TooBusy, } from '@nacre.work/core';
 import { administers, administersTenants, authenticate, rejectTenantOverride, } from './auth.js';
-import { badRequest, internal, notFound, Problem } from './errors.js';
+import { badRequest, internal, notAdministeredHere, notFound, Problem } from './errors.js';
 import { isConflict, isReplay } from './idempotency.js';
 import { limitHeaders } from './limits.js';
 import { looksLikeEmail } from './principals.js';
@@ -614,6 +614,7 @@ async function handleAuth(req, res, instance, requestId, options) {
             actor: `user:${tokens.userId}`,
             action: 'login',
             result: 'allow',
+            target: { user_id: tokens.userId },
             detail: {},
             requestId,
         });
@@ -1175,7 +1176,8 @@ async function handle(req, res, options) {
             actor: `${auth.principal.type}:${auth.principal.id}`,
             action: 'tenant_override_attempt',
             result: 'deny',
-            detail: { path: instance },
+            target: { path: instance },
+            detail: {},
             requestId,
         });
         send(res, override.status, override.toJSON(), requestId);
@@ -1201,7 +1203,8 @@ async function handle(req, res, options) {
                 actor: `${auth.principal.type}:${auth.principal.id}`,
                 action: 'rate_limited',
                 result: 'deny',
-                detail: { resource, limit: decision.limit },
+                target: { resource },
+                detail: { limit: decision.limit },
                 requestId,
             });
             const problem = new Problem({
@@ -1791,7 +1794,8 @@ async function handle(req, res, options) {
                         actor: `${auth.principal.type}:${auth.principal.id}`,
                         action: 'embedding_provider.create',
                         result: 'deny',
-                        detail: { name: name.trim() },
+                        target: { name: name.trim() },
+                        detail: {},
                         requestId,
                     });
                     const problem = notFound(instance, requestId);
@@ -1815,7 +1819,8 @@ async function handle(req, res, options) {
                     actor: `${auth.principal.type}:${auth.principal.id}`,
                     action: 'embedding_provider.create',
                     result: 'allow',
-                    detail: { name: outcome.provider.name, model: outcome.provider.model },
+                    target: { provider_id: outcome.provider.id, name: outcome.provider.name },
+                    detail: { model: outcome.provider.model },
                     requestId,
                 });
                 send(res, 201, {
@@ -1867,7 +1872,8 @@ async function handle(req, res, options) {
                     actor: `${auth.principal.type}:${auth.principal.id}`,
                     action: 'create_workspace',
                     result: outcome.kind === 'created' ? 'allow' : 'deny',
-                    detail: { slug, outcome: outcome.kind },
+                    target: { slug },
+                    detail: { outcome: outcome.kind },
                     requestId,
                 });
                 if (outcome.kind === 'denied') {
@@ -1951,7 +1957,8 @@ async function handle(req, res, options) {
                 actor: `${auth.principal.type}:${auth.principal.id}`,
                 action: 'create_layer',
                 result: outcome.kind === 'created' ? 'allow' : 'deny',
-                detail: { workspace_id: workspaceId, slug, outcome: outcome.kind },
+                target: { workspace_id: workspaceId, slug },
+                detail: { outcome: outcome.kind },
                 requestId,
             });
             if (outcome.kind === 'denied') {
@@ -2014,11 +2021,12 @@ async function handle(req, res, options) {
                 actor: `${auth.principal.type}:${auth.principal.id}`,
                 action: 'issue_grant',
                 result: issued === undefined ? 'deny' : 'allow',
-                detail: {
+                target: {
                     principal: `${parsed.principalType}:${parsed.principalId}`,
                     scope: `${parsed.scopeType}:${parsed.scopeId}`,
                     permission: parsed.permission,
                 },
+                detail: {},
                 requestId,
             });
             if (issued === undefined) {
@@ -2041,7 +2049,8 @@ async function handle(req, res, options) {
                 actor: `${auth.principal.type}:${auth.principal.id}`,
                 action: 'revoke_grant',
                 result: revoked ? 'allow' : 'deny',
-                detail: { grant_id: id },
+                target: { grant_id: id },
+                detail: {},
                 requestId,
             });
             if (!revoked) {
@@ -2759,7 +2768,8 @@ async function handle(req, res, options) {
                         actor: `${auth.principal.type}:${auth.principal.id}`,
                         action: 'create_service_account',
                         result: 'deny',
-                        detail: { name: name.trim(), reason: 'name taken' },
+                        target: { name: name.trim() },
+                        detail: { reason: 'name taken' },
                         requestId,
                     });
                     const problem = new Problem({
@@ -2779,10 +2789,11 @@ async function handle(req, res, options) {
                     actor: `${auth.principal.type}:${auth.principal.id}`,
                     action: 'create_service_account',
                     result: 'allow',
+                    target: { service_account_id: account.id, name: account.name },
                     // The prefix, never the key. This row is readable by anyone with the
                     // audit log, and the key is not recoverable from anywhere else by
                     // design — putting it here would undo that.
-                    detail: { service_account_id: account.id, key_prefix: account.keyPrefix },
+                    detail: { key_prefix: account.keyPrefix },
                     requestId,
                 });
                 // The only time the key exists outside the caller's process.
@@ -2804,7 +2815,8 @@ async function handle(req, res, options) {
                 actor: `${auth.principal.type}:${auth.principal.id}`,
                 action: 'revoke_service_account',
                 result: revoked ? 'allow' : 'deny',
-                detail: { service_account_id: id },
+                target: { service_account_id: id },
+                detail: {},
                 requestId,
             });
             if (!revoked) {
@@ -2834,7 +2846,8 @@ async function handle(req, res, options) {
                     actor: `${auth.principal.type}:${auth.principal.id}`,
                     action: 'administer_principals',
                     result: 'deny',
-                    detail: { path: instance, method: req.method ?? 'GET', reason: 'not an org_admin' },
+                    target: { path: instance, method: req.method ?? 'GET' },
+                    detail: { reason: 'not an org_admin' },
                     requestId,
                 });
                 const problem = notFound(instance, requestId);
@@ -2881,7 +2894,8 @@ async function handle(req, res, options) {
                         actor: `${auth.principal.type}:${auth.principal.id}`,
                         action: 'create_user',
                         result: 'deny',
-                        detail: { email, reason: 'address taken' },
+                        target: { email },
+                        detail: { reason: 'address taken' },
                         requestId,
                     });
                     const problem = new Problem({
@@ -2900,10 +2914,11 @@ async function handle(req, res, options) {
                     actor: `${auth.principal.type}:${auth.principal.id}`,
                     action: 'create_user',
                     result: 'allow',
-                    // The address and the role. Never the password — this row is readable
-                    // by anyone with the audit log, and the password is not recoverable
-                    // from anywhere else by design.
-                    detail: { user_id: created.user.id, email, role },
+                    target: { user_id: created.user.id, email },
+                    // The role, never the password — this row is readable by anyone with
+                    // the audit log, and the password is not recoverable from anywhere
+                    // else by design.
+                    detail: { role },
                     requestId,
                 });
                 // The only time the password exists outside the caller's process.
@@ -2931,9 +2946,15 @@ async function handle(req, res, options) {
                     actor: `${auth.principal.type}:${auth.principal.id}`,
                     action: 'disable_user',
                     result: disabled === 'updated' ? 'allow' : 'deny',
-                    detail: { user_id: id, ...(disabled === 'updated' ? {} : { reason: disabled }) },
+                    target: { user_id: id },
+                    detail: disabled === 'updated' ? {} : { reason: disabled },
                     requestId,
                 });
+                if (disabled === 'platform-admin') {
+                    const problem = notAdministeredHere(instance, requestId);
+                    send(res, problem.status, problem.toJSON(), requestId);
+                    return;
+                }
                 if (disabled === 'last-admin') {
                     const problem = new Problem({
                         type: 'https://nacre.work/errors/conflict',
@@ -2989,14 +3010,19 @@ async function handle(req, res, options) {
                     actor: `${auth.principal.type}:${auth.principal.id}`,
                     action: 'update_user',
                     result: changed === 'updated' ? 'allow' : 'deny',
+                    target: { user_id: id },
                     detail: {
-                        user_id: id,
                         ...(wantsRole ? { role: fields.role } : {}),
                         ...(wantsDisabled ? { disabled: fields.disabled } : {}),
                         ...(changed === 'updated' ? {} : { reason: changed }),
                     },
                     requestId,
                 });
+                if (changed === 'platform-admin') {
+                    const problem = notAdministeredHere(instance, requestId);
+                    send(res, problem.status, problem.toJSON(), requestId);
+                    return;
+                }
                 if (changed === 'last-admin') {
                     // 409 rather than 404: the caller is looking straight at this user —
                     // it is their own account or one they just listed — so the answer is
@@ -3026,17 +3052,29 @@ async function handle(req, res, options) {
         const passwordMatch = /^\/v1\/users\/([^/]+)\/password$/.exec(instance);
         if (req.method === 'POST' && passwordMatch && options.users !== undefined) {
             const id = decodeURIComponent(passwordMatch[1]);
-            const password = await options.users.resetPassword(auth, id);
+            const reset = await options.users.resetPassword(auth, id);
+            const refused = typeof reset === 'string' ? reset : undefined;
             await options.audit.write({
                 orgId: auth.orgId,
                 actor: `${auth.principal.type}:${auth.principal.id}`,
                 action: 'reset_password',
-                result: password === undefined ? 'deny' : 'allow',
+                result: refused === undefined ? 'allow' : 'deny',
                 // That it happened and to whom. Never the value.
-                detail: { user_id: id },
+                target: { user_id: id },
+                detail: refused === undefined ? {} : { reason: refused },
                 requestId,
             });
-            if (password === undefined) {
+            // The refusal that matters most on this route, and the one the whole
+            // guard was written for. Demoting a platform administrator takes the role
+            // away; resetting their password hands the caller the plaintext in the
+            // response and lets them sign in as the account that administers the
+            // installation.
+            if (reset === 'platform-admin') {
+                const problem = notAdministeredHere(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            if (reset === 'no-user') {
                 const problem = notFound(instance, requestId);
                 send(res, problem.status, problem.toJSON(), requestId);
                 return;
@@ -3044,7 +3082,7 @@ async function handle(req, res, options) {
             // Generated rather than chosen, for the reason `init` gives: an argument
             // ends up in a shell history, and a password an administrator picked is
             // one they know. This is the only time it exists outside the process.
-            send(res, 200, { password }, requestId);
+            send(res, 200, { password: reset.password }, requestId);
             return;
         }
         if (instance === '/v1/groups' && options.groups !== undefined) {
@@ -3072,7 +3110,8 @@ async function handle(req, res, options) {
                         actor: `${auth.principal.type}:${auth.principal.id}`,
                         action: 'create_group',
                         result: 'deny',
-                        detail: { name: name.trim(), reason: 'name taken' },
+                        target: { name: name.trim() },
+                        detail: { reason: 'name taken' },
                         requestId,
                     });
                     const problem = new Problem({
@@ -3091,7 +3130,8 @@ async function handle(req, res, options) {
                     actor: `${auth.principal.type}:${auth.principal.id}`,
                     action: 'create_group',
                     result: 'allow',
-                    detail: { group_id: created.id, name: created.name },
+                    target: { group_id: created.id, name: created.name },
+                    detail: {},
                     requestId,
                 });
                 send(res, 201, groupJson(created), requestId);
@@ -3107,7 +3147,8 @@ async function handle(req, res, options) {
                 actor: `${auth.principal.type}:${auth.principal.id}`,
                 action: 'delete_group',
                 result: removed ? 'allow' : 'deny',
-                detail: { group_id: id },
+                target: { group_id: id },
+                detail: {},
                 requestId,
             });
             if (!removed) {
@@ -3151,10 +3192,8 @@ async function handle(req, res, options) {
                     actor: `${auth.principal.type}:${auth.principal.id}`,
                     action: 'add_group_member',
                     result: outcome === 'no-group' || outcome === 'no-member' ? 'deny' : 'allow',
+                    target: { group_id: groupId, member_type: type, member_id: memberId },
                     detail: {
-                        group_id: groupId,
-                        member_type: type,
-                        member_id: memberId,
                         ...(outcome === 'already' ? { note: 'already a member' } : {}),
                         ...(outcome === 'no-group' || outcome === 'no-member' ? { reason: outcome } : {}),
                     },
@@ -3187,7 +3226,8 @@ async function handle(req, res, options) {
                 actor: `${auth.principal.type}:${auth.principal.id}`,
                 action: 'remove_group_member',
                 result: removed ? 'allow' : 'deny',
-                detail: { group_id: groupId, member_type: type, member_id: memberId },
+                target: { group_id: groupId, member_type: type, member_id: memberId },
+                detail: {},
                 requestId,
             });
             if (!removed) {