@nacre.work/api 0.33.0 → 0.34.0

package/dist/server.js

@@ -16,6 +16,7 @@ import { looksLikeEmail } from './principals.js';
 import { clientSource } from './source.js';
 import { auditFormat, auditJson, readAuditQuery, toCsv, toNdjson, } from './audit-export.js';
 import { decodeCursor, readPage } from './pagination.js';
+import { applyProposal, cancelProposal } from './proposals.js';
 /**
  * The default body cap, in bytes.
  *
@@ -3155,6 +3156,38 @@ async function handle(req, res, options) {
             }, requestId);
             return;
         }
+        /*
+         * Where a client connects: the REST base, the MCP endpoint, and — for an
+         * organization administrator — the administrative one.
+         *
+         * Asked of the server rather than worked out in a browser, because the
+         * page's own origin is the answer only when the console, the API and the
+         * MCP transport share one, and the operator already told the server which
+         * addresses are the public ones. Any credential may ask: a member connects
+         * their own client, and an agent reading this learns nothing its token did
+         * not already let it reach.
+         *
+         * `mcp_admin` is the administrative MCP, and only somebody who administers
+         * this organization is told it — its consent screen refuses everybody
+         * else, so offering it would be offering a connection that cannot be made.
+         * The same `administers` the gated handlers call.
+         */
+        if (instance === '/v1/endpoints') {
+            if (req.method !== 'GET' || options.endpoints === undefined) {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            const e = options.endpoints;
+            send(res, 200, {
+                api: e.api,
+                mcp: e.mcp,
+                ...(administers(auth) ? { mcp_admin: e.mcpAdmin } : {}),
+                contract: e.contract,
+                version: e.version,
+            }, requestId);
+            return;
+        }
         /*
          * The caller's own password.
          *
@@ -4123,6 +4156,76 @@ async function handle(req, res, options) {
          * is a denylist consulted on every request, which would make local
          * verification not local.
          */
+        // ── proposals ─────────────────────────────────────────────────────────
+        //
+        // docs/mcp-admin.md, "A change is proposed, and a person applies it". What
+        // the person's administrative connection proposed, waiting for them, and
+        // the two buttons. A person in their own session and nobody else: every
+        // other caller — a connected application's token included — gets the
+        // answer a path that does not exist gets.
+        const proposalMatch = pathMatch(/^\/v1\/proposals(?:\/([0-9a-f-]{36})\/(apply|cancel))?$/i, instance);
+        if (proposalMatch !== null && options.proposals !== undefined) {
+            const own = auth.principal.type === 'user' && auth.delegation === undefined && administers(auth);
+            const id = proposalMatch[1];
+            const verb = proposalMatch[2];
+            if (!own || (id === undefined ? req.method !== 'GET' : req.method !== 'POST')) {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            const deps = { proposals: options.proposals.store, audit: options.audit, writes: options.proposals.writes };
+            const by = { through: 'console', personId: auth.principal.id };
+            if (id === undefined) {
+                const items = await options.proposals.store.pending(auth);
+                send(res, 200, {
+                    items: items.map((p) => ({
+                        id: p.id,
+                        tool: p.tool,
+                        module: p.module,
+                        summary: p.summary,
+                        details: p.details,
+                        created_at: p.createdAt,
+                        expires_at: p.expiresAt,
+                        connection: { id: p.connection.id, application: p.connection.application },
+                    })),
+                }, requestId);
+                return;
+            }
+            const outcome = verb === 'apply'
+                ? await applyProposal(deps, auth, id, by, requestId)
+                : await cancelProposal(deps, auth, id, by, requestId);
+            switch (outcome.kind) {
+                case 'applied':
+                    send(res, 200, { applied: true, result: outcome.result }, requestId);
+                    return;
+                case 'cancelled':
+                    send(res, 204, null, requestId);
+                    return;
+                case 'refused': {
+                    // The proposal was theirs and is now spent; the change itself was
+                    // refused, in the tool's own words — the role was lost, the name is
+                    // taken, the last administrator would go. Not 404: they are looking
+                    // straight at it.
+                    const problem = new Problem({
+                        type: 'https://nacre.work/errors/proposal-refused',
+                        title: 'The change was refused',
+                        status: 409,
+                        detail: outcome.reason,
+                        instance,
+                        requestId,
+                    });
+                    send(res, problem.status, problem.toJSON(), requestId);
+                    return;
+                }
+                default: {
+                    // Absent, somebody else's, decided, expired, or proposed through a
+                    // connection revoked since — one answer.
+                    const problem = notFound(instance, requestId);
+                    send(res, problem.status, problem.toJSON(), requestId);
+                    return;
+                }
+            }
+        }
         if (instance === '/v1/oauth/consents' && options.oauth !== undefined) {
             if (req.method !== 'GET') {
                 const problem = notFound(instance, requestId);