@objectstack/runtime 14.3.0 → 14.5.0

package/dist/index.d.cts

@@ -682,6 +682,19 @@ interface DispatcherPluginConfig {
      * where membership has not been seeded.
      */
     enforceProjectMembership?: boolean;
+    /**
+     * Reject anonymous requests to `auth: true` service routes (AI, etc.) with
+     * HTTP 401, mirroring the REST API's `requireAuth` gate. Must match the
+     * REST plugin's `api.requireAuth` so `/ai` and `/meta` stay in lockstep
+     * with `/data` — otherwise the AI routes' declared `auth: true` contract is
+     * never enforced and anonymous callers reach adapter/model status routes.
+     *
+     * Defaults to `false` (backward-compatible: previously nothing enforced
+     * `RouteDefinition.auth` here). Hosts pass their `api.requireAuth` through —
+     * the framework `serve` command and the cloud apps do so from the same
+     * stack `api` config the REST plugin reads.
+     */
+    requireAuth?: boolean;
     /**
      * Security response headers. When provided, every response routed
      * through this plugin gets the headers merged in (route-specific
@@ -955,6 +968,14 @@ interface HttpDispatcherOptions {
      * called on every scoped request so idle projects are evicted after TTL.
      */
     scopeManager?: EnvironmentScopeManager;
+    /**
+     * Reject anonymous requests to `auth: true` service routes (AI) and to the
+     * metadata catch-all with HTTP 401, mirroring the REST API's `requireAuth`
+     * gate. Matches {@link DispatcherPluginConfig.requireAuth}; the dispatcher
+     * plugin threads the host's `api.requireAuth` here. Defaults to `false`
+     * (backward-compatible — nothing enforced `RouteDefinition.auth` before).
+     */
+    requireAuth?: boolean;
 }
 /**
  * The HTTP dispatch engine — translates an inbound (method, path, body, ctx)
@@ -982,6 +1003,12 @@ declare class HttpDispatcher {
      * `DispatcherConfig.enforceProjectMembership`).
      */
     private enforceMembership;
+    /**
+     * When `true`, `auth: true` AI routes and the metadata catch-all reject
+     * anonymous callers with 401 (mirrors the REST `requireAuth` gate). Set
+     * from {@link HttpDispatcherOptions.requireAuth}. Defaults to `false`.
+     */
+    private requireAuth;
     /**
      * In-memory cache of positive membership checks, keyed by
      * `${environmentId}:${userId}`. Entries expire 60 seconds after insertion
@@ -1498,7 +1525,7 @@ declare class HttpDispatcher {
      * Handles Analytics requests
      * path: sub-path after /analytics/
      */
-    handleAnalytics(path: string, method: string, body: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult>;
+    handleAnalytics(path: string, method: string, body: any, context: HttpProtocolContext): Promise<HttpDispatcherResult>;
     /**
      * Handles in-app notification requests (ADR-0030) — the
      * `/api/v1/notifications` surface backed by the messaging service's inbox

package/dist/index.d.ts

@@ -682,6 +682,19 @@ interface DispatcherPluginConfig {
      * where membership has not been seeded.
      */
     enforceProjectMembership?: boolean;
+    /**
+     * Reject anonymous requests to `auth: true` service routes (AI, etc.) with
+     * HTTP 401, mirroring the REST API's `requireAuth` gate. Must match the
+     * REST plugin's `api.requireAuth` so `/ai` and `/meta` stay in lockstep
+     * with `/data` — otherwise the AI routes' declared `auth: true` contract is
+     * never enforced and anonymous callers reach adapter/model status routes.
+     *
+     * Defaults to `false` (backward-compatible: previously nothing enforced
+     * `RouteDefinition.auth` here). Hosts pass their `api.requireAuth` through —
+     * the framework `serve` command and the cloud apps do so from the same
+     * stack `api` config the REST plugin reads.
+     */
+    requireAuth?: boolean;
     /**
      * Security response headers. When provided, every response routed
      * through this plugin gets the headers merged in (route-specific
@@ -955,6 +968,14 @@ interface HttpDispatcherOptions {
      * called on every scoped request so idle projects are evicted after TTL.
      */
     scopeManager?: EnvironmentScopeManager;
+    /**
+     * Reject anonymous requests to `auth: true` service routes (AI) and to the
+     * metadata catch-all with HTTP 401, mirroring the REST API's `requireAuth`
+     * gate. Matches {@link DispatcherPluginConfig.requireAuth}; the dispatcher
+     * plugin threads the host's `api.requireAuth` here. Defaults to `false`
+     * (backward-compatible — nothing enforced `RouteDefinition.auth` before).
+     */
+    requireAuth?: boolean;
 }
 /**
  * The HTTP dispatch engine — translates an inbound (method, path, body, ctx)
@@ -982,6 +1003,12 @@ declare class HttpDispatcher {
      * `DispatcherConfig.enforceProjectMembership`).
      */
     private enforceMembership;
+    /**
+     * When `true`, `auth: true` AI routes and the metadata catch-all reject
+     * anonymous callers with 401 (mirrors the REST `requireAuth` gate). Set
+     * from {@link HttpDispatcherOptions.requireAuth}. Defaults to `false`.
+     */
+    private requireAuth;
     /**
      * In-memory cache of positive membership checks, keyed by
      * `${environmentId}:${userId}`. Entries expire 60 seconds after insertion
@@ -1498,7 +1525,7 @@ declare class HttpDispatcher {
      * Handles Analytics requests
      * path: sub-path after /analytics/
      */
-    handleAnalytics(path: string, method: string, body: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult>;
+    handleAnalytics(path: string, method: string, body: any, context: HttpProtocolContext): Promise<HttpDispatcherResult>;
     /**
      * Handles in-app notification requests (ADR-0030) — the
      * `/api/v1/notifications` surface backed by the messaging service's inbox

package/dist/index.js

@@ -2119,6 +2119,7 @@ function checkApiExposure(def, action) {
 }
 
 // src/security/resolve-execution-context.ts
+import { scopesToAgentPermissionSets, MCP_OAUTH_SCOPE_ACTIONS } from "@objectstack/spec/ai";
 import {
   resolveAuthzContext,
   resolveLocalizationContext
@@ -2182,7 +2183,15 @@ async function resolveExecutionContext(opts) {
     isSystem: false
   };
   if (authz.userId) {
-    ctx.principalKind = "human";
+    if (oauthPrincipal?.clientId) {
+      ctx.principalKind = "agent";
+      ctx.onBehalfOf = { userId: authz.userId, principalKind: "human" };
+      ctx.permissions = scopesToAgentPermissionSets(oauthPrincipal.scopes);
+      ctx.positions = [];
+      ctx.systemPermissions = oauthPrincipal.scopes?.includes(MCP_OAUTH_SCOPE_ACTIONS) ? authz.systemPermissions ?? [] : [];
+    } else {
+      ctx.principalKind = "human";
+    }
   } else {
     ctx.principalKind = "guest";
     ctx.positions = ["guest"];
@@ -2266,6 +2275,7 @@ var _HttpDispatcher = class _HttpDispatcher {
       }
     };
     this.enforceMembership = options?.enforceProjectMembership ?? true;
+    this.requireAuth = options?.requireAuth ?? false;
     this.kernelResolver = options?.kernelResolver ?? resolveService("kernel-resolver");
     this.scopeManager = options?.scopeManager ?? resolveService("scope-manager");
   }
@@ -3431,6 +3441,15 @@ var _HttpDispatcher = class _HttpDispatcher {
    * Fallback for backward compat: /metadata (all objects), /metadata/:objectName (get object)
    */
   async handleMetadata(path, _context, method, body, query) {
+    if (this.requireAuth) {
+      const ec = _context.executionContext;
+      if (!ec?.userId && !ec?.isSystem) {
+        return {
+          handled: true,
+          response: this.error("Authentication is required to access this endpoint.", 401, { code: "unauthenticated" })
+        };
+      }
+    }
     const parts = path.replace(/^\/+/, "").split("/").filter(Boolean);
     if (parts[0] === "types") {
       const protocol = await this.resolveService("protocol");
@@ -3730,13 +3749,13 @@ var _HttpDispatcher = class _HttpDispatcher {
    * Handles Analytics requests
    * path: sub-path after /analytics/
    */
-  async handleAnalytics(path, method, body, _context) {
+  async handleAnalytics(path, method, body, context) {
     const analyticsService = await this.getService(CoreServiceName.enum.analytics);
     if (!analyticsService) return { handled: false };
     const m = method.toUpperCase();
     const subPath = path.replace(/^\/+/, "");
     if (subPath === "query" && m === "POST") {
-      const result = await analyticsService.query(body);
+      const result = await analyticsService.query(body, context?.executionContext);
       return { handled: true, response: this.success(result) };
     }
     if (subPath === "meta" && m === "GET") {
@@ -3744,7 +3763,7 @@ var _HttpDispatcher = class _HttpDispatcher {
       return { handled: true, response: this.success(result) };
     }
     if (subPath === "sql" && m === "POST") {
-      const result = await analyticsService.generateSql(body);
+      const result = await analyticsService.generateSql(body, context?.executionContext);
       return { handled: true, response: this.success(result) };
     }
     return { handled: false };
@@ -4932,6 +4951,15 @@ var _HttpDispatcher = class _HttpDispatcher {
       if (route.method !== method) continue;
       const params = matchRoute(route.path, fullPath);
       if (params === null) continue;
+      if (this.requireAuth && route.auth !== false) {
+        const gec = context.executionContext;
+        if (!gec?.userId && !gec?.isSystem) {
+          return {
+            handled: true,
+            response: this.error("Authentication is required to access this endpoint.", 401, { code: "unauthenticated" })
+          };
+        }
+      }
       const ec = context.executionContext;
       const user = ec?.userId ? {
         userId: ec.userId,
@@ -5664,7 +5692,7 @@ function resolveErrorReporter(ctx, override) {
 }
 
 // src/dispatcher-plugin.ts
-function mountRouteOnServer(route, server, routePath, securityHeaders, resolveUser) {
+function mountRouteOnServer(route, server, routePath, securityHeaders, resolveUser, requireAuth = false) {
   const handler = async (req, res) => {
     try {
       let user;
@@ -5674,6 +5702,17 @@ function mountRouteOnServer(route, server, routePath, securityHeaders, resolveUs
         } catch {
         }
       }
+      if (requireAuth && route.auth !== false && !user) {
+        res.status(401);
+        if (securityHeaders) {
+          for (const [k, v] of Object.entries(securityHeaders)) res.header(k, v);
+        }
+        res.json({
+          error: "unauthenticated",
+          message: "Authentication is required to access this endpoint."
+        });
+        return;
+      }
       const result = await route.handler({
         body: req.body,
         params: req.params,
@@ -5857,8 +5896,10 @@ function createDispatcherPlugin(config = {}) {
       if (!server) return;
       const kernel = ctx.getKernel();
       const enforceMembership = config.enforceProjectMembership ?? (config.scoping?.enableProjectScoping ?? false);
+      const requireAuth = config.requireAuth ?? config.scoping?.requireAuth ?? false;
       const dispatcher = new HttpDispatcher(kernel, void 0, {
-        enforceProjectMembership: enforceMembership
+        enforceProjectMembership: enforceMembership,
+        requireAuth
       });
       const prefix = config.prefix || "/api/v1";
       const securityHeaders = config.securityHeaders === false ? void 0 : buildSecurityHeaders(
@@ -6368,11 +6409,11 @@ function createDispatcherPlugin(config = {}) {
         const routePath = route.path.startsWith("/api/v1") ? route.path : `${prefix}${route.path}`;
         let count = 0;
         if (enableProjectScoping && projectResolution === "required") {
-          if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders, resolveRequestUser)) count++;
+          if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders, resolveRequestUser, requireAuth)) count++;
         } else {
-          if (mountRouteOnServer(route, server, routePath, securityHeaders, resolveRequestUser)) count++;
+          if (mountRouteOnServer(route, server, routePath, securityHeaders, resolveRequestUser, requireAuth)) count++;
           if (enableProjectScoping) {
-            if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders, resolveRequestUser)) count++;
+            if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders, resolveRequestUser, requireAuth)) count++;
           }
         }
         return count;