@opendatalabs/personal-server-ts-server 1.3.1 → 1.3.3

package/dist/api-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-auth.d.ts","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,yBAAyB,EAE1B,MAAM,2CAA2C,CAAC;AAOnD,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACjD,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;CAC/C;AA6CD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GACtB,yBAAyB,CA0E3B"}
+{"version":3,"file":"api-auth.d.ts","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,yBAAyB,EAE1B,MAAM,2CAA2C,CAAC;AAOnD,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACjD,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;CAC/C;AA6CD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GACtB,yBAAyB,CA+E3B"}

package/dist/api-auth.js

@@ -76,6 +76,10 @@ export function createServerApiAuth(deps) {
                     result.mechanism === "control-plane-token")) {
                 return { builder: result.auth.signer, grantId: "owner" };
             }
+            // Fail closed: a builder grant read can't be authorized if we can't
+            // identify this server's owner to bind the grant to.
+            if (!deps.serverOwner)
+                throw serverNotConfigured();
             const selectedEntry = deps.dataStorage?.findEntry({
                 scope: input.scope,
                 fileId: input.fileId,
@@ -85,6 +89,7 @@ export function createServerApiAuth(deps) {
                 grantId: result.auth.payload.grantId ?? input.grantId,
                 requestedScope: input.scope,
                 fileId: input.fileId ?? selectedEntry?.fileId ?? undefined,
+                serverOwner: deps.serverOwner,
             }, {
                 authSessionVerifier: deps.gateway,
                 grantVerifier: deps.gateway,

package/dist/api-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-auth.js","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAC;AAKpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACpF,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,GACzB,MAAM,8CAA8C,CAAC;AAkBtD,SAAS,mBAAmB;IAC1B,OAAO,IAAI,aAAa,CACtB,GAAG,EACH,uBAAuB,EACvB,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,WAAsC;IAEtC,OAAO,OAAO,CACZ,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,IAAuB;IAEvB,OAAO,mBAAmB,CAAC;QACzB,OAAO;QACP,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,OAAsB,EACtB,MAAqB;IAErB,IAAI,qBAAqB,IAAI,OAAO,EAAE,CAAC;QACrC,IAAI,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAAE,OAAO;QACtD,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAuB;IAEvB,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,OAAO;YAC1B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,cAAc;gBAAE,OAAO;YAClC,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,aAAa,CAAC;oBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;oBAC1B,QAAQ,EAAE,IAAI,CAAC,WAAW;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,OAAO;YAChC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IACE,MAAM,CAAC,cAAc;gBACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAC7C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAkC;YAC3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACnE,CAAC;YACD,yDAAyD;YACzD,sEAAsE;YACtE,wDAAwD;YACxD,kEAAkE;YAClE,mEAAmE;YACnE,4DAA4D;YAC5D,8BAA8B;YAC9B,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD;YACzD,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,iEAAiE;YACjE,oEAAoE;YACpE,IACE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;gBAC7C,CAAC,MAAM,CAAC,SAAS,KAAK,aAAa;oBACjC,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,EAC7C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC3D,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;gBAChD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC;gBACE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;gBACrD,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,MAAM,IAAI,SAAS;aAC3D,EACD;gBACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CACF,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"api-auth.js","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAC;AAKpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACpF,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,GACzB,MAAM,8CAA8C,CAAC;AAkBtD,SAAS,mBAAmB;IAC1B,OAAO,IAAI,aAAa,CACtB,GAAG,EACH,uBAAuB,EACvB,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,WAAsC;IAEtC,OAAO,OAAO,CACZ,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,IAAuB;IAEvB,OAAO,mBAAmB,CAAC;QACzB,OAAO;QACP,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,OAAsB,EACtB,MAAqB;IAErB,IAAI,qBAAqB,IAAI,OAAO,EAAE,CAAC;QACrC,IAAI,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAAE,OAAO;QACtD,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAuB;IAEvB,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,OAAO;YAC1B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,cAAc;gBAAE,OAAO;YAClC,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,aAAa,CAAC;oBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;oBAC1B,QAAQ,EAAE,IAAI,CAAC,WAAW;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,OAAO;YAChC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IACE,MAAM,CAAC,cAAc;gBACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAC7C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAkC;YAC3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACnE,CAAC;YACD,yDAAyD;YACzD,sEAAsE;YACtE,wDAAwD;YACxD,kEAAkE;YAClE,mEAAmE;YACnE,4DAA4D;YAC5D,8BAA8B;YAC9B,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD;YACzD,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,iEAAiE;YACjE,oEAAoE;YACpE,IACE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;gBAC7C,CAAC,MAAM,CAAC,SAAS,KAAK,aAAa;oBACjC,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,EAC7C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC3D,CAAC;YAED,oEAAoE;YACpE,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAEnD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;gBAChD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC;gBACE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;gBACrD,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,MAAM,IAAI,SAAS;gBAC1D,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,EACD;gBACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CACF,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/ui/ps-lite-debug.js

@@ -107983,11 +107983,21 @@ var ScopeMismatchError = class extends ProtocolError {
     super(403, "SCOPE_MISMATCH", "Scope not granted", details);
   }
 };
+var GrantOwnerMismatchError = class extends ProtocolError {
+  constructor(details) {
+    super(403, "GRANT_OWNER_MISMATCH", "Grant was not issued by this server's owner", details);
+  }
+};
 var PsUnavailableError = class extends ProtocolError {
   constructor(details) {
     super(503, "PS_UNAVAILABLE", "Personal Server runtime unavailable", details);
   }
 };
+var ServerNotConfiguredError = class extends ProtocolError {
+  constructor(details) {
+    super(500, "SERVER_NOT_CONFIGURED", "Server is not configured", details);
+  }
+};
 
 // ../core/dist/auth/request.js
 function resolveOrigin(origin) {
@@ -109885,6 +109895,18 @@ async function verifyDataReadPolicy(input, ports) {
       actual: input.signer
     });
   }
+  if (!input.serverOwner) {
+    throw new ServerNotConfiguredError({
+      reason: "serverOwner is required to verify grant ownership"
+    });
+  }
+  if (!grant.grantorAddress || grant.grantorAddress.toLowerCase() !== input.serverOwner.toLowerCase()) {
+    throw new GrantOwnerMismatchError({
+      grantId: grant.id,
+      expected: input.serverOwner,
+      actual: grant.grantorAddress ?? null
+    });
+  }
   return grant;
 }
 
@@ -124693,7 +124715,10 @@ function createWeb3SignedPsLiteAuth(options) {
         signer: auth.auth.signer,
         grantId: auth.auth.payload.grantId ?? input.grantId,
         requestedScope: input.scope,
-        fileId: input.fileId
+        fileId: input.fileId,
+        // Bind the read to this PS's owner — the grant must have been issued
+        // by us. Required now that the policy fails closed on a missing owner.
+        serverOwner: options.ownerAddress
       }, options.dataReadPolicyPorts);
       return { builder: auth.auth.signer, grantId: grant.id };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opendatalabs/personal-server-ts-server",
-  "version": "1.3.1",
+  "version": "1.3.3",
   "description": "Hono HTTP server for the Vana Personal Server — routes, middleware, composition root",
   "license": "MIT",
   "repository": {
@@ -44,8 +44,8 @@
   },
   "dependencies": {
     "@hono/node-server": "^1.19.13",
-    "@opendatalabs/personal-server-ts-core": "1.3.1",
-    "@opendatalabs/personal-server-ts-lite": "1.3.1",
+    "@opendatalabs/personal-server-ts-core": "1.3.3",
+    "@opendatalabs/personal-server-ts-lite": "1.3.3",
     "@opendatalabs/vana-sdk": "3.13.0",
     "better-sqlite3": "^12.11.1",
     "hono": "^4.12.27",