@optimuslabs/harness-map-staging 1.5.25 → 1.5.27

package/dist/approved_tenant_gate.js

@@ -0,0 +1,302 @@
+/**
+ * Approved-tenant check for the pre-prompt gate.
+ *
+ * The organization's approved and unapproved vendor tenants arrive with remediation sync and are
+ * stored in remediation_instructions.json, so this reads local files only. Claude reports one tenant,
+ * `oauthAccount.organizationUuid` in `.claude.json`; Cursor reports the teams its login belongs to,
+ * `aiSettings.teamIds` in its state.vscdb.
+ *
+ * Only a claude.ai login is checked. A session without `oauthAccount` (an API key, Bedrock, a
+ * gateway) is allowed here; blocking those is a separate level. So is one whose API key, auth
+ * token, Bedrock or Vertex setting overrides an `oauthAccount` left behind by an earlier login:
+ * Claude Code is not using that login, the same precedence as the backend's derive_auth_method.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { readCursorEmail, readCursorTeamIds, vscdbPath, } from './log_config_files/collection/cursor_token_usage_collector.js';
+import { resolveSqlite3Binary } from './log_config_files/runtime/sqlite_binary.js';
+import { readCodexIdentity } from './log_config_files/collection/codex_token_usage_collector.js';
+import { readDesktopActiveLogin } from './log_config_files/collection/claude_desktop_orgs_collector.js';
+const CLAUDE_CREDENTIAL_ENV = ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN'];
+const CLAUDE_PROVIDER_ENV = ['CLAUDE_CODE_USE_BEDROCK', 'CLAUDE_CODE_USE_VERTEX'];
+/** The `env` block of Claude Code's user settings.json, or {} when there is none to read. */
+function claudeSettingsEnv(configDir) {
+    const path = join(configDir || join(homedir(), '.claude'), 'settings.json');
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        const env = parsed?.env;
+        return env && typeof env === 'object' && !Array.isArray(env) ? env : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Whether Claude Code authenticates with something other than its claude.ai login: an API key or
+ * auth token, or Bedrock / Vertex, from the session's environment or settings.json's `env`.
+ */
+function claudeUsesOtherCredentials(env, configDir) {
+    const settingsEnv = claudeSettingsEnv(configDir);
+    const value = (name) => String(env[name] ?? settingsEnv[name] ?? '').trim();
+    return (CLAUDE_CREDENTIAL_ENV.some((name) => value(name) !== '') ||
+        CLAUDE_PROVIDER_ENV.some((name) => ['1', 'true', 'yes', 'on'].includes(value(name).toLowerCase())));
+}
+/** The claude.ai org this Claude Code session is signed into, or null when there is none to check. */
+export function readClaudeSignedInTenant(env = process.env) {
+    // Claude Code keeps .claude.json under CLAUDE_CONFIG_DIR when set, so a second account's
+    // directory is checked rather than the default one.
+    const configDir = (env.CLAUDE_CONFIG_DIR || '').trim();
+    const path = configDir ? join(configDir, '.claude.json') : join(homedir(), '.claude.json');
+    if (!existsSync(path) || claudeUsesOtherCredentials(env, configDir))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        const account = parsed?.oauthAccount;
+        const tenantId = typeof account?.organizationUuid === 'string' ? account.organizationUuid.trim() : '';
+        if (!tenantId)
+            return null;
+        const text = (key) => (typeof account?.[key] === 'string' ? account[key].trim() : '');
+        return {
+            tenant_id: tenantId,
+            tenant_name: text('organizationName'),
+            email: text('emailAddress'),
+            account_uuid: text('accountUuid'),
+        };
+    }
+    catch {
+        // Unreadable or mid-write: never lock the user out on a parse failure.
+        return null;
+    }
+}
+/** How to get out of a blocked tenant: Claude Desktop switches organization, Claude Code logs in. */
+function fix(agent, which) {
+    return agent === 'claude_desktop'
+        ? `Switch Claude Desktop to ${which} organization, or sign in to one.`
+        : `Run /login to sign in to ${which} organization.`;
+}
+function label(name, id) {
+    return name ? `${name} (${id})` : id;
+}
+function tenantIds(tenants) {
+    return (tenants ?? []).filter((t) => t && typeof t.tenant_id === 'string' && t.tenant_id.trim());
+}
+/**
+ * The block message when `signedIn` may not be used for `agent`, else null.
+ *
+ * Mirrors the backend's `tenant_approval`: a tenant the organization marked unapproved is always
+ * blocked; a shadow tenant (never decided) only once the agent has at least one approved tenant.
+ * Ids compare exactly, as the backend does -- vendor ids are not ours to case-fold.
+ */
+export function approvedTenantViolation(agent, approved, signedIn) {
+    if (!signedIn)
+        return null;
+    const policy = approved?.[agent];
+    const approvedTenants = tenantIds(policy?.tenants);
+    const unapprovedTenants = tenantIds(policy?.unapproved_tenants);
+    const signedInId = signedIn.tenant_id.trim();
+    const isIn = (list) => list.some((t) => t.tenant_id.trim() === signedInId);
+    let reason;
+    if (isIn(unapprovedTenants)) {
+        reason = 'which your organization has marked unapproved';
+    }
+    else if ((policy?.enforced || approvedTenants.length > 0) && !isIn(approvedTenants)) {
+        reason = 'which your organization has not approved';
+    }
+    else {
+        return null;
+    }
+    const allowed = approvedTenants.map((t) => label(t.tenant_name, t.tenant_id)).join(', ');
+    return (`this session is signed into ${label(signedIn.tenant_name, signedIn.tenant_id)}, ${reason}. ` +
+        (allowed
+            ? `Approved: ${allowed}. ${fix(agent, 'an approved')}`
+            : fix(agent, 'a different')));
+}
+/**
+ * The tenants a Cursor login is in: its teams, or, on no team, `@` and its email domain. Mirrors the
+ * backend's `cursor_tenants`, so an organization can approve its own people's personal accounts.
+ */
+export function cursorTenants(signedIn) {
+    const teams = signedIn.team_ids.map((t) => t.trim()).filter((t) => t.length > 0);
+    if (teams.length)
+        return teams;
+    const email = (signedIn.email ?? '').trim();
+    const at = email.lastIndexOf('@');
+    return at >= 0 && at < email.length - 1 ? [`@${email.slice(at + 1).toLowerCase()}`] : [];
+}
+/** The teams Cursor's signed-in login belongs to, or null when they cannot be read. */
+export function readCursorSignedInTeams(home = homedir()) {
+    const dbPath = vscdbPath(home);
+    if (!existsSync(dbPath))
+        return null;
+    const sqlite3 = resolveSqlite3Binary();
+    if (!sqlite3)
+        return null;
+    const teamIds = readCursorTeamIds(sqlite3, dbPath);
+    return teamIds === null ? null : { team_ids: teamIds, email: readCursorEmail(sqlite3, dbPath) };
+}
+/**
+ * Why a login in these tenants may not be used, or null when it may. Shared by every agent whose
+ * login is a list of tenants (Cursor's teams) or one tenant that may be a personal account's
+ * `@<domain>` (Codex), and mirrors the backend's `team_tenant_approval`: any approved tenant admits
+ * the login; failing that, one marked unapproved is always blocked, and any other -- an unknown
+ * tenant, or a personal account -- only once at least one tenant is approved for this agent.
+ */
+function listedTenantViolation(policy, tenants, noun) {
+    const approvedList = tenantIds(policy?.tenants);
+    if (tenants.some((id) => isListed(approvedList, id)))
+        return null;
+    const what = refusedTenantsText(tenants, noun, approvedList.length > 0 || Boolean(policy?.enforced), tenantIds(policy?.unapproved_tenants));
+    if (what === null)
+        return null;
+    return { what, allowed: approvedList.map((t) => label(t.tenant_name, t.tenant_id)).join(', ') };
+}
+function isListed(list, id) {
+    return list.some((t) => t.tenant_id.trim() === id);
+}
+function describeTenant(id, noun) {
+    return id.startsWith('@') ? `a personal account with an ${id} email` : `${noun} ${id}`;
+}
+/** What the login is signed into and why that is refused, or null when it is not refused. */
+function refusedTenantsText(tenants, noun, enforced, unapprovedList) {
+    const marked = tenants.find((id) => isListed(unapprovedList, id));
+    if (marked)
+        return `${describeTenant(marked, noun)}, which your organization has marked unapproved`;
+    // Not enforced (an older backend that sends no flag) and nothing approved: shadow passes.
+    if (!enforced)
+        return null;
+    if (tenants.length === 0)
+        return `a personal account that is on no ${noun}, which your organization has not approved`;
+    return `${tenants.map((id) => describeTenant(id, noun)).join(', ')}, which your organization has not approved`;
+}
+/** The block message when Cursor's login may not be used, else null. */
+export function cursorTeamViolation(approved, signedIn) {
+    if (!signedIn)
+        return null;
+    const v = listedTenantViolation(approved?.cursor, cursorTenants(signedIn), 'team');
+    if (!v)
+        return null;
+    return (`this Cursor session is signed into ${v.what}. ` +
+        (v.allowed ? `Approved: ${v.allowed}. ` : '') +
+        'Sign out of Cursor and sign in with an account on an approved team.');
+}
+/**
+ * Codex plans that are personal, mirroring the backend's `CodexPlans.PERSONAL`. On one of these
+ * the ChatGPT account is the person's own, so the login is keyed by email domain instead.
+ */
+const CODEX_PERSONAL_PLANS = new Set(['free', 'go', 'plus']);
+/** Codex's login from ~/.codex/auth.json (claims only, never tokens), or null when there is none. */
+export function readCodexSignedIn(home = homedir()) {
+    const identity = readCodexIdentity(home);
+    return identity.auth_mode || identity.email ? identity : null;
+}
+/**
+ * The tenant a Codex login is in, mirroring the backend's `codex_tenants`: its ChatGPT workspace
+ * (`chatgpt_account_id`, the claim Codex's own `forced_chatgpt_workspace_id` checks), or
+ * `@<email domain>` on a personal plan. Null when there is no ChatGPT login (an API key).
+ */
+export function codexTenants(signedIn) {
+    const plan = (signedIn.plan ?? '').trim().toLowerCase();
+    if (CODEX_PERSONAL_PLANS.has(plan)) {
+        const email = (signedIn.email ?? '').trim();
+        const at = email.lastIndexOf('@');
+        return at >= 0 && at < email.length - 1 ? [`@${email.slice(at + 1).toLowerCase()}`] : [];
+    }
+    const account = (signedIn.account_id ?? '').trim();
+    // The collector falls back to the API organization ("org-...") with no ChatGPT account.
+    return account && !account.startsWith('org-') ? [account] : null;
+}
+/** The block message when Codex's login may not be used, else null. */
+export function codexTenantViolation(approved, signedIn) {
+    const tenants = signedIn ? codexTenants(signedIn) : null;
+    if (!tenants)
+        return null;
+    const v = listedTenantViolation(approved?.codex, tenants, 'workspace');
+    if (!v)
+        return null;
+    return (`this Codex session is signed into ${v.what}. ` +
+        (v.allowed ? `Approved: ${v.allowed}. ` : '') +
+        'Run `codex logout`, then sign in to an approved workspace.');
+}
+/**
+ * The org Claude Desktop is signed into now, for its Code tab's prompts, or null when unknown.
+ *
+ * Desktop keeps its own login, apart from Claude Code's ~/.claude.json, and logs every token lookup
+ * as `[oauth-v2] … orgId=<org>` (with `cacheKey=acct:<account>|…` on lookups): the newest such
+ * line is the org Desktop is using. The name and email come from ~/.claude.json only when it is the
+ * same account and org. With no such line (another OS, or a fresh log), ~/.claude.json is used, so
+ * this is never a weaker check than Claude Code's.
+ */
+export function readClaudeDesktopSignedInTenant(home = homedir(), env = process.env) {
+    const fromClaudeCode = readClaudeSignedInTenant(env);
+    const active = readDesktopActiveLogin(home);
+    if (!active)
+        return fromClaudeCode;
+    const { org, account } = active;
+    const same = fromClaudeCode && fromClaudeCode.tenant_id.toLowerCase() === org;
+    return {
+        tenant_id: org,
+        tenant_name: same ? fromClaudeCode.tenant_name : '',
+        email: same ? fromClaudeCode.email : '',
+        account_uuid: account || (same ? fromClaudeCode.account_uuid : ''),
+    };
+}
+/**
+ * The block message when a login's email is on a domain the organization unapproved, else null.
+ *
+ * Unapproving a domain covers every agent and every address on it, and its subdomains
+ * (`mail.acme.com` falls under `acme.com`), the way an approved domain covers them.
+ */
+export function unapprovedEmailDomainViolation(email, unapproved) {
+    const address = (email ?? '').trim().toLowerCase();
+    const at = address.lastIndexOf('@');
+    if (at < 0 || !unapproved?.length)
+        return null;
+    const domain = address.slice(at + 1);
+    const hit = unapproved.find((d) => domain === d || domain.endsWith(`.${d}`));
+    if (!hit)
+        return null;
+    return (`this session is signed in as ${address}, on @${hit}, which your organization has unapproved. ` +
+        'Sign in with an account on an approved email domain.');
+}
+/**
+ * The block message when a login's email is not on the organization's email allowlist, else null.
+ *
+ * The allowlist is the organization's approved email domains; a domain covers its subdomains
+ * (`mail.acme.com` under `acme.com`). Null, so the login is allowed, when no allowlist has been
+ * synced to this machine yet or the login has no email we can read.
+ */
+export function emailAllowlistViolation(email, allowed) {
+    if (!Array.isArray(allowed))
+        return null;
+    const address = (email ?? '').trim().toLowerCase();
+    const at = address.lastIndexOf('@');
+    if (at < 0 || at === address.length - 1)
+        return null;
+    const domain = address.slice(at + 1);
+    if (allowed.some((d) => domain === d || domain.endsWith(`.${d}`)))
+        return null;
+    return (`this session is signed in as ${address}, and @${domain} is not on your organization's email allowlist. ` +
+        'Sign in with an account on an allowed email domain.');
+}
+/** The id an agent is approved under on the Agents page: Desktop's Code tab runs Claude Code. */
+const APPROVAL_ID = { claude_desktop: 'claude' };
+const AGENT_NAME = {
+    claude: 'Claude Code',
+    cursor: 'Cursor',
+    codex: 'Codex',
+    copilot: 'GitHub Copilot',
+    opencode: 'OpenCode',
+};
+/**
+ * The block message when this agent is not one the organization approved (unapproved or not yet
+ * reviewed), else null. Null when no approved-agents list has been synced to this machine yet.
+ */
+export function agentApprovalViolation(agent, approvedAgents) {
+    if (!Array.isArray(approvedAgents))
+        return null;
+    const id = APPROVAL_ID[agent] ?? agent;
+    if (approvedAgents.includes(id))
+        return null;
+    return `${AGENT_NAME[id] ?? id} is not an approved agent in your organization. Ask an admin to approve it.`;
+}