@pikku/kysely 0.13.1 → 0.13.2

package/CHANGELOG.md

@@ -1,3 +1,48 @@
+## 0.13.2
+
+### Patch Changes
+
+- 4324652: Scope AI agent thread reads to the calling session.
+
+  The generated thread-management functions (`getAgentThreads`,
+  `getAgentThreadMessages`, `getAgentThreadRuns`, `deleteAgentThread`) keyed purely
+  off a caller-supplied `threadId` and treated `resourceId` as an optional filter,
+  so omitting it enumerated every tenant's threads.
+  - `listThreads` gains an `owners` **authorization constraint** (distinct from the
+    `resourceId` filter): an empty array matches nothing, and it is always derived
+    from the session, never from input. Implemented across the Kysely, Redis and
+    MongoDB agent run services, with LIKE/regex metacharacter escaping so an owner
+    id containing `_` or `%` cannot match a foreign owner.
+  - The three `threadId`-keyed functions are now guarded by an `isThreadOwner`
+    `pikkuPermission` rather than an in-body check. A thread that does not exist is
+    denied rather than 404'd, so it is indistinguishable from one owned by someone
+    else.
+  - New `@pikku/core/ai-agent` helpers: `canAccessThread`, `threadOwnerConstraint`,
+    `sessionPrincipals`, `isOwnedByPrincipal`.
+
+  Services destructured by a wired function are now non-optional inside it.
+
+  The inspector already aggregated the services used by every wired `func`,
+  `permissions` and `middleware` into `RequiredSingletonServices`, but the
+  generated function types defaulted their service parameter to the raw `Services`
+  — so a service declared `foo?: Foo` still arrived as possibly-undefined, forcing
+  `if (!foo) throw new MissingServiceError(...)` guards that could never fire.
+  Generated types now expose `WiredSingletonServices` / `WiredServices`
+  (`RequiredSingletonServices & Services`) and default the `RequiredServices`
+  generic of functions, permissions, middleware, auth and approval-description
+  helpers to them. Optionality now means only what it should: "this service may
+  not be created, because nothing uses it".
+
+- Updated dependencies [5f19016]
+- Updated dependencies [78e4778]
+- Updated dependencies [4324652]
+- Updated dependencies [de044f8]
+- Updated dependencies [cd1a811]
+- Updated dependencies [19fa6f0]
+- Updated dependencies [b501612]
+- Updated dependencies [eb37b1e]
+  - @pikku/core@0.12.66
+
 ## 0.13.1
 
 ### Patch Changes

package/dist/src/kysely-ai-agent-run-service.d.ts

@@ -7,6 +7,7 @@ export declare class KyselyAgentRunService implements AgentRunService {
     listThreads(options?: {
         agentName?: string;
         resourceId?: string;
+        owners?: string[];
         limit?: number;
         offset?: number;
     }): Promise<AIThread[]>;

package/dist/src/kysely-ai-agent-run-service.js

@@ -1,11 +1,19 @@
+import { sql } from 'kysely';
 import { parseJson } from './kysely-json.js';
+// Owner ids routinely contain `_` (e.g. `user_123`), which LIKE treats as a
+// single-character wildcard — so a raw prefix would match a foreign owner.
+const escapeLikePattern = (value) => value.replace(/[\\%_]/g, (char) => `\\${char}`);
 export class KyselyAgentRunService {
     db;
     constructor(db) {
         this.db = db;
     }
     async listThreads(options) {
-        const { agentName, resourceId, limit = 50, offset = 0 } = options ?? {};
+        const { agentName, resourceId, owners, limit = 50, offset = 0, } = options ?? {};
+        // An owners constraint is an authorization boundary, so an empty list must
+        // match nothing rather than degrade to "no filter".
+        if (owners && owners.length === 0)
+            return [];
         let query = this.db
             .selectFrom('aiThreads as t')
             .select([
@@ -26,6 +34,12 @@ export class KyselyAgentRunService {
         if (resourceId) {
             query = query.where('t.resourceId', '=', resourceId);
         }
+        if (owners) {
+            query = query.where((eb) => eb.or(owners.flatMap((owner) => [
+                eb('t.resourceId', '=', owner),
+                eb('t.resourceId', 'like', sql `${`${escapeLikePattern(owner)}:%`} escape '\\'`),
+            ])));
+        }
         const result = await query
             .orderBy('t.updatedAt', 'desc')
             .limit(limit)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/kysely",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
   "module": "dist/src/index.js",
@@ -20,7 +20,7 @@
     "prepublishOnly": "yarn build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.64"
+    "@pikku/core": "^0.12.66"
   },
   "dependencies": {
     "kysely": "^0.29.0"

package/src/kysely-ai-agent-run-service.ts

@@ -5,19 +5,36 @@ import type {
   AgentRunService,
 } from '@pikku/core/ai-agent'
 import type { Kysely } from 'kysely'
+import { sql } from 'kysely'
 import type { KyselyPikkuDB } from './kysely-tables.js'
 import { parseJson } from './kysely-json.js'
 
+// Owner ids routinely contain `_` (e.g. `user_123`), which LIKE treats as a
+// single-character wildcard — so a raw prefix would match a foreign owner.
+const escapeLikePattern = (value: string) =>
+  value.replace(/[\\%_]/g, (char) => `\\${char}`)
+
 export class KyselyAgentRunService implements AgentRunService {
   constructor(private db: Kysely<KyselyPikkuDB>) {}
 
   async listThreads(options?: {
     agentName?: string
     resourceId?: string
+    owners?: string[]
     limit?: number
     offset?: number
   }): Promise<AIThread[]> {
-    const { agentName, resourceId, limit = 50, offset = 0 } = options ?? {}
+    const {
+      agentName,
+      resourceId,
+      owners,
+      limit = 50,
+      offset = 0,
+    } = options ?? {}
+
+    // An owners constraint is an authorization boundary, so an empty list must
+    // match nothing rather than degrade to "no filter".
+    if (owners && owners.length === 0) return []
 
     let query = this.db
       .selectFrom('aiThreads as t')
@@ -46,6 +63,21 @@ export class KyselyAgentRunService implements AgentRunService {
       query = query.where('t.resourceId', '=', resourceId)
     }
 
+    if (owners) {
+      query = query.where((eb) =>
+        eb.or(
+          owners.flatMap((owner) => [
+            eb('t.resourceId', '=', owner),
+            eb(
+              't.resourceId',
+              'like',
+              sql<string>`${`${escapeLikePattern(owner)}:%`} escape '\\'`
+            ),
+          ])
+        )
+      )
+    }
+
     const result = await query
       .orderBy('t.updatedAt', 'desc')
       .limit(limit)