@pipeline-builder/api-server 4.1.22 → 4.1.24

package/lib/http/sse-connection-manager.d.ts

@@ -1,6 +1,7 @@
 import { type SseTicketStore } from '@pipeline-builder/api-core';
 import type { Response } from 'express';
 import type { SSERelay } from './sse-relay.js';
+import { type CreateTicketResult } from './sse-ticket-broker.js';
 /**
  * Event types for SSE logging
  */
@@ -83,8 +84,8 @@ export interface SSEManagerOptions {
      */
     logStream?: boolean;
     /**
-     * TTL for a stream-ownership binding (default: `SSE_STREAM_OWNER_TTL_MS` env or
-     * 1h). Long enough to outlive a build; the producer re-binds as needed.
+     * TTL for a stream-ownership binding (default 1h). Long enough to outlive a
+     * build; the producer re-binds as needed.
      */
     streamOwnerTtlMs?: number;
     /**
@@ -110,14 +111,7 @@ export interface SSEManagerOptions {
  * both validate the subject identically.
  */
 export declare const SSE_REQUEST_ID_RE: RegExp;
-/** Result of {@link SSEManager.createTicket}. */
-export type CreateTicketResult = {
-    ok: true;
-    ticket: string;
-} | {
-    ok: false;
-    reason: 'org-limit' | 'capacity' | 'forbidden';
-};
+export type { CreateTicketResult };
 /**
  * SSE Manager statistics
  */
@@ -150,17 +144,11 @@ export declare class SSEManager {
      *  map mirrors `clients[].orgId` counts at all times. Orgs reach zero are
      *  deleted to keep the map bounded. */
     private orgClientCounts;
-    /** Injected ticket + stream-ownership backend, or the lazily built in-memory default. */
-    private ticketStoreInstance?;
-    /** True when this manager built its ticket store (so shutdown stops it). */
-    private ownsTicketStore;
+    /** Ticket minting / redemption + stream ownership (see ./sse-ticket-broker.ts). */
+    private readonly tickets;
     private readonly maxClientsPerRequest;
     private readonly maxTotalClients;
     private readonly maxClientsPerOrg;
-    private readonly maxTotalTickets;
-    private readonly maxTicketsPerOrg;
-    private readonly ticketTtlMs;
-    private readonly streamOwnerTtlMs;
     private readonly clientTimeoutMs;
     private cleanupInterval;
     /** Cross-pod fan-out bus (undefined ⇒ local-only delivery). */
@@ -178,8 +166,6 @@ export declare class SSEManager {
      * factory returns null (Redis not configured → local-only delivery).
      */
     enableRelay(): void;
-    /** The ticket store, building the in-memory default on first use. */
-    private get ticketStore();
     /**
      * Handle a frame received from another pod via the relay. We already delivered
      * our OWN frames to local clients before publishing, so ignore our echo. A
@@ -199,76 +185,20 @@ export declare class SSEManager {
     /** Current open-stream count for an org (0 if unseen). */
     getOrgClientCount(orgId: string): number;
     /**
-     * Canonical form of a requestId for equality checks: dashes stripped and
-     * lowercased, so the dashed (api-server `uuid()`) and undashed (nginx
-     * `$request_id`) renderings of the same id compare equal. Callers are
-     * expected to have already format-validated against {@link SSE_REQUEST_ID_RE}.
-     */
-    private static normalizeRequestId;
-    /**
-     * Canonical form of an orgId for ownership equality checks: trimmed and
-     * lowercased. The stream PRODUCER (bindStreamOwner) and the ticket-minting
-     * CONSUMER (createTicket) run in different services, so a casing / whitespace
-     * drift between how each renders the same org would otherwise make the owner
-     * comparison in {@link createTicket} false-`forbidden` the real owner.
-     * Normalizing both sides — mirroring {@link normalizeRequestId} — closes that.
-     */
-    private static normalizeOrgId;
-    /**
-     * Record the org that OWNS a stream subject. The stream PRODUCER calls this
-     * when it creates a build-log stream so that ticket minting can assert the
-     * caller's org owns the subject (see {@link createTicket}). Backed by the
-     * injected ticket store, so when a Redis store is wired the platform producer
-     * (a different service sharing the same Redis) can bind ownership that this
-     * service reads — closing the cross-tenant attach gap where any org could mint
-     * a ticket for a guessed requestId.
-     *
-     * @param requestId - The stream subject (format-validated by the caller).
-     * @param orgId - The owning org (normalized internally via normalizeOrgId).
+     * Record the org that OWNS a stream subject, so ticket minting can refuse a
+     * cross-tenant mint. Delegates to the ticket broker.
      */
     bindStreamOwner(requestId: string, orgId: string): Promise<void>;
     /**
-     * Mint a short-lived, single-use SSE ticket bound to `orgId` AND a specific
-     * stream subject (`requestId`). Clients POST to obtain one (JWT-authenticated)
-     * for the exact stream they intend to open, then open the EventSource with
-     * `?ticket=<t>` so the JWT never lands in a query string / access log. The
-     * ticket can then only be consumed to open that one subject's stream — see
-     * {@link consumeTicket} — which is what enforces per-subject authorization.
-     *
-     * ORG-OWNERSHIP: if a stream owner has been bound for this subject (via
-     * {@link bindStreamOwner}) and it is a DIFFERENT org, minting is refused
-     * (`reason: 'forbidden'`) — an org cannot mint a ticket for another org's
-     * stream even if it guesses the requestId. When no owner is bound (producer
-     * wiring not yet present), minting falls back to binding the ticket to the
-     * caller's own org, preserving current behavior.
-     *
-     * Bounded by the ticket store's live-ticket caps (total and per org). An
-     * ownership lookup the store can't answer is refused as `capacity`.
-     *
-     * @param orgId - Owning org (normalized internally via normalizeOrgId).
-     * @param requestId - The build-log stream subject this ticket authorizes.
-     *   The caller must have format-validated it (see {@link SSE_REQUEST_ID_RE}).
-     * @returns `{ ok: true, ticket }` on success, or `{ ok: false, reason }`
-     *   where reason is `'org-limit'`, `'capacity'`, or `'forbidden'`.
+     * Mint a short-lived, single-use ticket bound to `orgId` AND this stream
+     * subject — how a browser opens an EventSource without putting its JWT in a
+     * query string. Delegates to the ticket broker, which owns the ownership and
+     * cap rules.
      */
     createTicket(orgId: string, requestId: string): Promise<CreateTicketResult>;
     /**
-     * Validate and CONSUME a ticket for a specific stream subject. Single-use:
-     * the ticket is deleted whether or not it turns out to be valid, so a replay
-     * of the same value always fails. Returns the bound org on success, or null
-     * when the ticket is unknown / already-used / expired / OR was minted for a
-     * DIFFERENT `requestId` than the one being opened.
-     *
-     * The subject check is the authorization fix: without it, a ticket minted for
-     * one stream could be presented to open ANY stream the holder's org could
-     * name, letting an authenticated org attach to another org's log stream by
-     * guessing its requestId. The generic 401 the caller returns does not
-     * distinguish "unknown ticket" from "wrong subject", so it leaks nothing
-     * about which requestIds exist.
-     *
-     * @param ticketId - The opaque ticket value from `?ticket=`.
-     * @param requestId - The stream subject from the URL path (`:requestId`),
-     *   already format-validated by the caller.
+     * Validate and CONSUME a ticket for a specific stream subject (single-use,
+     * subject-bound). Delegates to the ticket broker.
      */
     consumeTicket(ticketId: string, requestId: string): Promise<{
         orgId: string;