@powerhousedao/switchboard 6.2.3-dev.45 → 6.2.3-dev.47

package/CHANGELOG.md

@@ -1,3 +1,25 @@
+## 6.2.3-dev.47 (2026-10-07)
+
+This was a version bump only for @powerhousedao/switchboard to align it with other projects, there were no code changes.
+
+## 6.2.3-dev.46 (2026-10-07)
+
+### 🚀 Features
+
+- **connect:** load local project models in the reactor worker ([6e2929ce60](https://github.com/powerhouse-inc/powerhouse/commit/6e2929ce60))
+
+### 🩹 Fixes
+
+- **builder-tools:** make the worker bundle survive consumer projects ([6361a66b6d](https://github.com/powerhouse-inc/powerhouse/commit/6361a66b6d))
+- **builder-tools:** assert the vendor-dir mode only where modes exist ([f47c32a020](https://github.com/powerhouse-inc/powerhouse/commit/f47c32a020))
+- **switchboard:** never let observability lower a fatal exit code ([0498342d22](https://github.com/powerhouse-inc/powerhouse/commit/0498342d22))
+- **switchboard:** survive a logger that fails during fatal shutdown ([ecc8975282](https://github.com/powerhouse-inc/powerhouse/commit/ecc8975282))
+
+### ❤️ Thank You
+
+- Claude Fable 5
+- Wouter Kampmann
+
 ## 6.2.3-dev.45 (2026-10-06)
 
 ### 🚀 Features

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@powerhousedao/switchboard",
   "type": "module",
-  "version": "6.2.3-dev.45",
+  "version": "6.2.3-dev.47",
   "main": "dist/index.mjs",
   "exports": {
     ".": {
@@ -41,7 +41,7 @@
     "@openfeature/core": "1.9.1",
     "@openfeature/env-var-provider": "0.3.1",
     "@openfeature/server-sdk": "1.19.0",
-    "@powerhousedao/config": "6.2.3-dev.45",
+    "@powerhousedao/config": "6.2.3-dev.47",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
@@ -55,22 +55,22 @@
     "@opentelemetry/sdk-node": "^0.218.0",
     "@opentelemetry/sdk-trace-base": "^2.7.1",
     "@opentelemetry/semantic-conventions": "^1.41.1",
-    "@powerhousedao/opentelemetry-instrumentation-reactor": "6.2.3-dev.45",
-    "@powerhousedao/reactor": "6.2.3-dev.45",
-    "@powerhousedao/shared": "6.2.3-dev.45",
-    "@powerhousedao/vetra": "6.2.3-dev.45",
-    "@powerhousedao/reactor-api": "6.2.3-dev.45",
-    "@powerhousedao/reactor-attachments": "6.2.3-dev.45",
-    "@powerhousedao/reactor-drive": "6.2.3-dev.45",
-    "@powerhousedao/reactor-group": "6.2.3-dev.45",
-    "@powerhousedao/reactor-privacy": "6.2.3-dev.45",
-    "@powerhousedao/reactor-workflow": "6.2.3-dev.45",
-    "@powerhousedao/workflow": "6.2.3-dev.45",
+    "@powerhousedao/opentelemetry-instrumentation-reactor": "6.2.3-dev.47",
+    "@powerhousedao/reactor": "6.2.3-dev.47",
+    "@powerhousedao/shared": "6.2.3-dev.47",
+    "@powerhousedao/vetra": "6.2.3-dev.47",
+    "@powerhousedao/reactor-api": "6.2.3-dev.47",
+    "@powerhousedao/reactor-attachments": "6.2.3-dev.47",
+    "@powerhousedao/reactor-drive": "6.2.3-dev.47",
+    "@powerhousedao/reactor-group": "6.2.3-dev.47",
+    "@powerhousedao/reactor-privacy": "6.2.3-dev.47",
+    "@powerhousedao/reactor-workflow": "6.2.3-dev.47",
+    "@powerhousedao/workflow": "6.2.3-dev.47",
     "@pyroscope/nodejs": "^0.4.5",
-    "@renown/sdk": "6.2.3-dev.45",
+    "@renown/sdk": "6.2.3-dev.47",
     "@sentry/node": "^10.53.1",
     "@sentry/opentelemetry": "^10.53.1",
-    "document-model": "6.2.3-dev.45",
+    "document-model": "6.2.3-dev.47",
     "dotenv": "^16.4.7",
     "express": "^4.22.1",
     "graphql": "^16",

package/test/workflow-read-gate.test.ts

@@ -1,21 +1,41 @@
+import { PGlite } from "@electric-sql/pglite";
 import {
   ReactorBuilder,
   ReactorClientBuilder,
   type InProcessReactorClientModule,
 } from "@powerhousedao/reactor";
-import { AuthorizationPolicy, type Context } from "@powerhousedao/reactor-api";
+import {
+  AuthorizationPolicy,
+  type Context,
+  type IAuthorizationService,
+} from "@powerhousedao/reactor-api";
+import * as engine from "@powerhousedao/reactor-workflow";
+import type { WorkflowRuntimeService } from "@powerhousedao/reactor-workflow";
 import {
   initializeAuth,
   withSignaturePolicy,
   type DocumentModelModule,
 } from "@powerhousedao/shared/document-model";
+import {
+  createRelationalDb,
+  type IRelationalDb,
+} from "@powerhousedao/shared/processors";
+import { Connection } from "@powerhousedao/workflow/document-models/connection";
 import type { ILogger } from "document-model";
 import { documentModelDocumentModelModule } from "document-model";
+import { Kysely } from "kysely";
+import { PGliteDialect } from "kysely-pglite-dialect";
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { composeWorkflowRuntime } from "../src/workflow-runtime.mjs";
+import {
+  composeWorkflowRuntime,
+  type ComposedWorkflowRuntime,
+} from "../src/workflow-runtime.mjs";
 
 const READER = "0xreader";
+const WRITER = "0xwriter";
 const OUTSIDER = "0xoutsider";
+const DOCUMENT = "wf-policed";
+const CONNECTION = "conn-policed";
 
 // The host's legacy layer under OPEN admits everyone, anonymous included.
 const openAuthorization = {
@@ -29,6 +49,19 @@ const openAuthorization = {
   canWrite: () => Promise.resolve(true),
 };
 
+// Document permissions: everyone reads, only the writer writes.
+const writerOnlyAuthorization = {
+  config: {
+    admins: [],
+    defaultProtection: false,
+    policy: AuthorizationPolicy.DOCUMENT_PERMISSIONS,
+  },
+  isSupremeAdmin: () => false,
+  canRead: () => Promise.resolve(true),
+  canWrite: (_id: string, address?: string) =>
+    Promise.resolve(address === WRITER),
+};
+
 const logger = {
   verbose: vi.fn(),
   debug: vi.fn(),
@@ -41,20 +74,56 @@ const logger = {
 const contextFor = (address?: string) =>
   ({ headers: {}, db: {}, user: address ? { address } : undefined }) as Context;
 
-describe("the workflow runtime's read check", () => {
+const readerOnly = (id: string) =>
+  initializeAuth({
+    version: 1,
+    grants: [
+      {
+        id: `${id}-read`,
+        description: "the reader reads the domain",
+        effect: "allow",
+        principal: { address: READER },
+        capability: { can: "read", scope: "global" },
+      },
+      {
+        id: `${id}-admin`,
+        description: "administration stays reachable",
+        effect: "allow",
+        principal: { anyone: true },
+        capability: { can: "execute", scope: "auth" },
+      },
+    ],
+  });
+
+describe("the workflow runtime's access checks", () => {
   let module: InProcessReactorClientModule | undefined;
+  let composed: ComposedWorkflowRuntime | undefined;
+  let database: Kysely<unknown> | undefined;
 
-  afterEach(() => {
-    module?.reactor.kill();
+  afterEach(async () => {
+    await composed?.stop();
+    await module?.reactor.kill().completed;
+    await database?.destroy();
+    composed = undefined;
     module = undefined;
+    database = undefined;
   });
 
-  async function hostDeps() {
+  // The real engine, composed as the host composes it; the runtime it builds
+  // is kept so the tests can call it as the subgraph would.
+  async function hostRuntime(
+    authorizationService: Pick<
+      IAuthorizationService,
+      "config" | "isSupremeAdmin" | "canRead" | "canWrite"
+    >,
+    options: { policed: boolean },
+  ): Promise<WorkflowRuntimeService> {
     module = await new ReactorClientBuilder()
       .withReactorBuilder(
         new ReactorBuilder()
           .withDocumentModelSources([
             documentModelDocumentModelModule as unknown as DocumentModelModule,
+            Connection as unknown as DocumentModelModule,
           ])
           .withExecutorConfig({
             featureFlags: { documentDecisions: true, authEnforcement: true },
@@ -62,84 +131,80 @@ describe("the workflow runtime's read check", () => {
       )
       .buildModule();
     const client = module.client;
-    const id = "wf-policed";
     await client.create(
       withSignaturePolicy(
         documentModelDocumentModelModule.utils.createDocument(),
         "legacy",
-        { id },
+        { id: DOCUMENT },
       ),
     );
-    await client.execute(id, "main", [
-      initializeAuth({
-        version: 1,
-        grants: [
-          {
-            id: "g-read",
-            description: "the reader reads the domain",
-            effect: "allow",
-            principal: { address: READER },
-            capability: { can: "read", scope: "global" },
-          },
-          {
-            id: "g-admin",
-            description: "administration stays reachable",
-            effect: "allow",
-            principal: { anyone: true },
-            capability: { can: "execute", scope: "auth" },
-          },
-        ],
+    await client.create(
+      withSignaturePolicy(Connection.utils.createDocument(), "legacy", {
+        id: CONNECTION,
       }),
-    ]);
+    );
+    if (options.policed) {
+      await client.execute(DOCUMENT, "main", [readerOnly(DOCUMENT)]);
+      await client.execute(CONNECTION, "main", [readerOnly(CONNECTION)]);
+    }
 
-    const createWorkflowRuntime = vi.fn((_deps: Record<string, unknown>) => ({
-      shutdown: vi.fn(),
-    }));
-    await composeWorkflowRuntime({
+    database = new Kysely<unknown>({
+      dialect: new PGliteDialect(new PGlite()),
+    });
+    let runtime: WorkflowRuntimeService | undefined;
+    composed = await composeWorkflowRuntime({
       reactorClient: client,
-      relationalDb: {} as never,
+      relationalDb: createRelationalDb(database) as IRelationalDb,
       attachments: {} as never,
-      authorizationService: openAuthorization as never,
+      authorizationService: authorizationService as never,
       logger,
       load: () =>
         Promise.resolve({
-          WORKFLOW_PACKAGE_NAME: "@powerhousedao/workflow",
-          setPieceRegistryUrl: vi.fn(),
-          createWorkflowRuntime,
-        } as never),
+          ...engine,
+          createWorkflowRuntime: (deps) =>
+            (runtime = engine.createWorkflowRuntime(deps)),
+        }),
     });
-    const [deps] = createWorkflowRuntime.mock.calls[0]!;
-    return {
-      id,
-      deps: deps as {
-        assertCanRead: (id: string, caller: object) => Promise<unknown>;
-        subjectOf: (caller: object) => unknown;
-      },
-    };
+    return runtime!;
   }
 
   it("refuses under OPEN a document the caller is not served", async () => {
-    const { id, deps } = await hostDeps();
+    const runtime = await hostRuntime(openAuthorization, { policed: true });
 
-    await expect(deps.assertCanRead(id, contextFor())).rejects.toThrow();
     await expect(
-      deps.assertCanRead(id, contextFor(OUTSIDER)),
+      runtime.cancelTriggerTestFor(DOCUMENT, contextFor()),
+    ).rejects.toThrow();
+    await expect(
+      runtime.cancelTriggerTestFor(DOCUMENT, contextFor(OUTSIDER)),
     ).rejects.toThrow();
     await expect(
-      deps.assertCanRead(id, contextFor(READER)),
-    ).resolves.toBeUndefined();
+      runtime.cancelTriggerTestFor(DOCUMENT, contextFor(READER)),
+    ).resolves.toBe(false);
   });
 
-  it("reads a caller as its own subject, anonymous as the empty one", async () => {
-    const { deps } = await hostDeps();
+  it("lists a connection only to the callers it is served to", async () => {
+    const runtime = await hostRuntime(openAuthorization, { policed: true });
+    const listed = async (address?: string) =>
+      (await runtime.connections(contextFor(address))).map(({ id }) => id);
 
-    expect(deps.subjectOf(contextFor(READER))).toEqual({
-      address: READER,
-      key: undefined,
-    });
-    expect(deps.subjectOf(contextFor())).toEqual({
-      address: undefined,
-      key: undefined,
+    expect(await listed(READER)).toEqual([CONNECTION]);
+    expect(await listed(OUTSIDER)).toEqual([]);
+    expect(await listed()).toEqual([]);
+  });
+
+  it("refuses a write the host's permissions deny", async () => {
+    const runtime = await hostRuntime(writerOnlyAuthorization, {
+      policed: false,
     });
+    const startOAuth = (address: string) =>
+      runtime.startOAuth(CONNECTION, contextFor(address), {
+        redirectUri: "https://host/oauth/callback",
+      });
+
+    await expect(startOAuth(READER)).rejects.toThrow("to write this document");
+    // Past the gate: refused for what the connection is, not who asked.
+    await expect(startOAuth(WRITER)).rejects.toThrow(
+      "does not sign in with OAuth2",
+    );
   });
 });