@qontinui/ui-bridge 0.21.0 → 0.21.1

package/dist/server/index.mjs

@@ -25865,7 +25865,12 @@ function handleRelayRoute(method, path, request, relay, config) {
           400
         );
       }
-      relay.recordRegistration(heartbeatTabId, { userId, sessionId });
+      const callerUserId = request.headers.get("x-caller-user-id") ?? request.headers.get("X-Caller-User-Id") ?? void 0;
+      const registration = relay.recordRegistration(
+        heartbeatTabId,
+        { userId, sessionId },
+        { callerUserId }
+      );
       relay.receiveHeartbeat(heartbeatTabId, {
         url: typeof body?.url === "string" ? body.url : void 0,
         title: typeof body?.title === "string" ? body.title : void 0,
@@ -25875,7 +25880,15 @@ function handleRelayRoute(method, path, request, relay, config) {
       const tabRegistered = diag.connectedTabs.includes(heartbeatTabId);
       return jsonResponse({
         success: true,
-        data: { received: true, tabRegistered },
+        data: {
+          received: true,
+          tabRegistered,
+          // Observability: signals an ownership claim/transfer was refused
+          // because the claimed userId was not auth-proven. Not a fatal
+          // heartbeat error — the loop continues; the tab simply keeps its
+          // prior (or no) owner. Absent when ownership was assigned.
+          ...registration.ownershipAssigned ? {} : { ownershipAssigned: false, ownerChangeRejected: registration.rejectedReason }
+        },
         timestamp: Date.now()
       });
     })();
@@ -29125,20 +29138,52 @@ var CommandRelay = class {
    * has been called for it. `listOwnedTabs`, `assertOwnership`, and the
    * bus-envelope receiver check all key off this map.
    *
-   * Re-registration under a DIFFERENT `userId` is permitted (e.g. a tab
-   * survives a re-login) — the entry is overwritten in place. This is
-   * the safe path: the alternative (reject + force a reconnect) would
-   * leave the tab unaddressable until the SSE stream re-establishes,
-   * which is strictly worse for the operator UX. The new ownership
-   * takes effect on the next dispatch.
-   */
-  recordRegistration(tabId, metadata) {
+   * Re-registration under a DIFFERENT `userId` (e.g. a tab survives a
+   * re-login) is permitted ONLY when the new user is AUTH-PROVEN, not
+   * merely asserted. `metadata.userId` rides in the (browser-supplied)
+   * heartbeat body and is therefore untrusted on its own: without a
+   * proof gate, anyone who learns a victim's `tabId` could POST a
+   * heartbeat claiming any `userId` and silently seize ownership of the
+   * tab (and with it the ability to drive it / settle its commands).
+   *
+   * `options.callerUserId` is the identity the consumer's auth gate
+   * proved and injected as `X-Caller-User-Id` (never a browser value).
+   * The rule:
+   *
+   *   - Same-owner heartbeat (existing owner === claimed userId): always
+   *     a refresh — `sessionId`/`lastSeen` updated in place. No proof
+   *     needed; you already hold the tab and the claim matches.
+   *   - TRANSFER (a DIFFERENT user already owns the tab): the claimed
+   *     `userId` MUST be auth-proven and equal to `callerUserId`. An
+   *     unauthenticated (`callerUserId` absent) or mismatched claim is
+   *     REFUSED and the prior owner is left untouched — this is the
+   *     takeover primitive being closed. A genuine re-login carries the
+   *     new user's proven identity and therefore still transfers.
+   *   - First CLAIM (tab has no owner yet — bootstrap): honored, so a
+   *     header-less / single-trust-domain deployment can still register
+   *     tabs. A *present* proven identity must still match the claimed
+   *     `userId` (you cannot bootstrap a tab under an identity you
+   *     cannot back).
+   *
+   * Returns whether ownership was (re)assigned so the HTTP layer can
+   * surface the refusal without bricking the heartbeat loop.
+   */
+  recordRegistration(tabId, metadata, options) {
     const now = Date.now();
+    const proven = options?.callerUserId;
+    if (proven != null && proven !== metadata.userId) {
+      return { ownershipAssigned: false, rejectedReason: "OWNER_CHANGE_UNVERIFIED" };
+    }
     const existing = this.tabOwnership.get(tabId);
     if (existing && existing.userId === metadata.userId) {
       existing.sessionId = metadata.sessionId;
       existing.lastSeen = now;
-      return;
+      return { ownershipAssigned: true };
+    }
+    if (existing) {
+      if (proven == null) {
+        return { ownershipAssigned: false, rejectedReason: "OWNER_CHANGE_UNVERIFIED" };
+      }
     }
     this.tabOwnership.set(tabId, {
       userId: metadata.userId,
@@ -29146,6 +29191,7 @@ var CommandRelay = class {
       firstSeen: existing?.firstSeen ?? now,
       lastSeen: now
     });
+    return { ownershipAssigned: true };
   }
   /**
    * Return the stored ownership record for a tab, or `null` if the tab