@saluzi/saluzi-edu 0.2.63 → 0.2.65

package/packages/remote-control-server/src/db/rcs-schema.sql

@@ -90,7 +90,8 @@ CREATE TABLE IF NOT EXISTS environments (
   created_at TEXT NOT NULL,
   owner_user_id TEXT,
   claim_token TEXT,
-  claim_expires_at TEXT
+  claim_expires_at TEXT,
+  session_mode TEXT
 );
 
 CREATE TABLE IF NOT EXISTS sessions (

package/packages/remote-control-server/src/db/sqlite.ts

@@ -208,6 +208,7 @@ function migrateEnvironmentsColumns(db: Database): void {
   addIfMissing('owner_user_id', 'TEXT')
   addIfMissing('claim_token', 'TEXT')
   addIfMissing('claim_expires_at', 'TEXT')
+  addIfMissing('session_mode', 'TEXT')
 }
 
 /**

package/packages/remote-control-server/src/routes/v1/environments.ts

@@ -1,93 +1,28 @@
 import { Hono } from 'hono'
-import type { Context, Next } from 'hono'
 import { randomUUID } from 'node:crypto'
 import {
   registerEnvironment,
   deregisterEnvironment,
   reconnectEnvironment,
+  updatePollTime,
 } from '../../services/environment'
+import { acceptCliHeaders, apiKeyAuth } from '../../auth/middleware'
 import {
-  apiKeyAuth,
-  acceptCliHeaders,
-  extractBearerToken,
-} from '../../auth/middleware'
-import { validateApiKey } from '../../auth/api-key'
-import { resolveToken } from '../../auth/token'
-import { resolveSessionToken } from '../../auth/session'
+  bridgeAuth,
+  resolveAttachCaller,
+  resolveUserIdUuid,
+} from '../../auth/bridge-auth'
 import { getDb } from '../../db/sqlite'
+import { isSessionClosedStatus } from '../../services/session'
 import {
   storeBindEnvSessionsToTeam,
   storeGetEnvironment,
   storeGetEnvironmentOwnership,
+  storeListSessionsByEnvironment,
 } from '../../store'
 
 const app = new Hono()
 
-/**
- * Combined auth for bridge endpoint: accepts session tokens (rct_*),
- * in-memory issueToken tokens, or admin API keys. Also falls back to
- * apiKeyAuth's X-Username header support for CLI bridges.
- */
-async function bridgeAuth(c: Context, next: Next) {
-  const bearer = extractBearerToken(c)
-  if (bearer) {
-    // Admin API key
-    if (validateApiKey(bearer)) {
-      c.set('userId', c.req.header('X-Username') || c.req.query('username'))
-      c.set('isApiAdmin', true)
-      await next()
-      return
-    }
-    // In-memory token
-    const username = resolveToken(bearer)
-    if (username) {
-      c.set('userId', username)
-      await next()
-      return
-    }
-    // SQLite session token
-    try {
-      const db = getDb()
-      const userId = resolveSessionToken(bearer, db)
-      if (userId) {
-        c.set('userId', userId)
-        await next()
-        return
-      }
-    } catch (err) {
-      console.error('[bridge] DB error during session token resolution:', err)
-      return c.json({ error: 'Database unavailable' }, 503)
-    }
-  }
-  // Fall back to apiKeyAuth (handles X-Username + API key from body/header)
-  return apiKeyAuth(c, next)
-}
-
-/**
- * Resolve a userId value (UUID or username) to a users.id UUID.
- * Returns null if no matching user exists.
- *
- * bridgeAuth's three token paths return different userId shapes:
- * - resolveSessionToken (rct_* SQLite token) → users.id (UUID)
- * - resolveToken (in-memory token) → username (string)
- * - validateApiKey + X-Username → X-Username header value (arbitrary string)
- *
- * Only UUIDs that exist in the users table can become env owners, so a
- * client-controlled X-Username value can't create an owner for a
- * non-existent user — resolveUserIdUuid is the safety gate.
- */
-function resolveUserIdUuid(
-  db: ReturnType<typeof getDb>,
-  value: string,
-): string | null {
-  const row = db
-    .query(
-      'SELECT id FROM users WHERE id = $value OR username = $value LIMIT 1',
-    )
-    .get({ $value: value }) as { id: string } | null
-  return row?.id ?? null
-}
-
 /** Result of validateTeamBinding — rendered by the route layer. */
 type TeamBindingCheck =
   | { ok: true; audit?: string }
@@ -299,6 +234,10 @@ app.post('/bridge', acceptCliHeaders, bridgeAuth, async c => {
     teamId: teamId || null,
     claimToken,
     claimExpiresAt,
+    // Session Attach wait mode: worker registered without creating a session,
+    // polling for the Web UI to bind one (surfaces as attach_waiting).
+    session_mode:
+      typeof body.session_mode === 'string' ? body.session_mode : null,
   })
 
   // Link environment to team if X-Team-Id was provided
@@ -342,6 +281,91 @@ app.post('/bridge', acceptCliHeaders, bridgeAuth, async c => {
   return c.json(result, 200)
 })
 
+/** GET /v1/environments/:id/assignment — Session Attach wait-mode poll.
+ *  A worker registered with session_mode:'attach' polls this endpoint while
+ *  waiting for the Web UI to bind a session (POST /v1/sessions/:id/attach).
+ *  Returns the first open, non-ACP session on the environment, or
+ *  assigned:false to keep waiting. Long-polling is unnecessary — the worker
+ *  already runs a poll loop cadence for work items.
+ *  Access: the env owner (the polling worker itself) or an admin. */
+app.get('/:id/assignment', acceptCliHeaders, bridgeAuth, async c => {
+  const envId = c.req.param('id')!
+  const env = storeGetEnvironment(envId)
+  if (!env || env.status !== 'active') {
+    return c.json(
+      { error: { type: 'not_found', message: 'Environment not found' } },
+      404,
+    )
+  }
+
+  // Ownership gate: assignment discloses the env's bound session AND doubles
+  // as its liveness signal (updatePollTime below) — both are restricted to
+  // the env owner (the wait-mode worker polls under the same identity it
+  // registered with) and admins. Unowned envs (claim pending) stay open:
+  // nothing is bound yet, so there is nothing to disclose or keep alive.
+  const caller = resolveAttachCaller(c)
+  if (caller.dbUnavailable) {
+    return c.json(
+      {
+        error: {
+          type: 'database_unavailable',
+          message: 'Database unavailable',
+        },
+      },
+      503,
+    )
+  }
+  let ownerUserId: string | null = null
+  try {
+    ownerUserId = storeGetEnvironmentOwnership(envId)?.ownerUserId ?? null
+  } catch (err) {
+    console.error('[bridge] DB error during assignment ownership lookup:', err)
+    return c.json(
+      {
+        error: {
+          type: 'database_unavailable',
+          message: 'Database unavailable',
+        },
+      },
+      503,
+    )
+  }
+  if (ownerUserId && !caller.isApiAdmin && caller.uuid !== ownerUserId) {
+    return c.json(
+      {
+        error: {
+          type: 'forbidden',
+          message: 'Not allowed to poll this environment',
+        },
+      },
+      403,
+    )
+  }
+
+  // The attach-wait worker has no work item in flight, so the work-poll
+  // route never refreshes its heartbeat. This poll IS its liveness signal:
+  // without touching lastPollAt the disconnect monitor flips the env to
+  // disconnected after the idle timeout, assignment starts 404ing, and the
+  // CLI silently spins until its 24h deadline (P0-2).
+  updatePollTime(envId)
+  const assigned = storeListSessionsByEnvironment(envId)
+    .filter(s => !isSessionClosedStatus(s.status))
+    .filter(s => s.source !== 'acp')
+    .sort((a, b) => b.updatedAt.getTime() - a.updatedAt.getTime())[0]
+  if (!assigned) {
+    return c.json({ assigned: false }, 200)
+  }
+  return c.json(
+    {
+      assigned: true,
+      session_id: assigned.id,
+      title: assigned.title,
+      status: assigned.status,
+    },
+    200,
+  )
+})
+
 /** DELETE /v1/environments/bridge/:id — Deregister */
 app.delete('/bridge/:id', acceptCliHeaders, apiKeyAuth, async c => {
   const envId = c.req.param('id')!