@sema-agent/server 7.43.0 → 7.44.0

package/dist/http/routes/sessions-list.js

@@ -1,26 +1,16 @@
 import { isUuidV7, legacyUnownedAmnestyOpen } from "../../security.js";
 import { sendJson, sendError } from "../send.js";
+import { filterFingerprint } from "../cursor-fingerprint.js";
 export async function handleSessionsList(req, res, url, ctx) {
     const miss = { fell: false };
     await handleSessionsListBody(req, res, url, ctx, miss);
     return !miss.fell;
 }
-/** 路由体 = 从 `server.ts` 的 `handle()` 里**整段剪切**过来的原文(唯一改动:统一去缩进两格)。裸 `return;`
- *  的语义原样 =「本域已应答」;走到函数尾才是「没匹配上」,置 `miss.fell` 交回装配器继续下一个域。
- *  跨域的东西(deps / 助手 / 单域状态)一律在首行解构出来,于是下面每一行都逐字不变。 */
 async function handleSessionsListBody(req, res, url, ctx, miss) {
     const { deps } = ctx;
     const { isFleetWide, sessionOwnerScope } = ctx.helpers;
-    // GET /v1/sessions — list the caller's OWN sessions (CC /resume picker), keyset-paginated newest-first by last
-    // activity. Owner-scope mirrors the trace list (the authoritative model): a system/traceToken caller is
-    // fleet-wide (honors ?owner, ops view); a principal caller is PINNED to its own sessions (no existence oracle).
-    // §0.5: session IDENTITY/enumeration comes from the SESSION abstraction (sessionStorage.listSessions — a row
-    // per session_meta), NOT the task_run runs ledger; task_run only JOINs to supply run-level preview. Falls back
-    // to the legacy task_run aggregate only when the session store can't enumerate (e.g. in-memory dev backend).
     if (req.method === "GET" && url === "/v1/sessions") {
-        // Authenticate BEFORE the store availability check (parity with the trace list) — otherwise a missing
-        // store would 501 an unauthenticated caller, a small backend-availability oracle.
-        const { fleetWide, gateOwner } = sessionOwnerScope(req); // direct-door safe; `|| null`: absent principal → null
+        const { fleetWide, gateOwner } = sessionOwnerScope(req);
         if (!fleetWide && gateOwner === null) {
             sendError(res, 401, "auth.unauthorized", "unauthorized");
             return;
@@ -30,28 +20,12 @@ async function handleSessionsListBody(req, res, url, ctx, miss) {
             sendError(res, 501, "capability.session_store_required", "session list requires a durable session store (DB_BACKEND=mysql|pg|local)");
             return;
         }
-        // [4198] 窄互认第二臂(列表面)—— 条件①③ 在此判,条件②(`owner === null`)由 store 的
-        // `owner = ? OR owner IS NULL` 谓词承载(见 legacyUnownedAmnestyOpen 的注)。fleet-wide 面不经本臂:
-        // 它本来就不钉 owner ⇒ 无主行早已在结果集内,多带位是噪声。
         const includeUnowned = !fleetWide && legacyUnownedAmnestyOpen(deps.config.requirePrincipal, gateOwner);
         await handleSessionList(res, lister, new URL(req.url ?? "", "http://x").searchParams, gateOwner, includeUnowned);
         return;
     }
-    // GET /v1/sendfile-links — the SendUserFile ledger's thin read face (multi-tenant governance: which links
-    // has this tenant issued). Owner-scope mirrors GET /v1/sessions: a principal caller is PINNED to its own
-    // scope (no existence oracle); a fleet-wide caller may pass ?scope= (ops view; no ?scope= on a fleet-wide
-    // caller defaults to the "_" single-user sentinel — the only scope a dev-open deployment writes).
-    // F5 (codex audit) on WHO is actually fleet-wide here: isFleetWide grants it to a system service-token
-    // caller and — nominally — a traceToken caller; but with SERVICE_AUTH_TOKEN(S) configured (the normal
-    // deployed shape) the GLOBAL auth gate runs FIRST and 401s a traceToken-only caller before this route, so
-    // the traceToken leg is UNREACHABLE there (same standing as GET /v1/sessions). The reachable faces are:
-    // service token (fleet-wide), SSO/registry-JWT or BFF principal (pinned), and dev-open (no tokens at all).
-    // Keyset = `?before=<id>` (uuidv7 ids are time-ordered; newest first).
-    // Returns METADATA + key only, NO url: the ledger doesn't store URLs by design — a public-track URL is
-    // reconstructible from bucket+key (+ the capability lives in the key, which the OWNER may see), and a
-    // presigned-track URL would long be expired; re-issuance is a separate (future) verb, not this list.
     if (req.method === "GET" && url === "/v1/sendfile-links") {
-        const { fleetWide, gateOwner } = sessionOwnerScope(req); // direct-door safe (verified principal, not the spoofable header)
+        const { fleetWide, gateOwner } = sessionOwnerScope(req);
         if (!fleetWide && gateOwner === null) {
             sendError(res, 401, "auth.unauthorized", "unauthorized");
             return;
@@ -60,9 +34,6 @@ async function handleSessionsListBody(req, res, url, ctx, miss) {
             sendError(res, 501, "capability.store_required", "sendfile ledger requires a store backend (DB_BACKEND=mysql|pg|local) and the SendUserFile issuer configured");
             return;
         }
-        // F6 (codex audit): STRICT query validation — a malformed limit used to silently degrade to the default
-        // (NaN→50) and a non-uuid `before` was compared lexically against uuidv7 ids (a confusingly-empty page).
-        // ABSENT params keep the exact defaults (limit 50, first page, fleet-wide default scope "_").
         const query = new URL(req.url ?? "", "http://x").searchParams;
         const limitRaw = query.get("limit");
         if (limitRaw !== null && !(/^[0-9]+$/.test(limitRaw) && Number(limitRaw) >= 1 && Number(limitRaw) <= 100)) {
@@ -78,12 +49,12 @@ async function handleSessionsListBody(req, res, url, ctx, miss) {
         const before = beforeRaw ?? undefined;
         let scope;
         if (gateOwner !== null) {
-            scope = gateOwner; // principal caller: PINNED to its own scope; ?scope= is ignored (unchanged)
+            scope = gateOwner;
         }
         else {
             const scopeRaw = query.get("scope");
             if (scopeRaw === null) {
-                scope = "_"; // fleet-wide default = the single-user sentinel (unchanged)
+                scope = "_";
             }
             else {
                 const s = scopeRaw.trim();
@@ -116,16 +87,16 @@ async function handleSessionsListBody(req, res, url, ctx, miss) {
     }
     miss.fell = true;
 }
-function encodeSessionCursor(c) {
-    return Buffer.from(JSON.stringify(c)).toString("base64url");
+function encodeSessionCursor(c, f) {
+    return Buffer.from(JSON.stringify({ ...c, f })).toString("base64url");
 }
-function decodeSessionCursor(s) {
+function decodeSessionCursor(s, expectF) {
     if (!s)
         return undefined;
     try {
         const o = JSON.parse(Buffer.from(s, "base64url").toString());
-        // Validate lastActivityAt parses to a real date — a tampered non-date string would otherwise reach `new Date()`
-        // in the store and make the keyset predicate a DB error / 500. Invalid → treat as no cursor (page 1).
+        if (o.f !== undefined && (typeof o.f !== "string" || o.f !== expectF))
+            return "mismatch";
         return o.lastActivityAt && o.sessionId && !Number.isNaN(Date.parse(o.lastActivityAt))
             ? { lastActivityAt: o.lastActivityAt, sessionId: o.sessionId }
             : undefined;
@@ -137,16 +108,19 @@ function decodeSessionCursor(s) {
 async function handleSessionList(res, lister, query, forceOwner, includeUnowned = false) {
     const owner = forceOwner != null ? forceOwner : (query.get("owner") ?? undefined);
     const limit = Math.min(100, Math.max(1, Number(query.get("limit") ?? 50) || 50));
-    const cursor = decodeSessionCursor(query.get("cursor"));
-    // `?q=` substring search over objective previews (SQL twins: ANY run via EXISTS; local: the
-    // synthesized preview). Trimmed + bounded (256 — a search box, not a payload); empty after trim = no filter.
     const qRaw = (query.get("q") ?? "").trim();
     const q = qRaw ? qRaw.slice(0, 256) : undefined;
+    const f = filterFingerprint([owner, includeUnowned, q]);
+    const cursor = decodeSessionCursor(query.get("cursor"), f);
+    if (cursor === "mismatch") {
+        sendError(res, 400, "request.cursor_filter_mismatch", "cursor was issued under a different filter (owner/q) — restart from the first page without a cursor");
+        return;
+    }
     const rows = await lister({ ...(owner ? { owner } : {}), ...(includeUnowned ? { includeUnowned: true } : {}), ...(cursor ? { cursor } : {}), limit: limit + 1, ...(q ? { q } : {}) });
     const hasMore = rows.length > limit;
     const page = hasMore ? rows.slice(0, limit) : rows;
     const last = page[page.length - 1];
-    const nextCursor = hasMore && last ? encodeSessionCursor({ lastActivityAt: last.lastActivityAt, sessionId: last.sessionId }) : undefined;
+    const nextCursor = hasMore && last ? encodeSessionCursor({ lastActivityAt: last.lastActivityAt, sessionId: last.sessionId }, f) : undefined;
     sendJson(res, 200, { sessions: page, ...(nextCursor ? { nextCursor } : {}) });
 }
 //# sourceMappingURL=sessions-list.js.map