@sigrun/sigrun 0.1.6 → 0.2.0

package/dist/server/routes/login.js

@@ -0,0 +1,223 @@
+import { ipAllowed } from "../auth/ip.js";
+import { bearerOf, resolveToken, sessionCookieOf } from "../auth/pipeline.js";
+import { LoginFlows } from "../login/flows.js";
+import { clearSetupCode, readSetupCode } from "../../harness/identity/setup-code.js";
+import { resolveLogin } from "../login/resolve.js";
+import { sendLoginResolution } from "../login/http.js";
+import { SetupClaimStore } from "../login/setup-claim.js";
+export const LOGIN_STATE_COOKIE = "sigrun_login_state";
+/** Only local absolute paths may survive the external-identity round trip. */
+export function safeReturnTo(value) {
+    if (typeof value !== "string" ||
+        !value.startsWith("/") ||
+        value.startsWith("//") ||
+        value.includes("\\") ||
+        /^[A-Za-z][A-Za-z0-9+.-]*:/.test(value))
+        return "/";
+    return value;
+}
+function cookieValue(request, name) {
+    const header = request.headers.cookie;
+    if (typeof header !== "string")
+        return undefined;
+    for (const pair of header.split(";")) {
+        const eq = pair.indexOf("=");
+        if (eq !== -1 && pair.slice(0, eq).trim() === name) {
+            return pair.slice(eq + 1).trim() || undefined;
+        }
+    }
+    return undefined;
+}
+function stateCookie(key, request, ctx) {
+    const trusted = ipAllowed(request.socket.remoteAddress, ctx.config.auth.proxy.trustedProxies);
+    const forwarded = request.headers["x-forwarded-proto"];
+    const secure = request.protocol === "https" ||
+        (trusted && (Array.isArray(forwarded) ? forwarded[0] : forwarded) === "https");
+    return `${LOGIN_STATE_COOKIE}=${key}; HttpOnly; SameSite=Lax; Path=/v1/auth/callback` +
+        (secure ? "; Secure" : "");
+}
+function browserError(reply, statusCode, error, asJson = false) {
+    if (asJson)
+        return reply.code(statusCode).send({ error });
+    return reply.code(statusCode).header("location", `/login?error=${encodeURIComponent(error)}`).send();
+}
+function queryOf(request) {
+    const query = {};
+    for (const [key, value] of Object.entries(request.query)) {
+        if (typeof value === "string")
+            query[key] = value;
+        else if (Array.isArray(value) && typeof value[0] === "string")
+            query[key] = value[0];
+    }
+    return query;
+}
+/** Register core-owned login flows over extension-contributed identity proofs. */
+export function registerLoginRoutes(app, ctx, options = {}) {
+    // Deliberately per-server, never a harness singleton: restart invalidates
+    // in-flight logins and separate server instances never share browser state.
+    const flows = options.flows ?? new LoginFlows();
+    const setupClaims = new SetupClaimStore(ctx.opened.identity.cacheDir);
+    const providers = new Map(ctx.opened.loginProviders.map((entry) => [entry.provider, entry]));
+    const resolve = options.resolver ?? (async (input) => {
+        const outcome = await resolveLogin({
+            provider: input.provider,
+            result: input.result,
+            ...(input.flow.link === undefined ? {} : { linkUser: input.flow.link }),
+        }, {
+            accounts: ctx.opened.identity.accounts,
+            users: ctx.opened.identity.users,
+            invites: ctx.opened.identity.invites,
+            setupCode: () => readSetupCode(ctx.opened.identity.cacheDir),
+            clearSetupCode: () => clearSetupCode(ctx.opened.identity.cacheDir),
+            setupClaims,
+            policy: providers.get(input.provider)?.contribution.policy ?? {},
+        });
+        if (outcome.kind === "needs_code") {
+            const parked = flows.park(input.flow, input.result);
+            return await input.reply.code(302).header("location", `/login/code?key=${encodeURIComponent(parked.key)}&reason=${outcome.reason}`).send();
+        }
+        return await sendLoginResolution(outcome, {
+            provider: input.provider,
+            returnTo: input.flow.returnTo,
+            request: input.request,
+            reply: input.reply,
+            ctx,
+        });
+    });
+    app.get("/v1/auth/providers", async () => ({
+        // External sign-in creates token-backed sessions, so a proxy-only
+        // deployment cannot use it. Do not advertise a flow that would loop.
+        providers: ctx.methods.includes("token")
+            ? ctx.opened.loginProviders.map(({ provider, contribution }) => ({
+                provider,
+                label: contribution.label,
+                ...(contribution.icon === undefined ? {} : { icon: contribution.icon }),
+            }))
+            : [],
+    }));
+    app.get("/v1/auth/login/:provider", async (request, reply) => {
+        const { provider } = request.params;
+        const binding = providers.get(provider);
+        if (binding === undefined)
+            return browserError(reply, 404, "unknown_provider");
+        const query = queryOf(request);
+        let link;
+        if (query.link === "1") {
+            const presented = bearerOf(request) ?? sessionCookieOf(request);
+            const principal = presented === undefined ? { status: 401 } : resolveToken(request, ctx);
+            if ("status" in principal)
+                return await reply.code(401).send({ error: "unauthenticated" });
+            if (principal.user === undefined)
+                return await reply.code(401).send({ error: "unauthenticated" });
+            link = principal.user;
+        }
+        const returnTo = safeReturnTo(query.return);
+        const started = flows.start(provider, { returnTo, ...(link === undefined ? {} : { link }) });
+        const callbackUrl = `${ctx.config.publicUrl ?? `${request.protocol}://${request.headers.host ?? "localhost"}`}/v1/auth/callback/${encodeURIComponent(provider)}`;
+        const flow = {
+            state: started.state,
+            callbackUrl,
+            data: started.data,
+        };
+        try {
+            const begun = await binding.contribution.begin(flow, {
+                abortSignal: request.raw.signal,
+            });
+            flows.save(started.state, flow);
+            return await reply
+                .code(302)
+                .header("location", begun.redirectUrl)
+                .header("set-cookie", stateCookie(started.browserKey, request, ctx))
+                .send();
+        }
+        catch (error) {
+            console.error(`sigrun: login provider ${provider} begin failed: ${error instanceof Error ? error.message : String(error)}`);
+            flows.take(started.state, started.browserKey);
+            return browserError(reply, 500, "provider_error");
+        }
+    });
+    const callback = async (request, reply) => {
+        const { provider } = request.params;
+        const binding = providers.get(provider);
+        if (binding === undefined)
+            return browserError(reply, 404, "unknown_provider");
+        const query = queryOf(request);
+        const state = query.state ?? "";
+        const browserKey = cookieValue(request, LOGIN_STATE_COOKIE) ?? "";
+        const flow = flows.take(state, browserKey);
+        if (flow === undefined)
+            return browserError(reply, 400, flows.failure(state, browserKey));
+        // State names ONE provider. A flow remains consumed on mismatch, so it
+        // cannot be replayed through the original provider after this attempt.
+        if (flow.provider !== provider)
+            return browserError(reply, 400, "invalid_state");
+        // Validate again at the trust boundary: a resolver must never receive an
+        // open redirect even if the stored flow was constructed elsewhere.
+        const safeFlow = { ...flow, returnTo: safeReturnTo(flow.returnTo) };
+        let result;
+        try {
+            result = await binding.contribution.complete({ state: flow.state, callbackUrl: flow.callbackUrl, data: flow.data }, { query, ...(request.body === undefined ? {} : { body: request.body }) }, { abortSignal: request.raw.signal });
+        }
+        catch (error) {
+            console.error(`sigrun: login provider ${provider} complete failed: ${error instanceof Error ? error.message : String(error)}`);
+            return browserError(reply, 400, "provider_error");
+        }
+        try {
+            return await resolve({ provider, result, flow: safeFlow, request, reply });
+        }
+        catch (error) {
+            if (reply.sent)
+                throw error;
+            console.error(`sigrun: login resolver failed for ${provider}: ${error instanceof Error ? error.message : String(error)}`);
+            return browserError(reply, 500, "login_failed");
+        }
+    };
+    app.get("/v1/auth/callback/:provider", callback);
+    app.post("/v1/auth/callback/:provider", callback);
+    app.post("/v1/auth/login/code", async (request, reply) => {
+        const body = request.body;
+        if (typeof body !== "object" || body === null || Array.isArray(body)) {
+            return await reply.code(400).send({ error: "invalid_body" });
+        }
+        const record = body;
+        for (const field of Object.keys(record)) {
+            if (field !== "key" && field !== "code") {
+                return await reply.code(400).send({ error: "invalid_field", field });
+            }
+        }
+        if (typeof record.key !== "string" || typeof record.code !== "string") {
+            return await reply.code(400).send({ error: "invalid_body" });
+        }
+        // The webui client requests JSON so fetch never follows a redirect
+        // into an HTML document. Existing form callers keep the 302 contract.
+        const asJson = request.headers.accept?.includes("application/json") === true;
+        const pending = flows.takePending(record.key);
+        if (pending === undefined)
+            return browserError(reply, 400, "login_expired", asJson);
+        const outcome = await resolveLogin({
+            provider: pending.provider,
+            result: pending.result,
+            code: record.code,
+        }, {
+            accounts: ctx.opened.identity.accounts,
+            users: ctx.opened.identity.users,
+            invites: ctx.opened.identity.invites,
+            setupCode: () => readSetupCode(ctx.opened.identity.cacheDir),
+            clearSetupCode: () => clearSetupCode(ctx.opened.identity.cacheDir),
+            setupClaims,
+            policy: providers.get(pending.provider)?.contribution.policy ?? {},
+        });
+        if (outcome.kind === "needs_code") {
+            flows.restorePending(record.key, pending);
+            return browserError(reply, 403, "invalid_code", asJson);
+        }
+        return await sendLoginResolution(outcome, {
+            provider: pending.provider,
+            returnTo: pending.returnTo,
+            request,
+            reply,
+            ctx,
+            asJson,
+        });
+    });
+}

package/dist/server/routes/me.js

@@ -0,0 +1,90 @@
+/**
+ * Multi-user M2 Task 2: self-service per-user extension stores.
+ *
+ * Every operation resolves from request.principal.user — never a query
+ * parameter. There is no cross-user selector: an admin asking for
+ * `?user=alice` still addresses the admin's own stores, so another user's
+ * data is never returned. Secret values are accepted on PUT and read
+ * in-process by extensions, but no HTTP route here ever returns one.
+ */
+/** Register the self-only settings/secrets routes. */
+export function registerMeRoutes(app, ctx) {
+    const { opened } = ctx;
+    app.get("/v1/me/services", async (request, reply) => {
+        const user = request.principal.user;
+        if (user === undefined || opened.identity.users.get(user) === undefined) {
+            return await reply.code(400).send({ error: "named_user_required" });
+        }
+        return { services: opened.userServices.statuses().filter((status) => status.user === user) };
+    });
+    /** Resolve the caller + slug before any store I/O. */
+    const resolve = (request, reply) => {
+        const user = request.principal.user;
+        if (user === undefined || opened.identity.users.get(user) === undefined) {
+            void reply.code(400).send({ error: "named_user_required" });
+            return undefined;
+        }
+        const { slug } = request.params;
+        if (!opened.extensionOutcomes.some((outcome) => outcome.name === slug)) {
+            void reply.code(404).send({ error: "extension_not_found" });
+            return undefined;
+        }
+        return opened.extensionStores.userExtensionStores(slug, user);
+    };
+    app.get("/v1/me/extensions/:slug/settings", async (request, reply) => {
+        const stores = resolve(request, reply);
+        if (stores === undefined)
+            return reply;
+        const response = {
+            settings: await stores.settings.get(),
+            pendingRestart: [],
+        };
+        return response;
+    });
+    app.put("/v1/me/extensions/:slug/settings", async (request, reply) => {
+        const stores = resolve(request, reply);
+        if (stores === undefined)
+            return reply;
+        const body = request.body;
+        if (typeof body !== "object" || body === null || Array.isArray(body)) {
+            return await reply.code(400).send({ error: "invalid_body" });
+        }
+        const settings = body;
+        await stores.settings.set(settings);
+        const { slug } = request.params;
+        opened.userServices.settingsChanged(slug, request.principal.user);
+        const response = { settings, pendingRestart: [] };
+        return response;
+    });
+    app.get("/v1/me/extensions/:slug/secrets", async (request, reply) => {
+        const stores = resolve(request, reply);
+        if (stores === undefined)
+            return reply;
+        // This store method lists names only; values have no HTTP read surface.
+        return { keys: await opened.extensionStores.userSecretKeys(request.params.slug, request.principal.user) };
+    });
+    app.put("/v1/me/extensions/:slug/secrets/:key", async (request, reply) => {
+        const stores = resolve(request, reply);
+        if (stores === undefined)
+            return reply;
+        const body = request.body;
+        if (typeof body !== "object" ||
+            body === null ||
+            Array.isArray(body) ||
+            typeof body.value !== "string" ||
+            body.value === "") {
+            return await reply.code(400).send({ error: "invalid_field", field: "value" });
+        }
+        const { key } = request.params;
+        await stores.secrets.set(key, body.value);
+        return await reply.code(204).send();
+    });
+    app.delete("/v1/me/extensions/:slug/secrets/:key", async (request, reply) => {
+        const stores = resolve(request, reply);
+        if (stores === undefined)
+            return reply;
+        const { key } = request.params;
+        await stores.secrets.delete(key);
+        return await reply.code(204).send();
+    });
+}

package/dist/server/routes/meta.js

@@ -120,6 +120,21 @@ export function registerMetaRoutes(app, ctx) {
             // §14.2/§14.4: the development flag — gates the gallery and the
             // development error bodies (a boot constant, cached like the rest).
             dev: config.dev,
+            // §13.3 (U4 Task 2): the supervised posture — the settings panel's
+            // pendingRestart callout renders its Restart button only for a
+            // supervised admin (an unsupervised deploy's restart exits and
+            // STAYS down, so the button must not exist there).
+            supervised: config.supervised,
+            isolation: {
+                mode: config.isolation.mode,
+                active: opened.isolationState.active(),
+                available: opened.isolation.available,
+                abi: opened.isolation.abi,
+                ...(opened.isolation.reason === undefined
+                    ? {}
+                    : { reason: opened.isolation.reason }),
+                osUsers: opened.osUsers.status,
+            },
             // The seam inventory: declaration-derived, no doc reads.
             seam: {
                 interactions: [...opened.seamKinds]

package/dist/server/routes/onboarding.js

@@ -18,6 +18,8 @@ import { withClaimLock } from "../auth/claim-lock.js";
 import { ipAllowed } from "../auth/ip.js";
 import { isLoopbackHost } from "../auth/loopback.js";
 import { readSetupCode, clearSetupCode } from "../../harness/identity/index.js";
+import { setupCodeMatches } from "../../harness/identity/setup-code-check.js";
+import { AdmissionRefusedError } from "../../harness/identity/users.js";
 import { stampSessionOwner } from "../helpers.js";
 import { buildSessionCookie } from "./auth.js";
 /** One header read (Fastify headers are string | string[]; first wins). */
@@ -136,106 +138,114 @@ export function registerOnboardingRoutes(app, ctx) {
         // valid code — it gets 409 `already_claimed` (the brief's "one
         // claimant wins and the rest get 409"), never a misleading 403.
         const codeWasSetup = validated.code !== undefined &&
-            validated.code === readSetupCode(identity.cacheDir);
+            setupCodeMatches(validated.code, readSetupCode(identity.cacheDir));
         // The claim critical section: read state, decide, add — all inside
         // the one mutex, so concurrent claims cannot both pass the gate.
         const outcome = await withClaimLock(async () => {
-            const claimed = identity.users.isClaimed();
-            if (!claimed) {
-                // The first admin: proxy headers, loopback bind, or the setup
-                // code ("the first invite" — same shape, admin grant).
-                let grant;
-                if (proxyIdentity !== undefined) {
-                    // Proxy claims take identity from the headers, verbatim
-                    // (body identity fields are ignored — the proxy vouched).
-                    grant = { ...proxyIdentity, source: "proxy" };
+            try {
+                const claimed = identity.users.isClaimed();
+                if (!claimed) {
+                    // The first admin: proxy headers, loopback bind, or the setup
+                    // code ("the first invite" — same shape, admin grant).
+                    let grant;
+                    if (proxyIdentity !== undefined) {
+                        // Proxy claims take identity from the headers, verbatim
+                        // (body identity fields are ignored — the proxy vouched).
+                        grant = { ...proxyIdentity, source: "proxy" };
+                    }
+                    else if (loopback) {
+                        if (validated.user === undefined)
+                            return { status: 400, error: "invalid_body" };
+                        grant = {
+                            user: validated.user,
+                            ...(validated.name === undefined ? {} : { name: validated.name }),
+                            ...(validated.email === undefined ? {} : { email: validated.email }),
+                            source: "cli",
+                        };
+                    }
+                    else if (codeWasSetup) {
+                        if (validated.user === undefined)
+                            return { status: 400, error: "invalid_body" };
+                        grant = {
+                            user: validated.user,
+                            ...(validated.name === undefined ? {} : { name: validated.name }),
+                            ...(validated.email === undefined ? {} : { email: validated.email }),
+                            source: "cli",
+                        };
+                    }
+                    else {
+                        // Wrong or absent code where one is required.
+                        return { status: 403, error: "invalid_code" };
+                    }
+                    if (!USERNAME_PATTERN.test(grant.user)) {
+                        return { status: 400, error: "invalid_username" };
+                    }
+                    const record = await identity.users.add({
+                        user: grant.user,
+                        ...(grant.name === undefined ? {} : { name: grant.name }),
+                        ...(grant.email === undefined ? {} : { email: grant.email }),
+                        admin: true,
+                        source: grant.source,
+                    });
+                    // The setup code dies with the claim (single-shot); the
+                    // pinned env form re-materializes at the next unclaimed
+                    // boot, which no longer exists once claimed.
+                    await clearSetupCode(identity.cacheDir);
+                    // The reserved root conversation belongs to the claimant —
+                    // the server's first configured resource.
+                    const root = await ctx.opened.harness.conversation(ctx.rootId, BACKGROUND_CONTEXT);
+                    if (root !== undefined) {
+                        await stampSessionOwner(root, record.user, ctx.opened);
+                    }
+                    return { status: 200, record };
                 }
-                else if (loopback) {
-                    if (validated.user === undefined)
-                        return { status: 400, error: "invalid_body" };
-                    grant = {
-                        user: validated.user,
-                        ...(validated.name === undefined ? {} : { name: validated.name }),
-                        ...(validated.email === undefined ? {} : { email: validated.email }),
-                        source: "cli",
-                    };
+                // Claimed: an invite code admits one more user; a codeless
+                // proxy/loopback caller auto-provisions (or re-surfaces); a code
+                // that WAS the setup code lost the race — 409, per the mutex
+                // contract (one winner, the rest already_claimed).
+                if (codeWasSetup) {
+                    return { status: 409, error: "already_claimed" };
                 }
-                else if (codeWasSetup) {
-                    if (validated.user === undefined)
-                        return { status: 400, error: "invalid_body" };
-                    grant = {
+                if (validated.code !== undefined) {
+                    const invite = validated.user === undefined
+                        ? undefined
+                        : await identity.invites.redeem(validated.code, validated.user);
+                    if (invite === undefined) {
+                        return { status: 403, error: "invalid_code" };
+                    }
+                    const record = await identity.users.add({
                         user: validated.user,
                         ...(validated.name === undefined ? {} : { name: validated.name }),
                         ...(validated.email === undefined ? {} : { email: validated.email }),
-                        source: "cli",
-                    };
+                        admin: invite.admin,
+                        source: "invite",
+                    });
+                    return { status: 200, record };
                 }
-                else {
-                    // Wrong or absent code where one is required.
-                    return { status: 403, error: "invalid_code" };
-                }
-                if (!USERNAME_PATTERN.test(grant.user)) {
-                    return { status: 400, error: "invalid_username" };
+                // Claimed + no code: only a trusted proxy identity still
+                // admits (auto-provision, or the existing record back) — a
+                // loopback/token caller has “nothing valid” and gets 409.
+                if (proxyIdentity === undefined) {
+                    return { status: 409, error: "already_claimed" };
                 }
+                const existing = identity.users.get(proxyIdentity.user);
+                if (existing !== undefined)
+                    return { status: 200, record: existing };
                 const record = await identity.users.add({
-                    user: grant.user,
-                    ...(grant.name === undefined ? {} : { name: grant.name }),
-                    ...(grant.email === undefined ? {} : { email: grant.email }),
-                    admin: true,
-                    source: grant.source,
+                    user: proxyIdentity.user,
+                    ...(proxyIdentity.name === undefined ? {} : { name: proxyIdentity.name }),
+                    ...(proxyIdentity.email === undefined ? {} : { email: proxyIdentity.email }),
+                    admin: false,
+                    source: "proxy",
                 });
-                // The setup code dies with the claim (single-shot); the
-                // pinned env form re-materializes at the next unclaimed
-                // boot, which no longer exists once claimed.
-                await clearSetupCode(identity.cacheDir);
-                // The reserved root conversation belongs to the claimant —
-                // the server's first configured resource.
-                const root = await ctx.opened.harness.conversation(ctx.rootId, BACKGROUND_CONTEXT);
-                if (root !== undefined) {
-                    await stampSessionOwner(root, record.user);
-                }
                 return { status: 200, record };
             }
-            // Claimed: an invite code admits one more user; a codeless
-            // proxy/loopback caller auto-provisions (or re-surfaces); a code
-            // that WAS the setup code lost the race — 409, per the mutex
-            // contract (one winner, the rest already_claimed).
-            if (codeWasSetup) {
-                return { status: 409, error: "already_claimed" };
-            }
-            if (validated.code !== undefined) {
-                const invite = validated.user === undefined
-                    ? undefined
-                    : await identity.invites.redeem(validated.code, validated.user);
-                if (invite === undefined) {
-                    return { status: 403, error: "invalid_code" };
+            catch (error) {
+                if (error instanceof AdmissionRefusedError) {
+                    return { status: 409, error: error.code };
                 }
-                const record = await identity.users.add({
-                    user: validated.user,
-                    ...(validated.name === undefined ? {} : { name: validated.name }),
-                    ...(validated.email === undefined ? {} : { email: validated.email }),
-                    admin: invite.admin,
-                    source: "invite",
-                });
-                return { status: 200, record };
-            }
-            // Claimed + no code: only a trusted proxy identity still
-            // admits (auto-provision, or the existing record back) — a
-            // loopback/token caller has “nothing valid” and gets 409.
-            if (proxyIdentity === undefined) {
-                return { status: 409, error: "already_claimed" };
+                throw error;
             }
-            const existing = identity.users.get(proxyIdentity.user);
-            if (existing !== undefined)
-                return { status: 200, record: existing };
-            const record = await identity.users.add({
-                user: proxyIdentity.user,
-                ...(proxyIdentity.name === undefined ? {} : { name: proxyIdentity.name }),
-                ...(proxyIdentity.email === undefined ? {} : { email: proxyIdentity.email }),
-                admin: false,
-                source: "proxy",
-            });
-            return { status: 200, record };
         });
         if (outcome.status !== 200) {
             return await reply.code(outcome.status).send({ error: outcome.error });