@sigrun/sigrun 0.1.6 → 0.2.1

package/dist/server/auth/pipeline.js

@@ -34,14 +34,22 @@
  *     request before handlers run) + a non-empty user header; a
  *     directory miss auto-provisions (`source:"proxy"`, admin:false)
  *     unless `autoProvision:false` → 403 `user_not_provisioned`.
+ *     Every proxy rejection (401/403) emits ONE sanitized `warn` naming
+ *     the socket peer + a short reason (release-readiness Task 1, spec
+ *     §3 — never tokens, cookies, identity-header VALUES, query
+ *     strings, or the full URL; a request presenting a Bearer/cookie
+ *     credential is a token attempt and stays silent).
  *     `token`: Bearer or the `sigrun_session` cookie → `tokens.verify`;
- *     the token's user must exist in the directory, else 401.
+ *     the token's user must exist in the directory, else 401 (no log —
+ *     token failures are not proxy diagnostics).
  *  6. **Empty list** (the naive workstation path): the trimmed
  *     `X-Sigrun-User` header verbatim, `admin: true`, method `"none"`.
  */
 import { timingSafeEqual } from "node:crypto";
 import { ipAllowed } from "./ip.js";
 import { isLoopbackHost } from "./loopback.js";
+import { AdmissionRefusedError } from "../../harness/identity/users.js";
+import { effectiveAdmin } from "../../harness/identity/groups.js";
 /** One header read: Fastify headers may be string | string[]; first wins. */
 function headerOf(request, name) {
     const value = request.headers[name.toLowerCase()];
@@ -57,7 +65,7 @@ function timingSafeStringEqual(a, b) {
     return timingSafeEqual(left, right);
 }
 /** The request's Bearer credential, if the Authorization header carries one. */
-function bearerOf(request) {
+export function bearerOf(request) {
     const value = headerOf(request, "authorization");
     if (value === undefined)
         return undefined;
@@ -65,7 +73,7 @@ function bearerOf(request) {
     return match?.[1]?.trim() || undefined;
 }
 /** The `sigrun_session` cookie value (naive parse; the cookie is ours). */
-function sessionCookieOf(request) {
+export function sessionCookieOf(request) {
     const raw = headerOf(request, "cookie");
     if (raw === undefined)
         return undefined;
@@ -160,6 +168,15 @@ function isPublicPath(request, ctx) {
         return true;
     if (pattern === "/v1/auth/logout" && request.method === "POST")
         return true;
+    if (pattern === "/v1/auth/providers" && request.method === "GET")
+        return true;
+    if (pattern === "/v1/auth/login/:provider" && request.method === "GET")
+        return true;
+    if (pattern === "/v1/auth/login/code" && request.method === "POST")
+        return true;
+    if (pattern === "/v1/auth/callback/:provider" &&
+        (request.method === "GET" || request.method === "POST"))
+        return true;
     if (pattern === "/v1/onboarding" || pattern?.startsWith("/v1/onboarding/")) {
         return true;
     }
@@ -173,6 +190,22 @@ function isPublicPath(request, ctx) {
     }
     return false;
 }
+/**
+ * The proxy-auth rejection diagnostic (release-readiness Task 1, spec §3):
+ * ONE `warn` per rejected request, naming the socket peer, the request
+ * method, a short reason, and — only when Fastify already resolved it —
+ * the ROUTE TEMPLATE (`routeOptions.url`, never the raw URL). The line
+ * must never carry API tokens, cookies, identity-header VALUES, query
+ * strings, or the full request URL; a header NAME appears only where the
+ * reason itself is "that configured header was absent/wrong" (its value
+ * never does). This is diagnostic logging, not evidence that the
+ * configured allowlist is correct.
+ */
+function warnProxyRejected(request, reason) {
+    const peer = request.socket.remoteAddress ?? "unknown";
+    const route = request.routeOptions.url;
+    console.warn(`sigrun: proxy auth rejected ${request.method} request from ${peer} (${reason})${route === undefined ? "" : ` on ${route}`}`);
+}
 /**
  * Stage 5a (proxy): resolve the forward-auth headers, or reply with the
  * rejection. The secret header is DELETED from the request before any
@@ -180,7 +213,24 @@ function isPublicPath(request, ctx) {
  */
 async function resolveProxy(request, ctx) {
     const { proxy, adminGroups } = ctx.config.auth;
+    // A request presenting a Bearer/cookie CREDENTIAL is attempting token
+    // auth (or riding the stage-3 service token), not claiming a proxy
+    // identity: when the token method is ALSO configured, suppress the
+    // rejection diagnostic — a denied credential is the token method's
+    // failure, which never logs (spec §3). The pipeline visits the proxy
+    // method FIRST for such a request (a trusted peer presenting a session
+    // without proxy headers is a legitimate client shape behind
+    // forward-auth), and a "missing secret" warn would fire even when the
+    // token then authenticates. In a PROXY-ONLY deployment the suppression
+    // does not apply: a rejected credential-bearing request there IS a
+    // proxy-method 401 and must log (spec §3 exempts token-auth failures,
+    // and no token method exists).
+    const attemptingToken = (bearerOf(request) !== undefined || sessionCookieOf(request) !== undefined) &&
+        ctx.methods.includes("token");
     if (!ipAllowed(request.socket.remoteAddress, proxy.trustedProxies)) {
+        if (!attemptingToken) {
+            warnProxyRejected(request, "untrusted proxy");
+        }
         return { status: 401 };
     }
     if (proxy.secret !== undefined && proxy.secretHeader !== undefined) {
@@ -188,12 +238,19 @@ async function resolveProxy(request, ctx) {
         const presented = headerOf(request, name);
         delete request.headers[name];
         if (presented === undefined || !timingSafeStringEqual(presented, proxy.secret)) {
+            if (!attemptingToken) {
+                warnProxyRejected(request, `missing or wrong shared secret (${proxy.secretHeader} header)`);
+            }
             return { status: 401 };
         }
     }
     const user = headerOf(request, proxy.userHeader);
-    if (user === undefined)
+    if (user === undefined) {
+        if (!attemptingToken) {
+            warnProxyRejected(request, `missing identity header (${proxy.userHeader})`);
+        }
         return { status: 401 };
+    }
     const groups = headerOf(request, proxy.groupsHeader)
         ?.split(",")
         .map((group) => group.trim())
@@ -201,53 +258,54 @@ async function resolveProxy(request, ctx) {
     const { users } = ctx.opened.identity;
     // The invalid-username case (a proxy header that can't be a directory
     // user) is a loud 403, not a 500: the proxy vouched for an identity
-    // this server can never represent.
+    // this server can never represent. The warn's reason never carries the
+    // claimed value (spec §3: no identity-header values).
     if (!/^[a-z0-9][a-z0-9._-]*$/.test(user)) {
+        warnProxyRejected(request, "unusable identity claim");
         return { status: 403, error: "invalid_username" };
     }
     const existing = users.get(user);
     if (existing === undefined && !proxy.autoProvision) {
+        warnProxyRejected(request, "untrusted identity source");
         return { status: 403, error: "user_not_provisioned" };
     }
-    const groupAdmin = groups.some((group) => adminGroups.includes(group));
-    const record = existing ??
-        (await users.add({
-            user,
-            ...(headerOf(request, proxy.nameHeader) === undefined
-                ? {}
-                : { name: headerOf(request, proxy.nameHeader) }),
-            ...(headerOf(request, proxy.emailHeader) === undefined
-                ? {}
-                : { email: headerOf(request, proxy.emailHeader) }),
-            admin: false,
-            // Gateway C8: the grant is stamped at provision — host-side
-            // checks (chat commands, no headers) read it from the record.
-            ...(adminGroups.length > 0 ? { groupAdmin } : {}),
-            source: "proxy",
-        }));
-    // Gateway C8 write-through: host-side code has no request headers, so
-    // the computed group grant must live on the directory record. Only a
-    // CHANGE writes (the steady state never rewrites the file), and only
-    // while `adminGroups` is configured — an empty list leaves the field
-    // untouched (a group-exit clears it at this user's next request under
-    // a non-empty list, never under an empty one). Absent counts as false;
-    // the auto-provisioned record was added with the flag already set, so
-    // the comparison is against the RESOLVED record, never `existing`.
-    if (adminGroups.length > 0 &&
-        (record.groupAdmin ?? false) !== groupAdmin) {
-        await users.update(user, { groupAdmin });
+    let record;
+    try {
+        record = existing ??
+            (await users.add({
+                user,
+                ...(headerOf(request, proxy.nameHeader) === undefined
+                    ? {}
+                    : { name: headerOf(request, proxy.nameHeader) }),
+                ...(headerOf(request, proxy.emailHeader) === undefined
+                    ? {}
+                    : { email: headerOf(request, proxy.emailHeader) }),
+                admin: false,
+                source: "proxy",
+            }));
+    }
+    catch (error) {
+        if (error instanceof AdmissionRefusedError) {
+            return { status: 403, error: error.code };
+        }
+        throw error;
     }
+    // Persist the authenticated source's groups on every proxy request;
+    // setGroups avoids the write when the values are unchanged. Effective
+    // admin is computed over the UPDATED record, so a group exit revokes
+    // the request's grant immediately and host-side checks agree.
+    record = await users.setGroups(user, "proxy", groups);
     return {
         user: record.user,
         ...(record.name === undefined ? {} : { name: record.name }),
         ...(record.email === undefined ? {} : { email: record.email }),
-        admin: record.admin || groupAdmin,
+        admin: effectiveAdmin(record, adminGroups),
         service: false,
         method: "proxy",
     };
 }
 /** Stage 5b (token): verify a presented credential against the token store. */
-function resolveToken(request, ctx) {
+export function resolveToken(request, ctx) {
     const presented = bearerOf(request) ?? sessionCookieOf(request);
     if (presented === undefined)
         return { status: 401 };
@@ -262,9 +320,14 @@ function resolveToken(request, ctx) {
         user: user.user,
         ...(user.name === undefined ? {} : { name: user.name }),
         ...(user.email === undefined ? {} : { email: user.email }),
-        admin: user.admin,
+        // Token/session credentials are not group sources: derive from the
+        // stored record without writing groups on this request path.
+        admin: effectiveAdmin(user, ctx.config.auth.adminGroups),
         service: false,
-        method: "token",
+        method: record.kind === "session" ? "session" : "token",
+        ...(record.kind === "session" && record.provider !== undefined
+            ? { provider: record.provider }
+            : {}),
     };
 }
 /** The ONE request hook. Stages 1→5 in brief order; a stage replies or falls through. */

package/dist/server/blocks/answers.js

@@ -0,0 +1,94 @@
+/**
+ * The block answer (UI-blocks U5 Task 3, spec §8.4): a turn action
+ * (`submit`, default `turn: true`; any action with `turn: true`) makes
+ * core submit a user message for the acting user through the normal
+ * submission path (`submitOp`):
+ *
+ *   { type: "input",
+ *     content: textProjection,             // "Submitted 'Ranking': 1. …"
+ *     entry: { kind: "sigrun.blocks.answer",
+ *              data: { entryId, action, payload, state } },
+ *     requestId: "blocks:" + actionId }
+ *
+ * The surface's unnoted change records fold into `content` first and
+ * `notedThrough` advances BEFORE the §8.3 note step runs — so the turn
+ * sends no separate note for this surface, while changes on OTHER
+ * surfaces still note. `requestId` makes a double click one turn.
+ */
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { toText } from "@sigrun/shared/blocks";
+import { submitOp } from "../conversation-ops.js";
+import { readChatBlock } from "./chat-surfaces.js";
+import { NOTE_HEADER } from "./notes.js";
+import { PROJECTION_LOCALE, PROJECTION_WIDTH, } from "../../harness/blocks/tools.js";
+import { BlocksAnswerEntry } from "../../harness/blocks/entries.js";
+import { BlocksStateDoc } from "../../harness/blocks/state.js";
+/**
+ * Submit one block answer: fold the surface's unnoted changes and its
+ * current projection into the user-visible content, advance the
+ * surface's `notedThrough`, then admit the input through `submitOp` with
+ * `skipNoteFor` (this surface notes no further this turn) and the
+ * answer entry. The route owns access gating and actionId dedup; this
+ * caller runs only for a located, write-accessible block whose handler
+ * starts a turn.
+ *
+ * The fold and the `notedThrough` advance run in ONE commit BEFORE the
+ * note step (§8.4: "The surface's unnoted change records are folded into
+ * `content` first, and `notedThrough` advances, before the §8.3 note
+ * step runs"), so the answer turn never double-reports its surface.
+ */
+export async function answerBlock(ctx, conversationId, entryId, action, payload, actionId) {
+    const { opened } = ctx;
+    const block = await readChatBlock(opened.harness, conversationId, entryId);
+    if (block === undefined) {
+        throw new Error(`answerBlock: block ${entryId} not found`);
+    }
+    const conversation = await opened.harness.conversation(conversationId, BACKGROUND_CONTEXT);
+    if (conversation === undefined) {
+        throw new Error(`answerBlock: conversation ${conversationId} not found`);
+    }
+    // The fold (one commit): read the CURRENT state, build the content
+    // (changes + projection), advance notedThrough past every record the
+    // fold covers.
+    const folded = await conversation.commit(async (tx) => {
+        const draft = await tx.doc(BlocksStateDoc, conversationId, entryId, entryId);
+        const pending = draft.changes.filter((record) => record.seq > draft.notedThrough);
+        const lines = [];
+        if (pending.length > 0) {
+            const byAuthor = new Map();
+            for (const record of pending) {
+                const list = byAuthor.get(record.by) ?? [];
+                list.push(record.summary);
+                byAuthor.set(record.by, list);
+            }
+            lines.push(NOTE_HEADER);
+            for (const [author, summaries] of byAuthor) {
+                lines.push(`• ${block.title} (${author}): ${summaries.join("; ")}`);
+            }
+        }
+        lines.push(`Submitted '${block.title}': ${toText(block.tree, draft.data, {
+            width: PROJECTION_WIDTH,
+            locale: PROJECTION_LOCALE,
+        })}`);
+        if (pending.length > 0) {
+            draft.notedThrough = pending[pending.length - 1].seq;
+        }
+        return {
+            content: lines.join("\n"),
+            state: JSON.parse(JSON.stringify(draft.data)),
+        };
+    }, BACKGROUND_CONTEXT);
+    await submitOp(ctx, conversation, folded.content, {
+        ...(actionId === undefined ? {} : { requestId: `blocks:${actionId}` }),
+        skipNoteFor: entryId,
+        entry: {
+            kind: BlocksAnswerEntry.kind,
+            data: {
+                entryId,
+                action,
+                payload,
+                state: folded.state,
+            },
+        },
+    });
+}