@snagset/server 0.0.1

package/dist/routes/comments.js

@@ -0,0 +1,313 @@
+import { Hono } from "hono";
+import { randomUUID } from "node:crypto";
+import { ID_PREFIX } from "../vendor/types/names.js";
+import { csrfOk } from "./owner.js";
+import { mcpAllows, scopeDenied, checkWriteBudget, budgetExhausted, recordAgentWrite, agentReviewer, } from "./mcpAuth.js";
+import { queueCommentNotice } from "../mail/notify.js";
+function fail(c, status, code, message, details) {
+    return c.json({ error: { code, message, ...(details ? { details } : {}), requestId: c.get("requestId") } }, status);
+}
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function rowId(wire, prefix) {
+    if (typeof wire !== "string")
+        return null;
+    const bare = wire.startsWith(prefix) ? wire.slice(prefix.length) : wire;
+    return UUID.test(bare) ? bare.toLowerCase() : null;
+}
+export function commentRoutes(deps) {
+    const app = new Hono();
+    const { sql } = deps;
+    const handle = async (c) => {
+        const threadRow = rowId(c.req.param("id"), ID_PREFIX.thread);
+        if (!threadRow)
+            return fail(c, 404, "thread_not_found", "No such thread.");
+        const [thread] = await sql `
+      SELECT t.id, t.project_id, t.org_id, t.private, p.uid AS project_uid,
+             t.key,
+             -- The page URL lives INSIDE the capture context, not in a column
+             -- of its own (05 §3.5). Two arrows, not one, so it arrives as
+             -- text rather than as a JSON-quoted string.
+             t.context->>'url' AS page_url
+      FROM threads t JOIN projects p ON p.id = t.project_id
+      WHERE t.id = ${threadRow}::uuid AND t.deleted_at IS NULL
+    `;
+        if (!thread)
+            return fail(c, 404, "thread_not_found", "No such thread.");
+        // The widget's URL always carries `:uid`; the dashboard's canonical form
+        // never does. When it is present it must be THIS thread's project — a uid
+        // that resolves to a different project is treated the same as a thread
+        // that does not exist, not as a permission question, so a uid's validity
+        // leaks nothing about a thread that belongs to somebody else's project.
+        const uidParam = c.req.param("uid");
+        if (uidParam && uidParam !== thread.project_uid) {
+            return fail(c, 404, "thread_not_found", "No such thread in this project.");
+        }
+        const body = (await c.req.json().catch(() => null));
+        // D2, same refusal PATCH already gives a caller that tries to move a
+        // thread's round: a comment does not choose one either. `attachmentIds` is
+        // 05 §6.2's bind-at-write path (`threads.ts`'s `bound` CTE); this route
+        // does not implement it yet, and accepting-then-dropping it would leave a
+        // reviewer believing their screenshot attached when it never bound to
+        // anything (§6.9's `field_not_permitted` is the code for "refused, not
+        // silently ignored"). `mentions` is genuinely inert for now — 05 §3.6
+        // parses it from `body` at write time server-side (§2.11), so a client
+        // sending it costs nothing and is left for that later slice to wire up.
+        for (const field of ["round", "roundId", "roundNumber", "attachmentIds"]) {
+            if (body && field in body) {
+                return fail(c, 422, "field_not_permitted", `"${field}" is not accepted on this route yet.`, {
+                    field,
+                });
+            }
+        }
+        const owner = c.get("owner");
+        const session = c.get("session");
+        const mcp = c.get("mcp");
+        const asOwner = !!owner && owner.orgId === thread.org_id;
+        const asSession = !!session && session.aud === thread.project_uid && session.perm.includes("comment:create");
+        /**
+         * THREE CREDENTIALS NOW. `comment_on_thread` (07 §8.3) is one half of an
+         * agent's entire write surface — the other is `mark_ready` — and it lands
+         * on this handler like everyone else, because 07 §8.1 is explicit that MCP
+         * *"is not a second API"*.
+         */
+        const asAgent = mcpAllows(mcp, thread.org_id, "comments:write");
+        if (mcp && !asAgent)
+            return scopeDenied(c, "comments:write");
+        if (!asOwner && !asSession && !asAgent) {
+            if (!owner && !session && !mcp) {
+                return fail(c, 401, "unauthorized", "Sign in, or open your review link, and try again.");
+            }
+            return fail(c, 403, "forbidden", owner ? "You cannot comment on another org's project." : "This review link does not allow replies.");
+        }
+        /**
+         * An agent may not reply on a thread the studio marked private, even
+         * holding `comments:write`.
+         *
+         * The same argument as the read side: `private` is the studio talking
+         * about the client, and the agent's reply would join that conversation
+         * having read none of it (this route's caller cannot see private comments
+         * either). Refused rather than silently made public, because a comment
+         * that lands somewhere other than where it was addressed is worse than one
+         * that does not land.
+         */
+        if (asAgent && !asOwner && thread.private) {
+            return fail(c, 403, "forbidden", "This thread is team-only. An agent cannot reply on it.");
+        }
+        // 07 §8.4's write budget, checked before the write. §8.6 mitigation 5.
+        if (asAgent && !asOwner && !asSession) {
+            const spent = await checkWriteBudget(sql, mcp.tokenId);
+            if (spent !== null)
+                return budgetExhausted(c);
+        }
+        // The CSRF half of `requireOwner()`, run by hand — see the file header for
+        // why that middleware cannot be mounted on a path a reviewer session also
+        // posts to. Every branch that reaches here is a mutation (POST-only route).
+        if (asOwner && !csrfOk(c)) {
+            return fail(c, 403, "csrf_failed", "That request could not be verified. Reload the dashboard and try again.");
+        }
+        // TEAM-ONLY REPLY (FOLDBACK §A5, §6.4a). Studio-only to set, same as a
+        // thread's own `private` — an owner always may; a session needs the link
+        // permission that names it, exactly like `thread:assign`/`thread:private`
+        // gate the thread-level fields (05 §6.4 step 4).
+        //
+        // A thread that is ALREADY private forces every reply on it private too —
+        // §6.4 is explicit that the field is then ignored, not merely defaulted.
+        // The first cut read `thread.private` off the row and never used it, so
+        // `wantPrivate` came only from the body: a reviewer session replying on a
+        // private thread with no `private` field in the body got a PUBLIC comment
+        // stored on a thread the client should never have been able to see existed,
+        // and the 403 below fired only when the body explicitly asked for private
+        // — never when the thread's own privacy should have applied silently.
+        const wantPrivate = thread.private || body?.private === true;
+        // `session!` below is safe only because an agent is excluded first: an MCP
+        // caller has no session at all, so the non-null assertion would have thrown
+        // a 500 on `session!.perm` the first time an agent sent `private: true`.
+        // It may not set the field regardless — a team-only reply is the studio's
+        // register, and 07 §8.2 is emphatic that an agent write is never laundered
+        // into a trust tier it did not earn.
+        if (asAgent && !asOwner && body?.private === true) {
+            return fail(c, 403, "field_not_permitted", "An agent cannot post a team-only reply.", {
+                field: "private",
+            });
+        }
+        if (!thread.private && body?.private === true && !asOwner && !session.perm.includes("thread:private")) {
+            return fail(c, 403, "field_not_permitted", "This review link does not allow team-only replies.", {
+                field: "private",
+            });
+        }
+        const commentBody = typeof body?.body === "string" ? body.body : "";
+        if (!commentBody)
+            return fail(c, 400, "validation_failed", "body is required.");
+        // §3.5's budget, enforced here rather than left to the CHECK: a client
+        // gets a code it can act on instead of a raw constraint-violation 500.
+        if (commentBody.length > 10_000) {
+            return fail(c, 400, "body_too_large", "A comment may be at most 10,000 characters.");
+        }
+        const commentId = body?.id === undefined ? randomUUID() : rowId(body.id, ID_PREFIX.comment);
+        if (!commentId) {
+            return fail(c, 400, "validation_failed", `id must be a UUIDv7, optionally prefixed "${ID_PREFIX.comment}".`);
+        }
+        /**
+         * A RETRY IS NOT AN ERROR — the same measured bug as `POST /threads`.
+         *
+         * A client-minted comment id sent twice hit the primary key and came back
+         * `500 internal_error`, with the reply already stored. On the reply
+         * composer that is a double-tapped Send, or a connection that dropped
+         * between the write and the response — and the reviewer is told their
+         * reply was lost while it sits in the thread.
+         *
+         * Checked BEFORE the write here rather than caught after, unlike the
+         * thread route, because this transaction also bumps two counters and
+         * queues a notification: relying on the whole thing rolling back to keep
+         * those correct is a much larger claim than relying on one INSERT to fail.
+         * The cost is one indexed lookup on a route that is not the hot path.
+         */
+        const [alreadyThere] = await sql `
+      SELECT id, body, created_at FROM comments
+       WHERE id = ${commentId}::uuid AND thread_id = ${thread.id}::uuid AND deleted_at IS NULL
+    `;
+        if (alreadyThere) {
+            const [author] = await sql `
+        SELECT r.id, r.name, r.kind FROM reviewers r
+          JOIN comments c ON c.author_id = r.id WHERE c.id = ${commentId}::uuid
+      `;
+            return c.json({
+                id: ID_PREFIX.comment + alreadyThere.id,
+                body: alreadyThere.body,
+                createdAt: alreadyThere.created_at.toISOString(),
+                author: {
+                    id: ID_PREFIX.reviewer + author.id,
+                    name: author.name,
+                    kind: author.kind,
+                },
+            }, 
+            // 200, not 201: this request created nothing.
+            200);
+        }
+        const created = await sql.begin(async (tx) => {
+            await tx `SELECT set_config('app.org_id', ${thread.org_id}, true)`;
+            // The author. A session's `sub` IS a `reviewers.id` (05 §4.4) — nothing
+            // to resolve. An OWNER has no reviewer row yet the first time they post
+            // from the dashboard, so one is found-or-created here: `kind='verified'`
+            // with `user_id` set satisfies 0001_init.sql's CHECK on that kind
+            // without a `holder_secret_hash`, which only non-verified kinds need.
+            let reviewerId;
+            if (session) {
+                reviewerId = session.sub;
+            }
+            else if (asAgent && !asOwner) {
+                // 05 §9.6's representation, via the one helper that knows it:
+                // kind='guest', is_agent, agent_mcp_token_id. NEVER 'verified'.
+                reviewerId = await agentReviewer(tx, {
+                    orgId: thread.org_id,
+                    projectId: thread.project_id,
+                    tokenId: mcp.tokenId,
+                    tokenName: mcp.name,
+                });
+            }
+            else {
+                const o = owner;
+                const [existing] = await tx `
+          SELECT id FROM reviewers
+          WHERE project_id = ${thread.project_id}::uuid AND user_id = ${o.userId}::uuid AND kind = 'verified'
+        `;
+                if (existing) {
+                    reviewerId = existing.id;
+                }
+                else {
+                    reviewerId = randomUUID();
+                    await tx `
+            INSERT INTO reviewers (id, org_id, project_id, kind, name, email, user_id)
+            VALUES (${reviewerId}::uuid, ${thread.org_id}::uuid, ${thread.project_id}::uuid, 'verified',
+                    ${o.name || o.email}, ${o.email}, ${o.userId}::uuid)
+          `;
+                }
+            }
+            // Locked here, not read-then-trusted: `seq` and both counters are
+            // derived from THIS row under the lock, so two replies landing at once
+            // serialise instead of racing to the same `seq` (§6.4, verbatim).
+            const [row] = await tx `
+        SELECT comment_count, comment_count_public FROM threads WHERE id = ${thread.id}::uuid FOR UPDATE
+      `;
+            const seq = row.comment_count + 1;
+            const publicCount = wantPrivate ? row.comment_count_public : row.comment_count_public + 1;
+            const [comment] = await tx `
+        INSERT INTO comments (id, org_id, project_id, thread_id, seq, author_id, body, private)
+        VALUES (${commentId}::uuid, ${thread.org_id}::uuid, ${thread.project_id}::uuid, ${thread.id}::uuid,
+                ${seq}, ${reviewerId}::uuid, ${commentBody}, ${wantPrivate})
+        RETURNING id, body, created_at
+      `;
+            await tx `
+        UPDATE threads
+        SET comment_count = comment_count + 1,
+            comment_count_public = ${publicCount},
+            version = version + 1,
+            updated_at = now()
+        WHERE id = ${thread.id}::uuid
+      `;
+            const [author] = await tx `
+        SELECT id, name, kind FROM reviewers WHERE id = ${reviewerId}::uuid
+      `;
+            // 07 §8.6 mitigation 8, in THIS transaction — so the audit row and the
+            // comment it records commit together and the budget above can never see
+            // fewer writes than actually happened.
+            if (asAgent && !asOwner && !asSession) {
+                await recordAgentWrite(tx, {
+                    orgId: thread.org_id,
+                    projectId: thread.project_id,
+                    type: "comment.created",
+                    subjectType: "comment",
+                    subjectId: comment.id,
+                    reviewerId,
+                    tokenId: mcp.tokenId,
+                });
+            }
+            /**
+             * The notification, queued in THIS transaction (07 §2.5).
+             *
+             * A comment that commits without its outbox row is a notification that
+             * never happens; a row that commits without its comment is mail about
+             * something that does not exist. One transaction rules out both, and it
+             * is the reason `queueCommentNotice` takes `tx` rather than a pool.
+             *
+             * PRIVATE COMMENTS ARE NOT MAILED. A private reply is visible only to
+             * the owner's side of the conversation, and while the owner is exactly
+             * who this mail goes to, the body would then sit in an inbox — and in
+             * whatever forwards, backs up or indexes it — for a comment the product
+             * promises is private. Not worth the surprise for a notification.
+             */
+            if (!wantPrivate && deps.notifications) {
+                await queueCommentNotice(tx, {
+                    orgId: thread.org_id,
+                    projectId: thread.project_id,
+                    threadId: thread.id,
+                    commentId: comment.id,
+                    threadKey: thread.key,
+                    authorId: reviewerId,
+                    authorName: author?.name ?? "Someone",
+                    body: comment.body,
+                    pageUrl: thread.page_url ?? "",
+                }, randomUUID());
+            }
+            return { comment: comment, author: author };
+        });
+        // The SAME shape the list route embeds per comment (`threads.ts`'s
+        // `shape()`) — a client merging this response into a thread it already
+        // holds must not learn a different Comment type depending on which route
+        // produced it.
+        return c.json({
+            id: ID_PREFIX.comment + created.comment.id,
+            body: created.comment.body,
+            createdAt: created.comment.created_at.toISOString(),
+            author: {
+                id: ID_PREFIX.reviewer + created.author.id,
+                name: created.author.name,
+                kind: created.author.kind,
+            },
+        }, 201);
+    };
+    app.post("/api/v1/threads/:id/comments", handle);
+    app.post("/api/v1/projects/:uid/threads/:id/comments", handle);
+    return app;
+}
+//# sourceMappingURL=comments.js.map

package/dist/routes/comments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comments.js","sourceRoot":"","sources":["../../src/routes/comments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGjD,OAAO,EAAE,MAAM,EAAoB,MAAM,YAAY,CAAC;AAEtD,OAAO,EACL,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAmCvD,SAAS,IAAI,CAAC,CAAM,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,OAAiB;IACpF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,EAC5F,MAAa,CACd,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,SAAS,KAAK,CAAC,IAAa,EAAE,MAAc;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAuBD,MAAM,UAAU,aAAa,CAAC,IAAiB;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAErB,MAAM,MAAM,GAAG,KAAK,EAAE,CAAM,EAAE,EAAE;QAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;QAE3E,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,CAUzB;;;;;;;;qBAQgB,SAAS;KACzB,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;QAExE,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QAEtF,qEAAqE;QACrE,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;YACzE,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,KAAK,sCAAsC,EAAE;oBAC1F,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC;QACzD,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAE7G;;;;;WAKG;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAChE,IAAI,GAAG,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAE7D,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,mDAAmD,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,WAAW,EACX,KAAK,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,0CAA0C,CACpG,CAAC;QACJ,CAAC;QAED;;;;;;;;;;WAUG;QACH,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,wDAAwD,CAAC,CAAC;QAC7F,CAAC;QAED,uEAAuE;QACvE,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAI,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,yEAAyE,CAAC,CAAC;QAChH,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,iDAAiD;QACjD,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;QAC7D,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,qCAAqC;QACrC,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,yCAAyC,EAAE;gBACpF,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,OAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvG,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,oDAAoD,EAAE;gBAC/F,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;QAChF,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,WAAW,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,6CAA6C,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5F,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,6CAA6C,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC;QAC/G,CAAC;QAED;;;;;;;;;;;;;;WAcG;QACH,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,GAAG,CAAkD;;oBAElE,SAAS,0BAA0B,MAAM,CAAC,EAAE;KAC3D,CAAC;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,CAA8C;;+DAEf,SAAS;OACjE,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,EAAE,EAAE,SAAS,CAAC,OAAO,GAAG,YAAY,CAAC,EAAE;gBACvC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE;gBAChD,MAAM,EAAE;oBACN,EAAE,EAAE,SAAS,CAAC,QAAQ,GAAG,MAAO,CAAC,EAAE;oBACnC,IAAI,EAAE,MAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,MAAO,CAAC,IAAI;iBACnB;aACF;YACD,8CAA8C;YAC9C,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3C,MAAM,EAAE,CAAA,mCAAmC,MAAM,CAAC,MAAM,SAAS,CAAC;YAElE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;YAClE,sEAAsE;YACtE,IAAI,UAAkB,CAAC;YACvB,IAAI,OAAO,EAAE,CAAC;gBACZ,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC;YAC3B,CAAC;iBAAM,IAAI,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC/B,8DAA8D;gBAC9D,gEAAgE;gBAChE,UAAU,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE;oBACnC,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,OAAO,EAAE,GAAI,CAAC,OAAO;oBACrB,SAAS,EAAE,GAAI,CAAC,IAAI;iBACrB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,KAAM,CAAC;gBACjB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAkB;;+BAEtB,MAAM,CAAC,UAAU,wBAAwB,CAAC,CAAC,MAAM;SACvE,CAAC;gBACF,IAAI,QAAQ,EAAE,CAAC;oBACb,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,UAAU,GAAG,UAAU,EAAE,CAAC;oBAC1B,MAAM,EAAE,CAAA;;sBAEI,UAAU,WAAW,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,UAAU;sBAC9D,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM;WACrD,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,uEAAuE;YACvE,kEAAkE;YAClE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAA2D;6EACV,MAAM,CAAC,EAAE;OAC/E,CAAC;YACF,MAAM,GAAG,GAAG,GAAI,CAAC,aAAa,GAAG,CAAC,CAAC;YACnC,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,GAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAI,CAAC,oBAAoB,GAAG,CAAC,CAAC;YAE5F,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAkD;;kBAEhE,SAAS,WAAW,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,UAAU,WAAW,MAAM,CAAC,EAAE;kBACjF,GAAG,KAAK,UAAU,WAAW,WAAW,KAAK,WAAW;;OAEnE,CAAC;YAEF,MAAM,EAAE,CAAA;;;qCAGuB,WAAW;;;qBAG3B,MAAM,CAAC,EAAE;OACvB,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAA8C;0DACnB,UAAU;OAC7D,CAAC;YAEF,uEAAuE;YACvE,wEAAwE;YACxE,uCAAuC;YACvC,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;gBACtC,MAAM,gBAAgB,CAAC,EAAE,EAAE;oBACzB,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,SAAS;oBACtB,SAAS,EAAE,OAAQ,CAAC,EAAE;oBACtB,UAAU;oBACV,OAAO,EAAE,GAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;YAED;;;;;;;;;;;;;eAaG;YACH,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvC,MAAM,kBAAkB,CACtB,EAAE,EACF;oBACE,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,SAAS,EAAE,OAAQ,CAAC,EAAE;oBACtB,SAAS,EAAE,MAAM,CAAC,GAAG;oBACrB,QAAQ,EAAE,UAAU;oBACpB,UAAU,EAAE,MAAM,EAAE,IAAI,IAAI,SAAS;oBACrC,IAAI,EAAE,OAAQ,CAAC,IAAI;oBACnB,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;iBAC/B,EACD,UAAU,EAAE,CACb,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,OAAQ,EAAE,MAAM,EAAE,MAAO,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,mEAAmE;QACnE,uEAAuE;QACvE,yEAAyE;QACzE,eAAe;QACf,OAAO,CAAC,CAAC,IAAI,CACX;YACE,EAAE,EAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE;YAC1C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAC1B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE;YACnD,MAAM,EAAE;gBACN,EAAE,EAAE,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE;gBAC1C,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;gBACzB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;aAC1B;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC;IACjD,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE,MAAM,CAAC,CAAC;IAE/D,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/cors.js

@@ -0,0 +1,174 @@
+import { HTTP_HEADER } from "../vendor/types/names.js";
+/**
+ * The request headers a widget may send — 05 §2.3's request rows, plus the two
+ * standard ones. Built from the registry rather than typed out, so adding a
+ * header to a request without listing it here is not possible.
+ */
+const ALLOWED_REQUEST_HEADERS = [
+    "content-type",
+    "authorization",
+    HTTP_HEADER.client,
+    HTTP_HEADER.schema,
+    HTTP_HEADER.idempotencyKey,
+    HTTP_HEADER.identity,
+    HTTP_HEADER.attachmentKind,
+    HTTP_HEADER.attachmentWidth,
+    HTTP_HEADER.attachmentHeight,
+].join(", ");
+/**
+ * 05 §5.1's CORS classes, and 08 §3.5's D2 — *"origin suggestion, never origin
+ * auto-allow"*.
+ *
+ * | Class          | Allow-Origin                                    |
+ * |----------------|-------------------------------------------------|
+ * | Public-read    | echo any Origin (`GET …/config`, `GET …/meta`)  |
+ * | Project-scoped | echo ONLY if allow-listed; otherwise omit       |
+ * | Dashboard      | no CORS headers at all (`/api/v1/setup`, `/auth`)|
+ *
+ * "Otherwise omit the header entirely" is the load-bearing half, and it is why
+ * this returns a header rather than a 403: the browser is the enforcement
+ * point. A response with no `Access-Control-Allow-Origin` is unreadable to the
+ * calling page no matter what its status says, and a 403 with a body would
+ * leak whether the uid exists to any origin that asks.
+ *
+ * The reason it is a suggestion and never an auto-allow is foundations §8:
+ * `Origin` is attacker-controllable. Auto-allowing would be an
+ * attacker-controlled header driving a state transition that GRANTS access —
+ * the mirror image of the denial-of-service case §8 already forbids. Recording
+ * it is inert data; a human clicking "Add this origin" is the transition.
+ */
+/** 05 §3.7: exact origin, or a single-level wildcard host. Scheme mandatory. */
+function matches(pattern, origin) {
+    if (pattern === origin)
+        return true;
+    if (!pattern.includes("*"))
+        return false;
+    // `https://*.acme.com` matches `https://staging.acme.com` and NOT
+    // `https://a.b.acme.com` — single level, because a wildcard that crosses
+    // dots allows any subdomain a subdomain-takeover can mint.
+    const [scheme, host] = pattern.split("://");
+    const [oScheme, oHost] = origin.split("://");
+    if (scheme !== oScheme || !host || !oHost)
+        return false;
+    const suffix = host.slice(1); // ".acme.com"
+    return oHost.endsWith(suffix) && !oHost.slice(0, -suffix.length).includes(".");
+}
+export async function allowedOrigins(sql, projectId) {
+    const rows = await sql `
+    SELECT pattern FROM project_origins WHERE project_id = ${projectId}
+  `;
+    return rows.map((r) => r.pattern);
+}
+export function isAllowed(patterns, origin) {
+    return patterns.some((p) => matches(p, origin.toLowerCase()));
+}
+/**
+ * 08 §3.5 D2's ledger. Capped at 5 distinct origins per project (05 owns the
+ * number), so a page that iterates hostnames cannot grow the table.
+ *
+ * `write_attempted` distinguishes the two cases the dashboard phrases
+ * differently: a bare `/config` fetch is *"add this origin?"*, while a write
+ * from an unknown origin is *"your project uid is in use somewhere else"*.
+ */
+export async function recordOrigin(sql, orgId, projectId, origin, wroteAttempt) {
+    try {
+        await sql `
+      INSERT INTO origin_violations (org_id, project_id, origin, write_attempted)
+      SELECT ${orgId}, ${projectId}, ${origin}, ${wroteAttempt}
+      WHERE (SELECT count(*) FROM origin_violations WHERE project_id = ${projectId}) < 5
+      ON CONFLICT (project_id, origin) DO UPDATE
+        SET hits = origin_violations.hits + 1,
+            last_seen_at = now(),
+            write_attempted = origin_violations.write_attempted OR EXCLUDED.write_attempted
+    `;
+    }
+    catch {
+        // A ledger write must never fail the request it is observing. The
+        // suggestion is a convenience; the CORS decision above it already happened.
+    }
+}
+/**
+ * The middleware, mounted at the APP level rather than inside a route group.
+ *
+ * It lived inside `threadRoutes` first, and the sessions route — registered
+ * before it — answered without an `Access-Control-Allow-Origin` header. The
+ * preflight still passed, because the OPTIONS handler was in the group that
+ * had the middleware, so the browser reported `net::ERR_FAILED` on the POST
+ * with a green OPTIONS above it: a CORS failure that looks like a network
+ * fault. Route-group middleware only covers the routes registered after it in
+ * that group, and a credential exchange is exactly the route you cannot afford
+ * to leave outside.
+ */
+export function corsForProjects(sql, lookup) {
+    /**
+     * The allow-list, memoised for 10 s — the same bargain and the same number as
+     * the project cache (05 §4.4).
+     *
+     * This was the last uncached query on the widget's hot path: one SELECT
+     * before every request, to read three rows that change when an operator runs
+     * `snagset allow-origin`. Ten seconds is the lag that buys, and it errs the
+     * safe way round — a NEWLY allowed origin waits up to ten seconds to work,
+     * which reads as "it took a moment"; a REVOKED one is not the control that
+     * matters here, since removing an origin is not how access is withdrawn
+     * (that is the link revoke, and it bumps `session_epoch`).
+     *
+     * Scoped to this middleware instance, so an app built by a test starts cold.
+     */
+    const ORIGINS_TTL_MS = 10_000;
+    const originCache = new Map();
+    const patternsFor = async (projectId) => {
+        const hit = originCache.get(projectId);
+        if (hit && Date.now() - hit.at < ORIGINS_TTL_MS)
+            return hit.patterns;
+        const patterns = await allowedOrigins(sql, projectId);
+        originCache.set(projectId, { at: Date.now(), patterns });
+        return patterns;
+    };
+    return async (c, next) => {
+        const origin = c.req.header("Origin");
+        // PUBLIC-READ (§5.1): `/config` echoes any origin, because that fetch is
+        // how an unknown origin becomes a suggestion in the first place — refusing
+        // it means the operator never sees the origin they are about to approve.
+        // The session exchange is PROJECT-SCOPED: it mints a credential.
+        const isPublicRead = c.req.path.endsWith("/config");
+        const uid = c.req.param("uid");
+        if (origin && uid) {
+            const project = await lookup(uid).catch(() => null);
+            if (project) {
+                const patterns = await patternsFor(project.id);
+                const ok = isAllowed(patterns, origin);
+                /**
+                 * The verdict, stashed for the config route (05 §7.2's origin-aware
+                 * body, D69). Computed HERE and not re-derived in the route because
+                 * "is this origin allowed" answered in two places is how the two
+                 * answers drift — and this one gates what the response discloses.
+                 */
+                c.set("originAllowed", ok);
+                if (ok || isPublicRead) {
+                    c.header("Access-Control-Allow-Origin", origin);
+                    c.header("Vary", "Origin");
+                    // §5.1: "Credentials: never" on both classes. The bearer travels in
+                    // an Authorization header, not a cookie, which is also why no widget
+                    // route needs CSRF machinery.
+                    // EVERY header the widget sends, not just the obvious two. A
+                    // preflight that omits one makes the browser block the real
+                    // request while the OPTIONS still answers 204 — the failure looks
+                    // like a network fault, and it is exactly how the screenshot
+                    // upload failed after the session exchange had already taught the
+                    // same lesson one layer up. Generated from the registry so a new
+                    // header cannot be added to a request without appearing here.
+                    c.header("Access-Control-Allow-Headers", ALLOWED_REQUEST_HEADERS);
+                    c.header("Access-Control-Allow-Methods", "GET,POST,PATCH,OPTIONS");
+                    c.header("Access-Control-Max-Age", "600");
+                }
+                // 08 §3.5 D2 — inert data plus a human decision, never a transition.
+                if (!ok)
+                    void recordOrigin(sql, project.org_id, project.id, origin.toLowerCase(), !isPublicRead);
+            }
+        }
+        if (c.req.method === "OPTIONS")
+            return c.body(null, 204);
+        return next();
+    };
+}
+//# sourceMappingURL=cors.js.map

package/dist/routes/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/routes/cors.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,uBAAuB,GAAG;IAC9B,cAAc;IACd,eAAe;IACf,WAAW,CAAC,MAAM;IAClB,WAAW,CAAC,MAAM;IAClB,WAAW,CAAC,cAAc;IAC1B,WAAW,CAAC,QAAQ;IACpB,WAAW,CAAC,cAAc;IAC1B,WAAW,CAAC,eAAe;IAC3B,WAAW,CAAC,gBAAgB;CAC7B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gFAAgF;AAChF,SAAS,OAAO,CAAC,OAAe,EAAE,MAAc;IAC9C,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,kEAAkE;IAClE,yEAAyE;IACzE,2DAA2D;IAC3D,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc;IAC5C,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAiB,EAAE,SAAiB;IACvE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAuB;6DACc,SAAS;GACnE,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAA2B,EAAE,MAAc;IACnE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAiB,EACjB,KAAa,EACb,SAAiB,EACjB,MAAc,EACd,YAAqB;IAErB,IAAI,CAAC;QACH,MAAM,GAAG,CAAA;;eAEE,KAAK,KAAK,SAAS,KAAK,MAAM,KAAK,YAAY;yEACW,SAAS;;;;;KAK7E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,4EAA4E;IAC9E,CAAC;AACH,CAAC;AAGD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAiB,EACjB,MAAuE;IAEvE;;;;;;;;;;;;;OAaG;IACH,MAAM,cAAc,GAAG,MAAM,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC1E,MAAM,WAAW,GAAG,KAAK,EAAE,SAAiB,EAAqB,EAAE;QACjE,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,cAAc;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACtD,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC/C,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACvC;;;;;mBAKG;gBACH,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;gBAC3B,IAAI,EAAE,IAAI,YAAY,EAAE,CAAC;oBACvB,CAAC,CAAC,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;oBAChD,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;oBAC3B,oEAAoE;oBACpE,qEAAqE;oBACrE,8BAA8B;oBAC9B,6DAA6D;oBAC7D,4DAA4D;oBAC5D,kEAAkE;oBAClE,6DAA6D;oBAC7D,kEAAkE;oBAClE,iEAAiE;oBACjE,8DAA8D;oBAC9D,CAAC,CAAC,MAAM,CAAC,8BAA8B,EAAE,uBAAuB,CAAC,CAAC;oBAClE,CAAC,CAAC,MAAM,CAAC,8BAA8B,EAAE,wBAAwB,CAAC,CAAC;oBACnE,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;gBAC5C,CAAC;gBACD,qEAAqE;gBACrE,IAAI,CAAC,EAAE;oBAAE,KAAK,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/jobs.js

@@ -0,0 +1,56 @@
+import { Hono } from "hono";
+import { runDueJobs, summarise } from "../jobs/index.js";
+import { l1Jobs } from "../jobs/reaper.js";
+import { selectMailer } from "../mail/index.js";
+import { deliverEmail } from "../mail/notify.js";
+import { getBucket } from "../storage/settings.js";
+import { createKeyring } from "../keys.js";
+import { resolveSecretKey } from "../boot.js";
+export function jobsRoutes(deps) {
+    const app = new Hono();
+    const { sql, cfg } = deps;
+    app.get("/api/jobs/run", async (c) => {
+        const secret = process.env["CRON_SECRET"];
+        if (!secret) {
+            return c.json({
+                error: "cron_not_configured",
+                message: "CRON_SECRET is not set, so this endpoint refuses every request. Set it in the " +
+                    "deployment's environment; the platform sends it as a bearer token on scheduled " +
+                    "invocations. An open jobs endpoint is a way to make this instance send mail on demand.",
+            }, 503);
+        }
+        // Both forms: platforms differ on whether they prefix, and accepting both
+        // costs nothing while saving an operator an hour on a 401 with no body.
+        const offered = (c.req.header("authorization") ?? "").replace(/^Bearer\s+/i, "");
+        if (!timingSafeEqualStr(offered, secret)) {
+            return c.json({ error: "unauthorized", message: "Bad or missing cron token." }, 401);
+        }
+        const keys = createKeyring(resolveSecretKey(cfg, null, () => { }), cfg.get("SNAGSET_SECRET_KEY_PREVIOUS"));
+        const bucket = await getBucket(sql, keys).catch(() => null);
+        const mailer = selectMailer(cfg);
+        const jobs = [...l1Jobs(bucket), deliverEmail(mailer, cfg.get("SNAGSET_BASE_URL") ?? "", keys)];
+        // Well inside a platform's function ceiling. A tick that runs out of budget
+        // leaves the rest for the next minute, which is what `runDueJobs` is built
+        // for; the alternative is a function killed mid-transaction.
+        const summary = await runDueJobs(sql, jobs, { budgetMs: 25_000, log: (m) => console.log(m) });
+        if (summary.ran.some((r) => r.did > 0) || summary.failed.length)
+            console.log(summarise(summary));
+        return c.json({
+            ms: summary.ms,
+            ran: summary.ran,
+            skipped: summary.skipped,
+            failed: summary.failed,
+        });
+    });
+    return app;
+}
+/** Constant-time compare, so the token cannot be recovered by timing. */
+function timingSafeEqualStr(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+//# sourceMappingURL=jobs.js.map

package/dist/routes/jobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobs.js","sourceRoot":"","sources":["../../src/routes/jobs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA8B9C,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE1B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,qBAAqB;gBAC5B,OAAO,EACL,gFAAgF;oBAChF,iFAAiF;oBACjF,wFAAwF;aAC3F,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,IAAI,GAAG,aAAa,CACxB,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,EACrC,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,CACvC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAEhG,4EAA4E;QAC5E,2EAA2E;QAC3E,6DAA6D;QAC7D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9F,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAEjG,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}