@songsid/agend 2.3.0-beta.2 → 2.3.0-beta.3

package/dist/web-api.js

@@ -1,4 +1,5 @@
 import { webHumanOrigin } from "./human-delivery-receipts.js";
+import { guestFrameData, guestPollBody, guestRequestOf, guestStatus } from "./web-guest-access.js";
 import { withSpawnHoldReply } from "./spawn-hold-reply.js";
 import { binaryProbe } from "./binary-probe.js";
 import { settingsRequestExecution, settingsWrite, isSettingsReplay } from "./settings-request-capability.js";
@@ -97,11 +98,27 @@ const safeInstanceSegment = (name) => /^[^\\/\x00]+$/.test(name) && name !== "."
  * the eviction the dead entry leaks forever, and without the try/catch a
  * single dead client breaks delivery to every client iterated after it.
  */
+/** #1920 phase 1b: the open streams that are a guest's, and whose — each event is projected for them (guestFrameData). */
+const streamGuests = new WeakMap();
 export function broadcastSseEvent(clients, event, data, onError, id) {
     const payload = sseFrame(event, data, id);
     const dead = [];
     for (const client of clients) {
         try {
+            // An admin's stream gets these bytes; a guest's, the event as projected for its scope now, or nothing (no id: it
+            // never replays chat, so a cursor of the admin's stream is not its to hold).
+            const guest = streamGuests.get(client);
+            if (guest) {
+                // The exact session that opened it ended (revoked, expired, rotated away): nothing more, and the stream goes.
+                if (!guest.current()) {
+                    dead.push(client);
+                    continue;
+                }
+                const shown = guestFrameData(event, data, guest.scope());
+                if (shown !== undefined)
+                    client.write(sseFrame(event, shown));
+                continue;
+            }
             client.write(payload);
         }
         catch (err) {
@@ -382,7 +399,7 @@ function handleEffectTrials(req, res, url, ctx, path, method) {
                 css = value;
         }
         catch { /* unavailable is never off */ }
-        // CSS remains a checked runtime value. The authority refuses anything except off on start/read.
+        // CSS is diagnostic for Try; its host-owned shadow shell isolates controls and local paint.
         const actor = Object.freeze({ via: "session", surface: "local", tier: "admin", sessionHash: v.session.idHash, epoch: v.session.handle, person, ownerCss: css });
         return { actor, record: v.session, sessions };
     };
@@ -978,6 +995,12 @@ export function handleWebRequest(req, res, url, ctx) {
     // that arrived while the stream was silent is not skipped by the cursor this answer hands out (#1251
     // review). The page keeps one entry per boot+id, so what it already loaded from /ui/history is not doubled.
     if (method === "GET" && path === "/ui/poll") {
+        // #1920: a guest's poll is projected for its scope (web-guest-access.ts) — the same rule as its stream.
+        const guest = guestRequestOf(req);
+        if (guest) {
+            json(res, 200, guestPollBody(ctx.getUiStatus(), guest.scope(), Date.now()));
+            return true;
+        }
         const history = ctx.webChatHistory;
         const after = url.searchParams.get("after");
         const fresh = after === null || after === ""; // a cursor that is not ours in shape still gets nothing
@@ -1013,9 +1036,15 @@ export function handleWebRequest(req, res, url, ctx) {
         });
         // #1823 (#1830 review): with the status, the server's clock — now and with every heartbeat — that the page counts a
         // poll down by (one write: the frames a connect sends are unchanged in number).
-        res.write(`event: status\ndata: ${JSON.stringify(ctx.getUiStatus())}\n\n${sseClock()}`);
+        // #1920: a guest's stream: its projected status now and with each heartbeat, then only what guestFrameData lets
+        // through — no replay, no ticks, prompts or Needs you.
+        const guest = guestRequestOf(req);
+        if (guest)
+            streamGuests.set(res, guest);
+        const statusFrame = () => `event: status\ndata: ${JSON.stringify(guest ? guestStatus(ctx.getUiStatus(), guest.scope()) : ctx.getUiStatus())}\n\n`;
+        res.write(`${statusFrame()}${sseClock()}`);
         // An EventSource that reconnects says what it last saw: send what it missed, before anything new.
-        const lastSeen = parseLastEventId(req.headers["last-event-id"]);
+        const lastSeen = guest ? null : parseLastEventId(req.headers["last-event-id"]);
         if (lastSeen !== null && ctx.webChatHistory) {
             const history = ctx.webChatHistory;
             for (const m of history.replayFor(lastSeen))
@@ -1023,20 +1052,22 @@ export function handleWebRequest(req, res, url, ctx) {
         }
         // Ticks change messages already sent and carry no cursor: every (re)connect gets where each one is now, so a
         // report that fell into a gap is not lost until a reload (#1253 review). No id: it is not a message.
-        if (ctx.webChatHistory)
+        if (!guest && ctx.webChatHistory)
             res.write(`event: deliveries\ndata: ${JSON.stringify(ctx.webChatHistory.deliveries())}\n\n`);
         // The same for the fleet prompts (C4): one posted, answered or expired during a gap is caught up here.
-        if (ctx.listWebPrompts)
+        if (!guest && ctx.listWebPrompts)
             res.write(`event: prompts\ndata: ${JSON.stringify(ctx.listWebPrompts())}\n\n`);
         // #1386: and "Needs you" as it is now; changes follow as `needs` events.
-        if (ctx.needsYouItems)
+        if (!guest && ctx.needsYouItems)
             res.write(`event: needs\ndata: ${JSON.stringify({ items: ctx.needsYouItems() })}\n\n`);
         ctx.sseClients.add(res);
         const interval = setInterval(() => {
             // A stream authorized once must not outlive the authorization. Re-checked
             // without counting as activity, or an open tab would keep an idle session
             // alive forever; a revoked, expired or rotated-away session ends here.
-            if (!isWebRequestAuthorized(req, url, ctx.webToken, ctx.webSessions, { touch: false })) {
+            // #2049 review: a guest's stream also needs the exact session that opened it — another cookie on the same request
+            // still authenticating does not keep a revoked device's stream (with its scope) alive.
+            if (!isWebRequestAuthorized(req, url, ctx.webToken, ctx.webSessions, { touch: false }) || (guest && !guest.current())) {
                 // Close the connection too, not just the response: an ended response leaves the socket idle in
                 // keep-alive, still held open by whoever's session just ended.
                 const socket = req.socket;
@@ -1049,7 +1080,7 @@ export function handleWebRequest(req, res, url, ctx) {
             }
             try {
                 // Every open dashboard tab, every 10 s: the status of every instance, serialized on the fleet's loop (#1235).
-                res.write(measureSyncWork("web.sseStatus", () => `event: status\ndata: ${JSON.stringify(ctx.getUiStatus())}\n\n`) + sseClock());
+                res.write(measureSyncWork("web.sseStatus", statusFrame) + sseClock());
             }
             catch {
                 cleanup();
@@ -1138,6 +1169,16 @@ export function handleWebRequest(req, res, url, ctx) {
     const fileMatch = path.match(/^\/ui\/file\/([^/]+)$/);
     if (method === "GET" && fileMatch) {
         const id = fileMatch[1];
+        // #1920: a guest gets a file only when its stored instance is in scope — "no such file" otherwise, like an unknown id
+        // (an id from another instance's chat is useless).
+        const guest = guestRequestOf(req);
+        if (guest) {
+            const served = isFileId(id) ? ctx.webFiles?.servedFile?.(id) ?? null : null;
+            if (!served || !guest.scope().has(served.instance)) {
+                json(res, 404, { error: "No such file" });
+                return true;
+            }
+        }
         // #1589: audio and video, played in the page — one byte range at a time (206), by id only, never a whole video in
         // memory. Every other type is answered exactly as before.
         const media = isFileId(id) ? ctx.webFiles?.mediaOf?.(id) ?? null : null;
@@ -2131,6 +2172,12 @@ export function handleWebRequest(req, res, url, ctx) {
         json(res, 200, ctx.orgChart?.() ?? { general: [], teams: [], instances: {} });
         return true;
     }
+    // #1918: the org canvas's traffic on opening, and the public link's (which has no stream) on its poll cadence. The
+    // fleet works it out at most once every two seconds and caps it, whoever asks how often.
+    if (method === "GET" && path === "/ui/traffic") {
+        json(res, 200, ctx.trafficSnapshot?.() ?? { now: new Date().toISOString(), items: [] });
+        return true;
+    }
     if (method === "GET" && path === "/ui/teams") {
         const teams = ctx.fleetConfig?.teams ?? {};
         json(res, 200, { teams });
@@ -2389,8 +2436,8 @@ function handleSendMessage(req, res, ctx) {
                 && !ctx.isClassicInstance?.(instance) && syncAdapter && groupId && topicId != null;
             // Add no runtime credentials or local attachment paths to the display copy.
             const preview = webEchoPreview(message, files.map(f => f.name));
-            // ClassicBot echo (#1320 part B): same ordering lane, per-entry
-            // opt-in resolved at send time inside sendClassicWebEcho.
+            // ClassicBot echo (#1320 part B): same ordering lane, each room's setting (#2054: on unless it says false, or
+            // the fleet-wide switch is off for a room that is unset) resolved at send time inside sendClassicWebEcho.
             const canClassicEcho = ctx.isClassicInstance?.(instance) === true && !!ctx.sendClassicWebEcho;
             const settleClassicEcho = canClassicEcho ? ctx.reserveWebChannelEcho?.(instance, async () => {
                 await ctx.sendClassicWebEcho(instance, formatWebChannelEcho(person.name, preview, t("web.echo_full_text")), person.name);