@songsid/agend 2.3.3 → 2.3.4-beta.1

package/dist/web-api.js

@@ -1,4 +1,5 @@
 import { CANVAS_WORKER_EXPERIMENTAL_MESSAGE } from "./web-experimental.js";
+import { daemonTopicMode } from "./web-only-fleet.js";
 import { webHumanOrigin } from "./human-delivery-receipts.js";
 import { classifyWebPeer, confirmAfterBody, noAuthority } from "./authority/web-authority.js";
 import { guestChatRefusal, guestCommandText, guestDeliveries, GUEST_PREF_MAX_BYTES, GUEST_SEARCHES, guestFrameData, guestHistory, guestMessages, guestOwnPrefs, guestPollBody, guestPrefs, guestRequestOf, guestSeesMessage, guestStatus } from "./web-guest-access.js";
@@ -40,6 +41,7 @@ import { z } from "zod";
 import { evaluateWebRequest, isPassiveWebRead, isSecureRequest, isWebRequestAuthorized, WEB_TOKEN_INVALID_MESSAGE } from "./web-auth.js";
 import { dashboardOriginFor } from "./web-preview.js";
 import { WEB_CHAT_CARDS_OVERFLOW, newWebMessageId, parseLastEventId, webChatReplyRef, webChatReplyText } from "./web-chat-history.js";
+import { PAGE_SHARE_LIMITS, htmlFences, htmlTitle } from "./page-share.js";
 import { attachmentDelivery, createPartFile, displayName, fileTooLargeText, INLINE_MIME, isFileId, MEDIA_RANGE_MAX, publicAttachment, UPLOAD_LIMITS, UPLOAD_MAX_MS, UPLOAD_STALL_MS, UploadSniffer, uploadLimits, wellFormed } from "./web-upload.js";
 import { getAgendHome } from "./paths.js";
 import { OPERATOR, isOwnerEffectKey } from "./web-prefs.js";
@@ -539,6 +541,140 @@ function handleOfficeShare(req, res, url, ctx, path, method) {
     });
     return true;
 }
+/**
+ * #2911 item 8: page share links — GET /ui/page-share (the open ones, and whether this fleet offers them), POST
+ * { instance, boot, id, fence | att, minutes? } (a new one: the server reads the HTML itself — the n-th complete ```html
+ * fence of that agent message, or its .html attachment — and answers the URL once the tunnel is up), DELETE
+ * /ui/page-share/<id|all>. The same admin check as the Office share's (handleOfficeShare): an admin session, directly
+ * or over the /web public link; never the CLI token, a read-only session or a guest. Asked again once the body is in.
+ */
+function handlePageShare(req, res, url, ctx, path, method) {
+    const service = ctx.officeShares;
+    if (!service?.createPage || !service.listPages || !service.revokePage || !service.pagesEnabled) {
+        json(res, 404, { error: "Page share links are not kept on this fleet" });
+        return true;
+    }
+    const one = /^\/ui\/page-share\/([0-9a-f]{8}|all)$/.exec(path);
+    const known = (method === "GET" && path === "/ui/page-share") || (method === "POST" && path === "/ui/page-share") || (method === "DELETE" && !!one);
+    if (!known) {
+        json(res, 404, { error: "not found" });
+        return true;
+    }
+    const who = () => {
+        const verdict = evaluateWebRequest(req, url, ctx.webToken ?? null, ctx.webSessions, { touch: false });
+        if (verdict.kind !== "allow")
+            return { status: 401 };
+        if (verdict.via !== "session" || verdict.session?.tier !== "admin")
+            return { status: 403 };
+        const owner = verdict.session.owner;
+        return { person: owner ? webPersonKey(owner) : "admin-session", name: owner ? ctx.webPerson?.(owner)?.name ?? owner.userId : "admin" };
+    };
+    const refuse = (status) => json(res, status, { error: status === 401 ? WEB_TOKEN_INVALID_MESSAGE : "page_share_needs_an_admin_session" });
+    const first = who();
+    if ("status" in first) {
+        refuse(first.status);
+        return true;
+    }
+    res.setHeader("Cache-Control", "no-store");
+    // `cdn`: whether a share made now may load the preview's CDN libraries (the confirm dialog says so).
+    if (method === "GET") {
+        json(res, 200, { enabled: service.pagesEnabled(), cdn: service.pagesCdn?.() === true, shares: service.listPages() });
+        return true;
+    }
+    if (method === "DELETE") {
+        // Its end is said in the instance's channel by the service's change listener (as an expiry is).
+        const n = service.revokePage(one[1]).length;
+        json(res, n ? 200 : 404, n ? { revoked: n } : { error: "not_found" });
+        return true;
+    }
+    (async () => {
+        let body;
+        try {
+            body = await parseBody(req);
+        }
+        catch {
+            json(res, 400, { error: "Invalid JSON" });
+            return;
+        }
+        if (!permitWebContinuation(req, res, ctx))
+            return;
+        const now = who();
+        if ("status" in now) {
+            refuse(now.status);
+            return;
+        }
+        const fence = body?.fence, att = body?.att;
+        if (!body || typeof body !== "object" || Array.isArray(body) || typeof body.instance !== "string" || !body.instance
+            || typeof body.boot !== "string" || !/^[0-9a-f]{1,32}$/.test(body.boot) || !Number.isSafeInteger(body.id) || body.id < 1
+            || (fence === undefined) === (att === undefined)
+            || (fence !== undefined && (!Number.isInteger(fence) || fence < 0 || fence > 999))
+            || (att !== undefined && (typeof att !== "string" || !isFileId(att)))
+            || (body.minutes !== undefined && typeof body.minutes !== "number")) {
+            json(res, 400, { error: "instance, boot, id, and fence (number) or att (file id); minutes? (number)" });
+            return;
+        }
+        const msg = ctx.webChatHistory?.find(body.instance, body.boot, body.id) ?? null;
+        if (!msg || msg.instance !== body.instance) {
+            json(res, 404, { error: "message_gone" });
+            return;
+        }
+        if (msg.role !== "agent") {
+            json(res, 400, { error: "not_an_agent_page" });
+            return;
+        }
+        let html, name = "";
+        if (fence !== undefined) {
+            const f = htmlFences(msg.text)[fence];
+            if (!f || !f.terminated) {
+                json(res, 404, { error: "page_gone" });
+                return;
+            }
+            html = f.code;
+        }
+        else {
+            const a = (msg.attachments ?? []).find((x) => !("gone" in x) && x.id === att);
+            if (!a || a.kind === "photo" || !/\.html?$/i.test(a.name.trim())) {
+                json(res, 404, { error: "page_gone" });
+                return;
+            }
+            const served = ctx.webFiles?.servedFile?.(a.id) ?? null;
+            if (!served) {
+                json(res, 404, { error: "page_gone" });
+                return;
+            }
+            if (served.size > PAGE_SHARE_LIMITS.maxBytes) {
+                json(res, 413, { error: "too_large" });
+                return;
+            }
+            const read = ctx.webFiles?.read?.(a.id) ?? null;
+            if (!read) {
+                json(res, 404, { error: "page_gone" });
+                return;
+            }
+            html = read.bytes.toString("utf8");
+            name = a.name;
+        }
+        const from = { boot: body.boot, id: body.id, ...(fence !== undefined ? { fence: fence } : { att: att }) };
+        // The caller is asked again once the tunnel is up (#2917 review P2): the same admin, the session still live.
+        const stillAllowed = () => { const currentCaller = who(); return !("status" in currentCaller) && currentCaller.person === now.person; };
+        const made = await service.createPage({ html, instance: body.instance, title: htmlTitle(html) || name, owner: now.person, from, stillAllowed,
+            ...(typeof body.minutes === "number" ? { minutes: body.minutes } : {}) });
+        if (!made.ok) {
+            const status = made.error === "disabled" ? 404 : made.error === "tunnel" ? 503 : made.error === "too_many" ? 409 : made.error === "too_large" ? 413 : made.error === "not_allowed" ? 403 : 400;
+            json(res, status, { error: made.error, ...(made.reason ? { reason: made.reason } : {}) });
+            return;
+        }
+        ctx.pageShareNotice?.(now.name, made.share);
+        json(res, 200, { share: made.share, url: made.url });
+    })().catch(err => {
+        ctx.logger.error({ err: err.message }, "Page share failed");
+        try {
+            json(res, 500, { error: "Page share failed" });
+        }
+        catch { /* already answered */ }
+    });
+    return true;
+}
 /**
  * #2513: the Office view's skin packs (web-office-skins.ts). The reads are the offices' (GET /ui/offices): whoever may
  * open the org chart, the public link too (its manifest lists them; a guest's routes do not): the list, a pack's
@@ -2400,6 +2536,8 @@ export function handleWebRequest(req, res, url, ctx) {
         return handleOfficePackChanges(req, res, url, ctx, path, method);
     if (path === "/ui/office-share" || path.startsWith("/ui/office-share/"))
         return handleOfficeShare(req, res, url, ctx, path, method);
+    if (path === "/ui/page-share" || path.startsWith("/ui/page-share/"))
+        return handlePageShare(req, res, url, ctx, path, method);
     // ── #1630: avatars and Discord server emoji, same-origin (the page never loads a platform's CDN; img-src stays 'self') ──
     const imageMatch = path.match(/^\/ui\/img\/(bot|avatar|emoji)\/([^/]+)$/);
     if (method === "GET" && imageMatch) {
@@ -2741,6 +2879,47 @@ export function handleWebRequest(req, res, url, ctx) {
         return handleBackendLogin(req, res, url, ctx, path, method);
     // #1386: Acknowledge a "Needs you" delivery item — a session write (CSRF, checked by the gate) or the CLI's header
     // token. Who did it is recorded by principal: the session's public handle, never the session id or a credential.
+    // #2910 D2: a web-only fleet's Notices — what General would have said. Admins only (never a guest: not in
+    // GUEST_ROUTES). GET /ui/notices/list lists them; POST /ui/notices/seen {id} marks everything up to it read (a session write).
+    if (path === "/ui/notices/list" && method === "GET") {
+        const feed = ctx.webNoticesFeed?.() ?? null;
+        res.setHeader("Cache-Control", "no-store");
+        json(res, 200, feed ? { enabled: true, ...feed.view() } : { enabled: false, items: [], seen: 0, unread: 0 });
+        return true;
+    }
+    if (path === "/ui/notices/seen" && method === "POST") {
+        (async () => {
+            let body;
+            try {
+                body = await parseBody(req);
+            }
+            catch {
+                json(res, 400, { error: "Invalid JSON" });
+                return;
+            }
+            if (!permitWebContinuation(req, res, ctx))
+                return;
+            const id = body && typeof body === "object" ? body.id : undefined;
+            if (typeof id !== "number" || !Number.isSafeInteger(id) || id < 0) {
+                json(res, 400, { error: "id required" });
+                return;
+            }
+            const feed = ctx.webNoticesFeed?.() ?? null;
+            if (!feed) {
+                json(res, 404, { error: "No notices here" });
+                return;
+            }
+            const seen = feed.markSeen(id);
+            json(res, 200, { seen, unread: feed.unread() });
+        })().catch(err => {
+            ctx.logger.error({ err: err.message }, "Notices mark-read failed");
+            try {
+                json(res, 500, { error: "Mark read failed" });
+            }
+            catch { /* already answered */ }
+        });
+        return true;
+    }
     if (method === "POST" && path === "/ui/needs/ack") {
         if (!ctx.acknowledgeNeedsItem) {
             json(res, 404, { error: "Nothing to acknowledge here" });
@@ -2979,7 +3158,7 @@ export function handleWebRequest(req, res, url, ctx) {
             json(res, 404, { error: `Instance not found: ${name}` });
             return true;
         }
-        const topicMode = ctx.fleetConfig?.channel?.mode === "topic";
+        const topicMode = daemonTopicMode(ctx.fleetConfig);
         (async () => {
             let held = false;
             try {