@standardagents/builder 0.41.15 → 0.41.17

package/dist/built-in-routes.js

@@ -9948,6 +9948,24 @@ var init_platform_handoff_jtis = __esm({
   }
 });
 
+// src/durable-objects/agentbuilder-migrations/0022_application_roles.ts
+var migration60;
+var init_application_roles = __esm({
+  "src/durable-objects/agentbuilder-migrations/0022_application_roles.ts"() {
+    migration60 = {
+      version: 22,
+      async up(sql) {
+        sql.exec(`CREATE TABLE platform_application_roles (
+      platform_user_id TEXT PRIMARY KEY,
+      roles TEXT NOT NULL DEFAULT '[]',
+      roles_version INTEGER NOT NULL DEFAULT 0
+    )`);
+        sql.exec(`INSERT OR REPLACE INTO _metadata (key, value) VALUES ('schema_version', '22')`);
+      }
+    };
+  }
+});
+
 // src/durable-objects/agentbuilder-migrations/index.ts
 var migrations2;
 var init_agentbuilder_migrations = __esm({
@@ -9973,9 +9991,10 @@ var init_agentbuilder_migrations = __esm({
     init_scope_skills();
     init_websocket_tickets();
     init_platform_handoff_jtis();
-    migrations2 = [migration39, migration40, migration41, migration42, migration43, migration44, migration45, migration46, migration47, migration48, migration49, migration50, migration51, migration52, migration53, migration54, migration55, migration56, migration57, migration58, migration59];
+    init_application_roles();
+    migrations2 = [migration39, migration40, migration41, migration42, migration43, migration44, migration45, migration46, migration47, migration48, migration49, migration50, migration51, migration52, migration53, migration54, migration55, migration56, migration57, migration58, migration59, migration60];
     migrations2.reduce(
-      (max, migration60) => Math.max(max, migration60.version),
+      (max, migration61) => Math.max(max, migration61.version),
       0
     );
   }
@@ -13781,9 +13800,9 @@ var init_DurableThread = __esm({
        * Each migration is run in order, starting from the current version + 1.
        */
       async runMigrations(fromVersion) {
-        for (const migration60 of migrations) {
-          if (migration60.version > fromVersion) {
-            await migration60.up(this.ctx.storage.sql);
+        for (const migration61 of migrations) {
+          if (migration61.version > fromVersion) {
+            await migration61.up(this.ctx.storage.sql);
           }
         }
       }
@@ -25378,6 +25397,7 @@ var init_ThreadStateImpl = __esm({
           username: user.username,
           role: user.role,
           permissions: user.permissions ?? null,
+          roles: user.roles ?? [],
           email: user.email ?? null,
           display_name: user.display_name ?? null,
           avatar_url: user.avatar_url ?? null
@@ -78945,6 +78965,8 @@ function parseWebSocketTicketAuth(authJson) {
   if (typeof user.id !== "string" || typeof user.username !== "string" || typeof user.role !== "string" || record24.authType !== "super_admin" && record24.authType !== "session" && record24.authType !== "api_key") {
     return null;
   }
+  const roles = user.roles;
+  if (roles !== void 0 && (!Array.isArray(roles) || !roles.every((role) => typeof role === "string"))) return null;
   const permissions = user.permissions;
   if (permissions !== void 0 && permissions !== null && (!Array.isArray(permissions) || !permissions.every((permission) => typeof permission === "string"))) {
     return null;
@@ -78956,6 +78978,7 @@ function parseWebSocketTicketAuth(authJson) {
       username: user.username,
       role: user.role,
       permissions,
+      roles: Array.isArray(roles) ? roles : [],
       platform_user_id: typeof user.platform_user_id === "string" ? user.platform_user_id : null,
       email: typeof user.email === "string" ? user.email : null,
       display_name: typeof user.display_name === "string" ? user.display_name : null,
@@ -78979,7 +79002,19 @@ async function consumeWebSocketTicket(request, env2) {
     ticket_hash: await hashToken(ticket),
     pathname: url.pathname
   });
-  return typeof authJson === "string" ? parseWebSocketTicketAuth(authJson) : null;
+  const context = typeof authJson === "string" ? parseWebSocketTicketAuth(authJson) : null;
+  if (!context || context.authType === "super_admin") return context;
+  const user = await getAgentBuilder(env2).getUserById(context.user.id);
+  if (!user) return null;
+  return {
+    ...context,
+    user: {
+      ...context.user,
+      role: user.role,
+      permissions: parsePermissions(user.permissions),
+      roles: user.roles ?? []
+    }
+  };
 }
 function isWebSocketTicketPath(pathname) {
   if (!pathname.startsWith("/api/") || pathname.includes("?") || pathname.includes("#")) return false;
@@ -79010,7 +79045,8 @@ async function authenticate(request, env2) {
             user: {
               id: "super_admin",
               username: "admin",
-              role: "admin"
+              role: "admin",
+              roles: []
             },
             authType: "super_admin"
           };
@@ -79031,6 +79067,7 @@ async function authenticate(request, env2) {
             username: user.username,
             role: user.role,
             permissions: parsePermissions(user.permissions),
+            roles: user.roles ?? [],
             platform_user_id: user.platform_user_id ?? null,
             email: user.email ?? null,
             display_name: user.display_name ?? null,
@@ -79054,6 +79091,7 @@ async function authenticate(request, env2) {
             username: user.username,
             role: user.role,
             permissions: parsePermissions(user.permissions),
+            roles: user.roles ?? [],
             platform_user_id: user.platform_user_id ?? null,
             email: user.email ?? null,
             display_name: user.display_name ?? null,
@@ -79332,6 +79370,8 @@ function normalizeLocalBootstrap(payload, endpoint) {
       id: platformUserId,
       username,
       role,
+      roles: Array.isArray(payload.user?.roles) && payload.user.roles.every((role2) => typeof role2 === "string") ? payload.user.roles : [],
+      roles_version: typeof payload.user?.roles_version === "number" ? payload.user.roles_version : 0,
       email: typeof payload.user?.email === "string" ? payload.user.email : null,
       display_name: typeof payload.user?.display_name === "string" ? payload.user.display_name : null,
       avatar_url: typeof payload.user?.avatar_url === "string" ? payload.user.avatar_url : null,
@@ -79389,7 +79429,9 @@ async function upsertReplicaUserForPlatformProfile(env2, profile) {
     email: profile.email ?? null,
     avatar_url: profile.avatar_url ?? null,
     role: profile.role ?? "admin",
-    permissions: profile.permissions ?? null
+    permissions: profile.permissions ?? null,
+    roles: profile.roles ?? [],
+    roles_version: profile.roles_version
   });
 }
 async function mintLocalSessionForPlatformUser(env2, platformUser) {
@@ -79403,7 +79445,7 @@ async function mintLocalSessionForPlatformUser(env2, platformUser) {
   const tokenHash = await hashToken(token);
   const expiresAt = Math.floor(Date.now() / 1e3) + SESSION_TTL_SECONDS;
   await agentBuilder.createSession({ user_id: user.id, token_hash: tokenHash, expires_at: expiresAt });
-  return { token, user: { id: user.id, username: user.username, role: user.role } };
+  return { token, user: { id: user.id, username: user.username, role: user.role, roles: user.roles ?? [] } };
 }
 async function consumePlatformHandoffJti(env2, jti, expiresAt) {
   return agentBuilderAuthStub(env2).consumePlatformHandoffJti({
@@ -79431,7 +79473,9 @@ async function createPlatformLocalSession(request, env2) {
     display_name: identity.user.display_name ?? null,
     email: identity.user.email ?? null,
     avatar_url: identity.user.avatar_url ?? null,
-    role: identity.user.role
+    role: identity.user.role,
+    roles: identity.user.roles ?? [],
+    roles_version: identity.user.roles_version
   });
   const token = generateUserToken();
   const tokenHash = await hashToken(token);
@@ -79446,7 +79490,8 @@ async function createPlatformLocalSession(request, env2) {
     user: {
       id: user.id,
       username: user.username,
-      role: user.role
+      role: user.role,
+      roles: user.roles ?? []
     },
     authType: "platform_token",
     platform: identity
@@ -79698,7 +79743,7 @@ var config_get_default = defineController2(async ({ config, env: env2, req }) =>
 });
 
 // src/version.ts
-var BUILDER_VERSION = "0.41.15".length > 0 ? "0.41.15" : "dev";
+var BUILDER_VERSION = "0.41.17".length > 0 ? "0.41.17" : "dev";
 
 // src/api/diagnostics.get.ts
 init_LLMRequest();
@@ -82109,6 +82154,101 @@ function authRateLimitedResponse(result) {
   );
 }
 
+// src/utils/key-exchange.ts
+var HOST_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function validHost(host) {
+  return host.length <= 253 && host.split(".").length >= 2 && host.split(".").every((label) => HOST_LABEL.test(label));
+}
+function canonicalSourceOrigin(value) {
+  if (typeof value !== "string" || value.length > 300) return null;
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.port || parsed.search || parsed.hash || parsed.pathname !== "/" && parsed.pathname !== "" || !validHost(parsed.hostname) || value.replace(/\/$/, "") !== parsed.origin) {
+    return null;
+  }
+  return parsed.origin;
+}
+function isTrustedOrigin(origin, trustedOrigins) {
+  const host = origin.slice("https://".length);
+  return trustedOrigins.some((entry) => {
+    const trusted = entry.slice("https://".length);
+    return trusted.startsWith("*.") ? host.endsWith(trusted.slice(1)) && host.length > trusted.length - 1 : host === trusted;
+  });
+}
+
+// src/api/auth/exchange.post.ts
+var ADDRESS_LIMIT = { limit: 30, window_seconds: 60 * 60 };
+var SOURCE_TIMEOUT_MS = 5e3;
+function refused(status, error, message) {
+  return Response.json({ error, message }, { status, headers: { "Cache-Control": "no-store" } });
+}
+var exchange_post_default = defineController2(async ({ req, env: env2, config }) => {
+  const trustedOrigins = config?.keyExchange?.trustedOrigins;
+  if (!trustedOrigins?.length) {
+    return refused(404, "key_exchange_unsupported", "This instance does not exchange keys.");
+  }
+  const body = await req.json().catch(() => null);
+  const sourceOrigin = canonicalSourceOrigin(body?.source_origin);
+  const sourceKey = typeof body?.source_key === "string" ? body.source_key.trim() : "";
+  if (!sourceOrigin || !sourceKey || sourceKey.length > 512) {
+    return refused(400, "invalid_request", "source_origin and source_key are required.");
+  }
+  if (sourceOrigin === new URL(req.url).origin || !isTrustedOrigin(sourceOrigin, trustedOrigins)) {
+    return refused(403, "untrusted_origin", "This instance does not trust that origin.");
+  }
+  const agentBuilder = env2.AGENT_BUILDER.get(env2.AGENT_BUILDER.idFromName("singleton"));
+  const addressLimit = await agentBuilder.consumeAuthRateLimit({
+    key: await authRateLimitKey("key-exchange-address", authClientAddress(req)),
+    ...ADDRESS_LIMIT
+  });
+  if (!addressLimit.allowed) return authRateLimitedResponse(addressLimit);
+  let identity;
+  try {
+    const response = await fetch(`${sourceOrigin}/api/auth/me`, {
+      headers: { Authorization: `Bearer ${sourceKey}`, Accept: "application/json" },
+      redirect: "manual",
+      signal: AbortSignal.timeout(SOURCE_TIMEOUT_MS)
+    });
+    if (response.status === 401 || response.status === 403) {
+      return refused(401, "source_key_rejected", "The source deployment rejected the key.");
+    }
+    if (!response.ok) {
+      return refused(502, "source_unavailable", `The source deployment answered ${response.status}.`);
+    }
+    identity = await response.json();
+  } catch {
+    return refused(502, "source_unavailable", "The source deployment could not be reached.");
+  }
+  if (identity?.authType !== "api_key") {
+    return refused(401, "source_key_rejected", "Only API keys can be exchanged.");
+  }
+  const platformUserId = identity.user?.platform_user_id;
+  if (typeof platformUserId !== "string" || !platformUserId) {
+    return refused(403, "unknown_user", "The key does not belong to a platform user.");
+  }
+  const user = await agentBuilder.getUserByPlatformUserId(platformUserId);
+  if (!user) {
+    return refused(403, "unknown_user", "That user has not signed in to this instance.");
+  }
+  const token = generateApiKey();
+  const sourceHost = new URL(sourceOrigin).hostname;
+  await agentBuilder.createApiKey({
+    name: `Key exchange from ${sourceHost}`.slice(0, 100),
+    key_hash: await hashToken(token),
+    key_prefix: getTokenPrefix(token),
+    last_five: getLastChars(token, 5),
+    user_id: user.id
+  });
+  return Response.json(
+    { token, endpoint: new URL(req.url).origin, user: { id: user.id, username: user.username } },
+    { status: 201, headers: { "Cache-Control": "no-store" } }
+  );
+});
+
 // src/api/auth/login.post.ts
 var LOGIN_ADDRESS_LIMIT = { limit: 10, window_seconds: 5 * 60 };
 var LOGIN_IDENTITY_LIMIT = { limit: 25, window_seconds: 15 * 60 };
@@ -82371,6 +82511,7 @@ var platform_replica_post_default = defineController2(async ({ req, env: env2 })
   const agentBuilder = env2.AGENT_BUILDER.get(env2.AGENT_BUILDER.idFromName("singleton"));
   const result = await agentBuilder.applyPlatformReplicaSnapshot({
     users: payload.users,
+    role_revocations: payload.role_revocations,
     api_keys: payload.api_keys ?? []
   });
   return Response.json({ ok: true, ...result });
@@ -86225,7 +86366,9 @@ var callback_get_default = defineController2(async ({ req, env: env2 }) => {
     email: payload.email ?? null,
     avatar_url: payload.avatar_url ?? null,
     role: payload.role,
-    permissions: payload.permissions ?? null
+    permissions: payload.permissions ?? null,
+    roles: payload.roles ?? [],
+    roles_version: payload.roles_version
   });
   const returnTo = failReturnTo;
   const headers = new Headers({
@@ -86679,7 +86822,9 @@ async function resolveDeviceApprovalIdentity(req, env2) {
       email: payload.email ?? null,
       avatar_url: payload.avatar_url ?? null,
       role: payload.role,
-      permissions: payload.permissions ?? null
+      permissions: payload.permissions ?? null,
+      roles: payload.roles ?? [],
+      roles_version: payload.roles_version
     };
     return {
       confirmationSubject: `platform:${payload.platform_user_id}`,
@@ -88079,6 +88224,7 @@ var routeHandlers = {
   "POST:/auth/brolly-control": brolly_control_post_default,
   "GET:/auth/config": config_get_default2,
   "DELETE:/auth/current-key": current_key_delete_default,
+  "POST:/auth/exchange": exchange_post_default,
   "POST:/auth/login": login_post_default,
   "POST:/auth/logout": logout_post_default,
   "GET:/auth/me": me_get_default,