@substrat-run/adapter-cloudflare 0.31.0 → 0.33.0

package/dist/host.js

@@ -1,4 +1,4 @@
-import { accessLogEntry, adminLogEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, connectionGrant, connectionSecret, entitlementGrant, entitlementGrantInput, subjectRef, createConnectionInput, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, platformRequest, } from '@substrat-run/contracts';
+import { accessLogEntry, adminLogEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, connectionGrant, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, subjectRef, createConnectionInput, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, platformRequest, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
 import { resolveScopeRecord, ulid, backoffAt, resolveRetryPolicy, unconfiguredSecretBox, } from '@substrat-run/kernel';
 /** DO row → contract shape. Never reads the secrets table — that is the split. */
@@ -73,6 +73,8 @@ export class CloudflareScopeHost {
     // Registration-mechanics bookkeeping (validation only — the DO executes).
     // Code-time, derived from the bundled modules, NOT durable directory state.
     moduleIds = new Set();
+    /** Module id → its declared recurring schedules (#383), for `registeredSchedules`/`runDueSchedules`. */
+    moduleSchedules = new Map();
     /** Registered (module, version) pairs — the frontier `schemaVersion` counts toward (§5.3, #49). */
     migrationTotal = 0;
     operations = new Set();
@@ -436,6 +438,9 @@ export class CloudflareScopeHost {
             this.predicateNames.set(name, manifest.id);
         }
         this.moduleIds.add(manifest.id);
+        if (manifest.schedules && manifest.schedules.length > 0) {
+            this.moduleSchedules.set(manifest.id, manifest.schedules);
+        }
         this.migrationTotal += migrations.length;
         const ownOperations = new Set(Object.keys(registration.operations ?? {}));
         for (const name of manifest.withdraws ?? []) {
@@ -474,6 +479,20 @@ export class CloudflareScopeHost {
         // storage, so project the tenant's current roles/tuples into it (no-op when off,
         // or if migration threw above — a failed scope stays closed, never projected).
         await this.projectScope(input.tenantId, input.scopeId);
+        // Project each registered module's SCHEDULE grants (#383): the system principal
+        // holds exactly the permissions its schedules declared, on this scope, so
+        // `ctx.check` resolves for scheduled work (the gate stays the check). Written to
+        // the scope's own tuples, where the checker reads them — the same place the owner
+        // grant and connection grants land. Idempotent, so a re-provision re-asserts them.
+        for (const [moduleId, schedules] of this.moduleSchedules) {
+            const perms = new Set();
+            for (const s of schedules)
+                for (const p of s.permissions)
+                    perms.add(p);
+            for (const perm of perms) {
+                await this.scopeStub(input.scopeId).writeTuple(`system:${moduleId}`, `granted:${perm}`, `scope:${input.scopeId}`, null);
+            }
+        }
         // Audit a real provision only; an idempotent re-provision changed nothing.
         if (created) {
             await this.recordAdmin(actor, 'provisionScope', { tenantId: input.tenantId, scopeId: input.scopeId, vertical: record.vertical }, null, record);
@@ -628,15 +647,82 @@ export class CloudflareScopeHost {
         await this.migrateAndRecord(scopeId);
         return this.buildStub(conn.tenant_id, scopeId, undefined, connectionId);
     }
-    /** The stub body, shared by the principal and connection doors. */
-    buildStub(tenantId, scopeId, principal, connectionId) {
+    /**
+     * A scope stub whose authority is a MODULE on a timer (#383) — the scheduler's
+     * door, mirror of `getConnectorScope`. The module must be registered on this host
+     * and the scope must pass the ordinary lifecycle gate; authority is then a check
+     * against `system:<moduleId>` grants inside the stub.
+     */
+    async getSystemScope(moduleId, tenantId, scopeId) {
+        if (!this.moduleIds.has(moduleId)) {
+            throw new Error(`module not registered on this host: ${moduleId}`);
+        }
+        await this.cp.validateScopeAccess(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        return this.buildStub(tenantId, scopeId, undefined, undefined, moduleId);
+    }
+    registeredSchedules() {
+        const out = [];
+        for (const [moduleId, schedules] of this.moduleSchedules) {
+            if (schedules.length > 0)
+                out.push({ moduleId: moduleId, schedules });
+        }
+        return out;
+    }
+    async runDueSchedules(moduleId, tenantId, scopeId) {
+        const report = { fired: 0, skipped: 0, failed: 0, errors: [] };
+        const schedules = this.moduleSchedules.get(moduleId);
+        if (!schedules || schedules.length === 0)
+            return report;
+        // Only run on a live scope of this tenant; a scope archived between the sweep's
+        // enumeration and here simply has nothing due.
+        const rec = await this.cp.getScopeRecord(tenantId, scopeId);
+        if (!rec || rec.status !== 'active')
+            return report;
+        const stub = this.scopeStub(scopeId);
+        // The grant IS the switch (#383): run only where the scope holds a live
+        // `system:<moduleId>` grant. Skips a foreign-vertical scope and a per-tenant
+        // revoke quietly — no run, no error.
+        if (!(await stub.hasSystemGrant(moduleId)))
+            return report;
+        const now = Date.now();
+        for (const schedule of schedules) {
+            const last = await stub.scheduleLastRun(schedule.operation);
+            const lastRun = last ? Date.parse(last) : null;
+            const dueAt = lastRun === null ? -Infinity : lastRun + schedule.cadence.everyMinutes * 60_000;
+            if (now < dueAt) {
+                report.skipped += 1;
+                continue;
+            }
+            let status = 'ok';
+            try {
+                const scope = await this.getSystemScope(moduleId, tenantId, scopeId);
+                await scope.invoke(schedule.operation, schedule.input);
+                report.fired += 1;
+            }
+            catch (err) {
+                status = 'failed';
+                report.failed += 1;
+                report.errors.push({
+                    operation: schedule.operation,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            }
+            await stub.recordScheduleRun(schedule.operation, new Date(now).toISOString(), status);
+        }
+        return report;
+    }
+    /** The stub body, shared by the principal, connection, and system doors. */
+    buildStub(tenantId, scopeId, principal, connectionId, systemModuleId) {
         const stub = this.scopeStub(scopeId);
         const cp = this.cp;
         const operationEntitlement = this.operationEntitlement;
         // The DO needs SOME principal-shaped value for `ctx.principal`; for a
-        // connection it is the connection id, and the honest attribution rides on
-        // the event actor instead.
-        const asPrincipalId = (principal ?? connectionId);
+        // connection it is the connection id, for a schedule the module id, and the
+        // honest attribution rides on the event actor instead.
+        const asPrincipalId = (principal ??
+            connectionId ??
+            systemModuleId);
         return {
             tenantId,
             scopeId,
@@ -650,7 +736,7 @@ export class CloudflareScopeHost {
                 if (requiredKey && !(await cp.tenantHoldsEntitlement(tenantId, requiredKey))) {
                     return Promise.reject(new Error(`operation not entitled: ${operation} — tenant does not hold '${requiredKey}'`));
                 }
-                const result = (await stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey));
+                const result = (await stub.invoke(operation, input, asPrincipalId, tenantId, scopeId, connectionId, requiredKey, systemModuleId));
                 await this.drainExecutors(tenantId, scopeId);
                 return result;
             },
@@ -862,6 +948,15 @@ export class CloudflareScopeHost {
                     node: grant.node,
                 });
             },
+            grantToSystem: async (actor, raw) => {
+                // The scheduler's grant (#383) — mirror of grantToConnection. Narrow: one
+                // module, one permission; tombstones on revoke; shows in the permission diff.
+                const grant = systemGrant.parse(raw);
+                await writeGrant(subjectRef({ kind: 'system', id: grant.moduleId }), grant.permission, grant.node, undefined, grant.expiresAt);
+                await this.recordAdmin(actor, 'grantToSystem', { tenantId: grant.node.tenantId, scopeId: grant.node.scopeId }, null, { moduleId: grant.moduleId, permission: grant.permission, node: grant.node });
+                if (!grant.node.scopeId)
+                    await this.fanOut(grant.node.tenantId);
+            },
             grantToOrg: async (actor, orgId, permission, node, entity) => {
                 // The org must exist in the node's tenant. A grant to a phantom org looks
                 // applied, resolves for nobody, and still shows up in the permission diff.
@@ -1553,6 +1648,18 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'listIdentityTenants', {}, { provider }, tenants.length);
                 return tenants;
             },
+            listIdentityLinks: async (actor, tenantId) => {
+                const rows = await this.cp.dumpTenantIdentities(tenantId);
+                const links = rows.map((r) => identityLink.parse({
+                    provider: r.provider,
+                    externalId: r.external_id,
+                    principal: r.principal_id,
+                    tenantId,
+                    scopeId: r.scope_id ?? undefined,
+                }));
+                await this.recordAccess(actor, 'listIdentityLinks', { tenantId }, null, links.length);
+                return links;
+            },
             // -- the integrations hub (#101) ---------------------------------------
             createConnection: async (actor, raw) => {
                 const input = createConnectionInput.parse(raw);
@@ -1660,6 +1767,10 @@ export class CloudflareScopeHost {
                 if (!changed)
                     return;
                 await this.recordAdmin(actor, 'linkIdentity', { tenantId: parsed.tenantId, scopeId: parsed.scopeId }, null, { provider: parsed.provider, externalId: parsed.externalId, principal: parsed.principal });
+                // #406: an identity link is a tenant-level write, so it fans out into the tenant's
+                // projected scopes exactly as entitlements do (#304) — a no-op unless scope-local
+                // projection is on; the reconcile sweep repairs any drop.
+                await this.fanOut(parsed.tenantId);
             },
             unlinkIdentity: async (actor, tenantId, principal) => {
                 // DELETE by principal (audit is the log), so the caller who removed a member
@@ -1668,6 +1779,10 @@ export class CloudflareScopeHost {
                 if (!changed)
                     return;
                 await this.recordAdmin(actor, 'unlinkIdentity', { tenantId, scopeId: null }, { principal }, null);
+                // The unlink must reach the projected scopes so the severed login stops resolving
+                // there — this is what makes revocation durable at request time (#406); a dropped
+                // fan-out is repaired by the reconcile sweep.
+                await this.fanOut(tenantId);
             },
             resolveIdentity: async (tenantId, provider, externalId) => {
                 const row = await this.cp.resolveIdentity(tenantId, provider, externalId);
@@ -1771,14 +1886,16 @@ export class CloudflareScopeHost {
     // the coordinator PROJECTS the tenant's current roles + tenant-level tuples into
     // its scopes, which then evaluate permissions from their own storage. Cost moves
     // from the request hot path (every check) to the admin write path (rare).
-    /** The tenant's current roles + tenant-level tuples + entitlements, in the shape the ScopeDO
-     *  stores. Entitlements (#304) ride the same projection so a hosted scope reads plan/quota/
-     *  expiry locally; expiry is applied at READ (in the scope), so the full list is carried. */
+    /** The tenant's current roles + tenant-level tuples + entitlements + identity links, in the
+     *  shape the ScopeDO stores. Entitlements (#304) ride the same projection so a hosted scope
+     *  reads plan/quota/expiry locally; expiry is applied at READ (in the scope), so the full list
+     *  is carried. Identity links (#406) ride it too, so a scope resolves logins locally. */
     async tenantProjection(tenantId) {
-        const [roleRows, tuples, entitlementRows] = await Promise.all([
+        const [roleRows, tuples, entitlementRows, identities] = await Promise.all([
             this.cp.listRoles({ tenantId }),
             this.cp.dumpTenantTuples(tenantId),
             this.cp.listEntitlements(tenantId),
+            this.cp.dumpTenantIdentities(tenantId),
         ]);
         return {
             roles: roleRows.map((r) => ({ role_key: r.role_key, permissions: r.permissions, source: r.source })),
@@ -1789,14 +1906,15 @@ export class CloudflareScopeHost {
                 quota: e.quota,
                 plan: e.plan,
             })),
+            identities,
         };
     }
     /** Project the tenant's current state into ONE scope + flip it to local. */
     async projectScope(tenantId, scopeId) {
         if (!this.scopeLocalPermissions)
             return;
-        const { roles, tuples, entitlements } = await this.tenantProjection(tenantId);
-        await this.scopeStub(scopeId).applyProjection(tenantId, roles, tuples, entitlements);
+        const { roles, tuples, entitlements, identities } = await this.tenantProjection(tenantId);
+        await this.scopeStub(scopeId).applyProjection(tenantId, roles, tuples, entitlements, undefined, identities);
     }
     /**
      * Fan the tenant's current state out into ALL its scopes — called after any
@@ -1806,9 +1924,9 @@ export class CloudflareScopeHost {
     async fanOut(tenantId) {
         if (!this.scopeLocalPermissions)
             return;
-        const { roles, tuples, entitlements } = await this.tenantProjection(tenantId);
+        const { roles, tuples, entitlements, identities } = await this.tenantProjection(tenantId);
         const scopes = await this.cp.listScopes({ tenantId });
-        await Promise.all(scopes.map((s) => this.scopeStub(s.scope_id).applyProjection(tenantId, roles, tuples, entitlements)));
+        await Promise.all(scopes.map((s) => this.scopeStub(s.scope_id).applyProjection(tenantId, roles, tuples, entitlements, undefined, identities)));
     }
     /**
      * Re-project a tenant's full state into every one of its scopes — the
@@ -1858,7 +1976,33 @@ export class CloudflareScopeHost {
                 object: `scope:${input.scopeId}`,
                 expires_at: null,
             },
-        ]);
+        ], 
+        // #406: identity links, delivered by the platform with provisioning exactly as
+        // entitlements are (#310). Preserve-on-undefined, so an absent field never wipes
+        // links a prior fan-out or reconcile projected.
+        input.identityLinks
+            ? input.identityLinks.map((l) => ({
+                provider: l.provider,
+                external_id: l.externalId,
+                principal_id: l.principal,
+                scope_id: l.scopeId ?? null,
+            }))
+            : undefined);
+    }
+    /**
+     * Resolve an external identity from a scope's PROJECTED links (#406) — the CP-less
+     * auth adapter's read path, the local equivalent of `HostAdmin.resolveIdentity` (same
+     * exemption: a machine read on the request path, not audited). Reads only what the
+     * platform projected into the scope (provision / reconcile / fan-out), so a miss means
+     * "unknown login — deny": an un-projected scope can only refuse a legitimate login,
+     * never admit a revoked one. A CP-full deployment keeps using `admin.resolveIdentity`;
+     * this exists precisely for deployments where that surface is unavailable.
+     */
+    async resolveIdentityLocal(tenantId, scopeId, provider, externalId) {
+        const row = await this.scopeStub(scopeId).resolveProjectedIdentity(tenantId, provider, externalId);
+        if (!row)
+            return undefined;
+        return resolvedIdentity.parse({ principal: row.principal, scopeId: row.scopeId });
     }
     /**
      * Grant a principal a role at SCOPE level in a CP-less vertical — the MEMBER half of