@substrat-run/adapter-cloudflare 0.40.0 → 0.42.0

package/dist/host.js

@@ -1,7 +1,8 @@
-import { accessLogEntry, adminLogEntry, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, connectionGrant, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, subjectRef, createConnectionInput, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, platformRequest, } from '@substrat-run/contracts';
+import { accessLogEntry, adminLogEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, connectionGrant, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, subjectRef, createConnectionInput, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, platformRequest, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { resolveScopeRecord, ulid, backoffAt, resolveRetryPolicy, unconfiguredSecretBox, } from '@substrat-run/kernel';
+import { attachmentBlobKey, resolveScopeRecord, ulid, backoffAt, resolveRetryPolicy, unconfiguredSecretBox, } from '@substrat-run/kernel';
 import { tenantStoreDatabaseName } from './d1.js';
+import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
 /** DO row → contract shape. Never reads the secrets table — that is the split. */
 const toConnection = (r) => connection.parse({
     id: r.id,
@@ -87,6 +88,10 @@ export class CloudflareScopeHost {
     fetchImpl;
     /** The live D1 client for per-tenant stores (#301); undefined ⇒ refuse loudly. */
     tenantStores;
+    /** The live R2 client for per-tenant blob stores (#473); undefined ⇒ refuse loudly. */
+    blobStores;
+    /** Worker-side attachment-bucket resolver (#473); undefined ⇒ attachments() refuses. */
+    attachmentBuckets;
     executors = new Map();
     /**
      * The event currently being effected, stamped onto admin rows the executor writes.
@@ -111,6 +116,8 @@ export class CloudflareScopeHost {
     constructor(options) {
         this.secretBox = options.secretBox ?? unconfiguredSecretBox;
         this.tenantStores = options.tenantStores;
+        this.blobStores = options.blobStores;
+        this.attachmentBuckets = options.attachmentBuckets;
         this.fetchImpl = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
         this.scopeLocalPermissions = options.scopeLocalPermissions ?? false;
         this.scopeNs = options.scope;
@@ -579,6 +586,161 @@ export class CloudflareScopeHost {
         }
         return this.tenantStores;
     }
+    async provisionBlobStore(actor, input) {
+        // Mirror of provisionTenantStore (#301) with R2 in place of D1: fail-closed tenant
+        // gate, ledger idempotency, deterministic name so a crashed retry converges, DO
+        // first-writer-wins with loser teardown.
+        const r2 = this.requireBlobStores(`provisionBlobStore(tenant=${input.tenantId} vertical=${input.vertical} binding=${input.binding})`);
+        const tenant = await this.cp.getTenant(input.tenantId);
+        if (!tenant) {
+            throw new Error(`cannot provision blob store under unknown tenant: ${input.tenantId}`);
+        }
+        if (tenant.status !== 'active') {
+            throw new Error(`cannot provision blob store under non-active tenant (status: ${tenant.status}): ${input.tenantId}`);
+        }
+        const existing = await this.cp.getBlobStore(input.tenantId, input.vertical, input.binding);
+        if (existing)
+            return { binding: input.binding, kind: 'blob', ref: existing.ref };
+        const name = await blobStoreBucketName(input.tenantId, input.vertical, input.binding);
+        const ref = await r2.create(name);
+        const stored = await this.cp.putBlobStore({
+            tenantId: input.tenantId,
+            vertical: input.vertical,
+            binding: input.binding,
+            kind: 'blob',
+            ref,
+            createdAt: new Date().toISOString(),
+        });
+        if (stored.ref !== ref) {
+            await r2.remove(ref).catch(() => undefined);
+            return { binding: input.binding, kind: 'blob', ref: stored.ref };
+        }
+        await this.recordAdmin(actor, 'provisionBlobStore', { tenantId: input.tenantId, vertical: input.vertical }, null, { binding: input.binding, kind: 'blob', ref });
+        return { binding: input.binding, kind: 'blob', ref };
+    }
+    /** The injected R2 client, or a loud refusal naming what to configure. */
+    requireBlobStores(what) {
+        if (!this.blobStores) {
+            throw new Error(`per-tenant blob stores are not configured on this host (#473): pass ` +
+                `CloudflareScopeHostOptions.blobStores (createR2BlobStores with the platform's ` +
+                `Cloudflare credential) — refused ${what}`);
+        }
+        return this.blobStores;
+    }
+    async attachments(principal, tenantId, scopeId) {
+        // Same fail-closed lifecycle gate + lazy-migration as getScope (#473). The permission
+        // gates and metadata facts live in the ScopeDO (per-scope serialization, spine event
+        // in the same transaction); bytes go straight to the per-tenant R2 bucket through the
+        // binding the vertical's worker resolved — never through the DO.
+        await this.cp.validateScopeAccess(tenantId, scopeId);
+        await this.migrateAndRecord(scopeId);
+        const store = await this.resolveAttachmentStore(tenantId);
+        return this.buildAttachmentSurface({ principal }, tenantId, scopeId, store);
+    }
+    async getConnectorAttachments(connectionId, scopeId) {
+        // The exact door `getConnectorScope` opens — same (tenant, vertical) gate — but it
+        // returns the attachment surface instead of the invoke stub, gated as the connection
+        // rather than a principal (#476).
+        const conn = await this.cp.readConnection(connectionId);
+        if (!conn)
+            throw new Error(`connection not found: ${connectionId}`);
+        if (conn.revoked_at)
+            throw new Error(`connection ${connectionId} is revoked`);
+        const scope = await this.cp.getScopeRecord(conn.tenant_id, scopeId);
+        if (!scope)
+            throw new Error(`unknown scope for connection: ${scopeId}`);
+        if (scope.vertical !== conn.vertical) {
+            throw new Error(`connection ${connectionId} is for vertical '${conn.vertical}' and scope ${scopeId} ` +
+                `runs '${scope.vertical ?? 'none'}'`);
+        }
+        await this.cp.validateScopeAccess(conn.tenant_id, scopeId);
+        await this.migrateAndRecord(scopeId);
+        const store = await this.resolveAttachmentStore(conn.tenant_id);
+        return this.buildAttachmentSurface({ connectionId }, conn.tenant_id, scopeId, store);
+    }
+    /** Resolve the per-tenant R2 blob store, or fail closed exactly as `attachments` did. */
+    async resolveAttachmentStore(tenantId) {
+        if (!this.attachmentBuckets) {
+            throw new Error(`attachments are not configured on this host (#473): pass ` +
+                `CloudflareScopeHostOptions.attachmentBuckets — (tenantId) => ` +
+                `env[blobStoreBindingName('<BINDING>', tenantId)] for the vertical's declared blob store`);
+        }
+        const bucket = await this.attachmentBuckets(tenantId);
+        if (!bucket) {
+            throw new Error(`no attachment bucket resolved for tenant ${tenantId} (#473) — is the per-tenant blob ` +
+                `store provisioned and its r2_bucket binding attached to the serving script?`);
+        }
+        return r2TenantBlobStore(bucket);
+    }
+    /**
+     * The `ScopeAttachments` surface, gated as either a principal or a connection (#473/#476).
+     * The subject decides two things: `createdBy` on the record, and the `connectionId` threaded
+     * to the DO so its permission gate resolves against `connection:<id>` grants (and a denial is
+     * attributed to the connection, not a laundered principal). Bytes never cross the DO boundary.
+     */
+    buildAttachmentSurface(subject, tenantId, scopeId, store) {
+        const connectionId = 'connectionId' in subject ? subject.connectionId : undefined;
+        const createdBy = 'principal' in subject ? subject.principal : subject.connectionId;
+        // The DO needs SOME principal-shaped value for `ctx.principal`; for a connection it is
+        // the connection id, and the honest attribution rides the event actor — the same trick
+        // `buildStub` uses for the invoke path.
+        const asPrincipalId = ('principal' in subject
+            ? subject.principal
+            : subject.connectionId);
+        const stub = this.scopeStub(scopeId);
+        const sha256Hex = async (body) => {
+            const digest = await crypto.subtle.digest('SHA-256', body);
+            return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('');
+        };
+        return {
+            upload: async (input) => {
+                const id = ulid();
+                const key = attachmentBlobKey(scopeId, id);
+                const record = attachmentRecord.parse({
+                    id,
+                    entity: input.entity,
+                    filename: input.filename,
+                    contentType: input.contentType,
+                    size: input.body.byteLength,
+                    sha256: await sha256Hex(input.body),
+                    visibility: input.visibility,
+                    createdBy,
+                    createdAt: new Date().toISOString(),
+                });
+                // Bytes first, row second — a crash between the two leaves an orphaned object
+                // (harmless, GC-able), never a row without bytes; a refused gate compensates.
+                await store.put(key, input.body, { contentType: input.contentType });
+                try {
+                    return await stub.attachmentAdd(record, asPrincipalId, tenantId, scopeId, connectionId);
+                }
+                catch (err) {
+                    await store.delete(key).catch(() => { });
+                    throw err;
+                }
+            },
+            list: (entity) => stub.attachmentList(entity, asPrincipalId, tenantId, scopeId, connectionId),
+            open: async (attachmentId) => {
+                const record = await stub.attachmentAuthorize(attachmentId, 'read', asPrincipalId, tenantId, scopeId, connectionId);
+                if (!record)
+                    return null;
+                const obj = await store.get(attachmentBlobKey(scopeId, record.id));
+                if (!obj) {
+                    throw new Error(`attachment ${record.id}: bytes missing from the blob store — the metadata row ` +
+                        `survived something the object did not (rewind/reap); see the #473 integrity notes`);
+                }
+                if ((await sha256Hex(obj.body)) !== record.sha256) {
+                    throw new Error(`attachment ${record.id}: bytes do not match the recorded sha256`);
+                }
+                return { record, body: obj.body, contentType: obj.contentType ?? record.contentType };
+            },
+            remove: async (attachmentId) => {
+                const removed = await stub.attachmentRemove(attachmentId, asPrincipalId, tenantId, scopeId, connectionId);
+                if (removed)
+                    await store.delete(attachmentBlobKey(scopeId, removed.id)).catch(() => { });
+                return removed;
+            },
+        };
+    }
     async importScope(actor, input, dump) {
         // Create the destination scope (directory row + DO + lazy migrate); the DO then
         // replaces its provisioned schema with the dump wholesale (drop-then-replay), so
@@ -1261,12 +1423,18 @@ export class CloudflareScopeHost {
                 const existing = await this.cp.readVertical(slug);
                 if (!existing)
                     throw new Error(`unknown vertical '${slug}'`);
-                // Refuse while any scope is bound: a deleted registry row would strand those
-                // scopes' version pins and routing. Deployed dispatch scripts are NOT reaped
-                // here — they become orphans for the cleanup script (#248).
+                // Refuse while any restorable scope is bound: a deleted registry row would strand
+                // those scopes' version pins and routing. An `archived` scope (a deleted app) still
+                // blocks — unarchive can bring it back — but the refusal names reap/restore, not
+                // "delete", because the app itself is already gone. `reaped` is terminal history and
+                // never blocks. Deployed dispatch scripts are NOT reaped here — they become orphans
+                // for the cleanup script (#248).
                 const bound = await this.cp.countScopesForVertical(slug);
-                if (bound > 0) {
-                    throw new Error(`vertical '${slug}' still backs ${bound} scope(s) — delete or rebind them first`);
+                if (bound.live > 0) {
+                    throw new Error(`vertical '${slug}' still backs ${bound.live} scope(s) — delete or rebind them first`);
+                }
+                if (bound.archived > 0) {
+                    throw new Error(`vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
                 }
                 await this.cp.deleteVertical(slug);
                 await this.recordAdmin(actor, 'deleteVertical', { tenantId: null }, { slug, source: existing.source, ownerTenant: existing.owner_tenant }, null);
@@ -1615,6 +1783,21 @@ export class CloudflareScopeHost {
                     createdAt: r.created_at,
                 }));
             },
+            listBlobStores: async (actor, filter) => {
+                const rows = await this.cp.listBlobStores({
+                    tenantId: filter?.tenantId,
+                    vertical: filter?.vertical,
+                });
+                await this.recordAccess(actor, 'listBlobStores', { tenantId: filter?.tenantId ?? null }, filter ?? null, rows.length);
+                return rows.map((r) => ({
+                    tenantId: r.tenant_id,
+                    vertical: r.vertical,
+                    binding: r.binding,
+                    kind: 'blob',
+                    ref: r.ref,
+                    createdAt: r.created_at,
+                }));
+            },
             listScopeTables: async (actor, tenantId, scopeId) => {
                 // K-3 cross-check on the shared directory BEFORE reaching the scope DO: a pair
                 // that does not resolve is unreachable, never another tenant's database.