@substrat-run/adapter-cloudflare 0.53.0 → 0.55.0

package/dist/host.js

@@ -1,6 +1,6 @@
-import { accessLogEntry, adminLogEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, connectionGrant, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, platformRequest, } from '@substrat-run/contracts';
+import { accessLogEntry, adminLogEntry, opsFailureEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, connectionGrant, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, platformRequest, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, backoffAt, resolveRetryPolicy, unconfiguredSecretBox, } from '@substrat-run/kernel';
+import { attachmentBlobKey, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, backoffAt, resolveRetryPolicy, unconfiguredSecretBox, createSubjectKeys, } from '@substrat-run/kernel';
 import { tenantStoreDatabaseName } from './d1.js';
 import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
 /** DO row → contract shape. Never reads the secrets table — that is the split. */
@@ -1949,6 +1949,42 @@ export class CloudflareScopeHost {
                     backupRef: opts?.backupRef ?? null,
                 });
             },
+            // -- subject erasure (#37) ----------------------------------------------
+            sealSubjectPayloads: async (actor, tenantId, scopeId, items) => {
+                await this.assertScope(tenantId, scopeId);
+                const sealed = await this.subjectKeysFor(tenantId, scopeId).sealMany(items);
+                await this.recordAccess(actor, 'sealSubjectPayloads', { tenantId, scopeId }, { subjects: new Set(items.map((i) => i.subjectId)).size }, sealed.filter((s) => s !== null).length);
+                return sealed;
+            },
+            openSubjectPayloads: async (actor, tenantId, scopeId, items) => {
+                await this.assertScope(tenantId, scopeId);
+                const opened = await this.subjectKeysFor(tenantId, scopeId).openMany(items);
+                await this.recordAccess(actor, 'openSubjectPayloads', { tenantId, scopeId }, { subjects: new Set(items.map((i) => i.subjectId)).size }, opened.filter((o) => o !== null).length);
+                return opened;
+            },
+            shredSubject: async (actor, tenantId, scopeId, subjectId) => {
+                await this.assertScope(tenantId, scopeId);
+                // Redact the live spine FIRST, destroy the key LAST. Both halves are idempotent and
+                // a crash between them converges on retry, so the order is decided by which
+                // half-done state harms the person: dying after the redaction leaves ciphertext in
+                // a backup that no key opens; destroying the key first would leave their PII in the
+                // live database while the audit log already claims they were erased.
+                const eventsRedacted = await this.scopeStub(scopeId).redactSubject(subjectId);
+                const at = new Date().toISOString();
+                const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, at);
+                const receipt = subjectShredReceipt.parse({
+                    subjectId,
+                    eventsRedacted,
+                    keyDestroyed: existed,
+                    tombstoned: true,
+                });
+                // BOTH logs, deliberately: the admin log because this is a mutation, the access log
+                // because it destroys evidence. An erasure is the one action where "who asked for
+                // this to disappear" is itself part of the record.
+                await this.recordAdmin(actor, 'shredSubject', { tenantId, scopeId }, null, receipt);
+                await this.recordAccess(actor, 'shredSubject', { tenantId, scopeId }, { subjectId }, eventsRedacted);
+                return receipt;
+            },
             grantEntitlement: async (actor, tenantId, entitlementKey, plan) => {
                 const input = entitlementGrantInput.parse(plan ?? {});
                 const result = await this.cp.grantEntitlement(tenantId, entitlementKey, input, actor);
@@ -2227,7 +2263,10 @@ export class CloudflareScopeHost {
             pruneAccessLog: async (actor, limit) => {
                 const pruned = await this.cp.pruneAccessLog(limit);
                 if (pruned > 0) {
-                    await this.recordAdmin(actor, 'pruneAccessLog', { tenantId: null }, { pruned }, null);
+                    // The payload is the APPLIED state, so it belongs in `after` (contracts'
+                    // adminLogEntry: before = prior state, after = the applied payload) — the
+                    // same shape as drainAccessLog's row above (#557).
+                    await this.recordAdmin(actor, 'pruneAccessLog', { tenantId: null }, null, { pruned });
                 }
                 return pruned;
             },
@@ -2252,6 +2291,41 @@ export class CloudflareScopeHost {
                 await this.recordAccess(actor, 'auditLog', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
                 return rows.map((r) => adminLogEntry.parse(r));
             },
+            recordOpsFailure: async (entry) => {
+                await this.cp.recordOpsFailure({
+                    id: ulid(),
+                    actor: entry.actor,
+                    operation: entry.operation,
+                    stage: entry.stage ?? null,
+                    tenant_id: entry.tenantId ?? null,
+                    scope_id: entry.scopeId ?? null,
+                    vertical: entry.vertical ?? null,
+                    status: entry.status ?? null,
+                    // Bounded here, not trusted from the catch site: one runaway upstream body
+                    // must not become a runaway directory row (#559).
+                    message: entry.message.slice(0, 2000),
+                    reference: entry.reference ?? null,
+                    at: new Date().toISOString(),
+                });
+            },
+            listOpsFailures: async (actor, filter) => {
+                const rows = await this.cp.listOpsFailures({
+                    tenantId: filter?.tenantId,
+                    scopeId: filter?.scopeId,
+                    vertical: filter?.vertical,
+                    operation: filter?.operation,
+                    reference: filter?.reference,
+                    since: filter?.since,
+                    until: filter?.until,
+                    limit: filter?.limit,
+                    cursor: filter?.cursor,
+                    order: filter?.order,
+                });
+                // Rows can name tenants and scopes, so reading them is recorded like the
+                // audit trail's own reads (K-24).
+                await this.recordAccess(actor, 'listOpsFailures', { tenantId: filter?.tenantId ?? null, scopeId: filter?.scopeId ?? null }, filter, rows.length);
+                return rows.map((r) => opsFailureEntry.parse(r));
+            },
         };
     }
     // -- helpers --------------------------------------------------------------
@@ -2259,6 +2333,28 @@ export class CloudflareScopeHost {
      * Record a staff read (K-24). `params` is a bounded summary, capped so one query
      * cannot write an unbounded row.
      */
+    /**
+     * K-3's cross-check on its own: the (tenant, scope) pair must exist and agree before a
+     * subject-key operation touches anything. Without it a caller could reach another
+     * tenant's keys by naming their scope id.
+     */
+    async assertScope(tenantId, scopeId) {
+        const rec = await this.cp.getScopeRecord(tenantId, scopeId);
+        if (!rec)
+            throw new Error(`unknown scope for tenant: (${tenantId}, ${scopeId})`);
+    }
+    /**
+     * This scope's per-subject keys (#37). The crypto lives in the kernel
+     * (`createSubjectKeys`); the adapter supplies only the three row operations, which here
+     * are RPCs into the control-plane DO that holds the directory.
+     */
+    subjectKeysFor(tenantId, scopeId) {
+        return createSubjectKeys(this.secretBox, {
+            read: (subjectId) => this.cp.readSubjectKey(scopeId, subjectId),
+            insert: (subjectId, row) => this.cp.insertSubjectKey({ scopeId, subjectId, tenantId, ...row }),
+            tombstone: (subjectId, at) => this.cp.tombstoneSubjectKey({ scopeId, subjectId, tenantId, at }),
+        });
+    }
     async recordAccess(actor, method, target, params, resultCount) {
         await this.cp.recordAccess({
             id: ulid(),