@substrat-run/adapter-cloudflare 0.70.0 → 0.72.0

package/dist/host.js

@@ -1,6 +1,6 @@
-import { accessLogEntry, adminLogEntry, opsFailureEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, platformRequest, connectorDispatchKind, outboundOfManifestJson, } from '@substrat-run/contracts';
+import { accessLogEntry, adminLogEntry, opsFailureEntry, attachmentRecord, createTenantInput, identityLink, identityPool, createOrgInput, promotionAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, registerVerticalInput, vertical as verticalSchema, verticalServingState, verticalChannel, verticalVersion, connection, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, entitlementGrant, entitlementGrantInput, instant, meterReading, subjectRef, createConnectionInput, projectedConnectionKey, moduleManifest, org as orgSchema, orgMembership, resolvedIdentity, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, subjectShredReceipt, platformRequest, connectorDispatchKind, outboundOfManifestJson, } from '@substrat-run/contracts';
 import { normalizeHostname, toRouteTarget } from './route-resolver.js';
-import { attachmentBlobKey, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, } from '@substrat-run/kernel';
+import { attachmentBlobKey, entitlementDenial, foldMeterReading, parseValidationRecords, resolveScopeRecord, ulid, backoffAt, resolveRetryPolicy, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, openSealed, } from '@substrat-run/kernel';
 import { tenantStoreDatabaseName } from './d1.js';
 import { blobStoreBucketName, r2TenantBlobStore } from './r2.js';
 /** DO row → contract shape. Never reads the secrets table — that is the split. */
@@ -188,6 +188,11 @@ export class CloudflareScopeHost {
                     // the control plane holds the directory and the credential but not the
                     // vertical's R2, so the bytes come back over the seam.
                     openAttachment: (attachmentId) => this.getConnectorAttachments(open.id, scopeId).then((a) => a.open(attachmentId)),
+                    // #687: open a cell the scope sealed TO this connection. The keyId-indexed
+                    // map goes in, never out — a connector receives the plaintext of one cell,
+                    // not a private key it could mislay. Retired keys are in the map too, so a
+                    // request pending across a rotation still opens.
+                    unseal: async (sealed) => openSealed(await this.openSealingKeys(open.id), sealed),
                     fetch: async (input, init) => {
                         try {
                             const res = await fetchImpl(input, {
@@ -2273,6 +2278,17 @@ export class CloudflareScopeHost {
                     createdBy: input.createdBy ?? actor,
                 });
             },
+            connectionSealingKey: (id) => this.ensureSealingKey(id),
+            connectionSealingKeys: async (tenantId, vertical) => {
+                // LIVE connections only. A revoked connection's key is KEPT (its pending
+                // ciphertext must still open) but stops being projected, so a scope can no
+                // longer seal to a credential that has been withdrawn.
+                const rows = await this.cp.listConnections({ tenantId, vertical });
+                const out = [];
+                for (const r of rows)
+                    out.push(await this.ensureSealingKey(r.id));
+                return out;
+            },
             listConnections: async (actor, filter) => {
                 const f = filter ?? {};
                 const rows = await this.cp.listConnections(f);
@@ -2553,6 +2569,70 @@ export class CloudflareScopeHost {
     async writeScopeTuple(scopeId, subject, relation, object, expiresAt) {
         await this.scopeStub(scopeId).writeTuple(subject, relation, object, expiresAt);
     }
+    /**
+     * The connection's CURRENT public sealing key, minted on first ask (#687).
+     *
+     * Mint-on-read rather than mint-only-at-connect, because the fleet already holds
+     * live connections older than this feature — Egeryds' Scrive credential carries
+     * years of real contracts, and "reconnect to acquire a keypair" is not a
+     * migration anyone should have to run against production. Asking IS the
+     * back-fill, and it is idempotent: the DO's insert loses silently against the
+     * partial-unique index and re-reads the winner, so a race yields one key.
+     *
+     * Minted HERE, on the coordinator, for the reason the credential is: the DO has
+     * never held a `SecretBox` and must never see an unsealed private half.
+     */
+    async ensureSealingKey(connectionId) {
+        const conn = await this.cp.readConnection(connectionId);
+        if (!conn)
+            throw new Error(`connection not found: ${connectionId}`);
+        const rows = await this.cp.readConnectionKeys(connectionId);
+        const current = rows.find((r) => r.retired_at === null);
+        if (current) {
+            return projectedConnectionKey.parse({
+                connectionId,
+                provider: conn.provider,
+                keyId: current.key_id,
+                publicKey: current.public_key,
+            });
+        }
+        const pair = await generateSealingKeyPair(`connection:${connectionId}:${ulid()}`);
+        const wrapped = await this.secretBox.seal(pair.privateKey);
+        const won = await this.cp.insertConnectionKey({
+            connectionId,
+            keyId: pair.keyId,
+            publicKey: pair.publicKey,
+            wrappedKeyId: wrapped.keyId,
+            wrappedPrivate: wrapped.ciphertext,
+            createdAt: new Date().toISOString(),
+        });
+        return projectedConnectionKey.parse({
+            connectionId,
+            provider: conn.provider,
+            keyId: won?.key_id ?? pair.keyId,
+            publicKey: won?.public_key ?? pair.publicKey,
+        });
+    }
+    /**
+     * EVERY private half this connection holds, keyed by keyId — retired ones too.
+     *
+     * A ciphertext sealed before a rotation still names the key that sealed it, so
+     * the opener has to hold the whole map or every request pending across a
+     * rotation dead-letters. When rotation eventually DESTROYS a retired key its row
+     * goes and the open fails loudly, which is the intended erasure (D-5), not an
+     * accident.
+     */
+    async openSealingKeys(connectionId) {
+        const rows = await this.cp.readConnectionKeys(connectionId);
+        const out = {};
+        for (const r of rows) {
+            out[r.key_id] = await this.secretBox.open({
+                keyId: r.wrapped_key_id,
+                ciphertext: r.wrapped_private,
+            });
+        }
+        return out;
+    }
     scopeStub(scopeId) {
         // Deterministic DO id in milestone 1. Production mints per-jurisdiction ids
         // via newUniqueId (K-7) and stores the mapping in the directory — deferred.
@@ -2586,12 +2666,35 @@ export class CloudflareScopeHost {
             identities,
         };
     }
+    /**
+     * The public sealing keys a scope of THIS vertical may seal to (#687), in the shape
+     * the ScopeDO stores.
+     *
+     * Per (tenant, vertical) rather than per tenant, unlike everything else in the
+     * projection: a connection is keyed (tenant, vertical, provider) because a vertical
+     * is a blast-radius boundary (D-30), so projecting another vertical's key would hand
+     * this scope a write channel into a credential it may not reach. `[]` for a scope
+     * bound to no vertical — which then seals to nothing, the fail-closed direction.
+     */
+    async connectionKeyRows(tenantId, vertical) {
+        if (!vertical)
+            return [];
+        const keys = await this.admin.connectionSealingKeys(tenantId, vertical);
+        return keys.map((k) => ({
+            connection_id: k.connectionId,
+            provider: k.provider,
+            key_id: k.keyId,
+            public_key: k.publicKey,
+        }));
+    }
     /** Project the tenant's current state into ONE scope + flip it to local. */
     async projectScope(tenantId, scopeId) {
         if (!this.scopeLocalPermissions)
             return;
         const { roles, tuples, entitlements, identities } = await this.tenantProjection(tenantId);
-        await this.scopeStub(scopeId).applyProjection(tenantId, roles, tuples, entitlements, undefined, identities);
+        const scope = await this.cp.getScopeRecord(tenantId, scopeId);
+        const connectionKeys = await this.connectionKeyRows(tenantId, scope?.vertical);
+        await this.scopeStub(scopeId).applyProjection(tenantId, roles, tuples, entitlements, undefined, identities, connectionKeys);
     }
     /**
      * Fan the tenant's current state out into ALL its scopes — called after any
@@ -2603,7 +2706,17 @@ export class CloudflareScopeHost {
             return;
         const { roles, tuples, entitlements, identities } = await this.tenantProjection(tenantId);
         const scopes = await this.cp.listScopes({ tenantId });
-        await Promise.all(scopes.map((s) => this.scopeStub(s.scope_id).applyProjection(tenantId, roles, tuples, entitlements, undefined, identities)));
+        // #687: connection keys are per (tenant, vertical), so they are resolved per scope
+        // rather than once for the tenant — memoized, because a fan-out over twenty scopes
+        // of one vertical must not mint or re-read twenty times.
+        const keysByVertical = new Map();
+        await Promise.all(scopes.map(async (s) => {
+            const vertical = s.vertical ?? '';
+            if (!keysByVertical.has(vertical)) {
+                keysByVertical.set(vertical, this.connectionKeyRows(tenantId, s.vertical));
+            }
+            await this.scopeStub(s.scope_id).applyProjection(tenantId, roles, tuples, entitlements, undefined, identities, await keysByVertical.get(vertical));
+        }));
     }
     /**
      * Re-project a tenant's full state into every one of its scopes — the
@@ -2689,6 +2802,18 @@ export class CloudflareScopeHost {
                 principal_id: l.principal,
                 scope_id: l.scopeId ?? null,
             }))
+            : undefined, 
+        // #687: the tenant's connection sealing keys, delivered with provisioning exactly as
+        // entitlements and identity links are. Preserve-on-undefined for the same reason: an
+        // absent field must never wipe keys a prior reconcile projected, or a working
+        // signature flow would break on an unrelated re-provision.
+        input.connectionKeys
+            ? input.connectionKeys.map((k) => ({
+                connection_id: k.connectionId,
+                provider: k.provider,
+                key_id: k.keyId,
+                public_key: k.publicKey,
+            }))
             : undefined);
     }
     /**