@substrat-run/control-plane-api 0.124.0 → 0.126.0

package/dist/api.js

@@ -17,7 +17,7 @@ import { mapError } from './errors.js';
 import { maskDump, maskRecords } from './mask.js';
 import { createPseudonymizer } from './pseudonymize.js';
 import { openDump, sealDump } from './seal.js';
-import { assertSandboxContract, deployManifest, storedDeployManifest, deploymentRefFor, stableDeploymentRefFor, nextMigrationTag, upstreamStatusOf, } from './deploy.js';
+import { assertSandboxContract, deployManifest, storedDeployManifest, pushedPermissionRegistry, deploymentRefFor, stableDeploymentRefFor, nextMigrationTag, upstreamStatusOf, } from './deploy.js';
 /**
  * Answer with a problem document (#113 phase 4).
  *
@@ -34,7 +34,7 @@ function problem(c, answer) {
 import { backfillDeclaredStores, blobStoreBindings, collectBlobStoreHandles, collectTenantStoreHandles, missingStoresForTenant, tenantStoreBindings, } from './tenant-stores.js';
 import { mintPushToken, pushActorFor } from './push-token.js';
 import { TENANT_SERIES_SCOPE_CAP, REQUEST_FACET_KEYS } from './observability.js';
-import { parseTenantRequestQuery, parseTenantWindowQuery, refineTenantWindow } from './tenant-request-query.js';
+import { parseTenantRequestQuery, parseTenantWindowQuery, refineTenantWindow, scriptFamiliesOfScopes } from './tenant-request-query.js';
 import { namespacesForScript } from './do-namespaces.js';
 import { backupDirectoryIfDue } from './directory-backup.js';
 import { STORAGE_PAGE_DEFAULT, STORAGE_PAGE_MAX, readStoragePage } from './storage-meter.js';
@@ -1719,8 +1719,15 @@ export function createControlPlaneApi(options) {
      * as it stood before the failed attempt. Every caller still re-asserts after it (the
      * fallback), passing what this reports.
      */
-    const restoreCarryingSwitches = async (actor, dest, tenantId, scopeId, tables) => {
-        return retryTransient(async () => dest.restoreScope(tenantId, scopeId, tables, await switchCarryFor(admin, actor, { tenantId, scopeId })));
+    const restoreCarryingSwitches = async (actor, dest, tenantId, scopeId, tables, 
+    /** #1869: the scope `tables` were captured from — `scopeId` itself unless the copy moves —
+     *  and `exact` when the platform exported them itself rather than a caller supplying them. */
+    source) => {
+        return retryTransient(async () => dest.restoreScope(tenantId, scopeId, tables, {
+            ...(await switchCarryFor(admin, actor, { tenantId, scopeId })),
+            sourceScopeId: source.scopeId,
+            exact: source.exact,
+        }));
     };
     const adoptScopeOntoServing = async (c, tenantId, scopeId, opts = {}) => {
         const actor = c.get('actor');
@@ -1758,7 +1765,7 @@ export function createControlPlaneApi(options) {
         }
         const dump = await source.exportScope(scopeId);
         // #1742: the recorded OFF positions ride the restore, applied in the replay's own event.
-        const restored = await restoreCarryingSwitches(actor, dest, tenantId, scopeId, dump);
+        const restored = await restoreCarryingSwitches(actor, dest, tenantId, scopeId, dump, { scopeId, exact: true });
         // Data landed — only now flip routing and move the version pointer.
         await admin
             .setScopeServingRef(actor, tenantId, scopeId, serving.ref, { acknowledge: opts.acknowledge })
@@ -1902,7 +1909,7 @@ export function createControlPlaneApi(options) {
             throw new ControlPlaneError(501, 'rebind-vertical needs dispatch resolution for both ends');
         }
         const dump = await source.exportScope(scopeId);
-        const restored = await restoreCarryingSwitches(actor, dest, tenantId, scopeId, dump); // #1742, as adopt
+        const restored = await restoreCarryingSwitches(actor, dest, tenantId, scopeId, dump, { scopeId, exact: true }); // #1742, as adopt
         // Data landed on the target script — only now flip routing and cross the pointer.
         // `bindScopeVersion` rewrites `scopes.vertical` from the version row, audited. No
         // extra snapshot here (adopt-serving's precedent): the source script's copy is the
@@ -1989,7 +1996,10 @@ export function createControlPlaneApi(options) {
         }
         const dump = await retryTransient(() => source.exportScope(scope.id));
         // #1742: the recorded OFF positions ride the restore, as on adopt and rebind.
-        const restored = await restoreCarryingSwitches(actor, dest, scope.tenantId, scope.id, dump);
+        const restored = await restoreCarryingSwitches(actor, dest, scope.tenantId, scope.id, dump, {
+            scopeId: scope.id,
+            exact: true,
+        });
         return { from, to, tables: restored.tables, switchedOff: restored.switchedOff };
     };
     app.get('/tenants/:tenantId/scopes/:scopeId/tables', async (c) => {
@@ -3262,6 +3272,8 @@ export function createControlPlaneApi(options) {
     // a vertical deployment, the same dump is then loaded THERE — the bytes the router
     // actually serves. (Yes, that stores the dump twice in delegated mode; the
     // placeholder copy is the price of one canonical audited path, same as export.)
+    /** #1869: the optional re-point hint a restore body may carry beside the dump. */
+    const restoreSourceHint = z.object({ sourceScopeId: scopeIdSchema.optional() });
     app.post('/tenants/:tenantId/scopes/:scopeId/restore', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
@@ -3269,7 +3281,12 @@ export function createControlPlaneApi(options) {
         const scope = await admin.getScopeRecord(actor, tenantId, scopeId);
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
-        const dump = scopeDump.parse(await c.req.json());
+        const raw = await c.req.json();
+        const dump = scopeDump.parse(raw);
+        // #1869: where the uploaded file says it came from, when the caller had to set the dump's
+        // own `scopeId` to something else. A hint for the grant re-point ONLY: the dump's
+        // `tenantId`/`scopeId` below still choose the keys that open its sealed payloads.
+        const { sourceScopeId: sourceHint } = restoreSourceHint.parse(raw);
         // A backup with no tables is not a scope dump — name that plainly rather than letting
         // the empty replay reach the checker and surface as a bare `internal error` (#321).
         if (dump.tables.length === 0) {
@@ -3289,11 +3306,16 @@ export function createControlPlaneApi(options) {
             const origin = { tenantId: tenantIdSchema.parse(dump.tenantId), scopeId: scopeIdSchema.parse(dump.scopeId) };
             const tables = await openDump(dump.tables, sealerFor(c, origin.tenantId, origin.scopeId));
             const landing = { ...dump, tables };
-            await host.restoreScope(actor, tenantId, scopeId, landing);
+            await host.restoreScope(actor, tenantId, scopeId, landing, sourceHint ? { sourceScopeId: sourceHint } : undefined);
             const vertical = await verticalForScope(c, scope);
             // #1742: the recorded OFF positions ride the restore, so the deployment switches them
             // off in the replay's own event — its own sweeper cannot land in between.
-            const restored = vertical ? await restoreCarryingSwitches(actor, vertical, tenantId, scopeId, tables) : undefined;
+            const restored = vertical
+                ? await restoreCarryingSwitches(actor, vertical, tenantId, scopeId, tables, {
+                    scopeId: sourceHint ?? origin.scopeId,
+                    exact: false,
+                })
+                : undefined;
             // #1674: a backup from before a module was switched off brings it back on; the
             // directory's record puts it back off now, not at the next reconcile. Where the
             // deployment already did (#1742), this finds it done and audits what it reported.
@@ -3962,10 +3984,17 @@ export function createControlPlaneApi(options) {
             catch {
                 return c.json({ error: 'manifestJson is not valid JSON' }, 400);
             }
+            const refuse = (issue, under = []) => c.json({ error: `manifestJson is not a deploy manifest: ${[...under, ...issue.path].join('.') || '(root)'}: ${issue.message}` }, 400);
             const checked = storedDeployManifest.safeParse(raw);
-            if (!checked.success) {
-                const issue = checked.error.issues[0];
-                return c.json({ error: `manifestJson is not a deploy manifest: ${issue.path.join('.') || '(root)'}: ${issue.message}` }, 400);
+            if (!checked.success)
+                return refuse(checked.error.issues[0]);
+            // #1869: a registry handed to this route now is NEW, so it answers to the push-time rule on
+            // entity-grant shapes (no kernel namespace as an entity type), as `deployManifest` does.
+            // An absent registry stays accepted, as above.
+            if (checked.data.registry) {
+                const registry = pushedPermissionRegistry.safeParse(checked.data.registry);
+                if (!registry.success)
+                    return refuse(registry.error.issues[0], ['registry']);
             }
         }
         await admin.publishVersion(c.get('actor'), input);
@@ -5121,7 +5150,9 @@ export function createControlPlaneApi(options) {
             until: c.req.query('until') || undefined,
             limit: c.req.query('limit'),
         });
-        return c.json(await options.observability.tenantLogs(input));
+        // #1877: scoped to the app's own scripts — the scan and trust boundary.
+        const services = await appServices(c.get('actor'), input.tenantId, input.scopeId, input.vertical);
+        return c.json(await options.observability.tenantLogs({ ...input, services }));
     });
     // #1746: the per-request record, read at the tenant grain. The three routes take ONE
     // query — tenant, window, facet filters (`tenant-request-query.ts`) — so the histogram,
@@ -5138,6 +5169,16 @@ export function createControlPlaneApi(options) {
             throw new ControlPlaneError(400, 'tenantId is required');
         return tenantId;
     };
+    /**
+     * #1877: the script families a tenant's app — or, with no scope named, its apps — run
+     * as (`scriptFamiliesOfScopes`). Every tenant log read is scoped to these: a query then
+     * reads one vertical's scripts instead of the whole account's, and a line counts only if
+     * one of them wrote it. From the directory, never the caller, and within the tenant: a
+     * scope id that is not this tenant's resolves no family, and a read over none answers
+     * nothing. `listScopes`, not `getScopeRecord`: a dashboard read must not write an access
+     * row per page view.
+     */
+    const appServices = async (actor, tenantId, scopeId, vertical) => scriptFamiliesOfScopes(await admin.listScopes(actor, { tenantId: tenantIdSchema.parse(tenantId) }), { scopeId, vertical });
     app.get('/observability/tenant-request-volume', async (c) => {
         if (!options.observability?.tenantRequestVolume) {
             return c.json({ error: 'request aggregation is not configured on this control plane' }, 501);
@@ -5146,7 +5187,8 @@ export function createControlPlaneApi(options) {
         // A bucket COUNT: zooming in keeps it and narrows the window, so the bucket shrinks.
         // 90 is the design's histogram; the bounds keep a chart drawable and a query cheap.
         const buckets = z.coerce.number().int().min(10).max(240).default(90).parse(c.req.query('buckets'));
-        return c.json(await options.observability.tenantRequestVolume({ ...scope, buckets }));
+        const services = await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
+        return c.json(await options.observability.tenantRequestVolume({ ...scope, services, buckets }));
     });
     app.get('/observability/tenant-request-facets', async (c) => {
         if (!options.observability?.tenantRequestFacets) {
@@ -5157,7 +5199,8 @@ export function createControlPlaneApi(options) {
         // that shows three asks for three.
         const asked = (c.req.queries('facet') ?? []).filter((k) => k.length > 0);
         const keys = asked.length === 0 ? undefined : z.array(z.enum(REQUEST_FACET_KEYS)).parse([...new Set(asked)]);
-        return c.json(await options.observability.tenantRequestFacets({ ...scope, ...(keys ? { keys } : {}) }));
+        const services = await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
+        return c.json(await options.observability.tenantRequestFacets({ ...scope, services, ...(keys ? { keys } : {}) }));
     });
     // #1747: the tenant's `ctx.log` lines grouped by the template they were written from.
     app.get('/observability/tenant-log-patterns', async (c) => {
@@ -5185,6 +5228,7 @@ export function createControlPlaneApi(options) {
             buckets: narrow.buckets,
             ...(narrow.level.length ? { level: narrow.level } : {}),
             ...(narrow.operation.length ? { operation: narrow.operation } : {}),
+            services: await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical),
         }));
     });
     app.get('/observability/tenant-requests', async (c) => {
@@ -5193,7 +5237,8 @@ export function createControlPlaneApi(options) {
         }
         const scope = parseTenantRequestQuery(requestTenantOf(c), requestQueryOf(c));
         const limit = z.coerce.number().int().min(1).max(200).default(50).parse(c.req.query('limit'));
-        return c.json(await options.observability.tenantRequests({ ...scope, limit }));
+        const services = await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
+        return c.json(await options.observability.tenantRequests({ ...scope, services, limit }));
     });
     /**
      * Observed-vs-declared outbound egress for a vertical's deployed versions (#859, D-46).
@@ -5836,7 +5881,7 @@ export function createControlPlaneApi(options) {
             // there; restore re-projects the vertical's roles from the dump's tuples). A one-shot
             // DO storage blip heals on the in-request retry WITHOUT burning a CI attempt (which
             // pushes a fresh version per try) — #559 (2).
-            await restoreOrRecord(() => target.restoreScope(tenantId, previewId, tables));
+            await restoreOrRecord(() => target.restoreScope(tenantId, previewId, tables, { sourceScopeId: source.id, exact: true }));
         }
         else {
             // A clean-room preview (#509 (b)): an EMPTY scope, no source to export. No `forkedFrom`