@suveren/gateway 0.8.6 → 0.8.7

package/dist/mcp-server/http.mjs

@@ -134,6 +134,13 @@ var SPClient = class {
   sessionCookie = "";
   apiKey = "";
   receiptRetry;
+  /** Set when a call comes back 401 while we held a session — distinct from
+   *  never having logged in. Cleared the moment a fresh cookie is configured. */
+  lockReason = null;
+  /** Single-flight per client instance: only the FIRST 401 after a session
+   *  was active tells the control plane. Concurrent in-flight calls that were
+   *  all sent under the same now-dead cookie would otherwise all report it. */
+  sessionExpiredNotified = false;
   /** The AS base URL this client talks to (for provenance records). */
   get url() {
     return this.baseUrl;
@@ -143,6 +150,22 @@ var SPClient = class {
   }
   setSessionCookie(cookie) {
     this.sessionCookie = cookie;
+    this.lockReason = null;
+    this.sessionExpiredNotified = false;
+  }
+  /**
+   * Drop the session because the control plane learned (by whatever path —
+   * one of OUR calls 401ing, or its own AS proxy 401ing) that it ended.
+   * Idempotent: safe to call redundantly from the control-plane's push.
+   */
+  clearSession() {
+    this.sessionCookie = "";
+    this.lockReason = "expired";
+  }
+  /** Why we are currently locked, if known. `null` means the default
+   *  boot-locked case (nobody has signed in yet this run). */
+  getLockReason() {
+    return this.sessionCookie === "" ? this.lockReason : null;
   }
   /**
    * Has anyone signed in yet this run?
@@ -174,10 +197,20 @@ var SPClient = class {
     if (this.apiKey) {
       headers["X-API-Key"] = this.apiKey;
     }
-    return globalThis.fetch(url, {
+    const hadSession = this.sessionCookie !== "";
+    const res = await globalThis.fetch(url, {
       ...init,
       headers
     });
+    if (res.status === 401 && hadSession) {
+      this.sessionCookie = "";
+      this.lockReason = "expired";
+      if (!this.sessionExpiredNotified) {
+        this.sessionExpiredNotified = true;
+        void notifyControlPlane("session-expired");
+      }
+    }
+    return res;
   }
   /**
    * Get SP public key.
@@ -1578,14 +1611,22 @@ function uiUrl() {
   const port2 = process.env.SUVEREN_CP_PORT ?? "3400";
   return `http://localhost:${port2}`;
 }
-function lockedNotice(action) {
-  const what = action ? `Cannot ${action}: the` : "The";
-  return `${what} Suveren gateway is running but LOCKED, so it cannot read any authorizations or credentials.
+function bootLockedNotice(what) {
+  return `${what} Suveren gateway is running but LOCKED, so it cannot read any mandates or credentials.
 
-This is not the same as having no authorizations \u2014 yours are on disk, encrypted, and unreadable until someone unlocks them.
+This is not the same as having no mandates \u2014 yours are on disk, encrypted, and unreadable until someone unlocks them.
 
 TELL THE USER: open ${uiUrl()} and enter your Suveren API key to unlock the gateway. It boots locked by design after every restart; the key is never stored.`;
 }
+function expiredSessionNotice(what) {
+  return `${what} Suveren gateway's sign-in has ended (sign-ins last 30 days, or it was revoked), so it is now LOCKED.
+
+TELL THE USER: open ${uiUrl()} and enter your Suveren API key to sign in again. Your mandates are safe; nothing ran.`;
+}
+function lockedNotice(action, reason = "restart") {
+  const what = action ? `Cannot ${action}: the` : "The";
+  return reason === "expired" ? expiredSessionNotice(what) : bootLockedNotice(what);
+}
 
 // src/tools/authorizations.ts
 import { getProfile as getProfile4 } from "@hap/core";
@@ -2109,7 +2150,7 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
   const lockedGuard = (inner) => async (args) => {
     if (!state2.spClient.isUnlocked()) {
       return {
-        content: [{ type: "text", text: lockedNotice(`use ${tool.namespacedName}`) }],
+        content: [{ type: "text", text: lockedNotice(`use ${tool.namespacedName}`, state2.spClient.getLockReason() ?? "restart") }],
         isError: true
       };
     }
@@ -2421,6 +2462,12 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
             }]
           };
         } catch (err) {
+          if (!state2.spClient.isUnlocked()) {
+            return {
+              content: [{ type: "text", text: lockedNotice(`use ${tool.namespacedName}`, "expired") }],
+              isError: true
+            };
+          }
           return {
             content: [{ type: "text", text: `Failed to submit proposal: ${err instanceof Error ? err.message : String(err)}` }],
             isError: true
@@ -2516,6 +2563,12 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.`
               }]
             };
           } catch (proposalErr) {
+            if (!state2.spClient.isUnlocked()) {
+              return {
+                content: [{ type: "text", text: lockedNotice(`use ${tool.namespacedName}`, "expired") }],
+                isError: true
+              };
+            }
             return {
               content: [{ type: "text", text: `Failed to submit approval proposal: ${proposalErr instanceof Error ? proposalErr.message : String(proposalErr)}` }],
               isError: true
@@ -2537,6 +2590,12 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.`
             isError: true
           };
         }
+        if (!state2.spClient.isUnlocked()) {
+          return {
+            content: [{ type: "text", text: lockedNotice(`use ${tool.namespacedName}`, "expired") }],
+            isError: true
+          };
+        }
         return {
           content: [{ type: "text", text: `SP unavailable \u2014 tool call blocked. ${err instanceof Error ? err.message : ""}` }],
           isError: true
@@ -2667,7 +2726,7 @@ function buildCapabilityMap(profileId, toolGating, integrationManager2) {
 function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
   return async (args) => {
     if (!state2.spClient.isUnlocked()) {
-      return { content: [{ type: "text", text: lockedNotice("list authorizations") }] };
+      return { content: [{ type: "text", text: lockedNotice("list authorizations", state2.spClient.getLockReason() ?? "restart") }] };
     }
     const authorizations = state2.getEnrichedAuthorizations();
     const now = Math.floor(Date.now() / 1e3);
@@ -2861,7 +2920,7 @@ function shortProfileName3(profileId) {
 function listIntegrationsHandler(state2, integrationManager2) {
   return async () => {
     if (!state2.spClient.isUnlocked()) {
-      return { content: [{ type: "text", text: lockedNotice("list integrations") }] };
+      return { content: [{ type: "text", text: lockedNotice("list integrations", state2.spClient.getLockReason() ?? "restart") }] };
     }
     if (!integrationManager2) {
       return { content: [{ type: "text", text: "No integration manager available." }] };
@@ -3067,7 +3126,7 @@ Result: ${resultText}` };
 function checkPendingCommitmentsHandler(state2, integrationManager2) {
   return async (args) => {
     if (!state2.spClient.isUnlocked()) {
-      return { content: [{ type: "text", text: lockedNotice("check commitments") }] };
+      return { content: [{ type: "text", text: lockedNotice("check commitments", state2.spClient.getLockReason() ?? "restart") }] };
     }
     try {
       if (args.proposal_id) {
@@ -4312,6 +4371,11 @@ app.post("/internal/configure", internalOnly, (req, res) => {
   }
   res.json({ ok: true });
 });
+app.post("/internal/clear-session", internalOnly, (_req, res) => {
+  state.spClient.clearSession();
+  console.error("[Suveren MCP] Session cleared by control-plane (AS session ended)");
+  res.json({ ok: true });
+});
 app.post("/internal/gate-content", internalOnly, async (req, res) => {
   try {
     const { authorizationId, boundsHash, contextHash, context, contextLabels, path: rawPath, gateContent } = req.body;