@synap-core/sdk 1.5.1 → 1.5.2

package/dist/testing.d.cts

@@ -172,7 +172,13 @@ declare function parseMockPodSeed(input: string | unknown): MockPodSeed;
 declare const MOCK_AUTH_ISSUER = "https://pod.mock-synap.test";
 declare const MOCK_GRANT: PodGrant[];
 declare const MOCK_USER: PodUser;
-type MockHubFailure = "rate_limited" | "forbidden" | "door_unsupported" | "unreachable" | "server" | "unavailable";
+type MockHubFailure = "rate_limited" | "forbidden" | "door_unsupported"
+/** 403 `{ error: <the pod's step-up message> }`: a stale device at a credential door (the Hub REST body has no reasonCode). */
+ | "step_up_required"
+/** 409 problem `CP_ACCOUNT_EMAIL_REQUIRED` (Control Plane: no verified email). */
+ | "email_unverified"
+/** 409 problem `FEDERATED_APPLICATION_ORIGIN_INSECURE` (Control Plane: an app origin that is not HTTPS). */
+ | "origin_insecure" | "unreachable" | "server" | "unavailable";
 interface MockAuthServerOptions {
     issuer?: string;
     /** Issue rotating refresh tokens. Default true; false = a pod without refresh tokens. */
@@ -209,6 +215,14 @@ interface MockAuthServerOptions {
      * not name it; the SDK reads an agent connection).
      */
     actsAs?: PodActsAs;
+    /**
+     * A Synap app's device starts STALE: `POST /proposals/:id/approve` is refused
+     * (403 `{ error: <step-up message> }`, the Hub REST shape) until the person
+     * re-confirms at the pod: `/authorize?prompt=login`, the code redeemed with the
+     * device's refresh token as `synap_device_refresh_token`. Needs `actsAs: "person"`.
+     * `expireStepUp()` makes it stale again (the 15-minute window).
+     */
+    requireStepUp?: boolean;
     /**
      * The pod's data as one JSON shape (`parseMockPodSeed`). `seed.entities` come
      * before `entities`; `seed.spaces` put a `templateSlug` on the grant rows of
@@ -284,6 +298,10 @@ interface MockAuthServer {
     authorize(authorizeUrl: string, decision?: AuthorizeDecision): string;
     /** Mark a refresh token used elsewhere: presenting it now is a REUSE (family + live key revoked). */
     consumeRefreshToken(token: string): void;
+    /** The pod now says `synap_acts_as: v` (null = says nothing): the app left, or joined, the Synap list. */
+    setActsAs(v: PodActsAs | null): void;
+    /** The device's last real sign-in is older than the step-up window. */
+    expireStepUp(): void;
     /** The next refresh redeem loses a concurrent race: invalid_grant, nothing revoked. */
     loseNextRefreshRace(): void;
     /** Refresh-token redeems that were reuses (each revoked a family). */

package/dist/testing.d.ts

@@ -172,7 +172,13 @@ declare function parseMockPodSeed(input: string | unknown): MockPodSeed;
 declare const MOCK_AUTH_ISSUER = "https://pod.mock-synap.test";
 declare const MOCK_GRANT: PodGrant[];
 declare const MOCK_USER: PodUser;
-type MockHubFailure = "rate_limited" | "forbidden" | "door_unsupported" | "unreachable" | "server" | "unavailable";
+type MockHubFailure = "rate_limited" | "forbidden" | "door_unsupported"
+/** 403 `{ error: <the pod's step-up message> }`: a stale device at a credential door (the Hub REST body has no reasonCode). */
+ | "step_up_required"
+/** 409 problem `CP_ACCOUNT_EMAIL_REQUIRED` (Control Plane: no verified email). */
+ | "email_unverified"
+/** 409 problem `FEDERATED_APPLICATION_ORIGIN_INSECURE` (Control Plane: an app origin that is not HTTPS). */
+ | "origin_insecure" | "unreachable" | "server" | "unavailable";
 interface MockAuthServerOptions {
     issuer?: string;
     /** Issue rotating refresh tokens. Default true; false = a pod without refresh tokens. */
@@ -209,6 +215,14 @@ interface MockAuthServerOptions {
      * not name it; the SDK reads an agent connection).
      */
     actsAs?: PodActsAs;
+    /**
+     * A Synap app's device starts STALE: `POST /proposals/:id/approve` is refused
+     * (403 `{ error: <step-up message> }`, the Hub REST shape) until the person
+     * re-confirms at the pod: `/authorize?prompt=login`, the code redeemed with the
+     * device's refresh token as `synap_device_refresh_token`. Needs `actsAs: "person"`.
+     * `expireStepUp()` makes it stale again (the 15-minute window).
+     */
+    requireStepUp?: boolean;
     /**
      * The pod's data as one JSON shape (`parseMockPodSeed`). `seed.entities` come
      * before `entities`; `seed.spaces` put a `templateSlug` on the grant rows of
@@ -284,6 +298,10 @@ interface MockAuthServer {
     authorize(authorizeUrl: string, decision?: AuthorizeDecision): string;
     /** Mark a refresh token used elsewhere: presenting it now is a REUSE (family + live key revoked). */
     consumeRefreshToken(token: string): void;
+    /** The pod now says `synap_acts_as: v` (null = says nothing): the app left, or joined, the Synap list. */
+    setActsAs(v: PodActsAs | null): void;
+    /** The device's last real sign-in is older than the step-up window. */
+    expireStepUp(): void;
     /** The next refresh redeem loses a concurrent race: invalid_grant, nothing revoked. */
     loseNextRefreshRace(): void;
     /** Refresh-token redeems that were reuses (each revoked a family). */

package/dist/testing.js

@@ -140,6 +140,7 @@ var MOCK_GRANT = [
   { permission: "entity.post.read", workspaceId: "ws_mock_studio", workspaceName: "Studio" },
   { permission: "entity.post.create", workspaceId: "ws_mock_studio", workspaceName: "Studio" }
 ];
+var STEP_UP_MESSAGE = "Confirm it's you before changing who or what can reach this pod.";
 var MOCK_USER = { id: "user_mock_ada", name: "Ada Lovelace" };
 var MOCK_APP = { id: "app_mock_studio", manageUrl: "https://pod-admin.mock-synap.test/apps/app_mock_studio" };
 var MOCK_APP_AGENT_ID = "agent_mock_app";
@@ -178,16 +179,32 @@ function createMockAuthServer(options = {}) {
   const seededAt = new Date(now()).toISOString();
   const rolesOf = (e) => Array.isArray(e.facets) ? e.facets.filter((f) => typeof f?.slug === "string") : [];
   function readableEntity(e, spaces, only) {
-    if (typeof e.workspaceId === "string" && spaces.has(e.workspaceId) && (!only || e.workspaceId === only)) return true;
+    if (typeof e.workspaceId === "string" && kindReadable(e, spaces, e.workspaceId) && (!only || e.workspaceId === only)) return true;
     return facetsOf(e, spaces, only ?? void 0).some((f) => e.workspaceId == null || !f.sharedRole);
   }
-  const facetsOf = (e, spaces, lens) => rolesOf(e).filter((f) => typeof f.workspaceId === "string" && spaces.has(f.workspaceId) && (lens === void 0 || f.workspaceId === lens));
+  const facetsOf = (e, spaces, lens) => rolesOf(e).filter((f) => typeof f.workspaceId === "string" && kindReadable(e, spaces, f.workspaceId) && (lens === void 0 || f.workspaceId === lens));
   const facetRow = (f) => ({ facetId: f.facetId, slug: f.slug, properties: f.properties ?? {}, status: f.status ?? null });
   const entityWire = (e) => {
     const { facets: _facets, facetSlugs: _facetSlugs, ...wire } = e;
     return wire;
   };
-  const readSpaces = (scope) => new Set(grant.filter((g) => /^entity\.(.+\.)?read$/.test(g.permission) && scope.includes(g.permission)).map((g) => g.workspaceId));
+  const readSpaces = (scope) => {
+    const out = /* @__PURE__ */ new Map();
+    for (const g of grant) {
+      const m = /^entity\.(?:(.+)\.)?read$/.exec(g.permission);
+      if (!m || !scope.includes(g.permission)) continue;
+      const kind = m[1];
+      if (kind === void 0 || kind === "*") out.set(g.workspaceId, null);
+      else if (out.get(g.workspaceId) !== null) out.set(g.workspaceId, (out.get(g.workspaceId) ?? /* @__PURE__ */ new Set()).add(kind));
+      else continue;
+    }
+    return out;
+  };
+  const kindReadable = (e, spaces, space) => {
+    if (!spaces.has(space)) return false;
+    const kinds = spaces.get(space);
+    return kinds === null || kinds === void 0 ? kinds === null : kinds.has(String(e.profileSlug ?? e.type ?? ""));
+  };
   for (const p of seed.proposals ?? []) {
     proposals.push({
       proposalType: "create",
@@ -202,7 +219,9 @@ function createMockAuthServer(options = {}) {
       ...p
     });
   }
-  const writeMode = options.writeMode ?? (options.actsAs === "person" ? "applied" : "proposed");
+  let actsAs = options.actsAs;
+  const writeMode = () => options.writeMode ?? (actsAs === "person" ? "applied" : "proposed");
+  let deviceFresh = !options.requireStepUp;
   const graceMs = (options.refreshGraceSec ?? 30) * 1e3;
   const app = options.app === void 0 ? MOCK_APP : options.app;
   let proposalSeq = 0;
@@ -248,7 +267,7 @@ function createMockAuthServer(options = {}) {
       synap_grant: grant.filter((g) => scope.includes(g.permission)).map((g) => g.templateSlug || !templateOf.has(g.workspaceId) ? g : { ...g, templateSlug: templateOf.get(g.workspaceId) }),
       synap_user: user,
       ...app ? { synap_app: app } : {},
-      ...options.actsAs ? { synap_acts_as: options.actsAs } : {}
+      ...actsAs ? { synap_acts_as: actsAs } : {}
     };
     if (pair) {
       body.refresh_token = pair.refreshToken;
@@ -274,6 +293,21 @@ function createMockAuthServer(options = {}) {
       if (form.resource !== void 0 && row.resource && form.resource !== row.resource) {
         return oauthError("invalid_target", "resource does not match the authorization request");
       }
+      if (actsAs === "person" && row.stepUp !== Boolean(form.synap_device_refresh_token)) {
+        return oauthError(
+          "invalid_grant",
+          row.stepUp ? "This code re-confirms a device: send its refresh token as synap_device_refresh_token" : "This code signs a new device in; a re-confirmation asks with prompt=login"
+        );
+      }
+      if (row.stepUp) {
+        const device = refreshTokens.get(form.synap_device_refresh_token);
+        if (!device || device.clientId !== row.clientId || device.used || device.revoked) {
+          return oauthError("invalid_grant", "Invalid, expired, revoked or already-used refresh token");
+        }
+        device.used = true;
+        deviceFresh = true;
+        return json(200, tokenBody(row.scope, row.clientId, device.family));
+      }
       for (const r of refreshTokens.values()) if (r.clientId === row.clientId) revokeFamily(r.family);
       return json(200, tokenBody(row.scope, row.clientId, randomToken()));
     }
@@ -350,6 +384,8 @@ function createMockAuthServer(options = {}) {
         const otherId = outgoing ? r.targetEntityId : r.sourceEntityId;
         const other = entities.find((e) => e.id === otherId);
         if (!other || !inLens(other) || !readableEntity(other, spaces)) continue;
+        const self = entities.find((e) => e.id === id);
+        if (self && self.workspaceId == null && other.workspaceId == null) continue;
         connections.push({
           entityId: otherId,
           // relations.ts: the raw row plus its role slugs under the read's facet lens (a 1.5.0 seed's own facetSlugs otherwise).
@@ -478,6 +514,12 @@ function createMockAuthServer(options = {}) {
         return json(403, { error: "Forbidden" });
       case "door_unsupported":
         return json(403, { error: "This door is not available to a space-scoped key", code: "GRANT_DOOR_UNSUPPORTED" });
+      case "step_up_required":
+        return json(403, { error: STEP_UP_MESSAGE });
+      case "email_unverified":
+        return json(409, { error: "Add and verify an email on your Synap account to connect a pod.", code: "CP_ACCOUNT_EMAIL_REQUIRED", recovery: { action: "update_control_plane_profile" } });
+      case "origin_insecure":
+        return json(409, { error: "This application must be served over HTTPS to connect to a Pod.", code: "FEDERATED_APPLICATION_ORIGIN_INSECURE" });
       case "server":
         return json(500, { error: "Internal error" });
       case "unavailable":
@@ -528,9 +570,10 @@ function createMockAuthServer(options = {}) {
     }
     const approve = method === "POST" ? /^\/proposals\/([^/]+)\/approve$/.exec(path) : null;
     if (approve) {
-      if (options.actsAs !== "person") {
+      if (actsAs !== "person") {
         return json(403, { error: "An agent credential cannot approve proposals \u2014 approve is human review. Approve from a human session." });
       }
+      if (!deviceFresh) return json(403, { error: STEP_UP_MESSAGE });
       const p = proposals.find((x) => x.id === decodeURIComponent(approve[1]));
       if (!p) return json(404, { error: "Proposal not found" });
       if (!grant.some((g) => g.permission === "proposal.approve" && row.scope.includes(g.permission) && g.workspaceId === p.workspaceId)) {
@@ -541,16 +584,26 @@ function createMockAuthServer(options = {}) {
       approvals.push(p.id);
       return json(200, { success: true, proposalId: p.id, proposal: { ...p } });
     }
+    const attach = method === "POST" ? /^\/entities\/([^/]+)\/facets$/.exec(path) : null;
+    const facetPatch = method === "PATCH" ? /^\/facets\/([^/]+)$/.exec(path) : null;
+    if (attach) return json(403, { error: "grant does not allow" });
+    if (facetPatch) {
+      const fid = decodeURIComponent(facetPatch[1]);
+      const parent = entities.find((e) => rolesOf(e).some((f) => f.facetId === fid));
+      if (parent && parent.workspaceId == null) return json(403, { error: "grant does not allow" });
+    }
     const patched = method === "PATCH" ? /^\/entities\/([^/]+)$/.exec(path) : null;
     if (patched) {
       const target = entities.find((e) => e.id === decodeURIComponent(patched[1]));
-      if (target && target.workspaceId == null) return json(403, { error: "grant does not allow" });
+      if (target && target.workspaceId == null) {
+        return typeof target.userId === "string" && target.userId !== user.id ? new Response(null, { status: 404 }) : json(403, { error: "grant does not allow" });
+      }
     }
     if (method !== "GET") {
       writes.push({ method, path, body });
       const fields = body && typeof body === "object" ? body : {};
       const workspaceId = typeof fields.workspaceId === "string" ? fields.workspaceId : null;
-      if (writeMode === "proposed") {
+      if (writeMode() === "proposed") {
         const proposalId = `prop_mock_${++proposalSeq}`;
         proposals.push({
           id: proposalId,
@@ -667,9 +720,15 @@ function createMockAuthServer(options = {}) {
       if (scope.length === 0) return finish({ error: "invalid_scope" });
       if (decision.deny) return finish({ error: "access_denied" });
       const code = randomToken();
-      codes.set(code, { clientId, redirectUri, challenge: q.get("code_challenge"), resource, scope });
+      codes.set(code, { clientId, redirectUri, challenge: q.get("code_challenge"), resource, scope, stepUp: actsAs === "person" && q.get("prompt") === "login" });
       return finish({ code });
     },
+    setActsAs(v) {
+      actsAs = v ?? void 0;
+    },
+    expireStepUp() {
+      deviceFresh = false;
+    },
     consumeRefreshToken(t) {
       const row = refreshTokens.get(t);
       if (row) row.used = true;