@taskforcehq/taskforce 0.3.301 → 0.3.302

package/dist/server/index.d.ts

@@ -22,6 +22,7 @@ interface AuthorizedRequestAccess extends RequestAccessContext {
 export declare function shouldProxyCloudPath(pathname: string): boolean;
 export declare function resolveCloudProxyUpstreamBaseUrl(req: http.IncomingMessage, fallbackBaseUrl: string): string;
 export declare function resolveAuthorizedWorkspaceAccess(core: Pick<TaskforceCore, 'resolveUserAccess' | 'getSystemRole'>, access: AuthorizedRequestAccess, requestedWorkspaceId: string): AuthorizedRequestAccess;
+export declare function resolveEffectiveRequestUserId(accessUserId: string, explicitUserId: string): string;
 export declare function resolveMaxPayloadBytesForPath(pathname: string, defaultMaxBytes: number): number;
 export declare function shouldRewriteSetCookieForLocalDevHost(hostHeader: string | undefined): boolean;
 export declare function writeJsonErrorIfPossible(res: http.ServerResponse, statusCode: number, payload: Record<string, unknown>): boolean;

package/dist/server/index.js

@@ -145,6 +145,17 @@ export function resolveAuthorizedWorkspaceAccess(core, access, requestedWorkspac
     }
     return access;
 }
+export function resolveEffectiveRequestUserId(accessUserId, explicitUserId) {
+    const normalizedAccessUserId = String(accessUserId || '').trim();
+    if (normalizedAccessUserId && normalizedAccessUserId !== 'anonymous') {
+        return normalizedAccessUserId;
+    }
+    const normalizedExplicitUserId = String(explicitUserId || '').trim();
+    if (normalizedExplicitUserId && normalizedExplicitUserId !== 'anonymous') {
+        return normalizedExplicitUserId;
+    }
+    return 'anonymous';
+}
 export function resolveMaxPayloadBytesForPath(pathname, defaultMaxBytes) {
     if (pathname.startsWith('/api/taskforce/sync/')) {
         // Sync routes (especially applying local changes) often include large binary attachments
@@ -677,7 +688,10 @@ export function createStandaloneServer(options) {
                 req.headers['x-taskforce-role'] = access.role;
                 req.headers['x-taskforce-system-role'] = access.systemRole;
                 req.headers['x-taskforce-workspace-id'] = access.workspaceId;
-                req.headers['x-taskforce-user-id'] = access.userId;
+                const explicitRequestUserId = Array.isArray(req.headers['x-taskforce-user-id'])
+                    ? String(req.headers['x-taskforce-user-id'][0] || '')
+                    : String(req.headers['x-taskforce-user-id'] || '');
+                req.headers['x-taskforce-user-id'] = resolveEffectiveRequestUserId(access.userId, explicitRequestUserId);
                 if (isCollaborationPolicyEnabled() && isMutation && access.role === 'read-only') {
                     res.writeHead(403, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({ error: 'Forbidden: read-only role cannot mutate data.' }));

package/dist/server/index.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it, vi } from 'vitest';
-import { ensureBillingWebhookAuthExclusion, ensurePublicSiteConfigAuthExclusion, isBillingWebhookPath, resolveAuthorizedWorkspaceAccess, shouldApplyAuthRateLimitForPath, shouldProxyCloudPath, writeJsonErrorIfPossible } from './index.js';
+import { ensureBillingWebhookAuthExclusion, ensurePublicSiteConfigAuthExclusion, isBillingWebhookPath, resolveEffectiveRequestUserId, resolveAuthorizedWorkspaceAccess, shouldApplyAuthRateLimitForPath, shouldProxyCloudPath, writeJsonErrorIfPossible } from './index.js';
 describe('server index helper policies', () => {
     it('adds webhook path to auth exclusions without duplicates', () => {
         const base = ['/api/taskforce/health', '/api/taskforce/auth'];
@@ -86,6 +86,7 @@ describe('shouldProxyCloudPath', () => {
         expect(shouldProxyCloudPath('/api/taskforce/admin/users')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/billing/plans')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/auth/login')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/account/team-management-access')).toBe(false);
         expect(shouldProxyCloudPath('/api/taskforce/public/site-config')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/public/site-config-script')).toBe(true);
     });
@@ -148,3 +149,15 @@ describe('resolveAuthorizedWorkspaceAccess', () => {
         expect(next.workspaceId).toBe('workspace-personal');
     });
 });
+describe('resolveEffectiveRequestUserId', () => {
+    it('prefers the authenticated access user when present', () => {
+        expect(resolveEffectiveRequestUserId('user-authenticated', 'user-explicit')).toBe('user-authenticated');
+    });
+    it('preserves an explicit local actor header when auth access is anonymous', () => {
+        expect(resolveEffectiveRequestUserId('anonymous', 'user-local-actor')).toBe('user-local-actor');
+        expect(resolveEffectiveRequestUserId('', 'user-local-actor')).toBe('user-local-actor');
+    });
+    it('falls back to anonymous when neither source has a user id', () => {
+        expect(resolveEffectiveRequestUserId('anonymous', '')).toBe('anonymous');
+    });
+});

package/dist/server/routes/admin.js

@@ -59,6 +59,7 @@ import { normalizeStorageIntegrityScheduleSettings, resolveStorageIntegritySched
 import { resolveVirusScanConfigFromEnv } from '../../security/virusScan.js';
 import { applyPrefixedRateLimitHeaders } from '../rateLimit.js';
 import { createTaskforceMcpServer, isMcpWriteToolName } from '../../mcp/runtime.js';
+import { parseAiProfileBootstrapHeaders } from '../../mcp/aiProfileBootstrap.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 import { randomUUID } from 'crypto';
@@ -81,6 +82,20 @@ export function registerAdminRoutes(deps) {
         const globalSettings = core.getGlobalSettings();
         return resolveEffectiveEmailConfig(process.env, globalSettings.email || null);
     };
+    const resolveBooleanSetting = (value, fallback) => {
+        if (typeof value === 'boolean')
+            return value;
+        if (typeof value === 'number')
+            return value !== 0;
+        const normalized = String(value || '').trim().toLowerCase();
+        if (!normalized)
+            return fallback;
+        if (['1', 'true', 'yes', 'on'].includes(normalized))
+            return true;
+        if (['0', 'false', 'no', 'off'].includes(normalized))
+            return false;
+        return fallback;
+    };
     const getAuthBehavior = () => {
         const globalSettings = core.getGlobalSettings();
         const authSettings = globalSettings.auth || {};
@@ -88,10 +103,10 @@ export function registerAdminRoutes(deps) {
         const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
         const signupSettings = core.getSignupMonetizationSettings();
         return {
-            allowSelfRegistration: authSettings.allowSelfRegistration !== false,
-            requireVerifiedEmail: authSettings.requireVerifiedEmail !== false,
-            defaultNewUserBetaAccess: authSettings.defaultNewUserBetaAccess === true,
-            authRateLimitEnabled: authSettings.authRateLimitEnabled !== false,
+            allowSelfRegistration: resolveBooleanSetting(authSettings.allowSelfRegistration, true),
+            requireVerifiedEmail: resolveBooleanSetting(authSettings.requireVerifiedEmail, true),
+            defaultNewUserBetaAccess: resolveBooleanSetting(authSettings.defaultNewUserBetaAccess, false),
+            authRateLimitEnabled: resolveBooleanSetting(authSettings.authRateLimitEnabled, true),
             authRateLimitMaxRequests: Number.isFinite(authRateLimitMaxRequestsRaw) && authRateLimitMaxRequestsRaw >= 1
                 ? Math.floor(authRateLimitMaxRequestsRaw)
                 : 10,
@@ -106,8 +121,8 @@ export function registerAdminRoutes(deps) {
         const globalSettings = core.getGlobalSettings();
         const siteSettings = globalSettings.site || {};
         return {
-            showRunTaskforceLocally: siteSettings.showRunTaskforceLocally !== false,
-            pricingPageEnabled: siteSettings.pricingPageEnabled !== false
+            showRunTaskforceLocally: resolveBooleanSetting(siteSettings.showRunTaskforceLocally, true),
+            pricingPageEnabled: resolveBooleanSetting(siteSettings.pricingPageEnabled, true)
         };
     };
     const resolveEffectiveVirusScanSettings = () => {
@@ -264,13 +279,7 @@ export function registerAdminRoutes(deps) {
             ? authorization.slice(7).trim()
             : '';
         const requestedWorkspaceId = requestHeader(req, 'x-taskforce-workspace-id', '').trim();
-        const aiProfileToken = requestHeader(req, 'x-taskforce-ai-profile-token', '').trim() || null;
-        const aiProfileName = requestHeader(req, 'x-taskforce-ai-name', '').trim() || null;
-        const aiProfileDescription = requestHeader(req, 'x-taskforce-ai-description', '').trim() || null;
-        const aiProfileRole = requestHeader(req, 'x-taskforce-ai-role', '').trim() || null;
-        const aiProfileProvider = requestHeader(req, 'x-taskforce-ai-provider', '').trim() || null;
-        const aiProfileModel = requestHeader(req, 'x-taskforce-ai-model', '').trim() || null;
-        const aiProfileSurfaceType = requestHeader(req, 'x-taskforce-ai-surface-type', '').trim() || null;
+        const bootstrap = parseAiProfileBootstrapHeaders(req.headers);
         if (bearerToken) {
             const tokenAuth = core.authenticateMcpAccessToken(bearerToken);
             const oauthAuth = tokenAuth ? null : core.authenticateMcpOAuthAccessToken(bearerToken);
@@ -318,13 +327,7 @@ export function registerAdminRoutes(deps) {
                 authenticatedViaToken: tokenAuth || null,
                 authenticatedViaOAuth: oauthAuth || null,
                 userId: null,
-                aiProfileToken,
-                aiProfileName,
-                aiProfileDescription,
-                aiProfileRole,
-                aiProfileProvider,
-                aiProfileModel,
-                aiProfileSurfaceType,
+                ...bootstrap,
             };
         }
         core.addMcpAuditLog({
@@ -1812,7 +1815,7 @@ export function registerAdminRoutes(deps) {
     addRoute('OPTIONS', '/mcp', async (_req, res) => {
         res.writeHead(204, {
             'Access-Control-Allow-Origin': '*',
-            'Access-Control-Allow-Headers': 'authorization, content-type, accept, last-event-id, mcp-protocol-version, mcp-session-id, x-taskforce-workspace-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
+            'Access-Control-Allow-Headers': 'authorization, content-type, accept, last-event-id, mcp-protocol-version, mcp-session-id, x-taskforce-workspace-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-icon, x-taskforce-ai-color, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
             'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS'
         });
         res.end();
@@ -1820,7 +1823,7 @@ export function registerAdminRoutes(deps) {
     addRoute('OPTIONS', '/mcp/', async (_req, res) => {
         res.writeHead(204, {
             'Access-Control-Allow-Origin': '*',
-            'Access-Control-Allow-Headers': 'authorization, content-type, accept, last-event-id, mcp-protocol-version, mcp-session-id, x-taskforce-workspace-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
+            'Access-Control-Allow-Headers': 'authorization, content-type, accept, last-event-id, mcp-protocol-version, mcp-session-id, x-taskforce-workspace-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-icon, x-taskforce-ai-color, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
             'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS'
         });
         res.end();

package/dist/server/routes/auth.d.ts

@@ -21,6 +21,7 @@
  *   POST /api/taskforce/auth/logout
  *   GET  /api/taskforce/account/access-status
  *   GET  /api/taskforce/account/entitlements
+ *   GET  /api/taskforce/account/team-management-access
  *   GET  /api/taskforce/account/plan-preview
  *   GET  /api/taskforce/auth/workspace-members
  *   GET  /api/taskforce/workspace/assignee-options
@@ -36,6 +37,8 @@
 import type { IncomingMessage, ServerResponse } from 'http';
 import type { TaskforceCore } from '../../core/Taskforce.js';
 import type { RouteHandler, RouteContext } from '../routes.js';
+import type { ResolvedObjectStorageConfig } from '../../storage/objectStorage.js';
+import { ObjectStorageClient } from '../../storage/objectStorageClient.js';
 export interface AuthRouteDependencies {
     addRoute: (method: string, path: string, handler: RouteHandler) => void;
     core: TaskforceCore;
@@ -57,5 +60,7 @@ export interface AuthRouteDependencies {
     shouldExposeDevAuthTokens: () => boolean;
     resolveRuntimeConfigBaseUrl: (req: IncomingMessage) => string;
     resolvePublicAuthBaseUrl: (req: IncomingMessage) => string;
+    resolveEffectiveObjectStorageConfig: () => ResolvedObjectStorageConfig;
+    getObjectStorageClient: () => ObjectStorageClient | null;
 }
 export declare function registerAuthRoutes(deps: AuthRouteDependencies): void;