@taskforcehq/taskforce 0.3.304 → 0.3.306

package/dist/server/auth/providers/appleClientSecret.js

@@ -0,0 +1,65 @@
+/**
+ * Apple OAuth client-secret JWT minter.
+ *
+ * Apple Sign In requires a short-lived JWT as the OAuth `client_secret` rather
+ * than a static secret. The JWT must be:
+ *   - Signed with ES256 (ECDSA P-256) using the private key registered in App Store Connect
+ *   - Valid for at most 6 months (Apple enforces this; we use 10 min for freshness)
+ *   - Cached so callers don't re-sign on every request
+ *
+ * Reference: https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens
+ */
+import { sign } from 'crypto';
+// ~9 min — well under Apple's 10-min max, allows safe margin for clock skew
+const CACHE_TTL_MS = 9 * 60 * 1000;
+// Apple max is 6 months; we use 10 min so tokens stay fresh
+const TOKEN_LIFETIME_SECONDS = 600;
+const secretCache = new Map();
+function configCacheKey(cfg) {
+    return `${cfg.teamId}:${cfg.servicesId}:${cfg.keyId}`;
+}
+function buildJwt(cfg) {
+    const now = Math.floor(Date.now() / 1000);
+    const header = Buffer.from(JSON.stringify({ alg: 'ES256', kid: cfg.keyId })).toString('base64url');
+    const payload = Buffer.from(JSON.stringify({
+        iss: cfg.teamId,
+        iat: now,
+        exp: now + TOKEN_LIFETIME_SECONDS,
+        aud: 'https://appleid.apple.com',
+        sub: cfg.servicesId
+    })).toString('base64url');
+    const signingInput = `${header}.${payload}`;
+    // sign() with dsaEncoding: 'ieee-p1363' produces raw r||s (64 bytes) required by JWT ES256
+    const signature = sign('SHA256', Buffer.from(signingInput), {
+        key: cfg.privateKeyPem,
+        dsaEncoding: 'ieee-p1363'
+    }).toString('base64url');
+    return `${signingInput}.${signature}`;
+}
+/**
+ * Returns a cached client-secret JWT for the given Apple config, minting a
+ * fresh one if the cache entry is absent or within 60 s of expiry.
+ */
+export function getAppleClientSecret(cfg) {
+    const key = configCacheKey(cfg);
+    const cached = secretCache.get(key);
+    if (cached && cached.expiresAt > Date.now() + 60_000) {
+        return cached.token;
+    }
+    const token = buildJwt(cfg);
+    secretCache.set(key, { token, expiresAt: Date.now() + CACHE_TTL_MS });
+    return token;
+}
+/**
+ * Force-mints a fresh JWT (bypasses cache) for health-check purposes.
+ * Returns success/error without updating the cache.
+ */
+export function testMintAppleClientSecret(cfg) {
+    try {
+        const token = buildJwt(cfg);
+        return { ok: true, token };
+    }
+    catch (err) {
+        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
+}

package/dist/server/auth/providers/github.d.ts

@@ -0,0 +1,26 @@
+/**
+ * GitHub OAuth adapter.
+ *
+ * Flow:
+ *   1. Redirect user to buildGithubAuthUrl() (includes PKCE S256 for GitHub Apps).
+ *   2. Receive code on callback; call exchangeGithubCode() to get profile.
+ *
+ * Email selection rules:
+ *   - Prefer the primary + verified email from /user/emails.
+ *   - Fall back to any verified email, then to user.email (public profile field).
+ *   - If none is available, email is null.
+ */
+import type { NormalizedOAuthProfile } from './types.js';
+export declare function buildGithubAuthUrl(input: {
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+}): string;
+export declare function exchangeGithubCode(input: {
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+    clientId: string;
+    clientSecret: string;
+}): Promise<NormalizedOAuthProfile>;

package/dist/server/auth/providers/github.js

@@ -0,0 +1,86 @@
+export function buildGithubAuthUrl(input) {
+    const params = new URLSearchParams({
+        client_id: input.clientId,
+        redirect_uri: input.redirectUri,
+        state: input.state,
+        scope: 'read:user user:email',
+        code_challenge: input.codeChallenge,
+        code_challenge_method: 'S256',
+    });
+    return `https://github.com/login/oauth/authorize?${params.toString()}`;
+}
+export async function exchangeGithubCode(input) {
+    // Step 1: exchange authorisation code for access token
+    const tokenRes = await fetch('https://github.com/login/oauth/access_token', {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json',
+        },
+        body: new URLSearchParams({
+            client_id: input.clientId,
+            client_secret: input.clientSecret,
+            code: input.code,
+            redirect_uri: input.redirectUri,
+            code_verifier: input.codeVerifier,
+        }).toString(),
+    });
+    if (!tokenRes.ok) {
+        const body = await tokenRes.text().catch(() => '');
+        throw new Error(`GitHub token exchange failed (${tokenRes.status}): ${body}`);
+    }
+    const tokens = await tokenRes.json();
+    if (tokens.error) {
+        throw new Error(`GitHub token exchange error: ${tokens.error}${tokens.error_description ? ` — ${tokens.error_description}` : ''}`);
+    }
+    const accessToken = String(tokens.access_token || '').trim();
+    if (!accessToken)
+        throw new Error('GitHub token exchange: missing access_token');
+    // Step 2: fetch user + emails in parallel
+    const ghHeaders = {
+        Authorization: `Bearer ${accessToken}`,
+        'User-Agent': 'Taskforce/1.0',
+        Accept: 'application/vnd.github+json',
+    };
+    const [userRes, emailsRes] = await Promise.all([
+        fetch('https://api.github.com/user', { headers: ghHeaders }),
+        fetch('https://api.github.com/user/emails', { headers: ghHeaders }),
+    ]);
+    if (!userRes.ok) {
+        throw new Error(`GitHub /user API failed (${userRes.status})`);
+    }
+    const user = await userRes.json();
+    const numericId = String(user.id || '').trim();
+    if (!numericId)
+        throw new Error('GitHub /user API: missing id');
+    // Step 3: resolve best email
+    let email = null;
+    let emailVerified = false;
+    if (emailsRes.ok) {
+        const emails = await emailsRes.json().catch(() => []);
+        const primaryVerified = emails.find(e => e.primary === true && e.verified === true);
+        if (primaryVerified) {
+            email = String(primaryVerified.email || '').trim().toLowerCase() || null;
+            emailVerified = true;
+        }
+        else {
+            const anyVerified = emails.find(e => e.verified === true);
+            if (anyVerified) {
+                email = String(anyVerified.email || '').trim().toLowerCase() || null;
+                emailVerified = true;
+            }
+        }
+    }
+    if (!email) {
+        // Last resort: public profile email (may be null / not set)
+        email = String(user.email || '').trim().toLowerCase() || null;
+    }
+    return {
+        provider: 'github',
+        providerSubject: numericId,
+        email,
+        emailVerified,
+        displayName: String(user.name || user.login || '').trim() || null,
+        avatarUrl: String(user.avatar_url || '').trim() || null,
+    };
+}

package/dist/server/auth/providers/google.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Google OAuth 2.0 / OpenID Connect adapter.
+ *
+ * Flow:
+ *   1. Redirect user to buildGoogleAuthUrl() (PKCE + S256).
+ *   2. Receive code on callback; call exchangeGoogleCode() to get profile.
+ */
+import type { NormalizedOAuthProfile } from './types.js';
+export declare function buildGoogleAuthUrl(input: {
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+}): string;
+export declare function exchangeGoogleCode(input: {
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+    clientId: string;
+    clientSecret: string;
+}): Promise<NormalizedOAuthProfile>;

package/dist/server/auth/providers/google.js

@@ -0,0 +1,56 @@
+export function buildGoogleAuthUrl(input) {
+    const params = new URLSearchParams({
+        client_id: input.clientId,
+        redirect_uri: input.redirectUri,
+        response_type: 'code',
+        scope: 'openid email profile',
+        state: input.state,
+        code_challenge: input.codeChallenge,
+        code_challenge_method: 'S256',
+        access_type: 'offline',
+        prompt: 'select_account',
+    });
+    return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
+}
+export async function exchangeGoogleCode(input) {
+    // Step 1: exchange authorisation code for tokens
+    const tokenRes = await fetch('https://oauth2.googleapis.com/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'authorization_code',
+            code: input.code,
+            redirect_uri: input.redirectUri,
+            client_id: input.clientId,
+            client_secret: input.clientSecret,
+            code_verifier: input.codeVerifier,
+        }).toString(),
+    });
+    if (!tokenRes.ok) {
+        const body = await tokenRes.text().catch(() => '');
+        throw new Error(`Google token exchange failed (${tokenRes.status}): ${body}`);
+    }
+    const tokens = await tokenRes.json();
+    const accessToken = String(tokens.access_token || '').trim();
+    if (!accessToken)
+        throw new Error('Google token exchange: missing access_token');
+    // Step 2: fetch userinfo
+    const userinfoRes = await fetch('https://www.googleapis.com/oauth2/v3/userinfo', {
+        headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    if (!userinfoRes.ok) {
+        throw new Error(`Google userinfo failed (${userinfoRes.status})`);
+    }
+    const info = await userinfoRes.json();
+    const sub = String(info.sub || '').trim();
+    if (!sub)
+        throw new Error('Google userinfo: missing sub');
+    return {
+        provider: 'google',
+        providerSubject: sub,
+        email: String(info.email || '').trim().toLowerCase() || null,
+        emailVerified: info.email_verified === true,
+        displayName: String(info.name || '').trim() || null,
+        avatarUrl: String(info.picture || '').trim() || null,
+    };
+}

package/dist/server/auth/providers/types.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Normalised OAuth profile returned by every provider adapter.
+ * The callback route uses this to resolve/create the Taskforce identity.
+ */
+export type OAuthProviderName = 'google' | 'github' | 'apple';
+export interface NormalizedOAuthProfile {
+    /** The provider that authenticated the user. */
+    provider: OAuthProviderName;
+    /** Stable, provider-assigned user ID (Google `sub`, GitHub numeric `id`, Apple `sub`). */
+    providerSubject: string;
+    /** Primary email address, or null if the provider withheld it (e.g. Apple private relay). */
+    email: string | null;
+    /** Whether the provider has verified ownership of the email address. */
+    emailVerified: boolean;
+    /** Human-readable display name, or null if not provided. */
+    displayName: string | null;
+    /** Avatar / profile picture URL, or null if not provided. */
+    avatarUrl: string | null;
+    /** Apple-specific: true when `email` is a private relay address. */
+    isPrivateEmail?: boolean;
+}

package/dist/server/auth/providers/types.js

@@ -0,0 +1 @@
+export {};

package/dist/server/auth.d.ts

@@ -30,6 +30,7 @@ export declare function createSessionTokenCookie(sessionId: string, config: Task
     role?: TaskforceRole;
     workspaceId?: string;
     userId?: string;
+    identityId?: string;
     secure?: boolean;
     sameSite?: 'Lax' | 'Strict' | 'None';
 }): string;
@@ -42,6 +43,7 @@ export interface RequestAccessContext {
     systemRole: TaskforceSystemRole;
     workspaceId: string;
     userId: string;
+    identityId: string | null;
 }
 export declare function resolveRequestAccess(req: IncomingMessage, config: TaskforceAuthConfig): RequestAccessContext;
 export declare function isRequestAuthorized(req: IncomingMessage, config: TaskforceAuthConfig): {

package/dist/server/auth.js

@@ -176,7 +176,8 @@ export function createSessionTokenCookie(sessionId, config, options) {
         exp,
         role: options?.role,
         workspaceId: options?.workspaceId,
-        userId: options?.userId
+        userId: options?.userId,
+        identityId: options?.identityId
     }));
     const sig = signPayload(payload, config.sessionSecret);
     const value = `${payload}.${sig}`;
@@ -240,7 +241,8 @@ export function resolveRequestAccess(req, config) {
         role: config.defaultRole,
         systemRole: 'user',
         workspaceId: fallbackWorkspaceId,
-        userId: fallbackUserId
+        userId: fallbackUserId,
+        identityId: null
     };
     const sessionClaims = readSessionClaimsFromRequest(req, config);
     if (sessionClaims?.sessionId) {
@@ -251,7 +253,8 @@ export function resolveRequestAccess(req, config) {
             role,
             systemRole: 'user',
             workspaceId: String(sessionClaims.workspaceId || config.defaultWorkspaceId).trim() || config.defaultWorkspaceId,
-            userId: String(sessionClaims.userId || fallbackUserId).trim() || fallbackUserId
+            userId: String(sessionClaims.userId || fallbackUserId).trim() || fallbackUserId,
+            identityId: String(sessionClaims.identityId || '').trim() || null
         };
     }
     return base;

package/dist/server/documentReviewRoutes.test.js

@@ -70,9 +70,9 @@ describe('document review routes', () => {
             core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
             const now = new Date().toISOString();
             core.db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, beta_access, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-            `).run('user-local-1', core.getTenantId(), 'local@example.com', 'Local User', 'local', 'user-local-1', 1, 0, now, now);
+                INSERT INTO users (id, tenant_id, email, display_name, beta_access, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('user-local-1', core.getTenantId(), 'local@example.com', 'Local User', 1, 0, now, now);
             core.db.prepare(`
                 INSERT INTO workspace_memberships (id, tenant_id, workspace_id, user_id, role, status, created_at, updated_at)
                 VALUES (?, ?, ?, ?, ?, ?, ?, ?)
@@ -154,4 +154,37 @@ describe('document review routes', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
+    it('blocks anonymous cloud access before reading document review sessions', async () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({
+            projectRoot,
+            storagePath: path.join(projectRoot, '.taskforce'),
+        });
+        try {
+            const routes = createRoutes(core, {
+                authConfig: {
+                    runtimeMode: 'cloud',
+                    enabled: true,
+                    requiredForApi: true,
+                    excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                    defaultRole: 'member',
+                    defaultWorkspaceId: '',
+                    sessionCookieName: 'taskforce_session',
+                    sessionSecret: 'test-secret',
+                    sessionTtlSeconds: 3600,
+                    sessionCookieSameSite: 'None',
+                    sessionCookieSecure: true,
+                },
+            });
+            const req = createMockReq('GET', '/api/taskforce/document-reviews/sessions?assetId=asset-doc-1', undefined, { 'x-taskforce-runtime-mode': 'cloud' });
+            const res = createMockRes();
+            await matchRoute('GET', '/api/taskforce/document-reviews/sessions', routes)?.handler(req, res, {});
+            expect(res.statusCode).toBe(401);
+            expect(res.__getBody()).toContain('Authentication required.');
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
 });

package/dist/server/index.cookieProxy.test.js

@@ -29,6 +29,7 @@ describe('proxy cookie rewrite helpers', () => {
         expect(shouldProxyCloudPath('/api/taskforce/billing/checkout-session')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/auth/session')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/workspace/assignee-options')).toBe(false);
+        expect(shouldProxyCloudPath('/api/taskforce/workspace/ai-profiles/avatar')).toBe(false);
         expect(shouldProxyCloudPath('/api/taskforce/settings/mcp/tokens')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/settings/mcp/test-connection')).toBe(true);
         expect(shouldProxyCloudPath('/api/platform/plans')).toBe(true);

package/dist/server/index.d.ts

@@ -11,6 +11,13 @@ export interface StandaloneServerOptions {
     projectRoot: string;
     port: number;
 }
+export type HttpServerTimeoutSettings = {
+    keepAliveTimeoutMs: number;
+    headersTimeoutMs: number;
+    requestTimeoutMs: number;
+};
+export declare function resolveHttpServerTimeoutSettings(env?: NodeJS.ProcessEnv): HttpServerTimeoutSettings;
+export declare function configureHttpServerTimeouts(server: Pick<http.Server, 'keepAliveTimeout' | 'headersTimeout' | 'requestTimeout'>, env?: NodeJS.ProcessEnv): HttpServerTimeoutSettings;
 export declare const TASKFORCE_PROXY_ORIGIN_HOST_HEADER = "x-taskforce-origin-host";
 export declare const TASKFORCE_PROXY_ORIGIN_PROTO_HEADER = "x-taskforce-origin-proto";
 export declare const TASKFORCE_PROXY_ORIGIN_BASE_URL_HEADER = "x-taskforce-origin-base-url";
@@ -18,10 +25,15 @@ export declare const TASKFORCE_PROXY_ORIGIN_RUNTIME_HEADER = "x-taskforce-origin
 export declare const TASKFORCE_PROXY_CLOUD_ENVIRONMENT_HEADER = "x-taskforce-cloud-environment";
 interface AuthorizedRequestAccess extends RequestAccessContext {
     disabled?: boolean;
+    accountDisabled?: boolean;
+    workspaceDisabled?: boolean;
 }
+export declare function isWorkspaceAccessRecoveryRoute(pathname: string): boolean;
+export declare function resolveDisabledAccessError(access: Pick<AuthorizedRequestAccess, 'disabled' | 'accountDisabled' | 'workspaceDisabled'>, pathname: string): string | null;
 export declare function shouldProxyCloudPath(pathname: string): boolean;
 export declare function resolveCloudProxyUpstreamBaseUrl(req: http.IncomingMessage, fallbackBaseUrl: string): string;
 export declare function resolveAuthorizedWorkspaceAccess(core: Pick<TaskforceCore, 'resolveUserAccess' | 'getSystemRole'>, access: AuthorizedRequestAccess, requestedWorkspaceId: string): AuthorizedRequestAccess;
+export declare function shouldApplyReadOnlyMutationGuard(methodRaw: string | undefined, pathname: string): boolean;
 export declare function resolveEffectiveRequestUserId(accessUserId: string, explicitUserId: string): string;
 export declare function resolveMaxPayloadBytesForPath(pathname: string, defaultMaxBytes: number): number;
 export declare function shouldRewriteSetCookieForLocalDevHost(hostHeader: string | undefined): boolean;

package/dist/server/index.js

@@ -84,11 +84,85 @@ const CORS_RESPONSE_HEADERS = new Set([
     'access-control-max-age',
     'vary'
 ]);
+const REFRESH_DIAGNOSTIC_PATH_PREFIXES = [
+    '/api/taskforce/auth/session',
+    '/api/taskforce/config',
+    '/api/taskforce/tasks',
+    '/api/taskforce/archive',
+    '/api/taskforce/workspaces',
+    '/api/taskforce/workspace/assignee-options',
+    '/api/taskforce/auth/workspace-members',
+    '/api/taskforce/taxonomy-state',
+    '/api/taskforce/categories',
+    '/api/taskforce/types',
+    '/api/taskforce/priorities',
+    '/api/taskforce/taxonomies',
+    '/api/taskforce/initiative-templates',
+    '/api/taskforce/workflow-templates',
+    '/api/taskforce/workflow-editor/overrides',
+    '/api/taskforce/environments',
+    '/api/taskforce/sync/'
+];
+const REFRESH_DIAGNOSTIC_DURATION_MS = 100;
+const DEFAULT_HTTP_KEEP_ALIVE_TIMEOUT_MS = 65_000;
+const DEFAULT_HTTP_HEADERS_TIMEOUT_MS = 70_000;
+const DEFAULT_HTTP_REQUEST_TIMEOUT_MS = 120_000;
+export function resolveHttpServerTimeoutSettings(env = process.env) {
+    const keepAliveTimeoutMs = readPositiveInteger(env.TASKFORCE_HTTP_KEEP_ALIVE_TIMEOUT_MS, DEFAULT_HTTP_KEEP_ALIVE_TIMEOUT_MS);
+    const configuredHeadersTimeoutMs = readPositiveInteger(env.TASKFORCE_HTTP_HEADERS_TIMEOUT_MS, DEFAULT_HTTP_HEADERS_TIMEOUT_MS);
+    const headersTimeoutMs = Math.max(configuredHeadersTimeoutMs, keepAliveTimeoutMs + 5_000);
+    const requestTimeoutMs = readPositiveInteger(env.TASKFORCE_HTTP_REQUEST_TIMEOUT_MS, DEFAULT_HTTP_REQUEST_TIMEOUT_MS);
+    return {
+        keepAliveTimeoutMs,
+        headersTimeoutMs,
+        requestTimeoutMs
+    };
+}
+export function configureHttpServerTimeouts(server, env = process.env) {
+    const settings = resolveHttpServerTimeoutSettings(env);
+    server.keepAliveTimeout = settings.keepAliveTimeoutMs;
+    server.headersTimeout = settings.headersTimeoutMs;
+    server.requestTimeout = settings.requestTimeoutMs;
+    return settings;
+}
 export const TASKFORCE_PROXY_ORIGIN_HOST_HEADER = 'x-taskforce-origin-host';
 export const TASKFORCE_PROXY_ORIGIN_PROTO_HEADER = 'x-taskforce-origin-proto';
 export const TASKFORCE_PROXY_ORIGIN_BASE_URL_HEADER = 'x-taskforce-origin-base-url';
 export const TASKFORCE_PROXY_ORIGIN_RUNTIME_HEADER = 'x-taskforce-origin-runtime';
 export const TASKFORCE_PROXY_CLOUD_ENVIRONMENT_HEADER = 'x-taskforce-cloud-environment';
+export function isWorkspaceAccessRecoveryRoute(pathname) {
+    return pathname === '/api/taskforce/workspaces'
+        || pathname === '/api/taskforce/session/workspace';
+}
+export function resolveDisabledAccessError(access, pathname) {
+    if (pathname.startsWith('/api/taskforce/auth/'))
+        return null;
+    if (access.accountDisabled ?? access.disabled) {
+        return 'Forbidden: user account is disabled.';
+    }
+    if (access.workspaceDisabled && !isWorkspaceAccessRecoveryRoute(pathname)) {
+        return 'Forbidden: workspace access is not active for this user.';
+    }
+    return null;
+}
+function shouldLogRefreshDiagnostic(pathname) {
+    return REFRESH_DIAGNOSTIC_PATH_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(prefix));
+}
+function getRequestTimingNow() {
+    return Date.now();
+}
+function isCloudOwnedUserAvatarContextPath(pathname) {
+    const prefix = '/api/taskforce/context/';
+    if (!pathname.startsWith(prefix))
+        return false;
+    try {
+        const decodedPath = decodeURIComponent(pathname.slice(prefix.length)).replace(/\\/g, '/');
+        return /^users\/[^/]+\/profile\/avatar\/[^/]+$/i.test(decodedPath);
+    }
+    catch {
+        return false;
+    }
+}
 export function shouldProxyCloudPath(pathname) {
     if (!pathname)
         return false;
@@ -114,6 +188,7 @@ export function shouldProxyCloudPath(pathname) {
         || pathname.startsWith('/api/taskforce/admin/')
         || pathname.startsWith('/api/taskforce/billing/')
         || pathname.startsWith('/api/taskforce/auth/')
+        || isCloudOwnedUserAvatarContextPath(pathname)
         || pathname.startsWith('/api/taskforce/settings/mcp/')
         || pathname.startsWith('/api/platform/')
         || pathname.startsWith('/api/taskforce/sync/');
@@ -142,11 +217,27 @@ export function resolveAuthorizedWorkspaceAccess(core, access, requestedWorkspac
             workspaceId: resolved.workspaceId,
             userId: resolved.userId,
             systemRole: core.getSystemRole(resolved.userId),
-            disabled: resolved.disabled
+            disabled: resolved.disabled,
+            accountDisabled: resolved.accountDisabled ?? resolved.disabled,
+            workspaceDisabled: resolved.workspaceDisabled ?? false
         };
     }
     return access;
 }
+export function shouldApplyReadOnlyMutationGuard(methodRaw, pathname) {
+    const method = String(methodRaw || 'GET').toUpperCase();
+    if (method !== 'POST' && method !== 'PATCH' && method !== 'DELETE')
+        return false;
+    if (!pathname.startsWith('/api/taskforce/'))
+        return false;
+    if (pathname.startsWith('/api/taskforce/auth/'))
+        return false;
+    if (pathname === '/api/taskforce/health')
+        return false;
+    if (method === 'POST' && pathname === '/api/taskforce/session/workspace')
+        return false;
+    return true;
+}
 export function resolveEffectiveRequestUserId(accessUserId, explicitUserId) {
     const normalizedAccessUserId = String(accessUserId || '').trim();
     if (normalizedAccessUserId && normalizedAccessUserId !== 'anonymous') {
@@ -259,6 +350,7 @@ export function shouldApplyAuthRateLimitForPath(pathname) {
     const normalizedPath = String(pathname || '').trim();
     return normalizedPath.startsWith('/api/taskforce/auth/')
         && normalizedPath !== '/api/taskforce/auth/session'
+        && normalizedPath !== '/api/taskforce/auth/providers'
         && normalizedPath !== '/api/taskforce/auth/runtime-config'
         && normalizedPath !== '/api/taskforce/auth/admin-session';
 }
@@ -458,6 +550,17 @@ export function createStandaloneServer(options) {
             statusCode
         }, counterKeys);
     };
+    const logRefreshDiagnostic = (input) => {
+        const { pathname, method, statusCode, durationMs, req } = input;
+        if (!shouldLogRefreshDiagnostic(pathname))
+            return;
+        if (durationMs < REFRESH_DIAGNOSTIC_DURATION_MS && statusCode < 400)
+            return;
+        const requestId = String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || '-';
+        const workspaceId = String(req.headers['x-taskforce-workspace-id'] || '').trim() || '-';
+        const userId = String(req.headers['x-taskforce-user-id'] || '').trim() || '-';
+        console.info(`[Taskforce RefreshDiag] method=${method} path=${pathname} status=${statusCode} durationMs=${durationMs} requestId=${requestId} workspaceId=${workspaceId} userId=${userId}`);
+    };
     // Resolve static files directory at runtime
     // Standalone UI source now lives in apps/app and builds to dist/ui.
     // When built: dist/server/index.js -> dist/ui/
@@ -514,6 +617,7 @@ export function createStandaloneServer(options) {
     const integritySchedulePollMinutes = readPositiveInteger(process.env.TASKFORCE_STORAGE_INTEGRITY_SCHEDULE_POLL_MINUTES, 1);
     console.log(`[Taskforce] Storage integrity scheduler poll: every ${integritySchedulePollMinutes} minute(s)`);
     const server = http.createServer(async (req, res) => {
+        const requestStartedAt = getRequestTimingNow();
         if (!distUiPath) {
             uiResolution = resolveStaticUiPath();
             distUiPath = uiResolution.uiPath;
@@ -568,11 +672,12 @@ export function createStandaloneServer(options) {
                 const hasBody = method !== 'GET' && method !== 'HEAD';
                 const requestMaxPayload = resolveMaxPayloadBytesForPath(url.pathname, maxPayloadBytes);
                 const body = hasBody ? await readRequestBody(req, requestMaxPayload) : undefined;
+                const shouldStreamCloudAvatar = method === 'GET' && isCloudOwnedUserAvatarContextPath(url.pathname);
                 const upstream = await fetch(upstreamUrl, {
                     method,
                     headers,
                     body: body && body.length > 0 ? new Uint8Array(body) : undefined,
-                    redirect: 'manual'
+                    redirect: shouldStreamCloudAvatar ? 'follow' : 'manual'
                 });
                 const outgoingHeaders = {};
                 for (const [key, value] of upstream.headers.entries()) {
@@ -714,19 +819,16 @@ export function createStandaloneServer(options) {
                     return;
                 }
                 const pathname = url.pathname;
-                const isMutation = (req.method === 'POST' || req.method === 'PATCH' || req.method === 'DELETE')
-                    && pathname.startsWith('/api/taskforce/')
-                    && !pathname.startsWith('/api/taskforce/auth/')
-                    && pathname !== '/api/taskforce/health';
+                const isMutation = shouldApplyReadOnlyMutationGuard(req.method, pathname);
                 let access = accessForRateLimit;
-                const isAuthRoute = pathname.startsWith('/api/taskforce/auth/');
                 if (access.authenticated) {
                     access = resolveAuthorizedWorkspaceAccess(core, access, Array.isArray(req.headers['x-taskforce-workspace-id'])
                         ? String(req.headers['x-taskforce-workspace-id'][0] || '')
                         : String(req.headers['x-taskforce-workspace-id'] || ''));
-                    if (access.disabled && !isAuthRoute) {
+                    const disabledAccessError = resolveDisabledAccessError(access, pathname);
+                    if (disabledAccessError) {
                         res.writeHead(403, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: 'Forbidden: user account is disabled.' }));
+                        res.end(JSON.stringify({ error: disabledAccessError }));
                         return;
                     }
                 }
@@ -756,6 +858,13 @@ export function createStandaloneServer(options) {
                 res.writeHead = originalWriteHead;
                 const finalStatus = Number.isFinite(Number(observedStatusCode)) ? Number(observedStatusCode) : 200;
                 recordCollaborationRouteTelemetry(url.pathname, req.method || 'GET', finalStatus);
+                logRefreshDiagnostic({
+                    pathname: url.pathname,
+                    method: String(req.method || 'GET').toUpperCase(),
+                    statusCode: finalStatus,
+                    durationMs: Math.max(0, Math.round(getRequestTimingNow() - requestStartedAt)),
+                    req
+                });
             }
             return;
         }
@@ -789,6 +898,8 @@ export function createStandaloneServer(options) {
         res.writeHead(404);
         res.end('Not Found');
     });
+    const timeoutSettings = configureHttpServerTimeouts(server);
+    console.log(`[Taskforce] HTTP timeouts: keepAlive=${timeoutSettings.keepAliveTimeoutMs}ms headers=${timeoutSettings.headersTimeoutMs}ms request=${timeoutSettings.requestTimeoutMs}ms`);
     // WebSocket server at /Taskforce-ws path
     const wss = new WebSocketServer({ server, path: '/taskforce-ws' });
     const realtimeWsManager = createRealtimeSyncWsManager(core, authConfig);

package/dist/server/index.rateLimit.test.js

@@ -7,6 +7,9 @@ describe('shouldApplyAuthRateLimitForPath', () => {
     it('excludes auth session endpoint', () => {
         expect(shouldApplyAuthRateLimitForPath('/api/taskforce/auth/session')).toBe(false);
     });
+    it('excludes auth providers metadata endpoint', () => {
+        expect(shouldApplyAuthRateLimitForPath('/api/taskforce/auth/providers')).toBe(false);
+    });
     it('excludes runtime config bootstrap endpoint', () => {
         expect(shouldApplyAuthRateLimitForPath('/api/taskforce/auth/runtime-config')).toBe(false);
     });