@taskforcehq/taskforce 0.3.304 → 0.3.306

package/dist/server/routes/shared.js

@@ -17,6 +17,57 @@ export function resolveErrorStatusCode(error, fallback = 400) {
     }
     return fallback;
 }
+// === SECTION: Route timing helpers ===
+export const BOOTSTRAP_ROUTE_SLOW_THRESHOLD_MS = 1500;
+export const BOOTSTRAP_ROUTE_SEVERE_THRESHOLD_MS = 5000;
+function sanitizeServerTimingMetricName(name) {
+    return String(name || 'taskforce-route')
+        .trim()
+        .replace(/[^A-Za-z0-9_-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        || 'taskforce-route';
+}
+export function getRouteTimingNow() {
+    return Date.now();
+}
+export function buildServerTimingMetric(name, durationMs) {
+    return `${sanitizeServerTimingMetricName(name)};dur=${Math.max(0, Math.round(durationMs))}`;
+}
+export function setServerTimingHeader(res, metrics) {
+    const value = metrics
+        .filter((metric) => String(metric.name || '').trim().length > 0)
+        .map((metric) => buildServerTimingMetric(metric.name, metric.durationMs))
+        .join(', ');
+    if (value)
+        res.setHeader('Server-Timing', value);
+}
+export function serializeJsonWithTiming(payload, startedAt = getRouteTimingNow()) {
+    const body = JSON.stringify(payload);
+    return {
+        body,
+        byteLength: Buffer.byteLength(body, 'utf8'),
+        durationMs: Math.max(0, getRouteTimingNow() - startedAt),
+    };
+}
+export function requestBootstrapTraceId(req) {
+    return requestHeader(req, 'x-taskforce-bootstrap-trace-id', '').trim();
+}
+export function logSlowBootstrapRoute(input) {
+    const thresholdMs = Number(input.thresholdMs) > 0 ? Number(input.thresholdMs) : BOOTSTRAP_ROUTE_SLOW_THRESHOLD_MS;
+    const severeThresholdMs = Number(input.severeThresholdMs) > 0 ? Number(input.severeThresholdMs) : BOOTSTRAP_ROUTE_SEVERE_THRESHOLD_MS;
+    const durationMs = Math.max(0, Math.round(input.durationMs));
+    if (durationMs < thresholdMs)
+        return;
+    const payload = {
+        route: input.route,
+        workspaceId: String(input.workspaceId || '').trim() || 'default',
+        traceId: String(input.traceId || '').trim() || null,
+        durationMs,
+        severity: durationMs >= severeThresholdMs ? 'high' : 'warning',
+        ...(input.details || {}),
+    };
+    console.warn('[Taskforce Bootstrap Timing]', payload);
+}
 export function buildCloudMcpRuntimeAuth(input) {
     const { req, auth, requestHeader, requestId, authScopes } = input;
     const actorType = auth.authenticatedViaToken
@@ -37,6 +88,7 @@ export function buildCloudMcpRuntimeAuth(input) {
         aiProfileProvider: auth.aiProfileProvider,
         aiProfileModel: auth.aiProfileModel,
         aiProfileSurfaceType: auth.aiProfileSurfaceType,
+        aiProfileSeatScope: 'cloud_metered',
         actorType,
         requestId: String(requestId || req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || undefined,
         ip: req.socket?.remoteAddress || null,
@@ -216,8 +268,14 @@ export function makeEnsureAdminRole(core, context) {
         return actor.authenticated && actor.systemRole === 'system_admin';
     };
 }
-export function makeEnsureAuthenticatedUser() {
+export function makeEnsureAuthenticatedUser(authConfig) {
     return function ensureAuthenticatedUser(req) {
+        if (authConfig?.enabled) {
+            const access = resolveRequestAccess(req, authConfig);
+            if (access.authenticated && access.userId && access.userId !== 'anonymous') {
+                return true;
+            }
+        }
         const userId = String(requestUserId(req) || '').trim();
         return userId.length > 0 && userId !== 'anonymous';
     };
@@ -286,21 +344,28 @@ export function makeAuditAdminAction(core, context) {
     };
 }
 export function makeAuditAuthAction(core, requestWorkspaceId, context) {
-    return function auditAuthAction(req, action, details) {
+    return function auditAuthAction(req, action, details, workspaceIdOverride) {
         const authConfig = context.authConfig;
         const resolvedAccess = authConfig?.enabled ? resolveRequestAccess(req, authConfig) : null;
         const actorUserId = resolvedAccess?.authenticated && resolvedAccess.userId && resolvedAccess.userId !== 'anonymous'
             ? resolvedAccess.userId
             : requestUserId(req);
-        const actorRole = resolvedAccess?.authenticated
+        let actorRole = resolvedAccess?.authenticated
             ? String(resolvedAccess.role || '').trim().toLowerCase() || requestRole(req)
             : requestRole(req);
+        const workspaceId = String(workspaceIdOverride || requestWorkspaceId(req) || '').trim() || 'default';
+        if (workspaceIdOverride && actorUserId && actorUserId !== 'anonymous') {
+            const membership = core.listWorkspaceUsers(workspaceId).find((user) => String(user.userId || '').trim() === actorUserId);
+            const role = String(membership?.role || '').trim().toLowerCase();
+            if (role)
+                actorRole = role;
+        }
         const payload = {
             ts: new Date().toISOString(),
             action,
             actorUserId,
             actorRole,
-            workspaceId: requestWorkspaceId(req),
+            workspaceId,
             details
         };
         try {

package/dist/server/routes/sync.d.ts

@@ -1,6 +1,6 @@
 import { IncomingMessage } from 'http';
 import { TaskforceCore, TaskforceSyncCapable } from '../../core/Taskforce.js';
-import { RouteHandler, RouteContext } from '../routes.js';
+import { type RouteContext, type RouteHandler } from './primitives.js';
 import { resolveRequestAccess, createSessionTokenCookie } from '../auth.js';
 import { isReservedWorkspaceId } from '../../utils/workspaceIdentity.js';
 export interface SyncRouteDependencies {