@taskforcehq/taskforce 0.3.305 → 0.3.307

package/dist/server/annotatedAttachmentsRoutes.test.js

@@ -199,7 +199,69 @@ describe('annotated attachment routes', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
-    it('allows local mutation attribution fallback when local runtime has an active user even if auth is enabled', async () => {
+    it('lists canonical image assets for the Image Notes tray', async () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({
+            projectRoot,
+            storagePath: path.join(projectRoot, '.taskforce'),
+        });
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            const category = core.getCategories()[0]?.value;
+            const type = core.getTypes()[0]?.value;
+            const task = core.createTask({ title: 'Review image', category, type }, { workspaceId: 'workspace-1', actorRef: 'owner-1' });
+            const assetStore = core.getWorkspaceAssetStore();
+            const asset = assetStore.upsertAsset({
+                assetId: 'asset-image-1',
+                workspaceId: 'workspace-1',
+                kind: 'image',
+                originalFilename: 'ui-review.png',
+                logicalName: 'UI Review',
+                mimeType: 'image/png',
+                storageProvider: 'local',
+                storageKey: 'workspaces/workspace-1/assets/images/asset-image-1-ui-review.png',
+                contentSha256: 'sha-image-1',
+                sizeBytes: 256,
+            });
+            assetStore.upsertLink({
+                workspaceId: 'workspace-1',
+                assetId: asset.assetId,
+                taskId: task.id,
+                role: 'attachment',
+            });
+            core.createAnnotatedAttachmentSession({
+                workspaceId: 'workspace-1',
+                taskId: '',
+                baseImageAssetId: asset.assetId,
+                title: 'UI Review session',
+                actorId: 'owner-1',
+            });
+            const routes = createRoutes(core);
+            const listImagesMatch = matchRoute('GET', '/api/taskforce/annotated-attachments/images', routes);
+            const listImagesReq = createMockReq('GET', '/api/taskforce/annotated-attachments/images?workspaceId=workspace-1');
+            const listImagesRes = createMockRes();
+            await listImagesMatch?.handler(listImagesReq, listImagesRes, {});
+            expect(listImagesRes.statusCode).toBe(200);
+            expect(listImagesRes.getHeader('cache-control')).toBe('no-store');
+            const listed = JSON.parse(listImagesRes.__getBody());
+            expect(listed.images).toHaveLength(1);
+            expect(listed.images[0]).toMatchObject({
+                assetId: asset.assetId,
+                displayName: 'UI Review',
+                path: '/api/taskforce/context/workspaces%2Fworkspace-1%2Fassets%2Fimages%2Fasset-image-1-ui-review.png',
+                attachmentCount: 1,
+                sessionCount: 1,
+                taskId: task.id,
+                taskReferenceLabel: task.referenceLabel,
+            });
+            expect(listed.images[0].imageReferenceLabel).toMatch(/^I-\d+$/);
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('rejects local mutation attribution when only an active workspace user fallback is available', async () => {
         const projectRoot = createProjectRoot();
         const core = new TaskforceCore({
             projectRoot,
@@ -209,9 +271,9 @@ describe('annotated attachment routes', () => {
             core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
             const now = new Date().toISOString();
             core.db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, beta_access, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-            `).run('user-local-1', core.getTenantId(), 'local@example.com', 'Local User', 'local', 'user-local-1', 1, 0, now, now);
+                INSERT INTO users (id, tenant_id, email, display_name, beta_access, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('user-local-1', core.getTenantId(), 'local@example.com', 'Local User', 1, 0, now, now);
             core.db.prepare(`
                 INSERT INTO workspace_memberships (id, tenant_id, workspace_id, user_id, role, status, created_at, updated_at)
                 VALUES (?, ?, ?, ?, ?, ?, ?, ?)
@@ -252,13 +314,10 @@ describe('annotated attachment routes', () => {
             });
             const createRes = createMockRes();
             await createMatch?.handler(createReq, createRes, {});
-            expect(createRes.statusCode).toBe(200);
+            expect(createRes.statusCode).toBe(401);
             expect(JSON.parse(createRes.__getBody())).toMatchObject({
-                success: true,
-                session: expect.objectContaining({
-                    createdByActorId: 'user-local-1',
-                    updatedByActorId: 'user-local-1',
-                }),
+                success: false,
+                code: 'MUTATION_AUTH_REQUIRED',
             });
         }
         finally {

package/dist/server/auth/providers/apple.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Apple Sign In adapter.
+ *
+ * Flow:
+ *   1. Redirect user to buildAppleAuthUrl() with response_mode=form_post.
+ *   2. Apple POSTs `code`, `state`, `id_token` and optional `user` JSON to the callback.
+ *   3. Call exchangeAppleCode() which mints the client-secret JWT, exchanges the code,
+ *      and decodes the id_token payload for the canonical profile.
+ *
+ * Notes:
+ *   - Apple never re-sends the user's name after the very first authorisation.
+ *     If the user JSON arrives on first login it is captured; subsequent logins
+ *     use the snapshot stored in user_auth_identities.
+ *   - Private-relay email addresses contain `.privaterelay.appleid.com`; the
+ *     `is_private_email` claim is set to `true` in that case.
+ */
+import type { NormalizedOAuthProfile } from './types.js';
+export declare function buildAppleAuthUrl(input: {
+    servicesId: string;
+    redirectUri: string;
+    state: string;
+    nonce: string;
+}): string;
+export declare function exchangeAppleCode(input: {
+    code: string;
+    redirectUri: string;
+    servicesId: string;
+    teamId: string;
+    keyId: string;
+    privateKeyPem: string;
+    /** Optional: JSON string Apple sends on first authorisation containing { name }. */
+    userJson?: string | null;
+}): Promise<NormalizedOAuthProfile>;

package/dist/server/auth/providers/apple.js

@@ -0,0 +1,82 @@
+import { getAppleClientSecret } from './appleClientSecret.js';
+export function buildAppleAuthUrl(input) {
+    const params = new URLSearchParams({
+        client_id: input.servicesId,
+        redirect_uri: input.redirectUri,
+        response_type: 'code id_token',
+        scope: 'name email',
+        state: input.state,
+        nonce: input.nonce,
+        response_mode: 'form_post',
+    });
+    return `https://appleid.apple.com/auth/authorize?${params.toString()}`;
+}
+export async function exchangeAppleCode(input) {
+    const clientSecret = getAppleClientSecret({
+        servicesId: input.servicesId,
+        teamId: input.teamId,
+        keyId: input.keyId,
+        privateKeyPem: input.privateKeyPem,
+    });
+    // Step 1: exchange authorisation code for tokens
+    const tokenRes = await fetch('https://appleid.apple.com/auth/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'authorization_code',
+            code: input.code,
+            redirect_uri: input.redirectUri,
+            client_id: input.servicesId,
+            client_secret: clientSecret,
+        }).toString(),
+    });
+    if (!tokenRes.ok) {
+        const body = await tokenRes.text().catch(() => '');
+        throw new Error(`Apple token exchange failed (${tokenRes.status}): ${body}`);
+    }
+    const tokens = await tokenRes.json();
+    const idToken = String(tokens.id_token || '').trim();
+    if (!idToken)
+        throw new Error('Apple token exchange: missing id_token');
+    // Step 2: decode id_token payload (trust Apple — skip signature verification here)
+    const parts = idToken.split('.');
+    if (parts.length !== 3)
+        throw new Error('Apple id_token: not a valid JWT');
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+    }
+    catch {
+        throw new Error('Apple id_token: could not decode payload');
+    }
+    const sub = String(payload.sub || '').trim();
+    if (!sub)
+        throw new Error('Apple id_token: missing sub');
+    const email = String(payload.email || '').trim().toLowerCase() || null;
+    const emailVerified = payload.email_verified === true || payload.email_verified === 'true';
+    const isPrivateEmail = payload.is_private_email === true || payload.is_private_email === 'true';
+    // Step 3: extract display name from one-time `user` JSON (first-login only)
+    let displayName = null;
+    if (input.userJson) {
+        try {
+            const userObj = JSON.parse(input.userJson);
+            const firstName = String(userObj?.name?.firstName || '').trim();
+            const lastName = String(userObj?.name?.lastName || '').trim();
+            const full = [firstName, lastName].filter(Boolean).join(' ');
+            if (full)
+                displayName = full;
+        }
+        catch {
+            // malformed — ignore
+        }
+    }
+    return {
+        provider: 'apple',
+        providerSubject: sub,
+        email,
+        emailVerified,
+        displayName,
+        avatarUrl: null, // Apple never provides an avatar
+        isPrivateEmail,
+    };
+}

package/dist/server/auth/providers/appleClientSecret.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Apple OAuth client-secret JWT minter.
+ *
+ * Apple Sign In requires a short-lived JWT as the OAuth `client_secret` rather
+ * than a static secret. The JWT must be:
+ *   - Signed with ES256 (ECDSA P-256) using the private key registered in App Store Connect
+ *   - Valid for at most 6 months (Apple enforces this; we use 10 min for freshness)
+ *   - Cached so callers don't re-sign on every request
+ *
+ * Reference: https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens
+ */
+export interface AppleClientSecretConfig {
+    /** 10-character Apple Team ID */
+    teamId: string;
+    /** Services ID (bundle ID) registered in App Store Connect */
+    servicesId: string;
+    /** Key ID of the registered Sign In with Apple key */
+    keyId: string;
+    /** PEM-encoded EC P-256 private key downloaded from App Store Connect */
+    privateKeyPem: string;
+}
+/**
+ * Returns a cached client-secret JWT for the given Apple config, minting a
+ * fresh one if the cache entry is absent or within 60 s of expiry.
+ */
+export declare function getAppleClientSecret(cfg: AppleClientSecretConfig): string;
+/**
+ * Force-mints a fresh JWT (bypasses cache) for health-check purposes.
+ * Returns success/error without updating the cache.
+ */
+export declare function testMintAppleClientSecret(cfg: AppleClientSecretConfig): {
+    ok: true;
+    token: string;
+} | {
+    ok: false;
+    error: string;
+};

package/dist/server/auth/providers/appleClientSecret.js

@@ -0,0 +1,65 @@
+/**
+ * Apple OAuth client-secret JWT minter.
+ *
+ * Apple Sign In requires a short-lived JWT as the OAuth `client_secret` rather
+ * than a static secret. The JWT must be:
+ *   - Signed with ES256 (ECDSA P-256) using the private key registered in App Store Connect
+ *   - Valid for at most 6 months (Apple enforces this; we use 10 min for freshness)
+ *   - Cached so callers don't re-sign on every request
+ *
+ * Reference: https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens
+ */
+import { sign } from 'crypto';
+// ~9 min — well under Apple's 10-min max, allows safe margin for clock skew
+const CACHE_TTL_MS = 9 * 60 * 1000;
+// Apple max is 6 months; we use 10 min so tokens stay fresh
+const TOKEN_LIFETIME_SECONDS = 600;
+const secretCache = new Map();
+function configCacheKey(cfg) {
+    return `${cfg.teamId}:${cfg.servicesId}:${cfg.keyId}`;
+}
+function buildJwt(cfg) {
+    const now = Math.floor(Date.now() / 1000);
+    const header = Buffer.from(JSON.stringify({ alg: 'ES256', kid: cfg.keyId })).toString('base64url');
+    const payload = Buffer.from(JSON.stringify({
+        iss: cfg.teamId,
+        iat: now,
+        exp: now + TOKEN_LIFETIME_SECONDS,
+        aud: 'https://appleid.apple.com',
+        sub: cfg.servicesId
+    })).toString('base64url');
+    const signingInput = `${header}.${payload}`;
+    // sign() with dsaEncoding: 'ieee-p1363' produces raw r||s (64 bytes) required by JWT ES256
+    const signature = sign('SHA256', Buffer.from(signingInput), {
+        key: cfg.privateKeyPem,
+        dsaEncoding: 'ieee-p1363'
+    }).toString('base64url');
+    return `${signingInput}.${signature}`;
+}
+/**
+ * Returns a cached client-secret JWT for the given Apple config, minting a
+ * fresh one if the cache entry is absent or within 60 s of expiry.
+ */
+export function getAppleClientSecret(cfg) {
+    const key = configCacheKey(cfg);
+    const cached = secretCache.get(key);
+    if (cached && cached.expiresAt > Date.now() + 60_000) {
+        return cached.token;
+    }
+    const token = buildJwt(cfg);
+    secretCache.set(key, { token, expiresAt: Date.now() + CACHE_TTL_MS });
+    return token;
+}
+/**
+ * Force-mints a fresh JWT (bypasses cache) for health-check purposes.
+ * Returns success/error without updating the cache.
+ */
+export function testMintAppleClientSecret(cfg) {
+    try {
+        const token = buildJwt(cfg);
+        return { ok: true, token };
+    }
+    catch (err) {
+        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
+}

package/dist/server/auth/providers/github.d.ts

@@ -0,0 +1,26 @@
+/**
+ * GitHub OAuth adapter.
+ *
+ * Flow:
+ *   1. Redirect user to buildGithubAuthUrl() (includes PKCE S256 for GitHub Apps).
+ *   2. Receive code on callback; call exchangeGithubCode() to get profile.
+ *
+ * Email selection rules:
+ *   - Prefer the primary + verified email from /user/emails.
+ *   - Fall back to any verified email, then to user.email (public profile field).
+ *   - If none is available, email is null.
+ */
+import type { NormalizedOAuthProfile } from './types.js';
+export declare function buildGithubAuthUrl(input: {
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+}): string;
+export declare function exchangeGithubCode(input: {
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+    clientId: string;
+    clientSecret: string;
+}): Promise<NormalizedOAuthProfile>;

package/dist/server/auth/providers/github.js

@@ -0,0 +1,86 @@
+export function buildGithubAuthUrl(input) {
+    const params = new URLSearchParams({
+        client_id: input.clientId,
+        redirect_uri: input.redirectUri,
+        state: input.state,
+        scope: 'read:user user:email',
+        code_challenge: input.codeChallenge,
+        code_challenge_method: 'S256',
+    });
+    return `https://github.com/login/oauth/authorize?${params.toString()}`;
+}
+export async function exchangeGithubCode(input) {
+    // Step 1: exchange authorisation code for access token
+    const tokenRes = await fetch('https://github.com/login/oauth/access_token', {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json',
+        },
+        body: new URLSearchParams({
+            client_id: input.clientId,
+            client_secret: input.clientSecret,
+            code: input.code,
+            redirect_uri: input.redirectUri,
+            code_verifier: input.codeVerifier,
+        }).toString(),
+    });
+    if (!tokenRes.ok) {
+        const body = await tokenRes.text().catch(() => '');
+        throw new Error(`GitHub token exchange failed (${tokenRes.status}): ${body}`);
+    }
+    const tokens = await tokenRes.json();
+    if (tokens.error) {
+        throw new Error(`GitHub token exchange error: ${tokens.error}${tokens.error_description ? ` — ${tokens.error_description}` : ''}`);
+    }
+    const accessToken = String(tokens.access_token || '').trim();
+    if (!accessToken)
+        throw new Error('GitHub token exchange: missing access_token');
+    // Step 2: fetch user + emails in parallel
+    const ghHeaders = {
+        Authorization: `Bearer ${accessToken}`,
+        'User-Agent': 'Taskforce/1.0',
+        Accept: 'application/vnd.github+json',
+    };
+    const [userRes, emailsRes] = await Promise.all([
+        fetch('https://api.github.com/user', { headers: ghHeaders }),
+        fetch('https://api.github.com/user/emails', { headers: ghHeaders }),
+    ]);
+    if (!userRes.ok) {
+        throw new Error(`GitHub /user API failed (${userRes.status})`);
+    }
+    const user = await userRes.json();
+    const numericId = String(user.id || '').trim();
+    if (!numericId)
+        throw new Error('GitHub /user API: missing id');
+    // Step 3: resolve best email
+    let email = null;
+    let emailVerified = false;
+    if (emailsRes.ok) {
+        const emails = await emailsRes.json().catch(() => []);
+        const primaryVerified = emails.find(e => e.primary === true && e.verified === true);
+        if (primaryVerified) {
+            email = String(primaryVerified.email || '').trim().toLowerCase() || null;
+            emailVerified = true;
+        }
+        else {
+            const anyVerified = emails.find(e => e.verified === true);
+            if (anyVerified) {
+                email = String(anyVerified.email || '').trim().toLowerCase() || null;
+                emailVerified = true;
+            }
+        }
+    }
+    if (!email) {
+        // Last resort: public profile email (may be null / not set)
+        email = String(user.email || '').trim().toLowerCase() || null;
+    }
+    return {
+        provider: 'github',
+        providerSubject: numericId,
+        email,
+        emailVerified,
+        displayName: String(user.name || user.login || '').trim() || null,
+        avatarUrl: String(user.avatar_url || '').trim() || null,
+    };
+}

package/dist/server/auth/providers/google.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Google OAuth 2.0 / OpenID Connect adapter.
+ *
+ * Flow:
+ *   1. Redirect user to buildGoogleAuthUrl() (PKCE + S256).
+ *   2. Receive code on callback; call exchangeGoogleCode() to get profile.
+ */
+import type { NormalizedOAuthProfile } from './types.js';
+export declare function buildGoogleAuthUrl(input: {
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+}): string;
+export declare function exchangeGoogleCode(input: {
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+    clientId: string;
+    clientSecret: string;
+}): Promise<NormalizedOAuthProfile>;

package/dist/server/auth/providers/google.js

@@ -0,0 +1,56 @@
+export function buildGoogleAuthUrl(input) {
+    const params = new URLSearchParams({
+        client_id: input.clientId,
+        redirect_uri: input.redirectUri,
+        response_type: 'code',
+        scope: 'openid email profile',
+        state: input.state,
+        code_challenge: input.codeChallenge,
+        code_challenge_method: 'S256',
+        access_type: 'offline',
+        prompt: 'select_account',
+    });
+    return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
+}
+export async function exchangeGoogleCode(input) {
+    // Step 1: exchange authorisation code for tokens
+    const tokenRes = await fetch('https://oauth2.googleapis.com/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'authorization_code',
+            code: input.code,
+            redirect_uri: input.redirectUri,
+            client_id: input.clientId,
+            client_secret: input.clientSecret,
+            code_verifier: input.codeVerifier,
+        }).toString(),
+    });
+    if (!tokenRes.ok) {
+        const body = await tokenRes.text().catch(() => '');
+        throw new Error(`Google token exchange failed (${tokenRes.status}): ${body}`);
+    }
+    const tokens = await tokenRes.json();
+    const accessToken = String(tokens.access_token || '').trim();
+    if (!accessToken)
+        throw new Error('Google token exchange: missing access_token');
+    // Step 2: fetch userinfo
+    const userinfoRes = await fetch('https://www.googleapis.com/oauth2/v3/userinfo', {
+        headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    if (!userinfoRes.ok) {
+        throw new Error(`Google userinfo failed (${userinfoRes.status})`);
+    }
+    const info = await userinfoRes.json();
+    const sub = String(info.sub || '').trim();
+    if (!sub)
+        throw new Error('Google userinfo: missing sub');
+    return {
+        provider: 'google',
+        providerSubject: sub,
+        email: String(info.email || '').trim().toLowerCase() || null,
+        emailVerified: info.email_verified === true,
+        displayName: String(info.name || '').trim() || null,
+        avatarUrl: String(info.picture || '').trim() || null,
+    };
+}

package/dist/server/auth/providers/types.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Normalised OAuth profile returned by every provider adapter.
+ * The callback route uses this to resolve/create the Taskforce identity.
+ */
+export type OAuthProviderName = 'google' | 'github' | 'apple';
+export interface NormalizedOAuthProfile {
+    /** The provider that authenticated the user. */
+    provider: OAuthProviderName;
+    /** Stable, provider-assigned user ID (Google `sub`, GitHub numeric `id`, Apple `sub`). */
+    providerSubject: string;
+    /** Primary email address, or null if the provider withheld it (e.g. Apple private relay). */
+    email: string | null;
+    /** Whether the provider has verified ownership of the email address. */
+    emailVerified: boolean;
+    /** Human-readable display name, or null if not provided. */
+    displayName: string | null;
+    /** Avatar / profile picture URL, or null if not provided. */
+    avatarUrl: string | null;
+    /** Apple-specific: true when `email` is a private relay address. */
+    isPrivateEmail?: boolean;
+}

package/dist/server/auth/providers/types.js

@@ -0,0 +1 @@
+export {};

package/dist/server/auth.d.ts

@@ -30,6 +30,7 @@ export declare function createSessionTokenCookie(sessionId: string, config: Task
     role?: TaskforceRole;
     workspaceId?: string;
     userId?: string;
+    identityId?: string;
     secure?: boolean;
     sameSite?: 'Lax' | 'Strict' | 'None';
 }): string;
@@ -42,6 +43,7 @@ export interface RequestAccessContext {
     systemRole: TaskforceSystemRole;
     workspaceId: string;
     userId: string;
+    identityId: string | null;
 }
 export declare function resolveRequestAccess(req: IncomingMessage, config: TaskforceAuthConfig): RequestAccessContext;
 export declare function isRequestAuthorized(req: IncomingMessage, config: TaskforceAuthConfig): {

package/dist/server/auth.js

@@ -176,7 +176,8 @@ export function createSessionTokenCookie(sessionId, config, options) {
         exp,
         role: options?.role,
         workspaceId: options?.workspaceId,
-        userId: options?.userId
+        userId: options?.userId,
+        identityId: options?.identityId
     }));
     const sig = signPayload(payload, config.sessionSecret);
     const value = `${payload}.${sig}`;
@@ -240,7 +241,8 @@ export function resolveRequestAccess(req, config) {
         role: config.defaultRole,
         systemRole: 'user',
         workspaceId: fallbackWorkspaceId,
-        userId: fallbackUserId
+        userId: fallbackUserId,
+        identityId: null
     };
     const sessionClaims = readSessionClaimsFromRequest(req, config);
     if (sessionClaims?.sessionId) {
@@ -251,7 +253,8 @@ export function resolveRequestAccess(req, config) {
             role,
             systemRole: 'user',
             workspaceId: String(sessionClaims.workspaceId || config.defaultWorkspaceId).trim() || config.defaultWorkspaceId,
-            userId: String(sessionClaims.userId || fallbackUserId).trim() || fallbackUserId
+            userId: String(sessionClaims.userId || fallbackUserId).trim() || fallbackUserId,
+            identityId: String(sessionClaims.identityId || '').trim() || null
         };
     }
     return base;

package/dist/server/documentReviewRoutes.test.js

@@ -70,9 +70,9 @@ describe('document review routes', () => {
             core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
             const now = new Date().toISOString();
             core.db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, beta_access, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-            `).run('user-local-1', core.getTenantId(), 'local@example.com', 'Local User', 'local', 'user-local-1', 1, 0, now, now);
+                INSERT INTO users (id, tenant_id, email, display_name, beta_access, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('user-local-1', core.getTenantId(), 'local@example.com', 'Local User', 1, 0, now, now);
             core.db.prepare(`
                 INSERT INTO workspace_memberships (id, tenant_id, workspace_id, user_id, role, status, created_at, updated_at)
                 VALUES (?, ?, ?, ?, ?, ?, ?, ?)
@@ -154,4 +154,37 @@ describe('document review routes', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
+    it('blocks anonymous cloud access before reading document review sessions', async () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({
+            projectRoot,
+            storagePath: path.join(projectRoot, '.taskforce'),
+        });
+        try {
+            const routes = createRoutes(core, {
+                authConfig: {
+                    runtimeMode: 'cloud',
+                    enabled: true,
+                    requiredForApi: true,
+                    excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                    defaultRole: 'member',
+                    defaultWorkspaceId: '',
+                    sessionCookieName: 'taskforce_session',
+                    sessionSecret: 'test-secret',
+                    sessionTtlSeconds: 3600,
+                    sessionCookieSameSite: 'None',
+                    sessionCookieSecure: true,
+                },
+            });
+            const req = createMockReq('GET', '/api/taskforce/document-reviews/sessions?assetId=asset-doc-1', undefined, { 'x-taskforce-runtime-mode': 'cloud' });
+            const res = createMockRes();
+            await matchRoute('GET', '/api/taskforce/document-reviews/sessions', routes)?.handler(req, res, {});
+            expect(res.statusCode).toBe(401);
+            expect(res.__getBody()).toContain('Authentication required.');
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
 });

package/dist/server/index.cookieProxy.test.js

@@ -29,6 +29,7 @@ describe('proxy cookie rewrite helpers', () => {
         expect(shouldProxyCloudPath('/api/taskforce/billing/checkout-session')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/auth/session')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/workspace/assignee-options')).toBe(false);
+        expect(shouldProxyCloudPath('/api/taskforce/workspace/ai-profiles/avatar')).toBe(false);
         expect(shouldProxyCloudPath('/api/taskforce/settings/mcp/tokens')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/settings/mcp/test-connection')).toBe(true);
         expect(shouldProxyCloudPath('/api/platform/plans')).toBe(true);