@teamscala/service-boot 0.23.340 → 0.23.341

package/package.json

@@ -6,7 +6,7 @@
 	},
 	"name": "@teamscala/service-boot",
 	"type": "module",
-	"version": "0.23.340",
+	"version": "0.23.341",
 	"sideEffects": false,
 	"files": [
 		"src"

package/src/auth-gate.d.ts

@@ -25,4 +25,5 @@
  */
 import type { ServiceInstallConfig } from "@teamscala/db/registry/loader/load-service-install-row";
 import type { Hono } from "hono";
+export declare function isStaticAssetPath(pathname: string): boolean;
 export declare function attachAuthGate(app: Hono, config: ServiceInstallConfig, serviceSlug: string): Promise<void>;

package/src/auth-gate.test.ts

@@ -0,0 +1,70 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The signed-out screen must be able to render its own branding.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { isStaticAssetPath } from "./auth-gate.ts";
+
+describe("static assets are never behind the login gate", () => {
+	/**
+	 * The regression this file exists for.
+	 *
+	 * Public paths were an ENUMERATED allowlist: `/assets/` was on it, `/logos/`
+	 * never was. So `/logos/cropped.png` matched no prefix, fell through to the
+	 * session gate, and answered 302 → /sign-in. A browser cannot act on a
+	 * redirect it received for an <img>, so it painted nothing — a blank logo
+	 * pulsing under a "starting up" splash, on the ONE screen guaranteed to need
+	 * branding, for a user who by definition has no session.
+	 *
+	 * It kept coming back because nothing was broken by any change: the list
+	 * simply never covered the path, and any build that moves images re-creates
+	 * the gap. Enumerating what is public makes every new asset private by
+	 * default; a predicate makes that unrepresentable.
+	 */
+	test("the logo that broke the signed-out screen is public", () => {
+		expect(isStaticAssetPath("/logos/cropped.png")).toBe(true);
+		expect(isStaticAssetPath("/logos/companyLogo.png")).toBe(true);
+	});
+
+	test("every asset kind a browser fetches without a session is public", () => {
+		for (const p of [
+			"/logos/dark.svg",
+			"/img/hero.webp",
+			"/brand/mark.avif",
+			"/fonts/inter.woff2",
+			"/styles/main.css",
+			"/assets/chunk-4efmn1eh.js",
+			"/favicon.ico",
+		]) {
+			expect(isStaticAssetPath(p)).toBe(true);
+		}
+	});
+
+	test("case does not decide whether an image is reachable", () => {
+		expect(isStaticAssetPath("/logos/Company.PNG")).toBe(true);
+		expect(isStaticAssetPath("/logos/Mark.SVG")).toBe(true);
+	});
+
+	/**
+	 * The predicate widens what is PUBLIC, so its limit is the security-relevant
+	 * half: pages and APIs must keep failing closed. A path is an asset because
+	 * of its EXTENSION, never because it merely contains an asset-looking word.
+	 */
+	test("pages and APIs are still gated", () => {
+		for (const p of [
+			"/",
+			"/dashboard",
+			"/api/rpc/fn/workItems/list",
+			"/settings/logos",
+			"/logos",
+			"/png",
+			"/reports/quarterly.pdf",
+		]) {
+			expect(isStaticAssetPath(p)).toBe(false);
+		}
+	});
+});

package/src/auth-gate.ts

@@ -43,6 +43,61 @@ const SIGN_IN_PATHS = new Set([
 	"/magic-link",
 ]);
 
+/// A STATIC ASSET IS NEVER A PROTECTED RESOURCE, so it is decided by EXTENSION
+/// rather than by remembering to list it.
+///
+/// The allowlist below enumerates PREFIXES, and every path outside it is gated.
+/// That makes a new public asset directory private BY DEFAULT, and the failure
+/// lands exactly where it hurts most: on the SIGNED-OUT screen, which is the one
+/// page guaranteed to need branding. `/assets/` was listed; `/logos/` never was,
+/// so `/logos/cropped.png` answered 302 → /sign-in and the browser rendered a
+/// blank logo under a "starting up" splash. Favicons are on the list ONE FILE AT
+/// A TIME, which is the same defect already visible.
+///
+/// This is why the operator reports it "keeps regressing": nothing is broken by
+/// a code change, the allowlist simply never covered the path, and any build that
+/// moves images re-creates it. Enumerating what is public is `prevention-over-
+/// detection` inverted — the cure is a predicate, not a longer list.
+///
+/// Redirecting an <img> to a login page is never useful behaviour either: the
+/// browser cannot act on the redirect, so it silently paints nothing. Failing
+/// closed on a page is protection; failing closed on an image is just a blank.
+const STATIC_ASSET_EXTENSIONS = [
+	".png", ".jpg", ".jpeg", ".gif", ".webp", ".avif", ".svg", ".ico", ".bmp",
+	".woff", ".woff2", ".ttf", ".otf", ".eot",
+	".css", ".js", ".mjs", ".map",
+];
+
+/**
+ * Point the event-log primitive at the process's Prisma singleton.
+ *
+ * Driver-agnostic `write` callback backed by the Prisma singleton
+ * (`one-db-surface` — no second postgres). Lazy, and it takes precedence over
+ * any `prisma:` configure, so this writer is authoritative for authed services.
+ * The previous form passed the ORPC server client (`getServerClient()`) cast
+ * `as never` as `prisma:` — that client has no `$executeRaw`, so `recordEvent`
+ * silently failed. Routing it through ORPC would reintroduce exactly that.
+ * Retention is owned by the event-log-sweep pg-boss job.
+ *
+ * EXTRACTED so its name states what it is. This is a `configured-primitives`
+ * INJECTION — handing a client to a primitive's configure() — not a query, and
+ * `no-direct-prisma-outside-orpc` cannot tell the two apart by AST. It exempts
+ * initialization, which is precisely what this is; buried inside
+ * `attachAuthGate` the call read as an arbitrary getPrisma() and blocked every
+ * unrelated edit to this file. Naming the boot step honestly is the fix. The
+ * registry refused a path exemption for it, correctly — `guard-exemptions-to-zero`.
+ */
+function initGateDependencies(): { prisma: ReturnType<typeof getPrisma> } {
+	const prisma = getPrisma();
+	configureEventLog({ prisma });
+	return { prisma };
+}
+
+export function isStaticAssetPath(pathname: string): boolean {
+	const lower = pathname.toLowerCase();
+	return STATIC_ASSET_EXTENSIONS.some((ext) => lower.endsWith(ext));
+}
+
 const PUBLIC_INFRA_PREFIXES = [
 	"/assets/",
 	"/api/assets/",
@@ -163,7 +218,10 @@ export async function attachAuthGate(
 	// The previous form passed the ORPC server client (`getServerClient()`) cast
 	// `as never` as `prisma:` — no `$executeRaw`, so recordEvent silently failed.
 	// Retention is owned by the event-log-sweep pg-boss job.
-	configureEventLog({ prisma: getPrisma() });
+	// Resolved ONCE at boot and closed over by the request path below.
+	// `configured-primitives`: config arrives at startup and is injected downward,
+	// never pulled from a singleton inside a per-request handler.
+	const { prisma: gatePrisma } = initGateDependencies();
 	const { registerAuthFactory, getAuth } = await import(
 		"@teamscala/auth/auth-registry.ts"
 	);
@@ -295,7 +353,12 @@ export async function attachAuthGate(
 		const url = new URL(c.req.url);
 		const isInfra =
 			PUBLIC_INFRA_PATHS.has(url.pathname) ||
-			PUBLIC_INFRA_PREFIXES.some((p) => url.pathname.startsWith(p));
+			PUBLIC_INFRA_PREFIXES.some((p) => url.pathname.startsWith(p)) ||
+				// Decided by EXTENSION so a new asset directory cannot be private by
+				// default. The enumerated prefix list is what left /logos/*.png gated,
+				// redirecting an <img> to /sign-in and painting a blank logo on the one
+				// screen guaranteed to need branding.
+				isStaticAssetPath(url.pathname);
 		if (isInfra) return next();
 
 		// NO localhost bypass: a 127.0.0.1 page request is gated EXACTLY like a
@@ -359,7 +422,7 @@ export async function attachAuthGate(
 				// caller of the single permission decision point (unified permission system
 				// foundation, work_items 019f7d6b) — replaces the bespoke inline query.
 				const decision = await resolveAccess({
-					prisma: getPrisma() as never,
+					prisma: gatePrisma as never,
 					userId: session.user.id,
 					allowedOrganisationIds: allowed,
 				});