@teamscala/service-boot 0.23.413 → 0.23.415

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.413",
+  "version": "0.23.415",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",
@@ -886,6 +886,62 @@
       "types": "./src/register-registry-page-route/resolve-page-data.d.ts",
       "default": "./src/register-registry-page-route/resolve-page-data.ts"
     },
+    "./register-registry-page-route/resolve-request-graph": {
+      "types": "./src/register-registry-page-route/resolve-request-graph.d.ts",
+      "default": "./src/register-registry-page-route/resolve-request-graph.ts"
+    },
+    "./register-registry-page-route/resolve-request-graph.ts": {
+      "types": "./src/register-registry-page-route/resolve-request-graph.d.ts",
+      "default": "./src/register-registry-page-route/resolve-request-graph.ts"
+    },
+    "./register-registry-page-route/resolve-panel-page": {
+      "types": "./src/register-registry-page-route/resolve-panel-page.d.ts",
+      "default": "./src/register-registry-page-route/resolve-panel-page.ts"
+    },
+    "./register-registry-page-route/resolve-panel-page.ts": {
+      "types": "./src/register-registry-page-route/resolve-panel-page.d.ts",
+      "default": "./src/register-registry-page-route/resolve-panel-page.ts"
+    },
+    "./register-registry-page-route/stamp-session-context": {
+      "types": "./src/register-registry-page-route/stamp-session-context.d.ts",
+      "default": "./src/register-registry-page-route/stamp-session-context.ts"
+    },
+    "./register-registry-page-route/stamp-session-context.ts": {
+      "types": "./src/register-registry-page-route/stamp-session-context.d.ts",
+      "default": "./src/register-registry-page-route/stamp-session-context.ts"
+    },
+    "./register-registry-page-route/run-content-gates": {
+      "types": "./src/register-registry-page-route/run-content-gates.d.ts",
+      "default": "./src/register-registry-page-route/run-content-gates.ts"
+    },
+    "./register-registry-page-route/run-content-gates.ts": {
+      "types": "./src/register-registry-page-route/run-content-gates.d.ts",
+      "default": "./src/register-registry-page-route/run-content-gates.ts"
+    },
+    "./register-registry-page-route/apply-page-branding": {
+      "types": "./src/register-registry-page-route/apply-page-branding.d.ts",
+      "default": "./src/register-registry-page-route/apply-page-branding.ts"
+    },
+    "./register-registry-page-route/apply-page-branding.ts": {
+      "types": "./src/register-registry-page-route/apply-page-branding.d.ts",
+      "default": "./src/register-registry-page-route/apply-page-branding.ts"
+    },
+    "./register-registry-page-route/warn-uncovered-blocks": {
+      "types": "./src/register-registry-page-route/warn-uncovered-blocks.d.ts",
+      "default": "./src/register-registry-page-route/warn-uncovered-blocks.ts"
+    },
+    "./register-registry-page-route/warn-uncovered-blocks.ts": {
+      "types": "./src/register-registry-page-route/warn-uncovered-blocks.d.ts",
+      "default": "./src/register-registry-page-route/warn-uncovered-blocks.ts"
+    },
+    "./register-registry-page-route/prefetch-org-id": {
+      "types": "./src/register-registry-page-route/prefetch-org-id.d.ts",
+      "default": "./src/register-registry-page-route/prefetch-org-id.ts"
+    },
+    "./register-registry-page-route/prefetch-org-id.ts": {
+      "types": "./src/register-registry-page-route/prefetch-org-id.d.ts",
+      "default": "./src/register-registry-page-route/prefetch-org-id.ts"
+    },
     "./register-static-assets": {
       "types": "./src/register-static-assets.d.ts",
       "default": "./src/register-static-assets.ts"
@@ -1077,6 +1133,54 @@
     "./ws-boot-self-test.ts": {
       "types": "./src/ws-boot-self-test.d.ts",
       "default": "./src/ws-boot-self-test.ts"
+    },
+    "./agreement-gate/settings": {
+      "types": "./src/agreement-gate/settings.d.ts",
+      "default": "./src/agreement-gate/settings.ts"
+    },
+    "./agreement-gate/settings.ts": {
+      "types": "./src/agreement-gate/settings.d.ts",
+      "default": "./src/agreement-gate/settings.ts"
+    },
+    "./agreement-gate/agreement-lookup": {
+      "types": "./src/agreement-gate/agreement-lookup.d.ts",
+      "default": "./src/agreement-gate/agreement-lookup.ts"
+    },
+    "./agreement-gate/agreement-lookup.ts": {
+      "types": "./src/agreement-gate/agreement-lookup.d.ts",
+      "default": "./src/agreement-gate/agreement-lookup.ts"
+    },
+    "./agreement-gate/signing-session": {
+      "types": "./src/agreement-gate/signing-session.d.ts",
+      "default": "./src/agreement-gate/signing-session.ts"
+    },
+    "./agreement-gate/signing-session.ts": {
+      "types": "./src/agreement-gate/signing-session.d.ts",
+      "default": "./src/agreement-gate/signing-session.ts"
+    },
+    "./agreement-gate/placeholder-strip": {
+      "types": "./src/agreement-gate/placeholder-strip.d.ts",
+      "default": "./src/agreement-gate/placeholder-strip.ts"
+    },
+    "./agreement-gate/placeholder-strip.ts": {
+      "types": "./src/agreement-gate/placeholder-strip.d.ts",
+      "default": "./src/agreement-gate/placeholder-strip.ts"
+    },
+    "./agreement-gate/signing-shell": {
+      "types": "./src/agreement-gate/signing-shell.d.ts",
+      "default": "./src/agreement-gate/signing-shell.ts"
+    },
+    "./agreement-gate/signing-shell.ts": {
+      "types": "./src/agreement-gate/signing-shell.d.ts",
+      "default": "./src/agreement-gate/signing-shell.ts"
+    },
+    "./agreement-gate/authorized-emails": {
+      "types": "./src/agreement-gate/authorized-emails.d.ts",
+      "default": "./src/agreement-gate/authorized-emails.ts"
+    },
+    "./agreement-gate/authorized-emails.ts": {
+      "types": "./src/agreement-gate/authorized-emails.d.ts",
+      "default": "./src/agreement-gate/authorized-emails.ts"
     }
   },
   "repository": "https://github.com/teamgbg/service-boot",

package/src/agreement-gate/agreement-lookup.ts

@@ -0,0 +1,127 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Agreement lookups + the gate's resolution caches: the page→agreement
+ * association cache, the owning/party org member-directory caches, and the
+ * event-driven invalidation (LISTEN registry_config_changed) that clears them.
+ *
+ * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
+ * paths adjusted only.
+ */
+
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { queryRows } from "@teamscala/db/query-rows";
+import { createCache } from "@teamscala/cache/create-cache";
+import { createNotifyListener, getDirectDatabaseUrl } from "@teamscala/db/notify-listener/index";
+import { getServerClient } from "../page-server-orpc/server-client.ts";
+
+export async function findFirstAgreement<T>(input: {
+	where: Record<string, unknown>;
+	select: Record<string, boolean>;
+}): Promise<T | null> {
+	const client = getServerClient() as unknown as {
+		agreements: { findFirst: (args: typeof input) => Promise<T | null> };
+	};
+	return client.agreements.findFirst(input);
+}
+
+/**
+ * Cache for the page→agreement association (new-flow pages that have no
+ * pre-placed gate block). The association changes rarely (only when a new
+ * agreement is created or a page is rebound), so a 30s TTL avoids a DB query
+ * per request while staying fresh enough for just-created agreements to appear.
+ * Negative results are cached too (id="") so non-agreement pages never re-query.
+ */
+export const pageAgreementCache = createCache<{ id: string; name: string }>(
+	"agreement-gate:page-association",
+	{ maxSize: 256, ttlMs: 30_000 },
+);
+
+/**
+ * Cache for the owning org's member directory (org id → lowercased email → name),
+ * used to grant VIEW-ONLY access to an agreement to any member of the org that
+ * owns it (signing stays roster-bound). Membership changes on human timescales,
+ * so a 30s TTL keeps the per-request authorize cheap (hot-path-resolutions-are-cached).
+ */
+export const orgMemberCache = createCache<Map<string, string>>(
+	"agreement-gate:org-members",
+	{ maxSize: 256, ttlMs: 30_000 },
+);
+
+/**
+ * The owning org's member directory: lowercased email → display name, for every
+ * member of `organisationId`. Empty when the org is unknown or has no members.
+ *
+ * Resolved via a parameterized raw join over better_auth_member + "user" rather
+ * rather than a service-local Prisma `member` model: `member` is a shared
+ * @@map'd Prisma model, and each
+ * service's per-service client is generated by live DB introspection from only
+ * the tables its service_schema declares — so that model is undefined
+ * on a service (scala-sign, scala-proposals) that doesn't list better_auth_member.
+ * A read-only raw query needs no model declaration and works on every client,
+ * which is what makes org-member VIEW access actually resolve (the typed access
+ * silently crashed → caught → empty directory → org members wrongly challenged).
+ */
+export async function resolveOrgMemberDirectory(
+	organisationId: string | null,
+): Promise<Map<string, string>> {
+	if (!organisationId) return new Map();
+	const cached = orgMemberCache.get(organisationId);
+	if (cached !== undefined) return cached;
+	const directory = new Map<string, string>();
+	try {
+		const rows = await queryRows`
+			SELECT u.email AS email, u.name AS name
+			FROM better_auth_member m
+			JOIN "user" u ON u.id = m.user_id
+			WHERE m.organization_id = ${organisationId}
+		` as
+			Array<{ email: string | null; name: string | null }>
+		;
+		for (const r of rows) {
+			const email = typeof r.email === "string" ? r.email.trim().toLowerCase() : "";
+			if (email) directory.set(email, String(r.name ?? r.email));
+		}
+		orgMemberCache.set(organisationId, directory);
+		return directory;
+	} catch (err) {
+		getAppLogger().error(
+			`[agreement-gate] org-member resolve failed: ${err instanceof Error ? err.message : String(err)}`,
+		);
+		return directory;
+	}
+}
+
+/**
+ * The combined member directory for EVERY org an agreement's parties represent
+ * (each party's `organisationId`) plus the agreement's owning org. Any of these
+ * members may VIEW the agreement; signing stays restricted to the designated
+ * signer (the party email). Usually 1 org (one of our orgs + an external party),
+ * so the loop is over a 1-2 element set, each entry cached.
+ */
+export async function resolveAgreementViewerDirectory(
+	orgIds: Iterable<string | null | undefined>,
+): Promise<Map<string, string>> {
+	const out = new Map<string, string>();
+	const unique = new Set(
+		[...orgIds].filter((id): id is string => typeof id === "string" && id.length > 0),
+	);
+	for (const orgId of unique) {
+		const dir = await resolveOrgMemberDirectory(orgId);
+		for (const [email, name] of dir) if (!out.has(email)) out.set(email, name);
+	}
+	return out;
+}
+
+// Event-driven invalidation via LISTEN on registry_config_changed
+{
+	const _url = getDirectDatabaseUrl();
+	if (_url) {
+		createNotifyListener(_url).listen("registry_config_changed", () => {
+			pageAgreementCache.clear();
+			orgMemberCache.clear();
+		}).catch((e: unknown) => console.error("[cache-invalidation] subscribe failed: " + e));
+	}
+}

package/src/agreement-gate/authorized-emails.ts

@@ -0,0 +1,85 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The agreement's authorized email sets: the signer roster (who may sign) and
+ * the roster ∪ owning/party-org members (who may view past the gate).
+ *
+ * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
+ * paths adjusted only.
+ */
+
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { parseAgreementParties } from "@teamscala/document-signing/agreement-parties";
+import { findFirstAgreement, resolveAgreementViewerDirectory } from "./agreement-lookup.ts";
+
+/** The agreement's authorized email set (its signer roster) for the access endpoint. */
+export async function resolveAgreementSignerEmails(
+	agreementId: string,
+): Promise<Set<string>> {
+	const emails = new Set<string>();
+	try {
+		const agreement = await findFirstAgreement<{
+			signer_email: string | null;
+			signature_data: unknown;
+		}>({
+			where: { id: agreementId },
+			select: { signer_email: true, signature_data: true },
+		});
+		if (!agreement) return emails;
+		const parties = parseAgreementParties(agreement.signature_data);
+		if (parties) {
+			for (const p of parties) {
+				if (p.email) emails.add(p.email.trim().toLowerCase());
+			}
+		}
+		if (agreement.signer_email) {
+			emails.add(String(agreement.signer_email).trim().toLowerCase());
+		}
+		return emails;
+	} catch (err) {
+		getAppLogger().error(
+			`[agreement-gate] signer-email resolve failed: ${err instanceof Error ? err.message : String(err)}`,
+		);
+		return emails;
+	}
+}
+
+/**
+ * Every email allowed PAST the gate: the signer roster (who may sign) UNION every
+ * member of the owning org (who may VIEW). Signing authority stays roster-only —
+ * buildSigningSession gives a non-party org member a view-only session. This is
+ * what the access endpoint and session-authorize check.
+ */
+export async function resolveAgreementAuthorizedEmails(
+	agreementId: string,
+): Promise<Set<string>> {
+	const emails = await resolveAgreementSignerEmails(agreementId);
+	try {
+		const agreement = await findFirstAgreement<{
+			organisation_id: string | null;
+			signature_data: unknown;
+		}>({
+			where: { id: agreementId },
+			select: { organisation_id: true, signature_data: true },
+		});
+		// View-orgs = each party's organisationId (self-describing model) ∪ the
+		// agreement's owning org (also included for agreements that predate
+		// per-party org). Members of any of these may view; signing stays designated-signer-only.
+		const orgIds = new Set<string | null | undefined>();
+		if (typeof agreement?.organisation_id === "string") {
+			orgIds.add(agreement.organisation_id);
+		}
+		for (const p of parseAgreementParties(agreement?.signature_data) ?? []) {
+			if (p.organisationId) orgIds.add(p.organisationId);
+		}
+		const directory = await resolveAgreementViewerDirectory(orgIds);
+		for (const email of directory.keys()) emails.add(email);
+	} catch (err) {
+		getAppLogger().error(
+			`[agreement-gate] authorized-emails resolve failed: ${err instanceof Error ? err.message : String(err)}`,
+		);
+	}
+	return emails;
+}

package/src/agreement-gate/placeholder-strip.ts

@@ -0,0 +1,42 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The withholding transform: drop blocks whose own text still carries an
+ * {{agreement.*}} token, recursively, so unauthed viewers never see raw
+ * placeholders.
+ *
+ * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
+ * paths adjusted only.
+ */
+
+import type { ContentBlock } from "./signing-session.ts";
+
+/** True if any of the block's OWN string props carries an {{agreement.*}} token. */
+function blockHasAgreementPlaceholder(block: ContentBlock): boolean {
+	const props = block.props;
+	if (!props) return false;
+	for (const propVal of Object.values(props)) {
+		if (typeof propVal === "string" && /\{\{\s*agreement\./.test(propVal)) return true;
+	}
+	return false;
+}
+
+/** Drop blocks whose own text still holds an {{agreement.*}} token, recursively. */
+export function stripAgreementPlaceholderBlocks(content: ContentBlock[]): ContentBlock[] {
+	const out: ContentBlock[] = [];
+	for (const block of content) {
+		if (blockHasAgreementPlaceholder(block)) continue;
+		const props = block.props;
+		if (props) {
+			for (const [k, propVal] of Object.entries(props)) {
+				if (Array.isArray(propVal)) {
+					props[k] = stripAgreementPlaceholderBlocks(propVal as ContentBlock[]);
+				}
+			}
+		}
+		out.push(block);
+	}
+	return out;
+}

package/src/agreement-gate/settings.ts

@@ -0,0 +1,59 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * DB-driven display + behaviour settings for the AGREEMENT content gate
+ * (config/content-gate-agreement), plus its cookie name.
+ *
+ * Split out of agreement-gate.ts (909 lines) — byte-for-byte move; import
+ * paths adjusted only.
+ */
+
+import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import * as v from "valibot";
+
+export const AG_COOKIE = "ag_token";
+
+/**
+ * Agreement gate display + behaviour, DB-driven (config/content-gate-agreement),
+ * never hardcoded — mirrors proposal-gate's loadProposalGateSettings. requireOtp
+ * is the per-gate OTP switch (agreements default ON: a signer verifies identity
+ * before signing). title is the fallback used when no agreement name resolves. A
+ * missing/invalid row falls back to these defaults so the gate UI ALWAYS renders.
+ */
+export interface AgreementGateSettings {
+	title: string;
+	subtitle: string;
+	submitLabel: string;
+	requireOtp: boolean;
+}
+
+export const AGREEMENT_GATE_DEFAULTS: AgreementGateSettings = {
+	title: "Private document",
+	subtitle: "Verify your email to view and sign this document.",
+	submitLabel: "Access document",
+	requireOtp: true,
+};
+
+const AgreementGateSettingsSchema = v.object({
+	title: v.optional(v.string(), AGREEMENT_GATE_DEFAULTS.title),
+	subtitle: v.optional(v.string(), AGREEMENT_GATE_DEFAULTS.subtitle),
+	submitLabel: v.optional(v.string(), AGREEMENT_GATE_DEFAULTS.submitLabel),
+	requireOtp: v.optional(v.boolean(), AGREEMENT_GATE_DEFAULTS.requireOtp),
+});
+
+/** Gate copy/behaviour, or null when the config row is absent/broken. Null is
+ *  the absent signal — callers default explicitly so a missing row neither 500s
+ *  the page nor masks as a populated value (protective-layers-fail-explicitly). */
+export async function loadAgreementGateSettings(): Promise<AgreementGateSettings | null> {
+	try {
+		return await loadRegistryConfig(
+			"config",
+			"content-gate-agreement",
+			AgreementGateSettingsSchema,
+		);
+	} catch {
+		return null;
+	}
+}