@tomato414941/foundation 0.22.0 → 0.24.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomato414941/foundation",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "Foundation CLI: give this machine a WebAuthn credential, and hand what is kept to a command without it passing through the agent.",
   "type": "module",
   "engines": {

package/runtime.mjs

@@ -256,10 +256,6 @@ async function main() {
   if (action === 'token') { console.log(token); return; }
   // One request, as this machine, and the answer printed as it came. Nothing here knows the endpoints.
   if (action === 'api') {
-    if (!publicSpec && !/[?&]as=/.test(call.target)) {
-      const me = await send('/v1/principals/me', undefined, { method: 'GET', accept: () => true });
-      if (me.acts_for?.length === 1) call.target += (call.target.includes('?') ? '&' : '?') + 'as=' + encodeURIComponent(me.acts_for[0]);
-    }
     const response = await fetch(url.origin + call.target, { method: call.method, headers: { ...(token ? { authorization: 'Bearer ' + token } : {}), ...(call.body === undefined ? {} : { 'content-type': call.type }) },
       ...(call.body === undefined ? {} : { body: call.body }), redirect: 'error', signal: AbortSignal.timeout(30_000) });
     const bytes = Buffer.from(await response.arrayBuffer());
@@ -304,11 +300,20 @@ async function main() {
     console.log(JSON.stringify(answer, null, 2));
     return;
   }
+  // What others hold and this machine has a line onto: the things at the far end of the lines it is at the near end of.
+  const shownToMe = async () => {
+    const things = [];
+    for (let after = null; ;) {
+      const page = await send('/v1/principals/me/relations?direction=from&limit=200' + (after ? '&after=' + encodeURIComponent(after) : ''), undefined, { method: 'GET', accept: () => true });
+      things.push(...(page.relations ?? []).filter(line => line.resource).map(line => line.resource));
+      if (!(after = page.next)) return things;
+    }
+  };
   // Reading a secret this machine was handed an envelope for: its own, or one shown to it along a line.
   if (action === 'read') {
     if (!key.own) throw new Error('This machine has no key of its own here, so nothing sealed for it can be opened.');
-    const own = await send('/v1/resources?kind=secret&name=' + encodeURIComponent(call.name), undefined, { method: 'GET', accept: () => true });
-    const resource = own.resource ?? (await send('/v1/resources?shown=me', undefined, { method: 'GET' })).resources.find(item => item.kind === 'secret' && item.name === call.name);
+    const own = await send('/v1/principals/me/resources?kind=secret&name=' + encodeURIComponent(call.name), undefined, { method: 'GET', accept: () => true });
+    const resource = own.resource ?? (await shownToMe()).find(item => item.kind === 'secret' && item.name === call.name);
     if (!resource) throw new Error('No secret named ' + JSON.stringify(call.name) + ' is kept by this machine or shown to it.');
     const kept = await send('/v1/resources/' + resource.id + '/content', undefined, { method: 'GET' });
     if (!kept.envelope) throw new Error('No envelope was made for this machine: it may read about this secret, but was not handed its key.');
@@ -327,17 +332,17 @@ async function main() {
   const acting = current.acts_for ?? [];
   const owner = process.env.FOUNDATION_AS || (acting.length === 1 ? acting[0] : null);
   if (!owner && acting.length > 1) throw new Error('This key acts for several principals. Set FOUNDATION_AS=<principal id> to say which one this run is for.');
-  const forHolder = target => owner ? target + (target.includes('?') ? '&' : '?') + 'as=' + encodeURIComponent(owner) : target;
+  const holder = '/v1/principals/' + encodeURIComponent(owner || 'me');
   // A secret is sealed here, with a key of its own, for each of the owner's recipients: the server keeps what it
   // cannot open. This machine is not among them; it places the bytes and does not read them back.
   const sealedFor = async bytes => {
-    const { recipients } = await send('/v1/principals/' + encodeURIComponent(owner || 'me') + '/recipients', undefined, { method: 'GET' });
+    const { recipients } = await send(holder + '/recipients', undefined, { method: 'GET' });
     if (!Array.isArray(recipients) || !recipients.length) throw new Error('Nobody can open a secret kept for this owner yet: the owner needs a key, or Foundation needs to act for them.');
     const contentKey = newContentKey();
     return { content: sealContent(contentKey, bytes).toString('base64url'), envelopes: Object.fromEntries(recipients.map(item => [item.principal_id, seal(contentKey, Buffer.from(item.public_key, 'base64url')).toString('base64url')])) };
   };
   if (action === 'keep') {
-    const saved = await send(forHolder('/v1/resources?kind=secret&name=' + encodeURIComponent(call.name)), await sealedFor(call.body), { method: 'PUT' });
+    const saved = await send(holder + '/resources?kind=secret&name=' + encodeURIComponent(call.name), await sealedFor(call.body), { method: 'PUT' });
     try { await send('/v1/principals/me/relations', { relation: 'editor', object_type: 'resource', object_id: saved.resource.id }, { method: 'DELETE' }); } catch {}
     console.log(JSON.stringify(saved));
     return;
@@ -348,13 +353,13 @@ async function main() {
   const handed = { environment: {}, files: [] };
   let asked = names;
   if (key.own && names.some(item => typeof item.name === 'string')) {
-    const shown = owner ? (await send('/v1/resources?shown=me', undefined, { method: 'GET', accept: () => true })).resources ?? [] : [];
+    const shown = owner ? await shownToMe() : [];
     asked = [];
     for (const item of names) {
       let resource = null;
       if (typeof item.name === 'string') {
         resource = owner ? shown.find(row => row.kind === 'secret' && row.name === item.name && row.owner_id === owner)
-          : (await send('/v1/resources?kind=secret&name=' + encodeURIComponent(item.name), undefined, { method: 'GET', accept: () => true })).resource;
+          : (await send('/v1/principals/me/resources?kind=secret&name=' + encodeURIComponent(item.name), undefined, { method: 'GET', accept: () => true })).resource;
       }
       const kept = resource ? await send('/v1/resources/' + resource.id + '/content', undefined, { method: 'GET', accept: () => true }) : null;
       if (!kept?.envelope) { asked.push(item); continue; }
@@ -364,7 +369,7 @@ async function main() {
     }
   }
   let injection;
-  if (asked.length) ({ injection } = await send(forHolder('/v1/injections'), { names: asked }));
+  if (asked.length) ({ injection } = await send(holder + '/injections', { names: asked }));
   else injection = { environment: {}, files: [] };
   if (!injection || typeof injection.environment !== 'object' || !Array.isArray(injection.files)) throw new Error('Foundation returned an invalid injection.');
   injection = { environment: { ...injection.environment, ...handed.environment }, files: [...injection.files, ...handed.files] };
@@ -434,7 +439,7 @@ async function main() {
       retainOutput = true;
       // The command wrote it; the agent never saw it, and keeps it that way: the line drawn for the one who kept it is declined.
       let saved;
-      try { saved = await send(forHolder('/v1/resources?kind=secret&name=' + encodeURIComponent(output.name)), await sealedFor(bytes), { method: 'PUT' }); }
+      try { saved = await send(holder + '/resources?kind=secret&name=' + encodeURIComponent(output.name), await sealedFor(bytes), { method: 'PUT' }); }
       catch { throw new Error(recovery()); }
       try { await send('/v1/principals/me/relations', { relation: 'editor', object_type: 'resource', object_id: saved.resource.id }, { method: 'DELETE' }); } catch {}
       retainOutput = false;