@tpsdev-ai/flair 0.10.1 → 0.12.0

package/dist/resources/Memory.js

@@ -1,6 +1,6 @@
 import { databases } from "@harperfast/harper";
 import { patchRecord, withDetachedTxn } from "./table-helpers.js";
-import { isAdmin } from "./auth-middleware.js";
+import { isAdmin, resolveAgentAuth } from "./agent-auth.js";
 import { getEmbedding, getModelId } from "./embeddings-provider.js";
 import { scanFields, isStrictMode } from "./content-safety.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
@@ -16,16 +16,22 @@ export class Memory extends databases.flair.Memory {
      * Non-admin calls also check MemoryGrant to include granted memories.
      */
     async search(query) {
-        // Access request context via Harper's Resource instance context
+        // Access request context via Harper's Resource instance context.
         const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        // No auth context (internal admin call) or admin agent — unfiltered
-        if (!authAgent || isAdminAgent) {
+        const auth = await resolveAgentAuth(ctx);
+        // Anonymous HTTP must NOT read memories. (Previously `!authAgent` was treated
+        // as unfiltered — the anonymous-read leak once the gate stops rejecting.)
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), {
+                status: 401, headers: { "content-type": "application/json" },
+            });
+        }
+        // Trusted internal call (no request context) or admin agent — unfiltered.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.search(query);
         }
-        // Collect agentIds this agent may read: own + any granted owners
+        // Non-admin agent: scope to own + granted owners.
+        const authAgent = auth.agentId;
         const allowedOwners = [authAgent];
         try {
             for await (const grant of databases.flair.MemoryGrant.search({
@@ -68,6 +74,26 @@ export class Memory extends databases.flair.Memory {
             if (!rl.allowed)
                 return rateLimitResponse(rl.retryAfterMs, "write");
         }
+        // Create ownership: a non-admin agent may only write memories it owns. Use
+        // resolveAgentAuth (reads the gate's tpsAgent annotation) — NOT context.user
+        // .username, which is the fallback "admin" super_user while de-elevation is
+        // dormant and would wrongly 403 every agent's own write. internal/admin → pass.
+        {
+            const auth = await resolveAgentAuth(ctx);
+            // Anonymous HTTP must NOT write. Pre-flip the global gate rejected no-auth
+            // upstream; with the non-rejecting gate, each write path self-enforces (same
+            // rule search() applies to reads).
+            if (auth.kind === "anonymous") {
+                return new Response(JSON.stringify({ error: "authentication required" }), {
+                    status: 401, headers: { "Content-Type": "application/json" },
+                });
+            }
+            if (auth.kind === "agent" && !auth.isAdmin && content?.agentId && content.agentId !== auth.agentId) {
+                return new Response(JSON.stringify({ error: "forbidden: cannot write memory owned by another agent" }), {
+                    status: 403, headers: { "Content-Type": "application/json" },
+                });
+            }
+        }
         content.durability ||= "standard";
         content.createdAt = new Date().toISOString();
         content.updatedAt = content.createdAt;
@@ -151,6 +177,25 @@ export class Memory extends databases.flair.Memory {
             delete content._reindex;
             return super.put(content);
         }
+        // Create/update ownership (same rule as post): a non-admin agent may only
+        // write memories it owns, via resolveAgentAuth (gate annotation), not
+        // context.user.username (the dormant-de-elevation fallback is "admin").
+        // The _reindex admin path above bypasses this.
+        {
+            const octx = this.getContext?.();
+            const auth = await resolveAgentAuth(octx);
+            // Anonymous HTTP must NOT write (non-rejecting gate → self-enforce here).
+            if (auth.kind === "anonymous") {
+                return new Response(JSON.stringify({ error: "authentication required" }), {
+                    status: 401, headers: { "Content-Type": "application/json" },
+                });
+            }
+            if (auth.kind === "agent" && !auth.isAdmin && content?.agentId && content.agentId !== auth.agentId) {
+                return new Response(JSON.stringify({ error: "forbidden: cannot write memory owned by another agent" }), {
+                    status: 403, headers: { "Content-Type": "application/json" },
+                });
+            }
+        }
         const now = new Date().toISOString();
         content.updatedAt = now;
         // Set defaults that post() sets — put() is also used for new records via CLI

package/dist/resources/MemoryBootstrap.js

@@ -1,4 +1,5 @@
 import { Resource, databases } from "@harperfast/harper";
+import { allowVerified } from "./agent-auth.js";
 import { getEmbedding } from "./embeddings-provider.js";
 import { wrapUntrusted } from "./content-safety.js";
 /**
@@ -40,6 +41,13 @@ function formatMemory(m, supersedes) {
     return base;
 }
 export class BootstrapMemories extends Resource {
+    // Self-authorize via the Ed25519 agent verify (the auth reshape removes the
+    // gate's admin super_user elevation, so custom resources must self-gate or
+    // Harper denies them for the least-privilege flair_agent role). Any verified
+    // agent may bootstrap; per-agent scoping is enforced in post() below.
+    async allowCreate() {
+        return allowVerified(this.getContext?.());
+    }
     async post(data, _context) {
         const { agentId: bodyAgentId, currentTask, maxTokens = 4000, includeSoul = true, since, channel, // e.g., "discord", "tps-mail", "claude-code"
         surface, // e.g., "tps-build", "tps-review", "cli-session"

package/dist/resources/MemoryConsolidate.js

@@ -16,7 +16,7 @@
  *   prompt      string
  */
 import { Resource, databases } from "@harperfast/harper";
-import { isAdmin } from "./auth-middleware.js";
+import { isAdmin, allowVerified } from "./agent-auth.js";
 function parseDuration(s) {
     const m = s.match(/^(\d+)([dhm])$/);
     if (!m)
@@ -56,6 +56,12 @@ function evaluate(record, now, olderThanMs) {
     return { memory, suggestion: "keep", reason: `Retrieved ${count} times, ${Math.round(daysSinceRetrieved)} days since last retrieval` };
 }
 export class ConsolidateMemories extends Resource {
+    // Self-authorize via the Ed25519 agent verify (auth reshape removes the gate's
+    // admin elevation). Any verified agent may consolidate; the isAdmin checks in
+    // post() handle finer-grained authorization.
+    async allowCreate() {
+        return allowVerified(this.getContext?.());
+    }
     async post(data) {
         const { agentId: bodyAgentId, scope = "persistent", olderThan = "30d", limit = 20 } = data || {};
         // See SemanticSearch / MemoryBootstrap — `this.request` isn't populated on

package/dist/resources/MemoryFeed.js

@@ -1,6 +1,14 @@
 import { Resource, databases } from "@harperfast/harper";
+import { allowVerified } from "./agent-auth.js";
 import { computeContentHash, findExistingMemoryByContentHash } from "./memory-feed-lib.js";
 export class FeedMemories extends Resource {
+    // Self-authorize via the Ed25519 agent verify (the auth reshape removes the
+    // gate's admin elevation). NOTE: post() trusts content.agentId from the body —
+    // closing that create-spoofing gap is tracked with the table-resource
+    // create-ownership work (Memory.allowCreate), not in this auth-coverage pass.
+    async allowCreate() {
+        return allowVerified(this.getContext?.());
+    }
     async post(content) {
         const agentId = String(content?.agentId ?? "");
         const body = String(content?.content ?? "");

package/dist/resources/MemoryGrant.js

@@ -0,0 +1,79 @@
+import { databases } from "@harperfast/harper";
+import { resolveAgentAuth } from "./agent-auth.js";
+const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
+const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+/**
+ * MemoryGrant — an agent (ownerId) grants another (granteeId) scoped access to its
+ * memories. Self-authorizes now that the global gate is non-rejecting (previously a
+ * pure @table protected only by the gate → anonymous could read/write any grant).
+ *
+ * Write: non-admin agents may only create/modify/delete grants they OWN
+ *        (ownerId === self) — you can only share your own memories.
+ * Read:  non-admin agents see grants where they are owner OR grantee.
+ * Internal calls (e.g. Memory.search's grant lookup) and admins pass unfiltered.
+ */
+export class MemoryGrant extends databases.flair.MemoryGrant {
+    _auth() {
+        return resolveAgentAuth(this.getContext?.());
+    }
+    async search(query) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.search(query);
+        }
+        // owner OR grantee
+        const scope = {
+            operator: "or",
+            conditions: [
+                { attribute: "ownerId", comparator: "equals", value: auth.agentId },
+                { attribute: "granteeId", comparator: "equals", value: auth.agentId },
+            ],
+        };
+        if (query && typeof query === "object" && !Array.isArray(query)) {
+            const existing = query.conditions ?? [];
+            query.conditions = Array.isArray(existing) ? [scope, ...existing] : [scope, existing];
+            return super.search(query);
+        }
+        const conditions = Array.isArray(query) && query.length > 0 ? [scope, ...query] : [scope];
+        return super.search(conditions);
+    }
+    async post(content, context) {
+        const denied = await this._enforceOwnerWrite(content);
+        if (denied)
+            return denied;
+        content.createdAt ||= new Date().toISOString();
+        return super.post(content, context);
+    }
+    async put(content, context) {
+        const denied = await this._enforceOwnerWrite(content);
+        if (denied)
+            return denied;
+        return super.put(content, context);
+    }
+    async delete(id, context) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.delete(id, context);
+        }
+        const record = await this.get(id);
+        if (!record)
+            return super.delete(id, context);
+        if (record.ownerId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot delete a grant owned by another agent");
+        }
+        return super.delete(id, context);
+    }
+    async _enforceOwnerWrite(content) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "agent" && !auth.isAdmin && content?.ownerId && content.ownerId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot grant access to another agent's memories");
+        }
+        return null;
+    }
+}

package/dist/resources/MemoryMaintenance.js

@@ -17,7 +17,7 @@
  * to gate auth correctly.
  */
 import { Resource, databases } from "@harperfast/harper";
-import { isAdmin } from "./auth-middleware.js";
+import { isAdmin } from "./agent-auth.js";
 export class MemoryMaintenance extends Resource {
     /** POST requires auth — either an agent acting on its own memories, or admin. */
     allowCreate() {

package/dist/resources/MemoryReflect.js

@@ -20,7 +20,7 @@
  *   count          number     — number of memories included
  */
 import { Resource, databases } from "@harperfast/harper";
-import { isAdmin } from "./auth-middleware.js";
+import { isAdmin, allowVerified } from "./agent-auth.js";
 import { patchRecordSilent } from "./table-helpers.js";
 const FOCUS_PROMPTS = {
     lessons_learned: "Review these memories and identify concrete lessons learned. For each lesson: what happened, what you learned, and how it should change future behavior. Write atomic memories with durability=persistent.",
@@ -29,6 +29,12 @@ const FOCUS_PROMPTS = {
     errors: "Extract errors, bugs, and failures. For each: what failed, root cause, and fix applied. These are high-value persistent memories.",
 };
 export class ReflectMemories extends Resource {
+    // Self-authorize via the Ed25519 agent verify (auth reshape removes the gate's
+    // admin elevation). Any verified agent may reflect; the isAdmin checks in post()
+    // handle finer-grained authorization.
+    async allowCreate() {
+        return allowVerified(this.getContext?.());
+    }
     async post(data) {
         const { agentId: bodyAgentId, scope = "recent", since, maxMemories = 50, focus = "lessons_learned", tag, } = data || {};
         // Authenticated identity comes from getContext().request, not this.request

package/dist/resources/MemoryReindex.js

@@ -24,8 +24,14 @@
  * This endpoint is idempotent: running it again finds zero drift.
  */
 import { Resource, databases } from "@harperfast/harper";
-import { isAdmin } from "./auth-middleware.js";
+import { isAdmin, allowAdmin } from "./agent-auth.js";
 export class MemoryReindex extends Resource {
+    // Admin-only: permit verified ADMIN agents (Basic-admin is super_user and
+    // bypasses allow*); non-admin agents denied. Mirrors the handler's admin gate
+    // but is the real authorization now that the gate no longer elevates agents.
+    async allowCreate() {
+        return allowAdmin(this.getContext?.());
+    }
     async post(data) {
         const ctx = this.getContext?.();
         const request = ctx?.request ?? ctx ?? this.request;

package/dist/resources/OAuthClient.js

@@ -0,0 +1,15 @@
+import { databases } from "@harperfast/harper";
+import { allowAdmin } from "./agent-auth.js";
+/**
+ * OAuthClient holds registered OAuth client records (incl. secrets) — admin/system
+ * only, no agent grant. OAuth endpoints (OAuthRegister/Authorize/Token) read+write
+ * clients via internal calls (allowAdmin permits internal), so the OAuth flows keep
+ * working; direct anonymous table access is denied. Self-authorizes now that the
+ * global gate is non-rejecting.
+ */
+export class OAuthClient extends databases.flair.OAuthClient {
+    allowRead() { return allowAdmin(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
+}

package/dist/resources/ObsAgentSnapshot.js

@@ -0,0 +1,13 @@
+import { databases } from "@harperfast/harper";
+import { allowVerified, allowAdmin } from "./agent-auth.js";
+/**
+ * ObsAgentSnapshot — observatory per-agent snapshot read-model. Writes are
+ * system-driven (internal sync); agents may read. See ObsOffice for the
+ * allowRead=allowVerified security default (flag for Sherlock).
+ */
+export class ObsAgentSnapshot extends databases.flair.ObsAgentSnapshot {
+    allowRead() { return allowVerified(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
+}

package/dist/resources/ObsEventFeed.js

@@ -0,0 +1,13 @@
+import { databases } from "@harperfast/harper";
+import { allowVerified, allowAdmin } from "./agent-auth.js";
+/**
+ * ObsEventFeed — observatory event-feed read-model. Writes are system-driven
+ * (internal sync); agents may read. See ObsOffice for the allowRead=allowVerified
+ * security default (flag for Sherlock).
+ */
+export class ObsEventFeed extends databases.flair.ObsEventFeed {
+    allowRead() { return allowVerified(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
+}

package/dist/resources/ObsOffice.js

@@ -0,0 +1,19 @@
+import { databases } from "@harperfast/harper";
+import { allowVerified, allowAdmin } from "./agent-auth.js";
+/**
+ * ObsOffice — observatory office-layout read-model. Writes are system-driven
+ * (internal sync); agents may read. Self-authorizes now that the global gate is
+ * non-rejecting.
+ *
+ * SECURITY DEFAULT (flag for Sherlock): allowRead is allowVerified (anonymous
+ * denied). The ObservationCenter HTML shell is public but its data API calls
+ * authenticate (admin-pass). If the public Office Space renderer needs anonymous
+ * Obs reads, relax to allowRead=true WITH field-allowlisting (as Presence.get does)
+ * — do NOT expose raw rows publicly.
+ */
+export class ObsOffice extends databases.flair.ObsOffice {
+    allowRead() { return allowVerified(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
+}

package/dist/resources/OrgEvent.js

@@ -1,42 +1,58 @@
 /**
  * OrgEvent.ts — Harper table resource for org-wide activity events.
  *
- * Auth: Ed25519 middleware sets request.tpsAgent.
- * Write: authorId must match authenticated agent (or admin).
- * Read: any authenticated participant can read (org-scoped).
+ * Auth (self-enforced now that the global gate is non-rejecting):
+ *   Read  — any verified agent/admin (org-scoped); anonymous denied.
+ *   Write — authorId must match the authenticated agent (or admin); anonymous denied.
+ *
+ * The previous version read context.request.tpsAgent and treated a MISSING agent
+ * as trusted (`if (agentId && …)` / `if (!agentId) super.delete`), so anonymous
+ * requests slipped through once the gate stopped rejecting. resolveAgentAuth
+ * distinguishes internal/agent/anonymous explicitly.
  */
 import { databases } from "@harperfast/harper";
+import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
+const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
+const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
 export class OrgEvent extends databases.flair.OrgEvent {
-    async post(content, context) {
-        const agentId = context?.request?.tpsAgent;
-        // authorId must match authenticated agent (unless admin)
-        if (agentId && !context?.request?.tpsAgentIsAdmin && content.authorId !== agentId) {
-            return new Response(JSON.stringify({ error: "forbidden: authorId must match authenticated agent" }), { status: 403, headers: { "Content-Type": "application/json" } });
-        }
-        // Generate composite ID if not provided
-        if (!content.id) {
-            content.id = `${content.authorId}-${Date.now()}`;
+    allowRead() { return allowVerified(this.getContext?.()); }
+    _auth() {
+        return resolveAgentAuth(this.getContext?.());
+    }
+    async post(content) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "agent" && !auth.isAdmin && content.authorId !== auth.agentId) {
+            return FORBIDDEN("forbidden: authorId must match authenticated agent");
         }
+        if (!content.id)
+            content.id = `${content.authorId}-${new Date().toISOString()}`;
         content.createdAt = new Date().toISOString();
-        // Harper 5: table resources use put() for create/upsert (post() removed)
+        // Harper 5: table resources use put() for create/upsert (post() removed).
         return databases.flair.OrgEvent.put(content);
     }
-    async put(content, context) {
-        const agentId = context?.request?.tpsAgent;
-        if (agentId && !context?.request?.tpsAgentIsAdmin && content.authorId !== agentId) {
-            return new Response(JSON.stringify({ error: "forbidden: authorId must match authenticated agent" }), { status: 403, headers: { "Content-Type": "application/json" } });
+    async put(content) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "agent" && !auth.isAdmin && content.authorId !== auth.agentId) {
+            return FORBIDDEN("forbidden: authorId must match authenticated agent");
         }
         return databases.flair.OrgEvent.put(content);
     }
     async delete(id, context) {
-        const agentId = context?.request?.tpsAgent;
-        if (!agentId)
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.delete(id, context);
+        }
         const record = await this.get(id);
         if (!record)
             return super.delete(id, context);
-        if (!context?.request?.tpsAgentIsAdmin && record.authorId !== agentId) {
-            return new Response(JSON.stringify({ error: "forbidden: cannot delete events authored by another agent" }), { status: 403, headers: { "Content-Type": "application/json" } });
+        if (record.authorId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot delete events authored by another agent");
         }
         return super.delete(id, context);
     }

package/dist/resources/OrgEventCatchup.js

@@ -10,7 +10,15 @@
  * Limit 50 events max.
  */
 import { Resource, databases } from "@harperfast/harper";
+import { allowVerified } from "./agent-auth.js";
 export class OrgEventCatchup extends Resource {
+    // Self-authorize via the Ed25519 agent verify (auth reshape removes the gate's
+    // admin elevation). Any verified agent may catch up; participant scoping is in
+    // get(). Uses getContext().request — the reliable v5 path (this.request is not
+    // populated on Harper v5 Resources).
+    async allowRead() {
+        return allowVerified(this.getContext?.());
+    }
     // HarperDB calls get(pathInfo, context) where pathInfo is the URL segment after /OrgEventCatchup/
     async get(pathInfo) {
         const request = this.request;

package/dist/resources/OrgEventMaintenance.js

@@ -5,7 +5,14 @@
  * Auth: admin only.
  */
 import { Resource, databases } from "@harperfast/harper";
+import { allowAdmin } from "./agent-auth.js";
 export class OrgEventMaintenance extends Resource {
+    // Admin-only: permit verified ADMIN agents (Basic-admin is super_user and
+    // bypasses allow*); non-admin agents denied. Real authorization now that the
+    // gate no longer elevates agents to admin.
+    async allowCreate() {
+        return allowAdmin(this.getContext?.());
+    }
     async post(_data, context) {
         // Admin-only
         if (!context?.request?.tpsAgentIsAdmin) {

package/dist/resources/PairingToken.js

@@ -0,0 +1,14 @@
+import { databases } from "@harperfast/harper";
+import { allowAdmin } from "./agent-auth.js";
+/**
+ * PairingToken holds one-time federation pairing secrets — admin/system only,
+ * no agent grant. The FederationPair endpoint consumes tokens via internal calls
+ * (allowAdmin permits internal), so dedicated flows keep working; direct anonymous
+ * table access is denied. Self-authorizes now that the global gate is non-rejecting.
+ */
+export class PairingToken extends databases.flair.PairingToken {
+    allowRead() { return allowAdmin(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
+}

package/dist/resources/Peer.js

@@ -0,0 +1,15 @@
+import { databases } from "@harperfast/harper";
+import { allowAdmin } from "./agent-auth.js";
+/**
+ * Peer holds federation peer records (URLs + credentials) — system/admin data,
+ * no agent grant. Before the auth flip the global gate was its only protection;
+ * the non-rejecting gate means it must self-authorize. Admin/internal only on
+ * every path. (Federation pairing/sync use dedicated endpoints — FederationPair,
+ * FederationSync — not direct Peer table access.)
+ */
+export class Peer extends databases.flair.Peer {
+    allowRead() { return allowAdmin(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
+}