@tpsdev-ai/flair 0.17.0 → 0.19.0

package/dist/resources/Admin.js

@@ -1,12 +1,24 @@
 import { Resource } from "@harperfast/harper";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /Admin — friendly redirect to /AdminDashboard.
  *
  * Operators bookmark or type the bare /Admin path. Without this resource
  * they hit a 404 and assume the admin UI is broken. The dashboard is the
  * canonical landing surface; redirect there.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): the /Admin* pathname
+ * gate in auth-middleware.ts only 401s when there's NO Authorization header
+ * at all (or Basic creds don't resolve to a real user) — a validly-verified
+ * TPS-Ed25519 agent that is NOT an admin, or a valid-but-non-super_user Basic
+ * user, currently sails through the middleware with no admin resource-level
+ * check at all. allowRead closes that gap the same way WorkspaceLatest.ts /
+ * MemoryReindex.ts already gate their own custom (non-@table) Resources.
  */
 export class Admin extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         return new Response("", {
             status: 302,

package/dist/resources/AdminConnectors.js

@@ -1,9 +1,15 @@
 import { Resource, databases } from "@harperfast/harper";
 import { layout, htmlResponse, esc } from "./admin-layout.js";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminConnectors — OAuth clients and active sessions.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
  */
 export class AdminConnectors extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         const clients = [];
         try {

package/dist/resources/AdminDashboard.js

@@ -1,9 +1,18 @@
 import { Resource, databases } from "@harperfast/harper";
 import { layout, htmlResponse } from "./admin-layout.js";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminDashboard — admin home page with system overview.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts for why
+ * this closes a real gap, not just belt-and-suspenders — a verified
+ * non-admin agent could otherwise read full instance stats (principal/agent/
+ * memory/relationship counts) with no admin check at all.
  */
 export class AdminDashboard extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         let principalCount = 0;
         let memoryCount = 0;

package/dist/resources/AdminIdp.js

@@ -1,9 +1,15 @@
 import { Resource, databases } from "@harperfast/harper";
 import { layout, htmlResponse, esc } from "./admin-layout.js";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminIdp — enterprise IdP configuration management.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
  */
 export class AdminIdp extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         const idps = [];
         try {

package/dist/resources/AdminInstance.js

@@ -4,6 +4,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * Resolve the public URL operators reach this Flair on.
  *
@@ -83,8 +84,13 @@ function resolveVersion() {
 }
 /**
  * GET /AdminInstance — instance info, public key, version.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
  */
 export class AdminInstance extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         const version = resolveVersion();
         // Pass the request through so URL resolution can derive from

package/dist/resources/AdminMemory.js

@@ -1,5 +1,6 @@
 import { Resource, databases } from "@harperfast/harper";
 import { layout, htmlResponse, esc } from "./admin-layout.js";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminMemory                browse + search memories (list view)
  * GET /AdminMemory?id=<id>        per-memory detail view with full provenance pane
@@ -19,8 +20,15 @@ import { layout, htmlResponse, esc } from "./admin-layout.js";
  * "memory that follows the agent across orchestrators" — the provenance pane
  * makes that legible: every memory shows where it came from, what it derived
  * from, what it superseded, and which peer it synced from.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts — this
+ * page surfaces full memory content across ALL agents, so the gap it closes
+ * matters more here than on the other Admin* pages.
  */
 export class AdminMemory extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         // Harper v5 does not populate this.request on Resource subclasses —
         // getContext() is the only reliable path (ops-sal4: the previous

package/dist/resources/AdminPrincipals.js

@@ -1,9 +1,15 @@
 import { Resource, databases } from "@harperfast/harper";
 import { layout, htmlResponse, esc } from "./admin-layout.js";
+import { allowAdmin } from "./agent-auth.js";
 /**
  * GET /AdminPrincipals — list all principals with kind, trust, status.
+ *
+ * allowRead()=allowAdmin (ops-oox7 defense-in-depth): see Admin.ts.
  */
 export class AdminPrincipals extends Resource {
+    async allowRead() {
+        return allowAdmin(this.getContext?.());
+    }
     async get() {
         const principals = [];
         try {

package/dist/resources/Integration.js

@@ -1,7 +1,8 @@
 import { databases } from "@harperfast/harper";
-import { resolveAgentAuth } from "./agent-auth.js";
+import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
 const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+const NOT_FOUND = () => new Response(JSON.stringify({ error: "not found" }), { status: 404, headers: { "Content-Type": "application/json" } });
 /**
  * Integration records are agent-owned. Auth: the non-rejecting gate annotates the
  * request; this resource self-enforces (resolveAgentAuth → internal/agent/anonymous).
@@ -12,6 +13,50 @@ export class Integration extends databases.flair.Integration {
     _auth() {
         return resolveAgentAuth(this.getContext?.());
     }
+    /**
+     * Self-authorize now that the global gate is non-rejecting (memory-soul-
+     * read-gate family fix, ops-oox7 — same pattern as Memory.ts/Soul.ts/
+     * WorkspaceState.ts/Relationship.ts). Closes the same P0 leak: Harper
+     * routes `GET /Integration/<id>` to get() and the collection describe
+     * (`GET /Integration`) outside search(), so neither was gated before this
+     * fix — an anonymous caller got a 200 with full record content. Per-record
+     * ownership scoping happens in get() below; the collection scope is still
+     * in search().
+     */
+    allowRead() { return allowVerified(this.getContext?.()); }
+    /**
+     * Override get() to scope by-id reads the same way search() scopes
+     * collection reads (memory-soul-read-gate family fix). Never distinguishes
+     * "doesn't exist" from "exists but not yours" — both return 404, never
+     * 403, so a denied caller can't use get() to enumerate other agents'
+     * integration ids.
+     */
+    async get(target) {
+        // Collection / query reads arrive as a RequestTarget with
+        // `isCollection === true`, and are governed by search() (same owner
+        // scoping). Only a genuine by-id get is ownership-checked below — see
+        // Memory.ts's get() for the full rationale (same bug class).
+        if (!target || (typeof target === "object" && target.isCollection)) {
+            return this.search(target);
+        }
+        const auth = await this._auth();
+        // Anonymous by-id read is already blocked at the allowRead() gate (403);
+        // this is defense-in-depth if get() is ever reached directly.
+        if (auth.kind === "anonymous") {
+            return NOT_FOUND();
+        }
+        // Trusted internal call or admin agent — unfiltered, unchanged behavior.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.get(target);
+        }
+        // Non-admin agent: only its own integrations.
+        const record = await super.get(target);
+        if (!record)
+            return NOT_FOUND();
+        if (record.agentId !== auth.agentId)
+            return NOT_FOUND();
+        return record;
+    }
     async search(query) {
         const auth = await this._auth();
         if (auth.kind === "anonymous")
@@ -66,7 +111,12 @@ export class Integration extends databases.flair.Integration {
         if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.delete(id);
         }
-        const record = await this.get(id);
+        // Use super.get(id), NOT this.get(id): the new get() override above 404s
+        // (a truthy Response) for a non-owner id, which would otherwise defeat
+        // the `if (!record)` check below and mis-route a genuinely-missing
+        // record into the FORBIDDEN branch instead of a clean super.delete(id)
+        // no-op. Mirrors Memory.ts's delete() — same rationale, same fix.
+        const record = await super.get(id);
         if (!record)
             return super.delete(id);
         if (record.agentId !== auth.agentId) {