@unoverse-platform/studio 0.1.90 → 0.1.92

package/vendor/base/src/registry.ts

@@ -0,0 +1,95 @@
+/**
+ * Node Registry - In-memory storage for loaded node definitions
+ */
+
+import type { NodeDefinition } from "./types.js";
+import { boot } from "./boot.js";
+
+// In-memory node registry (loaded from packages)
+const nodeRegistry: Map<string, NodeDefinition> = new Map();
+
+// In-memory credential type registry (loaded from packages)
+const credentialRegistry: Map<string, any> = new Map();
+
+// Track which plugins are loaded and their node types
+const pluginNodeMap: Map<string, string[]> = new Map();
+
+export function getNodeRegistry(): Map<string, NodeDefinition> {
+  return nodeRegistry;
+}
+
+export function getPluginNodeMap(): Map<string, string[]> {
+  return pluginNodeMap;
+}
+
+export function getNode(nodeType: string): NodeDefinition | undefined {
+  return nodeRegistry.get(nodeType);
+}
+
+export function setNode(nodeType: string, definition: NodeDefinition): void {
+  nodeRegistry.set(nodeType, definition);
+}
+
+export function deleteNode(nodeType: string): boolean {
+  return nodeRegistry.delete(nodeType);
+}
+
+export function clearRegistry(): void {
+  nodeRegistry.clear();
+  pluginNodeMap.clear();
+}
+
+export function getNodeCount(): number {
+  return nodeRegistry.size;
+}
+
+export function getPluginCount(): number {
+  return pluginNodeMap.size;
+}
+
+export function getAllNodes(): NodeDefinition[] {
+  return Array.from(nodeRegistry.values());
+}
+
+export function getAllNodeTypes(): string[] {
+  return Array.from(nodeRegistry.keys());
+}
+
+// Credential registry functions
+export function getCredentialRegistry(): Map<string, any> {
+  return credentialRegistry;
+}
+
+export function registerCredentialType(credentialType: any): void {
+  if (credentialRegistry.has(credentialType.name)) {
+    // Shared on purpose (several AWS packages declare awsCredential), so first-wins is
+    // the design and not an incident. Counted, not announced.
+    boot.credential(credentialType.name, true);
+    return;
+  }
+  credentialRegistry.set(credentialType.name, credentialType);
+  boot.credential(credentialType.name);
+}
+
+export function getAllCredentialTypes(): any[] {
+  return Array.from(credentialRegistry.values());
+}
+
+/**
+ * Replace a credential type outright, for owners that can be RELOADED.
+ *
+ * registerCredentialType is deliberately first-wins-and-skip, which is right for code
+ * plugins: they load once and a duplicate is a mistake. A declarative manifest is
+ * different — it can be installed, updated and removed while the process runs, and a
+ * package that adds a field to its credential must be able to land that change. With
+ * only the skipping path, the old shape would win forever and the new field would
+ * never appear in the UI or reach decryption.
+ */
+export function replaceCredentialType(credentialType: any): void {
+  credentialRegistry.set(credentialType.name, credentialType);
+}
+
+/** Retract a credential type. Returns false if it was not registered. */
+export function unregisterCredentialType(name: string): boolean {
+  return credentialRegistry.delete(name);
+}

package/vendor/base/src/security/permissions.ts

@@ -0,0 +1,93 @@
+/**
+ * THE VOCABULARY. Every question this platform's code is allowed to ask about a caller.
+ *
+ * Permissions are named after the CAPABILITY, never the person, and that is the whole
+ * discipline: a gate asks "may you manage credentials", not "are you an admin". The two
+ * read the same today, with two roles, and they diverge the first time somebody needs one
+ * capability without the whole role. Then the question the code asks is still right and
+ * only the grant table below moves.
+ *
+ * SHARED BY EVERY SERVICE. This lives in `base` rather than in one server because the
+ * unoverse server and apps/memory must not be able to disagree about what `admin` means.
+ * They did: memory derived its own `isAdmin` from the role string while the unoverse server
+ * had no role check at all, so "who is an administrator" had two answers and one of them was
+ * "nobody". One map, imported twice.
+ *
+ * ROLES ARE THE TOKEN'S SHAPE; PERMISSIONS ARE THE CODE'S SHAPE. Auth0 issues this
+ * platform `roles: ["admin"]` / `["author"]`, and the tokens carry no permissions claim we
+ * can rely on. So `ROLE_GRANTS` is the bridge, and it is deliberately the ONLY place the
+ * two vocabularies meet: one map, read once, so switching to real permission claims later
+ * is an edit here rather than a hunt through routes.
+ */
+
+/** Every capability. Adding one here is how a new kind of access gets invented. */
+export const PERMISSIONS = [
+  /**
+   * Build. Workflows (create, edit, delete, deploy, toggle, snapshots), the builder MCP,
+   * spatial and content, the node registry, and taking items from the marketplace.
+   *
+   * ONE PERMISSION, NOT FIVE, by owner ruling 2026-08-31: spatial and plugin management are
+   * things a builder does in the course of building, not separate privileges. Splitting them
+   * would have produced a table nobody could hold in their head and no decision it could
+   * express that this cannot.
+   */
+  "workflow:author",
+
+  /** Push your own assets into this universe (`POST /publish`). Existing, already enforced. */
+  "marketplace:publish",
+
+  /**
+   * Read and write the credential store. THE SENSITIVE ONE, and the reason the two roles
+   * are not the same role: an author can build anything on this platform and still cannot
+   * see an API key.
+   */
+  "credentials:manage",
+
+  /**
+   * Read ANOTHER person's memory (apps/memory). The second sensitive one, and it belongs
+   * beside the first: both are "may you see something that is not yours".
+   *
+   * The memory service enforces this differently from every route above, and correctly so.
+   * Its routes are not capability-gated, they are USER-SCOPED: everyone reaches the same
+   * endpoints and `enforceUserScope` narrows the answer to your own id. This permission is
+   * what widens it. A route table would be the wrong shape for that, which is why memory
+   * shares this vocabulary and not the policy table.
+   */
+  "memory:read-all",
+] as const;
+
+export type Permission = (typeof PERMISSIONS)[number];
+
+/**
+ * WHICH ROLE GRANTS WHAT. The one bridge between Auth0's vocabulary and this code's.
+ *
+ * `admin` is `author` plus the secrets. That is the entire difference between them, stated
+ * as data rather than described in a comment somewhere, so it cannot drift.
+ */
+const AUTHOR_GRANTS: Permission[] = ["workflow:author", "marketplace:publish"];
+
+export const ROLE_GRANTS: Record<string, readonly Permission[]> = {
+  author: AUTHOR_GRANTS,
+  admin: [...AUTHOR_GRANTS, "credentials:manage", "memory:read-all"],
+};
+
+/**
+ * What this caller may do, from the roles on their token.
+ *
+ * A PERMISSION CLAIM WINS WHEN IT IS THERE. If a deployment does turn on Auth0's
+ * "add permissions to the access token", those permissions are honoured directly and the
+ * role map becomes a fallback rather than a translation layer. Nothing needs to change here
+ * on the day that happens, which is the point of reading both.
+ */
+export function grantedTo(user: { roles?: string[]; permissions?: string[] } | undefined): Set<Permission> {
+  const granted = new Set<Permission>();
+  if (!user) return granted;
+
+  for (const p of user.permissions ?? []) {
+    if ((PERMISSIONS as readonly string[]).includes(p)) granted.add(p as Permission);
+  }
+  for (const role of user.roles ?? []) {
+    for (const p of ROLE_GRANTS[role] ?? []) granted.add(p);
+  }
+  return granted;
+}

package/vendor/base/src/security/rules.ts

@@ -0,0 +1,73 @@
+/**
+ * The SHAPE of an access rule, and how a request is matched against a list of them.
+ *
+ * No table here. Each service owns its own routes and therefore its own table
+ * (`apps/unoverse/server/src/security/policy.ts`); this is the vocabulary they are written
+ * in, so the matching semantics cannot drift between services.
+ */
+
+import type { Permission } from "./permissions.js";
+
+export type Requirement = "public" | "signed-in" | "own-gate" | Permission;
+
+export interface Rule {
+  /** HTTP methods this rule covers. `*` is every method. */
+  methods: readonly string[] | "*";
+  /** Path, with `:param` for one segment and a trailing `*` for a prefix. */
+  path: string;
+  requires: Requirement;
+  /** Why. Required for `public` and `own-gate`, because both need a reason to be read. */
+  note?: string;
+}
+
+export const ALL = "*" as const;
+export const READ = ["GET", "HEAD"] as const;
+export const WRITE = ["POST", "PUT", "PATCH", "DELETE"] as const;
+
+/**
+ * The rule for one request, or null if this table does not cover it.
+ *
+ * FIRST MATCH WINS, so order is meaning: the specific lines sit above `/api/*`, and moving
+ * that catch-all upwards would silently demote everything under it to "signed-in". The
+ * ordering test in tests/security guards exactly that.
+ *
+ * A null return is NOT permission. The caller refuses it (gate.ts) and the coverage test
+ * fails the build, so an unlisted route is caught before it ships and denied if it ever is.
+ */
+export function ruleFor(policy: readonly Rule[], method: string, pathname: string): Rule | null {
+  for (const rule of policy) {
+    if (rule.methods !== ALL && !rule.methods.includes(method.toUpperCase())) continue;
+    if (matches(rule.path, pathname)) return rule;
+  }
+  return null;
+}
+
+/**
+ * The value a `:userId` segment matched, or undefined when the pattern has none.
+ *
+ * A path that names a user is a path that can be pointed at somebody else. Rather than each
+ * handler remembering to compare, the TABLE carries the rule: write `:userId` in the pattern
+ * and the gate enforces that it is the caller's own (gate.ts). The engine handlers stay
+ * unchanged and cannot forget, because they are never consulted.
+ */
+export function ownerOf(pattern: string, pathname: string): string | undefined {
+  const p = pattern.split("/").filter(Boolean);
+  const s = (pathname.split("?")[0] ?? "").split("/").filter(Boolean);
+  const at = p.indexOf(":userId");
+  return at >= 0 ? s[at] : undefined;
+}
+
+/** `:param` matches one segment; a trailing `*` matches the rest, including nothing. */
+function matches(pattern: string, pathname: string): boolean {
+  const path = pathname.split("?")[0].replace(/\/+$/, "") || "/";
+  const p = pattern.split("/").filter(Boolean);
+  const s = path.split("/").filter(Boolean);
+
+  for (let i = 0; i < p.length; i++) {
+    if (p[i] === "*") return true; // trailing wildcard: everything from here down
+    if (i >= s.length) return false;
+    if (p[i].startsWith(":")) continue; // one segment, any value
+    if (p[i] !== s[i]) return false;
+  }
+  return p.length === s.length;
+}