@unoverse-platform/studio 0.1.99 → 0.1.101

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unoverse-platform/studio",
-  "version": "0.1.99",
+  "version": "0.1.101",
   "type": "module",
   "description": "Unoverse Studio: the local authoring app. Reads your own rx/ folder, no backend.",
   "scripts": {

package/screens/TemplatesView.tsx

@@ -325,7 +325,7 @@ export function TemplatesView({
       // A real JWT makes the workbench a proper authenticated channel: it rides the
       // MCP stream's `Authorization` header and the REST `Authorization` header, so the
       // workflow gets full user context (incl. the email claim → CRM join). See
-      // docs/AUTH_TOKEN_FLOW.md. Blank → no token (server must run with DISABLE_AUTH=true).
+      // docs/auth-security/IDENTITY.md. Blank → no token (server must run with DISABLE_AUTH=true).
       getAccessToken: token ? async () => token : undefined,
     }),
     [liveBase, token],
@@ -393,7 +393,7 @@ export function TemplatesView({
   const binding = selectedDef?.binding;
   // The session userId MUST be the token's `sub` when a token rides the connection —
   // the server binds the audio socket to the verified identity and REJECTS an
-  // INIT_SESSION claiming anyone else (AUTH_TOKEN_FLOW.md; the June audit's WS
+  // INIT_SESSION claiming anyone else (docs/auth-security/IDENTITY.md; the June audit's WS
   // finding). "dev" is only for a universe with auth off, where no token exists.
   const tokenSub = useMemo(() => {
     if (!token) return undefined;

package/vendor/base/src/auth/auth.ts

@@ -2,7 +2,7 @@
  * JWT authentication for the Unoverse MCP server.
  *
  * Mirrors apps/mcp-server/src/server/auth/auth.ts — same OIDC/JWT flow as the rest
- * of the platform (docs/AUTH_TOKEN_FLOW.md): validate the access token against the
+ * of the platform (docs/auth-security/IDENTITY.md): validate the access token against the
  * shared AUTH_ISSUER/AUTH_AUDIENCE via JWKS. The only difference is transport: this
  * server speaks MCP over uWS + Web `Request`/`Response`, so the gate is a pure
  * function over the Authorization header rather than node req/res.
@@ -13,6 +13,7 @@
 
 import { jwtVerify, createRemoteJWKSet, JWTPayload } from "jose";
 import { isAuthEnabled, devIdentity } from "./authConfig.js";
+import { grantedTo } from "../security/permissions.js";
 
 // Read env lazily (not at module load) so it's correct regardless of when .env loads.
 //
@@ -102,7 +103,7 @@ export function parseRoles(payload: JWTPayload): string[] {
 /** Parse a string claim, handling Auth0-style namespaced claims (e.g. https://…/email).
  *  Auth0 emits custom claims (email on the access token) ONLY namespaced, so a plain
  *  `payload.email` read returns undefined and silently no-ops every email-keyed feature
- *  (CRM resolve). Same namespace-aware read as parseArrayClaim. See docs/AUTH_TOKEN_FLOW.md. */
+ *  (CRM resolve). Same namespace-aware read as parseArrayClaim. See docs/auth-security/IDENTITY.md. */
 function parseStringClaim(payload: JWTPayload, claimName: string): string | undefined {
   const direct = payload[claimName];
   if (typeof direct === "string") return direct;
@@ -166,8 +167,11 @@ async function verifyJWT(token: string): Promise<AuthUser | null> {
     const { payload } = await jwtVerify(token, jwksSet, { issuer: issuers });
     const expected = getAudience();
     if (expected) {
-      const claimed = payload.aud ?? (payload as Record<string, unknown>).client_id;
-      const values = Array.isArray(claimed) ? claimed.map(String) : claimed ? [String(claimed)] : [];
+      // Both places are read, not the first one present: WorkOS sends its environment in `aud`
+      // and the signed-in app in `client_id`, and a cell names its own app.
+      const aud = payload.aud;
+      const clientId = (payload as Record<string, unknown>).client_id;
+      const values = [...(Array.isArray(aud) ? aud : aud ? [aud] : []), ...(clientId ? [clientId] : [])].map(String);
       if (!values.includes(expected)) {
         console.error(
           `[auth] JWT validation failed: audience mismatch (expected ${expected}, token had ${values.join(", ") || "none"})`,
@@ -209,7 +213,7 @@ export async function authorize(authHeader: string | null | undefined): Promise<
  * this exact string (Auth0 API permission on the gravity-api audience), NOT on a
  * role name — end-user chat tokens are valid on the same audience, so "authenticated"
  * is not enough; only "authenticated AND may author workflows" passes. This is the
- * platform's first authZ check (docs/AUTH_REMEDIATION.md Phase 1b).
+ * platform's first authZ check (docs/auth-security/legacy/AUTH_REMEDIATION_2026.md Phase 1b).
  */
 export const BUILDER_PERMISSION = "workflow:author";
 
@@ -221,7 +225,8 @@ export type BuilderAuthResult = { ok: true; user: AuthUser } | { ok: false; reas
  *  - FAIL-CLOSED when auth is disabled: this route must never be open, so an
  *    AUTH_ENABLED=false deployment simply cannot serve it (returns forbidden).
  *    Local dev uses the ungated LOOPBACK route (:4106) instead — never this one.
- *  - Requires the BUILDER_PERMISSION claim, not just a valid bearer.
+ *  - Requires BUILDER_PERMISSION, not just a valid bearer: granted by a role on the token
+ *    (ROLE_GRANTS, the one role-to-permission rule) or by a permission claim.
  * Returns the full user so a later step can bind the session to a workflow grant.
  */
 export async function authorizeBuilder(authHeader: string | null | undefined): Promise<BuilderAuthResult> {
@@ -232,7 +237,7 @@ export async function authorizeBuilder(authHeader: string | null | undefined): P
   if (!token) return { ok: false, reason: "unauthenticated" };
   const user = await validateJWT(token);
   if (!user) return { ok: false, reason: "unauthenticated" };
-  if (!user.permissions.includes(BUILDER_PERMISSION)) return { ok: false, reason: "forbidden" };
+  if (!grantedTo(user).has(BUILDER_PERMISSION)) return { ok: false, reason: "forbidden" };
   return { ok: true, user };
 }
 

package/vendor/base/src/auth/authConfig.ts

@@ -3,7 +3,7 @@
  *
  * MIRRORED across services (apps/server, apps/mcp-server, apps/memory-server, and
  * now apps/unoverse) — keep the copies in sync. Single source of truth:
- * docs/AUTH_REMEDIATION.md (Phase 0).
+ * docs/auth-security/legacy/AUTH_REMEDIATION_2026.md (Phase 0).
  *
  * Rules:
  *  - Default: auth ENABLED. Only an explicit AUTH_ENABLED=false (or the deprecated

package/vendor/base/src/manifests/executor/context.ts

@@ -5,7 +5,7 @@
  * calls execute, so {{signal.x}} and {{prompt.y}} an author wrote in a config field are
  * plain text by the time they reach here.
  *
- * `executionContext.auth.accessToken` — the CALLER'S JWT (AUTH_TOKEN_FLOW.md) — is
+ * `executionContext.auth.accessToken` — the CALLER'S JWT (docs/auth-security/IDENTITY.md) — is
  * DELIBERATELY WITHHELD, and must stay that way. A code node may reach it because a code
  * node is bounded by provenance; a manifest is data that can arrive by paste or database
  * row. The blast radii are not comparable: a third-party API key reaches that vendor

package/vendor/sdk/lib/connection.tsx

@@ -80,7 +80,7 @@ const UNOVERSE_EVENT = "notifications/unoverse/event";
 /**
  * Guest identity — CONTAINED HERE so hosts never write guest logic. A token-less
  * session is a GUEST to the platform's public-entry gate, which only admits
- * `guest-`-prefixed ids (Run Authorization, AUTH_TOKEN_FLOW.md). Minted once per
+ * `guest-`-prefixed ids (Run Authorization, docs/auth-security/IDENTITY.md). Minted once per
  * browser and persisted so the visitor's conversation and memory cohere across
  * reloads. A host that supplies its own guest id wins (two apps in one page share
  * one visitor); a host with a token is untouched.

package/vendor/sdk/main.tsx

@@ -42,7 +42,7 @@ function render() {
       // tokenless boot made the SDK skip its guest-id substitution (connection.tsx), so
       // the session registered a non-guest id and the public-entry gate refused it.
       // No token ⇒ no accessor ⇒ the SDK mints/persists `guest-<uuid>` per the contract
-      // (UNOVERSE_MCP_APP_PROTOCOL §5, AUTH_TOKEN_FLOW Run Authorization).
+      // (UNOVERSE_MCP_APP_PROTOCOL §5, docs/auth-security/IDENTITY.md Run Authorization).
       getAccessToken={current.token ? readToken : undefined}
     />,
   );