@usabledev/usable-chat 1.209.1 → 1.210.0

package/cli.js

@@ -57298,15 +57298,15 @@ var require_image_q = __commonJS({
           const match2 = -1;
           let bestMatch = match2;
           let bestDistance = Number.MAX_VALUE;
-          for (let lookup2 = 0; lookup2 < this._colors; lookup2++) {
-            const foundRed = lookupRed[lookup2];
-            const foundGreen = lookupGreen[lookup2];
-            const foundBlue = lookupBlue[lookup2];
-            const foundAlpha = lookupAlpha[lookup2];
+          for (let lookup3 = 0; lookup3 < this._colors; lookup3++) {
+            const foundRed = lookupRed[lookup3];
+            const foundGreen = lookupGreen[lookup3];
+            const foundBlue = lookupBlue[lookup3];
+            const foundAlpha = lookupAlpha[lookup3];
             const distance3 = this._distance.calculateRaw(foundRed, foundGreen, foundBlue, foundAlpha, color.r, color.g, color.b, color.a);
             if (distance3 < bestDistance) {
               bestDistance = distance3;
-              bestMatch = lookup2;
+              bestMatch = lookup3;
             }
           }
           this._reds[bestMatch] += color.r;
@@ -83959,15 +83959,15 @@ var init_image_q = __esm({
           const match2 = -1;
           let bestMatch = match2;
           let bestDistance = Number.MAX_VALUE;
-          for (let lookup2 = 0; lookup2 < this._colors; lookup2++) {
-            const foundRed = lookupRed[lookup2];
-            const foundGreen = lookupGreen[lookup2];
-            const foundBlue = lookupBlue[lookup2];
-            const foundAlpha = lookupAlpha[lookup2];
+          for (let lookup3 = 0; lookup3 < this._colors; lookup3++) {
+            const foundRed = lookupRed[lookup3];
+            const foundGreen = lookupGreen[lookup3];
+            const foundBlue = lookupBlue[lookup3];
+            const foundAlpha = lookupAlpha[lookup3];
             const distance3 = this._distance.calculateRaw(foundRed, foundGreen, foundBlue, foundAlpha, color.r, color.g, color.b, color.a);
             if (distance3 < bestDistance) {
               bestDistance = distance3;
-              bestMatch = lookup2;
+              bestMatch = lookup3;
             }
           }
           this._reds[bestMatch] += color.r;
@@ -94237,11 +94237,12 @@ var init_env2 = __esm({
         // (/api/oauth/register). Pre-configured in Keycloak (memory-mesh) with PKCE +
         // whitelisted redirect URIs — clients never hit Keycloak's DCR endpoint.
         MCP_OAUTH_CLIENT_ID: external_exports.string().min(1).default("mcp_oauth_client"),
-        // Optional azp (authorized party) allowlist for Bearer JWT auth on API routes.
-        // Comma-separated Keycloak client IDs. UNSET = no azp enforcement (issuer +
-        // signature + expiry only — pre-existing behaviour, keeps embed integrations
-        // working). SET = bearer tokens whose azp is not in the list are rejected
-        // with 401 JWT_AZP_REJECTED. See docs/chat-v2-contract.md#authentication.
+        // Optional override for Bearer JWT client trust. Bearer tokens are accepted
+        // when Usable trusts their azp (first-party SSO, mcp_oauth_client, any
+        // marketplace app — looked up via /api/oauth/client-trust). Client IDs listed
+        // here (comma-separated) are always trusted without a lookup: use it only for
+        // clients Usable does not know, or as break-glass during a Usable outage.
+        // See docs/chat-v2-contract.md#authentication.
         CHAT_TRUSTED_CLIENT_IDS: external_exports.string().optional(),
         USABLE_MOBILE_CHAT_HOST_ENABLED: external_exports.enum(["true", "false"]).default("false"),
         USABLE_MOBILE_CHAT_HOST_ORIGIN: external_exports.string().url().optional(),
@@ -94547,8 +94548,8 @@ var init_config = __esm({
         /** Static public client_id returned by the MCP OAuth registration endpoint. */
         mcpOAuthClientId: env.MCP_OAUTH_CLIENT_ID || DEFAULT_MCP_OAUTH_CLIENT_ID2,
         /**
-         * Optional azp allowlist for Bearer JWT auth (comma-separated client IDs).
-         * Empty/unset disables enforcement. See docs/chat-v2-contract.md.
+         * Optional override list of Bearer JWT client IDs trusted without asking
+         * Usable (comma-separated). See oauth-client-trust.service.ts.
          */
         trustedClientIdsRaw: env.CHAT_TRUSTED_CLIENT_IDS
       },
@@ -167172,7 +167173,7 @@ function buildBlock(artifact) {
 ${body2}
 </referenced-artifact>`;
 }
-async function resolveArtifactMentions(text5, lookup2) {
+async function resolveArtifactMentions(text5, lookup3) {
   if (!text5 || typeof text5 !== "string") return text5;
   const ids = /* @__PURE__ */ new Set();
   const matches = text5.matchAll(ARTIFACT_MENTION_RE);
@@ -167180,7 +167181,7 @@ async function resolveArtifactMentions(text5, lookup2) {
     ids.add(match2[1].toLowerCase());
   }
   if (ids.size === 0) return text5;
-  const resolved = await lookup2(Array.from(ids));
+  const resolved = await lookup3(Array.from(ids));
   const byId = /* @__PURE__ */ new Map();
   for (const artifact of resolved) {
     byId.set(artifact.id.toLowerCase(), artifact);
@@ -167211,14 +167212,14 @@ function buildElement(user) {
   const handle = escapeXml2(`@${handleSource}`);
   return `<slack-user id="${user.id}" handle="${handle}" name="${name18}" />`;
 }
-async function resolveSlackMentions(text5, lookup2) {
+async function resolveSlackMentions(text5, lookup3) {
   if (!text5 || typeof text5 !== "string") return text5;
   const ids = /* @__PURE__ */ new Set();
   for (const match2 of text5.matchAll(SLACK_MENTION_RE)) {
     ids.add(match2[1].toUpperCase());
   }
   if (ids.size === 0) return text5;
-  const resolved = await lookup2(Array.from(ids));
+  const resolved = await lookup3(Array.from(ids));
   const byId = /* @__PURE__ */ new Map();
   for (const user of resolved) {
     byId.set(user.id.toUpperCase(), user);
@@ -178067,12 +178068,12 @@ var require_base64_js = __commonJS({
     exports2.byteLength = byteLength;
     exports2.toByteArray = toByteArray;
     exports2.fromByteArray = fromByteArray;
-    var lookup2 = [];
+    var lookup3 = [];
     var revLookup = [];
     var Arr = typeof Uint8Array !== "undefined" ? Uint8Array : Array;
     var code = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
     for (i19 = 0, len = code.length; i19 < len; ++i19) {
-      lookup2[i19] = code[i19];
+      lookup3[i19] = code[i19];
       revLookup[code.charCodeAt(i19)] = i19;
     }
     var i19;
@@ -178125,7 +178126,7 @@ var require_base64_js = __commonJS({
       return arr;
     }
     function tripletToBase64(num) {
-      return lookup2[num >> 18 & 63] + lookup2[num >> 12 & 63] + lookup2[num >> 6 & 63] + lookup2[num & 63];
+      return lookup3[num >> 18 & 63] + lookup3[num >> 12 & 63] + lookup3[num >> 6 & 63] + lookup3[num & 63];
     }
     function encodeChunk(uint8, start, end) {
       var tmp;
@@ -178148,12 +178149,12 @@ var require_base64_js = __commonJS({
       if (extraBytes === 1) {
         tmp = uint8[len2 - 1];
         parts.push(
-          lookup2[tmp >> 2] + lookup2[tmp << 4 & 63] + "=="
+          lookup3[tmp >> 2] + lookup3[tmp << 4 & 63] + "=="
         );
       } else if (extraBytes === 2) {
         tmp = (uint8[len2 - 2] << 8) + uint8[len2 - 1];
         parts.push(
-          lookup2[tmp >> 10] + lookup2[tmp >> 4 & 63] + lookup2[tmp << 2 & 63] + "="
+          lookup3[tmp >> 10] + lookup3[tmp >> 4 & 63] + lookup3[tmp << 2 & 63] + "="
         );
       }
       return parts.join("");
@@ -212213,7 +212214,7 @@ var require_redis_errors = __commonJS({
 var require_lib3 = __commonJS({
   "node_modules/.pnpm/cluster-key-slot@1.1.2/node_modules/cluster-key-slot/lib/index.js"(exports2, module) {
     "use strict";
-    var lookup2 = [
+    var lookup3 = [
       0,
       4129,
       8258,
@@ -212513,11 +212514,11 @@ var require_lib3 = __commonJS({
             start = i19;
           }
         } else if (char2 !== 125) {
-          resultHash = lookup2[(char2 ^ resultHash >> 8) & 255] ^ resultHash << 8;
+          resultHash = lookup3[(char2 ^ resultHash >> 8) & 255] ^ resultHash << 8;
         } else if (i19 - 1 !== start) {
           return resultHash & 16383;
         }
-        result = lookup2[(char2 ^ result >> 8) & 255] ^ result << 8;
+        result = lookup3[(char2 ^ result >> 8) & 255] ^ result << 8;
       }
       return result & 16383;
     };
@@ -350204,7 +350205,7 @@ var require_issuer = __commonJS({
     var { keystores } = require_weak_cache();
     var processResponse = require_process_response();
     var request = require_request2();
-    var inFlight = /* @__PURE__ */ new WeakMap();
+    var inFlight2 = /* @__PURE__ */ new WeakMap();
     var caches = /* @__PURE__ */ new WeakMap();
     var lrus = (ctx) => {
       if (!caches.has(ctx)) {
@@ -350217,11 +350218,11 @@ var require_issuer = __commonJS({
       const keystore = keystores.get(this);
       const cache10 = lrus(this);
       if (reload || !keystore) {
-        if (inFlight.has(this)) {
-          return inFlight.get(this);
+        if (inFlight2.has(this)) {
+          return inFlight2.get(this);
         }
         cache10.reset();
-        inFlight.set(
+        inFlight2.set(
           this,
           (async () => {
             const response = await request.call(this, {
@@ -350232,7 +350233,7 @@ var require_issuer = __commonJS({
                 Accept: "application/json, application/jwk-set+json"
               }
             }).finally(() => {
-              inFlight.delete(this);
+              inFlight2.delete(this);
             });
             const jwks2 = processResponse(response);
             const joseKeyStore = KeyStore.fromJWKS(jwks2, { onlyPublic: true });
@@ -350241,7 +350242,7 @@ var require_issuer = __commonJS({
             return joseKeyStore;
           })()
         );
-        return inFlight.get(this);
+        return inFlight2.get(this);
       }
       return keystore;
     }
@@ -360154,15 +360155,126 @@ var init_embed_auth = __esm({
   }
 });
 
+// src/lib/services/oauth-client-trust.service.ts
+function overrideClientIds() {
+  return (config2.auth.trustedClientIdsRaw ?? "").split(",").map((id) => id.trim()).filter(Boolean);
+}
+function getClientTrustUrl() {
+  const mcpUrl = config2.mcp.url;
+  if (!mcpUrl || !MCP_PATH.test(mcpUrl)) return null;
+  return `${mcpUrl.replace(MCP_PATH, "")}/api/oauth/client-trust`;
+}
+function remember(azp, verdict) {
+  if (!verdictCache.has(azp) && verdictCache.size >= CACHE_MAX_ENTRIES) {
+    const oldest = verdictCache.keys().next().value;
+    if (typeof oldest === "string") verdictCache.delete(oldest);
+  }
+  const now2 = Date.now();
+  verdictCache.set(
+    azp,
+    verdict === "trusted" ? {
+      verdict,
+      expiresAt: now2 + TRUSTED_TTL_MS,
+      staleUntil: now2 + TRUSTED_TTL_MS + STALE_IF_ERROR_MS
+    } : { verdict, expiresAt: now2 + UNTRUSTED_TTL_MS }
+  );
+}
+async function lookup2(azp, accessToken, fetchImpl) {
+  const url3 = getClientTrustUrl();
+  if (!url3) {
+    logger.error("oauth-client-trust", "USABLE_MCP_URL is missing or does not end in /api/mcp");
+    return null;
+  }
+  try {
+    const response = await fetchImpl(url3, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${accessToken}` },
+      cache: "no-store",
+      signal: AbortSignal.timeout(LOOKUP_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      logger.warn("oauth-client-trust", "Client trust lookup failed", {
+        azp,
+        status: response.status
+      });
+      return null;
+    }
+    const parsed = trustResponseSchema.safeParse(await response.json());
+    if (!parsed.success || parsed.data.clientId !== azp) {
+      logger.warn("oauth-client-trust", "Client trust lookup returned an unexpected body", { azp });
+      return null;
+    }
+    const verdict = parsed.data.trusted ? "trusted" : "untrusted";
+    remember(azp, verdict);
+    return verdict;
+  } catch (error41) {
+    logger.warn("oauth-client-trust", "Client trust lookup errored", {
+      azp,
+      error: error41 instanceof Error ? error41.message : String(error41)
+    });
+    return null;
+  }
+}
+async function resolveOAuthClientTrust(azp, accessToken, options2 = {}) {
+  if (!azp) return "untrusted";
+  if (azp === config2.auth.mcpOAuthClientId || overrideClientIds().includes(azp)) return "trusted";
+  const cached2 = verdictCache.get(azp);
+  if (!options2.bypassCache && cached2 && cached2.expiresAt > Date.now()) {
+    return cached2.verdict;
+  }
+  let pending = inFlight.get(azp);
+  if (!pending) {
+    pending = lookup2(azp, accessToken, options2.fetchImpl ?? fetch).finally(() => {
+      inFlight.delete(azp);
+    });
+    inFlight.set(azp, pending);
+  }
+  const verdict = await pending;
+  if (verdict) return verdict;
+  const stale = verdictCache.get(azp);
+  if (!options2.bypassCache && stale?.verdict === "trusted" && stale.staleUntil !== void 0 && stale.staleUntil > Date.now()) {
+    logger.warn("oauth-client-trust", "Serving stale trusted verdict while Usable is unavailable", {
+      azp
+    });
+    return "trusted";
+  }
+  return "unavailable";
+}
+var TRUSTED_TTL_MS, UNTRUSTED_TTL_MS, STALE_IF_ERROR_MS, LOOKUP_TIMEOUT_MS, CACHE_MAX_ENTRIES, trustResponseSchema, verdictCache, inFlight, MCP_PATH;
+var init_oauth_client_trust_service = __esm({
+  "src/lib/services/oauth-client-trust.service.ts"() {
+    "use strict";
+    init_zod();
+    init_config();
+    init_logger();
+    TRUSTED_TTL_MS = 5 * 6e4;
+    UNTRUSTED_TTL_MS = 3e4;
+    STALE_IF_ERROR_MS = 60 * 6e4;
+    LOOKUP_TIMEOUT_MS = 5e3;
+    CACHE_MAX_ENTRIES = 500;
+    trustResponseSchema = external_exports.union([
+      external_exports.object({
+        clientId: external_exports.string().min(1),
+        trusted: external_exports.literal(true),
+        kind: external_exports.enum(["first-party-sso", "mcp-oauth", "marketplace-app"]),
+        appId: external_exports.string().optional()
+      }),
+      external_exports.object({
+        clientId: external_exports.string().min(1).nullable(),
+        trusted: external_exports.literal(false)
+      })
+    ]);
+    verdictCache = /* @__PURE__ */ new Map();
+    inFlight = /* @__PURE__ */ new Map();
+    MCP_PATH = /\/api\/mcp\/?$/;
+  }
+});
+
 // src/lib/auth-helper.ts
 function parseTrustedClientIds(raw) {
   if (!raw) return [];
   return raw.split(",").map((id) => id.trim()).filter(Boolean);
 }
-function isTrustedAzp(azp, trustedClientIds) {
-  if (trustedClientIds.length === 0) return true;
-  return azp !== void 0 && trustedClientIds.includes(azp);
-}
 function hasConfiguredSessionCookie(cookieHeader, sessionCookieName) {
   if (!cookieHeader || !sessionCookieName) return false;
   return cookieHeader.split(";").some((cookie) => {
@@ -360227,15 +360339,23 @@ async function getAuthFromRequest(request, options2) {
     const token = authHeader.slice(7);
     const result = await verifyJWT(token);
     if (result.success) {
-      const trustedClientIds = parseTrustedClientIds(config2.auth.trustedClientIdsRaw);
-      if (!isTrustedAzp(result.payload.azp, trustedClientIds)) {
+      const clientTrust = await resolveOAuthClientTrust(result.payload.azp, token);
+      if (clientTrust === "untrusted") {
         console.warn(
-          `[AuthHelper] Bearer JWT azp rejected: ${result.payload.azp ?? "<missing>"} not in CHAT_TRUSTED_CLIENT_IDS`
+          `[AuthHelper] Bearer JWT azp rejected: ${result.payload.azp ?? "<missing>"} is not a client trusted by Usable`
         );
         lastRejection = {
           code: "JWT_AZP_REJECTED",
           message: "JWT authorized party (azp) is not a trusted client for this service"
         };
+      } else if (clientTrust === "unavailable") {
+        console.warn(
+          `[AuthHelper] Bearer JWT azp ${result.payload.azp} could not be checked: Usable client trust lookup unavailable`
+        );
+        lastRejection = {
+          code: "CLIENT_TRUST_UNAVAILABLE",
+          message: "Client authorization is temporarily unavailable. Please try again."
+        };
       } else {
         const userId = result.payload.usable_user_id || result.payload.sub;
         if (!userId) {
@@ -360313,6 +360433,7 @@ var init_auth_helper = __esm({
     init_config();
     import_server2 = __toESM(require_server());
     init_embed_auth();
+    init_oauth_client_trust_service();
     jwks = null;
   }
 });
@@ -391814,7 +391935,7 @@ init_tui_select();
 init_model_registry();
 
 // package.json
-var version2 = "1.209.1";
+var version2 = "1.210.0";
 
 // src/adapters/cli/model-catalog.ts
 init_codex_auth();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usabledev/usable-chat",
-  "version": "1.209.1",
+  "version": "1.210.0",
   "description": "usable-chat — terminal harness for usable-chat (headless + TUI)",
   "type": "module",
   "bin": {