@vantageos/backend-doctor 0.1.13 → 0.2.0

package/fixtures/cr1-refusal-on-resolved/doors.ts

@@ -0,0 +1,180 @@
+// CR-1 fixture — public doors gated the way vantage-peers 58ed649 gates the OKF
+// export/import doors (okfBundleNode.ts:244-276, okfBundleDurable.ts:110-132,
+// okfBundleNode.ts:783-793), plus the negative poles that must stay FAIL-OPEN.
+// Each member is a pole for tests/cr1-refusal-on-resolved.test.ts.
+import {
+	requireMasterDirect,
+	requireNamespaceSometimes,
+	requireNonEmpty,
+	requireTenantNamespace,
+	withOrgScope,
+} from "./lib/auth";
+
+// ─── helpers, product-shaped ─────────────────────────────────────────────────
+
+/** ACTION side (okfBundleNode.ts:assertCanExportNamespace): binding through
+ *  ctx.runQuery(internal.…resolveOrgScopeForAction), refusal through a
+ *  TRANSITIVE value refuser. */
+async function assertCanExportNamespace(
+	ctx: ActionCtx,
+	namespace: string,
+	door: string,
+): Promise<void> {
+	if (namespace.includes("..")) {
+		throw new Error(`OKF_NAMESPACE_INVALID: "${namespace}"`);
+	}
+	const scope = await ctx.runQuery(
+		internal.lib.auth.resolveOrgScopeForAction,
+		{},
+	);
+	requireTenantNamespace(scope, namespace, door);
+}
+
+/** okfBundleNode.ts:assertCanImport — reaches the gate one call deeper. */
+async function assertCanImport(
+	ctx: ActionCtx,
+	namespace: string,
+): Promise<void> {
+	await assertCanExportNamespace(ctx, namespace, "doors:importBundle");
+}
+
+/** V8 side (okfBundleDurable.ts:assertCanExportNamespaceV8): binding through
+ *  withOrgScope, refusal through the same TRANSITIVE value refuser. */
+async function assertCanExportNamespaceV8(
+	ctx: MutationCtx,
+	namespace: string,
+	door: string,
+): Promise<void> {
+	const scope = await withOrgScope(ctx, { refuseWithoutThrow: true });
+	requireTenantNamespace(scope, namespace, door);
+}
+
+/** binding through withOrgScope, refusal through a DIRECT (one-level) refuser. */
+async function assertMasterDirect(
+	ctx: MutationCtx,
+	door: string,
+): Promise<void> {
+	const scope = await withOrgScope(ctx);
+	requireMasterDirect(scope, door);
+}
+
+/** NEGATIVE 1 — same resolution, result IGNORED: the refuser is handed the
+ *  namespace, never the resolved scope. */
+async function assertIgnored(
+	ctx: ActionCtx,
+	namespace: string,
+	door: string,
+): Promise<void> {
+	// biome-ignore lint/correctness/noUnusedVariables: the UNUSED binding IS the pole.
+	const scope = await ctx.runQuery(
+		internal.lib.auth.resolveOrgScopeForAction,
+		{},
+	);
+	requireNonEmpty(namespace, door);
+}
+
+/** NEGATIVE 2 — the old okfBundleNode.ts:assertCanValidate shape: the
+ *  absent-identity branch is a bare `return;`, whatever follows it. */
+async function assertCanValidateOld(
+	ctx: ActionCtx,
+	namespace: string,
+	door: string,
+): Promise<void> {
+	const identity = await ctx.auth.getUserIdentity();
+	if (identity === null || identity === undefined) {
+		return;
+	}
+	const scope = await ctx.runQuery(
+		internal.lib.auth.resolveOrgScopeForAction,
+		{},
+	);
+	requireTenantNamespace(scope, namespace, door);
+}
+
+/** NEGATIVE 3 — the refuser proceeds silently on a caller-supplied value. */
+async function assertSometimes(
+	ctx: MutationCtx,
+	namespace: string,
+	door: string,
+): Promise<void> {
+	const scope = await withOrgScope(ctx);
+	requireNamespaceSometimes(scope, namespace, door);
+}
+
+export const readRows = internalQuery({
+	args: { namespace: v.string() },
+	handler: async (ctx, args) => {
+		return await ctx.db
+			.query("rows")
+			.withIndex("by_namespace", (q) => q.eq("namespace", args.namespace))
+			.collect();
+	},
+});
+
+// ─── POSITIVE — RESOLVES ─────────────────────────────────────────────────────
+
+export const exportBundle = action({
+	args: { namespace: v.string() },
+	handler: async (ctx, args) => {
+		await assertCanExportNamespace(ctx, args.namespace, "doors:exportBundle");
+		return await ctx.runQuery(internal.doors.readRows, {
+			namespace: args.namespace,
+		});
+	},
+});
+
+export const importBundle = action({
+	args: { namespace: v.string() },
+	handler: async (ctx, args) => {
+		await assertCanImport(ctx, args.namespace);
+		return await ctx.runQuery(internal.doors.readRows, {
+			namespace: args.namespace,
+		});
+	},
+});
+
+export const startExport = mutation({
+	args: { namespace: v.string() },
+	handler: async (ctx, args) => {
+		await assertCanExportNamespaceV8(ctx, args.namespace, "doors:startExport");
+		return await ctx.db.insert("jobs", { namespace: args.namespace });
+	},
+});
+
+export const directDoor = mutation({
+	args: { namespace: v.string() },
+	handler: async (ctx, args) => {
+		await assertMasterDirect(ctx, "doors:directDoor");
+		return await ctx.db.insert("jobs", { namespace: args.namespace });
+	},
+});
+
+// ─── NEGATIVE — FAIL-OPEN ────────────────────────────────────────────────────
+
+export const ignoredDoor = action({
+	args: { namespace: v.string() },
+	handler: async (ctx, args) => {
+		await assertIgnored(ctx, args.namespace, "doors:ignoredDoor");
+		return await ctx.runQuery(internal.doors.readRows, {
+			namespace: args.namespace,
+		});
+	},
+});
+
+export const validateDoor = action({
+	args: { namespace: v.string() },
+	handler: async (ctx, args) => {
+		await assertCanValidateOld(ctx, args.namespace, "doors:validateDoor");
+		return await ctx.runQuery(internal.doors.readRows, {
+			namespace: args.namespace,
+		});
+	},
+});
+
+export const sometimesDoor = mutation({
+	args: { namespace: v.string() },
+	handler: async (ctx, args) => {
+		await assertSometimes(ctx, args.namespace, "doors:sometimesDoor");
+		return await ctx.db.insert("jobs", { namespace: args.namespace });
+	},
+});

package/fixtures/cr1-refusal-on-resolved/lib/auth.ts

@@ -0,0 +1,104 @@
+// CR-1 fixture — the RESOLVER and REFUSER helpers, shaped after vantage-peers
+// 58ed649 `convex/lib/auth.ts` (withOrgScope, requireResolvedCaller,
+// isNamespaceAllowedForScope, requireTenantNamespace, resolveOrgScopeForAction).
+// Each helper below is a pole for tests/cr1-refusal-on-resolved.test.ts. Do not
+// "tidy" it: a line that looks redundant is a discriminator.
+
+/** RESOLVER (not a gate): an absent identity returns an anonymous scope. */
+export async function withOrgScope(ctx: Ctx, opts?: Opts): Promise<Scope> {
+	const identity = await ctx.auth.getUserIdentity();
+	if (identity === null || identity === undefined) {
+		return { isMaster: false, orgSlug: null, anonymous: true, refused: true };
+	}
+	const row = await ctx.db
+		.query("client_org_mapping")
+		.withIndex("by_clerk_slug", (q) => q.eq("clerkSlug", identity.org_slug))
+		.unique();
+	if (row === null || opts?.refuseWithoutThrow) {
+		return { isMaster: false, orgSlug: null, anonymous: false, refused: true };
+	}
+	return {
+		isMaster: false,
+		orgSlug: row.orgSlug,
+		anonymous: false,
+		refused: false,
+	};
+}
+
+/** VALUE REFUSER, direct: refuses an anonymous scope by raising. */
+export function requireResolvedCaller(
+	scope: Pick<Scope, "isMaster" | "orgSlug" | "anonymous" | "refused">,
+	registration: string,
+	opts?: { masterOnly?: boolean },
+): void {
+	if (scope.isMaster) return;
+	if (scope.anonymous) {
+		throw new ConvexError(
+			`RBAC_DENIED: no credential presented to "${registration}"`,
+		);
+	}
+	if (opts?.masterOnly) {
+		throw new ConvexError(
+			`RBAC_DENIED: "${registration}" admits the fleet master only`,
+		);
+	}
+}
+
+/** a PREDICATE on the resolved scope — returns a boolean, refuses nothing. */
+export function isNamespaceAllowedForScope(
+	scope: Pick<Scope, "isMaster" | "orgSlug">,
+	namespace: string,
+): boolean {
+	if (scope.isMaster) return true;
+	if (scope.orgSlug === null) return false;
+	return namespace.startsWith(`team/${scope.orgSlug}`);
+}
+
+/** VALUE REFUSER, TRANSITIVE: no throw of its own — it allows on a test of the
+ *  RESOLVED scope and otherwise hands that scope to requireResolvedCaller. */
+export function requireTenantNamespace(
+	scope: Pick<Scope, "isMaster" | "orgSlug" | "anonymous" | "refused">,
+	namespace: string,
+	door: string,
+): void {
+	if (isNamespaceAllowedForScope(scope, namespace)) return;
+	requireResolvedCaller(scope, door, { masterOnly: true });
+}
+
+/** VALUE REFUSER, direct, one level: throws on a test of the resolved scope. */
+export function requireMasterDirect(scope: Scope, door: string): void {
+	if (!scope.isMaster) {
+		throw new ConvexError(
+			`RBAC_DENIED: "${door}" admits the fleet master only`,
+		);
+	}
+}
+
+/** NOT a refuser of `scope`: it PROCEEDS on a test of a caller-supplied argument
+ *  before any test of the resolved value — every principal, none included, whose
+ *  namespace starts `public/` is waved through. */
+export function requireNamespaceSometimes(
+	scope: Pick<Scope, "isMaster" | "orgSlug" | "anonymous" | "refused">,
+	namespace: string,
+	door: string,
+): void {
+	if (namespace.startsWith("public/")) return;
+	requireResolvedCaller(scope, door, { masterOnly: true });
+}
+
+/** a refuser of its OWN argument (a namespace), never of a principal. */
+export function requireNonEmpty(namespace: string, door: string): void {
+	if (namespace.length === 0) {
+		throw new Error(`OKF_NAMESPACE_INVALID at "${door}"`);
+	}
+}
+
+/** the ONE way an action resolves its caller — reached as
+ *  `internal.lib.auth.resolveOrgScopeForAction`, never by bare name. */
+export const resolveOrgScopeForAction = internalQuery({
+	args: {},
+	handler: async (ctx) => {
+		const scope = await withOrgScope(ctx, { refuseWithoutThrow: true });
+		return scope;
+	},
+});

package/fixtures/r34-vp-auth-30e821b/auth-805-812.ts.txt

@@ -0,0 +1,8 @@
+// verified token here is forwarded verbatim to Convex as `clerkJwt` below,
+// and Convex's own auth.config already requires aud === "convex", so binding
+// the same value here (Critical Rule 14 element 5: aud + iss binding) closes
+// the cross-tenant/cross-resource replay gap without rejecting any token a
+// correctly-configured Clerk "convex" JWT template mints.
+const CLERK_JWT_AUDIENCE = process.env.CLERK_JWT_AUDIENCE ?? "convex";
+
+// Lazy singleton — createRemoteJWKSet caches JWKS in-process (10-min TTL).

package/fixtures/r34-vp-auth-30e821b/auth-878-890.ts.txt

@@ -0,0 +1,13 @@
+ * that DOES require the fallback).
+ */
+async function tryVerifyClerkJwt(token: string): Promise<ClerkJwtResult> {
+	try {
+		const { payload } = await jwtVerify(token, clerkJwks(), {
+			issuer: CLERK_DOMAIN,
+			audience: CLERK_JWT_AUDIENCE,
+		});
+		// Verification succeeded — this IS the caller's own Clerk identity.
+		// `sub`/`exp` absence here would be a session-token shape violation
+		// (not the org concern this function types), so it is still
+		// "not-clerk" (try next layer) rather than "no-org".
+		const sub = payload.sub;

package/fixtures/vp-writer-tier-1e4ab36.csv

@@ -0,0 +1,55 @@
+outil,table,crud,writer_tier,writer_gate,write_doors
+import_okf_bundle,_storage+briefingNotes+memories+tasks,CREATE,org-member,orgResolver,okfBundleNode:importOkfBundle=orgResolver
+store_document_chunked,_storage+kbUploads+memories,UPSERT,org-member,orgResolver,kb:storeDocumentChunked=orgResolver
+delete_recurring_task,,DELETE,master,masterOnly,recurringTasks:remove=masterOnly
+pause_recurring_task,,UPDATE,master,masterOnly,recurringTasks:pause=masterOnly
+resume_recurring_task,,UPDATE,master,masterOnly,recurringTasks:resume=masterOnly
+soft_delete_memory,,UPDATE,org-member,orgResolver,memories:softDeleteMemory=orgResolver
+create_bu,businessUnits,CREATE,org-member,orgResolver,businessUnits:create=orgResolver
+delete_bu,businessUnits,DELETE,master,masterOnly,businessUnits:remove=masterOnly
+update_bu,businessUnits,UPDATE,org-member,orgResolver,businessUnits:update=orgResolver
+update_task,client_org_mapping+messageReceipts+messages+missions+oauth_access_tokens+taskClosureConfig+tasks,UPSERT,org-member,orgResolver,tasks:update=orgResolver
+send_message,client_org_mapping+messageReceipts+messages+profiles,CREATE,org-member,orgResolver,messages:sendMessage=orgResolver
+update_recurring_task,client_org_mapping+oauth_access_tokens,UPDATE,org-member,orgResolver,recurringTasks:update=orgResolver
+create_recurring_task,client_org_mapping+oauth_access_tokens+recurringTasks,CREATE,org-member,orgResolver,recurringTasks:create=orgResolver
+create_task,client_org_mapping+oauth_access_tokens+tasks,CREATE,org-member,orgResolver,tasks:create=orgResolver
+write_diary,diary,UPSERT,org-member,orgResolver,diary:write=orgResolver
+add_fix_attempt,fixAttempts+fixPatterns,UPSERT,master,masterOnly,fixPatterns:addAttempt=masterOnly
+create_fix_pattern,fixPatterns,CREATE,master,masterOnly,fixPatterns:create=masterOnly
+link_issue_to_pattern,fixPatterns,UPDATE,master,masterOnly,fixPatterns:linkIssue=masterOnly
+validate_fix,fixPatterns,UPDATE,master,masterOnly,fixPatterns:validate=masterOnly
+complete_task,fixPatterns+githubRepoMapping+issues+messageReceipts+messages+taskClosureConfig+tasks,UPSERT,org-member,orgResolver,tasks:complete=orgResolver
+add_repo_mapping,githubRepoMapping,UPSERT,master,masterOnly,githubRepoMapping:add=masterOnly
+remove_repo_mapping,githubRepoMapping,DELETE,master,masterOnly,githubRepoMapping:remove=masterOnly
+link_commit_to_issue,issues,UPDATE,master,masterOnly,issues:linkCommit=masterOnly
+update_issue_status,issues,TRANSITION,master,masterOnly,issues:updateStatus=masterOnly
+verify_issue,issues,TRANSITION,master,masterOnly,issues:verify=masterOnly
+accept_mandate,mandates,TRANSITION,master,masterOnly,mandates:accept=masterOnly
+create_mandate,mandates,CREATE,master,masterOnly,mandates:create=masterOnly
+settle_mandate,mandates,TRANSITION,master,masterOnly,mandates:settle=masterOnly
+update_mandate,mandates+tasks,UPDATE,master,masterOnly,mandates:update=masterOnly
+soft_delete_document,memories,UPDATE,org-member,orgResolver,kb:softDeleteDocument=orgResolver
+store_episode,memories,CREATE,org-member,orgResolver,episodes:storeEpisode=orgResolver
+store_memory,memories,UPSERT,org-member,orgResolver,memories:storeMemory=orgResolver
+mark_as_read,messageReceipts,UPDATE,org-member,orgResolver,messages:markAsRead=orgResolver
+delete_message,messageReceipts+messages,DELETE,org-member,orgResolver,messages:deleteMessage=orgResolver
+add_task_dependency,messageReceipts+messages+missions+taskClosureConfig+tasks,UPSERT,org-member,orgResolver,tasks:update=orgResolver
+block_task,messageReceipts+messages+missions+taskClosureConfig+tasks,UPSERT,org-member,orgResolver,tasks:blockTask=orgResolver; tasks:update=orgResolver
+fail_task,messageReceipts+messages+tasks,UPSERT,org-member,orgResolver,tasks:failTask=orgResolver
+create_mission,missions,CREATE,org-member,orgResolver,missions:create=orgResolver
+update_mission,missions,UPDATE,org-member,orgResolver,missions:update=orgResolver
+update_mission_status,missions,TRANSITION,org-member,orgResolver,missions:updateStatus=orgResolver
+soft_delete_mission_template,missionTemplates,UPDATE,master,masterOnly,missionTemplates:softDelete=masterOnly
+update_mission_template,missionTemplates,UPSERT,master,masterOnly,missionTemplates:upsert=masterOnly
+instantiate_template_into_mission,missionTemplates+missions+tasks,UPSERT,org-member,orgResolver,missionTemplates:instantiateTemplateIntoMission=orgResolver
+add_deployment,monitoredDeployments,UPSERT,master,masterOnly,errorMonitor:addDeployment=masterOnly
+remove_deployment,monitoredDeployments,UPDATE,master,masterOnly,errorMonitor:removeDeployment=masterOnly
+set_summary,profiles,UPSERT,master,masterOnly,profiles:updateDynamic=masterOnly
+update_profile,profiles,UPSERT,master,masterOnly,profiles:upsertProfile=masterOnly
+bulk_complete_tasks,taskClosureConfig+tasks,TRANSITION,org-member,orgResolver,tasks:bulkComplete=orgResolver
+correct_task_segment,taskClosureConfig+tasks,UPDATE,org-member,orgResolver,tasks:correctSegment=orgResolver
+checkout_task,tasks,TRANSITION,org-member,orgResolver,tasks:checkout=orgResolver
+delete_task,tasks,DELETE,org-member,orgResolver,tasks:deleteTask=orgResolver
+pause_task,tasks,TRANSITION,org-member,orgResolver,tasks:pause=orgResolver
+resume_task,tasks,TRANSITION,org-member,orgResolver,tasks:resume=orgResolver
+start_task,tasks,UPDATE,org-member,orgResolver,tasks:start=orgResolver

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/backend-doctor",
-  "version": "0.1.13",
+  "version": "0.2.0",
   "description": "A conformance instrument that measures the VantagePeers backend against the pinned backend standard. The THIRD doctor built ON the @vantageos/mcp-doctor engine — never a third engine. It consumes runDoctor/renderTable and adds only detectors.",
   "type": "module",
   "main": "./dist/cli.js",
@@ -16,7 +16,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && node scripts/stamp-build.mjs",
     "coverage": "tsx src/coverage-cli.ts",
     "doctor": "tsx src/cli.ts",
     "test": "vitest run",