@vibesdotdev/account 0.0.0-stage → 1.0.0-rc.3

package/dist/server/validate-org-membership.js

@@ -0,0 +1,30 @@
+import { accountValidateOrgMembershipRequestSchema, accountValidateOrgMembershipResponseSchema } from "../api/account.api-client.schemas.js";
+/**
+ * Live org-membership validation against account-web's canonical DB.
+ *
+ * JWT `orgs` claims are a cache minted at token time; a revoked membership
+ * keeps working until the token expires. Mutating boundaries that authorize
+ * through org membership must call this instead of trusting claim-presence.
+ * Throws on transport/wire failure so callers fail CLOSED (503, never a
+ * silent allow); a resolved `null` means "not a member" — deny as revoked.
+ */
+export async function validateActiveOrgMembership(options) {
+    const request = accountValidateOrgMembershipRequestSchema.parse({
+        userId: options.userId,
+        organizationId: options.organizationId
+    });
+    const response = await options.fetch(`${options.origin.replace(/\/+$/, '')}/api/internal/org-membership`, {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+            authorization: `Bearer ${options.token}`
+        },
+        body: JSON.stringify(request)
+    });
+    if (!response.ok) {
+        throw new Error(`Account org-membership validation failed with HTTP ${response.status}`);
+    }
+    const parsed = accountValidateOrgMembershipResponseSchema.parse(await response.json());
+    return parsed.membership;
+}
+//# sourceMappingURL=validate-org-membership.js.map

package/dist/server/validate-org-membership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-org-membership.js","sourceRoot":"","sources":["../../src/server/validate-org-membership.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,yCAAyC,EACzC,0CAA0C,EAE1C,MAAM,sCAAsC,CAAC;AAgB9C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,OAAqC;IAErC,MAAM,OAAO,GAAG,yCAAyC,CAAC,KAAK,CAAC;QAC/D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;KACtC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CACnC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,8BAA8B,EACnE;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC7B,CACD,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,sDAAsD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,MAAM,GAAG,0CAA0C,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,UAAU,CAAC;AAC1B,CAAC"}

package/dist/server/verify-service-org-membership.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Canonical internal-service org-membership verification.
+ *
+ * Both chat-web's `internal-service-identity` handle and ai-web's
+ * `service-run-actor` need the same live check: given a service-delegated
+ * (userId, organizationId) pair, verify against account-web's canonical DB
+ * that the user IS a member of exactly that organization. This module owns the
+ * shared sequence — resolve app origin, resolve the internal-service token
+ * on the invoking runtime, call the source-policy client through the
+ * ACCOUNT_SERVICE binding when present, and apply the membership triple-check
+ * (isMember AND accountId === userId AND organizationId === organizationId).
+ *
+ * The verdict is a status, not an error: callers keep their own HTTP mapping
+ * (chat-web denies with 403, ai-web masks with 404). 'unavailable' means the
+ * check could not be performed (no token, no origin, transport failure) —
+ * callers must fail CLOSED on it.
+ */
+import { type RuntimeRef, type VibesRuntime } from '@vibesdotdev/kernel';
+export type InternalServiceOrgMembershipStatus = 'member' | 'denied' | 'unavailable';
+export declare function verifyInternalServiceOrgMembership(input: {
+    runtime: Pick<VibesRuntime, 'resolveCredential' | 'getBinding' | 'query' | 'hasKind' | 'scope'> & RuntimeRef;
+    organizationId: string;
+    userId: string;
+}): Promise<InternalServiceOrgMembershipStatus>;
+//# sourceMappingURL=verify-service-org-membership.d.ts.map

package/dist/server/verify-service-org-membership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-service-org-membership.d.ts","sourceRoot":"","sources":["../../src/server/verify-service-org-membership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAyC,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKhH,MAAM,MAAM,kCAAkC,GAAG,QAAQ,GAAG,QAAQ,GAAG,aAAa,CAAC;AAarF,wBAAsB,kCAAkC,CAAC,KAAK,EAAE;IAC/D,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,mBAAmB,GAAG,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG,UAAU,CAAC;IAC7G,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,kCAAkC,CAAC,CA4B9C"}

package/dist/server/verify-service-org-membership.js

@@ -0,0 +1,58 @@
+/**
+ * Canonical internal-service org-membership verification.
+ *
+ * Both chat-web's `internal-service-identity` handle and ai-web's
+ * `service-run-actor` need the same live check: given a service-delegated
+ * (userId, organizationId) pair, verify against account-web's canonical DB
+ * that the user IS a member of exactly that organization. This module owns the
+ * shared sequence — resolve app origin, resolve the internal-service token
+ * on the invoking runtime, call the source-policy client through the
+ * ACCOUNT_SERVICE binding when present, and apply the membership triple-check
+ * (isMember AND accountId === userId AND organizationId === organizationId).
+ *
+ * The verdict is a status, not an error: callers keep their own HTTP mapping
+ * (chat-web denies with 403, ai-web masks with 404). 'unavailable' means the
+ * check could not be performed (no token, no origin, transport failure) —
+ * callers must fail CLOSED on it.
+ */
+import { resolveVibesAppOrigin } from '@vibesdotdev/config/environment/resolve-app-origin';
+import { getLogger } from '@vibesdotdev/logging';
+import { CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+import { createOrganizationSourcePolicyClient } from "../organizations/source-policy-client.js";
+import { AccountServiceBindingSchema } from "./account-service-binding.js";
+import { resolveInternalServiceToken } from "./internal-service-token.js";
+async function settleRead(read) {
+    try {
+        return { ok: true, value: await read() };
+    }
+    catch (failure) {
+        return { ok: false, failure };
+    }
+}
+export async function verifyInternalServiceOrgMembership(input) {
+    const serviceToken = await resolveInternalServiceToken(input.runtime);
+    const baseUrl = await resolveVibesAppOrigin('account', input.runtime);
+    if (!serviceToken || !baseUrl)
+        return 'unavailable';
+    const binding = input.runtime.getBinding('ACCOUNT_SERVICE', AccountServiceBindingSchema);
+    const account = createOrganizationSourcePolicyClient({
+        baseUrl,
+        serviceToken,
+        fetch: binding ? binding.fetch.bind(binding) : globalThis.fetch
+    });
+    const checked = await settleRead(() => account.checkMembership(input.organizationId, input.userId));
+    if (!checked.ok) {
+        // 'unavailable' is the declared verdict for a failed check; callers fail closed on it.
+        getLogger('account.server.verify-service-org-membership', input.runtime).warn('verifyServiceOrgMembership: membership check unavailable', {
+            organizationId: input.organizationId,
+            error: valueFreeFailure(CaughtFailureSchema.parse(checked.failure))
+        });
+        return 'unavailable';
+    }
+    const membership = checked.value;
+    const ok = membership.isMember &&
+        membership.accountId === input.userId &&
+        membership.organizationId === input.organizationId;
+    return ok ? 'member' : 'denied';
+}
+//# sourceMappingURL=verify-service-org-membership.js.map

package/dist/server/verify-service-org-membership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-service-org-membership.js","sourceRoot":"","sources":["../../src/server/verify-service-org-membership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,oDAAoD,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAsC,MAAM,qBAAqB,CAAC;AAChH,OAAO,EAAE,oCAAoC,EAAE,MAAM,0CAA0C,CAAC;AAChG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAO1E,KAAK,UAAU,UAAU,CAAI,IAAsB;IAClD,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAIxD;IACA,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC;IAEpD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,oCAAoC,CAAC;QACpD,OAAO;QACP,YAAY;QACZ,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK;KAC/D,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACpG,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,uFAAuF;QACvF,SAAS,CAAC,8CAA8C,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,0DAA0D,EAAE;YACzI,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;SACnE,CAAC,CAAC;QACH,OAAO,aAAa,CAAC;IACtB,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;IAEjC,MAAM,EAAE,GACP,UAAU,CAAC,QAAQ;QACnB,UAAU,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM;QACrC,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjC,CAAC"}