@vibesdotdev/kit 0.0.0-stage → 1.0.0-rc.3

package/dist/lib/server/handles/acting-scope.d.ts

@@ -0,0 +1,14 @@
+export interface ActingScope {
+    userId: string;
+    organizationId: string | null;
+    ownerType: 'user' | 'organization';
+    ownerId: string;
+    secretScope: 'user' | 'org';
+    secretScopeId: string;
+    isPersonalWorkspace: boolean;
+}
+export declare function actingScopeFromLocals(locals: App.Locals): ActingScope;
+export declare function matchesActingOwner(resource: {
+    ownerType: string;
+    ownerId: string;
+}, scope: ReturnType<typeof actingScopeFromLocals>): boolean;

package/dist/lib/server/handles/acting-scope.js

@@ -0,0 +1,27 @@
+import { scopeFromLocals } from './scope.js';
+export function actingScopeFromLocals(locals) {
+    const scope = scopeFromLocals(locals);
+    if (scope.organizationId) {
+        return {
+            userId: scope.userId,
+            organizationId: scope.organizationId,
+            ownerType: 'organization',
+            ownerId: scope.organizationId,
+            secretScope: 'org',
+            secretScopeId: scope.organizationId,
+            isPersonalWorkspace: false
+        };
+    }
+    return {
+        userId: scope.userId,
+        organizationId: null,
+        ownerType: 'user',
+        ownerId: scope.userId,
+        secretScope: 'user',
+        secretScopeId: scope.userId,
+        isPersonalWorkspace: true
+    };
+}
+export function matchesActingOwner(resource, scope) {
+    return resource.ownerType === scope.ownerType && resource.ownerId === scope.ownerId;
+}

package/dist/lib/server/handles/active-org.d.ts

@@ -0,0 +1,93 @@
+/**
+ * createActiveOrgHandle — reads the activeOrg cookie, validates it against
+ * the user's actual memberships (when known), and sets locals.activeOrgId.
+ *
+ * The activeOrg cookie scopes app data queries when set. It represents the
+ * organization the user is currently acting in (different from the user's
+ * memberships — a user can be in many orgs but only acts in one at a time).
+ * When `activeOrgId` is null, the user is acting in their personal workspace
+ * (data isolated to userId), as documented in `scopeFromLocals` /
+ * `actingScopeFromLocals`.
+ *
+ * Cookie validation. If `locals.userContext.organizations` is populated
+ * (i.e. `createUserContextHandle` ran earlier in the chain), this handle
+ * clears the cookie when it points to an org the user is no longer a
+ * member of. Without this step, a stale cookie would keep scoping queries
+ * to an inaccessible org. When `userContext` is null (apps that do not
+ * include `createUserContextHandle`), the cookie is read as-is — those
+ * apps remain responsible for any membership-aware filtering at the data
+ * layer.
+ *
+ * Single-tenant apps that need to *enforce* membership in a specific org
+ * (Casework → Northwind, etc.) layer `createOrgMembershipHandle` after
+ * this one — that handle force-sets `activeOrgId` to the required org and
+ * 403s non-members. This handle is purely read + validate, never enforce.
+ */
+import type { Handle } from '@sveltejs/kit';
+export declare const ACTIVE_ORG_COOKIE_NAME = "activeOrg";
+/**
+ * Non-browser acting-org assertion. API callers that authenticate with a
+ * Bearer JWT (the vibes CLI, agents) have no cookie jar, so without this
+ * header they can only ever act in the personal workspace — org-scoped
+ * mints (registry tokens, org secrets) were browser-only. The header is
+ * validated fail-CLOSED against the caller's memberships (userContext when
+ * loaded, else the TRUSTED JWT `orgs` claim); an unverifiable or non-member
+ * org id is refused with a 403 rather than silently downgraded, because a
+ * caller that explicitly asserted an org must never be quietly rebound to
+ * user-scoped data. The value is Account's canonical organization id.
+ * Constitution: IDENTITY, ORGANIZATION, AND INVENTORY.
+ */
+export declare const ACTIVE_ORG_HEADER_NAME = "x-vibes-active-org";
+/** The cookie attributes `setActiveOrgCookie` writes. */
+interface ActiveOrgCookieOptions {
+    path: string;
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: 'none';
+    maxAge: number;
+    domain?: string;
+}
+/**
+ * Create a handle that reads the activeOrg cookie and populates
+ * event.locals.activeOrgId.
+ *
+ * When `activeOrgId` is null, the user is acting in their personal
+ * workspace (admin bypass, no-org user, or explicitly cleared).
+ * When set, scoped queries should filter by this organizationId.
+ *
+ * @example
+ * ```typescript
+ * import { sequence } from '@sveltejs/kit/hooks';
+ * import { createSessionFetchHandle } from '@vibesdotdev/auth/server/session-handle';
+ * import {
+ *   createActiveOrgHandle,
+ *   createUserContextHandle
+ * } from '../../index.ts/server';
+ *
+ * export const handle = sequence(
+ *   createSessionFetchHandle({ sessionUrl: appLinks.session }),
+ *   createUserContextHandle({ accountOrigin }),
+ *   createActiveOrgHandle()
+ * );
+ * ```
+ */
+export declare function createActiveOrgHandle(): Handle;
+/**
+ * Read the activeOrg cookie value.
+ */
+export declare function readActiveOrgCookie(cookies: {
+    get: (name: string) => string | undefined;
+}): string | null;
+/**
+ * Set the activeOrg cookie.
+ * Call this from UI handlers when the user switches organizations.
+ *
+ * @param orgId - The organizationId to scope to, or null to clear
+ */
+export declare function setActiveOrgCookie(cookies: {
+    get: (name: string) => string | undefined;
+    set: (name: string, value: string, options: ActiveOrgCookieOptions) => void;
+}, orgId: string | null, options?: {
+    domain?: string;
+}): void;
+export {};

package/dist/lib/server/handles/active-org.js

@@ -0,0 +1,175 @@
+/**
+ * createActiveOrgHandle — reads the activeOrg cookie, validates it against
+ * the user's actual memberships (when known), and sets locals.activeOrgId.
+ *
+ * The activeOrg cookie scopes app data queries when set. It represents the
+ * organization the user is currently acting in (different from the user's
+ * memberships — a user can be in many orgs but only acts in one at a time).
+ * When `activeOrgId` is null, the user is acting in their personal workspace
+ * (data isolated to userId), as documented in `scopeFromLocals` /
+ * `actingScopeFromLocals`.
+ *
+ * Cookie validation. If `locals.userContext.organizations` is populated
+ * (i.e. `createUserContextHandle` ran earlier in the chain), this handle
+ * clears the cookie when it points to an org the user is no longer a
+ * member of. Without this step, a stale cookie would keep scoping queries
+ * to an inaccessible org. When `userContext` is null (apps that do not
+ * include `createUserContextHandle`), the cookie is read as-is — those
+ * apps remain responsible for any membership-aware filtering at the data
+ * layer.
+ *
+ * Single-tenant apps that need to *enforce* membership in a specific org
+ * (Casework → Northwind, etc.) layer `createOrgMembershipHandle` after
+ * this one — that handle force-sets `activeOrgId` to the required org and
+ * 403s non-members. This handle is purely read + validate, never enforce.
+ */
+import { DEV } from 'esm-env';
+import { asVibesKitLocals } from '../locals.js';
+import { readJwtOrgIds, readUserContext } from './user-context-schema.js';
+export const ACTIVE_ORG_COOKIE_NAME = 'activeOrg';
+/**
+ * Non-browser acting-org assertion. API callers that authenticate with a
+ * Bearer JWT (the vibes CLI, agents) have no cookie jar, so without this
+ * header they can only ever act in the personal workspace — org-scoped
+ * mints (registry tokens, org secrets) were browser-only. The header is
+ * validated fail-CLOSED against the caller's memberships (userContext when
+ * loaded, else the TRUSTED JWT `orgs` claim); an unverifiable or non-member
+ * org id is refused with a 403 rather than silently downgraded, because a
+ * caller that explicitly asserted an org must never be quietly rebound to
+ * user-scoped data. The value is Account's canonical organization id.
+ * Constitution: IDENTITY, ORGANIZATION, AND INVENTORY.
+ */
+export const ACTIVE_ORG_HEADER_NAME = 'x-vibes-active-org';
+/**
+ * The caller's validated org-membership id set, or `null` when NEITHER
+ * userContext (account-web) nor a JWT `orgs` claim is available to validate
+ * against (legacy token). Header validation treats `null` as fail-closed.
+ */
+function membershipIds(locals) {
+    const orgs = readUserContext(locals)?.organizations;
+    if (orgs) {
+        return new Set(orgs.map((org) => org.id));
+    }
+    const jwtOrgIds = readJwtOrgIds(locals.user);
+    return jwtOrgIds ? new Set(jwtOrgIds) : null;
+}
+function forbiddenActiveOrgResponse() {
+    return new Response(JSON.stringify({
+        error: `The ${ACTIVE_ORG_HEADER_NAME} header names an organization the caller is not a verified member of`
+    }), { status: 403, headers: { 'content-type': 'application/json' } });
+}
+/**
+ * Create a handle that reads the activeOrg cookie and populates
+ * event.locals.activeOrgId.
+ *
+ * When `activeOrgId` is null, the user is acting in their personal
+ * workspace (admin bypass, no-org user, or explicitly cleared).
+ * When set, scoped queries should filter by this organizationId.
+ *
+ * @example
+ * ```typescript
+ * import { sequence } from '@sveltejs/kit/hooks';
+ * import { createSessionFetchHandle } from '@vibesdotdev/auth/server/session-handle';
+ * import {
+ *   createActiveOrgHandle,
+ *   createUserContextHandle
+ * } from '../../index.ts/server';
+ *
+ * export const handle = sequence(
+ *   createSessionFetchHandle({ sessionUrl: appLinks.session }),
+ *   createUserContextHandle({ accountOrigin }),
+ *   createActiveOrgHandle()
+ * );
+ * ```
+ */
+export function createActiveOrgHandle() {
+    return async ({ event, resolve }) => {
+        const locals = asVibesKitLocals(event.locals);
+        if (!locals.user) {
+            locals.activeOrgId = null;
+            return resolve(event);
+        }
+        // An explicit per-request header (non-browser callers) takes precedence
+        // over the ambient cookie. Unlike a stale cookie — silently cleared — an
+        // explicit assertion is validated fail-CLOSED and refused loudly: honoring
+        // it silently as the personal workspace would make the caller act on
+        // user-scoped data while believing it acts as the org.
+        const headerOrgId = event.request.headers.get(ACTIVE_ORG_HEADER_NAME)?.trim();
+        if (headerOrgId) {
+            const members = membershipIds(locals);
+            if (!members || !members.has(headerOrgId)) {
+                return forbiddenActiveOrgResponse();
+            }
+            locals.activeOrgId = headerOrgId;
+            return resolve(event);
+        }
+        const cookieOrgId = readActiveOrgCookie(event.cookies);
+        locals.activeOrgId = cookieOrgId;
+        if (!cookieOrgId) {
+            return resolve(event);
+        }
+        const orgs = readUserContext(locals)?.organizations;
+        if (orgs) {
+            if (!orgs.some((org) => org.id === cookieOrgId)) {
+                // Cookie points to an org the user is not a member of. Clear it so
+                // data-layer scopes fall back to personal workspace instead of
+                // scoping to inaccessible org-owned rows.
+                locals.activeOrgId = null;
+            }
+            return resolve(event);
+        }
+        // userContext not loaded (an app without createUserContextHandle, OR
+        // account-web unreachable — userContext fetch fails OPEN to null). Fall
+        // back to the user's TRUSTED JWT `orgs` claim so a pinned activeOrg can't
+        // WIDEN access for a non-member during an account-web outage. This is the
+        // fail-CLOSED safety net the git-web private-browse gate (and the
+        // resolve/search endpoints that read actingScope directly) rely on. The
+        // org-RBAC work mints `orgs` as `[]` even for non-members, so a current
+        // token always carries the array; only a legacy token with no `orgs` field
+        // at all defers to the data layer (preserving prior behavior).
+        const jwtOrgIds = readJwtOrgIds(locals.user);
+        if (jwtOrgIds && !jwtOrgIds.includes(cookieOrgId)) {
+            locals.activeOrgId = null;
+        }
+        return resolve(event);
+    };
+}
+/**
+ * Read the activeOrg cookie value.
+ */
+export function readActiveOrgCookie(cookies) {
+    const value = cookies.get(ACTIVE_ORG_COOKIE_NAME);
+    return value && value.length > 0 ? value : null;
+}
+/**
+ * Set the activeOrg cookie.
+ * Call this from UI handlers when the user switches organizations.
+ *
+ * @param orgId - The organizationId to scope to, or null to clear
+ */
+export function setActiveOrgCookie(cookies, orgId, options) {
+    const maxAge = 60 * 60 * 24 * 365; // 1 year
+    // active-org is a user's CURRENT WORKSPACE — it must be shared across every
+    // .vibes.dev app, exactly like the session cookie. Callers that know the base
+    // domain (the app, which has it via PUBLIC_VIBES_BASE_DOMAIN) pass it here so
+    // the cookie is `domain=.vibes.dev` and the browser sends it to all subdomains
+    // (chat/platform/git read the same value). Omit `domain` (host-only) only in
+    // local dev where there is no shared parent domain. Clearing (orgId=null) must
+    // also carry the domain, or the cross-subdomain cookie is never removed.
+    // `sameSite: 'none'` REQUIRES `Secure` — browsers silently DROP a SameSite=None
+    // cookie that isn't Secure. When a cross-subdomain `domain` is set we are on a
+    // real HTTPS origin (vibes.dev), so force Secure regardless of how esm-env's
+    // DEV resolves in the worker runtime (it can mis-resolve to true and produce
+    // Secure:false → the cookie is rejected, which is exactly the bug that left
+    // active-org non-functional in prod). Host-only (local dev) keeps `!DEV`.
+    const cookieOptions = {
+        path: '/',
+        httpOnly: true,
+        secure: options?.domain ? true : !DEV,
+        sameSite: 'none',
+        maxAge: orgId ? maxAge : 0
+    };
+    if (options?.domain)
+        cookieOptions.domain = options.domain;
+    cookies.set(ACTIVE_ORG_COOKIE_NAME, orgId ?? '', cookieOptions);
+}

package/dist/lib/server/handles/active-project.d.ts

@@ -0,0 +1,154 @@
+/**
+ * createActiveProjectHandle — reads the activeProject cookie, VALIDATES that
+ * the signed-in user can access that project, and sets locals.activeProjectId.
+ *
+ * The activeProject cookie scopes all app data queries when set. Because many
+ * project-scoped tables use projectId as their ONLY tenant boundary (no
+ * userId column), a cookie value that is trusted verbatim is a cross-tenant
+ * IDOR: a signed-in user could set `activeProject` to a victim's projectId
+ * and read/mutate the victim's rows. This handle therefore never publishes an
+ * unverified cookie value into locals.
+ *
+ * Validation. Project data is owned solely by app-web (see
+ * `@vibesdotdev/projects` — its API client deliberately has no cloud variant).
+ * The default validator asks app-web `GET /api/projects/:id` with the caller's
+ * session bearer: 2xx means the user owns the project, 401/403/404 means
+ * they do not. Results are cached per (userId, projectId) with a TTL so the
+ * hot path (every authenticated request) does at most one subrequest per user
+ * per TTL window per isolate — the same pattern as `createUserContextHandle`.
+ *
+ * Fail-closed. Whenever access cannot be POSITIVELY confirmed (lookup error,
+ * app-web unreachable, non-owner), `locals.activeProjectId` is set to null and
+ * the request proceeds scoped to "All Projects" (the user's own data). A
+ * project-scoping outage must degrade UX, never widen access.
+ *
+ * app-web itself MUST pass `validateProjectAccess` (a direct DB ownership
+ * lookup) instead of the HTTP default — a worker fetching its own public
+ * hostname can be rejected at the edge (self-loopback), and would recurse
+ * through this very handle.
+ *
+ * Runs AFTER sessionHandle (only reads cookie for authenticated users).
+ */
+import type { Handle, RequestEvent } from '@sveltejs/kit';
+import { type VibesKitRuntimePort } from '../locals.js';
+export declare const ACTIVE_PROJECT_COOKIE_NAME = "activeProject";
+type ActiveProjectCookieOptions = {
+    path: string;
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: boolean | 'lax' | 'strict' | 'none';
+    maxAge: number;
+    domain?: string;
+};
+/** Minimal fetcher shape; matches both `globalThis.fetch` and CF service-binding fetchers. */
+export type ProjectAccessFetcher = (input: URL | string | Request, init?: RequestInit) => Promise<Response>;
+export interface ActiveProjectHandleOptions {
+    /**
+     * App-local access check. When provided, it replaces the HTTP lookup
+     * entirely. app-web (the owner of project data) passes a direct DB
+     * ownership lookup here. Must resolve `true` ONLY when the user may access
+     * the project — any error should be thrown (the handle fails closed).
+     */
+    validateProjectAccess?: (input: {
+        userId: string;
+        projectId: string;
+        event: RequestEvent;
+    }) => Promise<boolean>;
+    /**
+     * Origin of the projects API (app-web) used by the default HTTP validator.
+     * A function receives the request's runtime port. Caller overlays win;
+     * otherwise `loadKitConfig(runtime)` supplies the environment catalog
+     * `projects` origin (production `https://app.vibes.dev`). The lookup goes
+     * to the transport the request runtime's declared service names for that
+     * origin (its local dev server's loopback origin in the local tier); an
+     * origin no declared service serves refuses `service-undeclared`, which the
+     * handle treats as an unconfirmed lookup (fail closed).
+     */
+    projectsOrigin?: string | ((runtime: VibesKitRuntimePort) => string | undefined);
+    /**
+     * Optional fetcher for the HTTP validator. When omitted, the handle looks
+     * for a Cloudflare service-binding named `serviceBindingName` (default
+     * `'APP_SERVICE'`) and uses its `.fetch` if found; otherwise global
+     * `fetch`. Pass `null` to force global fetch.
+     */
+    fetcher?: ProjectAccessFetcher | (() => ProjectAccessFetcher | undefined) | null;
+    /** Runtime binding name preferred for the lookup. Default `'APP_SERVICE'`. */
+    serviceBindingName?: string | null;
+    /** Access-cache TTL in milliseconds. Defaults to 60 seconds. */
+    cacheTtlMs?: number;
+}
+/**
+ * Invalidate cached project-access verdicts. Call after mutations that change
+ * access (project archived, ownership transferred). With no arguments, clears
+ * the runtime's whole cache.
+ */
+export declare function invalidateActiveProjectAccess(runtime: VibesKitRuntimePort, userId?: string, projectId?: string): void;
+/**
+ * Ask app-web whether the caller can access the project, presenting the
+ * caller's session bearer. `GET /api/projects/:id` is owner-scoped — 2xx
+ * confirms access, 401/403/404 deny it. Any other status is a lookup failure
+ * and throws — callers must treat a throw as "not confirmed" (fail closed).
+ *
+ * This is the handle's default validator (where it is wrapped in a TTL
+ * cache); it is exported so cookie-SETTING endpoints outside app-web
+ * (hq-web / account-web project switchers) can enforce the same ownership
+ * rule before writing the cross-subdomain cookie.
+ */
+export declare function checkProjectAccessViaProjectsApi(event: RequestEvent, projectId: string, options?: Pick<ActiveProjectHandleOptions, 'projectsOrigin' | 'fetcher' | 'serviceBindingName'>): Promise<boolean>;
+/**
+ * Create a handle that reads the activeProject cookie, validates the user's
+ * access to that project, and populates `event.locals.activeProjectId`.
+ *
+ * When activeProjectId is null, the user is viewing "All Projects" (their full data).
+ * When set to a projectId, queries should be scoped to that project — and this
+ * handle guarantees the value has been checked against the user's own projects.
+ *
+ * @example
+ * ```typescript
+ * import { sequence } from '@sveltejs/kit/hooks';
+ * import { createSessionFetchHandle } from '@vibesdotdev/auth/system/session-handle';
+ * import { createActiveProjectHandle } from '../../index.ts/server';
+ *
+ * export const handle = sequence(
+ *   createSessionFetchHandle({ sessionUrl: accountLinks.session }),
+ *   createActiveProjectHandle()
+ * );
+ * ```
+ */
+export declare function createActiveProjectHandle(options?: ActiveProjectHandleOptions): Handle;
+/**
+ * Read the activeProject cookie value.
+ *
+ * SECURITY: this is the RAW cookie value — attacker-controlled until it has
+ * been validated against the user's projects. Only `createActiveProjectHandle`
+ * (which validates) and cookie-echo endpoints should consume it; never scope a
+ * data query by this value directly.
+ */
+export declare function readActiveProjectCookie(cookies: {
+    get: (name: string) => string | undefined;
+}): string | null;
+/**
+ * Set the activeProject cookie.
+ * Call this from UI handlers when the user switches projects.
+ *
+ * activeProject is a user's CURRENT PROJECT scope and must be shared across every
+ * .vibes.dev app, exactly like the session + `activeOrg` cookies. Callers that
+ * know the base domain (the app, via PUBLIC_VIBES_BASE_DOMAIN) pass it here so
+ * the cookie is `domain=.vibes.dev` and every subdomain sends it. Omit `domain`
+ * (host-only) only in local dev where there is no shared parent domain. Clearing
+ * (projectId=null) must also carry the domain, or the cross-subdomain cookie is
+ * never removed. `sameSite: 'none'` REQUIRES `Secure` — browsers silently DROP a
+ * SameSite=None cookie that isn't Secure. When a cross-subdomain `domain` is set
+ * we are on a real HTTPS origin, so force Secure regardless of how esm-env's DEV
+ * resolves in the worker runtime (it can mis-resolve to true → Secure:false → the
+ * cookie is rejected). Mirrors `setActiveOrgCookie`.
+ *
+ * @param projectId - The projectId to scope to, or null for "All Projects"
+ */
+export declare function setActiveProjectCookie(cookies: {
+    get: (name: string) => string | undefined;
+    set: (name: string, value: string, options: ActiveProjectCookieOptions) => void;
+}, projectId: string | null, options?: {
+    domain?: string;
+}): void;
+export {};