@volter/supercode-teams 0.2.127 → 0.2.128

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.127",
+  "version": "0.2.128",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",

package/server/harness-routes.mjs

@@ -13,7 +13,8 @@ import { captureDigest, captureMessages, handleOtlpRoute, sha256, validateArtifa
 import { handleCatalogEvents, handleSessionEvents, sessionNames } from './event-routes.mjs';
 import { exact } from '@volter/teams/server/request-json';
 import { MESSAGE_AT, OPEN_REVISION } from '@volter/teams/server/migrations';
-import { delegatedSessionOf, looksDelegated } from '@volter/teams/server/delegated';
+import { delegatedRoomNoticeOf, delegatedSessionOf, looksDelegated } from '@volter/teams/server/delegated';
+import { deliverSessionRoomNotice } from '@volter/teams/server/machine-link';
 import { renderSourceCollectorConfig } from './otlp/collector-config.mjs';
 import { attachmentActionRoute, createAttachment, liveGrantRoute, machineEffectRoute } from './effects.mjs';
 import { exportSessionRoute, operationRoute } from './exports.mjs';
@@ -26,6 +27,14 @@ function unverifiedSubject(token){try{return String(JSON.parse(Buffer.from(Strin
 
 async function preAuth({ api, req, res, path, requestId }) {
   let early;
+  if(req.method==='POST'&&(early=/^\/api\/v1\/teams\/([^/]+)\/sessions\/([^/]+)\/room-notices$/.exec(path))){
+    const access=await delegatedRoomNoticeOf(api,bearer(req.headers.authorization));
+    if(!access || access.teamId!==early[1] || access.sessionRef!==decodeURIComponent(early[2])) fail(401,'authentication_required','authentication required');
+    checkRate(api,`room-notices:${access.issuer}:${access.teamId}`,120,10);
+    const receipt=await deliverSessionRoomNotice(api,access);
+    send(res,200,{data:receipt},requestId);return true;
+  }
+
   // A session view (RH2 ADR 0008): a workplace page reads one session with a token its workplace signed for a Room and
   // Conversation, which reaches only a session its owner bound to them (session_view_bindings). A member's own
   // credential takes the ordinary routes below.