@volter/supercode-teams 0.2.164 → 0.2.165

package/bin/workspace.mjs

@@ -81,14 +81,14 @@ async function appsCommand(verb,sub,{flags,rest,output,team}) {
   const body=()=>{if(!flags.body_file)usage('--body-file is required (use - for stdin)');return JSON.parse(readFileSync(flags.body_file==='-'?0:flags.body_file,'utf8'));};
   if(verb==='apps') {
     if(sub==='catalogue'||sub==='list'){requireArgs(rest,0,0,'teams apps catalogue|list');return output(await team.apps[sub]());}
-    if(sub==='get'||sub==='rotate-secret'){requireArgs(rest,1,1,'teams apps get|rotate-secret APP');return output(await team.apps[sub==='get'?'get':'rotateSecret'](rest[0]));}
+    if(['get','rotate-secret','deregister'].includes(sub)){requireArgs(rest,1,1,'teams apps get|rotate-secret|deregister APP');return output(await team.apps[sub==='rotate-secret'?'rotateSecret':sub](rest[0]));}
     if(sub==='register'){requireArgs(rest,0,0,'teams apps register --body-file FILE');return output(await team.apps.register(body()));}
     if(sub==='install'){requireArgs(rest,1,1,'teams apps install APP --body-file FILE');return output(await team.apps.install(rest[0],body()));}
   } else {
     if(sub==='list'){requireArgs(rest,0,0,'teams app-installations list');return output(await team.appInstallations.list());}
     if(['get','uninstall','delegate'].includes(sub)){requireArgs(rest,1,1,'teams app-installations get|uninstall|delegate INSTALLATION');return output(await team.appInstallations[sub](rest[0],...(sub==='delegate'?[body()]:[])));}
   }
-  usage('teams apps catalogue|list|get|register|install|rotate-secret; app-installations list|get|uninstall|delegate');
+  usage('teams apps catalogue|list|get|register|install|rotate-secret|deregister; app-installations list|get|uninstall|delegate');
 }
 
 async function teamsCommand(verb, sub, { flags, rest, output, client }) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.164",
+  "version": "0.2.165",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",

package/server/event-routes.mjs

@@ -1,3 +1,4 @@
+import { appGrantAllows } from '@volter/teams/server/auth';
 import { appAuthentication } from '@volter/teams/server/apps';
 import { createHash } from 'node:crypto';
 import { validateListQuery } from '../contracts/index.mjs';
@@ -172,7 +173,7 @@ async function catalogWindow(api, auth, query) {
     list.push(grant); grantsBySession.set(grant.session_id, list);
   }
   const readable = (row, seen = new Set()) => {
-    if (!row || seen.has(row.id) || row.deleted_at != null || !row.descriptor_json) return false;
+    if (!row || seen.has(row.id) || row.deleted_at != null || !row.descriptor_json || !appGrantAllows(auth,'session',row.id,'sessions.read')) return false;
     seen.add(row.id);
     const own = row.visibility === 'team' || row.custodian_id === auth.principal_id || (grantsBySession.get(row.id) ?? []).some(grant =>
       (grant.expires_at == null || grant.expires_at > now) &&

package/server/harness-routes.mjs

@@ -53,7 +53,7 @@ async function preAuth({ api, req, res, path, requestId }) {
     const access=await delegatedSessionOf(api,bearer(req.headers.authorization));
     const ref=decodeURIComponent(early[2]);
     if(!access||access.teamId!==early[1]||access.sessionRef!==ref){console.log(`session-view refused team=${early[1]} session=${ref.slice(0,120)} subject=${access?access.subject:`unverified:${unverifiedSubject(bearer(req.headers.authorization))}`} reason=${!access?'token not admitted':'token names another session'}`);fail(401,'authentication_required','authentication required');}
-    const auth={kind:'session_view',team_id:early[1],principal_id:null,credential_id:null,bound:{issuer:access.issuer,room:access.room,conversation:access.conversation,expiresAt:access.expiresAt}};
+    const auth={kind:'session_view',team_id:early[1],principal_id:null,credential_id:null,bound:{installationId:access.installationId,installedAt:access.installedAt,issuer:access.issuer,room:access.room,conversation:access.conversation,expiresAt:access.expiresAt}};
     const url=new URL(req.url,'http://local');
     if(!early[3])await sessionDescriptor(api,res,auth,ref,requestId);
     else if(early[3]==='/messages')await readSession(api,res,auth,ref,url,requestId);

package/server/store-core.mjs

@@ -7,6 +7,7 @@ import { ingestOtlpBatch, correlateSessions } from './arc2-transactions.mjs';
 import { claimEffect, getEffect, listEffects, reportEffect } from './effects-transactions.mjs';
 import { applyCaptureMessages } from './capture-transactions.mjs';
 import { MIGRATIONS, MESSAGE_AT } from '@volter/teams/server/migrations';
+import { APP_LINEAGE_REVOKED, appGrantAllows } from '@volter/teams/server/auth';
 
 /** Bring a database to the newest schema. `version()`/`setVersion(n)` name where the host records it. */
 export function migrate({ exec, tx, version, setVersion }) {
@@ -26,9 +27,10 @@ export function createStoreHandlers({ all, get, run, tx }) {
     const {teamId,principalId,credentialId,ref,now,bound}=args;
     // `bound`: a workplace's session-view token ({issuer, room, conversation, expiresAt}), which reads only a
     // session its owner bound to that Room and Conversation; it holds no credential and is no member.
-    let membership=null;
+    let membership=null,appFence=null,grantSource=null;
+    if((args.delegationDepth??0)>16)domainError(401,'authentication_required','delegation lineage is too deep');
     if(bound){
-      if(!get(`SELECT 1 FROM app_installations i JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.principal_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE i.team_id=? AND a.issuer=? AND i.state='active' AND a.state='active' AND m.active=1 AND installer.active=1 AND installer.role IN ('owner','admin') AND EXISTS (SELECT 1 FROM json_each(i.actions_json) WHERE value='delegation.sessions')`,[teamId,bound.issuer]))domainError(401,'authentication_required','integration was uninstalled');
+      if(!get(`SELECT 1 FROM app_installations i JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.principal_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE i.team_id=? AND a.issuer=? AND i.id=? AND i.created_at=? AND i.state='active' AND a.state='active' AND m.active=1 AND installer.active=1 AND installer.role IN ('owner','admin') AND EXISTS (SELECT 1 FROM json_each(i.actions_json) WHERE value='delegation.sessions')`,[teamId,bound.issuer,bound.installationId,bound.installedAt]))domainError(401,'authentication_required','integration was uninstalled');
       if(!(bound.expiresAt>now))domainError(401,'authentication_required','authentication required');
     }else{
       const credential=get("SELECT id FROM credentials WHERE id=? AND principal_id=? AND kind IN ('user','service') AND (team_id IS NULL OR team_id=?) AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at>?)",[credentialId,principalId,teamId,now]);
@@ -36,7 +38,12 @@ export function createStoreHandlers({ all, get, run, tx }) {
       const identity=get(`SELECT i.state,a.state app_state,m.active,m.role FROM identity_app_credentials c JOIN app_installations i ON i.id=c.installation_id JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.installer_id WHERE c.credential_id=?`,[credentialId]);
       if(identity&&(identity.state!=='active'||identity.app_state!=='active'||!identity.active||!['owner','admin'].includes(identity.role)))domainError(401,'authentication_required','identity integration revoked');
       const app=get('SELECT ac.*,i.state,a.state app_state,installer.active,installer.role FROM app_credentials ac JOIN app_installations i ON i.id=ac.installation_id JOIN apps a ON a.id=i.app_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE ac.credential_id=?',[credentialId]);
-      if(app){if(app.state!=='active'||app.app_state!=='active'||!app.active||!['owner','admin'].includes(app.role)||!JSON.parse(app.actions_json).includes('sessions.read'))domainError(403,'forbidden','app session read authorization changed');const revoked=get(`WITH RECURSIVE lineage(id,parent_id) AS (SELECT credential_id,parent_id FROM app_credentials WHERE credential_id=? UNION ALL SELECT ac.credential_id,ac.parent_id FROM app_credentials ac JOIN lineage l ON ac.credential_id=l.parent_id) SELECT 1 FROM lineage l JOIN credentials c ON c.id=l.id WHERE c.revoked_at IS NOT NULL OR c.expires_at<=? LIMIT 1`,[credentialId,now]);if(revoked)domainError(401,'authentication_required','parent credential revoked');}
+      if(app){
+        if(app.state!=='active'||app.app_state!=='active'||!app.active||!['owner','admin'].includes(app.role)||!JSON.parse(app.actions_json).includes('sessions.read'))domainError(403,'forbidden','app session read authorization changed');
+        if(get(APP_LINEAGE_REVOKED,[credentialId,now]))domainError(401,'authentication_required','delegation authority revoked');
+        appFence=JSON.parse(app.grants_json);
+        if(appFence!==null)grantSource=get('SELECT id,principal_id FROM credentials WHERE id=?',[app.subject_credential_id??app.parent_id]);
+      }
       if(!credential||!membership)domainError(401,'authentication_required','authentication required');
     }
     if(typeof ref!=='string'||ref.length<8)domainError(404,'not_found','not found');
@@ -57,6 +64,11 @@ export function createStoreHandlers({ all, get, run, tx }) {
       const family=all('WITH RECURSIVE family(id) AS (SELECT ? UNION SELECT s.id FROM sessions s JOIN family f ON s.canonical_id=f.id WHERE s.team_id=?) SELECT s.* FROM sessions s JOIN family f ON f.id=s.id WHERE s.team_id=?',[root.id,teamId,teamId]);
       const readable=bound?Boolean(get('SELECT 1 ok FROM session_view_bindings WHERE team_id=? AND session_id=? AND issuer=? AND room=? AND conversation=?',[teamId,root.id,bound.issuer,bound.room,bound.conversation]))&&family.every(session=>session.deleted_at==null):family.every(session=>{
         if(session.deleted_at!=null)return false;
+        if(!appGrantAllows({app_grants:appFence},'session',session.id,'sessions.read'))return false;
+        if(appFence!==null){
+          if(!grantSource)return false;
+          try{authorizedSession({teamId,principalId:grantSource.principal_id,credentialId:grantSource.id,ref:session.id,now,delegationDepth:(args.delegationDepth??0)+1,projectionDepth:1});}catch{return false;}
+        }
         if(session.visibility==='team'||session.custodian_id===principalId)return true;
         const grants=all('SELECT subject_kind,subject_id,expires_at FROM session_grants WHERE team_id=? AND session_id=?',[teamId,session.id]);
         return grants.some(grant=>(grant.subject_kind==='principal'&&grant.subject_id===principalId||grant.subject_kind==='group'&&groups.includes(grant.subject_id))&&(grant.expires_at==null||grant.expires_at>now));

package/workspace-client.d.ts

@@ -49,11 +49,13 @@ export interface AppInstallation {
   id:string; app_id:string; team_id:string; principal_id:string; installer_id:string;
   actions:string[]; state:'active'|'uninstalled'; created_at:number; uninstalled_at:number|null;
 }
-export interface AppToken { token:string; kind:'service'; expires_at:number; actions:string[]; subject:string; act:string[] }
+export interface AppResourceGrant { kind:'session'; id:string; actions:('sessions.read'|'sessions.write'|'sessions.access')[] }
+export interface AppDelegation { actions:string[]; actor:string; expires_in_ms?:number; principal_id?:string; grants?:AppResourceGrant[]; subject_token?:string }
+export interface AppToken { grants?:AppResourceGrant[]|null; token:string; kind:'service'; expires_at:number; actions:string[]; subject:string; act:string[] }
 export interface AppCodeExchange { version:1; installation:AppInstallation; credential:AppToken; webhook_secret:string }
 export interface TeamClient {
-  apps:{catalogue(options?:RequestOptions):Promise<Result<{actions:string[];event_kinds:string[]}>>;list(options?:RequestOptions):Promise<Page<TeamsApp>>;get(id:string,options?:RequestOptions):Promise<Result<TeamsApp>>;register(body:RegisterTeamsApp,options?:RequestOptions):Promise<Result<TeamsApp & {secret?:string}>>;rotateSecret(id:string,options?:RequestOptions):Promise<Result<{id:string;secret?:string}>>;install(id:string,body:{redirect_url:string;state:string;actions?:string[]},options?:RequestOptions):Promise<Result<{installation:AppInstallation;code?:string;state:string;redirect_url:string;expires_at:number}>>};
-  appInstallations:{list(options?:RequestOptions):Promise<Page<AppInstallation>>;get(id:string,options?:RequestOptions):Promise<Result<AppInstallation>>;uninstall(id:string,options?:RequestOptions):Promise<null>;delegate(id:string,body:{actions:string[];actor:string;expires_in_ms?:number},options?:RequestOptions):Promise<Result<AppToken|null>>};
+  apps:{deregister(id:string,options?:RequestOptions):Promise<null>;catalogue(options?:RequestOptions):Promise<Result<{actions:string[];event_kinds:string[]}>>;list(options?:RequestOptions):Promise<Page<TeamsApp>>;get(id:string,options?:RequestOptions):Promise<Result<TeamsApp>>;register(body:RegisterTeamsApp,options?:RequestOptions):Promise<Result<TeamsApp & {secret?:string}>>;rotateSecret(id:string,options?:RequestOptions):Promise<Result<{id:string;secret?:string}>>;install(id:string,body:{redirect_url:string;state:string;actions?:string[]},options?:RequestOptions):Promise<Result<{installation:AppInstallation;code?:string;state:string;redirect_url:string;expires_at:number}>>};
+  appInstallations:{list(options?:RequestOptions):Promise<Page<AppInstallation>>;get(id:string,options?:RequestOptions):Promise<Result<AppInstallation>>;uninstall(id:string,options?:RequestOptions):Promise<null>;delegate(id:string,body:AppDelegation,options?:RequestOptions):Promise<Result<AppToken|null>>};
   sessions:{list(query?:ListQuery,options?:RequestOptions):Promise<Page<Descriptor>>;search(query:SearchQuery,options?:RequestOptions):Promise<SearchPage>;watch(query?:ListQuery,options?:StreamOptions):AsyncIterable<Event>;get(id:string):SessionClient};
   members:{list(query?:Record<string,unknown>,options?:RequestOptions):Promise<Page<Membership>>;update(id:string,body:{role:Membership['role']},options?:RequestOptions):Promise<Result<Membership>>;remove(id:string,options?:RequestOptions):Promise<null>};
   groups:{list(query?:Record<string,unknown>,options?:RequestOptions):Promise<Page<Group>>;create(body:{name:string},options?:RequestOptions):Promise<Result<Group>>;remove(id:string,options?:RequestOptions):Promise<null>;addMember(groupId:string,memberId:string,options?:RequestOptions):Promise<null>;removeMember(groupId:string,memberId:string,options?:RequestOptions):Promise<null>};

package/workspace-client.mjs

@@ -33,6 +33,7 @@ class TeamClient {
       catalogue: o => get('/apps/catalogue', o),
       list: o => get('/apps', o), get: (id, o) => get(resource('/apps', id), o),
       register: (body, o) => post('/apps', body, o),
+      deregister: (id, o) => remove(resource('/apps', id), o),
       rotateSecret: (id, o) => post(resource('/apps', id) + '/secret', {}, o),
       install: (id, body, o) => post(resource('/apps', id) + '/installations', body, o),
     };