@volter/supercode-teams 0.2.164 → 0.2.166

package/bin/workspace.mjs

@@ -81,14 +81,14 @@ async function appsCommand(verb,sub,{flags,rest,output,team}) {
   const body=()=>{if(!flags.body_file)usage('--body-file is required (use - for stdin)');return JSON.parse(readFileSync(flags.body_file==='-'?0:flags.body_file,'utf8'));};
   if(verb==='apps') {
     if(sub==='catalogue'||sub==='list'){requireArgs(rest,0,0,'teams apps catalogue|list');return output(await team.apps[sub]());}
-    if(sub==='get'||sub==='rotate-secret'){requireArgs(rest,1,1,'teams apps get|rotate-secret APP');return output(await team.apps[sub==='get'?'get':'rotateSecret'](rest[0]));}
+    if(['get','rotate-secret','deregister'].includes(sub)){requireArgs(rest,1,1,'teams apps get|rotate-secret|deregister APP');return output(await team.apps[sub==='rotate-secret'?'rotateSecret':sub](rest[0]));}
     if(sub==='register'){requireArgs(rest,0,0,'teams apps register --body-file FILE');return output(await team.apps.register(body()));}
     if(sub==='install'){requireArgs(rest,1,1,'teams apps install APP --body-file FILE');return output(await team.apps.install(rest[0],body()));}
   } else {
     if(sub==='list'){requireArgs(rest,0,0,'teams app-installations list');return output(await team.appInstallations.list());}
     if(['get','uninstall','delegate'].includes(sub)){requireArgs(rest,1,1,'teams app-installations get|uninstall|delegate INSTALLATION');return output(await team.appInstallations[sub](rest[0],...(sub==='delegate'?[body()]:[])));}
   }
-  usage('teams apps catalogue|list|get|register|install|rotate-secret; app-installations list|get|uninstall|delegate');
+  usage('teams apps catalogue|list|get|register|install|rotate-secret|deregister; app-installations list|get|uninstall|delegate');
 }
 
 async function teamsCommand(verb, sub, { flags, rest, output, client }) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.164",
+  "version": "0.2.166",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",

package/server/event-routes.mjs

@@ -1,3 +1,4 @@
+import { appGrantAllows } from '@volter/teams/server/auth';
 import { appAuthentication } from '@volter/teams/server/apps';
 import { createHash } from 'node:crypto';
 import { validateListQuery } from '../contracts/index.mjs';
@@ -172,7 +173,7 @@ async function catalogWindow(api, auth, query) {
     list.push(grant); grantsBySession.set(grant.session_id, list);
   }
   const readable = (row, seen = new Set()) => {
-    if (!row || seen.has(row.id) || row.deleted_at != null || !row.descriptor_json) return false;
+    if (!row || seen.has(row.id) || row.deleted_at != null || !row.descriptor_json || !appGrantAllows(auth,'session',row.id,'sessions.read')) return false;
     seen.add(row.id);
     const own = row.visibility === 'team' || row.custodian_id === auth.principal_id || (grantsBySession.get(row.id) ?? []).some(grant =>
       (grant.expires_at == null || grant.expires_at > now) &&

package/server/harness-routes.mjs

@@ -28,11 +28,17 @@ import { fail, parseJson, result, send, guardedMutation, requireRevision, checkR
 /** The `sub` a token says it is for, unverified: for a log line only, never for a decision. */
 function unverifiedSubject(token){try{return String(JSON.parse(Buffer.from(String(token).split('.')[1]??'','base64url').toString('utf8')).sub??'').slice(0,80)||'-';}catch{return '-';}}
 
+// URL encoding belongs to the HTTP boundary; native references retain their literal bytes in the store.
+function sessionRef(value) {
+  try { return decodeURIComponent(value); }
+  catch { fail(400, 'invalid_request', 'session reference has invalid URL encoding'); }
+}
+
 async function preAuth({ api, req, res, path, requestId }) {
   let early;
   if(req.method==='POST'&&(early=/^\/api\/v1\/teams\/([^/]+)\/sessions\/([^/]+)\/room-notices$/.exec(path))){
     const access=await delegatedRoomNoticeOf(api,bearer(req.headers.authorization));
-    if(!access || access.teamId!==early[1] || access.sessionRef!==decodeURIComponent(early[2])) fail(401,'authentication_required','authentication required');
+    if(!access || access.teamId!==early[1] || access.sessionRef!==sessionRef(early[2])) fail(401,'authentication_required','authentication required');
     checkRate(api,`room-notices:${access.issuer}:${access.teamId}`,120,10);
     const receipt=await deliverSessionRoomNotice(api,access);
     send(res,200,{data:receipt},requestId);return true;
@@ -46,14 +52,14 @@ async function preAuth({ api, req, res, path, requestId }) {
   if(req.method==='POST'&&(early=/^\/api\/v1\/teams\/([^/]+)\/sessions\/([^/]+)\/viewer-errors$/.exec(path))){
     const presented=bearer(req.headers.authorization)??'';checkRate(api,`viewer-errors:${hashToken(presented)}`,30,10);
     const access=looksDelegated(presented)?await delegatedSessionOf(api,presented):null,body=await parseJson(req).catch(()=>({})),text=(value,limit)=>typeof value==='string'?value.replace(/\s+/g,' ').slice(0,limit):null;
-    console.log(`viewer-error team=${early[1]} session=${decodeURIComponent(early[2]).slice(0,120)} subject=${access?access.subject:`unverified:${text(unverifiedSubject(presented),80)}`} scope=${access?.scope??'-'} room=${access?.room??'-'} stage=${text(body?.stage,40)} status=${Number.isSafeInteger(body?.status)?body.status:'-'} message=${JSON.stringify(text(body?.message,400))}`);
+    console.log(`viewer-error team=${early[1]} session=${sessionRef(early[2]).slice(0,120)} subject=${access?access.subject:`unverified:${text(unverifiedSubject(presented),80)}`} scope=${access?.scope??'-'} room=${access?.room??'-'} stage=${text(body?.stage,40)} status=${Number.isSafeInteger(body?.status)?body.status:'-'} message=${JSON.stringify(text(body?.message,400))}`);
     send(res,204,null,requestId);return true;
   }
   if(req.method==='GET'&&(early=/^\/api\/v1\/teams\/([^/]+)\/sessions\/([^/]+)(\/messages|\/events)?$/.exec(path))&&looksDelegated(bearer(req.headers.authorization))){
     const access=await delegatedSessionOf(api,bearer(req.headers.authorization));
-    const ref=decodeURIComponent(early[2]);
+    const ref=sessionRef(early[2]);
     if(!access||access.teamId!==early[1]||access.sessionRef!==ref){console.log(`session-view refused team=${early[1]} session=${ref.slice(0,120)} subject=${access?access.subject:`unverified:${unverifiedSubject(bearer(req.headers.authorization))}`} reason=${!access?'token not admitted':'token names another session'}`);fail(401,'authentication_required','authentication required');}
-    const auth={kind:'session_view',team_id:early[1],principal_id:null,credential_id:null,bound:{issuer:access.issuer,room:access.room,conversation:access.conversation,expiresAt:access.expiresAt}};
+    const auth={kind:'session_view',team_id:early[1],principal_id:null,credential_id:null,bound:{installationId:access.installationId,installedAt:access.installedAt,issuer:access.issuer,room:access.room,conversation:access.conversation,expiresAt:access.expiresAt}};
     const url=new URL(req.url,'http://local');
     if(!early[3])await sessionDescriptor(api,res,auth,ref,requestId);
     else if(early[3]==='/messages')await readSession(api,res,auth,ref,url,requestId);
@@ -85,18 +91,18 @@ async function team({ api, req, res, auth, url, path, sub, requestId }) {
   if(req.method==='GET'&&sub==='/sessions/search'){await listSessions(api,res,auth,url,requestId,true);return true;}
   if(req.method==='GET'&&sub==='/sessions/events'){await handleCatalogEvents({api,req,res,auth,url,requestId,qobj,canReadMerged,readerProjection,fail});return true;}
   if(req.method==='POST'&&sub==='/correlations'){await correlateRoute(api,req,res,auth,path,requestId);return true;}
-  if(req.method==='GET'&&(m=/^\/sessions\/([^/]+)$/.exec(sub))){await sessionDescriptor(api,res,auth,m[1],requestId);return true;}
-  if((req.method==='PATCH'||req.method==='DELETE')&&(m=/^\/sessions\/([^/]+)$/.exec(sub))){await mutateSession(api,req,res,auth,m[1],requestId);return true;}
-  if(req.method==='GET'&&(m=/^\/sessions\/([^/]+)\/messages$/.exec(sub))){await readSession(api,res,auth,m[1],url,requestId);return true;}
-  if(req.method==='GET'&&(m=/^\/sessions\/([^/]+)\/artifacts\/([^/]+)$/.exec(sub))){await readArtifact(api,req,res,auth,m[1],m[2],requestId);return true;}
-  if(req.method==='POST'&&(m=/^\/sessions\/([^/]+)\/exports$/.exec(sub))){await exportSessionRoute({api,req,res,auth,sessionId:m[1],requestId,parseJson,exact,fail,send,result,guardedMutation});return true;}
-  if(req.method==='POST'&&(m=/^\/sessions\/([^/]+)\/continuations$/.exec(sub))){await continuationRoute({api,req,res,auth,sessionId:m[1],requestId,parseJson,exact,fail,send,result,guardedMutation});return true;}
-  if(req.method==='GET'&&(m=/^\/sessions\/([^/]+)\/events$/.exec(sub))){await handleSessionEvents({api,req,res,auth,id:m[1],url,requestId,resolve,canReadMerged,readerProjection,fail});return true;}
-  if(['GET','POST','DELETE'].includes(req.method)&&(m=/^\/sessions\/([^/]+)\/view-bindings$/.exec(sub))){await viewBindingRoute(api,req,res,auth,m[1],requestId);return true;}
-  if((m=/^\/sessions\/([^/]+)\/access(?:\/([^/]+))?$/.exec(sub))){await accessRoute(api,req,res,auth,m[1],m[2],requestId);return true;}
+  if(req.method==='GET'&&(m=/^\/sessions\/([^/]+)$/.exec(sub))){await sessionDescriptor(api,res,auth,sessionRef(m[1]),requestId);return true;}
+  if((req.method==='PATCH'||req.method==='DELETE')&&(m=/^\/sessions\/([^/]+)$/.exec(sub))){await mutateSession(api,req,res,auth,sessionRef(m[1]),requestId);return true;}
+  if(req.method==='GET'&&(m=/^\/sessions\/([^/]+)\/messages$/.exec(sub))){await readSession(api,res,auth,sessionRef(m[1]),url,requestId);return true;}
+  if(req.method==='GET'&&(m=/^\/sessions\/([^/]+)\/artifacts\/([^/]+)$/.exec(sub))){await readArtifact(api,req,res,auth,sessionRef(m[1]),m[2],requestId);return true;}
+  if(req.method==='POST'&&(m=/^\/sessions\/([^/]+)\/exports$/.exec(sub))){await exportSessionRoute({api,req,res,auth,sessionId:sessionRef(m[1]),requestId,parseJson,exact,fail,send,result,guardedMutation});return true;}
+  if(req.method==='POST'&&(m=/^\/sessions\/([^/]+)\/continuations$/.exec(sub))){await continuationRoute({api,req,res,auth,sessionId:sessionRef(m[1]),requestId,parseJson,exact,fail,send,result,guardedMutation});return true;}
+  if(req.method==='GET'&&(m=/^\/sessions\/([^/]+)\/events$/.exec(sub))){await handleSessionEvents({api,req,res,auth,id:sessionRef(m[1]),url,requestId,resolve,canReadMerged,readerProjection,fail});return true;}
+  if(['GET','POST','DELETE'].includes(req.method)&&(m=/^\/sessions\/([^/]+)\/view-bindings$/.exec(sub))){await viewBindingRoute(api,req,res,auth,sessionRef(m[1]),requestId);return true;}
+  if((m=/^\/sessions\/([^/]+)\/access(?:\/([^/]+))?$/.exec(sub))){await accessRoute(api,req,res,auth,sessionRef(m[1]),m[2],requestId);return true;}
   if((m=/^\/machines\/([^/]+)\/grants(?:\/([^/]+))?$/.exec(sub))){await liveGrantRoute({api,req,res,auth,machineId:m[1],grantId:m[2],url,requestId,parseJson,exact,fail,send,result,guardedMutation,requireRevision});return true;}
   if((m=/^\/machines\/([^/]+)\/effects(?:\/([^/]+)(?:\/(claim|result))?)?$/.exec(sub))){await machineEffectRoute({api,req,res,auth,machineId:m[1],effectId:m[2],action:m[3],url,requestId,parseJson,exact,fail,send,result,guardedMutation});return true;}
-  if(req.method==='POST'&&(m=/^\/sessions\/([^/]+)\/attachments$/.exec(sub))){await createAttachment({api,req,res,auth,sessionId:m[1],requestId,parseJson,exact,fail,send,result,guardedMutation,resolve});return true;}
+  if(req.method==='POST'&&(m=/^\/sessions\/([^/]+)\/attachments$/.exec(sub))){await createAttachment({api,req,res,auth,sessionId:sessionRef(m[1]),requestId,parseJson,exact,fail,send,result,guardedMutation,resolve});return true;}
   if(req.method==='POST'&&(m=/^\/attachments\/([^/]+)\/actions$/.exec(sub))){await attachmentActionRoute({api,req,res,auth,attachmentId:m[1],requestId,parseJson,exact,fail,send,result,guardedMutation,resolve});return true;}
   if(req.method==='DELETE'&&(m=/^\/attachments\/([^/]+)$/.exec(sub))){await detachAttachmentRoute({api,res,auth,attachmentId:m[1],requestId,fail,send,guardedMutation});return true;}
   if(req.method==='GET'&&(m=/^\/operations\/([^/]+)$/.exec(sub))){await operationRoute({api,res,auth,operationId:m[1],requestId,fail,send,result,guardedMutation});return true;}
@@ -159,12 +165,8 @@ async function listSessions(api,res,auth,url,requestId,search){
     {kind:'query',sql:'SELECT * FROM session_grants WHERE team_id=?',params:[auth.team_id]}
   );
   if(cursorKey)statements.push({kind:'query',sql:`SELECT s.*,v.revision version_revision,v.descriptor_json,v.sort_at FROM ${cursorVersions} JOIN session_versions v ON v.team_id=? AND v.session_id=json_extract(j.value,'$[0]') AND v.revision=json_extract(j.value,'$[1]') JOIN sessions s ON s.team_id=v.team_id AND s.id=v.session_id WHERE s.deleted_at IS NULL AND v.revision<>s.revision`,params:[...cursorKey,auth.team_id]});
-  if(search){
-    statements.push({kind:'query',sql:'SELECT m.id,m.session_id,s.revision revision,m.recorded_at,m.search_text FROM sessions s JOIN messages m ON m.team_id=s.team_id AND m.session_id=s.id AND m.revision<=s.revision AND s.revision<COALESCE(m.until_revision,m.revision+1) WHERE s.team_id=? AND s.deleted_at IS NULL',params:[auth.team_id]});
-    if(cursorKey)statements.push({kind:'query',sql:`SELECT m.id,m.session_id,json_extract(j.value,'$[1]') revision,m.recorded_at,m.search_text FROM ${cursorVersions} JOIN messages m ON m.team_id=? AND m.session_id=json_extract(j.value,'$[0]') AND m.revision<=json_extract(j.value,'$[1]') AND json_extract(j.value,'$[1]')<COALESCE(m.until_revision,m.revision+1) JOIN sessions s ON s.team_id=m.team_id AND s.id=m.session_id WHERE s.deleted_at IS NULL AND json_extract(j.value,'$[1]')<>s.revision`,params:[...cursorKey,auth.team_id]});
-  }
   const values=await api.store.snapshot(statements),offset=cursorKey?1:0,cursor=cursorKey?values[0]:null,team=values[offset],credential=values[offset+1],membership=values[offset+2],currentRows=values[offset+3],allGrants=values[offset+4];
-  let at=offset+5;const olderRows=cursorKey?values[at++]:[],allMessages=search?[...values[at++],...(cursorKey?values[at++]:[])]:[];
+  const olderRows=cursorKey?values[offset+5]:[];
   const rows=[...currentRows,...olderRows],currentById=new Map(currentRows.map(row=>[row.id,row]));
   const boundaryNow=api.clock.nowMs();
   if(!membership?.active||credential?.revoked_at!=null||(credential?.expires_at!=null&&credential.expires_at<=boundaryNow))fail(401,'authentication_required','authentication required');
@@ -173,9 +175,8 @@ async function listSessions(api,res,auth,url,requestId,search){
     if(cursor.kind!==(search?'search':'list')||cursor.expires_at<=boundaryNow||cursor.auth_epoch!==team.auth_epoch||canonicalJson(JSON.parse(cursor.query_json))!==canonicalJson(normalizedQuery))fail(409,'resync_required','cursor expired, mismatched, or authorization changed');
     tuples=JSON.parse(cursor.snapshot_json);
   }else tuples=rows.filter(row=>row.revision===row.version_revision).map(row=>[row.id,row.version_revision]);
-  const rowByVersion=new Map(rows.map(row=>[`${row.id}:${row.version_revision}`,row])),grantsBySession=new Map(),messagesByVersion=new Map();
+  const rowByVersion=new Map(rows.map(row=>[`${row.id}:${row.version_revision}`,row])),grantsBySession=new Map();
   for(const grant of allGrants){const list=grantsBySession.get(grant.session_id)??[];list.push(grant);grantsBySession.set(grant.session_id,list);}
-  for(const message of allMessages){const key=`${message.session_id}:${message.revision}`,list=messagesByVersion.get(key)??[];list.push(message);messagesByVersion.set(key,list);}
   const hits=[],hitTuples=[];
   for(const [id,revision]of tuples){
     const row=rowByVersion.get(`${id}:${revision}`),current=currentById.get(id);
@@ -190,7 +191,20 @@ async function listSessions(api,res,auth,url,requestId,search){
     if(query.until!==undefined&&row.sort_at>=query.until)continue;
     if(query.include_children===false&&view.parent_id!==null)continue;
     let hit=view;
-    if(search){const needle=normalizeSearch(query.query.trim()),messages=messagesByVersion.get(`${id}:${revision}`)??[],matches=[],title=normalizeSearch(view.title??'');if(title.includes(needle))matches.push({message_id:null,field:'title',excerpt:title,offset:title.indexOf(needle)});for(const message of messages){const text=normalizeSearch(message.search_text),at=text.indexOf(needle);if(at>=0&&matches.length<3)matches.push({message_id:message.id,field:'content',excerpt:[...text].slice(Math.max(0,at-120),at+needle.length+120).join(''),offset:at});}if(!matches.length)continue;hit={session:view,matches,match_at:Math.max(...messages.map(message=>message.recorded_at??0),row.sort_at),indexed_revision:revision};}
+    if(search){
+      const needle=normalizeSearch(query.query.trim()),matches=[],title=normalizeSearch(view.title??'');
+      if(title.includes(needle))matches.push({message_id:null,field:'title',excerpt:title,offset:[...title.slice(0,title.indexOf(needle))].length});
+      // search_text is normalized on ingestion. SQLite matches the pinned version and returns only three bounded
+      // excerpts; neither nonmatching/private transcripts nor the org's retained text enter the Worker's heap.
+      const found=await api.store.query(`SELECT m.id,instr(m.search_text,?)-1 offset,
+        substr(m.search_text,max(1,instr(m.search_text,?)-120),length(?)+240) excerpt
+        FROM messages m WHERE m.team_id=? AND m.session_id=? AND ${MESSAGE_AT('m')}
+        AND instr(m.search_text,?)>0 ORDER BY m.ordinal,m.id LIMIT ?`,[needle,needle,needle,auth.team_id,id,revision,revision,needle,3-matches.length]);
+      matches.push(...found.map(message=>({message_id:message.id,field:'content',excerpt:message.excerpt,offset:message.offset})));
+      if(!matches.length)continue;
+      const latest=await api.store.one(`SELECT max(recorded_at) at FROM messages m WHERE m.team_id=? AND m.session_id=? AND ${MESSAGE_AT('m')}`,[auth.team_id,id,revision,revision]);
+      hit={session:view,matches,match_at:Math.max(latest?.at??0,row.sort_at),indexed_revision:revision};
+    }
     hits.push(hit);hitTuples.push([id,revision]);
   }
   const limit=query.limit??50,page=hits.slice(0,limit);let next=null;

package/server/store-core.mjs

@@ -7,6 +7,7 @@ import { ingestOtlpBatch, correlateSessions } from './arc2-transactions.mjs';
 import { claimEffect, getEffect, listEffects, reportEffect } from './effects-transactions.mjs';
 import { applyCaptureMessages } from './capture-transactions.mjs';
 import { MIGRATIONS, MESSAGE_AT } from '@volter/teams/server/migrations';
+import { APP_LINEAGE_REVOKED, appGrantAllows } from '@volter/teams/server/auth';
 
 /** Bring a database to the newest schema. `version()`/`setVersion(n)` name where the host records it. */
 export function migrate({ exec, tx, version, setVersion }) {
@@ -26,9 +27,10 @@ export function createStoreHandlers({ all, get, run, tx }) {
     const {teamId,principalId,credentialId,ref,now,bound}=args;
     // `bound`: a workplace's session-view token ({issuer, room, conversation, expiresAt}), which reads only a
     // session its owner bound to that Room and Conversation; it holds no credential and is no member.
-    let membership=null;
+    let membership=null,appFence=null,grantSource=null;
+    if((args.delegationDepth??0)>16)domainError(401,'authentication_required','delegation lineage is too deep');
     if(bound){
-      if(!get(`SELECT 1 FROM app_installations i JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.principal_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE i.team_id=? AND a.issuer=? AND i.state='active' AND a.state='active' AND m.active=1 AND installer.active=1 AND installer.role IN ('owner','admin') AND EXISTS (SELECT 1 FROM json_each(i.actions_json) WHERE value='delegation.sessions')`,[teamId,bound.issuer]))domainError(401,'authentication_required','integration was uninstalled');
+      if(!get(`SELECT 1 FROM app_installations i JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.principal_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE i.team_id=? AND a.issuer=? AND i.id=? AND i.created_at=? AND i.state='active' AND a.state='active' AND m.active=1 AND installer.active=1 AND installer.role IN ('owner','admin') AND EXISTS (SELECT 1 FROM json_each(i.actions_json) WHERE value='delegation.sessions')`,[teamId,bound.issuer,bound.installationId,bound.installedAt]))domainError(401,'authentication_required','integration was uninstalled');
       if(!(bound.expiresAt>now))domainError(401,'authentication_required','authentication required');
     }else{
       const credential=get("SELECT id FROM credentials WHERE id=? AND principal_id=? AND kind IN ('user','service') AND (team_id IS NULL OR team_id=?) AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at>?)",[credentialId,principalId,teamId,now]);
@@ -36,7 +38,12 @@ export function createStoreHandlers({ all, get, run, tx }) {
       const identity=get(`SELECT i.state,a.state app_state,m.active,m.role FROM identity_app_credentials c JOIN app_installations i ON i.id=c.installation_id JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.installer_id WHERE c.credential_id=?`,[credentialId]);
       if(identity&&(identity.state!=='active'||identity.app_state!=='active'||!identity.active||!['owner','admin'].includes(identity.role)))domainError(401,'authentication_required','identity integration revoked');
       const app=get('SELECT ac.*,i.state,a.state app_state,installer.active,installer.role FROM app_credentials ac JOIN app_installations i ON i.id=ac.installation_id JOIN apps a ON a.id=i.app_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE ac.credential_id=?',[credentialId]);
-      if(app){if(app.state!=='active'||app.app_state!=='active'||!app.active||!['owner','admin'].includes(app.role)||!JSON.parse(app.actions_json).includes('sessions.read'))domainError(403,'forbidden','app session read authorization changed');const revoked=get(`WITH RECURSIVE lineage(id,parent_id) AS (SELECT credential_id,parent_id FROM app_credentials WHERE credential_id=? UNION ALL SELECT ac.credential_id,ac.parent_id FROM app_credentials ac JOIN lineage l ON ac.credential_id=l.parent_id) SELECT 1 FROM lineage l JOIN credentials c ON c.id=l.id WHERE c.revoked_at IS NOT NULL OR c.expires_at<=? LIMIT 1`,[credentialId,now]);if(revoked)domainError(401,'authentication_required','parent credential revoked');}
+      if(app){
+        if(app.state!=='active'||app.app_state!=='active'||!app.active||!['owner','admin'].includes(app.role)||!JSON.parse(app.actions_json).includes('sessions.read'))domainError(403,'forbidden','app session read authorization changed');
+        if(get(APP_LINEAGE_REVOKED,[credentialId,now]))domainError(401,'authentication_required','delegation authority revoked');
+        appFence=JSON.parse(app.grants_json);
+        if(appFence!==null)grantSource=get('SELECT id,principal_id FROM credentials WHERE id=?',[app.subject_credential_id??app.parent_id]);
+      }
       if(!credential||!membership)domainError(401,'authentication_required','authentication required');
     }
     if(typeof ref!=='string'||ref.length<8)domainError(404,'not_found','not found');
@@ -57,6 +64,11 @@ export function createStoreHandlers({ all, get, run, tx }) {
       const family=all('WITH RECURSIVE family(id) AS (SELECT ? UNION SELECT s.id FROM sessions s JOIN family f ON s.canonical_id=f.id WHERE s.team_id=?) SELECT s.* FROM sessions s JOIN family f ON f.id=s.id WHERE s.team_id=?',[root.id,teamId,teamId]);
       const readable=bound?Boolean(get('SELECT 1 ok FROM session_view_bindings WHERE team_id=? AND session_id=? AND issuer=? AND room=? AND conversation=?',[teamId,root.id,bound.issuer,bound.room,bound.conversation]))&&family.every(session=>session.deleted_at==null):family.every(session=>{
         if(session.deleted_at!=null)return false;
+        if(!appGrantAllows({app_grants:appFence},'session',session.id,'sessions.read'))return false;
+        if(appFence!==null){
+          if(!grantSource)return false;
+          try{authorizedSession({teamId,principalId:grantSource.principal_id,credentialId:grantSource.id,ref:session.id,now,delegationDepth:(args.delegationDepth??0)+1,projectionDepth:1});}catch{return false;}
+        }
         if(session.visibility==='team'||session.custodian_id===principalId)return true;
         const grants=all('SELECT subject_kind,subject_id,expires_at FROM session_grants WHERE team_id=? AND session_id=?',[teamId,session.id]);
         return grants.some(grant=>(grant.subject_kind==='principal'&&grant.subject_id===principalId||grant.subject_kind==='group'&&groups.includes(grant.subject_id))&&(grant.expires_at==null||grant.expires_at>now));

package/workspace-client.d.ts

@@ -49,11 +49,13 @@ export interface AppInstallation {
   id:string; app_id:string; team_id:string; principal_id:string; installer_id:string;
   actions:string[]; state:'active'|'uninstalled'; created_at:number; uninstalled_at:number|null;
 }
-export interface AppToken { token:string; kind:'service'; expires_at:number; actions:string[]; subject:string; act:string[] }
+export interface AppResourceGrant { kind:'session'; id:string; actions:('sessions.read'|'sessions.write'|'sessions.access')[] }
+export interface AppDelegation { actions:string[]; actor:string; expires_in_ms?:number; principal_id?:string; grants?:AppResourceGrant[]; subject_token?:string }
+export interface AppToken { grants?:AppResourceGrant[]|null; token:string; kind:'service'; expires_at:number; actions:string[]; subject:string; act:string[] }
 export interface AppCodeExchange { version:1; installation:AppInstallation; credential:AppToken; webhook_secret:string }
 export interface TeamClient {
-  apps:{catalogue(options?:RequestOptions):Promise<Result<{actions:string[];event_kinds:string[]}>>;list(options?:RequestOptions):Promise<Page<TeamsApp>>;get(id:string,options?:RequestOptions):Promise<Result<TeamsApp>>;register(body:RegisterTeamsApp,options?:RequestOptions):Promise<Result<TeamsApp & {secret?:string}>>;rotateSecret(id:string,options?:RequestOptions):Promise<Result<{id:string;secret?:string}>>;install(id:string,body:{redirect_url:string;state:string;actions?:string[]},options?:RequestOptions):Promise<Result<{installation:AppInstallation;code?:string;state:string;redirect_url:string;expires_at:number}>>};
-  appInstallations:{list(options?:RequestOptions):Promise<Page<AppInstallation>>;get(id:string,options?:RequestOptions):Promise<Result<AppInstallation>>;uninstall(id:string,options?:RequestOptions):Promise<null>;delegate(id:string,body:{actions:string[];actor:string;expires_in_ms?:number},options?:RequestOptions):Promise<Result<AppToken|null>>};
+  apps:{deregister(id:string,options?:RequestOptions):Promise<null>;catalogue(options?:RequestOptions):Promise<Result<{actions:string[];event_kinds:string[]}>>;list(options?:RequestOptions):Promise<Page<TeamsApp>>;get(id:string,options?:RequestOptions):Promise<Result<TeamsApp>>;register(body:RegisterTeamsApp,options?:RequestOptions):Promise<Result<TeamsApp & {secret?:string}>>;rotateSecret(id:string,options?:RequestOptions):Promise<Result<{id:string;secret?:string}>>;install(id:string,body:{redirect_url:string;state:string;actions?:string[]},options?:RequestOptions):Promise<Result<{installation:AppInstallation;code?:string;state:string;redirect_url:string;expires_at:number}>>};
+  appInstallations:{list(options?:RequestOptions):Promise<Page<AppInstallation>>;get(id:string,options?:RequestOptions):Promise<Result<AppInstallation>>;uninstall(id:string,options?:RequestOptions):Promise<null>;delegate(id:string,body:AppDelegation,options?:RequestOptions):Promise<Result<AppToken|null>>};
   sessions:{list(query?:ListQuery,options?:RequestOptions):Promise<Page<Descriptor>>;search(query:SearchQuery,options?:RequestOptions):Promise<SearchPage>;watch(query?:ListQuery,options?:StreamOptions):AsyncIterable<Event>;get(id:string):SessionClient};
   members:{list(query?:Record<string,unknown>,options?:RequestOptions):Promise<Page<Membership>>;update(id:string,body:{role:Membership['role']},options?:RequestOptions):Promise<Result<Membership>>;remove(id:string,options?:RequestOptions):Promise<null>};
   groups:{list(query?:Record<string,unknown>,options?:RequestOptions):Promise<Page<Group>>;create(body:{name:string},options?:RequestOptions):Promise<Result<Group>>;remove(id:string,options?:RequestOptions):Promise<null>;addMember(groupId:string,memberId:string,options?:RequestOptions):Promise<null>;removeMember(groupId:string,memberId:string,options?:RequestOptions):Promise<null>};

package/workspace-client.mjs

@@ -33,6 +33,7 @@ class TeamClient {
       catalogue: o => get('/apps/catalogue', o),
       list: o => get('/apps', o), get: (id, o) => get(resource('/apps', id), o),
       register: (body, o) => post('/apps', body, o),
+      deregister: (id, o) => remove(resource('/apps', id), o),
       rotateSecret: (id, o) => post(resource('/apps', id) + '/secret', {}, o),
       install: (id, body, o) => post(resource('/apps', id) + '/installations', body, o),
     };