@volter/supercode-teams 0.2.59 → 0.2.60

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.59",
+  "version": "0.2.60",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",

package/server/harness-routes.mjs

@@ -20,15 +20,26 @@ import { attachmentStreamRoute, attachmentFramesRoute, closeMachineAttachmentRou
 import { continuationRoute, remoteContinuationArtifactRoute, remoteContinuationRoute } from './continuations.mjs';
 import { fail, parseJson, result, send, guardedMutation, requireRevision, checkRate, grants, syncRuleJson, authGuards } from '@volter/teams/server/http';
 
+/** The `sub` a token says it is for, unverified: for a log line only, never for a decision. */
+function unverifiedSubject(token){try{return String(JSON.parse(Buffer.from(String(token).split('.')[1]??'','base64url').toString('utf8')).sub??'').slice(0,80)||'-';}catch{return '-';}}
+
 async function preAuth({ api, req, res, path, requestId }) {
   let early;
   // A session view (RH2 ADR 0008): a workplace page reads one session with a token its workplace signed for a Room and
   // Conversation, which reaches only a session its owner bound to them (session_view_bindings). A member's own
   // credential takes the ordinary routes below.
+  // A session view that failed in the browser (its read, its follow, its page) reports it here, so the failure is in the
+  // server's log under the member it happened to; a token this server does not admit is logged as unverified.
+  if(req.method==='POST'&&(early=/^\/api\/v1\/teams\/([^/]+)\/sessions\/([^/]+)\/viewer-errors$/.exec(path))){
+    const presented=bearer(req.headers.authorization)??'';checkRate(api,`viewer-errors:${hashToken(presented)}`,30,10);
+    const access=looksDelegated(presented)?await delegatedSessionOf(api,presented):null,body=await parseJson(req).catch(()=>({})),text=(value,limit)=>typeof value==='string'?value.replace(/\s+/g,' ').slice(0,limit):null;
+    console.log(`viewer-error team=${early[1]} session=${decodeURIComponent(early[2]).slice(0,120)} subject=${access?access.subject:`unverified:${text(unverifiedSubject(presented),80)}`} scope=${access?.scope??'-'} room=${access?.room??'-'} stage=${text(body?.stage,40)} status=${Number.isSafeInteger(body?.status)?body.status:'-'} message=${JSON.stringify(text(body?.message,400))}`);
+    send(res,204,null,requestId);return true;
+  }
   if(req.method==='GET'&&(early=/^\/api\/v1\/teams\/([^/]+)\/sessions\/([^/]+)(\/messages|\/events)?$/.exec(path))&&looksDelegated(bearer(req.headers.authorization))){
     const access=await delegatedSessionOf(api,bearer(req.headers.authorization));
     const ref=decodeURIComponent(early[2]);
-    if(!access||access.teamId!==early[1]||access.sessionRef!==ref)fail(401,'authentication_required','authentication required');
+    if(!access||access.teamId!==early[1]||access.sessionRef!==ref){console.log(`session-view refused team=${early[1]} session=${ref.slice(0,120)} subject=${access?access.subject:`unverified:${unverifiedSubject(bearer(req.headers.authorization))}`} reason=${!access?'token not admitted':'token names another session'}`);fail(401,'authentication_required','authentication required');}
     const auth={kind:'session_view',team_id:early[1],principal_id:null,credential_id:null,bound:{issuer:access.issuer,room:access.room,conversation:access.conversation,expiresAt:access.expiresAt}};
     const url=new URL(req.url,'http://local');
     if(!early[3])await sessionDescriptor(api,res,auth,ref,requestId);

package/worker/wrangler.toml

@@ -18,6 +18,10 @@ compatibility_date = "2026-09-01"
 compatibility_flags = ["nodejs_compat"]
 keep_vars = true
 
+# Workers Logs: the Worker's log lines (viewer-error, session-view refused, maintain) kept and searchable after the fact.
+[observability]
+enabled = true
+
 [[durable_objects.bindings]]
 name = "TEAMS_SERVER"
 class_name = "TeamsServer"