@volter/supercode-teams 0.3.20 → 0.3.21

package/bin/teams.mjs

@@ -33,7 +33,7 @@ import { appendFileSync, createWriteStream, readFileSync, writeFileSync } from '
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
-import { noteStep, slowLogPath, timeCommand } from '@volter/supercode-harness-sdk/slow-log';
+import { noteStep, rotatedLogs, slowLogPath, timeCommand } from '@volter/supercode-harness-sdk/slow-log';
 
 // A Windows scheduled task keeps no output (launchd and systemd name log files), so its unit names one here.
 if (process.env.SUPERCODE_TEAMS_LOG) {
@@ -197,7 +197,7 @@ async function main() {
         return at;
       })();
       let text = '';
-      for (const file of [`${slowLogPath()}.1`, slowLogPath()]) {
+      for (const file of [...rotatedLogs(), slowLogPath()]) {
         try { text += readFileSync(file, 'utf8'); } catch (error) { if (error.code !== 'ENOENT') throw error; }
       }
       const groups = new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.3.20",
+  "version": "0.3.21",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",

package/server/harness-routes.mjs

@@ -440,7 +440,7 @@ async function captureCommit(api,req,res,auth,sourceId,captureId,requestId){cons
  */
 async function viewBindingRoute(api,req,res,auth,ref,requestId){
   if(!['user','service'].includes(auth.kind))fail(403,'forbidden','credential cannot bind sessions');
-  const session=await api.store.authorizedSession({teamId:auth.team_id,principalId:auth.principal_id,credentialId:auth.credential_id,ref,now:api.clock.nowMs()});
+  const session=await api.store.authorizedSession({teamId:auth.team_id,principalId:auth.principal_id,credentialId:auth.credential_id,ref,now:api.clock.nowMs(),forInstaller:true});
   const list=async()=>api.store.query('SELECT issuer,room,conversation,bound_by,created_at FROM session_view_bindings WHERE team_id=? AND session_id=? ORDER BY created_at',[auth.team_id,session.id]);
   if(req.method==='GET'){
     const bindings=await list();

package/server/store-core.mjs

@@ -28,7 +28,7 @@ export function createStoreHandlers({ all, get, run, tx }) {
     const {teamId,principalId,credentialId,ref,now,bound}=args;
     // `bound`: a workplace's session-view token ({issuer, room, conversation, expiresAt}), which reads only a
     // session its owner bound to that Room and Conversation; it holds no credential and is no member.
-    let membership=null,appFence=null,grantSource=null,agentGrantSource=null,agentReader=false;
+    let membership=null,appFence=null,grantSource=null,agentGrantSource=null,agentReader=false,installerFor=null;
     if((args.delegationDepth??0)>16)domainError(401,'authentication_required','delegation lineage is too deep');
     if(bound){
       if(!get(`SELECT 1 FROM app_installations i JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.principal_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE i.team_id=? AND a.issuer=? AND i.id=? AND i.created_at=? AND i.state='active' AND a.state='active' AND m.active=1 AND installer.active=1 AND installer.role IN ('owner','admin') AND EXISTS (SELECT 1 FROM json_each(i.actions_json) WHERE value='delegation.sessions')`,[teamId,bound.issuer,bound.installationId,bound.installedAt]))domainError(401,'authentication_required','integration was uninstalled');
@@ -38,11 +38,15 @@ export function createStoreHandlers({ all, get, run, tx }) {
       membership=get('SELECT role FROM memberships WHERE team_id=? AND principal_id=? AND active=1',[teamId,principalId]);
       const identity=get(`SELECT i.state,a.state app_state,m.active,m.role FROM identity_app_credentials c JOIN app_installations i ON i.id=c.installation_id JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.installer_id WHERE c.credential_id=?`,[credentialId]);
       if(identity&&(identity.state!=='active'||identity.app_state!=='active'||!identity.active||!['owner','admin'].includes(identity.role)))domainError(401,'authentication_required','identity integration revoked');
-      const app=get('SELECT ac.*,i.state,a.state app_state,installer.active,installer.role FROM app_credentials ac JOIN app_installations i ON i.id=ac.installation_id JOIN apps a ON a.id=i.app_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE ac.credential_id=?',[credentialId]);
+      const app=get('SELECT ac.*,i.state,i.installer_id,a.state app_state,installer.active,installer.role FROM app_credentials ac JOIN app_installations i ON i.id=ac.installation_id JOIN apps a ON a.id=i.app_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE ac.credential_id=?',[credentialId]);
       if(app){
         if(app.state!=='active'||app.app_state!=='active'||!app.active||!['owner','admin'].includes(app.role)||!JSON.parse(app.actions_json).includes('sessions.read'))domainError(403,'forbidden','app session read authorization changed');
         if(get(APP_LINEAGE_REVOKED,[credentialId,now]))domainError(401,'authentication_required','delegation authority revoked');
         appFence=JSON.parse(app.grants_json);
+        // `forInstaller` (the view-binding route only): an app its installer consented to `sessions.access` reaches the
+        // installer's own sessions to bind them, as that route already lets it act for them (ADR 0034). Every other read,
+        // a transcript, its messages and events, keeps the ordinary grants.
+        if(args.forInstaller&&appFence===null&&JSON.parse(app.actions_json).includes('sessions.access'))installerFor=app.installer_id;
         if(appFence!==null)grantSource=get('SELECT id,principal_id FROM credentials WHERE id=?',[app.subject_credential_id??app.parent_id]);
       }
       if(!credential||!membership)domainError(401,'authentication_required','authentication required');
@@ -72,6 +76,7 @@ export function createStoreHandlers({ all, get, run, tx }) {
       const readable=bound?Boolean(get('SELECT 1 ok FROM session_view_bindings WHERE team_id=? AND session_id=? AND issuer=? AND room=? AND conversation=?',[teamId,root.id,bound.issuer,bound.room,bound.conversation]))&&family.every(session=>session.deleted_at==null):family.every(session=>{
         if(session.deleted_at!=null)return false;
         if(!appGrantAllows({app_grants:appFence},'session',session.id,'sessions.read'))return false;
+        if(installerFor&&session.custodian_id===installerFor)return true;
         if(appFence!==null){
           if(!grantSource)return false;
           try{authorizedSession({teamId,principalId:grantSource.principal_id,credentialId:grantSource.id,ref:session.id,now,delegationDepth:(args.delegationDepth??0)+1,projectionDepth:1});}catch{return false;}