@volter/teams 0.1.1 → 0.1.3

package/admission.mjs

@@ -4,7 +4,8 @@
 // { id, caps, targets } rows from the caller's machine grants (design §11).
 //
 // Targets: `<kind>:<name>` for the kinds a product serves on this machine
-// (the harness: `pane:<contextKey>`, `runtime:<id>`, `root:<path>`, `port:<pane>/<n>`),
+// (the harness: `pane:<contextKey>`, `runtime:<id>`, `root:<path>`, `port:<pane>/<n>`,
+// `mail:<address>` for one session's mailbox),
 // `<kind>:*` for every target of one kind, or `*` (operate and view only).
 // `root:<path>` covers the path and everything under it.
 

package/channel.mjs

@@ -182,10 +182,17 @@ export class Channel extends EventEmitter {
     this._streams = new Map();
     this._nextStream = initiator ? 1 : 2;
     this.closed = false;
+    // A broken channel ends every open stream with the reason, so each caller's
+    // request fails with it; 'error' is emitted only to someone listening for it,
+    // never as an uncaught exception that takes the process down.
+    const failed = (error) => {
+      this.error ??= error;
+      if (this.listenerCount('error') > 0) this.emit('error', error);
+    };
     frameReader(
       socket,
       (frame) => this._onEnvelope(JSON.parse(frame.toString('utf8'))),
-      (error) => this.emit('error', error),
+      failed,
     );
     // The hello left the socket paused with any early frames unshifted; our reader is on now.
     socket.resume();
@@ -196,12 +203,12 @@ export class Channel extends EventEmitter {
       this.closed = true;
       for (const stream of this._streams.values()) {
         stream.closed = true;
-        stream._deliver('close', 'connection closed');
+        stream._deliver('close', this.error ? `connection closed: ${this.error.message}` : 'connection closed');
       }
       this._streams.clear();
       this.emit('close');
     });
-    socket.on('error', (error) => this.emit('error', error));
+    socket.on('error', failed);
   }
 
   _onEnvelope(envelope) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",
@@ -14,6 +14,7 @@
     "./machine-core": "./machine-core.mjs",
     "./home": "./home.mjs",
     "./server/core": "./server/core.mjs",
+    "./server/identity-orgs": "./server/identity-orgs.mjs",
     "./server/http": "./server/http.mjs",
     "./server/auth": "./server/auth.mjs",
     "./server/machine-link": "./server/machine-link.mjs",
@@ -37,7 +38,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@volter/identity": "^0.1.0",
+    "@volter/identity": "^0.3.0",
     "ws": "^8.21.0"
   }
 }

package/server/core.mjs

@@ -13,7 +13,7 @@ const productionIds={next(kind){return `${prefix[kind]??kind}_${randomBytes(16).
 const productionClock={nowMs:()=>Date.now()};
 export { productionIds, productionClock };
 
-export function createTeamsApi({clock=productionClock,ids=productionIds,publicOrigin=null,identityIssuer=null,delegatedIssuer=null,uploadLimitBytes=256*1024*1024}={}) {
+export function createTeamsApi({clock=productionClock,ids=productionIds,publicOrigin=null,identityIssuer=null,identityOrganizations=null,delegatedIssuer=null,uploadLimitBytes=256*1024*1024}={}) {
   // An identity service people may sign in with (protocol P02 federation); its tokens name this server's public origin.
   identityIssuer=normalizePublicOrigin(identityIssuer);
   if(identityIssuer&&!publicOrigin)throw new TypeError('an identity issuer needs the public origin its tokens name');
@@ -24,7 +24,9 @@ export function createTeamsApi({clock=productionClock,ids=productionIds,publicOr
   if(!Number.isSafeInteger(uploadLimitBytes)||uploadLimitBytes<1||uploadLimitBytes>256*1024*1024)throw new TypeError('uploadLimitBytes must be between 1 and 268435456');
   let store=null,serverId=null,localOrigin=null,harnessRoutes=null;
   const events=new TeamEvents();
-  return {clock,ids,events,publicOrigin,identityIssuer,delegatedIssuer,uploadLimitBytes,rateState:new Map(),openStreams:new Map(),securityEvents:[],
+  // Teams linked to organizations the identity service keeps for this server (identity-orgs.mjs).
+  if(identityOrganizations&&!identityIssuer)throw new TypeError('organizations need the identity issuer that keeps them');
+  return {clock,ids,events,publicOrigin,identityIssuer,identityOrganizations,delegatedIssuer,uploadLimitBytes,rateState:new Map(),openStreams:new Map(),securityEvents:[],
     get store(){return store;},get serverId(){return serverId;},get localOrigin(){return localOrigin;},get harnessRoutes(){return harnessRoutes;},
     attach(next){store=next.store??store;if(next.serverId!==undefined)serverId=next.serverId;if(next.localOrigin!==undefined)localOrigin=next.localOrigin;if(next.harnessRoutes!==undefined)harnessRoutes=next.harnessRoutes;},
   };

package/server/http.mjs

@@ -5,6 +5,7 @@ import { machineGrantRoute, machineGrantRows, closeMachineChannels, closeChannel
 import { exact, parseJson as parseRequestJson } from './request-json.mjs';
 import { identityOf } from './identity.mjs';
 import { serveViewer } from './viewer.mjs';
+import { inOrganization, linkedOrganization } from './identity-orgs.mjs';
 
 class HttpError extends Error { constructor(status,code,message,details=null){super(message);this.status=status;this.code=code;this.details=details;} }
 const fail=(status,code,message,details)=>{throw new HttpError(status,code,message,details)};
@@ -136,14 +137,51 @@ async function acceptInvite(api,res,body,requestId){exact(body,['enrollment_code
 async function removeMember(api,req,res,auth,pid,requestId){if(!isAdmin(auth))fail(403,'forbidden','forbidden');const target=await api.store.one('SELECT * FROM memberships WHERE team_id=? AND principal_id=? AND active=1',[auth.team_id,pid]);if(!target)fail(404,'not_found','not found');requireRevision(req,target.revision,'membership');if(target.role==='owner'&&auth.role!=='owner')fail(403,'forbidden','only owners may remove owners');const now=api.clock.nowMs(),guards=[...authGuards(auth,now),{sql:"SELECT 1 ok FROM memberships WHERE team_id=? AND principal_id=? AND active=1 AND revision=? AND (role!='owner' OR (SELECT count(*) FROM memberships WHERE team_id=? AND role='owner' AND active=1)>1)",params:[auth.team_id,pid,target.revision,auth.team_id],code:'conflict',status:409,message:'membership changed or last owner would be removed'}],statements=[{sql:'UPDATE memberships SET active=0,revision=revision+1 WHERE team_id=? AND principal_id=?',params:[auth.team_id,pid]},{sql:'UPDATE credentials SET revoked_at=? WHERE team_id=? AND principal_id=?',params:[now,auth.team_id,pid]},{sql:"UPDATE sources SET state='paused',revision=revision+1 WHERE team_id=? AND custodian_id=? AND state='active'",params:[auth.team_id,pid]},{sql:'UPDATE teams SET auth_epoch=auth_epoch+1 WHERE id=?',params:[auth.team_id]}];await guardedMutation(api,res,auth,guards,statements,{status:204,body:null,targetId:pid});api.events.publish(auth.team_id,{type:'authorization_changed',principal_id:pid});closeChannelsFor(api,auth.team_id,{principalId:pid,reason:'membership_removed'});send(res,204,null,requestId);}
 /** Federation (P02): a verified identity token is a member's sign-in, answered with the same 30-day credential an invitation gives. */
 async function identityLogin(api,res,body,requestId){
-  exact(body,['access_token','team_id']);if(typeof body.team_id!=='string')fail(400,'invalid_request','team_id is required');
+  exact(body,['access_token','team_id']);if(body.team_id!==undefined&&typeof body.team_id!=='string')fail(400,'invalid_request','team_id must be a string');
   const person=await identityOf(api,body.access_token);if(!person)fail(401,'authentication_required','the identity token did not verify');
-  const row=await api.store.one('SELECT p.id principal_id,p.display_name,t.id team_id,t.name team_name,t.revision team_revision FROM principal_identities i JOIN principals p ON p.id=i.principal_id JOIN memberships m ON m.principal_id=p.id AND m.active=1 JOIN teams t ON t.id=m.team_id WHERE i.issuer=? AND i.subject=? AND (t.id=? OR t.name=?)',[person.issuer,person.subject,body.team_id,body.team_id]);
+  // Without a team named, the person's own: the team they are a member of, or else the one whose organization lists
+  // them. Two or more are named back to choose from.
+  if(body.team_id===undefined)body.team_id=await teamOfPerson(api,person);
+  const memberRow=()=>api.store.one('SELECT p.id principal_id,p.display_name,t.id team_id,t.name team_name,t.revision team_revision FROM principal_identities i JOIN principals p ON p.id=i.principal_id JOIN memberships m ON m.principal_id=p.id AND m.active=1 JOIN teams t ON t.id=m.team_id WHERE i.issuer=? AND i.subject=? AND (t.id=? OR t.name=?)',[person.issuer,person.subject,body.team_id,body.team_id]);
+  let row=await memberRow();
+  // A team linked to an organization the identity service keeps for this server admits that organization's members
+  // with no invitation (identity-orgs.mjs): they join as members, exactly as an accepted invitation would add them.
+  if(!row)row=await joinThroughOrganization(api,person,body.team_id)&&await memberRow();
   if(!row)fail(401,'authentication_required','no member of this team is linked to that identity; accept an invitation with it, or link it while signed in');
   const now=api.clock.nowMs(),cid=api.ids.next('credential'),token=makeToken(cid);
   await api.store.transaction([{sql:'INSERT INTO credentials(id,token_hash,principal_id,kind,team_id,expires_at,created_at) VALUES (?,?,?,?,?,?,?)',params:[cid,hashToken(token),row.principal_id,'user',null,now+2592000000,now]}]);
   send(res,201,{principal:{id:row.principal_id,kind:'user',display_name:row.display_name},credential:{token,kind:'user',expires_at:now+2592000000},team:{id:row.team_id,name:row.team_name,revision:row.team_revision}},requestId);
 }
+/** The one team a signed-in person belongs to, as a member or through a linked organization. */
+async function teamOfPerson(api,person){
+  const rows=await api.store.query('SELECT t.id,t.name FROM principal_identities i JOIN memberships m ON m.principal_id=i.principal_id AND m.active=1 JOIN teams t ON t.id=m.team_id WHERE i.issuer=? AND i.subject=? ORDER BY t.name',[person.issuer,person.subject]);
+  let teams=rows;
+  if(!teams.length){
+    const linked=[];
+    for(const team of await api.store.query('SELECT id,name FROM teams ORDER BY name',[])){const slug=linkedOrganization(api,team);if(slug&&await inOrganization(api,person.subject,slug))linked.push(team);}
+    teams=linked;
+  }
+  if(teams.length===1)return teams[0].id;
+  if(!teams.length)fail(401,'authentication_required','you are not a member of a team on this server; ask a teammate for an invitation');
+  fail(409,'conflict',`you belong to several teams (${teams.map(t=>t.name).join(', ')}); name one with --team`);
+}
+/** Make `person` a member of team `team` when the team is linked to an organization they belong to; true if joined. */
+async function joinThroughOrganization(api,person,team){
+  const found=await api.store.one('SELECT id,name FROM teams WHERE id=? OR name=?',[team,team]);if(!found)return false;
+  const slug=linkedOrganization(api,found);if(!slug)return false;
+  if(!await inOrganization(api,person.subject,slug))return false;
+  const now=api.clock.nowMs(),linked=await api.store.one('SELECT principal_id FROM principal_identities WHERE issuer=? AND subject=?',[person.issuer,person.subject]);
+  const pid=linked?.principal_id??api.ids.next('user');
+  const statements=[];
+  if(!linked)statements.push({sql:'INSERT INTO principals(id,kind,display_name) VALUES (?,?,?)',params:[pid,'user',person.name??person.email??person.subject]},{sql:'INSERT INTO principal_identities(issuer,subject,principal_id,linked_at) VALUES (?,?,?,?)',params:[person.issuer,person.subject,pid,now]});
+  const member=await api.store.one('SELECT active FROM memberships WHERE team_id=? AND principal_id=?',[found.id,pid]);
+  if(member?.active)return true;
+  // A member removed from the team stays removed: the organization does not bring them back.
+  if(member)return false;
+  statements.push({sql:'INSERT INTO memberships(team_id,principal_id,role) VALUES (?,?,?)',params:[found.id,pid,'member']});
+  await api.store.transaction(statements);
+  return true;
+}
 /** A signed-in member links an identity service's subject to themselves, once per issuer. */
 async function linkIdentity(api,req,res,auth,requestId){
   if(auth.kind!=='user')fail(403,'forbidden','only a user links an identity');
@@ -181,7 +219,11 @@ async function groupRoute(api,req,res,auth,groupId,principalId,url,requestId){
   else{const group=await api.store.one('SELECT revision FROM groups_table WHERE team_id=? AND id=?',[auth.team_id,groupId]);if(!group)fail(404,'not_found','group not found');requireRevision(req,group.revision,'group');guards.push({sql:'SELECT 1 ok FROM groups_table WHERE team_id=? AND id=? AND revision=?',params:[auth.team_id,groupId,group.revision],code:'revision_mismatch',status:409,message:'group revision changed'});statements.push({sql:'DELETE FROM session_grants WHERE team_id=? AND subject_kind=\'group\' AND subject_id=?',params:[auth.team_id,groupId]},{sql:'DELETE FROM group_members WHERE team_id=? AND group_id=?',params:[auth.team_id,groupId]},{sql:'DELETE FROM groups_table WHERE team_id=? AND id=?',params:[auth.team_id,groupId]});}
   statements.push({sql:'UPDATE teams SET auth_epoch=auth_epoch+1 WHERE id=?',params:[auth.team_id]});await guardedMutation(api,res,auth,guards,statements,{status,body:response,targetId:target});api.events.publish(auth.team_id,{type:'authorization_changed',group_id:groupId});if(req.method==='DELETE')closeChannelsFor(api,auth.team_id,{groupId,principalId:principalId??null,reason:'group_changed'});send(res,status,response,requestId);
 }
-async function enroll(api,req,res,auth,requestId){if(auth.role==='viewer')fail(403,'forbidden','viewers cannot enroll machines');const b=await parseJson(req);exact(b,['name','enrollment_key']);if(!b.name||!b.enrollment_key)fail(400,'invalid_request','name and enrollment_key required');let machine=await api.store.one('SELECT m.*,s.id source_id,s.name source_name,s.kind source_kind,s.state source_state,s.visibility,s.revision source_revision,s.last_received_at,s.decoder,s.counters_json,s.last_error FROM machines m JOIN sources s ON s.team_id=m.team_id AND s.machine_id=m.id WHERE m.team_id=? AND m.custodian_id=? AND m.enrollment_key=?',[auth.team_id,auth.principal_id,b.enrollment_key]);if(machine){return send(res,200,result(api,auth,{machine:machineJson(machine,api.clock.nowMs()),source:sourceJson({id:machine.source_id,name:machine.source_name,kind:machine.source_kind,state:machine.source_state,machine_id:machine.id,custodian_id:machine.custodian_id,visibility:machine.visibility,revision:machine.source_revision,last_received_at:machine.last_received_at,decoder:machine.decoder,counters_json:machine.counters_json,last_error:machine.last_error}),credential:null}),requestId);}const mid=api.ids.next('machine'),sid=api.ids.next('source'),cid=api.ids.next('credential'),token=makeToken(cid),now=api.clock.nowMs(),data={machine:{id:mid,name:b.name,custodian_id:auth.principal_id,enrollment:'active',connection:'offline',last_seen_at:null,incarnation_id:null,revision:1},source:{id:sid,name:`${b.name} connector`,kind:'connector',state:'active',machine_id:mid,custodian_id:auth.principal_id,default_visibility:'restricted',revision:1,last_received_at:null,decoder:null},credential:{token,kind:'machine',expires_at:now+2592000000}},response=result(api,auth,data);await guardedMutation(api,res,auth,[...authGuards(auth,now),{sql:'SELECT 1 ok WHERE NOT EXISTS (SELECT 1 FROM sources WHERE team_id=? AND name=?)',params:[auth.team_id,`${b.name} connector`],code:'conflict',status:409,message:`a machine named ${b.name} is already enrolled in this team; enroll this one under another --name`}],[{sql:'INSERT INTO machines(team_id,id,name,custodian_id,enrollment_key) VALUES (?,?,?,?,?)',params:[auth.team_id,mid,b.name,auth.principal_id,b.enrollment_key]},{sql:"INSERT INTO sources(team_id,id,name,kind,machine_id,custodian_id,visibility,state) VALUES (?,?,?,?,?,?,?,'active')",params:[auth.team_id,sid,`${b.name} connector`,'connector',mid,auth.principal_id,'restricted']},{sql:'INSERT INTO credentials(id,token_hash,principal_id,kind,team_id,source_id,machine_id,expires_at,created_at) VALUES (?,?,?,?,?,?,?,?,?)',params:[cid,hashToken(token),auth.principal_id,'machine',auth.team_id,sid,mid,now+2592000000,now]}],{status:201,body:response,targetId:mid});send(res,201,response,requestId);}
+async function enroll(api,req,res,auth,requestId){if(auth.role==='viewer')fail(403,'forbidden','viewers cannot enroll machines');const b=await parseJson(req);exact(b,['name','enrollment_key']);if(!b.name||!b.enrollment_key)fail(400,'invalid_request','name and enrollment_key required');const byKey=()=>api.store.one('SELECT m.*,s.id source_id,s.name source_name,s.kind source_kind,s.state source_state,s.visibility,s.revision source_revision,s.last_received_at,s.decoder,s.counters_json,s.last_error FROM machines m JOIN sources s ON s.team_id=m.team_id AND s.machine_id=m.id WHERE m.team_id=? AND m.custodian_id=? AND m.enrollment_key=?',[auth.team_id,auth.principal_id,b.enrollment_key]);let machine=await byKey();
+  // The same person enrolling a machine of the same name again (a reinstall, a lost home) takes that machine back; the
+  // caller then rotates its credential, as for a machine it already knew.
+  if(!machine){const own=await api.store.one('SELECT id FROM machines WHERE team_id=? AND custodian_id=? AND name=? AND revoked_at IS NULL',[auth.team_id,auth.principal_id,b.name]);if(own){await api.store.transaction([{sql:'UPDATE machines SET enrollment_key=? WHERE team_id=? AND id=?',params:[b.enrollment_key,auth.team_id,own.id]}]);machine=await byKey();}}
+  if(machine){return send(res,200,result(api,auth,{machine:machineJson(machine,api.clock.nowMs()),source:sourceJson({id:machine.source_id,name:machine.source_name,kind:machine.source_kind,state:machine.source_state,machine_id:machine.id,custodian_id:machine.custodian_id,visibility:machine.visibility,revision:machine.source_revision,last_received_at:machine.last_received_at,decoder:machine.decoder,counters_json:machine.counters_json,last_error:machine.last_error}),credential:null}),requestId);}const mid=api.ids.next('machine'),sid=api.ids.next('source'),cid=api.ids.next('credential'),token=makeToken(cid),now=api.clock.nowMs(),data={machine:{id:mid,name:b.name,custodian_id:auth.principal_id,enrollment:'active',connection:'offline',last_seen_at:null,incarnation_id:null,revision:1},source:{id:sid,name:`${b.name} connector`,kind:'connector',state:'active',machine_id:mid,custodian_id:auth.principal_id,default_visibility:'restricted',revision:1,last_received_at:null,decoder:null},credential:{token,kind:'machine',expires_at:now+2592000000}},response=result(api,auth,data);await guardedMutation(api,res,auth,[...authGuards(auth,now),{sql:'SELECT 1 ok WHERE NOT EXISTS (SELECT 1 FROM sources WHERE team_id=? AND name=?)',params:[auth.team_id,`${b.name} connector`],code:'conflict',status:409,message:`a machine named ${b.name} is already enrolled in this team; enroll this one under another --name`}],[{sql:'INSERT INTO machines(team_id,id,name,custodian_id,enrollment_key) VALUES (?,?,?,?,?)',params:[auth.team_id,mid,b.name,auth.principal_id,b.enrollment_key]},{sql:"INSERT INTO sources(team_id,id,name,kind,machine_id,custodian_id,visibility,state) VALUES (?,?,?,?,?,?,?,'active')",params:[auth.team_id,sid,`${b.name} connector`,'connector',mid,auth.principal_id,'restricted']},{sql:'INSERT INTO credentials(id,token_hash,principal_id,kind,team_id,source_id,machine_id,expires_at,created_at) VALUES (?,?,?,?,?,?,?,?,?)',params:[cid,hashToken(token),auth.principal_id,'machine',auth.team_id,sid,mid,now+2592000000,now]}],{status:201,body:response,targetId:mid});send(res,201,response,requestId);}
 const machineJson=(m,now)=>({id:m.id,name:m.name,custodian_id:m.custodian_id,enrollment:m.revoked_at==null?'active':'revoked',connection:m.last_seen_at!=null&&m.last_seen_at+45000>now?'online':'offline',last_seen_at:m.last_seen_at,incarnation_id:m.incarnation_id,host_key_id:m.host_key_id??null,revision:m.revision});
 async function machineAdminRoute(api,req,res,auth,machineId,roots,requestId){
   // Custodians and admins see their machines; a subject holding a live machine grant sees that machine (roots stay custodial).

package/server/identity-orgs.mjs

@@ -0,0 +1,54 @@
+// Joining a team through an identity service's organization (Volter ID ADR-0002): a team may be linked to an
+// organization the identity service keeps for this server, and a person signed in with that service who is a member of
+// it joins the team with no invitation. The identity service's tokens name only the person, so membership is asked
+// through its organizations door with this server's own product credential (a `client_credentials` token for
+// `<issuer>/organizations`, scope `organizations`), which reads only the organizations this product created.
+//
+// Configured by `identityOrganizations: { clientId, clientSecret, teams: { <team id or name>: <organization slug> } }`,
+// from the environment as VOLTER_ORG_CLIENT_ID, VOLTER_ORG_CLIENT_SECRET and VOLTER_TEAM_ORGS (`team=slug,…`).
+
+/** The configuration from the environment, or null when a piece is missing. */
+export function identityOrganizationsFromEnv(env) {
+  const clientId = env.VOLTER_ORG_CLIENT_ID, clientSecret = env.VOLTER_ORG_CLIENT_SECRET, pairs = env.VOLTER_TEAM_ORGS;
+  if (!clientId || !clientSecret || !pairs) return null;
+  const teams = {};
+  for (const pair of String(pairs).split(',')) {
+    const [team, slug] = pair.split('=').map((part) => part?.trim());
+    if (team && slug) teams[team] = slug;
+  }
+  return Object.keys(teams).length ? { clientId, clientSecret, teams } : null;
+}
+
+/** The organization slug a team is linked to, by its id or its name. */
+export function linkedOrganization(api, team) {
+  const teams = api.identityOrganizations?.teams ?? {};
+  return teams[team.id] ?? teams[team.name] ?? null;
+}
+
+async function productToken(api) {
+  const held = api.identityOrganizationToken;
+  if (held && held.expiresAt > api.clock.nowMs() + 60_000) return held.token;
+  const discovery = await (await fetch(`${api.identityIssuer}/.well-known/openid-configuration`)).json();
+  const { clientId, clientSecret } = api.identityOrganizations;
+  const response = await fetch(discovery.token_endpoint, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded', Authorization: `Basic ${btoa(`${clientId}:${clientSecret}`)}` },
+    body: new URLSearchParams({ grant_type: 'client_credentials', scope: 'organizations', resource: `${api.identityIssuer}/organizations` }),
+  });
+  if (!response.ok) throw new Error(`the identity service refused this server's product credential (${response.status})`);
+  const value = await response.json();
+  api.identityOrganizationToken = { token: value.access_token, expiresAt: api.clock.nowMs() + (Number(value.expires_in) || 300) * 1000 };
+  return value.access_token;
+}
+
+/** Whether the identity service's subject is a member of the organization `slug` this product keeps there. */
+export async function inOrganization(api, subject, slug) {
+  if (!api.identityOrganizations || !api.identityIssuer) return false;
+  const token = await productToken(api);
+  const response = await fetch(`${api.identityIssuer}/api/people/${encodeURIComponent(subject)}/organizations`, { headers: { Authorization: `Bearer ${token}` } });
+  if (response.status === 404) return false;
+  if (!response.ok) throw new Error(`the identity service did not answer for that person's organizations (${response.status})`);
+  const value = await response.json();
+  const rows = Array.isArray(value) ? value : Array.isArray(value?.organizations) ? value.organizations : [];
+  return rows.some((row) => row?.slug === slug);
+}

package/server/machine-link.mjs

@@ -19,8 +19,8 @@ import { delegatedAccessOf, delegatedPrincipal, looksDelegated } from './delegat
 
 const LINK_PROTOCOL = 'supercode-machine-link.v1';
 const CHANNEL_PROTOCOL = 'supercode-machine-channel.v1';
-/** The machine daemon's door vocabulary: operate (operator: harness.v1 and launch) and the participant caps its doors check. */
-const CAPS = new Set(['operate', 'view', 'observe', 'interact', 'control', 'files', 'ports']);
+/** The machine daemon's door vocabulary: operate (operator: harness.v1 and launch) and the participant caps its doors check. `mail` writes one message into a session there (`mail:*`, or `mail:<address>` for one session). */
+const CAPS = new Set(['operate', 'view', 'observe', 'interact', 'control', 'files', 'ports', 'mail']);
 // A target is `*` or `<kind>:<name>`. The server checks shape only: which kinds a machine
 // serves is the daemon's business, and a grant on a kind it does not serve covers nothing.
 const TARGET = /^(\*|root:(\*|\/[^\x00-\x1f]{0,4095})|(?!root:)[a-z][a-z0-9-]{0,31}:[^\x00-\x1f]{1,4096})$/;