@volter/teams 0.1.4 → 0.1.6

package/README.md

@@ -7,7 +7,7 @@ reached by a team, with no harness in it.
   hash-chained account log, the owner-only local door, one outbound link to a Teams
   server with every stream admitted from the machine's own synced grants, and product
   doors. A product builds on `MachineCore` and registers its own doors by stream name;
-  the harness does (`@volter-ai-dev/supercode-teams`, `machine.mjs`).
+  the harness does (`@volter/supercode-teams`, `machine.mjs`).
 - **Products behind the daemon** (`products.mjs`): a product serving its own kind of
   target writes a receipt; the daemon admits the caller, both sides prove the receipt's
   token without sending it, and messages are relayed.

package/index.mjs

@@ -1,5 +1,5 @@
 // Volter Teams, the neutral team plane (company RFC 0008). A product builds on MachineCore
-// and registers its own doors; the harness is one such product (@volter-ai-dev/supercode-teams).
+// and registers its own doors; the harness is one such product (@volter/supercode-teams).
 export { MachineCore, MACHINE_VERSION } from './machine-core.mjs';
 export { Channel, NODE_PROTOCOL } from './channel.mjs';
 export { holds, targetsCover, admitFromGrants, observesPanes, LOCAL_OPERATOR } from './admission.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",
@@ -38,7 +38,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@volter/identity": "^0.3.1",
+    "@volter/identity": "^0.4.0",
     "ws": "^8.21.0"
   }
 }

package/server/http.mjs

@@ -33,6 +33,7 @@ export function createHttpHandler(api){return async(req,res)=>{const requestId=a
   if(api.harnessRoutes&&await api.harnessRoutes.authed({api,req,res,auth,path,requestId}))return;
   if(req.method==='POST'&&path==='/api/v1/invitations/accept'){checkRate(api,`login:${req.socket.remoteAddress}`,10,5);const body=await parseJson(req);return await acceptInvite(api,res,body,requestId);}
   if(req.method==='POST'&&path==='/api/v1/login/volter'){checkRate(api,`login:${req.socket.remoteAddress}`,10,5);const body=await parseJson(req);return await identityLogin(api,res,body,requestId);}
+  if(req.method==='POST'&&path==='/api/v1/login/volter/teams'){checkRate(api,`login-teams:${req.socket.remoteAddress}`,10,5);const body=await parseJson(req);return await identityTeams(api,res,body,requestId);}
   if(!auth)fail(401,'authentication_required','authentication required');auth.now=api.clock.nowMs();auth.clock=api.clock;
   const bulk=/\/captures\/[^/]+\/parts\/\d+$/.test(path)||/\/uploads\/[^/]+\/chunks\/\d+$/.test(path);checkRate(api,`credential:${auth.credential_id}:${bulk?'bulk':'ordinary'}`,bulk?600:120,bulk?60:30);
   if(req.method==='GET'&&path==='/api/v1/me'){if(!['user','service'].includes(auth.kind))fail(403,'forbidden','credential kind cannot use this operation');const teams=await api.store.query('SELECT t.id,t.name,t.revision,m.role FROM memberships m JOIN teams t ON t.id=m.team_id WHERE m.principal_id=? AND m.active=1 AND (? IS NULL OR m.team_id=?)',[auth.principal_id,auth.team_id,auth.team_id]);return send(res,200,{server_id:api.serverId,principal:{id:auth.principal_id,kind:auth.principal_kind,display_name:auth.display_name},teams:teams.map(x=>({team:{id:x.id,name:x.name,revision:x.revision},role:x.role}))},requestId);}
@@ -154,17 +155,33 @@ async function identityLogin(api,res,body,requestId){
 }
 /** The one team a signed-in person belongs to, as a member or through a linked organization. */
 async function teamOfPerson(api,person){
-  const rows=await api.store.query('SELECT t.id,t.name FROM principal_identities i JOIN memberships m ON m.principal_id=i.principal_id AND m.active=1 JOIN teams t ON t.id=m.team_id WHERE i.issuer=? AND i.subject=? ORDER BY t.name',[person.issuer,person.subject]);
-  let teams=rows;
-  if(!teams.length){
-    const linked=[];
-    for(const team of await api.store.query('SELECT id,name FROM teams ORDER BY name',[])){const slug=linkedOrganization(api,team);if(slug&&await inOrganization(api,person.subject,slug))linked.push(team);}
-    teams=linked;
-  }
+  // A member signs into their own team without the organizations door being asked (or being up).
+  const member=await teamsOfMember(api,person),teams=member.length?member:(await teamsOfPerson(api,person)).linked;
   if(teams.length===1)return teams[0].id;
   if(!teams.length)fail(401,'authentication_required','you are not a member of a team on this server; ask a teammate for an invitation');
   fail(409,'conflict',`you belong to several teams (${teams.map(t=>t.name).join(', ')}); name one with --team`);
 }
+/** The teams a signed-in person may sign in to: those they are a member of, and those linked to an organization they
+ * belong to that they have never left (a member removed from a team stays removed; joinThroughOrganization). */
+async function teamsOfPerson(api,person){
+  const member=await teamsOfMember(api,person);
+  const ever=new Set((await api.store.query('SELECT m.team_id FROM principal_identities i JOIN memberships m ON m.principal_id=i.principal_id WHERE i.issuer=? AND i.subject=?',[person.issuer,person.subject])).map(row=>row.team_id));
+  const linked=[];
+  // An organization the door cannot answer for offers no team: the teams the person is a member of still list.
+  for(const team of await api.store.query('SELECT id,name FROM teams ORDER BY name',[])){if(ever.has(team.id))continue;const slug=linkedOrganization(api,team);if(slug&&await inOrganization(api,person.subject,slug).catch(()=>false))linked.push(team);}
+  return {member,linked};
+}
+/** The teams a signed-in person is an active member of, with their role. */
+function teamsOfMember(api,person){
+  return api.store.query('SELECT t.id,t.name,m.role FROM principal_identities i JOIN memberships m ON m.principal_id=i.principal_id AND m.active=1 JOIN teams t ON t.id=m.team_id WHERE i.issuer=? AND i.subject=? ORDER BY t.name',[person.issuer,person.subject]);
+}
+/** Which teams a verified identity token may sign in to, so a person on several chooses rather than being refused. */
+async function identityTeams(api,res,body,requestId){
+  exact(body,['access_token']);
+  const person=await identityOf(api,body.access_token);if(!person)fail(401,'authentication_required','the identity token did not verify');
+  const {member,linked}=await teamsOfPerson(api,person);
+  send(res,200,{teams:[...member.map(t=>({id:t.id,name:t.name,role:t.role,joined:true})),...linked.map(t=>({id:t.id,name:t.name,role:null,joined:false}))]},requestId);
+}
 /** Make `person` a member of team `team` when the team is linked to an organization they belong to; true if joined. */
 async function joinThroughOrganization(api,person,team){
   const found=await api.store.one('SELECT id,name FROM teams WHERE id=? OR name=?',[team,team]);if(!found)return false;
@@ -226,8 +243,9 @@ async function enroll(api,req,res,auth,requestId){if(auth.role==='viewer')fail(4
   if(machine){return send(res,200,result(api,auth,{machine:machineJson(machine,api.clock.nowMs()),source:sourceJson({id:machine.source_id,name:machine.source_name,kind:machine.source_kind,state:machine.source_state,machine_id:machine.id,custodian_id:machine.custodian_id,visibility:machine.visibility,revision:machine.source_revision,last_received_at:machine.last_received_at,decoder:machine.decoder,counters_json:machine.counters_json,last_error:machine.last_error}),credential:null}),requestId);}const mid=api.ids.next('machine'),sid=api.ids.next('source'),cid=api.ids.next('credential'),token=makeToken(cid),now=api.clock.nowMs(),data={machine:{id:mid,name:b.name,custodian_id:auth.principal_id,enrollment:'active',connection:'offline',last_seen_at:null,incarnation_id:null,revision:1},source:{id:sid,name:`${b.name} connector`,kind:'connector',state:'active',machine_id:mid,custodian_id:auth.principal_id,default_visibility:'restricted',revision:1,last_received_at:null,decoder:null},credential:{token,kind:'machine',expires_at:now+2592000000}},response=result(api,auth,data);await guardedMutation(api,res,auth,[...authGuards(auth,now),{sql:'SELECT 1 ok WHERE NOT EXISTS (SELECT 1 FROM sources WHERE team_id=? AND name=?)',params:[auth.team_id,`${b.name} connector`],code:'conflict',status:409,message:`a machine named ${b.name} is already enrolled in this team; enroll this one under another --name`}],[{sql:'INSERT INTO machines(team_id,id,name,custodian_id,enrollment_key) VALUES (?,?,?,?,?)',params:[auth.team_id,mid,b.name,auth.principal_id,b.enrollment_key]},{sql:"INSERT INTO sources(team_id,id,name,kind,machine_id,custodian_id,visibility,state) VALUES (?,?,?,?,?,?,?,'active')",params:[auth.team_id,sid,`${b.name} connector`,'connector',mid,auth.principal_id,'restricted']},{sql:'INSERT INTO credentials(id,token_hash,principal_id,kind,team_id,source_id,machine_id,expires_at,created_at) VALUES (?,?,?,?,?,?,?,?,?)',params:[cid,hashToken(token),auth.principal_id,'machine',auth.team_id,sid,mid,now+2592000000,now]}],{status:201,body:response,targetId:mid});send(res,201,response,requestId);}
 const machineJson=(m,now)=>({id:m.id,name:m.name,custodian_id:m.custodian_id,enrollment:m.revoked_at==null?'active':'revoked',connection:m.last_seen_at!=null&&m.last_seen_at+45000>now?'online':'offline',last_seen_at:m.last_seen_at,incarnation_id:m.incarnation_id,host_key_id:m.host_key_id??null,revision:m.revision});
 async function machineAdminRoute(api,req,res,auth,machineId,roots,requestId){
-  // Custodians and admins see their machines; a subject holding a live machine grant sees that machine (roots stay custodial).
-  const custody=roots?'(m.custodian_id=? OR ?=1)':'(m.custodian_id=? OR ?=1 OR EXISTS (SELECT 1 FROM machine_grants g WHERE g.team_id=m.team_id AND g.machine_id=m.id AND g.expires_at>? AND g.subject_id IN (SELECT value FROM json_each(?))))',params=roots?[auth.team_id,auth.principal_id,isAdmin(auth)?1:0]:[auth.team_id,auth.principal_id,isAdmin(auth)?1:0,api.clock.nowMs(),JSON.stringify([auth.principal_id,...(auth.group_ids??[])])];
+  // Custodians and admins see their machines, revoked ones included; every member sees the team's active machines,
+  // each of which they can message (the team's standing mail grant, machine-link.mjs). Roots stay custodial.
+  const custody=roots?'(m.custodian_id=? OR ?=1)':'(m.custodian_id=? OR ?=1 OR m.revoked_at IS NULL)',params=[auth.team_id,auth.principal_id,isAdmin(auth)?1:0];
   if(machineId){const machine=await api.store.one(`SELECT m.* FROM machines m WHERE m.team_id=? AND ${custody} AND m.id=?`,[...params,machineId]);if(!machine)fail(404,'not_found','not found');if(roots){const rows=await api.store.query('SELECT value_json FROM machine_roots WHERE team_id=? AND machine_id=? ORDER BY id',[auth.team_id,machineId]);return send(res,200,{version:1,context:{server_id:api.serverId,team_id:auth.team_id,principal_id:auth.principal_id},items:rows.map(row=>JSON.parse(row.value_json)),next_cursor:null},requestId);}return send(res,200,result(api,auth,machineJson(machine,api.clock.nowMs())),requestId,{ETag:`"${machine.revision}"`});}
   const rows=await api.store.query(`SELECT m.* FROM machines m WHERE m.team_id=? AND ${custody} ORDER BY m.name,m.id`,params);send(res,200,{version:1,context:{server_id:api.serverId,team_id:auth.team_id,principal_id:auth.principal_id},items:rows.map(row=>machineJson(row,api.clock.nowMs())),next_cursor:null},requestId);
 }

package/server/machine-link.mjs

@@ -33,10 +33,20 @@ const channels = (api) => api.machineChannels ??= new Set();
 const key = (teamId, machineId) => `${teamId}\0${machineId}`;
 const grantJson = (row) => ({ id: row.id, machine_id: row.machine_id, subject_id: row.subject_id, caps: JSON.parse(row.caps_json), targets: JSON.parse(row.targets_json), issuer_id: row.issuer_id, created_at: row.created_at, expires_at: row.expires_at, revision: row.revision });
 
+/**
+ * Members of a team message each other's sessions without a grant each way, as Claude's own sessions reach one
+ * another: every machine carries the team's standing grant of `mail` on every session there, whose subject is the
+ * team itself, and every active member's claim names it. It grants nothing else, and the machine checks it from its
+ * own synced rows like any grant.
+ */
+export const TEAM_MAIL_GRANT = 'team-mail';
+const teamSubject = (teamId) => `team:${teamId}`;
+const teamMailGrant = (teamId, machineId) => ({ id: TEAM_MAIL_GRANT, machine_id: machineId, subject_id: teamSubject(teamId), caps: ['mail'], targets: ['mail:*'], issuer_id: null, created_at: 0, expires_at: Number.MAX_SAFE_INTEGER, revision: 1 });
+
 /** The unexpired grants of one machine, as its configuration carries them to the machine. */
 export async function machineGrantRows(api, teamId, machineId) {
   const rows = await api.store.query('SELECT * FROM machine_grants WHERE team_id=? AND machine_id=? AND expires_at>? ORDER BY id', [teamId, machineId, api.clock.nowMs()]);
-  return rows.map(grantJson);
+  return [...rows.map(grantJson), teamMailGrant(teamId, machineId)];
 }
 
 /** What the caller may claim on the machine right now, or null (indistinguishable from no machine). */
@@ -53,9 +63,10 @@ async function claimFor(api, auth, machineId) {
   if (machine.custodian_id === auth.principal_id) return { principal: auth.principal_id, groups, custodian: true };
   const subjects = [auth.principal_id, ...groups];
   const rows = await api.store.query(`SELECT id, revision FROM machine_grants WHERE team_id=? AND machine_id=? AND expires_at>? AND subject_id IN (${subjects.map(() => '?').join(',')}) ORDER BY id`, [auth.team_id, machineId, api.clock.nowMs(), ...subjects]);
-  if (!rows.length) return null;
+  // Every member holds the team's standing mail grant (TEAM_MAIL_GRANT) besides their own.
+  const held = [...rows, { id: TEAM_MAIL_GRANT, revision: 1 }];
   // Revisions let the machine notice a grant it holds has changed (rewritten, narrowed) and resync.
-  return { principal: auth.principal_id, groups, grants: rows.map((row) => row.id), revisions: Object.fromEntries(rows.map((row) => [row.id, row.revision])) };
+  return { principal: auth.principal_id, groups: [...groups, teamSubject(auth.team_id)], grants: held.map((row) => row.id), revisions: Object.fromEntries(held.map((row) => [row.id, row.revision])) };
 }
 
 /** Close every channel a member leaving the team, or a group losing a member or being deleted, leaves without its claimed authority. */