@volter/teams 0.1.5 → 0.1.7

package/README.md

@@ -7,7 +7,7 @@ reached by a team, with no harness in it.
   hash-chained account log, the owner-only local door, one outbound link to a Teams
   server with every stream admitted from the machine's own synced grants, and product
   doors. A product builds on `MachineCore` and registers its own doors by stream name;
-  the harness does (`@volter-ai-dev/supercode-teams`, `machine.mjs`).
+  the harness does (`@volter/supercode-teams`, `machine.mjs`).
 - **Products behind the daemon** (`products.mjs`): a product serving its own kind of
   target writes a receipt; the daemon admits the caller, both sides prove the receipt's
   token without sending it, and messages are relayed.

package/home.mjs

@@ -31,14 +31,19 @@ export function teamsHome(env = process.env) {
   return dir;
 }
 
+/** A Windows named pipe (`\\.\pipe\…`): no file to make, chmod or remove; it vanishes with its last handle. */
+export const isNamedPipe = (path) => /^\\\\[.?]\\pipe\\/i.test(path);
+
 /**
  * A Unix socket path for `name` in `dir`: the path itself when it fits a socket
  * address (104 bytes on macOS, 108 on Linux); otherwise, as tmux does, a
  * per-user directory under /tmp that only this user may enter, with the socket
- * named by a hash of the path it stands for.
+ * named by a hash of the path it stands for. Node on Windows listens only on
+ * named pipes, so there it is always a pipe named by that same hash.
  */
-export function shortSocketPath(dir, name) {
+export function shortSocketPath(dir, name, platform = process.platform) {
   const inside = join(dir, name);
+  if (platform === 'win32') return `\\\\.\\pipe\\supercode-${createHash('sha256').update(inside).digest('hex').slice(0, 24)}`;
   if (Buffer.byteLength(inside) <= 100) return inside;
   const uid = typeof process.getuid === 'function' ? process.getuid() : 'user';
   return join('/tmp', `supercode-machine-${uid}`, `${createHash('sha256').update(inside).digest('hex').slice(0, 24)}.sock`);
@@ -49,6 +54,7 @@ export const machineSocketPath = (home) => shortSocketPath(home, 'machine.sock')
 
 /** The socket's directory exists; the shared /tmp fallback must be ours and admit only us, and anything else there is refused, never adopted. */
 export function ensureSocketDirectory(socketPath) {
+  if (isNamedPipe(socketPath)) return;
   const dir = dirname(socketPath);
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   if (!basename(dir).startsWith('supercode-machine-') || dirname(dir) !== '/tmp') return;

package/index.mjs

@@ -1,5 +1,5 @@
 // Volter Teams, the neutral team plane (company RFC 0008). A product builds on MachineCore
-// and registers its own doors; the harness is one such product (@volter-ai-dev/supercode-teams).
+// and registers its own doors; the harness is one such product (@volter/supercode-teams).
 export { MachineCore, MACHINE_VERSION } from './machine-core.mjs';
 export { Channel, NODE_PROTOCOL } from './channel.mjs';
 export { holds, targetsCover, admitFromGrants, observesPanes, LOCAL_OPERATOR } from './admission.mjs';

package/machine-core.mjs

@@ -15,7 +15,7 @@ import { Channel, NODE_PROTOCOL } from './channel.mjs';
 import { holds, admitFromGrants, LOCAL_OPERATOR } from './admission.mjs';
 import { findProduct, DAEMON_KINDS, PRODUCT_MAX_MESSAGE, productProof, sameSecret } from './products.mjs';
 import { loadOrCreateKeyPair, publicKeyId } from './identity.mjs';
-import { teamsHome, paths, writeJson, readLimits, AccountLog, ensureSocketDirectory } from './home.mjs';
+import { teamsHome, paths, writeJson, readLimits, AccountLog, ensureSocketDirectory, isNamedPipe } from './home.mjs';
 
 export const MACHINE_VERSION = 2;
 const LINK_BACKOFF_MIN_MS = 1_000;
@@ -93,8 +93,9 @@ export class MachineCore extends EventEmitter {
       this.server.once('error', reject);
       this.server.listen(this.socketPath, () => { this.server.off('error', reject); resolveListen(); });
     });
-    // Owner-only: the socket is the local door, and whoever opens it is this OS user.
-    chmodSync(this.socketPath, 0o600);
+    // Owner-only: the socket is the local door, and whoever opens it is this OS user. A named pipe's default
+    // access already admits only its owner (and SYSTEM and Administrators) to connect.
+    if (!isNamedPipe(this.socketPath)) chmodSync(this.socketPath, 0o600);
     this.address = this.socketPath;
     writeJson(this.p.machine, { pid: process.pid, id: this.id, socket: this.socketPath, startedAt: Date.now(), version: MACHINE_VERSION, protocol: NODE_PROTOCOL, floor: this.floor, server: this.link?.server ?? null });
     this.emit('listening', this.socketPath);
@@ -115,7 +116,7 @@ export class MachineCore extends EventEmitter {
     for (const { channel } of this.connections.values()) channel.close();
     this.server?.close();
     await this.afterStop();
-    rmSync(this.socketPath, { force: true });
+    if (!isNamedPipe(this.socketPath)) rmSync(this.socketPath, { force: true });
     if (existsSync(this.p.machine)) rmSync(this.p.machine);
   }
 
@@ -385,13 +386,14 @@ export class MachineCore extends EventEmitter {
 }
 
 async function clearStaleSocket(path) {
-  if (!existsSync(path)) return;
+  // A named pipe has no file to leave behind: only a live daemon holds its name.
+  if (!isNamedPipe(path) && !existsSync(path)) return;
   const live = await new Promise((done) => {
     const probe = netConnect(path);
     probe.once('connect', () => { probe.destroy(); done(true); });
     probe.once('error', () => done(false));
   });
   if (live) throw Object.assign(new Error(`a machine daemon is already serving ${path}`), { code: 'EADDRINUSE' });
-  rmSync(path, { force: true });
+  if (!isNamedPipe(path)) rmSync(path, { force: true });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",
@@ -38,7 +38,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@volter/identity": "^0.3.1",
+    "@volter/identity": "^0.4.0",
     "ws": "^8.21.0"
   }
 }

package/server/http.mjs

@@ -33,6 +33,7 @@ export function createHttpHandler(api){return async(req,res)=>{const requestId=a
   if(api.harnessRoutes&&await api.harnessRoutes.authed({api,req,res,auth,path,requestId}))return;
   if(req.method==='POST'&&path==='/api/v1/invitations/accept'){checkRate(api,`login:${req.socket.remoteAddress}`,10,5);const body=await parseJson(req);return await acceptInvite(api,res,body,requestId);}
   if(req.method==='POST'&&path==='/api/v1/login/volter'){checkRate(api,`login:${req.socket.remoteAddress}`,10,5);const body=await parseJson(req);return await identityLogin(api,res,body,requestId);}
+  if(req.method==='POST'&&path==='/api/v1/login/volter/teams'){checkRate(api,`login-teams:${req.socket.remoteAddress}`,10,5);const body=await parseJson(req);return await identityTeams(api,res,body,requestId);}
   if(!auth)fail(401,'authentication_required','authentication required');auth.now=api.clock.nowMs();auth.clock=api.clock;
   const bulk=/\/captures\/[^/]+\/parts\/\d+$/.test(path)||/\/uploads\/[^/]+\/chunks\/\d+$/.test(path);checkRate(api,`credential:${auth.credential_id}:${bulk?'bulk':'ordinary'}`,bulk?600:120,bulk?60:30);
   if(req.method==='GET'&&path==='/api/v1/me'){if(!['user','service'].includes(auth.kind))fail(403,'forbidden','credential kind cannot use this operation');const teams=await api.store.query('SELECT t.id,t.name,t.revision,m.role FROM memberships m JOIN teams t ON t.id=m.team_id WHERE m.principal_id=? AND m.active=1 AND (? IS NULL OR m.team_id=?)',[auth.principal_id,auth.team_id,auth.team_id]);return send(res,200,{server_id:api.serverId,principal:{id:auth.principal_id,kind:auth.principal_kind,display_name:auth.display_name},teams:teams.map(x=>({team:{id:x.id,name:x.name,revision:x.revision},role:x.role}))},requestId);}
@@ -154,17 +155,33 @@ async function identityLogin(api,res,body,requestId){
 }
 /** The one team a signed-in person belongs to, as a member or through a linked organization. */
 async function teamOfPerson(api,person){
-  const rows=await api.store.query('SELECT t.id,t.name FROM principal_identities i JOIN memberships m ON m.principal_id=i.principal_id AND m.active=1 JOIN teams t ON t.id=m.team_id WHERE i.issuer=? AND i.subject=? ORDER BY t.name',[person.issuer,person.subject]);
-  let teams=rows;
-  if(!teams.length){
-    const linked=[];
-    for(const team of await api.store.query('SELECT id,name FROM teams ORDER BY name',[])){const slug=linkedOrganization(api,team);if(slug&&await inOrganization(api,person.subject,slug))linked.push(team);}
-    teams=linked;
-  }
+  // A member signs into their own team without the organizations door being asked (or being up).
+  const member=await teamsOfMember(api,person),teams=member.length?member:(await teamsOfPerson(api,person)).linked;
   if(teams.length===1)return teams[0].id;
   if(!teams.length)fail(401,'authentication_required','you are not a member of a team on this server; ask a teammate for an invitation');
   fail(409,'conflict',`you belong to several teams (${teams.map(t=>t.name).join(', ')}); name one with --team`);
 }
+/** The teams a signed-in person may sign in to: those they are a member of, and those linked to an organization they
+ * belong to that they have never left (a member removed from a team stays removed; joinThroughOrganization). */
+async function teamsOfPerson(api,person){
+  const member=await teamsOfMember(api,person);
+  const ever=new Set((await api.store.query('SELECT m.team_id FROM principal_identities i JOIN memberships m ON m.principal_id=i.principal_id WHERE i.issuer=? AND i.subject=?',[person.issuer,person.subject])).map(row=>row.team_id));
+  const linked=[];
+  // An organization the door cannot answer for offers no team: the teams the person is a member of still list.
+  for(const team of await api.store.query('SELECT id,name FROM teams ORDER BY name',[])){if(ever.has(team.id))continue;const slug=linkedOrganization(api,team);if(slug&&await inOrganization(api,person.subject,slug).catch(()=>false))linked.push(team);}
+  return {member,linked};
+}
+/** The teams a signed-in person is an active member of, with their role. */
+function teamsOfMember(api,person){
+  return api.store.query('SELECT t.id,t.name,m.role FROM principal_identities i JOIN memberships m ON m.principal_id=i.principal_id AND m.active=1 JOIN teams t ON t.id=m.team_id WHERE i.issuer=? AND i.subject=? ORDER BY t.name',[person.issuer,person.subject]);
+}
+/** Which teams a verified identity token may sign in to, so a person on several chooses rather than being refused. */
+async function identityTeams(api,res,body,requestId){
+  exact(body,['access_token']);
+  const person=await identityOf(api,body.access_token);if(!person)fail(401,'authentication_required','the identity token did not verify');
+  const {member,linked}=await teamsOfPerson(api,person);
+  send(res,200,{teams:[...member.map(t=>({id:t.id,name:t.name,role:t.role,joined:true})),...linked.map(t=>({id:t.id,name:t.name,role:null,joined:false}))]},requestId);
+}
 /** Make `person` a member of team `team` when the team is linked to an organization they belong to; true if joined. */
 async function joinThroughOrganization(api,person,team){
   const found=await api.store.one('SELECT id,name FROM teams WHERE id=? OR name=?',[team,team]);if(!found)return false;