@volter/teams 0.1.8 → 0.1.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",
@@ -38,7 +38,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@volter/identity": "^0.4.0",
+    "@volter/identity": "^0.4.1",
     "ws": "^8.21.0"
   }
 }

package/server/delegated.mjs

@@ -50,6 +50,39 @@ async function issuerKey(api, kid) {
  * target is null, and the caller refuses it exactly as an unknown credential.
  */
 export async function delegatedAccessOf(api, token) {
+  const claims = await verifiedClaims(api, token);
+  if (!claims) return null;
+  const surface = claims.surface;
+  const caps = CAPS[surface?.kind]?.[claims.scope];
+  const config = surface?.config ?? {};
+  if (!caps || typeof config.team !== 'string' || typeof config.machine !== 'string' || typeof config.target !== 'string') return null;
+  const target = surface.kind === 'pane' ? (config.target.startsWith('pane:') ? config.target : null) : (config.target.startsWith('root:/') ? config.target : null);
+  if (!target) return null;
+  return { caps, expiresAt: claims.exp * 1000, issuer: claims.iss, kind: surface.kind, machineId: config.machine, scope: claims.scope, subject: claims.sub, target, teamId: config.team };
+}
+
+/** Longest a session-view token may live, whatever it says: the workplace mints them for minutes. */
+const SESSION_TOKEN_MAX_S = 15 * 60;
+
+/**
+ * What a session-view token admits (RH2 ADR 0008), or null: { subject, issuer, teamId, sessionRef, room, conversation,
+ * scope, expiresAt }. It names one session (by its id or the harness's own) of one team, and the Room and Conversation
+ * viewing it; the server admits it only for a session its owner bound to that Room and Conversation.
+ */
+export async function delegatedSessionOf(api, token) {
+  const claims = await verifiedClaims(api, token);
+  if (!claims) return null;
+  const session = claims.session;
+  if (!session || typeof session.team !== 'string' || typeof session.id !== 'string' || !session.id) return null;
+  if (typeof claims.room !== 'string' || !claims.room || typeof claims.conversation !== 'string' || !claims.conversation) return null;
+  if (!['view', 'control'].includes(claims.scope)) return null;
+  const now = Math.floor(api.clock.nowMs() / 1000);
+  if (claims.exp - now > SESSION_TOKEN_MAX_S || (typeof claims.iat === 'number' && claims.exp - claims.iat > SESSION_TOKEN_MAX_S)) return null;
+  return { conversation: claims.conversation, expiresAt: claims.exp * 1000, issuer: claims.iss, room: claims.room, scope: claims.scope, sessionRef: session.id, subject: claims.sub, teamId: session.team };
+}
+
+/** A token's claims when it is one this server trusts: signed by the issuer's key, for this server, in its lifetime. */
+async function verifiedClaims(api, token) {
   if (!api.delegatedIssuer || !api.publicOrigin || !looksDelegated(token)) return null;
   try {
     const [head, body, signature] = token.split('.');
@@ -64,13 +97,7 @@ export async function delegatedAccessOf(api, token) {
     if (claims.iss !== api.delegatedIssuer || claims.aud !== api.publicOrigin) return null;
     if (typeof claims.exp !== 'number' || claims.exp <= now - SKEW_S || (typeof claims.nbf === 'number' && claims.nbf > now + SKEW_S)) return null;
     if (typeof claims.sub !== 'string' || !claims.sub) return null;
-    const surface = claims.surface;
-    const caps = CAPS[surface?.kind]?.[claims.scope];
-    const config = surface?.config ?? {};
-    if (!caps || typeof config.team !== 'string' || typeof config.machine !== 'string' || typeof config.target !== 'string') return null;
-    const target = surface.kind === 'pane' ? (config.target.startsWith('pane:') ? config.target : null) : (config.target.startsWith('root:/') ? config.target : null);
-    if (!target) return null;
-    return { caps, expiresAt: claims.exp * 1000, issuer: claims.iss, kind: surface.kind, machineId: config.machine, scope: claims.scope, subject: claims.sub, target, teamId: config.team };
+    return claims;
   } catch {
     return null;
   }

package/server/migrations/005.mjs

@@ -0,0 +1,11 @@
+// Schema migration 005 (SQLite DDL), applied in order by store-core migrate().
+export default `-- Schema 5: a session's owner lets one workplace Room's Conversation view it (a session
+-- view, RH2 ADR 0008). A token that workplace signs for that Room and Conversation reads
+-- the session; nothing else reaches it through the token.
+CREATE TABLE session_view_bindings (
+  team_id TEXT NOT NULL, session_id TEXT NOT NULL, issuer TEXT NOT NULL, room TEXT NOT NULL,
+  conversation TEXT NOT NULL, bound_by TEXT NOT NULL, created_at INTEGER NOT NULL,
+  PRIMARY KEY(team_id, session_id, issuer, room, conversation),
+  FOREIGN KEY(team_id, session_id) REFERENCES sessions(team_id, id)
+) STRICT;
+`;

package/server/migrations/index.mjs

@@ -3,4 +3,5 @@ import m001 from './001.mjs';
 import m002 from './002.mjs';
 import m003 from './003.mjs';
 import m004 from './004.mjs';
-export const MIGRATIONS = [m001, m002, m003, m004];
+import m005 from './005.mjs';
+export const MIGRATIONS = [m001, m002, m003, m004, m005];