@volter/teams 0.1.84 → 0.1.85

package/browser-channel.d.ts

@@ -59,7 +59,7 @@ export declare class TurnDeliveryUnconfirmedError extends Error {
  * does not undo delivery. After acceptance, a lost, invalid or cancelled receipt
  * rejects with TurnDeliveryUnconfirmedError. Reuse the same key when retrying it.
  */
-export function sendBrowserTurn(channel: BrowserChannel, text: string, options?: { turnKey?: string; signal?: AbortSignal }): Promise<BrowserTurnAnswer>;
+export function sendBrowserTurn(channel: BrowserChannel, text: string, options?: { turnKey?: string; target?: { harness: string; session: string }; signal?: AbortSignal }): Promise<BrowserTurnAnswer>;
 
 export interface MailHistoryEntry {
   id: string; from: string; fromName: string; to: string; text: string; at: number;

package/browser-channel.mjs

@@ -178,12 +178,15 @@ export class TurnDeliveryUnconfirmedError extends Error {
  * is free), or `{ code, text }` when it was not delivered; rejects when the machine refuses the stream.
  * `turnKey`: one key per line the person typed, reused when they retry it, so a line the machine took after its
  * first send was given up on is not typed twice (a machine of door vocabulary 3 or later keeps each key once).
+ * `target`: on a machine channel, the session that takes the line (`{ harness, session }`, the session's native
+ * id); a session channel's grant names its session, and needs none.
  * Receipt waits are bounded to thirty seconds and 256 KB. `signal` cancels the
  * wait; neither cancellation nor timeout undoes a turn already accepted.
  */
-export async function sendBrowserTurn(channel, text, { turnKey, signal } = {}) {
+export async function sendBrowserTurn(channel, text, { turnKey, target, signal } = {}) {
   signal?.throwIfAborted();
-  const stream = await channel.open('mail', { request: { op: 'turn', text, ...(turnKey ? { turn_key: String(turnKey) } : {}) } });
+  const named = target ? { harness: String(target.harness), session: String(target.session) } : {};
+  const stream = await channel.open('mail', { request: { op: 'turn', text, ...named, ...(turnKey ? { turn_key: String(turnKey) } : {}) } });
   return new Promise((resolve, reject) => {
     let answer = '', bytes = 0, settled = false;
     const cleanup = () => { clearTimeout(timer); stream.off('data', data); stream.off('close', closed); signal?.removeEventListener('abort', cancelled); };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.1.84",
+  "version": "0.1.85",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/apps.mjs

@@ -153,6 +153,12 @@ export async function installedIssuer(api, issuer, action, teamId = null) {
     WHERE a.issuer=? AND a.state='active' AND i.state='active' AND m.active=1 AND installer.active=1 AND installer.role IN ('owner','admin') AND (? IS NULL OR i.team_id=?) AND EXISTS (SELECT 1 FROM json_each(i.actions_json) WHERE value=?) LIMIT 1`, [issuer, teamId, teamId, action]);
 }
 
+/** Every issuer some team trusts for sign-in (installedIssuer's trust, any team): what a client may offer. */
+export async function identityIssuers(api) {
+  return (await api.store.query(`SELECT DISTINCT a.issuer FROM app_installations i JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.principal_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id
+    WHERE a.issuer IS NOT NULL AND a.state='active' AND i.state='active' AND m.active=1 AND installer.active=1 AND installer.role IN ('owner','admin') AND EXISTS (SELECT 1 FROM json_each(i.actions_json) WHERE value='identity.login') ORDER BY a.issuer`, [])).map(row => row.issuer);
+}
+
 /** Fan-out is durable and transactionally committed with the source mutation. C2 adds resource events. */
 export async function appEventStatements(api, teamId, kind, data, addedDestination = null) {
   const now = api.clock.nowMs(), eventId = api.ids.next('event');

package/server/http.mjs

@@ -1,4 +1,4 @@
-import { appRoute, appPreAuth, appAuthentication, enforceAppScope, appAuthGuards, installedIssuer } from './apps.mjs';
+import { appRoute, appPreAuth, appAuthentication, enforceAppScope, appAuthGuards, installedIssuer, identityIssuers } from './apps.mjs';
 import { machineEventStream } from './machine-events.mjs';
 import { randomBytes } from 'node:crypto';
 import { bearer, hashToken, canManage, isAdmin, makeToken } from './auth.mjs';
@@ -40,13 +40,16 @@ export function createHttpHandler(api){return async(req,res)=>{const requestId=a
   if(req.method==='POST'&&path==='/api/v1/invitations/accept'){checkRate(api,`login:${req.socket.remoteAddress}`,10,5);const body=await parseJson(req);return await acceptInvite(api,res,body,requestId);}
   if(req.method==='POST'&&path==='/api/v1/login/volter'){checkRate(api,`login:${req.socket.remoteAddress}`,10,5);const body=await parseJson(req);return await identityLogin(api,res,body,requestId);}
   if(req.method==='POST'&&path==='/api/v1/login/volter/teams'){checkRate(api,`login-teams:${req.socket.remoteAddress}`,10,5);const body=await parseJson(req);return await identityTeams(api,res,body,requestId);}
+  // How to sign in is public, as a client needs it before it has a credential: the modes this server takes and, for
+  // identity, the issuers some team trusts and the doors that exchange an issuer's token (identity.mjs verifies any
+  // OIDC issuer), so a client follows what is advertised rather than naming a provider.
+  if(req.method==='GET'&&path==='/api/v1/capabilities'){checkRate(api,`capabilities:${req.socket.remoteAddress}`,60,30);const issuers=api.publicOrigin?await identityIssuers(api):[];return send(res,200,{version:1,server_id:api.serverId,protocol:'teams.v1',operations:['catalog','search','read','follow','access','ingest'],auth_modes:['token','invitation','installed-app',...(issuers.length?['identity']:[])],app_token_exchange:'/api/v1/apps/token',...(issuers.length?{identity:{issuers,audience:api.publicOrigin,login:'/api/v1/login/volter',teams:'/api/v1/login/volter/teams'}}:{})},requestId);}
   if(!auth)fail(401,'authentication_required','authentication required');auth.now=api.clock.nowMs();auth.clock=api.clock;
   const bulk=/\/captures\/[^/]+\/parts\/\d+$/.test(path)||/\/uploads\/[^/]+\/chunks\/\d+$/.test(path);// A machine's own credential syncs its live sessions as they change (a capture is a begin and a commit), so it
   // gets the bulk allowance for ordinary requests too; a person's or a service's stays at 120 a minute.
   checkRate(api,`credential:${auth.credential_id}:${bulk?'bulk':'ordinary'}`,bulk||auth.kind==='machine'?600:120,bulk||auth.kind==='machine'?60:30);
   if(req.method==='GET'&&path==='/api/v1/me'){if(!['user','service'].includes(auth.kind))fail(403,'forbidden','credential kind cannot use this operation');const teams=await api.store.query('SELECT t.id,t.name,t.revision,m.role FROM memberships m JOIN teams t ON t.id=m.team_id WHERE m.principal_id=? AND m.active=1 AND (? IS NULL OR m.team_id=?)',[auth.principal_id,auth.team_id,auth.team_id]);return send(res,200,{server_id:api.serverId,principal:{id:auth.principal_id,kind:auth.principal_kind,display_name:auth.display_name},teams:teams.map(x=>({team:{id:x.id,name:x.name,revision:x.revision},role:x.role}))},requestId);}
   if(req.method==='POST'&&path==='/api/v1/me/identities')return await linkIdentity(api,req,res,auth,requestId);
-  if(req.method==='GET'&&path==='/api/v1/capabilities')return send(res,200,{version:1,server_id:api.serverId,protocol:'teams.v1',operations:['catalog','search','read','follow','access','ingest'],auth_modes:['token','invitation','installed-app'],app_token_exchange:'/api/v1/apps/token'},requestId);
   if(req.method==='GET'&&path==='/api/v1/teams')return await listTeams(api,res,auth,url,requestId);
   if(req.method==='POST'&&path==='/api/v1/teams')return await createTeam(api,req,res,auth,path,requestId);
   const match=/^\/api\/v1\/teams\/([^/]+)(\/.*)?$/.exec(path);if(!match)fail(404,'not_found','not found');const teamId=match[1],sub=match[2]??'';