@volter/teams 0.1.87 → 0.1.89

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.1.87",
+  "version": "0.1.89",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/machine-link.mjs

@@ -206,6 +206,12 @@ function installedGuard(access,action){
     params:[access.installationId,access.teamId,access.installedAt,action],status:404,code:'not_found',message:'integration authorization changed'};
 }
 
+/**
+ * A token still unexpired after the workplace stopped admitting its access (its Task closed, its contract ended, its
+ * binding revoked) mints no grant: the workplace is asked before every open, not only by an open channel's recheck.
+ */
+const ACCESS_ENDED = { status: 403, code: 'access_revoked', message: 'the workplace no longer admits this access' };
+
 async function delegatedChannel(api, teamId, machineId, token) {
   const access = await delegatedAccessOf(api, token);
   if (!access) return { status: 401, code: 'authentication_required', message: 'authentication required' };
@@ -214,6 +220,7 @@ async function delegatedChannel(api, teamId, machineId, token) {
   if (!machine) return { status: 404, code: 'not_found', message: 'machine not found' };
   const publication = await publicationFor(api, access);
   if (!publication) return { status: 404, code: 'not_found', message: 'machine not found' };
+  if (await delegatedStillAdmits({ issuer: access.issuer, token }) === false) return ACCESS_ENDED;
   const now = api.clock.nowMs(), id = api.ids.next('grant'), principal = delegatedPrincipal(access), issuer = delegatedGrantIssuer(access.issuer, publication.id);
   try {
     // The publication, and its publisher's standing, must still hold as the grant is written: an unpublish or a
@@ -231,7 +238,7 @@ async function delegatedChannel(api, teamId, machineId, token) {
     if (error.code === 'not_found') return { status: 404, code: 'not_found', message: 'machine not found' };
     throw error;
   }
-  return { door: 'channel', teamId, machineId, auth: { kind: 'delegated', installation_id:access.installationId, team_id: teamId, principal_id: principal, group_ids: [], grant_id: id, grant_issuer: issuer, expires_at: access.expiresAt } };
+  return { door: 'channel', teamId, machineId, auth: { kind: 'delegated', installation_id:access.installationId, team_id: teamId, principal_id: principal, group_ids: [], grant_id: id, grant_issuer: issuer, expires_at: access.expiresAt, issuer: access.issuer, token } };
 }
 
 /**
@@ -247,6 +254,7 @@ async function delegatedSessionChannel(api, teamId, sessionRef, token) {
   if (access.teamId !== teamId || !['view', 'control'].includes(access.scope) || access.sessionRef !== sessionRef) return unknown;
   const target = await boundSessionTarget(api, teamId, access);
   if (!target) return unknown;
+  if (await delegatedStillAdmits({ issuer: access.issuer, token }) === false) return ACCESS_ENDED;
   const now = api.clock.nowMs(), id = api.ids.next('grant'), principal = delegatedPrincipal(access);
   const issuer = `delegated:${new URL(access.issuer).host}:session:${target.sessionId}`;
   await api.store.guardedTransaction([
@@ -256,7 +264,7 @@ async function delegatedSessionChannel(api, teamId, sessionRef, token) {
     { sql: "DELETE FROM machine_grants WHERE team_id=? AND issuer_id LIKE 'delegated:%' AND expires_at<=?", params: [teamId, now] },
     { sql: 'INSERT INTO machine_grants(team_id,id,machine_id,subject_id,caps_json,targets_json,issuer_id,created_at,expires_at,app_installation_id) VALUES (?,?,?,?,?,?,?,?,?,?)', params: [teamId, id, target.machineId, principal, JSON.stringify(access.scope === 'control' ? ['observe', 'interact'] : ['observe']), JSON.stringify([`session:${target.harness}/${target.nativeId}`]), issuer, now, access.expiresAt, access.installationId] },
   ]).catch((error) => { if (error.code !== 'not_found') throw error; return null; });
-  return { door: 'channel', teamId, machineId: target.machineId, auth: { kind: 'delegated', installation_id:access.installationId, team_id: teamId, principal_id: principal, group_ids: [], grant_id: id, grant_issuer: issuer, expires_at: access.expiresAt, name: access.name, roomContext: access.roomContext } };
+  return { door: 'channel', teamId, machineId: target.machineId, auth: { kind: 'delegated', installation_id:access.installationId, team_id: teamId, principal_id: principal, group_ids: [], grant_id: id, grant_issuer: issuer, expires_at: access.expiresAt, name: access.name, roomContext: access.roomContext, issuer: access.issuer, token } };
 }
 
 /**
@@ -264,21 +272,49 @@ async function delegatedSessionChannel(api, teamId, sessionRef, token) {
  * the harness session the token names. Null unless the session's owner bound it to the token's Room and Conversation.
  */
 async function boundSessionTarget(api, teamId, access) {
+  return (await sessionDeliveryResolution(api, teamId, access)).target;
+}
+
+/** The same delivery checks, explainable only through a session custodian's authenticated door.
+ * No token is accepted and no grant, binding or native message is created by this read.
+ */
+export async function sessionDeliveryResolution(api, teamId, access, diagnostics = false) {
   const named = await api.store.query('SELECT id, canonical_id FROM sessions WHERE team_id=? AND deleted_at IS NULL AND (id=? OR id IN (SELECT session_id FROM origins WHERE team_id=? AND native_id=? AND deleted_at IS NULL))', [teamId, access.sessionRef, teamId, access.sessionRef]);
+  let reason = 'session_not_found', origins = null;
   for (const found of named) {
     let root = found;
     for (let hops = 0; root?.canonical_id && hops < 16; hops += 1) root = await api.store.one('SELECT id, canonical_id FROM sessions WHERE team_id=? AND id=? AND deleted_at IS NULL', [teamId, root.canonical_id]);
-    if (!root || root.canonical_id) continue;
+    if (!root || root.canonical_id) { reason = 'session_family_unresolved'; continue; }
     const bound = await api.store.one('SELECT 1 ok FROM session_view_bindings WHERE team_id=? AND session_id=? AND issuer=? AND room=? AND conversation=?', [teamId, root.id, access.issuer, access.room, access.conversation]);
-    if (!bound) continue;
+    if (!bound) { reason = 'binding_not_found'; continue; }
     const origin = await api.store.one(`SELECT o.harness, o.native_id, o.session_id, src.machine_id FROM origins o
       JOIN sources src ON src.team_id=o.team_id AND src.id=o.source_id AND src.state='active' AND src.machine_id IS NOT NULL
       JOIN machines m ON m.team_id=src.team_id AND m.id=src.machine_id AND m.revoked_at IS NULL
       WHERE o.team_id=? AND o.deleted_at IS NULL AND o.session_id IN (SELECT id FROM sessions WHERE team_id=? AND deleted_at IS NULL AND (id=? OR canonical_id=?))
       ORDER BY (o.native_id=?) DESC, o.sequence DESC LIMIT 1`, [teamId, teamId, root.id, root.id, access.sessionRef]);
-    if (origin) return { sessionId: root.id, harness: origin.harness, nativeId: origin.native_id, machineId: origin.machine_id };
+    if (origin) {
+      const target = { sessionId: root.id, harness: origin.harness, nativeId: origin.native_id, machineId: origin.machine_id };
+      return { state: 'ready', reason: null, target };
+    }
+    reason = 'no_live_origin';
+    if (diagnostics) {
+      // LEFT joins retain the row that the delivery's inner joins discarded.
+      const rows = await api.store.query(`SELECT o.harness, o.source_id, o.deleted_at, src.state source_state, src.machine_id,
+        m.id enrolled_machine, m.revoked_at machine_revoked_at FROM origins o
+        LEFT JOIN sources src ON src.team_id=o.team_id AND src.id=o.source_id
+        LEFT JOIN machines m ON m.team_id=src.team_id AND m.id=src.machine_id
+        WHERE o.team_id=? AND o.session_id IN (SELECT id FROM sessions WHERE team_id=? AND deleted_at IS NULL AND (id=? OR canonical_id=?))
+        ORDER BY o.sequence DESC LIMIT 51`, [teamId, teamId, root.id, root.id]);
+      const live = rows.filter(row => row.deleted_at == null), active = live.filter(row => row.source_state === 'active');
+      const attached = active.filter(row => row.machine_id != null), enrolled = attached.filter(row => row.enrolled_machine != null);
+      reason = !rows.length ? 'origin_not_found' : !live.length ? 'origin_deleted' : !active.length ? 'source_not_active'
+        : !attached.length ? 'source_without_machine' : !enrolled.length ? 'machine_not_found' : 'machine_revoked';
+      origins = { truncated: rows.length > 50, items: rows.slice(0,50).map(row => ({ harness: row.harness,
+        source_id: row.source_id, source_state: row.source_state, origin_deleted: row.deleted_at != null,
+        machine_id: row.machine_id, machine_present: row.enrolled_machine != null, machine_revoked: row.machine_revoked_at != null })) };
+    }
   }
-  return null;
+  return { state: 'unavailable', reason, target: null, ...(origins ? { origins } : {}) };
 }
 
 /** Close every delegated channel whose grant came from one publication (issuer from delegatedGrantIssuer): it was unpublished. */
@@ -335,6 +371,22 @@ async function acceptLink(api, teamId, machineId, duplex, closeSocket) {
 }
 
 const LINK_WAIT_MS = 10_000;
+/** How often an open delegated channel asks its workplace whether the token's access still holds. */
+const DELEGATED_RECHECK_MS = 15_000;
+
+/**
+ * Whether the workplace that issued a delegated token still admits the access it was issued for (RH2's status door,
+ * `POST <issuer>/api/v3/delegated/status`): false only on the workplace's own answer. An unreachable workplace or an
+ * unreadable answer is not a refusal; an open then proceeds and its channel ends at the token's expiry.
+ */
+async function delegatedStillAdmits(auth) {
+  try {
+    const response = await fetch(`${auth.issuer}/api/v3/delegated/status`, { body: JSON.stringify({ token: auth.token }), headers: { accept: 'application/json', 'content-type': 'application/json' }, method: 'POST', signal: AbortSignal.timeout(10_000) });
+    if (!response.ok) return null;
+    const { data } = await response.json();
+    return typeof data?.live === 'boolean' ? data.live : null;
+  } catch { return null; }
+}
 /** How long a typed line is retried on a machine that is linked but too loaded to open its stream. */
 const TURN_RETRY_MS = 120_000;
 
@@ -362,8 +414,15 @@ async function acceptChannel(api, auth, machineId, duplex, closeSocket) {
   channels(api).add(entry);
   // A delegated channel ends when its token does; the viewer reopens it with a fresh one.
   const expiry = (auth.kind === 'delegated'||(auth.installation_id&&auth.expires_at-api.clock.nowMs()<=2147483647)) ? setTimeout(() => entry.close('token_expired'), Math.max(0, auth.expires_at - api.clock.nowMs())) : null;
+  // It also ends when the workplace stops admitting the access the token was issued for (a binding revoked, a Task
+  // closed, a contract ended): an act already under way ends with its access, and the grant goes with it.
+  const recheck = auth.kind === 'delegated' && auth.token ? setInterval(() => void delegatedStillAdmits(auth).then(async (live) => {
+    if (live !== false) return;
+    await api.store.transaction([{ sql: 'DELETE FROM machine_grants WHERE team_id=? AND id=?', params: [auth.team_id, auth.grant_id] }]).catch(() => {});
+    entry.close('access_revoked');
+  }), DELEGATED_RECHECK_MS) : null;
   channel.on('error', () => {});
-  channel.on('close', () => { if (expiry) clearTimeout(expiry); channels(api).delete(entry); entry.dropStreams('caller closed'); });
+  channel.on('close', () => { if (expiry) clearTimeout(expiry); if (recheck) clearInterval(recheck); channels(api).delete(entry); entry.dropStreams('caller closed'); });
   channel.on('stream', async (stream, accept, refuse) => {
     const claim = await claimFor(api, auth, machineId).catch(() => null);
     if (!claim) return refuse('no machine grant for this caller');

package/viewer/viewer.mjs

@@ -238,6 +238,7 @@ async function showPane(connect, key, control) {
       pane = null;
       channel.close();
       // The server ends a channel when its token does: reopen with a fresh one. Any other close is shown and stays.
+      if (/access_revoked/.test(String(reason))) { status('Access ended: the workplace no longer grants this pane.'); return; }
       if (!/token_expired/.test(String(reason))) { status(`Disconnected: ${reason ?? 'closed'}`); return; }
       status('Reconnecting…');
       attach().catch((error) => status(error.message));