@volter/teams 0.1.88 → 0.1.89

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.1.88",
+  "version": "0.1.89",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/machine-link.mjs

@@ -206,6 +206,12 @@ function installedGuard(access,action){
     params:[access.installationId,access.teamId,access.installedAt,action],status:404,code:'not_found',message:'integration authorization changed'};
 }
 
+/**
+ * A token still unexpired after the workplace stopped admitting its access (its Task closed, its contract ended, its
+ * binding revoked) mints no grant: the workplace is asked before every open, not only by an open channel's recheck.
+ */
+const ACCESS_ENDED = { status: 403, code: 'access_revoked', message: 'the workplace no longer admits this access' };
+
 async function delegatedChannel(api, teamId, machineId, token) {
   const access = await delegatedAccessOf(api, token);
   if (!access) return { status: 401, code: 'authentication_required', message: 'authentication required' };
@@ -214,6 +220,7 @@ async function delegatedChannel(api, teamId, machineId, token) {
   if (!machine) return { status: 404, code: 'not_found', message: 'machine not found' };
   const publication = await publicationFor(api, access);
   if (!publication) return { status: 404, code: 'not_found', message: 'machine not found' };
+  if (await delegatedStillAdmits({ issuer: access.issuer, token }) === false) return ACCESS_ENDED;
   const now = api.clock.nowMs(), id = api.ids.next('grant'), principal = delegatedPrincipal(access), issuer = delegatedGrantIssuer(access.issuer, publication.id);
   try {
     // The publication, and its publisher's standing, must still hold as the grant is written: an unpublish or a
@@ -231,7 +238,7 @@ async function delegatedChannel(api, teamId, machineId, token) {
     if (error.code === 'not_found') return { status: 404, code: 'not_found', message: 'machine not found' };
     throw error;
   }
-  return { door: 'channel', teamId, machineId, auth: { kind: 'delegated', installation_id:access.installationId, team_id: teamId, principal_id: principal, group_ids: [], grant_id: id, grant_issuer: issuer, expires_at: access.expiresAt } };
+  return { door: 'channel', teamId, machineId, auth: { kind: 'delegated', installation_id:access.installationId, team_id: teamId, principal_id: principal, group_ids: [], grant_id: id, grant_issuer: issuer, expires_at: access.expiresAt, issuer: access.issuer, token } };
 }
 
 /**
@@ -247,6 +254,7 @@ async function delegatedSessionChannel(api, teamId, sessionRef, token) {
   if (access.teamId !== teamId || !['view', 'control'].includes(access.scope) || access.sessionRef !== sessionRef) return unknown;
   const target = await boundSessionTarget(api, teamId, access);
   if (!target) return unknown;
+  if (await delegatedStillAdmits({ issuer: access.issuer, token }) === false) return ACCESS_ENDED;
   const now = api.clock.nowMs(), id = api.ids.next('grant'), principal = delegatedPrincipal(access);
   const issuer = `delegated:${new URL(access.issuer).host}:session:${target.sessionId}`;
   await api.store.guardedTransaction([
@@ -256,7 +264,7 @@ async function delegatedSessionChannel(api, teamId, sessionRef, token) {
     { sql: "DELETE FROM machine_grants WHERE team_id=? AND issuer_id LIKE 'delegated:%' AND expires_at<=?", params: [teamId, now] },
     { sql: 'INSERT INTO machine_grants(team_id,id,machine_id,subject_id,caps_json,targets_json,issuer_id,created_at,expires_at,app_installation_id) VALUES (?,?,?,?,?,?,?,?,?,?)', params: [teamId, id, target.machineId, principal, JSON.stringify(access.scope === 'control' ? ['observe', 'interact'] : ['observe']), JSON.stringify([`session:${target.harness}/${target.nativeId}`]), issuer, now, access.expiresAt, access.installationId] },
   ]).catch((error) => { if (error.code !== 'not_found') throw error; return null; });
-  return { door: 'channel', teamId, machineId: target.machineId, auth: { kind: 'delegated', installation_id:access.installationId, team_id: teamId, principal_id: principal, group_ids: [], grant_id: id, grant_issuer: issuer, expires_at: access.expiresAt, name: access.name, roomContext: access.roomContext } };
+  return { door: 'channel', teamId, machineId: target.machineId, auth: { kind: 'delegated', installation_id:access.installationId, team_id: teamId, principal_id: principal, group_ids: [], grant_id: id, grant_issuer: issuer, expires_at: access.expiresAt, name: access.name, roomContext: access.roomContext, issuer: access.issuer, token } };
 }
 
 /**
@@ -363,6 +371,22 @@ async function acceptLink(api, teamId, machineId, duplex, closeSocket) {
 }
 
 const LINK_WAIT_MS = 10_000;
+/** How often an open delegated channel asks its workplace whether the token's access still holds. */
+const DELEGATED_RECHECK_MS = 15_000;
+
+/**
+ * Whether the workplace that issued a delegated token still admits the access it was issued for (RH2's status door,
+ * `POST <issuer>/api/v3/delegated/status`): false only on the workplace's own answer. An unreachable workplace or an
+ * unreadable answer is not a refusal; an open then proceeds and its channel ends at the token's expiry.
+ */
+async function delegatedStillAdmits(auth) {
+  try {
+    const response = await fetch(`${auth.issuer}/api/v3/delegated/status`, { body: JSON.stringify({ token: auth.token }), headers: { accept: 'application/json', 'content-type': 'application/json' }, method: 'POST', signal: AbortSignal.timeout(10_000) });
+    if (!response.ok) return null;
+    const { data } = await response.json();
+    return typeof data?.live === 'boolean' ? data.live : null;
+  } catch { return null; }
+}
 /** How long a typed line is retried on a machine that is linked but too loaded to open its stream. */
 const TURN_RETRY_MS = 120_000;
 
@@ -390,8 +414,15 @@ async function acceptChannel(api, auth, machineId, duplex, closeSocket) {
   channels(api).add(entry);
   // A delegated channel ends when its token does; the viewer reopens it with a fresh one.
   const expiry = (auth.kind === 'delegated'||(auth.installation_id&&auth.expires_at-api.clock.nowMs()<=2147483647)) ? setTimeout(() => entry.close('token_expired'), Math.max(0, auth.expires_at - api.clock.nowMs())) : null;
+  // It also ends when the workplace stops admitting the access the token was issued for (a binding revoked, a Task
+  // closed, a contract ended): an act already under way ends with its access, and the grant goes with it.
+  const recheck = auth.kind === 'delegated' && auth.token ? setInterval(() => void delegatedStillAdmits(auth).then(async (live) => {
+    if (live !== false) return;
+    await api.store.transaction([{ sql: 'DELETE FROM machine_grants WHERE team_id=? AND id=?', params: [auth.team_id, auth.grant_id] }]).catch(() => {});
+    entry.close('access_revoked');
+  }), DELEGATED_RECHECK_MS) : null;
   channel.on('error', () => {});
-  channel.on('close', () => { if (expiry) clearTimeout(expiry); channels(api).delete(entry); entry.dropStreams('caller closed'); });
+  channel.on('close', () => { if (expiry) clearTimeout(expiry); if (recheck) clearInterval(recheck); channels(api).delete(entry); entry.dropStreams('caller closed'); });
   channel.on('stream', async (stream, accept, refuse) => {
     const claim = await claimFor(api, auth, machineId).catch(() => null);
     if (!claim) return refuse('no machine grant for this caller');

package/viewer/viewer.mjs

@@ -238,6 +238,7 @@ async function showPane(connect, key, control) {
       pane = null;
       channel.close();
       // The server ends a channel when its token does: reopen with a fresh one. Any other close is shown and stays.
+      if (/access_revoked/.test(String(reason))) { status('Access ended: the workplace no longer grants this pane.'); return; }
       if (!/token_expired/.test(String(reason))) { status(`Disconnected: ${reason ?? 'closed'}`); return; }
       status('Reconnecting…');
       attach().catch((error) => status(error.message));