@volter/teams 0.2.28 → 0.2.30

package/machine-core.mjs

@@ -247,7 +247,7 @@ export class MachineCore extends EventEmitter {
     }
     const index = this.nextConnection++;
     // A delegated caller's claim also carries the name its workplace signed for it (who typed a turn).
-    const entry = { channel, admitted, principal: claim.principal, name: typeof claim.name === 'string' ? claim.name : null, roomContext: claim.roomContext ?? null, verify: () => this.#admitClaim(claim), localAdmission: () => admitFromGrants(claim, { custodianId: this.custodianId, grants: this.linkGrants }) };
+    const entry = { channel, admitted, principal: claim.principal, principalName: typeof claim.principal_name === 'string' ? claim.principal_name : null, name: typeof claim.name === 'string' ? claim.name : null, roomContext: claim.roomContext ?? null, verify: () => this.#admitClaim(claim), localAdmission: () => admitFromGrants(claim, { custodianId: this.custodianId, grants: this.linkGrants }) };
     this.connections.set(index, entry);
     stream.on('close', () => { this.connections.delete(index); this.connectionClosed(index); });
     this.log.append({ principal: entry.principal, cap: 'connect', target: '*', outcome: admitted.class, detail: 'server' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.28",
+  "version": "0.2.30",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/http.mjs

@@ -10,7 +10,7 @@ import { permissionRoute } from './permissions.mjs';
 import { randomBytes } from 'node:crypto';
 import { bearer, hashToken, canManage, isAdmin, makeToken } from './auth.mjs';
 import { ContractError, canonicalJson, validationFailure, cursorHash, cursorToken, sha256 } from './wire.mjs';
-import { machineGrantRoute, machineGrantRows, closeMachineChannels, closeChannelsFor } from './machine-link.mjs';
+import { machineGrantRoute, machineGrantRows, closeMachineChannels, closeChannelsFor, closeCredentialChannels } from './machine-link.mjs';
 import { publicationRoute, publisherRevocation } from './publications.mjs';
 import { exact, parseJson as parseRequestJson } from './request-json.mjs';
 import { identityOf } from './identity.mjs';
@@ -206,7 +206,7 @@ async function createCredential(api,req,res,auth,requestId){
 }
 async function revokeCredential(api,req,res,auth,id,requestId){
   if(!['user','service'].includes(auth.kind))fail(403,'forbidden','credential kind cannot use this operation');const credential=await api.store.one('SELECT * FROM credentials WHERE id=? AND revoked_at IS NULL',[id]);if(!credential)fail(404,'not_found','not found');const globalUser=credential.kind==='user'&&credential.team_id===null;if(globalUser?credential.principal_id!==auth.principal_id:credential.team_id!==auth.team_id||credential.principal_id!==auth.principal_id&&!isAdmin(auth))fail(404,'not_found','not found');
-  const now=api.clock.nowMs(),guards=[...authGuards(auth,now),{sql:"SELECT 1 ok FROM credentials c WHERE c.id=? AND c.revoked_at IS NULL AND ((c.kind='user' AND c.team_id IS NULL AND c.principal_id=?) OR (c.team_id=? AND (c.principal_id=? OR ?=1))) AND (c.id!=? OR c.kind!='user' OR c.team_id IS NOT NULL OR NOT EXISTS (SELECT 1 FROM memberships m WHERE m.principal_id=c.principal_id AND m.role='owner' AND m.active=1) OR EXISTS (SELECT 1 FROM credentials other WHERE other.principal_id=c.principal_id AND other.kind='user' AND other.team_id IS NULL AND other.id!=c.id AND other.revoked_at IS NULL AND (other.expires_at IS NULL OR other.expires_at>?)))",params:[id,auth.principal_id,auth.team_id,auth.principal_id,isAdmin(auth)?1:0,auth.credential_id,now],code:'conflict',status:409,message:'credential changed or would lock out owner'}];await guardedMutation(api,res,auth,guards,[{sql:'UPDATE credentials SET revoked_at=? WHERE id=?',params:[now,id]}],{status:204,body:null,targetId:id});send(res,204,null,requestId);
+  const now=api.clock.nowMs(),guards=[...authGuards(auth,now),{sql:"SELECT 1 ok FROM credentials c WHERE c.id=? AND c.revoked_at IS NULL AND ((c.kind='user' AND c.team_id IS NULL AND c.principal_id=?) OR (c.team_id=? AND (c.principal_id=? OR ?=1))) AND (c.id!=? OR c.kind!='user' OR c.team_id IS NOT NULL OR NOT EXISTS (SELECT 1 FROM memberships m WHERE m.principal_id=c.principal_id AND m.role='owner' AND m.active=1) OR EXISTS (SELECT 1 FROM credentials other WHERE other.principal_id=c.principal_id AND other.kind='user' AND other.team_id IS NULL AND other.id!=c.id AND other.revoked_at IS NULL AND (other.expires_at IS NULL OR other.expires_at>?)))",params:[id,auth.principal_id,auth.team_id,auth.principal_id,isAdmin(auth)?1:0,auth.credential_id,now],code:'conflict',status:409,message:'credential changed or would lock out owner'}];await guardedMutation(api,res,auth,guards,[{sql:'UPDATE credentials SET revoked_at=? WHERE id=?',params:[now,id]}],{status:204,body:null,targetId:id});await closeCredentialChannels(api,id);send(res,204,null,requestId);
 }
 async function createInvitation(api,req,res,auth,requestId){if(!isAdmin(auth))fail(403,'forbidden','forbidden');await requireUnlinked(api,auth.team_id);const body=await parseJson(req);exact(body,['display_name','role','expires_in_ms']);if(!['admin','member','viewer'].includes(body.role)||!Number.isSafeInteger(body.expires_in_ms)||body.expires_in_ms<1||body.expires_in_ms>604800000)fail(400,'invalid_request','invalid invitation');const pid=api.ids.next('user'),iid=api.ids.next('invitation'),secret=`sci_${iid}.${randomBytes(32).toString('base64url')}`,now=api.clock.nowMs(),exp=now+body.expires_in_ms,response=result(api,auth,{id:iid,role:body.role,expires_at:exp,enrollment_code:secret});await guardedMutation(api,res,auth,authGuards(auth,now),[{sql:'INSERT INTO principals(id,kind,display_name) VALUES (?,?,?)',params:[pid,'user',body.display_name]},{sql:'INSERT INTO invitations(team_id,id,principal_id,secret_hash,role,expires_at) VALUES (?,?,?,?,?,?)',params:[auth.team_id,iid,pid,hashToken(secret),body.role,exp]}],{status:201,body:response,targetId:iid});send(res,201,response,requestId);}
 async function acceptInvite(api,res,body,requestId){exact(body,['enrollment_code','access_token']);

package/server/machine-link.mjs

@@ -18,7 +18,7 @@ import { appAuthentication } from './apps.mjs';
 import { machineTransition } from './machine-events.mjs';
 import { randomUUID } from 'node:crypto';
 import { Channel } from '../channel.mjs';
-import { bearer } from './auth.mjs';
+import { APP_LINEAGE, bearer } from './auth.mjs';
 import { delegatedAccessOf, delegatedPrincipal, delegatedSessionOf, looksDelegated, surfaceCaps } from './delegated.mjs';
 import { delegatedGrantIssuer, publicationFor } from './publications.mjs';
 
@@ -73,13 +73,33 @@ async function claimFor(api, auth, machineId) {
   const membership = await api.store.one('SELECT active FROM memberships WHERE team_id=? AND principal_id=?', [auth.team_id, auth.principal_id]);
   if (!membership?.active) return null;
   const groups = auth.group_ids ?? [];
-  if (machine.custodian_id === auth.principal_id) return { principal: auth.principal_id, groups, custodian: true };
+  // The principal's name travels with its claim: the machine says who sent what came over this stream (a sender's
+  // identity is the link's, never a return address) without asking anyone.
+  const principal_name = (await api.store.one('SELECT display_name FROM principals WHERE id=?', [auth.principal_id]))?.display_name ?? null;
+  if (machine.custodian_id === auth.principal_id) return { principal: auth.principal_id, principal_name, groups, custodian: true };
   const subjects = [auth.principal_id, ...groups];
   const rows = await api.store.query(`SELECT id, revision FROM machine_grants WHERE team_id=? AND machine_id=? AND expires_at>? AND subject_id IN (${subjects.map(() => '?').join(',')}) ORDER BY id`, [auth.team_id, machineId, api.clock.nowMs(), ...subjects]);
   // Every member holds the team's standing mail grant (TEAM_MAIL_GRANT) besides their own.
   const held = [...rows, { id: TEAM_MAIL_GRANT, revision: 1 }];
   // Revisions let the machine notice a grant it holds has changed (rewritten, narrowed) and resync.
-  return { principal: auth.principal_id, groups: [...groups, teamSubject(auth.team_id)], grants: held.map((row) => row.id), revisions: Object.fromEntries(held.map((row) => [row.id, row.revision])) };
+  return { principal: auth.principal_id, principal_name, groups: [...groups, teamSubject(auth.team_id)], grants: held.map((row) => row.id), revisions: Object.fromEntries(held.map((row) => [row.id, row.revision])) };
+}
+
+/**
+ * Close every channel a revoked credential opened, or one derived from it (an app's or an agent's credential whose
+ * lineage holds it): a revoked, leaked token keeps no stream while its member stays.
+ */
+export async function closeCredentialChannels(api, credentialId, reason = 'credential_revoked') {
+  let closed = 0;
+  for (const entry of [...channels(api)]) {
+    if (!entry.credentialId) continue;
+    const derived = entry.credentialId === credentialId
+      || Boolean(await api.store.one(`${APP_LINEAGE} SELECT 1 ok FROM lineage WHERE id=? LIMIT 1`, [entry.credentialId, credentialId]).catch(() => null));
+    if (!derived) continue;
+    entry.close(reason);
+    closed += 1;
+  }
+  return closed;
 }
 
 /** Close every channel a member leaving the team, or a group losing a member or being deleted, leaves without its claimed authority. */
@@ -485,7 +505,7 @@ async function acceptChannel(api, auth, machineId, duplex, closeSocket) {
   } catch { closeSocket('refused'); return; }
   const open = new Set();
   const entry = {
-    teamId: auth.team_id, machineId, installationId:auth.installation_id??null, principal: auth.principal_id, actors:[...(auth.act??[])], claim: null, grantIssuer: auth.grant_issuer ?? null,
+    teamId: auth.team_id, machineId, installationId:auth.installation_id??null, principal: auth.principal_id, credentialId: auth.credential_id ?? null, actors:[...(auth.act??[])], claim: null, grantIssuer: auth.grant_issuer ?? null,
     close: (reason) => closeSocket(reason),
     dropStreams: (reason) => { for (const pair of open) pair.close(reason); },
   };