@volter/teams 0.2.29 → 0.2.31

package/board-owner.mjs

@@ -46,6 +46,14 @@ export const BOARD_OPERATION_VERBS = new Set(['serve', 'daemon', 'dispatch', 'in
 export const CALLER_FACTS = ['SUPERCODE_AGENT_ID', 'SUPERCODE_AUTOMATION', 'SUPERCODE_CONTEXT', 'HERMES_PROFILE', 'USER', 'SUPERCODE_CALLER', 'SUPERCODE_RUN_LAUNCH'];
 export const callerFacts = (env = process.env) => Object.fromEntries(CALLER_FACTS.filter((key) => env[key]).map((key) => [key, env[key]]));
 
+/**
+ * What a caller says of an answer marked `unanswered` (the owner took the request and the call ended with no answer):
+ * the outcome is unknown, and the card is read before the verb is run again. `what` names the verb or tool.
+ */
+export function unansweredText(answer, what) {
+  return `${String(answer.stderr ?? '').trim() || 'the board owner gave no answer'}; whether ${what} ran is unknown: read the card with \`supercode workflow show <id>\` before running it again\n`;
+}
+
 /**
  * Send one verb to the owner of the home at `root`: answers `{ code, stdout, stderr }`. A home whose owner is not
  * running answers that, with what starts it; nothing else runs the verb.
@@ -56,25 +64,29 @@ export function askBoardOwner(root, request) {
   return new Promise((done) => {
     let answer = '';
     let settled = false;
+    // once the request is written the owner may have run the verb: a failure after that is `unanswered` (whether it
+    // ran is unknown), never a plain failure a caller would take as "nothing happened" and run again
+    let sent = false;
     const finish = (value) => { if (!settled) { settled = true; done(value); } };
+    const lost = (stderr) => finish({ code: 1, stdout: '', stderr, ...(sent ? { unanswered: true } : {}) });
     const socket = connect(path);
     socket.setEncoding('utf8');
     // The request is one line, and the connection stays open both ways until the answer's line has come: an answer that
     // takes its time (a Teams lookup, a reread home) is never lost to a closed side.
-    socket.on('connect', () => socket.write(`${JSON.stringify({ v: 1, ...request })}\n`));
+    socket.on('connect', () => { sent = true; socket.write(`${JSON.stringify({ v: 1, ...request })}\n`); });
     socket.on('data', (chunk) => {
       answer += chunk;
       const end = answer.indexOf('\n');
       if (end < 0) return;
       socket.end();
-      try { finish(JSON.parse(answer.slice(0, end))); } catch { finish({ code: 1, stdout: '', stderr: `the board owner of ${root} answered nothing readable\n` }); }
+      try { finish(JSON.parse(answer.slice(0, end))); } catch { lost(`the board owner of ${root} answered nothing readable\n`); }
     });
-    socket.on('close', () => finish({ code: 1, stdout: '', stderr: `the board owner of ${root} closed the call before answering\n` }));
+    socket.on('close', () => lost(`the board owner of ${root} closed the call before answering\n`));
     socket.on('error', (error) => {
-      const down = ['ENOENT', 'ECONNREFUSED'].includes(error.code);
-      finish({ code: 1, stdout: '', stderr: down
+      const down = !sent && ['ENOENT', 'ECONNREFUSED'].includes(error.code);
+      lost(down
         ? `the boards of ${root} have no running owner: \`supercode workflow serve --root ${root}\` is it (an install's keeper runs it)\n`
-        : `the board owner of ${root} could not be reached: ${error.message}\n` });
+        : sent ? `the board owner of ${root} dropped the call after it was sent: ${error.message}\n` : `the board owner of ${root} could not be reached: ${error.message}\n`);
     });
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.29",
+  "version": "0.2.31",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/http.mjs

@@ -10,7 +10,7 @@ import { permissionRoute } from './permissions.mjs';
 import { randomBytes } from 'node:crypto';
 import { bearer, hashToken, canManage, isAdmin, makeToken } from './auth.mjs';
 import { ContractError, canonicalJson, validationFailure, cursorHash, cursorToken, sha256 } from './wire.mjs';
-import { machineGrantRoute, machineGrantRows, closeMachineChannels, closeChannelsFor } from './machine-link.mjs';
+import { machineGrantRoute, machineGrantRows, closeMachineChannels, closeChannelsFor, closeCredentialChannels } from './machine-link.mjs';
 import { publicationRoute, publisherRevocation } from './publications.mjs';
 import { exact, parseJson as parseRequestJson } from './request-json.mjs';
 import { identityOf } from './identity.mjs';
@@ -206,7 +206,7 @@ async function createCredential(api,req,res,auth,requestId){
 }
 async function revokeCredential(api,req,res,auth,id,requestId){
   if(!['user','service'].includes(auth.kind))fail(403,'forbidden','credential kind cannot use this operation');const credential=await api.store.one('SELECT * FROM credentials WHERE id=? AND revoked_at IS NULL',[id]);if(!credential)fail(404,'not_found','not found');const globalUser=credential.kind==='user'&&credential.team_id===null;if(globalUser?credential.principal_id!==auth.principal_id:credential.team_id!==auth.team_id||credential.principal_id!==auth.principal_id&&!isAdmin(auth))fail(404,'not_found','not found');
-  const now=api.clock.nowMs(),guards=[...authGuards(auth,now),{sql:"SELECT 1 ok FROM credentials c WHERE c.id=? AND c.revoked_at IS NULL AND ((c.kind='user' AND c.team_id IS NULL AND c.principal_id=?) OR (c.team_id=? AND (c.principal_id=? OR ?=1))) AND (c.id!=? OR c.kind!='user' OR c.team_id IS NOT NULL OR NOT EXISTS (SELECT 1 FROM memberships m WHERE m.principal_id=c.principal_id AND m.role='owner' AND m.active=1) OR EXISTS (SELECT 1 FROM credentials other WHERE other.principal_id=c.principal_id AND other.kind='user' AND other.team_id IS NULL AND other.id!=c.id AND other.revoked_at IS NULL AND (other.expires_at IS NULL OR other.expires_at>?)))",params:[id,auth.principal_id,auth.team_id,auth.principal_id,isAdmin(auth)?1:0,auth.credential_id,now],code:'conflict',status:409,message:'credential changed or would lock out owner'}];await guardedMutation(api,res,auth,guards,[{sql:'UPDATE credentials SET revoked_at=? WHERE id=?',params:[now,id]}],{status:204,body:null,targetId:id});send(res,204,null,requestId);
+  const now=api.clock.nowMs(),guards=[...authGuards(auth,now),{sql:"SELECT 1 ok FROM credentials c WHERE c.id=? AND c.revoked_at IS NULL AND ((c.kind='user' AND c.team_id IS NULL AND c.principal_id=?) OR (c.team_id=? AND (c.principal_id=? OR ?=1))) AND (c.id!=? OR c.kind!='user' OR c.team_id IS NOT NULL OR NOT EXISTS (SELECT 1 FROM memberships m WHERE m.principal_id=c.principal_id AND m.role='owner' AND m.active=1) OR EXISTS (SELECT 1 FROM credentials other WHERE other.principal_id=c.principal_id AND other.kind='user' AND other.team_id IS NULL AND other.id!=c.id AND other.revoked_at IS NULL AND (other.expires_at IS NULL OR other.expires_at>?)))",params:[id,auth.principal_id,auth.team_id,auth.principal_id,isAdmin(auth)?1:0,auth.credential_id,now],code:'conflict',status:409,message:'credential changed or would lock out owner'}];await guardedMutation(api,res,auth,guards,[{sql:'UPDATE credentials SET revoked_at=? WHERE id=?',params:[now,id]}],{status:204,body:null,targetId:id});await closeCredentialChannels(api,id);send(res,204,null,requestId);
 }
 async function createInvitation(api,req,res,auth,requestId){if(!isAdmin(auth))fail(403,'forbidden','forbidden');await requireUnlinked(api,auth.team_id);const body=await parseJson(req);exact(body,['display_name','role','expires_in_ms']);if(!['admin','member','viewer'].includes(body.role)||!Number.isSafeInteger(body.expires_in_ms)||body.expires_in_ms<1||body.expires_in_ms>604800000)fail(400,'invalid_request','invalid invitation');const pid=api.ids.next('user'),iid=api.ids.next('invitation'),secret=`sci_${iid}.${randomBytes(32).toString('base64url')}`,now=api.clock.nowMs(),exp=now+body.expires_in_ms,response=result(api,auth,{id:iid,role:body.role,expires_at:exp,enrollment_code:secret});await guardedMutation(api,res,auth,authGuards(auth,now),[{sql:'INSERT INTO principals(id,kind,display_name) VALUES (?,?,?)',params:[pid,'user',body.display_name]},{sql:'INSERT INTO invitations(team_id,id,principal_id,secret_hash,role,expires_at) VALUES (?,?,?,?,?,?)',params:[auth.team_id,iid,pid,hashToken(secret),body.role,exp]}],{status:201,body:response,targetId:iid});send(res,201,response,requestId);}
 async function acceptInvite(api,res,body,requestId){exact(body,['enrollment_code','access_token']);

package/server/machine-link.mjs

@@ -18,7 +18,7 @@ import { appAuthentication } from './apps.mjs';
 import { machineTransition } from './machine-events.mjs';
 import { randomUUID } from 'node:crypto';
 import { Channel } from '../channel.mjs';
-import { bearer } from './auth.mjs';
+import { APP_LINEAGE, bearer } from './auth.mjs';
 import { delegatedAccessOf, delegatedPrincipal, delegatedSessionOf, looksDelegated, surfaceCaps } from './delegated.mjs';
 import { delegatedGrantIssuer, publicationFor } from './publications.mjs';
 
@@ -85,6 +85,23 @@ async function claimFor(api, auth, machineId) {
   return { principal: auth.principal_id, principal_name, groups: [...groups, teamSubject(auth.team_id)], grants: held.map((row) => row.id), revisions: Object.fromEntries(held.map((row) => [row.id, row.revision])) };
 }
 
+/**
+ * Close every channel a revoked credential opened, or one derived from it (an app's or an agent's credential whose
+ * lineage holds it): a revoked, leaked token keeps no stream while its member stays.
+ */
+export async function closeCredentialChannels(api, credentialId, reason = 'credential_revoked') {
+  let closed = 0;
+  for (const entry of [...channels(api)]) {
+    if (!entry.credentialId) continue;
+    const derived = entry.credentialId === credentialId
+      || Boolean(await api.store.one(`${APP_LINEAGE} SELECT 1 ok FROM lineage WHERE id=? LIMIT 1`, [entry.credentialId, credentialId]).catch(() => null));
+    if (!derived) continue;
+    entry.close(reason);
+    closed += 1;
+  }
+  return closed;
+}
+
 /** Close every channel a member leaving the team, or a group losing a member or being deleted, leaves without its claimed authority. */
 export function closeChannelsFor(api, teamId, { principalId = null, groupId = null, reason = 'access_revoked' } = {}) {
   let closed = 0;
@@ -488,7 +505,7 @@ async function acceptChannel(api, auth, machineId, duplex, closeSocket) {
   } catch { closeSocket('refused'); return; }
   const open = new Set();
   const entry = {
-    teamId: auth.team_id, machineId, installationId:auth.installation_id??null, principal: auth.principal_id, actors:[...(auth.act??[])], claim: null, grantIssuer: auth.grant_issuer ?? null,
+    teamId: auth.team_id, machineId, installationId:auth.installation_id??null, principal: auth.principal_id, credentialId: auth.credential_id ?? null, actors:[...(auth.act??[])], claim: null, grantIssuer: auth.grant_issuer ?? null,
     close: (reason) => closeSocket(reason),
     dropStreams: (reason) => { for (const pair of open) pair.close(reason); },
   };