@volter/teams 0.2.3 → 0.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/agent-authority.mjs

@@ -1,4 +1,6 @@
 // Live agency and delegation are evaluated from the store; identity labels and environment hints grant nothing.
+// A seed's standing people are a CTE, not a subquery nested under the chain's: a hosted Teams server (a Durable
+// Object) prepares SQL under SQLite's expression-depth cap of 100, and this query is nested inside others (auth.mjs).
 export const AGENT_ACTIVE = `WITH RECURSIVE scope(team,id) AS (VALUES(?,?)), chain(id) AS (
  SELECT a.id FROM agents a,scope s WHERE a.team_id=s.team AND a.id=s.id
  UNION SELECT a.parent_id FROM agents a JOIN chain c ON a.id=c.id,scope s WHERE a.team_id=s.team AND a.parent_id IS NOT NULL
@@ -12,10 +14,11 @@ export const AGENT_ACTIVE = `WITH RECURSIVE scope(team,id) AS (VALUES(?,?)), cha
  UNION SELECT g.seed,json_extract(CASE WHEN j.type='object' THEN j.value ELSE '{}' END,'$.id') FROM agents a JOIN ancestry g ON a.id=g.id,scope s,json_tree(a.lineage_json,'$.starter') j WHERE a.team_id=s.team AND j.type='object' AND json_extract(CASE WHEN j.type='object' THEN j.value ELSE '{}' END,'$.kind')='person'
  UNION SELECT g.seed,ps.sponsor_id FROM agents a JOIN ancestry g ON a.id=g.id JOIN json_tree(a.lineage_json,'$.starter') j ON j.type='object' JOIN principal_sponsors ps ON ps.team_id=a.team_id AND ps.principal_id=json_extract(CASE WHEN j.type='object' THEN j.value ELSE '{}' END,'$.id'),scope s WHERE a.team_id=s.team
  UNION SELECT g.seed,i.installer_id FROM agents a JOIN ancestry g ON a.id=g.id JOIN json_tree(a.lineage_json,'$.starter') j ON j.type='object' JOIN app_installations i ON i.team_id=a.team_id AND i.principal_id=json_extract(CASE WHEN j.type='object' THEN j.value ELSE '{}' END,'$.id') AND i.state='active' JOIN apps app ON app.id=i.app_id AND app.state='active',scope s WHERE a.team_id=s.team
+), standing(seed) AS (
+ SELECT x.seed FROM people x JOIN principals p ON p.id=x.id,scope s WHERE x.seed IS NOT NULL AND p.kind='user' AND
+  (EXISTS(SELECT 1 FROM memberships m WHERE m.team_id=s.team AND m.principal_id=p.id AND m.active=1)
+   OR EXISTS(SELECT 1 FROM identity_principals ip WHERE ip.team_id=s.team AND ip.principal_id=p.id)
+   AND NOT EXISTS(SELECT 1 FROM memberships m WHERE m.team_id=s.team AND m.principal_id=p.id AND m.active=0))
 ) SELECT 1 FROM agents root,scope s WHERE root.id=s.id AND root.team_id=s.team
- AND NOT EXISTS(SELECT 1 FROM chain c LEFT JOIN agents a ON a.id=c.id AND a.team_id=s.team WHERE a.id IS NULL OR a.state!='active' OR NOT EXISTS(
-  SELECT 1 FROM people x JOIN principals p ON p.id=x.id WHERE x.seed=a.id AND p.kind='user' AND
-   (EXISTS(SELECT 1 FROM memberships m WHERE m.team_id=s.team AND m.principal_id=p.id AND m.active=1)
-    OR EXISTS(SELECT 1 FROM identity_principals ip WHERE ip.team_id=s.team AND ip.principal_id=p.id)
-    AND NOT EXISTS(SELECT 1 FROM memberships m WHERE m.team_id=s.team AND m.principal_id=p.id AND m.active=0))))`;
+ AND NOT EXISTS(SELECT 1 FROM chain c LEFT JOIN agents a ON a.id=c.id AND a.team_id=s.team WHERE a.id IS NULL OR a.state!='active' OR a.id NOT IN (SELECT seed FROM standing))`;
 export const AGENT_DESCENDANTS = `WITH RECURSIVE tree(id) AS (SELECT id FROM agents WHERE team_id=? AND id=? UNION SELECT a.id FROM agents a JOIN tree t ON a.parent_id=t.id) SELECT id FROM tree`;

package/server/auth.mjs

@@ -14,8 +14,10 @@ export const APP_LINEAGE = `WITH RECURSIVE lineage(id) AS (
   UNION SELECT d.parent_credential_id FROM agent_credentials d JOIN lineage l ON d.credential_id=l.id
   UNION SELECT ac.subject_credential_id FROM app_credentials ac JOIN lineage l ON ac.credential_id=l.id WHERE ac.subject_credential_id IS NOT NULL
 )`;
-export const APP_LINEAGE_REVOKED = `${APP_LINEAGE}
-  SELECT 1 FROM lineage l JOIN credentials c ON c.id=l.id
+// One compound term per way a lineage is revoked, and each agent's standing over a flat list of the lineage's agents
+// and actors: a hosted Teams server (a Durable Object) prepares SQL under SQLite's expression-depth cap of 100, and the
+// one OR over nested AGENT_ACTIVE subqueries needed about 125.
+const LINEAGE_ROWS = `FROM lineage l JOIN credentials c ON c.id=l.id
   JOIN principals p ON p.id=c.principal_id
   LEFT JOIN memberships m ON m.team_id=c.team_id AND m.principal_id=c.principal_id
   LEFT JOIN app_credentials ac ON ac.credential_id=c.id
@@ -23,16 +25,21 @@ export const APP_LINEAGE_REVOKED = `${APP_LINEAGE}
   LEFT JOIN app_installations i ON i.id=COALESCE(ac.installation_id,ic.installation_id)
   LEFT JOIN apps a ON a.id=i.app_id
   LEFT JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id
-  LEFT JOIN memberships service ON service.team_id=i.team_id AND service.principal_id=i.principal_id
-  WHERE (p.kind='agent' AND NOT EXISTS (${AGENT_ACTIVE.replace('VALUES(?,?)','SELECT c.team_id,c.principal_id')}))
-    OR EXISTS(SELECT 1 FROM json_each(COALESCE(ac.actor_json,'[]')) actor
-      JOIN agents named ON named.team_id=c.team_id AND named.id=actor.value
-      WHERE actor.type='text' AND NOT EXISTS (${AGENT_ACTIVE.replace('VALUES(?,?)','SELECT named.team_id,named.id')}))
-    OR EXISTS(SELECT 1 FROM agent_credentials d LEFT JOIN memberships dm ON dm.team_id=d.team_id AND dm.principal_id=c.principal_id WHERE d.parent_credential_id=c.id AND d.credential_id IN(SELECT id FROM lineage) AND COALESCE(dm.active,0)!=1)
+  LEFT JOIN memberships service ON service.team_id=i.team_id AND service.principal_id=i.principal_id`;
+export const APP_LINEAGE_REVOKED = `${APP_LINEAGE}, lineage_actors(team,id) AS (
+  SELECT c.team_id,actor.value FROM lineage l JOIN credentials c ON c.id=l.id JOIN principals p ON p.id=c.principal_id
+  JOIN app_credentials ac ON ac.credential_id=c.id, json_each(COALESCE(ac.actor_json,'[]')) actor WHERE actor.type='text')
+  SELECT 1 FROM lineage l JOIN credentials c ON c.id=l.id JOIN principals p ON p.id=c.principal_id
+    WHERE p.kind='agent' AND NOT EXISTS (${AGENT_ACTIVE.replace('VALUES(?,?)','SELECT c.team_id,c.principal_id')})
+  UNION ALL SELECT 1 FROM lineage_actors x JOIN agents named ON named.team_id=x.team AND named.id=x.id
+    WHERE NOT EXISTS (${AGENT_ACTIVE.replace('VALUES(?,?)','SELECT named.team_id,named.id')})
+  UNION ALL SELECT 1 ${LINEAGE_ROWS}
+    WHERE EXISTS(SELECT 1 FROM agent_credentials d LEFT JOIN memberships dm ON dm.team_id=d.team_id AND dm.principal_id=c.principal_id WHERE d.parent_credential_id=c.id AND d.credential_id IN(SELECT id FROM lineage) AND COALESCE(dm.active,0)!=1)
     OR c.revoked_at IS NOT NULL OR (c.expires_at IS NOT NULL AND c.expires_at<=?)
     OR (c.team_id IS NOT NULL AND COALESCE(m.active,0)!=1)
     OR (i.id IS NOT NULL AND (i.state!='active' OR a.state!='active' OR COALESCE(installer.active,0)!=1
-      OR installer.role NOT IN ('owner','admin') OR COALESCE(service.active,0)!=1)) LIMIT 1`;
+      OR installer.role NOT IN ('owner','admin') OR COALESCE(service.active,0)!=1))
+  LIMIT 1`;
 export function canRead(auth, session, grants = []) {
   if (!auth || !['user','service'].includes(auth.kind) || !auth.active || session.deleted_at != null) return false;
   if (!appGrantAllows(auth, 'session', session.id, 'sessions.read')) return false;