@volter/teams 0.2.36 → 0.2.37

package/admission.mjs

@@ -9,6 +9,27 @@
 // `<kind>:*` for every target of one kind, or `*` (operate and view only).
 // `root:<path>` covers the path and everything under it.
 
+const MACHINE_CAPS = new Set(['operate', 'view', 'observe', 'interact', 'control', 'files', 'ports', 'mail']);
+const MACHINE_TARGET = /^(\*|root:(\*|\/[^\x00-\x1f]{0,4095})|(?!root:)[a-z][a-z0-9-]{0,31}:[^\x00-\x1f]{1,4096})$/;
+export const AGENT_MACHINE_GRANT_MS = 60 * 60 * 1000;
+
+/** Canonical grant shape, shared by both issuance doors and persisted-row admission.
+ * Lifetime is measured from issuance, so an old overlong row cannot become valid by ageing.
+ */
+export function machineGrantProblem(grant, { agent = false, lifetime = false, now = Date.now() } = {}) {
+  const { caps, targets, created_at, expires_at } = grant;
+  if (!Array.isArray(caps) || !caps.length || new Set(caps).size !== caps.length || !caps.every(cap => MACHINE_CAPS.has(cap))) return 'caps must be a non-empty set of machine capabilities';
+  if (!Array.isArray(targets) || !targets.length || targets.length > 64 || !targets.every(target => typeof target === 'string' && MACHINE_TARGET.test(target))) return 'targets must name * or <kind>:<name>';
+  if (caps.includes('operate') && !(targets.length === 1 && targets[0] === '*')) return 'operate is the whole machine: its only target is *';
+  if (targets.includes('*') && !caps.every(cap => cap === 'operate' || cap === 'view')) return 'only operate and view may target *';
+  if (!Number.isSafeInteger(expires_at) || expires_at <= now) return 'machine grant expiry must be in the future';
+  if (agent || lifetime) {
+    const maximum = agent ? AGENT_MACHINE_GRANT_MS : 90 * 24 * 60 * 60 * 1000;
+    if (!Number.isSafeInteger(created_at) || expires_at <= created_at || expires_at - created_at > maximum) return agent ? 'an agent machine delegation expires within 1 hour of issuance' : 'machine grant expiry must be within 90 days of issuance';
+  }
+  return null;
+}
+
 export function targetsCover(patterns, target) {
   for (const pattern of patterns) {
     if (pattern === '*') return true;
@@ -52,7 +73,7 @@ export function admitFromGrants(claim, { custodianId, grants, now = Date.now() }
   const held = [];
   for (const id of Array.isArray(claim.grants) ? claim.grants : []) {
     const grant = grants.get(id);
-    if (!grant || grant.expires_at <= now) continue;
+    if (!grant || machineGrantProblem(grant, { agent: claim.agent === true, now })) continue;
     const subjects = new Set([claim.principal, ...(Array.isArray(claim.groups) ? claim.groups : [])]);
     if (!subjects.has(grant.subject_id)) continue;
     held.push({ id: grant.id, caps: grant.caps, targets: grant.targets });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.36",
+  "version": "0.2.37",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/http.mjs

@@ -10,7 +10,7 @@ import { permissionRoute } from './permissions.mjs';
 import { randomBytes } from 'node:crypto';
 import { bearer, hashToken, canManage, isAdmin, makeToken } from './auth.mjs';
 import { ContractError, canonicalJson, validationFailure, cursorHash, cursorToken, sha256 } from './wire.mjs';
-import { machineGrantRoute, machineGrantRows, closeMachineChannels, closeChannelsFor, closeCredentialChannels } from './machine-link.mjs';
+import { machineGrantRoute, machineGrantRows, agentMachineClaim, closeMachineChannels, closeChannelsFor, closeCredentialChannels } from './machine-link.mjs';
 import { publicationRoute, publisherRevocation } from './publications.mjs';
 import { exact, parseJson as parseRequestJson } from './request-json.mjs';
 import { identityOf } from './identity.mjs';
@@ -44,7 +44,9 @@ export function createHttpHandler(api){return async(req,res)=>{const requestId=a
   const auth=await authenticate(api,bearer(req.headers.authorization));res._authenticated=Boolean(auth);
   if(auth?.installation_id){const scoped=/^\/api\/v1\/teams\/([^/]+)(\/.*)?$/.exec(path);if(scoped&&scoped[1]!==auth.team_id)fail(403,'forbidden','app token belongs to another organization');const target=scoped?.[2]??path.replace(/^\/api\/v1/,'');if(target===`/app-installations/${auth.installation_id}/delegations`&&req.method==='POST'){}else enforceAppScope(auth,req.method,target);}
   // An agent reads identity attribution (C4: resolving a requester to sponsor a card); a link grants it nothing.
-  if(auth?.agent_credential&&!((req.method==='GET'&&/^\/api\/v1\/(?:me$|teams(?:$|\/[^/]+(?:$|\/(?:agents|sessions)(?:$|\/)|\/identity\/resolve$)))/.test(path))||(req.method==='POST'&&/^\/api\/v1\/teams\/[^/]+\/sessions\/[^/]+\/mail$/.test(path))))fail(403,'forbidden','agent credential is limited to identity reads, session reads and own-session mail');
+  if(auth?.agent_credential&&!((req.method==='GET'&&/^\/api\/v1\/(?:me$|teams(?:$|\/[^/]+(?:$|\/(?:agents|sessions)(?:$|\/)|\/identity\/resolve$)))/.test(path))
+    ||(req.method==='GET'&&/^\/api\/v1\/teams\/[^/]+\/machines(?:\/(?!events$)[^/]+)?$/.test(path))
+    ||(req.method==='POST'&&/^\/api\/v1\/teams\/[^/]+\/sessions\/[^/]+\/mail$/.test(path))))fail(403,'forbidden','agent credential is limited to identity/session reads, own-session mail and explicitly granted machines');
   if(api.harnessRoutes&&await api.harnessRoutes.authed({api,req,res,auth,path,requestId}))return;
   if(req.method==='POST'&&path==='/api/v1/invitations/accept'){checkRate(api,`login:${req.socket.remoteAddress}`,10,5);const body=await parseJson(req);return await acceptInvite(api,res,body,requestId);}
   if(req.method==='POST'&&path==='/api/v1/login/volter'){checkRate(api,`login:${req.socket.remoteAddress}`,10,5);const body=await parseJson(req);return await identityLogin(api,res,body,requestId);}
@@ -376,6 +378,15 @@ async function enroll(api,req,res,auth,requestId){if(auth.role==='viewer')fail(4
 // `online` is a machine that heartbeats and holds its link, so callers can reach it; `unlinked` heartbeats without one.
 const machineJson=(m,now,api)=>({id:m.id,name:m.name,custodian_id:m.custodian_id,enrollment:m.revoked_at==null?'active':'revoked',connection:m.last_seen_at!=null&&m.last_seen_at+45000>now?(m.presence_linked===1?'online':'unlinked'):'offline',last_seen_at:m.last_seen_at,incarnation_id:m.incarnation_id,host_key_id:m.host_key_id??null,revision:m.revision});
 async function machineAdminRoute(api,req,res,auth,machineId,roots,requestId){
+  if(auth.agent_credential){
+    // Discovery reveals only machines this exact agent may reach; a reader gets no fleet directory by membership.
+    const ids=machineId?[{machine_id:machineId}]:await api.store.query('SELECT DISTINCT machine_id FROM machine_grants WHERE team_id=? AND subject_id=? AND expires_at>?',[auth.team_id,auth.principal_id,api.clock.nowMs()]);
+    const allowed=[];for(const item of ids)if(await agentMachineClaim(api,auth,item.machine_id))allowed.push(item.machine_id);
+    if(machineId&&!allowed.length)fail(404,'not_found','not found');
+    const rows=allowed.length?await api.store.query(`SELECT m.*,(SELECT linked FROM machine_presence p WHERE p.team_id=m.team_id AND p.machine_id=m.id) presence_linked FROM machines m WHERE m.team_id=? AND m.id IN (${allowed.map(()=>'?').join(',')}) ORDER BY m.name,m.id`,[auth.team_id,...allowed]):[];
+    if(machineId){if(!rows.length)fail(404,'not_found','not found');return send(res,200,result(api,auth,machineJson(rows[0],api.clock.nowMs(),api)),requestId,{ETag:`"${rows[0].revision}"`});}
+    return send(res,200,{version:1,context:{server_id:api.serverId,team_id:auth.team_id,principal_id:auth.principal_id},items:rows.map(row=>machineJson(row,api.clock.nowMs(),api)),next_cursor:null},requestId);
+  }
   // Custodians and admins see their machines, revoked ones included; every member sees the team's active machines,
   // each of which they can message (the team's standing mail grant, machine-link.mjs). Roots stay custodial.
   const custody=roots?'(m.custodian_id=? OR ?=1)':'(m.custodian_id=? OR ?=1 OR m.revoked_at IS NULL)',params=[auth.team_id,auth.principal_id,isAdmin(auth)?1:0];

package/server/machine-link.mjs

@@ -18,20 +18,16 @@ import { appAuthentication } from './apps.mjs';
 import { machineTransition } from './machine-events.mjs';
 import { randomUUID } from 'node:crypto';
 import { Channel } from '../channel.mjs';
-import { APP_LINEAGE, bearer } from './auth.mjs';
+import { machineGrantProblem } from '../admission.mjs';
+import { lineSplitter } from '../lines.mjs';
+import { APP_LINEAGE, APP_LINEAGE_REVOKED, bearer } from './auth.mjs';
+import { AGENT_ACTIVE } from './agent-authority.mjs';
 import { delegatedAccessOf, delegatedPrincipal, delegatedSessionOf, looksDelegated, surfaceCaps } from './delegated.mjs';
 import { delegatedGrantIssuer, publicationFor } from './publications.mjs';
 
 const LINK_PROTOCOL = 'supercode-machine-link.v1';
 const CHANNEL_PROTOCOL = 'supercode-machine-channel.v1';
 /** The machine daemon's door vocabulary: operate (operator: harness.v1 and launch) and the participant caps its doors check. `mail` writes one message into a session there (`mail:*`, or `mail:<address>` for one session). */
-const CAPS = new Set(['operate', 'view', 'observe', 'interact', 'control', 'files', 'ports', 'mail']);
-// A target is `*` or `<kind>:<name>`. The server checks shape only: which kinds a machine
-// serves is the daemon's business, and a grant on a kind it does not serve covers nothing.
-const TARGET = /^(\*|root:(\*|\/[^\x00-\x1f]{0,4095})|(?!root:)[a-z][a-z0-9-]{0,31}:[^\x00-\x1f]{1,4096})$/;
-// `*` is the whole machine: operate it, or list it. Anything more names the kind it reaches.
-const WHOLE_MACHINE_CAPS = new Set(['operate', 'view']);
-const MAX_GRANT_MS = 90 * 24 * 60 * 60 * 1000;
 
 const links = (api) => api.machineLinks ??= new Map();
 const channels = (api) => api.machineChannels ??= new Set();
@@ -54,11 +50,39 @@ export async function machineGrantRows(api, teamId, machineId) {
   return [...rows.map(grantJson), teamMailGrant(teamId, machineId)];
 }
 
+/** An agent's reader token exercises only a direct, explicitly issued machine grant.
+ * Neither its sponsor, its groups nor the team's standing mail grant conveys machine access.
+ * The token and its delegation chain are checked again when a stream is opened.
+ */
+export async function agentMachineClaim(api, auth, machineId) {
+  if (!auth.agent_credential || auth.principal_kind !== 'agent') return null;
+  const now = api.clock.nowMs();
+  if (!await api.store.one(`SELECT 1 FROM credentials c JOIN agent_credentials a ON a.credential_id=c.id
+    JOIN memberships mem ON mem.team_id=c.team_id AND mem.principal_id=c.principal_id
+    WHERE c.id=? AND c.team_id=? AND c.principal_id=? AND c.revoked_at IS NULL
+      AND c.expires_at>? AND mem.active=1`, [auth.credential_id, auth.team_id, auth.principal_id, now])) return null;
+  if (!await api.store.one(AGENT_ACTIVE, [auth.team_id, auth.principal_id])
+    || await api.store.one(APP_LINEAGE_REVOKED, [auth.credential_id, now])) return null;
+  const candidates = await api.store.query(`SELECT g.* FROM machine_grants g
+    JOIN machines machine ON machine.team_id=g.team_id AND machine.id=g.machine_id
+    JOIN memberships issuer ON issuer.team_id=g.team_id AND issuer.principal_id=g.issuer_id
+    WHERE g.team_id=? AND g.machine_id=? AND g.subject_id=? AND g.expires_at>?
+      AND machine.revoked_at IS NULL AND issuer.active=1 AND g.issuer_id!=g.subject_id
+      AND (g.issuer_id=machine.custodian_id OR issuer.role IN ('owner','admin'))
+      AND g.app_installation_id IS NULL ORDER BY g.id`, [auth.team_id, machineId, auth.principal_id, now]);
+  const rows = candidates.filter(row => {
+    try { return !machineGrantProblem(grantJson(row), { agent: true, now }); }
+    catch { return false; }
+  });
+  if (!rows.length) return null;
+  return { principal: auth.principal_id, principal_name: auth.display_name ?? null, groups: [], agent: true,
+    expires_at: Math.min(auth.expires_at, ...rows.map(row => row.expires_at)),
+    grants: rows.map(row => row.id), revisions: Object.fromEntries(rows.map(row => [row.id, row.revision])) };
+}
+
 /** What the caller may claim on the machine right now, or null (indistinguishable from no machine). */
 async function claimFor(api, auth, machineId) {
-  // Session credentials never inherit the team's all-session mail grant or machine grants.
-  // Their narrowly authorized session operations use the session door instead.
-  if(auth.agent_credential)return null;
+  if (auth.agent_credential) return agentMachineClaim(api, auth, machineId);
   if(auth.installation_id&&auth.kind!=='delegated'&&!await appAuthentication(api,auth))return null;
   if (auth.kind === 'delegated') {
     const row = await api.store.one(`SELECT g.id,g.revision FROM machine_grants g JOIN app_installations i ON i.id=g.app_installation_id JOIN apps a ON a.id=i.app_id
@@ -157,18 +181,19 @@ export async function machineGrantRoute({ api, req, res, auth, machineId, grantI
   }
   if (req.method === 'POST' && !grantId) {
     const body = await parseJson(req); exact(body, ['subject_id', 'caps', 'targets', 'expires_at']);
-    if (!Array.isArray(body.caps) || !body.caps.length || new Set(body.caps).size !== body.caps.length || !body.caps.every((cap) => CAPS.has(cap))) fail(400, 'invalid_request', `caps must be a non-empty set of ${[...CAPS].join(', ')}`);
-    if (!Array.isArray(body.targets) || !body.targets.length || body.targets.length > 64 || !body.targets.every((target) => typeof target === 'string' && TARGET.test(target))) fail(400, 'invalid_request', 'targets must name * or <kind>:<name> (for example pane:<key>, root:/path, port:<pane>/<n>, pane:*)');
-    if (body.caps.includes('operate') && !(body.targets.length === 1 && body.targets[0] === '*')) fail(400, 'invalid_request', 'operate is the whole machine: its only target is *');
-    if (body.targets.includes('*') && !body.caps.every((cap) => WHOLE_MACHINE_CAPS.has(cap))) fail(400, 'invalid_request', 'only operate and view may target *; name the kind instead (e.g. pane:*, port:*)');
     const now = api.clock.nowMs();
-    if (!Number.isSafeInteger(body.expires_at) || body.expires_at <= now || body.expires_at > now + MAX_GRANT_MS) fail(400, 'invalid_request', 'machine grant expiry must be within 90 days');
-    const subject = typeof body.subject_id === 'string' ? await api.store.one(`SELECT 'member' kind FROM memberships WHERE team_id=? AND principal_id=? AND active=1 UNION ALL SELECT 'group' kind FROM groups_table WHERE team_id=? AND id=?`, [auth.team_id, body.subject_id, auth.team_id, body.subject_id]) : null;
+    const subject = typeof body.subject_id === 'string' ? await api.store.one(`SELECT p.kind FROM memberships m JOIN principals p ON p.id=m.principal_id WHERE m.team_id=? AND m.principal_id=? AND m.active=1 UNION ALL SELECT 'group' kind FROM groups_table WHERE team_id=? AND id=?`, [auth.team_id, body.subject_id, auth.team_id, body.subject_id]) : null;
     if (!subject) fail(400, 'invalid_request', 'subject must be an active member, service account or group of this team');
+    const problem = machineGrantProblem({ ...body, created_at: now }, { agent: subject.kind === 'agent', lifetime: true, now });
+    if (problem) fail(400, 'invalid_request', problem);
     const id = api.ids.next('grant');
     const row = { id, machine_id: machineId, subject_id: body.subject_id, caps: body.caps, targets: body.targets, issuer_id: auth.principal_id, created_at: now, expires_at: body.expires_at, revision: 1 };
     const response = result(api, auth, row);
-    await guardedMutation(api, res, auth, [{ sql: 'SELECT 1 ok FROM machines WHERE team_id=? AND id=? AND revoked_at IS NULL', params: [auth.team_id, machineId], code: 'not_found', status: 404, message: 'machine not found' }], [
+    await guardedMutation(api, res, auth, [
+      { sql: 'SELECT 1 FROM credentials WHERE id=? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at>?)', params: [auth.credential_id, now], code: 'forbidden', status: 403, message: 'grant issuer credential changed' },
+      { sql: "SELECT 1 FROM machines machine JOIN memberships issuer ON issuer.team_id=machine.team_id WHERE machine.team_id=? AND machine.id=? AND machine.revoked_at IS NULL AND issuer.principal_id=? AND issuer.active=1 AND (machine.custodian_id=issuer.principal_id OR issuer.role IN ('owner','admin'))", params: [auth.team_id, machineId, auth.principal_id], code: 'forbidden', status: 403, message: 'machine grant authority changed' },
+      { sql: "SELECT 1 WHERE EXISTS(SELECT 1 FROM memberships WHERE team_id=? AND principal_id=? AND active=1) OR EXISTS(SELECT 1 FROM groups_table WHERE team_id=? AND id=?)", params: [auth.team_id, body.subject_id, auth.team_id, body.subject_id], code: 'invalid_request', status: 400, message: 'grant subject changed' },
+    ], [
       { sql: 'INSERT INTO machine_grants(team_id,id,machine_id,subject_id,caps_json,targets_json,issuer_id,created_at,expires_at,app_installation_id) VALUES (?,?,?,?,?,?,?,?,?,?)', params: [auth.team_id, id, machineId, body.subject_id, JSON.stringify(body.caps), JSON.stringify(body.targets), auth.principal_id, now, body.expires_at, auth.installation_id??null] },
     ], { status: 201, body: response, targetId: id });
     return send(res, 201, response, requestId, { ETag: '"1"' });
@@ -203,7 +228,6 @@ export async function authorizeMachineUpgrade(api, { authenticate, url, headers
   if (door === 'channel' && looksDelegated(presented)) return await delegatedChannel(api, teamId, machineId, presented);
   const auth = await authenticate(api, presented);
   if (!auth) return { status: 401, code: 'authentication_required', message: 'authentication required' };
-  if(auth.agent_credential)return {status:403,code:'forbidden',message:'agent session credential cannot open a machine channel'};
   if (door === 'link') {
     if (auth.kind !== 'machine' || auth.team_id !== teamId || auth.machine_id !== machineId) return { status: 403, code: 'forbidden', message: 'exact machine credential required' };
     const machine = await api.store.one('SELECT incarnation_id FROM machines WHERE team_id=? AND id=? AND revoked_at IS NULL', [teamId, machineId]);
@@ -504,6 +528,7 @@ async function acceptChannel(api, auth, machineId, duplex, closeSocket) {
     channel = await Channel.accept(duplex, { floor: 2 });
   } catch { closeSocket('refused'); return; }
   const open = new Set();
+  let grantExpiry = null, grantDeadline = Infinity;
   const entry = {
     teamId: auth.team_id, machineId, installationId:auth.installation_id??null, principal: auth.principal_id, credentialId: auth.credential_id ?? null, actors:[...(auth.act??[])], claim: null, grantIssuer: auth.grant_issuer ?? null,
     close: (reason) => closeSocket(reason),
@@ -511,7 +536,18 @@ async function acceptChannel(api, auth, machineId, duplex, closeSocket) {
   };
   channels(api).add(entry);
   // A delegated channel ends when its token does; the viewer reopens it with a fresh one.
-  const expiry = (auth.kind === 'delegated'||(auth.installation_id&&auth.expires_at-api.clock.nowMs()<=2147483647)) ? setTimeout(() => entry.close('token_expired'), Math.max(0, auth.expires_at - api.clock.nowMs())) : null;
+  const expiry = (auth.kind === 'delegated'||auth.agent_credential||(auth.installation_id&&auth.expires_at-api.clock.nowMs()<=2147483647)) ? setTimeout(() => entry.close('token_expired'), Math.max(0, auth.expires_at - api.clock.nowMs())) : null;
+  const armGrantExpiry = claim => {
+    if (!Number.isSafeInteger(claim.expires_at) || claim.expires_at >= grantDeadline) return;
+    grantDeadline = claim.expires_at;
+    clearTimeout(grantExpiry);
+    grantExpiry = setTimeout(() => entry.close('grant_expired'), Math.max(0, grantDeadline - api.clock.nowMs()));
+  };
+  // A grant's expiry, a sponsor suspension or a delegator leaving also ends existing agent streams.
+  // Explicit revocations already close them synchronously through closeMachineChannels/closeCredentialChannels.
+  const agentRecheck = auth.agent_credential ? setInterval(() => void agentMachineClaim(api, auth, machineId)
+    .then(claim => { if (!claim || entry.claim?.grants?.some(id => !claim.grants.includes(id) || entry.claim.revisions[id] !== claim.revisions[id])) entry.close('access_revoked'); })
+    .catch(() => entry.close('access_unknown')), 5000) : null;
   // It also ends when the workplace stops admitting the access the token was issued for (a binding revoked, a Task
   // closed, a contract ended): an act already under way ends with its access, and the grant goes with it.
   const recheck = auth.kind === 'delegated' && auth.token ? setInterval(() => void delegatedStillAdmits(auth).then(async (live) => {
@@ -520,11 +556,12 @@ async function acceptChannel(api, auth, machineId, duplex, closeSocket) {
     entry.close('access_revoked');
   }), DELEGATED_RECHECK_MS) : null;
   channel.on('error', () => {});
-  channel.on('close', () => { if (expiry) clearTimeout(expiry); if (recheck) clearInterval(recheck); channels(api).delete(entry); entry.dropStreams('caller closed'); });
+  channel.on('close', () => { if (expiry) clearTimeout(expiry); if (grantExpiry) clearTimeout(grantExpiry); if (recheck) clearInterval(recheck); if (agentRecheck) clearInterval(agentRecheck); channels(api).delete(entry); entry.dropStreams('caller closed'); });
   channel.on('stream', async (stream, accept, refuse) => {
     const claim = await claimFor(api, auth, machineId).catch(() => null);
     if (!claim) return refuse('no machine grant for this caller');
     entry.claim = claim;
+    armGrantExpiry(claim);
     // A machine relinks within seconds of this server restarting (a deploy drops every link): a stream waits for its
     // link that long, and retries once on a link that closed under it, rather than refusing a message mid-relink.
     // A line typed into a session is a person's words: a machine too loaded to answer the open in time is waited on,
@@ -551,7 +588,20 @@ async function acceptChannel(api, auth, machineId, duplex, closeSocket) {
     accept();
     const pair = { close: (reason) => { if (!stream.closed) stream.close(reason); if (!upstream.closed) upstream.close(reason); } };
     open.add(pair);
-    stream.on('data', (data) => { if (!upstream.closed) upstream.write(data); });
+    if (auth.agent_credential && stream.name === 'harness') {
+      // A held harness stream carries many calls. Opening it is not perpetual authority:
+      // check each complete request at forwarding time, including queued and split lines.
+      const lines = lineSplitter();
+      let forwarding = Promise.resolve();
+      stream.on('data', data => {
+        for (const line of lines(data)) forwarding = forwarding.then(async () => {
+          if (stream.closed || upstream.closed) return;
+          const current = await agentMachineClaim(api, auth, machineId);
+          if (!current || current.expires_at <= api.clock.nowMs() || claim.grants.some(id => !current.grants.includes(id) || current.revisions[id] !== claim.revisions[id])) return pair.close('access_revoked');
+          if (!stream.closed && !upstream.closed) upstream.write(line + '\n');
+        }).catch(() => pair.close('access_unknown'));
+      });
+    } else stream.on('data', (data) => { if (!upstream.closed) upstream.write(data); });
     upstream.on('data', (data) => { if (!stream.closed) stream.write(data); });
     stream.on('close', (reason) => { open.delete(pair); if (!upstream.closed) upstream.close(reason); });
     upstream.on('close', (reason) => { open.delete(pair); if (!stream.closed) stream.close(reason); });

package/server/permissions.mjs

@@ -3,6 +3,8 @@
 // machine, …). Membership is a binding of a role on the Org. Teams grants allow: withholding is not granting.
 import { isAdmin } from './auth.mjs';
 import { exact } from './request-json.mjs';
+import { machineGrantProblem } from '../admission.mjs';
+import { closeMachineChannels } from './machine-link.mjs';
 
 const fail = (status, code, message) => { throw Object.assign(new Error(message), { status, code }); };
 const stmt = (sql, ...params) => ({ sql, params });
@@ -85,6 +87,17 @@ export async function permissionRoute({ api, req, res, auth, sub, url, requestId
     // a machine binding is what the machine admits: capabilities, their targets and an end (the machine channel's grant)
     if (body.resource.kind === 'machine' && (!body.actions || !Array.isArray(body.conditions?.targets) || !body.conditions.targets.every((t) => typeof t === 'string') || body.expires_at == null))
       fail(400, 'invalid_request', 'a machine binding names its capabilities as actions, conditions.targets and expires_at');
+    const machineGuards = [];
+    if (body.resource.kind === 'machine') {
+      const subject = body.holder.kind === 'principal'
+        ? await api.store.one('SELECT p.kind FROM memberships m JOIN principals p ON p.id=m.principal_id WHERE m.team_id=? AND m.principal_id=? AND m.active=1', [auth.team_id, body.holder.id])
+        : await api.store.one("SELECT 'group' kind FROM groups_table WHERE team_id=? AND id=?", [auth.team_id, body.holder.id]);
+      if (!subject) fail(400, 'invalid_request', 'machine binding holder must be an active principal or group of this Org');
+      const problem = machineGrantProblem({ caps: body.actions, targets: body.conditions.targets, created_at: now, expires_at: body.expires_at }, { agent: subject.kind === 'agent', lifetime: true, now });
+      if (problem) fail(400, 'invalid_request', problem);
+      machineGuards.push(guard("SELECT 1 FROM machines machine JOIN memberships issuer ON issuer.team_id=machine.team_id WHERE machine.team_id=? AND machine.id=? AND machine.revoked_at IS NULL AND issuer.principal_id=? AND issuer.active=1 AND (machine.custodian_id=issuer.principal_id OR issuer.role IN ('owner','admin'))", [auth.team_id, body.resource.id, auth.principal_id], 'machine grant authority changed'),
+        guard("SELECT 1 WHERE EXISTS(SELECT 1 FROM memberships WHERE team_id=? AND principal_id=? AND active=1) OR EXISTS(SELECT 1 FROM groups_table WHERE team_id=? AND id=?)", [auth.team_id, body.holder.id, auth.team_id, body.holder.id], 'machine grant holder changed'));
+    }
     if (body.resource.kind === 'session' && body.role != null && !['reader', 'manager'].includes(body.role)) fail(400, 'invalid_request', 'a session binding grants reader or manager');
     // Passing permission only narrows: a non-admin grants on a resource only what it may itself manage there.
     const manage = isAdmin(auth) || (await decide(api, auth.team_id, auth.principal_id, `${body.resource.kind}s.access`, body.resource, now)).allowed;
@@ -94,7 +107,7 @@ export async function permissionRoute({ api, req, res, auth, sub, url, requestId
       resource_id: body.resource.id, effect: 'allow', conditions_json: JSON.stringify(body.conditions ?? {}), expires_at: body.expires_at ?? null, revoked_at: null, revision: 1 };
     const response = result(api, auth, bindingJson(row));
     await guardedMutation(api, res, auth, [guard('SELECT 1 FROM credentials WHERE id=? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at>?)', [auth.credential_id, now]),
-      guard('SELECT 1 FROM memberships WHERE team_id=? AND principal_id=? AND active=1', [auth.team_id, auth.principal_id])],
+      guard('SELECT 1 FROM memberships WHERE team_id=? AND principal_id=? AND active=1', [auth.team_id, auth.principal_id]), ...machineGuards],
       [stmt('INSERT INTO permission_bindings(team_id,id,holder_kind,holder_id,role,actions_json,resource_kind,resource_id,effect,conditions_json,issuer_id,created_at,expires_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)',
         auth.team_id, id, row.holder_kind, row.holder_id, row.role, row.actions_json, row.resource_kind, row.resource_id, 'allow', row.conditions_json, auth.principal_id, now, row.expires_at),
        stmt('UPDATE teams SET auth_epoch=auth_epoch+1 WHERE id=?', auth.team_id)], { status: 201, body: response, targetId: id });
@@ -108,6 +121,7 @@ export async function permissionRoute({ api, req, res, auth, sub, url, requestId
     await guardedMutation(api, res, auth, [guard('SELECT 1 FROM credentials WHERE id=? AND revoked_at IS NULL', [auth.credential_id])],
       [stmt('UPDATE permission_bindings SET revoked_at=COALESCE(revoked_at,?),revision=revision+1 WHERE team_id=? AND id=?', now, auth.team_id, row.id),
        stmt('UPDATE teams SET auth_epoch=auth_epoch+1 WHERE id=?', auth.team_id)], { status: 204, body: null, targetId: row.id });
+    if (row.resource_kind === 'machine') closeMachineChannels(api, auth.team_id, row.resource_id, { grantId: row.id });
     send(res, 204, null, requestId); return true;
   }
   if (req.method === 'POST' && sub === '/permissions/decide') {