@volter/teams 0.2.9 → 0.2.10

package/http-client.d.ts

@@ -83,8 +83,10 @@ export interface TeamClient {
     catalogue(options?: RequestOptions): Promise<Result<{kinds: string[]}>>;
     createSource(body: {name: string}, options?: RequestOptions): Promise<Result<{id: string; name: string}>>;
     publish(source: string, body: unknown, options?: RequestOptions): Promise<Result<OntologyEvent>>;
+    purge(ids: string[], options?: RequestOptions): Promise<Result<{purged: string[]; unknown: string[]}>>;
     follow(query?: Query, options?: StreamOptions): AsyncIterable<PublishedEventFrame>;
   };
+  purgeSessionText(sessions: string[], values: string[], options?: RequestOptions): Promise<Result<{sessions: Record<string, {messages: number; natives: number; artifacts_removed: number; artifacts_left: number; chunks_removed: number; shared_chunks_kept: number; shared_chunks_holding_value: number}>}>>;
   sessions: {
     list(query?: Query, options?: RequestOptions): Promise<Page>;
     search(query: Query, options?: RequestOptions): Promise<unknown>;

package/http-client.mjs

@@ -84,7 +84,9 @@ class TeamClient {
       follow: (q = {},o = {}) => events(root,base+'/events'+query(q),o),
       createSource: (body,o) => post('/event-sources',body,o),
       publish: (source,body,o) => post(resource('/event-sources',source)+'/events',body,o),
+      purge: (ids,o) => post('/events/purge',{events:ids},o),
     };
+    this.purgeSessionText = (sessions, values, o) => post('/sessions/purge', { sessions, values }, o);
     this.apps = {
       catalogue: o => get('/apps/catalogue', o),
       list: o => get('/apps', o), get: (id, o) => get(resource('/apps', id), o),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/published-events.mjs

@@ -8,6 +8,9 @@ import { APP_EVENTS, PUBLISHABLE_EVENTS, eventReadAction } from './event-catalog
 import { EVENT_DATA_LIMIT } from '../event-limits.mjs';
 
 const stmt = (sql, ...params) => ({sql, params});
+// A Durable Object binds at most 100 parameters to a statement, so id lists go in batches.
+const batches = (list, size = 90) => Array.from({length: Math.ceil(list.length / size)}, (_, at) => list.slice(at * size, (at + 1) * size));
+const holes = list => list.map(() => '?').join(',');
 const fail = (status,code,message) => {throw Object.assign(new Error(message),{status,code});};
 const text = (value,label) => {if(typeof value!=='string'||!value||value.length>256||/[\x00-\x1f]/.test(value))fail(400,'invalid_request',`${label} must be a nonempty string of at most 256 characters`);return value;};
 const eventOf = row => ({id:row.id,org:row.team_id,at:row.created_at,actor:JSON.parse(row.actor_json),kind:row.kind,resource:{kind:row.resource_kind,id:row.resource_id},data:JSON.parse(row.data_json)});
@@ -84,6 +87,68 @@ export async function publishedEventRoute(ctx) {
     await guardedMutation(api,res,auth,guards,[stmt('INSERT INTO org_events(id,team_id,source_id,source_revision,kind,resource_kind,resource_id,actor_json,data_json,created_at) VALUES (?,?,?,?,?,?,?,?,?,?)',body.id,auth.team_id,publication[1],body.revision,body.kind,body.resource.kind,body.resource.id,JSON.stringify(actor),JSON.stringify(body.data),now)],{status:201,body:response,targetId:body.resource.id});
     send(res,201,response,requestId);return true;
   }
+  // An admin purges published events by id: each one's data becomes a tombstone (and so does the resource snapshot it
+  // left), its row and sequence kept so followers' cursors hold. The request names ids only, never the text purged, and
+  // the log line names the ids. A secret pasted into a card reaches here with the card; this is how it leaves.
+  if(sub==='/events/purge'&&req.method==='POST'){
+    if(!isAdmin(auth))fail(403,'forbidden','an admin purges events');
+    const body=await parseJson(req);exact(body,['events']);
+    if(!Array.isArray(body.events)||!body.events.length||body.events.length>500||body.events.some(id=>typeof id!=='string'||!/^event_[0-9a-f]{64}$/.test(id)))fail(400,'invalid_request','events must name 1 to 500 event ids');
+    const ids=[...new Set(body.events)],found=[];
+    for(const part of batches(ids))found.push(...(await api.store.query(`SELECT id FROM org_events WHERE team_id=? AND id IN (${holes(part)})`,[auth.team_id,...part])).map(row=>row.id));
+    const tombstone='{"purged":true}',response=result(api,auth,{purged:found,unknown:ids.filter(id=>!found.includes(id))});
+    await guardedMutation(api,res,auth,authorityGuards(auth,api.clock.nowMs()),batches(found).flatMap(part=>[
+      stmt(`UPDATE org_events SET data_json=? WHERE team_id=? AND id IN (${holes(part)})`,tombstone,auth.team_id,...part),
+      stmt(`UPDATE event_resources SET event_json=json_set(event_json,'$.data',json(?)) WHERE team_id=? AND json_extract(event_json,'$.id') IN (${holes(part)})`,tombstone,auth.team_id,...part),
+      // Each event was also copied whole into the webhook body of every subscribed installation (migration 015): pending
+      // rows would still deliver it, and finished ones keep it for a week.
+      stmt(`UPDATE app_webhook_deliveries SET body=json_set(body,'$.data',json(?)) WHERE installation_id IN (SELECT id FROM app_installations WHERE team_id=?) AND event_id IN (${holes(part)})`,tombstone,auth.team_id,...part),
+    ]),{status:200,body:response,targetId:null});
+    console.log(`events purged by ${auth.principal_id}: ${found.join(',') || 'none'}`);
+    send(res,200,response,requestId);return true;
+  }
+  // An admin redacts text from named sessions' recorded messages and the captures they came from. The text is in the
+  // request body (never a URL, never logged); the answer and the log line are counts per session. Ids alone cannot find
+  // which messages hold a pasted secret, and a search would carry it in a URL.
+  if(sub==='/sessions/purge'&&req.method==='POST'){
+    if(!isAdmin(auth))fail(403,'forbidden','an admin purges session text');
+    const body=await parseJson(req);exact(body,['sessions','values']);
+    if(!Array.isArray(body.sessions)||!body.sessions.length||body.sessions.length>20||body.sessions.some(id=>typeof id!=='string'||!/^ses_[0-9a-f]{32}$/.test(id)))fail(400,'invalid_request','sessions must name 1 to 20 session ids');
+    if(!Array.isArray(body.values)||!body.values.length||body.values.length>20||body.values.some(v=>typeof v!=='string'||v.length<16||v.length>512||/["\\\u0000-\u001f]/.test(v)))fail(400,'invalid_request','values must be 1 to 20 strings of 16 to 512 characters with no quotes, backslashes or control characters');
+    const marker='[redacted]',counts={};
+    for(const session of new Set(body.sessions)){
+      const natives=(await api.store.query("SELECT DISTINCT json_extract(descriptor_json,'$.native_session_id') AS native FROM bindings WHERE team_id=? AND session_id=?",[auth.team_id,session])).map(row=>row.native).filter(Boolean);
+      const statements=[];
+      for(const value of body.values){
+        statements.push(stmt('UPDATE messages SET value_json=replace(value_json,?,?),search_text=replace(search_text,?,?) WHERE team_id=? AND session_id=? AND (instr(value_json,?)>0 OR instr(search_text,?)>0)',value,marker,value,marker,auth.team_id,session,value,value));
+        if(natives.length)statements.push(stmt(`UPDATE capture_parts SET payload_json=replace(payload_json,?,?) WHERE team_id=? AND instr(payload_json,?)>0 AND capture_id IN (SELECT id FROM captures WHERE team_id=? AND native_id IN (${natives.map(()=>'?').join(',')}))`,value,marker,auth.team_id,value,auth.team_id,...natives));
+      }
+      // The native transcript each capture uploaded (and any export made from it) holds the text byte for byte, behind
+      // a manifest's sha256: those files go whole, so a later native export or continuation answers fidelity_unavailable
+      // rather than the secret. An upload or content-addressed chunk another session still names is kept, and the answer
+      // counts how many kept chunks still hold a value.
+      const mine="SELECT upload_id FROM session_artifacts WHERE team_id=? AND session_id=?",others="SELECT 1 FROM session_artifacts o WHERE o.team_id=? AND o.session_id<>? AND o.upload_id=",both=[auth.team_id,session,auth.team_id,session];
+      const uploads=(await api.store.query(`SELECT DISTINCT upload_id FROM session_artifacts a WHERE team_id=? AND session_id=? AND NOT EXISTS (${others}a.upload_id)`,both)).map(row=>row.upload_id);
+      const blobs=(await api.store.query(`SELECT DISTINCT sha256 FROM artifact_chunk_refs r WHERE team_id=? AND upload_id IN (${mine}) AND NOT EXISTS (${others}r.upload_id)`,[auth.team_id,...both])).map(row=>row.sha256);
+      statements.push(
+        stmt(`DELETE FROM artifact_chunks WHERE team_id=? AND upload_id IN (${mine}) AND NOT EXISTS (${others}artifact_chunks.upload_id)`,auth.team_id,...both),
+        stmt(`DELETE FROM artifact_chunk_refs WHERE team_id=? AND upload_id IN (${mine}) AND NOT EXISTS (${others}artifact_chunk_refs.upload_id)`,auth.team_id,...both),
+        stmt('DELETE FROM session_artifacts WHERE team_id=? AND session_id=?',auth.team_id,session),
+        ...batches(uploads).map(part=>stmt(`DELETE FROM uploads WHERE team_id=? AND id IN (${holes(part)}) AND NOT EXISTS (SELECT 1 FROM session_artifacts a WHERE a.team_id=uploads.team_id AND a.upload_id=uploads.id)`,auth.team_id,...part)),
+        ...batches(blobs).map(part=>stmt(`DELETE FROM artifact_blobs WHERE team_id=? AND sha256 IN (${holes(part)}) AND NOT EXISTS (SELECT 1 FROM artifact_chunk_refs r WHERE r.team_id=artifact_blobs.team_id AND r.sha256=artifact_blobs.sha256)`,auth.team_id,...part)));
+      const before=await api.store.one(`SELECT (SELECT count(*) FROM messages WHERE team_id=? AND session_id=? AND (${body.values.map(()=>'instr(value_json,?)>0').join(' OR ')})) messages`,[auth.team_id,session,...body.values]);
+      await api.store.guardedTransaction(authorityGuards(auth,api.clock.nowMs()),statements);
+      let kept=0,holding=0;
+      for(const part of batches(blobs,70)){
+        const row=await api.store.one(`SELECT count(*) kept,coalesce(sum(${body.values.map(()=>'instr(CAST(bytes AS TEXT),?)>0').join(' OR ')}),0) holding FROM artifact_blobs WHERE team_id=? AND sha256 IN (${holes(part)})`,[...body.values,auth.team_id,...part]);
+        kept+=row?.kept??0;holding+=row?.holding??0;
+      }
+      const left=await api.store.one('SELECT count(*) n FROM session_artifacts WHERE team_id=? AND session_id=?',[auth.team_id,session]);
+      counts[session]={messages:before?.messages??0,natives:natives.length,artifacts_removed:uploads.length,artifacts_left:left?.n??0,chunks_removed:blobs.length-kept,shared_chunks_kept:kept,shared_chunks_holding_value:holding};
+    }
+    console.log(`session text purged by ${auth.principal_id}: ${JSON.stringify(counts)}`);
+    send(res,200,result(api,auth,{sessions:counts}),requestId);return true;
+  }
   if(sub==='/events/catalogue'&&req.method==='GET'){send(res,200,result(api,auth,{kinds:APP_EVENTS}),requestId);return true;}
   if(sub==='/events'&&req.method==='GET'){await eventStream(ctx);return true;}
   return false;