@volter/twin-googleoauth 0.1.1 → 0.1.2

package/dist/src/googleoauth-jwt.js

@@ -11,7 +11,7 @@
 // `node:crypto` is required LAZILY (inside the functions that use it), NOT as a top-level static
 // import, so this module can be pulled into the browser bundle of the consent client without Bun's
 // browser target choking on it — the signing helpers are server-only and never reached there.
-import { applyTwinWrite, projectResources, nodeBuiltin } from '@volter/world-core';
+import { applyTwinWrite, projectResources, nodeBuiltin, runAsVendorMove } from '@volter/world-core';
 function nodeCrypto() {
     // eslint-disable-next-line @typescript-eslint/no-require-imports
     return nodeBuiltin('node:crypto');
@@ -51,13 +51,14 @@ export async function ensureKeypair(root) {
     }
     const { publicKeyPem, privateKeyPem } = keypairGenerator.current();
     const kid = kidFor(publicKeyPem);
-    await applyTwinWrite(SERVICE, {
+    // Google's own signing key: a vendor move, made on first use whoever asks (a read-only request too)
+    await runAsVendorMove(() => applyTwinWrite(SERVICE, {
         operation: '_keypair.create',
         subjectType: KEYPAIR_TYPE,
         subjectId: KEYPAIR_ID,
         fields: { _kid: kid, _publicKeyPem: publicKeyPem, _privateKeyPem: privateKeyPem },
         actor: { kind: 'system' },
-    }, root);
+    }, root));
     return { kid, publicKeyPem, privateKeyPem };
 }
 /** Stable key id = first 40 hex of SHA-1-length SHA-256 over the SPKI DER. Google's own kids are

package/dist/src/googleoauth-server.js

@@ -13,7 +13,7 @@
 // It also tells the handler its OWN origin, so the OIDC discovery document and the consent form's
 // action point BACK AT THE TWIN. Without that a discovery-driven client (openid-client) would read
 // the document and walk straight out to the real accounts.google.com.
-import { serveHttp } from '@volter/world-core';
+import { isReadOnlyRequest, serveHttp, withRequestScopes } from '@volter/world-core';
 import { CONSENT_CLIENT_CSS, CONSENT_CLIENT_JS, CONSENT_SCRIPT_PATH, CONSENT_STYLE_PATH } from "./googleoauth-consent-ui.js";
 import { worldNow, statefulTwinManifest, twinPublicBase } from '@volter/world-core';
 import { handleGoogleOAuthTwinRequest } from "./googleoauth-twin.js";
@@ -31,8 +31,10 @@ import { handleGoogleOAuthTwinRequest } from "./googleoauth-twin.js";
  * plane by `scripts/consent-clients.ts`) — no build and no disk read on the fetch path.
  */
 export function createGoogleOAuthTwinFetch(options = {}) {
-    const readOnly = options.readOnly ?? false;
-    return async function googleOAuthTwinFetch(request) {
+    // a read-only request (x-volter-read-only) is a request to a read-only twin: the flow's writes (a code,
+    // a token, a revoke) are refused as Google-shaped errors, and the kernel refuses any that slip past
+    return withRequestScopes(async function googleOAuthTwinFetch(request) {
+        const readOnly = (options.readOnly ?? false) || isReadOnlyRequest(request);
         const url = new URL(request.url);
         // GET /twin — the discovery manifest (education inside the twin).
         if (request.method === 'GET' && url.pathname.replace(/\/+$/, '') === '/twin') {
@@ -70,7 +72,7 @@ export function createGoogleOAuthTwinFetch(options = {}) {
         }
         out['content-type'] = out['content-type'] ?? 'application/json; charset=utf-8';
         return new Response(JSON.stringify(res.body), { status: res.status, headers: out });
-    };
+    }, { refuse: () => Response.json({ error: 'temporarily_unavailable', error_description: 'this request is read-only' }, { status: 405 }) });
 }
 export async function createGoogleOAuthTwinServer(options) {
     const server = await serveHttp({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-googleoauth",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Local Google OAuth 2.0 / OpenID Connect twin — the real consent screen, the real authorization-code round trip, and real RS256 id_tokens an unmodified OAuth client library completes a full flow against. Built on @volter/world-core.",
   "keywords": [
     "twin",
@@ -57,10 +57,10 @@
     "react-dom": "^19.2.7"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.1"
+    "@volter/world-core": "2.0.2"
   },
   "devDependencies": {
-    "@volter/world-core": "2.0.1",
+    "@volter/world-core": "2.0.2",
     "@volter/world-tooling": "0.1.0",
     "google-auth-library": "^9.15.1",
     "@types/bun": "^1.2.20",

package/src/googleoauth-jwt.ts

@@ -11,7 +11,7 @@
 // `node:crypto` is required LAZILY (inside the functions that use it), NOT as a top-level static
 // import, so this module can be pulled into the browser bundle of the consent client without Bun's
 // browser target choking on it — the signing helpers are server-only and never reached there.
-import { applyTwinWrite, projectResources, nodeBuiltin } from '@volter/world-core';
+import { applyTwinWrite, projectResources, nodeBuiltin, runAsVendorMove } from '@volter/world-core';
 
 type NodeCrypto = typeof import('node:crypto');
 function nodeCrypto(): NodeCrypto {
@@ -62,7 +62,8 @@ export async function ensureKeypair(root?: string): Promise<GoogleOAuthKeypair>
   }
   const { publicKeyPem, privateKeyPem } = keypairGenerator.current();
   const kid = kidFor(publicKeyPem);
-  await applyTwinWrite(
+  // Google's own signing key: a vendor move, made on first use whoever asks (a read-only request too)
+  await runAsVendorMove(() => applyTwinWrite(
     SERVICE,
     {
       operation: '_keypair.create',
@@ -72,7 +73,7 @@ export async function ensureKeypair(root?: string): Promise<GoogleOAuthKeypair>
       actor: { kind: 'system' },
     },
     root,
-  );
+  ));
   return { kid, publicKeyPem, privateKeyPem };
 }
 

package/src/googleoauth-server.ts

@@ -13,7 +13,7 @@
 // It also tells the handler its OWN origin, so the OIDC discovery document and the consent form's
 // action point BACK AT THE TWIN. Without that a discovery-driven client (openid-client) would read
 // the document and walk straight out to the real accounts.google.com.
-import { serveHttp } from '@volter/world-core';
+import { isReadOnlyRequest, serveHttp, withRequestScopes } from '@volter/world-core';
 import { CONSENT_CLIENT_CSS, CONSENT_CLIENT_JS, CONSENT_SCRIPT_PATH, CONSENT_STYLE_PATH } from './googleoauth-consent-ui.ts';
 import { worldNow, statefulTwinManifest, twinPublicBase } from '@volter/world-core';
 import { handleGoogleOAuthTwinRequest } from './googleoauth-twin.ts';
@@ -38,8 +38,10 @@ export interface GoogleOAuthTwinFetchOptions {
  * plane by `scripts/consent-clients.ts`) — no build and no disk read on the fetch path.
  */
 export function createGoogleOAuthTwinFetch(options: GoogleOAuthTwinFetchOptions = {}): (request: Request) => Promise<Response> {
-  const readOnly = options.readOnly ?? false;
-  return async function googleOAuthTwinFetch(request: Request): Promise<Response> {
+  // a read-only request (x-volter-read-only) is a request to a read-only twin: the flow's writes (a code,
+  // a token, a revoke) are refused as Google-shaped errors, and the kernel refuses any that slip past
+  return withRequestScopes(async function googleOAuthTwinFetch(request: Request): Promise<Response> {
+    const readOnly = (options.readOnly ?? false) || isReadOnlyRequest(request);
     const url = new URL(request.url);
     // GET /twin — the discovery manifest (education inside the twin).
     if (request.method === 'GET' && url.pathname.replace(/\/+$/, '') === '/twin') {
@@ -80,7 +82,7 @@ export function createGoogleOAuthTwinFetch(options: GoogleOAuthTwinFetchOptions
     }
     out['content-type'] = out['content-type'] ?? 'application/json; charset=utf-8';
     return new Response(JSON.stringify(res.body), { status: res.status, headers: out });
-  };
+  }, { refuse: () => Response.json({ error: 'temporarily_unavailable', error_description: 'this request is read-only' }, { status: 405 }) });
 }
 
 export async function createGoogleOAuthTwinServer(options: { root?: string; port?: number; readOnly?: boolean }): Promise<{ port: number; stop: () => void }> {