@wtfalch/foundry 0.45.1 → 0.46.0

package/dist/plan/platform-diff.js

@@ -12,6 +12,7 @@ import { PLATFORM_MAIL_RELAY_KEY, planMailRelay } from './mail-relay.js';
 import { MAIL_DATABASE_SCOPE_KEY, mailStoreIsLegacy, mailStoreSwitchChange, mailStoreSwitchDescription, } from './mail-store.js';
 import { planOikosIngress } from './oikos-ingress.js';
 import { callsSfuAppliedFingerprint } from './platform-sfu.js';
+import { postLogoutUpdateOwed, postLogoutUrisFor } from './post-logout-uris.js';
 import { archonInAppHost } from './sign-in-archon.js';
 import { signInDomainBlockedText } from './sign-in-org.js';
 import { withStepSystem } from './step-system.js';
@@ -64,6 +65,12 @@ export const PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY = 'auth_zitadel_a
 export const AUTH_ZITADEL_RUN_OPTIONS = '--entrypoint "/app/zitadel start-from-init --masterkeyFromEnv --tlsMode external"';
 /** The run options last applied to the ZITADEL app (value: the options string), so a changed value forces one redeploy. */
 export const PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY = 'zitadel_platform_auth_run_options_applied';
+/**
+ * The `gitRef` the platform's login, in-app login and broker apps were last built from (value: the ref). A
+ * different declared ref plans the auth step again: it patches `git_branch` on those three apps and
+ * redeploys them, so a release tag named in the declaration reaches the running login.
+ */
+export const PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY = 'platform_auth_applied_git_ref';
 /**
  * #251: the Synapse/MAS image tags an org's calls Matrix stack last
  * successful apply actually set live. `coolifyCalls` (`executor.ts`)
@@ -694,6 +701,31 @@ export const PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY = 'zitadel_platform_access_ap
  * repair while this differs from the recorded client app id.
  */
 export const PLATFORM_ARCHON_ID_TOKEN_USERINFO_APPLIED_SCOPE_KEY = 'archon_id_token_userinfo_applied';
+/**
+ * The marker for Archon's sign-in client once its post-logout addresses were
+ * set: the client's ZITADEL app id and the set it holds
+ * (`postLogoutAppliedValue`). `planArchonPostLogoutUris` plans the update
+ * while this differs from what the declared hostname wants.
+ */
+export const PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY = 'archon_post_logout_applied';
+/**
+ * #394 (decision D2, release one): the role key on the platform's `mail`
+ * ZITADEL project that every mailbox user holds once the project's role check
+ * is on. This release only makes the role and grants it; the check stays off.
+ */
+export const PLATFORM_MAIL_USER_ROLE = 'mail:use';
+/** The mail project id once {@link PLATFORM_MAIL_USER_ROLE} exists on it. */
+export const PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY = 'zitadel_platform_mail_role';
+/** `<mail project id>|<owner user id, or none>` once the owner holds the role. */
+export const PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY = 'zitadel_platform_mail_role_granted';
+/** The mail project id once its role check and has-project check are on (release two, behind an option). */
+export const PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY = 'zitadel_platform_mail_role_check';
+/**
+ * The ZITADEL app id of Archon's sign-in client once `/auth/desktop/callback`
+ * was registered on it (#339). `planArchonDesktopCallback` plans the step
+ * while this differs from the recorded client app id.
+ */
+export const PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY = 'archon_desktop_callback_applied';
 export function appSettingsOf(entry) {
     return {
         folder: entry.folder,
@@ -1324,7 +1356,7 @@ export function planPlatform(platform, live, options = {}) {
     // reconcile below can be planned in the *same* round hc first comes up,
     // the same way files/mail/archon are planned in auth's own first round.
     const hcReady = hc.step !== null || Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_HC_KEY)]);
-    const auth = planAuth(platform, recordedIds, blocked.auth ?? dnsBlocked?.('sign-in'), blocked.authExecutorMissing ?? false, drifted.auth ?? false, blocked.authOtherInputsMissing ?? [], blocked.authOwnerInvite);
+    const auth = planAuth(platform, recordedIds, blocked.auth ?? dnsBlocked?.('sign-in'), blocked.authExecutorMissing ?? false, drifted.auth ?? false, blocked.authOtherInputsMissing ?? [], blocked.authOwnerInvite, drifted.authApps ?? false);
     if (auth.step)
         plannedSteps.push(auth.step);
     // #174: the integrations host. Planned after auth; neither step reads the
@@ -1414,6 +1446,20 @@ export function planPlatform(platform, live, options = {}) {
     const idTokenUserinfo = planArchonIdTokenUserinfo(platform, recordedIds, blocked.archonIdTokenUserinfo ?? false);
     if (idTokenUserinfo)
         plannedSteps.push(idTokenUserinfo);
+    const postLogoutUris = planArchonPostLogoutUris(platform, recordedIds, blocked.archonPostLogoutUris ?? false);
+    if (postLogoutUris)
+        plannedSteps.push(postLogoutUris);
+    // #339: Archon's sign-in client takes the desktop callback too.
+    const desktopCallback = planArchonDesktopCallback(platform, recordedIds, blocked.archonDesktopCallback ?? false);
+    if (desktopCallback)
+        plannedSteps.push(desktopCallback);
+    // #394: the mail role and its grants. After the auth and mail steps, which record what it reads.
+    const mailRole = planMailRole(platform, recordedIds, {
+        role: blocked.mailRole ?? false,
+        check: blocked.mailRoleCheck ?? false,
+    });
+    if (mailRole.step)
+        plannedSteps.push(mailRole.step);
     // #669: after the ID token repair too, which is proven; a policy call that fails every time holds up nothing.
     const signInPolicy = planAuthSignInPolicy(platform, recordedIds, blocked.authSignInPolicy ?? false);
     if (signInPolicy)
@@ -1481,6 +1527,8 @@ export function planPlatform(platform, live, options = {}) {
         unmanaged.push({ description: auth.blocked, key: 'auth' });
     if (mail.blocked)
         unmanaged.push({ description: mail.blocked, key: 'mail' });
+    if (mailRole.blocked)
+        unmanaged.push({ description: mailRole.blocked, key: 'mail-role' });
     if (relay.blocked)
         unmanaged.push({ description: relay.blocked, key: 'mail-relay' });
     if (platform.mail.relay === true) {
@@ -1946,7 +1994,7 @@ function planSfu(platform, callsOrgSlugs, recordedIds) {
  * promising "this apply re-mints" while one of those is still missing would
  * be wrong the moment it is read.
  */
-function planAuth(platform, recordedIds, executorBlocked, executorMissing, authDrifted, otherInputsMissing = [], ownerInviteBlocked) {
+function planAuth(platform, recordedIds, executorBlocked, executorMissing, authDrifted, otherInputsMissing = [], ownerInviteBlocked, appsDown = false) {
     if (!platform.auth.enabled)
         return { step: null, blocked: null };
     // C3/S2: standing notes. The invite and the domain wait on a person; they hold nothing else back.
@@ -1977,7 +2025,14 @@ function planAuth(platform, recordedIds, executorBlocked, executorMissing, authD
     // comment for why this never holds the step back the way the admin key's
     // own `undelivered` check below does.
     const loginClientUndelivered = recordedIds[PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY];
-    if (recordedIds[key] &&
+    if (
+    // #643: the apps recorded, but one is gone or stopped. The step finds each by name, deploys what is not
+    // running and mints nothing while the records stand.
+    !appsDown &&
+        // #741: a refused owner-org domain (blocked key recorded, domain not) is tried again on the next apply.
+        // While it stays refused the step is planned on every run, each spending about five seconds; known, no code.
+        ownerDomainBlockedText(recordedIds) === null &&
+        recordedIds[key] &&
         connectorApplied &&
         brokerApplied &&
         brokerDeployed &&
@@ -1995,7 +2050,8 @@ function planAuth(platform, recordedIds, executorBlocked, executorMissing, authD
                 recordedIds[PLATFORM_OWNER_ORG_SCOPE_KEY]) &&
         // The ZITADEL run options reach the container only through the auth
         // step's redeploy, so a platform recorded before them still plans it.
-        recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS) {
+        recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS &&
+        recordedIds[PLATFORM_AUTH_APPLIED_GIT_REF_SCOPE_KEY] === platform.auth.gitRef) {
         return { step: null, blocked: standingNote };
     }
     // The admin key was minted but never reached the host. ZITADEL shows a
@@ -2542,6 +2598,97 @@ function planArchonIdTokenUserinfo(platform, recordedIds, wired) {
         },
     };
 }
+/**
+ * #394, decision D2 (release one): one `zitadel:mail-role` step keyed
+ * {@link PLATFORM_MAIL_KEY}. It makes the role {@link PLATFORM_MAIL_USER_ROLE}
+ * on the mail project, grants it to the platform owner, and (only when the host
+ * asks, `wired.check`) turns on the project's role check on a later run than the
+ * grant. It waits until the mail project, the platform's ZITADEL org and the
+ * owner invite are recorded.
+ *
+ * The owner's user lives in the owner company's sign-in org, and the mail project
+ * in the platform's own org. A role grant on a project of another org needs a
+ * project grant with role keys, which the ports do not have; the owner's grant
+ * is reported blocked, not attempted, and the role is still made.
+ */
+function planMailRole(platform, recordedIds, wired) {
+    if (!wired.role || !platform.mail.enabled || !platform.auth.enabled) {
+        return { step: null, blocked: null };
+    }
+    const projectId = recordedIds[PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY];
+    const orgId = recordedIds[PLATFORM_ZITADEL_ORG_SCOPE_KEY];
+    const invite = recordedIds[PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY];
+    if (!projectId || !orgId || !invite)
+        return { step: null, blocked: null };
+    const sameOrg = invite === 'none' || recordedIds[PLATFORM_AUTH_OWNER_INVITE_ORG_SCOPE_KEY] === orgId;
+    const blocked = sameOrg
+        ? null
+        : "the platform owner's mail role is blocked, not planned: the owner is in another ZITADEL org than the mail project, and a role grant across orgs needs a project grant with role keys, which is not built";
+    const needsRole = recordedIds[PLATFORM_MAIL_ROLE_ENSURED_SCOPE_KEY] !== projectId;
+    const granted = recordedIds[PLATFORM_MAIL_ROLE_GRANTED_SCOPE_KEY] === `${projectId}|${invite}`;
+    // The check is planned only after a grant an earlier apply made, never with the first grant,
+    // and never while the owner holds no role (it would lock the owner out).
+    const needsCheck = wired.check &&
+        sameOrg &&
+        granted &&
+        recordedIds[PLATFORM_MAIL_ROLE_CHECK_SCOPE_KEY] !== projectId;
+    if (!needsRole && !(sameOrg && !granted) && !needsCheck)
+        return { step: null, blocked };
+    return {
+        step: {
+            action: { system: 'zitadel', kind: 'mail-role', key: PLATFORM_MAIL_KEY, desired: {} },
+            step: {
+                description: `make the mail role '${PLATFORM_MAIL_USER_ROLE}' on the mail project and grant it to the platform owner`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked,
+    };
+}
+function planArchonDesktopCallback(platform, recordedIds, wired) {
+    if (!wired || !platform.archon.enabled)
+        return null;
+    const appId = recordedIds[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
+    if (!appId || recordedIds[PLATFORM_ARCHON_DESKTOP_CALLBACK_APPLIED_SCOPE_KEY] === appId) {
+        return null;
+    }
+    return {
+        action: { system: 'zitadel', kind: 'desktop-callback', key: PLATFORM_ARCHON_KEY, desired: {} },
+        step: {
+            description: "register the desktop sign-in callback on Archon's sign-in client",
+            destroys: false,
+            migrates: false,
+        },
+    };
+}
+/**
+ * Archon's sign-in client holds its root and `/auth/signed-out` as post-logout
+ * addresses. One `zitadel:post-logout-uris` step keyed {@link PLATFORM_ARCHON_KEY},
+ * planned while {@link PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY} differs
+ * from the recorded client app id and the declared hostname's set (a client
+ * made again records it at creation). Not planned when the host's ZITADEL
+ * client lacks the method, and not blocked either.
+ */
+function planArchonPostLogoutUris(platform, recordedIds, wired) {
+    if (!wired || !platform.archon.enabled)
+        return null;
+    const appId = recordedIds[PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY];
+    if (!appId)
+        return null;
+    const uris = postLogoutUrisFor([platform.archon.hostname]);
+    if (!postLogoutUpdateOwed(recordedIds[PLATFORM_ARCHON_POST_LOGOUT_APPLIED_SCOPE_KEY], appId, uris)) {
+        return null;
+    }
+    return {
+        action: { system: 'zitadel', kind: 'post-logout-uris', key: PLATFORM_ARCHON_KEY, desired: {} },
+        step: {
+            description: "update the post-logout addresses of Archon's sign-in client",
+            destroys: false,
+            migrates: false,
+        },
+    };
+}
 /**
  * #394, #669: the platform's sign-in org reserves the username `admin` and
  * switches self-registration off. One `zitadel:sign-in-policy` step keyed
@@ -3061,6 +3208,14 @@ function planArchon(platform, recordedIds, executorBlocked, ownerSignIn, ownerFi
     // A deploy the step triggered is still running: planning it again would deploy twice.
     if (deployRunning)
         return { step: null, blocked: deployRunning };
+    // Giving Archon's address up edits the in-app login app's host table: without that app's id the binding
+    // cannot be removed, so nothing is planned (and the address is not recorded as given up).
+    if (ownerSignIn && !ownerSignIn.signInLoginAppId && archonInAppHost(recordedIds) !== '') {
+        return {
+            step: null,
+            blocked: "Archon's own sign-in address cannot be given up: the owner company's in-app login app is not recorded",
+        };
+    }
     const key = resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY);
     const archonOrgId = recordedIds[PLATFORM_ARCHON_ORG_SCOPE_KEY];
     const applied = Boolean(recordedIds[key]) &&

package/dist/plan/platform-org.d.ts

@@ -104,6 +104,8 @@ export interface OrgPlatformReadiness {
     platformZitadelIds?: readonly string[];
     /** The second login app that serves `/sign-in` for companies with `signIn.inApp` is applied. Absent reads as false. */
     signInLoginReady?: boolean;
+    /** `LOGIN_SESSION_BIND_KEY` is live on the in-app login app (`sign_in_bind_key_ready`). Absent reads as false. */
+    signInBindKeyReady?: boolean;
     /** The platform's own sign-in (#168), which every org's own ZITADEL org lives inside. */
     authReady: boolean;
     /**

package/dist/plan/platform-org.js

@@ -1,5 +1,6 @@
 import { ownsServices } from '../org.js';
 import { ZITADEL_ORG_SCOPE_KEY, agoraHostnameFor } from './agora.js';
+import { SIGN_IN_BIND_KEY_SCOPE_KEY } from './cookie-domain.js';
 import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './held-key-refs.js';
 import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-host.js';
@@ -161,6 +162,9 @@ edgePortPresent = false) {
             ? { platformAuthRecordedHost: platform.auth.hostname }
             : {}),
         ...(platformRecordedIds[SIGN_IN_LOGIN_APP_SCOPE_KEY] ? { signInLoginReady: true } : {}),
+        ...(platformRecordedIds[SIGN_IN_BIND_KEY_SCOPE_KEY] === '1'
+            ? { signInBindKeyReady: true }
+            : {}),
         authReady,
         authIssuer: authReady ? `https://${platform.auth.hostname}` : null,
         jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,

package/dist/plan/platform-providers.d.ts

@@ -391,6 +391,10 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
         archonRunsInsideApp?: boolean;
         archonDeployRunning?: string;
         archonIdTokenUserinfo?: boolean;
+        archonPostLogoutUris?: boolean;
+        archonDesktopCallback?: boolean;
+        mailRole?: boolean;
+        mailRoleCheck?: boolean;
         authSignInPolicy?: boolean;
         archonOrg?: string;
         archonOrgInvite?: string;
@@ -716,7 +720,13 @@ export interface PlatformMailDeps {
      * checks an access token's `aud` claim against -- #346, no host has to
      * register a resource API for this by hand any more.
      */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject'>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject'> & Partial<Pick<ZitadelPort, 'ensureProjectRole' | 'grantProjectRoles' | 'setProjectRoleChecks'>>;
+    /**
+     * #394 (decision D2): turn on the mail project's role check and has-project check. Default off:
+     * release one only makes the role and grants it, and the check follows in release two, on a
+     * run after the grant. Needs `setProjectRoleChecks` on the client.
+     */
+    requireMailRole?: boolean;
     /** {@link PlatformArchonDeps.zitadelForInstance}, for Stalwart's OIDC directory. */
     zitadelForInstance?: (issuerUrl: string) => PlatformMailDeps['zitadel'];
     /**
@@ -917,7 +927,7 @@ export interface PlatformArchonDeps {
     access: PlatformAccessFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp' | 'updateOidcAppIdTokenUserinfoAssertion'> & Partial<Pick<ZitadelPort, 'ensureTrustedDomain' | 'deleteTrustedDomain' | 'updateOidcAppLoginBaseUri' | 'allowPerAppLoginBaseUri'>>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp' | 'updateOidcAppIdTokenUserinfoAssertion'> & Partial<Pick<ZitadelPort, 'ensureTrustedDomain' | 'deleteTrustedDomain' | 'updateOidcAppLoginBaseUri' | 'allowPerAppLoginBaseUri' | 'updateOidcAppPostLogoutRedirectUris' | 'getOidcAppRedirectUris' | 'updateOidcAppRedirectUris'>>;
     /**
      * {@link PlatformAuthDeps.zitadelForInstance}, for Archon's sign-in client:
      * the owner company's own ZITADEL, by its issuer and the held-key reference of