@zackbart/connecta 0.32.0 → 0.33.0

package/dist/routes/activity.js

@@ -1,10 +1,10 @@
 import { activityEventVisible } from "./activity-disclosure.js";
-import { Duration, Effect } from "effect";
+import { Effect } from "effect";
 import { activityBehaviorFacts, activityPackageVersion, activityClientFact, InvalidActivityCursorError, } from "../activity.js";
 import { failureRecord, logFailure } from "../operator-record.js";
-import { ACTOR_LABEL_BUDGET_MS, ACTOR_LABEL_CONCURRENCY, actorKey, cleanActorLabel, labelLookups, } from "./actor-labels.js";
+import { actorKey, resolveActorLabels } from "./actor-labels.js";
 import { authorized, refuse, serveOperator, visibleRegistry } from "./operator.js";
-import { privateJson } from "./shared.js";
+import { privateJson, readsActivity } from "./shared.js";
 /**
  * Add display-only actor labels to one authorized activity page. Resolution is
  * best-effort, bounded, and read-time only: stored events retain stable ids and
@@ -15,50 +15,42 @@ import { privateJson } from "./shared.js";
  * abandoned, as they are when the reader leaves.
  */
 function enrichActivityActorLabels(page, auth) {
-    return Effect.suspend(() => {
-        const labels = new Map();
-        const resolve = ({ key, id, provider }) => Effect.tryPromise(() => Promise.resolve(provider.activityActorLabel(id))).pipe(Effect.map(cleanActorLabel), Effect.orElseSucceed(() => undefined), Effect.map((label) => {
-            if (label)
-                labels.set(key, label);
-        }));
-        return Effect.forEach(labelLookups(page.events.map((event) => event.actor), auth), resolve, {
-            concurrency: ACTOR_LABEL_CONCURRENCY,
-            discard: true,
-        }).pipe(Effect.timeoutOption(Duration.millis(ACTOR_LABEL_BUDGET_MS)), Effect.map(() => ({
-            ...page,
-            events: page.events.map((event) => {
-                const resolved = event.actor.id ? labels.get(actorKey(event.actor)) : undefined;
-                // Never trust or echo a `label` supplied by storage. The persisted event
-                // schema has no label; only this authenticated read path may add one.
-                const actor = {
-                    kind: event.actor.kind,
-                    ...(event.actor.id ? { id: event.actor.id } : {}),
-                    ...(event.actor.namespace ? { namespace: event.actor.namespace } : {}),
-                };
-                // Re-check stored client facts, including custom readers and old rows.
-                const { packageVersion: suppliedPackageVersion, clientName: suppliedName, clientVersion: suppliedVersion, classification: _classification, resultBytes: _resultBytes, kind: _kind, drift: _drift, pool: _pool, actorBasis: _actorBasis, ...record } = event;
-                const packageVersion = activityPackageVersion(suppliedPackageVersion);
-                const clientName = activityClientFact(suppliedName, "name");
-                const clientVersion = activityClientFact(suppliedVersion, "version");
-                return {
-                    ...record,
-                    ...activityBehaviorFacts(event),
-                    ...(packageVersion !== undefined ? { packageVersion } : {}),
-                    ...(clientName !== undefined ? { clientName } : {}),
-                    ...(clientVersion !== undefined ? { clientVersion } : {}),
-                    actor: resolved ? { ...actor, label: resolved } : actor,
-                };
-            }),
-        })));
-    });
+    return resolveActorLabels(page.events.map((event) => event.actor), auth).pipe(Effect.map((labels) => ({
+        ...page,
+        events: page.events.map((event) => {
+            const resolved = event.actor.id ? labels.get(actorKey(event.actor)) : undefined;
+            // Never trust or echo a `label` supplied by storage. The persisted event
+            // schema has no label; only this authenticated read path may add one.
+            const actor = {
+                kind: event.actor.kind,
+                ...(event.actor.id ? { id: event.actor.id } : {}),
+                ...(event.actor.namespace ? { namespace: event.actor.namespace } : {}),
+            };
+            // Re-check stored client facts, including custom readers and old rows.
+            const { packageVersion: suppliedPackageVersion, clientName: suppliedName, clientVersion: suppliedVersion, classification: _classification, resultBytes: _resultBytes, kind: _kind, drift: _drift, pool: _pool, actorBasis: _actorBasis, ...record } = event;
+            const packageVersion = activityPackageVersion(suppliedPackageVersion);
+            const clientName = activityClientFact(suppliedName, "name");
+            const clientVersion = activityClientFact(suppliedVersion, "version");
+            return {
+                ...record,
+                ...activityBehaviorFacts(event),
+                ...(packageVersion !== undefined ? { packageVersion } : {}),
+                ...(clientName !== undefined ? { clientName } : {}),
+                ...(clientVersion !== undefined ? { clientVersion } : {}),
+                actor: resolved ? { ...actor, label: resolved } : actor,
+            };
+        }),
+    })));
 }
 function activityRead(context) {
     const { url, opts } = context;
     return Effect.gen(function* () {
         const authz = yield* authorized(context);
+        // A maintainer principal, interactive or not (#837); members and agents
+        // get the private 404 every operator route gives them.
+        if (!readsActivity(context.opts, authz))
+            return yield* refuse("not found", 404);
         const registry = yield* visibleRegistry(context, authz);
-        if (!authz.operator)
-            return yield* refuse("activity access required", 403);
         if (opts.config.activity?.readGate &&
             !(yield* Effect.promise(async () => opts.config.activity?.readGate(authz.actor)))) {
             return yield* refuse("forbidden", 403);
@@ -66,19 +58,7 @@ function activityRead(context) {
         const list = opts.config.activity?.store.list?.bind(opts.config.activity?.store);
         if (!list)
             return yield* refuse("activity history is not configured", 404);
-        const admittedPools = new Set();
-        for (const [name, pool] of opts.pools) {
-            if (yield* Effect.promise(async () => {
-                try {
-                    return (await pool.grant(authz.identity)) === true;
-                }
-                catch {
-                    return false;
-                }
-            }))
-                admittedPools.add(name);
-        }
-        const visible = (event) => activityEventVisible(context, authz, registry, admittedPools, event);
+        const visible = (event) => activityEventVisible(context, authz, registry, event);
         const cursor = url.searchParams.get("cursor") ?? undefined;
         if (cursor && cursor.length > 500)
             return yield* refuse("invalid cursor", 400);

package/dist/routes/actor-labels.js

@@ -2,11 +2,12 @@
 // read time from the one auth provider that owns the actor's directory, and
 // only on an authorized read path. Nothing here is persisted, and a label a
 // store happens to carry is never trusted or echoed.
+import { Duration, Effect } from "effect";
 import { activityActorNamespace } from "./shared.js";
-export const ACTOR_LABEL_CONCURRENCY = 8;
-export const ACTOR_LABEL_BUDGET_MS = 1_500;
+const ACTOR_LABEL_CONCURRENCY = 8;
+const ACTOR_LABEL_BUDGET_MS = 1_500;
 const ACTOR_LABEL_MAX_LENGTH = 160;
-export function cleanActorLabel(value) {
+function cleanActorLabel(value) {
     if (typeof value !== "string")
         return undefined;
     const compact = value.replace(/\s+/gu, " ").trim();
@@ -22,7 +23,7 @@ export function actorKey(actor) {
  * the actor's directory. An actor no provider can claim unambiguously gets no
  * lookup at all.
  */
-export function labelLookups(actors, auth) {
+function labelLookups(actors, auth) {
     const identities = new Map();
     for (const actor of actors) {
         if (!actor.id)
@@ -65,3 +66,31 @@ export function labelLookups(actors, auth) {
     }
     return lookups;
 }
+/**
+ * Resolve labels for these actors, keyed by `actorKey`. Best-effort and
+ * bounded: at most eight lookups run at once, and whatever has resolved
+ * within 1.5 seconds in all is used; the rest are abandoned, as they are when
+ * the reader leaves. A lookup that fails or answers nothing usable is absent.
+ */
+export function resolveActorLabels(actors, auth) {
+    return Effect.suspend(() => {
+        const labels = new Map();
+        const resolve = ({ key, id, provider }) => Effect.tryPromise(() => Promise.resolve(provider.activityActorLabel(id))).pipe(Effect.map(cleanActorLabel), Effect.orElseSucceed(() => undefined), Effect.map((label) => {
+            if (label)
+                labels.set(key, label);
+        }));
+        return Effect.forEach(labelLookups(actors, auth), resolve, {
+            concurrency: ACTOR_LABEL_CONCURRENCY,
+            discard: true,
+        }).pipe(Effect.timeoutOption(Duration.millis(ACTOR_LABEL_BUDGET_MS)), Effect.map(() => labels));
+    });
+}
+/**
+ * The activity actor a listed person would be recorded as: the principal in
+ * the namespace of the interactive provider that owns that directory. People
+ * no interactive provider owns have no actor, and so no label.
+ */
+export function principalActor(principal, auth) {
+    const provider = auth.find((candidate) => candidate.interactiveOperator && activityActorNamespace(candidate) === principal.namespace);
+    return provider ? { kind: provider.kind, id: principal.id, namespace: principal.namespace } : undefined;
+}

package/dist/routes/agent-path.js

@@ -0,0 +1,43 @@
+// Agent endpoint paths (#837, decisions/0006). Cloudflare Access bypasses
+// `/agent/*` at the edge after resolving dot segments, folding case, decoding
+// unreserved escapes, and collapsing a leading `//`, while the Worker sees
+// the raw pathname. So connecta claims every path Access might treat as
+// `/agent/*`, and admits only the one exact, raw spelling of a pool.
+/** Pool names, as `createConnecta` validates them. */
+const POOL_NAME_RE = /^[a-z0-9_-]+$/;
+/** Escapes decoded before giving up and treating the path as an agent path. */
+const MAX_DECODE_ROUNDS = 8;
+/**
+ * The pool an agent endpoint names, or undefined. The raw pathname must be
+ * byte-equal to `/agent/` plus a well-formed pool name: no decoding, case
+ * folding, slash collapsing, trailing slash, extra segment, or `%`.
+ */
+export function agentEndpointPool(path) {
+    if (!path.startsWith("/agent/"))
+        return undefined;
+    const pool = path.slice("/agent/".length);
+    return POOL_NAME_RE.test(pool) ? pool : undefined;
+}
+/**
+ * Whether a pathname belongs to the agent namespace: anything that starts
+ * with `/agent` once every escape is decoded, case is folded, and slashes are
+ * collapsed. This is deliberately wider than Access's own matching, so no
+ * path the edge bypasses can fall through to a human route.
+ */
+export function isAgentPath(path) {
+    let value = path;
+    for (let round = 0; value.includes("%"); round++) {
+        // Still encoded after the bound: refuse it with the agent 404.
+        if (round === MAX_DECODE_ROUNDS)
+            return true;
+        const decoded = value.replace(/%([0-9a-f]{2})/gi, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+        if (decoded === value)
+            break;
+        value = decoded;
+    }
+    return value
+        .replace(/\\/g, "/")
+        .replace(/\/{2,}/g, "/")
+        .toLowerCase()
+        .startsWith("/agent");
+}

package/dist/routes/connect.js

@@ -8,7 +8,7 @@ import { drainOAuthStartResets } from "../auth/oauth-start-reset.js";
 import { finishOAuthConnectStart, consumeOAuthConnectLink, oauthConnectUnavailable, verifyOAuthHandoff, } from "../oauth-handoff.js";
 import { failureRecord, logFailure } from "../operator-record.js";
 import { runEdge, withDeadlineEffect } from "../runtime/run.js";
-import { authorizeUiIdentity, mayManageConnector, privateJson, validateAuthPermissions, withSessionCookies, } from "./shared.js";
+import { admitsMaintainer, authorizeUiIdentity, mayManageConnector, privateJson, withSessionCookies, } from "./shared.js";
 const START_TIMEOUT_MS = 30_000;
 /** Clerk establishes a browser session on this origin before retrying the link. */
 function clerkSignIn(context) {
@@ -84,33 +84,37 @@ async function connect(context) {
             headers: { Location: target.href, "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" },
         });
     };
-    const authz = await authorizeUiIdentity(request, baseUrl, opts.config.auth, "OAuth connection", runtimeContext, opts.config.identity);
+    const authz = await authorizeUiIdentity(request, baseUrl, opts.config.auth, "OAuth connection", runtimeContext);
     if (!authz.ok) {
         // Access sign-in is enforced at the edge. Clerk needs its own sign-in page.
+        // The sign-in page returns to this link, which then sends a maintainer on
+        // to the operator UI. Pool members cannot use that UI yet (#837), so
+        // signing in there would strand them.
         if (authz.response.status === 401 &&
             authorizationCredential(request).kind === "absent" &&
             !runtimeContext?.access) {
-            if (opts.config.ui)
-                return authPage();
             const signIn = clerkSignIn(context);
             if (signIn)
                 return signIn;
+            if (opts.config.ui)
+                return authPage();
         }
         return authz.response;
     }
-    try {
-        validateAuthPermissions(authz, opts.registry);
-    }
-    catch {
-        return refuse("forbidden");
-    }
     const connector = opts.registry.getConnector(id);
-    if (authz.principalKey !== handoff.principal || !mayManageConnector(authz, connector)) {
+    // Visibility is the caller's pools, or everything for a maintainer, so a
+    // member may connect a personal connector in a pool they belong to.
+    if (authz.principalKey !== handoff.principal || !mayManageConnector(opts, authz, connector)) {
         return refuse("Sign in as the user who requested this connection and has permission to manage it.");
     }
+    // The operator UI serves maintainers only until member views ship (#837).
+    // A member's OAuth link starts here directly, as it does without a UI.
+    const viaUi = Boolean(opts.config.ui) && admitsMaintainer(opts, authz);
     if (!connector.startAuth) {
         if (!connector.credential || !opts.config.ui || !opts.config.vault)
             return refuse("unknown OAuth connector", 404);
+        if (!viaUi)
+            return refuse("Credential entry is in the operator UI, which only maintainers can use for now.");
         let target;
         try {
             target = new URL(opts.config.ui.credentialHandoffUrl(baseUrl), baseUrl);
@@ -133,7 +137,7 @@ async function connect(context) {
             },
         }), authz.sessionCookies);
     }
-    if (opts.config.ui && context.url.searchParams.get("start") !== "1")
+    if (viaUi && context.url.searchParams.get("start") !== "1")
         return withSessionCookies(authPage(), authz.sessionCookies);
     const registry = opts.registry.scoped({
         connectorIds: [id],

package/dist/routes/credentials.js

@@ -2,45 +2,10 @@ import { failureRecord, logFailure } from "../operator-record.js";
 import { Effect } from "effect";
 import { claimConnectorScopeCleanup, closeConnectorScope } from "../connector-scope.js";
 import { credentialTestRule, describeCredentialTestMismatch, storedCredentialShape } from "../credential-rules.js";
-import { authorizedPerson, refuse, serveOperator, visibleRegistry } from "./operator.js";
-import { mayManageConnector, isSameOrigin, msg, privateJson } from "./shared.js";
+import { authorizedPerson, refuse, serveOperator, managementRegistry } from "./operator.js";
+import { boundedText, mayManageConnector, isSameOrigin, msg, privateJson } from "./shared.js";
 /** The longest body, in characters, a credential write accepts. */
 const MAX_BODY_CHARS = 20_000;
-/**
- * The most UTF-8 a body within MAX_BODY_CHARS can take. No UTF-16 unit costs
- * more than three bytes, and a malformed sequence decodes to one U+FFFD per
- * at most three bytes, so a body past this many bytes is past the character
- * limit too — and reading stops there, instead of buffering whatever a client
- * cares to send before measuring it.
- */
-const MAX_BODY_BYTES = MAX_BODY_CHARS * 3;
-/** The body as text, or undefined once it is longer than MAX_BODY_CHARS. */
-async function boundedText(request) {
-    if (!request.body)
-        return "";
-    const reader = request.body.getReader();
-    const chunks = [];
-    let size = 0;
-    for (;;) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        size += value.byteLength;
-        if (size > MAX_BODY_BYTES) {
-            reader.cancel().catch(() => { });
-            return undefined;
-        }
-        chunks.push(value);
-    }
-    const bytes = new Uint8Array(size);
-    let offset = 0;
-    for (const chunk of chunks) {
-        bytes.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    const text = new TextDecoder().decode(bytes);
-    return text.length > MAX_BODY_CHARS ? undefined : text;
-}
 /** Field-by-field checks, in words the Credentials page shows as written. */
 function credentialInput(body, config) {
     if (!config.fields?.length) {
@@ -73,7 +38,7 @@ function readCredentialInput(request, config) {
         if (!request.headers.get("content-type")?.toLowerCase().startsWith("application/json")) {
             return yield* refuse("Content-Type must be application/json", 415);
         }
-        const raw = yield* Effect.promise(() => boundedText(request));
+        const raw = yield* Effect.promise(() => boundedText(request, MAX_BODY_CHARS));
         if (raw === undefined)
             return yield* refuse("request body is too large", 413);
         let body;
@@ -99,12 +64,12 @@ function credentialRequest(context, connectorId, action) {
             return yield* refuse("same-origin request required", 403);
         }
         const authz = yield* authorizedPerson(context, "credential management");
-        const registry = yield* visibleRegistry(context, authz);
+        const registry = yield* managementRegistry(context, authz);
         const connector = registry.getConnector(connectorId);
         const credential = connector?.credential;
         if (!connector || !credential)
             return yield* refuse("unknown credential slot", 404);
-        if (!mayManageConnector(authz, connector)) {
+        if (!mayManageConnector(opts, authz, connector)) {
             return yield* refuse("credential management is not permitted", 403);
         }
         const personal = connector.authScope === "personal";
@@ -191,6 +156,17 @@ function credentialRequest(context, connectorId, action) {
             }).pipe(Effect.catch((error) => refuse(msg(error), 400)));
         }
         if (request.method === "DELETE") {
+            // Clearing nothing is refused, as testing nothing is, so the route
+            // agrees with the operator contract, which offers `clear` only once a
+            // value is stored in the caller's partition (#837). A value that cannot
+            // be read may still be cleared: removing it is how one recovers.
+            const stored = yield* Effect.tryPromise({
+                try: () => vault.metadata(connectorId, owner),
+                catch: (error) => error,
+            }).pipe(Effect.orElseSucceed(() => "unreadable"));
+            if (stored === null) {
+                return privateJson({ error: "no credential is stored to clear", problem: "credential_required" }, { status: 409 });
+            }
             yield* Effect.promise(() => vault.delete(connectorId, owner));
             yield* Effect.promise(() => registry.invalidateStored(connectorId));
             return new Response(null, {