@zhin.js/host-http 1.2.0 → 1.2.2

package/src/console-rpc-handlers.ts

@@ -257,14 +257,71 @@ export async function dispatchHostResourceConsoleRpc(
       const page = positiveInteger(message.page, 1);
       const pageSize = Math.min(positiveInteger(message.pageSize, 50), 500);
       const where = recordField(message.where);
+      const order = recordField(message.orderBy);
+      if (message.orderBy !== undefined && message.orderBy !== null
+        && (!order || typeof order.column !== 'string' || (order.direction !== 'asc' && order.direction !== 'desc'))) {
+        errorReply(payloads, requestId, 'orderBy must be { column, direction: "asc" | "desc" }');
+        return true;
+      }
       if (!ctx.database) {
         emit({ requestId, data: { rows: [], total: 0, page, pageSize } });
         return true;
       }
       try {
-        emit({ requestId, data: await ctx.database.select(table, page, pageSize, where) });
+        const orderBy = order ? { column: order.column as string, direction: order.direction as 'asc' | 'desc' } : undefined;
+        emit({ requestId, data: await ctx.database.select(table, page, pageSize, where, orderBy) });
+      } catch (error) {
+        emit({ requestId, error: `Failed to select: ${errorMessage(error)}`, ...refusalData(error) });
+      }
+      return true;
+    }
+    case 'db:query': {
+      const sql = sqlField(message);
+      if (!sql) { errorReply(payloads, requestId, `sql is required (at most ${MAX_CONSOLE_SQL_LENGTH} characters)`); return true; }
+      if (!ctx.database?.query) { unsupportedDatabaseFeature(payloads, requestId, 'SQL query'); return true; }
+      try {
+        const maxRows = typeof message.maxRows === 'number' ? message.maxRows : undefined;
+        emit({ requestId, data: await ctx.database.query(sql, maxRows ? { maxRows } : undefined) });
+      } catch (error) {
+        emit({ requestId, error: errorMessage(error), ...refusalData(error) });
+      }
+      return true;
+    }
+    case 'db:execute': {
+      const sql = sqlField(message);
+      if (!sql) { errorReply(payloads, requestId, `sql is required (at most ${MAX_CONSOLE_SQL_LENGTH} characters)`); return true; }
+      if (!ctx.database?.execute) { unsupportedDatabaseFeature(payloads, requestId, 'SQL execution'); return true; }
+      try {
+        emit({ requestId, data: await ctx.database.execute(sql, { dryRun: message.dryRun === true }) });
+      } catch (error) {
+        emit({ requestId, error: errorMessage(error), ...refusalData(error) });
+      }
+      return true;
+    }
+    case 'db:schema:describe': {
+      const table = stringField(message, 'table');
+      if (!table) { errorReply(payloads, requestId, 'table is required'); return true; }
+      if (!ctx.database?.describe) { unsupportedDatabaseFeature(payloads, requestId, 'Schema inspection'); return true; }
+      try {
+        emit({ requestId, data: await ctx.database.describe(table) });
+      } catch (error) {
+        emit({ requestId, error: errorMessage(error), ...refusalData(error) });
+      }
+      return true;
+    }
+    case 'db:schema:preview':
+    case 'db:schema:apply': {
+      const change = recordField(message.change);
+      if (!change) { errorReply(payloads, requestId, 'change is required'); return true; }
+      const database = ctx.database;
+      if (!database?.previewSchema || !database.applySchema) { unsupportedDatabaseFeature(payloads, requestId, 'Schema editing'); return true; }
+      try {
+        const plan = type === 'db:schema:apply'
+          ? await database.applySchema(change, typeof message.confirm === 'string' ? message.confirm : undefined)
+          : await database.previewSchema(change);
+        emit({ requestId, data: plan });
       } catch (error) {
-        emit({ requestId, error: `Failed to select: ${errorMessage(error)}` });
+        emit({ requestId, error: errorMessage(error), ...refusalData(error) });
       }
       return true;
     }
@@ -532,6 +589,46 @@ export async function dispatchHostResourceConsoleRpc(
   }
 }
 
+/** Longest statement text the Console SQL editor sends. */
+export const MAX_CONSOLE_SQL_LENGTH = 100_000;
+
+function sqlField(message: RuntimeConsoleRpcMessage): string {
+  const value = message.sql;
+  return typeof value === 'string' && value.trim() && value.length <= MAX_CONSOLE_SQL_LENGTH ? value : '';
+}
+
+const REFUSAL_NAMES: ReadonlySet<string> = new Set(['ConsoleSqlRefusal', 'ConsoleSchemaRefusal', 'ConsoleSelectRefusal', 'SqliteQueryTimeoutError']);
+
+/**
+ * `data.code` of a refusal by the database port (`read_only`, `protected_table`, …), and the DDL a
+ * failed `db:schema:apply` attempted (`data.statements`, for the audit log).
+ */
+/** SQLSTATE of a driver error (PostgreSQL `code`, mysql2 `sqlState`), e.g. `42501` insufficient privilege. */
+function sqlStateOf(error: Error): string | undefined {
+  const record = error as { code?: unknown; sqlState?: unknown };
+  for (const candidate of [record.sqlState, record.code]) {
+    if (typeof candidate === 'string' && /^[0-9A-Z]{5}$/u.test(candidate)) return candidate;
+  }
+  return undefined;
+}
+
+function refusalData(error: unknown): { data?: { code?: string; statements?: readonly string[]; sqlState?: string } } {
+  if (!(error instanceof Error)) return {};
+  const attempted = (error as { statements?: unknown }).statements;
+  const statements = Array.isArray(attempted) && attempted.every(entry => typeof entry === 'string') ? { statements: attempted as string[] } : {};
+  if (error.name === 'GatewayOwnedTableError') return { data: { code: 'protected_table', ...statements } };
+  const code = (error as { code?: unknown }).code;
+  const refused = REFUSAL_NAMES.has(error.name) && typeof code === 'string';
+  // The server's SQLSTATE lets the Console explain e.g. 42501 from the restricted account (ADR 0059 §4).
+  const sqlState = refused ? undefined : sqlStateOf(error);
+  const data = { ...(refused ? { code } : {}), ...(sqlState ? { sqlState } : {}), ...statements };
+  return Object.keys(data).length ? { data } : {};
+}
+
+function unsupportedDatabaseFeature(payloads: RuntimeConsoleRpcReply[], requestId: number | string | undefined, feature: string): void {
+  payloads.push({ requestId, error: `${feature} is not supported by this database Host`, data: { code: 'unsupported' } });
+}
+
 export function stringField(message: RuntimeConsoleRpcMessage, key: string): string {
   const value = message[key];
   return typeof value === 'string' ? value.trim() : '';

package/src/console-rpc.ts

@@ -3,6 +3,7 @@ import type { DatabaseHostConsole } from '@zhin.js/plugin-runtime';
 import {
   CONFIG_PATCH_LIMITS,
   CONFIG_RPC,
+  grantsAllow,
   type ConsoleConfigPatchRequest,
   type ConsoleConfigPatchResult,
   type ConsoleConfigProjectPatchResult,
@@ -10,7 +11,7 @@ import {
   type ConsoleConfigExplanation,
   type ConsoleEndpointSummary,
 } from '@zhin.js/console-protocol';
-import { authorizeConsoleRpc, type ConsolePrincipal } from './access-control.js';
+import { authorizeConsoleRpc, principalAllows, type ConsolePrincipal } from './access-control.js';
 import { dispatchExtendedConsoleRpc, type ConsoleRpcExtendedCtx } from './console-rpc-extended/index.js';
 import { dispatchPluginConsoleRpc } from './console-plugin-rpc.js';
 import {
@@ -187,11 +188,6 @@ export type RuntimeConsoleRpcContext = {
   /** Full-scope project read (`config:get-project`); masked unless `reveal`. */
   readProjectConfig?(request: import('@zhin.js/console-protocol').ConsoleConfigProjectReadRequest): Promise<import('@zhin.js/console-protocol').ConsoleConfigProjectRead>;
   applyConfig?(expectedRevision: string): Promise<import('@zhin.js/console-protocol').ConsoleConfigApplyResult>;
-  /** Persist a declared child Plugin lifecycle state. Takes effect after restart. */
-  setPluginEnabled?(
-    instanceKey: string,
-    enabled: boolean,
-  ): Promise<Readonly<{ disabled: readonly string[] }>>;
   /** Read-only install planning shared by Console Web and CLI surfaces. */
   pluginManagement?: PluginManagementPort;
   validatePluginConfig?(pluginName: string, data: unknown): Promise<PluginConfigValidation>;
@@ -262,6 +258,21 @@ export function pickRpcReply(
   );
 }
 
+/**
+ * The Endpoint a principal was admitted for when only an adapter / endpoint-scoped grant covers the
+ * call (B-1): handlers must then stay inside it. `undefined` when a global grant covers it.
+ */
+function scopedAuthorizedEndpoint(
+  principal: ConsolePrincipal,
+  decision: Extract<ReturnType<typeof authorizeConsoleRpc>, { allowed: true }>,
+): ConsoleRpcExtendedCtx['authorizedEndpoint'] {
+  if (principal.kind === 'bootstrap' || !decision.permission || !decision.rule) return undefined;
+  if (grantsAllow(principal.grants, decision.permission)) return undefined;
+  const target = decision.rule.target;
+  if (target.kind !== 'endpoint') return undefined;
+  return Object.freeze({ adapter: target.adapter, endpointKey: target.endpoint });
+}
+
 export async function dispatchRuntimeConsoleRpc(
   message: RuntimeConsoleRpcMessage,
   ctx: RuntimeConsoleRpcContext,
@@ -273,12 +284,20 @@ export async function dispatchRuntimeConsoleRpc(
   const type = String(message.type ?? '');
   const requestId = message.requestId as number | string | undefined;
 
+  let authorizedEndpoint: ConsoleRpcExtendedCtx['authorizedEndpoint'];
+  let canOperateEndpoint: ConsoleRpcExtendedCtx['canOperateEndpoint'];
   if (ctx.principal) {
-    const decision = authorizeConsoleRpc(ctx.principal, message as Record<string, unknown>);
+    const principal = ctx.principal;
+    const decision = authorizeConsoleRpc(principal, message as Record<string, unknown>);
     if (!decision.allowed) {
       emit({ requestId, error: decision.error, code: decision.code });
       return payloads;
     }
+    authorizedEndpoint = scopedAuthorizedEndpoint(principal, decision);
+    // Same grant check the map applies to `login.submit` for that Endpoint (ADR 0058 §8).
+    canOperateEndpoint = (adapter, endpointKey) => principalAllows(
+      principal, 'endpoint.operate', Object.freeze({ kind: 'endpoint', adapter, endpoint: endpointKey }),
+    );
   }
 
   // Extended RPC surface (cron/schedule、endpoint 社交/inbox)
@@ -286,11 +305,16 @@ export async function dispatchRuntimeConsoleRpc(
     const extended = await dispatchExtendedConsoleRpc(
       type,
       message as Record<string, unknown>,
-      { ...ctx.extended, fullScope: ctx.authScope === 'full' },
+      {
+        ...ctx.extended,
+        fullScope: ctx.authScope === 'full',
+        ...(authorizedEndpoint ? { authorizedEndpoint } : {}),
+        ...(canOperateEndpoint ? { canOperateEndpoint } : {}),
+      },
     );
     if (extended !== undefined) {
       emit('error' in extended
-        ? { requestId, error: extended.error }
+        ? { requestId, error: extended.error, ...(extended.data !== undefined ? { data: extended.data } : {}) }
         : { requestId, data: extended.data });
       return payloads;
     }

package/src/index.ts

@@ -43,6 +43,7 @@ export {
   requestMeta,
   rpcAuditDetail,
   rpcAuditTarget,
+  type RpcAuditOptions,
   type ConsoleAccessProvider,
   type ConsoleAuditEntry,
   type ConsoleBootstrapPrincipal,
@@ -109,7 +110,7 @@ export {
   type PluginVerificationPlan,
   type PluginConfigValidation,
 } from './console-rpc.js';
-export { dispatchPluginConsoleRpc } from './console-plugin-rpc.js';
+export { dispatchPluginConsoleRpc, PLUGIN_SWITCH_REQUIRES_GATEWAY } from './console-plugin-rpc.js';
 export {
   buildProjectFileTree,
   FILE_MANAGER_ALLOWED,
@@ -135,6 +136,10 @@ export {
   type ConsoleWorkroomProfileControlPort,
   type ConsoleWorkroomKnowledgeControlPort,
   type ExtendedRpcResult,
+  type ConsoleLoginAssistPort,
+  type ConsoleEndpointLoginAccess,
+  loginAuditDetail,
+  LOGIN_SUBMIT_WAIT_MS,
 } from './console-rpc-extended/index.js';
 export * from './host-installer.js';