agor-live 0.22.0 → 0.23.2

package/dist/daemon/setup/socketio.js

@@ -1,5 +1,6 @@
 // src/setup/socketio.ts
-import { shortId } from "@agor/core/db";
+import { resolveTenantContext as resolveTenantContext2 } from "@agor/core/config";
+import { shortId as shortId3 } from "@agor/core/db";
 import jwt2 from "jsonwebtoken";
 
 // src/auth/runtime-tokens.ts
@@ -7,20 +8,54 @@ import jwt from "jsonwebtoken";
 var RUNTIME_JWT_ISSUER = "agor";
 var RUNTIME_JWT_AUDIENCE = "https://agor.dev";
 
+// src/utils/realtime-publish.ts
+import {
+  resolveTenantContext,
+  TenantResolutionError
+} from "@agor/core/config";
+import { getCurrentTenantId, shortId as shortId2 } from "@agor/core/db";
+import { hasMinimumRole as hasMinimumRole2, ROLES as ROLES2 } from "@agor/core/types";
+
+// src/utils/branch-authorization.ts
+import { shortId } from "@agor/core/db";
+import { Forbidden, NotAuthenticated, NotFound } from "@agor/core/feathers";
+import { BRANCH_PERMISSION_LEVELS, hasMinimumRole, ROLES } from "@agor/core/types";
+var PERMISSION_RANK = Object.fromEntries(
+  BRANCH_PERMISSION_LEVELS.map((level, i) => [level, i - 1])
+);
+
+// src/utils/realtime-access-cache.ts
+var DEFAULT_BRANCH_VISIBILITY_TTL_MS = 5 * 6e4;
+var DEFAULT_SESSION_BRANCH_TTL_MS = 60 * 6e4;
+
+// src/utils/realtime-publish.ts
+var SESSION_STREAM_CHANNEL_PREFIX = "session-stream:";
+function leaveAllSessionStreamChannels(app, connection) {
+  for (const name of app.channels ?? []) {
+    if (name.startsWith(SESSION_STREAM_CHANNEL_PREFIX)) {
+      app.channel(name).leave(connection);
+    }
+  }
+}
+var DEBUG_REALTIME_PUBLISH = process.env.AGOR_DEBUG_REALTIME_PUBLISH === "1" || process.env.DEBUG?.includes("realtime-publish");
+
 // src/setup/socketio.ts
+function socketAuthState(userId, isService, tenant) {
+  return tenant ? { userId, isService, tenant } : { userId, isService };
+}
 function getSocketAuthState(socket) {
   const s = socket;
   const user = s.feathers?.user;
   if (user?._isServiceAccount === true) {
-    return { userId: null, isService: true };
+    return socketAuthState(null, true, s.data?.tenant);
   }
   if (s.data?.isService === true) {
-    return { userId: null, isService: true };
+    return socketAuthState(null, true, s.data?.tenant);
   }
   if (user?.user_id) {
-    return { userId: user.user_id, isService: false };
+    return socketAuthState(user.user_id, false, s.data?.tenant);
   }
-  return { userId: null, isService: false };
+  return socketAuthState(null, false, s.data?.tenant);
 }
 function isAuthenticated(auth) {
   return auth.userId !== null || auth.isService;
@@ -43,6 +78,12 @@ function createTokenBucket(capacity, refillPerSec, now = Date.now) {
 function userRoomName(userId) {
   return `user:${userId}`;
 }
+function tenantChannelName(tenantId) {
+  return `tenant:${tenantId}`;
+}
+function tenantUserChannelName(tenantId, userId) {
+  return `tenant:${tenantId}:user:${userId}`;
+}
 function boardPresenceRoomName(boardId) {
   return `board:${boardId}:presence`;
 }
@@ -56,6 +97,7 @@ function parseTerminalChannel(channel) {
 var GLOBAL_PRESENCE_EMIT_INTERVAL_MS = 1e4;
 function createSocketIOConfig(app, options) {
   const { corsOrigin, jwtSecret, credentialsAllowed, buildInfo } = options;
+  const multiTenancy = options.multiTenancy;
   const webTerminalEnabled = options.webTerminalEnabled !== false;
   let socketServer = null;
   const serverOptions = {
@@ -96,9 +138,13 @@ function createSocketIOConfig(app, options) {
         if (tokenType !== void 0 && tokenType !== "access" && tokenType !== "service") {
           return next(new Error("Invalid token type"));
         }
+        const tenant = multiTenancy ? resolveTenantContext2(multiTenancy, {
+          authPayload: decoded,
+          headers: socket.handshake.headers
+        }) : void 0;
         if (tokenType === "service") {
-          const fs = socket;
-          fs.feathers = {
+          const fs2 = socket;
+          fs2.feathers = {
             user: {
               user_id: "executor-service",
               email: "executor@agor.internal",
@@ -106,15 +152,30 @@ function createSocketIOConfig(app, options) {
               _isServiceAccount: true
             }
           };
-          fs.data.isService = true;
+          fs2.data.isService = true;
+          if (tenant) {
+            fs2.tenant = tenant;
+            if (fs2.data) fs2.data.tenant = tenant;
+          }
           console.log(
             `\u{1F510} WebSocket authenticated (service): ${socket.id} (role: ${decoded.role || "unknown"})`
           );
           return next();
         }
-        const user = await app.service("users").get(decoded.sub);
-        socket.feathers = { user };
-        console.log(`\u{1F510} WebSocket authenticated: ${socket.id} (user: ${shortId(user.user_id)})`);
+        const user = await app.service("users").get(
+          decoded.sub,
+          {
+            ...tenant ? { tenant } : {},
+            authentication: { payload: decoded }
+          }
+        );
+        const fs = socket;
+        fs.feathers = { user: tenant ? { ...user, tenant_id: tenant.tenant_id } : user };
+        if (tenant) {
+          fs.tenant = tenant;
+          if (fs.data) fs.data.tenant = tenant;
+        }
+        console.log(`\u{1F510} WebSocket authenticated: ${socket.id} (user: ${shortId3(user.user_id)})`);
         next();
       } catch (error) {
         console.error(`\u274C WebSocket authentication failed for ${socket.id}:`, error);
@@ -125,7 +186,7 @@ function createSocketIOConfig(app, options) {
       activeConnections++;
       const user = socket.feathers?.user;
       console.log(
-        `\u{1F50C} Socket.io connection established: ${socket.id} (user: ${user ? shortId(user.user_id) : "unknown"}, total: ${activeConnections})`
+        `\u{1F50C} Socket.io connection established: ${socket.id} (user: ${user ? shortId3(user.user_id) : "unknown"}, total: ${activeConnections})`
       );
       if (buildInfo) {
         socket.emit("server-info", {
@@ -136,7 +197,7 @@ function createSocketIOConfig(app, options) {
       if (user?.user_id) {
         socket.join(userRoomName(user.user_id));
         console.log(
-          `\u{1F3E0} Socket ${socket.id} joined user room at connection: user:${shortId(user.user_id)}`
+          `\u{1F3E0} Socket ${socket.id} joined user room at connection: user:${shortId3(user.user_id)}`
         );
       }
       setTimeout(() => {
@@ -221,7 +282,7 @@ function createSocketIOConfig(app, options) {
         if (typeof payloadUserId !== "string" || payloadUserId !== auth.userId) {
           rejectTerminal(
             event,
-            `payload userId (${shortId(String(payloadUserId))}\u2026) does not match authed userId (${shortId(auth.userId)}\u2026)`
+            `payload userId (${shortId3(String(payloadUserId))}\u2026) does not match authed userId (${shortId3(auth.userId)}\u2026)`
           );
           return null;
         }
@@ -245,7 +306,7 @@ function createSocketIOConfig(app, options) {
         if (!auth.isService && auth.userId !== target) {
           rejectTerminal(
             "join",
-            `user ${auth.userId ? shortId(auth.userId) : "unknown"}\u2026 tried to join ${shortId(target)}\u2026's channel`
+            `user ${auth.userId ? shortId3(auth.userId) : "unknown"}\u2026 tried to join ${shortId3(target)}\u2026's channel`
           );
           return;
         }
@@ -263,7 +324,7 @@ function createSocketIOConfig(app, options) {
           if (!auth.isService && auth.userId !== target) {
             rejectTerminal(
               "leave",
-              `user ${auth.userId ? shortId(auth.userId) : "unknown"}\u2026 tried to leave ${shortId(target)}\u2026's channel`
+              `user ${auth.userId ? shortId3(auth.userId) : "unknown"}\u2026 tried to leave ${shortId3(target)}\u2026's channel`
             );
             return;
           }
@@ -364,7 +425,7 @@ function createSocketIOConfig(app, options) {
         if (socket.feathers === context.connection) {
           socket.join(userRoomName(userId));
           console.debug(
-            `\u{1F3E0} Socket ${socket.id} joined user room after login: user:${shortId(userId)}`
+            `\u{1F3E0} Socket ${socket.id} joined user room after login: user:${shortId3(userId)}`
           );
           break;
         }
@@ -384,20 +445,47 @@ function createSocketIOConfig(app, options) {
     getSocketServer: () => socketServer
   };
 }
-function configureChannels(app) {
+function configureChannels(app, options = {}) {
   app.on("connection", (_connection) => {
   });
   app.on("login", (authResult, context) => {
     if (context.connection) {
       const result = authResult;
       console.debug("\u2705 Login event fired:", result.user?.user_id, result.user?.email);
+      const connection = context.connection;
+      const tenant = options.multiTenancy ? resolveTenantContext2(options.multiTenancy, {
+        params: {
+          user: result.user,
+          authentication: { payload: result.authentication?.payload }
+        }
+      }) : void 0;
+      if (tenant) {
+        connection.tenant = tenant;
+        if (connection.data) connection.data.tenant = tenant;
+      }
       app.channel("authenticated").join(context.connection);
+      if (tenant) {
+        app.channel(tenantChannelName(tenant.tenant_id)).join(context.connection);
+        if (result.user?.user_id) {
+          app.channel(tenantUserChannelName(tenant.tenant_id, result.user.user_id)).join(context.connection);
+        }
+      }
     }
   });
   app.on("logout", (_authResult, context) => {
     if (context.connection) {
       console.log("\u{1F44B} Logout event fired");
+      const connection = context.connection;
+      const tenant = connection.data?.tenant ?? connection.tenant;
+      const userId = connection.feathers?.user?.user_id;
       app.channel("authenticated").leave(context.connection);
+      if (tenant) {
+        app.channel(tenantChannelName(tenant.tenant_id)).leave(context.connection);
+        if (userId) {
+          app.channel(tenantUserChannelName(tenant.tenant_id, userId)).leave(context.connection);
+        }
+      }
+      leaveAllSessionStreamChannels(app, context.connection);
     }
   });
 }
@@ -408,5 +496,7 @@ export {
   createTokenBucket,
   getSocketAuthState,
   parseTerminalChannel,
+  tenantChannelName,
+  tenantUserChannelName,
   userRoomName
 };

package/dist/daemon/startup.d.ts

@@ -5,12 +5,13 @@
  * server listen, scheduler, gateway init, and graceful shutdown.
  */
 import type { AgorConfig } from '@agor/core/config';
-import type { Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
+import type { Session, Task } from '@agor/core/types';
 import type { Application, SessionsServiceImpl } from './declarations.js';
 import type { TerminalsService } from './services/terminals.js';
 export interface StartupContext {
     app: Application;
-    db: Database;
+    db: TenantScopeAwareDatabase;
     config: AgorConfig;
     DAEMON_PORT: number;
     /** Bind address (default: 'localhost', use '0.0.0.0' for containers) */
@@ -24,6 +25,16 @@ export interface StartupContext {
     sessionsService: SessionsServiceImpl;
     terminalsService: TerminalsService | null;
 }
+interface OrphanCleanupResult {
+    wasGraceful: boolean;
+    orphanedTasks: Task[];
+    orphanedSessions: Session[];
+    sessionIdsWithOrphanedTasks: Set<string>;
+    queuedTasks: Task[];
+    sessionsResetFromOrphanedTasks: number;
+}
+export declare function cleanupOrphanStatuses(ctx: StartupContext): Promise<OrphanCleanupResult>;
 export declare function runPostStartJob(name: string, job: () => Promise<void> | void): void;
 export declare function startup(ctx: StartupContext): Promise<void>;
+export {};
 //# sourceMappingURL=startup.d.ts.map

package/dist/daemon/startup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"startup.d.ts","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAI9C,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAoB,MAAM,mBAAmB,CAAC;AAM5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAiBhE,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,WAAW,CAAC;IACjB,EAAE,EAAE,QAAQ,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,2EAA2E;IAE3E,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,GAAG,CAAC;IACnC,+DAA+D;IAC/D,eAAe,EAAE,MAAM,OAAO,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACzD,gDAAgD;IAChD,eAAe,EAAE,mBAAmB,CAAC;IACrC,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC3C;AAoTD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CASnF;AA0CD,wBAAsB,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAiNhE"}
+{"version":3,"file":"startup.d.ts","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAMpD,OAAO,EAKL,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAiB,OAAO,EAAa,IAAI,EAAiB,MAAM,kBAAkB,CAAC;AAE/F,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAoB,MAAM,mBAAmB,CAAC;AAM5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAiBhE,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,WAAW,CAAC;IACjB,EAAE,EAAE,wBAAwB,CAAC;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,2EAA2E;IAE3E,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,GAAG,CAAC;IACnC,+DAA+D;IAC/D,eAAe,EAAE,MAAM,OAAO,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACzD,gDAAgD;IAChD,eAAe,EAAE,mBAAmB,CAAC;IACrC,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC3C;AA0ED,UAAU,mBAAmB;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,IAAI,EAAE,CAAC;IACtB,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAC5B,2BAA2B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,WAAW,EAAE,IAAI,EAAE,CAAC;IACpB,8BAA8B,EAAE,MAAM,CAAC;CACxC;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAE7F;AAyUD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CASnF;AA0CD,wBAAsB,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA8NhE"}