anbaric-cloud-hosting 1.20.0 → 1.21.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.20.0",
+  "version": "1.21.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,17 +18,18 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.20.0",
-    "anbaric-plugins": "^1.20.0",
-    "anbaric-tsapi": "^1.20.0",
+    "anbaric-data-store": "^1.21.0",
+    "anbaric-plugins": "^1.21.0",
+    "anbaric-tsapi": "^1.21.0",
+    "anbaric-web": "^1.21.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.20.0",
-    "anbaric-state-machine": "^1.20.0",
+    "anbaric-impl-cloud": "^1.21.0",
+    "anbaric-state-machine": "^1.21.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/auditing/AuditRecordStore.ts

@@ -1,6 +1,7 @@
 import {AuditRecord} from "anbaric-tsapi";
 
 type AuditFilter = {
+    appId? : string,
     resourceType? : string,
     resourceId? : string,
     actorId? : string,

package/src/auditing/InMemoryAuditRecordStore.ts

@@ -15,6 +15,7 @@ class InMemoryAuditRecordStore implements AuditRecordStore {
         const page = filter.page ?? 0;
 
         return this.records
+            .filter(record => !filter.appId || record.appId === filter.appId)
             .filter(record => !filter.resourceType || record.resourceType === filter.resourceType)
             .filter(record => !filter.resourceId || record.resourceId === filter.resourceId)
             .filter(record => !filter.actorId || record.actorId === filter.actorId)

package/src/auth/Authenticator.ts

@@ -13,6 +13,14 @@ abstract class Authenticator {
         return true;
     }
 
+    // True for authenticators that answer an unauthenticated request with a
+    // redirect to an interactive login (an identity provider). The platform
+    // uses this to avoid discarding the body of a state-changing request that
+    // hits an expired session - it fails such a request cleanly instead.
+    redirectsToLoginOnFailure() : boolean {
+        return false;
+    }
+
 }
 
 export { Authenticator, SESSION_COOKIE }

package/src/auth/SessionSigner.ts

@@ -7,6 +7,11 @@ import {User} from "./User";
 
 const DEFAULT_TTL_SECONDS = 30 * 24 * 60 * 60;
 
+const configuredTtlSeconds = () => {
+    const seconds = Number(process.env.ANBARIC_SESSION_TTL_SECONDS);
+    return Number.isFinite(seconds) && seconds > 0 ? seconds : DEFAULT_TTL_SECONDS;
+};
+
 const nowSeconds = () => Math.floor(Date.now() / 1000);
 
 const base64url = (input : Buffer | string) => Buffer.from(input).toString("base64url");
@@ -18,11 +23,13 @@ const base64url = (input : Buffer | string) => Buffer.from(input).toString("base
    store. The signing secret lives in the environment
    (ANBARIC_SESSION_SIGNING_SECRET, sourced from a secret manager); with none
    set the signer is inert and the platform falls back to the authenticator.
-   Sessions slide: a valid one is re-issued with a fresh expiry on each request. */
+   Sessions slide: a valid one is re-issued with a fresh expiry on each request.
+   The lifetime defaults to 30 days and can be tuned with
+   ANBARIC_SESSION_TTL_SECONDS. */
 class SessionSigner {
 
     constructor(private secret : string = process.env.ANBARIC_SESSION_SIGNING_SECRET ?? "",
-                private ttlSeconds : number = DEFAULT_TTL_SECONDS) {}
+                private ttlSeconds : number = configuredTtlSeconds()) {}
 
     get configured() : boolean {
         return this.secret.length > 0;

package/src/data-store/PostgresAuditRecordStore.ts

@@ -29,10 +29,10 @@ class PostgresAuditRecordStore implements AuditRecordStore {
 
         await this.pool.query(
             `INSERT INTO anbaric_system.audit_records
-                (resource_type, resource_id, actor_id, actor_type, interaction, description, details)
-             VALUES ($1, $2, $3, $4, $5::text[], $6, $7)`,
-            [record.resourceType, record.resourceId, record.actorId, record.actorType, record.interaction,
-                record.description, JSON.stringify(record.details ?? null)],
+                (app_id, resource_type, resource_id, actor_id, actor_type, interaction, description, details)
+             VALUES ($1, $2, $3, $4, $5, $6::text[], $7, $8)`,
+            [record.appId || null, record.resourceType, record.resourceId, record.actorId, record.actorType,
+                record.interaction, record.description, JSON.stringify(record.details ?? null)],
         );
     }
 
@@ -40,6 +40,10 @@ class PostgresAuditRecordStore implements AuditRecordStore {
         const conditions : Array<string> = [];
         const parameters : Array<any> = [];
 
+        if (filter.appId) {
+            parameters.push(filter.appId);
+            conditions.push(`app_id = $${parameters.length}`);
+        }
         if (filter.resourceType) {
             parameters.push(filter.resourceType);
             conditions.push(`resource_type = $${parameters.length}`);
@@ -68,7 +72,7 @@ class PostgresAuditRecordStore implements AuditRecordStore {
         const offset = `OFFSET $${parameters.length}`;
 
         const result = await this.pool.query(
-            `SELECT id, resource_type, resource_id, actor_id, actor_type, interaction, description, details, at
+            `SELECT id, app_id, resource_type, resource_id, actor_id, actor_type, interaction, description, details, at
              FROM anbaric_system.audit_records ${where}
              ORDER BY at DESC, id DESC ${limit} ${offset}`,
             parameters,
@@ -76,6 +80,7 @@ class PostgresAuditRecordStore implements AuditRecordStore {
 
         return result.rows.map(row => ({
             id: String(row.id),
+            appId: row.app_id ?? undefined,
             resourceType: row.resource_type,
             resourceId: row.resource_id,
             actorId: row.actor_id,

package/src/data-store/PostgresJobPersistence.ts

@@ -6,6 +6,7 @@ type JobRow = {
     state : string,
     properties : Record<string, any>,
     workflow_id? : string,
+    app_id? : string,
     started_at : Date,
     started_by : string,
     last_updated : Date,
@@ -19,7 +20,7 @@ type JobRow = {
    carry a waiting_for foreign key, the metadata lives once in awaits, and the
    job's awaitMetadata is rejoined on read. */
 const JOB_SELECT =
-    `SELECT j.id, j.state, j.properties, j.workflow_id, j.started_at, j.started_by, j.last_updated,
+    `SELECT j.id, j.state, j.properties, j.workflow_id, j.app_id, j.started_at, j.started_by, j.last_updated,
             j.killed, j.status, j.waiting_for, a.metadata AS await_metadata
      FROM jobs j LEFT JOIN awaits a ON a.id = j.waiting_for`;
 
@@ -46,12 +47,12 @@ class PostgresJobPersistence extends JobPersistence {
             }
 
             await client.query(
-                `INSERT INTO jobs (id, state, properties, workflow_id, started_at, started_by, last_updated, killed, status, waiting_for)
-                 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+                `INSERT INTO jobs (id, state, properties, workflow_id, app_id, started_at, started_by, last_updated, killed, status, waiting_for)
+                 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
                  ON CONFLICT (id) DO UPDATE SET state = EXCLUDED.state, properties = EXCLUDED.properties,
-                     workflow_id = EXCLUDED.workflow_id, last_updated = EXCLUDED.last_updated, killed = EXCLUDED.killed,
-                     status = EXCLUDED.status, waiting_for = EXCLUDED.waiting_for`,
-                [job.id, job.state, Object.fromEntries(job.properties), job.workflowId,
+                     workflow_id = EXCLUDED.workflow_id, app_id = EXCLUDED.app_id, last_updated = EXCLUDED.last_updated,
+                     killed = EXCLUDED.killed, status = EXCLUDED.status, waiting_for = EXCLUDED.waiting_for`,
+                [job.id, job.state, Object.fromEntries(job.properties), job.workflowId, job.appId || null,
                     job.startedAt, job.startedBy, job.lastUpdated, job.killed, job.status, job.waitingFor ?? null],
             );
 
@@ -112,6 +113,7 @@ class PostgresJobPersistence extends JobPersistence {
         return deserializeJob({
             ...row,
             workflowId: row.workflow_id ?? undefined,
+            appId: row.app_id ?? undefined,
             startedAt: row.started_at.toISOString(),
             startedBy: row.started_by,
             lastUpdated: row.last_updated.toISOString(),

package/src/data-store/PostgresJsonStore.ts

@@ -1,24 +1,26 @@
 import {Auditor, JsonStore, NoOpAuditor} from "anbaric-tsapi";
 import {Pool} from "pg";
 
+/* Documents are keyed by the composite (app_id, collection, id): the owning app,
+   the collection and the document id, so ids never collide across apps. */
 class PostgresJsonStore extends JsonStore {
 
-    constructor(private pool : Pool, collection : string, auditor : Auditor = new NoOpAuditor()) {
+    constructor(private pool : Pool, private appId : string, collection : string, auditor : Auditor = new NoOpAuditor()) {
         super(auditor, collection);
     }
 
     protected async saveInternal(id : string, document : any) : Promise<void> {
         await this.pool.query(
-            `INSERT INTO documents (collection, id, document) VALUES ($1, $2, $3)
-             ON CONFLICT (collection, id) DO UPDATE SET document = EXCLUDED.document`,
-            [this.collection, id, document],
+            `INSERT INTO documents (app_id, collection, id, document) VALUES ($1, $2, $3, $4)
+             ON CONFLICT (app_id, collection, id) DO UPDATE SET document = EXCLUDED.document`,
+            [this.appId, this.collection, id, document],
         );
     }
 
     protected async retrieveInternal(id : string) : Promise<any> {
         const result = await this.pool.query(
-            "SELECT document FROM documents WHERE collection = $1 AND id = $2",
-            [this.collection, id],
+            "SELECT document FROM documents WHERE app_id = $1 AND collection = $2 AND id = $3",
+            [this.appId, this.collection, id],
         );
         if (result.rowCount === 0) throw new Error(`No document found with id "${id}"`);
 
@@ -26,13 +28,14 @@ class PostgresJsonStore extends JsonStore {
     }
 
     protected async deleteInternal(id : string) : Promise<void> {
-        await this.pool.query("DELETE FROM documents WHERE collection = $1 AND id = $2", [this.collection, id]);
+        await this.pool.query("DELETE FROM documents WHERE app_id = $1 AND collection = $2 AND id = $3",
+            [this.appId, this.collection, id]);
     }
 
     protected async listInternal(pageSize : number = 100, page : number = 0) : Promise<Array<any>> {
         const result = await this.pool.query(
-            "SELECT document FROM documents WHERE collection = $1 ORDER BY inserted_at LIMIT $2 OFFSET $3",
-            [this.collection, pageSize, page * pageSize],
+            "SELECT document FROM documents WHERE app_id = $1 AND collection = $2 ORDER BY inserted_at LIMIT $3 OFFSET $4",
+            [this.appId, this.collection, pageSize, page * pageSize],
         );
 
         return result.rows.map(row => row.document);

package/src/data-store/Schema.ts

@@ -25,6 +25,14 @@ const ensureSchema = async (pool : Pool) : Promise<void> => {
     await pool.query("ALTER TABLE jobs ADD COLUMN IF NOT EXISTS transitions JSONB NOT NULL DEFAULT '[]'");
     await pool.query("ALTER TABLE jobs ADD COLUMN IF NOT EXISTS killed BOOLEAN NOT NULL DEFAULT false");
     await pool.query("ALTER TABLE jobs ADD COLUMN IF NOT EXISTS status TEXT NOT NULL DEFAULT 'active'");
+    // A workflow is keyed by the composite (app_id, workflow_id). Older rows
+    // stored "appId/workflowId" in workflow_id; split that once into the two
+    // columns (best effort - a bare workflow id with no app is left as-is).
+    await pool.query("ALTER TABLE jobs ADD COLUMN IF NOT EXISTS app_id TEXT");
+    await pool.query(`UPDATE jobs
+        SET app_id = split_part(workflow_id, '/', 1),
+            workflow_id = substring(workflow_id from position('/' in workflow_id) + 1)
+        WHERE app_id IS NULL AND workflow_id LIKE '%/%'`);
     // The await a job is parked on; its metadata is normalised here rather than on the job.
     await pool.query(`
         CREATE TABLE IF NOT EXISTS awaits (
@@ -36,13 +44,24 @@ const ensureSchema = async (pool : Pool) : Promise<void> => {
     await pool.query("ALTER TABLE jobs ADD COLUMN IF NOT EXISTS waiting_for UUID REFERENCES awaits(id) ON DELETE SET NULL");
     await pool.query(`
         CREATE TABLE IF NOT EXISTS documents (
+            app_id      TEXT NOT NULL DEFAULT '',
             collection  TEXT NOT NULL,
             id          TEXT NOT NULL,
             document    JSONB NOT NULL,
             inserted_at BIGINT GENERATED ALWAYS AS IDENTITY,
-            PRIMARY KEY (collection, id)
+            PRIMARY KEY (app_id, collection, id)
         )
     `);
+    // Documents are owned by an app: widen the key to (app_id, collection, id).
+    await pool.query("ALTER TABLE documents ADD COLUMN IF NOT EXISTS app_id TEXT NOT NULL DEFAULT ''");
+    await pool.query(`DO $$ BEGIN
+        IF NOT EXISTS (SELECT 1 FROM information_schema.key_column_usage
+                       WHERE table_name = 'documents' AND constraint_name = 'documents_pkey'
+                         AND column_name = 'app_id') THEN
+            ALTER TABLE documents DROP CONSTRAINT IF EXISTS documents_pkey;
+            ALTER TABLE documents ADD PRIMARY KEY (app_id, collection, id);
+        END IF;
+    END $$`);
     await pool.query(`
         CREATE TABLE IF NOT EXISTS queue (
             position     BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
@@ -52,6 +71,11 @@ const ensureSchema = async (pool : Pool) : Promise<void> => {
             leased_until TIMESTAMPTZ
         )
     `);
+    await pool.query("ALTER TABLE queue ADD COLUMN IF NOT EXISTS app_id TEXT");
+    await pool.query(`UPDATE queue
+        SET app_id = split_part(workflow_id, '/', 1),
+            workflow_id = substring(workflow_id from position('/' in workflow_id) + 1)
+        WHERE app_id IS NULL AND workflow_id LIKE '%/%'`);
     await pool.query("CREATE SCHEMA IF NOT EXISTS anbaric_system");
     await pool.query(`
         CREATE TABLE IF NOT EXISTS anbaric_system.cli_keys (
@@ -86,6 +110,8 @@ const ensureSchema = async (pool : Pool) : Promise<void> => {
     `);
     await pool.query("ALTER TABLE anbaric_system.audit_records ADD COLUMN IF NOT EXISTS resource_type TEXT");
     await pool.query("ALTER TABLE anbaric_system.audit_records ADD COLUMN IF NOT EXISTS resource_id TEXT");
+    // The app that owns the audited resource; part of every resource's composite identity.
+    await pool.query("ALTER TABLE anbaric_system.audit_records ADD COLUMN IF NOT EXISTS app_id TEXT");
     await pool.query("ALTER TABLE anbaric_system.audit_records ADD COLUMN IF NOT EXISTS interaction TEXT[]");
     await pool.query(`
         DO $$ BEGIN

package/src/hosting/HostingServer.ts

@@ -7,6 +7,7 @@ import {TokenAuthenticator} from "../auth/TokenAuthenticator";
 import {ConfirmableQueue} from "../queuing/ConfirmableQueue";
 import {ConsumerRegistry} from "../queuing/ConsumerRegistry";
 import {AppProxyHandler} from "./handlers/AppProxyHandler";
+import {AppLinkFallbackHandler} from "./handlers/AppLinkFallbackHandler";
 import {AppsHandler} from "./handlers/AppsHandler";
 import {AuditsHandler} from "./handlers/AuditsHandler";
 import {AuthorizeCliHandler} from "./handlers/auth/AuthorizeCliHandler";
@@ -44,8 +45,8 @@ class HostingServer {
     constructor(persistence : JobPersistence, queue : ConfirmableQueue,
                 registry : ConsumerRegistry = new ConsumerRegistry(),
                 buildLayer? : BuildLayer,
-                documentStoreFor? : (collection : string) => JsonStore,
-                secretStore? : SecretStore,
+                documentStoreFor? : (appId : string, collection : string) => JsonStore,
+                secretStoreFor? : (appId : string) => SecretStore,
                 authenticator? : Authenticator,
                 cliAuthorizer? : CliAuthorizer,
                 tokenAuthenticator? : TokenAuthenticator,
@@ -59,7 +60,7 @@ class HostingServer {
         const consumers = new ConsumersHandler(registry);
         const stateMachines = new StateMachinesHandler(registry);
         const documents = documentStoreFor && new DocumentsHandler(documentStoreFor);
-        const secrets = secretStore && new SecretsHandler(secretStore);
+        const secrets = secretStoreFor && new SecretsHandler(secretStoreFor);
         const audits = auditRecords && new AuditsHandler(auditRecords);
         const sessions = new SessionsHandler();
 
@@ -84,6 +85,9 @@ class HostingServer {
             publicRouter.registerApi("apps", new AppsHandler(buildLayer));
             publicRouter.register("app", new AppProxyHandler(buildLayer));
         }
+        // An unrouted absolute path carrying an app Referer is an app-internal
+        // link the proxy's prefix-stripping left bare; send it back to its app.
+        publicRouter.registerFallback(new AppLinkFallbackHandler());
 
         const internalRouter = new Router();
         internalRouter.register("ping", ping);

package/src/hosting/Request.ts

@@ -67,6 +67,12 @@ class Request {
         return value === undefined ? undefined : String(value);
     }
 
+    // The calling app's id, sent as an ambient header by the cloud clients, used
+    // to scope app-owned resources (documents, secrets) server-side.
+    get appId() : string | undefined {
+        return this.header("x-anbaric-app");
+    }
+
     query(name : string) : string | undefined {
         return this.parsed.searchParams.get(name) ?? undefined;
     }
@@ -105,6 +111,11 @@ class Request {
         this.response.end(script);
     }
 
+    redirect(location : string, status : number = 302, headers : Record<string, string> = {}) : void {
+        this.response.writeHead(status, { location, ...headers });
+        this.response.end();
+    }
+
     notFound() : void {
         this.reply(404, { error: "Not found" });
     }

package/src/hosting/handlers/AppLinkFallbackHandler.ts

@@ -0,0 +1,26 @@
+import {appInternalRedirect} from "anbaric-web";
+import {Request} from "../Request";
+import {RequestHandler} from "../RequestHandler";
+
+/* The public router's fallback for an otherwise-unrouted path. When the request
+   is an app-internal absolute link (identified by its Referer), it is redirected
+   back onto its app; anything else is a genuine 404. A 307 is used so a form
+   POST to an absolute action keeps its method and body across the redirect.
+
+   The redirect must never be cached: the same root path (e.g. "/thing") maps to
+   different apps depending on the Referer, so a stored mapping would send one
+   app's request to another. `no-store` forbids caching outright and
+   `Vary: Referer` states the dependency for any cache that stores it anyway. */
+class AppLinkFallbackHandler implements RequestHandler {
+
+    async handle(request : Request) : Promise<void> {
+        const target = appInternalRedirect(request.url.pathname, request.url.search, request.header("referer"));
+        if (target !== undefined) {
+            return request.redirect(target, 307, { "cache-control": "no-store", "vary": "Referer" });
+        }
+        request.notFound();
+    }
+
+}
+
+export { AppLinkFallbackHandler };

package/src/hosting/handlers/AuditsHandler.ts

@@ -34,6 +34,7 @@ class AuditsHandler implements RequestHandler {
     private async handleQuery(request : Request) : Promise<void> {
         const interaction = request.query("interaction");
         const records = await this.auditRecords.list({
+            appId: request.query("appId"),
             resourceType: request.query("resourceType"),
             resourceId: request.query("resourceId"),
             actorId: request.query("actorId"),

package/src/hosting/handlers/ConsumersHandler.ts

@@ -11,8 +11,8 @@ class ConsumersHandler implements RequestHandler {
 
         switch (request.method) {
             case "POST": {
-                const { workflowId, url } = await request.body();
-                this.registry.register(workflowId, url);
+                const { appId, workflowId, url } = await request.body();
+                this.registry.register(appId, workflowId, url);
                 return request.reply(204);
             }
         }

package/src/hosting/handlers/DocumentsHandler.ts

@@ -4,12 +4,14 @@ import {RequestHandler} from "../RequestHandler";
 
 class DocumentsHandler implements RequestHandler {
 
-    constructor(private storeFor : (collection : string) => JsonStore) {}
+    constructor(private storeFor : (appId : string, collection : string) => JsonStore) {}
 
     async handle(request : Request) : Promise<void> {
         if (!request.id) return request.notFound();
 
-        const store = this.storeFor(request.id);
+        // Documents are owned by the calling app (the ambient app header); the
+        // store is scoped to (appId, collection) so ids never collide across apps.
+        const store = this.storeFor(request.appId ?? "", request.id);
         if (request.subresource) return this.handleDocument(request, store, request.subresource);
         return this.handleCollection(request, store);
     }

package/src/hosting/handlers/QueueHandler.ts

@@ -17,20 +17,20 @@ class QueueHandler implements RequestHandler {
 
         switch (request.id) {
             case "enqueue": {
-                const { jobId, workflowId } = await request.body();
-                await this.queue.enqueue(jobId, workflowId);
+                const { jobId, appId, workflowId } = await request.body();
+                await this.queue.enqueue(jobId, appId, workflowId);
                 return request.reply(204);
             }
             case "schedule": {
-                const { jobId, workflowId, due } = await request.body();
-                await this.queue.schedule(jobId, workflowId, new Date(due));
+                const { jobId, appId, workflowId, due } = await request.body();
+                await this.queue.schedule(jobId, appId, workflowId, new Date(due));
                 return request.reply(204);
             }
             case "dequeue":
                 return request.reply(200, { messages: await this.queue.dequeueSome() });
             case "confirm": {
-                const { jobId, workflowId, position } = await request.body();
-                await this.queue.confirm({ jobId, workflowId, position });
+                const { jobId, appId, workflowId, position } = await request.body();
+                await this.queue.confirm({ jobId, appId, workflowId, position });
                 return request.reply(204);
             }
         }

package/src/hosting/handlers/SecretsHandler.ts

@@ -4,35 +4,37 @@ import {RequestHandler} from "../RequestHandler";
 
 class SecretsHandler implements RequestHandler {
 
-    constructor(private secretStore : SecretStore) {}
+    constructor(private storeFor : (appId : string) => SecretStore) {}
 
     async handle(request : Request) : Promise<void> {
         if (request.subresource) return request.notFound();
-        if (request.id) return this.handleSecret(request, request.id);
-        return this.handleCollection(request);
+        // Secrets are owned by the calling app (the ambient app header).
+        const store = this.storeFor(request.appId ?? "");
+        if (request.id) return this.handleSecret(request, store, request.id);
+        return this.handleCollection(request, store);
     }
 
-    private async handleSecret(request : Request, name : string) : Promise<void> {
+    private async handleSecret(request : Request, store : SecretStore, name : string) : Promise<void> {
         switch (request.method) {
             case "PUT": {
                 const { value } = await request.body();
                 if (typeof value !== "string") return request.reply(400, { error: "Expected a body of { value : string }" });
-                await this.secretStore.create(SystemActor.actor, name, value);
+                await store.create(SystemActor.actor, name, value);
                 return request.reply(204);
             }
             case "GET":
-                return request.reply(200, { value: await this.secretStore.retrieve(name, SystemActor.actor) });
+                return request.reply(200, { value: await store.retrieve(name, SystemActor.actor) });
             case "DELETE":
-                await this.secretStore.delete(name, SystemActor.actor);
+                await store.delete(name, SystemActor.actor);
                 return request.reply(204);
         }
         request.notFound();
     }
 
-    private async handleCollection(request : Request) : Promise<void> {
+    private async handleCollection(request : Request, store : SecretStore) : Promise<void> {
         switch (request.method) {
             case "GET":
-                return request.reply(200, await this.secretStore.list(SystemActor.actor));
+                return request.reply(200, await store.list(SystemActor.actor));
         }
         request.notFound();
     }

package/src/hosting/middleware/AuthenticationMiddleware.ts

@@ -39,6 +39,15 @@ class AuthenticationMiddleware implements Middleware {
             }
         }
 
+        // A state-changing request with no valid session, bound for an
+        // authenticator that redirects to an interactive login, would have its
+        // body silently discarded across that redirect. Fail it loudly instead
+        // so the client can re-authenticate (a fresh GET) and retry.
+        if (this.isStateChanging(request.method) && this.authenticator?.redirectsToLoginOnFailure() && !request.handled) {
+            request.reply(401, { error: "Your session has expired or you are not signed in. Reload the page and try again." });
+            return false;
+        }
+
         if (!this.authenticator) return true;
 
         const authenticated = await this.authenticator.authenticate(request.session, request.raw, request.rawResponse);
@@ -51,6 +60,10 @@ class AuthenticationMiddleware implements Middleware {
         return this.authorized(request);
     }
 
+    private isStateChanging(method : string) : boolean {
+        return method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";
+    }
+
     private async authorized(request : Request) : Promise<boolean> {
         if (!this.authenticator || !request.user) return true;
 

package/src/main.ts

@@ -61,9 +61,15 @@ const buildLayer = process.env.ANBARIC_BUILD_LAYER === "docker"
     })
     : undefined;
 
-const secretStore : SecretStore = process.env.AWS_REGION
-    ? new SecretsManagerSecretStore(new SecretsManagerClient({}))
-    : new InMemorySecretStore();
+// Secrets are owned by an app: each app gets its own namespace. AWS-backed
+// stores fold the app into their name prefix (stateless, built per request);
+// the in-memory local store is cached per app so its data persists.
+const secretsManagerClient = process.env.AWS_REGION ? new SecretsManagerClient({}) : undefined;
+const localSecretStores = new Map<string, InMemorySecretStore>();
+const secretStoreFor = (appId : string) : SecretStore =>
+    secretsManagerClient
+        ? new SecretsManagerSecretStore(secretsManagerClient, `anbaric/${appId}/`)
+        : localSecretStores.get(appId) ?? localSecretStores.set(appId, new InMemorySecretStore()).get(appId)!;
 
 const authenticator = await loadAuthenticator(process.env.ANBARIC_AUTHENTICATOR);
 const cliKeyStore = process.env.ANBARIC_CLI_KEY_LOOKUP_URL
@@ -75,7 +81,7 @@ const tokenAuthenticator = new TokenAuthenticator(cliKeyStore, process.env.ANBAR
 const plugins = await new PluginLoader().load(process.env.ANBARIC_PLUGINS ?? "anbaric-plugins/state-machines");
 
 const server = new HostingServer(new PostgresJobPersistence(pool), queue, registry, buildLayer,
-    (collection) => new PostgresJsonStore(pool, collection), secretStore, authenticator, cliAuthorizer,
+    (appId, collection) => new PostgresJsonStore(pool, appId, collection), secretStoreFor, authenticator, cliAuthorizer,
     tokenAuthenticator, process.env.ANBARIC_TENANT, new PostgresAuditRecordStore(pool), plugins);
 const port = await server.listen(hostingPort);
 const internal = await server.listenInternal(internalPort);

package/src/queuing/ConsumerRegistry.ts

@@ -1,17 +1,23 @@
 class ConsumerRegistry {
 
-    private consumers = new Map<string, string>();
+    private consumers = new Map<string, { appId? : string, workflowId : string, url : string }>();
 
-    register(workflowId : string, url : string) : void {
-        this.consumers.set(workflowId, url);
+    // Consumers are keyed by the (appId, workflowId) composite, encoded as a
+    // tuple so an app and a machine id can never collide.
+    private key(appId : string | undefined, workflowId : string) : string {
+        return JSON.stringify([appId || null, workflowId]);
     }
 
-    lookup(workflowId : string) : string | undefined {
-        return this.consumers.get(workflowId);
+    register(appId : string | undefined, workflowId : string, url : string) : void {
+        this.consumers.set(this.key(appId, workflowId), { appId, workflowId, url });
     }
 
-    list() : Array<{ workflowId : string, url : string }> {
-        return Array.from(this.consumers, ([workflowId, url]) => ({ workflowId, url }));
+    lookup(appId : string | undefined, workflowId : string) : string | undefined {
+        return this.consumers.get(this.key(appId, workflowId))?.url;
+    }
+
+    list() : Array<{ appId? : string, workflowId : string, url : string }> {
+        return Array.from(this.consumers.values());
     }
 
 }

package/src/queuing/Dispatcher.ts

@@ -28,9 +28,9 @@ class Dispatcher {
             const byConsumerUrl = new Map<string, Array<QueueMessage>>();
 
             for (const message of messages) {
-                const url = this.registry.lookup(message.workflowId);
+                const url = this.registry.lookup(message.appId, message.workflowId);
                 if (!url) {
-                    await this.queue.enqueue(message.jobId, message.workflowId);
+                    await this.queue.enqueue(message.jobId, message.appId, message.workflowId);
                     continue;
                 }
                 byConsumerUrl.set(url, [...(byConsumerUrl.get(url) ?? []), message]);
@@ -54,7 +54,7 @@ class Dispatcher {
             if (!response.ok) throw new Error(`Consumer at ${url} responded with status ${response.status}`);
         } catch {
             for (const message of batch) {
-                await this.queue.enqueue(message.jobId, message.workflowId);
+                await this.queue.enqueue(message.jobId, message.appId, message.workflowId);
             }
         }
     }

package/src/queuing/PostgresQueue.ts

@@ -9,12 +9,12 @@ class PostgresQueue implements ConfirmableQueue {
 
     constructor(private pool : Pool) {}
 
-    async enqueue(jobId : string, workflowId : string) : Promise<void> {
-        await this.pool.query("INSERT INTO queue (job_id, workflow_id) VALUES ($1, $2)", [jobId, workflowId]);
+    async enqueue(jobId : string, appId : string | undefined, workflowId : string) : Promise<void> {
+        await this.pool.query("INSERT INTO queue (job_id, app_id, workflow_id) VALUES ($1, $2, $3)", [jobId, appId || null, workflowId]);
     }
 
-    async schedule(jobId : string, workflowId : string, due : Date) : Promise<void> {
-        await this.pool.query("INSERT INTO queue (job_id, workflow_id, due) VALUES ($1, $2, $3)", [jobId, workflowId, due]);
+    async schedule(jobId : string, appId : string | undefined, workflowId : string, due : Date) : Promise<void> {
+        await this.pool.query("INSERT INTO queue (job_id, app_id, workflow_id, due) VALUES ($1, $2, $3, $4)", [jobId, appId || null, workflowId, due]);
     }
 
     async dequeueSome() : Promise<Array<QueueMessage>> {
@@ -28,7 +28,7 @@ class PostgresQueue implements ConfirmableQueue {
                  LIMIT $1
                  FOR UPDATE SKIP LOCKED
              )
-             RETURNING job_id, workflow_id, due, position`,
+             RETURNING job_id, app_id, workflow_id, due, position`,
             [DEQUEUE_BATCH_SIZE],
         );
 
@@ -39,7 +39,7 @@ class PostgresQueue implements ConfirmableQueue {
                 if (!b.due) return 1;
                 return a.due.getTime() - b.due.getTime() || a.position - b.position;
             })
-            .map(row => ({ jobId: row.job_id, workflowId: row.workflow_id, position: Number(row.position) }));
+            .map(row => ({ jobId: row.job_id, appId: row.app_id ?? undefined, workflowId: row.workflow_id, position: Number(row.position) }));
     }
 
     async confirm(message : QueueMessage) : Promise<void> {