ankka-console 0.15.1 → 0.16.0

package/dist/testing/fake-control-plane.js

@@ -96,6 +96,13 @@ function fakeFingerprint(schema) {
 }
 /** The hostings whose pods hold the platform's container beside the developer's. */
 const twoContainers = (hosting) => hosting === "process" || hosting === "web";
+/** A handler's answer with 201, as the control plane gives for a new erasure request. */
+class Created {
+    body;
+    constructor(body) {
+        this.body = body;
+    }
+}
 class HttpError extends Error {
     status;
     constructor(status, message) {
@@ -135,6 +142,8 @@ export async function fakeControlPlane(options = {}) {
     let base = "";
     let objectStore = "garage";
     let cloud = null;
+    let erasureOn = false;
+    let erasureSeq = 0;
     const serviceKey = (p, n) => `${p}/${n}`;
     // ── Views of state ─────────────────────────────────────────────────────────
     const orgSummary = (org, caller) => {
@@ -383,10 +392,11 @@ export async function fakeControlPlane(options = {}) {
             ...(cloud ? { cloud: { ...where, ...(kmsKey && owns ? { kmsKey } : {}) } } : {}),
             // Feature 038: where secrets are kept, as an installation that has said nothing answers.
             secrets: { backend: "postgres", recordRetention: "365d", auditLog: "unknown" },
-            // Spec 057: a one-node broker and no bound on retention, as the shipped settings say; no
-            // erasure, which the platform does not have yet.
+            // Spec 057: a one-node broker and no bound on retention, as the shipped settings say.
             broker: { nodes: 1, defaultCopies: 1, minInSync: 1 },
             retention: { unbounded: true },
+            // Feature 042: the installation's erasure, as `ANKKA_ERASURE` sets it, with the keyring's default size.
+            erasure: { enabled: erasureOn, keyringInstances: 2 },
             // Feature 041: where the backups go, as an installation with Garage and no copy says it.
             backups: {
                 backupTarget: "object-store",
@@ -1070,6 +1080,195 @@ export async function fakeControlPlane(options = {}) {
     const display = (c) => c.name ?? c.email ?? c.subject;
     const noSuchProject = (id) => new HttpError(404, `no such project '${id}'`);
     /** A project's grants are read by its organization's members and written by its owners; an outsider is told there is no project. */
+    // ── Erasure requests (feature 042) ─────────────────────────────────────────
+    const Crockford = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+    /** A request's id: a ULID, sortable by time, as the control plane makes one. */
+    const erasureId = () => {
+        let time = Date.now();
+        let head = "";
+        for (let i = 0; i < 10; i++) {
+            head = Crockford[time % 32] + head;
+            time = Math.floor(time / 32);
+        }
+        const tail = [...randomBytes(16)].map((b) => Crockford[b % 32]).join("");
+        return head + tail;
+    };
+    const SubjectRule = "a data subject is 1 to 253 characters from letters, digits, '.', '_', '-', '/' and ':'";
+    /** Every write is refused while the installation's erasure is off, in the control plane's words. */
+    function requireErasure() {
+        if (!erasureOn)
+            throw new HttpError(409, "erasure is off on this installation (ANKKA_ERASURE)");
+    }
+    /** The key destroyed and every service of the project completed: what the platform does after the answer. */
+    function applyErasure(r) {
+        const at = now();
+        r.state = "applied";
+        r.erasureSeq = ++erasureSeq;
+        r.destroyedAt = at;
+        r.appliedAt = at;
+        r.lastFailure = undefined;
+        r.completions = [...services.values()]
+            .filter((s) => s.projectId === r.project)
+            .map((s) => ({ service: s.name, completedAt: at, rowsRedacted: 3, tokensDropped: 1, sessionsEnded: 1 }))
+            .sort((a, b) => a.service.localeCompare(b.service));
+    }
+    /** A request answered as `applying` is applied by the next read, as the real one is moments later. */
+    function settleErasures(project) {
+        for (const r of project.erasures ?? [])
+            if (r.state === "applying")
+                applyErasure(r);
+    }
+    function requireErasure404(project, rid) {
+        const r = project.erasures?.find((e) => e.id === rid);
+        if (!r)
+            throw new HttpError(404, `no such erasure request '${project.id}/${rid}'`);
+        return r;
+    }
+    const notHeld = (r, what) => {
+        if (r.state !== "held")
+            throw new HttpError(409, `erasure request '${r.project}/${r.id}': it is ${r.state} and cannot be ${what}`);
+    };
+    const erasureView = (r) => ({
+        id: r.id,
+        project: r.project,
+        subject: r.subject,
+        state: r.state,
+        askedBy: r.askedBy,
+        askedAt: r.askedAt,
+        notBefore: r.notBefore,
+        reason: r.reason,
+        correlation: r.correlation,
+        lapsedAt: r.lapsedAt,
+        holdOverride: r.holdOverride,
+        erasureSeq: r.erasureSeq,
+        destroyedAt: r.destroyedAt,
+        completions: r.completions,
+        finalAt: r.finalAt,
+        lastFailure: r.lastFailure,
+    });
+    const erasureSummary = (r, withProject = false) => ({
+        id: r.id,
+        subject: r.subject,
+        state: r.state,
+        correlation: r.correlation,
+        notBefore: r.notBefore,
+        askedBy: r.askedBy,
+        askedAt: r.askedAt,
+        appliedAt: r.appliedAt,
+        finalAt: r.finalAt,
+        project: withProject ? r.project : undefined,
+    });
+    function askErasure(project, subject, notBefore, reason, correlation, askedBy) {
+        if (typeof subject !== "string" || !/^[A-Za-z0-9._/:-]{1,253}$/.test(subject))
+            throw new HttpError(400, `the value given is not a data subject: ${SubjectRule}`);
+        if (reason !== undefined && reason.length > 500)
+            throw new HttpError(400, "a reason is at most 500 characters");
+        if (correlation !== undefined && !/^[A-Za-z0-9._/:-]{1,128}$/.test(correlation))
+            throw new HttpError(400, "a correlation is 1 to 128 characters from letters, digits, '.', '_', '-', '/' and ':'");
+        if (notBefore !== undefined && Number.isNaN(Date.parse(notBefore)))
+            throw new HttpError(400, `'${notBefore}' is not an instant`);
+        const askedAt = now();
+        const held = notBefore !== undefined && Date.parse(notBefore) > Date.parse(askedAt);
+        const r = { id: erasureId(), project: project.id, subject, state: held ? "held" : "applying", askedBy, askedAt, notBefore, reason, correlation, completions: [] };
+        project.erasures ??= [];
+        project.erasures.push(r);
+        return r;
+    }
+    route("POST", "/projects/{projectId}/erasures", (c, p, body) => {
+        const { project, org } = requireProject(c, p.projectId);
+        requireWrite(org);
+        requireErasure();
+        const b = (body ?? {});
+        settleErasures(project);
+        // Asked again for a data subject already erased: that request, answered 200 rather than 201.
+        const applied = project.erasures?.find((r) => r.subject === b.subject && r.state === "applied");
+        if (applied)
+            return erasureView(applied);
+        return new Created(erasureView(askErasure(project, b.subject, b.notBefore ?? undefined, b.reason ?? undefined, b.correlation ?? undefined, c.subject)));
+    });
+    route("GET", "/projects/{projectId}/erasures", (c, p, _body, url) => {
+        const { project } = requireProject(c, p.projectId);
+        settleErasures(project);
+        const subject = url.searchParams.get("subject");
+        const state = url.searchParams.get("state");
+        const correlation = url.searchParams.get("correlation");
+        if (state !== null && !["held", "applying", "applied", "withdrawn"].includes(state))
+            throw new HttpError(400, `state is one of held, applying, applied, withdrawn, not '${state}'`);
+        return [...(project.erasures ?? [])]
+            .reverse()
+            .filter((r) => (subject === null || r.subject === subject) && (state === null || r.state === state) && (correlation === null || r.correlation === correlation))
+            .map((r) => erasureSummary(r));
+    });
+    route("GET", "/erasures", (c, _p, _body, url) => {
+        const correlation = url.searchParams.get("correlation");
+        return [...projects.values()]
+            .filter((p) => organizations.get(p.organizationId)?.members.has(c.subject))
+            .flatMap((p) => (settleErasures(p), [...(p.erasures ?? [])].reverse()))
+            .filter((r) => correlation === null || r.correlation === correlation)
+            .map((r) => erasureSummary(r, true));
+    });
+    route("GET", "/projects/{projectId}/erasures/{rid}", (c, p) => {
+        const { project } = requireProject(c, p.projectId);
+        settleErasures(project);
+        return erasureView(requireErasure404(project, p.rid));
+    });
+    route("PUT", "/projects/{projectId}/erasures/{rid}", (c, p, body) => {
+        const { project, org } = requireProject(c, p.projectId);
+        requireWrite(org);
+        requireErasure();
+        const r = requireErasure404(project, p.rid);
+        notHeld(r, "replaced");
+        const b = (body ?? {});
+        if (b.reason && b.reason.length > 500)
+            throw new HttpError(400, "a reason is at most 500 characters");
+        r.notBefore = b.notBefore ?? undefined;
+        r.reason = b.reason ?? undefined;
+        return erasureView(r);
+    });
+    route("POST", "/projects/{projectId}/erasures/{rid}/withdraw", (c, p) => {
+        const { project, org } = requireProject(c, p.projectId);
+        requireWrite(org);
+        requireErasure();
+        const r = requireErasure404(project, p.rid);
+        notHeld(r, "withdrawn");
+        r.state = "withdrawn";
+        return erasureView(r);
+    });
+    route("POST", "/projects/{projectId}/erasures/{rid}/override", (c, p, body) => {
+        const { project } = requireProject(c, p.projectId);
+        const org = requireOwner(c, project.organizationId);
+        requireWrite(org);
+        requireErasure();
+        const r = requireErasure404(project, p.rid);
+        notHeld(r, "overridden");
+        const reason = String(body?.reason ?? "");
+        if (reason.trim() === "")
+            throw new HttpError(400, "an override needs a reason");
+        if (reason.length > 500)
+            throw new HttpError(400, "an override's reason is at most 500 characters");
+        r.state = "applying";
+        r.holdOverride = { owner: c.subject, reason, at: now() };
+        return erasureView(r);
+    });
+    route("GET", "/projects/{projectId}/erasures/{rid}/certificate", (c, p) => {
+        const { project } = requireProject(c, p.projectId);
+        settleErasures(project);
+        const r = requireErasure404(project, p.rid);
+        if (r.state !== "applied")
+            throw new HttpError(409, `erasure request '${r.id}' is ${r.state}; a certificate is issued once it is applied`);
+        return {
+            request: r.id,
+            project: r.project,
+            subject: r.subject,
+            askedBy: r.askedBy,
+            askedAt: r.askedAt,
+            hold: r.notBefore ? { notBefore: r.notBefore, reason: r.reason, lapsedAt: r.lapsedAt } : undefined,
+            holdOverride: r.holdOverride,
+            keyDestroyedAt: r.destroyedAt,
+            services: r.completions.map((x) => ({ service: x.service, completedAt: x.completedAt })),
+            finalAt: r.finalAt,
+        };
+    });
     function grantProject(c, id, owner) {
         const project = projects.get(id);
         if (!project)
@@ -1726,7 +1925,10 @@ export async function fakeControlPlane(options = {}) {
         match.r.keys.forEach((k, i) => (params[k] = decodeURIComponent(match.m[i + 1])));
         try {
             const result = match.r.handler(caller, params, body, url);
-            send(res, 200, result);
+            if (result instanceof Created)
+                send(res, 201, result.body);
+            else
+                send(res, 200, result);
         }
         catch (e) {
             if (e instanceof HttpError)
@@ -1799,6 +2001,8 @@ export async function fakeControlPlane(options = {}) {
                 cloud = seed.cloud;
             if (seed.held)
                 hold = { ...seed.held, releasedAt: undefined, releasedBy: undefined };
+            if (seed.erasure !== undefined)
+                erasureOn = seed.erasure;
             for (const o of seed.organizations ?? []) {
                 const members = new Map();
                 for (const s of o.owners ?? [])
@@ -1900,6 +2104,19 @@ export async function fakeControlPlane(options = {}) {
                 if (g.state && g.state !== "pending" && g.state !== "accepted")
                     grant.ended = { by: g.by ?? "seed", at: grant.granted.at };
             }
+            for (const e of seed.erasures ?? []) {
+                const project = projects.get(e.projectId);
+                if (!project)
+                    throw new Error(`no project ${e.projectId}`);
+                const notBefore = e.notBefore ?? (e.state === "held" ? new Date(Date.now() + 30 * 86400000).toISOString() : undefined);
+                const r = askErasure(project, e.subject, notBefore, e.reason, e.correlation, e.askedBy ?? "seed");
+                if (e.state === "applied")
+                    applyErasure(r);
+                else if (e.state === "withdrawn")
+                    r.state = "withdrawn";
+                else if (r.state !== "held")
+                    throw new Error(`a held erasure request needs a not-before date in the future, not ${notBefore}`);
+            }
         },
         close: () => new Promise((resolve) => {
             server.closeAllConnections();

package/dist/ui/erasures.d.ts

@@ -0,0 +1,9 @@
+/** What the erasure pages share (feature 042). */
+/**
+ * A not-before date as a date field gives it (`YYYY-MM-DD`), as the instant the control plane takes:
+ * the start of that day, UTC. Empty is no hold. A value that is not a date is passed on as it is, for
+ * the control plane to refuse in its own words.
+ */
+export declare function notBeforeOf(date: string): string | undefined;
+/** The not-before date as a date field shows it: the instant's day, UTC. */
+export declare function dateOf(instant: string | undefined): string | undefined;

package/dist/ui/erasures.js

@@ -0,0 +1,16 @@
+/** What the erasure pages share (feature 042). */
+/**
+ * A not-before date as a date field gives it (`YYYY-MM-DD`), as the instant the control plane takes:
+ * the start of that day, UTC. Empty is no hold. A value that is not a date is passed on as it is, for
+ * the control plane to refuse in its own words.
+ */
+export function notBeforeOf(date) {
+    if (!date)
+        return undefined;
+    const at = new Date(`${date}T00:00:00Z`);
+    return Number.isNaN(at.getTime()) ? date : at.toISOString();
+}
+/** The not-before date as a date field shows it: the instant's day, UTC. */
+export function dateOf(instant) {
+    return instant ? instant.slice(0, 10) : undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ankka-console",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "description": "The ankka console as a package: the control plane client, sign-in and sessions, and the pages as routes a React Router host mounts.",
   "license": "Apache-2.0",
   "type": "module",
@@ -52,13 +52,13 @@
   "dependencies": {
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
-    "jose": "^6.2.13",
-    "lucide-react": "^1.62.0",
-    "openid-client": "^6.8.8",
+    "jose": "^6.2.15",
+    "lucide-react": "^1.67.0",
+    "openid-client": "^6.8.9",
     "zod": "^4.6.7"
   },
   "peerDependencies": {
-    "@react-router/dev": "^8.5.0",
+    "@react-router/dev": "^8.5.1",
     "@react-router/node": "^8.4.0",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
@@ -71,10 +71,10 @@
   },
   "devDependencies": {
     "@fontsource-variable/inter": "^5.3.0",
-    "@react-router/dev": "^8.5.0",
+    "@react-router/dev": "^8.5.1",
     "@react-router/node": "^8.4.0",
-    "@tailwindcss/cli": "^4.3.3",
-    "@types/node": "^26.6.5",
+    "@tailwindcss/cli": "^4.3.4",
+    "@types/node": "^26.6.6",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
     "react": "^19.3.1",