cartethyia 2.7.3 → 2.7.5

package/src/console/auth/session.ts

@@ -1,5 +1,5 @@
 import { asCookie, clearCsrfCookie, newCsrfToken, setCsrfCookie } from "../../security/csrf";
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import { eq } from "drizzle-orm";
 import { isRecord } from "../../protocol/codecs";
 import { userRecord, returningRows, assertMutationApplied } from "./row-coercion";
@@ -13,12 +13,13 @@ import type { FirstBootSetupService } from "./setup-service";
 import { isTrustedProxyPeer, resolveClientIdentity } from "../../security/ip-boundary";
 import type { TrustedProxyBoundary } from "../../config/network";
 import { readSessionCookie } from "./session-resolver";
-export interface LoginRequest {
+import { asConsoleDb } from "../shared/transaction";
+interface LoginRequest {
   readonly username: string;
   readonly password: string;
 }
 
-export interface LoginResponse {
+interface LoginResponse {
   readonly status: "success" | "failed";
   /** Session secrets are cookie-only and are never returned in JSON. */
   readonly session_id?: never;
@@ -47,13 +48,13 @@ export type SessionStatusResponse =
     }
   | { readonly status: "unauthenticated" };
 
-export interface SetupRequest {
+interface SetupRequest {
   readonly password: string;
   readonly username?: string;
   readonly display_name?: string;
 }
 
-export interface SetupResponse {
+interface SetupResponse {
   readonly status: "success" | "failed";
   readonly message?: string;
 }
@@ -65,7 +66,7 @@ export interface SetupResponse {
  * report that instead of only "it worked".
  */
 /** A backup's cover, so the wizard can show what a file holds before restoring. */
-export interface SetupInspectResponse extends SetupResponse {
+interface SetupInspectResponse extends SetupResponse {
   readonly format?: "native" | "nine_router";
   readonly version?: number;
   readonly exportedAt?: string;
@@ -79,18 +80,18 @@ export interface SetupInspectResponse extends SetupResponse {
   readonly warnings?: readonly { readonly table?: string; readonly column?: string; readonly reason: string }[];
 }
 
-export interface SetupRestoreResponse extends SetupResponse {
+interface SetupRestoreResponse extends SetupResponse {
   readonly restored?: Record<string, number>;
   readonly warnings?: readonly { readonly table?: string; readonly column?: string; readonly reason: string }[];
   /** The administrator this install was given, since the file carries none. */
   readonly createdAdmin?: boolean;
 }
 
-export interface LogoutResponse {
+interface LogoutResponse {
   readonly status: "success";
 }
 
-export interface ChangePasswordResponse {
+interface ChangePasswordResponse {
   readonly status: "success" | "failed";
   readonly message?: string;
 }
@@ -183,6 +184,31 @@ async function lockedOutMessage(
   };
 }
 
+/**
+ * Records one failed login and answers with the 429/401 result, including the
+ * `retry-after` header when the failure took the lock. Shared by the unknown /
+ * inactive-user and wrong-password branches, which differ only in the audit
+ * reason string.
+ */
+async function rejectLogin(
+  lockoutService: ConsoleLockoutService,
+  lockoutKey: string,
+  reason: string,
+  set: { status?: number | string; headers: Record<string, string | number | string[]> },
+): Promise<LoginResponse> {
+  const isBanned = await lockoutService.recordFailure(lockoutKey, reason);
+  if (isBanned) {
+    set.status = 429;
+    set.headers["retry-after"] = String(await lockoutService.remainingLockSeconds(lockoutKey));
+    return lockedOutMessage(lockoutService, lockoutKey);
+  }
+  set.status = 401;
+  return {
+    status: "failed",
+    message: await failedLoginMessage(lockoutService, lockoutKey),
+  } satisfies LoginResponse;
+}
+
 function parseLoginRequest(body: unknown): LoginRequest | undefined {
   if (!isRecord(body) || typeof body.password !== "string") {
     return undefined;
@@ -217,7 +243,7 @@ export function createConsoleAuthRoutes(
   cookiePolicy: SessionCookiePolicy = defaultSessionCookiePolicy,
   trustedProxyBoundary: TrustedProxyBoundary = { mode: "disabled" },
   resolvePeerAddress: (request: Request) => string | undefined = () => undefined,
-): Elysia {
+): AnyElysia {
   const app = new Elysia({ prefix: "/auth" });
   const policy = cookiePolicy;
   const database = db;
@@ -266,32 +292,12 @@ export function createConsoleAuthRoutes(
       const rows = await readUsers(database, input.username);
       const user = userRecord(rows[0]);
       if (!user || !user.isActive) {
-        const isBanned = await lockoutService.recordFailure(lockoutKey, "unknown_user");
-        if (isBanned) {
-          set.status = 429;
-          set.headers["retry-after"] = String(await lockoutService.remainingLockSeconds(lockoutKey));
-          return lockedOutMessage(lockoutService, lockoutKey);
-        }
-        set.status = 401;
-        return {
-          status: "failed",
-          message: await failedLoginMessage(lockoutService, lockoutKey),
-        } satisfies LoginResponse;
+        return rejectLogin(lockoutService, lockoutKey, "unknown_user", set);
       }
 
       const valid = await credentialService.verifyPassword(input.password, user.passwordHash);
       if (!valid) {
-        const isBanned = await lockoutService.recordFailure(lockoutKey, "invalid_password");
-        if (isBanned) {
-          set.status = 429;
-          set.headers["retry-after"] = String(await lockoutService.remainingLockSeconds(lockoutKey));
-          return lockedOutMessage(lockoutService, lockoutKey);
-        }
-        set.status = 401;
-        return {
-          status: "failed",
-          message: await failedLoginMessage(lockoutService, lockoutKey),
-        } satisfies LoginResponse;
+        return rejectLogin(lockoutService, lockoutKey, "invalid_password", set);
       }
 
       await lockoutService.clearFailures(lockoutKey);
@@ -526,11 +532,11 @@ export function createConsoleAuthRoutes(
         });
         return invalidated;
       };
-      await database.transaction((tx) => rotateInScope(tx as unknown as CartethyiaDatabase));
+      await database.transaction((tx) => rotateInScope(asConsoleDb(tx)));
       set.status = 200;
       return { status: "success" } satisfies ChangePasswordResponse;
     },
   );
 
-  return app as unknown as Elysia;
+  return app;
 }

package/src/console/auth/setup-service.ts

@@ -20,6 +20,7 @@ import {
 import { resolveDefaultGatewayApiKey } from "../../config/runtime";
 import { TENANT_KEY_SCOPES } from "../../security/access-control";
 import { isRecord } from "../../protocol/codecs";
+import { asConsoleDb } from "../shared/transaction";
 import { BackupService } from "../backup/service";
 import type { BackupInspection } from "../backup/service";
 import type { RestoreWarning } from "../backup/contracts";
@@ -28,14 +29,14 @@ import type { RestoreWarning } from "../backup/contracts";
 // and the mode is read from the environment the process was started with.
 
 /** The administrator to create when a restored backup left none to sign in with. */
-export interface AdminBootstrap {
+interface AdminBootstrap {
   readonly password: string;
   readonly username?: string;
   readonly displayName?: string;
 }
 
 /** What a first-boot restore did, so the console can report it honestly. */
-export interface RestoreBackupOutcome {
+interface RestoreBackupOutcome {
   readonly restored: Record<string, number>;
   readonly skipped: Record<string, number>;
   /** Parts of the file that could not be restored. */
@@ -171,7 +172,7 @@ export class FirstBootSetupService {
     // unserialized lets two boots both pass the check.
     await this.db.transaction(async (transaction) => {
       await transaction.execute(firstBootSetupLock());
-      await create(transaction as unknown as CartethyiaDatabase);
+      await create(asConsoleDb(transaction));
     });
   }
 

package/src/console/auth/user-store.ts

@@ -6,7 +6,7 @@ import {
 
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 
-export class ConsoleUserStore {
+class ConsoleUserStore {
   constructor(private readonly db: CartethyiaDatabase) {}
 
   async findByUsername(username: string): Promise<unknown | undefined> {

package/src/console/backup/9router-map.ts

@@ -106,9 +106,6 @@ export const PROXY_KINDS: Readonly<Record<string, "http" | "https" | "socks5">>
   workers: "https",
 };
 
-/** Proxy types we recognize but cannot represent, with the reason. */
-export const REFUSED_PROXY_KINDS: Readonly<Record<string, string>> = {};
-
 /**
  * Router combo strategy → ours.
  *

package/src/console/backup/contracts.ts

@@ -33,6 +33,7 @@ import {
   poolRoutingSettings,
   providerAccounts,
   providerOauthStates,
+  providerPoolAccounts,
   providerRoutingSettings,
   providers,
   shareLinks,
@@ -96,6 +97,7 @@ export const CONFIG_TABLES = [
   models,
   providerRoutingSettings,
   providerAccounts,
+  providerPoolAccounts,
   poolRoutingSettings,
   networkPools,
   providers,
@@ -168,9 +170,15 @@ const SEALED_COLUMNS: Readonly<Record<string, Readonly<Record<string, string>>>>
   share_links: { token_encrypted: "share_token" },
 };
 
+const SEALED_COLUMNS_CACHE = new WeakMap<Table, ReadonlySet<string>>();
+
 /** The sealed columns of `table`, by column name. */
 export function sealedColumns(table: Table): ReadonlySet<string> {
-  return new Set(Object.keys(SEALED_COLUMNS[getTableName(table)] ?? {}));
+  const cached = SEALED_COLUMNS_CACHE.get(table);
+  if (cached) return cached;
+  const names = new Set(Object.keys(SEALED_COLUMNS[getTableName(table)] ?? {}));
+  SEALED_COLUMNS_CACHE.set(table, names);
+  return names;
 }
 
 /**
@@ -203,7 +211,6 @@ export function sealedAliases(table: Table): ReadonlyMap<string, string> {
   return out;
 }
 
-
 /**
  * Which rows of a table belong to one tenant, and how a restore replaces them.
  *
@@ -234,7 +241,7 @@ export function sealedAliases(table: Table): ReadonlyMap<string, string> {
  * - `self` — the tenant row itself, matched on its own id, upserted and never
  *   deleted.
  */
-export type TableOwnership =
+type TableOwnership =
   | { readonly kind: "direct"; readonly column: Column; readonly replace: "delete" | "upsert" }
   | {
       readonly kind: "viaParent";
@@ -491,7 +498,7 @@ export function findTable(section: BackupSection, name: string): Table | undefin
   return tablesForSection(section).find((table) => tableName(table) === name);
 }
 
-export interface BackupExportResult {
+export interface BackupPayloadExport {
   readonly payload: BackupPayload;
   readonly counts: Record<string, number>;
 }
@@ -509,11 +516,6 @@ export interface ValidatedTable {
   readonly rows: readonly BackupRow[];
 }
 
-export interface RestoreResult {
-  readonly restored: Record<string, number>;
-  readonly skipped: Record<string, number>;
-}
-
 /**
  * One part of a backup that could not be restored, and why.
  *

package/src/console/backup/export-endpoint.ts

@@ -23,11 +23,11 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { GatewayError } from "../../protocol/gateway-error";
 import { isLoopbackPeer, tokenMatches } from "../../transport/drain-endpoint";
-import { BACKUP_SECTIONS, tablesForSection } from "./contracts";
+import { tablesForSection } from "./contracts";
 import { compressBackupStream, exportBackupStream } from "./store";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
 
-export interface BackupExportDeps {
+interface BackupExportDeps {
   readonly db: CartethyiaDatabase;
   /** Shared secret; the route is registered only when this is set. */
   readonly token: string;
@@ -37,7 +37,8 @@ export interface BackupExportDeps {
   readonly resolvePeerAddress: (request: Request) => string | null;
 }
 
-export interface BackupExportResult {
+/** The file-write result of an operator export, distinct from the payload shape `BackupPayloadExport` in `contracts.ts`. */
+export interface BackupExportFileResult {
   readonly path: string;
   readonly bytes: number;
   readonly counts: Record<string, number>;
@@ -52,20 +53,20 @@ export function createBackupExportHandler(
     // came from, the second is the credential it carried — and `invalid_request`
     // told an operator to fix a body that was never the problem.
     if (!isLoopbackPeer(deps.resolvePeerAddress(request)))
-      throw new GatewayError("policy_rejected", 403, "backup export is only available from loopback");
+      throw new GatewayError("policy_rejected", 403, "backup export is only available from loopback (request {requestId}). This operation is only allowed from a trusted loopback connection — no hard feelings 🫂");
     if (!tokenMatches(request.headers.get("x-drain-token"), deps.token))
-      throw new GatewayError("authentication_failed", 401, "invalid export token");
+      throw new GatewayError("authentication_failed", 401, "invalid export token (request {requestId}). Wrong key, right door — check the token 🔑");
 
     const directory =
       body !== null && typeof body === "object" && "directory" in body
         ? body.directory
         : undefined;
     if (directory !== undefined && typeof directory !== "string")
-      throw new GatewayError("invalid_request", 400, "directory must be a string");
+      throw new GatewayError("invalid_request", 400, "directory must be a string (request {requestId}). Check the shape of what you sent — then resend 🪞");
 
     const tenantId = await deps.resolveTenantId();
     if (tenantId === null)
-      throw new GatewayError("invalid_request", 409, "no tenant exists; run setup first");
+      throw new GatewayError("invalid_request", 409, "no tenant exists; run setup first (request {requestId}). Nothing here but dust — run setup first 🌙");
 
     // One gzip pass over the streamed document: a tenant with hundreds of
     // thousands of rows is read page by page and only the compressed bytes
@@ -83,13 +84,13 @@ export function createBackupExportHandler(
       writeFileSync(path, gzipped);
     } catch (error) {
       throw new GatewayError(
-        "invalid_request",
+        "internal_error",
         500,
-        `could not write ${path}: ${error instanceof Error ? error.message : "unknown error"}`,
+        `could not write ${path}: ${error instanceof Error ? error.message : "unknown error"} (request {requestId}). Even we have bad days — retry, and quote the request id if it persists 🐻`,
       );
     }
 
-    const result: BackupExportResult = { path, bytes: gzipped.byteLength, counts };
+    const result: BackupExportFileResult = { path, bytes: gzipped.byteLength, counts };
     return new Response(JSON.stringify(result), {
       status: 200,
       headers: { "content-type": "application/json", "cache-control": "no-store" },
@@ -108,5 +109,3 @@ function downloadDirectory(): string {
         : join(process.env.XDG_DOWNLOAD_DIR ?? join(home, "Downloads"));
   return candidate;
 }
-
-export { BACKUP_SECTIONS };

package/src/console/backup/nine-router.ts

@@ -29,7 +29,6 @@ import {
   isNodeProviderId,
   NODE_WIRE_FAMILIES,
   PROXY_KINDS,
-  REFUSED_PROXY_KINDS,
   UNSUPPORTED_PROVIDERS,
   UPSTREAM_PROVIDERS,
 } from "./9router-map";
@@ -50,7 +49,7 @@ export interface ImportReport {
   readonly remapped: readonly string[];
 }
 
-export interface ConversionResult {
+interface ConversionResult {
   readonly payload: BackupPayload;
   readonly report: ImportReport;
 }
@@ -479,11 +478,6 @@ export function convert9RouterBackup(input: unknown, tenantId: string): Conversi
       return;
     }
     const rawKind = text(entry.type) ?? "http";
-    const refused = REFUSED_PROXY_KINDS[rawKind];
-    if (refused !== undefined) {
-      skipped.push(`proxy pool "${label}": type "${rawKind}" (${refused})`);
-      return;
-    }
     const kind = PROXY_KINDS[rawKind];
     if (kind === undefined) {
       skipped.push(`proxy pool "${label}": unknown type "${rawKind}"`);

package/src/console/backup/routes.ts

@@ -14,7 +14,7 @@
  * The body bound is enforced here, before the JSON parse, because the whole
  * point of the limit is to not buffer an unbounded file.
  */
-import { Elysia, t } from "elysia";
+import { Elysia, t, type AnyElysia } from "elysia";
 import type { ConsoleAccessResolver } from "../auth/access";
 import { invalidateApiKeyCache } from "../../security/api-key-auth";
 import { invalidatePublicModels } from "../providers/catalog/public-model-store";
@@ -26,7 +26,7 @@ import { DELETE_ALL_SCOPES, compressBackupStream } from "./store";
 import type { BackupService } from "./service";
 import type { AuditRecorder } from "../auth/audit-recorder";
 
-export interface BackupRoutesConfig {
+interface BackupRoutesConfig {
   readonly accessResolver: ConsoleAccessResolver;
   /**
    * Builds the service for one request. A factory rather than an instance
@@ -118,6 +118,30 @@ function parseSections(raw: string | undefined): readonly BackupSection[] | unde
     .filter((part) => part.length > 0) as readonly BackupSection[];
 }
 
+/**
+ * Enforces the byte bound against actual received bytes, not just the declared
+ * header: a missing or spoofed content-length would otherwise bypass the 413
+ * and buffer an unbounded file into JSON.parse. Elysia has already parsed the
+ * body here, so measure the re-serialized form — an over-limit file still
+ * fails closed before any restore/inspection touches the DB. Returns the 413
+ * response when over the limit, or `null` when the body is accepted.
+ */
+function enforceBodyLimit(request: Request, body: unknown, set: { status?: number | string }): { error: string; code: string } | null {
+  const declared = Number(request.headers.get("content-length") ?? "0");
+  const actualBytes = JSON.stringify(body ?? null).length;
+  if (
+    (Number.isFinite(declared) && declared > MAX_BACKUP_BYTES) ||
+    actualBytes > MAX_BACKUP_BYTES
+  ) {
+    set.status = 413;
+    return {
+      error: `backup exceeds the ${MAX_BACKUP_BYTES} byte limit`,
+      code: "request_too_large",
+    };
+  }
+  return null;
+}
+
 /**
  * Streams the export document into the response body as it is written; one
  * row-page of the tenant's data is in memory at a time.
@@ -139,7 +163,7 @@ function payloadDocument(chunks: AsyncGenerator<string, void, void>): ReadableSt
   });
 }
 
-export function createBackupRoutes(config: BackupRoutesConfig): Elysia {
+export function createBackupRoutes(config: BackupRoutesConfig): AnyElysia {
   return new Elysia({ prefix: "/backup" })
     .get("/export", { query: exportQuery }, async ({ request, query, set }) => {
       try {
@@ -194,23 +218,8 @@ export function createBackupRoutes(config: BackupRoutesConfig): Elysia {
         if (access.tenantId === null) {
           throw new ConsoleDomainError("tenant_required", 403, "Tenant isolation required");
         }
-        // Enforce against actual received bytes, not just the declared header:
-        // a missing or spoofed content-length would otherwise bypass the 413
-        // and buffer an unbounded file into JSON.parse. Elysia has already
-        // parsed the body here, so measure the re-serialized form — an
-        // over-limit file still fails closed before restore touches the DB.
-        const declared = Number(request.headers.get("content-length") ?? "0");
-        const actualBytes = JSON.stringify(body ?? null).length;
-        if (
-          (Number.isFinite(declared) && declared > MAX_BACKUP_BYTES) ||
-          actualBytes > MAX_BACKUP_BYTES
-        ) {
-          set.status = 413;
-          return {
-            error: `backup exceeds the ${MAX_BACKUP_BYTES} byte limit`,
-            code: "request_too_large",
-          };
-        }
+        const tooLarge = enforceBodyLimit(request, body, set);
+        if (tooLarge !== null) return tooLarge;
         // The restoring tenant comes from the caller's own access decision and
         // from nowhere else. A request body may not name the tenant it writes
         // into: that would let any holder of the scope import into, and
@@ -283,26 +292,13 @@ export function createBackupRoutes(config: BackupRoutesConfig): Elysia {
         if (access.tenantId === null) {
           throw new ConsoleDomainError("tenant_required", 403, "Tenant isolation required");
         }
-        // Same byte bound as the import, for the same reason: the file is
-        // parsed here too, and an unbounded one would be buffered before any
-        // validation could refuse it.
-        const declared = Number(request.headers.get("content-length") ?? "0");
-        const actualBytes = JSON.stringify(body ?? null).length;
-        if (
-          (Number.isFinite(declared) && declared > MAX_BACKUP_BYTES) ||
-          actualBytes > MAX_BACKUP_BYTES
-        ) {
-          set.status = 413;
-          return {
-            error: `backup exceeds the ${MAX_BACKUP_BYTES} byte limit`,
-            code: "request_too_large",
-          };
-        }
+        const tooLarge = enforceBodyLimit(request, body, set);
+        if (tooLarge !== null) return tooLarge;
         // Reads nothing and writes nothing: the checklist the restore wizard
         // shows, so an operator can pick sections before typing a password.
         return config.backupFor(request).inspect(body.backup);
       } catch (error) {
         return errorResponse(error, set, "Backup inspection failed");
       }
-    }) as unknown as Elysia;
+    });
 }