create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/middleware/default-tenant.ts

@@ -1,166 +0,0 @@
-/**
- * Default-tenant guard preHandler — the BASE-build tenant guard (#5677).
- *
- * The base-build counterpart to `./tenant.ts`, which is a multi-tenant SLICE
- * (`// oss: false`) and therefore absent on a build without that module. Same
- * posture, same decoration, same denials; the only difference is where the
- * tenant comes from — the seeded default Workspace
- * (`services/default-tenant.ts#resolveDefaultTenant`) rather than the
- * session's active workspace, which a single-tenant site does not have.
- *
- * `server.ts` picks ONE of the two per build: multi-tenant's guard when the
- * module is enabled, this one otherwise. They never both run, and this one is
- * never reachable on a build that has the module — a fallback beneath it, not
- * a parallel path.
- *
- * Default-deny — every branch that is not an explicit grant is a denial:
- *
- *   - unauthenticated                                    → 401
- *   - a personal ApiToken (no cookie session, no agent)  → 403
- *   - an agent (#3591) whose person is not the operator,
- *     or not bound to the default workspace under the
- *     operator's own Membership                          → 403
- *   - AILK_OPERATOR_EMAIL is unset                       → 403
- *   - the caller's email is not the pinned one           → 403
- *   - the deployment is not unambiguously single-tenant  → 403
- *   - the caller holds no Membership on the default Org  → 403
- *   - URL workspaceId ≠ the resolved workspace           → 403
- *     (compared BEFORE any lookup of the target — no tenant enumeration)
- *
- * The two `AILK_OPERATOR_EMAIL` branches are this guard's own, and they are
- * why it calls `resolveDefaultTenantForOperator` rather than
- * `resolveDefaultTenant`: on this build the review surface and
- * `isPlatformOperator`'s unfiltered `{kind: "all"}` scope became reachable
- * together, so an unpinned deployment must seat nobody rather than seat
- * whoever authenticates first. See that function for the full reasoning. A
- * deployment that wants the dashboard MUST pin the operator; unset is a
- * refusal, not a default-open.
- *
- * The URL-workspaceId comparison is not redundant on this path even though
- * `resolveDefaultTenant` only ever yields the one seeded workspace: it is what
- * makes a request naming a FOREIGN workspaceId a 403 rather than a silently
- * mis-scoped read, and it is the same comparison `tenant.ts` makes, in the
- * same place.
- *
- * This guard deliberately does NOT read `sessionTenant.activeWorkspaceId`.
- * `resolveDefaultTenant` grants only while `workspace.count() === 1` and that
- * sole workspace is the sentinel default, so on any build this path can grant
- * on there is no second workspace for a stale session binding to point at.
- *
- * On grant it decorates `request.tenant` (a `TenantContext`), exactly as
- * `tenant.ts` does; route handlers pass that to `tenantDb(tenant)` so every
- * domain query is workspace-scoped. The `declare module` augmentation below is
- * the ONE copy of that decoration's type — `tenant.ts` no longer carries its
- * own, because this file ships on every build and the paid slice does not.
- */
-import type {
-  FastifyPluginCallback,
-  FastifyReply,
-  FastifyRequest,
-} from "fastify";
-
-import {
-  resolveDefaultTenantForAgent,
-  resolveDefaultTenantForOperator,
-  type TenantContext,
-} from "../services/default-tenant.js";
-
-declare module "fastify" {
-  interface FastifyRequest {
-    tenant?: TenantContext;
-  }
-}
-
-const FORBIDDEN = {
-  ok: false,
-  error: { code: "forbidden", message: "Forbidden" },
-} as const;
-
-/**
- * Resolve + attach the default tenant, or reply 401/403. Registered as a hook
- * in a tenant route scope (after auth), so no tenant-scoped handler runs
- * without a granted TenantContext.
- */
-export async function defaultTenantPreHandler(
-  request: FastifyRequest,
-  reply: FastifyReply,
-): Promise<void> {
-  const userId = request.userId;
-  if (!userId) {
-    reply.code(401).send({
-      ok: false,
-      error: { code: "unauthorized", message: "Authentication required" },
-    });
-    return;
-  }
-
-  // An agent (#3591 D5) goes through the same operator resolution, bound to
-  // its own workspace and Membership, with its role clamped. Any other caller
-  // without a cookie session — a personal ApiToken — carries no workspace
-  // binding and is denied, the same default-deny `resolveActiveTenant`
-  // applies on the multi-tenant path.
-  let tenant: TenantContext | null;
-  if (request.agent) {
-    tenant = await resolveDefaultTenantForAgent(userId, request.agent);
-  } else if (!request.sessionTenant) {
-    reply.code(403).send(FORBIDDEN);
-    return;
-  } else {
-    tenant = await resolveDefaultTenantForOperator(userId);
-  }
-  if (!tenant) {
-    reply.code(403).send(FORBIDDEN);
-    return;
-  }
-
-  // URL-scoped routes: the target workspace MUST be the resolved workspace.
-  // Compared before any target lookup — a foreign (or nonexistent)
-  // workspaceId gets the same 403.
-  const params = request.params as { workspaceId?: string } | undefined;
-  if (params?.workspaceId && params.workspaceId !== tenant.workspaceId) {
-    reply.code(403).send(FORBIDDEN);
-    return;
-  }
-
-  // #8514 D4 (SEC-8514-A) — fail closed: an agent's tenant must carry the
-  // marker `agentTenant` sets, or the agent would hold a member's client rows
-  // by role. A path that built one without it refuses every request.
-  if (request.agent && tenant.agent !== true) {
-    request.log.error({ event: "agent-tenant-unmarked" }, "agent tenant without its marker");
-    reply.code(403).send(FORBIDDEN);
-    return;
-  }
-
-  request.tenant = tenant;
-}
-
-/**
- * Tag a route as tenant-guarded (#3591 D6). Both guard plugins add this as an
- * `onRoute` hook, so it reaches exactly the routes their `preHandler` does:
- * every route registered after the plugin in its scope. The auth preHandler
- * refuses an agent on any route without the tag.
- */
-export function tagTenantGuarded(routeOptions: { config?: object }): void {
-  routeOptions.config = { ...routeOptions.config, tenantGuarded: true };
-}
-
-/**
- * Plugin form, mirroring `tenantPreHandlerPlugin`: skip-override so the hooks
- * propagate to sibling route plugins registered in the same scope.
- */
-export const defaultTenantPreHandlerPlugin: FastifyPluginCallback = (
-  fastify,
-  _opts,
-  done,
-) => {
-  fastify.decorateRequest("tenant", undefined);
-  fastify.addHook("onRoute", tagTenantGuarded);
-  fastify.addHook("preHandler", defaultTenantPreHandler);
-  done();
-};
-
-(
-  defaultTenantPreHandlerPlugin as FastifyPluginCallback & {
-    [key: symbol]: boolean;
-  }
-)[Symbol.for("skip-override")] = true;