hippo-memory 1.70.0 → 1.72.0

package/dist/server/route-table.js

@@ -1,8 +1,10 @@
+import { handleGitHubEventsWebhook } from '../connectors/github/webhook.js';
+import { handleSlackEventsWebhook } from '../connectors/slack/webhook.js';
 import { withSqliteOffLoop } from '../db/index.js';
-import { hasGroup } from '../store/index.js';
+import { hasGroup, requireGroup } from '../store/index.js';
 import { runsOffLoop } from '../store/sqlite/worker-store.js';
 import { HttpError, JSON_HEADERS, sendJson, STORE_NOT_PORTED_MESSAGE } from '../util/http-util.js';
-import { buildContextWithAuth, requireAuth } from './auth.js';
+import { assertCrossTenantAdmin, buildContextWithAuth, isLoopback } from './auth.js';
 import { matchPath, noteAccess } from './request.js';
 import { handleApproveQuarantine, handleCreateAuthKey, handleListAudit, handleListAuthKeys, handleListQuarantine, handleRejectQuarantine, handleRevokeAuthKey } from './routes/admin.js';
 import { handleCloseCustomerNote, handleCreateCustomerNote, handleGetCustomerNote, handleListCustomerNotes, handleSupersedeCustomerNote } from './routes/customer-notes.js';
@@ -16,102 +18,134 @@ import { handleCloseProjectBrief, handleCreateProjectBrief, handleGetProjectBrie
 import { handleAssembleSession, handleDrillRecall, handleGetContext, handleRecallMemories } from './routes/recall.js';
 import { handleCloseSkill, handleCreateSkill, handleExportSkills, handleGetSkill, handleListSkills, handleSupersedeSkill } from './routes/skills.js';
 import { parseJsonBody } from './validation.js';
-// Review patch #2: explicit allow-list for unauthenticated /v1/* routes.
-// New unauth routes MUST be added here AND get a corresponding entry in
-// tests/server-bearer-lockdown.test.ts. Do not gate auth elsewhere by
-// `path.startsWith` — pattern-positional auth is bypass-by-accident.
-//
-// The route handlers consult `isPublicRoute` before invoking
-// `buildContextWithAuth` / `requireAuth`. Adding a route here without
-// adding the corresponding `isPublicRoute` short-circuit in a handler is
-// a no-op (auth still applies), so the failure mode is fail-closed.
-// The only other unauthenticated paths are ServeOpts.publicJson's: GET only, checked at boot by assertPublicJson.
-const PUBLIC_ROUTES = new Set([
-    'POST /v1/connectors/slack/events',
-    'POST /v1/connectors/github/events',
-]);
-export function isPublicRoute(method, path) {
-    return PUBLIC_ROUTES.has(`${method} ${path}`);
+const WEBHOOK_GROUPS = ['entryWrites', 'connectorWrites', 'connectorEvents'];
+/** A store missing a group a delivery writes through refuses the webhook up front, so no delivery is acknowledged and then half stored. */
+function webhook(handle) {
+    return async ({ req, res, opts }) => {
+        for (const group of WEBHOOK_GROUPS)
+            requireGroup(opts.store, group);
+        await handle({ req, res, opts }, opts.store);
+    };
 }
-/** The /v1 routes in dispatch order; the first entry whose method and path match handles the request. */
-const V1_ROUTES = [
-    { method: 'POST', path: '/v1/memories', storeReady: 'entryWrites', loop: 'off', handler: handleCreateMemory },
-    { method: 'GET', path: '/v1/graph', storeReady: 'graphReads', loop: 'off', handler: handleGetGraph },
-    { method: 'GET', path: '/v1/memories', storeReady: 'base', loop: 'off', handler: handleRecallMemories },
-    { method: 'GET', pattern: '/v1/sessions/:id/assemble', storeReady: 'dagReads', loop: 'off', handler: handleAssembleSession },
-    { method: 'GET', pattern: '/v1/recall/drill/:id', storeReady: 'dagReads', handler: handleDrillRecall },
-    { method: 'POST', pattern: '/v1/memories/:id/archive', storeReady: 'entryWrites', loop: 'off', handler: handleArchiveMemory },
-    { method: 'POST', pattern: '/v1/memories/:id/supersede', storeReady: 'entryWrites', loop: 'off', handler: handleSupersedeMemory },
-    { method: 'POST', pattern: '/v1/memories/:id/promote', sqliteOnly: 'copies a memory between the two local hippo.db files', handler: handlePromoteMemory },
-    { method: 'DELETE', pattern: '/v1/memories/:id', storeReady: 'entryWrites', loop: 'off', handler: handleForgetMemory },
-    { method: 'POST', path: '/v1/outcome', storeReady: 'entryWrites', handler: handleApplyOutcome },
-    { method: 'GET', path: '/v1/context', storeReady: 'contextReads', handler: handleGetContext },
-    { method: 'POST', path: '/v1/sleep', sqliteOnly: 'consolidates every tenant under the local hippo root in this process', handler: handleSleep },
-    { method: 'POST', path: '/v1/auth/keys', storeReady: 'keyWrites', loop: 'off', handler: handleCreateAuthKey },
-    { method: 'GET', path: '/v1/auth/keys', storeReady: 'keyWrites', loop: 'off', handler: handleListAuthKeys },
-    { method: 'DELETE', pattern: '/v1/auth/keys/:keyId', storeReady: 'keyAudit', loop: 'off', handler: handleRevokeAuthKey },
-    { method: 'GET', path: '/v1/quarantine', storeReady: 'quarantine', loop: 'off', handler: handleListQuarantine },
-    { method: 'POST', pattern: '/v1/quarantine/:id/approve', storeReady: 'quarantine', loop: 'off', handler: handleApproveQuarantine },
-    { method: 'POST', pattern: '/v1/quarantine/:id/reject', storeReady: 'quarantine', loop: 'off', handler: handleRejectQuarantine },
-    { method: 'GET', path: '/v1/audit', storeReady: 'auditLog', loop: 'off', handler: handleListAudit },
-    { method: 'POST', path: '/v1/predictions', storeReady: 'predictions', loop: 'off', handler: handleCreatePrediction },
-    { method: 'GET', path: '/v1/predictions', storeReady: 'predictions', loop: 'off', handler: handleListPredictions },
-    { method: 'GET', path: '/v1/predictions/stats', storeReady: 'predictions', loop: 'off', handler: handlePredictionStats },
-    { method: 'GET', regex: /^\/v1\/predictions\/(\d+)$/, storeReady: 'predictions', loop: 'off', handler: handleGetPrediction },
-    { method: 'POST', regex: /^\/v1\/predictions\/(\d+)\/close$/, storeReady: 'predictions', loop: 'off', handler: handleClosePrediction },
-    { method: 'POST', path: '/v1/decisions', storeReady: 'objects', handler: handleCreateDecision },
-    { method: 'GET', path: '/v1/decisions', storeReady: 'objects', handler: handleListDecisions },
-    { method: 'POST', regex: /^\/v1\/decisions\/(\d+)\/supersede$/, storeReady: 'objects', handler: handleSupersedeDecision },
-    { method: 'POST', regex: /^\/v1\/decisions\/(\d+)\/close$/, storeReady: 'objects', handler: handleCloseDecision },
-    { method: 'GET', regex: /^\/v1\/decisions\/(\d+)$/, storeReady: 'objects', handler: handleGetDecision },
-    { method: 'POST', path: '/v1/incidents', storeReady: 'objects', handler: handleCreateIncident },
-    { method: 'GET', path: '/v1/incidents', storeReady: 'objects', handler: handleListIncidents },
-    { method: 'POST', regex: /^\/v1\/incidents\/(\d+)\/resolve$/, storeReady: 'objects', handler: handleResolveIncident },
-    { method: 'POST', regex: /^\/v1\/incidents\/(\d+)\/close$/, storeReady: 'objects', handler: handleCloseIncident },
-    { method: 'GET', regex: /^\/v1\/incidents\/(\d+)$/, storeReady: 'objects', handler: handleGetIncident },
-    { method: 'POST', path: '/v1/processes', storeReady: 'objects', handler: handleCreateProcess },
-    { method: 'GET', path: '/v1/processes', storeReady: 'objects', handler: handleListProcesses },
-    { method: 'POST', regex: /^\/v1\/processes\/(\d+)\/supersede$/, storeReady: 'objects', handler: handleSupersedeProcess },
-    { method: 'POST', regex: /^\/v1\/processes\/(\d+)\/close$/, storeReady: 'objects', handler: handleCloseProcess },
-    { method: 'GET', regex: /^\/v1\/processes\/(\d+)$/, storeReady: 'objects', handler: handleGetProcess },
-    { method: 'POST', path: '/v1/policies', storeReady: 'objects', handler: handleCreatePolicy },
-    { method: 'GET', path: '/v1/policies', storeReady: 'objects', handler: handleListPolicies },
-    { method: 'GET', path: '/v1/policies/asof', storeReady: 'objects', handler: handlePoliciesAsOf },
-    { method: 'POST', regex: /^\/v1\/policies\/(\d+)\/supersede$/, storeReady: 'objects', handler: handleSupersedePolicy },
-    { method: 'POST', regex: /^\/v1\/policies\/(\d+)\/close$/, storeReady: 'objects', handler: handleClosePolicy },
-    { method: 'GET', regex: /^\/v1\/policies\/(\d+)$/, storeReady: 'objects', handler: handleGetPolicy },
-    { method: 'POST', path: '/v1/skills', storeReady: 'objects', handler: handleCreateSkill },
-    { method: 'GET', path: '/v1/skills', storeReady: 'objects', handler: handleListSkills },
-    { method: 'GET', path: '/v1/skills/export', storeReady: 'objects', handler: handleExportSkills },
-    { method: 'POST', regex: /^\/v1\/skills\/(\d+)\/supersede$/, storeReady: 'objects', handler: handleSupersedeSkill },
-    { method: 'POST', regex: /^\/v1\/skills\/(\d+)\/close$/, storeReady: 'objects', handler: handleCloseSkill },
-    { method: 'GET', regex: /^\/v1\/skills\/(\d+)$/, storeReady: 'objects', handler: handleGetSkill },
-    { method: 'POST', path: '/v1/project-briefs', storeReady: 'objects', handler: handleCreateProjectBrief },
-    { method: 'GET', path: '/v1/project-briefs', storeReady: 'objects', handler: handleListProjectBriefs },
-    { method: 'POST', path: '/v1/project-briefs/refresh', storeReady: 'objects', handler: handleRefreshProjectBrief },
-    { method: 'POST', regex: /^\/v1\/project-briefs\/(\d+)\/supersede$/, storeReady: 'objects', handler: handleSupersedeProjectBrief },
-    { method: 'POST', regex: /^\/v1\/project-briefs\/(\d+)\/close$/, storeReady: 'objects', handler: handleCloseProjectBrief },
-    { method: 'GET', regex: /^\/v1\/project-briefs\/(\d+)$/, storeReady: 'objects', handler: handleGetProjectBrief },
-    { method: 'POST', path: '/v1/customer-notes', storeReady: 'objects', handler: handleCreateCustomerNote },
-    { method: 'GET', path: '/v1/customer-notes', storeReady: 'objects', handler: handleListCustomerNotes },
-    { method: 'POST', regex: /^\/v1\/customer-notes\/(\d+)\/supersede$/, storeReady: 'objects', handler: handleSupersedeCustomerNote },
-    { method: 'POST', regex: /^\/v1\/customer-notes\/(\d+)\/close$/, storeReady: 'objects', handler: handleCloseCustomerNote },
-    { method: 'GET', regex: /^\/v1\/customer-notes\/(\d+)$/, storeReady: 'objects', handler: handleGetCustomerNote },
+/** The /v1 routes in dispatch order; the first entry whose method and path match handles the request. Each row's `auth` is what the
+ *  dispatch gate proves before its handler runs, so a handler never checks the caller itself. */
+export const V1_ROUTES = [
+    { method: 'POST', path: '/v1/memories', auth: 'caller', storeReady: 'entryWrites', loop: 'off', handler: handleCreateMemory },
+    { method: 'GET', path: '/v1/graph', auth: 'caller', storeReady: 'graphReads', loop: 'off', handler: handleGetGraph },
+    { method: 'GET', path: '/v1/memories', auth: 'caller', storeReady: 'base', loop: 'off', handler: handleRecallMemories },
+    { method: 'GET', pattern: '/v1/sessions/:id/assemble', auth: 'caller', storeReady: 'dagReads', loop: 'off', handler: handleAssembleSession },
+    { method: 'GET', pattern: '/v1/recall/drill/:id', auth: 'caller', storeReady: 'dagReads', handler: handleDrillRecall },
+    { method: 'POST', pattern: '/v1/memories/:id/archive', auth: 'caller', storeReady: 'entryWrites', loop: 'off', handler: handleArchiveMemory },
+    { method: 'POST', pattern: '/v1/memories/:id/supersede', auth: 'caller', storeReady: 'entryWrites', loop: 'off', handler: handleSupersedeMemory },
+    { method: 'POST', pattern: '/v1/memories/:id/promote', auth: 'caller', sqliteOnly: 'copies a memory between the two local hippo.db files',
+        handler: handlePromoteMemory },
+    { method: 'DELETE', pattern: '/v1/memories/:id', auth: 'caller', storeReady: 'entryWrites', loop: 'off', handler: handleForgetMemory },
+    { method: 'POST', path: '/v1/outcome', auth: 'caller', storeReady: 'entryWrites', handler: handleApplyOutcome },
+    { method: 'GET', path: '/v1/context', auth: 'caller', storeReady: 'contextReads', handler: handleGetContext },
+    { method: 'POST', path: '/v1/sleep', auth: 'host-admin-local', sqliteOnly: 'consolidates every tenant under the local hippo root in this process',
+        handler: handleSleep },
+    { method: 'POST', path: '/v1/auth/keys', auth: 'caller', storeReady: 'keyWrites', loop: 'off', handler: handleCreateAuthKey },
+    { method: 'GET', path: '/v1/auth/keys', auth: 'caller', storeReady: 'keyWrites', loop: 'off', handler: handleListAuthKeys },
+    { method: 'DELETE', pattern: '/v1/auth/keys/:keyId', auth: 'caller', storeReady: 'keyAudit', loop: 'off', handler: handleRevokeAuthKey },
+    { method: 'GET', path: '/v1/quarantine', auth: 'admin', storeReady: 'quarantine', loop: 'off', handler: handleListQuarantine },
+    { method: 'POST', pattern: '/v1/quarantine/:id/approve', auth: 'admin', storeReady: 'quarantine', loop: 'off', handler: handleApproveQuarantine },
+    { method: 'POST', pattern: '/v1/quarantine/:id/reject', auth: 'admin', storeReady: 'quarantine', loop: 'off', handler: handleRejectQuarantine },
+    { method: 'GET', path: '/v1/audit', auth: 'caller', storeReady: 'auditLog', loop: 'off', handler: handleListAudit },
+    { method: 'POST', path: '/v1/predictions', auth: 'caller', storeReady: 'predictions', loop: 'off', handler: handleCreatePrediction },
+    { method: 'GET', path: '/v1/predictions', auth: 'caller', storeReady: 'predictions', loop: 'off', handler: handleListPredictions },
+    { method: 'GET', path: '/v1/predictions/stats', auth: 'caller', storeReady: 'predictions', loop: 'off', handler: handlePredictionStats },
+    { method: 'GET', regex: /^\/v1\/predictions\/(\d+)$/, auth: 'caller', storeReady: 'predictions', loop: 'off', handler: handleGetPrediction },
+    { method: 'POST', regex: /^\/v1\/predictions\/(\d+)\/close$/, auth: 'caller', storeReady: 'predictions', loop: 'off', handler: handleClosePrediction },
+    { method: 'POST', path: '/v1/decisions', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCreateDecision },
+    { method: 'GET', path: '/v1/decisions', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleListDecisions },
+    { method: 'POST', regex: /^\/v1\/decisions\/(\d+)\/supersede$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleSupersedeDecision },
+    { method: 'POST', regex: /^\/v1\/decisions\/(\d+)\/close$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCloseDecision },
+    { method: 'GET', regex: /^\/v1\/decisions\/(\d+)$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleGetDecision },
+    { method: 'POST', path: '/v1/incidents', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCreateIncident },
+    { method: 'GET', path: '/v1/incidents', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleListIncidents },
+    { method: 'POST', regex: /^\/v1\/incidents\/(\d+)\/resolve$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleResolveIncident },
+    { method: 'POST', regex: /^\/v1\/incidents\/(\d+)\/close$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCloseIncident },
+    { method: 'GET', regex: /^\/v1\/incidents\/(\d+)$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleGetIncident },
+    { method: 'POST', path: '/v1/processes', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCreateProcess },
+    { method: 'GET', path: '/v1/processes', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleListProcesses },
+    { method: 'POST', regex: /^\/v1\/processes\/(\d+)\/supersede$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleSupersedeProcess },
+    { method: 'POST', regex: /^\/v1\/processes\/(\d+)\/close$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCloseProcess },
+    { method: 'GET', regex: /^\/v1\/processes\/(\d+)$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleGetProcess },
+    { method: 'POST', path: '/v1/policies', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCreatePolicy },
+    { method: 'GET', path: '/v1/policies', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleListPolicies },
+    { method: 'GET', path: '/v1/policies/asof', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handlePoliciesAsOf },
+    { method: 'POST', regex: /^\/v1\/policies\/(\d+)\/supersede$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleSupersedePolicy },
+    { method: 'POST', regex: /^\/v1\/policies\/(\d+)\/close$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleClosePolicy },
+    { method: 'GET', regex: /^\/v1\/policies\/(\d+)$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleGetPolicy },
+    { method: 'POST', path: '/v1/skills', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCreateSkill },
+    { method: 'GET', path: '/v1/skills', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleListSkills },
+    { method: 'GET', path: '/v1/skills/export', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleExportSkills },
+    { method: 'POST', regex: /^\/v1\/skills\/(\d+)\/supersede$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleSupersedeSkill },
+    { method: 'POST', regex: /^\/v1\/skills\/(\d+)\/close$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCloseSkill },
+    { method: 'GET', regex: /^\/v1\/skills\/(\d+)$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleGetSkill },
+    { method: 'POST', path: '/v1/project-briefs', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCreateProjectBrief },
+    { method: 'GET', path: '/v1/project-briefs', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleListProjectBriefs },
+    { method: 'POST', path: '/v1/project-briefs/refresh', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleRefreshProjectBrief },
+    { method: 'POST', regex: /^\/v1\/project-briefs\/(\d+)\/supersede$/, auth: 'caller', storeReady: 'objects', loop: 'off',
+        handler: handleSupersedeProjectBrief },
+    { method: 'POST', regex: /^\/v1\/project-briefs\/(\d+)\/close$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCloseProjectBrief },
+    { method: 'GET', regex: /^\/v1\/project-briefs\/(\d+)$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleGetProjectBrief },
+    { method: 'POST', path: '/v1/customer-notes', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCreateCustomerNote },
+    { method: 'GET', path: '/v1/customer-notes', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleListCustomerNotes },
+    { method: 'POST', regex: /^\/v1\/customer-notes\/(\d+)\/supersede$/, auth: 'caller', storeReady: 'objects', loop: 'off',
+        handler: handleSupersedeCustomerNote },
+    { method: 'POST', regex: /^\/v1\/customer-notes\/(\d+)\/close$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCloseCustomerNote },
+    { method: 'GET', regex: /^\/v1\/customer-notes\/(\d+)$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleGetCustomerNote },
+    { method: 'POST', path: '/v1/connectors/slack/events', auth: 'webhook-signature', storeReady: 'connectorEvents', handler: webhook(handleSlackEventsWebhook) },
+    { method: 'POST', path: '/v1/connectors/github/events', auth: 'webhook-signature', storeReady: 'connectorEvents',
+        handler: webhook(handleGitHubEventsWebhook) },
 ];
-/** The route's handler bound to this request's path params, or null when method or path differ. The matcher runs before the
- *  method check, as the inline route blocks did, so a malformed `%` escape still throws from matchPath on any method. */
-function routeMatches(route, method, path) {
+/** The handler bound to this path's params, or null when the path differs. */
+function bindPath(route, path) {
     if ('path' in route)
-        return method === route.method && path === route.path ? route.handler : null;
+        return path === route.path ? route.handler : null;
     if ('pattern' in route) {
         const params = matchPath(route.pattern, path);
-        return method === route.method && params ? (r) => route.handler(r, params) : null;
+        return params ? (r) => route.handler(r, params) : null;
     }
     const match = path.match(route.regex);
-    return method === route.method && match ? (r) => route.handler(r, match) : null;
+    return match ? (r) => route.handler(r, match) : null;
+}
+/** The route's run for this request, gate first, or null when method or path differ. The matcher runs before the method check,
+ *  as the inline route blocks did, so a malformed `%` escape still throws from matchPath on any method. */
+export function routeMatches(route, method, path) {
+    if (route.auth === 'webhook-signature') {
+        const run = bindPath(route, path);
+        if (run === null || method !== route.method)
+            return null;
+        return async (r) => {
+            assertRoutePorted(r.opts, route.storeReady);
+            await run(r);
+        };
+    }
+    const run = bindPath(route, path);
+    if (run === null || method !== route.method)
+        return null;
+    return async (r) => run({ ...r, ctx: await passAuthGate(route, r) });
+}
+/** The one caller check a gated route passes: sleep refuses a caller off this host before any key work, then one charged auth,
+ *  then 501 for an unported route, so a bad key is still a 401 there, and the row's role last. */
+async function passAuthGate(route, { req, opts }) {
+    const label = routeLabel(route);
+    // Defence in depth, not the boundary: a socket address says where a request came from, never who sent it.
+    if (route.auth === 'host-admin-local' && !isLoopback(req.socket.remoteAddress)) {
+        throw new HttpError(403, `${label} is loopback-only (host-wide consolidation; see CHANGELOG v1.11.4)`);
+    }
+    const ctx = await buildContextWithAuth(req, opts);
+    assertRoutePorted(opts, route.storeReady);
+    if (route.auth === 'admin' && ctx.actor.role !== 'admin')
+        throw new HttpError(403, `${label} requires admin role`);
+    if (route.auth === 'host-admin-local')
+        assertCrossTenantAdmin(ctx, label);
+    return ctx;
 }
 /** The route as the access line names it; a regex route reads as its pattern would, so no line carries a caller's id. */
-function routeLabel(route) {
+export function routeLabel(route) {
     if ('path' in route)
         return route.path;
     if ('pattern' in route)
@@ -125,61 +159,20 @@ export async function dispatchV1Route(r, method, path) {
         if (run === null)
             continue;
         noteAccess(r.req, { route: routeLabel(route) });
-        await refuseUnportedRoute(r.req, r.opts, route.storeReady);
         // Only a store with worker threads has moved the route's SQLite work; under any other the handler still opens hippo.db itself.
         await (route.loop === 'off' && runsOffLoop(r.opts.store) ? withSqliteOffLoop(() => run(r)) : run(r));
         return true;
     }
     return false;
 }
-const PLAIN_SEGMENT_RE = /^[A-Za-z0-9._~-]+$/;
-function isPlainV1Path(path) {
-    return path.startsWith('/v1/') && new URL(path, 'http://h').pathname === path
-        && path.slice('/v1/'.length).split('/').every((segment) => PLAIN_SEGMENT_RE.test(segment));
-}
-// A plain path never holds a `%`, so matchPath cannot throw here.
-function isCorePath(method, path) {
-    return PUBLIC_ROUTES.has(`${method} ${path}`) || V1_ROUTES.some((route) => routeMatches(route, method, path) !== null);
-}
-/** Boot-time check: an add-on path must be plain, unique and not one core serves, so no add-on shadows a core route or hides from dispatch. */
-export function assertAddonRoutes(routes) {
-    const seen = new Set();
-    for (const { path } of routes) {
-        if (!isPlainV1Path(path))
-            throw new Error(`add-on route '${path}' is not a plain /v1/ path (segments use A-Z a-z 0-9 . _ ~ -)`);
-        if (seen.has(path))
-            throw new Error(`add-on route '${path}' is registered twice`);
-        if (isCorePath('POST', path))
-            throw new Error(`add-on route '${path}' is already served by core`);
-        seen.add(path);
-    }
-}
-const PUBLIC_JSON_MAX_BYTES = 64 * 1024;
-/** Boot-time check and serialization: a public path that a core GET route serves would open that route to anyone. */
-export function assertPublicJson(publicJson) {
-    const bodies = new Map();
-    for (const [path, value] of Object.entries(publicJson)) {
-        if (!isPlainV1Path(path))
-            throw new Error(`public JSON path '${path}' is not a plain /v1/ path (segments use A-Z a-z 0-9 . _ ~ -)`);
-        if (isCorePath('GET', path))
-            throw new Error(`public JSON path '${path}' is already served by core`);
-        const text = JSON.stringify(value);
-        if (text === undefined)
-            throw new Error(`public JSON at '${path}' is not JSON`);
-        if (Buffer.byteLength(text) > PUBLIC_JSON_MAX_BYTES)
-            throw new Error(`public JSON at '${path}' is over 64 KiB`);
-        bodies.set(path, text);
-    }
-    return bodies;
-}
 /** Core authenticates and parses before the handler runs, so an add-on route gets the same 401, 400 and 501 as a core one. */
 export async function dispatchAddonRoute({ req, res, opts }, method, path) {
     const route = method === 'POST' ? opts.routes?.find((r) => r.path === path) : undefined;
     if (!route)
         return false;
     noteAccess(req, { route: route.path });
-    await refuseUnportedRoute(req, opts, route.storeReady);
     const ctx = await buildContextWithAuth(req, opts);
+    assertRoutePorted(opts, route.storeReady);
     noteAccess(req, { tenant: ctx.tenantId });
     const body = await parseJsonBody(req, ctx);
     sendJson(res, 200, await route.handler({ ctx, body }));
@@ -195,15 +188,10 @@ export function dispatchPublicJson({ req, res, opts }, method, path) {
     res.end(text);
     return true;
 }
-export function assertSqliteStore(opts) {
-    if (opts.store.kind !== 'sqlite')
-        throw new HttpError(501, STORE_NOT_PORTED_MESSAGE);
-}
-/** Under another store, a route that names no group, or one the store lacks, answers 501 without running; the caller is checked first, so a bad key is still a 401. */
-async function refuseUnportedRoute(req, opts, group) {
+/** Under another store, a route that names no group, or one the store lacks, answers 501 without running. */
+function assertRoutePorted(opts, group) {
     if (opts.store.kind === 'sqlite' || (group !== undefined && hasGroup(opts.store, group)))
         return;
-    await requireAuth(req, opts);
-    assertSqliteStore(opts);
+    throw new HttpError(501, STORE_NOT_PORTED_MESSAGE);
 }
 //# sourceMappingURL=route-table.js.map

package/dist/server/routes/admin.d.ts

@@ -1,9 +1,9 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreateAuthKey({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleListAuthKeys({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleRevokeAuthKey({ req, res, opts }: RouteRequest, keyMatch: Record<string, string>): Promise<void>;
-export declare function handleListQuarantine({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleApproveQuarantine({ req, res, opts }: RouteRequest, quarantineApproveMatch: Record<string, string>): Promise<void>;
-export declare function handleRejectQuarantine({ req, res, opts }: RouteRequest, quarantineRejectMatch: Record<string, string>): Promise<void>;
-export declare function handleListAudit({ req, res, opts, query }: RouteRequest): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreateAuthKey({ req, res, opts }: AuthedRouteRequest): Promise<void>;
+export declare function handleListAuthKeys({ res, ctx, query }: AuthedRouteRequest): Promise<void>;
+export declare function handleRevokeAuthKey({ res, ctx }: AuthedRouteRequest, keyMatch: Record<string, string>): Promise<void>;
+export declare function handleListQuarantine({ res, ctx, query }: AuthedRouteRequest): Promise<void>;
+export declare function handleApproveQuarantine({ res, ctx }: AuthedRouteRequest, quarantineApproveMatch: Record<string, string>): Promise<void>;
+export declare function handleRejectQuarantine({ res, ctx }: AuthedRouteRequest, quarantineRejectMatch: Record<string, string>): Promise<void>;
+export declare function handleListAudit({ res, ctx, query }: AuthedRouteRequest): Promise<void>;
 //# sourceMappingURL=admin.d.ts.map

package/dist/server/routes/admin.js

@@ -1,38 +1,33 @@
 // Admin routes: API keys, quarantine and the audit log.
+import { DEFAULT_LIST_LIMIT } from '../../util/limits.js';
 import { AUDIT_OPS } from '../../store/audit.js';
 import { auditList, authCreate, authListRows, authRevoke, quarantineApprove, quarantineList, quarantineReject } from '../../api/index.js';
 import { HttpError, readBody, sendJson } from '../../util/http-util.js';
-import { log } from '../../util/log.js';
-import { assertCrossTenantAdmin, buildContextWithAuth } from '../auth.js';
+import { assertCrossTenantAdmin, recheckContextWithAuth } from '../auth.js';
 import { pageOf, parseCursor, setNextCursorHeader } from '../cursor.js';
 import { isSetMember, parseJsonObjectText, parseListLimit, validateIdSegment } from '../validation.js';
-import { isJsonString } from '../../util/json.js';
+import { isJsonBoolean, isJsonNumber, isJsonString } from '../../util/json.js';
 const VALID_AUDIT_OPS = new Set(AUDIT_OPS);
-// POST /v1/auth/keys reads its body before auth, so an unauthenticated caller can make the server buffer at most this many bytes and wait at most this many ms.
+// A key mint is a few short fields, so even an authenticated caller gets a small cap and a short wait.
 // ServeOpts.mintBodyDeadlineMs overrides the wait for tests only, so a 408 test need not sit through it.
 const MINT_BODY_MAX_BYTES = 4 * 1024;
 const MINT_BODY_DEADLINE_MS = 10_000;
-// Cap on GET /v1/audit?limit=. Matches docs/api.md (when written) and is large
-// enough to dump a small deployment's full audit log without paginating, but
-// small enough that a malicious client can't ask for the world.
+// Cap on GET /v1/audit?limit=: large enough to dump a small deployment's audit log unpaginated, small enough that a client cannot ask for the world.
 const MAX_AUDIT_LIMIT = 10000;
 // GET /v1/auth/keys had no limit, so its default page is the cap: a deployment below 1000 keys sees no change.
 const MAX_AUTH_KEYS_PAGE = 1000;
-// POST /v1/auth/keys — mint a new API key. Plaintext lands in the response
-// body: the HTTP layer hands it to the client; the user-facing
-// "store this somewhere safe" warning belongs in the CLI client, not here.
+// POST /v1/auth/keys: mints a key; plaintext is in the response body (the CLI client, not this layer, carries the "store this somewhere safe" warning).
 export async function handleCreateAuthKey({ req, res, opts }) {
-    // Body first, so the resolver's check (and any gate in it) runs right before the mint with no wait between.
+    // The dispatch gate authenticated before the body, so an unknown caller costs no read; this recheck runs the resolver right before the mint.
     const raw = await readBody(req, { maxBytes: MINT_BODY_MAX_BYTES, deadlineMs: opts.mintBodyDeadlineMs ?? MINT_BODY_DEADLINE_MS });
-    const ctx = await buildContextWithAuth(req, opts);
+    const ctx = await recheckContextWithAuth(req, opts);
     const body = parseJsonObjectText(raw);
     const labelRaw = body['label'];
     if (labelRaw !== undefined && !isJsonString(labelRaw)) {
         throw new HttpError(400, 'label must be a string');
     }
-    // Optional body.role mirrors the --role CLI flag. Validated
-    // strictly — anything other than 'admin'|'member' is a 400 (no silent
-    // fallback to admin). authCreate refuses a member caller with a 403.
+    // Optional body.role mirrors the --role CLI flag and is validated strictly: anything but 'admin'|'member' is a 400; authCreate refuses a member caller
+    // with a 403.
     const roleRaw = body['role'];
     let role;
     if (roleRaw !== undefined) {
@@ -41,25 +36,28 @@ export async function handleCreateAuthKey({ req, res, opts }) {
         }
         role = roleRaw;
     }
-    // Security: any `tenantId` in the body is IGNORED. The minted key is
-    // bound to the caller's authenticated tenant (ctx.tenantId, resolved
-    // from the Bearer token). Forwarding body.tenantId here would let
-    // tenant A mint a key for tenant B — see authCreate doc comment.
+    // A null is a 400 too: a client that serialises an unset field as null must not get a key that never expires.
+    const ttlDays = body['ttlDays'];
+    if (ttlDays !== undefined && !isJsonNumber(ttlDays)) {
+        throw new HttpError(400, 'ttlDays must be a number');
+    }
+    const noExpiry = body['noExpiry'];
+    if (noExpiry !== undefined && !isJsonBoolean(noExpiry)) {
+        throw new HttpError(400, 'noExpiry must be true or false');
+    }
+    // Security: any body `tenantId` is IGNORED; the key is bound to the caller's authenticated tenant, or tenant A could mint a key for tenant B (see
+    // authCreate).
     const result = await authCreate(ctx, {
         label: labelRaw,
         role,
+        ttlDays,
+        noExpiry,
     });
-    // The reply cannot change shape, so the server log is where a defaulted admin key gets noticed.
-    if (role === undefined && result.role === 'admin') {
-        log.warn(`auth key ${result.keyId} was minted with no role in the body, so it is an admin key, and it never expires; send "role": "member" for a narrower one`);
-    }
     sendJson(res, 200, result);
     return;
 }
-// GET /v1/auth/keys?active=true&limit=&cursor=: list keys visible to ctx.tenantId.
-// `active` defaults to true so the common case (show me usable keys) is
-// a single GET; ?active=false includes revoked and expired rows.
-export async function handleListAuthKeys({ req, res, opts, query }) {
+// GET /v1/auth/keys?active=true&limit=&cursor=: lists keys visible to ctx.tenantId; `active` defaults to true, ?active=false includes revoked and expired rows.
+export async function handleListAuthKeys({ res, ctx, query }) {
     const activeRaw = query.get('active');
     let active = true;
     if (activeRaw !== null) {
@@ -72,28 +70,21 @@ export async function handleListAuthKeys({ req, res, opts, query }) {
     }
     const limit = parseListLimit(query.get('limit'), MAX_AUTH_KEYS_PAGE, MAX_AUTH_KEYS_PAGE);
     const after = parseCursor(query.get('cursor'), 'integer', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
     const page = pageOf(await authListRows(ctx, { active, limit: limit + 1, after }), limit, (r) => ({ key: r.rowId, id: r.rowId }));
     setNextCursorHeader(res, page.nextCursor);
     sendJson(res, 200, page.items.map((r) => r.key));
     return;
 }
-// DELETE /v1/auth/keys/:keyId — revoke. Missing or cross-tenant keys are 404 (no info leak); a member
-// is 403 on any key but its own key or, signed in through the resolver, the keys it minted.
-// 200 with the body rather than 204 so the caller sees revokedAt.
-export async function handleRevokeAuthKey({ req, res, opts }, keyMatch) {
+// DELETE /v1/auth/keys/:keyId revokes: missing or cross-tenant keys are 404 (no leak); a member is 403 on any key but its own or, via the resolver, those it
+// minted. Returns 200 with the body rather than 204 so the caller sees revokedAt.
+export async function handleRevokeAuthKey({ res, ctx }, keyMatch) {
     validateIdSegment(keyMatch.keyId, 'key id');
-    const ctx = await buildContextWithAuth(req, opts);
     const result = await authRevoke(ctx, keyMatch.keyId);
     sendJson(res, 200, result);
     return;
 }
-// GET /v1/quarantine?status=&limit=&cursor=: quarantine review queue. quarantineList carries no role gate itself, so it's checked here.
-export async function handleListQuarantine({ req, res, opts, query }) {
-    const ctx = await buildContextWithAuth(req, opts);
-    if (ctx.actor.role !== 'admin') {
-        throw new HttpError(403, '/v1/quarantine requires admin role');
-    }
+// GET /v1/quarantine?status=&limit=&cursor=: quarantine review queue. quarantineList carries no role gate itself, so its row's admin gate is the check.
+export async function handleListQuarantine({ res, ctx, query }) {
     const statusRaw = query.get('status');
     let status = 'pending';
     if (statusRaw !== null) {
@@ -109,25 +100,21 @@ export async function handleListQuarantine({ req, res, opts, query }) {
     return;
 }
 // POST /v1/quarantine/:id/approve: admin only; ForbiddenError falls through to mapApiError's 403.
-export async function handleApproveQuarantine({ req, res, opts }, quarantineApproveMatch) {
+export async function handleApproveQuarantine({ res, ctx }, quarantineApproveMatch) {
     validateIdSegment(quarantineApproveMatch.id, 'memory id');
-    const ctx = await buildContextWithAuth(req, opts);
     await quarantineApprove(ctx, quarantineApproveMatch.id);
     sendJson(res, 200, { approved: quarantineApproveMatch.id });
     return;
 }
 // POST /v1/quarantine/:id/reject: admin only; ForbiddenError falls through to mapApiError's 403.
-export async function handleRejectQuarantine({ req, res, opts }, quarantineRejectMatch) {
+export async function handleRejectQuarantine({ res, ctx }, quarantineRejectMatch) {
     validateIdSegment(quarantineRejectMatch.id, 'memory id');
-    const ctx = await buildContextWithAuth(req, opts);
     await quarantineReject(ctx, quarantineRejectMatch.id);
     sendJson(res, 200, { rejected: quarantineRejectMatch.id });
     return;
 }
-// GET /v1/audit?op=&since=&limit=&cursor=: read audit events. All three filters
-// validated at the route boundary so an invalid value lands a 400 before
-// we hit the DB.
-export async function handleListAudit({ req, res, opts, query }) {
+// GET /v1/audit?op=&since=&limit=&cursor=: all three filters are validated at the route boundary so an invalid value is a 400 before the DB is hit.
+export async function handleListAudit({ res, ctx, query }) {
     const opRaw = query.get('op');
     let op;
     if (opRaw !== null) {
@@ -146,7 +133,7 @@ export async function handleListAudit({ req, res, opts, query }) {
         since = sinceRaw;
     }
     const limitRaw = query.get('limit');
-    let limit = 100;
+    let limit = DEFAULT_LIST_LIMIT;
     if (limitRaw !== null) {
         const parsed = Number(limitRaw);
         if (!Number.isFinite(parsed) || !Number.isInteger(parsed) || parsed < 1 || parsed > MAX_AUDIT_LIMIT) {
@@ -155,7 +142,6 @@ export async function handleListAudit({ req, res, opts, query }) {
         limit = parsed;
     }
     const after = parseCursor(query.get('cursor'), 'string', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
     // ?tenant=<t> reads another tenant (e.g. '__host__' for consolidate rows); admin only.
     const tenantOverride = query.get('tenant');
     const crossTenant = tenantOverride !== null && tenantOverride !== '' && tenantOverride !== ctx.tenantId;

package/dist/server/routes/customer-notes.d.ts

@@ -1,7 +1,7 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreateCustomerNote(rr: RouteRequest): Promise<void>;
-export declare function handleListCustomerNotes(rr: RouteRequest): Promise<void>;
-export declare function handleSupersedeCustomerNote(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleCloseCustomerNote(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleGetCustomerNote(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreateCustomerNote(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleListCustomerNotes(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleSupersedeCustomerNote(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseCustomerNote(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetCustomerNote(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=customer-notes.d.ts.map

package/dist/server/routes/customer-notes.js

@@ -1,9 +1,9 @@
 // /v1/customer-notes routes.
-import { CUSTOMER_NOTE, MAX_CUSTOMER_LEN } from '../../objects/customer-notes.js';
+import { CUSTOMER_NOTE, MAX_CHANGE_SUMMARY_LEN, MAX_CUSTOMER_LEN } from '../../objects/customer-notes.js';
 import { sendJson } from '../../util/http-util.js';
-import { buildContextWithAuth } from '../auth.js';
 import { parseJsonBody } from '../validation.js';
-import { closeRoute, getRoute, listRoute, optionalString, requiredString, saveFor, supersedeRoute } from './object-routes.js';
+import { saveFor } from '../../api/objects.js';
+import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute } from './object-routes.js';
 const noteRoutes = {
     noun: 'customer note',
     field: 'note',
@@ -12,22 +12,16 @@ const noteRoutes = {
     filterParam: 'customer',
     revise: (body) => {
         const note = requiredString(body, 'note', { max: 8192 });
-        const changeSummary = optionalString(body, 'changeSummary', 4096);
+        const changeSummary = optionalString(body, 'changeSummary', MAX_CHANGE_SUMMARY_LEN);
         return (existing, id) => ({ customer: existing.customer, note, changeSummary, supersedesNoteId: id });
     },
 };
-// ── customer_note routes ──
-//
-// 5 routes (no assembler/refresh): POST /v1/customer-notes (new; body customer +
-// note), GET /v1/customer-notes (list; status + customer filter; shared
-// parseListLimit), GET /v1/customer-notes/:id, POST /v1/customer-notes/:id/supersede,
-// POST /v1/customer-notes/:id/close. DoS caps: customer 256, note 8192,
-// changeSummary 4096. The store validates + throws; the boundary maps validation ->
-// 400, not-found -> 404, not-active -> 409. Mirrors /v1/project-briefs.
+// Routes: customer notes under /v1/customer-notes (create, list, show, supersede, close), mirroring /v1/project-briefs. The store validates and throws;
+// the boundary maps validation -> 400, not-found -> 404, not-active -> 409.
 export async function handleCreateCustomerNote(rr) {
-    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const { ctx } = rr;
     const body = await parseJsonBody(rr.req, ctx);
-    const customerNote = await saveFor(rr, CUSTOMER_NOTE, ctx.tenantId, ctx.actor.subject, {
+    const customerNote = await saveFor(ctx, CUSTOMER_NOTE, {
         customer: requiredString(body, 'customer', { max: MAX_CUSTOMER_LEN }),
         note: requiredString(body, 'note', { max: 8192 }),
     });