hippo-memory 1.71.0 → 2.0.0

package/dist/server/route-table.js

@@ -1,8 +1,10 @@
+import { handleGitHubEventsWebhook } from '../connectors/github/webhook.js';
+import { handleSlackEventsWebhook } from '../connectors/slack/webhook.js';
 import { withSqliteOffLoop } from '../db/index.js';
-import { hasGroup } from '../store/index.js';
+import { hasGroup, requireGroup } from '../store/index.js';
 import { runsOffLoop } from '../store/sqlite/worker-store.js';
 import { HttpError, JSON_HEADERS, sendJson, STORE_NOT_PORTED_MESSAGE } from '../util/http-util.js';
-import { buildContextWithAuth, requireAuth } from './auth.js';
+import { assertCrossTenantAdmin, buildContextWithAuth, isLoopback } from './auth.js';
 import { matchPath, noteAccess } from './request.js';
 import { handleApproveQuarantine, handleCreateAuthKey, handleListAudit, handleListAuthKeys, handleListQuarantine, handleRejectQuarantine, handleRevokeAuthKey } from './routes/admin.js';
 import { handleCloseCustomerNote, handleCreateCustomerNote, handleGetCustomerNote, handleListCustomerNotes, handleSupersedeCustomerNote } from './routes/customer-notes.js';
@@ -16,94 +18,134 @@ import { handleCloseProjectBrief, handleCreateProjectBrief, handleGetProjectBrie
 import { handleAssembleSession, handleDrillRecall, handleGetContext, handleRecallMemories } from './routes/recall.js';
 import { handleCloseSkill, handleCreateSkill, handleExportSkills, handleGetSkill, handleListSkills, handleSupersedeSkill } from './routes/skills.js';
 import { parseJsonBody } from './validation.js';
-// Explicit allow-list for unauthenticated /v1/* routes: add a new one here AND in tests/server-bearer-lockdown.test.ts; never gate auth by `path.startsWith`.
-// Handlers check `isPublicRoute` before auth, so an entry without that check is a no-op (fail-closed); other open paths are ServeOpts.publicJson GETs.
-const PUBLIC_ROUTES = new Set([
-    'POST /v1/connectors/slack/events',
-    'POST /v1/connectors/github/events',
-]);
-export function isPublicRoute(method, path) {
-    return PUBLIC_ROUTES.has(`${method} ${path}`);
+const WEBHOOK_GROUPS = ['entryWrites', 'connectorWrites', 'connectorEvents'];
+/** A store missing a group a delivery writes through refuses the webhook up front, so no delivery is acknowledged and then half stored. */
+function webhook(handle) {
+    return async ({ req, res, opts }) => {
+        for (const group of WEBHOOK_GROUPS)
+            requireGroup(opts.store, group);
+        await handle({ req, res, opts }, opts.store);
+    };
 }
-/** The /v1 routes in dispatch order; the first entry whose method and path match handles the request. */
-const V1_ROUTES = [
-    { method: 'POST', path: '/v1/memories', storeReady: 'entryWrites', loop: 'off', handler: handleCreateMemory },
-    { method: 'GET', path: '/v1/graph', storeReady: 'graphReads', loop: 'off', handler: handleGetGraph },
-    { method: 'GET', path: '/v1/memories', storeReady: 'base', loop: 'off', handler: handleRecallMemories },
-    { method: 'GET', pattern: '/v1/sessions/:id/assemble', storeReady: 'dagReads', loop: 'off', handler: handleAssembleSession },
-    { method: 'GET', pattern: '/v1/recall/drill/:id', storeReady: 'dagReads', handler: handleDrillRecall },
-    { method: 'POST', pattern: '/v1/memories/:id/archive', storeReady: 'entryWrites', loop: 'off', handler: handleArchiveMemory },
-    { method: 'POST', pattern: '/v1/memories/:id/supersede', storeReady: 'entryWrites', loop: 'off', handler: handleSupersedeMemory },
-    { method: 'POST', pattern: '/v1/memories/:id/promote', sqliteOnly: 'copies a memory between the two local hippo.db files', handler: handlePromoteMemory },
-    { method: 'DELETE', pattern: '/v1/memories/:id', storeReady: 'entryWrites', loop: 'off', handler: handleForgetMemory },
-    { method: 'POST', path: '/v1/outcome', storeReady: 'entryWrites', handler: handleApplyOutcome },
-    { method: 'GET', path: '/v1/context', storeReady: 'contextReads', handler: handleGetContext },
-    { method: 'POST', path: '/v1/sleep', sqliteOnly: 'consolidates every tenant under the local hippo root in this process', handler: handleSleep },
-    { method: 'POST', path: '/v1/auth/keys', storeReady: 'keyWrites', loop: 'off', handler: handleCreateAuthKey },
-    { method: 'GET', path: '/v1/auth/keys', storeReady: 'keyWrites', loop: 'off', handler: handleListAuthKeys },
-    { method: 'DELETE', pattern: '/v1/auth/keys/:keyId', storeReady: 'keyAudit', loop: 'off', handler: handleRevokeAuthKey },
-    { method: 'GET', path: '/v1/quarantine', storeReady: 'quarantine', loop: 'off', handler: handleListQuarantine },
-    { method: 'POST', pattern: '/v1/quarantine/:id/approve', storeReady: 'quarantine', loop: 'off', handler: handleApproveQuarantine },
-    { method: 'POST', pattern: '/v1/quarantine/:id/reject', storeReady: 'quarantine', loop: 'off', handler: handleRejectQuarantine },
-    { method: 'GET', path: '/v1/audit', storeReady: 'auditLog', loop: 'off', handler: handleListAudit },
-    { method: 'POST', path: '/v1/predictions', storeReady: 'predictions', loop: 'off', handler: handleCreatePrediction },
-    { method: 'GET', path: '/v1/predictions', storeReady: 'predictions', loop: 'off', handler: handleListPredictions },
-    { method: 'GET', path: '/v1/predictions/stats', storeReady: 'predictions', loop: 'off', handler: handlePredictionStats },
-    { method: 'GET', regex: /^\/v1\/predictions\/(\d+)$/, storeReady: 'predictions', loop: 'off', handler: handleGetPrediction },
-    { method: 'POST', regex: /^\/v1\/predictions\/(\d+)\/close$/, storeReady: 'predictions', loop: 'off', handler: handleClosePrediction },
-    { method: 'POST', path: '/v1/decisions', storeReady: 'objects', loop: 'off', handler: handleCreateDecision },
-    { method: 'GET', path: '/v1/decisions', storeReady: 'objects', loop: 'off', handler: handleListDecisions },
-    { method: 'POST', regex: /^\/v1\/decisions\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedeDecision },
-    { method: 'POST', regex: /^\/v1\/decisions\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseDecision },
-    { method: 'GET', regex: /^\/v1\/decisions\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetDecision },
-    { method: 'POST', path: '/v1/incidents', storeReady: 'objects', loop: 'off', handler: handleCreateIncident },
-    { method: 'GET', path: '/v1/incidents', storeReady: 'objects', loop: 'off', handler: handleListIncidents },
-    { method: 'POST', regex: /^\/v1\/incidents\/(\d+)\/resolve$/, storeReady: 'objects', loop: 'off', handler: handleResolveIncident },
-    { method: 'POST', regex: /^\/v1\/incidents\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseIncident },
-    { method: 'GET', regex: /^\/v1\/incidents\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetIncident },
-    { method: 'POST', path: '/v1/processes', storeReady: 'objects', loop: 'off', handler: handleCreateProcess },
-    { method: 'GET', path: '/v1/processes', storeReady: 'objects', loop: 'off', handler: handleListProcesses },
-    { method: 'POST', regex: /^\/v1\/processes\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedeProcess },
-    { method: 'POST', regex: /^\/v1\/processes\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseProcess },
-    { method: 'GET', regex: /^\/v1\/processes\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetProcess },
-    { method: 'POST', path: '/v1/policies', storeReady: 'objects', loop: 'off', handler: handleCreatePolicy },
-    { method: 'GET', path: '/v1/policies', storeReady: 'objects', loop: 'off', handler: handleListPolicies },
-    { method: 'GET', path: '/v1/policies/asof', storeReady: 'objects', loop: 'off', handler: handlePoliciesAsOf },
-    { method: 'POST', regex: /^\/v1\/policies\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedePolicy },
-    { method: 'POST', regex: /^\/v1\/policies\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleClosePolicy },
-    { method: 'GET', regex: /^\/v1\/policies\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetPolicy },
-    { method: 'POST', path: '/v1/skills', storeReady: 'objects', loop: 'off', handler: handleCreateSkill },
-    { method: 'GET', path: '/v1/skills', storeReady: 'objects', loop: 'off', handler: handleListSkills },
-    { method: 'GET', path: '/v1/skills/export', storeReady: 'objects', loop: 'off', handler: handleExportSkills },
-    { method: 'POST', regex: /^\/v1\/skills\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedeSkill },
-    { method: 'POST', regex: /^\/v1\/skills\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseSkill },
-    { method: 'GET', regex: /^\/v1\/skills\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetSkill },
-    { method: 'POST', path: '/v1/project-briefs', storeReady: 'objects', loop: 'off', handler: handleCreateProjectBrief },
-    { method: 'GET', path: '/v1/project-briefs', storeReady: 'objects', loop: 'off', handler: handleListProjectBriefs },
-    { method: 'POST', path: '/v1/project-briefs/refresh', storeReady: 'objects', loop: 'off', handler: handleRefreshProjectBrief },
-    { method: 'POST', regex: /^\/v1\/project-briefs\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedeProjectBrief },
-    { method: 'POST', regex: /^\/v1\/project-briefs\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseProjectBrief },
-    { method: 'GET', regex: /^\/v1\/project-briefs\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetProjectBrief },
-    { method: 'POST', path: '/v1/customer-notes', storeReady: 'objects', loop: 'off', handler: handleCreateCustomerNote },
-    { method: 'GET', path: '/v1/customer-notes', storeReady: 'objects', loop: 'off', handler: handleListCustomerNotes },
-    { method: 'POST', regex: /^\/v1\/customer-notes\/(\d+)\/supersede$/, storeReady: 'objects', loop: 'off', handler: handleSupersedeCustomerNote },
-    { method: 'POST', regex: /^\/v1\/customer-notes\/(\d+)\/close$/, storeReady: 'objects', loop: 'off', handler: handleCloseCustomerNote },
-    { method: 'GET', regex: /^\/v1\/customer-notes\/(\d+)$/, storeReady: 'objects', loop: 'off', handler: handleGetCustomerNote },
+/** The /v1 routes in dispatch order; the first entry whose method and path match handles the request. Each row's `auth` is what the
+ *  dispatch gate proves before its handler runs, so a handler never checks the caller itself. */
+export const V1_ROUTES = [
+    { method: 'POST', path: '/v1/memories', auth: 'caller', storeReady: 'entryWrites', loop: 'off', handler: handleCreateMemory },
+    { method: 'GET', path: '/v1/graph', auth: 'caller', storeReady: 'graphReads', loop: 'off', handler: handleGetGraph },
+    { method: 'GET', path: '/v1/memories', auth: 'caller', storeReady: 'base', loop: 'off', handler: handleRecallMemories },
+    { method: 'GET', pattern: '/v1/sessions/:id/assemble', auth: 'caller', storeReady: 'dagReads', loop: 'off', handler: handleAssembleSession },
+    { method: 'GET', pattern: '/v1/recall/drill/:id', auth: 'caller', storeReady: 'dagReads', handler: handleDrillRecall },
+    { method: 'POST', pattern: '/v1/memories/:id/archive', auth: 'caller', storeReady: 'entryWrites', loop: 'off', handler: handleArchiveMemory },
+    { method: 'POST', pattern: '/v1/memories/:id/supersede', auth: 'caller', storeReady: 'entryWrites', loop: 'off', handler: handleSupersedeMemory },
+    { method: 'POST', pattern: '/v1/memories/:id/promote', auth: 'caller', sqliteOnly: 'copies a memory between the two local hippo.db files',
+        handler: handlePromoteMemory },
+    { method: 'DELETE', pattern: '/v1/memories/:id', auth: 'caller', storeReady: 'entryWrites', loop: 'off', handler: handleForgetMemory },
+    { method: 'POST', path: '/v1/outcome', auth: 'caller', storeReady: 'entryWrites', handler: handleApplyOutcome },
+    { method: 'GET', path: '/v1/context', auth: 'caller', storeReady: 'contextReads', handler: handleGetContext },
+    { method: 'POST', path: '/v1/sleep', auth: 'host-admin-local', sqliteOnly: 'consolidates every tenant under the local hippo root in this process',
+        handler: handleSleep },
+    { method: 'POST', path: '/v1/auth/keys', auth: 'caller', storeReady: 'keyWrites', loop: 'off', handler: handleCreateAuthKey },
+    { method: 'GET', path: '/v1/auth/keys', auth: 'caller', storeReady: 'keyWrites', loop: 'off', handler: handleListAuthKeys },
+    { method: 'DELETE', pattern: '/v1/auth/keys/:keyId', auth: 'caller', storeReady: 'keyAudit', loop: 'off', handler: handleRevokeAuthKey },
+    { method: 'GET', path: '/v1/quarantine', auth: 'admin', storeReady: 'quarantine', loop: 'off', handler: handleListQuarantine },
+    { method: 'POST', pattern: '/v1/quarantine/:id/approve', auth: 'admin', storeReady: 'quarantine', loop: 'off', handler: handleApproveQuarantine },
+    { method: 'POST', pattern: '/v1/quarantine/:id/reject', auth: 'admin', storeReady: 'quarantine', loop: 'off', handler: handleRejectQuarantine },
+    { method: 'GET', path: '/v1/audit', auth: 'admin', storeReady: 'auditLog', loop: 'off', handler: handleListAudit },
+    { method: 'POST', path: '/v1/predictions', auth: 'caller', storeReady: 'predictions', loop: 'off', handler: handleCreatePrediction },
+    { method: 'GET', path: '/v1/predictions', auth: 'caller', storeReady: 'predictions', loop: 'off', handler: handleListPredictions },
+    { method: 'GET', path: '/v1/predictions/stats', auth: 'caller', storeReady: 'predictions', loop: 'off', handler: handlePredictionStats },
+    { method: 'GET', regex: /^\/v1\/predictions\/(\d+)$/, auth: 'caller', storeReady: 'predictions', loop: 'off', handler: handleGetPrediction },
+    { method: 'POST', regex: /^\/v1\/predictions\/(\d+)\/close$/, auth: 'caller', storeReady: 'predictions', loop: 'off', handler: handleClosePrediction },
+    { method: 'POST', path: '/v1/decisions', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCreateDecision },
+    { method: 'GET', path: '/v1/decisions', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleListDecisions },
+    { method: 'POST', regex: /^\/v1\/decisions\/(\d+)\/supersede$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleSupersedeDecision },
+    { method: 'POST', regex: /^\/v1\/decisions\/(\d+)\/close$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCloseDecision },
+    { method: 'GET', regex: /^\/v1\/decisions\/(\d+)$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleGetDecision },
+    { method: 'POST', path: '/v1/incidents', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCreateIncident },
+    { method: 'GET', path: '/v1/incidents', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleListIncidents },
+    { method: 'POST', regex: /^\/v1\/incidents\/(\d+)\/resolve$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleResolveIncident },
+    { method: 'POST', regex: /^\/v1\/incidents\/(\d+)\/close$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCloseIncident },
+    { method: 'GET', regex: /^\/v1\/incidents\/(\d+)$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleGetIncident },
+    { method: 'POST', path: '/v1/processes', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCreateProcess },
+    { method: 'GET', path: '/v1/processes', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleListProcesses },
+    { method: 'POST', regex: /^\/v1\/processes\/(\d+)\/supersede$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleSupersedeProcess },
+    { method: 'POST', regex: /^\/v1\/processes\/(\d+)\/close$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCloseProcess },
+    { method: 'GET', regex: /^\/v1\/processes\/(\d+)$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleGetProcess },
+    { method: 'POST', path: '/v1/policies', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCreatePolicy },
+    { method: 'GET', path: '/v1/policies', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleListPolicies },
+    { method: 'GET', path: '/v1/policies/asof', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handlePoliciesAsOf },
+    { method: 'POST', regex: /^\/v1\/policies\/(\d+)\/supersede$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleSupersedePolicy },
+    { method: 'POST', regex: /^\/v1\/policies\/(\d+)\/close$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleClosePolicy },
+    { method: 'GET', regex: /^\/v1\/policies\/(\d+)$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleGetPolicy },
+    { method: 'POST', path: '/v1/skills', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCreateSkill },
+    { method: 'GET', path: '/v1/skills', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleListSkills },
+    { method: 'GET', path: '/v1/skills/export', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleExportSkills },
+    { method: 'POST', regex: /^\/v1\/skills\/(\d+)\/supersede$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleSupersedeSkill },
+    { method: 'POST', regex: /^\/v1\/skills\/(\d+)\/close$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCloseSkill },
+    { method: 'GET', regex: /^\/v1\/skills\/(\d+)$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleGetSkill },
+    { method: 'POST', path: '/v1/project-briefs', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCreateProjectBrief },
+    { method: 'GET', path: '/v1/project-briefs', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleListProjectBriefs },
+    { method: 'POST', path: '/v1/project-briefs/refresh', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleRefreshProjectBrief },
+    { method: 'POST', regex: /^\/v1\/project-briefs\/(\d+)\/supersede$/, auth: 'caller', storeReady: 'objects', loop: 'off',
+        handler: handleSupersedeProjectBrief },
+    { method: 'POST', regex: /^\/v1\/project-briefs\/(\d+)\/close$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCloseProjectBrief },
+    { method: 'GET', regex: /^\/v1\/project-briefs\/(\d+)$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleGetProjectBrief },
+    { method: 'POST', path: '/v1/customer-notes', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCreateCustomerNote },
+    { method: 'GET', path: '/v1/customer-notes', auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleListCustomerNotes },
+    { method: 'POST', regex: /^\/v1\/customer-notes\/(\d+)\/supersede$/, auth: 'caller', storeReady: 'objects', loop: 'off',
+        handler: handleSupersedeCustomerNote },
+    { method: 'POST', regex: /^\/v1\/customer-notes\/(\d+)\/close$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleCloseCustomerNote },
+    { method: 'GET', regex: /^\/v1\/customer-notes\/(\d+)$/, auth: 'caller', storeReady: 'objects', loop: 'off', handler: handleGetCustomerNote },
+    { method: 'POST', path: '/v1/connectors/slack/events', auth: 'webhook-signature', storeReady: 'connectorEvents', handler: webhook(handleSlackEventsWebhook) },
+    { method: 'POST', path: '/v1/connectors/github/events', auth: 'webhook-signature', storeReady: 'connectorEvents',
+        handler: webhook(handleGitHubEventsWebhook) },
 ];
-/** The route's handler bound to this request's path params, or null when method or path differ. The matcher runs before the
- *  method check, as the inline route blocks did, so a malformed `%` escape still throws from matchPath on any method. */
-function routeMatches(route, method, path) {
+/** The handler bound to this path's params, or null when the path differs. */
+function bindPath(route, path) {
     if ('path' in route)
-        return method === route.method && path === route.path ? route.handler : null;
+        return path === route.path ? route.handler : null;
     if ('pattern' in route) {
         const params = matchPath(route.pattern, path);
-        return method === route.method && params ? (r) => route.handler(r, params) : null;
+        return params ? (r) => route.handler(r, params) : null;
     }
     const match = path.match(route.regex);
-    return method === route.method && match ? (r) => route.handler(r, match) : null;
+    return match ? (r) => route.handler(r, match) : null;
+}
+/** The route's run for this request, gate first, or null when method or path differ. The matcher runs before the method check,
+ *  as the inline route blocks did, so a malformed `%` escape still throws from matchPath on any method. */
+export function routeMatches(route, method, path) {
+    if (route.auth === 'webhook-signature') {
+        const run = bindPath(route, path);
+        if (run === null || method !== route.method)
+            return null;
+        return async (r) => {
+            assertRoutePorted(r.opts, route.storeReady);
+            await run(r);
+        };
+    }
+    const run = bindPath(route, path);
+    if (run === null || method !== route.method)
+        return null;
+    return async (r) => run({ ...r, ctx: await passAuthGate(route, r) });
+}
+/** The one caller check a gated route passes: sleep refuses a caller off this host before any key work, then one charged auth,
+ *  then 501 for an unported route, so a bad key is still a 401 there, and the row's role last. */
+async function passAuthGate(route, { req, opts }) {
+    const label = routeLabel(route);
+    // Defence in depth, not the boundary: a socket address says where a request came from, never who sent it.
+    if (route.auth === 'host-admin-local' && !isLoopback(req.socket.remoteAddress)) {
+        throw new HttpError(403, `${label} is loopback-only (host-wide consolidation; see CHANGELOG v1.11.4)`);
+    }
+    const ctx = await buildContextWithAuth(req, opts);
+    assertRoutePorted(opts, route.storeReady);
+    if (route.auth === 'admin' && ctx.actor.role !== 'admin')
+        throw new HttpError(403, `${label} requires admin role`);
+    if (route.auth === 'host-admin-local')
+        assertCrossTenantAdmin(ctx, label);
+    return ctx;
 }
 /** The route as the access line names it; a regex route reads as its pattern would, so no line carries a caller's id. */
-function routeLabel(route) {
+export function routeLabel(route) {
     if ('path' in route)
         return route.path;
     if ('pattern' in route)
@@ -117,61 +159,20 @@ export async function dispatchV1Route(r, method, path) {
         if (run === null)
             continue;
         noteAccess(r.req, { route: routeLabel(route) });
-        await refuseUnportedRoute(r.req, r.opts, route.storeReady);
         // Only a store with worker threads has moved the route's SQLite work; under any other the handler still opens hippo.db itself.
         await (route.loop === 'off' && runsOffLoop(r.opts.store) ? withSqliteOffLoop(() => run(r)) : run(r));
         return true;
     }
     return false;
 }
-const PLAIN_SEGMENT_RE = /^[A-Za-z0-9._~-]+$/;
-function isPlainV1Path(path) {
-    return path.startsWith('/v1/') && new URL(path, 'http://h').pathname === path
-        && path.slice('/v1/'.length).split('/').every((segment) => PLAIN_SEGMENT_RE.test(segment));
-}
-// A plain path never holds a `%`, so matchPath cannot throw here.
-function isCorePath(method, path) {
-    return PUBLIC_ROUTES.has(`${method} ${path}`) || V1_ROUTES.some((route) => routeMatches(route, method, path) !== null);
-}
-/** Boot-time check: an add-on path must be plain, unique and not one core serves, so no add-on shadows a core route or hides from dispatch. */
-export function assertAddonRoutes(routes) {
-    const seen = new Set();
-    for (const { path } of routes) {
-        if (!isPlainV1Path(path))
-            throw new Error(`add-on route '${path}' is not a plain /v1/ path (segments use A-Z a-z 0-9 . _ ~ -)`);
-        if (seen.has(path))
-            throw new Error(`add-on route '${path}' is registered twice`);
-        if (isCorePath('POST', path))
-            throw new Error(`add-on route '${path}' is already served by core`);
-        seen.add(path);
-    }
-}
-const PUBLIC_JSON_MAX_BYTES = 64 * 1024;
-/** Boot-time check and serialization: a public path that a core GET route serves would open that route to anyone. */
-export function assertPublicJson(publicJson) {
-    const bodies = new Map();
-    for (const [path, value] of Object.entries(publicJson)) {
-        if (!isPlainV1Path(path))
-            throw new Error(`public JSON path '${path}' is not a plain /v1/ path (segments use A-Z a-z 0-9 . _ ~ -)`);
-        if (isCorePath('GET', path))
-            throw new Error(`public JSON path '${path}' is already served by core`);
-        const text = JSON.stringify(value);
-        if (text === undefined)
-            throw new Error(`public JSON at '${path}' is not JSON`);
-        if (Buffer.byteLength(text) > PUBLIC_JSON_MAX_BYTES)
-            throw new Error(`public JSON at '${path}' is over 64 KiB`);
-        bodies.set(path, text);
-    }
-    return bodies;
-}
 /** Core authenticates and parses before the handler runs, so an add-on route gets the same 401, 400 and 501 as a core one. */
 export async function dispatchAddonRoute({ req, res, opts }, method, path) {
     const route = method === 'POST' ? opts.routes?.find((r) => r.path === path) : undefined;
     if (!route)
         return false;
     noteAccess(req, { route: route.path });
-    await refuseUnportedRoute(req, opts, route.storeReady);
     const ctx = await buildContextWithAuth(req, opts);
+    assertRoutePorted(opts, route.storeReady);
     noteAccess(req, { tenant: ctx.tenantId });
     const body = await parseJsonBody(req, ctx);
     sendJson(res, 200, await route.handler({ ctx, body }));
@@ -187,16 +188,9 @@ export function dispatchPublicJson({ req, res, opts }, method, path) {
     res.end(text);
     return true;
 }
-export function assertSqliteStore(opts) {
-    if (opts.store.kind !== 'sqlite')
+/** A route answers 501 without running when the store lacks its group; a route that names none, a sqliteOnly one among them, needs hippo.db's local files. */
+function assertRoutePorted(opts, group = 'localFiles') {
+    if (!hasGroup(opts.store, group))
         throw new HttpError(501, STORE_NOT_PORTED_MESSAGE);
 }
-/** Under another store, a route that names no group, or one the store lacks, answers
- * 501 without running; the caller is checked first, so a bad key is still a 401. */
-async function refuseUnportedRoute(req, opts, group) {
-    if (opts.store.kind === 'sqlite' || (group !== undefined && hasGroup(opts.store, group)))
-        return;
-    await requireAuth(req, opts);
-    assertSqliteStore(opts);
-}
 //# sourceMappingURL=route-table.js.map

package/dist/server/routes/admin.d.ts

@@ -1,9 +1,9 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreateAuthKey({ req, res, opts }: RouteRequest): Promise<void>;
-export declare function handleListAuthKeys({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleRevokeAuthKey({ req, res, opts }: RouteRequest, keyMatch: Record<string, string>): Promise<void>;
-export declare function handleListQuarantine({ req, res, opts, query }: RouteRequest): Promise<void>;
-export declare function handleApproveQuarantine({ req, res, opts }: RouteRequest, quarantineApproveMatch: Record<string, string>): Promise<void>;
-export declare function handleRejectQuarantine({ req, res, opts }: RouteRequest, quarantineRejectMatch: Record<string, string>): Promise<void>;
-export declare function handleListAudit({ req, res, opts, query }: RouteRequest): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreateAuthKey({ req, res, opts }: AuthedRouteRequest): Promise<void>;
+export declare function handleListAuthKeys({ res, ctx, query }: AuthedRouteRequest): Promise<void>;
+export declare function handleRevokeAuthKey({ res, ctx }: AuthedRouteRequest, keyMatch: Record<string, string>): Promise<void>;
+export declare function handleListQuarantine({ res, ctx, query }: AuthedRouteRequest): Promise<void>;
+export declare function handleApproveQuarantine({ res, ctx }: AuthedRouteRequest, quarantineApproveMatch: Record<string, string>): Promise<void>;
+export declare function handleRejectQuarantine({ res, ctx }: AuthedRouteRequest, quarantineRejectMatch: Record<string, string>): Promise<void>;
+export declare function handleListAudit({ res, ctx, query }: AuthedRouteRequest): Promise<void>;
 //# sourceMappingURL=admin.d.ts.map

package/dist/server/routes/admin.js

@@ -1,13 +1,14 @@
 // Admin routes: API keys, quarantine and the audit log.
+import { DEFAULT_LIST_LIMIT } from '../../util/limits.js';
 import { AUDIT_OPS } from '../../store/audit.js';
 import { auditList, authCreate, authListRows, authRevoke, quarantineApprove, quarantineList, quarantineReject } from '../../api/index.js';
 import { HttpError, readBody, sendJson } from '../../util/http-util.js';
-import { assertCrossTenantAdmin, buildContextWithAuth } from '../auth.js';
+import { assertCrossTenantAdmin, recheckContextWithAuth } from '../auth.js';
 import { pageOf, parseCursor, setNextCursorHeader } from '../cursor.js';
 import { isSetMember, parseJsonObjectText, parseListLimit, validateIdSegment } from '../validation.js';
 import { isJsonBoolean, isJsonNumber, isJsonString } from '../../util/json.js';
 const VALID_AUDIT_OPS = new Set(AUDIT_OPS);
-// POST /v1/auth/keys reads its body before auth, so an unauthenticated caller can make the server buffer at most this many bytes and wait at most this many ms.
+// A key mint is a few short fields, so even an authenticated caller gets a small cap and a short wait.
 // ServeOpts.mintBodyDeadlineMs overrides the wait for tests only, so a 408 test need not sit through it.
 const MINT_BODY_MAX_BYTES = 4 * 1024;
 const MINT_BODY_DEADLINE_MS = 10_000;
@@ -17,9 +18,9 @@ const MAX_AUDIT_LIMIT = 10000;
 const MAX_AUTH_KEYS_PAGE = 1000;
 // POST /v1/auth/keys: mints a key; plaintext is in the response body (the CLI client, not this layer, carries the "store this somewhere safe" warning).
 export async function handleCreateAuthKey({ req, res, opts }) {
-    // Body first, so the resolver's check (and any gate in it) runs right before the mint with no wait between.
+    // The dispatch gate authenticated before the body, so an unknown caller costs no read; this recheck runs the resolver right before the mint.
     const raw = await readBody(req, { maxBytes: MINT_BODY_MAX_BYTES, deadlineMs: opts.mintBodyDeadlineMs ?? MINT_BODY_DEADLINE_MS });
-    const ctx = await buildContextWithAuth(req, opts);
+    const ctx = await recheckContextWithAuth(req, opts);
     const body = parseJsonObjectText(raw);
     const labelRaw = body['label'];
     if (labelRaw !== undefined && !isJsonString(labelRaw)) {
@@ -56,7 +57,7 @@ export async function handleCreateAuthKey({ req, res, opts }) {
     return;
 }
 // GET /v1/auth/keys?active=true&limit=&cursor=: lists keys visible to ctx.tenantId; `active` defaults to true, ?active=false includes revoked and expired rows.
-export async function handleListAuthKeys({ req, res, opts, query }) {
+export async function handleListAuthKeys({ res, ctx, query }) {
     const activeRaw = query.get('active');
     let active = true;
     if (activeRaw !== null) {
@@ -69,7 +70,6 @@ export async function handleListAuthKeys({ req, res, opts, query }) {
     }
     const limit = parseListLimit(query.get('limit'), MAX_AUTH_KEYS_PAGE, MAX_AUTH_KEYS_PAGE);
     const after = parseCursor(query.get('cursor'), 'integer', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
     const page = pageOf(await authListRows(ctx, { active, limit: limit + 1, after }), limit, (r) => ({ key: r.rowId, id: r.rowId }));
     setNextCursorHeader(res, page.nextCursor);
     sendJson(res, 200, page.items.map((r) => r.key));
@@ -77,19 +77,14 @@ export async function handleListAuthKeys({ req, res, opts, query }) {
 }
 // DELETE /v1/auth/keys/:keyId revokes: missing or cross-tenant keys are 404 (no leak); a member is 403 on any key but its own or, via the resolver, those it
 // minted. Returns 200 with the body rather than 204 so the caller sees revokedAt.
-export async function handleRevokeAuthKey({ req, res, opts }, keyMatch) {
+export async function handleRevokeAuthKey({ res, ctx }, keyMatch) {
     validateIdSegment(keyMatch.keyId, 'key id');
-    const ctx = await buildContextWithAuth(req, opts);
     const result = await authRevoke(ctx, keyMatch.keyId);
     sendJson(res, 200, result);
     return;
 }
-// GET /v1/quarantine?status=&limit=&cursor=: quarantine review queue. quarantineList carries no role gate itself, so it's checked here.
-export async function handleListQuarantine({ req, res, opts, query }) {
-    const ctx = await buildContextWithAuth(req, opts);
-    if (ctx.actor.role !== 'admin') {
-        throw new HttpError(403, '/v1/quarantine requires admin role');
-    }
+// GET /v1/quarantine?status=&limit=&cursor=: quarantine review queue. quarantineList carries no role gate itself, so its row's admin gate is the check.
+export async function handleListQuarantine({ res, ctx, query }) {
     const statusRaw = query.get('status');
     let status = 'pending';
     if (statusRaw !== null) {
@@ -105,23 +100,21 @@ export async function handleListQuarantine({ req, res, opts, query }) {
     return;
 }
 // POST /v1/quarantine/:id/approve: admin only; ForbiddenError falls through to mapApiError's 403.
-export async function handleApproveQuarantine({ req, res, opts }, quarantineApproveMatch) {
+export async function handleApproveQuarantine({ res, ctx }, quarantineApproveMatch) {
     validateIdSegment(quarantineApproveMatch.id, 'memory id');
-    const ctx = await buildContextWithAuth(req, opts);
     await quarantineApprove(ctx, quarantineApproveMatch.id);
     sendJson(res, 200, { approved: quarantineApproveMatch.id });
     return;
 }
 // POST /v1/quarantine/:id/reject: admin only; ForbiddenError falls through to mapApiError's 403.
-export async function handleRejectQuarantine({ req, res, opts }, quarantineRejectMatch) {
+export async function handleRejectQuarantine({ res, ctx }, quarantineRejectMatch) {
     validateIdSegment(quarantineRejectMatch.id, 'memory id');
-    const ctx = await buildContextWithAuth(req, opts);
     await quarantineReject(ctx, quarantineRejectMatch.id);
     sendJson(res, 200, { rejected: quarantineRejectMatch.id });
     return;
 }
 // GET /v1/audit?op=&since=&limit=&cursor=: all three filters are validated at the route boundary so an invalid value is a 400 before the DB is hit.
-export async function handleListAudit({ req, res, opts, query }) {
+export async function handleListAudit({ res, ctx, query }) {
     const opRaw = query.get('op');
     let op;
     if (opRaw !== null) {
@@ -140,7 +133,7 @@ export async function handleListAudit({ req, res, opts, query }) {
         since = sinceRaw;
     }
     const limitRaw = query.get('limit');
-    let limit = 100;
+    let limit = DEFAULT_LIST_LIMIT;
     if (limitRaw !== null) {
         const parsed = Number(limitRaw);
         if (!Number.isFinite(parsed) || !Number.isInteger(parsed) || parsed < 1 || parsed > MAX_AUDIT_LIMIT) {
@@ -149,7 +142,6 @@ export async function handleListAudit({ req, res, opts, query }) {
         limit = parsed;
     }
     const after = parseCursor(query.get('cursor'), 'string', 'integer');
-    const ctx = await buildContextWithAuth(req, opts);
     // ?tenant=<t> reads another tenant (e.g. '__host__' for consolidate rows); admin only.
     const tenantOverride = query.get('tenant');
     const crossTenant = tenantOverride !== null && tenantOverride !== '' && tenantOverride !== ctx.tenantId;

package/dist/server/routes/customer-notes.d.ts

@@ -1,7 +1,7 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreateCustomerNote(rr: RouteRequest): Promise<void>;
-export declare function handleListCustomerNotes(rr: RouteRequest): Promise<void>;
-export declare function handleSupersedeCustomerNote(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleCloseCustomerNote(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleGetCustomerNote(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreateCustomerNote(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleListCustomerNotes(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleSupersedeCustomerNote(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseCustomerNote(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetCustomerNote(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=customer-notes.d.ts.map

package/dist/server/routes/customer-notes.js

@@ -1,7 +1,6 @@
 // /v1/customer-notes routes.
 import { CUSTOMER_NOTE, MAX_CHANGE_SUMMARY_LEN, MAX_CUSTOMER_LEN } from '../../objects/customer-notes.js';
 import { sendJson } from '../../util/http-util.js';
-import { buildContextWithAuth } from '../auth.js';
 import { parseJsonBody } from '../validation.js';
 import { saveFor } from '../../api/objects.js';
 import { closeRoute, getRoute, listRoute, optionalString, requiredString, supersedeRoute } from './object-routes.js';
@@ -20,7 +19,7 @@ const noteRoutes = {
 // Routes: customer notes under /v1/customer-notes (create, list, show, supersede, close), mirroring /v1/project-briefs. The store validates and throws;
 // the boundary maps validation -> 400, not-found -> 404, not-active -> 409.
 export async function handleCreateCustomerNote(rr) {
-    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const { ctx } = rr;
     const body = await parseJsonBody(rr.req, ctx);
     const customerNote = await saveFor(ctx, CUSTOMER_NOTE, {
         customer: requiredString(body, 'customer', { max: MAX_CUSTOMER_LEN }),

package/dist/server/routes/decisions.d.ts

@@ -1,7 +1,7 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreateDecision(rr: RouteRequest): Promise<void>;
-export declare function handleListDecisions(rr: RouteRequest): Promise<void>;
-export declare function handleSupersedeDecision(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleCloseDecision(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleGetDecision(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreateDecision(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleListDecisions(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleSupersedeDecision(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseDecision(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetDecision(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=decisions.d.ts.map

package/dist/server/routes/decisions.js

@@ -3,7 +3,6 @@ import { DECISION } from '../../objects/decisions.js';
 import { HttpError, sendJson } from '../../util/http-util.js';
 import { NotFoundError } from '../../core/api-errors.js';
 import { isJsonNumber } from '../../util/json.js';
-import { buildContextWithAuth } from '../auth.js';
 import { MAX_SHORT_FIELD_LEN, parseJsonBody } from '../validation.js';
 import { saveFor } from '../../api/objects.js';
 import { closeRoute, getRoute, listRoute, optionalString, requiredString } from './object-routes.js';
@@ -21,8 +20,7 @@ function supersededId(body) {
 // Routes: /v1/decisions (create, list, show, supersede, close), Bearer-authed and tenant-scoped; status is validated against VALID_DECISION_STATES.
 // The HTTP surface has no legacy --supersedes <memory-id> constraint, so it supersedes by table id and never weakens a memory mirror.
 export async function handleCreateDecision(rr) {
-    const { req, res } = rr;
-    const ctx = await buildContextWithAuth(req, rr.opts);
+    const { req, res, ctx } = rr;
     const body = await parseJsonBody(req, ctx);
     const write = {
         decisionText: requiredString(body, 'text', TEXT),
@@ -46,7 +44,7 @@ export function handleListDecisions(rr) {
 // Not on supersedeRoute: this one answers 201 and leaves the missing-row 404 to the store, where the other five answer 200 after their own lookup.
 export async function handleSupersedeDecision(rr, match) {
     const oldId = parseInt(match[1], 10);
-    const ctx = await buildContextWithAuth(rr.req, rr.opts);
+    const { ctx } = rr;
     const body = await parseJsonBody(rr.req, ctx);
     const decision = await saveFor(ctx, DECISION, {
         decisionText: requiredString(body, 'text', TEXT),

package/dist/server/routes/incidents.d.ts

@@ -1,7 +1,7 @@
-import type { RouteRequest } from '../types.js';
-export declare function handleCreateIncident(rr: RouteRequest): Promise<void>;
-export declare function handleListIncidents(rr: RouteRequest): Promise<void>;
-export declare function handleResolveIncident(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleCloseIncident(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
-export declare function handleGetIncident(rr: RouteRequest, match: RegExpMatchArray): Promise<void>;
+import type { AuthedRouteRequest } from '../types.js';
+export declare function handleCreateIncident(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleListIncidents(rr: AuthedRouteRequest): Promise<void>;
+export declare function handleResolveIncident(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleCloseIncident(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
+export declare function handleGetIncident(rr: AuthedRouteRequest, match: RegExpMatchArray): Promise<void>;
 //# sourceMappingURL=incidents.d.ts.map

package/dist/server/routes/incidents.js

@@ -2,7 +2,6 @@
 import { INCIDENT, openIncident, resolveOpenIncident } from '../../objects/incidents.js';
 import { HttpError, sendJson } from '../../util/http-util.js';
 import { NotFoundError } from '../../core/api-errors.js';
-import { buildContextWithAuth } from '../auth.js';
 import { MAX_SHORT_FIELD_LEN, parseJsonBody } from '../validation.js';
 import { isJsonString } from '../../util/json.js';
 import { objectsOf } from '../../api/objects.js';
@@ -28,8 +27,7 @@ function linkedMemoryIds(body) {
 // Routes: /v1/incidents (open, list, show, resolve, close), mirroring /v1/decisions; status is validated against VALID_INCIDENT_STATES.
 // Lifecycle is open->resolved->closed (no supersede), so linkedMemoryIds replaces supersedesDecisionId on create.
 export async function handleCreateIncident(rr) {
-    const { req, res, opts } = rr;
-    const ctx = await buildContextWithAuth(req, opts);
+    const { req, res, opts, ctx } = rr;
     const body = await parseJsonBody(req, ctx);
     const write = {
         incidentText: requiredString(body, 'text', { max: MAX_SHORT_FIELD_LEN, untrimmed: true }),
@@ -51,9 +49,8 @@ export function handleListIncidents(rr) {
     return listRoute(incidentRoutes, rr);
 }
 export async function handleResolveIncident(rr, match) {
-    const { req, res, opts } = rr;
+    const { req, res, ctx } = rr;
     const id = parseInt(match[1], 10);
-    const ctx = await buildContextWithAuth(req, opts);
     const resolutionText = requiredString(await parseJsonBody(req, ctx), 'resolutionText', { max: MAX_SHORT_FIELD_LEN });
     const incident = await resolveOpenIncident(objectsOf(ctx), ctx.tenantId, id, resolutionText, ctx.actor.subject);
     sendJson(res, 200, { incident });