instar 1.3.1649 → 1.3.1650

package/dist/server/mobilePairingRoutes.js

@@ -28,6 +28,7 @@ import { Router } from 'express';
 import { resolveDevAgentGate } from '../core/devAgentGate.js';
 import { arrivedOverLocalTls } from '../core/desktopTransport.js';
 import { PairingCodeStore, NONCE_PATTERN, buildPairLink, cleanText, codeTtlMs, pingAnswer, stableOrigin, } from '../core/MobilePairing.js';
+import { featureEvidence } from '../monitoring/FeatureEvidenceLog.js';
 import { ConfirmationCodes, DeviceRegistry, displayCode, ReplayGuard, parseDevicePublicKey, verifyDeviceRequest, } from '../core/MobileDeviceKeys.js';
 import { isPeerUrlAllowedForCredentials } from './peerUrlGuard.js';
 import { poolPeerFetch } from './poolPeerFetch.js';
@@ -38,6 +39,7 @@ import { PairingInviteTelegram } from '../threadline/PairingInviteTelegram.js';
 import { APP_CONVERSATION_KEY_PATTERN, derivedEventId, hideCredentialSpans, removeAuthorityTokens } from '../core/appConversationText.js';
 import { deviceKeyHashOf } from '../core/AppRecordSignatures.js';
 import { buildSignedOrigin } from './mobileConversationRoutes.js';
+import { mountConsoleTicketDeviceRoutes } from './mobileConsoleTicket.js';
 import { checkSignedFiles, claimMediaUploads, mediaRecordTooLarge, mirrorMediaToTelegram, preflightMediaAttachments, publishMediaMessage, signedFileHashParts, } from './mobileMediaSend.js';
 import { isExactStopMessage } from '../core/MessageSentinel.js';
 import { UserManager } from '../users/UserManager.js';
@@ -392,16 +394,26 @@ export class MobilePairingService {
         this.deviceRate.set(deviceId, arr);
         return true;
     }
-    /** A rule's own per-minute bucket (media chunks), independent of the read allowance. */
-    deviceBucketOk(deviceId, perMinute) {
+    /**
+     * A rule's own per-minute bucket, independent of the read allowance. Each named bucket counts
+     * separately (media chunks use 'default'; the session screen has its own two), and a key whose
+     * window has emptied is deleted, so the map holds only devices active in the last minute.
+     */
+    deviceBucketOk(deviceId, perMinute, bucket = 'default') {
         const t = this.now();
-        const arr = (this.deviceBucket.get(deviceId) ?? []).filter((x) => t - x < 60_000);
+        const key = bucket === 'default' ? deviceId : `${deviceId}\u0000${bucket}`;
+        const arr = (this.deviceBucket.get(key) ?? []).filter((x) => t - x < 60_000);
         if (arr.length >= perMinute) {
-            this.deviceBucket.set(deviceId, arr);
+            this.deviceBucket.set(key, arr);
             return false;
         }
         arr.push(t);
-        this.deviceBucket.set(deviceId, arr);
+        this.deviceBucket.set(key, arr);
+        if (this.deviceBucket.size > 64) {
+            for (const [k, v] of this.deviceBucket)
+                if (!v.some((x) => t - x < 60_000))
+                    this.deviceBucket.delete(k);
+        }
         return true;
     }
     /** Inbound Telegram text: void any pending device whose live code appears in it. */
@@ -609,12 +621,14 @@ export function mountPublicMobilePairingRoutes(app, svc) {
         const reqHost = normalizeRequestHost(req.headers.host);
         const eligible = svc.redeemHostEligible(reqHost);
         if (!arrivedOverLocalTls(req.secure, req.socket.remoteAddress, req.headers['x-forwarded-proto']) || !eligible) {
+            featureEvidence.recordAtMostEvery('mobilePairing', 'redeem|not-secure-address', 60_000, { kind: 'held', reason: 'redeem refused: not-secure-address' });
             res.status(403).json({ error: 'Pairing only works over this agent\'s secure address.' });
             return;
         }
         const body = (req.body ?? {});
         const publicKey = typeof body.devicePublicKey === 'string' ? body.devicePublicKey : '';
         if (!parseDevicePublicKey(publicKey)) {
+            featureEvidence.recordAtMostEvery('mobilePairing', 'redeem|bad-device-key', 60_000, { kind: 'held', reason: 'redeem refused: bad-device-key' });
             res.status(400).json({ error: 'A valid device public key is required.' });
             return;
         }
@@ -624,16 +638,19 @@ export function mountPublicMobilePairingRoutes(app, svc) {
         // session, which needs no lease.
         const approval = svc.approvalPath();
         if (!approval || (approval === 'telegram' && !svc.holdsLease())) {
+            featureEvidence.recordAtMostEvery('mobilePairing', 'redeem|approval-unavailable', 60_000, { kind: 'held', reason: 'redeem refused: approval-unavailable' });
             res.status(409).json({ error: 'approval-unavailable', detail: 'This agent cannot send you the confirmation code right now (no Telegram owner chat on this machine).' });
             return;
         }
         if (svc.devices.pairingPaused()) {
+            featureEvidence.recordAtMostEvery('mobilePairing', 'redeem|pairing-paused', 60_000, { kind: 'held', reason: 'redeem refused: pairing-paused' });
             res.status(429).json({ error: 'pairing-paused' });
             return;
         }
         // Take-and-delete happens synchronously inside redeem(), before any async work.
         const r = svc.codes.redeem(body.code, token);
         if (!r.ok) {
+            featureEvidence.recordAtMostEvery('mobilePairing', `redeem|${r.reason}`, 60_000, { kind: 'held', reason: `redeem refused: ${r.reason}` });
             if (r.reason === 'too-many-attempts') {
                 res.status(429).json({ error: 'too-many-attempts' });
                 return;
@@ -644,6 +661,7 @@ export function mountPublicMobilePairingRoutes(app, svc) {
         // §3.2 step 3: an honest phone sends to the link's own origin. A code with no bound origin
         // (minted before this change, in this process) keeps the old rule: the eligible host.
         if (r.bound && (r.bound.host !== reqHost || r.bound.kind !== eligible.kind)) {
+            featureEvidence.recordAtMostEvery('mobilePairing', 'redeem|wrong-origin', 60_000, { kind: 'held', reason: 'redeem refused: wrong-origin' });
             res.status(403).json({ error: 'That link has expired or was already used.' });
             return;
         }
@@ -653,11 +671,13 @@ export function mountPublicMobilePairingRoutes(app, svc) {
         }
         catch (err) {
             svc.deps.reportDegradation?.('MobilePairing.registryWrite', err);
+            featureEvidence.record('mobilePairing', { kind: 'error', reason: 'redeem failed: registry write', context: { routeKind: eligible.kind } });
             res.status(500).json({ error: 'Could not record the device. Ask for a new link.' });
             return;
         }
         if (!created.ok) {
             const status = created.reason === 'duplicate-key' ? 409 : 429;
+            featureEvidence.record('mobilePairing', { kind: 'held', reason: `redeem refused: ${created.reason}`, context: { routeKind: eligible.kind, status } });
             res.status(status).json({ error: created.reason });
             return;
         }
@@ -672,6 +692,7 @@ export function mountPublicMobilePairingRoutes(app, svc) {
             svc.holdDashboardCode(device.id, code, Date.parse(device.expiresAt));
             // dashboard-console-default-and-pair-page §3.3: the code page on the host this phone just
             // redeemed on (already checked above: local TLS, an eligible host, the code's bound host).
+            featureEvidence.record('mobilePairing', { kind: 'fired', reason: 'redeemed: code held on dashboard', context: { deviceId: device.id, approval: 'dashboard', role: device.role ?? 'owner', routeKind: eligible.kind, codeFormat } });
             res.json({ deviceId: device.id, agentName: svc.deps.config.projectName, status: 'pending', approval: 'dashboard', codeFormat,
                 codePageUrl: codePageUrlForDevice(reqHost, device.id) });
             return;
@@ -707,9 +728,11 @@ export function mountPublicMobilePairingRoutes(app, svc) {
             catch (err) {
                 svc.deps.reportDegradation?.('MobilePairing.registryWrite', err);
             }
+            featureEvidence.record('mobilePairing', { kind: 'error', reason: 'redeem failed: confirmation code not delivered', context: { deviceId: device.id, routeKind: eligible.kind } });
             res.status(409).json({ error: 'approval-unavailable', detail: 'I could not send you the confirmation code in Telegram. Open a private chat with the bot and send it any message, then ask me for a new link.' });
             return;
         }
+        featureEvidence.record('mobilePairing', { kind: 'fired', reason: 'redeemed: code sent by Telegram', context: { deviceId: device.id, approval: 'telegram', role: device.role ?? 'owner', routeKind: eligible.kind, codeFormat } });
         res.json({ deviceId: device.id, agentName: svc.deps.config.projectName, status: 'pending', approval: 'telegram', codeFormat });
     });
 }
@@ -1062,15 +1085,18 @@ export function createMobilePairingRouter(svc, deps, poolCtx) {
             catch (err) {
                 deps.reportDegradation?.('MobilePairing.registryWrite', err);
             }
+            featureEvidence.record('mobilePairing', { kind: 'held', reason: 'confirm refused: approval-moved', context: { deviceId: d.id } });
             res.status(409).json({ error: 'approval-moved', detail: 'This pairing moved machines. Ask for a new link.' });
             return;
         }
         if (svc.devices.pairingPaused()) {
+            featureEvidence.record('mobilePairing', { kind: 'held', reason: 'confirm refused: pairing-paused', context: { deviceId: d.id } });
             res.status(429).json({ error: 'pairing-paused' });
             return;
         }
         const check = svc.confirm.check(d.id, req.body?.code);
         if (check.result === 'none') {
+            featureEvidence.record('mobilePairing', { kind: 'held', reason: 'confirm refused: expired', context: { deviceId: d.id } });
             res.status(409).json({ error: 'expired' });
             return;
         }
@@ -1088,6 +1114,7 @@ export function createMobilePairingRouter(svc, deps, poolCtx) {
             }
             catch (err) {
                 deps.reportDegradation?.('MobilePairing.keyLedger', err);
+                featureEvidence.record('mobilePairing', { kind: 'error', reason: 'confirm failed: key ledger write', context: { deviceId: d.id, approvedVia } });
                 res.status(500).json({ error: 'Could not record the confirmation. Try again.' });
                 return;
             }
@@ -1097,6 +1124,7 @@ export function createMobilePairingRouter(svc, deps, poolCtx) {
         }
         catch (err) {
             deps.reportDegradation?.('MobilePairing.registryWrite', err);
+            featureEvidence.record('mobilePairing', { kind: 'error', reason: 'confirm failed: registry write', context: { deviceId: d.id, approvedVia } });
             res.status(500).json({ error: 'Could not record the confirmation. Try again.' });
             return;
         }
@@ -1106,9 +1134,11 @@ export function createMobilePairingRouter(svc, deps, poolCtx) {
             for (const [n, id] of svc.declineNonces)
                 if (id === d.id)
                     svc.declineNonces.delete(n);
+            featureEvidence.record('mobilePairing', { kind: 'fired', reason: 'confirmed', context: { deviceId: d.id, approvedVia, role: d.role ?? 'owner' } });
             res.json({ status: 'active' });
             return;
         }
+        featureEvidence.record('mobilePairing', { kind: 'held', reason: 'confirm refused: wrong code', context: { deviceId: d.id, nowDeclined: after?.status === 'declined', pairingPaused: svc.devices.pairingPaused() } });
         if (svc.devices.pairingPaused()) {
             deps.raiseAttention?.('Phone pairing paused', 'Ten wrong pairing codes were entered in the last 24 hours, so phone pairing is paused for now. If you were not pairing a phone, someone may be guessing.');
         }
@@ -1121,6 +1151,8 @@ export function createMobilePairingRouter(svc, deps, poolCtx) {
         }
         res.status(403).json({ error: 'wrong-code' });
     });
+    // Console sign-in from an owner phone (docs/specs/mobile-console-device-signin.md).
+    mountConsoleTicketDeviceRoutes(router, svc);
     // Revoke: bearer may revoke any device; a device only itself.
     router.post('/mobile/devices/:id/revoke', async (req, res) => {
         if (!svc.enabled()) {
@@ -1158,11 +1190,13 @@ export function createMobilePairingRouter(svc, deps, poolCtx) {
         }
         catch (err) {
             deps.reportDegradation?.('MobilePairing.registryWrite', err);
+            featureEvidence.record('mobilePairing', { kind: 'error', reason: 'revoke failed: registry write', context: { deviceId: id, by: p.kind } });
             res.status(500).json({ error: 'Could not record the revocation. Try again.' });
             return;
         }
         if (held) {
             svc.confirm.drop(id);
+            featureEvidence.record('mobilePairing', { kind: 'fired', reason: 'revoked here', context: { deviceId: id, by: p.kind, heldHere: true } });
             res.json({ revoked: true, machine: deps.selfMachineId ?? null });
             return;
         }
@@ -1172,9 +1206,11 @@ export function createMobilePairingRouter(svc, deps, poolCtx) {
         }
         const r = await forwardRevoke(poolCtx, id);
         if (r.confirmedBy) {
+            featureEvidence.record('mobilePairing', { kind: 'fired', reason: 'revoked by a peer', context: { deviceId: id, by: p.kind, heldHere: false } });
             res.json({ revoked: true, machine: r.confirmedBy });
             return;
         }
+        featureEvidence.record('mobilePairing', { kind: 'error', reason: 'revoke unconfirmed: no machine holding this phone answered', context: { deviceId: id, by: p.kind } });
         res.status(202).json({ pending: true, detail: 'No machine holding this phone confirmed yet. Until one does, the phone may still have access. Revoke it on the machine that serves its address for an immediate effect.' });
     });
     // ── Mobile push (docs/specs/mobile-push.md) ──
@@ -1733,6 +1769,8 @@ const UUID = APP_CONVERSATION_KEY_PATTERN;
 // `unassignedOk`: the route answers a phone whose person is no longer in the registry (people and
 // roles §3.4): only its own status, confirm and self-revoke. `conversationRef`: the route names a
 // conversation, so it must call the shared `mayUse` check (the coverage test reads this flag).
+// `ownerOnly`: only a phone whose person is the owner (403 owner-phone-required otherwise).
+// `bucket`: the name of the rule's own bucket (rules sharing a name share a count).
 export const DEVICE_ALLOWLIST = (() => {
     const active = new Set(['active']);
     return [
@@ -1775,7 +1813,18 @@ export const DEVICE_ALLOWLIST = (() => {
         { method: 'GET', re: new RegExp(`^/mobile/media/uploads/${UUID}$`), statuses: active, body: 'none' },
         { method: 'GET', re: /^\/mobile\/media\/[0-9a-f]{64}$/, statuses: active, body: 'none', conversationRef: true },
         { method: 'POST', re: /^\/mobile\/media\/purge$/, statuses: active, body: 'json', conversationRef: true },
+        // Console sign-in from an owner phone (mobile-console-device-signin §3.1-3.2); each route
+        // re-checks owner, local TLS and the feature switch itself.
+        { method: 'POST', re: /^\/mobile\/device\/presence-key$/, statuses: active, body: 'json' },
+        { method: 'POST', re: /^\/mobile\/console-ticket\/challenge$/, statuses: active, body: 'json' },
+        { method: 'POST', re: /^\/mobile\/console-ticket$/, statuses: active, body: 'json' },
         { method: 'POST', re: /^\/mobile\/devices\/[^/]+\/revoke$/, statuses: new Set(['pending', 'active', 'declined', 'expired']), unassignedOk: true },
+        // The native session screen (docs/specs/mobile-native-session-screen.md): read a session's pane
+        // and type plain text into it. Owner phones only; each has its own bucket so polling and typing
+        // never use up the read allowance the chat list needs. The path is lower-cased here; the router
+        // reads the name with its case kept.
+        { method: 'GET', re: /^\/sessions\/[a-z0-9_-]{1,200}\/output$/, statuses: active, body: 'none', ownerOnly: true, ownBucket: 90, bucket: 'session-output' },
+        { method: 'POST', re: /^\/sessions\/[a-z0-9_-]{1,200}\/input$/, statuses: active, body: 'json', ownerOnly: true, ownBucket: 12, bucket: 'session-input' },
     ];
 })();
 /**
@@ -1837,6 +1886,9 @@ export function deviceAuthenticator(svc) {
         if (svc.ownNames) {
             const h = normalizeRequestHost(req.headers.host);
             if (!h || !svc.ownNames.accepts(h) || !arrivedOverLocalTls(req.secure, req.socket.remoteAddress, req.headers['x-forwarded-proto'])) {
+                // The bar is about OWN names: a name that is not ours is someone knocking, not a refusal of a real route.
+                const ownName = !!h && svc.ownNames.accepts(h);
+                featureEvidence.recordAtMostEvery('mobilePairing.multiRoute', `host-refused|${ownName}`, 60_000, { kind: ownName ? 'error' : 'held', reason: ownName ? 'refused on an own name: not over local TLS' : 'refused: host is not an own name', context: { ownName, routeKind: ownName ? svc.ownNames.listed().find((n) => n.host === h)?.kind ?? 'unknown' : null } });
                 return refuse(401, 'device-unauthorized');
             }
             host = h;
@@ -1851,10 +1903,13 @@ export function deviceAuthenticator(svc) {
             const ledgerRevoked = !!svc.keyLedger && svc.keyLedger.isRevoked(deviceKeyHashOf(d.publicKey), d.id);
             return { publicKey: d.publicKey, host: d.host, status: ledgerRevoked ? 'revoked' : d.status };
         }, rule.statuses, svc.replay, Date.now(), rule.sendRoute === true);
+        if (!v.ok && host) {
+            featureEvidence.recordAtMostEvery('mobilePairing.multiRoute', `signature-refused|${v.reason}|${host}`, 60_000, { kind: v.reason === 'rate-limited' ? 'held' : 'error', reason: `signature refused on an own name: ${v.reason}`, context: { signatureReason: v.reason, host, routeKind: svc.ownNames?.listed().find((n) => n.host === host)?.kind ?? 'unknown' } });
+        }
         if (!v.ok)
             return refuse(v.reason === 'rate-limited' ? 429 : 401, v.reason === 'rate-limited' ? 'too-many-requests' : 'device-unauthorized');
         if (rule.ownBucket !== undefined) {
-            if (!svc.deviceBucketOk(v.deviceId, rule.ownBucket))
+            if (!svc.deviceBucketOk(v.deviceId, rule.ownBucket, rule.bucket))
                 return refuse(429, 'too-many-requests');
         }
         else if (!(rule.sendRoute && svc.nativeOn) && !svc.deviceRateOk(v.deviceId))
@@ -1869,6 +1924,8 @@ export function deviceAuthenticator(svc) {
                 return refuse(403, 'person-unknown');
         }
         else {
+            if (rule.ownerOnly && person.role !== 'owner')
+                return refuse(403, 'owner-phone-required');
             req.instarDevicePerson = person;
         }
         req.instarPrincipal = { kind: 'device', deviceId: v.deviceId };
@@ -1877,6 +1934,10 @@ export function deviceAuthenticator(svc) {
         // The Host the signature was checked against (multi-route: one of this machine's own names;
         // otherwise the paired host). Signed records store THIS host, never the paired one.
         req.instarDeviceHost = host ?? svc.devices.get(v.deviceId)?.host ?? '';
+        if (host) {
+            // Per request by nature: one row a device and route an hour, carrying how many it stands for.
+            featureEvidence.recordAtMostEvery('mobilePairing.multiRoute', `accepted|${v.deviceId}|${host}`, 60 * 60 * 1000, { kind: 'fired', reason: 'signature accepted on an own name', context: { deviceId: v.deviceId, host, routeKind: svc.ownNames?.listed().find((n) => n.host === host)?.kind ?? 'unknown', pairedHost: rec?.host === host } });
+        }
         return 'ok';
     };
 }