libre-webui 0.21.2 → 0.22.0

package/backend/dist/services/websocketTicketService.js

@@ -0,0 +1,183 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { createHash, randomBytes } from 'crypto';
+import { getCoordinator } from '../platform/coordination/service.js';
+import { SHARED_COORDINATION_OPERATION_TIMEOUT_MS, withCoordinationTimeout, } from '../platform/coordination/sharedAdmission.js';
+const DEFAULT_TICKET_TTL_MS = 30000;
+const MAX_TICKET_TTL_MS = 60000;
+const MAX_OUTSTANDING_TICKETS_PER_USER = 5;
+const MAX_OUTSTANDING_TICKETS = 10000;
+const MAX_SHARED_TICKETS_PER_USER_PER_TTL = 100;
+export class WebSocketTicketRateLimitError extends Error {
+    constructor() {
+        super('Too many WebSocket tickets were requested.');
+        this.name = 'WebSocketTicketRateLimitError';
+    }
+}
+export class WebSocketTicketCoordinationError extends Error {
+    constructor(cause) {
+        super('WebSocket ticket coordination is unavailable.');
+        this.name = 'WebSocketTicketCoordinationError';
+        this.cause = cause;
+    }
+}
+const positiveInteger = (value, fallback) => {
+    const parsed = Number.parseInt(value || '', 10);
+    return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+};
+const configuredTicketTtlMs = () => Math.min(positiveInteger(process.env.WEBSOCKET_TICKET_TTL_MS, DEFAULT_TICKET_TTL_MS), MAX_TICKET_TTL_MS);
+const ticketDigest = (ticket) => createHash('sha256').update(ticket).digest('base64url');
+const cacheKey = (digest) => `websocket-ticket:${digest}`;
+const isTicketRecord = (value) => {
+    if (!value || typeof value !== 'object')
+        return false;
+    const record = value;
+    return (typeof record.userId === 'string' &&
+        record.userId.length > 0 &&
+        (record.audience === 'chat' || record.audience === 'work-terminal') &&
+        (record.resourceId === undefined ||
+            typeof record.resourceId === 'string') &&
+        Number.isSafeInteger(record.expiresAt) &&
+        Number.isSafeInteger(record.sessionExpiresAt) &&
+        Number.isSafeInteger(record.issuedAt));
+};
+/**
+ * Stores one-use WebSocket credentials in the selected coordinator. The
+ * browser receives only an opaque random value, and the durable login token
+ * never enters a URL. Redis provides cross-replica atomic consumption in the
+ * team profile; the private map is retained only for isolated unit instances.
+ */
+export class WebSocketTicketService {
+    constructor(ttlMs = configuredTicketTtlMs(), now = Date.now, coordinatorProvider, operationTimeoutMs = SHARED_COORDINATION_OPERATION_TIMEOUT_MS) {
+        this.ttlMs = ttlMs;
+        this.now = now;
+        this.coordinatorProvider = coordinatorProvider;
+        this.operationTimeoutMs = operationTimeoutMs;
+        this.tickets = new Map();
+    }
+    async issue(userId, sessionExpiresAt, audience, resourceId) {
+        const normalizedUserId = userId.trim();
+        if (!normalizedUserId) {
+            throw new Error('A user ID is required to issue a WebSocket ticket.');
+        }
+        const now = this.now();
+        if (!Number.isSafeInteger(sessionExpiresAt) || sessionExpiresAt <= now) {
+            throw new Error('A current session is required to issue a WebSocket ticket.');
+        }
+        if (audience === 'work-terminal' && !resourceId?.trim()) {
+            throw new Error('A task ID is required for a Work terminal ticket.');
+        }
+        const ticket = randomBytes(32).toString('base64url');
+        const expiresAt = Math.min(now + this.ttlMs, sessionExpiresAt);
+        const record = {
+            userId: normalizedUserId,
+            audience,
+            ...(resourceId?.trim() ? { resourceId: resourceId.trim() } : {}),
+            expiresAt,
+            sessionExpiresAt,
+            issuedAt: now,
+        };
+        const digest = ticketDigest(ticket);
+        const coordinator = this.coordinatorProvider?.();
+        if (coordinator) {
+            const [userLimit, globalLimit] = await withCoordinationTimeout(Promise.all([
+                coordinator.consumeRateLimit(`websocket-ticket.user:${normalizedUserId}`, MAX_SHARED_TICKETS_PER_USER_PER_TTL, this.ttlMs),
+                coordinator.consumeRateLimit('websocket-ticket.global', MAX_OUTSTANDING_TICKETS, this.ttlMs),
+            ]), this.operationTimeoutMs);
+            if (!userLimit.allowed || !globalLimit.allowed) {
+                throw new WebSocketTicketRateLimitError();
+            }
+            await withCoordinationTimeout(coordinator.setCache(cacheKey(digest), record, expiresAt - now), this.operationTimeoutMs);
+        }
+        else {
+            this.pruneExpired(now);
+            this.evictOldestForUser(normalizedUserId);
+            this.evictOldestGlobal();
+            this.tickets.set(digest, record);
+        }
+        return {
+            ticket,
+            expiresAt: new Date(expiresAt).toISOString(),
+        };
+    }
+    async consume(ticket, audience, resourceId) {
+        const normalizedTicket = ticket.trim();
+        if (!/^[A-Za-z0-9_-]{43}$/.test(normalizedTicket))
+            return null;
+        const digest = ticketDigest(normalizedTicket);
+        const coordinator = this.coordinatorProvider?.();
+        let record;
+        try {
+            record = coordinator
+                ? await withCoordinationTimeout(coordinator.consumeCache(cacheKey(digest)), this.operationTimeoutMs)
+                : this.consumeLocal(digest);
+        }
+        catch (error) {
+            throw new WebSocketTicketCoordinationError(error);
+        }
+        if (!isTicketRecord(record))
+            return null;
+        if (record.expiresAt <= this.now() ||
+            record.audience !== audience ||
+            record.resourceId !== resourceId?.trim()) {
+            return null;
+        }
+        return {
+            userId: record.userId,
+            sessionExpiresAt: record.sessionExpiresAt,
+        };
+    }
+    consumeLocal(digest) {
+        const record = this.tickets.get(digest) ?? null;
+        // Delete before evaluating it so replay is impossible even at the expiry
+        // boundary or when later authorization checks reject the account.
+        this.tickets.delete(digest);
+        return record;
+    }
+    pruneExpired(now) {
+        for (const [digest, record] of this.tickets) {
+            if (record.expiresAt <= now)
+                this.tickets.delete(digest);
+        }
+    }
+    evictOldestForUser(userId) {
+        const matching = [...this.tickets.entries()]
+            .filter(([, record]) => record.userId === userId)
+            .sort(([, left], [, right]) => left.issuedAt - right.issuedAt);
+        while (matching.length >= MAX_OUTSTANDING_TICKETS_PER_USER) {
+            const oldest = matching.shift();
+            if (oldest)
+                this.tickets.delete(oldest[0]);
+        }
+    }
+    evictOldestGlobal() {
+        if (this.tickets.size < MAX_OUTSTANDING_TICKETS)
+            return;
+        let oldestDigest;
+        let oldestIssuedAt = Number.POSITIVE_INFINITY;
+        for (const [digest, record] of this.tickets) {
+            if (record.issuedAt < oldestIssuedAt) {
+                oldestDigest = digest;
+                oldestIssuedAt = record.issuedAt;
+            }
+        }
+        if (oldestDigest)
+            this.tickets.delete(oldestDigest);
+    }
+}
+export const websocketTicketService = new WebSocketTicketService(configuredTicketTtlMs(), Date.now, getCoordinator);
+//# sourceMappingURL=websocketTicketService.js.map

package/backend/dist/services/websocketTicketService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"websocketTicketService.js","sourceRoot":"","sources":["../../src/services/websocketTicketService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EACL,wCAAwC,EACxC,uBAAuB,GACxB,MAAM,6CAA6C,CAAC;AAGrD,MAAM,qBAAqB,GAAG,KAAM,CAAC;AACrC,MAAM,iBAAiB,GAAG,KAAM,CAAC;AACjC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAC3C,MAAM,uBAAuB,GAAG,KAAM,CAAC;AACvC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAuBhD,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAGzD,YAAY,KAAe;QACzB,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,MAAM,eAAe,GAAG,CACtB,KAAyB,EACzB,QAAgB,EACR,EAAE;IACV,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,GAAW,EAAE,CACzC,IAAI,CAAC,GAAG,CACN,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,qBAAqB,CAAC,EAC3E,iBAAiB,CAClB,CAAC;AAEJ,MAAM,YAAY,GAAG,CAAC,MAAc,EAAU,EAAE,CAC9C,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAE1D,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,oBAAoB,MAAM,EAAE,CAAC;AAE1E,MAAM,cAAc,GAAG,CAAC,KAAc,EAAyB,EAAE;IAC/D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,MAAM,GAAG,KAA8B,CAAC;IAC9C,OAAO,CACL,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,eAAe,CAAC;QACnE,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;YAC9B,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC;QACxC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;QACtC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC7C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CACtC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IAGjC,YACmB,KAAK,GAAG,qBAAqB,EAAE,EAC/B,GAAG,GAAiB,IAAI,CAAC,GAAG,EAC5B,mBAAuC,EACvC,kBAAkB,GAAG,wCAAwC;QAH7D,UAAK,GAAL,KAAK,CAA0B;QAC/B,QAAG,GAAH,GAAG,CAAyB;QAC5B,wBAAmB,GAAnB,mBAAmB,CAAoB;QACvC,uBAAkB,GAAlB,kBAAkB,CAA2C;QAN/D,YAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAOxD,CAAC;IAEJ,KAAK,CAAC,KAAK,CACT,MAAc,EACd,gBAAwB,EACxB,QAAiC,EACjC,UAAmB;QAEnB,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,IAAI,GAAG,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,eAAe,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAiB;YAC3B,MAAM,EAAE,gBAAgB;YACxB,QAAQ;YACR,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,SAAS;YACT,gBAAgB;YAChB,QAAQ,EAAE,GAAG;SACd,CAAC;QACF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACjD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,uBAAuB,CAC5D,OAAO,CAAC,GAAG,CAAC;gBACV,WAAW,CAAC,gBAAgB,CAC1B,yBAAyB,gBAAgB,EAAE,EAC3C,mCAAmC,EACnC,IAAI,CAAC,KAAK,CACX;gBACD,WAAW,CAAC,gBAAgB,CAC1B,yBAAyB,EACzB,uBAAuB,EACvB,IAAI,CAAC,KAAK,CACX;aACF,CAAC,EACF,IAAI,CAAC,kBAAkB,CACxB,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBAC/C,MAAM,IAAI,6BAA6B,EAAE,CAAC;YAC5C,CAAC;YACD,MAAM,uBAAuB,CAC3B,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,GAAG,GAAG,CAAC,EAC/D,IAAI,CAAC,kBAAkB,CACxB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YAC1C,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QAED,OAAO;YACL,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SAC7C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAc,EACd,QAAiC,EACjC,UAAmB;QAEnB,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/D,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACjD,IAAI,MAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,WAAW;gBAClB,CAAC,CAAC,MAAM,uBAAuB,CAC3B,WAAW,CAAC,YAAY,CAAe,QAAQ,CAAC,MAAM,CAAC,CAAC,EACxD,IAAI,CAAC,kBAAkB,CACxB;gBACH,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gCAAgC,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,IACE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAC5B,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,IAAI,EAAE,EACxC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,MAAc;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;QAChD,yEAAyE;QACzE,kEAAkE;QAClE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,MAAc;QACvC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;aACzC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;aAChD,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEjE,OAAO,QAAQ,CAAC,MAAM,IAAI,gCAAgC,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,uBAAuB;YAAE,OAAO;QAExD,IAAI,YAAgC,CAAC;QACrC,IAAI,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAC9C,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,QAAQ,GAAG,cAAc,EAAE,CAAC;gBACrC,YAAY,GAAG,MAAM,CAAC;gBACtB,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;YACnC,CAAC;QACH,CAAC;QACD,IAAI,YAAY;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC;CACF;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,sBAAsB,CAC9D,qBAAqB,EAAE,EACvB,IAAI,CAAC,GAAG,EACR,cAAc,CACf,CAAC"}

package/backend/dist/services/workAccessService.d.ts

@@ -2,8 +2,8 @@ export type WorkAccessMode = 'admins' | 'all-users';
 export declare const WORK_ACCESS_MODES: readonly WorkAccessMode[];
 export declare const WORK_ACCESS_MODE_KEY = "work_access_mode";
 export declare function isWorkAccessMode(value: unknown): value is WorkAccessMode;
-export declare function getWorkAccessMode(): WorkAccessMode;
-export declare function setWorkAccessMode(mode: WorkAccessMode): void;
+export declare function getWorkAccessMode(): Promise<WorkAccessMode>;
+export declare function setWorkAccessMode(mode: WorkAccessMode): Promise<void>;
 /**
  * Whether a user may use Work right now. Administrators always may; other
  * active accounts may when the mode is opened to all users.
@@ -11,5 +11,5 @@ export declare function setWorkAccessMode(mode: WorkAccessMode): void;
 export declare function userHasWorkAccess(user: {
     role?: string;
     status?: string;
-}): boolean;
+}): Promise<boolean>;
 //# sourceMappingURL=workAccessService.d.ts.map

package/backend/dist/services/workAccessService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workAccessService.d.ts","sourceRoot":"","sources":["../../src/services/workAccessService.ts"],"names":[],"mappings":"AA+BA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpD,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAGtD,CAAC;AAEF,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAKxE;AAED,wBAAgB,iBAAiB,IAAI,cAAc,CAKlD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAa5D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAIV"}
+{"version":3,"file":"workAccessService.d.ts","sourceRoot":"","sources":["../../src/services/workAccessService.ts"],"names":[],"mappings":"AA+BA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpD,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAGtD,CAAC;AAEF,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAKxE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGjE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3E;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,OAAO,CAAC,CAInB"}

package/backend/dist/services/workAccessService.js

@@ -25,7 +25,7 @@
  * Host-folder workspaces are NOT governed by this mode: they bind-mount
  * server paths and therefore stay admin-only regardless of the setting.
  */
-import { getDatabase } from '../db.js';
+import { getSystemSetting, setSystemSetting } from './systemSettingsService.js';
 export const WORK_ACCESS_MODES = [
     'admins',
     'all-users',
@@ -35,33 +35,25 @@ export function isWorkAccessMode(value) {
     return (typeof value === 'string' &&
         WORK_ACCESS_MODES.includes(value));
 }
-export function getWorkAccessMode() {
-    const row = getDatabase()
-        .prepare('SELECT value FROM system_settings WHERE key = ?')
-        .get(WORK_ACCESS_MODE_KEY);
-    return isWorkAccessMode(row?.value) ? row.value : 'admins';
+export async function getWorkAccessMode() {
+    const value = await getSystemSetting(WORK_ACCESS_MODE_KEY);
+    return isWorkAccessMode(value) ? value : 'admins';
 }
-export function setWorkAccessMode(mode) {
+export async function setWorkAccessMode(mode) {
     if (!isWorkAccessMode(mode)) {
         throw new Error(`Invalid Work access mode "${String(mode)}".`);
     }
-    getDatabase()
-        .prepare(`INSERT INTO system_settings (key, value, updated_at)
-       VALUES (?, ?, ?)
-       ON CONFLICT(key) DO UPDATE SET
-         value = excluded.value,
-         updated_at = excluded.updated_at`)
-        .run(WORK_ACCESS_MODE_KEY, mode, Date.now());
+    await setSystemSetting(WORK_ACCESS_MODE_KEY, mode);
 }
 /**
  * Whether a user may use Work right now. Administrators always may; other
  * active accounts may when the mode is opened to all users.
  */
-export function userHasWorkAccess(user) {
+export async function userHasWorkAccess(user) {
     if (user.status !== undefined && user.status !== 'active')
         return false;
     if (user.role === 'admin')
         return true;
-    return getWorkAccessMode() === 'all-users';
+    return (await getWorkAccessMode()) === 'all-users';
 }
 //# sourceMappingURL=workAccessService.js.map

package/backend/dist/services/workAccessService.js.map

@@ -1 +1 @@
-{"version":3,"file":"workAccessService.js","sourceRoot":"","sources":["../../src/services/workAccessService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAIvC,MAAM,CAAC,MAAM,iBAAiB,GAA8B;IAC1D,QAAQ;IACR,WAAW;CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,iBAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,WAAW,EAAE;SACtB,OAAO,CAAC,iDAAiD,CAAC;SAC1D,GAAG,CAAC,oBAAoB,CAAmC,CAAC;IAC/D,OAAO,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAoB;IACpD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,WAAW,EAAE;SACV,OAAO,CACN;;;;0CAIoC,CACrC;SACA,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAGjC;IACC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,iBAAiB,EAAE,KAAK,WAAW,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"workAccessService.js","sourceRoot":"","sources":["../../src/services/workAccessService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAIhF,MAAM,CAAC,MAAM,iBAAiB,GAA8B;IAC1D,QAAQ;IACR,WAAW;CACZ,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,iBAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;IAC3D,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAoB;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,gBAAgB,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAGvC;IACC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,CAAC,MAAM,iBAAiB,EAAE,CAAC,KAAK,WAAW,CAAC;AACrD,CAAC"}

package/backend/dist/services/workAdminService.d.ts

@@ -42,10 +42,10 @@ export interface WorkAdminOverview {
     }>;
 }
 interface WorkAdminDeps {
-    listTasksWithOwner: () => Array<{
+    listTasksWithOwner: () => Promise<Array<{
         record: WorkTaskRecord;
         ownerUsername: string;
-    }>;
+    }>>;
     listManaged: () => Promise<Array<{
         name: string;
         taskId: string;
@@ -60,7 +60,7 @@ interface WorkAdminDeps {
         maxPerUser: number;
     };
     recoveryPending: () => number;
-    accessMode: () => WorkAccessMode;
+    accessMode: () => Promise<WorkAccessMode> | WorkAccessMode;
 }
 export declare function buildWorkAdminOverview(deps?: WorkAdminDeps): Promise<WorkAdminOverview>;
 export {};

package/backend/dist/services/workAdminService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workAdminService.d.ts","sourceRoot":"","sources":["../../src/services/workAdminService.ts"],"names":[],"mappings":"AAiBA;;;;;;GAMG;AAEH,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAIhF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE;QACT,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,6DAA6D;IAC7D,gBAAgB,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC7E;AAED,UAAU,aAAa;IACrB,kBAAkB,EAAE,MAAM,KAAK,CAAC;QAC9B,MAAM,EAAE,cAAc,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IACH,WAAW,EAAE,MAAM,OAAO,CACxB,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAC1D,CAAC;IACF,kBAAkB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,wBAAwB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC9C,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;IACzC,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,eAAe,EAAE,MAAM,MAAM,CAAC;IAC9B,UAAU,EAAE,MAAM,cAAc,CAAC;CAClC;AAiBD,wBAAsB,sBAAsB,CAC1C,IAAI,GAAE,aAA2B,GAChC,OAAO,CAAC,iBAAiB,CAAC,CAoD5B"}
+{"version":3,"file":"workAdminService.d.ts","sourceRoot":"","sources":["../../src/services/workAdminService.ts"],"names":[],"mappings":"AAiBA;;;;;;GAMG;AAEH,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAIhF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE;QACT,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,6DAA6D;IAC7D,gBAAgB,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC7E;AAED,UAAU,aAAa;IACrB,kBAAkB,EAAE,MAAM,OAAO,CAC/B,KAAK,CAAC;QACJ,MAAM,EAAE,cAAc,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CACH,CAAC;IACF,WAAW,EAAE,MAAM,OAAO,CACxB,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAC1D,CAAC;IACF,kBAAkB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,wBAAwB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC9C,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;IACzC,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,eAAe,EAAE,MAAM,MAAM,CAAC;IAC9B,UAAU,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,cAAc,CAAC;CAC5D;AAiBD,wBAAsB,sBAAsB,CAC1C,IAAI,GAAE,aAA2B,GAChC,OAAO,CAAC,iBAAiB,CAAC,CAoD5B"}

package/backend/dist/services/workAdminService.js

@@ -28,8 +28,8 @@ import workTerminalService from './workTerminalService.js';
 const defaultDeps = {
     listTasksWithOwner: () => workTaskService.listAllTasksWithOwner(),
     listManaged: () => workRuntimeService.driver.listManaged(),
-    isRuntimeAvailable: () => workRuntimeService.isDockerAvailable(),
-    runtimeUnavailableReason: () => workRuntimeService.dockerUnavailableReason,
+    isRuntimeAvailable: () => workRuntimeService.isRuntimeAvailable(),
+    runtimeUnavailableReason: () => workRuntimeService.runtimeUnavailableReason,
     sessionCount: taskId => workTerminalService.sessionCount(taskId),
     activeGlobal: () => workRuntimeService.activeRuntimeCounts().global,
     limits: () => ({
@@ -40,7 +40,7 @@ const defaultDeps = {
     accessMode: () => getWorkAccessMode(),
 };
 export async function buildWorkAdminOverview(deps = defaultDeps) {
-    const tasks = deps.listTasksWithOwner();
+    const tasks = await deps.listTasksWithOwner();
     const runtimeAvailable = await deps.isRuntimeAvailable();
     // One labeled listing answers "what is actually running" for every task
     // at once. When the runtime is down the inventory is still useful, so
@@ -61,7 +61,7 @@ export async function buildWorkAdminOverview(deps = defaultDeps) {
     const limits = deps.limits();
     return {
         generatedAt: Date.now(),
-        accessMode: deps.accessMode(),
+        accessMode: await deps.accessMode(),
         runtimeAvailable,
         runtimeReason: runtimeAvailable
             ? undefined

package/backend/dist/services/workAdminService.js.map

@@ -1 +1 @@
-{"version":3,"file":"workAdminService.js","sourceRoot":"","sources":["../../src/services/workAdminService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAuB,MAAM,wBAAwB,CAAC;AAChF,OAAO,kBAAkB,MAAM,yBAAyB,CAAC;AACzD,OAAO,eAAe,MAAM,sBAAsB,CAAC;AACnD,OAAO,mBAAmB,MAAM,0BAA0B,CAAC;AAoD3D,MAAM,WAAW,GAAkB;IACjC,kBAAkB,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,qBAAqB,EAAE;IACjE,WAAW,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE;IAC1D,kBAAkB,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE;IAChE,wBAAwB,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,uBAAuB;IAC1E,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,YAAY,CAAC,MAAM,CAAC;IAChE,YAAY,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,mBAAmB,EAAE,CAAC,MAAM;IACnE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACb,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC,uBAAuB;QAC5D,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,wBAAwB;KAC/D,CAAC;IACF,eAAe,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,oBAAoB;IAC9D,UAAU,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE;CACtC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAI,GAAkB,WAAW;IAEjC,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;IACxC,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAEzD,wEAAwE;IACxE,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,OAAO,GAA8D,EAAE,CAAC;IAC5E,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CACpD,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC7B,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;QAC7B,gBAAgB;QAChB,aAAa,EAAE,gBAAgB;YAC7B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,IAAI,SAAS,CAAC;QAClD,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;QACvC,SAAS,EAAE;YACT,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;YACjC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B;QACD,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/C,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,aAAa;YACb,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YACtE,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"workAdminService.js","sourceRoot":"","sources":["../../src/services/workAdminService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAuB,MAAM,wBAAwB,CAAC;AAChF,OAAO,kBAAkB,MAAM,yBAAyB,CAAC;AACzD,OAAO,eAAe,MAAM,sBAAsB,CAAC;AACnD,OAAO,mBAAmB,MAAM,0BAA0B,CAAC;AAsD3D,MAAM,WAAW,GAAkB;IACjC,kBAAkB,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,qBAAqB,EAAE;IACjE,WAAW,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE;IAC1D,kBAAkB,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,kBAAkB,EAAE;IACjE,wBAAwB,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,wBAAwB;IAC3E,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,YAAY,CAAC,MAAM,CAAC;IAChE,YAAY,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,mBAAmB,EAAE,CAAC,MAAM;IACnE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACb,SAAS,EAAE,kBAAkB,CAAC,MAAM,CAAC,uBAAuB;QAC5D,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,wBAAwB;KAC/D,CAAC;IACF,eAAe,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,oBAAoB;IAC9D,UAAU,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE;CACtC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAI,GAAkB,WAAW;IAEjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC9C,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAEzD,wEAAwE;IACxE,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,OAAO,GAA8D,EAAE,CAAC;IAC5E,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CACpD,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC7B,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;QACvB,UAAU,EAAE,MAAM,IAAI,CAAC,UAAU,EAAE;QACnC,gBAAgB;QAChB,aAAa,EAAE,gBAAgB;YAC7B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,IAAI,SAAS,CAAC;QAClD,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;QACvC,SAAS,EAAE;YACT,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;YACjC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B;QACD,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/C,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,aAAa;YACb,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YACtE,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC"}

package/backend/dist/services/workAgentService.d.ts

@@ -7,16 +7,40 @@ export declare const WORK_WEB_SEARCH_TOOL_SCHEMA: Record<string, unknown>;
 export declare function workToolSchemasForTask(task: {
     networkEnabled: boolean;
     userId: string;
-}): Record<string, unknown>[];
+}): Promise<Record<string, unknown>[]>;
 export declare class WorkAgentService {
     private controllers;
     private executions;
     start(taskId: string, runId: string, userId: string): void;
+    /**
+     * Durable worker entrypoint. An interrupted active run is moved back to the
+     * queue while its persisted provider/tool transcript is retained. Missing
+     * tool results are restored as "outcome unknown", so the exact external
+     * call is not blindly replayed after a worker crash.
+     */
+    executeDurable(taskId: string, runId: string, userId: string): Promise<void>;
+    /**
+     * Materialize every tool intent whose worker disappeared before its result
+     * commit. This must run while the caller owns the durable job lease. The
+     * persisted result is both user-visible and part of the next model request;
+     * checking the transcript first makes a crash after the insert safe to
+     * reclaim without duplicating the result.
+     */
+    reconcileInterruptedToolCalls(taskId: string, runId: string): Promise<number>;
     cancel(taskId: string, userId: string): Promise<WorkTaskDetail>;
     removeTask(taskId: string, userId: string): Promise<void>;
     private cancelTask;
     removeTasksForUser(userId: string): Promise<void>;
+    /**
+     * Persist a cross-replica account fence before deleting external state.
+     * A failed drain deliberately leaves the account `retiring`, so a retry can
+     * continue while authentication and all new Work admission stay denied.
+     */
+    retireAndDeleteUser(userId: string, actorUserId: string): Promise<boolean>;
+    private removeTasksWithRetirementHeld;
+    private drainDurableJobsForUser;
     revokeWorkAccessForUser<T>(userId: string, revoke: () => Promise<T>): Promise<T>;
+    private revokeWorkAccessWithLeaseHeld;
     releaseUserRetirement(userId: string): void;
     private removeTaskInternal;
     shutdown(): Promise<{

package/backend/dist/services/workAgentService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workAgentService.d.ts","sourceRoot":"","sources":["../../src/services/workAgentService.ts"],"names":[],"mappings":"AA0CA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EACL,WAAW,EACX,OAAO,EACP,cAAc,EAEd,YAAY,EACb,MAAM,kBAAkB,CAAC;AAU1B,eAAO,MAAM,gCAAgC,sBAAsB,CAAC;AACpE,eAAO,MAAM,sCAAsC,uBAAuB,CAAC;AAS3E,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EA8EtD,CAAC;AAKF,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAa7D,CAAC;AAEJ,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAM5B;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,UAAU,CAAoC;IAEtD,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAazD;IAEK,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAGpE;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;YAEa,UAAU;IA2BlB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtD;IAEK,uBAAuB,CAAC,CAAC,EAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACvB,OAAO,CAAC,CAAC,CAAC,CAmEZ;IAED,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAE1C;YAEa,kBAAkB;IA2B1B,QAAQ,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAc7D;YAEa,OAAO;YAimBP,yBAAyB;IA6BvC,OAAO,CAAC,2BAA2B;IAsBnC,OAAO,CAAC,eAAe;YA0BT,WAAW;IAiJzB,OAAO,CAAC,gBAAgB;CAYzB;AA+CD,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAKxD;CACF;AAsJD,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,WAAW,EAAE,EACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,YAAY,GAAG,OAAO,CAAC,EAChE,kBAAkB,CAAC,EAAE,MAAM,GAC1B,iBAAiB,EAAE,CAwLrB;AA4ED,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,kBAAkB,GAC3B,YAAY,EAAE,CA+GhB;AA4LD,eAAO,MAAM,gBAAgB,kBAAyB,CAAC;eACxC,gBAAgB"}
+{"version":3,"file":"workAgentService.d.ts","sourceRoot":"","sources":["../../src/services/workAgentService.ts"],"names":[],"mappings":"AA0CA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EACL,WAAW,EACX,OAAO,EACP,cAAc,EAEd,YAAY,EACb,MAAM,kBAAkB,CAAC;AAe1B,eAAO,MAAM,gCAAgC,sBAAsB,CAAC;AACpE,eAAO,MAAM,sCAAsC,uBAAuB,CAAC;AAW3E,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EA8EtD,CAAC;AAKF,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAa7D,CAAC;AAEJ,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAMrC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,UAAU,CAAoC;IAEtD,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAazD;IAED;;;;;OAKG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAyBf;IAED;;;;;;OAMG;IACG,6BAA6B,CACjC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAsEjB;IAEK,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAGpE;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;YAEa,UAAU;IAiClB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAStD;IAED;;;;OAIG;IACG,mBAAmB,CACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAkBlB;YAEa,6BAA6B;YAW7B,uBAAuB;IA6C/B,uBAAuB,CAAC,CAAC,EAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACvB,OAAO,CAAC,CAAC,CAAC,CAIZ;YAEa,6BAA6B;IAqF3C,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAE1C;YAEa,kBAAkB;IA2B1B,QAAQ,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAc7D;YAEa,OAAO;YAktBP,yBAAyB;YA6BzB,2BAA2B;YAuB3B,eAAe;YA0Bf,WAAW;YAsJX,gBAAgB;CAe/B;AAuDD,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAKxD;CACF;AAsJD,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,WAAW,EAAE,EACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,YAAY,GAAG,OAAO,CAAC,EAChE,kBAAkB,CAAC,EAAE,MAAM,GAC1B,iBAAiB,EAAE,CAuLrB;AA4ED,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,kBAAkB,GAC3B,YAAY,EAAE,CA+GhB;AA4LD,eAAO,MAAM,gBAAgB,kBAAyB,CAAC;eACxC,gBAAgB"}