okengine 0.1.4

package/src/console/server/security.gate.test.ts

@@ -0,0 +1,286 @@
+/**
+ * Console whole-surface security gates (console §10).
+ *
+ * Walks the live `console.*` flow registry rather than hand-picked samples so
+ * an 18th panel's flows are covered automatically.
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { issueSession } from "../../auth/index.ts";
+import { PII_MASK } from "../../elements/store/classify.ts";
+import type { Binding } from "../../kernel/index.ts";
+import type { Manifest } from "../../manifest/types.ts";
+import type { WideEvent } from "../../runs/types.ts";
+import type { ConsoleAppHandle } from "./app.ts";
+import { AUTH_RATE_LIMIT } from "./auth-rate.ts";
+import { projectRun } from "./flows.ts";
+import {
+  maskWideEventForConsole,
+  piiFieldNamesFromManifest,
+} from "./runs-pii.ts";
+import { startConsoleApp } from "./serve.ts";
+
+/** Deduplicate console.* flows from the live binding registry. */
+function consoleFlows(handle: ConsoleAppHandle) {
+  const byName = new Map<
+    string,
+    { readonly name: string; readonly plane: string | undefined }
+  >();
+  for (const binding of handle.app.bindings) {
+    const name = binding.flow.name;
+    if (!name.startsWith("console.")) continue;
+    byName.set(name, { name, plane: binding.flow.plane });
+  }
+  return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+
+const PII_MANIFEST = {
+  oke: "1.0" as const,
+  app: "security-gate",
+  stores: {
+    db: {
+      facet: "sql" as const,
+      tables: {
+        bookings: {
+          columns: { email: { pii: true }, id: {} },
+        },
+      },
+    },
+  },
+} satisfies Manifest;
+
+describe("console security gates (whole surface)", () => {
+  let cwd: string;
+  let handle: ConsoleAppHandle;
+  let operatorToken: string;
+  let operatorId: string;
+
+  beforeAll(async () => {
+    cwd = await mkdtemp(join(tmpdir(), "oke-console-sec-"));
+    handle = await startConsoleApp({
+      cwd,
+      secret: "test-secret-security-gate",
+      silentClaim: true,
+      manifest: PII_MANIFEST,
+    });
+
+    const claimRes = await handle.app.fetch(
+      new Request("http://console.test/console/setup/claim", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          claimCode: handle.state.claim.code,
+          email: "ops@example.com",
+          name: "Ops",
+          password: "password123",
+        }),
+      }),
+    );
+    expect(claimRes.status).toBe(200);
+    const claimBody = (await claimRes.json()) as {
+      data: { accessToken: string; operatorId: string };
+    };
+    operatorToken = claimBody.data.accessToken;
+    operatorId = claimBody.data.operatorId;
+  });
+
+  afterAll(async () => {
+    await handle.app.stop();
+  });
+
+  test("1. every registered console.* flow is plane:operator and rejects a user principal", async () => {
+    const flows = consoleFlows(handle);
+    expect(flows.length).toBeGreaterThan(20);
+
+    for (const flow of flows) {
+      expect(flow.plane).toBe("operator");
+    }
+
+    // HTTP compilers validate the body before the pipeline; walk execute()
+    // so beforeHandle (plane check) runs with a user principal regardless of
+    // each flow's input schema — same Forbidden the HTTP path returns once
+    // the body is well-formed (proven for ping in console.test.ts).
+    const failures: string[] = [];
+    for (const binding of handle.app.bindings) {
+      if (!binding.flow.name.startsWith("console.")) continue;
+      const result = await handle.app.execute(
+        binding.flow,
+        {},
+        binding.trigger,
+        {
+          validated: true,
+          principal: {
+            plane: "user",
+            userId: "user-plane-1",
+            scopes: ["bookings:create"],
+          },
+        },
+      );
+      const code = result.failure?.error?.code;
+      if (code !== "Forbidden") {
+        failures.push(`${binding.flow.name} → ${code ?? "no-failure"}`);
+      }
+    }
+    expect(failures).toEqual([]);
+
+    // Spot-check the HTTP path still returns 403 Forbidden for a valid body.
+    const userSession = await issueSession(
+      handle.state.sessions,
+      { secret: handle.state.secret, now: handle.state.now },
+      {
+        id: "user-plane-http",
+        plane: "user",
+        scopes: ["bookings:create"],
+      },
+    );
+    const httpRes = await handle.app.fetch(
+      new Request("http://console.test/console/action/ping", {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          authorization: `Bearer ${userSession.accessToken}`,
+        },
+        body: JSON.stringify({ note: "escalate" }),
+      }),
+    );
+    expect(httpRes.status).toBe(403);
+    const httpBody = (await httpRes.json()) as { error: { code: string } };
+    expect(httpBody.error.code).toBe("Forbidden");
+  });
+
+  test("5. PII-classified fields are masked on the shared Runs projection", () => {
+    const pii = piiFieldNamesFromManifest(handle.state.manifest);
+    expect(pii.has("email")).toBe(true);
+
+    const event = {
+      id: "run-pii-1",
+      flow: "bookings.create",
+      trigger: "http",
+      plane: "user",
+      tenant: null,
+      principal: "user-1",
+      gates: [],
+      cache: "none",
+      error: null,
+      effects: [],
+      logs: [
+        {
+          level: "info",
+          message: "created",
+          data: { email: "leak@example.com", id: "b1" },
+          at: 1,
+        },
+      ],
+      durationMs: 1,
+      startedAt: 1,
+      endedAt: 2,
+      dimensions: {
+        flow: "bookings.create",
+        email: "leak@example.com",
+        id: "b1",
+      },
+    } as unknown as WideEvent;
+
+    const masked = maskWideEventForConsole(event, pii);
+    expect(masked.dimensions.email).toBe(PII_MASK);
+    expect(masked.dimensions.id).toBe("b1");
+    expect(masked.logs[0]?.data?.email).toBe(PII_MASK);
+    expect(masked.logs[0]?.data?.id).toBe("b1");
+
+    const projected = projectRun(event, pii);
+    expect(projected.dimensions.email).toBe(PII_MASK);
+    expect(projected.logs[0]?.data?.email).toBe(PII_MASK);
+  });
+
+  test("7. every registered console.* flow leaves a Runs entry when executed", async () => {
+    const flows = consoleFlows(handle);
+    const before = new Set(
+      (await handle.state.listRuns()).map((r: WideEvent) => r.flow),
+    );
+
+    for (const flowMeta of flows) {
+      if (before.has(flowMeta.name)) continue;
+      const binding = handle.app.bindings.find(
+        (b: Binding) => b.flow.name === flowMeta.name,
+      );
+      expect(binding).toBeDefined();
+      try {
+        await handle.app.execute(
+          binding!.flow,
+          {},
+          binding!.trigger,
+          {
+            validated: true,
+            principal: {
+              plane: "operator",
+              operatorId,
+            },
+          },
+        );
+      } catch {
+        // Handler throws still record a wide event (pipeline catches).
+      }
+    }
+
+    const after = await handle.state.listRuns();
+    const names = new Set(after.map((r: WideEvent) => r.flow));
+    const missing = flows
+      .map((f) => f.name)
+      .filter((name) => !names.has(name));
+    expect(missing).toEqual([]);
+  });
+
+  test("8. operator login is rate-limited (5 / 60s) like setup-claim", async () => {
+    for (let i = 0; i < AUTH_RATE_LIMIT; i++) {
+      const res = await handle.app.fetch(
+        new Request("http://console.test/console/session/login", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            email: "ops@example.com",
+            password: "wrong-password",
+          }),
+        }),
+      );
+      expect(res.status).toBe(400);
+      const body = (await res.json()) as { error: { code: string } };
+      expect(body.error.code).toBe("AuthFailed");
+    }
+
+    const limited = await handle.app.fetch(
+      new Request("http://console.test/console/session/login", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          email: "ops@example.com",
+          password: "password123",
+        }),
+      }),
+    );
+    expect(limited.status).toBe(400);
+    const limitedBody = (await limited.json()) as {
+      error: { code: string };
+    };
+    expect(limitedBody.error.code).toBe("AuthRateLimited");
+
+    // Sanity: a different email still authenticates under its own bucket.
+    // (No second operator — AuthFailed, not rate-limited.)
+    const other = await handle.app.fetch(
+      new Request("http://console.test/console/session/login", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          email: "other@example.com",
+          password: "password123",
+        }),
+      }),
+    );
+    const otherBody = (await other.json()) as { error: { code: string } };
+    expect(otherBody.error.code).toBe("AuthFailed");
+
+    void operatorToken;
+  });
+});

package/src/console/server/serve.ts

@@ -0,0 +1,319 @@
+/**
+ * Serve the Console on port 6533 — SPA + operator flows + live channel.
+ *
+ * Host/Origin validation is mandatory (console §10.1). Security headers and
+ * SameSite=Strict cookies are applied from the first response.
+ */
+
+import {
+  checkRequestSecurity,
+  forbiddenResponse,
+  resolveAllowedHosts,
+  secureFetch,
+} from "../../runtime/security.ts";
+import { CONSOLE_PORT, type ServerHandle } from "../../runtime/types.ts";
+import {
+  bindManifestSignalBus,
+  bindManifestStoreRuntime,
+  bindManifestVaultRuntime,
+  bootConsoleApp,
+  createConsoleApp,
+  type ConsoleAppHandle,
+  type CreateConsoleAppOptions,
+} from "./app.ts";
+import { createLiveWebsocket, type ConsoleLiveData } from "./live.ts";
+import {
+  CONSOLE_COOKIES,
+  consoleSessionCookie,
+  withConsoleSecurityHeaders,
+} from "./security-headers.ts";
+
+/** Options for {@link serveConsole}. */
+export interface ServeConsoleOptions extends CreateConsoleAppOptions {
+  readonly port?: number;
+  readonly hostname?: string;
+  readonly allowedHosts?: readonly string[];
+  /** Directory of prebuilt SPA assets (Vite outDir). */
+  readonly staticDir?: string;
+  /** Boot environment — use `"dev"` / `"prod"` so Bearer auth is production-like. */
+  readonly env?: "dev" | "prod" | "test";
+}
+
+/** Running Console server handle. */
+export interface ConsoleServerHandle extends ServerHandle {
+  readonly console: ConsoleAppHandle;
+}
+
+/**
+ * Boot and serve the Console kernel.
+ *
+ * @param options - Port, static dir, claim options
+ */
+export async function serveConsole(
+  options: ServeConsoleOptions = {},
+): Promise<ConsoleServerHandle> {
+  const hostname = options.hostname ?? "127.0.0.1";
+  const port = options.port ?? CONSOLE_PORT;
+  const handle = createConsoleApp({
+    ...options,
+    silentClaim: options.silentClaim ?? false,
+  });
+
+  const env = options.env ?? "dev";
+  await handle.app.boot({ env });
+  handle.state.listRuns = async () => {
+    const runs = handle.app.bootResult?.runs;
+    if (!runs) return [];
+    return runs.all();
+  };
+  await bindManifestSignalBus(handle.state);
+  await bindManifestStoreRuntime(handle.state);
+  await bindManifestVaultRuntime(handle.state);
+
+  const staticDir =
+    options.staticDir ?? new URL("../ui/dist/", import.meta.url).pathname;
+
+  const live = createLiveWebsocket(handle.state);
+  const allowed = resolveAllowedHosts(hostname, options.allowedHosts);
+
+  const appFetch = async (request: Request): Promise<Response> => {
+    const url = new URL(request.url);
+
+    if (url.pathname === "/console/live") {
+      return withConsoleSecurityHeaders(
+        new Response("Expected WebSocket upgrade", { status: 426 }),
+      );
+    }
+
+    const authed = withCookieAuth(request);
+
+    if (url.pathname.startsWith("/console/")) {
+      const response = await handle.app.fetch(authed);
+      const withCookies = await attachSessionCookies(authed, response);
+      return withConsoleSecurityHeaders(withCookies);
+    }
+
+    if (url.pathname.startsWith("/plugin-frame/")) {
+      return withConsoleSecurityHeaders(pluginFrameResponse(url.pathname));
+    }
+
+    const staticResponse = await serveStatic(staticDir, url.pathname);
+    if (staticResponse) {
+      return withConsoleSecurityHeaders(staticResponse);
+    }
+
+    const index = Bun.file(`${staticDir}index.html`);
+    if (await index.exists()) {
+      return withConsoleSecurityHeaders(
+        new Response(index, {
+          headers: { "Content-Type": "text/html; charset=utf-8" },
+        }),
+      );
+    }
+
+    return withConsoleSecurityHeaders(
+      new Response(fallbackShellHtml(), {
+        headers: { "Content-Type": "text/html; charset=utf-8" },
+      }),
+    );
+  };
+
+  const fetchHandler = secureFetch(appFetch, options, hostname);
+
+  const server = Bun.serve<ConsoleLiveData>({
+    port,
+    hostname,
+    fetch(req, srv) {
+      const url = new URL(req.url);
+      if (url.pathname === "/console/live") {
+        const check = checkRequestSecurity(req, allowed);
+        if (!check.ok) return forbiddenResponse(check.reason);
+        const upgraded = srv.upgrade(req, { data: { kind: "console-live" } });
+        if (upgraded) return undefined as unknown as Response;
+        return withConsoleSecurityHeaders(
+          new Response("WebSocket upgrade failed", { status: 400 }),
+        );
+      }
+      return fetchHandler(req);
+    },
+    websocket: {
+      open: live.open,
+      message: live.message,
+      close: live.close,
+    },
+  });
+
+  const boundPort = server.port ?? port;
+  const boundHost = server.hostname ?? hostname;
+  const hostForUrl =
+    boundHost.includes(":") && !boundHost.startsWith("[")
+      ? `[${boundHost}]`
+      : boundHost;
+  const url = new URL(`http://${hostForUrl}:${boundPort}/`);
+
+  return {
+    console: handle,
+    url,
+    port: boundPort,
+    hostname: boundHost,
+    fetch: fetchHandler,
+    stop(closeActive = false) {
+      server.stop(closeActive);
+      void handle.app.stop();
+    },
+  };
+}
+
+/**
+ * Create + boot without listening (unit tests).
+ *
+ * @param options - Console options
+ */
+export async function startConsoleApp(
+  options: CreateConsoleAppOptions & {
+    readonly env?: "dev" | "prod" | "test";
+  } = {},
+): Promise<ConsoleAppHandle> {
+  const handle = createConsoleApp({
+    ...options,
+    silentClaim: options.silentClaim ?? true,
+  });
+  await bootConsoleApp(handle);
+  return handle;
+}
+
+/**
+ * Promote session cookie → Authorization when Bearer is absent.
+ *
+ * @param request - Incoming request
+ */
+export function withCookieAuth(request: Request): Request {
+  if (request.headers.get("authorization")?.startsWith("Bearer ")) {
+    return request;
+  }
+  const cookie = request.headers.get("cookie") ?? "";
+  const match = cookie.match(
+    new RegExp(`(?:^|;\\s*)${CONSOLE_COOKIES.access}=([^;]+)`),
+  );
+  if (!match?.[1]) return request;
+  const token = decodeURIComponent(match[1]);
+  const headers = new Headers(request.headers);
+  headers.set("Authorization", `Bearer ${token}`);
+  return new Request(request, { headers });
+}
+
+/**
+ * After successful claim/login, mirror tokens into SameSite=Strict cookies.
+ *
+ * @param request - Request
+ * @param response - Flow response
+ */
+export async function attachSessionCookies(
+  request: Request,
+  response: Response,
+): Promise<Response> {
+  if (response.status >= 400) return response;
+  const url = new URL(request.url);
+  const isSessionIssue =
+    url.pathname === "/console/setup/claim" ||
+    url.pathname === "/console/session/login";
+  const isLogout = url.pathname === "/console/session/logout";
+  if (!isSessionIssue && !isLogout) return response;
+
+  let body: {
+    data?: { accessToken?: string; refreshToken?: string };
+  };
+  try {
+    body = (await response.clone().json()) as typeof body;
+  } catch {
+    return response;
+  }
+
+  const headers = new Headers(response.headers);
+  if (isLogout) {
+    headers.append(
+      "Set-Cookie",
+      consoleSessionCookie(CONSOLE_COOKIES.access, "", { clear: true }),
+    );
+    headers.append(
+      "Set-Cookie",
+      consoleSessionCookie(CONSOLE_COOKIES.refresh, "", { clear: true }),
+    );
+  } else if (body.data?.accessToken && body.data?.refreshToken) {
+    headers.append(
+      "Set-Cookie",
+      consoleSessionCookie(CONSOLE_COOKIES.access, body.data.accessToken, {
+        maxAgeSec: 14 * 60,
+      }),
+    );
+    headers.append(
+      "Set-Cookie",
+      consoleSessionCookie(CONSOLE_COOKIES.refresh, body.data.refreshToken, {
+        maxAgeSec: 30 * 24 * 60 * 60,
+      }),
+    );
+  }
+  return new Response(JSON.stringify(body), {
+    status: response.status,
+    headers,
+  });
+}
+
+async function serveStatic(
+  staticDir: string,
+  pathname: string,
+): Promise<Response | null> {
+  if (pathname.includes("..")) return null;
+  const path = pathname === "/" ? "index.html" : pathname.replace(/^\//, "");
+  const file = Bun.file(`${staticDir}${path}`);
+  if (!(await file.exists())) return null;
+  return new Response(file);
+}
+
+function pluginFrameResponse(pathname: string): Response {
+  const id = pathname
+    .slice("/plugin-frame/".length)
+    .replace(/[^a-z0-9_-]/gi, "");
+  const html = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'self'"/>
+<title>Plugin ${id}</title>
+</head>
+<body>
+<script type="module">
+const id = ${JSON.stringify(id)};
+window.parent.postMessage({ type: "oke-plugin-ready", id }, location.origin);
+window.addEventListener("message", (ev) => {
+  if (ev.origin !== location.origin) return;
+  if (ev.data?.type === "oke-plugin-rpc") {
+    window.parent.postMessage({ type: "oke-plugin-rpc-result", id, ok: false, error: "sandbox" }, location.origin);
+  }
+});
+</script>
+</body>
+</html>`;
+  return new Response(html, {
+    headers: { "Content-Type": "text/html; charset=utf-8" },
+  });
+}
+
+function fallbackShellHtml(): string {
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8"/>
+<meta name="viewport" content="width=device-width, initial-scale=1"/>
+<title>oke Console</title>
+</head>
+<body>
+<div id="root">
+  <main>
+    <h1>oke Console</h1>
+    <p>Shell assets not built — run the Console UI build, or use the API on <code>/console/*</code>.</p>
+  </main>
+</div>
+</body>
+</html>`;
+}

package/src/console/server/signals.test.ts

@@ -0,0 +1,88 @@
+import { describe, expect, test } from "bun:test";
+import { memorySignalDriver } from "../../drivers/signal-memory.ts";
+import { signal } from "../../elements/signal/declare.ts";
+import {
+  createMemorySignalConfigStore,
+} from "../../elements/signal/reconcile.ts";
+import { createSignalRuntime } from "../../elements/signal/runtime.ts";
+import type { Manifest } from "../../manifest/types.ts";
+import { projectSignalsList } from "./signals.ts";
+
+const MANIFEST: Manifest = {
+  oke: "1.0",
+  app: "signals-console-test",
+  flows: {
+    "bookings.create": {
+      trigger: { http: { method: "POST", path: "/bookings" } },
+      effects: { emits: ["order-placed"] },
+    },
+    "fulfillment.onOrder": {
+      trigger: { signal: "order-placed" },
+      durable: true,
+      effects: { writes: ["sql:shipments"] },
+    },
+  },
+  signals: {
+    "order-placed": { delivery: "once", retries: 3, deadLetter: true },
+  },
+};
+
+describe("projectSignalsList", () => {
+  test("reads bus stats and surfaces durable consumers from Manifest", async () => {
+    const runtime = createSignalRuntime({ driver: memorySignalDriver });
+    const decl = signal("order-placed", {
+      delivery: "once",
+      retries: 3,
+      deadLetter: true,
+    });
+    runtime.register(decl);
+    const bus = await runtime.start();
+    await bus.subscribe("order-placed", "oke:fulfillment", async () => {
+      const err = new Error("card declined");
+      (err as Error & { code: string }).code = "PaymentDeclined";
+      throw err;
+    });
+    await bus.emit("order-placed", { orderId: "o1" });
+    await bus.drain();
+    await bus.drain();
+    await bus.drain();
+    await bus.drain();
+
+    const config = createMemorySignalConfigStore([
+      {
+        name: "legacy-shipped",
+        delivery: "once",
+        retries: 3,
+        deadLetter: true,
+        status: "orphaned",
+      },
+    ]);
+
+    const rows = await projectSignalsList({
+      manifest: MANIFEST,
+      config,
+      bus,
+    });
+
+    const order = rows.find((r) => r.name === "order-placed");
+    expect(order).toBeDefined();
+    expect(order!.dead).toBeGreaterThan(0);
+    expect(order!.consumersDurable).toBe(true);
+    expect(order!.consumers[0]?.flowId).toBe("fulfillment.onOrder");
+    expect(order!.producers[0]?.flowId).toBe("bookings.create");
+
+    const orphan = rows.find((r) => r.name === "legacy-shipped");
+    expect(orphan?.orphaned).toBe(true);
+
+    const dry = await bus.replay({
+      signal: "order-placed",
+      ratePerSec: 100,
+      dryRun: true,
+    });
+    expect(dry.dryRun).toBe(true);
+    expect(dry.attempted).toBeGreaterThan(0);
+    expect(dry.wouldHaveFired).toEqual([]);
+
+    await runtime.close();
+  });
+});