okengine 0.14.1 → 0.16.0

package/src/console/server/gates.test.ts

@@ -78,6 +78,14 @@ async function liveRuntime(): Promise<{
   };
 }
 
+describe("createDefaultGateAuthStores", () => {
+  test("user roles grant member only — no leftover app catalog", () => {
+    const auth = createDefaultGateAuthStores();
+    expect([...(auth.roles.grants.get("role_member") ?? [])]).toEqual(["member"]);
+    expect([...(auth.roles.grants.get("role_staff") ?? [])]).toEqual(["member"]);
+  });
+});
+
 describe("isApplicationScope", () => {
   test("console:* is not application; everything else is", () => {
     expect(isApplicationScope("console:store.sql:write")).toBe(false);
@@ -91,6 +99,21 @@ describe("projectGatesPanel", () => {
     const auth = createDefaultGateAuthStores();
     // Poison an operator role with an application scope.
     setRoleGrants(auth.roles, "role_ops", ["console:store.sql:read", "booking:create"]);
+    auth.apiKeys.keys.set("key_fixture", {
+      id: "key_fixture",
+      plane: "user",
+      hash: "fixture",
+      name: "Fixture",
+      scopes: ["member"],
+      expiresAt: null,
+      rateLimit: null,
+      ipAllowlist: [],
+      creatorId: "user_demo",
+      creatorScopes: ["member"],
+      createdAt: 0,
+      lastUsedAt: null,
+      revokedAt: null,
+    });
 
     const projection = projectGatesPanel({
       manifest: MANIFEST,
@@ -318,6 +341,7 @@ describe("simulateGates — evaluate only", () => {
   test("role principal resolves scopes from RoleStore", async () => {
     const { runtime, close } = await liveRuntime();
     const auth = createDefaultGateAuthStores();
+    setRoleGrants(auth.roles, "role_member", ["member", "booking:create"]);
     try {
       const ok = await simulateGates({
         flowId: "bookings.create",

package/src/console/server/gates.ts

@@ -33,6 +33,7 @@ import { statusForFailure } from "../../compiler/response.ts";
 import { gateDenialFailure } from "../../kernel/index.ts";
 import { diffManifest } from "../../manifest/diff.ts";
 import type { Gate as ManifestGate, Manifest, ManifestChange } from "../../manifest/types.ts";
+import { defaultMemberIdentityIds } from "./dev-identities.ts";
 
 /** Identity slice needed for Gates (avoids circular import with state). */
 export interface GatesIdentity {
@@ -413,8 +414,8 @@ export function createDefaultGateAuthStores(): {
     plane: "operator",
     description: "Console operators",
   });
-  setRoleGrants(roles, "role_member", ["member", "booking:create"]);
-  setRoleGrants(roles, "role_staff", ["member", "booking:create", "staff", "reports:export"]);
+  setRoleGrants(roles, "role_member", ["member"]);
+  setRoleGrants(roles, "role_staff", ["member"]);
   setRoleGrants(roles, "role_ops", [
     "console:store.sql:read",
     "console:store.sql:write",
@@ -422,24 +423,9 @@ export function createDefaultGateAuthStores(): {
   ]);
 
   const apiKeys = createApiKeyStore();
-  apiKeys.keys.set("key_demo", {
-    id: "key_demo",
-    plane: "user",
-    hash: "demo",
-    name: "Demo key",
-    scopes: ["member", "booking:create"],
-    expiresAt: null,
-    rateLimit: null,
-    ipAllowlist: [],
-    creatorId: "user_demo",
-    creatorScopes: ["member", "booking:create"],
-    createdAt: 0,
-    lastUsedAt: null,
-    revokedAt: null,
-  });
 
   const roleMembers = new Map<string, string[]>([
-    ["role_member", ["user_demo", "user_member"]],
+    ["role_member", defaultMemberIdentityIds()],
     ["role_staff", []],
     ["role_ops", []],
   ]);
@@ -706,7 +692,7 @@ function resolvePrincipalContext(options: SimulateGatesOptions): {
     return {
       ctx: {
         auth: { userId: null, scopes: new Set(), verified: false },
-        operator: { id: `key:${id}` },
+        operator: { id: key.creatorId },
         meta: { ip: options.meta?.ip },
       },
     };
@@ -714,12 +700,13 @@ function resolvePrincipalContext(options: SimulateGatesOptions): {
   return {
     ctx: {
       auth: {
-        userId: `key:${id}`,
+        userId: key.creatorId,
         scopes: new Set(key.scopes),
         verified: true,
+        apiKeyId: key.id,
       },
       operator: { id: null },
-      meta: { ip: options.meta?.ip, userId: `key:${id}` },
+      meta: { ip: options.meta?.ip, userId: key.creatorId },
     },
   };
 }

package/src/console/server/index.ts

@@ -6,6 +6,7 @@ export {
   accessCreateKey,
   accessRevokeKey,
   accessRotateKey,
+  accessUpdateKey,
   accessSetRoleGrants,
   effectivePermissions,
   expandAccessCeiling,

package/src/console/server/invoke-user-flow.test.ts

@@ -181,7 +181,9 @@ describe("resolveInvokeAs", () => {
     const resolved = resolveInvokeAs({ asGate: "member" }, IDENTITIES, MANIFEST);
     expect(resolved.ok).toBe(true);
     if (!resolved.ok) return;
-    expect(resolved.asUserId).toBe("gate:member");
+    expect(resolved.asUserId).toBe("");
+    expect(resolved.principal.userId).toBe("");
+    expect(resolved.rls).toEqual({ gate: "member", userId: "", scopes: ["member"] });
     expect([...resolved.principal.scopes]).toEqual(["member"]);
     expect(resolved.principal.verified).toBe(true);
   });

package/src/console/server/invoke-user-flow.ts

@@ -14,6 +14,8 @@ import type { AnyFlowDef } from "../../kernel/flow.ts";
 import { isJsonResult } from "../../kernel/fx.ts";
 import { isFlowFailure } from "../../kernel/hooks.ts";
 import type { Trigger } from "../../kernel/triggers.ts";
+import type { RlsIdentity } from "../../drivers/pg-rls.ts";
+import { resolveRlsIdentity } from "../../elements/store.ts";
 import type { Manifest } from "../../manifest/types.ts";
 import type { ConsoleIdentity } from "./state.ts";
 
@@ -32,6 +34,8 @@ export interface InvokeUserFlowInput {
    * Envelope remask is skipped separately when this is true.
    */
   readonly revealPii?: boolean;
+  /** Same bag as SQL console / browse — stamped onto host `fx.store`. */
+  readonly rls?: RlsIdentity;
 }
 
 /** Resolved Call API invoke-as principal. */
@@ -42,6 +46,7 @@ export type ResolvedInvokeAs =
       readonly asUserId: string;
       readonly asGate: string | null;
       readonly bypassGates: boolean;
+      readonly rls: RlsIdentity | null;
     }
   | { readonly ok: false; readonly reason: string };
 
@@ -75,6 +80,12 @@ export function resolveInvokeAs(
       asUserId: identity.id,
       asGate: asGate ?? null,
       bypassGates: false,
+      rls: resolveRlsIdentity({
+        asUserId: identity.id,
+        asGate: asGate ?? null,
+        identities,
+        manifest,
+      }),
     };
   }
 
@@ -89,6 +100,7 @@ export function resolveInvokeAs(
       asUserId: "console:operator",
       asGate: null,
       bypassGates: true,
+      rls: null,
     };
   }
 
@@ -103,6 +115,7 @@ export function resolveInvokeAs(
       asUserId: "public",
       asGate: "public",
       bypassGates: false,
+      rls: resolveRlsIdentity({ asGate: "public", manifest }),
     };
   }
 
@@ -114,13 +127,14 @@ export function resolveInvokeAs(
   return {
     ok: true,
     principal: userPrincipal({
-      userId: `gate:${asGate}`,
+      userId: "",
       scopes,
       verified: true,
     }),
-    asUserId: `gate:${asGate}`,
+    asUserId: "",
     asGate,
     bypassGates: false,
+    rls: resolveRlsIdentity({ asGate, manifest }),
   };
 }
 
@@ -353,6 +367,7 @@ export function bindHostInvokeUserFlow(app: InvokeHostApp): ConsoleInvokeUserFlo
       runId,
       ...(input.bypassGates === true ? { bypassGates: true } : {}),
       ...(input.revealPii === true ? { revealPii: true } : {}),
+      ...(input.rls ? { rls: input.rls } : {}),
       principal: {
         plane: "user",
         userId: input.principal.userId.length > 0 ? input.principal.userId : null,

package/src/console/server/iso-at.test.ts

@@ -0,0 +1,9 @@
+import { describe, expect, test } from "bun:test";
+
+import { isoAt } from "./iso-at.ts";
+
+describe("isoAt", () => {
+  test("formats epoch ms as UTC ISO-8601", () => {
+    expect(isoAt(1_787_305_011_525)).toBe("2026-08-21T09:36:51.525Z");
+  });
+});

package/src/console/server/iso-at.ts

@@ -0,0 +1,11 @@
+/**
+ * ISO-8601 UTC instant from a Console clock reading (epoch ms).
+ *
+ * Mutation receipts (`clock.run-now`, store edit, vault write, …) return
+ * this instead of a raw millisecond number so Call API JSON is readable.
+ *
+ * @param ms - Epoch milliseconds from `state.now()` / `Date.now()`
+ */
+export function isoAt(ms: number): string {
+  return new Date(ms).toISOString();
+}

package/src/console/server/live.test.ts

@@ -6,7 +6,7 @@ import { describe, expect, test } from "bun:test";
 import type { Manifest } from "../../manifest/types.ts";
 import type { WideEvent } from "../../runs/types.ts";
 import { feedManifest, feedRun, subscribeLive } from "./live.ts";
-import { createConsoleState, type ConsoleLiveMessage } from "./state.ts";
+import { createConsoleState, setManifest, type ConsoleLiveMessage } from "./state.ts";
 
 describe("console live Manifest feed", () => {
   test("pushes manifest and diff to subscribers", () => {
@@ -28,6 +28,31 @@ describe("console live Manifest feed", () => {
     expect(messages.some((m) => m.type === "manifest")).toBe(true);
     expect(messages.some((m) => m.type === "manifest.diff")).toBe(true);
   });
+
+  test("seeded identities follow the Manifest — no invented booking:create", () => {
+    const state = createConsoleState({ silentClaim: true, secret: "x" });
+    expect(state.identities).toHaveLength(10);
+    expect(state.identities[0]?.id).toBe("user_demo");
+    expect(state.identities.find((row) => row.id === "user_member")?.scopes).toEqual(["member"]);
+    expect(state.identities.find((row) => row.id === "user_guest")?.scopes).toEqual([]);
+    expect(state.identities.find((row) => row.id === "user_demo")?.scopes).toEqual(["member"]);
+
+    setManifest(state, {
+      oke: "1.0",
+      app: "keel-like",
+      gates: {
+        member: { kind: "policy", scopes: ["member"] },
+        "task:write": { kind: "policy", scopes: ["task:write"] },
+      },
+    });
+    expect(state.identities.find((row) => row.id === "user_demo")?.scopes).toEqual([
+      "member",
+      "task:write",
+    ]);
+    expect(state.identities.find((row) => row.id === "user_demo")?.scopes).not.toContain(
+      "booking:create",
+    );
+  });
 });
 
 describe("console live run feed", () => {

package/src/console/server/live.ts

@@ -8,8 +8,8 @@
 import type { WideEvent } from "../../runs/types.ts";
 import { projectRun } from "./flows.ts";
 import { piiFieldNamesFromManifest } from "./runs-pii.ts";
-import type { ConsoleLiveMessage, ConsoleState } from "./state.ts";
-import { publishLive } from "./state.ts";
+import { isKeelManifest, refreshSeededIdentities, seedKeelAccessRoles } from "./dev-identities.ts";
+import { publishLive, type ConsoleLiveMessage, type ConsoleState } from "./state.ts";
 
 /** WebSocket data bag for Console live clients. */
 export interface ConsoleLiveData {
@@ -97,6 +97,8 @@ export function feedManifest(
 ): void {
   const before = state.manifest;
   state.manifest = manifest;
+  refreshSeededIdentities(state.identities, manifest);
+  if (isKeelManifest(manifest)) seedKeelAccessRoles(state.roles, state.roleMembers);
   publishLive(state, { type: "manifest", manifest });
   if (before) {
     publishLive(state, { type: "manifest.diff", before, after: manifest });

package/src/console/server/operator-db.ts

@@ -11,6 +11,8 @@
  * Spec: wizard closes permanently once the first operator exists (console §2.5).
  * Claim codes stay out of Postgres (optional local DX mirror: `.oke/claim-code`);
  * operators, sessions, and the signing secret must survive restarts.
+ * API keys persist on the host `store.sql()` connection (`public.oke_api_keys`),
+ * not in this schema — Console attaches that store via `attachHostToConsole`.
  */
 
 import { mkdirSync } from "node:fs";

package/src/console/server/security-headers.ts

@@ -7,14 +7,16 @@ export const CONSOLE_CSP: string = [
   "default-src 'self'",
   "script-src 'self'",
   "style-src 'self' 'unsafe-inline'",
-  "img-src 'self' data:",
+  "img-src 'self' data: blob:",
+  "media-src 'self' blob:",
   "font-src 'self'",
   "connect-src 'self' ws: wss:",
   "object-src 'none'",
   "base-uri 'self'",
   "form-action 'self'",
   "frame-ancestors 'none'",
-  "frame-src 'self'",
+  // Files preview mints blob: URLs for PDF iframes, images, and A/V.
+  "frame-src 'self' blob:",
 ].join("; ");
 
 /**
@@ -27,13 +29,14 @@ export const CONSOLE_VITE_DEV_CSP: string = [
   "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
   "style-src 'self' 'unsafe-inline'",
   "img-src 'self' data: blob:",
+  "media-src 'self' blob:",
   "font-src 'self'",
   "connect-src 'self' ws: wss: http://127.0.0.1:* ws://127.0.0.1:*",
   "object-src 'none'",
   "base-uri 'self'",
   "form-action 'self'",
   "frame-ancestors 'none'",
-  "frame-src 'self'",
+  "frame-src 'self' blob:",
 ].join("; ");
 
 /** CSP for sandboxed plugin panel iframes (no operator session reach). */

package/src/console/server/spa-proxy.test.ts

@@ -61,6 +61,7 @@ describe("serveConsole spaProxy", () => {
     expect(html.status).toBe(200);
     expect(html.headers.get("content-security-policy")).toBe(CONSOLE_VITE_DEV_CSP);
     expect(html.headers.get("content-security-policy")).toContain("unsafe-inline");
+    expect(html.headers.get("content-security-policy")).toContain("frame-src 'self' blob:");
     expect(await html.text()).toContain("vite-spa");
 
     const client = await server.fetch(

package/src/console/server/sql-catalog.ts

@@ -31,6 +31,8 @@ import {
   parseSqlPolicySpec,
   quotePgIdent,
   sqlPolicyRowId,
+  emitStoreSchemaPolicySource,
+  installOkeRlsHelpers,
 } from "../../drivers/pg-rls.ts";
 import type { ConsoleStoreChild, ConsoleWillNotFire } from "./store.ts";
 
@@ -117,18 +119,52 @@ export async function listSqlTableRls(sql: SqlStoreHandle): Promise<ReadonlyMap<
 }
 
 /**
- * Copy RLS flags onto SQL table children. Catalog folders are unchanged.
+ * Live RLS policy counts (`pg_policies`) keyed by table name.
+ *
+ * Counts in process — memory SQL has no `GROUP BY` / `COUNT(*)::int`.
+ *
+ * @param sql - Open SQL handle
+ */
+export async function listSqlTablePolicyCounts(
+  sql: SqlStoreHandle,
+): Promise<ReadonlyMap<string, number>> {
+  try {
+    const rows = await sql.raw(`SELECT * FROM pg_policies`);
+    const out = new Map<string, number>();
+    for (const row of rows) {
+      if (!isAppCatalogSchema(row)) continue;
+      const name = stringOrNull(row.tablename ?? row.table);
+      if (name === null) continue;
+      out.set(name, (out.get(name) ?? 0) + 1);
+    }
+    return out;
+  } catch {
+    return new Map();
+  }
+}
+
+/**
+ * Copy RLS flags and policy counts onto SQL table children. Catalog folders
+ * are unchanged.
  *
  * @param children - Store list children
  * @param rlsByTable - Table name → RLS enabled
+ * @param declared - Manifest RLS when live catalog is empty
+ * @param policyCounts - Table name → live + declared policy count
  */
 export function applySqlTableRls(
   children: readonly ConsoleStoreChild[],
   rlsByTable: ReadonlyMap<string, boolean>,
+  declared?: ReadonlyMap<string, boolean>,
+  policyCounts?: ReadonlyMap<string, number>,
 ): ConsoleStoreChild[] {
   return children.map((child) => {
     if (child.kind !== "table") return child;
-    return { ...child, rls: rlsByTable.get(child.name) ?? child.rls === true };
+    return {
+      ...child,
+      rls: rlsByTable.get(child.name) ?? declared?.get(child.name) ?? child.rls === true,
+      rlsPolicyCount: policyCounts?.get(child.name) ?? child.rlsPolicyCount ?? 0,
+    };
   });
 }
 
@@ -156,6 +192,9 @@ export async function listSqlCatalog(
   limit: number,
 ): Promise<readonly Record<string, unknown>[]> {
   const live = await tryLiveCatalog(sql, kind, limit);
+  if (kind === "policy") {
+    return overlayDeclaredPolicies(live ?? [], manifest, storeName).slice(0, limit);
+  }
   if (live) return live;
   if (kind === "index") return manifestIndexes(manifest, storeName).slice(0, limit);
   if (kind === "extension") return fallbackExtensions().slice(0, limit);
@@ -172,6 +211,11 @@ export async function createSqlPolicy(
   sql: SqlStoreHandle,
   patch: Readonly<Record<string, unknown>>,
 ): Promise<void> {
+  try {
+    await installOkeRlsHelpers((stmt) => sql.raw(stmt));
+  } catch {
+    // Memory / engines without CREATE FUNCTION — CREATE POLICY may still run.
+  }
   const spec = parseSqlPolicySpec(patch);
   if (patch.enableRls === true) {
     await sql.raw(buildRowSecuritySql(spec.table, true));
@@ -393,11 +437,13 @@ function catalogColumnDescriptions(kind: SqlCatalogKind): Readonly<Record<string
     return {
       name: "Policy",
       table: "Table",
+      origin: "Declared or live-only",
       command: "Command",
       roles: "Roles",
       permissive: "Permissive or restrictive",
       using: "USING expression",
       with_check: "WITH CHECK expression",
+      code: "Copy as code",
     };
   }
   return {
@@ -459,19 +505,113 @@ function isAppCatalogSchema(row: Record<string, unknown>): boolean {
 function projectPolicyRow(row: Record<string, unknown>): Record<string, unknown> {
   const name = stringOrNull(row.name ?? row.policyname) ?? "";
   const table = stringOrNull(row.table ?? row.tablename) ?? "";
+  const command = stringOrNull(row.command ?? row.cmd) ?? "ALL";
+  const roles = rolesText(row.roles);
+  const using = stringOrNull(row.using ?? row.qual);
+  const withCheck = stringOrNull(row.with_check);
+  const permissive = stringOrNull(row.permissive) ?? "PERMISSIVE";
   return {
     id: sqlPolicyRowId(table, name),
     name,
     table,
     schema: stringOrNull(row.schema ?? row.schemaname) ?? "public",
-    command: stringOrNull(row.command ?? row.cmd) ?? "ALL",
-    roles: rolesText(row.roles),
-    permissive: stringOrNull(row.permissive) ?? "PERMISSIVE",
-    using: stringOrNull(row.using ?? row.qual),
-    with_check: stringOrNull(row.with_check),
+    command,
+    roles,
+    permissive,
+    using,
+    with_check: withCheck,
+    origin: stringOrNull(row.origin) ?? "live",
+    code: policyCopyAsCode({
+      name,
+      table,
+      command,
+      roles,
+      permissive,
+      using,
+      withCheck,
+    }),
   };
 }
 
+function overlayDeclaredPolicies(
+  live: readonly Record<string, unknown>[],
+  manifest: Manifest | null,
+  storeName: string,
+): Record<string, unknown>[] {
+  const byId = new Map<string, Record<string, unknown>>();
+  for (const row of live) {
+    byId.set(String(row.id), { ...row, origin: "live" });
+  }
+  for (const row of declaredPoliciesFromManifest(manifest, storeName)) {
+    const existing = byId.get(row.id);
+    byId.set(row.id, existing ? { ...existing, ...row, origin: "declared" } : row);
+  }
+  return [...byId.values()];
+}
+
+function declaredPoliciesFromManifest(
+  manifest: Manifest | null,
+  storeName: string,
+): Array<Record<string, unknown> & { readonly id: string }> {
+  const tables = manifest?.stores?.[storeName]?.tables ?? {};
+  const out: Array<Record<string, unknown> & { readonly id: string }> = [];
+  for (const [table, spec] of Object.entries(tables)) {
+    for (const [name, policy] of Object.entries(spec.policies ?? {})) {
+      const command = (policy.for ?? "all").toUpperCase();
+      const roles = Array.isArray(policy.to) ? policy.to.join(", ") : (policy.to ?? "public");
+      const permissive = (policy.as ?? "permissive").toUpperCase();
+      out.push({
+        id: sqlPolicyRowId(table, name),
+        name,
+        table,
+        schema: "public",
+        command,
+        roles,
+        permissive,
+        using: policy.using ?? null,
+        with_check: policy.withCheck ?? null,
+        origin: "declared",
+        code: policyCopyAsCode({
+          name,
+          table,
+          command,
+          roles,
+          permissive,
+          using: policy.using,
+          withCheck: policy.withCheck,
+        }),
+      });
+    }
+  }
+  return out;
+}
+
+function policyCopyAsCode(input: {
+  readonly name: string;
+  readonly table: string;
+  readonly command: string;
+  readonly roles: string;
+  readonly permissive: string;
+  readonly using?: string | null;
+  readonly withCheck?: string | null;
+}): string {
+  try {
+    return emitStoreSchemaPolicySource(
+      parseSqlPolicySpec({
+        name: input.name,
+        table: input.table,
+        command: input.command,
+        behavior: input.permissive,
+        roles: input.roles,
+        using: input.using ?? "",
+        withCheck: input.withCheck ?? "",
+      }),
+    );
+  } catch {
+    return "";
+  }
+}
+
 function projectTriggerRow(row: Record<string, unknown>): Record<string, unknown> {
   const enabled = row.enabled;
   return {

package/src/console/server/sql-rls.test.ts

@@ -41,4 +41,20 @@ describe("applySqlTableRls", () => {
     const rows = [{ ...child("comments"), rls: false }];
     expect(applySqlTableRls(rows, new Map())[0]?.rls).toBe(false);
   });
+
+  test("Manifest declared RLS wins when live catalog is empty", () => {
+    const out = applySqlTableRls([child("bookings")], new Map(), new Map([["bookings", true]]));
+    expect(out[0]?.rls).toBe(true);
+  });
+
+  test("stamps policy counts on tables and leaves catalog folders alone", () => {
+    const out = applySqlTableRls(
+      [child("comments"), child("policies", "policy")],
+      new Map([["comments", true]]),
+      undefined,
+      new Map([["comments", 2]]),
+    );
+    expect(out.find((row) => row.name === "comments")?.rlsPolicyCount).toBe(2);
+    expect(out.find((row) => row.name === "policies")?.rlsPolicyCount).toBeUndefined();
+  });
 });