okengine 0.2.3 → 0.2.4

package/src/config/resolve-driver.test.ts

@@ -0,0 +1,30 @@
+/**
+ * Driver map resolution — including `stack` → prod fallback.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { resolveDriverId } from "./index.ts";
+
+describe("resolveDriverId", () => {
+  test("reads the named env key", () => {
+    expect(
+      resolveDriverId({ dev: "sqlite", prod: "postgres" }, "dev"),
+    ).toBe("sqlite");
+    expect(
+      resolveDriverId({ dev: "sqlite", prod: "postgres" }, "prod"),
+    ).toBe("postgres");
+  });
+
+  test("stack prefers stack, then prod, then dev", () => {
+    expect(
+      resolveDriverId(
+        { dev: "sqlite", stack: "postgres", prod: "postgres" },
+        "stack",
+      ),
+    ).toBe("postgres");
+    expect(
+      resolveDriverId({ dev: "sqlite", prod: "postgres" }, "stack"),
+    ).toBe("postgres");
+    expect(resolveDriverId({ dev: "sqlite" }, "stack")).toBe("sqlite");
+  });
+});

package/src/console/server/flows.ts

@@ -2366,7 +2366,7 @@ async function issueOperatorSession(
 ): Promise<IssuedSession> {
   const op = state.operators.operators.get(operatorId);
   if (op) op.lastSeenAt = state.now();
-  return issueSession(
+  const issued = await issueSession(
     state.sessions,
     {
       secret: state.secret,
@@ -2379,6 +2379,8 @@ async function issueOperatorSession(
       scopes: ["console:*"],
     },
   );
+  state.persistSessions();
+  return issued;
 }
 
 function sessionPayload(

package/src/console/server/operator-db.test.ts

@@ -1,5 +1,5 @@
 /**
- * Durable Console operators under `.oke/console.sqlite`.
+ * Durable Console operators + sessions under `.oke/console.sqlite`.
  */
 
 import { afterEach, describe, expect, test } from "bun:test";
@@ -7,7 +7,8 @@ import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { createOperator } from "../../auth/operator.ts";
-import { createConsoleApp } from "./app.ts";
+import { issueSession, verifyAccess } from "../../auth/sessions.ts";
+import { bootConsoleApp, createConsoleApp } from "./app.ts";
 import {
   openConsolePersistence,
   resolveConsoleSecret,
@@ -62,7 +63,9 @@ describe("console operator persistence", () => {
         cwd,
         secret: second.secret,
         operators: second.operators,
+        sessions: second.sessions,
         persistOperator: second.persistOperator,
+        persistSessions: second.persistSessions,
         silentClaim: false,
       });
       expect(app.state.setupClosed).toBe(true);
@@ -72,4 +75,139 @@ describe("console operator persistence", () => {
       second.close();
     }
   });
+
+  test("sessions survive reopen so access tokens still verify", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "oke-console-sess-"));
+    dirs.push(cwd);
+
+    const first = await openConsolePersistence(cwd);
+    const op = await createOperator(first.operators, {
+      email: "ops@example.com",
+      name: "Ops",
+      password: "password123",
+    });
+    first.persistOperator(op.id);
+    const issued = await issueSession(
+      first.sessions,
+      { secret: first.secret },
+      { id: op.id, plane: "operator", scopes: ["console:*"] },
+    );
+    first.persistSessions();
+    first.close();
+
+    const second = await openConsolePersistence(cwd);
+    expect(second.sessions.sessions.size).toBe(1);
+    const claims = await verifyAccess(
+      second.sessions,
+      second.secret,
+      issued.accessToken,
+    );
+    expect(claims.sub).toBe(op.id);
+    second.close();
+  });
+
+  test("claim then reopen keeps session.me authorized", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "oke-console-roundtrip-"));
+    dirs.push(cwd);
+
+    const firstPersist = await openConsolePersistence(cwd);
+    const first = createConsoleApp({
+      cwd,
+      secret: firstPersist.secret,
+      operators: firstPersist.operators,
+      sessions: firstPersist.sessions,
+      persistOperator: firstPersist.persistOperator,
+      persistSessions: firstPersist.persistSessions,
+      silentClaim: true,
+    });
+    await bootConsoleApp(first);
+    let accessToken = "";
+    try {
+      const claimRes = await first.app.fetch(
+        new Request("http://console.test/console/setup/claim", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            claimCode: first.state.claim.code,
+            email: "ops@example.com",
+            name: "Ops",
+            password: "password123",
+          }),
+        }),
+      );
+      expect(claimRes.status).toBe(200);
+      const body = (await claimRes.json()) as {
+        data: { accessToken: string };
+      };
+      accessToken = body.data.accessToken;
+    } finally {
+      await first.app.stop();
+      firstPersist.close();
+    }
+
+    const secondPersist = await openConsolePersistence(cwd);
+    const second = createConsoleApp({
+      cwd,
+      secret: secondPersist.secret,
+      operators: secondPersist.operators,
+      sessions: secondPersist.sessions,
+      persistOperator: secondPersist.persistOperator,
+      persistSessions: secondPersist.persistSessions,
+      silentClaim: true,
+    });
+    await bootConsoleApp(second);
+    try {
+      const me = await second.app.fetch(
+        new Request("http://console.test/console/session/me", {
+          headers: { authorization: `Bearer ${accessToken}` },
+        }),
+      );
+      expect(me.status).toBe(200);
+      const meBody = (await me.json()) as {
+        data: { email: string };
+      };
+      expect(meBody.data.email).toBe("ops@example.com");
+    } finally {
+      await second.app.stop();
+      secondPersist.close();
+    }
+  });
+
+  test("stale Bearer on setup.status does not 401", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "oke-console-stale-"));
+    dirs.push(cwd);
+    const persistence = await openConsolePersistence(cwd);
+    const op = await createOperator(persistence.operators, {
+      email: "ops@example.com",
+      name: "Ops",
+      password: "password123",
+    });
+    persistence.persistOperator(op.id);
+
+    const handle = createConsoleApp({
+      cwd,
+      secret: persistence.secret,
+      operators: persistence.operators,
+      // Empty sessions — token cannot verify; public flow must still succeed.
+      persistOperator: persistence.persistOperator,
+      persistSessions: persistence.persistSessions,
+      silentClaim: true,
+    });
+    await bootConsoleApp(handle);
+    try {
+      const res = await handle.app.fetch(
+        new Request("http://console.test/console/setup/status", {
+          headers: { authorization: "Bearer totally-forged-token" },
+        }),
+      );
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as {
+        data: { setupClosed: boolean };
+      };
+      expect(body.data.setupClosed).toBe(true);
+    } finally {
+      await handle.app.stop();
+      persistence.close();
+    }
+  });
 });

package/src/console/server/operator-db.ts

@@ -2,7 +2,8 @@
  * Durable operator plane for Console — `.oke/console.sqlite` + secret file.
  *
  * Spec: wizard closes permanently once the first operator exists (console §2.5).
- * Claim codes stay ephemeral; operators and the signing secret must survive restarts.
+ * Claim codes stay ephemeral; operators, sessions, and the signing secret must
+ * survive restarts.
  */
 
 import { mkdirSync } from "node:fs";
@@ -12,10 +13,16 @@ import {
   createOperatorStore,
   type OperatorStore,
 } from "../../auth/operator.ts";
+import {
+  createSessionStore,
+  type SessionStore,
+} from "../../auth/sessions.ts";
 import type {
   OperatorCredentialRow,
   OperatorRow,
   OperatorSsoLinkRow,
+  RefreshTokenRow,
+  SessionRow,
 } from "../../auth/tables.ts";
 import { AUTH_TABLES } from "../../auth/tables.ts";
 
@@ -30,8 +37,12 @@ export interface ConsolePersistence {
   readonly secret: string;
   /** Hydrated operator Maps. */
   readonly operators: OperatorStore;
+  /** Hydrated session + refresh Maps. */
+  readonly sessions: SessionStore;
   /** Persist (or update) one operator + credential + roles/sso. */
   readonly persistOperator: (operatorId: string) => void;
+  /** Persist the full session store (issue / revoke). */
+  readonly persistSessions: () => void;
   /** Close the SQLite connection. */
   readonly close: () => void;
 }
@@ -97,13 +108,18 @@ export async function openConsolePersistence(
   db.exec("PRAGMA journal_mode = WAL;");
   migrateOperatorSchema(db);
   const operators = loadOperatorStore(db);
+  const sessions = loadSessionStore(db);
 
   return {
     secret,
     operators,
+    sessions,
     persistOperator(operatorId: string) {
       persistOperator(db, operators, operatorId);
     },
+    persistSessions() {
+      persistSessions(db, sessions);
+    },
     close() {
       db.close();
     },
@@ -145,9 +161,139 @@ export function migrateOperatorSchema(db: Database): void {
       PRIMARY KEY (operator_id, role),
       FOREIGN KEY (operator_id) REFERENCES ${AUTH_TABLES.operators}(id)
     );
+    CREATE TABLE IF NOT EXISTS ${AUTH_TABLES.sessions} (
+      id TEXT PRIMARY KEY NOT NULL,
+      plane TEXT NOT NULL,
+      principal_id TEXT NOT NULL,
+      family_id TEXT NOT NULL,
+      revoked_at INTEGER,
+      created_at INTEGER NOT NULL,
+      expires_at INTEGER NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS ${AUTH_TABLES.refreshTokens} (
+      id TEXT PRIMARY KEY NOT NULL,
+      session_id TEXT NOT NULL,
+      family_id TEXT NOT NULL,
+      hash TEXT NOT NULL,
+      expires_at INTEGER NOT NULL,
+      used_at INTEGER,
+      revoked_at INTEGER
+    );
   `);
 }
 
+/**
+ * Hydrate a {@link SessionStore} from SQLite.
+ *
+ * @param db - Open database
+ */
+export function loadSessionStore(db: Database): SessionStore {
+  const store = createSessionStore();
+
+  const sessionRows = db
+    .query(
+      `SELECT id, plane, principal_id, family_id, revoked_at, created_at, expires_at
+       FROM ${AUTH_TABLES.sessions}`,
+    )
+    .all() as Array<{
+    id: string;
+    plane: SessionRow["plane"];
+    principal_id: string;
+    family_id: string;
+    revoked_at: number | null;
+    created_at: number;
+    expires_at: number;
+  }>;
+
+  for (const row of sessionRows) {
+    const session: SessionRow = {
+      id: row.id,
+      plane: row.plane,
+      principalId: row.principal_id,
+      familyId: row.family_id,
+      revokedAt: row.revoked_at,
+      createdAt: row.created_at,
+      expiresAt: row.expires_at,
+    };
+    store.sessions.set(session.id, session);
+  }
+
+  const refreshRows = db
+    .query(
+      `SELECT id, session_id, family_id, hash, expires_at, used_at, revoked_at
+       FROM ${AUTH_TABLES.refreshTokens}`,
+    )
+    .all() as Array<{
+    id: string;
+    session_id: string;
+    family_id: string;
+    hash: string;
+    expires_at: number;
+    used_at: number | null;
+    revoked_at: number | null;
+  }>;
+
+  for (const row of refreshRows) {
+    const token: RefreshTokenRow = {
+      id: row.id,
+      sessionId: row.session_id,
+      familyId: row.family_id,
+      hash: row.hash,
+      expiresAt: row.expires_at,
+      usedAt: row.used_at,
+      revokedAt: row.revoked_at,
+    };
+    store.refresh.set(token.id, token);
+  }
+
+  return store;
+}
+
+/**
+ * Replace session tables with the in-memory store snapshot.
+ *
+ * @param db - Open database
+ * @param store - In-memory session store
+ */
+export function persistSessions(db: Database, store: SessionStore): void {
+  db.exec(`DELETE FROM ${AUTH_TABLES.refreshTokens}`);
+  db.exec(`DELETE FROM ${AUTH_TABLES.sessions}`);
+
+  const insertSession = db.query(
+    `INSERT INTO ${AUTH_TABLES.sessions}
+      (id, plane, principal_id, family_id, revoked_at, created_at, expires_at)
+     VALUES ($id, $plane, $principal, $family, $revoked, $created, $expires)`,
+  );
+  for (const session of store.sessions.values()) {
+    insertSession.run({
+      $id: session.id,
+      $plane: session.plane,
+      $principal: session.principalId,
+      $family: session.familyId,
+      $revoked: session.revokedAt,
+      $created: session.createdAt,
+      $expires: session.expiresAt,
+    });
+  }
+
+  const insertRefresh = db.query(
+    `INSERT INTO ${AUTH_TABLES.refreshTokens}
+      (id, session_id, family_id, hash, expires_at, used_at, revoked_at)
+     VALUES ($id, $session, $family, $hash, $expires, $used, $revoked)`,
+  );
+  for (const token of store.refresh.values()) {
+    insertRefresh.run({
+      $id: token.id,
+      $session: token.sessionId,
+      $family: token.familyId,
+      $hash: token.hash,
+      $expires: token.expiresAt,
+      $used: token.usedAt,
+      $revoked: token.revokedAt,
+    });
+  }
+}
+
 /**
  * Hydrate an {@link OperatorStore} from SQLite.
  *

package/src/console/server/plugin.ts

@@ -30,6 +30,26 @@ export function consolePlugin(): PluginDef {
       entry: "./panels/traces.js",
     })
     .table("oke_console_prefs", { plane: "operator" })
+    // Public flows must not 401 when a stale Bearer/cookie is present —
+    // kernel onAuth verifies before beforeHandle's public-flow exemption.
+    // Rebuild from URL: `new Request(req, { headers })` re-copies Authorization.
+    .hook("onRequest", (ctx) => {
+      if (!PUBLIC_CONSOLE_FLOWS.has(ctx.flow.name) || !ctx.request) return;
+      const auth = ctx.request.headers.get("authorization");
+      if (!auth?.startsWith("Bearer ")) return;
+      const headers = new Headers();
+      for (const [key, value] of ctx.request.headers) {
+        if (key.toLowerCase() === "authorization") continue;
+        headers.set(key, value);
+      }
+      const method = ctx.request.method;
+      const init: RequestInit = { method, headers };
+      if (method !== "GET" && method !== "HEAD") {
+        init.body = ctx.request.body;
+        (init as RequestInit & { duplex: "half" }).duplex = "half";
+      }
+      ctx.request = new Request(ctx.request.url, init);
+    })
     .hook("beforeHandle", (ctx, fxOrErr) => {
       const fx = fxOrErr as Fx;
       const name = ctx.flow.name;

package/src/console/server/serve.ts

@@ -11,6 +11,7 @@ import {
   resolveAllowedHosts,
   secureFetch,
 } from "../../runtime/security.ts";
+import { runWithDevSurface } from "../../runtime/dev-request-log.ts";
 import { CONSOLE_PORT, type ServerHandle } from "../../runtime/types.ts";
 import {
   bindManifestSignalBus,
@@ -75,7 +76,9 @@ export async function serveConsole(
       ? {
           secret: options.secret ?? persistence.secret,
           operators: persistence.operators,
+          sessions: persistence.sessions,
           persistOperator: persistence.persistOperator,
+          persistSessions: persistence.persistSessions,
         }
       : {}),
   });
@@ -109,7 +112,9 @@ export async function serveConsole(
     const authed = withCookieAuth(request);
 
     if (url.pathname.startsWith("/console/")) {
-      const response = await handle.app.fetch(authed);
+      const response = await runWithDevSurface("Console", () =>
+        handle.app.fetch(authed),
+      );
       const withCookies = await attachSessionCookies(authed, response);
       return withConsoleSecurityHeaders(withCookies);
     }
@@ -213,7 +218,9 @@ export async function startConsoleApp(
       ? {
           secret: options.secret ?? persistence.secret,
           operators: persistence.operators,
+          sessions: persistence.sessions,
           persistOperator: persistence.persistOperator,
+          persistSessions: persistence.persistSessions,
         }
       : {}),
   });

package/src/console/server/state.ts

@@ -350,6 +350,11 @@ export interface ConsoleState {
    * No-op when persistence is disabled (tests / memory-only).
    */
   persistOperator: (operatorId: string) => void;
+  /**
+   * Persist sessions after issue / revoke (SQLite under `.oke/`).
+   * No-op when persistence is disabled (tests / memory-only).
+   */
+  persistSessions: () => void;
   /**
    * Per-email login attempt timestamps for credential-check rate limiting
    * (console §10.4 — same 5/60s strategy as setup-claim).
@@ -405,8 +410,12 @@ export interface CreateConsoleStateOptions {
   readonly pluginRegistry?: PluginRegistry | null;
   /** Pre-hydrated operator store (from `.oke/console.sqlite`). */
   readonly operators?: OperatorStore;
+  /** Pre-hydrated session store (from `.oke/console.sqlite`). */
+  readonly sessions?: SessionStore;
   /** Persist hook after claim/create. */
   readonly persistOperator?: (operatorId: string) => void;
+  /** Persist hook after session issue / revoke. */
+  readonly persistSessions?: () => void;
 }
 
 /**
@@ -424,10 +433,11 @@ export function createConsoleState(
   const now = options.now ?? (() => Date.now());
   const operators = options.operators ?? createOperatorStore();
   const claim = mintClaimCode(now);
-  const sessions = createSessionStore();
+  const sessions = options.sessions ?? createSessionStore();
   const liveSubscribers = new Set<(msg: ConsoleLiveMessage) => void>();
   const persistOperator =
     options.persistOperator ?? ((_operatorId: string) => {});
+  const persistSessions = options.persistSessions ?? (() => {});
 
   const signalConfig = createMemorySignalConfigStore();
   const gateAuth = createDefaultGateAuthStores();
@@ -855,6 +865,7 @@ export function createConsoleState(
       return operators.operators.size > 0;
     },
     persistOperator,
+    persistSessions,
   };
 
   return state;