okengine 0.4.3 → 0.5.0

package/src/compiler/extract.ts

@@ -671,6 +671,25 @@ function visitDeclarationCall(call: CallExpression, program: AstNode, scope: Pro
       }
     }
 
+    if (obj === "gate" && prop === "scope") {
+      const scopeName = stringArg(call.arguments[0]);
+      if (scopeName) {
+        scope.gates[scopeName] = {
+          kind: "policy",
+          roles: [scopeName],
+          scopes: [scopeName],
+        };
+        const bindingName = enclosingConstName(call, program);
+        if (bindingName) {
+          scope.gateIds.set(bindingName, scopeName);
+          scope.bindings.set(bindingName, {
+            kind: "unknown",
+            ref: scopeName,
+          });
+        }
+      }
+    }
+
     if (obj === "gate" && prop === "rate") {
       const opts = objectArg(call.arguments[0]);
       const strategy = (stringProp(opts, "strategy") ?? "sliding-window-counter") as RateStrategy;

package/src/compiler/response.ts

@@ -91,8 +91,22 @@ export function encodeExecuteResult(result: {
 }): Response {
   if (result.response) return result.response;
   if (result.failure) return encodeFailure(result.failure);
-  if (result.error !== undefined && isFlowFailure(result.error)) {
-    return encodeFailure(result.error);
+  if (result.error !== undefined) {
+    if (isFlowFailure(result.error)) {
+      return encodeFailure(result.error);
+    }
+    // Unhandled throws must never look like success (`undefined` → 204).
+    return Response.json(
+      {
+        data: null,
+        error: {
+          code: "InternalError",
+          data: {},
+          message: result.error instanceof Error ? result.error.message : "internal error",
+        },
+      } satisfies FailureEnvelope,
+      { status: 500 },
+    );
   }
   return encodeSuccess(result.output);
 }

package/src/console/server/app.ts

@@ -2,12 +2,12 @@
  * ConsoleApp — operator-plane app built on `createClient<ConsoleApp>`.
  */
 
-import { auth } from "../../auth/index.ts";
 import { memorySignalDriver } from "../../drivers/signal-memory.ts";
 import { signal as declareSignal } from "../../elements/signal/declare.ts";
 import { createSignalRuntime } from "../../elements/signal/runtime.ts";
 import { oke, type OkeApp } from "../../kernel/index.ts";
 import { createManifestAiRuntime } from "./ai.ts";
+import { CONSOLE_GATES } from "./console-gates.ts";
 import { createConsoleBindings } from "./flows.ts";
 import { consolePlugin } from "./plugin.ts";
 import {
@@ -61,14 +61,18 @@ export function createConsoleApp(options: CreateConsoleAppOptions = {}): Console
     bindings,
     autoBoot: false,
     fx: { now: state.now },
-    auth: {
-      secret: state.secret,
-      sessions: state.sessions,
-      now: state.now,
+    gate: {
+      auth: {
+        secret: state.secret,
+        sessions: state.sessions,
+        now: state.now,
+        // Console owns `/console/session/*` — no app `/auth/*` surfaces.
+        http: false,
+      },
+      policies: [...CONSOLE_GATES],
     },
     runs: { driver: "memory" },
   })
-    .plug(auth({ secret: state.secret }))
     .plug(consolePlugin())
     .adopt({
       console: {

package/src/console/server/auth-rate.test.ts

@@ -53,18 +53,18 @@ describe("auth-rate strategy", () => {
     await createOperator(store, {
       email: "ops@example.com",
       name: "Ops",
-      password: "password123",
+      password: "password1234",
     });
 
     const tMissing = performance.now();
-    expect(await authenticateOperator(store, "missing@example.com", "password123")).toBeNull();
+    expect(await authenticateOperator(store, "missing@example.com", "password1234")).toBeNull();
     const missingMs = performance.now() - tMissing;
 
     const tBad = performance.now();
     expect(await authenticateOperator(store, "ops@example.com", "wrong-password")).toBeNull();
     const badMs = performance.now() - tBad;
 
-    expect(await authenticateOperator(store, "ops@example.com", "password123")).not.toBeNull();
+    expect(await authenticateOperator(store, "ops@example.com", "password1234")).not.toBeNull();
 
     // Both paths pay an argon2 verify — neither should be near-instant.
     expect(missingMs).toBeGreaterThan(5);

package/src/console/server/bind.ts

@@ -2,18 +2,29 @@
  * Local HTTP bindings that do not touch the global {@link on} registry.
  */
 
+import { gate } from "../../elements/gate.ts";
 import type { AnyFlowDef } from "../../kernel/flow.ts";
 import type { Binding } from "../../kernel/on.ts";
 import { normalizeTrigger, type HttpTrigger, type Trigger } from "../../kernel/triggers.ts";
+import { consoleOperatorGate } from "./console-gates.ts";
+import { PUBLIC_CONSOLE_FLOWS } from "./public-flows.ts";
 
 /**
  * Bind an HTTP trigger to a flow without registering on the global `on` list.
+ * Attaches {@link gate.public} or {@link consoleOperatorGate} when the trigger
+ * has no declared auth posture yet.
  *
  * @param trigger - HTTP trigger
  * @param flowDef - Flow definition
  */
 export function bindHttp(trigger: HttpTrigger, flowDef: AnyFlowDef): Binding {
-  const normalized = normalizeTrigger(trigger);
+  const withPosture =
+    trigger.gates.length > 0
+      ? trigger
+      : PUBLIC_CONSOLE_FLOWS.has(flowDef.name)
+        ? trigger.gate(gate.public)
+        : trigger.gate(consoleOperatorGate);
+  const normalized = normalizeTrigger(withPosture);
   const list = flowDef.triggers as Trigger[];
   list.push(normalized);
   (flowDef as { $trigger: Trigger }).$trigger = normalized;

package/src/console/server/channels.test.ts

@@ -115,7 +115,7 @@ describe("console.channel.sendTest", () => {
             claimCode: code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );

package/src/console/server/console-gates.ts

@@ -0,0 +1,14 @@
+/**
+ * Console HTTP auth-posture gates — public sentinel vs operator policy.
+ */
+
+import { gate, type PolicyGateDecl } from "../../elements/gate.ts";
+
+/** Operator must be present (Console plane). */
+export const consoleOperatorGate: PolicyGateDecl = gate.policy(
+  "console:operator",
+  ({ operator }) => operator.id !== null,
+);
+
+/** Gates registered on the Console app runtime. */
+export const CONSOLE_GATES = [gate.public, consoleOperatorGate] as const;

package/src/console/server/console.test.ts

@@ -69,7 +69,7 @@ describe("console kernel", () => {
             claimCode: code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );
@@ -89,7 +89,7 @@ describe("console kernel", () => {
             claimCode: code,
             email: "other@example.com",
             name: "Other",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );
@@ -127,7 +127,7 @@ describe("console kernel", () => {
             claimCode: handle.state.claim.code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );
@@ -175,7 +175,7 @@ describe("console kernel", () => {
             claimCode: handle.state.claim.code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );
@@ -223,7 +223,7 @@ describe("console kernel", () => {
             claimCode: handle.state.claim.code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );
@@ -317,7 +317,7 @@ describe("console serve security", () => {
           claimCode: server.console.state.claim.code,
           email: "ops@example.com",
           name: "Ops",
-          password: "password123",
+          password: "password1234",
         }),
       }),
     );

package/src/console/server/flows-invoke.test.ts

@@ -31,7 +31,7 @@ describe("console flows invoke", () => {
             claimCode: code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );
@@ -100,7 +100,7 @@ describe("console flows invoke", () => {
             claimCode: code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );

package/src/console/server/flows.ts

@@ -751,6 +751,7 @@ const GatesListOut = z.object({
       plane: z.enum(["user", "operator"]),
       gates: z.array(z.string()),
       unguarded: z.boolean(),
+      explicitPublic: z.boolean(),
     }),
   ),
   gates: z.array(
@@ -2817,6 +2818,7 @@ function createGatesList(state: ConsoleState) {
           plane: f.plane,
           gates: [...f.gates],
           unguarded: f.unguarded,
+          explicitPublic: f.explicitPublic,
         })),
         gates: projection.gates.map((g) => ({
           name: g.name,

package/src/console/server/gates.ts

@@ -66,8 +66,13 @@ export interface ConsoleFlowGatesRow {
   readonly flowId: string;
   readonly plane: "user" | "operator";
   readonly gates: readonly string[];
-  /** User-plane with empty chain — public. */
+  /**
+   * User-plane with empty chain — missing auth posture (boot error when
+   * `unguardedHttp: "deny"`). Distinct from {@link explicitPublic}.
+   */
   readonly unguarded: boolean;
+  /** Chain includes the reserved `public` sentinel (`gate.public`). */
+  readonly explicitPublic: boolean;
 }
 
 /**
@@ -449,11 +454,13 @@ function projectFlows(manifest: Manifest | null): ConsoleFlowGatesRow[] {
   for (const [flowId, flow] of Object.entries(manifest.flows)) {
     const plane = flow.plane === "operator" ? "operator" : "user";
     const gates = [...(flow.gates ?? [])];
+    const explicitPublic = gates.includes("public");
     rows.push({
       flowId,
       plane,
       gates,
       unguarded: plane === "user" && gates.length === 0,
+      explicitPublic,
     });
   }
   return rows.sort((a, b) => a.flowId.localeCompare(b.flowId));

package/src/console/server/operator-db.test.ts

@@ -36,7 +36,7 @@ describe("console operator persistence", () => {
     const op = await createOperator(first.operators, {
       email: "ops@example.com",
       name: "Ops",
-      password: "password123",
+      password: "password1234",
     });
     first.persistOperator(op.id);
     first.close();
@@ -77,7 +77,7 @@ describe("console operator persistence", () => {
     const op = await createOperator(first.operators, {
       email: "ops@example.com",
       name: "Ops",
-      password: "password123",
+      password: "password1234",
     });
     first.persistOperator(op.id);
     const issued = await issueSession(
@@ -120,7 +120,7 @@ describe("console operator persistence", () => {
             claimCode: first.state.claim.code,
             email: "ops@example.com",
             name: "Ops",
-            password: "password123",
+            password: "password1234",
           }),
         }),
       );
@@ -169,7 +169,7 @@ describe("console operator persistence", () => {
     const op = await createOperator(persistence.operators, {
       email: "ops@example.com",
       name: "Ops",
-      password: "password123",
+      password: "password1234",
     });
     persistence.persistOperator(op.id);
 

package/src/console/server/operator-db.ts

@@ -157,7 +157,8 @@ export function migrateOperatorSchema(db: Database): void {
       family_id TEXT NOT NULL,
       revoked_at INTEGER,
       created_at INTEGER NOT NULL,
-      expires_at INTEGER NOT NULL
+      expires_at INTEGER NOT NULL,
+      last_active_at INTEGER
     );
     CREATE TABLE IF NOT EXISTS ${AUTH_TABLES.refreshTokens} (
       id TEXT PRIMARY KEY NOT NULL,
@@ -169,6 +170,20 @@ export function migrateOperatorSchema(db: Database): void {
       revoked_at INTEGER
     );
   `);
+  ensureSessionLastActiveColumn(db);
+}
+
+/**
+ * Add `last_active_at` when opening an older console.sqlite that predates idle TTL.
+ *
+ * @param db - Open database
+ */
+function ensureSessionLastActiveColumn(db: Database): void {
+  const cols = db.query(`PRAGMA table_info(${AUTH_TABLES.sessions})`).all() as Array<{
+    name: string;
+  }>;
+  if (cols.some((c) => c.name === "last_active_at")) return;
+  db.exec(`ALTER TABLE ${AUTH_TABLES.sessions} ADD COLUMN last_active_at INTEGER`);
 }
 
 /**
@@ -181,7 +196,7 @@ export function loadSessionStore(db: Database): SessionStore {
 
   const sessionRows = db
     .query(
-      `SELECT id, plane, principal_id, family_id, revoked_at, created_at, expires_at
+      `SELECT id, plane, principal_id, family_id, revoked_at, created_at, expires_at, last_active_at
        FROM ${AUTH_TABLES.sessions}`,
     )
     .all() as Array<{
@@ -192,6 +207,7 @@ export function loadSessionStore(db: Database): SessionStore {
     revoked_at: number | null;
     created_at: number;
     expires_at: number;
+    last_active_at: number | null;
   }>;
 
   for (const row of sessionRows) {
@@ -203,6 +219,7 @@ export function loadSessionStore(db: Database): SessionStore {
       revokedAt: row.revoked_at,
       createdAt: row.created_at,
       expiresAt: row.expires_at,
+      lastActiveAt: row.last_active_at ?? row.created_at,
     };
     store.sessions.set(session.id, session);
   }
@@ -250,8 +267,8 @@ export function persistSessions(db: Database, store: SessionStore): void {
 
   const insertSession = db.query(
     `INSERT INTO ${AUTH_TABLES.sessions}
-      (id, plane, principal_id, family_id, revoked_at, created_at, expires_at)
-     VALUES ($id, $plane, $principal, $family, $revoked, $created, $expires)`,
+      (id, plane, principal_id, family_id, revoked_at, created_at, expires_at, last_active_at)
+     VALUES ($id, $plane, $principal, $family, $revoked, $created, $expires, $lastActive)`,
   );
   for (const session of store.sessions.values()) {
     insertSession.run({
@@ -262,6 +279,7 @@ export function persistSessions(db: Database, store: SessionStore): void {
       $revoked: session.revokedAt,
       $created: session.createdAt,
       $expires: session.expiresAt,
+      $lastActive: session.lastActiveAt,
     });
   }
 

package/src/console/server/security.gate.test.ts

@@ -69,7 +69,7 @@ describe("console security gates (whole surface)", () => {
           claimCode: handle.state.claim.code,
           email: "ops@example.com",
           name: "Ops",
-          password: "password123",
+          password: "password1234",
         }),
       }),
     );
@@ -234,7 +234,7 @@ describe("console security gates (whole surface)", () => {
         headers: { "content-type": "application/json" },
         body: JSON.stringify({
           email: "ops@example.com",
-          password: "password123",
+          password: "password1234",
         }),
       }),
     );
@@ -252,7 +252,7 @@ describe("console security gates (whole surface)", () => {
         headers: { "content-type": "application/json" },
         body: JSON.stringify({
           email: "other@example.com",
-          password: "password123",
+          password: "password1234",
         }),
       }),
     );

package/src/console/ui/gates/fixture.ts

@@ -20,24 +20,28 @@ export const GATES_LIST_FIXTURE: GatesListResponse = {
       plane: "user",
       gates: ["member", "booking:create", "rate:sliding-window-counter:300/1m"],
       unguarded: false,
+      explicitPublic: false,
     },
     {
       flowId: "health.ping",
       plane: "user",
       gates: [],
       unguarded: true,
+      explicitPublic: false,
     },
     {
       flowId: "reports.export",
       plane: "user",
       gates: ["staff"],
       unguarded: false,
+      explicitPublic: false,
     },
     {
       flowId: "console.store.query",
       plane: "operator",
       gates: [],
       unguarded: false,
+      explicitPublic: false,
     },
   ],
   gates: [

package/src/console/ui/gates/types.ts

@@ -11,6 +11,8 @@ export interface FlowGatesRecord {
   readonly plane: "user" | "operator";
   readonly gates: readonly string[];
   readonly unguarded: boolean;
+  /** Chain includes the reserved `public` sentinel. */
+  readonly explicitPublic?: boolean;
 }
 
 /** Declared gate definition. */

package/src/console/ui/shell/client.ts

@@ -808,6 +808,7 @@ interface ConsoleClient {
         plane: "user" | "operator";
         gates: string[];
         unguarded: boolean;
+        explicitPublic: boolean;
       }>;
       gates: Array<{
         name: string;

package/src/elements/gate/boot.ts

@@ -0,0 +1,136 @@
+/**
+ * Gate boot audit — every HTTP trigger must declare auth posture.
+ *
+ * Fail loud: missing gate and missing {@link gate.public} → {@link GateBootError}.
+ * `unguardedHttp: "allow"` is honoured **only** when `env === "test"` — never a
+ * production-wide bypass. Migrate real apps with per-trigger `gate.public`.
+ */
+
+import { GATE_PUBLIC_NAME } from "./declare.ts";
+
+/** One HTTP flow missing declared auth posture. */
+export interface GatePostureGap {
+  /** Flow id (`unit.name` or flow name). */
+  readonly flowId: string;
+  /** HTTP method. */
+  readonly method: string;
+  /** HTTP path template. */
+  readonly path: string;
+}
+
+/**
+ * Thrown when HTTP triggers omit both a gate chain and {@link gate.public}.
+ * Lists every gap (Vault-style — fail once with the full set).
+ */
+export class GateBootError extends Error {
+  readonly gaps: readonly GatePostureGap[];
+
+  constructor(gaps: readonly GatePostureGap[]) {
+    const lines = gaps.map((g) => `  - ${g.flowId} ${g.method} ${g.path}`);
+    super(
+      `gate boot failed — ${gaps.length} HTTP trigger(s) missing auth posture (attach a gate or gate.public):\n${lines.join("\n")}`,
+    );
+    this.name = "GateBootError";
+    this.gaps = gaps;
+  }
+}
+
+/** Minimal HTTP trigger shape for posture audit. */
+export interface HttpTriggerPosture {
+  readonly kind: "http";
+  readonly method: string;
+  readonly path: string;
+  readonly gates: readonly (string | { readonly name: string })[];
+}
+
+/** Binding shape consumed by the audit. */
+export interface BindingPosture {
+  readonly trigger: { readonly kind: string } & Omit<Partial<HttpTriggerPosture>, "kind">;
+  readonly flow: { readonly name: string };
+}
+
+/** Options for {@link assertHttpGatePosture}. */
+export interface AssertHttpGatePostureOptions {
+  /**
+   * `"allow"` skips the audit **only** when {@link env} is `"test"`.
+   * Outside test, `"allow"` has no effect — enforcement still runs.
+   */
+  readonly unguardedHttp?: "deny" | "allow";
+  /**
+   * Boot environment. Hard-coded gate: `"allow"` is ignored unless this is
+   * `"test"` (not developer-overridable beyond the env value itself).
+   */
+  readonly env?: string;
+}
+
+/**
+ * Whether a gate ref is the public sentinel.
+ *
+ * @param ref - Gate name or named handle
+ */
+export function isPublicGateRef(ref: string | { readonly name: string }): boolean {
+  return (typeof ref === "string" ? ref : ref.name) === GATE_PUBLIC_NAME;
+}
+
+/**
+ * Whether an HTTP trigger has declared auth posture (any gate or public).
+ *
+ * @param gates - Trigger gate chain
+ */
+export function hasHttpGatePosture(
+  gates: readonly (string | { readonly name: string })[],
+): boolean {
+  return gates.length > 0;
+}
+
+/**
+ * Collect HTTP triggers with neither a gate nor {@link gate.public}.
+ *
+ * @param bindings - Adopted / registered bindings
+ */
+export function collectUnguardedHttpGaps(bindings: readonly BindingPosture[]): GatePostureGap[] {
+  const gaps: GatePostureGap[] = [];
+  for (const b of bindings) {
+    if (b.trigger.kind !== "http") continue;
+    const t = b.trigger as HttpTriggerPosture;
+    if (hasHttpGatePosture(t.gates)) continue;
+    gaps.push({
+      flowId: b.flow.name,
+      method: t.method,
+      path: t.path,
+    });
+  }
+  return gaps;
+}
+
+/**
+ * Whether `unguardedHttp: "allow"` may skip the audit for this boot.
+ * Hard-coded: only `env === "test"`.
+ *
+ * @param unguardedHttp - Requested opt-out
+ * @param env - Boot environment
+ */
+export function unguardedHttpAllowActive(
+  unguardedHttp: "deny" | "allow" | undefined,
+  env: string | undefined,
+): boolean {
+  return unguardedHttp === "allow" && env === "test";
+}
+
+/**
+ * Assert every HTTP trigger declares auth posture. Throws {@link GateBootError}.
+ *
+ * @param bindings - Adopted / registered bindings
+ * @param options - Opt-out + env (allow only in test)
+ */
+export function assertHttpGatePosture(
+  bindings: readonly BindingPosture[],
+  options: AssertHttpGatePostureOptions | "deny" | "allow" = "deny",
+): void {
+  // Back-compat: second arg was previously just `"deny" | "allow"`.
+  const opts: AssertHttpGatePostureOptions =
+    typeof options === "string" ? { unguardedHttp: options } : options;
+  if (unguardedHttpAllowActive(opts.unguardedHttp, opts.env)) return;
+  const gaps = collectUnguardedHttpGaps(bindings);
+  if (gaps.length > 0) throw new GateBootError(gaps);
+}

package/src/elements/gate/config.ts

@@ -0,0 +1,69 @@
+/**
+ * `oke({ gate })` — nested Gate bag (auth · policies · rate · posture).
+ */
+
+import { resolveGateAuth, type GateAuthOptions, type ResolvedGateAuth } from "../../auth/config.ts";
+import type { GateDecl } from "./declare.ts";
+
+/** Rate-limit defaults under Gate. */
+export interface GateRateLimitOptions {
+  /** When true, auth Flows attach stricter rate presets (default true when auth enabled). */
+  readonly enabled?: boolean;
+}
+
+/**
+ * Nested Gate options for {@link oke}.
+ *
+ * Replaces root `auth` / `gates` / `unguardedHttp`.
+ */
+export interface GateOptions {
+  /** Builtin hybrid-session auth + core Flows under `basePath`. */
+  readonly auth?: GateAuthOptions;
+  /** Named policy / rate declarations for the Gate runtime. */
+  readonly policies?: readonly GateDecl[];
+  /** Global rate-limit posture (auth path presets). */
+  readonly rateLimit?: GateRateLimitOptions;
+  /**
+   * HTTP auth-posture enforcement at boot.
+   * Default `"deny"`. `"allow"` is honoured only when `env === "test"`.
+   */
+  readonly unguardedHttp?: "deny" | "allow";
+}
+
+/** Fully resolved Gate config consumed by `oke` / boot. */
+export interface ResolvedGateConfig {
+  readonly auth: ResolvedGateAuth | undefined;
+  readonly policies: readonly GateDecl[];
+  readonly rateLimitEnabled: boolean;
+  readonly unguardedHttp: "deny" | "allow";
+}
+
+/** Options for {@link resolveGateConfig}. */
+export interface ResolveGateConfigOptions {
+  readonly gate?: GateOptions;
+  readonly env?: string;
+}
+
+/**
+ * Resolve the nested `gate` bag for construction / boot.
+ *
+ * @param options - Gate bag + env (for auth secret rules)
+ */
+export function resolveGateConfig(options: ResolveGateConfigOptions = {}): ResolvedGateConfig {
+  const bag = options.gate ?? {};
+  const auth =
+    bag.auth !== undefined ? resolveGateAuth({ auth: bag.auth, env: options.env }) : undefined;
+  const rateLimitEnabled =
+    bag.rateLimit?.enabled !== undefined
+      ? bag.rateLimit.enabled
+      : auth !== undefined
+        ? true
+        : false;
+
+  return {
+    auth,
+    policies: bag.policies ?? [],
+    rateLimitEnabled,
+    unguardedHttp: bag.unguardedHttp ?? "deny",
+  };
+}