okengine 0.6.0 → 0.7.0

package/src/console/server/flows.ts

@@ -7,8 +7,10 @@
 import { z } from "zod";
 import {
   authenticateOperator,
+  BreachCheckError,
   createOperator,
   issueSession,
+  PasswordPolicyError,
   scopesForRoles,
   userPrincipal,
   type IssuedSession,
@@ -24,6 +26,7 @@ import { maskWideEventForConsole, piiFieldNamesFromManifest } from "./runs-pii.t
 import { ClockResourceNotFoundError, ScheduleNotOverridableError } from "./clock.ts";
 import { createFileDiff, emitStructuralDiff } from "./structural.ts";
 import type { ConsoleState } from "./state.ts";
+import { consoleFailureMessage } from "./i18n.ts";
 import { PUBLIC_CONSOLE_FLOWS } from "./public-flows.ts";
 import { tenancyDeclared } from "./store.ts";
 
@@ -38,7 +41,8 @@ const ClaimIn = z.object({
   claimCode: z.string().min(1),
   email: z.string().email(),
   name: z.string().min(1),
-  password: z.string().min(8),
+  /** Matches default operator password policy (minLength 12). */
+  password: z.string().min(12),
 });
 
 const SessionOut = z.object({
@@ -292,7 +296,11 @@ const InvokeOut = z.object({
 });
 
 const SetupClosed = z.object({ reason: z.string() });
-const ClaimFailed = z.object({ reason: z.string() });
+const ClaimFailed = z.object({
+  reason: z.string(),
+  /** Password-policy detail lines when `reason` is `password_policy`. */
+  reasons: z.array(z.string()).optional(),
+});
 const AuthFailed = z.object({});
 const AuthRateLimited = z.object({ reason: z.string() });
 const NotFound = z.object({ flowId: z.string() });
@@ -1688,17 +1696,39 @@ function createSetupClaim(state: ConsoleState) {
     errors: { SetupClosed, ClaimFailed },
     do: async (input: z.infer<typeof ClaimIn>, fx) => {
       if (state.setupClosed) {
-        return fail("SetupClosed", { reason: "first operator already exists" });
+        const data = { reason: "first_operator_exists" };
+        return fail("SetupClosed", data, { message: consoleFailureMessage("SetupClosed", data) });
       }
       const verified = verifyClaimCode(state.claim, input.claimCode, state.now);
       if (!verified.ok) {
-        return fail("ClaimFailed", { reason: verified.reason });
+        const data = { reason: verified.reason };
+        return fail("ClaimFailed", data, { message: consoleFailureMessage("ClaimFailed", data) });
+      }
+      let op: Awaited<ReturnType<typeof createOperator>>;
+      try {
+        op = await createOperator(state.operators, {
+          email: input.email,
+          name: input.name,
+          password: input.password,
+        });
+      } catch (err) {
+        if (err instanceof PasswordPolicyError) {
+          const data = {
+            reason: "password_policy",
+            reasons: [...err.reasons],
+          };
+          return fail("ClaimFailed", data, {
+            message: consoleFailureMessage("ClaimFailed", data),
+          });
+        }
+        if (err instanceof BreachCheckError) {
+          const data = { reason: "password_breached" };
+          return fail("ClaimFailed", data, {
+            message: consoleFailureMessage("ClaimFailed", data),
+          });
+        }
+        throw err;
       }
-      const op = await createOperator(state.operators, {
-        email: input.email,
-        name: input.name,
-        password: input.password,
-      });
       state.persistOperator(op.id);
       const issued = await issueOperatorSession(state, op.id);
       fx.log.info("console.setup.claim", { operatorId: op.id });

package/src/console/server/i18n.ts

@@ -0,0 +1,41 @@
+/**
+ * Console-only failure copy — kept out of kernel built-in catalogs so the
+ * edge profile and app exports do not pay for operator-claim strings.
+ */
+
+const en = {
+  ClaimFailed: "Could not create the first operator.",
+  "ClaimFailed.mismatch": "That claim code does not match. Copy it from the boot log.",
+  "ClaimFailed.expired": "That claim code expired. Restart `oke dev` for a new one.",
+  "ClaimFailed.rate_limited": "Too many claim attempts. Wait a minute and try again.",
+  "ClaimFailed.missing": "No claim code is active. Restart `oke dev` to mint one.",
+  "ClaimFailed.password_policy":
+    "Password needs at least 12 characters, including a letter and a number.",
+  "ClaimFailed.password_breached":
+    "Choose a different password — this one appears in a breach list.",
+  SetupClosed: "Setup is closed — an operator already exists. Sign in instead.",
+  "SetupClosed.first_operator_exists":
+    "Setup is closed — an operator already exists. Sign in instead.",
+} as const;
+
+/**
+ * Resolve a Console claim/setup failure message (English; boot log is EN).
+ *
+ * @param code - Failure code
+ * @param data - Failure data (may include `reason`)
+ */
+export function consoleFailureMessage(code: string, data?: unknown): string {
+  const reason =
+    data !== null &&
+    data !== undefined &&
+    typeof data === "object" &&
+    "reason" in data &&
+    typeof (data as { reason: unknown }).reason === "string"
+      ? (data as { reason: string }).reason
+      : undefined;
+  if (reason) {
+    const keyed = en[`${code}.${reason}` as keyof typeof en];
+    if (keyed !== undefined) return keyed;
+  }
+  return en[code as keyof typeof en] ?? code;
+}

package/src/console/server/vault.ts

@@ -6,21 +6,16 @@
  * rotation blast radius are derived — never reimplemented in the UI.
  */
 
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
 import type { ConfigEnv } from "../../config/index.ts";
-import { envVaultDriver, memoryVaultDriver, openbaoVaultDriver } from "../../drivers/index.ts";
-import { parseDotenv } from "../../drivers/vault-dotenv-parse.ts";
+import { buildVaultBootChain } from "../../elements/vault/boot-chain.ts";
 import {
   createVaultRuntime,
   vault as declareVault,
-  type VaultChainLayer,
   type VaultResolutionSource,
   type VaultResolutionStep,
   type VaultRuntime,
   type VaultSecretDecl,
 } from "../../elements/vault.ts";
-import { resolveComposeEnvPath } from "../../elements/vault/chain.ts";
 import type { JournalRun, JournalStore } from "../../kernel/journal.ts";
 import type { Manifest } from "../../manifest/types.ts";
 
@@ -236,41 +231,20 @@ export async function createManifestVaultRuntime(
   });
 
   const seed = options.seed ?? {};
-  const composeEnv = resolveComposeEnvPath(cwd);
-  const envMap = parseDotenv(readFileSync(composeEnv.path, "utf8").toString());
-  const openbaoUrl = process.env.OKE_VAULT_URL ?? envMap.get("OKE_VAULT_URL");
-  const openbaoToken = process.env.OKE_VAULT_TOKEN ?? envMap.get("OKE_VAULT_TOKEN");
-  const openbaoMount = process.env.OKE_VAULT_MOUNT ?? envMap.get("OKE_VAULT_MOUNT") ?? "secret";
-  const driverLayer: VaultChainLayer =
-    openbaoUrl && openbaoToken
-      ? {
-          driver: openbaoVaultDriver,
-          source: "driver",
-          options: { url: openbaoUrl, token: openbaoToken, mount: openbaoMount },
-        }
-      : {
-          driver: memoryVaultDriver,
-          source: "driver",
-          options: { secrets: seed },
-        };
+  const env = options.env ?? "local";
+  // Auto-detect: prefer OpenBao when credentials exist; soft-fallback to memory
+  // (historical Console behaviour — never fail the Console for missing vault).
   const runtime = createVaultRuntime({
     secrets,
-    allowDevFallbacks: options.allowDevFallbacks ?? (options.env ?? "local") !== "prod",
+    allowDevFallbacks: options.allowDevFallbacks ?? env !== "prod",
     now: options.now,
-    chain: [
-      { driver: envVaultDriver, source: "process.env" },
-      {
-        driver: envVaultDriver,
-        source: ".env.local",
-        options: { path: resolve(cwd, ".env.local") },
-      },
-      {
-        driver: envVaultDriver,
-        source: composeEnv.source,
-        options: { path: composeEnv.path },
-      },
-      driverLayer,
-    ],
+    chain: buildVaultBootChain({
+      cwd,
+      driverId: "openbao",
+      env,
+      seed,
+      missingOpenbao: "memory",
+    }),
   });
   await runtime.boot();
   return runtime;