patchwork-os 1.2.0-beta.2.canary.657 → 1.2.0-beta.2.canary.660

package/dist/identity/dashboardSession.js

@@ -0,0 +1,179 @@
+/**
+ * The dashboard session cookie format — ONE implementation, two processes.
+ *
+ * ADR-0020 Phase A. The dashboard mints these at login (`v2.<memberId>.<exp>.<HMAC>`
+ * once a real member authenticates, `v1.<exp>.<HMAC>` when only the shared
+ * password was presented). The BRIDGE now needs to read them too, so that an
+ * approval arriving over the dashboard's proxy can name the human who gave it.
+ *
+ * ## Why this moved here rather than being reimplemented
+ *
+ * The obvious shape is a second verifier on the bridge side. It is also how
+ * this subsystem has failed before: two implementations of one wire format
+ * drift, and the drift here is not a crash. A bridge verifier that is slightly
+ * more permissive than the dashboard's signer accepts a cookie the dashboard
+ * would reject, and the consequence is an audit record naming a person on a
+ * credential nobody would have issued. A format whose two halves disagree is
+ * worse than a format with no second half.
+ *
+ * So the signing and verification live here, once, and `dashboard/src/lib/session.ts`
+ * re-exports them. The dashboard remains the only thing that MINTS a cookie;
+ * the bridge only ever verifies.
+ *
+ * ## Web Crypto only — no `node:` imports in this file
+ *
+ * Load-bearing. The dashboard's consumer runs in the Edge Runtime (middleware),
+ * where `node:crypto` is unavailable. `crypto.subtle` is present in both the
+ * Edge Runtime and every Node version the bridge targets, so one implementation
+ * covers all three. Adding a `node:` import here breaks the dashboard build,
+ * and it breaks it in middleware — the one place where a failure locks every
+ * user out of the dashboard.
+ */
+export const SESSION_COOKIE_NAME = "patchwork_session";
+export const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+function getSecret() {
+    return process.env.DASHBOARD_SESSION_SECRET ?? "";
+}
+function base64url(bytes) {
+    const buf = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    let s = "";
+    for (let i = 0; i < buf.length; i++)
+        s += String.fromCharCode(buf[i] ?? 0);
+    return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlDecode(input) {
+    const padded = input.replace(/-/g, "+").replace(/_/g, "/");
+    const padding = "=".repeat((4 - (padded.length % 4)) % 4);
+    const raw = atob(padded + padding);
+    const bytes = new Uint8Array(new ArrayBuffer(raw.length));
+    for (let i = 0; i < raw.length; i++)
+        bytes[i] = raw.charCodeAt(i);
+    return bytes.buffer;
+}
+async function importKey() {
+    return crypto.subtle.importKey("raw", new TextEncoder().encode(getSecret()), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+}
+async function sign(payload) {
+    const key = await importKey();
+    const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload));
+    return base64url(sig);
+}
+/**
+ * Member ids that are safe inside a dot-delimited cookie payload.
+ *
+ * Load-bearing, not cosmetic. The payload is split on ".", so an id
+ * containing one makes `v2.a.b.123.<sig>` ambiguous — is the subject `a` with
+ * expiry `b.123`, or `a.b` with expiry `123`? Two members could then produce
+ * cookies that parse as each other. Rejected at BOTH ends: signing throws,
+ * verifying returns invalid, because a check on only one side is a check that
+ * a hand-written cookie skips.
+ */
+export const MEMBER_ID_RE = /^[A-Za-z0-9_-]+$/;
+/**
+ * Sign a session cookie.
+ *
+ * With `memberId` → `v2.<memberId>.<expiresAt>.<HMAC>`, an ATTRIBUTED session.
+ * Without → `v1.<expiresAt>.<HMAC>`, exactly as before.
+ *
+ * v1 is still minted on purpose. The dashboard password gate authenticates a
+ * SECRET, not a person, so there is nobody to name; minting a v2 with a
+ * placeholder subject would turn "we do not know who this is" into a claim
+ * about someone. v2 appears only once a real member has authenticated.
+ */
+export async function signSession(expiresAtOrOpts = Date.now() + SESSION_TTL_MS) {
+    const opts = typeof expiresAtOrOpts === "number"
+        ? { expiresAt: expiresAtOrOpts }
+        : expiresAtOrOpts;
+    const expiresAt = opts.expiresAt ?? Date.now() + SESSION_TTL_MS;
+    const memberId = opts.memberId;
+    if (memberId === undefined) {
+        const payload = `v1.${expiresAt}`;
+        return `${payload}.${await sign(payload)}`;
+    }
+    if (!MEMBER_ID_RE.test(memberId)) {
+        throw new Error("memberId must match /^[A-Za-z0-9_-]+$/ — a dot would make the payload ambiguous");
+    }
+    const payload = `v2.${memberId}.${expiresAt}`;
+    return `${payload}.${await sign(payload)}`;
+}
+/**
+ * Verify a session cookie.
+ *
+ * `memberId` is present ONLY for a valid v2 cookie. For v1 it is `undefined`,
+ * and that is the whole point of this function's shape:
+ *
+ *   **a v1 cookie must never read as an attributed v2.**
+ *
+ * A v1 cookie means nobody was identified. If verification returned some
+ * stand-in subject there — the implicit owner, the first member, a literal
+ * "unknown" — the absence of a subject would become a CLAIM of one, and every
+ * record stamped from it would name a person on no evidence. Undefined stays
+ * undefined; callers decide, and must treat it as unattributed.
+ *
+ * The version is inside the SIGNED payload, so a v1 cookie cannot be
+ * re-spelled as a v2 one: the HMAC covers `v1.<exp>` or `v2.<id>.<exp>`, and
+ * those are different strings under the same key.
+ *
+ * With NO secret configured this returns invalid for everything. On the bridge
+ * that is the expected state — the bridge has never been given
+ * `DASHBOARD_SESSION_SECRET` — and it is the correct one: no secret means no
+ * verification means no actor, and an absent actor already means "nobody
+ * recorded this".
+ */
+export async function verifySession(value) {
+    if (!value || !getSecret())
+        return { valid: false };
+    const parts = value.split(".");
+    const version = parts[0];
+    let memberId;
+    let expiresAtStr;
+    let sig;
+    if (version === "v1" && parts.length === 3) {
+        expiresAtStr = parts[1];
+        sig = parts[2];
+    }
+    else if (version === "v2" && parts.length === 4) {
+        memberId = parts[1];
+        expiresAtStr = parts[2];
+        sig = parts[3];
+        // Defence in depth, and honestly redundant TODAY — probed, not assumed.
+        // Removing this line leaves every test green, because an id containing a
+        // "." makes the cookie 5 parts and the arity check above rejects it, while
+        // any other malformed id can only appear in a cookie we signed — and
+        // signing refuses it. The signature stops the rest.
+        //
+        // Kept because the arity check is what currently carries it, and arity
+        // stops discriminating the moment a fifth field is added to this format.
+        // A constraint that survives a format change is worth one line.
+        if (!memberId || !MEMBER_ID_RE.test(memberId))
+            return { valid: false };
+    }
+    else {
+        return { valid: false };
+    }
+    if (!expiresAtStr || !sig)
+        return { valid: false };
+    const expiresAt = Number.parseInt(expiresAtStr, 10);
+    if (!Number.isFinite(expiresAt))
+        return { valid: false };
+    if (Date.now() > expiresAt)
+        return { valid: false };
+    const payload = memberId === undefined
+        ? `v1.${expiresAtStr}`
+        : `v2.${memberId}.${expiresAtStr}`;
+    try {
+        const key = await importKey();
+        const sigBytes = base64urlDecode(sig);
+        const ok = await crypto.subtle.verify("HMAC", key, sigBytes, new TextEncoder().encode(payload));
+        // `memberId` is spread only when defined, so a v1 result has no such key
+        // at all — not a key holding undefined that some later `in` check reads
+        // as present.
+        return ok
+            ? { valid: true, expiresAt, ...(memberId !== undefined && { memberId }) }
+            : { valid: false };
+    }
+    catch {
+        return { valid: false };
+    }
+}
+//# sourceMappingURL=dashboardSession.js.map

package/dist/identity/dashboardSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboardSession.js","sourceRoot":"","sources":["../../src/identity/dashboardSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AACvD,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAElE,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,KAA+B;IAChD,MAAM,GAAG,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,EACrC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,OAAe;IACjC,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAClC,MAAM,EACN,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAClC,CAAC;IACF,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,kBAEgD,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;IAE3E,MAAM,IAAI,GACR,OAAO,eAAe,KAAK,QAAQ;QACjC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE;QAChC,CAAC,CAAC,eAAe,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAE/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,SAAS,EAAE,CAAC;QAClC,OAAO,GAAG,OAAO,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;IAC9C,OAAO,GAAG,OAAO,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAgC;IAEhC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAEzB,IAAI,QAA4B,CAAC;IACjC,IAAI,YAAgC,CAAC;IACrC,IAAI,GAAuB,CAAC;IAE5B,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACf,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,qEAAqE;QACrE,oDAAoD;QACpD,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACzD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAEpD,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,MAAM,YAAY,EAAE;QACtB,CAAC,CAAC,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACnC,MAAM,EACN,GAAG,EACH,QAAQ,EACR,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAClC,CAAC;QACF,yEAAyE;QACzE,wEAAwE;QACxE,cAAc;QACd,OAAO,EAAE;YACP,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE;YACzE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/server.d.ts

@@ -347,6 +347,21 @@ export declare class Server extends EventEmitter<ServerEvents> {
     ntfyServer: string | undefined;
     /** Patchwork: approval decision audit callback wired to activityLog.recordEvent. */
     onApprovalDecision: ((event: string, meta: Record<string, unknown>) => void) | undefined;
+    /**
+     * Patchwork: resolves the human behind a forwarded dashboard session cookie
+     * so an approve/reject can be attributed (ADR-0020 Phase A).
+     *
+     * Built lazily and ONLY when `DASHBOARD_SESSION_SECRET` is present, because
+     * without it `verifySession` rejects every cookie — a resolver that can
+     * never succeed is worth neither the roster read nor the confusion of
+     * appearing wired. Left undefined ⇒ decisions record no actor, which is the
+     * status quo and the honest answer.
+     */
+    resolveApprover: ((sessionCookie?: string) => Promise<{
+        id: string;
+        kind: "human" | "worker";
+        displayName: string;
+    } | undefined>) | undefined;
     /**
      * Patchwork: activity log handle, used by approvalHttp to compute
      * passive risk personalization signals (`src/approvalSignals.ts`).

package/dist/server.js

@@ -284,6 +284,17 @@ export class Server extends EventEmitter {
     ntfyServer = undefined;
     /** Patchwork: approval decision audit callback wired to activityLog.recordEvent. */
     onApprovalDecision = undefined;
+    /**
+     * Patchwork: resolves the human behind a forwarded dashboard session cookie
+     * so an approve/reject can be attributed (ADR-0020 Phase A).
+     *
+     * Built lazily and ONLY when `DASHBOARD_SESSION_SECRET` is present, because
+     * without it `verifySession` rejects every cookie — a resolver that can
+     * never succeed is worth neither the roster read nor the confusion of
+     * appearing wired. Left undefined ⇒ decisions record no actor, which is the
+     * status quo and the honest answer.
+     */
+    resolveApprover = undefined;
     /**
      * Patchwork: activity log handle, used by approvalHttp to compute
      * passive risk personalization signals (`src/approvalSignals.ts`).
@@ -2475,11 +2486,21 @@ export class Server extends EventEmitter {
                         // approvalHttp.ts — is an HMAC over the path and is unaffected.)
                         approvalToken: req.headers["x-approval-token"] ??
                             undefined,
+                        // ADR-0020 Phase A. The dashboard proxy forwards the member's
+                        // own session cookie; the bridge VERIFIES it against
+                        // DASHBOARD_SESSION_SECRET rather than trusting an asserted id,
+                        // so holding the shared bridge token is not enough to put a
+                        // person's name on a decision. A dedicated header, not the
+                        // `Cookie` header: the bridge is not a browser origin and must
+                        // not start reading ambient cookies.
+                        sessionCookie: req.headers["x-patchwork-session"] ??
+                            undefined,
                     }, {
                         queue: getApprovalQueue(),
                         workspace: this.workspace,
                         managedSettingsPath: this.managedSettingsPath,
                         onDecision: this.onApprovalDecision,
+                        resolveApprover: this.resolveApprover,
                         webhookUrl: this.approvalWebhookUrl,
                         approvalGate: this.approvalGate,
                         pushServiceUrl: this.pushServiceUrl,