pilotswarm 0.5.13 → 0.5.14

package/web/api/router.js

@@ -137,12 +137,12 @@ export function createApiRouter({ runtime, requireAuth }) {
             return;
         }
         try {
-            const artifact = await runtime.downloadArtifactBinary(req.params.sessionId, req.params.filename);
+            const artifact = await runtime.downloadArtifactBinary(req.params.sessionId, req.params.filename, req.auth);
             res.setHeader("content-type", String(artifact?.contentType || "application/octet-stream"));
             res.setHeader("content-disposition", `attachment; filename="${path.basename(req.params.filename)}"`);
             res.send(artifact.body);
         } catch (error) {
-            sendError(res, error, 404);
+            sendError(res, error, error?.code === "FORBIDDEN" ? 403 : 404);
         }
     });
 
@@ -151,10 +151,11 @@ export function createApiRouter({ runtime, requireAuth }) {
         const expressPath = op.path.replace(/:([\w]+)/g, ":$1");
         router[op.method.toLowerCase()](expressPath, async (req, res) => {
             try {
-                // Tier-2 operational ops require the admin role. This is the
-                // API's only per-route role check; every other op shares the
-                // binary admission gate (requireAuth above).
-                if (op.admin && !isAdminAuth(req.auth)) {
+                // Tier-2 operational ops require the admin role — a hard gate
+                // regardless of the ownership dark-launch flag. Finer-grained
+                // ownership/visibility classes (op.access) are enforced inside
+                // runtime.call(), the shared dispatch chokepoint.
+                if ((op.admin || op.access === "fleet:admin") && !isAdminAuth(req.auth)) {
                     sendError(res, Object.assign(new Error("This operation requires the admin role."), { code: "FORBIDDEN" }), 403);
                     return;
                 }

package/web/api/ws.js

@@ -52,6 +52,11 @@ export function createConnectionHandler(runtime, { allowThemeMessages = false }
                 if (!sessionId || sessionSubscriptions.has(sessionId)) return;
                 try {
                     await runtime.start();
+                    // Ownership/visibility gate: live events are a content
+                    // read, same predicate as the REST catch-up path.
+                    if (typeof runtime.authorizeSessionSubscribe === "function") {
+                        await runtime.authorizeSessionSubscribe(sessionId, auth);
+                    }
                     const unsubscribe = runtime.subscribeSession(sessionId, (event) => {
                         send({ type: "sessionEvent", sessionId, event });
                     });
@@ -77,6 +82,10 @@ export function createConnectionHandler(runtime, { allowThemeMessages = false }
                 if (logUnsubscribe) return;
                 try {
                     await runtime.start();
+                    // Log tail is fleet-wide observability: admin-gated.
+                    if (typeof runtime.authorizeLogSubscribe === "function") {
+                        await runtime.authorizeLogSubscribe(auth);
+                    }
                     logUnsubscribe = runtime.startLogTail((entry) => {
                         send({ type: "logEntry", entry });
                     });

package/web/auth/index.js

@@ -1,11 +1,16 @@
 import { createNoAuthProvider } from "./providers/none.js";
 import { createEntraAuthProvider } from "./providers/entra.js";
+import { createDevAuthProvider } from "./providers/dev.js";
 import { authorizePrincipal } from "./authz/engine.js";
 import { loadAuthorizationPolicy, resolveAuthProviderId, resolvePluginAuthConfigFromPluginDirs } from "./config.js";
 
 const PROVIDERS = {
     none: createNoAuthProvider,
     entra: createEntraAuthProvider,
+    // Test personas, no real authentication. Never inferred — only an explicit
+    // PORTAL_AUTH_PROVIDER=dev selects it, and its factory throws without
+    // PORTAL_AUTH_DEV_ALLOW=true (see providers/dev.js).
+    dev: createDevAuthProvider,
 };
 
 const NO_AUTH_UNKNOWN_PRINCIPAL = Object.freeze({

package/web/auth/providers/dev.js

@@ -0,0 +1,119 @@
+// Development auth provider: authenticates as one of a small roster of
+// predefined personas with zero IdP involvement. The "token" is the literal
+// string `dev:<persona>` so it rides every existing credential path (Bearer
+// header, WebSocket subprotocol, PILOTSWARM_API_TOKEN) unchanged.
+//
+// This provider exists to exercise the multi-user security model (ownership,
+// visibility, sharing) on a laptop — see
+// docs/proposals/dev-auth-provider-and-multiuser-test-plan.md. Any holder of
+// the string IS that persona, so the guards below are deliberately strict:
+// never inferred, explicit second opt-in env, and mutual exclusion with Entra.
+
+const DEV_BANNER = "DEV AUTH — not for production";
+
+const DEFAULT_ROSTER = [
+    { id: "ada", displayName: "Ada Admin", role: "admin" },
+    { id: "alice", displayName: "Alice Anderson", role: "user" },
+    { id: "bob", displayName: "Bob Baker", role: "user" },
+    { id: "carol", displayName: "Carol Chen", role: "user" },
+    { id: "dave", displayName: "Dave Diaz", role: "user" },
+];
+
+function isTruthyEnv(value) {
+    return ["1", "true", "yes", "on"].includes(String(value || "").trim().toLowerCase());
+}
+
+function titleCase(id) {
+    return id.charAt(0).toUpperCase() + id.slice(1);
+}
+
+export function parseDevRoster(raw) {
+    const trimmed = String(raw || "").trim();
+    if (!trimmed) {
+        return DEFAULT_ROSTER.map((persona) => ({ ...persona, email: `${persona.id}@dev.local` }));
+    }
+    const personas = [];
+    const seen = new Set();
+    for (const entry of trimmed.split(",")) {
+        const cleaned = entry.trim();
+        if (!cleaned) continue;
+        const [rawId, rawRole] = cleaned.split(":").map((part) => String(part || "").trim());
+        const id = rawId.toLowerCase();
+        const role = String(rawRole || "user").toLowerCase();
+        if (!/^[a-z][a-z0-9_-]*$/.test(id)) {
+            throw new Error(`[portal-auth:dev] Invalid persona id "${rawId}" in PORTAL_AUTH_DEV_USERS (expected [a-z][a-z0-9_-]*)`);
+        }
+        if (role !== "admin" && role !== "user") {
+            throw new Error(`[portal-auth:dev] Invalid role "${rawRole}" for persona "${id}" in PORTAL_AUTH_DEV_USERS (expected admin|user)`);
+        }
+        if (seen.has(id)) {
+            throw new Error(`[portal-auth:dev] Duplicate persona id "${id}" in PORTAL_AUTH_DEV_USERS`);
+        }
+        seen.add(id);
+        personas.push({
+            id,
+            displayName: `${titleCase(id)} (dev)`,
+            email: `${id}@dev.local`,
+            role,
+        });
+    }
+    if (personas.length === 0) {
+        throw new Error("[portal-auth:dev] PORTAL_AUTH_DEV_USERS is set but contains no personas");
+    }
+    return personas;
+}
+
+export function createDevAuthProvider({ env = process.env } = {}) {
+    const configuredEntraKeys = Object.entries(env)
+        .filter(([key, value]) => key.startsWith("PORTAL_AUTH_ENTRA_") && String(value || "").trim())
+        .map(([key]) => key);
+    if (configuredEntraKeys.length > 0) {
+        throw new Error(
+            `[portal-auth:dev] Refusing to start: PORTAL_AUTH_ENTRA_* is configured (${configuredEntraKeys.join(", ")}). `
+            + "The dev provider performs no real authentication and cannot coexist with a real identity provider.",
+        );
+    }
+    if (!isTruthyEnv(env.PORTAL_AUTH_DEV_ALLOW)) {
+        throw new Error(
+            "[portal-auth:dev] Refusing to start: the dev auth provider authenticates anyone as any persona. "
+            + "Set PORTAL_AUTH_DEV_ALLOW=true to explicitly opt in (local development only).",
+        );
+    }
+
+    const roster = parseDevRoster(env.PORTAL_AUTH_DEV_USERS);
+    const personasById = new Map(roster.map((persona) => [persona.id, persona]));
+
+    return {
+        id: "dev",
+        enabled: true,
+        displayName: "Dev Auth (testing)",
+        async authenticateRequest(token) {
+            if (typeof token !== "string" || !token.startsWith("dev:")) return null;
+            const persona = personasById.get(token.slice(4).trim().toLowerCase());
+            if (!persona) return null;
+            return {
+                provider: "dev",
+                subject: persona.id,
+                email: persona.email,
+                displayName: persona.displayName,
+                groups: [],
+                // Non-empty roles[] makes the authz engine decide from roles
+                // authoritatively — the same decision path Entra app roles use.
+                roles: [persona.role],
+                tenantId: null,
+                rawClaims: { dev: true, persona: persona.id },
+            };
+        },
+        async getPublicConfig() {
+            return {
+                enabled: true,
+                provider: "dev",
+                displayName: "Dev Auth (testing)",
+                banner: DEV_BANNER,
+                client: {
+                    users: roster.map(({ id, displayName, email, role }) => ({ id, displayName, email, role })),
+                },
+            };
+        },
+    };
+}

package/web/authz.js

@@ -0,0 +1,142 @@
+import { OPERATIONS } from "pilotswarm-sdk/api";
+
+/**
+ * Ownership/visibility authorization for the portal runtime
+ * (docs/proposals/user-admin-security-model.md).
+ *
+ * The protocol table classifies every operation (`op.access`); this module
+ * evaluates the session-tree predicate for the classes that need a resource
+ * lookup. `runtime.call()` is the single enforcement point — both the
+ * generated /api/v1 routes and the legacy /api/rpc dispatcher land there.
+ *
+ * Dark launch: with AUTHZ_ENFORCE_OWNERSHIP=false (the default) every
+ * decision is computed and would-be denials are recorded in the authz audit
+ * table, but nothing is blocked. Flipping the env to true makes the same
+ * decisions enforcing — the audit stream is the pre-flip verification.
+ */
+
+function parseBooleanEnv(value, defaultValue) {
+    if (value == null || value === "") return defaultValue;
+    return ["1", "true", "yes", "on"].includes(String(value).trim().toLowerCase());
+}
+
+const VISIBILITY_VALUES = new Set(["private", "shared_read", "shared_write"]);
+
+export function loadAuthzConfig(env = process.env) {
+    const rawDefault = String(env.SESSIONS_DEFAULT_VISIBILITY || "").trim().toLowerCase();
+    return {
+        enforce: parseBooleanEnv(env.AUTHZ_ENFORCE_OWNERSHIP, false),
+        defaultVisibility: VISIBILITY_VALUES.has(rawDefault) ? rawDefault : "private",
+        // "read" (default): system sessions are metadata/content-visible to
+        // every admitted user, interaction stays admin-only. "admin": hidden.
+        systemVisibility: String(env.SESSIONS_SYSTEM_VISIBILITY || "").trim().toLowerCase() === "admin" ? "admin" : "read",
+    };
+}
+
+export function normalizeVisibility(value, fallback) {
+    const normalized = String(value || "").trim().toLowerCase();
+    return VISIBILITY_VALUES.has(normalized) ? normalized : fallback;
+}
+
+// Methods reachable only through /api/rpc (not in the OPERATIONS table).
+const RPC_ONLY_ACCESS = {
+    copyArtifact: "session:copy",
+    setArtifactPinned: "session:manage",
+    readArtifactBase64: "session:read",
+};
+
+const ACCESS_BY_METHOD = new Map(OPERATIONS.map((op) => [op.name, { access: op.access, sessionParam: op.sessionParam || "sessionId" }]));
+for (const [name, access] of Object.entries(RPC_ONLY_ACCESS)) {
+    if (!ACCESS_BY_METHOD.has(name)) ACCESS_BY_METHOD.set(name, { access, sessionParam: "sessionId" });
+}
+
+export function getMethodAccess(method) {
+    return ACCESS_BY_METHOD.get(method) || null;
+}
+
+export function forbiddenError(message) {
+    return Object.assign(new Error(message), { code: "FORBIDDEN", status: 403 });
+}
+
+export function notFoundError() {
+    // Unreadable point-lookups report NOT_FOUND, not FORBIDDEN — an admitted
+    // caller must not be able to probe which session ids exist.
+    return Object.assign(new Error("Session not found."), { code: "NOT_FOUND", status: 404 });
+}
+
+function ownerLabel(snapshot) {
+    return snapshot?.owner?.displayName || snapshot?.owner?.email || snapshot?.owner?.subject || "another user";
+}
+
+/**
+ * The caller's relation to a session tree, recorded on message payloads and
+ * shown to the agent in multi-writer sessions.
+ */
+export function relationFor(snapshot, { isAdmin } = {}) {
+    if (snapshot?.viewerIsOwner) return "owner";
+    if (isAdmin) return "admin";
+    return "collaborator";
+}
+
+/**
+ * Evaluate one session-scoped access class against an access snapshot.
+ *
+ * @param accessClass "session:read" | "session:write" | "session:manage" | "session:destroy" | "session:share"
+ * @param snapshot    result of getSessionAccess (null = missing/deleted session)
+ * @param opts        { isAdmin, systemReadable }
+ * @returns {{ allowed: boolean, notFound?: boolean, reason?: string, breakGlass?: boolean }}
+ */
+export function evaluateSessionAccess(accessClass, snapshot, { isAdmin = false, systemReadable = true } = {}) {
+    if (!snapshot) {
+        // Missing/deleted session: let the underlying operation produce its
+        // own not-found; nothing to protect.
+        return { allowed: true };
+    }
+
+    if (isAdmin) {
+        // Admins pass everything; flag break-glass when this would have been
+        // invisible to a plain user in the same position.
+        const wouldBeInvisible = !snapshot.viewerIsOwner
+            && !snapshot.isSystem
+            && snapshot.visibility === "private"
+            && !snapshot.viewerShareAccess;
+        return { allowed: true, breakGlass: wouldBeInvisible };
+    }
+
+    const isRead = accessClass === "session:read";
+
+    if (snapshot.isSystem) {
+        // When system sessions are hidden from users, every class 404s so a
+        // write attempt can't confirm the session exists (review LOW-2).
+        if (!systemReadable) return { allowed: false, notFound: true };
+        if (isRead) return { allowed: true };
+        return { allowed: false, reason: "System sessions are managed by administrators." };
+    }
+
+    const canRead = snapshot.viewerIsOwner
+        || snapshot.visibility === "shared_read"
+        || snapshot.visibility === "shared_write"
+        || Boolean(snapshot.viewerShareAccess);
+
+    if (isRead) {
+        return canRead ? { allowed: true } : { allowed: false, notFound: true };
+    }
+
+    // Anything beyond read on an unreadable session is also a 404 — the
+    // caller must not learn the session exists from the error shape.
+    if (!canRead) return { allowed: false, notFound: true };
+
+    if (accessClass === "session:write") {
+        const canWrite = snapshot.viewerIsOwner
+            || snapshot.visibility === "shared_write"
+            || snapshot.viewerShareAccess === "write";
+        return canWrite
+            ? { allowed: true }
+            : { allowed: false, reason: `You have read access to this session; write access is required. Ask ${ownerLabel(snapshot)} for write access.` };
+    }
+
+    // manage / destroy / share: owner only (admin handled above).
+    return snapshot.viewerIsOwner
+        ? { allowed: true }
+        : { allowed: false, reason: `Only the session owner (${ownerLabel(snapshot)}) or an admin can do this.` };
+}