rnxsim 0.1.514 → 0.1.516

package/src/cloud-contract.ts

@@ -6,25 +6,51 @@ export const RNX_CLOUD_DESIGN_MAX_STORAGE_BYTES = 1024 * 1024
 export const RNX_CLOUD_TEST_FILES_MAX_COUNT = 256
 export const RNX_CLOUD_TEST_FILES_MAX_BYTES = 500_000
 
-export const RNX_CLOUD_COMMAND_TYPES = Object.freeze([
-  'state',
-  'query',
-  'resolve',
-  'perform',
-  'waitFor',
-  'reset',
-  'screenshot',
-  'capture',
-  'captureRegions',
-  'settle',
-  'setAppearance',
-  'openUrl',
-  'tree',
-  'tap',
-  'longPress',
-  'memory',
-  'diagnostics',
-]) satisfies readonly BridgeCommandType[]
+export type RnxCloudCommandScope = 'read' | 'drive' | 'reset' | 'media' | 'debug'
+
+// one scope table for both remote planes: every bridge verb names the scope
+// that may send it, so the nano service and the box relay admit the same
+// vocabulary and differ only by caller scope. reads observe, drive moves,
+// reset wipes, media injects camera fixtures, and debug evaluates.
+export const RNX_CLOUD_COMMAND_SCOPES = {
+  state: 'read',
+  tree: 'read',
+  query: 'read',
+  resolve: 'read',
+  screenshot: 'read',
+  capture: 'read',
+  captureRegions: 'read',
+  memory: 'read',
+  diagnostics: 'read',
+  storageSnapshot: 'read',
+  perform: 'drive',
+  waitFor: 'drive',
+  tap: 'drive',
+  longPress: 'drive',
+  settle: 'drive',
+  openUrl: 'drive',
+  setAppearance: 'drive',
+  keyboard: 'drive',
+  focus: 'drive',
+  flowStatus: 'drive',
+  reset: 'reset',
+  camera: 'media',
+  // string evaluation and arbitrary bridge calls are maestro's boundary: the
+  // customer sdk never carries this scope, and the service grants it only to
+  // the account api key caller. close rides along, since ending the page ends
+  // the sim and belongs to the sim's owner rather than any driver.
+  evaluate: 'debug',
+  call: 'debug',
+  close: 'debug',
+} satisfies Record<BridgeCommandType, RnxCloudCommandScope>
+
+function scopeTableKeys(): BridgeCommandType[] {
+  return Object.keys(RNX_CLOUD_COMMAND_SCOPES).filter((key): key is BridgeCommandType =>
+    Object.prototype.hasOwnProperty.call(RNX_CLOUD_COMMAND_SCOPES, key),
+  )
+}
+
+export const RNX_CLOUD_COMMAND_TYPES = Object.freeze(scopeTableKeys())
 
 const RNX_CLOUD_COMMAND_TYPE_SET = new Set<string>(RNX_CLOUD_COMMAND_TYPES)
 
@@ -34,6 +60,32 @@ export function isRnxCloudCommandType(
   return RNX_CLOUD_COMMAND_TYPE_SET.has(value)
 }
 
+export function rnxCloudCommandScope(type: BridgeCommandType): RnxCloudCommandScope {
+  return RNX_CLOUD_COMMAND_SCOPES[type]
+}
+
+// what the full per-simulator token and the box token carry until scoped
+// tokens exist: every scope except debug.
+export const RNX_CLOUD_TOKEN_SCOPES: readonly RnxCloudCommandScope[] = Object.freeze([
+  'read',
+  'drive',
+  'reset',
+  'media',
+])
+
+// every scope, granted only to the account api key caller through the account
+// service. the only credential the services accept for it today is the shared
+// service key, which only the account service holds.
+export const RNX_CLOUD_ALL_COMMAND_SCOPES: readonly RnxCloudCommandScope[] =
+  Object.freeze(['read', 'drive', 'reset', 'media', 'debug'])
+
+export function rnxCloudScopesAllowCommand(
+  scopes: readonly RnxCloudCommandScope[],
+  type: BridgeCommandType,
+): boolean {
+  return scopes.includes(RNX_CLOUD_COMMAND_SCOPES[type])
+}
+
 export interface RnxCloudClaim {
   id: string
   expiresAt: number

package/src/cloud.ts

@@ -14,6 +14,9 @@ import {
   isRnxCloudCommandType,
   RNX_CLOUD_COMMAND_TYPES,
   RNX_CLOUD_MAX_ARTIFACT_BYTES,
+  RNX_CLOUD_TOKEN_SCOPES,
+  rnxCloudCommandScope,
+  rnxCloudScopesAllowCommand,
   type RnxCloudBoxCreateReceipt,
   type RnxCloudClaim,
   type RnxCloudCreateReceipt,
@@ -338,6 +341,13 @@ function cloudCommand(command: { type: string; [key: string]: unknown }): Remote
   if (!isRnxCloudCommandType(command.type)) {
     throw new Error(`RNX Cloud does not support bridge command type ${command.type}`)
   }
+  // the customer sdk never carries debug: evaluate/call/close belong to the
+  // account api key caller. refusing here names the scope before a request.
+  if (!rnxCloudScopesAllowCommand(RNX_CLOUD_TOKEN_SCOPES, command.type)) {
+    throw new Error(
+      `RNX Cloud command ${command.type} requires the ${rnxCloudCommandScope(command.type)} scope`,
+    )
+  }
   return { ...clean, type: command.type }
 }