scene-capability-engine 3.6.2 → 3.6.3

package/lib/state/sce-state-store.js

@@ -1,4 +1,5 @@
-const path = require('path');
+const path = require('path');
+const crypto = require('crypto');
 const fs = require('fs-extra');
 
 const DEFAULT_BACKEND = 'sqlite';
@@ -31,6 +32,27 @@ function parseJsonSafe(value, fallback) {
   }
 }
 
+function normalizeStringArray(value, fallback = []) {
+  if (!Array.isArray(value)) {
+    return [...fallback];
+  }
+  return value
+    .map((item) => normalizeString(item))
+    .filter(Boolean);
+}
+
+function normalizeIsoTimestamp(value, fallback = '') {
+  const normalized = normalizeString(value);
+  if (!normalized) {
+    return normalizeString(fallback);
+  }
+  const parsed = Date.parse(normalized);
+  if (!Number.isFinite(parsed)) {
+    return normalizeString(fallback);
+  }
+  return new Date(parsed).toISOString();
+}
+
 function formatSegment(value) {
   const normalized = normalizeInteger(value, 0);
   if (normalized <= 0) {
@@ -83,6 +105,8 @@ class SceStateStore {
       specs: {},
       tasks: {},
       refs: {},
+      auth_leases: {},
+      auth_events: [],
       sequences: {
         scene_next: 1,
         spec_next_by_scene: {},
@@ -181,6 +205,39 @@ class SceStateStore {
 
       CREATE INDEX IF NOT EXISTS idx_studio_event_stream_job_ts
         ON studio_event_stream(job_id, event_timestamp);
+
+      CREATE TABLE IF NOT EXISTS auth_lease_registry (
+        lease_id TEXT PRIMARY KEY,
+        subject TEXT NOT NULL,
+        role TEXT NOT NULL,
+        scope_json TEXT NOT NULL,
+        reason TEXT,
+        metadata_json TEXT,
+        issued_at TEXT NOT NULL,
+        expires_at TEXT NOT NULL,
+        revoked_at TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_auth_lease_registry_expires
+        ON auth_lease_registry(expires_at);
+
+      CREATE TABLE IF NOT EXISTS auth_event_stream (
+        event_id TEXT PRIMARY KEY,
+        event_timestamp TEXT NOT NULL,
+        event_type TEXT NOT NULL,
+        action TEXT,
+        actor TEXT,
+        lease_id TEXT,
+        result TEXT,
+        target TEXT,
+        detail_json TEXT,
+        created_at TEXT NOT NULL
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_auth_event_stream_ts
+        ON auth_event_stream(event_timestamp);
     `);
   }
 
@@ -264,6 +321,43 @@ class SceStateStore {
     };
   }
 
+  _mapAuthLeaseRow(row) {
+    if (!row) {
+      return null;
+    }
+    return {
+      lease_id: normalizeString(row.lease_id),
+      subject: normalizeString(row.subject),
+      role: normalizeString(row.role),
+      scope: normalizeStringArray(parseJsonSafe(row.scope_json, []), ['project:*']),
+      reason: normalizeString(row.reason) || null,
+      metadata: parseJsonSafe(row.metadata_json, {}) || {},
+      issued_at: normalizeIsoTimestamp(row.issued_at) || null,
+      expires_at: normalizeIsoTimestamp(row.expires_at) || null,
+      revoked_at: normalizeIsoTimestamp(row.revoked_at) || null,
+      created_at: normalizeIsoTimestamp(row.created_at) || null,
+      updated_at: normalizeIsoTimestamp(row.updated_at) || null
+    };
+  }
+
+  _mapAuthEventRow(row) {
+    if (!row) {
+      return null;
+    }
+    return {
+      event_id: normalizeString(row.event_id),
+      event_timestamp: normalizeIsoTimestamp(row.event_timestamp) || null,
+      event_type: normalizeString(row.event_type),
+      action: normalizeString(row.action) || null,
+      actor: normalizeString(row.actor) || null,
+      lease_id: normalizeString(row.lease_id) || null,
+      result: normalizeString(row.result) || null,
+      target: normalizeString(row.target) || null,
+      detail: parseJsonSafe(row.detail_json, {}) || {},
+      created_at: normalizeIsoTimestamp(row.created_at) || null
+    };
+  }
+
   async resolveOrCreateTaskRef(options = {}) {
     const sceneId = normalizeString(options.sceneId);
     const specId = normalizeString(options.specId);
@@ -510,6 +604,287 @@ class SceStateStore {
     return events;
   }
 
+  async issueAuthLease(options = {}) {
+    const subject = normalizeString(options.subject) || 'unknown';
+    const role = normalizeString(options.role) || 'maintainer';
+    const scope = normalizeStringArray(options.scope, ['project:*']);
+    const reason = normalizeString(options.reason) || null;
+    const metadata = options.metadata && typeof options.metadata === 'object'
+      ? options.metadata
+      : {};
+    const issuedAt = normalizeIsoTimestamp(options.issued_at || options.issuedAt, this.now()) || this.now();
+    const ttlMinutes = normalizeInteger(options.ttl_minutes || options.ttlMinutes, 15);
+    const fallbackExpiresAt = new Date(
+      (Date.parse(issuedAt) || Date.now()) + (Math.max(ttlMinutes, 1) * 60 * 1000)
+    ).toISOString();
+    const expiresAt = normalizeIsoTimestamp(options.expires_at || options.expiresAt, fallbackExpiresAt) || fallbackExpiresAt;
+    const leaseId = normalizeString(options.lease_id || options.leaseId)
+      || `lease-${Date.now()}-${crypto.randomBytes(4).toString('hex')}`;
+    const nowIso = this.now();
+
+    if (this._useMemoryBackend()) {
+      return this._issueAuthLeaseInMemory({
+        leaseId,
+        subject,
+        role,
+        scope,
+        reason,
+        metadata,
+        issuedAt,
+        expiresAt,
+        nowIso
+      });
+    }
+
+    if (!await this.ensureReady()) {
+      return null;
+    }
+
+    this._db
+      .prepare(`
+        INSERT OR REPLACE INTO auth_lease_registry(
+          lease_id, subject, role, scope_json, reason, metadata_json, issued_at, expires_at, revoked_at, created_at, updated_at
+        )
+        VALUES(?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?)
+      `)
+      .run(
+        leaseId,
+        subject,
+        role,
+        JSON.stringify(scope),
+        reason,
+        JSON.stringify(metadata),
+        issuedAt,
+        expiresAt,
+        nowIso,
+        nowIso
+      );
+
+    return this.getAuthLease(leaseId);
+  }
+
+  async getAuthLease(leaseId) {
+    const normalizedLeaseId = normalizeString(leaseId);
+    if (!normalizedLeaseId) {
+      return null;
+    }
+
+    if (this._useMemoryBackend()) {
+      const row = this._memory.auth_leases[normalizedLeaseId];
+      return row
+        ? {
+          ...row,
+          scope: normalizeStringArray(row.scope, ['project:*']),
+          metadata: { ...(row.metadata || {}) }
+        }
+        : null;
+    }
+
+    if (!await this.ensureReady()) {
+      return null;
+    }
+
+    const row = this._db
+      .prepare(`
+        SELECT lease_id, subject, role, scope_json, reason, metadata_json, issued_at, expires_at, revoked_at, created_at, updated_at
+        FROM auth_lease_registry
+        WHERE lease_id = ?
+      `)
+      .get(normalizedLeaseId);
+    return this._mapAuthLeaseRow(row);
+  }
+
+  async listAuthLeases(options = {}) {
+    const activeOnly = options.activeOnly !== false;
+    const limit = normalizeInteger(options.limit, 20);
+    const nowIso = this.now();
+
+    if (this._useMemoryBackend()) {
+      let rows = Object.values(this._memory.auth_leases || {}).map((item) => ({
+        ...item,
+        scope: normalizeStringArray(item.scope, ['project:*']),
+        metadata: { ...(item.metadata || {}) }
+      }));
+      if (activeOnly) {
+        const nowTime = Date.parse(nowIso) || Date.now();
+        rows = rows.filter((item) => {
+          const revokedAt = normalizeString(item.revoked_at);
+          if (revokedAt) {
+            return false;
+          }
+          const expiresAt = Date.parse(item.expires_at || '') || 0;
+          return expiresAt > nowTime;
+        });
+      }
+      rows.sort((left, right) => (Date.parse(right.created_at || '') || 0) - (Date.parse(left.created_at || '') || 0));
+      return limit > 0 ? rows.slice(0, limit) : rows;
+    }
+
+    if (!await this.ensureReady()) {
+      return null;
+    }
+
+    const query = activeOnly
+      ? `
+        SELECT lease_id, subject, role, scope_json, reason, metadata_json, issued_at, expires_at, revoked_at, created_at, updated_at
+        FROM auth_lease_registry
+        WHERE revoked_at IS NULL AND expires_at > ?
+        ORDER BY created_at DESC
+        LIMIT ?
+      `
+      : `
+        SELECT lease_id, subject, role, scope_json, reason, metadata_json, issued_at, expires_at, revoked_at, created_at, updated_at
+        FROM auth_lease_registry
+        ORDER BY created_at DESC
+        LIMIT ?
+      `;
+
+    const statement = this._db.prepare(query);
+    const rows = activeOnly
+      ? statement.all(nowIso, limit)
+      : statement.all(limit);
+    return rows
+      .map((row) => this._mapAuthLeaseRow(row))
+      .filter(Boolean);
+  }
+
+  async revokeAuthLease(leaseId, options = {}) {
+    const normalizedLeaseId = normalizeString(leaseId);
+    if (!normalizedLeaseId) {
+      return null;
+    }
+    const revokedAt = normalizeIsoTimestamp(options.revoked_at || options.revokedAt, this.now()) || this.now();
+
+    if (this._useMemoryBackend()) {
+      const existing = this._memory.auth_leases[normalizedLeaseId];
+      if (!existing) {
+        return null;
+      }
+      existing.revoked_at = revokedAt;
+      existing.updated_at = revokedAt;
+      this._memory.auth_leases[normalizedLeaseId] = existing;
+      return {
+        ...existing,
+        scope: normalizeStringArray(existing.scope, ['project:*']),
+        metadata: { ...(existing.metadata || {}) }
+      };
+    }
+
+    if (!await this.ensureReady()) {
+      return null;
+    }
+
+    this._db
+      .prepare('UPDATE auth_lease_registry SET revoked_at = ?, updated_at = ? WHERE lease_id = ?')
+      .run(revokedAt, revokedAt, normalizedLeaseId);
+    return this.getAuthLease(normalizedLeaseId);
+  }
+
+  async appendAuthEvent(event = {}) {
+    const eventType = normalizeString(event.event_type || event.eventType);
+    if (!eventType) {
+      return false;
+    }
+    const eventId = normalizeString(event.event_id || event.eventId)
+      || `auth-evt-${Date.now()}-${crypto.randomBytes(3).toString('hex')}`;
+    const timestamp = normalizeIsoTimestamp(event.event_timestamp || event.timestamp, this.now()) || this.now();
+    const normalizedEvent = {
+      event_id: eventId,
+      event_timestamp: timestamp,
+      event_type: eventType,
+      action: normalizeString(event.action) || null,
+      actor: normalizeString(event.actor) || null,
+      lease_id: normalizeString(event.lease_id || event.leaseId) || null,
+      result: normalizeString(event.result) || null,
+      target: normalizeString(event.target) || null,
+      detail: event.detail && typeof event.detail === 'object'
+        ? event.detail
+        : {}
+    };
+
+    if (this._useMemoryBackend()) {
+      const existingIndex = this._memory.auth_events
+        .findIndex((item) => normalizeString(item.event_id) === eventId);
+      const row = {
+        ...normalizedEvent,
+        created_at: this.now()
+      };
+      if (existingIndex >= 0) {
+        this._memory.auth_events[existingIndex] = row;
+      } else {
+        this._memory.auth_events.push(row);
+      }
+      this._memory.auth_events.sort((left, right) => {
+        const l = Date.parse(left.event_timestamp || '') || 0;
+        const r = Date.parse(right.event_timestamp || '') || 0;
+        return l - r;
+      });
+      return true;
+    }
+
+    if (!await this.ensureReady()) {
+      return false;
+    }
+
+    this._db
+      .prepare(`
+        INSERT OR REPLACE INTO auth_event_stream(
+          event_id, event_timestamp, event_type, action, actor, lease_id, result, target, detail_json, created_at
+        )
+        VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `)
+      .run(
+        normalizedEvent.event_id,
+        normalizedEvent.event_timestamp,
+        normalizedEvent.event_type,
+        normalizedEvent.action,
+        normalizedEvent.actor,
+        normalizedEvent.lease_id,
+        normalizedEvent.result,
+        normalizedEvent.target,
+        JSON.stringify(normalizedEvent.detail || {}),
+        this.now()
+      );
+    return true;
+  }
+
+  async listAuthEvents(options = {}) {
+    const limit = normalizeInteger(options.limit, 50);
+
+    if (this._useMemoryBackend()) {
+      const rows = [...this._memory.auth_events]
+        .sort((left, right) => (Date.parse(right.event_timestamp || '') || 0) - (Date.parse(left.event_timestamp || '') || 0))
+        .map((row) => ({
+          ...row,
+          detail: row.detail && typeof row.detail === 'object' ? row.detail : {}
+        }));
+      return limit > 0 ? rows.slice(0, limit) : rows;
+    }
+
+    if (!await this.ensureReady()) {
+      return null;
+    }
+
+    const query = limit > 0
+      ? `
+        SELECT event_id, event_timestamp, event_type, action, actor, lease_id, result, target, detail_json, created_at
+        FROM auth_event_stream
+        ORDER BY event_timestamp DESC
+        LIMIT ?
+      `
+      : `
+        SELECT event_id, event_timestamp, event_type, action, actor, lease_id, result, target, detail_json, created_at
+        FROM auth_event_stream
+        ORDER BY event_timestamp DESC
+      `;
+
+    const statement = this._db.prepare(query);
+    const rows = limit > 0 ? statement.all(limit) : statement.all();
+    return rows
+      .map((row) => this._mapAuthEventRow(row))
+      .filter(Boolean);
+  }
+
   _resolveOrCreateTaskRefInMemory(options = {}) {
     const sceneId = normalizeString(options.sceneId);
     const specId = normalizeString(options.specId);
@@ -566,6 +941,30 @@ class SceStateStore {
     this._memory.refs[taskRef] = row;
     return { ...row, metadata: { ...(row.metadata || {}) } };
   }
+
+  _issueAuthLeaseInMemory(options = {}) {
+    const leaseId = normalizeString(options.leaseId)
+      || `lease-${Date.now()}-${crypto.randomBytes(4).toString('hex')}`;
+    const row = {
+      lease_id: leaseId,
+      subject: normalizeString(options.subject) || 'unknown',
+      role: normalizeString(options.role) || 'maintainer',
+      scope: normalizeStringArray(options.scope, ['project:*']),
+      reason: normalizeString(options.reason) || null,
+      metadata: options.metadata && typeof options.metadata === 'object' ? { ...options.metadata } : {},
+      issued_at: normalizeIsoTimestamp(options.issuedAt, this.now()) || this.now(),
+      expires_at: normalizeIsoTimestamp(options.expiresAt, this.now()) || this.now(),
+      revoked_at: null,
+      created_at: normalizeIsoTimestamp(options.nowIso, this.now()) || this.now(),
+      updated_at: normalizeIsoTimestamp(options.nowIso, this.now()) || this.now()
+    };
+    this._memory.auth_leases[leaseId] = row;
+    return {
+      ...row,
+      scope: normalizeStringArray(row.scope, ['project:*']),
+      metadata: { ...(row.metadata || {}) }
+    };
+  }
 }
 
 const STORE_CACHE = new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scene-capability-engine",
-  "version": "3.6.2",
+  "version": "3.6.3",
   "description": "SCE (Scene Capability Engine) - A CLI tool and npm package for spec-driven development with AI coding assistants.",
   "main": "index.js",
   "bin": {