sh3-server 0.8.1 → 0.8.2

package/dist/shard-router.js

@@ -1,30 +1,51 @@
 // packages/sh3-server/src/shard-router.ts
 import { Hono } from 'hono';
-import { mkdirSync } from 'node:fs';
+import { mkdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { scopeRequired, tenantRequired } from './scope.js';
 import { pathToFileURL } from 'node:url';
-/** Middleware that requires admin session OR valid API key. */
-export function adminOnly(keys, settings) {
+import { getSyncBundle, createSyncHandle, createSyncRegistry } from 'sh3-core/server-sync';
+/** Middleware requiring the caller's scope set to include admin:*. */
+export function adminOnly(_keys, settings) {
     return async (c, next) => {
-        // When auth is disabled (--no-auth), skip admin checks entirely
-        if (!settings.get().auth.required) {
+        if (!settings.get().auth.required)
             return next();
-        }
-        // Session-based admin — forwarded from upstream sessionAuth via env
-        const session = c.get('session') ?? c.env?.session;
-        if (session?.role === 'admin') {
+        const caller = c.get('caller');
+        if (caller?.scopes.includes('admin:*'))
             return next();
+        return c.json({ error: 'Admin privileges required' }, 403);
+    };
+}
+const PERMISSION_DOCUMENTS_SYNC = 'documents:sync';
+/**
+ * Build a ServerShardContext object for the given shard, wiring
+ * sync/syncRegistry based on the declared permissions.
+ */
+export function buildShardCtx(shardId, dataDir, permissions, keys, settings, wsRegister, documentBackend) {
+    const hasSync = permissions.includes(PERMISSION_DOCUMENTS_SYNC);
+    const ctx = {
+        shardId,
+        dataDir,
+        permissions,
+        adminOnly: adminOnly(keys, settings),
+        scopeRequired,
+        tenantRequired,
+        wsRegister,
+    };
+    ctx.sync = async (tenantId, connectorId) => {
+        if (!hasSync) {
+            throw new Error(`Shard "${shardId}" cannot call ctx.sync — missing '${PERMISSION_DOCUMENTS_SYNC}' permission in manifest.`);
         }
-        // Fallback: API key (for external tools / CLI)
-        const authHeader = c.req.header('Authorization');
-        if (authHeader?.startsWith('Bearer sh3_')) {
-            const token = authHeader.slice(7);
-            if (keys.validate(token)) {
-                return next();
-            }
+        const { engine, registry } = await getSyncBundle(documentBackend, tenantId);
+        return createSyncHandle({ tenantId, connectorId, engine, registry });
+    };
+    ctx.syncRegistry = (tenantId) => {
+        if (!hasSync) {
+            throw new Error(`Shard "${shardId}" cannot call ctx.syncRegistry — missing '${PERMISSION_DOCUMENTS_SYNC}' permission in manifest.`);
         }
-        return c.json({ error: 'Admin privileges required' }, 403);
+        return createSyncRegistry(documentBackend, tenantId);
     };
+    return ctx;
 }
 /**
  * Dynamic shard route manager. Holds a Map of shard Hono sub-apps
@@ -44,13 +65,17 @@ export class ShardRouter {
             throw new Error(`${shardId}/server.js invalid export shape — expected { id, routes }`);
         }
         const shardDataDir = join(ctx.pkgDir, 'data');
+        const manifestPath = join(ctx.pkgDir, 'manifest.json');
+        let permissions = [];
+        try {
+            const manifest = JSON.parse(readFileSync(manifestPath, 'utf-8'));
+            permissions = Array.isArray(manifest.permissions) ? manifest.permissions : [];
+        }
+        catch {
+            // Framework built-ins (mountStatic) may have no sibling manifest; default to empty.
+        }
         const router = new Hono();
-        const shardCtx = {
-            shardId: shard.id,
-            dataDir: shardDataDir,
-            adminOnly: adminOnly(ctx.keys, ctx.settings),
-            wsRegister: ctx.wsRegister,
-        };
+        const shardCtx = buildShardCtx(shard.id, shardDataDir, permissions, ctx.keys, ctx.settings, ctx.wsRegister, ctx.documentBackend);
         await shard.routes(router, shardCtx);
         // Create data dir only after routes() succeeds — so a failure
         // doesn't leave behind a dir that prevents install rollback cleanup.
@@ -68,13 +93,17 @@ export class ShardRouter {
             throw new Error(`${shardId} static mount — expected { id, routes }, got ${typeof mod}`);
         }
         const shardDataDir = join(ctx.pkgDir, 'data');
+        const manifestPath = join(ctx.pkgDir, 'manifest.json');
+        let permissions = [];
+        try {
+            const manifest = JSON.parse(readFileSync(manifestPath, 'utf-8'));
+            permissions = Array.isArray(manifest.permissions) ? manifest.permissions : [];
+        }
+        catch {
+            // Framework built-ins (mountStatic) may have no sibling manifest; default to empty.
+        }
         const router = new Hono();
-        const shardCtx = {
-            shardId: mod.id,
-            dataDir: shardDataDir,
-            adminOnly: adminOnly(ctx.keys, ctx.settings),
-            wsRegister: ctx.wsRegister,
-        };
+        const shardCtx = buildShardCtx(mod.id, shardDataDir, permissions, ctx.keys, ctx.settings, ctx.wsRegister, ctx.documentBackend);
         await mod.routes(router, shardCtx);
         mkdirSync(shardDataDir, { recursive: true });
         this.shards.set(shardId, router);

package/dist/shell-shard/index.d.ts

@@ -1,5 +1,5 @@
 import { Hono } from 'hono';
-import type { Context } from 'hono';
+import type { Context, MiddlewareHandler } from 'hono';
 import type { WsLike } from './session-manager.js';
 export interface ShellServerContext {
     shardId: string;
@@ -8,6 +8,9 @@ export interface ShellServerContext {
     tenantRootBase?: string;
     adminOnly: any;
     wsRegister: (onConnect: (ws: WsLike, c: Context) => void) => any;
+    permissions: string[];
+    scopeRequired: (scope: string) => MiddlewareHandler;
+    tenantRequired: MiddlewareHandler;
 }
 declare const _default: {
     id: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sh3-server",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "type": "module",
   "bin": {
     "sh3-server": "dist/cli.js"