slotlock 0.6.2 → 0.6.3

package/config.js

@@ -97,15 +97,32 @@ export function readAvailability(env) {
  * (bidi, zero-width) or line separator character, `<` or `>`.
  */
 export const SLOTLOCK_DASHBOARD_NAME_PATTERN = /^[^\p{Cc}\p{Cf}\p{Zl}\p{Zp}<>]{1,60}$/u;
+/**
+ * Setting any of these means serving the dashboard. SLOTLOCK_DASHBOARD_USERS is not one: alone, it
+ * names whose keys a server takes when the dashboard runs elsewhere (readDashboardUsers).
+ */
 const DASHBOARD_VARIABLES = [
     'SLOTLOCK_GITHUB_CLIENT_ID',
     'SLOTLOCK_GITHUB_CLIENT_SECRET',
     'SLOTLOCK_SESSION_SECRET',
-    'SLOTLOCK_DASHBOARD_USERS',
 ];
 /**
- * The dashboard's settings, or undefined when none is set. Setting any of them means serving the
- * dashboard, so the rest are then required: a half-configured sign-in is a startup error.
+ * SLOTLOCK_DASHBOARD_USERS: `'*'`, GitHub user ids, or undefined when it is not set. A server whose
+ * dashboard runs elsewhere (a Worker) reads it too, so that removing a person there stops their keys.
+ */
+export function readDashboardUsers(env) {
+    const users = optional(env, 'SLOTLOCK_DASHBOARD_USERS')?.replaceAll(' ', '');
+    if (users === undefined)
+        return undefined;
+    if (users !== '*' && !/^[1-9]\d{0,19}(,[1-9]\d{0,19})*$/.test(users)) {
+        throw new SlotlockConfigError('SLOTLOCK_DASHBOARD_USERS must be * for every GitHub account, or a comma-separated list of GitHub user ids (gh api users/<login> --jq .id)');
+    }
+    return users === '*' ? '*' : [...new Set(users.split(','))];
+}
+/**
+ * The dashboard's settings, or undefined when none of DASHBOARD_VARIABLES is set. Setting any of
+ * them means serving the dashboard, so the rest, and SLOTLOCK_DASHBOARD_USERS, are then required: a
+ * half-configured sign-in is a startup error.
  */
 export function readDashboardConfig(env) {
     if (DASHBOARD_VARIABLES.every((name) => optional(env, name) === undefined))
@@ -130,8 +147,14 @@ export function readDashboardConfig(env) {
     if (others.includes(sessionSecret)) {
         throw new SlotlockConfigError('SLOTLOCK_SESSION_SECRET must differ from every other secret');
     }
-    const users = optional(env, 'SLOTLOCK_DASHBOARD_USERS')?.replaceAll(' ', '');
-    if (users === undefined || (users !== '*' && !/^[1-9]\d{0,19}(,[1-9]\d{0,19})*$/.test(users))) {
+    let users;
+    try {
+        users = readDashboardUsers(env);
+    }
+    catch {
+        users = undefined;
+    }
+    if (users === undefined) {
         throw new SlotlockConfigError('SLOTLOCK_DASHBOARD_USERS is required to serve the dashboard: * for every GitHub account, or a comma-separated list of GitHub user ids (gh api users/<login> --jq .id)');
     }
     const assistantSecret = readSecret(env, 'SLOTLOCK_ASSISTANT_SECRET');
@@ -152,7 +175,7 @@ export function readDashboardConfig(env) {
         githubClientId,
         githubClientSecret,
         sessionSecret,
-        allowedUsers: users === '*' ? '*' : [...new Set(users.split(','))],
+        allowedUsers: users,
         ...(orgs !== undefined ? { organizations: orgs } : {}),
         ...(name !== undefined && name !== '' ? { name } : {}),
         ...(assistantSecret !== undefined ? { assistantSecret } : {}),
@@ -372,3 +395,18 @@ export function readTrustedProxyHeader(env) {
     }
     return value.toLowerCase();
 }
+/** The request field that carries SLOTLOCK_TRUSTED_PROXY_SECRET; not cf-…, which Cloudflare's rules may not set. */
+export const SLOTLOCK_TRUSTED_PROXY_PROOF_FIELD = 'x-slotlock-proxy-proof';
+/**
+ * SLOTLOCK_TRUSTED_PROXY_SECRET: a value the proxy in front adds to every request in
+ * SLOTLOCK_TRUSTED_PROXY_PROOF_FIELD, such as a Cloudflare transform rule. With it, the trusted
+ * proxy field is believed only beside that value, so a process that reaches the server without
+ * passing the proxy (another container on its network) cannot choose its own client address.
+ */
+export function readTrustedProxySecret(env, trustedProxyHeader) {
+    const value = readSecret(env, 'SLOTLOCK_TRUSTED_PROXY_SECRET');
+    if (value !== undefined && trustedProxyHeader === undefined) {
+        throw new SlotlockConfigError('SLOTLOCK_TRUSTED_PROXY_SECRET proves SLOTLOCK_TRUSTED_PROXY_HEADER: set both, or neither');
+    }
+    return value;
+}

package/dashboard.js

@@ -645,6 +645,9 @@ export function createSlotlockDashboard(options) {
     const base = publicUrl.pathname.replace(/\/$/, '');
     const root = `${base}/dashboard`;
     const callbackUrl = `${origin}${root}/callback`;
+    // Its cookies are Secure, but a first visit over http:// could still be answered by someone else:
+    // a browser that has seen this goes straight to https:// for a year. Not for a local http one.
+    const hsts = publicUrl.protocol === 'https:' ? { 'Strict-Transport-Security': 'max-age=31536000' } : {};
     const service = new URL(options.serviceUrl ?? options.publicUrl);
     const serviceRoot = `${service.origin}${service.pathname.replace(/\/$/, '')}`;
     const mcpUrl = `${serviceRoot}/mcp`;
@@ -774,6 +777,7 @@ export function createSlotlockDashboard(options) {
                 'X-Content-Type-Options': 'nosniff',
                 'Referrer-Policy': REFERRER_POLICY,
                 'Cross-Origin-Opener-Policy': 'same-origin',
+                ...hsts,
                 ...headers,
             },
         });
@@ -1365,6 +1369,11 @@ ${entries.length === 0
     const resolveHost = assistantOptions?.resolve ??
         (async (hostname) => (await dnsLookup(hostname, { all: true })).map(({ address }) => address));
     const PRIVATE_URL_REFUSAL = 'That URL is, or resolves to, a local or private network address (loopback, private, link-local, shared, unique-local or cloud metadata), which this server does not reach. For a model on its own machine or network, the server’s operator can allow them with SLOTLOCK_ASSISTANT_PRIVATE_URLS=on.';
+    // The dashboard's own host and the server's: a model there would be sent the organization's key
+    // and the conversation by this deployment itself, on a public name the private-address check passes.
+    const ownHosts = new Set([publicUrl.hostname, service.hostname]);
+    const namesOwnHost = (baseUrl) => ownHosts.has(new URL(baseUrl).hostname);
+    const OWN_HOST_REFUSAL = 'That URL is this Slotlock deployment’s own address. Give the address of the model’s API.';
     const assistantTimeout = assistantOptions?.timeoutMs ?? 30_000;
     const assistantTurnTimeout = assistantOptions?.turnTimeoutMs ?? 90_000;
     const conversationTtl = assistantOptions?.conversationTtlMs ?? 2 * 3_600_000;
@@ -1493,6 +1502,8 @@ ${entries.length === 0
         const settings = store ? await store.getSettings(tenantOf(session)) : null;
         if (!settings || !assistantOptions)
             return null;
+        if (namesOwnHost(settings.baseUrl))
+            return { problem: OWN_HOST_REFUSAL };
         if (!slotlockAssistantUrlAllowed(settings.baseUrl, privateUrls) ||
             !(await checkSlotlockAssistantHost(settings.baseUrl, { privateUrls, resolve: resolveHost }))) {
             return { problem: PRIVATE_URL_REFUSAL };
@@ -1662,6 +1673,8 @@ ${settings
                 : 'Give an https base URL (http only for localhost or 127.0.0.1), with no user name, query or #fragment.');
         }
         const baseUrl = checkedUrl.url;
+        if (namesOwnHost(baseUrl))
+            return settingsPage(session, 400, OWN_HOST_REFUSAL);
         if (!(await checkSlotlockAssistantHost(baseUrl, { privateUrls, resolve: resolveHost }))) {
             return settingsPage(session, 400, PRIVATE_URL_REFUSAL);
         }

package/ddl.d.ts

@@ -1,18 +1,17 @@
 /** The start of the message with which the deployment DDL refuses a `slotlock` schema. */
 export declare const SLOTLOCK_SCHEMA_CONTROL_REFUSAL = "Slotlock will not deploy into schema slotlock";
 /**
- * The version of the schema this release creates, recorded in `slotlock.schema_version` by every
- * migration. Releases up to 0.2 recorded nothing; 0.1 was version 1 and 0.2 version 2; 0.3 to 0.5
- * recorded 3. 0.6 is 4, so a 0.5 release refuses it before it changes anything: its DDL would put
- * back the trigger that names a coverage source by its guessable digest.
+ * The schema version this release creates, recorded in `slotlock.schema_version`. Up to 0.2
+ * recorded nothing (0.1 was 1, 0.2 was 2); 0.3 to 0.5 recorded 3. 0.6 is 4, so a 0.5 release
+ * refuses it rather than restoring the trigger that names a coverage source by its guessable
+ * digest.
  */
 export declare const SLOTLOCK_SCHEMA_VERSION = 4;
 /** The start of the message with which the deployment DDL refuses a schema a newer release migrated. */
 export declare const SLOTLOCK_SCHEMA_NEWER_REFUSAL = "Slotlock will not migrate a schema a newer release migrated";
 /**
- * What every migration checks before it changes anything, applySchema and applyTenantRls included
- * when they find nothing to change: that no other role controls the schema, then the server version
- * and the schema version. Run with search_path pinned, as the DDL pins it.
+ * What every migration checks before changing anything, even when it finds nothing to change: no
+ * other role controls the schema, then server and schema version. Run with search_path pinned.
  */
 export declare const SLOTLOCK_DEPLOYMENT_CHECKS = "DO $slotlock_schema_control$\nDECLARE\n  refusals text[];\nBEGIN\n  SELECT pg_catalog.array_agg(refusal.reason ORDER BY refusal.reason)\n    INTO refusals\n    FROM (\n      SELECT 'schema slotlock is owned by ' || owned_by.rolname AS reason\n        FROM pg_catalog.pg_namespace ns\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = ns.nspowner\n       WHERE ns.nspname = 'slotlock'\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n      UNION\n      SELECT COALESCE(grantee_role.rolname, 'PUBLIC') || ' can create objects in schema slotlock'\n        FROM pg_catalog.pg_namespace ns\n       CROSS JOIN LATERAL pg_catalog.aclexplode(ns.nspacl) acl\n        LEFT JOIN pg_catalog.pg_roles grantee_role ON grantee_role.oid = acl.grantee\n       WHERE ns.nspname = 'slotlock'\n         AND acl.privilege_type = 'CREATE'\n         AND acl.grantee <> ns.nspowner\n         AND (acl.grantee = 0\n              OR (grantee_role.rolname <> CURRENT_USER AND NOT grantee_role.rolsuper))\n      UNION\n      SELECT ident.type || ' ' || ident.identity || ' is owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_shdepend owned\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = owned.refobjid\n       CROSS JOIN LATERAL pg_catalog.pg_identify_object(owned.classid, owned.objid, owned.objsubid) ident\n       WHERE owned.dbid = (SELECT db.oid FROM pg_catalog.pg_database db\n                            WHERE db.datname = pg_catalog.current_database())\n         AND owned.deptype = 'o'\n         AND owned.refclassid = 'pg_catalog.pg_authid'::pg_catalog.regclass\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n         AND ident.schema = 'slotlock'\n      UNION\n      SELECT 'trigger ' || trg.tgname || ' on slotlock.' || rel.relname || ' runs '\n             || trg.tgfoid::pg_catalog.regprocedure::pg_catalog.text\n             || ', owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_trigger trg\n        JOIN pg_catalog.pg_class rel ON rel.oid = trg.tgrelid\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace\n        JOIN pg_catalog.pg_proc fn ON fn.oid = trg.tgfoid\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = fn.proowner\n       WHERE ns.nspname = 'slotlock'\n         AND NOT trg.tgisinternal\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n      UNION\n      SELECT COALESCE(grantee_role.rolname, 'PUBLIC') || ' can create triggers on slotlock.'\n             || rel.relname\n        FROM pg_catalog.pg_class rel\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = rel.relnamespace\n       CROSS JOIN LATERAL pg_catalog.aclexplode(rel.relacl) acl\n        LEFT JOIN pg_catalog.pg_roles grantee_role ON grantee_role.oid = acl.grantee\n       WHERE ns.nspname = 'slotlock'\n         AND acl.privilege_type = 'TRIGGER'\n         AND acl.grantee <> rel.relowner\n         AND (acl.grantee = 0\n              OR (grantee_role.rolname <> CURRENT_USER AND NOT grantee_role.rolsuper))\n      UNION\n      SELECT 'extension ' || ext.extname || ' in schema slotlock is owned by ' || owned_by.rolname\n        FROM pg_catalog.pg_extension ext\n        JOIN pg_catalog.pg_namespace ns ON ns.oid = ext.extnamespace\n        JOIN pg_catalog.pg_roles owned_by ON owned_by.oid = ext.extowner\n       WHERE ns.nspname = 'slotlock'\n         AND owned_by.rolname <> CURRENT_USER AND NOT owned_by.rolsuper\n    ) refusal;\n  IF refusals IS NOT NULL THEN\n    RAISE EXCEPTION 'Slotlock will not deploy into schema slotlock: another role controls it'\n      USING ERRCODE = 'insufficient_privilege',\n            DETAIL = pg_catalog.to_jsonb(refusals)::pg_catalog.text,\n            HINT = 'The deployment role must own schema slotlock and every object in it, and no other role may create objects in it.';\n  END IF;\nEND\n$slotlock_schema_control$;\nDO $slotlock_schema_preconditions$\nDECLARE\n  installed integer;\nBEGIN\n  IF pg_catalog.current_setting('server_version_num')::integer < 160000 THEN\n    RAISE EXCEPTION 'Slotlock needs PostgreSQL 16 or later; this server is %',\n      pg_catalog.current_setting('server_version')\n      USING ERRCODE = 'feature_not_supported';\n  END IF;\n  IF pg_catalog.to_regclass('slotlock.schema_version') IS NOT NULL THEN\n    EXECUTE 'SELECT version FROM slotlock.schema_version WHERE singleton' INTO installed;\n    IF installed > 4 THEN\n      RAISE EXCEPTION 'Slotlock will not migrate a schema a newer release migrated (version %; this release is version 4)', installed\n        USING ERRCODE = 'object_not_in_prerequisite_state',\n              HINT = 'Migrate and serve it with the release that migrated it, or a later one.';\n    END IF;\n  END IF;\nEND\n$slotlock_schema_preconditions$;\n";
 /** Active (unrevoked, unexpired) API keys one tenant may hold. */
@@ -43,21 +42,21 @@ export declare const SLOTLOCK_SCHEMA_TABLES: readonly ["schema_version"];
 /** The SECURITY DEFINER function through which a server reads the version it is serving. */
 export declare const SLOTLOCK_SCHEMA_FUNCTIONS: readonly ["slotlock.installed_schema_version()"];
 /** The table of suspended tenants: they may read, and write nothing (store.ts withTenant). */
-export declare const SLOTLOCK_TENANT_ADMIN_TABLES: readonly ["tenant_suspensions", "webhook_tenants", "rate_buckets", "assistant_tenants"];
+export declare const SLOTLOCK_TENANT_ADMIN_TABLES: readonly ["tenant_suspensions", "webhook_tenants", "rate_buckets", "assistant_tenants", "maintenance_tenants"];
 /**
  * The SECURITY DEFINER functions through which a server checks a tenant's suspension and erases a
  * tenant, by signature.
  */
-export declare const SLOTLOCK_TENANT_ADMIN_FUNCTIONS: readonly ["slotlock.tenant_suspended(text)", "slotlock.erase_tenant(text)", "slotlock.register_webhook_tenant(text)", "slotlock.webhook_tenants(text)", "slotlock.unregister_webhook_tenant(text)", "slotlock.take_rate_token(text, double precision, double precision)", "slotlock.register_assistant_tenant(text, timestamptz)", "slotlock.sweep_assistant_conversations(integer)"];
+export declare const SLOTLOCK_TENANT_ADMIN_FUNCTIONS: readonly ["slotlock.tenant_suspended(text)", "slotlock.erase_tenant(text)", "slotlock.register_webhook_tenant(text)", "slotlock.webhook_tenants(text)", "slotlock.unregister_webhook_tenant(text)", "slotlock.take_rate_token(text, double precision, double precision)", "slotlock.register_assistant_tenant(text, timestamptz)", "slotlock.sweep_assistant_conversations(integer)", "slotlock.list_maintenance_tenant()", "slotlock.maintenance_tenants(text)"];
 /**
  * Functions only the deployment role runs: suspending and lifting a suspension. No other role is
  * granted them, so a serving role cannot lift a suspension.
  */
 export declare const SLOTLOCK_OPERATOR_FUNCTIONS: readonly ["slotlock.suspend_tenant(text, text)", "slotlock.unsuspend_tenant(text)"];
 /** Every SECURITY DEFINER function the serving role may execute, by signature. */
-export declare const SLOTLOCK_DEFINER_FUNCTIONS: readonly ("slotlock.authenticate_api_key(bytea)" | "slotlock.create_api_key(text, text, text, bytea, text[], timestamptz, text)" | "slotlock.dashboard_session_ended(bytea, timestamptz)" | "slotlock.erase_api_keys(text)" | "slotlock.erase_tenant(text)" | "slotlock.installed_schema_version()" | "slotlock.list_api_keys(text)" | "slotlock.register_assistant_tenant(text, timestamptz)" | "slotlock.register_webhook_tenant(text)" | "slotlock.revoke_api_key(text, uuid)" | "slotlock.rotate_api_key(text, uuid, text, bytea)" | "slotlock.sweep_assistant_conversations(integer)" | "slotlock.take_rate_token(text, double precision, double precision)" | "slotlock.tenant_suspended(text)" | "slotlock.unregister_webhook_tenant(text)" | "slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)" | "slotlock.webhook_tenants(text)")[];
+export declare const SLOTLOCK_DEFINER_FUNCTIONS: readonly ("slotlock.authenticate_api_key(bytea)" | "slotlock.create_api_key(text, text, text, bytea, text[], timestamptz, text)" | "slotlock.dashboard_session_ended(bytea, timestamptz)" | "slotlock.erase_api_keys(text)" | "slotlock.erase_tenant(text)" | "slotlock.installed_schema_version()" | "slotlock.list_api_keys(text)" | "slotlock.list_maintenance_tenant()" | "slotlock.maintenance_tenants(text)" | "slotlock.register_assistant_tenant(text, timestamptz)" | "slotlock.register_webhook_tenant(text)" | "slotlock.revoke_api_key(text, uuid)" | "slotlock.rotate_api_key(text, uuid, text, bytea)" | "slotlock.sweep_assistant_conversations(integer)" | "slotlock.take_rate_token(text, double precision, double precision)" | "slotlock.tenant_suspended(text)" | "slotlock.unregister_webhook_tenant(text)" | "slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)" | "slotlock.webhook_tenants(text)")[];
 /** Tables no role but their owner reads or writes, reached only through SLOTLOCK_DEFINER_FUNCTIONS. */
-export declare const SLOTLOCK_DEFINER_TABLES: readonly ("api_key_retired_digests" | "api_keys" | "assistant_tenants" | "dashboard_tokens" | "rate_buckets" | "schema_version" | "tenant_suspensions" | "webhook_tenants")[];
+export declare const SLOTLOCK_DEFINER_TABLES: readonly ("api_key_retired_digests" | "api_keys" | "assistant_tenants" | "dashboard_tokens" | "maintenance_tenants" | "rate_buckets" | "schema_version" | "tenant_suspensions" | "webhook_tenants")[];
 /**
  * The advisory lock every server transaction for a tenant holds shared (store.ts withTenant), and
  * suspension and erasure take exclusively, keyed by this text's hashtextextended(…, 0).
@@ -68,16 +67,12 @@ export declare const SLOTLOCK_VALIDATION_DDL: string;
 /** Outbox ids one batch of the coverage-change rename reads (by primary key) in one transaction. */
 export declare const SLOTLOCK_COVERAGE_CHANGE_RENAME_BATCH = 5000;
 /**
- * One batch of the rename of coverage changes an earlier release wrote: of the outbox rows with ids
- * after `after` up to `head` (SQL expressions, bigint), the first `batch` by id, each `coverage.*`
- * one not yet in this release's shape gets its source's source_id as subject and `data.source_id`,
- * and loses `source` and `last_error`. Before 0.5.3 coverage.stale carried the source itself (an
- * iCalendar URL with a token, an address) and the error read from it; 0.5.3 named it by an unkeyed
- * digest anyone could confirm a guess against. A source deleted since is `src_redacted`: nothing
- * can match it any more, and a made-up id would look like a source the tenant could find. Selects
- * the last id read (`last`, null when there was none) and how many it renamed (`renamed`), `INTO`
- * `into` when given (PL/pgSQL). Rows in the new shape are left alone, so a batch run again changes
- * nothing.
+ * One batch of the rename of coverage changes an earlier release wrote: of the outbox rows after
+ * `after` up to `head` (bigint SQL expressions), the first `batch` by id; each `coverage.*` row not
+ * yet in shape gets its source_id as subject and `data.source_id`, and loses `source` and
+ * `last_error` (before 0.5.3 these carried the source itself, a URL with a token; 0.5.3's unkeyed
+ * digest could confirm a guess). A deleted source becomes `src_redacted`. Selects `last` (null when
+ * none) and `renamed`, `INTO` `into` when given. Idempotent.
  */
 export declare function slotlockCoverageChangeRenameSql(after: string, head: string, batch: string, into?: string): string;
 /** The whole deployment DDL, run in one transaction: the schema, then its constraints validated. */
@@ -95,12 +90,10 @@ export declare const SLOTLOCK_TENANT_CONTEXT_SETTING = "slotlock.tenant_ref";
  */
 export declare const SLOTLOCK_TENANT_TABLES: readonly ["resources", "reservations", "reservation_tombstones", "reservation_conflict_archive", "calendar_events", "calendar_event_attendees", "calendar_event_reminders", "calendar_event_exceptions", "calendar_event_occurrences", "calendar_event_tombstones", "calendar_event_commands", "calendar_coverage", "hold_commands", "outbox", "outbox_pruned", "webhook_endpoints", "waitlist_entries", "booking_rule_defaults", "assistant_settings", "assistant_conversations"];
 /**
- * Build the grants for the application role: USAGE on the `slotlock` schema, DML on the store's
- * tables and EXECUTE on the API key and dashboard functions. Nothing else: no ownership, DDL,
- * sequence, RLS-contract, API key or dashboard table access. The role must not be
- * able to leave forced RLS, itself or through a role it belongs to (`grantApplicationRole` refuses
- * the known ways out; these statements check nothing). Rerun after every `applySchema()`, since a
- * release may add a table.
+ * Build the grants for the application role: USAGE on the schema, DML on the store's tables and
+ * EXECUTE on the API key and dashboard functions, nothing else. The role must not be able to leave
+ * forced RLS (`grantApplicationRole` checks; these statements do not). Rerun after every
+ * `applySchema()`, since a release may add a table.
  */
 export declare function createSlotlockApplicationRoleGrantsDdl(role: string): string;
 /**