takos-control 1.0.0

package/src/application/services/identity/space-members.ts

@@ -0,0 +1,177 @@
+import type { D1Database } from '../../../shared/types/bindings.ts';
+import type { User, SpaceMembership, SpaceRole } from '../../../shared/types';
+import { generateId, now } from '../../../shared/utils';
+import { resolveActorPrincipalId } from './principals';
+import { getDb, accounts, accountMemberships } from '../../../infra/db';
+import { eq, and } from 'drizzle-orm';
+
+interface MemberListItem {
+  username: string;
+  email: string;
+  name: string;
+  picture: string | null;
+  role: string;
+  created_at: string;
+}
+
+async function resolveMembershipPrincipalId(db: D1Database, actorId: string): Promise<string> {
+  const principalId = await resolveActorPrincipalId(db, actorId);
+  if (!principalId) {
+    throw new Error(`Principal not found for actor ${actorId}`);
+  }
+  return principalId;
+}
+
+export async function listSpaceMembers(
+  db: D1Database,
+  spaceId: string
+): Promise<MemberListItem[]> {
+  const drizzle = getDb(db);
+
+  // Join accountMemberships with accounts (member accounts that are users)
+  const memberAccounts = drizzle
+    .select({
+      username: accounts.slug,
+      email: accounts.email,
+      name: accounts.name,
+      picture: accounts.picture,
+      role: accountMemberships.role,
+      created_at: accountMemberships.createdAt,
+    })
+    .from(accountMemberships)
+    .innerJoin(accounts, eq(accounts.id, accountMemberships.memberId))
+    .where(
+      and(
+        eq(accountMemberships.accountId, spaceId),
+        eq(accounts.type, 'user')
+      )
+    )
+    .orderBy(accountMemberships.createdAt);
+
+  const rows = await memberAccounts.all();
+
+  return rows.map((r) => ({
+    username: r.username,
+    email: r.email ?? '',
+    name: r.name,
+    picture: r.picture,
+    role: r.role,
+    created_at: r.created_at,
+  }));
+}
+
+export async function getUserByEmail(db: D1Database, email: string): Promise<User | null> {
+  const drizzle = getDb(db);
+  const row = await drizzle
+    .select()
+    .from(accounts)
+    .where(and(eq(accounts.email, email), eq(accounts.type, 'user')))
+    .limit(1)
+    .get();
+
+  if (!row) return null;
+
+  const user: User = {
+    id: row.id,
+    principal_id: row.id,
+    email: row.email ?? '',
+    name: row.name,
+    username: row.slug,
+    principal_kind: 'user',
+    bio: row.bio,
+    picture: row.picture,
+    trust_tier: row.trustTier,
+    setup_completed: row.setupCompleted,
+    created_at: row.createdAt,
+    updated_at: row.updatedAt,
+  };
+  return user;
+}
+
+export async function getSpaceMember(
+  db: D1Database,
+  spaceId: string,
+  actorId: string
+): Promise<SpaceMembership | null> {
+  const principalId = await resolveMembershipPrincipalId(db, actorId);
+  const drizzle = getDb(db);
+  const row = await drizzle
+    .select()
+    .from(accountMemberships)
+    .where(
+      and(
+        eq(accountMemberships.accountId, spaceId),
+        eq(accountMemberships.memberId, principalId)
+      )
+    )
+    .limit(1)
+    .get();
+
+  if (!row) return null;
+
+  return {
+    id: row.id,
+    space_id: row.accountId,
+    principal_id: row.memberId,
+    role: row.role as SpaceRole,
+    created_at: row.createdAt,
+  };
+}
+
+export async function createSpaceMember(
+  db: D1Database,
+  spaceId: string,
+  actorId: string,
+  role: SpaceRole
+): Promise<{ role: SpaceRole; created_at: string }> {
+  const timestamp = now();
+  const principalId = await resolveMembershipPrincipalId(db, actorId);
+  const drizzle = getDb(db);
+  await drizzle.insert(accountMemberships).values({
+    id: generateId(),
+    accountId: spaceId,
+    memberId: principalId,
+    role,
+    status: 'active',
+    updatedAt: timestamp,
+    createdAt: timestamp,
+  });
+
+  return { role, created_at: timestamp };
+}
+
+export async function updateSpaceMemberRole(
+  db: D1Database,
+  spaceId: string,
+  actorId: string,
+  role: SpaceRole
+): Promise<void> {
+  const principalId = await resolveMembershipPrincipalId(db, actorId);
+  const drizzle = getDb(db);
+  await drizzle
+    .update(accountMemberships)
+    .set({ role, updatedAt: now() })
+    .where(
+      and(
+        eq(accountMemberships.accountId, spaceId),
+        eq(accountMemberships.memberId, principalId)
+      )
+    );
+}
+
+export async function deleteSpaceMember(
+  db: D1Database,
+  spaceId: string,
+  actorId: string
+): Promise<void> {
+  const principalId = await resolveMembershipPrincipalId(db, actorId);
+  const drizzle = getDb(db);
+  await drizzle
+    .delete(accountMemberships)
+    .where(
+      and(
+        eq(accountMemberships.accountId, spaceId),
+        eq(accountMemberships.memberId, principalId)
+      )
+    );
+}

package/src/application/services/identity/space-models.ts

@@ -0,0 +1,50 @@
+import type { D1Database } from '../../../shared/types/bindings.ts';
+import { isValidOpaqueId } from '../../../shared/utils/db-guards';
+import { now } from '../../../shared/utils';
+import { getDb, accounts } from '../../../infra/db';
+import { eq } from 'drizzle-orm';
+
+interface ModelSettings {
+  ai_model: string | null;
+  ai_provider: string | null;
+}
+
+export async function getWorkspaceModelSettings(
+  db: D1Database,
+  spaceId: string
+): Promise<ModelSettings | null> {
+  if (!isValidOpaqueId(spaceId)) {
+    return null;
+  }
+
+  const drizzle = getDb(db);
+  const row = await drizzle
+    .select({
+      ai_model: accounts.aiModel,
+      ai_provider: accounts.aiProvider,
+      security_posture: accounts.securityPosture,
+    })
+    .from(accounts)
+    .where(eq(accounts.id, spaceId))
+    .limit(1)
+    .get();
+
+  return row || null;
+}
+
+export async function updateWorkspaceModel(
+  db: D1Database,
+  spaceId: string,
+  model: string,
+  provider: string
+): Promise<void> {
+  const drizzle = getDb(db);
+  await drizzle
+    .update(accounts)
+    .set({
+      aiModel: model,
+      aiProvider: provider,
+      updatedAt: now(),
+    })
+    .where(eq(accounts.id, spaceId));
+}

package/src/application/services/identity/spaces.ts

@@ -0,0 +1,29 @@
+export type { SpaceListItem } from './space-crud.js';
+export {
+  findLatestRepositoryBySpaceId,
+  loadSpaceById,
+  getRepositoryById,
+  listWorkspacesForUser,
+  createWorkspaceWithDefaultRepo,
+  getWorkspaceWithRepository,
+  updateWorkspace,
+  getWorkspaceByIdOrSlug,
+  deleteWorkspace,
+  getPersonalWorkspace,
+  getOrCreatePersonalWorkspace,
+  ensurePersonalWorkspace,
+} from './space-crud.js';
+
+export {
+  listSpaceMembers,
+  getUserByEmail,
+  getSpaceMember,
+  createSpaceMember,
+  updateSpaceMemberRole,
+  deleteSpaceMember,
+} from './space-members.js';
+
+export {
+  getWorkspaceModelSettings,
+  updateWorkspaceModel,
+} from './space-models.js';

package/src/application/services/identity/takos-access-tokens.ts

@@ -0,0 +1,149 @@
+import type { D1Database } from '../../../shared/types/bindings.ts';
+import { ALL_SCOPES } from '../../../shared/types/oauth';
+import { computeSHA256 } from '../../../shared/utils/hash';
+import { base64UrlEncode } from '../../../shared/utils/encoding-utils';
+import { getDb, personalAccessTokens, serviceManagedTakosTokens } from '../../../infra/db';
+import { eq } from 'drizzle-orm';
+
+export type TakosAccessTokenValidation = {
+  userId: string;
+  scopes: string[];
+  tokenKind: 'personal' | 'managed_builtin';
+};
+
+function generateRandomBytes(length: number): Uint8Array {
+  const bytes = new Uint8Array(length);
+  crypto.getRandomValues(bytes);
+  return bytes;
+}
+
+function parseScopesPayload(raw: string | null | undefined): string[] | null {
+  if (raw === '*') {
+    return [...ALL_SCOPES];
+  }
+
+  try {
+    const parsed = JSON.parse(raw || 'null') as unknown;
+    if (!Array.isArray(parsed) || !parsed.every((scope) => typeof scope === 'string')) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+function hasRequiredScopes(scopes: string[], requiredScopes?: string[]): boolean {
+  if (!requiredScopes?.length) return true;
+  return requiredScopes.every((scope) => scopes.includes(scope));
+}
+
+async function validateManagedTakosToken(
+  d1: D1Database,
+  token: string,
+  requiredScopes?: string[]
+): Promise<TakosAccessTokenValidation | null> {
+  const tokenHash = await computeSHA256(token);
+  const db = getDb(d1);
+
+  const row = await db.select({
+    id: serviceManagedTakosTokens.id,
+    subjectAccountId: serviceManagedTakosTokens.subjectAccountId,
+    scopesJson: serviceManagedTakosTokens.scopesJson,
+  })
+    .from(serviceManagedTakosTokens)
+    .where(eq(serviceManagedTakosTokens.tokenHash, tokenHash))
+    .get();
+
+  if (!row) return null;
+
+  const scopes = parseScopesPayload(row.scopesJson);
+  if (!scopes || !hasRequiredScopes(scopes, requiredScopes)) {
+    return null;
+  }
+
+  const nowIso = new Date().toISOString();
+  db.update(serviceManagedTakosTokens)
+    .set({ lastUsedAt: nowIso, updatedAt: nowIso })
+    .where(eq(serviceManagedTakosTokens.id, row.id))
+    .run();
+
+  return {
+    userId: row.subjectAccountId,
+    scopes,
+    tokenKind: 'managed_builtin',
+  };
+}
+
+async function validatePersonalAccessToken(
+  d1: D1Database,
+  token: string,
+  requiredScopes?: string[]
+): Promise<TakosAccessTokenValidation | null> {
+  const tokenHash = await computeSHA256(token);
+  const db = getDb(d1);
+
+  const row = await db.select({
+    id: personalAccessTokens.id,
+    accountId: personalAccessTokens.accountId,
+    scopes: personalAccessTokens.scopes,
+    expiresAt: personalAccessTokens.expiresAt,
+  })
+    .from(personalAccessTokens)
+    .where(eq(personalAccessTokens.tokenHash, tokenHash))
+    .get();
+
+  if (!row) return null;
+  if (row.expiresAt && new Date(row.expiresAt) < new Date()) return null;
+
+  const scopes = parseScopesPayload(row.scopes);
+  if (!scopes || !hasRequiredScopes(scopes, requiredScopes)) {
+    return null;
+  }
+
+  db.update(personalAccessTokens)
+    .set({ lastUsedAt: new Date().toISOString() })
+    .where(eq(personalAccessTokens.id, row.id))
+    .run();
+
+  return {
+    userId: row.accountId,
+    scopes,
+    tokenKind: 'personal',
+  };
+}
+
+export async function validateTakosAccessToken(
+  db: D1Database,
+  token: string,
+  requiredScopes?: string[]
+): Promise<TakosAccessTokenValidation | null> {
+  return (
+    await validateManagedTakosToken(db, token, requiredScopes)
+    || await validatePersonalAccessToken(db, token, requiredScopes)
+  );
+}
+
+export async function validateTakosPersonalAccessToken(
+  db: D1Database,
+  token: string,
+  requiredScopes?: string[]
+): Promise<TakosAccessTokenValidation | null> {
+  return validatePersonalAccessToken(db, token, requiredScopes);
+}
+
+export async function issueTakosAccessToken(): Promise<{
+  token: string;
+  tokenHash: string;
+  tokenPrefix: string;
+}> {
+  const tokenBytes = generateRandomBytes(32);
+  const token = `tak_pat_${base64UrlEncode(tokenBytes)}`;
+  const tokenHash = await computeSHA256(token);
+  const tokenPrefix = token.slice(0, 12);
+  return {
+    token,
+    tokenHash,
+    tokenPrefix,
+  };
+}

package/src/application/services/identity/user-cache.ts

@@ -0,0 +1,66 @@
+import type { D1Database } from '../../../shared/types/bindings.ts';
+import type { User } from '../../../shared/types';
+import { getDb, accounts } from '../../../infra/db';
+import { eq } from 'drizzle-orm';
+import { toIsoString } from '../../../shared/utils/date-utils';
+
+interface UserCacheContext {
+  get(key: 'user'): User | undefined;
+  set(key: 'user', value: User): void;
+  env: { DB: D1Database };
+}
+
+const MAX_USER_ID_LENGTH = 128;
+const USER_ID_PATTERN = /^[a-z0-9_-]+$/i;
+
+function normalizeUserId(userId: unknown): string | null {
+  if (typeof userId !== 'string') return null;
+  const value = userId.trim();
+  if (!value) return null;
+  if (value.length > MAX_USER_ID_LENGTH) return null;
+  if (!USER_ID_PATTERN.test(value)) return null;
+  return value;
+}
+
+export function isValidUserId(userId: unknown): userId is string {
+  return normalizeUserId(userId) !== null;
+}
+
+export async function getCachedUser<C extends UserCacheContext>(
+  c: C,
+  userId: string
+): Promise<User | null> {
+  const normalizedUserId = normalizeUserId(userId);
+  if (!normalizedUserId) {
+    return null;
+  }
+
+  const cachedUser = c.get('user');
+  if (cachedUser && cachedUser.id === normalizedUserId) {
+    return cachedUser;
+  }
+
+  const db = getDb(c.env.DB);
+  const row = await db.select().from(accounts).where(eq(accounts.id, normalizedUserId)).get();
+
+  if (row) {
+    const user: User = {
+      id: row.id,
+      principal_id: undefined,
+      email: row.email ?? '',
+      name: row.name,
+      username: row.slug,
+      principal_kind: 'user',
+      bio: row.bio,
+      picture: row.picture,
+      trust_tier: row.trustTier,
+      setup_completed: row.setupCompleted,
+      created_at: toIsoString(row.createdAt),
+      updated_at: toIsoString(row.updatedAt),
+    };
+    c.set('user', user);
+    return user;
+  }
+
+  return null;
+}

package/src/application/services/identity/user-settings.ts

@@ -0,0 +1,146 @@
+import type { D1Database } from '../../../shared/types/bindings.ts';
+import { getDb, accountSettings } from '../../../infra/db';
+import { eq } from 'drizzle-orm';
+import { isValidOpaqueId } from '../../../shared/utils/db-guards';
+import { DEFAULT_MODEL_ID, SUPPORTED_MODEL_IDS } from '../agent';
+
+export interface UserSettingsRow {
+  userId: string;
+  setupCompleted: boolean;
+  autoUpdateEnabled: boolean;
+  privateAccount: boolean;
+  activityVisibility: string;
+  aiModel: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export const AI_MODELS = SUPPORTED_MODEL_IDS;
+export type AIModel = typeof AI_MODELS[number];
+export const DEFAULT_AI_MODEL: AIModel = DEFAULT_MODEL_ID as AIModel;
+
+export async function getUserSettings(db: D1Database, userId: string): Promise<UserSettingsRow | null> {
+  if (!isValidOpaqueId(userId)) return null;
+
+  const drizzle = getDb(db);
+  const row = await drizzle.select().from(accountSettings).where(eq(accountSettings.accountId, userId)).get();
+
+  if (!row) return null;
+  return {
+    userId: row.accountId,
+    setupCompleted: row.setupCompleted,
+    autoUpdateEnabled: row.autoUpdateEnabled,
+    privateAccount: row.privateAccount,
+    activityVisibility: row.activityVisibility,
+    aiModel: null,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}
+
+export async function ensureUserSettings(db: D1Database, userId: string): Promise<UserSettingsRow> {
+  if (!isValidOpaqueId(userId)) {
+    return {
+      userId,
+      setupCompleted: false,
+      autoUpdateEnabled: true,
+      privateAccount: false,
+      activityVisibility: 'public',
+      aiModel: null,
+      createdAt: '',
+      updatedAt: '',
+    };
+  }
+
+  const drizzle = getDb(db);
+  let row = await drizzle.select().from(accountSettings).where(eq(accountSettings.accountId, userId)).get();
+
+  if (!row) {
+    try {
+      row = await drizzle.insert(accountSettings).values({
+        accountId: userId,
+        setupCompleted: false,
+        autoUpdateEnabled: true,
+        privateAccount: false,
+        activityVisibility: 'public',
+      }).returning().get();
+    } catch {
+      // Race condition: another request created it first
+      row = await drizzle.select().from(accountSettings).where(eq(accountSettings.accountId, userId)).get();
+    }
+  }
+
+  if (!row) {
+    return {
+      userId,
+      setupCompleted: false,
+      autoUpdateEnabled: true,
+      privateAccount: false,
+      activityVisibility: 'public',
+      aiModel: null,
+      createdAt: '',
+      updatedAt: '',
+    };
+  }
+
+  return {
+    userId: row.accountId,
+    setupCompleted: row.setupCompleted,
+    autoUpdateEnabled: row.autoUpdateEnabled,
+    privateAccount: row.privateAccount,
+    activityVisibility: row.activityVisibility,
+    aiModel: null,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}
+
+export async function updateUserSettings(
+  db: D1Database,
+  userId: string,
+  updates: {
+    setup_completed?: boolean;
+    auto_update_enabled?: boolean;
+    private_account?: boolean;
+    activity_visibility?: string;
+  }
+): Promise<UserSettingsRow | null> {
+  if (!isValidOpaqueId(userId)) {
+    return null;
+  }
+
+  await ensureUserSettings(db, userId);
+
+  const drizzle = getDb(db);
+  const data: Record<string, unknown> = {};
+
+  if (updates.setup_completed !== undefined) {
+    data.setupCompleted = updates.setup_completed;
+  }
+  if (updates.auto_update_enabled !== undefined) {
+    data.autoUpdateEnabled = updates.auto_update_enabled;
+  }
+  if (updates.private_account !== undefined) {
+    data.privateAccount = updates.private_account;
+  }
+  if (updates.activity_visibility !== undefined) {
+    data.activityVisibility = String(updates.activity_visibility);
+  }
+
+  if (Object.keys(data).length > 0) {
+    await drizzle.update(accountSettings).set(data).where(eq(accountSettings.accountId, userId));
+  }
+
+  return getUserSettings(db, userId);
+}
+
+export function formatUserSettingsResponse(settings: UserSettingsRow | null) {
+  return {
+    setup_completed: !!settings?.setupCompleted,
+    auto_update_enabled: !!settings?.autoUpdateEnabled,
+    private_account: !!settings?.privateAccount,
+    activity_visibility: settings?.activityVisibility || 'public',
+    ai_model: settings?.aiModel || DEFAULT_AI_MODEL,
+    available_models: AI_MODELS,
+  };
+}