unoverse 0.1.108 → 0.1.110

package/lib/urls.mjs

@@ -60,20 +60,30 @@ function findUniverseRoot() {
   }
 }
 
-/** The ground's terraform outputs, when a state is present. Best-effort. */
-function terraformOutputs(root) {
-  for (const ground of ["infra/digitalocean", "infra/aws"]) {
-    const dir = join(root, ground);
+/**
+ * EVERY ground with state, not the first one found.
+ *
+ * This looped ["infra/digitalocean", "infra/aws"] and RETURNED on the first match, so an
+ * operator running both clouds was shown DigitalOcean and told nothing about AWS — the same
+ * first-match bug that let `unoverse destroy` aim at the wrong cloud. "Where is my universe"
+ * has two answers when there are two universes.
+ *
+ * Returns [{ ground, outputs }], in the order the grounds are listed.
+ */
+function allGroundOutputs(root) {
+  const found = [];
+  for (const ground of ["digitalocean", "aws"]) {
+    const dir = join(root, "infra", ground);
     if (!existsSync(join(dir, "terraform.tfstate")) && !existsSync(join(dir, ".terraform"))) continue;
     const r = spawnSync("terraform", ["output", "-json"], { cwd: dir, encoding: "utf8" });
-    if (r.status === 0) {
-      try {
-        const out = JSON.parse(r.stdout);
-        return Object.fromEntries(Object.entries(out).map(([k, v]) => [k, v.value]));
-      } catch { /* fall through */ }
-    }
+    if (r.status !== 0) continue;
+    try {
+      const out = JSON.parse(r.stdout);
+      const values = Object.fromEntries(Object.entries(out).map(([k, v]) => [k, v.value]));
+      if (Object.keys(values).length) found.push({ ground, outputs: values });
+    } catch { /* a ground that cannot be read is simply not shown */ }
   }
-  return {};
+  return found;
 }
 
 /**

package/operator/infra/aws/main.tf

@@ -388,6 +388,10 @@ resource "time_sleep" "iam_propagation" {
 
 resource "aws_lambda_function" "pretoken" {
   depends_on       = [time_sleep.iam_propagation]
+  # The role → permission map, so the Lambda can emit both claims from one group list.
+  environment {
+    variables = { ROLE_PERMISSIONS = jsonencode(local.all_roles) }
+  }
   function_name    = "${var.name}-pretoken"
   role             = aws_iam_role.pretoken.arn
   runtime          = "nodejs20.x"
@@ -459,18 +463,39 @@ resource "aws_cognito_user_pool" "pool" {
 # comes from var.roles — the deployment's own `noun:verb` role list, matched by
 # node manifests' `requires.role` (DECLARATIVE_NODES.md §9.13).
 locals {
-  platform_roles = {
-    "workflow:author"     = "May use the hosted workflow builder"
-    "marketplace:publish" = "May publish items to this universe"
-  }
-  all_roles = merge(local.platform_roles, { for r in var.roles : r => "requires.role gate: ${r}" })
+  # TWO LEVELS, BECAUSE THE PLATFORM READS TWO CLAIMS.
+  #
+  # Auth0 (the DigitalOcean ground) models this properly and is the standing contract:
+  #
+  #     ROLE admin      → permission  admin:access
+  #     ROLE developer  → permissions marketplace:publish, workflow:author, workflow:promote
+  #
+  # Canvas gates on `roles` containing "admin" (apps/canvas/src/App.jsx). The publish and
+  # builder gates read `permissions` for marketplace:publish and workflow:author
+  # (auth/publishGate.ts, auth/auth.ts). Roles are who somebody is; permissions are what
+  # they may do, and the platform never confuses them.
+  #
+  # Cognito has ONE level — groups — so the mapping lives here and the Lambda applies it.
+  # This ground previously made GROUPS the permissions and emitted them as both claims, so
+  # a pool had workflow:author and no admin: every gate passed except the one that decides
+  # whether you may open Canvas at all.
+  role_permissions = {
+    admin     = ["admin:access", "workflow:author", "marketplace:publish", "workflow:promote"]
+    developer = ["workflow:author", "marketplace:publish", "workflow:promote"]
+  }
+  # Extra roles a deployment invents carry themselves as their own permission, which is what
+  # a node's `requires.role` matches.
+  all_roles = merge(
+    local.role_permissions,
+    { for r in var.roles : r => [r] },
+  )
 }
 
 resource "aws_cognito_user_group" "roles" {
   for_each     = local.all_roles
   name         = each.key
   user_pool_id = aws_cognito_user_pool.pool.id
-  description  = each.value
+  description  = "Grants: ${join(", ", each.value)}"
 }
 
 # The initial ADMIN — the first human in the universe. Without this, a fresh pool

package/operator/infra/aws/pretoken/index.mjs

@@ -13,13 +13,31 @@
  * `permissions`: the platform's builder/publish gates read permissions, node
  * requires.role matches either.
  */
+// The role → permission map, from the ground (ROLE_PERMISSIONS, set by terraform). Its
+// absence is not an error: without it a group grants itself, which is the old behaviour.
+const ROLE_PERMISSIONS = (() => {
+  try { return JSON.parse(process.env.ROLE_PERMISSIONS ?? "{}"); } catch { return {}; }
+})();
+
 export const handler = async (event) => {
   const groups = event.request.groupConfiguration?.groupsToOverride ?? [];
   const email = event.request.userAttributes?.email;
 
+  // ROLES ARE WHO YOU ARE; PERMISSIONS ARE WHAT YOU MAY DO. Cognito has one level — groups
+  // — and the platform reads two claims: Canvas gates on `roles` containing "admin", while
+  // the publish and builder gates read `permissions` for marketplace:publish and
+  // workflow:author. Emitting groups as BOTH made every group a role and a permission at
+  // once, so a pool built from permission-shaped groups had no "admin" and Canvas refused
+  // an administrator who held every permission it grants.
+  //
+  // Groups are the roles. Permissions are what those roles map to, unioned.
+  const permissions = [...new Set(
+    groups.flatMap((g) => ROLE_PERMISSIONS[g] ?? [g]),
+  )];
+
   const claims = {
     roles: groups,
-    permissions: groups,
+    permissions,
     ...(email ? { email } : {}),
   };
 

package/operator/lib/ground.sh

@@ -322,7 +322,6 @@ roles = [
   "workflow:author",     # build and test workflows (builder gate — ENFORCED)
   "marketplace:publish", # publish assets to this universe (publish gate — ENFORCED)
   "workflow:promote",    # promote a draft to active / go-live (declared only)
-  "admin:access",        # admin to Unoverse Canvas (declared only)
 ]
 
 # The rendered output (terraform output -raw env_production > ../../.env.production)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.108",
+  "version": "0.1.110",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",