31 Commits

Include renames

Author	SHA1	Message	Date
Daniel Salazar	5d907d18c9	fix(socket): bound acks a receipt ask leaves on sockets that never answer (#4422) ... An acked broadcast leaves its callback in socket.io's per-socket ack map on every socket it reaches, and nodes other than the asker free it only when that socket answers or disconnects. Each socket's map is now a BoundedTtlMap capped at 64 entries and 60 s, so a socket that never answers holds a bounded number and a late answer is ignored. BoundedTtlMap drops expired entries on set so its TTL frees memory too.	2026-10-31 00:26:44 -07:00
Daniel Salazar	7401fe0b09	fix(notifications): receipts report what the user saw, sticky push opt-in, safer app pushes (#4413) ... * fix(socket): count sockets that never acknowledge instead of asking them askWithAck sent an acked broadcast to sockets outside the ack room only to learn whether any were there. Those sockets never answer, so every node held the ack callback until they disconnected. Each node now answers a server-side count of them instead; a node that does not answer in time still reads as holding one. * feat(notifications): read focus and own display from receipt answers A receipt answer may carry focused and showsOwn beside visibilityState; both pass through to notif.delivery.settled when they are booleans. An answer with received: false is not a responder, and an ask answered only that way settles as unreceived. * fix(notifications): name an app message's bad field before the size cap An app message over the 16 KB value cap answered notification_value_too_large even when one field was what broke a rule of its own. The fields are checked first now, so the caller gets bad_request naming the field; the total cap still applies after. Character counts skip the code point walk on strings that can't fit. * fix(push-sw): match the server's tags, keep taps, and show pages' notifications - A push is tagged with the server's group, `<app uid>:<group>` or the uid, and alerts again when that replaces one showing. Handlers get the app's own group and the send time in ms from `ts`. - The app's icon stands in when the notification has none. - Default and relative tap URLs resolve against the worker's scope, still only on its origin. - A tap posted to an open window waits briefly for the page to take it; without a click handler there, the window is taken to the URL, or one is opened. - A page that got a notification live while away can ask the worker to show it; the worker holds it back while another window of the origin has focus. * fix(notifications): answer every receipt ask A page now answers each socket that asks about a notification, not only the first, and answers { received: false } when the notification doesn't arrive within the wait or the page holds too many asks, so the server's nodes can let go of them. A received answer carries focused and showsOwn beside visibilityState. * fix(notifications): keep web push to users who turned it on, and show what a push would Subscription: - onPush() renews the subscription on load only for a user who turned push on on this origin with enable(); enable() records that, and disable(), sign-out and push_revoked forget it. One renewal runs per page and worker, however many onPush() calls there are, and push_disabled, push_revoked, push_unavailable and too_many_requests stay quiet there. - puter.auth.signOut() on a website removes this browser's subscription with the leaving user's token and forgets the opt-in and kept taps, without holding up the sign-out. - A subscription another service on the site made is left alone and rejected as push_subscription_conflict; one made with Puter's earlier key is replaced. - A subscription refused with push_endpoint_revoked is replaced once, like push_subscription_invalid. - Another worker holding the scope rejects push_worker_conflict, naming importScripts and the serviceWorker option, instead of waiting out the confirmation push. - enable() rejects user_gesture_required outside a click instead of prompting, and a refused browser subscribe rejects push_subscribe_failed. Live side: - A page that is hidden or unfocused shows every app notification it receives, with or without a handler for its channel, through push-sw.js so a focused window of the app holds it back. It uses the server's tag, the app's icon as a fallback, the generic app line for sensitive ones, and the registration of its own worker. - Page handlers get 5 seconds, as in the worker (push_handler_timeout). - A feed stopped by a sign-out starts again on the next sign-in. - onPush() still delivers live when IndexedDB is unavailable. - onPush() rejects invalid_handler for a handler the worker could not rebuild from its source (methods, bound and built-in functions). - Saving and removing a handler's source for the worker is ordered per key, so a quick unmount and remount keeps it. - A tap posted by push-sw.js is acknowledged only when a click handler takes it. * fix(gui): show app pushes under the app's name and Puter's icon - On Puter's own origin, an app's push takes the app's name as its title, with the app's title and text in the body, and Puter's copy of the app's icon; an icon the app chose is never shown. A sensitive one keeps its generic line. - A push's ts is its timestamp, and a newer push in a group alerts again. - Re-registering this browser counts only apps that push to Puter's devices (puterDevices), so a website's Web Push confirmation alone never registers it. * fix(gui): free the push dialog's button when registering fails late A registration that failed after the dialog's deadline left the button spinning and disabled. It now clears the attempt, settles on a state the browser moved to meanwhile, or offers a retry. * fix(permission): a user's own app grant clears a narrower via on the row An app grant that already existed was skipped, so a row another path recorded with extra.via kept it after the user approved the same permission in Puter. A grant without via now rewrites such a row without it, keeping its other extras; a grant with via still never touches an existing row. * refactor(notifications): export the notification text cleaner Extensions that word notifications can use the same cleaning as app messages. * docs(notifications): describe when pushes go out, taps, worker rules and enable() errors Pushes go out when no open page answers that it's visible and focused or shows the notification itself. Documents the page-shown notification, the sticky opt-in, tap routing, group and sensitive behavior, service worker rules, requirements, every enable() and onPush() error, push caps for unlisted apps and websites, and sending from workers and events handlers. The push playground example is removed (the playground can't serve the site's service worker) and redirects to the guide. The minimal page catches enable() errors and sends after 5 seconds. The recipe no longer sends on every load, and app.message is listed in events fetch and the catch-up recipe. * docs(notifications): per-app browser caps and when push_endpoint_revoked appears * docs(notifications): the page's handler timeout * fix(notifications): leave a site's own service worker alone when enabling pushes Registering /puter-sw.js at a scope another worker holds queued it behind that worker, so enable() rejected with push_worker_conflict but swapped the site's worker out once its tabs closed. Now enable() checks the scope first and rejects without registering. * docs(notifications): a background page shows score alerts itself	2026-10-30 14:43:48 -07:00
Juan Fernando CastroandDaniel Salazar	c00f693ec6	feat(notifications): report how each live notification was received (#4403) ... * feat(notifications): report how each live notif.message was received SocketService.sendWithAck sends an event to rooms or sockets and waits, up to a timeout, for an acknowledgement from each socket that listed the event in its handshake (`auth.acks`); every other socket gets a plain emit. It lists sockets across the cluster with fetchSockets and asks the listed ones through the adapter's broadcast acks, and counts this node alone when the adapter cannot list the others. The emitting region now sends notif.message through it, with the window from `notificationAckTimeoutMs` (default 5000), and emits the node-local `notif.delivery.settled` with the outcome: received, unreceived, no-socket or remote-only (sockets only in a peer region), whether any socket there acknowledges, and each responder's visibilityState. Peer regions keep sending their own copy as before; the GUI event carries `region_delivered` so this region does not send it twice. The desktop and dashboard list notif.message in their handshake and answer its callback once with document.visibilityState. Nothing in core acts on the settled event. * fix(notifications): send live notif.message at once and report what the count covers sendWithAck now emits to the whole room straight away as a broadcast with ack, and lists the room's sockets alongside it only to fill in the counts, so nobody waits on the listing. Whether the adapter can count the cluster's servers is checked once; where it cannot, sends go out per socket on this node with a one-time warning. The result carries `complete`: false when only this node's sockets were counted, either for that reason or because the listing failed or took over 1 s, which is warned about at most once a minute. notif.delivery.settled gains `sendId`, `type`, `complete` and `peerRegions`. An incomplete count with no socket found settles as unreceived rather than no-socket, and the peer-region read runs alongside the send instead of after it. notif.written carries the same `sendId`, minted per send (an update gets a new one) and passed through notif.created to the socket adapter on the fold-in path. The comment on revoking sockets no longer says fetchSockets is unavailable with our Redis client; it works with ioredis cluster. * fix(notifications): keep a failed server count from ending the process socket.io awaits the adapter's serverCount without a catch on every broadcast with an ack, and the redis-streams adapter's count rejects as soon as one cluster node fails to answer. The count on the root namespace's adapter now never rejects: a failure reports the last good count (1 before any), and is warned about at most once a minute. A stale count only lets an ack wait run to its timeout. Whether sendWithAck takes the cluster path is no longer a one-shot check awaited before the emit. Until a count has succeeded, sends go out per socket on this node at once while a count is retried in the background, at most every 30 s (SocketService.COUNT_RETRY_MS); the first success switches to the cluster path for good. * fix(notifications): ask only acknowledging sockets, through an ack room A socket whose handshake lists an event in `acks` now joins `<room>:acks:<event>` for each of its rooms and its own id. sendWithAck sends the ordinary broadcast to the target rooms except those ack rooms, which keeps it on the adapter's stream, and a broadcast with an ack only to the ack rooms. Sockets that never acknowledge are no longer asked, so other nodes hold no pending ack for them and a send completes as soon as every acknowledging socket answered. The per-socket listing that matched socket.data.acks is gone; the ack-capable count comes from the room membership the listing already returns. The per-socket path stays only for a node whose adapter has not counted servers yet. A failed server count during a send now marks its counts incomplete, so a stale count can't make a listing that missed a node read as complete. With no count ever succeeded (an in-memory Redis), the failure is warned once per process instead of once a minute. * fix(notifications): say whether every socket on a live notification acknowledges it A tab on an older bundle beside one that acknowledges made the settle read as ack-capable, so a listener could not tell that the older tab may have shown the notification. notif.delivery.settled now carries everySocketAcks. * feat(notifications): app pages acknowledge the live copy of an app message NotificationService.appReceipt() asks an app's own sockets whether a notification reached a page, and settles it as notif.delivery.settled with appUid, the same outcomes as the desktop's. Callers ask only when the answer decides something, since it is a round trip to every node. - SocketService.askWithAck asks without listing sockets: sockets that don't acknowledge get an acked broadcast too, which can only time out, and that says whether an older client shares the target. - puter.js declares notif.receipt on its filesystem and events sockets. A page answers once one of its notification feeds received that uid, before any handler runs, and never when no feed on the page got it. - Docs describe the push route as "no page of the app received it live within 5 seconds". * fix(notifications): count a socket that acknowledges other events as a current client Every desktop page also holds puter.js's own socket, which never shows notif.message, so "every socket acknowledges notif.message" never held there. sendWithAck now reports `declaring`, the sockets that listed any event in auth.acks, and everySocketAcks on the desktop's settle means no socket here declares nothing. * fix(puter-js): fall back to the Continue dialog when a popup can't be opened Some browsers report user activation but still return null from window.open (iOS home-screen web apps, Safari after awaited work), so permission prompts, signIn, enablePush, and GUI action popups failed without showing anything. PuterDialog.launch() now owns the open-now-or-show-Continue decision for every popup flow and shows the consent dialog when the direct open returns null. On cross-origin-isolated pages signIn leaves settling to the /login/wait relay on both launch paths. * fix(notifications): show a live push when the page's window isn't focused onPush showed the handler's result as a system notification only when the tab was hidden. A visible tab in a window the user left showed nothing. It now also shows when the document doesn't have focus. Inside the Puter desktop the desktop's banner shows the notification, so an app's frame still never does. * build(puter-js): publish push-sw.js exactly as written The build emits dist/push-sw.js next to puter.js, but terser minified it along with the bundle. It is now marked as already minimized, so the file apps import into their service worker is the source unchanged. * fix(notifications): send live notif.message plainly and ask for receipts on request Every live notif.message used to be sent with an ack, list the user's sockets across the cluster (fetchSockets ships each socket's handshake between nodes) and wait out the receipt window, whether or not anything would act on it. notif.message is a plain send again. NotificationService.receipt() asks the desktop's sockets, or with appUid an app's own, the way app receipts already did: an ask with no socket listing, settled as notif.delivery.settled. A caller asks only when the answer changes what it does. - The desktop and dashboard sockets answer notif.receipt from the page's puter.js receipt log and note each live notif.message in it, so every socket on the page answers alike. A page whose puter.js has no log lists no acks. - SocketService.sendWithAck, the socket listing and region_delivered are gone. askWithAck counts this node's sockets when the adapter cannot count servers. - The send id stays on notif.written and the settle, and leaves the wire. * fix(socket): join only the ack room receipts are asked in A socket listing events in auth.acks joined an ack room beside each of its rooms and its own id. Receipts are only asked in the user's room, or the app's for an app socket, so that is the one ack room it joins. * docs(notifications): publish the push limits of 12 a minute and 1,000 a day Pushes are capped per user per app at 12 a minute and 1,000 a day, and at 6 a minute and 200 a day while an app is new. The rate limits table and the notification pages said one a minute and 100 a day. --------- Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-29 18:57:36 -07:00
Daniel Salazar	2b254b8892	fix: misc bugs (#4251)	2026-10-15 23:49:17 -07:00
Daniel Salazar	576e893a5b	refactor(services-core): read-only socket reauth, one token-grant read per check, shared grant/revoke and hosted-asset paths (#4187) ... * perf(socket): re-check live sockets without touching their sessions The 5-minute sweep reused the request-path authenticate(), which slid every connected session's expiry and wrote user activity each tick, and could fill SessionStore's touch-throttle map. authenticate() now takes touch: false for re-checks; the sweep uses it, checks credentials through runWithConcurrencyLimitSettled, and a call while a sweep runs joins it instead of starting another. * perf(acl): read a scoped token's grants once per check ACLService.check did a Redis GET + JSON.parse of the token's grant list for every ancestor x mode, and the permission scan did the same per option. Both now read the list once (PermissionStore.listAccessTokenPerms, which replaces the per-permission hasAccessTokenPerm) and test it in memory. * refactor(metering): incrementUsage goes through batchIncrementUsages incrementUsage was a copy of the batch path that let an infinite amount through and skipped NaN, where the batch path counts either as one unit. It now calls batchIncrementUsages with a one-entry batch, so both apply the batch clamping (documented on batchIncrementUsages). The overuse alarm loses the single-path fields nothing sets any more. * perf(metering): memoize an actor's spent addons on the increment path Every increment and credit refresh read the actor's addons record from the KV store. A record with no purchased credit left can only change through a grant, and every grant announces credits-changed, so it is now kept per actor beside the credit memo and dropped with it. Records with credit left are still read fresh, since increments on other nodes draw them down without announcing it. A read that straddles a drop isn't kept. * refactor(services): route raw table writes through their stores - access_token_permissions: AuthService inserted grants one row at a time through a cast to the store's db client, read the authorizer, and deleted the manifest with raw SQL, then asked PermissionStore to drop its cache. PermissionStore now owns insertAccessTokenPerms (chunked multi-row insert), deleteAccessTokenPerms and getAccessTokenAuthorizerId, and invalidates inside the writes. - TeamService's 2FA reset clears the OTP columns through UserStore.update. - AppIconService's data-URL icon swap is AppStore.replaceDataUrlIcon. * fix(user): correct cascadeDelete's FK note; seat cleanup is best effort The header said most user_id foreign keys are ON DELETE SET NULL; the migrations cascade nearly all of them and keep SET NULL for audit and analytics history. forgetSeat ran unguarded after the row was already gone, so a cache failure there failed the whole delete; it is now logged and stepped over like the other teardown steps. * refactor(acl): one grant/revoke path per holder kind ACLService's user and group stat/set pairs were copies differing only in which PermissionService methods they called. They now share #stat and #set over a holder adapter ({ lockKey, query, grant, revoke }); lock keys and errors are unchanged. PermissionService's eleven grant/revoke methods repeated the same guard blocks. Each keeps its own order of checks, now through shared helpers (#requireUserId, #refuseAppActor, #assertCanManage, #requireUser, #requireApp, #assertFitsColumn, #audit), so every refusal keeps its status, legacyCode and wording. Audit writes stay fire-and-forget. * refactor(auth): one hosted-asset token API keyed by kind The private-asset and public hosted-actor cookies had separate create/ verify methods, four cookie-name getters and two identical options getters, differing only in the kind claim and what the host field was called. They are now createHostedAssetToken(kind, claims), verifyHostedAssetToken(kind, token, expected), getHostedAssetCookieOptions(), and the exported HOSTED_ASSET_COOKIES names. Token claims, cookie names and every error message are unchanged; puterSite and privateAppGate call the new methods. * refactor(auth): one revoked/expired check for every actor builder The session, app-under-user and access-token builders (and the access token's parent-session check) each spelled out the same revoked/expired tests. They now share #endedSession, which returns the same reauth results; only a session token passes its auth_id. Adds coverage for an access token whose parent session expires, is revoked, or is gone.	2026-10-11 21:55:20 -07:00
Daniel Salazar	491729e060	fix: backend test flakes and a socket shutdown hang (#4170) ... - SocketService's prepare-shutdown hook awaited io.close(), which also closes the http server and waits for every HTTP connection to end. A connection mid-request when close() runs stays open for the keep-alive timeout, so shutdown stalled before PuterServer severs connections. The hook no longer waits on the http close. - Test servers disable Ollama unless a test configures it. Its boot probe logged after files had ended, which failed shared-worker shards with EnvironmentTeardownError. - vitest ignores that teardown error for a console call still in flight. - setupPuterTestEnv boots again on a fresh port after EADDRINUSE, and a failed setupTestServer start shuts the server down. - UploadReservationStore expiry tests pin the clock instead of racing a 50 ms TTL.	2026-10-10 19:34:32 -04:00
Juan Fernando Castro	50bcdc9c6c	fix: let a revocation be seen by the reads and the nodes that outlive it (#4151) ... * fix: let a revocation be seen by the reads and the nodes that outlive it Four places where a revoke lands on the primary and the next reader can still be told the old answer. The u2a cache key was dropped but not re-filled, so the next miss read a replica that may still carry the row and cached it for the TTL -- and a revoke's own settling pass is usually that miss. It re-fills from the primary, as the u2u side already does. A revoked session dropped its keys the same way. It now leaves the revoked row in the cache, read from the primary, so there is nothing for a lagging replica to re-introduce. A link share is its own authority rather than an index over a permission, so a replica still carrying a withdrawn row answers with it. For a short window after one is withdrawn, those reads go to the primary. Socket eviction rode a local event, so it only reached the node that did the revoking. It is announced on the fan-out channel too, which is where the node actually holding the connection hears it. * refactor: carry the revocation on outer.* instead of outer.pubsub.* Eviction runs through `io.in(room).disconnectSockets()`, which goes via the socket.io Redis adapter a cluster shares, so one node handling the event disconnects that user on every node in it. Fanning out to siblings had each of them repeat the same cluster-wide disconnect. The adapter's Redis is per-cluster, so peer clusters still need the hop -- `outer.*` reaches them and skips the sibling fan-out. The local `auth.sessions.revoked` goes with it: `outer.*` fires on the emitting node too, and nothing else subscribed.	2026-10-09 16:36:26 -04:00
Daniel Salazar	dcfb1263de	fix(events): single-writer presence items, live-socket counts and region-wide leave grace (PUT-1759) (#4142) ... * fix(events): keep each region's presence item written only by that region - A region that receives a forward for a pair it holds no socket for retires its own presence item through the pin-ordered leave path, gated by a region-shared claim. The sender no longer retires another region's item, and the forward reply no longer carries noSocket. - Presence reads skip items for regions outside the peer list instead of retiring them. - removeConnection decrements and deletes the count in one script. - A failed join releases the join pin, and any connect that finds the pin free writes the join. - A single delivery treats a socket on any node of the region as local, using the region-wide connection count, and picks the next remote candidate by the regions already tried instead of by index. - Correct the connection-count TTL comment. * fix(events): count presence by live socket and honor the leave window region-wide - A region's presence for a pair is a sorted set of socket ids scored by last renewal under a new key, replacing the integer count. A socket counts while renewed within the concurrency-slot window; add, renew and remove each prune lapsed members and report the live count in one script, so a node that dies stops holding the pair. - The last socket going marks the pair as leaving region-wide for the grace window, in the same script; a connect clears it. A forward that lands on another node inside the window does not retire the item. - Add the events.presence.write counter, labelled by op (join, leave, refresh, retire).	2026-10-08 23:55:55 -07:00
Juan Fernando CastroandDaniel Salazar	a46eb15d5e	Let the account's own API token reach the routes a privileged app needs (#4032) ... * feat: let the account's own API token reach the routes it should A privileged app is launched with the GUI session token today. Running one on a full-access personal access token instead costs much less when it leaks, but several routes those apps depend on refuse every access token, so the swap would break them. Admitted, each a read or a write the token's own HTTP reach already covers: - the realtime socket handshake, which refused access tokens outright; FS live updates and notifications stop without it - GET /get-dev-profile and POST /profile, both puter.js surface - GET /auth/list-permissions — a read of what was granted, not a grant - GET /share/shared-by-me/apps and GET /share/audit, over grants /share/shared-by-me already lists for the same credential - POST /rao, which puter.js calls on every setAuthToken Gated on `isAccountContext`, not the `full_access` claim alone, so a token with an app anywhere in its chain is still refused and a socket for one never joins the user room. Left session-only: mint, session, 2FA, grant, team and billing, plus two the list named. /share/blocks is a personal safety control whose only caller is the desktop's Blocked Senders window. /app-feedback is reachable only from our own GUI pages, and being unsubmittable programmatically on a user's behalf is the property it was built with. The new HTTP suite drives a real server with a minted token and fails on all six admissions without the change; the block routes' existing metadata check already pins their refusal. * test: sort the two token shapes at the events handshake * fix: carry the account-context invariant into the HTTP gate `requireUserActorGate` admitted on the raw `full_access` claim while the socket and /rao use `isAccountContext`, so one shape — a token carrying the claim with an app in its chain, or an actor built without `makeActor` — would have been refused in two places and admitted in the third. Unreachable today, since the mint and the auth-time read both drop the claim when `app_uid` is present, but it is the invariant this change states and it should hold at every enforcement point. The payout address goes back behind a plain session: `/get-dev-profile` is open to the account's own token now, and the rest of what it answers is a developer's own name and incentive-program status. Also drops a cross-reference in EventsService to the socket posture this change relaxed, and rewords the block-routes comment, which read as if access tokens were admitted there rather than refused. * fix: drop a revoked token's sockets, and read the dev-profile columns Two gaps the review found, both reachable only because this branch lets the account's own token hold a socket and call /get-dev-profile. `#revokeAccessTokenTail` soft-revoked the session row and told no one, so a revoked token kept its connection — and the account's `outer.gui.*` fan with it — until the five-minute reauth sweep. Sockets now join a per-token room and a new `auth.access-token.revoked` event drops exactly that room, so the account's other tabs stay up. Session revoke keeps its account-wide eviction. `/get-dev-profile` read `first_name`, `last_name`, `paypal` and the two incentive flags off the user row, which carries none of them: the columns have always been `dev_`-prefixed, so the endpoint answered nulls to everyone and `puter.apps.getDeveloperProfile()` has never returned anything. Reads the real columns, keeping the unprefixed name as a fallback for a deployment carrying both. The payout address stays behind a plain session, so opening the route to the account's token hands over a name and incentive status and nothing else. Both fail without the fix: the socket test waits five seconds on a connection that should already be gone, and the profile test reads back a seeded row. * fix: close /open_item to tokens, and stop the node runner leaking sockets `/open_item` carried `allowFullAccessToken`, but it grants an app a permission on the user's behalf and mints the app token to go with it — a grant and a mint, which stay session-only. Pre-existing, and missed by the first sweep here, which only asked whether routes lacking the flag should gain it and never re-read the ones that already had it. Refused at the top of the handler too, so a credential that gets past the gate cannot leave an ACL row behind. The node runner loads each SDK into a vm context and never closed it, so every test leaked a socket, and every socket holds a per-(user, origin) connection slot. Admitting the account's own token to the handshake pushed that past the cap, and the whole events block failed with `events_connection_failed` while the browser and workerd runners — which do not leak — passed. Closing the FS socket and the events channel after each test gives the slots back. * fix: announce only the revokes that can have a socket to drop Every access-token revoke broadcast an eviction cluster-wide, including the read-URL tokens `revokeReadUrl` retires constantly. A scoped token is refused at the handshake, so none of those broadcasts could ever reach a connection. The announcement now goes out only for a token the handshake would have admitted: full access, no app in the chain. `revokeOwnAccessToken` refuses full-access tokens outright, so that whole path is silent; a revoke by raw uuid says nothing about the token and still announces, which costs a no-op broadcast rather than leaving a revoked socket up. Fails without it: the test revokes a scoped token and a full-access one through the same entry point and counts the announcements. * test: pin the mint route against the account's own token `/auth/create-access-token` carries only `requireAuth`, so it never showed up in the sweep over `requireUserActor` routes — the refusal lives in `AuthService.createAccessToken`, which turns away any access-token actor outright. That holds today, and a leaked full-access token minting itself a sibling that survives revoking the original is exactly what the token swap is meant to rule out, so it is worth a test rather than a reading. * fix: let the recommended-apps test follow the list it tests Two commits on main rewrote `RECOMMENDED_APP_NAMES` without touching the test, which seeds `editor` and `camera` and asserts the result contains them. Neither is on the list any more, so the resolved set came back empty and `test (base)` has failed on every PR since. The test now seeds the first two names off the list itself and asserts on those, so the next edit to it cannot strand the test: prepending two unknown apps keeps all four cases green. * feat: let an extension waive a plan gate for one route or driver method A plan gate about to refuse a caller now emits `subscription.gate.<surface>` through `emitAndWait` first: `route.<method>.<path>` for a route, `driver.<iface>.<method>` for a driver method, `share.anyone` for link shares. The payload carries the actor, the request and the requirement, and a listener that sets `allow` waives the plan for that call. Callers the plan already covers never reach the hook, and a listener that throws leaves the refusal in place. * feat: mint godmode apps their own full-access token `/auth/get-user-app-token` answers a desktop launch of a godmode app (the `godmode` column) with a full-access token instead of an app token. Origin lookups, the sign-in popups for pages outside the desktop, keep getting ordinary app tokens, and only a web session may mint one. The token carries the app in `godmode_app_uid`, read into `accessToken.godmodeApp` for attribution only: `effectiveApp` stays null, so it keeps the account's reach and passes the same gates as a personal access token, including the vendor-compatible AI routes. It is refused once the app is gone or no longer godmode. Its row is an `access_token` session parented to the web session that asked, with `app_uid` set, so signing out, revoking that session or revoking all sessions takes it along, and the sessions list shows it under the app. Each mint re-signs onto the same row with a 12h `exp` and moves the row's expiry out, so the desktop keeps an open app alive while a copy taken earlier still expires on schedule. A full-access token may now mint scoped tokens (read URLs), parented to its own row; it still may not mint full access. Revoking a full-access token cascades to the tokens it minted. An access token whose session row has a parent now authenticates only while that parent is live, so a read URL a godmode app minted lapses with the app's token, and through it with the desktop session. * feat: launch godmode apps on their own token and renew it The desktop asks for a godmode app's token at launch and blocks the launch if it can't get one, as it does for other apps; a godmode app never runs on the desktop's session token. While the window is open the desktop re-mints the token once less than 6h of its 12h remain, checking on a timer and when the tab becomes visible, and answers the app's `reauth_required` with a fresh one, posted to the app's origin. puter.js keeps a godmode token in sessionStorage like a session token, never in localStorage. In app mode a 401 on a godmode token, background requests included, asks the desktop for a new token and replays, and a `puter.token` message is only taken from the embedding frame. The sessions list shows a godmode token row with its app's title and icon. * fix: keep a godmode token the same across renewals Apps hand their launch token to code that never sees a replacement (the terminal's Drive mount, a CLI's API key), so a token re-signed every renewal broke those copies once the first one expired. The JWT now carries no `exp` and a renewal moves only its row's expiry, so every copy keeps working while the desktop keeps the app alive. What still bounds it: - only the desktop's web session can extend it; using the token never does, and signing out or revoking that session revokes it; - it lapses 12h after the desktop last asked, and a lapsed row is never revived: the next launch gets a new token; - however often it is renewed, a token is replaced after 7 days, and the old one is revoked on the spot along with the tokens it minted and its sockets. The desktop no longer re-posts a renewal that kept the same token, so the app's sockets aren't rebuilt every few hours; an app that reports its token stopped working is always answered. * fix: reserve the feedback and no-reply mailbox names again Signup checks names against `util/reservedUsernames`, but `fbl`, `noreply` and `no-reply` were added to a second copy of the list in AuthController that nothing reads any more, so they became claimable. Move them into the live list and drop the copy. --------- Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-05 01:10:29 -07:00
Daniel Salazar	4ef5e6c110	fix(socket): hold unlisted free plans to the free connection cap (PUT-1830) (#4060) ... The per-account socket cap looked a plan up directly in its map, so org_seat_free (team seats on a free team) got the paid cap. Route and events limits already gave an unlisted free plan the default free entry; that rule now lives in one helper, subscriptionOverride, used by all three. Also publishes the socket connection caps, corrects the seat-plan line in rate-limits-and-quotas.md, and makes the isFreeSubscription test assert literal ids.	2026-10-04 00:46:59 -07:00
Daniel Salazar	1cc091206c	fix: PUT-1885 PUT 1950 (#3981) ... * fix: app uuid fixes * fix: bound kv update/add createPaths writes (PUT-1885) * fix: upload progress socket events on the v2 tracker (PUT-1950)	2026-09-28 23:38:34 -07:00
Juan Castro	ee3f928b0e	fix: annotate the seat-lookup catch so the baselined typecheck passes	2026-09-25 14:39:23 -04:00
Juan Castro	db1a95260a	feat: let a team require 2FA of the accounts it provisioned (PUT-1988) ... `group.require_2fa`, toggled by the owner through `PUT /teams/:uid` and recorded in the audit log like `directory_enabled` — it changes what every seat must hold to sign in, so it is not something a team should be able to alter silently. Enforced by deriving, not by stamping a flag on the user: a stamp left behind by a member leaving, or by the rule being turned off, would lock someone out of their own account with no team left to clear it. The seat row already joins `group` and is already read per request, so it carries the flag and the gate costs nothing extra. Toggling busts those rows, or turning the rule off would leave members locked out until the TTL lapsed. The gate rides the same `allowUnconfirmed` opt-out as the other pending- requirement gates, so the routes a gated member must still reach stay reachable — `configure-2fa` among them, which would otherwise be walled off behind the very requirement it clears. Scoped to `org_owned = 1`: the owner is not a seat of their own team, and a joined member is an ordinary self-paying account whose personal login is not a team's to dictate. The owner is held to the rule at the point it matters — they cannot turn it on without 2FA of their own.	2026-09-25 10:35:24 -04:00
Daniel Salazar	132cae9f6a	Bug bash fixes (PUT-1876, 1877, 1880, 1881, 1948, 1949, 1951) and KV event fan-out by plan (#3943) ... * fix(kv): keep disableSharing entries out of other apps' events (PUT-1876) Private kv keys and values are no longer delivered to cross-app subscriptions, including forwarded and durable deliveries. * fix(fs): refuse usernames whose home path still holds another account's rows (PUT-1877) Username claims (signup, save_account, change-username, OIDC, team provisioning) now also check for leftover rows under /<name>/, and the root listing only returns the actor's own home. * fix(puter-js): reconnect the events channel after a server-side disconnect (PUT-1881) A server hang-up is retried with a bounded backoff; persistent handlers survive it and get an optional onError when the connection can't be restored. * fix(backend): let the graceful shutdown finish before telemetry exits (PUT-1948) The telemetry preload no longer exits on signals; the entry point drains, tears down top-down, flushes telemetry last, then exits. DB pools stay open until teardown. * fix(fs): reserve quota for signed uploads in progress (PUT-1880) startWrite/startBatchWrite hold each upload's declared size in a per-owner cache reservation until it completes, aborts or expires, so a burst of starts can't all read the same committed usage. Caps in-flight uploads at 10,000 per account. * fix(fs): refuse to complete a signed upload whose object never arrived (PUT-1951) Completion now 400s when the object store reports the key missing (transient errors stay lenient), abort no longer deletes an object a live entry still uses, and a ghost entry is only removed after a second miss at its recorded location. * fix(metering): move usage to v2 keys with a small totals item, per-model detail shards and a 3-month TTL (PUT-1949) The billed item holds only totals; per-model detail lives in 100 hash-sharded items read in one batch and cached for 60s, and more than 5,000 distinct usage types in a month fold into other. Global and per-app aggregates store totals only, appTotals comes from a prefix listing, a refused path only skips the key that refused it, exact reads near the allowance are throttled per key, and every metering record expires after 3 months. September usage restarts at deploy; the monthly-charge claim stays on the v1 key through September so recurring charges don't fire twice. * test(events): let the worker backoff test tolerate a loaded run * feat(events): scale KV event fan-out with the key owner's plan A KV change delivers to up to 512 matching subscriptions (2,048 filter evaluations) for a paid key owner and 128 (512) otherwise, inline values are dropped once more than 128 match, and paid accounts may hold up to 512 share handles per app. The owner's plan is only looked up when a change has more candidates than any cap. * test(metering): seed the 150-app listing test directly so it fits under coverage	2026-09-24 16:00:52 -07:00
Juan Castro	4e821c128c	Merge remote-tracking branch 'origin/main' into juancastro/put-1813-team-share-blocklist-and-unshare-paging ... # Conflicts: # src/backend/services/share/ShareService.ts # src/backend/stores/share/ShareStore.js	2026-09-21 10:28:33 -04:00
Daniel Salazar	9292771554	fix: hardening (#3904)	2026-09-18 11:22:39 -07:00
Daniel Salazar	e5f322f68c	fix: misc event hardening + perm fixes (#3831)	2026-09-08 19:16:21 -07:00
Daniel Salazar	b784b51cf3	fix: harden the events stack for flag-on (#3752) ... * fix: harden events dispatch, single delivery and KV share handles Dispatch: a filtered subscription used the anchor path stored at subscribe time, so renaming or moving the anchor folder silently ended its deliveries; dispatch now resolves the anchor's live path from the event's own ancestor chain. A move out of a watched folder now reaches that folder's subscribers, with `from` only for rows that watched the source side. Gap markers are authorized like deliveries and coalesced per subscription and subject instead of fanning per lost event. Session subscriptions: the per-socket cap decides on the write, not before it; an orphaned watched-set token heals on refresh; durable rows keep their watch window when a session subscribe touches the same keys. `self` is false when the acting user is unknown. Single delivery: a subscription in backoff or suspended with a backlog pinned the sweeper's head and starved everyone behind it — the sweep now defers it. Only a settled handler run bills a delivery. A socket-only account row no longer wedges after two attempts nobody received. The lease is twice the handler timeout; remote candidates have their own attempt counter; the region depth reconcile runs once a minute region-wide with a bounded scan. KV share handles: a grantee no longer sees the owner's namespace and absolute prefix on the subscribe answer or listing, nor in the delivery token; revoking a wider handle retires the handles it covers; minting the same handle twice returns the existing one, after the delegation check; a row whose event cannot be re-based onto its handle is dropped rather than delivered raw. * fix: presence survives replication, long sessions and region churn One presence item per (user, app) with per-region map fields lost a region whenever two regions joined inside the replication window, and nothing ever put it back. Presence is now one item per (user, app, region): each region writes only its own, a leave or repair retires it conditionally on its own write stamp, and a read is a prefix query. Items carry a 48 h ttl refreshed by a claim-gated write off the existing socket renew path, at most once per 12 h, so a tab that stays connected keeps its region in the row. A region that answered "no socket" or completed a leave releases a shared pin, so a reconnect on another node rejoins and a flapping client cannot force a replicated write per cycle. Cached rows expire after a minute; unaddressable region names are filtered and pruned; relayed acks settle under a bounded concurrency; the forward queue is bounded in bytes as well as items. * feat: indexes for the event_subscriptions hot queries Handler publish, remove and listing, and the hourly expiry and suspension sweeps, all scanned `event_subscriptions`. Adds (app_uid, handler_name), (expires_at) and (suspended_at, id), guarded on every engine. Existing migrations: the postgres widens are now guarded so a boot does not take an exclusive lock for a no-op, the kv_share_handles grantee FK gets an index, the sqlite notification rebuild is transactional and idempotent. * fix: notification writes go through the registry The driver's `create` bypassed the type registry, producing uncatalogued rows with no size bound; it now requires a registered type, caps the payload, and answers 400 rather than 500 for a bad one. `mark_acknowledged` emits the ack other tabs listen for, and only when a row was actually changed. * fix: the handler scanner, unsubscribe, and the in-tab handler environment The free-variable scanner skipped arrows inside a declaration's initializer, so `const ids = event.items.map(x => x.id)` was refused, and treated a name after a comma in a nested initializer as bound, so a real free variable slipped through to fail on first delivery. `unsubscribe()` now drops the durable routing entry so the events socket can close. A broadcast handler running in the tab gets `user` and `fetch` like the worker gives it. `single` without a handler name is refused before the round trip. * docs: events limits, error codes and the background-workers section Retention is deployment-configured rather than a fixed 14 days, and the template no longer ships it armed. Documents `events_terminal`, the two per-event gap reasons, the subject length and listing caps, the `from` field on moves, and the handle-relative anchor. The sessions manager hides the background-workers section when the server has none to show. * feat: a background handler acts as the app does for its user A handler's `user` was a five-minute access token scoped to the subscription's `list` grant, which could stat the changed file but not read it, and could not reach the app's KV or AppData — so an app told that a file was written could do nothing with it. It now runs with the same authority the app has for that user in a tab: an app-under-user worker session, one row per (user, app) named `events:handlers`, visible and revocable in the sessions list. The `events:background` consent is what authorizes running it unattended, and is re-checked before every mint. The wider token exposed two things: puter.js opens a filesystem socket the moment it has a token, which would have parked the isolate in the app's own delivery room and steered deliveries at it; the events client now opts out of sockets (and the per-open bookkeeping) before construction, and is memoized per token in the isolate. And four filesystem operations assumed a socket exists; they no longer do.	2026-09-04 17:32:57 -07:00
Daniel Salazar	7ec674d33b	feat: app sockets join their own events room (PUT-1671) (#3676)	2026-09-02 09:01:22 -07:00
Daniel Salazar	b07d2e109f	feat: session event subscriptions and dispatch hot path (PUT-1666) (#3675)	2026-09-02 09:01:22 -07:00
Daniel Salazar	f3a46a9be4	fix: stop sockets outliving the session that authenticated them (#3658) ... A socket was checked once at handshake and never again. Nothing in the backend disconnected one, so logout-everywhere, password reset, session revoke and suspension all left every connection streaming legacy FS entries, upload paths and notification bodies — up to 400 per account — on a credential that had already been revoked. Three gaps, three fixes: - The handshake skipped the suspension and pending-verification checks every authenticated HTTP route gets. `decideSocketAuth` now applies both. - `revokeCascade` reports which rows it revoked, AuthService announces that as `auth.sessions.revoked`, and SocketService drops the account's room. The whole room goes, not just the revoked session: narrowing it would need `fetchSockets`, which the adapter builds on `serverCount()` — and that calls node-redis's `send_command`, which ioredis does not implement. A connection whose session survived reconnects on its own and re-authenticates. - A bulk suspension writes `user.suspended` without touching `sessions`, so no revoke fires. A five-minute sweep re-verifies each live socket's token and drops the ones that no longer authenticate. De-duplicated by token, since a browser's tabs share one.	2026-08-28 11:12:27 -07:00
Juan Fernando Castro	d5ae5a0049	🔧 PUR-1072: Flatten driver permissions to hardcoded values (#3545) ... * refactor(permissions): drop hardcoded group permission map for a flat default * test(drivers): assert credential-gate intent instead of a 403 proxy	2026-08-12 12:08:38 -07:00
Daniel Salazar	79d4201f12	fix: rate limits, AI routing, and a type-check gate (#3529) ... - declare rate + concurrency limits on every route and driver that lacked one - add acquireConcurrent for websocket connections and the DAV mount - bucket AI models by identity key only; keep resold duplicates of any vendor - skip recently-failed provider routes; cap the fallback chain at 3 attempts - let full-access access tokens bind a worker to an app their own user owns - cache resolved subscriptions so tiered limits don't add a round trip	2026-08-10 19:09:47 -07:00
Daniel Salazar	116d6e6663	tests: big test push for better coverage (#3490)	2026-08-01 14:29:59 -07:00
Daniel Salazar	8f8efcb349	feat (PUT-1025 PUT-1026 and PUT-1017): better handling old token auth required in gui (#3166) ... * feat (PUT-1025 PUT-1026 and PUT-1017): better handling old token forcing in gui * fix: misc issues with token inval project	2026-05-27 02:26:35 -07:00
Daniel Salazar	b188942436	feat (PUT-1016 & PUT-1020) (#3164) ... * feat (PUT-1016 & PUT-1020) temp account preservation on forced relogin hosted asset cookies to v2 token too * fix: remove llm dashes and ugly comments * update agents	2026-05-26 23:35:16 -07:00
Daniel SalazarandClaude Opus 4.7	ac5eecb7f3	feat (put-1019 put-1021): v2 auth revoke endpoints + silent v1->v2 to… (#3158) ... * feat (put-1019 put-1021): v2 auth revoke endpoints + silent v1->v2 token migration PUT-1019 (AUTH-5): full revoke-endpoint coverage - /logout: soft-revoke web session + its asset cookies via revokeCascade (app sessions and access tokens survive) - POST /auth/revoke-session: cascade per row kind (web/app/access_token/asset) - POST /auth/revoke-all-sessions: revoke all web rows for user; optional include_apps=true nuclear option; gated by userProtected (cookie-only) - revokeAccessToken: soft-revoke matching access_token row in addition to removing access_token_permissions - All revokes are UPDATE revoked_at = now(); no DELETE statements remain PUT-1021 (SDK-1): backend POST /auth/migrate-token - v1 access_token/app -> mint matching-kind v2 token, idempotent on (auth_id, kind, token_uid) - v1 web/session -> 409 { code: "reauth_required" } (interactive relogin only) - Same-origin / signed-referer hardening; rate-limited per IP and auth_id - Gated by auth.allow_v1_tokens; emits puter_token_v2 cookie for app-in-browser DB migrations: mysql_mig_10, sqlite 0053 (sessions.access_token_uid column) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(put-1019): reject self-revoke; enrich list-sessions response - handleRevokeSession refuses uuid === req.actor.session.uid (use /logout instead). The cookie that authenticated the call should never be the target of a self-revoke — the response can't write fresh auth state and the client ends up with an ambiguous identity. revoke-all-sessions still has the explicit include_current opt-in for the nuclear case. - AuthService.listSessions now joins the apps table for kind='app' rows (returning { uid, name, title, icon } so the manage-sessions UI can render the authorizing app without a second round trip), surfaces kind / expires_at / label / last_ip / created_via, and filters out asset rows (per-cookie children of web rows, revoked transitively via cascade — surfacing them as standalone entries would be confusing). - Sort order: current session first, then most-recently-active. UI relies on this to anchor "you are here" at the top. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(put-1019 put-1021): review nits — origin normalization, cookie fallback, types, migration order B1: createAccessToken.options.expiresIn widened to string | number. The impl (#hardExpiryFromExpiresIn) and existing callers/tests use jsonwebtoken-style strings ('1h', '30d'); narrowing to number forced unsafe casts at every call site. Cast at the single sign() boundary where jsonwebtoken's typed template-literal SignOptions clashes with the wider runtime contract. B2: Inline comment on the DELETE in access_token_permissions. The AUTH-5 "no DELETE on revoke" rule scoped to the `sessions` table (where the cascade graph + audit trail matter). Permissions rows are the grant manifest for an active token — once its session is soft-revoked they're dead-weight cache entries. A future audit requirement would land as a `revoked_at` column on this table, not a behavior change in this PR. B3: handleMigrateToken now sets the puter_token_v2 cookie (with the shared sessionCookieFlags + httpOnly) when the migration result is kind='app'. The endpoint is already gated on Origin so the caller is by definition in a browser; access tokens deliberately skip the cookie since they're programmatic. B4: #isMigrateTokenOriginAllowed normalizes both incoming origin and config.origin / allowlist entries (trim + strip trailing slash + lowercase) before equality. A misconfigured `config.origin = "https://puter.com/"` would otherwise reject every same-origin browser call. B5: Replaced 4x `this.config.cookie_name!` non-null assertions in AuthController with `(this.config.cookie_name ?? 'puter_token')`. IConfig is `Partial<IConfigOptional>` so cookie_name is undefined at runtime in some deployments / test setups; the fallback matches the pattern in userProtected / OIDCController / puterSite. B6: MySQLDatabaseClient sorts migrations numerically by trailing integer instead of lexically. Existing files use unpadded names (`mysql_mig_<N>.sql`), so plain `.sort()` ran mysql_mig_10 before mysql_mig_2 — a future migration that depended on _2..9 running first would break. Non-numeric filenames fall through to localeCompare for determinism. B7: Restored the docstring for SessionStore.getOrCreateApp's `opts.auth_id` ("Stable per-user identity (survives re-login); carried on every v2 JWT so manage-sessions can group by identity") — the previous edit truncated it to a fragment. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test + feat: backend test coverage for PUT-1019/1021 review fixes + worker session methods Tests ----- - compareMigrationFilenames (new) covering B6 numeric-sort: confirms mysql_mig_10.sql lands after mysql_mig_9.sql; non-numeric files sort after numbered ones; stable for already-ordered input. - listSessions (AuthService.test.ts): excludes kind="asset" rows; enriches with kind/expires_at/last_ip/created_via; joins kind="app" rows with the apps table; sorts current first then by last_activity desc. - handleRevokeSession (AuthController.test.ts): refuses self-revoke with 400; still allows revoking a sibling session. - handleMigrateToken (AuthController.test.ts): rejects missing/ disallowed Origin; tolerates trailing slash and uppercase Origin (B4 normalization); returns 409 reauth_required for v1 web tokens; does NOT set the cookie for access-token migration; DOES set the puter_token_v2 cookie (httpOnly + sessionCookieFlags) for app-under-user migration. - SessionStore tests updated to import APP_WINDOW_SECONDS / WEB_WINDOW_SECONDS rather than hardcoded 30/90 day values — the windows just got bumped to 1y and the assertions need to follow the constant. Refactor -------- - MySQLDatabaseClient exports compareMigrationFilenames so the sort logic is unit-testable in isolation. Worker tokens ------------- - AuthService.createWorkerSessionToken(user, meta?): mints a new kind="web" row tagged meta.worker=true, expires_at = WORKER_WINDOW_SECONDS, returns { session, token, gui_token } with worker: true on each JWT. - AuthService.createWorkerAppToken(actor, appUid): mints a new kind="app" row tagged meta.worker=true, expires_at = WORKER_WINDOW_SECONDS, returns an app-under-user JWT with worker: true. Note the existing idx_sessions_user_app_active unique index will collide with an existing non-worker app session for the same (user, app) — future schema work can carve workers out of that uniqueness. SessionStore.js: WEB/APP_WINDOW_SECONDS now 1y; WORKER_WINDOW_SECONDS = 99y added for the worker path. Full backend suite: 2172 passed / 16 skipped / 0 failed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 18:49:36 -07:00
Daniel Salazar	5394ccc45c	feat: add verification for v2 auth (#3155)	2026-05-26 15:34:54 -07:00
Daniel Salazar	0276420213	fix: treat access tokens as non-auth unless opted in (#3111) ... * fix: treat access tokens as non-auth unless opted in * fix: tests	2026-05-13 14:20:15 -07:00
Nariman Jelveh	267f464232	Add AGPL license headers to source files (#2877)	2026-05-01 13:50:42 -07:00
6 people	d4d78ac7db	rework: change backend and backend extensions to use simpler code structure and patterns (#2815) ... * fix: dynamodb health checks and client recreation (#2789) * wip: no nanoServices groundwork * feat: data clients in new shape * wip: auth and perms in new system * more wip * middlewaters mainly done * wip: fsv2 in new layout * old fs v2 migration * driver system * driver and old fs fixes * ai drivers wip * stream support * metering in ai chat driver * wip: new auth * rate limit and auth routes * captcha and anti csrf * fix: types * auth store * app logic * wip most other dricvers * fs * mostly kill all legacy stuff * fs finish * fix: redis usage * ai controller * driver cleanup * socket io in v2 * broadcast and crudq stuff * subdomains * notifcations and shares * fix bad syntaxes * auth wip Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * extensions * extension setup * more routes * sql migrations and default services * home router * tier 7 * everything else * everything else * remaining missing bits * server health * logs * cleanup * deps * cleanup 2 * more cleanup 2 * boot * fix launch * config fix * move file * fix: tsconfig things * fix: extension loading * launching * fix: drivers * fix: others * fix: icons * fix: file uploads * fs fixes * fix: fs api * fix: dev-center * config * add back telemetry * lint stuff * husky hooks * fix: fs oss * fix: config migration * config migration * migrate scripts + replicate * runner * fix: merge defafult config * fix: default region * fix: api domain * fix paths in readfile * fix fs entry default s3 * NS: Remove Referral && Entri Service * dep cleanups * fix: static assets * fix: kv and perms * fix: driver registrations * fix: home mapping * fix: rao * adding back 500 alarm * fix: build paths * fix: fs and kv shapes * fix: kv shape * more kv coercing and ai chat matching format as prior * fix: private app gates * private app caches * fix: whole bunch of legacy shape issues * update template jsonc * fix caching partial oidc and fs signed paths * more oidc fixes * fix: wip * fix: private apps * admin route fixes * fix: last few things hopefully * claude uploads * fix security for app only routes * fix kv system namespace * stuff * fix: app and kv and suggested apps * fix:open item * fix: FS operations * fix: default app icons * add back token-read and WSL support * metering fixes * fix: fsEntry * perm scanners and implicators * proper download endpoint * fix: download * fix anti csrft on v2 * fix file extensions, app icons * fold in v1 fixes from origin/main into v2 equivalents Re-applies the v1 fixes that landed on origin/main into their v2 counterparts since the v1 files were deleted on DS/wip during the v2 migration. v1 commits referenced below. - SQLBatcher: flush immediately when queue hits maxBatchSize instead of racing the timer (v1 12f48238). - RedisClient: drop maxRetriesPerRequest from 2 to 1 to shrink failure window (v1 b6776ab4). - ChatCompletionDriver: default minimumCredits to 1 when unset/zero so zero-cost precheck doesn't auto-pass (v1 36bd6073). - OpenAiImageProvider: add gpt-image-2 support — open-ended size rules, token-based cost estimator, arbitrary-size normalizer, isGpt prefix broadened to gpt-image- (v1 f14f1bf4). models.ts auto-merged via rename detection. - AppStore: bump row cache TTL from 5m to 24h (v1 6b3196ed). Not ported: v1 app-object Redis cache (bdfa12b5/b886dde3) — v2's #toClient recomputes filetype_associations/created_from_origin per read; adding a second cache layer is a larger change for a follow-up. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * remoe anti-csrf from auth routes that had not used them * more icon fixes * fix worker functionality * fix: app and subdomain es Co-authored-by: Copilot <copilot@github.com> * fix PUT-761 * fix: PUT-748 * fix: rename fsService * Add security back to WorkerDriver * Migrate worker from fsEntry to fs. Fix cache issue * remove ability to create symlinks * strict webdav acl * require auth for wisp * chore: service renames * Add metering back to puter peer api * fix: PUT-760 PUT-749 * fix: PUT-746 * fix: peer cost Co-authored-by: Copilot <copilot@github.com> * fix: 771 * change order of peer controller * fix: create appdata folder for app on get auth token * fix: align delete site and list sites * delete: putility * fix subdomains * Add support for tilde in subdomains, fix subdomain update * cleanup PeerController.ts and fix billing oversight (#2844) * fix: PUT-786 * fix: bugs * fix: issues with multiple subdomain queries, or permission checks * fix: harden response shapes to not contain uneeded fields * fix: move state to redis * fix: missing kv methods + better sec Co-authored-by: Copilot <copilot@github.com> * fix: subdomainStore limit * fix: missing path resolution Co-authored-by: Copilot <copilot@github.com> * fs fixes * fix: undef error * fix fs + cleanup * fix: npm audit fixes * heal path entries where missing Co-authored-by: Copilot <copilot@github.com> * fix: caching Co-authored-by: Copilot <copilot@github.com> * fix: cache inconsistencies Co-authored-by: Copilot <copilot@github.com> * fix: app driver metadata Co-authored-by: Copilot <copilot@github.com> * remove extraneous comma * fix: associated app icons * fix: bad tool call * Add validation to WorkerDriver#getFilePaths * misc fs and auth issues Co-authored-by: Copilot <copilot@github.com> * fix: oidc errors Co-authored-by: Copilot <copilot@github.com> * fix: PUT-797 * fix: legacy appdata_app Co-authored-by: Copilot <copilot@github.com> * fix: add alert logs Co-authored-by: Copilot <copilot@github.com> * fix: error handling * Disable sharecontroller * fix: remove private user identifier for ai * fix: private app fixes * Add backback signup_server * fix: completionId size Co-authored-by: Copilot <copilot@github.com> * fix: revalidate path for oidc * fix: revalidate path for oidc * fix: email validation Co-authored-by: Copilot <copilot@github.com> * fix: user create query * fix: middleware extensions Co-authored-by: Copilot <copilot@github.com> * use x-forwarded-for for req ip forwarded * fix: missing last_activity ts * feat: add cache broadcast to subdomains * fix: update config typing --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: ProgrammerIn-wonderland <3838shah@gmail.com> Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Nariman Jelveh <nj@puter.com> Co-authored-by: velzie <velzie@velzie.rip>	2026-04-30 12:13:43 -07:00