363 Commits

Include renames

Author	SHA1	Message	Date
Neal Shah	2a15afc570	Resolve PUT-2059 (#4250)	2026-10-16 01:45:56 -04:00
Juan Fernando Castro	c6c0dd5e29	fix: bound how many accounts a team owner can provision (#4223) ... * feat: bound provisioning by what an owner may mint, not only what is live Seat and team caps express how much may exist at one time. This adds the other half of the rule: how much an owner may create over a window, and the checks a provisioned account answers to. - Provisioning puts each seat through `SignupService.runSignupGate`, the same extension-owned gate a signup answers, and refuses what it blocks. It fails closed, since a check that could not run is not a check that passed. - A per-owner budget over a rolling window, sized to every seat the owner may hold live across every team they may own, times the churn allowed on top. It is spent on creation and is not returned. Keyed on the owner's uuid so a recycled id cannot inherit someone else's spend, and charged after validation so a taken username costs nothing. * refactor: tighten the provisioning gate and budget after review - The gate runs before the seat-cap lock. A listener has no deadline and the lease is ten seconds with nothing to renew it, so the lock must not be held across one. - `failOpen: false` rethrows rather than returning false, so a backend outage is answered 503 instead of escaping the handler. - An address goes through `validateEmail` first, as it does on every other path that creates an account. - The gate always runs; a request only enriches what it is told, so one being absent is no reason to skip it. - The gate is told it is looking at a seat, whose address is optional. - A refusal carries the gate's own code and request code, as a blocked signup does, so support can correlate it. - Restored `provisionAccount`'s docblock, which an insert had displaced. Tests: the spy restores in `finally`, and the cap overrides are taken after the fixtures, so one failure cannot cascade through the file. * fix: show a provisioning refusal as a rule, not a failure The console special-cases the seat cap and sends everything else to "Something went wrong", which reads as a fault rather than an answer. The provisioning budget refuses the same way the cap does, so it is presented the same way.	2026-10-14 11:54:35 -04:00
Juan Fernando Castro	e32bfa839d	fix: count one app open per account per app per hour (#4152) ... * fix: count one app open per account per app per day `app_opens` is read two ways at once: `open_count` is a row count and `user_count` is distinct accounts. A repeated open moves the first without the first moving the second, and the incentive report prices opens. An open is now marked as it is recorded and skipped for the rest of the day, before both the row and the event ClickHouse ingests, so the two stores agree. The marker is set only when absent, so the first open of the day wins a race; an unreachable marker counts the open, since counting twice beats not counting. * fix: count one app open per account per app per day, at the count Dropped the row-suppression approach. `app_opens` is not only a counter: `getRecentAppOpens` orders the desktop's recent list by `MAX(_id)`, and `app.opened` is the socket event other tabs reorder on. Suppressing the repeat row froze both at the first open of the day. Every open is recorded as before. `open_count` counts each account once per day instead, which is the figure `user_count` is read against. `countDistinctUserDays` folds the pair into one number because `COUNT(DISTINCT a, b)` is MySQL-only, and `dayBucket` covers MySQL's decimal division. ClickHouse has uniqExact over the tuple. Note the figure's meaning changes at deploy: a period spanning it mixes rows with account-days, so a comparison across that point is not one. * fix: count one app open per account per app per hour Review feedback: a day is too long a window for the repeat to collapse into. The period is now an argument rather than a baked-in 86400, held in one constant on AppStore beside the other store policy numbers, so the SQL and ClickHouse sites cannot drift and a future change is one line. The fold `COUNT(DISTINCT user * N + bucket)` is only injective while the bucket index stays under N. Hourly buckets are 24x the day index and pass the old 1000000 in 2084, so N moves to 10000000. Buckets are clock hours, not a rolling window, so two opens a minute apart either side of the hour still count twice — tested, and the same property the day version had at UTC midnight. The detailed-stats fixture gave its repeat open a 60s offset, which under hourly buckets would have counted twice whenever the suite ran in the first minute of an hour. It now shares a timestamp with the open it repeats.	2026-10-14 11:54:17 -04:00
Daniel Salazar	ff815f730d	fix: harden token delivery, session revokes, app identity and fs scoping (#4229) ... - relay sign-in popups take the opener origin from the referrer only - session revokes read the primary, batch per user, and tombstone caches in every region - wisp relay tokens bound to the minting session; verify rechecks the account - hosted origins keep app identity with the site owner; deleted app uids recorded in deleted_apps - subdomain cache tombstoned on delete, update, reclaim and app/account cascades - email lookups require an exact address match after the SQL lookup - workers deploy only from files the deployer owns - share_app_data:false enforced at ACL time, plus copy/move/rename/share/recursive listing - kv remove returns no value without read; kv:expire op grant usable - fs errors name the entry instead of the owner's path - shared-by-me drops rows a delegate no longer has authority over - private apps can't move index_url onto another user's origin - GUI: default apps saved and launched by uid; save picker accepts only copy/move; permission dialog waits for focus; Publish as Worker hidden on others' files	2026-10-14 06:56:44 -07:00
Daniel Salazar	f6a1e54642	fix(fs): keep S3 read stream errors from crashing the process (#4227) ... getObjectStream now attaches an 'error' listener to every body it returns. A body that fails before its consumer attaches (socket timeout, reset, or a checksum mismatch on a truncated read) used to emit 'error' with no listener and exit the process, failing every in-flight request on the task. It now logs a warning; consumers that attach later still receive the error.	2026-10-13 17:42:28 -07:00
Neal Shah	62270ff9aa	Delete worker sessions when workers are deleted, don't treat sessions from deleted workers as still valid. (#4163)	2026-10-13 12:43:45 -04:00
Daniel Salazar	b52fc01712	perf: cut godmode app launch latency (cached token renewal, launch reuse) (#4221) ... * perf(auth): renew godmode app tokens from cache instead of the primary Every godmode launch read its token row from the primary and rewrote its expiry, a few cross-region round trips per launch far from the primary. - A cache pointer names the row per (user, web session, app). The row is read through the uuid cache token auth uses and re-checked (owner, session, app, revoked, expired, max age); anything else falls back to the primary read. Revoking the row drops the pointer. - The expiry write is skipped when it would move by under an hour. A renewal that hits a revoked or lapsed row mints a new one instead. - The response carries the row's actual expires_at. * perf(gui): reuse a just-minted godmode token for repeat launches A launch of a godmode app reuses the token this page minted for it within the last ten minutes under the same desktop session, instead of asking again. The cache is dropped when an app reports its token dead, after a session revoke from the session manager or an uninstall, and across tabs via a BroadcastChannel that carries token row ids, never tokens. A mint in flight during a drop is not remembered.	2026-10-13 08:53:55 -07:00
Neal Shah	b8bb6292d6	Fix webdav locks issue and tighten GUI ipc rules for setWindow* (#4207)	2026-10-12 17:39:09 -04:00
404oops	f9cde23937	Merge branch 'filipkujundzic/put-1954-elevenlabs-tts-passes-voice-names-through-as-voice-ids-so' into filipkujundzic/put-1907-ai-streaming-buffering-and-error-shape-cleanup ... # Conflicts: # src/backend/drivers/ai-chat/utils/inlineImages.test.ts # src/backend/drivers/ai-chat/utils/inlineImages.ts # src/backend/drivers/util/fileInput.ts	2026-10-12 12:39:35 +02:00
Daniel Salazar	d8f9aff3dd	fix: follow-ups to #4161–#4203 (rate limits, broadcast, AI routing and billing, fs subtree walks) (#4205) ... * fix(rate-limit): count the newest KV rate rows first The KV backend's rate check, peek and concurrent acquire list the key's rows with a limit + 1 cap that the store applies before dropping expired rows, so unswept rows from past windows (oldest keys) could fill the fetch and the live count read as zero. They now list newest first. * fix(broadcast): split webhook flushes under a byte budget, per-peer backlogs Flushes go out in bodies of at most `broadcast.outboundMaxBodyBytes` (default 4 MiB) instead of one POST, and each peer keeps its own backlog of what it missed, capped by count and four bodies' worth of bytes, oldest dropped first, so one failing peer can no longer grow every peer's body past their 50 MB limit. * fix(ai-chat): classify dropped upstream connections as provider failures A connection reset or refusal (SDK APIConnectionError, Mistral's ConnectionError, an undici reset on the cause) carries no status, so a chain of them fell through to 500 internal_error. Attempts now record connectionFailed; a chain of only resets and 5xx answers 400 upstream_provider_unavailable, and a reset counts as an upstream signal in a mixed chain. * fix(ai-chat): keep SDK retries on Anthropic count_tokens The Claude client is built with SDK retries off so the driver can fall back, but count_tokens has no fallback route. It now passes sdkRetryOptions, like the OpenAI moderation call, so a transient 429 or reset is retried. * fix(ai-chat): mark a route unhealthy for 60 s after a transient failure With SDK retries off, one 5xx, 429, timeout or dropped connection kept a route marked for 10 minutes, sending that model's traffic to resellers. Those failures now mark the route for 60 s; bad credentials, an exhausted account and other route-level failures keep 10 minutes. * fix(metering): don't memoise spent addons inside the force-exact window The spent-addons memo could cache a pre-grant record read from a lagging replica right after a credits-changed announcement, so overage skipped the new credit and requireCredits kept answering 402 for up to 15 s. A spent record is now only cached once the actor's force-exact window has ended. * fix(share): send the digest entries a flush claimed when another take fails Digest entries are taken concurrently, and a single rejected take threw away every entry the other takes had already removed from KV. The flush now logs the failed takes and sends what it claimed; an entry whose take failed stays queued for a later flush. * fix(fs): announce an overwriting move's replaced entry only when it took its name /move and v2 /fs/move looked up the entry at the destination name before moving and always announced its removal. A move into someone else's Trash renames instead of replacing, so the owner's desktop hid a live entry and legacy /move reported it as `overwritten`. Both routes now pass the target on only when the moved entry kept the name it was looked up by. * fix(ai): name the vendor in upstream error fields from media providers upstreamFetch now takes the provider id plus a display label, and UpstreamResponseError carries the id. translateProviderError copies a string `provider` off the error into `fields`, and the BytePlus video and Cloudflare image errors set one, so upstream_auth_failed and upstream_credits_exhausted alarms say which vendor failed again. * fix(teams): delete a provisioned seat whose home folders could not be created provisionUser logs a failed default-folder creation and still returns the account, so provisionAccount went on to add the membership, issue a password, mail the seat and emit team.account.created for an account with no home. It now cascade-deletes the new user and returns 500 internal_error before any of that. * fix(ai-chat): load model catalogs without holding up server start onServerStart awaited every gateway catalog (up to its 10s fetch timeout) while HTTP was already listening, so drivers started after it had no providers yet and chat requests found an empty model map. The first build now runs in the background; complete(), models() and token counting wait on it instead of failing. * fix(ai-chat): serve direct models while gateway catalogs load at boot The first model-map build now publishes a fresh map as each provider's catalog lands, so static catalogs are routable at once. complete() and token counting wait for the full first build only when the model, or the provider asked for, isn't in the map yet. Refreshes still swap once. * fix(ai-chat): split gateway-billed cost across input and output A completion billed at the cost OpenRouter, Infron or Neuralwatt reports was quoted to `ai.prompt.cost-calculated` as all input and no output. The ledger still records one `billedUsage` line; the reported per-key costs now spread that bill over the usage keys at the catalog's relative rates, in whole µ¢ that sum to it. Neuralwatt energy units take no share. * fix(ai-image): hold Replicate credits for the whole prediction The output and input-surcharge holds took the default 10-minute TTL, the same as the prediction window alone, so a slow prediction could outlive them once creation and input measurement were added. They now last 15 minutes, like the video job holds. * feat(ai-chat): report what a completion was charged as usage.cost Chat usage (the non-stream result and the stream's final usage line) now carries `cost`: the µ¢ the ledger records for the request after the cost factor, from the request's recorded charges and the gate's factor lookup. `usd_cents` is unchanged. A hooked recording now copies the usage object first, so keys the driver adds later never land in the ledger. * fix(ai): charge streamed speech once its first byte arrives Per-character TTS and the voice changer recorded their charge when the upstream's response headers arrived, so a body that failed before any audio was billed in full. A shared relay now charges on the first byte, or when the caller hangs up, and charges nothing for an upstream that fails or ends before sending audio. * fix(ai): release credit holds only after the request's usage lands A hold was released as soon as its operation returned, while the usage it stood for was still being written (behind the cost-factor lookup), so a concurrent request briefly saw neither. AI metering now tracks the request's usage writes and its holds (chat included) release once those settle, without delaying the response; a streamed charge chains its own. A failed write still releases the hold, and the hold's TTL backstops it. * test(ai-chat): wait for a stream's credit hold to come back after its usage lands * perf(fs): page subtree delete and copy by parent link, not by depth over the path range Each page of a recursive delete or copy sorted the whole remaining subtree by a computed depth, so a walk cost grew with the square of its size. It now pages the children of up to 100 sibling directories at a time by parent_uid, depth first, keyset on (parent_uid, id), so a page reads only its own rows; rows with no stored path are reached too. SQLite gets the parent_uid index the others have. * fix(fs): find children by parent_uid in the empty check and supplementary-name lookup Rows the old backend wrote carry parent_uid and no parent_id, so a non-recursive delete of a directory holding only such rows passed the empty check and orphaned them, and on MySQL the supplementary-character child lookup missed them, leaving their subtrees out of listings, counts and renames. Both now key on parent_uid; the empty check still probes parent_id too, which the delete cascade follows. * docs(fs): drop the single-POST note from the entry broadcast cap	2026-10-12 01:10:54 -07:00
Daniel Salazar	b88aa55b24	fix: drop moved descendants from the entry cache; read cursor=null as the first page (#4204) ... Renaming or moving a directory rewrote its descendants' paths but left their cached copies (by id, uuid and old path) live for up to 60 s. A lookup of an old path kept resolving, and a write beneath one landed at a path its parent no longer had. updatePathPrefixForUser and renameUserHome now drop those keys, here and, within the broadcast budget, in peer regions. puter.js sent `cursor=null` for `listShared`/`listSharedByMe({ cursor: null })`, which decoded to null and failed every keyset listing with a 500. decodeCursor reads it as no cursor, and the SDK no longer sends it.	2026-10-12 00:19:11 -07:00
Daniel Salazar	f3134b2530	refactor(ai-media): shared upstream fetch, provider registry and bounded inputs for AI media drivers (#4188) ... * refactor(ai): route TTS, STT and voice-changer REST calls through upstreamFetch upstreamFetch bounds a provider call with AbortSignal.timeout and throws an UpstreamResponseError carrying the upstream status and code, which the /drivers/call boundary maps like any SDK error. Replaces five hand-written status translators (ElevenLabs TTS, xAI TTS, Speechify, xAI STT, voice changer); caller-facing messages are now sanitized by the shared mapper. * perf(ai): bound input image fetches and share one data-URI parser fetchImageBytes now streams under a byte cap (30 MB by default) with a 30-second timeout, via a readBoundedBody helper shared with loadFileInput's web branch and Replicate's input measuring. assertInputImagesShape caps input_images at 16. Chat image inlining uses fetchImageBytes instead of buffering with no timeout. fileInput, imageInput and mediaParts parse data URIs through one parseDataUri. * refactor(ai-tts): one per-character metering path for TTS providers meterPerCharacter holds text length x price, runs the synthesis and meters the same amount once it succeeds; characterCostReport builds the per-character cost lines. Both sit on a new withAiCreditHold (reserve, run, release) that Gemini TTS uses directly. SAMPLE_AUDIO_URL is defined once. The TTSProvider base class is gone: its methods were stubs every provider overrode, and only Polly read its untyped providerConfig. * refactor(ai): one ProviderRegistry and key reader for the AI media drivers ProviderRegistry holds a driver's provider catalog (ids, default, aliases) and its configured instances: alias resolution, the not-found 400, default fallback and parallel 'all' listing. TTS, speech-to-text, OCR and the voice changer route through it. readProviderKey reads apiKey, secret_key, api_key and key in that order for every AI media driver, so providers.xai.secret_key now enables xAI TTS as it already did xAI image and speech-to-text. ElevenLabs caches its voice list for 10 minutes, as Polly does. * perf(ai): stream TTS and voice-changer audio instead of buffering it OpenAI, xAI and ElevenLabs TTS and the voice changer hand the upstream body straight to the caller through upstreamBodyStream; their costs are known before the call, so nothing waits on the download. A body that fails mid-stream ends the response early instead of raising an unhandled stream error. xAI speech-to-text keeps one copy of the audio (the upload Blob) instead of up to three. The voice changer and xAI STT hold credits through withAiCreditHold. * perf(ai-ocr): read Puter files only when the provider needs the bytes resolveFileInput resolves and access-checks a Puter file and defers the read to load(); loadFileInput is that plus the read. OCR resolves first: Textract reads the object straight from S3 and downloads it only if Textract can't reach the bucket, and only Mistral loads the bytes. A file over the size cap is refused from its recorded size before any read. countPdfPages inflates object streams on the libuv pool instead of the request thread. * perf(ai): build image and video model catalogs once and share output saving ModelCatalog holds what the public model routes serve (models, sorted names, cost lines), computed once after boot instead of on every listing. The video driver now awaits its model map before serving. resolveOutputPath and saveGeneratedMediaToFS replace the copies of puter_output_path handling in both drivers, using expandTildePath and normalizeAbsolutePath. The video driver normalizes a copy of the caller's args instead of mutating them, and its never-taken stream branch is gone. * fix(drivers): abort the response when a streamed driver result fails mid-body upstreamBodyStream now errors when the provider body fails instead of ending cleanly, and DriverController pipes stream results through pipeStreamResult (stream.pipeline): a failed source destroys the response so the client sees an aborted transfer, the failure is logged once, and nothing is left to raise an unhandled stream error. A client hanging up stops the source. * fix(drivers): drop a streamed driver result when the caller already hung up pipeline() throws synchronously on a closed destination, which surfaced as a 500 alarm on every early disconnect and left the upstream body open. * fix(ai): bound streamed upstream calls by time to first byte, not download time upstreamFetch takes a `stream` option: the timeout covers the request until the response (or a non-2xx error body) is read, then is cleared so a body piped to the client drains at the client's pace. ElevenLabs TTS, xAI TTS and the voice changer pass it; non-streamed calls keep the full-response bound. A stalled upstream body is still cut by undici's body idle timeout. * fix(drivers): type pipeStreamResult's response by the members it uses	2026-10-11 22:05:37 -07:00
Daniel Salazar	45f6e9d8ee	refactor(drivers-wiring): AppService views and launch gates, batched app lookups, shared driver policy and guards (#4186) ... * perf(workers): skip hot-reload lookups for files no worker is bound to The fs.write.file / fs.remove.node / fs.move.node listeners listed every workers.puter.* row of the file's owner on every event, for every user. The event's FSEntry already carries the worker rows bound to it, so a file with none returns before any I/O; a bound file reads just its own rows, batched, from the primary. * perf(apps): read the uid alias only after a direct lookup misses Every AppDriver uid lookup fired an uncached system-KV GetItem for the merge alias in parallel with the direct read, even when the direct read hit. The alias is now read only on a miss. * refactor(apps): one app view with the launch gates, built by AppService AppDriver's serializer and its private-app / hosted-backing gates move to AppService.views, built on a pure toAppView that is the one place index_url is withheld. AppDriver, the subdomains driver's embedded apps and the GUI shell view all use it. Visibility of protected apps (filterReadable) moves with it. Subdomain embeds (associated_app, app_owner) used to return index_url with no gate; they now withhold it from a viewer who may not open a private app or whose hosted backing is gone, and carry privateAccess, godmode and feedback_enabled like a direct app read. * refactor(apps): one toAppSummary; batch the recommended and taskbar lookups SuggestedApps, RecommendedApps, /get-launch-apps and the taskbar each built their own launch summary; they now share toAppSummary (the extra feedback_enabled / external flags appear on the lists that lacked them). getRecommendedApps awaited getByName once per recommended app (29) and getTaskbarItems did the same per taskbar entry on every whoami; both now make one batched call per key through the new AppStore.getByNames, which keeps getByName's case-insensitive and old-name matching. The taskbar's raw UPDATE of the user row goes through UserStore.update, and /get-launch-apps checks hosted backings in one batch and reaches the stores without casts. * refactor(apps): app routes read through AppService; /delete-site calls the subdomains driver AppController used the global driversContainers through a getter whose boot-order comment no longer held; it uses the injected drivers and AppService. GET /apps/:name looked each name up, read it again through the driver and resolved private access a second time, emitting app.privateAccess.resolveLaunch twice per private app; it now batches the names and resolves once. POST /query/app did a lookup, a driver read and a raw app_filetype_association SELECT per selector (up to 200, serially); it now makes one batched lookup per key, one grant check and one filetype read. The driver's read shape is a pure toAppReadView both use. HostingController's /delete-site re-implemented the subdomains driver's delete (protected check, delete, subdomain.delete event); it keeps its owner-scoped 404 and calls the driver. Hosting and Desktop controllers drop constructors that discarded the drivers argument, and trivial getters. * refactor(drivers): one per-method policy validator and resolver; drop @Driver Four policy blocks (rateLimit, concurrent, requireSubscription, requireReputation) share the { default, methods } shape but each had its own validator and resolver. They become validatePerMethod(value, label, policy) and resolvePerMethod(cfg, method); error messages are unchanged. The @Driver class decorator and the prototype keys it wrote had no users outside its own tests; drivers declare their fields, and resolveDriverMeta reads only those. DriverController takes the driver name from the meta it already resolved instead of probing the prototype. resolveDriverMethodRateLimit/Concurrent stay as deprecated aliases for the email extension. * refactor(drivers): shared actor guards and crud-q concurrency policy The apps, subdomains, workers and notifications drivers each carried a private #requireActor, two carried the same #requireVerified, and apps and subdomains the same owner/app_owner write predicate. These become requireContextActor, requireContextUserActor, assertActorEmailVerified and actorOwnsRow in core/actor.ts; each driver keeps its own error for the cases that differed (system actors still read apps; notifications still answer 403 for an actor without a user). The identical crud-q concurrency block is one CRUD_CONCURRENT constant. The metering, installedApps and appTelemetry extensions re-checked an actor their routes already require; those checks and the tests for them go. * refactor(extensions): store methods instead of raw SQL in OSS extensions installedApps and appTelemetry queried user_to_app_permissions directly and metering read apps by name with its own SELECT. PermissionStore gains listAppsGrantedByUser, listAppAuthenticatedUsers (with the email-share check folded in) and countAppUsers; metering uses AppStore.getByName. * refactor(server): one layer builder and one lifecycle hook runner PuterServer built each of its five layers with its own copy of the same loop (built-ins, then extension additions, into the layer and its export container), and ran each lifecycle hook with five near-identical loops per hook. Both are now one helper each: #instantiateLayer and #runHook(order, hook). Construction order, the args each layer receives, and hook order (start and prepare bottom-up, shutdown top-down) are unchanged. * fix(workers): tear down a deleted source's worker after its FK nulls root_dir_id	2026-10-11 22:04:23 -07:00
Daniel Salazar	d162549c1d	refactor(controllers): one signup, login, confirm and window.user path; userProtected/internalAuth route options (#4189) ... * refactor(auth): one signup path for form, temp, OIDC and team accounts Signup steps (validate hook, phone/card forcing, bonus verdict, provisioning, signup events) move from AuthController and OIDCService into SignupService. Username rules, availability and generation move to util/username.ts, and user-row + group + default-folder creation to provisionUser, which TeamService and DefaultUserService now share. Behaviour fixes: a provisioned team seat joins default_user_group like every other account, and generated temp usernames skip names whose home path is occupied. * refactor(auth): one web-session start for password and OIDC sign-in startWebSession creates the session with the request's IP, user agent, origin and host and sets the session cookie. OIDC sign-ins used to create their session without that metadata, so they showed up blank in the session list. * refactor(auth): one confirmEmail for the code and link confirmation routes Both routes now re-run the email checks, refuse an address another account confirmed, strip it from other rows, promote the group and push user.email_confirmed to the account's sockets (with the originating socket id on the code route). The link route's full-table UPDATE clearing other accounts' pending change-email requests is dropped: /change_email/confirm already refuses an address a confirmed account owns. * refactor(auth): build window.user once for whoami and sign-in buildUserDetails and scrubSensitive move from the whoami extension into util/userDetails.ts. /whoami calls them; sign-in responses now return the same user-actor payload, scrubbed, so the login copy no longer ships the phone number and a no-reload login gets oidc_only/otp/directories up front. Taskbar resolution is best-effort on both. * refactor(http): userProtected route option replaces AuthController's route walker copy The user-protected gate is materialized from a userProtected RouteOption (implies requireUserActor), so AuthController no longer re-implements the decorator walker to wire it per instance; those routes and the session routes are plain decorators now. AuthRequired also counts requireVerified and userProtected. * refactor(http): internalAuth route option and a shared bodyRecord EventsController and PeerController each checked x-puter-internal-auth by hand with different compares; an internalAuth RouteOption now picks the secret from config and one constant-time gate checks it. ShareController and EventsController share bodyRecord instead of private copies. * fix(fs): cap legacy /delete at 500 paths per request The bulk form resolved, ACL-checked and removed an unbounded paths[] list one by one. It now refuses more than FS_BATCH_WRITE_MAX_ITEMS (500), the cap the batch write routes already use, before touching any entry. * refactor(controllers): user and subdomain writes and reads through their stores AuthController's 2FA setup/enable/disable and recovery-code writes go through UserStore.update instead of raw UPDATEs plus a manual invalidate, and /readdir-subdomains pages SubdomainStore.listByUserId instead of an unbounded SELECT; the response shape is unchanged. * refactor(auth): note SignupService's call-time peers * fix(auth): type userDetails' taskbar deps independently of TaskbarDeps.clients	2026-10-11 22:00:53 -07:00
Daniel Salazar	ecef154630	refactor(services): page fs subtree walks, gate share fan-out, one fs ACL helper (#4190) ... * refactor(acl): read ancestor chains from FSEntryStore and share one fs ACL helper getAncestorChain (split a path, batch-read the entries) moves to FSEntryStore, with getAncestors for callers that want the rows. Services read it from the store instead of calling FSService sideways; FSService.getAncestorChain stays for drivers and extensions. ACLService gains fsDescriptor (memoized chain), assertFsAccess, assertFsCreate and refusal, plus the pure aclRefusal mapping. The eight hand-rolled descriptor and safe-error copies in FSService, ShareService, events/authorization, FSController, legacyFsHelpers, LegacyFSController, AuthController and WebDAVController use them. Each route keeps its status, legacyCode and message: fs routes answer access_denied on a 403, the legacy routes still hide refusals from apps as 404, share and events keep forbidden and their own 404 text. * perf(fs): page recursive deletes and batch their event dispatch A recursive delete read every descendant into memory, and an empty-check for a non-recursive one did the same. It now walks the subtree a page at a time in descending path order (children before the directory holding them, so the parent_id cascade never takes a row before it is handled), deleting objects and rows and publishing each page as it goes. A non-recursive delete probes with one LIMIT 1 query. Removals publish once per entry, after the row is gone (the same change as the open fix for the double emit), with one surviving-ancestor chain read at most once for the whole subtree. Events-API dispatch for a batch runs as one background task at bounded concurrency instead of a fire-and-forget promise per entry. FSEntryStore gains hasDescendants and listDescendantsInOrder (keyset paged by path, then id). * perf(fs): copy directories a level at a time A directory copy walked every descendant in memory and copied them one by one: an insert per directory and, per file, an S3 CopyObject, a batchCreateEntries of one and its read-back. It now pages the source in ascending path order (parents before children) and takes each page a depth at a time: rows for directories, links and empty files at bounded concurrency, then the depth's S3 copies at bounded concurrency and one batchCreateEntries for all of them. A single-file copy goes through the same path. A failed S3 copy still fails the call (a ghost file still answers 404), but only after the objects that did copy have their rows, so nothing is left in the bucket unreferenced. Copied entries publish per depth in one dispatch. * refactor(share): build masked share paths in one place sharePathMask exports maskedRoot(owner, uuid, name) and maskUnder(root, realPath). ShareService's maskedPathVia goes, its maskedSelfPath and shareDeepLink's maskedSharePath build on them, and the masker, maskUnderAnchor and learnShareRoots use maskedRoot. Output is byte-for-byte the same; tests pin it. * fix(share): send old_path on a recipient's item.moved The desktop's item.moved handler reads old_path; ShareService sent the former masked path only as from_path. Both are sent now. * perf(share): skip the audience lookup for owners with nothing shared Every fs write, create, rename, move and delete looked for share recipients: an ancestor walk plus two share queries, for an owner who in nearly every case has shared nothing. #sharesReaching now reads the chain through FSEntryStore.getAncestors (no third copy of the walk) and asks a per-owner "has anything shared" flag before the share queries. The flag is the per-user cache events already keeps for subscriptions (SubscriptionCache): one ShareStore.ownerHasShares read per owner per TTL, coalesced across a burst. Creating a share (user, team, claimed invite) or moving a subtree to a new owner bumps it locally and over outer.pubsub.share.ownerShared; the TTL covers a process that misses the bump. A failed lookup reads as shared, so the full lookup decides. * perf(share): batch the per-row reads behind share listings Share listings looked things up one row at a time: - teams by id: TeamStore.getByIdsIncludingDeleted (the single-id read calls it) for listSharedByMe, listSharesOf and #revokeGroupSharesBy - team shares per node and ancestor: ShareStore.listGroupOnFsentries, one query for the chain, in the same node-then-ancestor order - #liveGroupGrants: PermissionStore.queryIssuerGroupPermsByPrefixes reads every issuer/group pair under every prefix in one query - #revokeGroupSharesBy: the five canManagePermission checks per row run together instead of one after another - ShareNotificationService #unblocked: users via getByIds and blocks via UserBlockStore.blockersAmong, two queries instead of two per member - digest flush: entries are taken at bounded concurrency rather than one at a time * perf(events): ask background consent once per holder and app on a revoke settle Withdrawing events:background re-checked consent row by row, resolving the holder's actor and asking the permission service for every one of their background rows. Rows of one holder and app stand on one consent, so it is asked once and shared. * refactor(events): drop the registry's unused push fields notify, defaultDelivery, PushMessage, NotifyProjection and pushProjection were read only by registry.test. Every subject was unpushable and broadcast by default; the subscription's delivery class stays in DeliveryClass, which the stores use. * refactor(share): retire trashed shares through onEntryOwnerChanged onEntryTrashed was a copy of onEntryOwnerChanged: the same subtree share sweep, grant retire and row delete. * fix(fs): page subtree walks by depth, not path MySQL sorts a PAD SPACE string on its first max_sort_length (1024) bytes, so under utf8mb4_unicode_ci paths past about 512 characters tie and fall back to id. A file moved under a newer directory then sorted after it: the delete walk reached the directory first and the parent_id cascade took the file without its object delete or event, and the keyset skipped or repeated rows. Pages now order by segment count, then id, which no collation can reorder. * fix(share): cache an owner as shared when the bump arrives A bump only dropped the cached answer, so the next lookup could read a replica that hadn't applied the new share yet and cache "nothing shared" for another TTL. The bump now records "shared" outright. * fix(fs): probe a directory for children by parent_id, from the primary * fix(fs): keep the copied-size check in the batched directory copy A copied file records the size CopyObject actually duplicated; growth past the source row is charged against the allowance, and a copy that no longer fits is deleted and refused, as a single-file copy already does.	2026-10-11 21:54:13 -07:00
Daniel Salazar	af9ebb0ef1	fix(ai): map BytePlus video and Cloudflare image upstream errors at the driver boundary (#4184)	2026-10-11 21:20:27 -07:00
Daniel Salazar	96909b0800	fix(fs): send the same outer.gui.item.* payload from every fs controller (#4179) ... * fix(fs): send the same outer.gui.item.* payload from every fs controller The v2 /fs/move and /fs/delete routes spread the raw camelCase FSEntry into item.moved / item.removed and named the old path `from_path`, while the desktop reads the legacy snake_case shape and `old_path`. One helper, emitGuiItemEvent, now builds the payload for LegacyFSController, FSController and WebDAVController. v2 and WebDAV copy/move with overwrite now also emit item.removed for the entry they replace, as the legacy routes do, and v2 /fs/move forwards new_metadata to the service like the legacy /move. * fix(fs): announce a replaced entry before the one replacing it The desktop hides rows by path on item.removed, so a removal sent after the overwriting copy's added (or move's moved) hid the new row too. The shared emitter now takes the replaced entry and sends its removal first, awaited, on the v2, legacy and WebDAV copy/move paths.	2026-10-11 21:18:47 -07:00
Daniel Salazar	847a4fc031	fix(fs): route thumbnail writes through FSEntryStore (#4174) ... * fix(fs): route thumbnail writes through FSEntryStore Add FSEntryStore.updateEntryThumbnailByUuid, which sets a thumbnail with no owner check (callers authorize) and refreshes the entry cache, with an optional expected-value guard. The thumbnails extension's inline data: URL migration, its copy duplication, and the legacy /update-fsentry-thumbnail endpoint now write through it instead of raw UPDATEs, so cached entries stop serving the old thumbnail. The migration validates the image like the upload path, awaits the write, and only repoints a row that still holds the data URL; a read that loses that race deletes its upload. * fix(fs): report a thumbnail update by whether the row changed updateEntryThumbnailByUuid returned the refreshed entry, which is null when the cache misses and the replica hasn't seen the row yet. The read-time migration took that null for a lost race and deleted the object the row had just been pointed at. It now returns whether the UPDATE changed a row; the cache refresh still runs after it.	2026-10-11 18:23:58 -07:00
404oops	64db150a90	fix(ai): bound streaming buffers and normalize input errors	2026-10-11 21:14:16 +02:00
Daniel Salazar	0e0cedb02b	fix(auth): no email password recovery for built-in admin accounts (#4153) ... - /send-pass-recovery-email for `admin`/`system` (by username or email) returns the usual generic message, writes no token, sends no mail, and raises a critical alarm with the requester's IP, user agent and, when signed in, their user. - /verify-pass-recovery-token and /set-pass-using-token reject recovery tokens for those accounts as no longer valid.	2026-10-09 18:13:22 -07:00
Neal Shah	43094a84a0	PUT-1901 (#4159)	2026-10-09 20:12:45 -04:00
Juan Fernando Castro	1ff5d93244	fix: a signed overwrite lands on the live key only once its completion is accepted (#4136) ... * fix: a signed overwrite lands on the live key only once its completion is accepted A presigned overwrite URL was signed against the live object key, so the browser's PUT replaced the owner's bytes directly. That PUT never passes through Puter, which leaves the access check on `completeWrite` with nothing left to protect: by the time it runs, what /read serves has already changed. The upload now goes to a key of its own. `completeWrite` is already the authorized step, so that is where the staged object is copied onto the live key, server-side, and the staged one dropped. The entry keeps its uuid, so everything written against it still holds. Aborting deletes the staged object, which the old shared key made unsafe to do. `copyObjectOfAnySize` carries the copy past the single-request ceiling by copying part by part, so a large file is no different. Two behaviours follow from the key no longer being shared: completing an overwrite that uploaded nothing is refused rather than reported as an overwrite of unchanged bytes, and abort always drops the session's object. Only the two presigned paths changed; `prepareBatchWrites` uploads server-side within one authorized request and still writes in place. * fix: the review's findings on the staged overwrite The batch signed path still signed against the live key, so the route the SDK's signed upload actually takes was unchanged. It stages now, which also makes the abort simplification safe: the guard that had protected a shared key was removed while that path still shared one, so aborting a batch overwrite would have deleted the owner's object. The completion is allowed against a path but lands on the uuid captured at start, and a move between the two puts the bytes somewhere the caller was never authorized for. The promote refuses unless the entry is still where the check looked. The batch promote failing left every session pending with its lease held; it now fails them as the rest of the function does. The pending GUI tile and the thumbnail key were keyed on the staged uuid, which no entry ever carries, so neither correlated with what the completion emitted. Responses carry `entryUid` for that. * fix: do not treat a pre-staging session's key as this upload's own A session signed by the previous release points straight at the live key, since `objectKey` was `existingEntry?.uuid ?? uuidv4()`. Completing one is already handled -- the promote returns early when the two keys match -- but abort deleted `objectKey` unconditionally, which during a rolling deploy would take the owner's file rather than the upload's litter. Abort now deletes only a key the upload owns. The multipart branch was always safe: discarding parts never touches an object already in place.	2026-10-09 16:22:36 -04:00
Juan Fernando Castro	86cc3490f7	fix: settle which plan an org seat resolves to, and confirm a seat's address (#4139) ... * fix: settle which default plan an org seat resolves to, and what counts as paid Default subscription resolvers ran in registration order, which is boot order: whichever layer registered first answered first. A seat is provisioned by a team and its address is never confirmed, so the seat resolver now states a priority and wins over anything a deployment infers from an address. The seat cap asked whether the owner's plan was outside the free set, which a default plan can be without anyone having bought it. Metering now reports whether an explicit subscription answered, and the cap rests on that. * fix: the review's findings on plan resolution `fromDefault` was read off which resolver answered, not off which policy applied. An explicit id naming a policy nobody registered falls through to the default one, and that read as bought. It follows the applied policy now. A deployment with unlimited metering has no explicit resolver, so every owner on it became unpaid and its teams dropped from the paid seat cap to the free one. Unlimited answers for what a paid plan would, so it counts as one. Also: the new constants had been placed between `FREE_SUBSCRIPTION_IDS` and its docblock, the register docstring still described first-wins, and prettier had reflowed an untouched licence header. * feat: a seat confirms the address its team typed in An address on a seat is the team's claim about someone else's inbox, and nothing asked the inbox. It is now demanded and sent a code, so the address counts for nothing until the seat hands it back. Resolvers that read a domain are the reason this matters. No address is still fine and demands nothing: the team is the trust anchor for the account, not for a mailbox it does not hold. `/confirm-email` allows an unconfirmed actor, so a seat can sign in with its temporary credential and clear the demand; nothing locks it out. * fix: clear the confirmation demand with the address it names `clearUnconfirmedEmail` releases a seat's address so the inbox's owner can sign up with it. The demand to confirm that address has to go at the same write: the gate reads `requires_email_confirmation && !email_confirmed`, and once the address is gone there is nothing left to send a code to. * fix: keep a seat's address correctable, and only ask what can be answered Review of the confirmation demand turned up two ways a seat could be left holding one it had no way to meet: - With no mail transport configured, the code is never sent and a resend cannot reach the seat either, so the demand stood with nothing able to lift it. The seat is now gated only when a code can actually travel. - An address the owner mistyped gated the seat on an inbox nobody could read, and the gate itself closes `/user-protected/change-email`, the route the seat would have fixed it by. `updateSeatEmail` lets the owner who typed the address retarget it, and refuses once it is confirmed, when it belongs to whoever proved it. Also resolves the owner's plan sequentially, so the second read takes the cache the first wrote and the pair cannot come from two resolutions, and restores the licence header a jsdoc reflow had rewrapped. * fix: let the confirm-email window open before the profile has loaded Booted from a stored token, the window renders before `window.user` is populated, and reading `.email` off null threw inside the window itself -- so the one screen that could have asked for the code never drew, leaving a blank page. Reproducible without a team: sign up, then load the GUI again before confirming. The address is now encoded rather than interpolated raw, and both forms of the line are i18n keys; it was hardcoded English before.	2026-10-09 16:17:51 -04:00
Juan Fernando Castro	7de8360a6e	Sharing cleanup: bounded outbound listings, and what see does not reach (#4118) ... * fix: keep a file name to one line in a subject, and the inbound total to the account **A name reaches the digest subject as the user typed it.** Subjects compile with `noEscape` on purpose -- a header is not HTML, and escaping would show entities to the reader -- and the comment there says free-form values collapse whitespace upstream. A file name does not: `#assertUsableName` refuses only an empty name, a slash, `.` and `..`, so a name may carry newlines. It is collapsed to one line and bounded before it goes in. **`includeTotal` answered an app with the account's figure.** The page is filtered by what the caller can reach -- an app sees only what its user handed it -- while `countByHolder` counts every inbound share. The docs already call `total` an approximation for the filtering; they did not cover an app reading the size of everything else. It is answered only for a caller acting as the account now, and the page documents that. The team-share fixture built its actor as `{ user }` with no `effectiveApp`, which reads as an app rather than a session. A session acts as the account, so it says so. * fix: stop `see` reaching inside a folder, and bound mode changes **A `see`-only folder recipient was pushed every child's name, size and type.** The fan-out picked holders by reach -- any live grant on a reaching root -- and `see` is a grant. But `see` says a node is there; `list` is what says what is inside it, and the payload carries exactly what `list` would: name, path, `is_dir`, type, size, modified. Descendants now go only to a holder whose mode reaches inside. A change to the shared node itself still goes to everyone who holds it, which is what `see` covers. **Mode changes skipped the daily quota entirely.** Not spending share budget is right -- changing a mode is not new reach, and the existing test says so -- but unbounded it lets one account write a pair as fast as it can ask. They have their own budget now, ten times the share limit by default and configurable, so the exemption stays an exemption from *that* budget rather than from any. * fix: let a half-finished downgrade be finished, and stop Trash answering **A mode downgrade that failed between its two halves could not be repaired.** `setUserUser` grants the new mode and then revokes the superseded ones. If the revokes did not all land, the higher grant stood -- and the retry returned early, because the mode it was asked for was now present. "Nothing to do" now means this mode is the only one standing, so asking again is what finishes it. The same two halves, and the same early return, were in the group variant. **Trashing someone else's item answered for what is in their Trash.** Moving into the owner's Trash is deliberately authorized without write on it -- that is what lets a recipient delete from a shared folder -- but a name collision there came back as `An entry already exists at /owner/Trash/<name>`. The mover picks the name, so that is a question they can ask about a folder they cannot list. It dedupes instead, which is also what the GUI wants: trashing should not fail over a name. * perf: record the entry's owner on the share row The outbound listings answer "shares on things I own that someone else issued" by joining `share` to `fsentries` and filtering on the owner there. Neither side of that join bounds the work: driven from `fsentries` it walks every file the user owns, driven from `share` it walks every share until it has a page. For a user who owns a lot and delegates nothing, that is the whole table for an empty result. `#outboundAppsSql` is worse than the ticket says -- it has no LIMIT at all, so every call aggregates the join across both tables. The owner now rides on the row, indexed with `id`, so all three read it directly. An entry cannot change owner -- a move out of the owner's tree is refused -- so it is written once, with the row. Set in SQL from `fsentry_id` rather than threaded through callers: four insert sites, each of which already has the id, and none of which can now forget. The risk in denormalising is a write path that does: a row with no owner recorded is a share that silently stops appearing in its owner's listing. The new test covers exactly that -- it fails when one insert is made to write NULL. Verified against a real boot: a pre-existing share row, on a database that genuinely predates the column, comes out with the owner its entry has. * fix: the review's findings on this branch **The Trash collision still had both halves open.** `overwrite` was checked before the trash case, so a caller setting it -- it is wire-supplied -- could still delete whatever it collided with in the owner's Trash, and the 409 survived for anyone who did not. The trash case is decided first now. Dedupe alone did not close it either: a name that changes only when there is a collision answers the same question the refusal did, and the mover sees that name even though the path is masked. Trashing someone else's item renames it every time, so the result carries no signal. `original_name` already records the real name, which is what a restore reads. Two tests pinned the old name; they say what it is now. **The owner column had no fallback.** Reads went only through it, so a row written by anything that predates it -- a pod mid-roll -- would never appear in its owner's listing again. The three reads now also cover `IS NULL` rows through the old join, indexed on the null and empty once none remain. **The grant became conditional on a replica read.** `if (!already)` skipped it on a stale row while the revokes below stayed unconditional, which could leave the holder with nothing where the old early return left their access alone. It grants unconditionally again; only the early return changed. **The re-issue budget covered one path of four.** Team, link and invite re-issues reserved nothing, so three ways round it were left open. They share one `#reserveRemodeQuota` now. Two docblocks had been pushed off the functions they describe, and two comments still described the join that is gone. * chore: one-line the comments added here * test: measure the prefix walk by what it keys on, not by the clock `checks many long paths without re-reading every prefix of each` gave the walk 1500ms of wall clock. It measured nothing useful: the shape it guards against — keying each step on the accumulated prefix text rather than on the parent id — costs 29ms against the current 8ms on that input, so both ends sit far under the bound. Under coverage the same test ran 1511ms and failed, which is the only thing the number could ever report on. `PathPrefixIds` now counts the characters it keys on, and the walk is asserted on that: proportional to the input, and twice the depth costs twice as much rather than four times. Keying on the accumulated text fails both. The original case keeps its real assertion, that a request this size is refused. * fix: keep the recorded entry owner current, and the trash guard on the retry A move into someone else's tree re-owns the whole subtree, which the migration comment claimed could not happen. The shares on it are re-pointed at the new owner, or they drop out of the listing the column keys and stay in the old owner's. The unique-violation retry re-entered the collision resolver without the trash flag, which is the one call site the guard was not threaded through.	2026-10-09 16:14:23 -04:00
Daniel Salazar	8a6929847d	Auth limits, reborn-app tokens, seat addresses, drop-area encode (#4148) ... * auth: per-account 2FA code limit, single-use otp-login tokens, recovery mail limits - /login/otp and /login/recovery-code share a per-account bucket charged on wrong codes; an otp-login token completes one sign-in. - /send-pass-recovery-email adds an IP bucket, a per-account cap and captcha, and reuses the outstanding recovery token instead of rotating it. - Reauth tokens carry the rejection reason; /signup re-attaches a temp account only from an expired session. * auth: app-issued access tokens older than their app stop authenticating An access token whose row or parent session predates the app now holding its uid is refused, the same check app and worker sessions already get. * teams: signup can take an address a seat never confirmed Password signup, save-account and a provider-verified OIDC sign-up take an address a team seat holds unconfirmed; the seat's copy is cleared at the write. A seat address that was confirmed still blocks. * dev-center: encode dropped directory child names	2026-10-09 00:12:59 -07:00
Daniel Salazar	360f6b1079	fix(events): bill reached deliveries, bound dispatch reads, seal cursors (PUT-1900) (#4146) ... * fix(events): bill reached deliveries only, bound dispatch reads, seal cursors - A broadcast socket copy is billed only when a connection for its holder exists on this node, anywhere in this region (connection count) or, for a durable row, in a region presence names. Without peers it bills as before. - Compiled match filters are held in a bounded LRU with a TTL, and dropped when another process reports a subscription ended. - GET /events/fetch reads the continuation from `cursor`, falling back to `after`. - Cursors from /events/fetch, /events/subscriptions and /events/kv-handles are encrypted with sealCursor/openCursor; plain cursors still read. - A durable subscribe counts again after its insert and removes its own row when over the cap; the generation bump for that removal is published. - Subscribe checks access before reading the anchor's owner, and an anchor gone in between answers with the subject the caller sent. - Dispatch reads at most the rows per token routing can use, scanning large token hashes; a removal still settles every row on the removed anchor. - puter.events.unsubscribe() stops routing after the server ends the subscription or reports it gone; fetch() accepts `cursor`. * fix(events): forward kv values only to regions with rows that ask - A region counts its session rows asking for kv values per token and announces the token's value variant (`v#<token>`) over the existing `watch` item on the first such row, withdrawing it with the last. Add, remove, reap, reanchor and refresh all keep it, reading `includeValue` off the row as it is dropped. - A kv write reads the value variants alongside the watch index and attaches the value only to forwards bound for a region that announced one. * fix(pagination): seal id-keyed cursors on every list endpoint Apps, subdomains, workers, team (members, directory, teams, audit, own audit), shares (inbound, outbound), the user-to-user permission audit and readdir/descendant listings now hand out cursors sealed with sealCursor and read them with openCursor, so a cursor no longer carries a row id. Plain cursors issued before still read. * test(events): pass socket ids to noteConnect in the billing tests	2026-10-09 00:08:13 -07:00
Daniel Salazar	dcfb1263de	fix(events): single-writer presence items, live-socket counts and region-wide leave grace (PUT-1759) (#4142) ... * fix(events): keep each region's presence item written only by that region - A region that receives a forward for a pair it holds no socket for retires its own presence item through the pin-ordered leave path, gated by a region-shared claim. The sender no longer retires another region's item, and the forward reply no longer carries noSocket. - Presence reads skip items for regions outside the peer list instead of retiring them. - removeConnection decrements and deletes the count in one script. - A failed join releases the join pin, and any connect that finds the pin free writes the join. - A single delivery treats a socket on any node of the region as local, using the region-wide connection count, and picks the next remote candidate by the regions already tried instead of by index. - Correct the connection-count TTL comment. * fix(events): count presence by live socket and honor the leave window region-wide - A region's presence for a pair is a sorted set of socket ids scored by last renewal under a new key, replacing the integer count. A socket counts while renewed within the concurrency-slot window; add, renew and remove each prune lapsed members and report the live count in one script, so a node that dies stops holding the pair. - The last socket going marks the pair as leaving region-wide for the grace window, in the same script; a connect clears it. A forward that lands on another node inside the window does not retire the item. - Add the events.presence.write counter, labelled by op (join, leave, refresh, retire).	2026-10-08 23:55:55 -07:00
Juan Fernando Castro	c55437245b	fix: settle the url file-access gate from a grant held on a folder above (#4132) ... * fix: settle the url file-access gate from a grant held on a folder above The gate asks `/auth/check-permissions` with `app_uid`, which resolved through the permission scan. `fs:` access inherits down a tree and only ACL walks that, so a grant on a folder never answered for a file inside it and the gate asked again, writing another per-file row on each Allow. The `app_uid` branch now routes `fs:<uid>:<mode>` through `ACLService.check` as the app-under-user actor, which is the same authority the operation itself will face. Everything else keeps the scan, including `puter.perms.holds`, which sends no `app_uid`. * fix: the review's findings on the consent gate A permission that is not a string reached `startsWith` and faulted the whole request, where it used to answer false inside the catch; both parsers now refuse a non-string, which also covers the other callers that read a request's list. The path spelling of a permission took the scan while the uid spelling took ACL, so one file could answer two ways. Both spellings resolve to their entry and take the same route. The checks run together rather than one after another: the caller gives up after five seconds and prompts, and a deep path is several reads.	2026-10-08 15:05:01 -04:00
Juan Fernando Castro	d1d55a6bc3	SDK auth plumbing: cache scope, dedupe keys and the token listener (#4112) ... * fix: pin the token sender, scope the grant flag, and stop two stragglers Five of the SDK auth-plumbing items. **The global `puter.token` handler pinned origin but not source.** Its three siblings all pin both, and each says why: the GUI origin is shared by every frame on that domain, so origin alone identifies a domain, not a sender. `signIn` pins its popup and binds `msg_id`, the consent dialog pins its popup, and the reauth wait pins the embedder. This one pinned the embedder only when `env === 'app'`. Since `authenticateWithPuter` now hands off to `signIn`, which adopts the token itself, the embedder is the only sender this handler is left serving, so it pins in every environment. **`is_grant_user_app_permission` was a request-wide flag held across an await.** It tells the `app-root-dir` rewriter that a row is being written, and while it is set that rewriter resolves to a real `fs:` permission instead of `PERMISSION_FOR_NOTHING_IN_PARTICULAR`. Anything evaluating an `app-root-dir:` permission beside the grant -- the grant route runs one under `Promise.all` with fs work -- read the same flag. It now lives in a scope derived for that call, so what the write needs to say about itself is not also said to its neighbours. `runInDerivedContext` is new: `runWithContext` starts an empty store, which would drop the `actor` the rewriter reads. **`fs.stat` and `fs.readdir` deduped on parameters alone**, so two identities in one realm could share a result. They now key on origin and token as `os/user.js` does, which documents the reason. **`signIn`'s relay poll never stopped.** Closing the popup settles the promise; the loop kept asking `/login/wait` every second for the life of the page. **`triggerReauth`'s five-minute timeout was never cleared**, so a successful reauth left a timer to fire into a settled promise. The concurrency test parks the rewrite and reads the flag while it is held -- my first attempt read before the flag was even set and passed either way. * fix: scope the fs cache per identity, and retarget two paths that never ran The remaining SDK auth-plumbing items. **`puter._cache` outlived the identity that filled it.** `_clearAuthToken` dropped the token and the stored session but left the cache and `whoami` as they were, and its keys were raw paths -- `item:/alice/Documents` and a `~`-relative key alike, identical whoever asked. A GUI user switch without a reload could be served the previous user's stat or readdir. Keys now carry the origin and token they were read as, built in one place so the writers, the readers, the invalidations and the warm-up probes cannot drift apart, and signing out drops the cache and `whoami` with the token. **The driver permission prompt could not fire.** Both paths waited for a 200 carrying `{success:false, error:{code:'permission_denied'}}`. The driver route answers `success: true` or throws, so a refusal arrives as a 403 -- the shape the retry now reads. Its two tests synthesised the old envelope, so they passed against a response the API does not send; they use the real one now, and the prompt goes from never called to called once. This is a behaviour change: a driver call refused for permissions will now prompt, which is what the path was written to do. Happy to delete it instead if the prompt is not wanted. The half-written copy of the same idea in `utils.js` is gone -- it prompted for one hard-coded interface and its retry was a `// todo`. **The verification-gate single-flight was keyed on nothing**, so a phone-gated request in flight beside an email-gated one took the email answer, replayed, failed again and surfaced raw without ever asking. Keyed per gate: same gate still shares one dialog, a different gate gets its own. * test: ask the cache the same way the code does The API suites built `item:<path>` keys by hand, so they stopped finding anything once the real keys carried the identity they were read as. They go through `fsCacheKey` now, which is the point: a test that spells the key itself passes until the moment the spelling changes, and then fails for a reason that has nothing to do with the behaviour it is guarding. These run against a live server, so a plain `vitest run` does not reach them -- they were green locally and red in CI. * fix: the review's findings on this branch Eight, and three of them were regressions this branch introduced. **Pinning the token sender to `globalThis.parent` in every environment broke the case it was meant to protect.** On a top-level page `parent` is the page itself, and the token arrives from a popup, so the handler stopped accepting anything. The GUI posts `puter.token` to `window.opener` for the file pickers too, not only for sign-in, and this handler is their only consumer -- a site calling `showOpenFilePicker()` would have signed the user in, dropped the token and run the following read with none. It now pins the embedder when framed and a window this SDK opened when not; `UI.js` already tracked its picker popups for the same reason, so that set is shared rather than duplicated. **The GUI still spelled a cache key by hand.** `updateSubdomainsForItems` built `item:<path>`, which no longer matches what the SDK writes, so its `get` could not hit and its `set` wrote an orphan nothing reads and nothing evicts -- a published website's badge quietly stopped appearing on a cached render. It goes through `fsCacheKey` now, and that is the last hand-spelled key in the tree. **Retargeting the driver permission prompt to 403 was wrong and is reverted to the deletion the ticket asked for.** The route refuses with `forbidden`, not `permission_denied`, so the retarget still missed it; meanwhile a driver that raises `permission_denied` for its own reasons would have opened a prompt that had nothing to do with the refusal. And the prompt asks for `driver:<iface>:<method>` while the route checks `service:<driver>:ii:<iface>`, so granting it changes nothing. The path cannot work as written. The rest were pre-existing or latent: `cacheWhoami_` wrote its answer without checking the token it was issued under was still current, so a reauth landing mid-flight could repopulate `whoami` with the previous identity. `_dropIdentityCaches` also left `whoamiCache_`, which other call sites await. `setAuthToken` now drops the identity caches when the token actually changes: keys carry the token and the store is persisted with no TTL, so a rotation that did not go through `_clearAuthToken` orphaned a whole key space with nothing to reclaim it. The verification-gate entry was registered after the body could already have deleted it -- a synchronous throw stranded a resolved "not verified" in the map for the life of the page. It registers first and clears on a microtask. `signIn`'s poll is bounded as well as settle-checked: on a cross-origin isolated page opened from a gesture, nothing watches the popup, so closing it never settled the promise and the loop ran on exactly as before. `runInDerivedContext` says in its docblock that callee writes do not survive; only the one flag needs the scope, and a future caller should not expect to hand a value back through it. * fix: the review's findings on the SDK auth plumbing **The relay bound stopped asking without saying so.** The deadline left the `signIn` promise pending and its listener attached. On an isolated page opened from a gesture the relay is the only thing that can settle it -- nothing watches the popup there -- so a user who took longer than the deadline was left with a promise that never resolved, and `authenticateWithPuter` queues every later implicit-auth call behind it. It rejects now. **Pinning the token source left `signIn`'s own popup untracked.** Only the picker popups registered, so on a top-level page the global handler bailed on a sign-in it had opened itself: `puter.onAuth` never fired, and `puterAuthState.authGranted` was never set. `openAuthPopup` is the one place auth popups are opened, so they register there. **A closed popup is ours too.** Rejecting one that had already closed loses a message from a popup that posts and then closes itself, which is why `UI.js` tolerates the same case. Kept, with the set bounded instead. **The gate key carried the factors**, so one route naming them and another not opened two dialogs for the same gate. It keys on the gate, as `ctx.done` does. **`fsCacheKey` left `~` unresolved**, so a writer and an invalidation spelling the same place differently missed each other -- the drift the one key builder was meant to end. The dead `opts.permission` went with the path that used to read it. Four workerd-runner failures are left: `ai > chat stream adapter supports cancellation`, `kv > a GUI boot key written by another client reads fresh` and two cache-warmer ones. All four fail the same way on `origin/main`, and the node and browser runners pass. * chore: one-line the comments added here * chore: reflow the comments the removed retry cause left ragged	2026-10-08 15:04:49 -04:00
Filip Kujundžić	b6150d63f3	Merge pull request #4090 from HeyPuter/fix/ai-stream-cancellation ... fix(ai): propagate cancellation and stream termination failures	2026-10-08 13:33:50 +02:00
Daniel Salazar	f234bd477c	fix(auth): answer a username lost to a concurrent write with the taken-name 400 (#4115) ... The duplicate-username check in the signup placeholder claim, change-username and save-account runs before the user-row write, so a concurrent write can take the name in between and the unique index rejects ours. Each path now re-reads the holder from the primary on a unique violation and returns the 400 its pre-check returns for a taken name, instead of a 500. In all three, the home-directory rename, rename budget charge and username-changed event run after the user-row write, so nothing has happened yet when it fails.	2026-10-07 22:34:31 -07:00
Daniel Salazar	2e275a8f6b	fix: godmode installation (#4116) ... * fix: godmode installation * fix: godmode classifier * fix: vitest	2026-10-07 13:16:10 -07:00
Daniel Salazar	f674e51b4d	fix: answer lost write races with 4xx, and time health-check timeouts against loop stalls (#4107) ... - signup: a username taken by a concurrent signup between the duplicate check and the insert now returns the pre-check's 400 instead of surfacing the unique-key error as a 500. The holder is read from the primary. - fs move: when the UPDATE trips the (parent_id, name) unique key after the collision probe missed the occupant, re-read it from the primary and resolve it the same way the probe would have (overwrite, dedupe, or the 409 item_with_same_name_exists), then retry the move once. - server health: a check that hits the per-check timeout reports how long the event loop was blocked during it, like the database-liveness latency failure already does.	2026-10-07 12:02:05 -07:00
Juan Castro	6efb96d560	Merge branch 'juancastro/flat-permission-view-scope' into juancastro/permissions-access-control-cleanup	2026-10-07 09:00:40 -04:00
Daniel Salazar	11e48c68a9	fix: verification for sms (#4101)	2026-10-06 22:03:07 -07:00
Daniel Salazar	464f758a97	fix: verification for sms (#4100)	2026-10-06 22:00:14 -07:00
Daniel Salazar	6bce256589	refactor(ai): trim redundant cancellation checks ... - Chat driver runs each attempt through one helper and checks the abort signal only on entry and in the attempt catch blocks, where it keeps a cancelled request from marking the route unhealthy. - A stream ended after cancellation still emits ai.prompt.cost-calculated; only ai.prompt.complete is skipped. - pipeNdjsonStream owns its line buffer and onEnd is optional; drop the errored guards that can no longer fire. - Drop the Claude post-loop abort check (finalMessage already throws). - Skip provider error logs when the caller cancelled. - Simplify the usage_limited cap condition.	2026-10-06 19:49:25 -07:00
Daniel Salazar	d2cdde5147	fix: verification for sms (#4098)	2026-10-06 19:36:18 -07:00
Juan Castro	ad1be70d06	Merge branch 'juancastro/flat-permission-view-scope' into juancastro/permissions-access-control-cleanup	2026-10-06 19:44:37 -04:00
Juan Castro	738a8058ef	fix: close the path oracle where it actually was ... Local testing against a running instance found the service-side fix was not enough. Both answers were 403, but they did not read the same: exists -> permission_denied: fs:/other/rd:read missing -> Cannot create outside your home directory (forbidden) The second comes from `#planFsPathCreate` in the controller, which probes the path itself and only calls the create guard once it knows the path is absent. Its comment said so outright -- checked "only once the path is confirmed missing, so an existing shared path outside the caller's home is not a new rejection" -- which is the oracle stated as an intention. A foreign path now refuses word for word whichever it is. Responses are byte-identical apart from the caller's own input. `rewritePermissionForActor` collapses the create guard's `forbidden` the same way it already collapsed the 404, for the paths that reach it through the service rather than the controller. The existing test pinned `forbidden` here; its subject is that nothing is created in someone else's tree, which still holds. Alongside it is the invariant itself: refuse a present and an absent foreign path, mask the path, compare the whole error. Without the controller check that fails.	2026-10-06 19:41:55 -04:00
Juan Fernando Castro	0e2f9663b2	Merge pull request #4091 from HeyPuter/juancastro/teams-cleanup ... Teams cleanup: pagination, resumable delete, and credentials that stop leaving by mail	2026-10-06 19:27:09 -04:00
Juan Castro	b8fcbffe3f	fix: the five remaining review findings ... **The path oracle was not closed.** The rewrite only remapped the *error*, so success-vs-403 still answered whether a foreign path exists. Narrower than reported: every other grant path already gates on `canManagePermission`, and only `grantUserAppPermission` has no authority check -- deliberately, since granting your own app something you don't hold is inert. It now refuses a foreign path the actor cannot see, with the same error a missing one gives. My first test for this passed without the fix: `makeUserActor` creates no fsentries, so both paths 404'd and nothing distinguished them. It inserts a real entry now, and the control fails with "expected null to match 403" -- null being the grant that succeeded, which is the oracle. **`#validateEmail` still failed open** on the main signup / change-email / confirm path while its OIDC twin was hardened. Same shape as OIDC now: a gate that did not run is not a pass. **The 16-permission cap broke `puter.perms.check()`** for longer lists. The SDK's own docblock promised "one round trip however many are asked about", which the cap made untrue, so it batches instead. The reported second half -- the UI grant poller burning its timeout -- is not reachable: `MAX_REQUESTED_PERMISSIONS` already caps that path at the same 16. **`listener_failed` was set by wildcard listeners.** An unrelated observer on `email.*` throwing would refuse every signup. Only an exact-key listener implements the event, so only that one speaks for the gate. **`whoami()` labelled everything `Unauthorized`.** A 502 with an HTML body is not a 401; the server's `code` now rides along and the fallback names the status.	2026-10-06 19:23:40 -04:00
Juan Castro	755b58fd49	fix: don't hand the owner's subtree size to a see-only caller ... Switching `getSubtreeSize` to `entry.userId` fixed a recipient reading 0 for a shared folder, but `/stat` is gated on `see` and `return_size` is caller- supplied. `see` is the weakest level -- the folder is visible, what is under it is not -- so the sum now covered entries the caller had no way to enumerate. It is answered only for a caller who passes a `list` check, which is where the contents become enumerable anyway. Everyone below that gets the directory row's own size, which is what they got before this branch. `#assertAccess` grew a non-throwing sibling for this; the descriptor both need moves into `#aclDescriptor`. Test grants `see`, asserts 0, grants `list`, asserts the real size. Without the gate the `see` case reads the file's bytes.	2026-10-06 19:08:46 -04:00
Juan Castro	66774ff90c	Merge branch 'main' into juancastro/permissions-access-control-cleanup	2026-10-06 18:12:39 -04:00
Juan Castro	0495ea0f9d	fix: close the holes the review found in the storage gate ... Four, all real. The gate threw on a non-string. `validator.isEmail` asserts its argument, and two call sites hand it an unvalidated body value -- `send-pass-recovery-email` is public, so `{"email": 1}` was a 500 rather than a 400. The check belongs in the gate, not in each caller, which is the whole premise of having one. OIDC signup never shape-checked the claim at all. `claims.email` went from a truthiness check straight into `user.create`, so a provider we do not run could store exactly the string this branch exists to keep out. `email_verified` attests the mailbox, not the characters. The change-email confirm handler promoted the staged column without re-reading it through anything. A row staged before this deploys still lands on `email`; one check at promotion closes that window. The invite path kept its own regex, and it was never the same rule. It admitted `a..b@x.com`, `.a@x.com`, `a@-x.com`, `a;b@x.com` and `a,b@x.com` -- the last of which nodemailer reads as two recipients -- each one a permanent pending row that spent daily quota, which is the failure the comment above the constant said it existed to prevent. It uses the gate now, and the second regex is gone. A regression test each, all four confirmed to fail without their fix.	2026-10-06 17:20:35 -04:00
Juan Castro	73698be964	fix: one gate for an address we are about to store ... `validator.isEmail` accepts a quoted local part, so an address whose local part is an arbitrary string passes it. Five call sites relied on that check alone before writing the address to `user.email`, and the invite path's own shape regex was equally permissive. `isStorableEmail` is now the single gate: the library check, plus a refusal of `<`, `>` and `"`, which are legal in an address only inside the quoted form. Nothing deliverable uses that form, so the rule costs no real address -- apostrophes and ampersands in a local part still pass, and the suite covers them. One function rather than a check each caller has to remember, because the next place that stores an address will not remember.	2026-10-06 16:47:15 -04:00
Juan Castro	25f132b28d	fix: address code review on the teams cleanup ... Six findings, all real. `total` described rows the page withheld. The count ran over every live team the user belongs to, while the app-actor filter ran afterwards on the items only, so `GET /teams?includeTotal=true` from an app returned `items: []` with a non-zero `total` -- the exact thing the filter exists to prevent, and newly reachable because `includeTotal` was inert before this branch. The directory-open restriction moves into the query, so items, cursor and total all describe the same set. The GUI told owners the opposite of what the server now does: "we email the username and temporary password to it." An owner who believed it would dismiss the one copy of the password and strand the seat. Rewritten. `runWithConcurrencyLimit` rejects on the first error but cannot cancel the workers beside it, so a failed seat let up to seven others finish suspending and emailing "your team has been closed" for a team that was still live. The page now settles before the rejection is rethrown, which leaves a state the retry can resume from instead of an arbitrary one. My earlier claim that failure semantics were unchanged was wrong. `#disableSeatForDelete` returned `true` on both paths, so the boolean read as if it distinguished them. It returns nothing; the counter uses the settled results. `listTeamsForUser` had picked up a second stacked docblock -- the same defect this branch removes from `#cached` one file over. `reissueCredential` sent the provisioning mail, which after the credential change was a byte-identical duplicate saying nothing about the password it had just invalidated, while the GUI promises the member hears about it. It has its own template now. Regression tests for the count leak and the reissue notice; both confirmed to fail without their fix.	2026-10-06 16:22:48 -04:00
Juan Castro	36a22b05a2	docs: stop claiming the directory discloses what /members does ... Both docblocks on the directory route said it carries nothing a colleague cannot already read through `/members`. It carries `uuid`, and `/members` withholds `uuid` from everyone but the owner, with its own comment pointing apps at the directory to get one. The disclosure itself is the opt-in working as designed: `directory_enabled` is the owner's consent to expose a roster, every member reaches the route the same way whether they call it from a session or through an app, and the SDK and the teams recipes already document the directory as where a stable id comes from. So the comments are what was wrong, not the route. Removing `uuid` from the directory would be the other way to make them agree, but it breaks `listDirectory()` for every caller and contradicts the published recipes; that wants a decision, not a cleanup commit.	2026-10-06 16:02:13 -04:00
Juan Castro	f3b05ca822	fix: page GET /teams like every other team listing ... `listTeamsForUser` returned every row and the controller never read `req.query`, so `limit`, `cursor` and `includeTotal` were accepted and ignored on the one team route that did not paginate. The docs promise a capped page there, and every sibling listing already honours it. Keyset-paginated on `id` per doc/pagination.md, with the envelope the other routes return. The app-actor directory filter still runs over the page, so an app sees the same teams it saw before, just a page at a time.	2026-10-06 15:55:22 -04:00
404oops	96f0c51d1e	fix(ai): propagate cancellation and stream termination failures	2026-10-06 20:24:19 +02:00