69 Commits

Include renames

Author	SHA1	Message	Date
Daniel Salazar	e5fd30ccf0	fix(ai): validate large base64 by decoded length, not regexps (#4265) ... * fix(ai): validate large base64 without anchored regexp loops Gemini TTS replies over ~4 MB of base64 (~65 s of audio) failed with "Maximum call stack size exceeded". Once a process holds enough compiled code, V8 compiles new regexps unoptimized, and `^[...]+={0,2}$` then pushes a backtrack entry per character until its stack overflows. TTS now searches for a character outside the alphabet instead. The raw base64 icon/reference-image check drops its own anchored regexp; decodeStrictBase64 already rejects the same inputs. * perf(ai): validate base64 by decoded length instead of regexp passes Unoptimized regexp scans dominated large payloads: 186 ms for max-length TTS audio, 880 ms in decodeStrictBase64 for 30 MB of video. Buffer.from skips characters outside the alphabet, so comparing the decoded length with the one the input length predicts catches them for free. decodeStrictBase64 now does that plus rejecting the URL-safe alphabet (~10 ms for 30 MB), and TTS reuses it instead of its own check. Non-canonical trailing bits now decode instead of being rejected. * fix(ai): reject non-ASCII base64 that Node decodes by its low byte Node reads code units above 0xFF by their low byte, so U+012B decodes as '+' and keeps the decoded length the input predicts. Require ASCII (~1-2 ms for 43M chars) before the length check.	2026-10-18 21:56:29 -07:00
Daniel Salazar	9ff224e22f	perf(backend): cut sequential round trips on auth, fs, driver, event and site paths (#4259) ... Pipeline - CORS preflights send Access-Control-Max-Age: browsers stop re-preflighting authed calls every 5 s. - `req.ua` is parsed on first read instead of on every request. - JSON `rawBody` reuses the parsed buffer instead of copying it. - `emitAndWait` returns early when nothing listens: no span or closure per unlistened driver call. - SQLBatcher sends a lone query on the next tick while fewer than 8 flushes are in flight, and waits `maxTimeInQueue` as before otherwise. Lone reads skip the 10/30 ms wait; batching under load is unchanged. Auth and permissions - Token-to-actor auth starts the user, session and app lookups together and checks them in the same order: fewer sequential Redis round trips per authed request. - get-user-app-token and check-app reuse the resolved app row. getOrCreateApp skips the re-select after its own insert and doesn't wait on the cache write for replica rows. - getOrCreateApp reads the race winner from the primary when its insert loses, so it no longer hands out a session that was never written. - whoami runs the email check and the OIDC/taskbar/team lookups in parallel; key order unchanged. - OIDC providers are memoized once every discovery succeeds, with one discovery fetch in flight per URL, and the Apple key is parsed once. - gui-token and sync-cookie use `req.actor.user` instead of re-reading the user. - listSessions batches app lookups. App icon probes run together, and the original-icon probe skips the lineage fallback. - Default-granted permissions are answered from config before the scan cache, and exploded options are deduped: one less Redis read per /drivers/call. - ACL resolves ancestors lazily (owners and full-access tokens skip them) and scans the node first, then the ancestors concurrently on a miss. Filesystem - Missing-path lineage lookups run 10 at a time: batch-upload path resolution drops from about 1.3 s to about 40 ms per 100 new files. - MySQL single-file inserts return the row built from the written values, falling back to the primary read: one less primary round trip per new file. - Batch thumbnails are stored with one UPDATE per chunk (200 rows or 4M chars), with a per-row fallback. - storage.quota.bonus listeners run concurrently next to the usage SUM, and the payload carries `userUuid`: quota checks and /df no longer serialize the listener reads. - readdir cache backfill is one pipeline instead of 3xN SETEX. - Profile reads skip the lineage fallback; the own profile is read alongside the user lookup. - Legacy /stat runs is_empty (new `hasChildrenByParentUid`), owner and thumbnail concurrently. - Downloads and the video proxy pipe through `pipeToResponse`: aborts release the storage stream at once with no extra 'close' listeners, and the video proxy no longer crashes on a mid-stream upstream error. - mkdir looks up target and parent together. - Upload completion reuses the session from the access check (status is still re-read before completing), and multipart signing reads it once. - Moving a shared file to Trash skips two lookups that always returned the entry itself. Drivers and events - Subscription resolvers run concurrently and are folded in registration order. - SubdomainDriver and WorkerDriver overlap independent lookups. - The events "anyone subscribed?" check is one Redis pipeline when the region is warm. - Handler publish overlaps the count with the size check. - Broadcast flushes peers concurrently over a keep-alive agent, so a slow peer no longer delays cross-region invalidations to the others. Sites, share and AI - Hosted sites resolve the owner first, then the app and root together. Site config loads only on 404s. The hosted-app query selects only the columns it uses and moves into AppStore. - shareFlags asks about the plan only when an item is shared by link only. - Share listings run the count, teams and plan reads alongside their page query. - Claude attachment cleanup no longer blocks the response. - New util `awaitLater` for promises started early and awaited later.	2026-10-17 12:03:35 -07:00
Daniel Salazar	ff815f730d	fix: harden token delivery, session revokes, app identity and fs scoping (#4229) ... - relay sign-in popups take the opener origin from the referrer only - session revokes read the primary, batch per user, and tombstone caches in every region - wisp relay tokens bound to the minting session; verify rechecks the account - hosted origins keep app identity with the site owner; deleted app uids recorded in deleted_apps - subdomain cache tombstoned on delete, update, reclaim and app/account cascades - email lookups require an exact address match after the SQL lookup - workers deploy only from files the deployer owns - share_app_data:false enforced at ACL time, plus copy/move/rename/share/recursive listing - kv remove returns no value without read; kv:expire op grant usable - fs errors name the entry instead of the owner's path - shared-by-me drops rows a delegate no longer has authority over - private apps can't move index_url onto another user's origin - GUI: default apps saved and launched by uid; save picker accepts only copy/move; permission dialog waits for focus; Publish as Worker hidden on others' files	2026-10-14 06:56:44 -07:00
404oops	f9cde23937	Merge branch 'filipkujundzic/put-1954-elevenlabs-tts-passes-voice-names-through-as-voice-ids-so' into filipkujundzic/put-1907-ai-streaming-buffering-and-error-shape-cleanup ... # Conflicts: # src/backend/drivers/ai-chat/utils/inlineImages.test.ts # src/backend/drivers/ai-chat/utils/inlineImages.ts # src/backend/drivers/util/fileInput.ts	2026-10-12 12:39:35 +02:00
Daniel Salazar	b88aa55b24	fix: drop moved descendants from the entry cache; read cursor=null as the first page (#4204) ... Renaming or moving a directory rewrote its descendants' paths but left their cached copies (by id, uuid and old path) live for up to 60 s. A lookup of an old path kept resolving, and a write beneath one landed at a path its parent no longer had. updatePathPrefixForUser and renameUserHome now drop those keys, here and, within the broadcast budget, in peer regions. puter.js sent `cursor=null` for `listShared`/`listSharedByMe({ cursor: null })`, which decoded to null and failed every keyset listing with a 500. decodeCursor reads it as no cursor, and the SDK no longer sends it.	2026-10-12 00:19:11 -07:00
Daniel Salazar	590c87c00a	refactor(stores): one row cache and keyset page helper, batched cache round trips, dead store methods removed (#4191) ... * refactor(stores): one read-through RowCache for UserStore and AppStore UserStore and AppStore each carried the same multi-key row cache: key builder, cache read, tombstone-guarded backfill, broadcast refresh, invalidate and tombstone-on-delete. They now share RowCache on PuterStore, which also single-flights concurrent misses for one key and batches getByIds/getByUids: one pipelined tombstone check for the loaded rows and one pipelined backfill instead of per-row awaits. Cache keys and TTLs are unchanged. * perf(apps): invalidate cached app lists by generation, not by tracker scan Every app write SMEMBERS'd a global set of every cached list key, parsed each key back into its filters and deleted the matches. List pages are now keyed by their owner's generation token (or a shared one for unscoped lists), and a write replaces the tokens it affects: O(1) per write, and a page loaded before a write can no longer be cached after it. * refactor(stores): one keyset page helper for store listings Thirteen store listings each cut a LIMIT n+1 read to a page and sealed the last row's position, and each opened an id cursor its own way. They now use keysetPage() and openIdCursor() from util/pagination. Cursor payloads and sealing are unchanged; a cursor without a usable id still fails with 400 in ShareStore and still restarts the listing elsewhere (strict option). * refactor(stores): delete store methods nothing calls AppStore.existsByIndexUrl, OIDCStore.unlinkByUserId, TeamStore.listByOwner/listActiveSeatUuids, SubdomainStore.getByDomain/ listByDomain, FSEntryStore.ensureDirectoriesForUser, ShareStore.listByIssuer/listByRecipientEmail/deleteByRecipientEmail/ getDailyShareCount/listByHolderAndFsentries and PermissionStore.invalidateScanCache/deleteUserUserPermsByPermissionPrefix had no production callers. ShareStore.listByFsentries was a copy of listReaching; its callers use the latter. SubdomainStore SMEMBERS'd a per-user prefix-list tracker on every write and broadcast its deletion, but nothing ever wrote that set or cached a prefix listing. The reads are gone. * refactor(stores): shared escapeLike and bumpGeneration helpers escapeLike replaces the LIKE escaping copied into PermissionStore (twice), ShareStore and FSEntryStore, and now also guards SubdomainStore's prefix filters, which passed caller prefixes into LIKE unescaped. bumpGeneration sends INCR and EXPIRE in one pipeline instead of two awaited commands in PermissionStore, EventSubscriptionStore and PresenceStore. * refactor(stores): read affected rows off WriteResult Every database client returns affectedRows and anyRowsAffected, so the `affectedRows ?? changes ?? 0` fallbacks in ShareStore, NotificationStore, UserStore and UserBlockStore read those directly. * perf(stores): batch flat-permission KV deletes and durable cache drops PermissionStore deleted each flat KV entry with its own kv.del; one kv.batchDel now covers the set. DurableSubscriptionStore's suspend and reap dropped each row from the cache separately; EventSubscriptionStore gains dropDurables, which drops them per owner in one pass, and dropDurable calls it. suspend keeps one conditional UPDATE per row, which is how concurrent settles learn which rows each of them suspended. * refactor(fs): fold FSEntryStore's duplicate getters, sort maps and cache keys - getEntryByUuid and getEntryById share one by-column getter. - listChildren and listChildrenPage read one sort table; the offset listing now coalesces NULL modified/size like the cursor listing, so both order NULLs the same way on every engine. - Entry cache keys come from one builder instead of hand-built strings. - getEntriesByIds, getEntriesByPaths and the per-user path reader fetch their cache hits in one pipelined round trip instead of a GET per key, through readCacheValues, which RowCache.readMany now uses too. * fix(apps): cache the row a lost createFromOrigin race reads from the primary Keeps AppStore's private #writeCache as a RowCache write, so code that still calls it (#4166's read-back) loads in either merge order.	2026-10-11 22:07:53 -07:00
Daniel Salazar	45f6e9d8ee	refactor(drivers-wiring): AppService views and launch gates, batched app lookups, shared driver policy and guards (#4186) ... * perf(workers): skip hot-reload lookups for files no worker is bound to The fs.write.file / fs.remove.node / fs.move.node listeners listed every workers.puter.* row of the file's owner on every event, for every user. The event's FSEntry already carries the worker rows bound to it, so a file with none returns before any I/O; a bound file reads just its own rows, batched, from the primary. * perf(apps): read the uid alias only after a direct lookup misses Every AppDriver uid lookup fired an uncached system-KV GetItem for the merge alias in parallel with the direct read, even when the direct read hit. The alias is now read only on a miss. * refactor(apps): one app view with the launch gates, built by AppService AppDriver's serializer and its private-app / hosted-backing gates move to AppService.views, built on a pure toAppView that is the one place index_url is withheld. AppDriver, the subdomains driver's embedded apps and the GUI shell view all use it. Visibility of protected apps (filterReadable) moves with it. Subdomain embeds (associated_app, app_owner) used to return index_url with no gate; they now withhold it from a viewer who may not open a private app or whose hosted backing is gone, and carry privateAccess, godmode and feedback_enabled like a direct app read. * refactor(apps): one toAppSummary; batch the recommended and taskbar lookups SuggestedApps, RecommendedApps, /get-launch-apps and the taskbar each built their own launch summary; they now share toAppSummary (the extra feedback_enabled / external flags appear on the lists that lacked them). getRecommendedApps awaited getByName once per recommended app (29) and getTaskbarItems did the same per taskbar entry on every whoami; both now make one batched call per key through the new AppStore.getByNames, which keeps getByName's case-insensitive and old-name matching. The taskbar's raw UPDATE of the user row goes through UserStore.update, and /get-launch-apps checks hosted backings in one batch and reaches the stores without casts. * refactor(apps): app routes read through AppService; /delete-site calls the subdomains driver AppController used the global driversContainers through a getter whose boot-order comment no longer held; it uses the injected drivers and AppService. GET /apps/:name looked each name up, read it again through the driver and resolved private access a second time, emitting app.privateAccess.resolveLaunch twice per private app; it now batches the names and resolves once. POST /query/app did a lookup, a driver read and a raw app_filetype_association SELECT per selector (up to 200, serially); it now makes one batched lookup per key, one grant check and one filetype read. The driver's read shape is a pure toAppReadView both use. HostingController's /delete-site re-implemented the subdomains driver's delete (protected check, delete, subdomain.delete event); it keeps its owner-scoped 404 and calls the driver. Hosting and Desktop controllers drop constructors that discarded the drivers argument, and trivial getters. * refactor(drivers): one per-method policy validator and resolver; drop @Driver Four policy blocks (rateLimit, concurrent, requireSubscription, requireReputation) share the { default, methods } shape but each had its own validator and resolver. They become validatePerMethod(value, label, policy) and resolvePerMethod(cfg, method); error messages are unchanged. The @Driver class decorator and the prototype keys it wrote had no users outside its own tests; drivers declare their fields, and resolveDriverMeta reads only those. DriverController takes the driver name from the meta it already resolved instead of probing the prototype. resolveDriverMethodRateLimit/Concurrent stay as deprecated aliases for the email extension. * refactor(drivers): shared actor guards and crud-q concurrency policy The apps, subdomains, workers and notifications drivers each carried a private #requireActor, two carried the same #requireVerified, and apps and subdomains the same owner/app_owner write predicate. These become requireContextActor, requireContextUserActor, assertActorEmailVerified and actorOwnsRow in core/actor.ts; each driver keeps its own error for the cases that differed (system actors still read apps; notifications still answer 403 for an actor without a user). The identical crud-q concurrency block is one CRUD_CONCURRENT constant. The metering, installedApps and appTelemetry extensions re-checked an actor their routes already require; those checks and the tests for them go. * refactor(extensions): store methods instead of raw SQL in OSS extensions installedApps and appTelemetry queried user_to_app_permissions directly and metering read apps by name with its own SELECT. PermissionStore gains listAppsGrantedByUser, listAppAuthenticatedUsers (with the email-share check folded in) and countAppUsers; metering uses AppStore.getByName. * refactor(server): one layer builder and one lifecycle hook runner PuterServer built each of its five layers with its own copy of the same loop (built-ins, then extension additions, into the layer and its export container), and ran each lifecycle hook with five near-identical loops per hook. Both are now one helper each: #instantiateLayer and #runHook(order, hook). Construction order, the args each layer receives, and hook order (start and prepare bottom-up, shutdown top-down) are unchanged. * fix(workers): tear down a deleted source's worker after its FK nulls root_dir_id	2026-10-11 22:04:23 -07:00
Daniel Salazar	d162549c1d	refactor(controllers): one signup, login, confirm and window.user path; userProtected/internalAuth route options (#4189) ... * refactor(auth): one signup path for form, temp, OIDC and team accounts Signup steps (validate hook, phone/card forcing, bonus verdict, provisioning, signup events) move from AuthController and OIDCService into SignupService. Username rules, availability and generation move to util/username.ts, and user-row + group + default-folder creation to provisionUser, which TeamService and DefaultUserService now share. Behaviour fixes: a provisioned team seat joins default_user_group like every other account, and generated temp usernames skip names whose home path is occupied. * refactor(auth): one web-session start for password and OIDC sign-in startWebSession creates the session with the request's IP, user agent, origin and host and sets the session cookie. OIDC sign-ins used to create their session without that metadata, so they showed up blank in the session list. * refactor(auth): one confirmEmail for the code and link confirmation routes Both routes now re-run the email checks, refuse an address another account confirmed, strip it from other rows, promote the group and push user.email_confirmed to the account's sockets (with the originating socket id on the code route). The link route's full-table UPDATE clearing other accounts' pending change-email requests is dropped: /change_email/confirm already refuses an address a confirmed account owns. * refactor(auth): build window.user once for whoami and sign-in buildUserDetails and scrubSensitive move from the whoami extension into util/userDetails.ts. /whoami calls them; sign-in responses now return the same user-actor payload, scrubbed, so the login copy no longer ships the phone number and a no-reload login gets oidc_only/otp/directories up front. Taskbar resolution is best-effort on both. * refactor(http): userProtected route option replaces AuthController's route walker copy The user-protected gate is materialized from a userProtected RouteOption (implies requireUserActor), so AuthController no longer re-implements the decorator walker to wire it per instance; those routes and the session routes are plain decorators now. AuthRequired also counts requireVerified and userProtected. * refactor(http): internalAuth route option and a shared bodyRecord EventsController and PeerController each checked x-puter-internal-auth by hand with different compares; an internalAuth RouteOption now picks the secret from config and one constant-time gate checks it. ShareController and EventsController share bodyRecord instead of private copies. * fix(fs): cap legacy /delete at 500 paths per request The bulk form resolved, ACL-checked and removed an unbounded paths[] list one by one. It now refuses more than FS_BATCH_WRITE_MAX_ITEMS (500), the cap the batch write routes already use, before touching any entry. * refactor(controllers): user and subdomain writes and reads through their stores AuthController's 2FA setup/enable/disable and recovery-code writes go through UserStore.update instead of raw UPDATEs plus a manual invalidate, and /readdir-subdomains pages SubdomainStore.listByUserId instead of an unbounded SELECT; the response shape is unchanged. * refactor(auth): note SignupService's call-time peers * fix(auth): type userDetails' taskbar deps independently of TaskbarDeps.clients	2026-10-11 22:00:53 -07:00
Daniel Salazar	c815dc82a1	refactor(core-util): shared bounded map, cheaper route lifecycle, DDB/DB/rate-limit/gate dedup (#4185) ... * refactor(util): add BoundedTtlMap for core caches and log throttles One size-capped, LRU-evicting map with an optional TTL and a once-per-window shouldEmit helper. Replaces the hand-rolled maps in the DynamoDB throttle and repair loggers (the repair one was unbounded), the Slack repeat throttle, the auth probe's reauth log throttle, and the card-verification status memo. * perf(http): skip route lifecycle work when nothing listens The per-route lifecycle middleware built a payload, opened an event.emitAndWait span and hooked finish/close on every request, listeners or not. Each phase now checks hasListeners first. EventClient's three copies of the key-prefix walk become one memoized #matchKeys. * perf(ddb): write batch chunks concurrently and retry the TTL sweep batchPut/batchDel sent their 25-item chunks one after another; they now run up to four at a time through runWithConcurrencyLimit, and a failed chunk stops the ones not yet started. batchGet and the batch write share one #sendWithUnprocessedRetry instead of two copies of the backoff loop, and the TTL sweep goes through #batchWrite, so the unprocessed deletes it used to drop are retried. The AWS and local clients are built by one #bindClient. * refactor(db): share migrations and tryHardRead in the base client MySQL and Postgres each carried a copy of the migration-path runner and of the replica-racing tryHardRead; both now live on AbstractDatabaseClient (applyMigrationPaths, and tryHardRead gated on hasReadReplica), and SQLite drops its own tryHardRead override. Removes MySQL reinitPrimary, reinitReplica, isRetriableError and readWithRetry and the base requireRead, which had no callers outside tests. SQLite prepared statements and the Postgres SQL rewrite are memoized per query text in a bounded map. * refactor(rate-limit): route every entry point through one charge() The nine rate/peek/acquire entry points each repeated key and limit resolution, the backend call and the fail-open catch. They now share charge(), routeKey() and guardSlot(); log lines are unchanged. Driver concurrency slots release at most once like the other slot handles, and checkRateLimit takes { failOpen: false } for limits that must hold when the backend is down. * refactor(util): add secretsEqual for constant-time secret comparison One HMAC-then-timingSafeEqual helper, safe for inputs of any length, so callers stop hand-rolling the length guard. File signature verification uses it. * refactor(fs): infer signed-file MIME types with mime-types mimeFromName looks extensions up in mime-types instead of a 35-entry inline table, keeping the two types the table reported differently (ico, wav). The purpose-labelled signing key is derived once per secret instead of on every signature, where signFile derived it twice. * refactor(http): build route gates from one gate() helper Each gate repeated a try/catch -> next(err) wrapper or a .then(next, next) chain around an assertion. gate(check) does that once: a throw or rejection goes to next(err), and a synchronous check still calls next synchronously. The credits, subscription and reputation gate files held nothing but such a wrapper; their factories move into gates.ts and the files go. * perf(hosting): build the puter-site hosting config once createPuterSiteMiddleware rebuilt the normalized hosting-domain config on every hosted-site request; it is derived from static config, like the domain lists the middleware already builds at construction. * fix(db): tryHardRead's replica leg doesn't fail over to the primary MySQL's read() retries on the primary after a load-shed or transient replica error, so routing tryHardRead through it read the primary twice on that path. The replica leg now reads the replica alone. * fix(ddb): settle in-flight batch chunks before rethrowing A failed chunk stopped unstarted chunks but rejected while others were still retrying, so writes could land after the caller had handled the error and invalidated its cache.	2026-10-11 21:53:33 -07:00
Daniel Salazar	2131b980ce	fix(redis): release locks with an atomic compare-and-delete (#4183) ... * fix(redis): release locks with an atomic compare-and-delete ACLService, TeamService and the share digest flush each hand-rolled a SET NX lock whose release was a GET-then-DEL (or a blind DEL), so a holder whose TTL lapsed could delete the next holder's lock. They now share withRedisLock, which claims with a random token and releases via a Lua compare-and-delete. * chore(team): place the redis lock import with the other runtime imports	2026-10-11 21:19:37 -07:00
Daniel Salazar	906d6b7886	fix(email): one canonicalization and blocklist for every address path (#4176) ... Share invites, share notifications and app feedback checked addresses through EmailClient.clean/validate, a second copy of the rules in util/email.ts that stripped dots on iCloud, stripped `+tags` on every domain, and matched the blocklist case-sensitively. They now use util/email.ts: isBlockedEmail for the blocklist, abuseKey for the per-address notification budget, and cleanEmail for the invite digest key. EmailClient keeps transport and templates only. isBlockedEmail also lowercases the configured suffixes, so a mixed-case blocklist entry still matches.	2026-10-11 18:24:28 -07:00
Daniel Salazar	360f6b1079	fix(events): bill reached deliveries, bound dispatch reads, seal cursors (PUT-1900) (#4146) ... * fix(events): bill reached deliveries only, bound dispatch reads, seal cursors - A broadcast socket copy is billed only when a connection for its holder exists on this node, anywhere in this region (connection count) or, for a durable row, in a region presence names. Without peers it bills as before. - Compiled match filters are held in a bounded LRU with a TTL, and dropped when another process reports a subscription ended. - GET /events/fetch reads the continuation from `cursor`, falling back to `after`. - Cursors from /events/fetch, /events/subscriptions and /events/kv-handles are encrypted with sealCursor/openCursor; plain cursors still read. - A durable subscribe counts again after its insert and removes its own row when over the cap; the generation bump for that removal is published. - Subscribe checks access before reading the anchor's owner, and an anchor gone in between answers with the subject the caller sent. - Dispatch reads at most the rows per token routing can use, scanning large token hashes; a removal still settles every row on the removed anchor. - puter.events.unsubscribe() stops routing after the server ends the subscription or reports it gone; fetch() accepts `cursor`. * fix(events): forward kv values only to regions with rows that ask - A region counts its session rows asking for kv values per token and announces the token's value variant (`v#<token>`) over the existing `watch` item on the first such row, withdrawing it with the last. Add, remove, reap, reanchor and refresh all keep it, reading `includeValue` off the row as it is dropped. - A kv write reads the value variants alongside the watch index and attaches the value only to forwards bound for a region that announced one. * fix(pagination): seal id-keyed cursors on every list endpoint Apps, subdomains, workers, team (members, directory, teams, audit, own audit), shares (inbound, outbound), the user-to-user permission audit and readdir/descendant listings now hand out cursors sealed with sealCursor and read them with openCursor, so a cursor no longer carries a row id. Plain cursors issued before still read. * test(events): pass socket ids to noteConnect in the billing tests	2026-10-09 00:08:13 -07:00
Juan Castro	cf817b0f0a	fix: treat dots as significant on Apple's mail domains ... `cleanEmail()` applied gmail's `dots_dont_matter` rule to icloud.com, me.com and mac.com. Apple allocates the exact string: `j.smith@icloud.com` and `jsmith@icloud.com` are two mailboxes with two owners. Collapsing them made one canonical address stand for both. What that canonical address feeds: - `findEmailOwner` falls back to it, so an OIDC sign-in whose verified claim is the dotted address resolves to the account holding the undotted one, and `linkProviderToUser` has nothing left to object to -- the provider verified a real mailbox and the account's address is confirmed. - The unique index on COALESCE(clean_email, lower(email)) reads it, so the rightful owner of a dotted Apple address is refused signup because the undotted account already "owns" it. - Pending share invites are stored and claimed on it. Subaddressing is untouched: Apple does fold `+tag`, so that rule stays. Gmail keeps both rules -- there the fold is correct. A migration recomputes `clean_email` for those domains on all three engines, since rows written before this still hold the collapsed value and the index reads the stored one. Verified the SQL against the function rather than by inspection: same five inputs through `cleanEmail()` and through sqlite give byte-identical output. It can only split rows apart, never merge them, so it cannot collide with the unique index. Not changed: `findUserByEmail` still matches on the canonical address. The cross-match it documents is correct where the provider really does fold -- `foo.bar+tag@gmail.com` is the same inbox as `foobar@gmail.com`. Requiring an exact match would break that for no benefit here; the fix is for the data to say what the provider does.	2026-10-07 09:17:03 -04:00
Daniel Salazar	fadee6fac5	fix: verification for sms (#4099)	2026-10-06 21:59:58 -07:00
Juan Castro	0495ea0f9d	fix: close the holes the review found in the storage gate ... Four, all real. The gate threw on a non-string. `validator.isEmail` asserts its argument, and two call sites hand it an unvalidated body value -- `send-pass-recovery-email` is public, so `{"email": 1}` was a 500 rather than a 400. The check belongs in the gate, not in each caller, which is the whole premise of having one. OIDC signup never shape-checked the claim at all. `claims.email` went from a truthiness check straight into `user.create`, so a provider we do not run could store exactly the string this branch exists to keep out. `email_verified` attests the mailbox, not the characters. The change-email confirm handler promoted the staged column without re-reading it through anything. A row staged before this deploys still lands on `email`; one check at promotion closes that window. The invite path kept its own regex, and it was never the same rule. It admitted `a..b@x.com`, `.a@x.com`, `a@-x.com`, `a;b@x.com` and `a,b@x.com` -- the last of which nodemailer reads as two recipients -- each one a permanent pending row that spent daily quota, which is the failure the comment above the constant said it existed to prevent. It uses the gate now, and the second regex is gone. A regression test each, all four confirmed to fail without their fix.	2026-10-06 17:20:35 -04:00
Juan Castro	73698be964	fix: one gate for an address we are about to store ... `validator.isEmail` accepts a quoted local part, so an address whose local part is an arbitrary string passes it. Five call sites relied on that check alone before writing the address to `user.email`, and the invite path's own shape regex was equally permissive. `isStorableEmail` is now the single gate: the library check, plus a refusal of `<`, `>` and `"`, which are legal in an address only inside the quoted form. Nothing deliverable uses that form, so the rule costs no real address -- apostrophes and ampersands in a local part still pass, and the suite covers them. One function rather than a check each caller has to remember, because the next place that stores an address will not remember.	2026-10-06 16:47:15 -04:00
Juan Fernando CastroandDaniel Salazar	a46eb15d5e	Let the account's own API token reach the routes a privileged app needs (#4032) ... * feat: let the account's own API token reach the routes it should A privileged app is launched with the GUI session token today. Running one on a full-access personal access token instead costs much less when it leaks, but several routes those apps depend on refuse every access token, so the swap would break them. Admitted, each a read or a write the token's own HTTP reach already covers: - the realtime socket handshake, which refused access tokens outright; FS live updates and notifications stop without it - GET /get-dev-profile and POST /profile, both puter.js surface - GET /auth/list-permissions — a read of what was granted, not a grant - GET /share/shared-by-me/apps and GET /share/audit, over grants /share/shared-by-me already lists for the same credential - POST /rao, which puter.js calls on every setAuthToken Gated on `isAccountContext`, not the `full_access` claim alone, so a token with an app anywhere in its chain is still refused and a socket for one never joins the user room. Left session-only: mint, session, 2FA, grant, team and billing, plus two the list named. /share/blocks is a personal safety control whose only caller is the desktop's Blocked Senders window. /app-feedback is reachable only from our own GUI pages, and being unsubmittable programmatically on a user's behalf is the property it was built with. The new HTTP suite drives a real server with a minted token and fails on all six admissions without the change; the block routes' existing metadata check already pins their refusal. * test: sort the two token shapes at the events handshake * fix: carry the account-context invariant into the HTTP gate `requireUserActorGate` admitted on the raw `full_access` claim while the socket and /rao use `isAccountContext`, so one shape — a token carrying the claim with an app in its chain, or an actor built without `makeActor` — would have been refused in two places and admitted in the third. Unreachable today, since the mint and the auth-time read both drop the claim when `app_uid` is present, but it is the invariant this change states and it should hold at every enforcement point. The payout address goes back behind a plain session: `/get-dev-profile` is open to the account's own token now, and the rest of what it answers is a developer's own name and incentive-program status. Also drops a cross-reference in EventsService to the socket posture this change relaxed, and rewords the block-routes comment, which read as if access tokens were admitted there rather than refused. * fix: drop a revoked token's sockets, and read the dev-profile columns Two gaps the review found, both reachable only because this branch lets the account's own token hold a socket and call /get-dev-profile. `#revokeAccessTokenTail` soft-revoked the session row and told no one, so a revoked token kept its connection — and the account's `outer.gui.*` fan with it — until the five-minute reauth sweep. Sockets now join a per-token room and a new `auth.access-token.revoked` event drops exactly that room, so the account's other tabs stay up. Session revoke keeps its account-wide eviction. `/get-dev-profile` read `first_name`, `last_name`, `paypal` and the two incentive flags off the user row, which carries none of them: the columns have always been `dev_`-prefixed, so the endpoint answered nulls to everyone and `puter.apps.getDeveloperProfile()` has never returned anything. Reads the real columns, keeping the unprefixed name as a fallback for a deployment carrying both. The payout address stays behind a plain session, so opening the route to the account's token hands over a name and incentive status and nothing else. Both fail without the fix: the socket test waits five seconds on a connection that should already be gone, and the profile test reads back a seeded row. * fix: close /open_item to tokens, and stop the node runner leaking sockets `/open_item` carried `allowFullAccessToken`, but it grants an app a permission on the user's behalf and mints the app token to go with it — a grant and a mint, which stay session-only. Pre-existing, and missed by the first sweep here, which only asked whether routes lacking the flag should gain it and never re-read the ones that already had it. Refused at the top of the handler too, so a credential that gets past the gate cannot leave an ACL row behind. The node runner loads each SDK into a vm context and never closed it, so every test leaked a socket, and every socket holds a per-(user, origin) connection slot. Admitting the account's own token to the handshake pushed that past the cap, and the whole events block failed with `events_connection_failed` while the browser and workerd runners — which do not leak — passed. Closing the FS socket and the events channel after each test gives the slots back. * fix: announce only the revokes that can have a socket to drop Every access-token revoke broadcast an eviction cluster-wide, including the read-URL tokens `revokeReadUrl` retires constantly. A scoped token is refused at the handshake, so none of those broadcasts could ever reach a connection. The announcement now goes out only for a token the handshake would have admitted: full access, no app in the chain. `revokeOwnAccessToken` refuses full-access tokens outright, so that whole path is silent; a revoke by raw uuid says nothing about the token and still announces, which costs a no-op broadcast rather than leaving a revoked socket up. Fails without it: the test revokes a scoped token and a full-access one through the same entry point and counts the announcements. * test: pin the mint route against the account's own token `/auth/create-access-token` carries only `requireAuth`, so it never showed up in the sweep over `requireUserActor` routes — the refusal lives in `AuthService.createAccessToken`, which turns away any access-token actor outright. That holds today, and a leaked full-access token minting itself a sibling that survives revoking the original is exactly what the token swap is meant to rule out, so it is worth a test rather than a reading. * fix: let the recommended-apps test follow the list it tests Two commits on main rewrote `RECOMMENDED_APP_NAMES` without touching the test, which seeds `editor` and `camera` and asserts the result contains them. Neither is on the list any more, so the resolved set came back empty and `test (base)` has failed on every PR since. The test now seeds the first two names off the list itself and asserts on those, so the next edit to it cannot strand the test: prepending two unknown apps keeps all four cases green. * feat: let an extension waive a plan gate for one route or driver method A plan gate about to refuse a caller now emits `subscription.gate.<surface>` through `emitAndWait` first: `route.<method>.<path>` for a route, `driver.<iface>.<method>` for a driver method, `share.anyone` for link shares. The payload carries the actor, the request and the requirement, and a listener that sets `allow` waives the plan for that call. Callers the plan already covers never reach the hook, and a listener that throws leaves the refusal in place. * feat: mint godmode apps their own full-access token `/auth/get-user-app-token` answers a desktop launch of a godmode app (the `godmode` column) with a full-access token instead of an app token. Origin lookups, the sign-in popups for pages outside the desktop, keep getting ordinary app tokens, and only a web session may mint one. The token carries the app in `godmode_app_uid`, read into `accessToken.godmodeApp` for attribution only: `effectiveApp` stays null, so it keeps the account's reach and passes the same gates as a personal access token, including the vendor-compatible AI routes. It is refused once the app is gone or no longer godmode. Its row is an `access_token` session parented to the web session that asked, with `app_uid` set, so signing out, revoking that session or revoking all sessions takes it along, and the sessions list shows it under the app. Each mint re-signs onto the same row with a 12h `exp` and moves the row's expiry out, so the desktop keeps an open app alive while a copy taken earlier still expires on schedule. A full-access token may now mint scoped tokens (read URLs), parented to its own row; it still may not mint full access. Revoking a full-access token cascades to the tokens it minted. An access token whose session row has a parent now authenticates only while that parent is live, so a read URL a godmode app minted lapses with the app's token, and through it with the desktop session. * feat: launch godmode apps on their own token and renew it The desktop asks for a godmode app's token at launch and blocks the launch if it can't get one, as it does for other apps; a godmode app never runs on the desktop's session token. While the window is open the desktop re-mints the token once less than 6h of its 12h remain, checking on a timer and when the tab becomes visible, and answers the app's `reauth_required` with a fresh one, posted to the app's origin. puter.js keeps a godmode token in sessionStorage like a session token, never in localStorage. In app mode a 401 on a godmode token, background requests included, asks the desktop for a new token and replays, and a `puter.token` message is only taken from the embedding frame. The sessions list shows a godmode token row with its app's title and icon. * fix: keep a godmode token the same across renewals Apps hand their launch token to code that never sees a replacement (the terminal's Drive mount, a CLI's API key), so a token re-signed every renewal broke those copies once the first one expired. The JWT now carries no `exp` and a renewal moves only its row's expiry, so every copy keeps working while the desktop keeps the app alive. What still bounds it: - only the desktop's web session can extend it; using the token never does, and signing out or revoking that session revokes it; - it lapses 12h after the desktop last asked, and a lapsed row is never revived: the next launch gets a new token; - however often it is renewed, a token is replaced after 7 days, and the old one is revoked on the spot along with the tokens it minted and its sockets. The desktop no longer re-posts a renewal that kept the same token, so the app's sockets aren't rebuilt every few hours; an app that reports its token stopped working is always answered. * fix: reserve the feedback and no-reply mailbox names again Signup checks names against `util/reservedUsernames`, but `fbl`, `noreply` and `no-reply` were added to a second copy of the list in AuthController that nothing reads any more, so they became claimable. Move them into the live list and drop the copy. --------- Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-05 01:10:29 -07:00
Neal Shah	970092f0a0	PUT-1995 (#4020)	2026-10-05 03:26:54 -04:00
Daniel Salazar	83d64ac685	fix: follow-ups from the reviews of #4047, #4049, #4051, #4053, #4055 and #4057 (#4068) ... * fix(auth): issue reauth tokens only for browser sessions A rejected token's 401 carried a signed reauth_token, which /signup turns into a session on a temp account. Any revoked app or access token, a stale token from a deleted app whose uid was reused, or a worker credential could get one. Only a GUI/browser session's rejection now carries a reauth_token; everything else still gets reauth_required without it. The stale-app check also runs before the session is touched. * fix(events): refuse worker creation from an events handler workers.create minted a worker token with no handler depth, so a handler could deploy a worker and chain writes through it at depth 0. A handler actor can no longer create a worker; delivery, deploys and hot reload mint from plain owner actors and are unaffected. * fix(ai-ocr): bound the page count's parsing and close its under-counts - Object-stream headers are capped (/N, /First) and read incrementally, and the inflate budget scales with the file, so a crafted PDF can't spend seconds and gigabytes before the credit check. - An escaped /ObjStm type, an indirect /Count, untyped page leaves and an object redefined to a smaller tree no longer lower the count. - An account with no balance is refused before the file is parsed. * fix(fs): add a switch to stop accepting pre-binding signed URLs Signed URLs issued before owner binding are still accepted, and owner-signed ones never expire, so the move-to-another-tree attack stays open for them indefinitely. legacy_file_signatures (default on) can now turn them off, a rate-limited warning counts their use so it's visible when they've died out, and a non-UUID uid is refused before the entry lookup. * fix(fs): hide the issuer's home uid from a scoped token's entries A token scoped below the home could still learn the home's uid as the parent_uid of a direct child (e.g. stat on ~/Documents). For access-token actors that can't list the home, a direct child's parent uid is now null in the v2 and legacy entry shapes, using the same rule as the root listing. * fix(gui): ask for the 2FA code on the last step, right before enabling The setup flow verified a code before the recovery-codes screen and sent that same code to enable afterwards; by then it had usually expired, and the user was sent back to the start. The code is now entered last and goes straight to enable; a wrong code keeps the user on that step, and other failures show the server's message. Enter submits the password step. * test(fs): expect the legacy-signature flag in the signing config * fix: apply the review's follow-ups to the merged-PR fixes - Reauth tokens also require the session row to be a browser ('web') session, not just the absence of the worker claim. - The OCR page count only treats an untyped object as a page when it sits in a page tree's /Kids, so outline items, widgets and name-tree leaves can't inflate an honest PDF's count. - The signed-URL uid guard checks the uuid's shape only, so a legacy row whose uuid has nonstandard version/variant bits still resolves.	2026-10-04 14:46:21 -07:00
Daniel Salazar	c981a51f21	fix(fs): bind signed file URLs to the owner they were issued under (#4053) ... New /sign signatures are an HMAC over uid, action, expiry and the entry's owner at signing time. /file and /writeFile resolve the entry first and verify against its current owner, so a move that hands the entry to another account ends its URLs and stops /file minting child URLs from them. The URL shape is unchanged; signatures in the previous format still verify, without the owner check.	2026-10-04 00:47:16 -07:00
Daniel Salazar	d57f638eda	fix: keep system sites writable and their names out of reach (#4064) ... Follow-up to #4056. Icons and profiles are now written as the system user, so on a storage-limited install they counted against its allowance (100 MB by default) and every write past that returned 413, including a user's profile save. Both writes now pass the unmetered allowance, as writes the system makes on users' behalf already may. ensureSystemSite reclaims a mismatched subdomain row in place instead of delete+create, so the name is never free for a user to register, the row keeps its uuid, and `protected` is never cleared; the previous holder's bindings are dropped. If the row vanished since the read it falls through to create. puter-app-icons is now protected like puter-profiles, both names are reserved from user registration, and they live in util/systemSite so the subdomain driver doesn't import the services. The icon service's shutdown wait is capped at 5 s so a stalled run can't hold up the metering flush.	2026-10-04 00:23:01 -07:00
Daniel Salazar	3defae3cfc	fix: own system sites by the system user (#4056) ... * fix: register system sites to the owner of their directory The hosting middleware refuses a site whose user doesn't own its root directory (absent a manage grant). The app-icons and profiles bootstraps always registered their subdomain to the admin, but the directory can belong to another user: a carried-over `/system` owned by the `system` user, which a new child directory inherits. Those sites then 404 on every request. Both bootstraps now go through ensureSystemSite, which registers the subdomain to the directory's owner and replaces a row registered to anyone else or pointing at another directory. Fixes #4045 * fix: own system sites by the system user `/system`, `/system/app_icons` and `/system/profiles` and their subdomains belong to the system user, and icon and profile files are written as it. ensureSystemSite re-owns directories another account created and replaces a subdomain row registered to anyone else, so installs bootstrapped under the admin move over on boot. The bootstrap no longer waits for an admin account, so DefaultUserService stops re-running it, and deployments without an admin get icons and profiles. AppIconService lets in-flight icon runs finish on shutdown.	2026-10-03 17:06:13 -07:00
Daniel Salazar	e6bda950f0	perf: batch per-app origin, canonical and hosted-backing lookups in app listings (PUT-1892) (#4013)	2026-10-01 18:30:06 -07:00
Daniel Salazar	4f31388dad	fix: cap app lookups and fields, dedupe icon processing, rate-limit app landing pages (PUT-1891) (#4012)	2026-10-01 17:54:25 -07:00
Juan Castro	785304e807	fix: stop deleted apps and users from being resurrected by a lagging replica ... A delete lands on the primary and invalidates the cache, but a concurrent request that misses the cache reads a replica that hasn't applied it yet, finds the row, and writes it back under a fresh TTL — 24h for apps, 15m for users. Every write referencing that resurrected row then fails its foreign key and escapes as a raw driver error, so the route 500s until the TTL expires. Origin-bootstrapped app uids are deterministic, so the same origin keeps hitting the stale row and never re-bootstraps. Deletes now tombstone their cache keys before dropping them. While a tombstone is live the read path goes to the primary and the write path refuses to cache; re-creating a row clears it. As a backstop, a write rejected for a missing parent is answered as one: 404 for a vanished app, 401 for a vanished account, with the stale entry retired either way. Also fixes cascadeDelete's identity lookup, which selected a column some schemas lack and so threw into its catch, skipping the invalidation entirely; and drops SessionStore's private copy of isUniqueViolation in favour of the shared helper.	2026-09-29 10:16:48 -04:00
Daniel Salazar	09887747e0	fix: app uuid fixes (#3980)	2026-09-28 19:43:23 -07:00
Nariman JelvehandDaniel Salazar	3d3678a555	feat: let the Contact Us form carry screenshots and recordings (#3563) ... * feat: let the Contact Us form carry screenshots and recordings The form doubles as our bug-report channel, and the bugs worth reporting are often the ones that need a picture: a visual glitch, or something that takes five steps to reach. Up to 5 images or videos may now ride along with the message, delivered as attachments on the support email. Nothing the client says about a file is believed. The endpoint takes bare base64 and re-derives all three of the things that matter from the decoded bytes: - Type, sniffed from magic numbers and matched against an allow-list of PNG/JPEG/GIF/WebP and MP4/QuickTime/WebM. A declared MIME is never read, so it cannot smuggle anything past the list. SVG is excluded on purpose (it carries script, and support tooling renders what it is sent), as are the non-video brands that share MP4's `ftyp` box -- HEIC, M4A, JPEG 2000. - The file name, reduced to a display label with the extension taken from the sniffed type. PNG bytes named `payload.html` arrive as `payload.png`; a name can never carry the CR/LF that would break out of a Content-Disposition header, nor the bidi overrides that make `report<RLO>gnp.exe` render as `report.exe.mp4`. - Size: 10 MB per file, 15 MB per submission, counted on decoded bytes. Encoded length is capped before decoding, so an oversized payload costs a length check rather than a 10 MB allocation. The total stays well under the 25 MB most providers enforce, since the outgoing mail base64s these again. Base64 is decoded strictly, reusing the round-tripping decoder that already guards app icons -- `Buffer.from(s, 'base64')` silently drops characters it does not recognise, and the round-trip is what rejects bytes smuggled after the payload. That decoder and the image sniffer move from appIcon.ts to a new mediaSniff.ts, which gains the video counterpart. One request is now worth megabytes of parsing and outbound mail, so the existing per-user rate limit gains a per-IP backstop (which the per-user counter cannot see through freshly minted accounts), a concurrency cap, and a Content-Length gate that refuses an impossible body before anything decodes it. Payloads are not stored. They ride the email; the new `feedback.attachments` column records names, types and sizes only, so an abusive submission stays attributable once the mail has been dealt with. Also fixes the form posting an empty message when Send was pressed with nothing typed, and surfaces submit failures instead of leaving the button disabled with no explanation. * fix: stream Contact Us attachments as multipart instead of base64 JSON Base64 in a JSON body went through the global JSON parser before the route ran: raw buffer, rawBody copy, decoded string, parsed strings, then decoded Buffers plus a re-encode for the strict check. A max-size submission peaked around 110-135 MB of heap for 15 MB of files, and the route's Content-Length check ran after all of it. Attachments now arrive as multipart/form-data, which the global parser skips. Auth, rate limit, concurrency and the Content-Length 413 all run before the body is read, and busboy enforces the count, per-file and total caps while streaming, so only the decoded file bytes are held (~16 MB peak). On a broken limit the reader stops and the response closes the connection. JSON stays supported for message-only posts; a JSON `attachments` field is rejected. * fix: deliver Contact Us 413s instead of resetting the upload Closing the socket on a mid-stream limit sent the 413 and then reset the connection with the client still uploading, so the client could see a reset instead of the error. After a limit trips, the rest of the body is now read and discarded, bounded by the body budget; past the budget the request is destroyed. Adds an HTTP-level test through the full middleware stack (FormData upload, unauthenticated refusal, 413 on declared length before the body is sent, 413 on a chunked upload over the per-file cap), trims comments to the AGENTS.md length rule, and drops a box-drawing test divider. --------- Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-09-25 14:19:35 -07:00
Daniel Salazar	132cae9f6a	Bug bash fixes (PUT-1876, 1877, 1880, 1881, 1948, 1949, 1951) and KV event fan-out by plan (#3943) ... * fix(kv): keep disableSharing entries out of other apps' events (PUT-1876) Private kv keys and values are no longer delivered to cross-app subscriptions, including forwarded and durable deliveries. * fix(fs): refuse usernames whose home path still holds another account's rows (PUT-1877) Username claims (signup, save_account, change-username, OIDC, team provisioning) now also check for leftover rows under /<name>/, and the root listing only returns the actor's own home. * fix(puter-js): reconnect the events channel after a server-side disconnect (PUT-1881) A server hang-up is retried with a bounded backoff; persistent handlers survive it and get an optional onError when the connection can't be restored. * fix(backend): let the graceful shutdown finish before telemetry exits (PUT-1948) The telemetry preload no longer exits on signals; the entry point drains, tears down top-down, flushes telemetry last, then exits. DB pools stay open until teardown. * fix(fs): reserve quota for signed uploads in progress (PUT-1880) startWrite/startBatchWrite hold each upload's declared size in a per-owner cache reservation until it completes, aborts or expires, so a burst of starts can't all read the same committed usage. Caps in-flight uploads at 10,000 per account. * fix(fs): refuse to complete a signed upload whose object never arrived (PUT-1951) Completion now 400s when the object store reports the key missing (transient errors stay lenient), abort no longer deletes an object a live entry still uses, and a ghost entry is only removed after a second miss at its recorded location. * fix(metering): move usage to v2 keys with a small totals item, per-model detail shards and a 3-month TTL (PUT-1949) The billed item holds only totals; per-model detail lives in 100 hash-sharded items read in one batch and cached for 60s, and more than 5,000 distinct usage types in a month fold into other. Global and per-app aggregates store totals only, appTotals comes from a prefix listing, a refused path only skips the key that refused it, exact reads near the allowance are throttled per key, and every metering record expires after 3 months. September usage restarts at deploy; the monthly-charge claim stays on the v1 key through September so recurring charges don't fire twice. * test(events): let the worker backoff test tolerate a loaded run * feat(events): scale KV event fan-out with the key owner's plan A KV change delivers to up to 512 matching subscriptions (2,048 filter evaluations) for a paid key owner and 128 (512) otherwise, inline values are dropped once more than 128 match, and paid accounts may hold up to 512 share handles per app. The owner's plan is only looked up when a change has more candidates than any cap. * test(metering): seed the 150-app listing test directly so it fits under coverage	2026-09-24 16:00:52 -07:00
Echa ApriliyantoandDaniel Salazar	9f69483593	feat: allow browser extension origins in auth requests (#3907) ... * feat: allow browser extension origins in auth requests Add chrome-extension://, moz-extension://, safari-extension://, safari-web-extension://, and extension:// to the protocol allow-list so browser extensions can obtain app tokens via /auth/get-user-app-token. Extract WEB_AND_EXTENSION_PROTOCOLS constant in validation.js so the allow-list is defined once and shared by AuthService, AppStore, and AppDriver. * fix: harden the extension-origin allow-list Review follow-ups on the extension-origin change: - Require a host in `validateUrl`. Only "special" schemes need an authority, so `chrome-extension:` parsed with an empty hostname and slipped past the reserved-system-host guard in AppDriver. - Lowercase the host in `AuthService#normalizedOrigin`. `new URL()` lowercases http(s) hosts but leaves opaque ones alone, so one extension in two spellings resolved to two app uids — two AppData trees, two permission sets — and missed the origin blocklist. - Drop `extension:`. No browser emits it, and it accepted `extension://evil.com` as an app origin. - Freeze the allow-list and derive `validateUrl`'s http(s) default from `WEB_PROTOCOLS` so the two spellings can't drift apart. - Pin the tests to the real uid derivation, use unique extension ids so a row left by another test can't mask the bootstrap path, and cover the host-less and near-miss schemes. - Fix the prettier/eslint failure in AppStore.js. --------- Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-09-23 18:24:31 -07:00
Daniel Salazar	58ed2f485f	feat(auth): signup bonus codes ... Signup links can carry a bonusCode. Core checks its shape and previews it through `puter.signup-bonus.check`, refuses a dead code before the abuse hook records the attempt, then hands a live one to `puter.signup-bonus.validate` after `puter.signup.validate`, which may raise the phone/card gates; the accepted code rides on `puter.signup.success`, and OIDC carries it in the signed state. `user.card-verified` is now awaited like `user.phone-verified`. The signup form shows the offer and sends the code.	2026-09-23 14:47:34 -07:00
Daniel Salazar	d07ddeaaf5	fix(fs): keep a home directory on its account's username (#3920) ... A root was free to be renamed or moved, so it could be parked on a username no account held yet. The next account to take that name provisioned a second root at the same path, and from then on either row could answer a lookup of it — new entries inherit their owner from whichever row resolved as the parent, so one account's files were created owned by the other, and renaming the parked root dragged the other account's subtree along with it. Rename and move now refuse a root, every username claim checks the home path before the user row is written, and renameUserHome refuses to heal onto a path another account holds.	2026-09-21 23:29:09 -07:00
404oopsandClaude Fable 5.1	027e9a71f3	fix(ai-image): refresh model catalogs, unify txt2img requests, expand docs (#3889) ... * fix(ai-image): sync image catalogs, unify request shape, document models Model sync against every vendor listing and a live generation sweep: Gemini stable ids replace the retired preview spellings (2.5 Flash Image delisted ahead of its 2026-10-02 shutdown), OpenAI gpt-image-1/-1-mini/-1.5 are delisted but routable until their shutdown dates with gpt-image-2 as the default, xAI gains grok-imagine-image-2.0 with its quality tiers, BytePlus gains the 3K/4K tiers and per-model pixel bounds, Cloudflare gains SDXL Lightning/Base and SD 1.5 Inpainting, Replicate gains a schema-driven catalog of 88 additional models with version-pinned community predictions, and every Together image route is excluded for the third-party data-sharing requirement. Request normalization: the driver collapses ratio/width/height/aspect_ratio into one imageSize with aspect-versus-pixel intent, validates prompt, quality and resolution once, resolves provider hints (short names or full driver ids) and aliases with exact ids winning over resellers, and hands each provider an immutable copy of the caller's args. Providers share prompt validation, aspect snapping, and content-sniffed data URIs so responses carry the right MIME type. Replicate predictions are created once, cancelled on abort or deadline, and bounded in input fan-out. SDK: txt2img copies caller options, rejects blank prompts with prompt_required in every call form, and documents that normalize has no effect because the image return shape is already uniform. Docs: txt2img options per provider, provider defaults and discovery, availability notes, a new image model catalog and pricing page, and the image-generation limits in the quotas page. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(ai-image): sniff SVG outputs correctly, reject hex/exponent dimensions imageDataUri only decoded the first 24 base64 chars (18 bytes) before sniffImageMime, which cannot see an <svg> root behind an XML prolog - SVG outputs from recraft-v*-svg models were being labeled image/png. Decode enough of the payload to cover the 8 KB SVG sniff window. dimension() accepted string number literals ('0x10', '1e3') as if they were decimal dimensions; restrict to plain decimal notation. * docs(ai): link to the model directory instead of a static catalog The image model catalog and pricing page duplicated the always up to date model directory at developer.puter.com/ai/models. Link to the directory from txt2img-related docs and keep the Together data-sharing exclusion note self-contained. --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-21 15:00:02 -07:00
Daniel Salazar	194ca7c789	fix: list a link share only while the owner's plan covers it (#3891) ... * fix: list a link share only while the owner's plan covers it * chore: types + jsdoc cleanup	2026-09-16 14:42:52 -07:00
Daniel Salazar	59f73528cb	feat: share with anyone with the link (PUT-1580) (#3874) ... * feat(email): inline cid attachments and Puter mailbox delivery for sendTransactional EmailAttachment gains cid/contentDisposition so the transactional driver can send inline images. The SDK's EmailAttachment typedef now comes from types.js, which already carried cid. Docs describe delivery to <username>@puter.email recipients and the not_found code. * feat: share with anyone with the link (PUT-1580); gate sharing on a verified phone or card	2026-09-15 21:06:12 -07:00
Juan Castro	f5b2365e83	feat: enforce the forced password change on team seats ... `user.requires_password_change` shipped with the team columns but nothing enforced it and nothing ever cleared it, so a provisioned seat kept its administrator-issued password indefinitely and `reissueCredential`'s "already activated" 409 was unreachable. Adds the fourth clause to `assertVerifiedAccount`, the only place a verification gate may live -- WebDAV builds its own actor and calls that function directly, so a second implementation would bypass it the way the phone and card gates once were bypassed. A gate that refuses everything also refuses the endpoint that clears it, so `/user-protected/change-password` opts out with `allowUnconfirmed`. That widens the route: an account pending email, phone or card verification can now change its password, which it could not before. The caller is authenticated and proves the current password, so this is benign, but it is a behaviour change to a shared route. Also here, because the gate is worthless without them: - change-password and the recovery-token path clear the flag, and record an `activate` entry when the account is a seat. - Reset takes a live account back with a fresh credential, capped at 20 per day and audited as `reset_member_password` with no credential in the row. Re-issue is audited the same way; it stays closed once a seat has chosen its own password. - An issued credential expires after 24h (new `temp_password_expires_at` column, three dialects) and login refuses it after that, so an unused reset dies instead of becoming a standing credential. - 2FA is untouched by a reset, so a reset alone is not takeover.	2026-09-09 11:51:44 -04:00
Daniel Salazar	799fc4ac3c	feat: send app icons as a subdomain URL plus an API fallback (#3734) ... App payloads carried only the /app-icon endpoint URL, which 302s to the icons hosting subdomain. Networks that mangle that redirect render no icon at all, and every icon load pays a round trip for the hop. Ship the direct subdomain URL as `iconCdnUrl` alongside it (taskbar items, installedApps, recent/recommended launch apps, suggested apps), and have the GUI load that first with the endpoint URL as a one-shot retry - desktop taskbar, start menu, dashboard app grid and recents. Only rows whose `icon` column is already an http(s) URL get one: a data: column means the resize pipeline has not written anything to the subdomain yet. Also folds the four copies of the generated-size list into one exported APP_ICON_SIZES.	2026-09-03 13:32:55 -07:00
Daniel Salazar	684d6752f9	fix: provide fallback for signup verification (#3631)	2026-08-23 21:49:35 -07:00
Juan Fernando Castro	5e1645d40e	🔧 PUT-1524: Sanity check file sharing api (#3603) ... * fix: sharing answers "who can reach this" from the grants, not the index Two ways a share listing could name access that was no longer there. A recipient's listing paired the flat permission read with the list of permissions it asked for by array index. That read drops misses and dedupes its keys, so the two are not positional: one entry's live grant vouched for another entry that had none, and listShared() kept publishing a withdrawn item's name, size and signed thumbnail URL to someone who could no longer open it. Read the permission off the value instead. getShares() had the same gap from the owner's side, with no liveness check at all — a grant withdrawn through /auth/revoke-user-user or an ACL mode change left the index row behind, and the owner was told someone could reach a file they could not. Checked against the grants now, one batched read per distinct holder. Pending invites are not subject to it: they have no grant yet, which is the point of them. Also covers the access-token actor, which reaches the same reach bound as an app through a different arm of the ACL check. No behavior change there — it was correct and untested. * test: pin that a revoke crosses regions A revoke reaches a peer region as a replicated SQL delete plus three invalidation events, one per cache the region owns: the u2u row cache, the flat view and the scan generation. The delete alone changes nothing there, and each cache has a different consequence if its event is lost — 20s for the generation, 5 minutes for the row cache, and forever for the flat view, whose grant-path entries carry no expiry. Nothing covered the whole path end to end. The store tests prove each event is emitted and applied; this proves the result, which is that the recipient stops being able to read. It asserts the read still succeeds after the SQL delete alone, so the test also records why replication is not sufficient on its own. * test: pin that a leaked uuid buys no access A masked share path hides which folder an item sits in; it was never the thing deciding who may open it. Nothing checked that at the route level, so the guarantee rested on unit tests of the resolver alone. Reads one shared file through its masked path, then tries the sibling four ways: the shared uuid with the sibling's name, the sibling's own uuid, a `..` back out of the root, and the owner's real path. Worth knowing about this one: it's mutation-checked. Removing the head !== root.name guard in sharePathMask.ts fails it with reachable: /testuser/55dd54c0…/share-http-1df8933e.txt. I verified that specifically because two tests I wrote earlier in this chunk passed with their guards broken — both were vacuous, and I deleted them rather than commit false assurance. * docs: say what listShared's total actually counts `total` counts the shares recorded for you; items are filtered after the page is read, so a withdrawn grant leaves the count higher than anything paging will yield. The page description already explained the short-page behaviour, but the field read as an exact count and the example printed it as one. The test pins the gap it describes: two shares, one withdrawn outside the index, one item listed and a total of two. * fix: keep an undelivered broadcast event instead of dropping it The outbound queue was cleared before the send, so a peer that timed out took its events with it. Most were survivable — a lost cache invalidation heals when the entry's TTL lapses. A revoke's flat-perm invalidation is not: grant-path entries carry no expiry, so a peer went on serving a withdrawn grant until something else wrote that key. Failed sends now go back on the queue, which the existing flush timer retries. Anything queued since wins over the retry, and the queue is bounded at 10,000 with the oldest dropped first, so a peer that stays down cannot grow it without limit. Each retry is signed at send time, so it is not rejected against the replay window. * fix: stop plus-addressing from deciding who a share reaches	2026-08-18 15:51:23 -07:00
Daniel Salazar	bd06e88185	feat: bring back referrals PUT-1463 (#3599)	2026-08-17 23:49:09 -07:00
Daniel Salazar	f81b76c1d1	fix: webdav connectivity fixes for macos (#3597)	2026-08-17 19:02:55 -07:00
3 people	2c852bf6b3	✨ PUT-1412 File sharing backend api (#3553) ... * refactor(permissions): drop hardcoded group permission map for a flat default * test(drivers): assert credential-gate intent instead of a 403 proxy * fix(permissions): report whether a revoke removed anything and persist the linked grant row before the flat view * feat(permissions): replicate permission invalidations across regions * feat(share): extend the share table into an index of active shares * feat(share): query and maintain active shares in ShareStore * feat(users): add a batched lookup by email * fix(cache): apply cache updates broadcast from peer regions * fix(permissions): scope a revoke to the issuer that granted it * feat(share): add ShareService with a per-day share limit A share is two writes that belong together: the permission grant, which authorizes access, and a share row, which makes it listable and ties it to an fsentry so it dies with the file. Nothing else grants fs:* to a user. Authorization reuses canManagePermission — an owner satisfies it through the is-owner implicator, a delegate through an explicit manage:fs:<uid> grant. An owner may clear any issuer's share of their node; anyone else only the ones they issued, or their own access. Self-revoke skips the manage gate but still requires `see`, so it cannot be used to probe for files. The per-day limit counts shares created rather than live rows, so revoking and re-sharing cannot recycle a slot, and changing an existing share's mode is not new reach and does not spend budget. Tunable via share_daily_limit. * feat(share): expose sharing over HTTP POST /share, POST /share/revoke, GET /share/shared-with-me, GET /share/shares. The controller was registered but entirely commented out. Recipients × items fan out concurrently — every pair is a distinct (holder, entry) key, so none of them contend — bounded by runWithConcurrencyLimitSettled, which returns results index-aligned with the input for the per-pair outcome list. Responses carry usernames only, never internal ids, and the 404-not-403 rule is preserved so a failed call cannot confirm a file the caller could not otherwise see. Notifications are fired off the response path; a share must not fail over its own notification. Per-request caps on recipients and items bound one call's fan-out; the daily limit bounds the total. * feat(share): keep recipients consistent when a shared item changes * fix(fs): stop listing issuer homes at the filesystem root * fix(acl): serialize concurrent mode changes on one node and pin app containment on shared paths * fix(fs): expire signed URLs over entries the signer doesn't own signFile defaults to a ~317k-year TTL and verifySignature checks only uid, expires and signature — never the ACL. A recipient who ever signed a shared file therefore held a permanent, revocation-proof URL to its bytes: revoking the share did nothing to it. signEntry now takes the acting user and drops to NON_OWNER_SIGNATURE_TTL_SECONDS (1 hour) when the signer is not the entry's owner. Owners keep the permanent default, so no existing client changes behavior. The signature-authenticated directory listing bounds its children unconditionally: that route has no session actor, and a signature proves possession rather than ownership, so a recipient holding a short-lived directory signature could otherwise mint permanent URLs for every child. A bounded window is not revocation — the durable fix is a per-entry signature epoch folded into the HMAC and bumped on any permission change. * refactor(permissions): drop the unused permission-issuer lookup listUserPermissionIssuers and its store method listUserPermissionIssuerIds existed to synthesize the filesystem root from the home directories of everyone who had granted the caller a permission. That listing is gone — it advertised folders readdir then refused to open — and the share index answers "who shared with me" directly, so nothing wants them back. One removed test only asserted that the call returned an array; the other covered readLinkedUserUserPerms round-tripping and is kept, rewritten without the issuer lookup. * fix(share): return the created share, not just an acknowledgement * feat(puter.js): add file sharing to puter.fs share(), unshare(), listShared() and getShares() on puter.fs, following the existing FS operation shape: positional and options-object forms through defineOperation, JSDoc overloads as the published signature, relative paths resolved against the app's root directory. A bare recipient string is read as an email when it contains @ and as a username otherwise. Sharing an item with someone who already has it replaces their access rather than stacking a second grant, so raising read to write is one more call. Adds a sharing suite to the API runner, which passes unchanged on node, browser and workerd. Documents all four methods with runnable examples, and corrects the FS overview callout that told readers one user cannot read another's files — true before this, not after. * feat(gui): add a Shared folder for items others shared with you A sidebar entry listing everything other users have shared with you, backed by puter.fs.listShared(). The path is the sentinel `puter://shared` rather than /<user>/Shared: this is a query, not a directory, and a path-shaped value could collide with a folder someone actually creates. refresh_item_container and update_window_path both branch on it to skip the stat there is no fsentry for, and the listing swaps readdir for listShared. Entries render at their real paths under their owners' directories — the item container already preferred an explicit fsentry.path over joining onto the container, so nothing else had to change. Each carries who shared it and at what level, which the context menu reads next. * feat(gui): share items from the context menu A sharing dialog shaped like its neighbours — options object, HTML-string template, jQuery wiring, delegating to UIWindow() — with a recipient field, a read/edit/share dropdown, and the current access list with revoke buttons. Reached from a new "Share…" context menu entry, which is hidden on items shared *with* you: re-sharing needs manage, so the dialog would only surface an error. Those items get "Remove from Shared" in place of Delete. Delete moves an item to *your* trash, which for someone else's file means moving their data out of their tree — FSService refuses it, and the user saw a bare 403. Removing your own access is what the action was reaching for, so that is what it now does. * fix(share): withdraw what a removed recipient re-shared * feat(share): report access inherited from a parent folder * fix(gui): load the puter.js bundle the server configured * refactor(gui): extract the action icon set into a helper * feat(gui): surface Shared in the file browser * feat(gui): manage access from the share dialog * test(share): cover access inherited from a parent folder * fix(share): keep downstream access from surviving a delegate who leaves * fix(gui): name the real owner in the share dialog * fix(gui): page through every shared item instead of the first 50 * feat(share): return item metadata with a share * fix(share): invalidate a holder's cache when the entry is deleted * fix(gui): treat items inside a shared folder as someone else's * feat(permissions): let manage inherit down the filesystem tree Access already reached descendants through the ancestor chain while authority did not, so someone trusted to manage a shared folder could re-share the folder but nothing inside it, and could not see who had access to a file within it. A manage-inherits-from-ancestor implicator resolves it in the permission layer, beside is-owner, so every caller agrees rather than just ShareService. It consults only the immediate parent — resolving that re-enters one level up, making a chain of depth d cost d checks rather than d². That makes two cascade gaps reachable, both fixed here. A revoke now walks the subtree, since a grant on a descendant can rest on authority held at the folder. And it stops at a delegate whose authority survives another issuer, because what they granted was never theirs to lose. Also pins that manage is not transitive: granting it needs manage:manage:fs:<uid>, which only the owner holds, so delegation is one level deep by construction. * fix(gui): offer sharing inside a folder you manage The menus encoded "manage does not inherit" and would now hide an action that works. The Shared listing records each root's mode; the menus resolve a child's by longest matching ancestor, loading on demand so a deep link or restored window works too. * fix(share): make the daily share limit hold under concurrency * test(share): cover concurrency, measure cost, and name cases for what they verify * fix(gui): import the ownership helpers the item menu calls The single-item context menu handler calls is_owned_by_me and shared_mode_for, but the imports were only ever added to generate_file_context_menu.js — so every right-click on an item threw a ReferenceError before the menu could build, and the non-owner Delete gating never ran. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(share): authorize before resolving the recipient share() looked up the recipient in parallel with the entry, before the manage check — and the two failures carried different error codes. Any verified user with a real entry uid could probe arbitrary emails and usernames for account existence, at no quota cost. Resolve the entry, authorize, and only then resolve the recipient: an unauthorized caller now sees the identical safe 404 whether or not the recipient exists. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(permissions): broadcast permission row-cache invalidations to peer regions Every publishCacheKeys call for the u2u, u2a, and access-token row caches omitted broadcast, so a revoke only cleared the mutating region's Redis. A peer region applied the replicated generation bump, re-scanned, read the deleted row from its own still-warm 5-minute row cache, and re-warmed the flat view from it — revoked access outlived the revoke by the row-cache TTL instead of the intended 60-second bound. CacheReplicationService already consumes these events; the emits were just never sent. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(fs): refuse to rename an entry owned by another user remove and move both refuse to act on an entry the caller does not own, even when the ACL allows the write — rename had no such guard, so a write-mode share recipient could rename the owner's file, or the shared folder itself, rewriting the owner's whole subtree's paths. rename now takes the acting user and applies the same policy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(permissions): decide a flat delete from the primary, not a lagging replica revokeUserUserPermission deletes the SQL grant, then only drops the flat KV entry once no issuer still grants the permission. That remaining-check read through the row cache the delete had just invalidated, straight to a replica — under any lag the deleted row reappeared, the flat delete was skipped, and the stale rows were re-cached for another five minutes. Grant-path flat entries carry no TTL, so the holder kept working access with zero SQL rows behind it, invisible to every listing. The check now reads the primary and re-warms the cache with what it actually saw. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(permissions): keep a failed remote flat-invalidation from crashing the process The outer.permission.flatInvalidated applier was fire-and-forget with no catch, and it awaits a KV delete — one transient KV error while applying a peer region's revoke became an unhandled rejection, which is process-fatal under default Node. Its sibling appliers were already guarded; this one now logs and moves on, leaving the entry to the next invalidation or its TTL, same as a lost event. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(share): revoke every requested item and recipient, not just the first revokeShare destructured only the first recipient and first item while the parsers accept arrays up to the request caps — unshare({items: [a, b, c]}) returned success having revoked only a, leaving access the caller believes is gone. Revoke now fans out over every (recipient, item) pair exactly like POST /share, reports per-pair outcomes, and sums the revoked count; the response stays backward compatible. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(share): only a confirmed email designates a recipient Recipient resolution by email accepted unconfirmed accounts, so pre-registering someone else's address (unconfirmed) was enough to receive shares meant for them once no confirmed account held it. An email now only resolves to an account that has confirmed it; username shares are unaffected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(share): accept tilde-rooted paths like the FS routes do The SDK resolves relative paths to ~/..., but the share routes never expanded the tilde — a ~-prefixed string was read as a uid and every relative-path call 404'd. Item parsing now treats ~ as path-shaped and expands it to the actor's home with the same helper the legacy FS routes use, on share, revoke, and the shares listing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(share): walk a directory revoke by parent linkage, not path prefix listByFsentrySubtree matched descendants with fsentry_id = ? OR path LIKE ?, which has two problems: fsentries.path is lazily backfilled and NULL on old rows, so those descendants' shares silently survived a directory revoke, and the OR'd predicates forced a scan of every active share. A recursive CTE over parent_id — the same shape the lineage resolver already uses — covers every descendant and runs on idx_parentId_name. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(gui): give each item its own share dialog single_instance keyed the dialog on the app id alone, so opening Share… on a second file focused the first file's dialog — typing a recipient there granted access to the wrong file, with only the title hinting at it. The dialog is now instanced per path: same item refocuses, different item opens fresh. Also stops pre-encoding the title, which UIWindow encodes again. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(permissions): let manage answer a write check A manage grant let its holder re-share a folder but not work in it: the ACL mode family stops at write, and the fs exploder had no rule for the narrowest mode, so `manage:fs:<uid>` never satisfied `fs:<uid>:write`. Fold manage into the candidate list for every non-manage mode, in both the access-token branch and the scan branch, and give `write` an (empty) exploder rule so the manage arm is emitted for it too. * fix(fs): authorize restructuring by write on the parent * fix(fs): let a share recipient work inside a shared folder rename, remove and move refused outright when the entry belonged to someone else, so a recipient with write could neither delete nor rename anything inside a folder shared with them. The GUI compounded it by hiding Delete for any item it did not own. Authorize the three by ACL write on the entry's parent. For an owner that is the same answer; for a recipient it grants the inside of a shared folder and withholds the folder itself, whose parent is the owner's private tree. Deleting sends the item to its owner's trash rather than the deleter's, so it leaves the recipient's view without leaving the owner's account and without changing hands. A move may not otherwise carry someone else's entry out of their tree. * fix(fs): give a new entry to the owner of the folder it lands in A file a share recipient added to a shared folder was recorded as theirs while living in the owner's tree, so a subtree could hold rows belonging to several people — and the storage it consumed was checked against the writer while being counted against the owner. Take the owner from the parent row at every insert, charge the allowance to that owner, and hand a moved entry over to the tree it moves into. An entry now always belongs to whoever owns the directory holding it. * feat(fs): address shared entries as ~/share/<uid> A recipient could read the owner's whole path off any shared entry — where they keep the file and what sits beside it, neither of which the share is about. Give shares their own namespace. `~/share/<entry-uid>/rel/path` resolves to the real path on the way in, and outgoing paths are rewritten to it on the way out. Entries the actor owns pass through untouched, so no existing client contract moves. * revert(fs): mask only the directory bar, not the addressing fe535d598 made `~/share/<uid>` the actual address for every shared entry. That reached far past the intent: item names became uuids, the Shared views rendered uuids instead of filenames, and navigation addressed entries through a namespace nothing else understood. Put real paths back everywhere — responses, the share listing, and request handling — and do the masking where it was wanted, in the window's directory bar. A recipient sees `Shared › Contents › sub` while every crumb keeps the real path it navigates to. The share listing now carries the entry's name, content type, owner and a signed thumbnail. A share row has no fsentry behind it for a client to stat, and the stored thumbnail is an `s3://bucket/key` URI that no client can render and none should see. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: path obfuscation, webdav + small ui stuff * test(share): assert the masked share path by its exact shape The substring check tripped on the scratch files' own names, which start with `sharing-`; the exact-equality assertion on `/<owner>/<uid>/<name>` already proves nothing above the share leaks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(share): rename policy, shared-view guards, webdav share parent, quota/bucket invariants - Rename: a directly-shared FILE renames with write on it; a shared folder root stays fixed (its name is the owner's tree structure). GUI can_rename mirrors the backend, guards all editor entry points. - Up from a share root goes to the Shared view on both surfaces; the Shared view gets a single crumb, a disabled Up button, and refuses drops, New/Paste, uploads and ctrl+V everywhere (it is a query, not a directory). - WebDAV: PROPFIND on /owner/uuid answers as a virtual collection holding the share root (ACL-gated; 404 for strangers). - Storage allowance override no longer crosses user boundaries: a recipient's plan cannot raise the owner's cap. - Overwrites stay in the bucket the entry already lives in instead of repointing to the handling server's bucket and stranding the old object. - manage mode documented as implying write (matches enforcement); share dialog label now "Can edit & share". Documented that fs socket events are owner-only. - Sidebar: saved orders gain the Shared entry once the user has shares. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(share): close review findings, and retire /auth/grant-user-user Security - Recipient writes no longer echo the owner's real path back. The pending-write event and the upload-progress meta both go to the *acting* user, so a write into a shared folder handed out the layout above the share root. - `maskerFor` failed open: the first caller fixed the actor, and one that ran before the request knew who was acting pinned `undefined` — after which every path published unmasked. It now adopts the first real actor and rebuilds for a different one. - `/auth/grant-user-user` returns 501. It wrote user-to-user grants straight to the permission tables with no share row, so nothing could list or cascade a revoke over them — and the new `manage` mode meant a delegate could reach it for the owner's files. Filesystem access goes through `/share`; nothing else is meant to pass between two users. Undocumented (its docs page was never written) and no callers. Revoking is untouched, so grants made before this can still be withdrawn. - `#assertCanManage` asks about the permission actually being granted rather than a fixed `read`, so sharing at `manage` is refused at the share layer instead of by `grantUserUserPermission` two levels down. - `listSharedWithMe` checks the grants, not just the index: withdrawing access any other way left the row publishing name, size and a signed thumbnail URL. - Moving an item into another tree now retires its shares. Grants are keyed on uuid, so they followed it and left the new owner with recipients they never agreed to. Correctness - `acl.check` gets the real path again, not the masked one. ACL matches on the path string, and a mask hides the `AppData/<appUid>` shape it needs. - "Leave this share" works for a grant that predates the index; the fallback scoped the delete to the caller as issuer, which can never match. - `move`/`copy` reject a name with a slash or a `.`/`..` segment, as `rename` already did. It matters more here: a move into the owner's Trash skips the destination write check. - Descendant walks scope by path, not by owner, so rows predating the one-owner-per-subtree invariant aren't orphaned by their parent's deletion. Performance - Index `user_to_user_permissions(permission)`. Retiring a node's grants is a prefix match, but the primary key is (issuer, holder, permission), so it was a full scan. - Retirement is coalesced and chunked. `remove()` emits one event per descendant, so deleting a directory fired one unindexed lookup per file, all at once and unawaited. - `listReaching` is a plain `fsentry_id IN (...)` on `idx_share_fsentry`. It runs behind every file write, and the join-plus-OR it replaced was unindexable. --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-08-17 09:08:23 -04:00
Parman Mohammadalizadeh	facb844747	fix: derive express subdomain offset from the configured root domain (#3575) ... Express derives `req.subdomains` by dropping a fixed number of labels from the right of the hostname, defaulting to 2. A deployment whose `domain` has more than two labels therefore reads its own root domain as an active subdomain, so the user-site redirect sends the root origin to the static hosting domain, which sends it back. Self-hosting docs recommend exactly that shape (`puter.example.com`). Set the offset from the label count of `config.domain`. Two-label domains keep the express default, so existing deployments are unchanged. Fixes #3561	2026-08-16 23:48:20 -07:00
Daniel Salazar	8ed8feed4b	fix: don't let an aborted upload take down the process (#3557)	2026-08-13 01:02:17 -07:00
Daniel Salazar	79d4201f12	fix: rate limits, AI routing, and a type-check gate (#3529) ... - declare rate + concurrency limits on every route and driver that lacked one - add acquireConcurrent for websocket connections and the DAV mount - bucket AI models by identity key only; keep resold duplicates of any vendor - skip recently-failed provider routes; cap the fallback chain at 3 attempts - let full-access access tokens bind a worker to an app their own user owns - cache resolved subscriptions so tiered limits don't add a round trip	2026-08-10 19:09:47 -07:00
Daniel Salazar	40c8d09f05	fix: PUT-1401 (#3504)	2026-08-04 16:37:33 -07:00
Daniel Salazar	116d6e6663	tests: big test push for better coverage (#3490)	2026-08-01 14:29:59 -07:00
Daniel Salazar	5a157197b6	fix: PUT-1398 (#3478)	2026-07-30 01:42:40 -07:00
Daniel Salazar	148771a82b	fix: performance degradations in app fetching + puter-js module parent class (#3460) ... * fix: centralize module methods in parent class * fix: performance degradations in app fetching	2026-07-27 23:41:51 -07:00
Daniel Salazar	e6e6e3ba9a	chore: cleanup API driver calls PUT-1324 (#3448)	2026-07-25 18:05:36 -07:00
Daniel Salazar	3a8b6394de	feat: standardized api pagination (#3412)	2026-07-20 15:58:23 -07:00