Jakob Wennberg
0ff1b05553
* feat(entitlements): partition the self-host bypass so connector capabilities fall through to grants; capability_grants.source accepts 'connector' Sovereign plan WS3 PR3: ships dark, nothing changes for hosted. - lib/entitlements/keys.ts: CONNECTOR_CAPABILITIES = bank_sync, skatteverket, org_lookup, migration (services Accounted operates that a self-hosted instance cannot provide itself) + isConnectorCapability(). Separate from PAID_CAPABILITIES and outside the trial-seed trigger on purpose: a hosted company can never hold a connector grant. - lib/entitlements/has-capability.ts: isPaywallBypassed() -> isBypassedFor(key). Hosted: byte-identical (dev / DISABLE_PAYWALL bypass, FORCE_PAYWALL wins, else the grant lookup). Self-host: local capabilities always on (FORCE_PAYWALL included, as the existing test demands); connector capabilities behave like hosted, i.e. dev bypass, FORCE_PAYWALL, else the grant lookup where the connector sync will write source='connector' rows. getCompanyEntitlements on a self-host: local paid keys + active connector keys, state 'paid' with an active connector grant else 'none' (never the hosted trial copy). - Migration 20260820122000: capability_grants.source CHECK gains 'connector', found through pg_constraint (the CHECK was declared inline and auto-named; Postgres stores IN as = ANY, matched accordingly). pg-real test: connector accepted, unknown source rejected, upsert on the (scope, key, source) identity, trial seed writes no connector rows. - Tests: self-hosted connector matrix (local all-on without DB, connector gated by grant/expiry, dev bypass all-on, FORCE_PAYWALL gates connector keys only, bulk resolution, entitlements shape); two pre-existing tests that asserted the old "self-host holds connector keys" contract updated to the new one. Verified: full unit suite green, pg-real suite for lib/entitlements green against a local supabase/postgres with every migration applied, lint ratchet, guards. Deferred to the instance-wiring PR: adding the connector extensions to the self-host Docker preset (dead-end upsells until a key can be issued). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(entitlements): fold the self-host branch into the existing grants query One .or(scopeFilter), not two: the duplicated helper pushed the no-phantom-columns unresolvable-expression count to 380/379. Behaviour is unchanged; the self-host matrix tests still pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(connect): hosted connector-key registry + validate RPC + entitlements endpoint; instance sync writes connector grants hourly Sovereign plan WS3 PR4 ("key infra enabling manual sales"), stacked on the entitlement partition (#1747). Nothing is purchasable yet; this is the plumbing both ends need before the first manually issued key. Hosted side: - Migration 20260820123000: connector_keys (SHA-256 key_hash, prefix, org_number, pinned instance_url, scopes, status, Stripe ids, current_period_end, per-minute rate limit, active_company_count, last_seen/synced) and connector_usage_events (per-request metering, separate from metered_events whose company_id references hosted companies). RLS on, NO policies: service role only. RPC validate_and_increment_connector_key copies the api_keys pattern (FOR UPDATE, minute window, suspended reported not counted, revoked = no row) and is REVOKEd from PUBLIC/anon/authenticated, GRANTed to service_role. pg-real test covers validate/count, unknown+revoked, suspended, rate limit, execute privileges per role, RLS invisibility, usage cascade. - lib/connect/contract.ts (shared wire types), lib/connect/hosted/keys.ts (generate/hash/validate -> 401/403/429 mapping), with-connector-auth.ts (Bearer or X-Connector-Key, one usage row per request, 500 envelope on handler throw), /api/connect/entitlements GET + POST (records active_company_count, pins instance_url on first report, never moves a pinned one), scripts/issue-connector-key.ts (dry run unless --confirm, prints the key once + the .env lines). Instance side: - lib/connect/instance/config.ts (GNUBOK_CONNECTOR_KEY, GNUBOK_CONNECT_URL default https://app.gnubok.se), sync.ts: reports the active company count and writes source='connector' grants for every company x covered scope, expires_at = min(now+72h, period_end+3d); 401/403 or a non-active status deletes them (freeze-and-retain); network/5xx/429 leave them alone. /api/connector/sync/cron (hourly) runs it; not_configured without a key. - Crontab generator gains EXTRA_JOBS (variant-only jobs not in vercel.json, with reasons) + drift tests; docker/crontab.self-hosted regenerated with the hourly sync. Docs (SELF-HOSTING connector section, env templates), DECISIONS. Tests: 52 new unit tests (keys, auth wrapper, route, config, sync outcomes and grant arithmetic, cron route, crontab EXTRA_JOBS) + 7 pg-real tests run locally against supabase/postgres with every migration applied. no-phantom-columns ceiling +1 with a reason (the bulk grant upsert). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(connect): update pg test to re-versioned migration 20260831190000 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb * fix(connect): RPC errors answer 503 not 401; X-Connector-Key wins over Authorization A hosted DB error mapped to 401 made the instance sync treat a pooler blip as key revocation and delete its entire connector grant cache, zeroing the 72h offline grace. 503 lands in the sync's keep-grants branch (already test-pinned). Bearer-first extraction hashed the upstream token on dual-header proxied calls, 401ing the exact shape X-Connector-Key exists for. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb * fix(connect): sync deletes grants only on a body-proven connector rejection, never bare 401/403 A WAF challenge page, edge deployment protection, or an egress proxy answers 401/403 without the hosted app ever running; trusting status alone wiped the instance's 72h offline grant cache within the hour. Deletion now requires the hosted route's own rejection code in the JSON body; codeless 401/403 keeps grants (server_error branch). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb * fix(connect): PR #1748 review batch: https-only connect URL, atomic pin, prefix-gated Bearer, deferred metering, entitlements validation, integer months - GNUBOK_CONNECT_URL must be https (http only for loopback); invalid or plaintext URLs disable the connector instead of sending the key. - instance_url pin update filters on IS NULL; a lost race re-reads and reports the winner's pin. - extractConnectorKey: a Bearer is the connector credential only with the gnubok_ck_ prefix; upstream Bearer falls through to X-Connector-Key. - Usage metering runs via after() off the response path (inline outside a request scope). - Sync validates entitlements shape: unknown status or malformed current_period_end keeps grants (server_error), never deletes. - issue-connector-key rejects fractional --months. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Emil <emilmattsson14@gmail.com>
84 lines
4.1 KiB
Bash
84 lines
4.1 KiB
Bash
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
|
|
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
|
|
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
|
|
NEXT_PUBLIC_APP_URL=https://your-domain.com
|
|
CRON_SECRET=generate-a-random-secret
|
|
|
|
# Self-hosted (Docker) flag: disables application-side MFA enforcement.
|
|
NEXT_PUBLIC_SELF_HOSTED=true
|
|
|
|
# Session timeouts are also disabled by default for self-hosted deployments.
|
|
# Uncomment to opt into hosted-style banking-app limits (milliseconds).
|
|
# Automatic logout is additionally opt-in per user (Settings > Security);
|
|
# set NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=true to enforce it for everyone.
|
|
# NEXT_PUBLIC_SESSION_IDLE_TIMEOUT_MS=1800000
|
|
# NEXT_PUBLIC_SESSION_ABSOLUTE_TIMEOUT_MS=43200000
|
|
# NEXT_PUBLIC_SESSION_WARNING_MS=120000
|
|
# NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=false
|
|
# Optional dedicated HMAC secret; otherwise SUPABASE_SERVICE_ROLE_KEY is used.
|
|
# SESSION_TIMEOUT_SECRET=
|
|
|
|
# Optional Cloudflare Turnstile site key for Supabase Auth bot protection.
|
|
# The matching secret is configured in GoTrue/Supabase Auth, never here.
|
|
# Enable provider-side enforcement only after this public key is deployed.
|
|
# NEXT_PUBLIC_TURNSTILE_SITE_KEY=
|
|
|
|
# Set to true when public signup is turned off in your GoTrue/Supabase auth
|
|
# config (GOTRUE_DISABLE_SIGNUP / "Allow new users to sign up" off). GoTrue
|
|
# offers no clean server-side read of that setting, so this flag mirrors it.
|
|
# When true, inviting a teammate who has no account provisions the account
|
|
# server-side via the auth admin invite API (GoTrue must have SMTP configured
|
|
# to deliver that mail) instead of relying on public /register, which GoTrue
|
|
# would reject with "Signups not allowed".
|
|
# The GoTrue redirect URI allow-list (URI Allow List / GOTRUE_URI_ALLOW_LIST)
|
|
# must include /invite/* or the invite email's redirect silently falls back
|
|
# to SITE_URL.
|
|
# AUTH_SIGNUPS_DISABLED=false
|
|
|
|
# Optional: WebSocket origin allowed for Supabase Realtime in the CSP.
|
|
# Defaults to NEXT_PUBLIC_SUPABASE_URL with https:// replaced by wss://
|
|
# (http:// by ws://). Set only if Realtime is served from another origin.
|
|
# NEXT_PUBLIC_SUPABASE_WS_URL=wss://your-project.supabase.co
|
|
|
|
# Optional: connector subscription for this self-hosted instance (bank sync,
|
|
# Skatteverket API, company lookup, migration run on services Accounted
|
|
# operates). Key issued by Accounted; the hourly connector sync writes the
|
|
# capability grants. See docs/SELF-HOSTING.md "Connector subscription".
|
|
# GNUBOK_CONNECTOR_KEY=
|
|
# GNUBOK_CONNECT_URL=https://app.gnubok.se
|
|
# Optional: AI features (document extraction, in-app assistant). The image
|
|
# includes the extraction extensions; set ONE backend. See
|
|
# docs/SELF-HOSTING.md "AI Features" for the full list of model overrides.
|
|
# 1. Claude via AWS Bedrock (inference stays inside the EU through the eu.
|
|
# cross-region inference profile; AWS_REGION is the API endpoint, not a pin):
|
|
# AWS_ACCESS_KEY_ID=
|
|
# AWS_SECRET_ACCESS_KEY=
|
|
# AWS_REGION=eu-north-1
|
|
# 2. Claude via the direct Anthropic API:
|
|
# ANTHROPIC_API_KEY=
|
|
# 3. Any OpenAI-compatible endpoint (e.g. a Swedish inference provider; see
|
|
# docs/SOVEREIGN.md). A model id is required. Extraction, the assistant's
|
|
# question-and-answer and categorization run here; only the specialized
|
|
# Anthropic-only conversational flows return 503 (see docs/SELF-HOSTING.md,
|
|
# What runs on any model).
|
|
# AI_BASE_URL=https://api.example.se/v1
|
|
# AI_API_KEY=
|
|
# AI_MODEL=
|
|
# AI_EXTRACTION_MODEL= # a vision model, if AI_MODEL is not one
|
|
# AI_VISION=true # false for a text-only model
|
|
# AI_PDF_MODE=auto # auto | native | rasterize (the image ships pdftoppm)
|
|
|
|
# Optional: outbound email (invoices, reminders). Pick one provider.
|
|
# 1. Resend (what hosted runs):
|
|
# RESEND_API_KEY=
|
|
# RESEND_FROM_EMAIL=
|
|
# 2. Your own SMTP relay (Swedish mail provider, M365/Workspace relay, Postfix):
|
|
# EMAIL_PROVIDER=smtp
|
|
# SMTP_HOST=
|
|
# SMTP_PORT=587
|
|
# SMTP_SECURE=false # true = implicit TLS on 465, false = STARTTLS required (set SMTP_REQUIRE_TLS=false only for a plaintext LAN relay)
|
|
# SMTP_USER=
|
|
# SMTP_PASS=
|
|
# SMTP_FROM_EMAIL=
|
|
# SMTP_REQUIRE_TLS=true # false only for a plaintext relay on a trusted LAN
|