Release v0.2.8

Author: dxcodeagent

RELEASE.json

@@ -1,14 +1,14 @@
 {
-  "version": "0.2.7",
+  "version": "0.2.8",
   "license": "FSL-1.1-ALv2",
   "baselineSha256": "7847f65a9b20b366a60d52d19ca3cd6bdd1bb09b8cb506659a270f27a21d8877",
   "e2b": {
     "recipeSha256": "761809ee2efa2b6c750451ace29283cbb8e55b6ce3b5b14c2bb4509df71df801",
     "profileSha256": "414dbecee2d47de36016ea05c736e2edff3a0deb298babf923887ea184a01c10"
   },
   "dxd": {
-    "url": "https://github.com/dxcode-dev/dxcode/releases/download/v0.2.7/dxd-linux-x64",
-    "sha256": "2e3408e65cad33ccea13ba9f95321693cb22beb7944d5e02438184921190c700"
+    "url": "https://github.com/dxcode-dev/dxcode/releases/download/v0.2.8/dxd-linux-x64",
+    "sha256": "b793f9d2c7032e5fe3e233e40fc906b12648c3dd53969b5b7ef44d2d075d219b"
   },
   "toolchain": {
     "node": ">=22.19.0",

apps/core/migration-manifest.json

@@ -4,7 +4,8 @@
   "previousAcceptedD1Migration": "0000_baseline_v0.1.0.sql",
   "acceptedDestructiveD1Migrations": [
     "0002_release_v0.1.2.sql",
-    "0003_release_v0.2.0.sql"
+    "0003_release_v0.2.0.sql",
+    "0005_release_v0.2.8.sql"
   ],
   "d1": [
     {
@@ -31,6 +32,11 @@
       "filename": "0004_release_v0.2.7.sql",
       "sha256": "8be098b80c880ff8795e4d83da23eaac8e8d622d4c99b074aa4447a3cae1d98b",
       "classification": "non-destructive"
+    },
+    {
+      "filename": "0005_release_v0.2.8.sql",
+      "sha256": "d96a76cbee9e18c273ba6da1a57bf0ab62e77e23d4b05420e6eb8ef7cbe501d8",
+      "classification": "destructive"
     }
   ],
   "durableObjects": [

apps/core/migrations/0005_release_v0.2.8.sql

@@ -1,7 +1,7 @@
 {
   "name": "@dx/core",
   "private": true,
-  "version": "0.2.7",
+  "version": "0.2.8",
   "license": "FSL-1.1-ALv2",
   "type": "module",
   "scripts": {

apps/core/package.json

@@ -19,6 +19,10 @@ import { submissionStartupObservation } from "./observability/submission-startup
 import { projectRoutes } from "./projects/routes.js";
 import { readinessHandler } from "./readiness/handler.js";
 import { realtimeRoutes } from "./realtime/realtime-hub.js";
+import {
+  inviteAcceptRoutes,
+  publicInviteRoutes,
+} from "./settings/members/routes.js";
 import { settingsRoutes } from "./settings/routes.js";
 import { pluginTriggerIngressRoutes } from "./settings/triggers/routes.js";
 import { scheduleUsageRetention } from "./settings/usage/retention.js";
@@ -49,12 +53,14 @@ app.get("/readyz", readinessHandler);
 app.route("/api/auth", authRoutes);
 app.route("/api/workload-identity", workloadIdentityRoutes);
 app.route("/api/triggers", pluginTriggerIngressRoutes);
+app.route("/api/invites", publicInviteRoutes);
 app.route("/api/source/bitbucket/git", bitbucketGitGatewayRoutes);
 app.route("/v1/integrations/github", githubWebhookRoutes);
 app.route("/v1", threadDaemonRoutes);
 app.use("/v1/*", authenticate);
 app.use("/v1/*", authorizeApiTokenScope);
 app.route("/v1/dictation", dictationRoutes);
+app.route("/v1/invites", inviteAcceptRoutes);
 app.route("/v1/integrations/bitbucket", bitbucketControlPlaneRoutes);
 app.route("/v1/integrations/github", githubControlPlaneRoutes);
 app.route("/v1/projects", projectRoutes);

apps/core/src/app.ts

@@ -14,6 +14,7 @@ import { APIError } from "better-auth/api";
 import { organization } from "better-auth/plugins";
 import { Effect, Option, Schema } from "effect";
 import type { Bindings } from "../http/types.js";
+import { inviteSignupAdmission } from "../settings/members/service.js";
 import { cloudflareMagicLink } from "./cloudflare-magic-link.js";
 import { emailPassword } from "./email-password.js";
 import type { AuthenticationRequirements } from "./requirements.js";
@@ -53,12 +54,19 @@ const defaultAuthenticationPlugins = (
   if (browserAuthenticationMode(requirements, bindings) === "email-password") {
     return [
       requirements.environment === "selfhost"
-        ? emailPassword(undefined, selfhostSignupEnabled(bindings))
+        ? emailPassword(
+            undefined,
+            selfhostSignupEnabled(bindings),
+            bindings.DB === undefined
+              ? undefined
+              : (callbackURL) =>
+                  inviteSignupAdmission(bindings.DB, callbackURL),
+          )
         : emailPassword(undefined, true),
     ];
   }
-  if (bindings.DB === undefined)
-    throw new Error("D1 database binding is required.");
+  const db = bindings.DB;
+  if (db === undefined) throw new Error("D1 database binding is required.");
   if (bindings.EMAIL === undefined)
     throw new Error("Cloudflare email binding is required for deployed auth.");
   const from = bindings.DX_AUTH_EMAIL_FROM?.trim();
@@ -67,7 +75,9 @@ const defaultAuthenticationPlugins = (
   const magicLink = cloudflareMagicLink({
     email: bindings.EMAIL,
     from,
-    admitEmail: waitlistAdmission(bindings.DB),
+    admitEmail: async (email, callbackURL) =>
+      (await inviteSignupAdmission(db, callbackURL)) ||
+      (await waitlistAdmission(db)(email)),
     verifyRequest: async (token) => {
       const error = await Effect.runPromise(
         verifyTurnstile({
@@ -149,6 +159,7 @@ const workspaceOrganization = (bindings: Bindings) => {
 
   return organization({
     organizationLimit: 1,
+    invitationLimit: 0,
     disableOrganizationDeletion: true,
     allowUserToCreateOrganization: async (user) =>
       !(await workspaceMembershipExists(db, user.id)),
@@ -162,6 +173,17 @@ const workspaceOrganization = (bindings: Bindings) => {
       beforeAddMember: async ({ member }) => {
         await assertNoMembership(member.userId);
       },
+      // Workspaces grow only through dx invite links (settings/members).
+      beforeCreateInvitation: async () => {
+        throw new APIError("FORBIDDEN", {
+          message: "Use a workspace invite link.",
+        });
+      },
+      beforeAcceptInvitation: async () => {
+        throw new APIError("FORBIDDEN", {
+          message: "Use a workspace invite link.",
+        });
+      },
     },
   });
 };

apps/core/src/auth/better-auth.ts

@@ -7,7 +7,10 @@ export interface CloudflareMagicLinkOptions {
   readonly email: SendEmail;
   readonly from: string;
   readonly verifyRequest?: (token: string | null) => Promise<void>;
-  readonly admitEmail?: (email: string) => Promise<boolean>;
+  readonly admitEmail?: (
+    email: string,
+    callbackURL: unknown,
+  ) => Promise<boolean>;
 }
 
 const magicLinkToken = () =>
@@ -47,7 +50,7 @@ export const cloudflareMagicLink = ({
             if (
               typeof recipient === "string" &&
               admitEmail !== undefined &&
-              !(await admitEmail(recipient))
+              !(await admitEmail(recipient, context.body?.callbackURL))
             ) {
               return context.json({ status: true });
             }

apps/core/src/auth/cloudflare-magic-link.ts

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { ThreadId, UserId } from "@dx/domain";
 import { Effect, Option, Redacted, Schema } from "effect";
 import type { Bindings } from "../http/types.js";
+import { threadProjectReachableSql } from "../settings/members/membership-sql.js";
 import { createAuth } from "./better-auth.js";
 import { loadAuthenticationRequirements } from "./requirements.js";
 
@@ -94,7 +95,10 @@ export const verifyThreadDaemonApiKey = async (
     .prepare(
       `SELECT 1 AS owned
          FROM threads
-        WHERE id = ? AND owner_user_id = ? AND lifecycle_state = 'active'`,
+         JOIN projects ON projects.id = threads.project_id
+        WHERE threads.id = ? AND threads.owner_user_id = ?
+          AND threads.lifecycle_state = 'active'
+          AND ${threadProjectReachableSql("projects", "threads.owner_user_id")}`,
     )
     .bind(threadId, verified.key.referenceId)
     .first<{ readonly owned: number }>();
@@ -117,12 +121,14 @@ export const confirmThreadDaemonApiKey = async (
       `SELECT 1 AS owned
          FROM apikey
          JOIN threads ON threads.owner_user_id = apikey.referenceId
+         JOIN projects ON projects.id = threads.project_id
         WHERE apikey.id = ?
           AND apikey.configId = ?
           AND (apikey.enabled IS NULL OR apikey.enabled = 1)
           AND apikey.expiresAt IS NULL
           AND threads.id = ?
-          AND threads.lifecycle_state = 'active'`,
+          AND threads.lifecycle_state = 'active'
+          AND ${threadProjectReachableSql("projects", "threads.owner_user_id")}`,
     )
     .bind(keyId, DAEMON_KEY_CONFIG, threadId)
     .first<{ readonly owned: number }>();

apps/core/src/auth/daemon-api-key.ts

@@ -14,13 +14,14 @@ const emailDomain = (email: string) => {
 export const emailPassword = (
   allowedSignupDomain: string | undefined,
   signupEnabled = false,
+  admitInvitedSignup?: (callbackURL: unknown) => Promise<boolean>,
 ): BetterAuthPlugin => ({
   id: "dx-email-password",
   init: () => ({
     options: {
       emailAndPassword: {
         enabled: true,
-        disableSignUp: !signupEnabled,
+        disableSignUp: !signupEnabled && admitInvitedSignup === undefined,
         autoSignIn: true,
         requireEmailVerification: false,
       },
@@ -39,6 +40,14 @@ export const emailPassword = (
           ) {
             throw accountCreationUnavailable();
           }
+          // A valid workspace invite link admits sign-up when public
+          // sign-up is off.
+          if (
+            !signupEnabled &&
+            !(await admitInvitedSignup?.(context.body?.callbackURL))
+          ) {
+            throw accountCreationUnavailable();
+          }
         }),
       },
     ],

apps/core/src/auth/email-password.ts

@@ -24,7 +24,7 @@ import {
 } from "../../thread-changes/candidate.js";
 
 export const DXD_PROTOCOL_MAJOR = 2;
-export const DXD_RELEASE = "0.8.1";
+export const DXD_RELEASE = "0.8.2";
 export const DXD_TERMINAL_VERSION = 1;
 export const DXD_WORKLOAD_IDENTITY_VERSION = 1;
 export const DXD_HEARTBEAT_INTERVAL_MS = 2_000;