Close Registry authorisation recovery gaps

Author: a19q3

CHANGELOG.md

@@ -10,22 +10,32 @@
   nor the resulting key ID to the browser. The publishing key is written to
   the OS keychain as `pending` before the browser opens, promoted to `active`
   only when either successful status returns the matching key ID, and removed
-  on cancellation or expiry. This closes the process-exit window after wallet
-  approval without treating local state as Registry authority. The browser
+  only after the Registry confirms cancellation or pending-session expiry. A
+  local polling deadline performs one final authoritative read and otherwise
+  preserves the pending key. Completed sessions remain poll-readable for 24
+  hours after their 15-minute approval window, closing the boundary race in
+  which wallet approval commits just before the CLI's next poll. This closes
+  the process-exit window after wallet approval without treating local state
+  as Registry authority. The browser
   token survives same-tab refresh in `sessionStorage` and is removed on
-  completion or expiry. Session mode now
+  completion or expiry, with an executable storage-lifecycle regression test.
+  Session mode now
   lists only connectors that can actually complete the browser flow and folds
   challenge creation, wallet signing, and completion into one **Approve
   publishing access** action; the full external-wallet directory remains in
   the explicit manual CLI path. Session completion atomically consumes the
   nonce, records the publishing key, claims or reviews the namespace, updates
   the session, and writes its audit trail. Concurrent or replayed completion
-  returns the committed result without duplicating authority. Submit
-  distinguishes detected in-browser connectors from the complete
-  external-signature directory, uses
-  plain publishing-access language on the first-run path, states the
-  non-replaceable release rule directly, and preserves the explicit CLI path
-  for external wallets and CI. Artifact details now derive one recommended
+  returns the committed result without duplicating authority. The Publish page
+  is now session-first: a direct visit presents one `cellc publish --authorise`
+  starting command, while a CLI session becomes a one-screen wallet approval
+  surface with one current action and end-to-end release progress. Artifact
+  identity is read-only in session mode because cellc and the manifest remain
+  authoritative. External signing, manifest scaffolding, and existing-key
+  checks remain available in a deliberately secondary advanced workspace.
+  Technical scope and session identifiers stay collapsed by default, and
+  loading, expiry, retry, review-pending, and terminal-continuation states keep
+  the same stable layout. Artifact details now derive one recommended
   action from availability, verification, deployment, and consumption state.
 - Add an isolated Pudge Testnet Registry Sandbox. Its API, Postgres database,
   object volume, signing origin, RPC identity, website build, wallet storage,

docs/CELLSCRIPT_GATE_POLICY.md

@@ -69,14 +69,19 @@ The CLI coverage includes both first-publish admission paths: the explicit
 `cellc publish` sequence, and the short-lived `cellc publish --authorise`
 browser session in which the private publishing key remains in the local OS
 keychain as pending while the CLI polls with a one-time secret, becomes active
-only after the server returns the matching key ID, and is removed on terminal
-cancellation or expiry. The browser token survives a same-tab refresh but is
-cleared after completion or expiry. Browser-session completion is one atomic admission boundary across
+only after the server returns the matching key ID, and is removed only after
+the server confirms terminal cancellation or pending-session expiry. A local
+polling deadline performs a final authoritative read and preserves the pending
+key if the result is still pending or unreachable. Completed sessions remain
+poll-readable for a bounded 24-hour recovery window. The browser token survives
+a same-tab refresh but is cleared after completion or expiry; the website build
+runs the fragment-store-refresh-clear lifecycle regression. Browser-session
+completion is one atomic admission boundary across
 nonce consumption, publishing-key registration, namespace claim/review,
 session state, and audit events. API tests cover expiry, wrong browser/poll/
 challenge tokens, challenge replay, concurrent completion, conflicting
-namespace ownership, review-pending admission, and injected mid-transaction
-failure. Publisher maintenance additionally uses the capability-signed
+namespace ownership, review-pending admission, post-expiry terminal reads, and
+injected mid-transaction failure. Publisher maintenance additionally uses the capability-signed
 `cellc artifact set-availability` path, and `cellc artifact cell-dep` performs a
 fresh mainnet liveness check before producing a transaction-builder descriptor.
 Independent reproducibility builders use `cellc auth reproducer create`; CLI

services/registry-api/README.md

@@ -176,16 +176,21 @@ registration, namespace claim or review state, session completion, and audit
 events in one store transaction. A concurrent call returns the committed
 session instead of creating a second capability use. Expired sessions, stale
 challenge tokens, and conflicting namespace owners leave the session pending
-and create none of those records.
+and create none of those records. The 15-minute expiry applies only while a
+session is pending. `authorised` and `review_pending` results remain readable
+to the polling CLI for 24 hours, then cleanup removes them; this lets a CLI
+recover a wallet approval committed immediately before the approval window
+closed.
 
 For an interactive first publish, `cellc publish --authorise` creates a
 15-minute, exact-coordinate browser session and opens the matching Registry
 site. The CLI generates the delegated P-256 key first and keeps its private key
 in the OS keychain as pending before opening the browser, then promotes it to
 active only after `authorised` or `review_pending` returns the same key ID.
-Cancellation and expiry remove the pending entry; an interrupted CLI can still
-recover the key through the key ID printed before the browser opens if the
-wallet completed first. The API stores only the public key plus hashes of separate
+Only Registry-confirmed cancellation or pending-session expiry removes the
+pending entry. A local polling deadline performs one final Registry read and
+otherwise leaves the pending key recoverable through the key ID printed before
+the browser opens. The API stores only the public key plus hashes of separate
 one-time CLI-polling and browser-approval tokens. The browser token travels in
 the URL fragment, not the query string, so it is absent from HTTP logs and
 Referer headers; browser reads never return the polling token or resulting

services/registry-api/src/index.ts

@@ -2768,7 +2768,7 @@ async function handleGetAuthorisationSession(
   sessionIdFromPath: string,
 ): Promise<Response> {
   const sessionId = validateAuthorisationSessionId(sessionIdFromPath);
-  const session = await requireLiveAuthorisationSession(store, sessionId, now);
+  const session = await requireReadableAuthorisationSession(store, sessionId, now);
   const authorization = request.headers.get("authorization");
   const token = authorization?.startsWith("Bearer ") ? authorization.slice("Bearer ".length).trim() : "";
   if (!token) throw new ApiError(401, "authorisation_session_token_required", "authorisation session bearer token is required");
@@ -2804,8 +2804,11 @@ async function handlePrepareAuthorisationSession(
 ): Promise<Response> {
   await throttleRequestSource(store, request, requestId, "authorisation_session_challenge", 60, 60, now);
   const sessionId = validateAuthorisationSessionId(sessionIdFromPath);
-  const session = await requireLiveAuthorisationSession(store, sessionId, now);
+  const session = await requireReadableAuthorisationSession(store, sessionId, now);
   await requireAuthorisationBrowserToken(request, session.browser_token_hash);
+  if (session.status !== "pending") {
+    throw new ApiError(409, "authorisation_session_complete", "authorisation session has already completed");
+  }
   if (session.registry_origin !== registryOrigin) {
     throw new ApiError(409, "authorisation_session_origin_mismatch", "authorisation session belongs to another Registry origin");
   }
@@ -2857,7 +2860,7 @@ async function handleCompleteAuthorisationSession(
 ): Promise<Response> {
   await throttleRequestSource(store, request, requestId, "authorisation_session_complete", 40, 60, now);
   const sessionId = validateAuthorisationSessionId(sessionIdFromPath);
-  const session = await requireLiveAuthorisationSession(store, sessionId, now);
+  const session = await requireReadableAuthorisationSession(store, sessionId, now);
   await requireAuthorisationBrowserToken(request, session.browser_token_hash);
   if (session.status !== "pending") {
     return json({
@@ -2928,10 +2931,10 @@ function validateAuthorisationSessionId(value: string): string {
   return sessionId;
 }
 
-async function requireLiveAuthorisationSession(store: RegistryStore, sessionId: string, now: Date) {
+async function requireReadableAuthorisationSession(store: RegistryStore, sessionId: string, now: Date) {
   const session = await store.getAuthorisationSession(sessionId);
   if (!session) throw new ApiError(404, "authorisation_session_not_found", "authorisation session was not found");
-  if (Date.parse(session.expires_at) <= now.getTime()) {
+  if (session.status === "pending" && Date.parse(session.expires_at) <= now.getTime()) {
     throw new ApiError(410, "authorisation_session_expired", "authorisation session has expired; start again from cellc");
   }
   return session;

services/registry-api/src/sql-store.ts

@@ -1,6 +1,7 @@
 import { Client } from "pg";
 import {
   assertPromotionTransition,
+  AUTHORISATION_SESSION_TERMINAL_RETENTION_HOURS,
   deriveRegistryEntryStatus,
   packageVersionRequiresReproduction,
   type AuditEventInput,
@@ -281,13 +282,13 @@ export class SqlRegistryStore implements RegistryStore {
         const sessionRow = sessionResult.rows[0];
         if (!sessionRow) throw new ApiError(404, "authorisation_session_not_found", "authorisation session was not found");
         const session = authorisationSessionFromRow(sessionRow);
-        if (Date.parse(session.expires_at) <= Date.parse(input.now_iso)) {
-          throw new ApiError(410, "authorisation_session_expired", "authorisation session has expired");
-        }
         if (session.status !== "pending") {
           await client.query("commit");
           return { session, replayed: true };
         }
+        if (Date.parse(session.expires_at) <= Date.parse(input.now_iso)) {
+          throw new ApiError(410, "authorisation_session_expired", "authorisation session has expired");
+        }
         if (session.challenge_token_hash !== input.expected_challenge_token_hash
           || !session.payload
           || canonicalJson(session.payload) !== canonicalJson(input.payload)) {
@@ -2177,7 +2178,13 @@ export class SqlRegistryStore implements RegistryStore {
       try {
         const usedNonces = await client.query("delete from used_nonces where expires_at < $1", [input.now_iso]);
         const idempotencyKeys = await client.query("delete from idempotency_keys where expires_at < $1", [input.now_iso]);
-        const authorisationSessions = await client.query("delete from authorisation_sessions where expires_at < $1", [input.now_iso]);
+        const authorisationSessions = await client.query(
+          `delete from authorisation_sessions
+           where (status = 'pending' and expires_at < $1)
+              or (status <> 'pending'
+                  and coalesce(completed_at, updated_at) < $1::timestamptz - ($2 * interval '1 hour'))`,
+          [input.now_iso, AUTHORISATION_SESSION_TERMINAL_RETENTION_HOURS],
+        );
         const quotaEvents = await client.query("delete from quota_events where created_at < $1", [input.quota_events_before_iso]);
         const expiredVersions = await client.query(
           `update package_versions

services/registry-api/src/store.ts

@@ -35,6 +35,7 @@ export interface CapabilityRecord {
 }
 
 export type AuthorisationSessionStatus = "pending" | "authorised" | "review_pending";
+export const AUTHORISATION_SESSION_TERMINAL_RETENTION_HOURS = 24;
 
 export interface AuthorisationSessionRecord {
   session_id: string;
@@ -666,10 +667,10 @@ export class MemoryRegistryStore implements RegistryStore {
     return this.withAuthorisationSessionCompletionLock("authorisation-store", async () => {
       const existing = this.authorisationSessions.get(input.session_id);
       if (!existing) throw new ApiError(404, "authorisation_session_not_found", "authorisation session was not found");
+      if (existing.status !== "pending") return { session: existing, replayed: true };
       if (Date.parse(existing.expires_at) <= Date.parse(input.now_iso)) {
         throw new ApiError(410, "authorisation_session_expired", "authorisation session has expired");
       }
-      if (existing.status !== "pending") return { session: existing, replayed: true };
       if (existing.challenge_token_hash !== input.expected_challenge_token_hash
         || !existing.payload
         || canonicalJson(existing.payload) !== canonicalJson(input.payload)) {
@@ -1405,7 +1406,12 @@ export class MemoryRegistryStore implements RegistryStore {
       }
     }
     for (const [key, record] of this.authorisationSessions.entries()) {
-      if (Date.parse(record.expires_at) < now) {
+      const terminalRetentionDeadline = Date.parse(record.completed_at ?? record.updated_at)
+        + AUTHORISATION_SESSION_TERMINAL_RETENTION_HOURS * 60 * 60 * 1000;
+      const shouldDelete = record.status === "pending"
+        ? Date.parse(record.expires_at) < now
+        : terminalRetentionDeadline < now;
+      if (shouldDelete) {
         this.authorisationSessions.delete(key);
         authorisationSessionsDeleted += 1;
       }

services/registry-api/test/registry-api.test.ts

@@ -916,6 +916,43 @@ describe("registry api", () => {
     expect(store.usedNonces.size).toBe(0);
   });
 
+  it("keeps a completed authorisation session readable after its approval window closes", async () => {
+    const store = new MemoryRegistryStore();
+    const { app } = testApp(store);
+    const { created, browserToken } = await createBrowserAuthorisationSession(app, "terminalread", "demo");
+    const challenge = await prepareBrowserAuthorisationChallenge(app, created.session_id, browserToken);
+    const completed = await completeBrowserAuthorisationSession(app, created.session_id, browserToken, challenge);
+    expect(completed.status).toBe(201);
+
+    const afterExpiry = testApp(store, undefined, {
+      now: () => new Date("2026-06-23T12:16:00Z"),
+    }).app;
+    const poll = await get(afterExpiry, `/v1/authorisation-sessions/${created.session_id}`, {}, {
+      authorization: `Bearer ${created.poll_token}`,
+    });
+
+    expect(poll.status).toBe(200);
+    expect(await poll.json()).toMatchObject({
+      status: "authorised",
+      namespace_status: "active",
+      capability_key_id: await capabilityKeyId(reproducerPublicKeys["builder-a"]),
+    });
+
+    const retained = await store.cleanupExpiredState({
+      now_iso: "2026-06-23T12:16:00.000Z",
+      quota_events_before_iso: "2026-06-22T12:16:00.000Z",
+    });
+    expect(retained.authorisation_sessions_deleted).toBe(0);
+    expect(await store.getAuthorisationSession(created.session_id)).not.toBeNull();
+
+    const purged = await store.cleanupExpiredState({
+      now_iso: "2026-06-24T12:01:00.000Z",
+      quota_events_before_iso: "2026-06-23T12:01:00.000Z",
+    });
+    expect(purged.authorisation_sessions_deleted).toBe(1);
+    expect(await store.getAuthorisationSession(created.session_id)).toBeNull();
+  });
+
   it("rejects browser, poll, and challenge token substitution", async () => {
     const { app, store } = testApp();
     const { created, browserToken } = await createBrowserAuthorisationSession(app);