feat: in-app Chat (Matrix JWT SSO) + Drive (embedded oCIS)

- api: matrix-sso module (tuwunel jwt -> login/get_token), POST /matrix/session, GET /matrix/identity, drive controller
- web: /chat full-height Element view, /files Library+Drive tabs, embedded-app frame component
- edge: /hub-sso.html handshake route (origin-pinned CSP), X-Frame-Options strip on files
- oCIS: csp.yaml frame-ancestors app.occupymedia.cc
- server config still required: tuwunel [global.jwt], MATRIX_SSO_JWT_SECRET, oCIS restart

apps/api/src/matrix-sso/matrix-sso.service.ts

@@ -0,0 +1,168 @@
+import { ConflictException, Inject, Injectable, Logger, Optional, ServiceUnavailableException } from "@nestjs/common";
+import { withTenant } from "../db/client.js";
+import { loadMatrixSsoConfig, matrixUserIdFor, signSsoJwt, type MatrixSsoConfig } from "./matrix-sso.config.js";
+
+/** What the Hub tells the web client about the caller's chat identity (no secrets). */
+export interface MatrixIdentity {
+  configured: boolean;
+  homeserverUrl: string | null;
+  elementUrl: string | null;
+  /** Full MXID the Hub signs this user in as; null when SSO is not configured. */
+  userId: string | null;
+}
+
+/** A freshly minted single-use m.login.token for Element's `?loginToken=` flow. */
+export interface MatrixSession {
+  homeserverUrl: string;
+  elementUrl: string;
+  userId: string;
+  loginToken: string;
+  expiresInMs: number;
+}
+
+/** Minimal fetch surface so tests stub the homeserver without HTTP. */
+export type MatrixFetch = (url: string, init: RequestInit) => Promise<Response>;
+
+export const MATRIX_SSO_FETCH: unique symbol = Symbol("MATRIX_SSO_FETCH");
+
+/** Stable broker device: a failed logout leaves at most ONE stray device per user. */
+const BROKER_DEVICE_ID = "HUB_SSO_BROKER";
+
+function record(value: unknown): Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? (value as Record<string, unknown>) : {};
+}
+
+/** Homeserver error text WITHOUT echoing request bodies (they carry the JWT). */
+async function describe(res: Response): Promise<string> {
+  try {
+    const body = record(await res.json());
+    const errcode = typeof body.errcode === "string" ? body.errcode : "unknown";
+    return `HTTP ${res.status} ${errcode}`;
+  } catch {
+    return `HTTP ${res.status}`;
+  }
+}
+
+/**
+ * Hub → Matrix SSO. Every mint is for the session's own user: the user id is
+ * derived server-side from `users.username`, never taken from the request.
+ * Nothing minted here is logged or persisted; the broker access token lives
+ * for the duration of one request and is logged out before returning.
+ */
+@Injectable()
+export class MatrixSsoService {
+  private readonly logger = new Logger("MatrixSso");
+  private readonly fetcher: MatrixFetch;
+
+  constructor(@Optional() @Inject(MATRIX_SSO_FETCH) fetcher?: MatrixFetch) {
+    this.fetcher = fetcher ?? ((url, init) => fetch(url, init));
+  }
+
+  async identity(workspaceId: string, userId: string): Promise<MatrixIdentity> {
+    const config = loadMatrixSsoConfig();
+    if (config === null) return { configured: false, homeserverUrl: null, elementUrl: null, userId: null };
+    const mapped = matrixUserIdFor(config, await this.usernameFor(workspaceId, userId));
+    return {
+      configured: true,
+      homeserverUrl: config.homeserverUrl.origin,
+      elementUrl: config.elementUrl.origin,
+      userId: mapped?.userId ?? null,
+    };
+  }
+
+  async mintSession(workspaceId: string, userId: string): Promise<MatrixSession> {
+    const config = loadMatrixSsoConfig();
+    if (config === null) {
+      throw new ServiceUnavailableException("chat sign-in is not configured: set MATRIX_SSO_JWT_SECRET and MATRIX_SSO_HOMESERVER_URL");
+    }
+    const mapped = matrixUserIdFor(config, await this.usernameFor(workspaceId, userId));
+    if (mapped === null) throw new ConflictException("this username cannot be used as a Matrix user id");
+    return this.mintFor(config, mapped.localpart);
+  }
+
+  /** JWT login → get_token (UIA via the same JWT) → logout. Exposed for tests. */
+  async mintFor(config: MatrixSsoConfig, localpart: string): Promise<MatrixSession> {
+    const jwt = signSsoJwt(config, localpart);
+    const login = await this.call(config, "/_matrix/client/v3/login", null, {
+      type: "org.matrix.login.jwt",
+      token: jwt,
+      device_id: BROKER_DEVICE_ID,
+      initial_device_display_name: "Hub sign-in broker",
+    }, "JWT login");
+    const accessToken = login.access_token;
+    const matrixUserId = login.user_id;
+    if (typeof accessToken !== "string" || typeof matrixUserId !== "string") {
+      throw new ServiceUnavailableException("homeserver login response missing access_token/user_id");
+    }
+    try {
+      const minted = await this.call(config, "/_matrix/client/v1/login/get_token", accessToken, {
+        auth: { type: "org.matrix.login.jwt", token: jwt },
+      }, "get_token");
+      const loginToken = minted.login_token;
+      if (typeof loginToken !== "string" || loginToken === "") {
+        throw new ServiceUnavailableException("homeserver get_token response missing login_token");
+      }
+      return {
+        homeserverUrl: config.homeserverUrl.origin,
+        elementUrl: config.elementUrl.origin,
+        userId: matrixUserId,
+        loginToken,
+        expiresInMs: typeof minted.expires_in_ms === "number" ? minted.expires_in_ms : 120_000,
+      };
+    } finally {
+      await this.logout(config, accessToken);
+    }
+  }
+
+  private async call(
+    config: MatrixSsoConfig,
+    path: string,
+    accessToken: string | null,
+    json: Record<string, unknown>,
+    step: string,
+  ): Promise<Record<string, unknown>> {
+    const headers: Record<string, string> = { accept: "application/json", "content-type": "application/json" };
+    if (accessToken !== null) headers.authorization = `Bearer ${accessToken}`;
+    let res: Response;
+    try {
+      res = await this.fetcher(new URL(path, config.homeserverUrl).toString(), {
+        method: "POST",
+        headers,
+        body: JSON.stringify(json),
+        redirect: "error",
+      });
+    } catch (err) {
+      this.logger.warn(`${step} unreachable: ${err instanceof Error ? err.name : "error"}`);
+      throw new ServiceUnavailableException(`chat homeserver unreachable (${step})`);
+    }
+    if (!res.ok) {
+      const detail = await describe(res);
+      this.logger.warn(`${step} refused: ${detail}`);
+      throw new ServiceUnavailableException(`chat homeserver refused ${step} (${detail})`);
+    }
+    return record(await res.json().catch(() => null));
+  }
+
+  /** Best-effort: a stray broker device is harmless (fixed id, reused next mint). */
+  private async logout(config: MatrixSsoConfig, accessToken: string): Promise<void> {
+    try {
+      await this.fetcher(new URL("/_matrix/client/v3/logout", config.homeserverUrl).toString(), {
+        method: "POST",
+        headers: { accept: "application/json", "content-type": "application/json", authorization: `Bearer ${accessToken}` },
+        body: "{}",
+        redirect: "error",
+      });
+    } catch {
+      this.logger.warn("broker logout failed; device HUB_SSO_BROKER will be reused on the next mint");
+    }
+  }
+
+  private async usernameFor(workspaceId: string, userId: string): Promise<string> {
+    const row = await withTenant(workspaceId, (client) =>
+      client.query<{ username: string }>("SELECT username FROM users WHERE id = $1", [userId]),
+    );
+    const username = row.rows[0]?.username;
+    if (username === undefined) throw new ConflictException("no username on this account");
+    return username;
+  }
+}