feat(tess): persist durable session state

apps/gateway/src/commands/command-authorization.service.ts

@@ -15,6 +15,22 @@ export interface CommandApproval {
   expiresAt: string;
 }
 
+/** Exact immutable binding for a privileged runtime termination. */
+export interface RuntimeTerminationApprovalAction {
+  providerId: string;
+  sessionId: string;
+  actorId: string;
+  tenantId: string;
+  channelId: string;
+  correlationId: string;
+}
+
+export interface RuntimeTerminationApproval extends RuntimeTerminationApprovalAction {
+  approvalId: string;
+  actionDigest: string;
+  expiresAt: string;
+}
+
 export interface CommandAuthorizationResult {
   allowed: boolean;
   reason?: string;
@@ -75,6 +91,52 @@ export class CommandAuthorizationService {
     return approval;
   }
 
+  /**
+   * Uses the same `tess:command-approval:*` store and one-time deletion rule as
+   * command approvals. This deliberately avoids a parallel approval database.
+   */
+  async createRuntimeTerminationApproval(
+    action: RuntimeTerminationApprovalAction,
+  ): Promise<RuntimeTerminationApproval | null> {
+    if (!this.hasRuntimeTerminationAction(action)) return null;
+    const role = await this.resolveRole(action.actorId);
+    if (role !== 'admin') return null;
+
+    const approval: RuntimeTerminationApproval = {
+      approvalId: randomUUID(),
+      actionDigest: this.runtimeActionDigest(action),
+      ...action,
+      expiresAt: new Date(Date.now() + 5 * 60_000).toISOString(),
+    };
+    await this.redis.set(this.key(approval.approvalId), JSON.stringify(approval), 'EX', '300');
+    return approval;
+  }
+
+  async consumeRuntimeTerminationApproval(
+    approvalId: string,
+    action: RuntimeTerminationApprovalAction,
+  ): Promise<boolean> {
+    const encoded = await this.redis.get(this.key(approvalId));
+    if (!encoded) return false;
+    let approval: unknown;
+    try {
+      approval = JSON.parse(encoded);
+    } catch {
+      return false;
+    }
+    if (
+      !this.isRuntimeTerminationApproval(approval) ||
+      approval.actionDigest !== this.runtimeActionDigest(action) ||
+      approval.actorId !== action.actorId ||
+      approval.tenantId !== action.tenantId ||
+      !this.isUnexpired(approval.expiresAt)
+    ) {
+      return false;
+    }
+    if ((await this.resolveRole(approval.actorId)) !== 'admin') return false;
+    return (await this.redis.del(this.key(approvalId))) === 1;
+  }
+
   private async resolveRole(actorId: string): Promise<CommandRole | null> {
     const [user] = await this.db
       .select({ role: usersTable.role })
@@ -98,12 +160,17 @@ export class CommandAuthorizationService {
     const key = this.key(approvalId);
     const encoded = await this.redis.get(key);
     if (!encoded) return false;
-    const parsed: unknown = JSON.parse(encoded);
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(encoded);
+    } catch {
+      return false;
+    }
     if (
-      !this.isApproval(parsed) ||
+      !this.isCommandApproval(parsed) ||
       parsed.actorId !== actorId ||
       parsed.actionDigest !== actionDigest ||
-      Date.parse(parsed.expiresAt) <= Date.now()
+      !this.isUnexpired(parsed.expiresAt)
     )
       return false;
     return (await this.redis.del(key)) === 1;
@@ -121,13 +188,62 @@ export class CommandAuthorizationService {
       .digest('hex');
   }
 
-  private isApproval(value: unknown): value is CommandApproval {
+  private hasRuntimeTerminationAction(action: RuntimeTerminationApprovalAction): boolean {
+    return [
+      action.providerId,
+      action.sessionId,
+      action.actorId,
+      action.tenantId,
+      action.channelId,
+      action.correlationId,
+    ].every((value: string): boolean => value.trim().length > 0);
+  }
+
+  private runtimeActionDigest(action: RuntimeTerminationApprovalAction): string {
+    return createHash('sha256')
+      .update(
+        JSON.stringify({
+          providerId: action.providerId,
+          sessionId: action.sessionId,
+          actorId: action.actorId,
+          tenantId: action.tenantId,
+          channelId: action.channelId,
+          correlationId: action.correlationId,
+        }),
+      )
+      .digest('hex');
+  }
+
+  private isUnexpired(expiresAt: unknown): expiresAt is string {
+    if (typeof expiresAt !== 'string') return false;
+    const expiresAtMs = Date.parse(expiresAt);
+    return Number.isFinite(expiresAtMs) && expiresAtMs > Date.now();
+  }
+
+  private isCommandApproval(value: unknown): value is CommandApproval {
     return (
       typeof value === 'object' &&
       value !== null &&
       'approvalId' in value &&
       'actionDigest' in value &&
       'actorId' in value &&
+      'expiresAt' in value &&
+      'command' in value
+    );
+  }
+
+  private isRuntimeTerminationApproval(value: unknown): value is RuntimeTerminationApproval {
+    return (
+      typeof value === 'object' &&
+      value !== null &&
+      'approvalId' in value &&
+      'actionDigest' in value &&
+      'actorId' in value &&
+      'tenantId' in value &&
+      'providerId' in value &&
+      'sessionId' in value &&
+      'channelId' in value &&
+      'correlationId' in value &&
       'expiresAt' in value
     );
   }