actionagent 1.8.1 → 1.9.1

data/app/models/action_agent/project_secret.rb

@@ -0,0 +1,339 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # An environment variable a project's sandbox boots with, such as the
+  # app's own STRIPE_SECRET_KEY.
+  #
+  # The value is encrypted at rest. A boot hands it to the steps that run
+  # the repository's code (setup, manifest and start, see
+  # Project#boot_spec). A secret's value is never rendered back to the
+  # client, and every log, error and code-session event of the project's
+  # sandboxes is scrubbed of it. A value the setup assistant set is not
+  # secret, so it is shown and not scrubbed.
+  #
+  # A secret has one of three sources:
+  #
+  #   entered           a value someone typed in: into the project's secrets
+  #                     form, or as the answer to the setup assistant's
+  #                     request_secret
+  #   organization_key  the owner's stored provider key for +provider+,
+  #                     resolved at boot and never copied here. Taking it
+  #                     needs the consent of whoever set the secret, because
+  #                     the repository's code can read it.
+  #   setup_assistant   a value that is not secret, set by the setup
+  #                     assistant's set_env (see ProjectSetup)
+  #
+  # And one of three kinds. Only an env secret reaches the sandbox's
+  # environment; the other two are read by the engine alone, when the
+  # project's browser signs in to the app:
+  #
+  #   env            an environment variable a boot sets
+  #   sign_in        a JSON object the explorer's sign_in tool fills a login
+  #                  form with (see #sign_in_credentials)
+  #   storage_state  a Playwright storage state (cookies and localStorage)
+  #                  the project's browser starts with, saved from a browser
+  #                  someone signed in by hand
+  class ProjectSecret < ApplicationRecord
+    include Ownable
+    owned_by :account, :user
+
+    SOURCES = %w[entered organization_key setup_assistant].freeze
+    KINDS = %w[env sign_in storage_state].freeze
+    # The sign-in fields a sign_in secret may hold. login_url is a path on
+    # the app; the *_field entries are CSS selectors for when the form's
+    # fields cannot be found on their own.
+    SIGN_IN_FIELDS = %w[login_url login password login_field password_field submit_field].freeze
+    MAX_SELECTOR_LENGTH = 200
+    # A storage state's values are scrubbed only when they look like a
+    # credential: an httpOnly cookie's, or one at least this long. Shorter
+    # values are preferences such as "accepted" or "expanded", which ordinary
+    # page text also holds.
+    STORAGE_SECRET_MIN_LENGTH = 20
+    # A storage state is kept in the value column (text), encrypted; its
+    # ciphertext must still fit there.
+    MAX_STORAGE_STATE_LENGTH = 40_000
+    # The variables "Use the organization's key" is offered for, with the
+    # stored provider key each one reads.
+    ORGANIZATION_KEY_PROVIDERS = {
+      "OPENAI_API_KEY" => "openai",
+      "ANTHROPIC_API_KEY" => "anthropic",
+      "OPENROUTER_API_KEY" => "openrouter"
+    }.freeze
+    # Live-mode credential prefixes (Stripe's secret and restricted keys).
+    LIVE_PREFIXES = %w[sk_live_ rk_live_].freeze
+    MAX_VALUE_LENGTH = 10_000
+
+    belongs_to :project, class_name: "ActionAgent::Project"
+
+    encrypts :value if ActionAgent.encrypt_credentials
+
+    validates :name, presence: true, length: { maximum: 255 }, format: { with: SandboxBootSpec::ENV_NAME, message: "must be an environment variable name" }
+    validates :name, uniqueness: { scope: :project_id, case_sensitive: true }
+    validates :source, inclusion: { in: SOURCES }
+    validates :kind, inclusion: { in: KINDS }
+    validate :name_allowed
+    validate :value_matches_source
+    validate :value_matches_kind
+    validate :kind_unchanged, on: :update
+
+    scope :ordered, -> { order(:name) }
+    scope :env, -> { where(kind: "env") }
+    scope :sign_in, -> { where(kind: "sign_in") }
+    scope :storage_state, -> { where(kind: "storage_state") }
+
+    # Whether +name+ is one the backend sets itself or one that changes how
+    # Ruby, Bundler, Node or git load code (SandboxBootSpec::REFUSED_SECRET_NAME).
+    def self.refused_name?(name)
+      SandboxBootSpec::REFUSED_SECRET_NAME.match?(name.to_s)
+    end
+
+    # What the secrets form warns about for +name+ set to +value+, before it
+    # is saved: [{ code:, message: }]. A warning never stops a save.
+    #
+    #   live_credential   a live-mode key, where a test key belongs
+    #   short_value       under SecretScrubber::MIN_SECRET_LENGTH characters,
+    #                     so logs cannot mask it
+    #   rails_master_key  RAILS_MASTER_KEY, better a development or test
+    #                     credentials key than production's
+    def self.warnings_for(name, value)
+      warnings = []
+      text = value.to_s
+      if LIVE_PREFIXES.any? { |prefix| text.start_with?(prefix) }
+        warnings << { code: "live_credential",
+                      message: "This looks like a live-mode key. A sandbox runs the repository's code with it: use a test-mode key." }
+      end
+      if text.present? && text.length < SecretScrubber::MIN_SECRET_LENGTH
+        warnings << { code: "short_value",
+                      message: "Values under #{SecretScrubber::MIN_SECRET_LENGTH} characters cannot be masked in logs." }
+      end
+      if name.to_s == "RAILS_MASTER_KEY"
+        warnings << { code: "rails_master_key",
+                      message: "Prefer the key of development or test credentials over production's." }
+      end
+      warnings
+    end
+
+    def organization_key?
+      source == "organization_key"
+    end
+
+    # Whether the value is not secret: one the setup assistant set.
+    def plain?
+      source == "setup_assistant"
+    end
+
+    def env?
+      kind == "env"
+    end
+
+    def sign_in?
+      kind == "sign_in"
+    end
+
+    def storage_state?
+      kind == "storage_state"
+    end
+
+    # A sign_in secret's fields: login_url (a path on the app, "/" when
+    # unset), login, password and the optional *_field selectors. Empty for
+    # any other secret, or a value that is not a JSON object.
+    #
+    # @return [Hash{String => String}]
+    def sign_in_credentials
+      return {} unless sign_in?
+
+      parsed = parse_json_object(value) || {}
+      fields = parsed.slice(*SIGN_IN_FIELDS).select { |_name, field| field.is_a?(String) && field.present? }
+      fields["login_url"] = "/" if fields["login_url"].blank?
+      fields
+    end
+
+    # A storage_state secret's state as Playwright reads it, or nil.
+    #
+    # @return [Hash, nil]
+    def storage_state_value
+      storage_state? ? parse_json_object(value) : nil
+    end
+
+    # The values a sandbox's output, a candidate or a recording is scrubbed
+    # of for this secret:
+    #
+    #   env            its value, the organization's key resolved; none
+    #                  once that key is gone
+    #   sign_in        its value and the password apart. The login is an
+    #                  account name the app shows and mails, so it is kept.
+    #   storage_state  its value, and each cookie and localStorage value
+    #                  that looks like a credential (STORAGE_SECRET_MIN_LENGTH)
+    #
+    # @return [Array<String>]
+    def scrub_parts
+      case kind
+      when "sign_in"
+        [ value, sign_in_credentials["password"] ].compact
+      when "storage_state"
+        [ value, *storage_state_credentials ].compact.map(&:to_s)
+      else
+        [ resolved_value ].compact
+      end
+    rescue ActiveRecord::RecordNotFound
+      []
+    end
+
+    # The value a boot sets the variable to: the entered value, or the
+    # owner's stored provider key.
+    #
+    # @raise [ActiveRecord::RecordNotFound] when the organization's key is
+    #   no longer stored
+    def resolved_value
+      return value unless organization_key?
+
+      key = organization_provider_key or
+        raise ActiveRecord::RecordNotFound, "#{name} uses the organization's #{provider} key, which is no longer stored: " \
+          "add it in Settings, or enter #{name} for this project"
+      key.credential
+    end
+
+    def warnings
+      return self.class.warnings_for(nil, sign_in_credentials["password"]) if sign_in?
+      return [] if storage_state?
+
+      self.class.warnings_for(name, organization_key? ? nil : value)
+    end
+
+    # The owner's stored provider key for +provider+, or nil. Looked up
+    # through ProviderKey's own owner column, which is the project's: both
+    # models are owned by the account first. An install that also stores
+    # members' personal keys keeps the organization's under scope_key
+    # "organization", and only those are read.
+    def organization_provider_key
+      return nil unless ProviderKey::KEY_PROVIDERS.include?(provider)
+
+      scope = ProviderKey.where(provider: provider)
+      scope = scope.where(scope_key: "organization") if ProviderKey.column_names.include?("scope_key")
+      case ProviderKey.owner_association
+      when :account then project.account_id && scope.find_by(account_id: project.account_id)
+      when :user then project.user_id && scope.find_by(user_id: project.user_id)
+      else scope.first
+      end
+    end
+
+    # The secret as the Environment tab lists it. Only a value that is not
+    # secret (#plain?) is included, so a person can see what the setup
+    # assistant set.
+    #
+    # @param setters [Hash{Integer => Object}] users by id, for set_by
+    def as_summary(setters = {})
+      setter = set_by_id && setters[set_by_id]
+      summary = {
+        name: name,
+        kind: kind,
+        source: source,
+        provider: provider,
+        set_by: setter && { id: setter.id, name: self.class.display_name(setter) },
+        updated_at: updated_at&.iso8601
+      }
+      summary[:value] = value if plain?
+      summary
+    end
+
+    def self.display_name(user)
+      user.try(:display_name) || user.try(:name) || user.try(:email_address) || user.try(:email)
+    end
+
+    private
+
+    def name_allowed
+      return if name.blank?
+
+      if self.class.refused_name?(name)
+        errors.add(:name, "#{name} is set by the sandbox or changes how code is loaded, so a project cannot set it")
+      elsif env? && [ Project::SIGN_IN_SECRET, Project::STORAGE_STATE_SECRET ].include?(name)
+        errors.add(:name, "#{name} keeps the project's sign-in, so an environment variable cannot take it")
+      end
+    end
+
+    def value_matches_source
+      if organization_key?
+        expected = ORGANIZATION_KEY_PROVIDERS[name]
+        if expected.nil?
+          errors.add(:source, "organization_key is offered only for #{ORGANIZATION_KEY_PROVIDERS.keys.join(", ")}")
+        elsif provider != expected
+          errors.add(:provider, "must be #{expected} for #{name}")
+        end
+        errors.add(:base, "Using the organization's key needs consent to the repository's code reading it") if consented_at.nil?
+        errors.add(:value, "must be empty when the organization's key is used") if value.present?
+        if expected && provider == expected && organization_provider_key.nil?
+          errors.add(:base, "The organization has no #{provider} key to use for #{name}")
+        end
+      elsif value.blank?
+        errors.add(:value, "can't be blank")
+      elsif value.length > max_value_length || value.include?("\0")
+        errors.add(:value, "must be text of at most #{max_value_length} characters")
+      end
+    end
+
+    def max_value_length
+      storage_state? ? MAX_STORAGE_STATE_LENGTH : MAX_VALUE_LENGTH
+    end
+
+    def value_matches_kind
+      return if env? || value.blank?
+
+      errors.add(:source, "must be entered for a #{kind} secret") if organization_key?
+      if sign_in?
+        validate_sign_in
+      elsif storage_state?
+        state = storage_state_value
+        unless state && state["cookies"].is_a?(Array) && (state["origins"].nil? || state["origins"].is_a?(Array))
+          errors.add(:value, "must be a storage state: a JSON object with a cookies list")
+        end
+      end
+    end
+
+    def validate_sign_in
+      fields = parse_json_object(value)
+      return errors.add(:value, "must be a JSON object with login_url, login and password") unless fields
+
+      errors.add(:value, "needs a password") unless fields["password"].is_a?(String) && fields["password"].present?
+      unless fields["login_url"].blank? || SandboxBootSpec.start_url_path?(fields["login_url"].to_s)
+        errors.add(:value, "login_url must be a path on the app, such as /users/sign_in")
+      end
+      %w[login_field password_field submit_field].each do |field|
+        selector = fields[field]
+        next if selector.nil?
+
+        unless selector.is_a?(String) && selector.length <= MAX_SELECTOR_LENGTH && !selector.match?(/[\r\n\0]/)
+          errors.add(:value, "#{field} must be a CSS selector of at most #{MAX_SELECTOR_LENGTH} characters")
+        end
+      end
+    end
+
+    def storage_state_credentials
+      state = storage_state_value || {}
+      cookies = Array(state["cookies"]).filter_map do |cookie|
+        next unless cookie.is_a?(Hash)
+
+        cookie["value"].to_s if cookie["httpOnly"] == true || cookie["value"].to_s.length >= STORAGE_SECRET_MIN_LENGTH
+      end
+      stored = Array(state["origins"]).flat_map do |origin|
+        next [] unless origin.is_a?(Hash)
+
+        Array(origin["localStorage"]).filter_map do |item|
+          item["value"].to_s if item.is_a?(Hash) && item["value"].to_s.length >= STORAGE_SECRET_MIN_LENGTH
+        end
+      end
+      cookies + stored
+    end
+
+    def kind_unchanged
+      errors.add(:kind, "cannot change: remove #{name} and set it again") if kind_changed?
+    end
+
+    def parse_json_object(text)
+      parsed = JSON.parse(text.to_s)
+      parsed.is_a?(Hash) ? parsed : nil
+    rescue JSON::ParserError
+      nil
+    end
+  end
+end

data/app/models/action_agent/provider_key.rb

@@ -18,6 +18,19 @@ module ActionAgent
   # need it — a checkout sandbox runs Claude Code sessions with it — through
   # #runtime_environment. For Claude Code that is an Anthropic API key only
   # (see CLAUDE_CODE_CREDENTIAL).
+  #
+  # A key is an organization key or a personal key, as its scope_key says:
+  #
+  #   "organization"  the key the owner shares with everyone acting for it
+  #   "user:<id>"     one member's own key for an account, used for that
+  #                   member's runs when ActionAgent.provider_key_scope is
+  #                   :personal_override
+  #
+  # Personal keys exist only on an install that owns keys per account. They
+  # are left out of .for_owner and the dashboard API's `owned`, so a caller
+  # that looks a key up by owner and provider reads the organization's.
+  # .personal_for is the one way to reach them, and
+  # ActionAgent::ProviderCredentials decides when to.
   class ProviderKey < ApplicationRecord
     # Providers that authenticate with an API key.
     KEY_PROVIDERS = %w[openai anthropic openrouter].freeze
@@ -43,6 +56,14 @@ module ActionAgent
     # a stored one is never handed out (see #needs_replacing?).
     SUBSCRIPTION_TOKEN_PREFIX = "sk-ant-oat"
 
+    ORGANIZATION_SCOPE = "organization"
+    PERSONAL_SCOPE_PREFIX = "user:"
+    SCOPE_KEY = /\A(?:organization|user:\d+)\z/
+
+    # Resolver options that point a provider somewhere other than its public
+    # endpoint — a proxy or gateway whose key is meant for that endpoint only.
+    ENDPOINT_OPTIONS = %w[uri_base base_url api_base host].freeze
+
     include Ownable
     owned_by :account, :user
 
@@ -54,8 +75,13 @@ module ActionAgent
     before_validation :normalize_host_credential, if: :host_based?
 
     validates :provider, presence: true, inclusion: { in: PROVIDERS }
-    # One credential per provider per owner; which column that means
-    # depends on the configured mode, so it is checked at validation time.
+    validates :scope_key, format: { with: SCOPE_KEY }
+    validate :personal_key_allowed, if: :personal?
+    # One organization credential per provider per owner, and one personal
+    # credential per member, owner and provider. The unique index on
+    # (account_id, scope_key, provider) holds the same rule for an
+    # account-owned install; which owner column applies depends on the
+    # configured mode, so it is also checked at validation time.
     validate :provider_unique_within_owner
     validates :credential, presence: true, length: { maximum: 500 }
     validates :credential, format: { with: %r{\Ahttps?://\S+\z}, message: "must be an http(s):// URL" },
@@ -83,6 +109,58 @@ module ActionAgent
       end
     end
 
+    # The organization rows: .for_owner and the dashboard API's `owned` read
+    # only these.
+    def self.owned_rows
+      where(scope_key: ORGANIZATION_SCOPE)
+    end
+
+    # +actor+'s personal keys for +owner+'s account. None when +actor+ is not
+    # a saved instance of ActionAgent.user_class, when +owner+ does not
+    # resolve to an account, or when keys are not owned per account (a
+    # single-user install, or one that owns keys per user), where no
+    # personal key can exist.
+    #
+    # @return [ActiveRecord::Relation]
+    def self.personal_for(owner, actor)
+      return none unless owner_association == :account
+
+      user_class = owner_class_for(:user)
+      return none unless user_class && actor.is_a?(user_class) && actor.id.present?
+
+      account = resolve_owner(owner)
+      return none if account.nil?
+
+      unscoped_by_owner.where(account_id: account.id, scope_key: personal_scope_key(actor))
+    end
+
+    # Every key +owner+'s account holds, organization and personal. Only for
+    # masking secrets out of output: a credential is read through .for_owner
+    # or .personal_for.
+    #
+    # @return [ActiveRecord::Relation]
+    def self.every_scope_for(owner)
+      return for_owner(owner) unless owner_association == :account
+
+      account = resolve_owner(owner)
+      account ? unscoped_by_owner.where(account_id: account.id) : none
+    end
+
+    # Whether this install keeps personal keys: ActionAgent.provider_key_scope
+    # is :personal_override and keys are owned per account.
+    def self.personal_keys_enabled?
+      ActionAgent.provider_key_scope == :personal_override && owner_association == :account
+    end
+
+    def self.personal_scope_key(actor)
+      "#{PERSONAL_SCOPE_PREFIX}#{actor.id}"
+    end
+
+    def self.unscoped_by_owner
+      unscope(where: :scope_key)
+    end
+    private_class_method :unscoped_by_owner
+
     def self.kind_of_provider(provider)
       if HOST_PROVIDERS.include?(provider) then "host"
       elsif CONNECTION_PROVIDERS.include?(provider) then "connection"
@@ -108,10 +186,119 @@ module ActionAgent
       host
     end
 
+    class << self
+      # The API keys for +owner+, `{ "openai" => "sk-...", ... }` — one entry
+      # per KEY_PROVIDERS provider that has one. Host-addressed providers
+      # (ollama) are left out: their credential is a URL, not a key.
+      #
+      # Each key is looked up in the order generation runs use: the host's
+      # `ActionAgent.provider_credentials_resolver`, asked with +owner+, and
+      # only when it answers nothing for a provider, the owner's saved row.
+      # A resolver answer leaves the provider out when it carries no key
+      # (`api_key`/`access_token`) — a run would then use the host's own
+      # configuration — or when it also sends the provider to another
+      # endpoint (ENDPOINT_OPTIONS), since a gateway's key must not reach the
+      # public endpoint a RubyLLM config would pair it with.
+      #
+      # On an install with an owner model, +owner+ must be an instance of the
+      # model this install keeps provider keys by — the configured
+      # `account_class`, or `user_class` when there is none — because rows
+      # are scoped by its id alone, and another model's id would read someone
+      # else's keys. Anything else raises ArgumentError. A nil owner reads no
+      # saved rows (only the resolver's keys), and an install with no owner
+      # model reads every saved row.
+      #
+      # A saved credential that no longer decrypts (a key rotation the row
+      # missed) is skipped with a warning rather than raised, so one stale row
+      # does not take every provider down with it. The warning names the
+      # error class only, never the value.
+      #
+      # @param owner [Object, nil] an instance of the owner model, or nil
+      # @return [Hash{String => String}]
+      # @raise [ArgumentError] when +owner+ is not an instance of the owner model
+      def credentials_for(owner)
+        owner = owner_record(owner)
+        saved = nil
+
+        KEY_PROVIDERS.sort.each_with_object({}) do |provider, credentials|
+          from_host = ActionAgent.provider_credentials(owner, provider)
+          credential = if from_host.present?
+            key_from(from_host)
+          else
+            (saved ||= saved_credentials(owner))[provider]
+          end
+          credentials[provider] = credential if credential.present?
+        end
+      end
+
+      # Writes the owner's keys onto `config` through `<provider>_api_key=`
+      # writers, the shape a `RubyLLM.context { |config| ... }` block hands
+      # out — but any object with those writers will do, so the engine gains
+      # no RubyLLM dependency:
+      #
+      #   context = RubyLLM.context { |config| ActionAgent::ProviderKey.apply_to(config, owner: account) }
+      #
+      # Only providers with a key are written; the rest keep whatever the
+      # config already held (for a `RubyLLM.context`, the host's global keys).
+      #
+      # @param config [Object] anything answering to `openai_api_key=` and friends
+      # @param owner [Object, nil] as for #credentials_for
+      # @return [Array<String>] the providers written — never the keys, so the
+      #   return value is safe to log
+      def apply_to(config, owner:)
+        credentials_for(owner).map do |provider, credential|
+          config.public_send(:"#{provider}_api_key=", credential)
+          provider
+        end
+      end
+
+      private
+
+      # +owner+ itself — unwrapped from a SimpleDelegator-style decorator —
+      # once it is known to be an instance of the owner model.
+      def owner_record(owner)
+        owner = owner.__getobj__ while defined?(::Delegator) && owner.is_a?(::Delegator)
+        association = owner_association
+        return owner if owner.nil? || association.nil?
+
+        class_name = ActionAgent.public_send(Ownable::CLASS_FOR.fetch(association))
+        owner_class = class_name.to_s.safe_constantize
+        raise ArgumentError, "provider keys are kept per #{association}, but #{class_name} does not load" if owner_class.nil?
+        return owner if owner.is_a?(owner_class)
+
+        raise ArgumentError,
+              "this install keeps provider keys per #{association} (#{class_name}), but was given a #{owner.class.name}"
+      end
+
+      def saved_credentials(owner)
+        for_owner(owner).where(provider: KEY_PROVIDERS).each_with_object({}) do |key, credentials|
+          credentials[key.provider] = key.credential
+        rescue StandardError => e
+          Rails.logger.warn("[ProviderKey] skipping #{key.provider} credential ##{key.id}: #{e.class.name}")
+        end
+      end
+
+      # The key a resolver answer carries, in the order the providers' own
+      # options read it (`api_key`, then `access_token`), or nil when it
+      # carries none or sends the provider to another endpoint.
+      def key_from(options)
+        return unless options.respond_to?(:to_hash)
+
+        options = options.to_hash.stringify_keys
+        return if ENDPOINT_OPTIONS.any? { |name| options[name].present? }
+
+        options["api_key"].presence || options["access_token"].presence
+      end
+    end
+
     def host_based?
       HOST_PROVIDERS.include?(provider)
     end
 
+    def personal?
+      scope_key.to_s.start_with?(PERSONAL_SCOPE_PREFIX)
+    end
+
     def connection?
       CONNECTION_PROVIDERS.include?(provider)
     end
@@ -187,10 +374,20 @@ module ActionAgent
       self.api_key = api_key.presence&.strip
     end
 
+    # A personal key needs an account to belong to, and is never a connection
+    # credential: those are handed to sandboxes, which every member shares.
+    def personal_key_allowed
+      if self.class.owner_association != :account || account_id.nil?
+        errors.add(:scope_key, "can name a member only when keys are owned per account")
+      elsif connection?
+        errors.add(:provider, "cannot be a personal key: #{provider} is connected for the whole organization")
+      end
+    end
+
     def provider_unique_within_owner
       return if provider.blank?
 
-      siblings = self.class.for_owner(owner)
+      siblings = personal? ? self.class.where(account_id: account_id, scope_key: scope_key) : self.class.for_owner(owner)
       siblings = siblings.where.not(id: id) if persisted?
       errors.add(:provider, "has already been taken") if siblings.exists?(provider: provider)
     end