4runr-os 2.10.85 → 2.10.86

package/apps/gateway/src/routes/ai-providers-simple.ts

@@ -1,220 +0,0 @@
-/**
- * AI Provider Credentials Management with Redis Persistence
- * Credentials are encrypted and stored in Redis
- */
-
-import { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
-import { getCredentialsStore } from '../ai-providers/redis-credentials-store.js';
-import { requireAuth } from '../middleware/auth.js';
-import { readRateLimit, writeRateLimit } from '../middleware/rateLimit.js';
-import { isRedisAvailable } from '../db/redis.js';
-
-// Lazy initialization - only create store when actually needed and Redis is available
-let credentialsStore: ReturnType<typeof getCredentialsStore> | null = null;
-function getStore() {
-  if (!credentialsStore) {
-    credentialsStore = getCredentialsStore();
-  }
-  return credentialsStore;
-}
-
-export async function aiProviderRoutes(fastify: FastifyInstance) {
-  fastify.post(
-    '/api/ai-providers/credentials',
-    {
-      preHandler: [requireAuth, writeRateLimit],
-    },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-      try {
-        // Check if Redis is available before trying to use credential store
-        const redisOk = await isRedisAvailable();
-        if (!redisOk) {
-          return reply.status(503).send({
-            error: 'Redis not available',
-            message: 'Credential storage requires Redis. Please configure REDIS_URL or start Redis.',
-          });
-        }
-
-        const { provider, apiKey } = (request.body || {}) as { provider?: string; apiKey?: string };
-
-        if (!provider || !apiKey) {
-          return reply.status(400).send({
-            error: 'Missing required fields',
-            required: ['provider', 'apiKey'],
-          });
-        }
-
-        await getStore().setCredential(provider, apiKey);
-
-        console.log(`[AIProviders] Credential stored in Redis: ${provider}`);
-
-        return reply.status(201).send({
-          success: true,
-          message: 'Credential stored successfully (encrypted in Redis)',
-          provider,
-          persistent: true,
-        });
-      } catch (error: unknown) {
-        const msg = error instanceof Error ? error.message : String(error);
-        console.error('[AIProviders] Error storing credential:', msg);
-        return reply.status(500).send({
-          error: 'Failed to store credential',
-          details: msg,
-        });
-      }
-    }
-  );
-
-  fastify.post(
-    '/api/ai-providers/test',
-    {
-      preHandler: [requireAuth, writeRateLimit],
-    },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-      try {
-        const redisOk = await isRedisAvailable();
-        if (!redisOk) {
-          return reply.status(503).send({
-            success: false,
-            error: 'Redis not available',
-            message: 'Credential storage requires Redis',
-          });
-        }
-
-        const { provider } = (request.body || {}) as { provider?: string };
-
-        if (!provider) {
-          return reply.status(400).send({
-            success: false,
-            error: 'Missing provider',
-            message: 'Request body must include provider',
-          });
-        }
-
-        const hasCredential = await getStore().hasCredential(provider);
-
-        if (!hasCredential) {
-          return reply.status(400).send({
-            success: false,
-            error: 'Provider not configured',
-            message: `No API key found for ${provider} in Redis`,
-          });
-        }
-
-        return reply.status(200).send({
-          success: true,
-          provider,
-          message: 'Connection test successful (key found in Redis)',
-          configured: true,
-          persistent: true,
-        });
-      } catch (error: unknown) {
-        const msg = error instanceof Error ? error.message : String(error);
-        console.error('[AIProviders] Error testing provider:', msg);
-        return reply.status(500).send({
-          error: 'Failed to test provider',
-          details: msg,
-        });
-      }
-    }
-  );
-
-  fastify.get(
-    '/api/ai-providers',
-    {
-      preHandler: [requireAuth, readRateLimit],
-    },
-    async (_request: FastifyRequest, reply: FastifyReply) => {
-      try {
-        const redisOk = await isRedisAvailable();
-        if (!redisOk) {
-          return reply.status(200).send({
-            success: true,
-            providers: [],
-            total: 0,
-            storage: 'Redis (unavailable)',
-          });
-        }
-
-        const providerList = await getStore().listProviders();
-
-        const configuredProviders = providerList.map((provider) => ({
-          provider,
-          configured: true,
-          models: getModelsForProvider(provider),
-          persistent: true,
-        }));
-
-        return reply.status(200).send({
-          success: true,
-          providers: configuredProviders,
-          total: configuredProviders.length,
-          storage: 'Redis (encrypted)',
-        });
-      } catch (error: unknown) {
-        const msg = error instanceof Error ? error.message : String(error);
-        console.error('[AIProviders] Error listing providers:', msg);
-        return reply.status(500).send({
-          error: 'Failed to list providers',
-          details: msg,
-        });
-      }
-    }
-  );
-
-  fastify.delete(
-    '/api/ai-providers/credentials/:provider',
-    {
-      preHandler: [requireAuth, writeRateLimit],
-    },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-      try {
-        const redisOk = await isRedisAvailable();
-        if (!redisOk) {
-          return reply.status(503).send({
-            error: 'Redis not available',
-            message: 'Credential storage requires Redis',
-          });
-        }
-
-        const { provider } = request.params as { provider: string };
-
-        const hasCredential = await getStore().hasCredential(provider);
-
-        if (!hasCredential) {
-          return reply.status(404).send({
-            error: 'Provider not found in Redis',
-            provider,
-          });
-        }
-
-        await getStore().deleteCredential(provider);
-
-        console.log(`[AIProviders] Credential removed from Redis: ${provider}`);
-
-        return reply.status(200).send({
-          success: true,
-          message: 'Credential removed from Redis successfully',
-          provider,
-        });
-      } catch (error: unknown) {
-        const msg = error instanceof Error ? error.message : String(error);
-        console.error('[AIProviders] Error removing credential:', msg);
-        return reply.status(500).send({
-          error: 'Failed to remove credential',
-          details: msg,
-        });
-      }
-    }
-  );
-}
-
-function getModelsForProvider(provider: string): string[] {
-  const modelMap: Record<string, string[]> = {
-    openai: ['gpt-4', 'gpt-4-turbo', 'gpt-3.5-turbo'],
-    anthropic: ['claude-3-opus-20240229', 'claude-3-sonnet-20240229', 'claude-3-haiku-20240307'],
-    google: ['gemini-pro', 'gemini-pro-vision'],
-  };
-
-  return modelMap[provider] || [];
-}

package/apps/gateway/src/routes/gdpr.ts

@@ -1,337 +0,0 @@
-/**
- * GDPR Compliance Routes
- * Data export, deletion, and retention policies
- */
-
-import { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
-import { getPrismaClient } from '../db/prisma.js';
-import { createLogger } from '@4runr/shared';
-import { z } from 'zod';
-import { requireAuth } from '../middleware/auth.js';
-import { writeRateLimit, strictRateLimit } from '../middleware/rateLimit.js';
-
-const logger = createLogger('Gateway:Routes:GDPR');
-
-/**
- * When JWT auth provides `sub`, it must match body.userId (reduces IDOR with Bearer tokens).
- */
-function assertGdprSubject(request: FastifyRequest, userId: string, reply: FastifyReply): boolean {
-  const auth = (request as { auth?: { sub?: string }; user?: { sub?: string } }).auth ||
-    (request as { user?: { sub?: string } }).user;
-  if (auth?.sub && auth.sub !== userId) {
-    reply.status(403).send({
-      error: 'forbidden',
-      message: 'userId does not match authenticated identity',
-    });
-    return false;
-  }
-  return true;
-}
-
-const deleteDataSchema = z.object({
-  userId: z.string().uuid(),
-  confirm: z.boolean().refine(val => val === true, {
-    message: 'Must confirm deletion'
-  })
-});
-
-const exportDataSchema = z.object({
-  userId: z.string().uuid()
-});
-
-/**
- * Register GDPR routes
- */
-export async function gdprRoutes(fastify: FastifyInstance) {
-  logger.info('Registering GDPR routes...');
-  
-  /**
-   * POST /api/gdpr/export
-   * Export all user data (GDPR right to data portability)
-   */
-  fastify.post(
-    '/api/gdpr/export',
-    {
-      preHandler: [requireAuth, writeRateLimit],
-    },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-    try {
-      const body = exportDataSchema.parse(request.body);
-      if (!assertGdprSubject(request, body.userId, reply)) return;
-      const prisma = await getPrismaClient();
-
-      const user = await prisma.user.findUnique({
-        where: { id: body.userId },
-        include: {
-          roles: {
-            include: {
-              role: true
-            }
-          },
-          apiKeys: true,
-          sessions: true
-        }
-      });
-
-      if (!user) {
-        return reply.status(404).send({
-          error: 'not_found',
-          message: 'User not found'
-        });
-      }
-
-      // Get all runs associated with user (via API keys)
-      const apiKeyIds = user.apiKeys.map(k => k.id);
-      // Note: Runs don't directly link to users, but we can find them via API keys
-      // This is a simplified version - adjust based on your actual schema
-
-      // Get chat history for user
-      const chatHistory = await prisma.chatHistory.findMany({
-        where: {
-          clientId: body.userId
-        }
-      });
-
-      // Compile export data
-      const exportData = {
-        user: {
-          id: user.id,
-          email: user.email,
-          username: user.username,
-          status: user.status,
-          createdAt: user.createdAt,
-          updatedAt: user.updatedAt,
-          lastLoginAt: user.lastLoginAt,
-          mfaEnabled: user.mfaEnabled
-        },
-        roles: user.roles.map(ur => ({
-          role: ur.role.name,
-          assignedAt: ur.assignedAt
-        })),
-        apiKeys: user.apiKeys.map(k => ({
-          id: k.id,
-          label: k.label,
-          createdAt: k.createdAt,
-          revoked: k.revoked,
-          revokedAt: k.revokedAt
-          // Note: Not exporting actual key for security
-        })),
-        sessions: user.sessions.map(s => ({
-          id: s.id,
-          ipAddress: s.ipAddress,
-          userAgent: s.userAgent,
-          createdAt: s.createdAt,
-          lastActivityAt: s.lastActivityAt,
-          expiresAt: s.expiresAt
-        })),
-        chatHistory: chatHistory.map(ch => ({
-          id: ch.id,
-          agentName: ch.agentName,
-          messages: ch.messages,
-          createdAt: ch.createdAt,
-          lastMessageAt: ch.lastMessageAt
-        })),
-        exportedAt: new Date().toISOString(),
-        format: 'json',
-        version: '1.0'
-      };
-
-      return reply.send(exportData);
-    } catch (error: any) {
-      logger.error('Error exporting user data', { error: error.message });
-      if (error instanceof z.ZodError) {
-        return reply.status(400).send({
-          error: 'invalid_request',
-          message: 'Invalid request body',
-          details: error.errors
-        });
-      }
-      return reply.status(500).send({
-        error: 'internal_error',
-        message: 'Failed to export user data'
-      });
-    }
-  }
-  );
-
-  /**
-   * POST /api/gdpr/delete
-   * Delete all user data (GDPR right to erasure)
-   */
-  fastify.post(
-    '/api/gdpr/delete',
-    {
-      preHandler: [requireAuth, strictRateLimit],
-    },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-    try {
-      const body = deleteDataSchema.parse(request.body);
-      if (!assertGdprSubject(request, body.userId, reply)) return;
-      const prisma = await getPrismaClient();
-
-      const user = await prisma.user.findUnique({
-        where: { id: body.userId },
-        include: {
-          apiKeys: true,
-          sessions: true
-        }
-      });
-
-      if (!user) {
-        return reply.status(404).send({
-          error: 'not_found',
-          message: 'User not found'
-        });
-      }
-
-      // Delete in order (respecting foreign key constraints)
-      
-      // 1. Delete sessions
-      await prisma.userSession.deleteMany({
-        where: { userId: body.userId }
-      });
-
-      // 2. Delete API keys
-      await prisma.apiKey.deleteMany({
-        where: { userId: body.userId }
-      });
-
-      // 3. Delete user roles
-      await prisma.userRole.deleteMany({
-        where: { userId: body.userId }
-      });
-
-      // 4. Delete chat history
-      await prisma.chatHistory.deleteMany({
-        where: { clientId: body.userId }
-      });
-
-      // 5. Anonymize or delete user
-      // Option 1: Soft delete (mark as DELETED)
-      await prisma.user.update({
-        where: { id: body.userId },
-        data: {
-          status: 'DELETED',
-          email: `deleted_${body.userId}@deleted.local`,
-          username: `deleted_${body.userId}`,
-          passwordHash: null,
-          mfaSecret: null,
-          mfaBackupCodes: [],
-          mfaEnabled: false
-        }
-      });
-
-      // Option 2: Hard delete (uncomment if preferred)
-      // await prisma.user.delete({
-      //   where: { id: body.userId }
-      // });
-
-      logger.info('User data deleted (GDPR)', { userId: body.userId });
-
-      return reply.send({
-        deleted: true,
-        message: 'User data deleted successfully',
-        deletedAt: new Date().toISOString()
-      });
-    } catch (error: any) {
-      logger.error('Error deleting user data', { error: error.message });
-      if (error instanceof z.ZodError) {
-        return reply.status(400).send({
-          error: 'invalid_request',
-          message: 'Invalid request body',
-          details: error.errors
-        });
-      }
-      return reply.status(500).send({
-        error: 'internal_error',
-        message: 'Failed to delete user data'
-      });
-    }
-  }
-  );
-
-  /**
-   * POST /api/gdpr/retention/cleanup
-   * Clean up data based on retention policies
-   */
-  fastify.post(
-    '/api/gdpr/retention/cleanup',
-    {
-      preHandler: [requireAuth, strictRateLimit],
-    },
-    async (request: FastifyRequest, reply: FastifyReply) => {
-    try {
-      const prisma = await getPrismaClient();
-      const now = new Date();
-
-      // Retention policies (in days)
-      const RETENTION_POLICIES = {
-        runs: parseInt(process.env['GDPR_RETENTION_RUNS_DAYS'] || '365'), // 1 year default
-        chatHistory: parseInt(process.env['GDPR_RETENTION_CHAT_DAYS'] || '90'), // 90 days default
-        sessions: parseInt(process.env['GDPR_RETENTION_SESSIONS_DAYS'] || '30'), // 30 days default
-        logs: parseInt(process.env['GDPR_RETENTION_LOGS_DAYS'] || '90') // 90 days default
-      };
-
-      const results = {
-        runsDeleted: 0,
-        chatHistoryDeleted: 0,
-        sessionsDeleted: 0,
-        deletedAt: now.toISOString()
-      };
-
-      // Delete old runs
-      const runsCutoff = new Date(now.getTime() - RETENTION_POLICIES.runs * 24 * 60 * 60 * 1000);
-      const deletedRuns = await prisma.run.deleteMany({
-        where: {
-          createdAt: {
-            lt: runsCutoff
-          }
-        }
-      });
-      results.runsDeleted = deletedRuns.count;
-
-      // Delete old chat history
-      const chatCutoff = new Date(now.getTime() - RETENTION_POLICIES.chatHistory * 24 * 60 * 60 * 1000);
-      const deletedChat = await prisma.chatHistory.deleteMany({
-        where: {
-          lastMessageAt: {
-            lt: chatCutoff
-          }
-        }
-      });
-      results.chatHistoryDeleted = deletedChat.count;
-
-      // Delete expired sessions
-      const sessionCutoff = new Date(now.getTime() - RETENTION_POLICIES.sessions * 24 * 60 * 60 * 1000);
-      const deletedSessions = await prisma.userSession.deleteMany({
-        where: {
-          OR: [
-            { expiresAt: { lt: now } },
-            { lastActivityAt: { lt: sessionCutoff } }
-          ]
-        }
-      });
-      results.sessionsDeleted = deletedSessions.count;
-
-      logger.info('GDPR retention cleanup completed', results);
-
-      return reply.send({
-        success: true,
-        results,
-        retentionPolicies: RETENTION_POLICIES
-      });
-    } catch (error: any) {
-      logger.error('Error running retention cleanup', { error: error.message });
-      return reply.status(500).send({
-        error: 'internal_error',
-        message: 'Failed to run retention cleanup'
-      });
-    }
-  }
-  );
-  
-  logger.info('GDPR routes registration completed', {
-    routes: ['/api/gdpr/export', '/api/gdpr/delete', '/api/gdpr/retention/cleanup']
-  });
-}
-