@agenticmail/enterprise 0.5.327 → 0.5.328

package/src/dashboard/components/transport-encryption.js

@@ -1,288 +0,0 @@
-/**
- * Transport Encryption — Dashboard Client
- *
- * Encrypts outgoing requests and decrypts incoming responses
- * for sensitive API endpoints. Uses Web Crypto API (AES-256-CBC).
- *
- * Must use the same key derivation as the server middleware.
- */
-
-// ─── State ────────────────────────────────────────────────
-
-var _enabled = false;
-var _encKey = null;   // CryptoKey for AES
-var _hmacKey = null;  // CryptoKey for HMAC
-var _keyReady = false;
-var _keyReadyPromise = null;  // Resolves when keys are derived
-var _keyReadyResolve = null;
-
-// ─── Key derivation (must match server) ───────────────────
-
-async function sha256(input) {
-  var data = new TextEncoder().encode(input);
-  var hash = await crypto.subtle.digest('SHA-256', data);
-  return new Uint8Array(hash);
-}
-
-async function deriveKeys() {
-  if (_keyReady) return;
-
-  // Fetch the encryption config from server — use XMLHttpRequest to bypass
-  // the fetch interceptor (we can't encrypt/decrypt without keys yet)
-  var resp = await new Promise(function(resolve, reject) {
-    var xhr = new XMLHttpRequest();
-    xhr.open('GET', '/api/engine/transport-encryption/client-key');
-    xhr.withCredentials = true;
-    xhr.onload = function() { resolve({ ok: xhr.status >= 200 && xhr.status < 300, status: xhr.status, json: function() { return Promise.resolve(JSON.parse(xhr.responseText)); } }); };
-    xhr.onerror = function() { reject(new Error('XHR failed')); };
-    xhr.send();
-  });
-  if (!resp.ok) { _enabled = false; return; }
-  var cfg = await resp.json();
-  if (!cfg.keyToken) { _enabled = false; return; }
-
-  var salt = 'agenticmail-transport-v1';
-  var encRaw = await sha256(cfg.keyToken + ':' + salt + ':enc');
-  var hmacRaw = await sha256(cfg.keyToken + ':' + salt + ':hmac');
-
-  _encKey = await crypto.subtle.importKey('raw', encRaw, { name: 'AES-CBC' }, false, ['encrypt', 'decrypt']);
-  _hmacKey = await crypto.subtle.importKey('raw', hmacRaw, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign', 'verify']);
-  _keyReady = true;
-}
-
-// ─── Helpers ──────────────────────────────────────────────
-
-function bufToHex(buf) {
-  return Array.from(new Uint8Array(buf)).map(function(b) { return b.toString(16).padStart(2, '0'); }).join('');
-}
-
-function hexToBuf(hex) {
-  var bytes = new Uint8Array(hex.length / 2);
-  for (var i = 0; i < hex.length; i += 2) bytes[i / 2] = parseInt(hex.substr(i, 2), 16);
-  return bytes;
-}
-
-function bufToBase64(buf) {
-  var bytes = new Uint8Array(buf);
-  var str = '';
-  for (var i = 0; i < bytes.length; i++) str += String.fromCharCode(bytes[i]);
-  return btoa(str);
-}
-
-function base64ToBuf(b64) {
-  var str = atob(b64);
-  var bytes = new Uint8Array(str.length);
-  for (var i = 0; i < str.length; i++) bytes[i] = str.charCodeAt(i);
-  return bytes;
-}
-
-async function sha256Hex(input) {
-  var hash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(input));
-  return bufToHex(hash);
-}
-
-async function hmacSign(data) {
-  var sig = await crypto.subtle.sign('HMAC', _hmacKey, new TextEncoder().encode(data));
-  return bufToHex(sig).slice(0, 32);
-}
-
-// ─── Encrypt / Decrypt ────────────────────────────────────
-
-export async function encryptPayload(data) {
-  if (!_keyReady) await deriveKeys();
-  if (!_keyReady) return null; // Encryption not available
-
-  var plaintext = typeof data === 'string' ? data : JSON.stringify(data);
-  var iv = crypto.getRandomValues(new Uint8Array(16));
-  var encoded = new TextEncoder().encode(plaintext);
-
-  var ciphertext = await crypto.subtle.encrypt({ name: 'AES-CBC', iv: iv }, _encKey, encoded);
-  var cs = (await sha256Hex(plaintext)).slice(0, 16);
-  var ts = Date.now();
-  var ivHex = bufToHex(iv);
-  var dataB64 = bufToBase64(ciphertext);
-
-  var sigInput = ivHex + ':' + dataB64 + ':' + ts + ':' + cs;
-  var sig = await hmacSign(sigInput);
-
-  var payload = { v: 1, iv: ivHex, d: dataB64, ts: ts, cs: cs, sig: sig };
-  return btoa(JSON.stringify(payload));
-}
-
-export async function decryptPayload(encoded) {
-  if (!_keyReady) await deriveKeys();
-  if (!_keyReady) throw new Error('Encryption keys not available');
-
-  var json = atob(encoded);
-  var payload = JSON.parse(json);
-  if (payload.v !== 1) throw new Error('Unsupported encryption version');
-
-  // Verify HMAC
-  var sigInput = payload.iv + ':' + payload.d + ':' + payload.ts + ':' + payload.cs;
-  var expectedSig = await hmacSign(sigInput);
-  if (payload.sig !== expectedSig) throw new Error('Invalid signature');
-
-  // Decrypt
-  var iv = hexToBuf(payload.iv);
-  var ciphertext = base64ToBuf(payload.d);
-  var decrypted = await crypto.subtle.decrypt({ name: 'AES-CBC', iv: iv }, _encKey, ciphertext);
-  var plaintext = new TextDecoder().decode(decrypted);
-
-  // Verify checksum
-  var cs = (await sha256Hex(plaintext)).slice(0, 16);
-  if (cs !== payload.cs) throw new Error('Data integrity check failed');
-
-  try { return JSON.parse(plaintext); } catch(e) { return plaintext; }
-}
-
-// ─── Fetch interceptor ────────────────────────────────────
-
-var _sensitivePatterns = [];
-
-// Endpoint groups (must match server ENDPOINT_GROUPS)
-var ENDPOINT_GROUPS = {
-  settings:      ['/api/settings', '/api/settings/*'],
-  models:        ['/api/settings/models', '/api/llm-keys', '/api/llm-keys/*'],
-  auth:          ['/api/auth/*', '/api/login', '/api/users', '/api/users/*'],
-  agents:        ['/bridge/agents/*'],
-  email:         ['/bridge/agents/*/email-config', '/api/settings/email', '/api/email/*'],
-  database:      ['/api/database-access', '/api/database-access/*', '/api/database/connections', '/api/database/connections/*'],
-  vault:         ['/api/vault', '/api/vault/*'],
-  integrations:  ['/api/org-integrations', '/api/org-integrations/*', '/api/organizations/*/integrations'],
-  skills:        ['/api/skills/*', '/community/*'],
-  organizations: ['/api/organizations', '/api/organizations/*'],
-  knowledge:     ['/api/knowledge-bases', '/api/knowledge-bases/*', '/knowledge/*'],
-  tasks:         ['/api/tasks', '/api/tasks/*', '/task-pipeline/*'],
-  workforce:     ['/api/workforce', '/api/workforce/*'],
-  messages:      ['/api/messages', '/api/messages/*', '/bridge/agents/*/whatsapp', '/bridge/agents/*/telegram'],
-  guardrails:    ['/guardrails/*', '/dlp/*'],
-  journal:       ['/activity/*', '/api/journal/*'],
-  approvals:     ['/approvals/*'],
-  compliance:    ['/api/compliance/*', '/api/audit/*', '/api/events/*'],
-  domain:        ['/api/domain/*'],
-  roles:         ['/api/roles', '/api/roles/*', '/profiles/*'],
-  memory:        ['/api/memory/*', '/api/memory-transfer/*'],
-  dashboard:     ['/api/dashboard/*', '/api/overview/*'],
-};
-
-function buildPatterns(config) {
-  if (config.encryptAll) {
-    // Encrypt all API/auth calls (server NEVER_ENCRYPT list handles exclusions)
-    var all = ['/api/*', '/auth/*'];
-    if (config.customEndpoints) all = all.concat(config.customEndpoints);
-    return all;
-  }
-  var patterns = [];
-  var groups = config.enabledGroups || {};
-  Object.keys(ENDPOINT_GROUPS).forEach(function(k) {
-    if (groups[k]) patterns = patterns.concat(ENDPOINT_GROUPS[k]);
-  });
-  if (config.customEndpoints) patterns = patterns.concat(config.customEndpoints);
-  return patterns;
-}
-
-export function setConfig(config) {
-  _enabled = config.enabled || false;
-  var patterns = buildPatterns(config);
-  _sensitivePatterns = patterns.map(function(p) {
-    return new RegExp('^' + p.replace(/\*/g, '[^/]+') + '(/.*)?$');
-  });
-  if (_enabled && !_keyReady) {
-    // Create a promise that apiCall can await
-    _keyReadyPromise = new Promise(function(resolve) { _keyReadyResolve = resolve; });
-    deriveKeys().then(function() {
-      if (_keyReadyResolve) _keyReadyResolve();
-    }).catch(function() { _enabled = false; if (_keyReadyResolve) _keyReadyResolve(); });
-  }
-}
-
-function isSensitive(url) {
-  var path = url.replace(/^https?:\/\/[^/]+/, '').split('?')[0];
-  for (var i = 0; i < _sensitivePatterns.length; i++) {
-    if (_sensitivePatterns[i].test(path)) return true;
-  }
-  return false;
-}
-
-/**
- * Wrap fetch calls to auto-encrypt/decrypt sensitive endpoints.
- * Call this once at app startup.
- */
-export function installFetchInterceptor() {
-  // No-op — encryption is now handled directly in apiCall
-  return;
-  if (window.__teInstalled) return;
-  window.__teInstalled = true;
-  var originalFetch = window.fetch;
-
-  window.fetch = async function(input, init) {
-    if (!_enabled) return originalFetch(input, init);
-
-    var url = typeof input === 'string' ? input : input.url;
-    if (!isSensitive(url)) return originalFetch(input, init);
-
-    // Add encryption header
-    init = init || {};
-    init.headers = init.headers || {};
-    if (init.headers instanceof Headers) {
-      init.headers.set('x-transport-encryption', '1');
-    } else {
-      init.headers['x-transport-encryption'] = '1';
-    }
-
-    // Encrypt request body
-    var method = (init.method || 'GET').toUpperCase();
-    if ((method === 'POST' || method === 'PUT' || method === 'PATCH') && init.body) {
-      try {
-        var bodyData = typeof init.body === 'string' ? JSON.parse(init.body) : init.body;
-        var encrypted = await encryptPayload(bodyData);
-        if (encrypted) {
-          init.body = JSON.stringify({ _enc: encrypted });
-          if (init.headers instanceof Headers) {
-            init.headers.set('content-type', 'application/json');
-          } else {
-            init.headers['content-type'] = 'application/json';
-          }
-        }
-      } catch(e) {
-        // Fall through — send unencrypted
-      }
-    }
-
-    var response = await originalFetch(input, init);
-
-    // Decrypt response if encrypted
-    if (response.headers.get('x-transport-encrypted') === '1') {
-      try {
-        var resBody = await response.json();
-        if (resBody && resBody._enc) {
-          var decrypted = await decryptPayload(resBody._enc);
-          // Return a new Response with decrypted data
-          return new Response(JSON.stringify(decrypted), {
-            status: response.status,
-            statusText: response.statusText,
-            headers: response.headers,
-          });
-        }
-      } catch(e) {
-        // Decryption failed — return original
-        return response;
-      }
-    }
-
-    return response;
-  };
-}
-
-export function isEnabled() { return _enabled; }
-export function isReady() { return _keyReady; }
-
-// Expose for apiCall integration (avoids fetch interceptor timing issues)
-window.__transportEncryption = {
-  isEnabled: function() { return _enabled; },
-  isReady: function() { return _enabled && _keyReady; },
-  isSensitive: isSensitive,
-  encryptPayload: encryptPayload,
-  decryptPayload: decryptPayload,
-  waitForReady: function() { return _keyReadyPromise || Promise.resolve(); },
-};

package/src/dashboard/components/utils.js

@@ -1,205 +0,0 @@
-const h = React.createElement;
-const { useState, useEffect, useCallback, useRef, Fragment, createContext, useContext } = React;
-const AppContext = createContext();
-export { h, useState, useEffect, useCallback, useRef, Fragment, createContext, useContext, AppContext };
-
-export function useApp() { return useContext(AppContext); }
-
-// Org ID — set from server settings after setup wizard, cached in localStorage
-var _orgIdLoaded = false;
-export function getOrgId() {
-  var id = localStorage.getItem('em_org_id');
-  if (!id && !_orgIdLoaded) {
-    _orgIdLoaded = true;
-    // Fetch from server settings (async, will update on next call)
-    apiCall('/settings').then(function(s) {
-      if (s && s.orgId) {
-        localStorage.setItem('em_org_id', s.orgId);
-      }
-    }).catch(function() {});
-  }
-  return id || 'default';
-}
-export function setOrgId(id) {
-  if (id) localStorage.setItem('em_org_id', id);
-}
-
-// Derive accent color variants from a hex color
-export function applyBrandColor(hex) {
-  if (!hex || !/^#[0-9a-fA-F]{6}$/.test(hex)) return;
-  const r = parseInt(hex.slice(1,3), 16), g = parseInt(hex.slice(3,5), 16), b = parseInt(hex.slice(5,7), 16);
-  const root = document.documentElement;
-  root.style.setProperty('--brand-color', hex);
-  // Darken by 15% for hover
-  root.style.setProperty('--brand-hover', `rgb(${Math.round(r*0.85)},${Math.round(g*0.85)},${Math.round(b*0.85)})`);
-  // 12% opacity for soft bg
-  root.style.setProperty('--brand-soft', `rgba(${r},${g},${b},0.15)`);
-  // Lighten for text variant
-  const lr = Math.min(255, r + Math.round((255-r)*0.35)), lg = Math.min(255, g + Math.round((255-g)*0.35)), lb = Math.min(255, b + Math.round((255-b)*0.35));
-  root.style.setProperty('--brand-text', `rgb(${lr},${lg},${lb})`);
-}
-
-// Get CSRF token from cookie (non-httpOnly, readable by JS)
-export function getCsrf() {
-  const m = document.cookie.match(/em_csrf=([^;]+)/);
-  return m ? m[1] : '';
-}
-
-let _refreshing = null;
-export async function tryRefreshToken() {
-  if (_refreshing) return _refreshing;
-  _refreshing = fetch('/auth/refresh', { method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': getCsrf() } })
-    .then(async r => { _refreshing = null; if (!r.ok) throw new Error('refresh failed'); return r.json(); })
-    .catch(e => { _refreshing = null; throw e; });
-  return _refreshing;
-}
-
-export function apiCall(path, opts = {}) {
-  const headers = { 'Content-Type': 'application/json', 'X-CSRF-Token': getCsrf() };
-  const apiKey = localStorage.getItem('em_api_key');
-  if (apiKey) headers['X-API-Key'] = apiKey;
-  const url = '/api' + (path.startsWith('/') ? '' : '/') + path;
-
-  const doFetch = async () => {
-    // Wait for transport encryption to be ready if enabled
-    const te = window.__transportEncryption;
-    if (te && te.isEnabled()) await te.waitForReady();
-    const sensitive = te && te.isReady() && te.isSensitive(url);
-    const fetchHeaders = { ...headers, ...opts.headers };
-    if (sensitive) fetchHeaders['x-transport-encryption'] = '1';
-
-    let fetchOpts = { ...opts, credentials: 'same-origin', headers: fetchHeaders };
-
-    // Encrypt request body for sensitive endpoints
-    if (sensitive && fetchOpts.body && (fetchOpts.method === 'PUT' || fetchOpts.method === 'POST' || fetchOpts.method === 'PATCH')) {
-      try {
-        const bodyData = typeof fetchOpts.body === 'string' ? JSON.parse(fetchOpts.body) : fetchOpts.body;
-        const encrypted = await te.encryptPayload(bodyData);
-        if (encrypted) fetchOpts.body = JSON.stringify({ _enc: encrypted });
-      } catch {}
-    }
-
-    const r = await fetch(url, fetchOpts);
-    if (r.status === 401 && !opts._retried) {
-      try { await tryRefreshToken(); return apiCall(path, { ...opts, _retried: true }); }
-      catch { if (window.__emLogout && !window.__suppressLogout) window.__emLogout(); throw new Error('Session expired'); }
-    }
-
-    const d = await r.json().catch(() => ({}));
-
-    // Decrypt response if it contains encrypted payload
-    if (d && d._enc && typeof d._enc === 'string') {
-      const _te = window.__transportEncryption;
-      if (_te) {
-        if (!_te.isReady()) await _te.waitForReady();
-        try {
-          const decrypted = await _te.decryptPayload(d._enc);
-          if (!r.ok) throw new Error(decrypted?.error || r.statusText);
-          if (decrypted) return decrypted;
-        } catch (e) {
-          if (e.message) throw e;
-        }
-      }
-    }
-
-    if (!r.ok) throw new Error(d.error || r.statusText);
-    return d;
-  };
-
-  return doFetch();
-}
-export function authCall(path, opts = {}) {
-  const headers = { 'Content-Type': 'application/json', 'X-CSRF-Token': getCsrf() };
-  return fetch('/auth' + (path.startsWith('/') ? '' : '/') + path, { ...opts, credentials: 'same-origin', headers: { ...headers, ...opts.headers } })
-    .then(async r => { const d = await r.json().catch(() => ({})); if (!r.ok) throw new Error(d.error || r.statusText); return d; });
-}
-export function engineCall(path, opts = {}) { return apiCall('/engine' + (path.startsWith('/') ? '' : '/') + path, opts); }
-
-export function formatUptime(seconds) {
-  if (!seconds || seconds < 0) return '-';
-  var d = Math.floor(seconds / 86400);
-  var h = Math.floor((seconds % 86400) / 3600);
-  var m = Math.floor((seconds % 3600) / 60);
-  if (d > 0) return d + 'd ' + h + 'h';
-  if (h > 0) return h + 'h ' + m + 'm';
-  return m + 'm';
-}
-
-export var DEPLOY_PHASES = ['validate', 'provision', 'configure', 'upload', 'install', 'start', 'healthcheck', 'complete'];
-export var DEPLOY_PHASE_LABELS = { validate: 'Validate Config', provision: 'Provision Infrastructure', configure: 'Configure Environment', upload: 'Upload Agent Files', install: 'Install Dependencies', start: 'Start Agent Process', healthcheck: 'Health Check', complete: 'Complete' };
-
-export async function showConfirm(opts) { return window.__showConfirm ? window.__showConfirm(opts) : confirm(opts.message); }
-
-var _uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-
-export function buildAgentEmailMap(agents) {
-  const map = {};
-  (agents || []).forEach(a => {
-    const identity = a.config?.identity || {};
-    const email = identity.email || a.config?.email?.address || a.config?.email || a.email || null;
-    if (email && !_uuidRe.test(email)) {
-      map[a.id] = email;
-    } else {
-      map[a.id] = ((identity.name || a.config?.name || a.name || a.id || 'unknown').toLowerCase().replace(/\s+/g, '-') + '@agenticmail.local');
-    }
-  });
-  return map;
-}
-
-export function buildAgentDataMap(agents) {
-  const map = {};
-  (agents || []).forEach(a => {
-    const identity = a.config?.identity || {};
-    const name = identity.name || a.config?.displayName || a.config?.name || a.name || null;
-    const rawEmail = identity.email || a.config?.email?.address || a.config?.email || a.email || null;
-    const email = (rawEmail && !_uuidRe.test(rawEmail)) ? rawEmail : null;
-    const avatar = identity.avatar || null;
-    map[a.id] = { name, email, avatar };
-  });
-  return map;
-}
-
-export function resolveAgentEmail(id, emailMap) {
-  if (!id) return 'Unknown';
-  if (id === 'system') return 'system@agenticmail.local';
-  if (id.startsWith('ext:email:')) return id.slice(10);
-  if (id.startsWith('ext:')) return id.slice(4);
-  return emailMap?.[id] || id;
-}
-
-var _badgeAvatarStyle = { width: 24, height: 24, borderRadius: '50%', objectFit: 'cover', flexShrink: 0 };
-var _badgeInitialStyle = { width: 24, height: 24, borderRadius: '50%', background: 'var(--accent-soft)', color: 'var(--accent-text)', display: 'flex', alignItems: 'center', justifyContent: 'center', fontSize: 11, fontWeight: 600, flexShrink: 0 };
-
-export function renderAgentBadge(id, agentDataMap) {
-  if (!id) return h('span', null, 'Unknown');
-  if (id === 'system') return h('div', { style: { display: 'flex', alignItems: 'center', gap: 8 } },
-    h('div', { style: _badgeInitialStyle }, 'S'),
-    h('div', { style: { lineHeight: 1.3 } },
-      h('div', { style: { fontWeight: 500, fontSize: 13 } }, 'System'),
-      h('div', { style: { fontSize: 11, color: 'var(--text-muted)' } }, 'system@agenticmail.local')
-    )
-  );
-  if (id.startsWith('ext:')) {
-    var extEmail = id.startsWith('ext:email:') ? id.slice(10) : id.slice(4);
-    return h('div', { style: { display: 'flex', alignItems: 'center', gap: 8 } },
-      h('div', { style: _badgeInitialStyle }, extEmail.charAt(0).toUpperCase()),
-      h('div', { style: { lineHeight: 1.3 } },
-        h('div', { style: { fontWeight: 500, fontSize: 13 } }, extEmail),
-        h('div', { style: { fontSize: 11, color: 'var(--text-muted)' } }, 'External')
-      )
-    );
-  }
-  var data = agentDataMap?.[id];
-  if (!data) return h('span', { style: { fontSize: 13 } }, id);
-  var displayName = data.name || 'Agent';
-  var displayEmail = data.email || '';
-  return h('div', { style: { display: 'flex', alignItems: 'center', gap: 8 } },
-    data.avatar
-      ? h('img', { src: data.avatar, style: _badgeAvatarStyle })
-      : h('div', { style: _badgeInitialStyle }, displayName.charAt(0).toUpperCase()),
-    h('div', { style: { lineHeight: 1.3 } },
-      h('div', { style: { fontWeight: 500, fontSize: 13 } }, displayName),
-      h('div', { style: { fontSize: 11, color: 'var(--text-muted)' } }, displayEmail)
-    )
-  );
-}