@agentxv2/gateway 0.1.1

package/src/middleware/rate-limiter.ts

@@ -0,0 +1,115 @@
+// ---------------------------------------------------------------------------
+// AgentX Gateway — Rate Limiter Middleware
+// ---------------------------------------------------------------------------
+// Three-layer rate limiting:
+//   1. Global IP-level (express-rate-limit)
+//   2. Per-tenant RPM (Redis sliding window)
+//   3. Per-tenant daily quota (Redis counter + DB fallback)
+//   4. Per-tenant concurrency control (Redis)
+// ---------------------------------------------------------------------------
+
+import { Request, Response, NextFunction } from 'express'
+import Redis from 'ioredis'
+import { config } from '../config'
+import { getPool } from '../lib/db'
+
+let redis: Redis | null = null
+
+export function getRedis(): Redis | null {
+  if (!redis) {
+    redis = new Redis(config.redisUrl, { lazyConnect: true })
+    redis.connect().catch(() => {
+      redis = null
+    })
+  }
+  return redis
+}
+
+export async function tenantRateLimiter(
+  req: Request,
+  res: Response,
+  next: NextFunction
+): Promise<void> {
+  const tenant = req.tenant
+  if (!tenant) {
+    next()
+    return
+  }
+
+  const r = getRedis()
+  if (!r) {
+    next()
+    return
+  }
+
+  try {
+    // 1. RPM check
+    const rpmKey = `rpm:${tenant.id}`
+    const rpmCurrent = await r.incr(rpmKey)
+    if (rpmCurrent === 1) {
+      await r.expire(rpmKey, 60)
+    }
+    if (rpmCurrent > tenant.rateLimitRpm) {
+      res.status(429).json({
+        error: 'Rate limit exceeded',
+        retry_after: 60,
+        limit: tenant.rateLimitRpm,
+        limit_type: 'rpm',
+      })
+      return
+    }
+
+    // 2. Daily quota check (only for platform mode)
+    if (tenant.quotaDaily > 0) {
+      const quotaKey = `quota:${tenant.id}`
+      const used = await r.get(quotaKey)
+      const current = used ? parseInt(used, 10) : tenant.quotaUsed
+      if (current >= tenant.quotaDaily) {
+        res.status(429).json({
+          error: 'Daily quota exceeded. Upgrade your plan or switch to BYOK mode.',
+          limit: tenant.quotaDaily,
+          used: current,
+          limit_type: 'daily_quota',
+        })
+        return
+      }
+    }
+
+    // 3. Concurrency check
+    const concurrencyKey = `concurrent:${tenant.id}`
+    const currentConcurrent = await r.incr(concurrencyKey)
+    await r.expire(concurrencyKey, 300)
+    if (currentConcurrent > tenant.maxConcurrent) {
+      await r.decr(concurrencyKey)
+      res.status(429).json({
+        error: 'Too many concurrent requests',
+        limit: tenant.maxConcurrent,
+        limit_type: 'concurrency',
+      })
+      return
+    }
+
+    res.on('finish', () => {
+      r.decr(concurrencyKey).catch(() => {})
+    })
+
+    next()
+  } catch {
+    next()
+  }
+}
+
+export async function updateQuota(tenantId: string, tokens: number): Promise<void> {
+  const r = getRedis()
+  if (r) {
+    const quotaKey = `quota:${tenantId}`
+    await r.incrby(quotaKey, tokens)
+    await r.expire(quotaKey, 86400)
+  } else {
+    const pool = getPool()
+    await pool.query(
+      `UPDATE tenants SET quota_used = quota_used + $2 WHERE id = $1`,
+      [tenantId, tokens]
+    )
+  }
+}

package/src/routes/a2a.ts

@@ -0,0 +1,97 @@
+// ---------------------------------------------------------------------------
+// AgentX Gateway — A2A Task Results API
+// ---------------------------------------------------------------------------
+// GET  /api/v1/a2a/pending-tasks?agentId=X     → tasks ready for agent to complete
+// GET  /api/v1/a2a/task-result/:taskId          → single task LLM result
+// GET  /api/v1/a2a/worker-status                 → A2A worker health
+// ---------------------------------------------------------------------------
+
+import { Router, Request, Response } from 'express'
+import { getPool } from '../lib/db'
+import { getWorkerStatus } from '../services/a2a-worker'
+
+const router = Router()
+
+// ── List pending task results for an agent ─────────────────────────────────
+
+router.get('/pending-tasks', async (req: Request, res: Response) => {
+  try {
+    const agentId = parseInt(req.query.agentId as string)
+    if (!agentId || isNaN(agentId)) {
+      res.status(400).json({ error: 'agentId query parameter required' })
+      return
+    }
+
+    const pool = getPool()
+    const { rows } = await pool.query(
+      `SELECT task_id, agent_id, task_type, input_data, output_data, status,
+              llm_model, tokens_used, processed_at, created_at
+       FROM a2a_task_results
+       WHERE agent_id = $1 AND status = 2
+       ORDER BY created_at DESC
+       LIMIT 50`,
+      [agentId]
+    )
+
+    res.json({ tasks: rows, total: rows.length, agentId })
+  } catch (err: any) {
+    console.error('[a2a] pending-tasks error:', err.message)
+    res.status(500).json({ error: 'Failed to fetch pending tasks' })
+  }
+})
+
+// ── Single task result ─────────────────────────────────────────────────────
+
+router.get('/task-result/:taskId', async (req: Request, res: Response) => {
+  try {
+    const taskId = parseInt(req.params.taskId)
+    if (!taskId || isNaN(taskId)) {
+      res.status(400).json({ error: 'Invalid taskId' })
+      return
+    }
+
+    const pool = getPool()
+    const { rows } = await pool.query(
+      `SELECT * FROM a2a_task_results WHERE task_id = $1`,
+      [taskId]
+    )
+
+    if (rows.length === 0) {
+      res.status(404).json({ error: 'Task result not found', taskId })
+      return
+    }
+
+    res.json(rows[0])
+  } catch (err: any) {
+    console.error('[a2a] task-result error:', err.message)
+    res.status(500).json({ error: 'Failed to fetch task result' })
+  }
+})
+
+// ── Worker status ──────────────────────────────────────────────────────────
+
+router.get('/worker-status', async (_req: Request, res: Response) => {
+  try {
+    const status = getWorkerStatus()
+    const pool = getPool()
+    const { rows: stats } = await pool.query(
+      `SELECT status, COUNT(*) as count
+       FROM a2a_task_results
+       GROUP BY status`
+    )
+    const counts: Record<string, number> = { pending: 0, processing: 0, completed: 0, failed: 0 }
+    for (const r of stats) {
+      if (r.status === 0) counts.pending = Number(r.count)
+      else if (r.status === 1) counts.processing = Number(r.count)
+      else if (r.status === 2) counts.completed = Number(r.count)
+      else if (r.status === 3) counts.failed = Number(r.count)
+    }
+
+    res.json({ ...status, taskCounts: counts })
+  } catch (err: any) {
+    console.error('[a2a] worker-status error:', err.message)
+    res.status(500).json({ error: 'Failed to fetch worker status' })
+  }
+})
+
+export default router

package/src/routes/admin.ts

@@ -0,0 +1,219 @@
+// ---------------------------------------------------------------------------
+// AgentX Gateway — Admin Routes
+// ---------------------------------------------------------------------------
+// POST   /api/v1/admin/platform-keys          — Add platform API key
+// GET    /api/v1/admin/platform-keys          — List platform API keys
+// DELETE /api/v1/admin/platform-keys/:id      — Delete platform API key
+// GET    /api/v1/admin/plans                  — List plans
+// GET    /api/v1/admin/tenants               — List tenants (paginated)
+// PATCH  /api/v1/admin/tenants/:id           — Update tenant plan/status
+// GET    /api/v1/admin/usage                 — Usage stats
+// ---------------------------------------------------------------------------
+
+import { Router, Request, Response } from 'express'
+import { getPool } from '../lib/db'
+import { adminAuth } from '../middleware/adminAuth'
+import { encryptApiKey } from '../lib/crypto'
+import { config } from '../config'
+
+const router = Router()
+
+// All admin routes require admin auth
+router.use(adminAuth)
+
+// ── Platform API Keys ─────────────────────────────────────────────────────
+
+// List all platform keys (masked)
+router.get('/platform-keys', async (_req: Request, res: Response) => {
+  try {
+    const pool = getPool()
+    const result = await pool.query(
+      `SELECT pk.id, pk.provider, pk.endpoint, pk.models, pk.plan_ids, pk.weight, pk.is_active,
+              pk.created_at,
+              array_agg(p.slug) as plan_slugs
+       FROM platform_api_keys pk
+       LEFT JOIN plans p ON p.id = ANY(pk.plan_ids)
+       GROUP BY pk.id
+       ORDER BY pk.created_at DESC`
+    )
+    res.json({ keys: result.rows })
+  } catch (err: any) {
+    res.status(500).json({ error: err.message })
+  }
+})
+
+// Add platform API key
+router.post('/platform-keys', async (req: Request, res: Response) => {
+  try {
+    const { provider, endpoint, api_key, models, plan_slugs } = req.body
+    if (!provider || !endpoint || !api_key) {
+      res.status(400).json({ error: 'provider, endpoint, and api_key are required' })
+      return
+    }
+
+    const pool = getPool()
+
+    // Resolve plan slugs to IDs
+    const slugs: string[] = plan_slugs || ['pro', 'enterprise']
+    const planResult = await pool.query(
+      `SELECT id FROM plans WHERE slug = ANY($1)`, [slugs]
+    )
+    const planIds = planResult.rows.map((r: any) => r.id)
+
+    const encrypted = encryptApiKey(api_key, config.masterEncryptionKey)
+    const modelList: string[] = models || [provider === 'deepseek' ? 'deepseek-chat' : 'gpt-4o']
+
+    await pool.query(
+      `INSERT INTO platform_api_keys (provider, endpoint, api_key, plan_ids, models, weight, is_active)
+       VALUES ($1, $2, $3, $4, $5, 1, true)`,
+      [provider, endpoint, encrypted, planIds, modelList]
+    )
+
+    res.status(201).json({ success: true, provider, endpoint, models: modelList })
+  } catch (err: any) {
+    res.status(500).json({ error: err.message })
+  }
+})
+
+// Delete platform API key
+router.delete('/platform-keys/:id', async (req: Request, res: Response) => {
+  try {
+    const pool = getPool()
+    const result = await pool.query(
+      `DELETE FROM platform_api_keys WHERE id = $1 RETURNING id, provider`,
+      [req.params.id]
+    )
+    if (result.rows.length === 0) {
+      res.status(404).json({ error: 'Key not found' })
+      return
+    }
+    res.json({ success: true, deleted: result.rows[0] })
+  } catch (err: any) {
+    res.status(500).json({ error: err.message })
+  }
+})
+
+// ── Plans ──────────────────────────────────────────────────────────────────
+
+router.get('/plans', async (_req: Request, res: Response) => {
+  try {
+    const pool = getPool()
+    const result = await pool.query(
+      `SELECT id, name, slug, price_monthly, quota_daily, quota_monthly,
+              byok_enabled, rate_limit_rpm, max_concurrent, platform_models, is_active
+       FROM plans ORDER BY price_monthly ASC`
+    )
+    res.json({ plans: result.rows })
+  } catch (err: any) {
+    res.status(500).json({ error: err.message })
+  }
+})
+
+// ── Tenants ────────────────────────────────────────────────────────────────
+
+router.get('/tenants', async (req: Request, res: Response) => {
+  try {
+    const page = parseInt(req.query.page as string) || 1
+    const limit = Math.min(parseInt(req.query.limit as string) || 20, 100)
+    const offset = (page - 1) * limit
+
+    const pool = getPool()
+    const [countResult, tenantResult] = await Promise.all([
+      pool.query(`SELECT COUNT(*) FROM tenants`),
+      pool.query(
+        `SELECT t.id, t.wallet_address, t.status,
+                t.quota_daily, t.quota_used, t.rate_limit_rpm, t.max_concurrent,
+                t.created_at, t.updated_at,
+                p.slug as plan_slug, p.name as plan_name
+         FROM tenants t
+         LEFT JOIN plans p ON t.plan_id = p.id
+         ORDER BY t.created_at DESC
+         LIMIT $1 OFFSET $2`,
+        [limit, offset]
+      ),
+    ])
+
+    res.json({
+      tenants: tenantResult.rows,
+      total: parseInt(countResult.rows[0].count),
+      page,
+      limit,
+    })
+  } catch (err: any) {
+    res.status(500).json({ error: err.message })
+  }
+})
+
+router.patch('/tenants/:id', async (req: Request, res: Response) => {
+  try {
+    const { plan_slug, status } = req.body
+    const pool = getPool()
+
+    if (plan_slug) {
+      const planResult = await pool.query(`SELECT id FROM plans WHERE slug = $1`, [plan_slug])
+      if (planResult.rows.length === 0) {
+        res.status(400).json({ error: 'Invalid plan slug' })
+        return
+      }
+      const plan = planResult.rows[0]
+      await pool.query(`UPDATE tenants SET plan_id = $1, updated_at = NOW() WHERE id = $2`,
+        [plan.id, req.params.id])
+    }
+
+    if (status) {
+      await pool.query(`UPDATE tenants SET status = $1, updated_at = NOW() WHERE id = $2`,
+        [status, req.params.id])
+    }
+
+    res.json({ success: true })
+  } catch (err: any) {
+    res.status(500).json({ error: err.message })
+  }
+})
+
+// ── Usage Stats ────────────────────────────────────────────────────────────
+
+router.get('/usage', async (_req: Request, res: Response) => {
+  try {
+    const pool = getPool()
+    const [total, recent, topTenants] = await Promise.all([
+      pool.query(
+        `SELECT COUNT(*) as total_requests,
+                COALESCE(SUM(tokens_total), 0) as total_tokens
+         FROM usage_logs`
+      ),
+      pool.query(
+        `SELECT DATE(created_at) as date,
+                COUNT(*) as requests,
+                SUM(tokens_total) as tokens
+         FROM usage_logs
+         WHERE created_at > NOW() - INTERVAL '30 days'
+         GROUP BY DATE(created_at)
+         ORDER BY date DESC
+         LIMIT 30`
+      ),
+      pool.query(
+        `SELECT t.wallet_address, p.slug as plan,
+                COUNT(ul.*) as requests,
+                COALESCE(SUM(ul.tokens_total), 0) as tokens
+         FROM tenants t
+         LEFT JOIN usage_logs ul ON ul.tenant_id = t.id
+         LEFT JOIN plans p ON t.plan_id = p.id
+         WHERE ul.created_at > NOW() - INTERVAL '30 days' OR ul.id IS NULL
+         GROUP BY t.id, t.wallet_address, p.slug
+         ORDER BY tokens DESC
+         LIMIT 20`
+      ),
+    ])
+
+    res.json({
+      summary: total.rows[0],
+      daily: recent.rows,
+      topTenants: topTenants.rows,
+    })
+  } catch (err: any) {
+    res.status(500).json({ error: err.message })
+  }
+})
+
+export default router

package/src/routes/agents.ts

@@ -0,0 +1,52 @@
+// ---------------------------------------------------------------------------
+// ── Agents API (public, read-only)
+// ---------------------------------------------------------------------------
+// GET /api/v1/agents         → list all agents
+// GET /api/v1/agents/:id     → single agent detail
+// ---------------------------------------------------------------------------
+
+import { Router, Request, Response } from 'express'
+import { getPool } from '../lib/db'
+
+const router = Router()
+
+// ── List all agents ─────────────────────────────────────────────────────────
+
+router.get('/', async (_req: Request, res: Response) => {
+  try {
+    const pool = getPool()
+    const { rows } = await pool.query(
+      `SELECT id, owner, name, description, tags, capabilities, synced_at, created_at
+       FROM agents
+       ORDER BY id DESC`
+    )
+    res.json({ agents: rows, total: rows.length })
+  } catch (err: any) {
+    console.error('[agents] list error:', err.message)
+    res.status(500).json({ error: 'Failed to fetch agents' })
+  }
+})
+
+// ── Single agent detail ─────────────────────────────────────────────────────
+
+router.get('/:id', async (req: Request, res: Response) => {
+  try {
+    const pool = getPool()
+    const { rows } = await pool.query(
+      `SELECT id, owner, name, description, tags, capabilities, token_uri, metadata_json, synced_at, created_at, updated_at
+       FROM agents WHERE id = $1`,
+      [parseInt(req.params.id)]
+    )
+
+    if (rows.length === 0) {
+      return res.status(404).json({ error: 'Agent not found' })
+    }
+
+    res.json(rows[0])
+  } catch (err: any) {
+    console.error('[agents] detail error:', err.message)
+    res.status(500).json({ error: 'Failed to fetch agent' })
+  }
+})
+
+export default router

package/src/routes/chat.ts

@@ -0,0 +1,219 @@
+// ---------------------------------------------------------------------------
+// AgentX Gateway — Chat Completions Proxy
+// ---------------------------------------------------------------------------
+// POST /api/v1/chat/completions
+// Resolves tenant API key, proxies to LLM, streams back, records usage.
+// ---------------------------------------------------------------------------
+
+import { Router, Request, Response } from 'express'
+import { getPool } from '../lib/db'
+import { decryptApiKey } from '../lib/crypto'
+import { config } from '../config'
+import { updateQuota } from '../middleware/rate-limiter'
+
+const router = Router()
+
+router.post('/chat/completions', async (req: Request, res: Response) => {
+  const tenant = req.tenant
+  if (!tenant) {
+    res.status(401).json({ error: 'Unauthorized' })
+    return
+  }
+
+  const {
+    model,
+    messages,
+    tools,
+    stream,
+    key_source,
+    tenant_key_id,
+    temperature,
+    max_tokens,
+  } = req.body
+
+  let apiKey: string
+  let endpoint: string
+  let keySource: string
+  let platformKeyId: string | null = null
+  let tenantKeyId: string | null = null
+  let resolvedModel = model || 'gpt-4o'
+
+  const pool = getPool()
+
+  try {
+    if (key_source === 'tenant_owned' && tenant_key_id) {
+      // ── BYOK Mode ──
+      const keyRow = await pool.query(
+        `SELECT * FROM tenant_api_keys WHERE id = $1 AND tenant_id = $2 AND is_active = true`,
+        [tenant_key_id, tenant.id]
+      )
+      if (keyRow.rows.length === 0) {
+        res.status(400).json({ error: 'Tenant API key not found or inactive' })
+        return
+      }
+      const tk = keyRow.rows[0]
+      apiKey = decryptApiKey(tk.api_key, config.masterEncryptionKey)
+      endpoint = tk.endpoint
+      resolvedModel = model || tk.model
+      keySource = 'tenant_owned'
+      tenantKeyId = tk.id
+    } else if (tenant.quotaDaily > 0) {
+      // ── Platform Mode ──
+      if (tenant.quotaUsed >= tenant.quotaDaily) {
+        res.status(429).json({
+          error: 'Platform quota exhausted',
+          hint: 'Switch to BYOK mode or upgrade your plan',
+        })
+        return
+      }
+
+      const planRow = await pool.query(
+        `SELECT platform_models FROM plans WHERE id = $1`,
+        [tenant.planId]
+      )
+      const planModels = planRow.rows[0]?.platform_models || []
+
+      let matchedModel: { provider: string; model: string } | null = null
+      if (resolvedModel) {
+        matchedModel = planModels.find(
+          (m: { model: string }) => m.model === resolvedModel
+        ) || planModels[0]
+      } else {
+        matchedModel = planModels[0]
+      }
+
+      if (!matchedModel) {
+        res.status(400).json({
+          error: 'No platform models available on current plan',
+          available_models: planModels.map((m: { model: string }) => m.model),
+        })
+        return
+      }
+
+      const keyRow = await pool.query(
+        `SELECT * FROM platform_api_keys
+         WHERE provider = $1 AND $2 = ANY(plan_ids) AND is_active = true
+         ORDER BY random() LIMIT 1`,
+        [matchedModel.provider, tenant.planId]
+      )
+      if (keyRow.rows.length === 0) {
+        res.status(500).json({ error: 'No platform API key available' })
+        return
+      }
+
+      const pk = keyRow.rows[0]
+      apiKey = decryptApiKey(pk.api_key, config.masterEncryptionKey)
+      endpoint = pk.endpoint
+      resolvedModel = matchedModel.model
+      keySource = 'platform'
+      platformKeyId = pk.id
+    } else {
+      res.status(400).json({
+        error: 'No LLM access configured',
+        hint: 'Add a BYOK API key in tenant settings or upgrade to a paid plan',
+      })
+      return
+    }
+
+    // ── Proxy to LLM ──
+    const llmBody: Record<string, unknown> = {
+      model: resolvedModel,
+      messages,
+      stream: true,
+    }
+    if (tools) llmBody.tools = tools
+    if (temperature !== undefined) llmBody.temperature = temperature
+    if (max_tokens) llmBody.max_tokens = max_tokens
+
+    const llmResponse = await fetch(`${endpoint}/chat/completions`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': `Bearer ${apiKey}`,
+      },
+      body: JSON.stringify(llmBody),
+    })
+
+    if (!llmResponse.ok) {
+      const errText = await llmResponse.text()
+      res.status(llmResponse.status).json({ error: `LLM error: ${errText}` })
+      return
+    }
+
+    // ── SSE Stream Pipe ──
+    res.setHeader('Content-Type', 'text/event-stream')
+    res.setHeader('Cache-Control', 'no-cache')
+    res.setHeader('Connection', 'keep-alive')
+
+    const reader = llmResponse.body?.getReader()
+    if (!reader) {
+      res.status(500).json({ error: 'No response from LLM' })
+      return
+    }
+
+    const decoder = new TextDecoder()
+    let buffer = ''
+    let totalPrompt = 0
+    let totalCompletion = 0
+    let totalTokens = 0
+
+    try {
+      while (true) {
+        const { done, value } = await reader.read()
+        if (done) break
+
+        buffer += decoder.decode(value, { stream: true })
+        const lines = buffer.split('\n')
+        buffer = lines.pop() ?? ''
+
+        for (const line of lines) {
+          res.write(line + '\n')
+
+          if (line.startsWith('data: ') && !line.includes('[DONE]')) {
+            try {
+              const data = JSON.parse(line.slice(6))
+              if (data.usage) {
+                totalPrompt = data.usage.prompt_tokens || 0
+                totalCompletion = data.usage.completion_tokens || 0
+                totalTokens = data.usage.total_tokens || 0
+              }
+            } catch { /* skip parse errors */ }
+          }
+        }
+      }
+
+      if (buffer) {
+        res.write(buffer + '\n')
+      }
+    } finally {
+      reader.releaseLock()
+    }
+
+    try {
+      await pool.query(
+        `INSERT INTO usage_logs (tenant_id, key_source, platform_key_id, tenant_key_id, provider, model, tokens_prompt, tokens_completion, tokens_total, tool_calls, agent_id)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)`,
+        [
+          tenant.id, keySource, platformKeyId, tenantKeyId,
+          keySource === 'platform' ? 'openai' : 'unknown',
+          resolvedModel,
+          totalPrompt, totalCompletion, totalTokens,
+          Array.isArray(tools) ? tools.length : 0,
+          null,
+        ]
+      )
+    } catch { /* usage logging is non-critical */ }
+
+    if (keySource === 'platform' && totalTokens > 0) {
+      updateQuota(tenant.id, totalTokens).catch(() => {})
+    }
+
+    res.end()
+  } catch (err) {
+    if (!res.headersSent) {
+      res.status(500).json({ error: 'Internal proxy error' })
+    }
+  }
+})
+
+export default router