@axiom-lattice/gateway 2.1.52 → 2.1.54

package/src/channels/lark/verification.ts

@@ -0,0 +1,67 @@
+import crypto from "crypto";
+import type { FastifyRequest } from "fastify";
+import type { LarkIngressConfig, LarkUrlVerificationPayload } from "./types";
+
+export function parseLarkRequestBody(
+  body: unknown,
+  encryptKey?: string,
+): LarkUrlVerificationPayload {
+  const parsed = (body || {}) as LarkUrlVerificationPayload;
+
+  if (encryptKey && typeof parsed.encrypt === "string") {
+    return decryptLarkPayload(encryptKey, parsed.encrypt);
+  }
+
+  return parsed;
+}
+
+export function decryptLarkPayload(
+  encryptKey: string,
+  encryptedPayload: string,
+): LarkUrlVerificationPayload {
+  const key = crypto.createHash("sha256").update(encryptKey).digest();
+  const buffer = Buffer.from(encryptedPayload, "base64");
+  const iv = buffer.subarray(0, 16);
+  const ciphertext = buffer.subarray(16);
+  const decipher = crypto.createDecipheriv("aes-256-cbc", key, iv);
+  const plaintext = Buffer.concat([
+    decipher.update(ciphertext),
+    decipher.final(),
+  ]).toString("utf8");
+
+  return JSON.parse(plaintext) as LarkUrlVerificationPayload;
+}
+
+export function createLarkRequestVerifier(config: LarkIngressConfig) {
+  return function verifyRequest(request: FastifyRequest): boolean {
+    const body = parseLarkRequestBody(request.body, config.encryptKey);
+
+    return verifyLarkParsedBody(body, config);
+  };
+}
+
+export function verifyLarkParsedBody(
+  body: LarkUrlVerificationPayload,
+  config: LarkIngressConfig,
+): boolean {
+    
+    if (!config.verificationToken) {
+      return true;
+    }
+
+    return extractVerificationToken(body) === config.verificationToken;
+}
+
+function extractVerificationToken(
+  body: LarkUrlVerificationPayload,
+): string | undefined {
+  if (typeof body.token === "string") {
+    return body.token;
+  }
+
+  if (typeof body.header?.token === "string") {
+    return body.header.token;
+  }
+
+  return undefined;
+}

package/src/channels/routes.ts

@@ -0,0 +1,25 @@
+import type { FastifyInstance } from "fastify";
+import type { LarkEventHandlerDependencies } from "./lark/controller";
+import { registerLarkChannelRoutes } from "./lark/routes";
+
+interface ChannelRouteDependencies {
+  lark?: LarkEventHandlerDependencies;
+}
+
+type ChannelRouteRegistrar = (
+  app: FastifyInstance,
+  dependencies: ChannelRouteDependencies,
+) => void;
+
+const channelRouteRegistrars: ChannelRouteRegistrar[] = [
+  (app, dependencies) => registerLarkChannelRoutes(app, dependencies.lark),
+];
+
+export function registerChannelRoutes(
+  app: FastifyInstance,
+  dependencies: ChannelRouteDependencies = {},
+): void {
+  for (const registerRoutes of channelRouteRegistrars) {
+    registerRoutes(app, dependencies);
+  }
+}

package/src/controllers/channel-installations.ts

@@ -0,0 +1,354 @@
+import { FastifyRequest, FastifyReply } from "fastify";
+import { randomUUID } from "crypto";
+import {
+  ChannelInstallationStore,
+  ChannelInstallation,
+  CreateChannelInstallationRequest,
+  UpdateChannelInstallationRequest,
+  ChannelInstallationType,
+} from "@axiom-lattice/protocols";
+
+/**
+ * Channel Installation Controller
+ * Handles channel installation CRUD operations for Lark/Feishu and future channels
+ * All operations are scoped to a tenant ID
+ */
+
+/**
+ * Get tenant ID from authenticated user context
+ * Falls back to request headers for backward compatibility
+ */
+function getTenantId(request: FastifyRequest): string {
+  // First try to get from authenticated user context
+  const userTenantId = (request as any).user?.tenantId;
+  if (userTenantId) {
+    return userTenantId;
+  }
+
+  // Fallback to request headers for backward compatibility
+  return (request.headers["x-tenant-id"] as string) || "default";
+}
+
+/**
+ * Channel installation list response
+ */
+interface ChannelInstallationListResponse {
+  success: boolean;
+  message: string;
+  data: {
+    records: ChannelInstallation[];
+    total: number;
+  };
+}
+
+/**
+ * Channel installation response
+ */
+interface ChannelInstallationResponse {
+  success: boolean;
+  message: string;
+  data?: ChannelInstallation;
+}
+
+/**
+ * Get channel installation store
+ */
+function getInstallationStore(): ChannelInstallationStore {
+  // Import dynamically to avoid circular dependencies
+  const { PostgreSQLChannelInstallationStore } = require("@axiom-lattice/pg-stores");
+  const databaseUrl = process.env.DATABASE_URL;
+  
+  if (!databaseUrl) {
+    throw new Error("DATABASE_URL is required for channel installation store");
+  }
+  
+  return new PostgreSQLChannelInstallationStore({
+    poolConfig: databaseUrl,
+  });
+}
+
+/**
+ * Get all channel installations for a tenant
+ */
+export async function getChannelInstallationList(
+  request: FastifyRequest<{
+    Querystring: { channel?: ChannelInstallationType };
+  }>,
+  reply: FastifyReply,
+): Promise<ChannelInstallationListResponse> {
+  const tenantId = getTenantId(request);
+  const { channel } = request.query;
+
+  try {
+    const store = getInstallationStore();
+    const installations = await store.getInstallationsByTenant(tenantId, channel);
+
+    return {
+      success: true,
+      message: "Channel installations retrieved successfully",
+      data: {
+        records: installations,
+        total: installations.length,
+      },
+    };
+  } catch (error) {
+    console.error("Failed to get channel installations:", error);
+    return {
+      success: false,
+      message: "Failed to retrieve channel installations",
+      data: {
+        records: [],
+        total: 0,
+      },
+    };
+  }
+}
+
+/**
+ * Get a single channel installation by ID
+ */
+export async function getChannelInstallation(
+  request: FastifyRequest<{
+    Params: { installationId: string };
+  }>,
+  reply: FastifyReply,
+): Promise<ChannelInstallationResponse> {
+  const tenantId = getTenantId(request);
+  const { installationId } = request.params;
+
+  try {
+    const store = getInstallationStore();
+    const installation = await store.getInstallationById(installationId);
+
+    if (!installation) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "Channel installation not found",
+      };
+    }
+
+    // Verify tenant access
+    if (installation.tenantId !== tenantId) {
+      reply.code(403);
+      return {
+        success: false,
+        message: "Access denied",
+      };
+    }
+
+    return {
+      success: true,
+      message: "Channel installation retrieved successfully",
+      data: installation,
+    };
+  } catch (error) {
+    console.error("Failed to get channel installation:", error);
+    return {
+      success: false,
+      message: "Failed to retrieve channel installation",
+    };
+  }
+}
+
+/**
+ * Create new channel installation
+ */
+export async function createChannelInstallation(
+  request: FastifyRequest<{
+    Body: CreateChannelInstallationRequest & { id?: string };
+  }>,
+  reply: FastifyReply,
+): Promise<ChannelInstallationResponse> {
+  const tenantId = getTenantId(request);
+  const body = request.body;
+
+  try {
+    // Validate required fields
+    if (!body.channel) {
+      reply.code(400);
+      return {
+        success: false,
+        message: "Channel type is required",
+      };
+    }
+
+    if (!body.config) {
+      reply.code(400);
+      return {
+        success: false,
+        message: "Configuration is required",
+      };
+    }
+
+    // Validate Lark-specific config
+    if (body.channel === "lark") {
+      const larkConfig = body.config;
+      if (!larkConfig.appId || !larkConfig.appSecret) {
+        reply.code(400);
+        return {
+          success: false,
+          message: "appId and appSecret are required for Lark installations",
+        };
+      }
+      if (!larkConfig.assistantId) {
+        reply.code(400);
+        return {
+          success: false,
+          message: "assistantId is required for Lark installations",
+        };
+      }
+    }
+
+    const store = getInstallationStore();
+    const installationId = body.id || randomUUID();
+    
+    const installation = await store.createInstallation(
+      tenantId,
+      installationId,
+      body,
+    );
+
+    reply.code(201);
+    return {
+      success: true,
+      message: "Channel installation created successfully",
+      data: installation,
+    };
+  } catch (error: any) {
+    console.error("Failed to create channel installation:", error);
+    
+    // Check for duplicate key error
+    if (error.message?.includes("duplicate") || error.code === "23505") {
+      reply.code(409);
+      return {
+        success: false,
+        message: "Channel installation with this ID already exists",
+      };
+    }
+
+    return {
+      success: false,
+      message: "Failed to create channel installation",
+    };
+  }
+}
+
+/**
+ * Update channel installation
+ */
+export async function updateChannelInstallation(
+  request: FastifyRequest<{
+    Params: { installationId: string };
+    Body: UpdateChannelInstallationRequest;
+  }>,
+  reply: FastifyReply,
+): Promise<ChannelInstallationResponse> {
+  const tenantId = getTenantId(request);
+  const { installationId } = request.params;
+  const body = request.body;
+
+  try {
+    const store = getInstallationStore();
+
+    // Verify installation exists and belongs to tenant
+    const existing = await store.getInstallationById(installationId);
+    if (!existing) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "Channel installation not found",
+      };
+    }
+
+    if (existing.tenantId !== tenantId) {
+      reply.code(403);
+      return {
+        success: false,
+        message: "Access denied",
+      };
+    }
+
+    const installation = await store.updateInstallation(
+      tenantId,
+      installationId,
+      body,
+    );
+
+    if (!installation) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "Channel installation not found",
+      };
+    }
+
+    return {
+      success: true,
+      message: "Channel installation updated successfully",
+      data: installation,
+    };
+  } catch (error) {
+    console.error("Failed to update channel installation:", error);
+    return {
+      success: false,
+      message: "Failed to update channel installation",
+    };
+  }
+}
+
+/**
+ * Delete channel installation
+ */
+export async function deleteChannelInstallation(
+  request: FastifyRequest<{
+    Params: { installationId: string };
+  }>,
+  reply: FastifyReply,
+): Promise<{ success: boolean; message: string }> {
+  const tenantId = getTenantId(request);
+  const { installationId } = request.params;
+
+  try {
+    const store = getInstallationStore();
+
+    // Verify installation exists and belongs to tenant
+    const existing = await store.getInstallationById(installationId);
+    if (!existing) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "Channel installation not found",
+      };
+    }
+
+    if (existing.tenantId !== tenantId) {
+      reply.code(403);
+      return {
+        success: false,
+        message: "Access denied",
+      };
+    }
+
+    const deleted = await store.deleteInstallation(tenantId, installationId);
+
+    if (!deleted) {
+      reply.code(404);
+      return {
+        success: false,
+        message: "Channel installation not found",
+      };
+    }
+
+    return {
+      success: true,
+      message: "Channel installation deleted successfully",
+    };
+  } catch (error) {
+    console.error("Failed to delete channel installation:", error);
+    return {
+      success: false,
+      message: "Failed to delete channel installation",
+    };
+  }
+}

package/src/controllers/threads.ts

@@ -58,20 +58,22 @@ interface ThreadUpdateBody {
 export async function getThreadList(
   request: FastifyRequest<{
     Params: { assistantId: string };
-    Querystring: { workspaceId?: string; projectId?: string };
   }>,
   reply: FastifyReply
 ): Promise<ThreadListResponse> {
   const tenantId = getTenantId(request);
   const { assistantId } = request.params;
 
-  // Build metadata filter from query params
+  // Build metadata filter from headers (workspace/project isolation)
   const metadataFilter: Record<string, string> = {};
-  if (request.query.workspaceId) {
-    metadataFilter.workspaceId = request.query.workspaceId;
+  const workspaceId = request.headers["x-workspace-id"] as string | undefined;
+  const projectId = request.headers["x-project-id"] as string | undefined;
+  
+  if (workspaceId) {
+    metadataFilter.workspaceId = workspaceId;
   }
-  if (request.query.projectId) {
-    metadataFilter.projectId = request.query.projectId;
+  if (projectId) {
+    metadataFilter.projectId = projectId;
   }
 
   const storeLattice = getStoreLattice("default", "thread");

package/src/routes/channel-installations.ts

@@ -0,0 +1,33 @@
+import { FastifyInstance } from "fastify";
+import * as channelInstallationController from "../controllers/channel-installations";
+
+/**
+ * Register channel installation management routes
+ */
+export function registerChannelInstallationRoutes(app: FastifyInstance): void {
+  // List all installations for current tenant
+  app.get<{
+    Querystring: { channel?: "lark" };
+  }>("/api/channel-installations", channelInstallationController.getChannelInstallationList);
+
+  // Get single installation by ID
+  app.get<{
+    Params: { installationId: string };
+  }>("/api/channel-installations/:installationId", channelInstallationController.getChannelInstallation);
+
+  // Create new installation
+  app.post<{
+    Body: any;
+  }>("/api/channel-installations", channelInstallationController.createChannelInstallation);
+
+  // Update installation
+  app.put<{
+    Params: { installationId: string };
+    Body: any;
+  }>("/api/channel-installations/:installationId", channelInstallationController.updateChannelInstallation);
+
+  // Delete installation
+  app.delete<{
+    Params: { installationId: string };
+  }>("/api/channel-installations/:installationId", channelInstallationController.deleteChannelInstallation);
+}

package/src/routes/index.ts

@@ -39,6 +39,8 @@ import { registerMcpServerConfigRoutes } from "../controllers/mcp-configs";
 import { registerUserRoutes } from "../controllers/users";
 import { registerTenantRoutes } from "../controllers/tenants";
 import { registerAuthRoutes } from "../controllers/auth";
+import { registerChannelRoutes } from "../channels/routes";
+import { registerChannelInstallationRoutes } from "./channel-installations";
 // import {
 //   getThreadStatusHandler,
 //   getAgentThreadsHandler,
@@ -343,6 +345,10 @@ export const registerLatticeRoutes = (app: FastifyInstance): void => {
     allowTenantRegistration: process.env.ALLOW_TENANT_REGISTRATION !== "false",
   });
 
+  registerChannelRoutes(app);
+
+  registerChannelInstallationRoutes(app);
+
   // // Thread 状态查询路由
   // app.get("/api/threads/:thread_id/status", getThreadStatusHandler);
   // app.get("/api/assistants/:assistant_id/threads/status", getAgentThreadsHandler);