@axiom-lattice/gateway 3.0.2 → 3.0.4

package/src/controllers/resources.ts

@@ -1,477 +0,0 @@
-import { FastifyRequest, FastifyReply } from "fastify";
-import type { ResourceAddress, ShareRecord, SharedResourceStore } from "@axiom-lattice/protocols";
-import bcrypt from "bcryptjs";
-import {
-  generateToken,
-  createSharePayload,
-  TokenCache,
-  SandboxLatticeManager,
-  buildNamedVolumeName,
-} from "@axiom-lattice/core";
-import { getContentTypeFromFilename } from "../utils/mime";
-
-interface ResourceControllerDeps {
-  store: SharedResourceStore;
-  sandboxManager: SandboxLatticeManager;
-  cache: TokenCache;
-  logger: { info: (msg: string, obj?: object) => void; warn: (msg: string, obj?: object) => void; error: (msg: string, obj?: object) => void };
-}
-
-export class ResourceController {
-  constructor(private deps: ResourceControllerDeps) {}
-
-  async createShare(request: FastifyRequest, reply: FastifyReply) {
-    const userId = (request as any).user
-      ? (request as any).user.id ?? "unknown"
-      : "unknown";
-    const tenantId = (request.headers["x-tenant-id"] as string) || "default";
-    const workspaceId = request.headers["x-workspace-id"] as string;
-    const projectId = request.headers["x-project-id"] as string;
-    const body = request.body as any;
-
-    if (!workspaceId || !projectId) {
-      return reply.status(400).send({ error: "x-workspace-id and x-project-id headers required" });
-    }
-
-    const payload = createSharePayload(
-      tenantId,
-      workspaceId,
-      projectId,
-      userId as string,
-      body,
-    );
-    const token = generateToken();
-
-    try {
-      await this.deps.store.create({ ...payload, token });
-      this.deps.logger.info(
-        "[share] created",
-        { token, originalPath: body.resourcePath, normalizedPath: payload.address.resourcePath, volume: payload.address.volume, userId },
-      );
-    } catch {
-      return reply.status(500).send({ error: "Failed to create share" });
-    }
-
-    return reply.status(201).send({ token, url: `/s/${token}` });
-  }
-
-  async listShares(request: FastifyRequest, reply: FastifyReply) {
-    const userId = (request as any).user
-      ? (request as any).user.id ?? "unknown"
-      : "unknown";
-    const tenantId = (request.headers["x-tenant-id"] as string) || "default";
-    const shares = await this.deps.store.listByUser(tenantId, userId as string);
-    return reply.send(shares.filter((r: any) => (r as any).visibility !== "internal"));
-  }
-
-  async updateShare(request: FastifyRequest, reply: FastifyReply) {
-    const { token } = request.params as unknown as { token: string };
-    const userId = (request as any).user
-      ? (request as any).user.id ?? "unknown"
-      : "unknown";
-    const patch = request.body as any;
-
-    const record = await this.deps.store.findByToken(token);
-    if (!record || record.createdBy !== userId) {
-      return reply.status(404).send({ error: "Share not found" });
-    }
-
-    await this.deps.store.update(token, patch);
-
-    if (patch.revoked) {
-      this.deps.cache.invalidate(token);
-    }
-
-    return reply.send({ ok: true });
-  }
-
-  async revokeShare(request: FastifyRequest, reply: FastifyReply) {
-    const { token } = request.params as unknown as { token: string };
-    const userId = (request as any).user
-      ? (request as any).user.id ?? "unknown"
-      : "unknown";
-
-    const record = await this.deps.store.findByToken(token);
-    if (!record || record.createdBy !== userId) {
-      return reply.status(404).send({ error: "Share not found" });
-    }
-
-    await this.deps.store.update(token, { revoked: true });
-    this.deps.cache.invalidate(token);
-
-    return reply.send({ ok: true });
-  }
-
-  async resolveResource(request: FastifyRequest, reply: FastifyReply) {
-    const params = request.params as unknown as { token: string; "*"?: string };
-    const { token } = params;
-    const subPath = params["*"] ?? "";
-
-    this.deps.logger.info("[share] resolve start", { token, subPath });
-
-    const isApi = subPath && /(^|\/)api\//.test(subPath) && (subPath.endsWith(".js") || subPath.endsWith(".py"));
-
-    // Only API paths accept non-GET methods
-    if (request.method !== "GET" && !isApi) {
-      return reply.status(405).send({ error: "Method not allowed" });
-    }
-
-    // API runtime — proxy to sandbox. Detected by /api/ anywhere in subPath.
-    if (isApi) {
-      const record = await this.deps.store.findByToken(token);
-      if (!record || record.revoked) return reply.status(404).send("Not found");
-      if (record.expiresAt && new Date(record.expiresAt) < new Date()) {
-        return reply.status(410).send("Expired");
-      }
-      // Auth check for API calls (same as file access)
-      if (!this._isInternalRequest(request)) {
-        if (record.visibility === "internal") {
-          return reply.status(401).send({ error: "Internal access only" });
-        }
-        if (record.visibility === "password") {
-          if (!this._isUnlocked(request, token)) {
-            return reply.status(401).send({ error: "Password required" });
-          }
-        }
-      }
-      const ext = subPath.endsWith(".py") ? "py" : "js";
-      return this._execApi(record, subPath, ext, request, reply);
-    }
-
-    // 1. Check cache
-    const cached = this.deps.cache.get(token);
-    if (cached && !cached.requiresUnlock) {
-      this.deps.logger.info("[share] cache hit", { token, volume: cached.address.volume, resourcePath: cached.address.resourcePath });
-      return this._serveFile(cached.address, token, subPath, cached.sandboxConfig ?? { tenantId: "default", workspaceId: "", projectId: "", assistantId: null }, reply);
-    }
-    this.deps.logger.info("[share] cache miss, querying DB", { token });
-
-    // 2. Single DB lookup
-    const record = await this.deps.store.findByToken(token);
-    if (!record || record.revoked) {
-      this.deps.logger.warn("[share] token not found or revoked", { token, found: !!record, revoked: record?.revoked });
-      return reply.status(404).send("Not found");
-    }
-    if (record.expiresAt && new Date(record.expiresAt) < new Date()) {
-      this.deps.logger.info("[share] token expired", { token, expiresAt: record.expiresAt });
-      return reply.status(410).send("Expired");
-    }
-
-    this.deps.logger.info("[share] record found", {
-      token,
-      volume: record.address.volume,
-      resourcePath: record.address.resourcePath,
-      visibility: record.visibility,
-      workspaceId: record.workspaceId,
-      projectId: record.projectId,
-    });
-
-    // 3. Auth
-    const isInternal = this._isInternalRequest(request);
-    if (!isInternal) {
-      // Internal shares: must be logged in
-      if (record.visibility === "internal") {
-        return reply.status(401).send({ error: "Internal access only" });
-      }
-      if (record.visibility === "password") {
-        const unlocked = this._isUnlocked(request, token);
-        if (!unlocked) {
-          this.deps.logger.info("[share] password protected, returning password page", { token });
-          this.deps.cache.set(token, {
-            address: record.address,
-            requiresUnlock: true,
-            sandboxConfig: { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId },
-          });
-          return reply.type("text/html").send(this._passwordPage(token));
-        }
-        this.deps.logger.info("[share] password unlocked", { token });
-      }
-    }
-
-    // 4. Access count
-    if (record.maxAccess !== null) {
-      const ok = await this.deps.store.atomicIncrementAccess(token);
-      if (!ok) return reply.status(410).send("Access limit reached");
-    } else {
-      this.deps.store.incrementAccess(token).catch(() => {});
-    }
-
-    // 5. Cache
-    const sandboxConfig = { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId };
-    this.deps.cache.set(token, {
-      address: record.address,
-      requiresUnlock: record.visibility === "password" && !isInternal,
-      sandboxConfig,
-    });
-
-    return this._serveFile(record.address, token, subPath, sandboxConfig, reply);
-  }
-
-  /**
-   * Thin redirect: /f/{uuidHex3}/{path} → /s/{internal-token}/{path}
-   * Decodes 3 UUIDs (no dashes, 96 hex chars), ensures internal share, 302 redirects.
-   */
-  async resolveDirectFile(request: FastifyRequest, reply: FastifyReply) {
-    const params = request.params as unknown as { tid: string; wid: string; pid: string; "*"?: string };
-    const tenantId = params.tid;
-    const workspaceId = params.wid;
-    const projectId = params.pid;
-    const subPath = (params["*"] ?? "");
-
-    const isApi = subPath && /(^|\/)api\//.test(subPath) && (subPath.endsWith(".js") || subPath.endsWith(".py"));
-
-    // Only API paths accept non-GET methods
-    if (request.method !== "GET" && !isApi) {
-      return reply.status(405).send({ error: "Method not allowed" });
-    }
-
-    // API runtime
-    if (isApi) {
-      const ext = subPath.endsWith(".py") ? "py" : "js";
-      return this._execApiCore({
-        tenantId, workspaceId, projectId, assistantId: "",
-        resourcePath: subPath,
-      }, subPath, ext, request, reply);
-    }
-
-    const volume = buildNamedVolumeName("p", "project", tenantId, workspaceId, projectId);
-    return this._resolveAndServe(volume, subPath, reply, `/f/${tenantId}/${workspaceId}/${projectId}`,
-      { tenantId, workspaceId, projectId, assistantId: null },
-    );
-  }
-
-  async unlockShare(request: FastifyRequest, reply: FastifyReply) {
-    const { token } = request.params as unknown as { token: string };
-    const { password } = request.body as unknown as { password: string };
-
-    const record = await this.deps.store.findByToken(token);
-    if (!record || !record.passwordHash) {
-      return reply.status(404).send({ error: "Invalid request" });
-    }
-
-    const valid = await bcrypt.compare(password, record.passwordHash!);
-    if (!valid) {
-      return reply.status(401).send({ error: "Incorrect password" });
-    }
-
-    const cookieOpts = [
-      `share_unlock_${token}=1`,
-      "Max-Age=86400",
-      `Path=/s/${token}`,
-      "SameSite=Lax",
-      "HttpOnly",
-    ];
-    if (request.protocol === "https") {
-      cookieOpts.push("Secure");
-    }
-    reply.header("Set-Cookie", cookieOpts.join("; "));
-    return reply.send({ ok: true });
-  }
-
-  private _isInternalRequest(request: FastifyRequest): boolean {
-    const user = (request as any).user;
-    if (user && user.id) return true;
-    // Fallback: same-origin browser request (iframe/img embed — no Auth header)
-    const origin = request.headers.origin || request.headers.referer;
-    if (origin) {
-      try {
-        const { hostname } = new URL(origin);
-        if (hostname === request.hostname) return true;
-      } catch { /* malformed */ }
-    }
-    return false;
-  }
-
-  private _isUnlocked(request: FastifyRequest, token: string): boolean {
-    const cookie = request.headers.cookie ?? "";
-    return cookie.includes(`share_unlock_${token}=1`);
-  }
-
-  /** Returns true if the path has a file extension indicating it's a file, not a directory */
-  private _isFilePath(path: string): boolean {
-    return /\.[a-zA-Z0-9]+$/.test(path);
-  }
-
-  /**
-   * Shared file resolution: directory → index.html, volume FS → sandbox, base tag, response.
-   */
-  private async _resolveAndServe(
-    volume: string,
-    resourcePath: string,
-    reply: FastifyReply,
-    baseTagPrefix: string,
-    sandboxConfig?: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },
-  ) {
-    const cleanPath = resourcePath.replace(/\/+$/, "");
-    const entryPath = !cleanPath
-      ? "index.html"
-      : this._isFilePath(cleanPath)
-        ? cleanPath
-        : `${cleanPath}/index.html`;
-
-    const address: ResourceAddress = { volume, resourcePath: "" };
-
-    let buf: Buffer;
-    try {
-      // Volume FS first
-      const provider = this.deps.sandboxManager.getDefaultProvider();
-      buf = await provider.getResourceResolver().resolve({ ...address, resourcePath: entryPath });
-    } catch {
-      // Sandbox fallback
-      if (!sandboxConfig) return reply.status(404).send("File not found");
-      try {
-        const sandbox = await this.deps.sandboxManager.getSandboxFromConfig({
-          assistant_id: sandboxConfig.assistantId ?? "",
-          thread_id: "",
-          tenantId: sandboxConfig.tenantId,
-          workspaceId: sandboxConfig.workspaceId,
-          projectId: sandboxConfig.projectId,
-        });
-        buf = await sandbox.file.downloadFile({ file: `/project/${entryPath}` });
-      } catch {
-        return reply.status(404).send("File not found");
-      }
-    }
-
-    const filename = entryPath.split("/").pop() || "download";
-    const contentType = getContentTypeFromFilename(filename);
-
-    // Inject base tag for HTML
-    if (/\.(html|htm)$/i.test(filename)) {
-      const baseDir = cleanPath
-        ? (this._isFilePath(cleanPath) ? cleanPath.replace(/[^/]+$/, "") : cleanPath)
-        : "";
-      const html = buf.toString("utf-8");
-      if (!/<base\b/i.test(html)) {
-        const baseTag = `<base href="${baseTagPrefix}${baseDir ? "/" + baseDir : ""}/">`;
-        buf = Buffer.from(
-          html.includes("<head>") ? html.replace("<head>", `<head>${baseTag}`) : baseTag + html,
-          "utf-8"
-        );
-      }
-    }
-
-    return reply
-      .status(200)
-      .type(contentType)
-      .header("Content-Disposition", `inline; filename*=UTF-8''${encodeURIComponent(filename)}`)
-      .header("Access-Control-Allow-Origin", "*")
-      .send(buf);
-  }
-
-  private async _serveFile(
-    address: ResourceAddress,
-    token: string,
-    subPath: string,
-    sandboxConfig: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },
-    reply: FastifyReply,
-  ) {
-    const resourcePath = subPath
-      ? this._resolveSafeSubPath(address.resourcePath, subPath)
-      : address.resourcePath;
-    return this._resolveAndServe(
-      address.volume,
-      resourcePath,
-      reply,
-      `/s/${token}`,
-      sandboxConfig,
-    );
-  }
-
-  private async _execApi(
-    record: ShareRecord,
-    apiSubPath: string,
-    ext: "js" | "py",
-    request: FastifyRequest,
-    reply: FastifyReply,
-  ) {
-    const basePath = this._isFilePath(record.address.resourcePath)
-      ? ""
-      : `${record.address.resourcePath}/`;
-    return this._execApiCore({
-      tenantId: record.tenantId,
-      workspaceId: record.workspaceId,
-      projectId: record.projectId,
-      assistantId: record.assistantId,
-      resourcePath: basePath + apiSubPath,
-    }, apiSubPath, ext, request, reply);
-  }
-
-  private async _execApiCore(
-    config: { tenantId: string; workspaceId: string; projectId: string; assistantId?: string | null; resourcePath: string },
-    apiSubPath: string,
-    ext: "js" | "py",
-    request: FastifyRequest,
-    reply: FastifyReply,
-  ) {
-    let sandbox: any;
-    try {
-      sandbox = await this.deps.sandboxManager.getSandboxFromConfig({
-        assistant_id: config.assistantId ?? "",
-        thread_id: "",
-        tenantId: config.tenantId,
-        workspaceId: config.workspaceId,
-        projectId: config.projectId,
-      });
-    } catch (err) {
-      this.deps.logger.error("[share] sandbox start failed for API", { error: (err as Error).message });
-      return reply.status(502).send({ error: "Sandbox unavailable" });
-    }
-
-    const scriptPath = `/project/${config.resourcePath}`;
-    const cmd = ext === "py" ? `python3 ${scriptPath}` : `node ${scriptPath}`;
-
-    // Pass query params and body via environment
-    const queryStr = request.url.includes("?") ? (request.url as string).split("?")[1] : "";
-    const queryObj: Record<string, string> = {};
-    if (queryStr) {
-      for (const [k, v] of new URLSearchParams(queryStr)) {
-        queryObj[k] = v;
-      }
-    }
-
-    const bodyStr = (request.body as string) ?? "";
-
-    const envVars = [
-      `export API_QUERY='${JSON.stringify(queryObj).replace(/'/g, "'\\''")}'`,
-      `export API_BODY='${bodyStr.replace(/'/g, "'\\''")}'`,
-      `export API_METHOD='${request.method}'`,
-      `export API_GATEWAY_URL='${request.protocol}://${request.hostname}'`,
-      `export API_TENANT_ID='${config.tenantId}'`,
-      `export API_ASSISTANT_ID='${config.assistantId || ""}'`,
-    ].join(" && ");
-
-    const fullCmd = `${envVars} && ${cmd}`;
-
-    this.deps.logger.info("[api] exec", { scriptPath, cmd: cmd.substring(0, 80) });
-
-    try {
-      const result = await sandbox.shell.execCommand({ command: fullCmd });
-      // Parse stdout as JSON
-      let data: unknown;
-      try {
-        data = JSON.parse(result.output?.trim() || "{}");
-      } catch {
-        data = { output: result.output?.trim() || "" };
-      }
-      return reply.status(200).type("application/json").send(data);
-    } catch (err) {
-      this.deps.logger.warn("[api] exec failed", { scriptPath, error: (err as Error).message });
-      return reply.status(500).send({ error: (err as Error).message });
-    }
-  }
-
-  private _resolveSafeSubPath(entryFile: string, subPath: string): string {
-    if (!subPath) return entryFile;
-    if (subPath.includes("..")) throw new Error("Path traversal denied");
-    if (subPath.startsWith(entryFile + "/") || subPath === entryFile) return subPath;
-    const entryDir = this._isFilePath(entryFile)
-      ? entryFile.replace(/[^/]+$/, "")
-      : entryFile + "/";
-    return (entryDir + subPath).replace(/\/+/g, "/");
-  }
-
-  private _passwordPage(token: string): string {
-    return `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Password Protected</title><style>body{font-family:-apple-system,BlinkMacSystemFont,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f5f5f5}.card{background:#fff;padding:32px;border-radius:12px;box-shadow:0 2px 8px rgba(0,0,0,.1);width:100%;max-width:360px;text-align:center}h2{margin:0 0 8px;font-size:20px}p{margin:0 0 20px;color:#666;font-size:14px}input{width:100%;padding:10px 12px;border:1px solid #d9d9d9;border-radius:8px;font-size:14px;box-sizing:border-box;margin-bottom:12px}button{width:100%;padding:10px;background:#6366f1;color:#fff;border:none;border-radius:8px;font-size:14px;cursor:pointer}.error{color:#ef4444;font-size:13px;margin-top:8px;display:none}</style></head><body><div class="card"><h2>Password Protected</h2><p>This share requires a password to access.</p><form id="f"><input type="password" id="p" placeholder="Enter password" required><button type="submit">Unlock</button><div class="error" id="e">Incorrect password</div></form></div><script>document.getElementById('f').onsubmit=async(e)=>{e.preventDefault();const r=await fetch('/s/${token}/unlock',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:document.getElementById('p').value})});if(r.ok)location.reload();else document.getElementById('e').style.display='block'}</script></body></html>`;
-  }
-}