@c4roa0/agentpay-user 0.0.0-stage → 0.3.0

package/src/owner-signer.mjs

@@ -0,0 +1,67 @@
+// Explicit owner signer selection. A chain ID never implicitly grants access to
+// unlocked test accounts; external owners approve fixed plans outside local Wallet.
+// SPDX-License-Identifier: MPL-2.0
+// This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
+// If a copy was not distributed with this file, see https://mozilla.org/MPL/2.0/.
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+import { join } from "node:path";
+
+export function ownerSignerKind(value = "external") {
+  if (!["external", "anvil"].includes(value))
+    throw Error("Owner signer must be external or anvil.");
+  return value;
+}
+async function read(path) {
+  let h;
+  try {
+    h = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const st = await h.stat();
+    if (
+      !st.isFile() ||
+      st.uid !== process.getuid() ||
+      st.mode & 0o077 ||
+      st.size > 4096
+    )
+      throw Error("Unsafe owner signer settings.");
+    return JSON.parse(await h.readFile("utf8"));
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  } finally {
+    await h?.close();
+  }
+}
+export async function selectedOwnerSigner({
+  dataDir,
+  choice,
+  readState = read,
+  env = process.env,
+} = {}) {
+  const explicit = choice ?? env.AGENTPAY_OWNER_SIGNER;
+  if (explicit !== undefined) return ownerSignerKind(explicit);
+  const saved = await readState(join(dataDir, "runtime", "owner-signer.json"));
+  if (saved === null || saved === undefined) return "external";
+  if (
+    saved.version !== 1 ||
+    Object.keys(saved).some((k) => !["version", "kind"].includes(k))
+  )
+    throw Error("Invalid owner signer settings.");
+  return ownerSignerKind(saved.kind);
+}
+// This guard is independent of any chain mode label downloaded from Market.
+export function checkTestSigner(kind, source) {
+  ownerSignerKind(kind);
+  if (kind !== "anvil") return;
+  const rpc = new URL(source.registryRpcUrl || source.rpcUrl);
+  if (
+    source.chainId !== 31337 ||
+    rpc.protocol !== "http:" ||
+    !["127.0.0.1", "localhost", "[::1]"].includes(rpc.hostname) ||
+    rpc.username ||
+    rpc.password ||
+    rpc.search ||
+    rpc.hash
+  )
+    throw Error("Anvil owner signer requires chain 31337 and loopback HTTP.");
+}

package/src/policy-info.mjs

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: MPL-2.0
+// This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
+// If a copy was not distributed with this file, see https://mozilla.org/MPL/2.0/.
+import { resolveUserDataDir } from "./local-data-directory.mjs";
+import { readAuthorizationStatus } from "./status-panel.mjs";
+export async function showPolicyInfo({
+  write = console.log,
+  resolveDirectory = resolveUserDataDir,
+} = {}) {
+  try {
+    const p = await readAuthorizationStatus(await resolveDirectory());
+    write(
+      "\n> Spending permission\n  Policy ID: " +
+        p.policyId +
+        "\n  Valid until: " +
+        new Date(p.validUntil * 1000).toLocaleString(),
+    );
+    write(
+      "  Status: " +
+        (p.revoked
+          ? "Revoked (last verified)"
+          : p.validUntil <= Math.floor(Date.now() / 1000)
+            ? "Expired"
+            : "Within saved validity period"),
+    );
+    write(
+      "\nRenew or change limits: agentpay policy renew\nRevoke permission: agentpay policy revoke\nWallet and network details: agentpay wallet info",
+    );
+    return 0;
+  } catch (e) {
+    write(
+      e.code === "ENOENT"
+        ? "No saved spending permission. Continue agentpay setup."
+        : "Could not read the saved permission. Check agentpay wallet info.",
+    );
+    return 1;
+  }
+}

package/src/policy-migration.mjs

@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: MPL-2.0
+// This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
+// If a copy was not distributed with this file, see https://mozilla.org/MPL/2.0/.
+import { unixSecondsToMilliseconds } from "@c4roa0/agentpay-protocol";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import {
+  assertPrivateFile,
+  atomicWritePrivate,
+} from "./private-journal-files.mjs";
+// Public user-facing projection. Chain verification and local switching belong to Wallet.
+export function migrationSummary(plan) {
+  return {
+    migrationId: plan.migrationId,
+    chainId: plan.source.chainId,
+    safe: plan.source.safe,
+    delegate: plan.source.delegate,
+    token: plan.source.token,
+    registry: plan.source.registry,
+    oldPolicyId: plan.source.policyId,
+    newPolicyId: plan.destination.policyId,
+    oldModule: plan.source.module,
+    newModule: plan.destination.module,
+    oldFactory: plan.source.factory,
+    newFactory: plan.destination.factory,
+    originalBudgetAtomic: plan.sourceTerms.totalBudget,
+    alreadySpentAtomic: plan.sourceTerms.spent,
+    replacementBudgetAtomic: plan.totalBudget,
+    oldPerPaymentAtomic: plan.source.maxAmount,
+    newPerPaymentAtomic: plan.destination.maxAmount,
+    validAfter: plan.validAfter,
+    validUntil: plan.destination.validUntil,
+    expiresAt: new Date(
+      unixSecondsToMilliseconds(plan.destination.validUntil),
+    ).toISOString(),
+    expiresAtMs: unixSecondsToMilliseconds(plan.destination.validUntil),
+    note: "Migration pauses Wallet signing. Revoke the old Policy before creating the replacement. No budget increase or expiry extension.",
+  };
+}
+
+export function migratedPublicPolicy(plan) {
+  const p = plan.destination;
+  return {
+    chainId: p.chainId,
+    rpcUrl: p.registryRpcUrl,
+    safe: p.safe,
+    module: p.module,
+    factory: p.factory,
+    registry: p.registry,
+    token: p.token,
+    policyId: p.policyId,
+    maxPerPayment: p.maxAmount,
+    totalBudget: plan.totalBudget,
+    validAfter: plan.validAfter,
+    validUntil: p.validUntil,
+  };
+}
+
+export async function syncMigratedPublicPolicy(dataDir, plan) {
+  const path = join(dataDir, "public-policy.json");
+  await assertPrivateFile(path);
+  const current = JSON.parse(await readFile(path, "utf8"));
+  const matches = (p) =>
+    [
+      "chainId",
+      "safe",
+      "module",
+      "factory",
+      "registry",
+      "token",
+      "policyId",
+      "validUntil",
+    ].every(
+      (key) =>
+        String(current[key]).toLowerCase() === String(p[key]).toLowerCase(),
+    );
+  if (!matches(plan.source) && !matches(plan.destination))
+    throw new Error("PUBLIC_POLICY_CONFIG_CONFLICT");
+  const replacement = { ...current, ...migratedPublicPolicy(plan) };
+  // The Wallet journal already preserves the old binding and on-chain budget.
+  // If this write fails, rerunning complete verifies the chain and retries only this projection.
+  await atomicWritePrivate(path, JSON.stringify(replacement, null, 2));
+  return path;
+}

package/src/policy-operations.mjs

@@ -0,0 +1,67 @@
+// Resumable owner-authorized permission changes. Keep original operation identity
+// and verify chain effects before updating local binding or continuing connection.
+// SPDX-License-Identifier: MPL-2.0
+// This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
+// If a copy was not distributed with this file, see https://mozilla.org/MPL/2.0/.
+import { approveOwnerOperations } from "./owner-approval-server.mjs";
+import { ownerSignerKind, checkTestSigner } from "./owner-signer.mjs";
+import { Contract, Interface } from "ethers";
+import { executeAnvilOwnerCall } from "./safe-owner-anvil.mjs";
+const abi = [
+  "function policies(address,bytes32) view returns(address delegate,address token,address factory,address registry,uint256 maxPerPayment,uint256 totalBudget,uint256 spent,uint64 validAfter,uint64 validUntil,bool revoked)",
+  "function revokePolicy(bytes32 policyId)",
+];
+export async function revokeOnChain({
+  rpc,
+  policy,
+  write = console.log,
+  submit = executeAnvilOwnerCall,
+  ownerSigner = "external",
+  dataDir,
+  ask,
+  approve = approveOwnerOperations,
+}) {
+  const signer = ownerSignerKind(ownerSigner);
+  checkTestSigner(signer, policy);
+  const contract = new Contract(policy.module, abi, rpc);
+  const current = await contract.policies(policy.safe, policy.policyId);
+  if (current.delegate.toLowerCase() !== policy.delegate.toLowerCase())
+    throw Error("Policy delegate could not be verified.");
+  if (current.revoked) return true;
+  const call = {
+    purpose: "revoke previous spending permission",
+    to: policy.module,
+    value: "0",
+    operation: 0,
+    data: new Interface(abi).encodeFunctionData("revokePolicy", [
+      policy.policyId,
+    ]),
+  };
+  if (signer === "external")
+    return approve({
+      source: policy,
+      calls: [call],
+      dataDir,
+      ask,
+      write,
+      check: async () =>
+        Boolean(
+          (await contract.policies(policy.safe, policy.policyId)).revoked,
+        ),
+    });
+  const safe = new Contract(
+    policy.safe,
+    [
+      "function getOwners() view returns(address[])",
+      "function getThreshold() view returns(uint256)",
+    ],
+    rpc,
+  );
+  const owners = await safe.getOwners();
+  if (Number(await safe.getThreshold()) !== 1 || owners.length !== 1)
+    throw Error("Private rehearsal requires the sole prepared Safe owner.");
+  await submit({ source: policy }, owners[0], call);
+  if (!(await contract.policies(policy.safe, policy.policyId)).revoked)
+    throw Error("Policy revocation has not been verified.");
+  return true;
+}

package/src/policy-preview-server.mjs

@@ -0,0 +1,236 @@
+// SPDX-License-Identifier: MPL-2.0
+// This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
+// If a copy was not distributed with this file, see https://mozilla.org/MPL/2.0/.
+import {
+  assertUnixMilliseconds,
+  parseLegacyIsoMilliseconds,
+} from "@c4roa0/agentpay-protocol";
+import { isIP } from "node:net";
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { parseUnits, JsonRpcProvider } from "ethers";
+import { buildSafePolicyPlan, inspectSafePolicy } from "./safe-policy-plan.mjs";
+
+export function createPolicyPreviewServer({
+  deployment,
+  delegate,
+  demoNetworkPreview = false,
+  inspect = async (plan) => {
+    const rpc = new JsonRpcProvider(plan.rpcUrl);
+    try {
+      return await inspectSafePolicy(rpc, plan);
+    } finally {
+      rpc.destroy();
+    }
+  },
+}) {
+  const token = randomBytes(32).toString("hex");
+  const policyId = `0x${randomBytes(32).toString("hex")}`;
+  const trusted = Object.fromEntries(
+    ["chainId", "rpcUrl", "module", "token", "factory", "registry"].map((k) => [
+      k,
+      deployment[k],
+    ]),
+  );
+  const decimals = deployment.tokenDecimals;
+  if (
+    !Number.isInteger(decimals) ||
+    decimals < 0 ||
+    decimals > 18 ||
+    typeof deployment.source !== "string" ||
+    !deployment.source.trim()
+  ) {
+    throw new Error(
+      "Public deployment file requires tokenDecimals (0–18) and source",
+    );
+  }
+  buildSafePolicyPlan(
+    {
+      ...trusted,
+      safe: delegate,
+      policyId,
+      maxPerPayment: "1",
+      totalBudget: "1",
+      validAfter: 0,
+      validUntil: Math.floor(Date.now() / 1000) + 3600,
+    },
+    delegate,
+  );
+  let busy = false;
+  return createServer(async (req, res) => {
+    const localOrigin = `http://127.0.0.1:${res.socket.localPort}`;
+    let origin = localOrigin;
+    let validHost = req.headers.host === new URL(localOrigin).host;
+    if (demoNetworkPreview) {
+      try {
+        const requested = new URL(`http://${req.headers.host}`);
+        validHost =
+          (!!isIP(requested.hostname) || requested.hostname === "localhost") &&
+          requested.host === req.headers.host;
+        if (validHost) origin = requested.origin;
+      } catch {
+        validHost = false;
+      }
+    }
+    const send = (status, data) => {
+      res.writeHead(status, {
+        "content-type": "application/json; charset=utf-8",
+      });
+      res.end(JSON.stringify(data));
+    };
+    res.setHeader("cache-control", "no-store");
+    res.setHeader("x-content-type-options", "nosniff");
+    res.setHeader(
+      "content-security-policy",
+      "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'; form-action 'self'; base-uri 'none'",
+    );
+    if (!validHost || req.headers["sec-fetch-site"] === "cross-site")
+      return send(403, { error: "Use the local preview address directly" });
+    try {
+      if (req.method === "GET" && req.url === "/") {
+        res.setHeader(
+          "set-cookie",
+          `preview=${token}; HttpOnly; SameSite=Strict; Path=/`,
+        );
+        res.setHeader("content-type", "text/html; charset=utf-8");
+        return res.end(
+          await readFile(
+            new URL("../web/policy-preview.html", import.meta.url),
+            "utf8",
+          ),
+        );
+      }
+      if (req.method === "GET" && req.url === "/preview.js") {
+        res.setHeader("content-type", "text/javascript; charset=utf-8");
+        return res.end(
+          await readFile(
+            new URL("../web/policy-preview.js", import.meta.url),
+            "utf8",
+          ),
+        );
+      }
+      if (
+        !String(req.headers.cookie || "")
+          .split(";")
+          .some((item) => item.trim() === `preview=${token}`)
+      )
+        return send(403, { error: "Open the local page first" });
+      if (req.method === "GET" && req.url === "/context")
+        return send(200, {
+          deployment: {
+            ...trusted,
+            tokenDecimals: decimals,
+            source: deployment.source,
+          },
+          delegate,
+          policyId,
+        });
+      if (req.method !== "POST" || req.url !== "/preview")
+        return send(404, { error: "Not found" });
+      if (
+        req.headers.origin !== origin ||
+        req.headers["content-type"] !== "application/json" ||
+        req.headers["x-agentpay-preview"] !== "1"
+      )
+        return send(403, { error: "Local page request required" });
+      if (busy)
+        return send(409, {
+          error: "A preview is already running; wait and retry",
+        });
+      busy = true;
+      try {
+        let body = "";
+        for await (const chunk of req) {
+          body += chunk.toString();
+          if (Buffer.byteLength(body) > 4096)
+            return send(413, { error: "Request too large" });
+        }
+        const input = JSON.parse(body);
+        if (
+          Object.keys(input).some(
+            (k) =>
+              ![
+                "safe",
+                "budget",
+                "perPayment",
+                "validUntil",
+                "validUntilMs",
+              ].includes(k),
+          )
+        )
+          throw new Error("Unsupported preview field");
+        for (const key of ["budget", "perPayment"])
+          if (
+            typeof input[key] !== "string" ||
+            !/^\d+(\.\d+)?$/.test(input[key])
+          )
+            throw new Error("Amounts must be positive decimal values");
+        const until = Object.hasOwn(input, "validUntilMs")
+          ? assertUnixMilliseconds(input.validUntilMs)
+          : parseLegacyIsoMilliseconds(input.validUntil);
+        if (
+          input.validUntil !== undefined &&
+          parseLegacyIsoMilliseconds(input.validUntil) !== until
+        )
+          throw Error("Expiry representations disagree");
+        if (!Number.isFinite(until)) throw new Error("Choose a valid expiry");
+        const plan = buildSafePolicyPlan(
+          {
+            ...trusted,
+            safe: input.safe,
+            policyId,
+            totalBudget: parseUnits(input.budget, decimals).toString(),
+            maxPerPayment: parseUnits(input.perPayment, decimals).toString(),
+            validAfter: Math.floor(Date.now() / 1000),
+            validUntil: Math.floor(until / 1000),
+          },
+          delegate,
+        );
+        let state = null,
+          chainError = null;
+        try {
+          state = await Promise.race([
+            inspect(plan),
+            new Promise((_, reject) => {
+              const timer = setTimeout(
+                () => reject(new Error("timeout")),
+                10000,
+              );
+              timer.unref();
+            }),
+          ]);
+        } catch {
+          chainError =
+            "链上只读核对未通过。检查 RPC、网络和 Safe／合约地址；不能继续签名。";
+        }
+        send(200, {
+          ok: true,
+          draft: {
+            safe: plan.safe,
+            delegate: plan.delegate,
+            chainId: plan.chainId,
+            budget: input.budget,
+            perPayment: input.perPayment,
+            validUntil: new Date(until).toISOString(),
+            validUntilMs: until,
+            policyId: plan.policyId,
+            calls: plan.calls,
+          },
+          chainState: state,
+          chainError,
+          readyToSign: false,
+          readyToPurchase: false,
+          mode: "preview_only",
+        });
+      } finally {
+        busy = false;
+      }
+    } catch {
+      send(400, {
+        error:
+          "请检查 Safe 地址、预算、单笔上限和未来的有效期；总预算不能小于单笔上限。",
+      });
+    }
+  });
+}