@camstack/core 0.1.14 → 0.1.15

package/dist/chunk-3BK2Y7GY.mjs

@@ -0,0 +1,593 @@
+// src/builtins/local-auth/local-auth.addon.ts
+import { BaseAddon, authProviderCapability, userManagementCapability } from "@camstack/types";
+
+// src/auth/auth-manager.ts
+import * as jwt from "jsonwebtoken";
+import * as bcrypt from "bcryptjs";
+import * as crypto from "crypto";
+var noopLogger = {
+  debug() {
+  },
+  info() {
+  },
+  warn() {
+  },
+  error() {
+  },
+  child() {
+    return noopLogger;
+  },
+  withTags() {
+    return noopLogger;
+  }
+};
+var AuthManager = class {
+  constructor(config, logger = noopLogger) {
+    this.config = config;
+    this.logger = logger;
+    const configured = this.config.get("auth.jwtSecret");
+    if (configured) {
+      this.jwtSecret = configured;
+    } else {
+      const secret = crypto.randomBytes(32).toString("hex");
+      this.config.update("auth", { jwtSecret: secret });
+      this.logger.info("Generated JWT secret and saved to config.yaml (auth.jwtSecret)");
+      this.jwtSecret = secret;
+    }
+  }
+  config;
+  jwtSecret;
+  scopedTokenManager = null;
+  logger;
+  signToken(payload) {
+    return jwt.sign({ ...payload }, this.jwtSecret, { expiresIn: "24h" });
+  }
+  verifyToken(token) {
+    return jwt.verify(token, this.jwtSecret);
+  }
+  async hashPassword(password) {
+    return bcrypt.hash(password, 10);
+  }
+  async comparePassword(password, hash2) {
+    return bcrypt.compare(password, hash2);
+  }
+  generateApiKey() {
+    const token = crypto.randomBytes(32).toString("hex");
+    const hash2 = crypto.createHash("sha256").update(token).digest("hex");
+    const prefix = token.slice(0, 8);
+    return { token, hash: hash2, prefix };
+  }
+  validateApiKey(token, storedHash) {
+    const hash2 = crypto.createHash("sha256").update(token).digest("hex");
+    return hash2 === storedHash;
+  }
+  /**
+   * Create a service token for agent/worker authentication.
+   * Used when forking workers or when agents register.
+   */
+  createServiceToken(opts) {
+    const payload = {
+      userId: opts.agentId,
+      username: opts.agentId,
+      role: opts.role ?? "agent",
+      type: "service",
+      agentId: opts.agentId,
+      allowedProviders: "*",
+      allowedDevices: {}
+    };
+    const expiresIn = opts.expiresIn ?? "24h";
+    return jwt.sign(payload, this.jwtSecret, { expiresIn });
+  }
+  /**
+   * Set the scoped token manager for the auth chain.
+   */
+  setScopedTokenManager(manager) {
+    this.scopedTokenManager = manager;
+  }
+  /**
+   * Validate a scoped token string.
+   * Returns the token record if valid, null otherwise.
+   */
+  async validateScopedToken(rawToken) {
+    if (!this.scopedTokenManager) {
+      return null;
+    }
+    return this.scopedTokenManager.validate(rawToken);
+  }
+  /**
+   * Check whether a scoped token grants access to a given addon/route/capability.
+   */
+  matchesScopedTokenScope(token, addonId, routePath, capability) {
+    if (!this.scopedTokenManager) {
+      return false;
+    }
+    return this.scopedTokenManager.matchesScope(token, addonId, routePath, capability);
+  }
+};
+
+// src/auth/user-manager.ts
+import * as crypto2 from "crypto";
+import { UserRecordSchema } from "@camstack/types";
+
+// src/auth/parse-record.ts
+function parseRecord(kind, schema, data) {
+  try {
+    return schema.parse(data);
+  } catch (err) {
+    const topKeys = data && typeof data === "object" && !Array.isArray(data) ? Object.keys(data).join(", ") || "(empty)" : `(non-object: ${typeof data})`;
+    const detail = err instanceof Error ? err.message : String(err);
+    const looksDoubleWrapped = data && typeof data === "object" && !Array.isArray(data) && Object.keys(data).length === 1 && "data" in data;
+    const hint = looksDoubleWrapped ? " This shape is the legacy double-wrap from a stale settings-store query path. Restart the server with the latest @camstack/core build." : "";
+    throw new Error(
+      `Failed to parse ${kind} from settings store. Top-level keys=[${topKeys}].${hint} Underlying: ${detail}`,
+      { cause: err }
+    );
+  }
+}
+
+// src/auth/user-manager.ts
+var USERS_COLLECTION = "users";
+function parseUser(data) {
+  return parseRecord("user", UserRecordSchema, data);
+}
+var UserManager = class {
+  constructor(storageAccess, auth, config) {
+    this.storageAccess = storageAccess;
+    this.auth = auth;
+    this.config = config;
+  }
+  storageAccess;
+  auth;
+  config;
+  get store() {
+    return this.storageAccess.getStore();
+  }
+  async create(input) {
+    const existing = await this.findByUsername(input.username);
+    if (existing) throw new Error(`User with username "${input.username}" already exists`);
+    const passwordHash = await this.auth.hashPassword(input.password);
+    const now = Date.now();
+    const record = {
+      id: crypto2.randomUUID(),
+      username: input.username,
+      passwordHash,
+      role: input.role,
+      allowedProviders: input.allowedProviders ?? "*",
+      allowedDevices: input.allowedDevices ?? {},
+      createdAt: now,
+      updatedAt: now
+    };
+    await this.store.insert.mutate({ collection: USERS_COLLECTION, record: { id: record.id, data: { ...record } } });
+    return record;
+  }
+  async findByUsername(username) {
+    const results = await this.store.query.query({ collection: USERS_COLLECTION, filter: { where: { username } } });
+    if (results.length === 0) return null;
+    return parseUser(results[0].data);
+  }
+  async findById(id) {
+    const results = await this.store.query.query({ collection: USERS_COLLECTION, filter: { where: { id } } });
+    if (results.length === 0) return null;
+    return parseUser(results[0].data);
+  }
+  async validateCredentials(username, password) {
+    const user = await this.findByUsername(username);
+    if (!user) return null;
+    const valid = await this.auth.comparePassword(password, user.passwordHash);
+    return valid ? user : null;
+  }
+  async listAll() {
+    const results = await this.store.query.query({ collection: USERS_COLLECTION });
+    return results.map((r) => {
+      const parsed = parseUser(r.data);
+      const { passwordHash: _ph, ...rest } = parsed;
+      return rest;
+    });
+  }
+  async update(id, data) {
+    const existing = await this.findById(id);
+    if (!existing) throw new Error(`User with id "${id}" not found`);
+    await this.store.update.mutate({ collection: USERS_COLLECTION, id, data: { ...existing, ...data, updatedAt: Date.now() } });
+  }
+  async delete(id) {
+    await this.store.delete.mutate({ collection: USERS_COLLECTION, key: id });
+  }
+  async resetPassword(id, newPassword) {
+    const existing = await this.findById(id);
+    if (!existing) throw new Error(`User with id "${id}" not found`);
+    const passwordHash = await this.auth.hashPassword(newPassword);
+    await this.store.update.mutate({ collection: USERS_COLLECTION, id, data: { ...existing, passwordHash, updatedAt: Date.now() } });
+  }
+  async ensureAdminExists() {
+    const adminUsername = this.config.get("auth.adminUsername");
+    const adminPassword = this.config.get("auth.adminPassword");
+    if (!adminUsername || !adminPassword) return;
+    const existing = await this.findByUsername(adminUsername);
+    if (existing) {
+      const matches = await this.auth.comparePassword(adminPassword, existing.passwordHash);
+      if (!matches) {
+        await this.resetPassword(existing.id, adminPassword);
+      }
+      return;
+    }
+    await this.create({ username: adminUsername, password: adminPassword, role: "super_admin", allowedProviders: "*", allowedDevices: {} });
+  }
+};
+
+// src/auth/api-key-manager.ts
+import * as crypto3 from "crypto";
+import { ApiKeyRecordSchema } from "@camstack/types";
+var API_KEYS_COLLECTION = "api_keys";
+function parseApiKey(data) {
+  return parseRecord("api-key", ApiKeyRecordSchema, data);
+}
+var ApiKeyManager = class {
+  constructor(storageAccess, auth) {
+    this.storageAccess = storageAccess;
+    this.auth = auth;
+  }
+  storageAccess;
+  auth;
+  get store() {
+    return this.storageAccess.getStore();
+  }
+  async create(input) {
+    const { token: rawToken, hash: hash2, prefix } = this.auth.generateApiKey();
+    const now = Date.now();
+    const record = {
+      id: crypto3.randomUUID(),
+      label: input.label,
+      role: input.role,
+      allowedProviders: input.allowedProviders ?? "*",
+      allowedDevices: input.allowedDevices ?? {},
+      tokenHash: hash2,
+      tokenPrefix: prefix,
+      createdAt: now
+    };
+    await this.store.insert.mutate({ collection: API_KEYS_COLLECTION, record: { id: record.id, data: { ...record } } });
+    return { record, token: rawToken };
+  }
+  async validateToken(token) {
+    const allKeys = await this.store.query.query({ collection: API_KEYS_COLLECTION });
+    for (const entry of allKeys) {
+      const record = parseApiKey(entry.data);
+      if (this.auth.validateApiKey(token, record.tokenHash)) {
+        const updatedData = { ...record, lastUsedAt: Date.now() };
+        await this.store.update.mutate({ collection: API_KEYS_COLLECTION, id: record.id, data: { ...updatedData } });
+        return updatedData;
+      }
+    }
+    return null;
+  }
+  async listAll() {
+    const results = await this.store.query.query({ collection: API_KEYS_COLLECTION });
+    return results.map((r) => {
+      const parsed = parseApiKey(r.data);
+      const { tokenHash: _th, ...rest } = parsed;
+      return rest;
+    });
+  }
+  async revoke(id) {
+    await this.store.delete.mutate({ collection: API_KEYS_COLLECTION, key: id });
+  }
+  async findById(id) {
+    const results = await this.store.query.query({ collection: API_KEYS_COLLECTION, filter: { where: { id } } });
+    if (results.length === 0) return null;
+    return parseApiKey(results[0].data);
+  }
+};
+
+// src/auth/scoped-token-manager.ts
+import * as crypto4 from "crypto";
+import { ScopedTokenSchema } from "@camstack/types";
+var TOKENS_COLLECTION = "scoped_tokens";
+var TOKEN_PREFIX = "cst_";
+function parseToken(data) {
+  return parseRecord("scoped-token", ScopedTokenSchema, data);
+}
+var ScopedTokenManager = class {
+  constructor(store) {
+    this.store = store;
+  }
+  store;
+  async create(userId, name, scopes, expiresAt) {
+    const rawHex = crypto4.randomBytes(32).toString("hex");
+    const rawToken = `${TOKEN_PREFIX}${rawHex}`;
+    const tokenHash = crypto4.createHash("sha256").update(rawToken).digest("hex");
+    const tokenPrefix = rawToken.slice(0, 12);
+    const record = {
+      id: crypto4.randomUUID(),
+      userId,
+      name,
+      tokenHash,
+      tokenPrefix,
+      scopes: scopes.map((s) => ({ ...s })),
+      expiresAt,
+      lastUsedAt: void 0,
+      createdAt: Date.now()
+    };
+    await this.store.insert.mutate({ collection: TOKENS_COLLECTION, record: { id: record.id, data: { ...record } } });
+    return { token: rawToken, record };
+  }
+  async validate(rawToken) {
+    if (!rawToken.startsWith(TOKEN_PREFIX)) return null;
+    const tokenHash = crypto4.createHash("sha256").update(rawToken).digest("hex");
+    const results = await this.store.query.query({ collection: TOKENS_COLLECTION, filter: { where: { tokenHash } } });
+    if (results.length === 0) return null;
+    const record = parseToken(results[0].data);
+    if (record.expiresAt !== void 0 && record.expiresAt !== null && Date.now() > record.expiresAt) return null;
+    this.updateLastUsed(record.id).catch(() => {
+    });
+    return record;
+  }
+  matchesScope(token, addonId, routePath, capability) {
+    for (const scope of token.scopes) {
+      switch (scope.type) {
+        case "addon":
+          if (addonId && scope.target === addonId) return true;
+          break;
+        case "route-prefix":
+          if (routePath && routePath.startsWith(scope.target)) return true;
+          break;
+        case "capability":
+          if (capability && scope.target === capability) return true;
+          break;
+      }
+    }
+    return false;
+  }
+  async revoke(tokenId) {
+    await this.store.delete.mutate({ collection: TOKENS_COLLECTION, key: tokenId });
+  }
+  async listForUser(userId) {
+    const results = await this.store.query.query({ collection: TOKENS_COLLECTION, filter: { where: { userId } } });
+    return results.map((r) => parseToken(r.data));
+  }
+  async updateLastUsed(tokenId) {
+    const results = await this.store.query.query({ collection: TOKENS_COLLECTION, filter: { where: { id: tokenId } } });
+    if (results.length === 0) return;
+    const existing = parseToken(results[0].data);
+    await this.store.update.mutate({ collection: TOKENS_COLLECTION, id: tokenId, data: { ...existing, lastUsedAt: Date.now() } });
+  }
+};
+
+// src/builtins/local-auth/auth-schema.ts
+var USERS_COLLECTION2 = "users";
+var API_KEYS_COLLECTION2 = "api_keys";
+var SCOPED_TOKENS_COLLECTION = "scoped_tokens";
+var USERS_COLUMNS = [
+  { name: "id", type: "TEXT", primaryKey: true, notNull: true },
+  { name: "username", type: "TEXT", notNull: true, unique: true },
+  { name: "passwordHash", type: "TEXT", notNull: true },
+  { name: "role", type: "TEXT", notNull: true },
+  { name: "allowedProviders", type: "JSON" },
+  { name: "allowedDevices", type: "JSON" },
+  { name: "createdAt", type: "INTEGER", notNull: true },
+  { name: "updatedAt", type: "INTEGER", notNull: true }
+];
+var API_KEYS_COLUMNS = [
+  { name: "id", type: "TEXT", primaryKey: true, notNull: true },
+  { name: "label", type: "TEXT", notNull: true },
+  { name: "role", type: "TEXT", notNull: true },
+  { name: "tokenHash", type: "TEXT", notNull: true, unique: true },
+  { name: "tokenPrefix", type: "TEXT", notNull: true },
+  { name: "allowedProviders", type: "JSON" },
+  { name: "allowedDevices", type: "JSON" },
+  { name: "createdAt", type: "INTEGER", notNull: true },
+  { name: "lastUsedAt", type: "INTEGER" }
+];
+var SCOPED_TOKENS_COLUMNS = [
+  { name: "id", type: "TEXT", primaryKey: true, notNull: true },
+  { name: "userId", type: "TEXT", notNull: true },
+  { name: "name", type: "TEXT", notNull: true },
+  { name: "tokenHash", type: "TEXT", notNull: true, unique: true },
+  { name: "tokenPrefix", type: "TEXT", notNull: true },
+  { name: "scopes", type: "JSON" },
+  { name: "expiresAt", type: "INTEGER" },
+  { name: "lastUsedAt", type: "INTEGER" },
+  { name: "createdAt", type: "INTEGER", notNull: true }
+];
+async function declareAuthSchema(store) {
+  await store.declareCollection.mutate({
+    collection: USERS_COLLECTION2,
+    columns: USERS_COLUMNS
+  });
+  await store.declareCollection.mutate({
+    collection: API_KEYS_COLLECTION2,
+    columns: API_KEYS_COLUMNS,
+    indexes: [
+      { name: "idx_api_keys_token_prefix", columns: ["tokenPrefix"] }
+    ]
+  });
+  await store.declareCollection.mutate({
+    collection: SCOPED_TOKENS_COLLECTION,
+    columns: SCOPED_TOKENS_COLUMNS,
+    indexes: [
+      { name: "idx_scoped_tokens_user_id", columns: ["userId"] }
+    ]
+  });
+}
+
+// src/builtins/local-auth/local-auth.addon.ts
+function toAuthResult(user) {
+  return {
+    userId: user.id,
+    username: user.username,
+    displayName: user.username,
+    roles: [user.role]
+  };
+}
+var LocalAuthAddon = class extends BaseAddon {
+  authManager = null;
+  userManager = null;
+  apiKeyManager = null;
+  scopedTokenManager = null;
+  constructor() {
+    super({ jwtSecret: "", adminUsername: "", adminPassword: "" });
+  }
+  async onInitialize() {
+    const authSection = await this.ctx.settings?.getSection("auth") ?? {};
+    const resolvedJwtSecret = typeof authSection["jwtSecret"] === "string" ? authSection["jwtSecret"] : this.config.jwtSecret ?? "";
+    const resolvedAdminUser = typeof authSection["adminUsername"] === "string" && authSection["adminUsername"] ? authSection["adminUsername"] : this.config.adminUsername ?? "";
+    const resolvedAdminPass = typeof authSection["adminPassword"] === "string" && authSection["adminPassword"] ? authSection["adminPassword"] : this.config.adminPassword ?? "";
+    const reader = {
+      get(path) {
+        if (path === "auth.jwtSecret") return resolvedJwtSecret;
+        if (path === "auth.adminUsername") return resolvedAdminUser;
+        if (path === "auth.adminPassword") return resolvedAdminPass;
+        return void 0;
+      },
+      update: (_section, data) => {
+        if (typeof data["jwtSecret"] === "string") {
+          void this.ctx.settings?.setSection("auth", { jwtSecret: data["jwtSecret"] });
+        }
+      }
+    };
+    this.authManager = new AuthManager(reader, this.ctx.logger);
+    const store = this.ctx.api?.settingsStore;
+    if (store) {
+      await declareAuthSchema(store);
+      const storageAccess = {
+        getStore() {
+          return store;
+        }
+      };
+      this.userManager = new UserManager(storageAccess, this.authManager, reader);
+      this.apiKeyManager = new ApiKeyManager(storageAccess, this.authManager);
+      this.scopedTokenManager = new ScopedTokenManager(store);
+      try {
+        await this.userManager.ensureAdminExists();
+      } catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new Error(
+          `local-auth bootstrap failed: ensureAdminExists threw before \`user-management\` could be registered. Most likely a \`users\` collection schema mismatch in the settings-store. Underlying: ${detail}`,
+          { cause: err }
+        );
+      }
+    } else {
+      throw new Error(
+        "local-auth: settings-store API not available \u2014 refusing to register `user-management` cap. Check that `sqlite-storage` addon initialized before `local-auth`."
+      );
+    }
+    const authProvider = {
+      validateCredentials: async (input) => {
+        if (!this.userManager) return null;
+        const user = await this.userManager.validateCredentials(input.username, input.password);
+        return user ? toAuthResult(user) : null;
+      },
+      getLoginUrl: async () => {
+        throw new Error("local-auth: URL-based login not supported");
+      },
+      handleCallback: async () => {
+        throw new Error("local-auth: URL-based login not supported");
+      },
+      validateToken: async (input) => {
+        if (!this.authManager || !this.userManager) return null;
+        try {
+          const payload = this.authManager.verifyToken(input.token);
+          const userId = payload.userId;
+          if (!userId) return null;
+          const user = await this.userManager.findById(userId);
+          return user ? toAuthResult(user) : null;
+        } catch {
+          return null;
+        }
+      }
+    };
+    const userMgmt = {
+      listUsers: async () => {
+        if (!this.userManager) return [];
+        return this.userManager.listAll();
+      },
+      createUser: async (input) => {
+        if (!this.userManager) throw new Error("User management not available");
+        const record = await this.userManager.create(input);
+        const { passwordHash: _, ...summary } = record;
+        return summary;
+      },
+      updateUser: async (input) => {
+        if (!this.userManager) throw new Error("User management not available");
+        const { id, ...data } = input;
+        await this.userManager.update(id, data);
+        return { success: true };
+      },
+      deleteUser: async (input) => {
+        if (!this.userManager) throw new Error("User management not available");
+        await this.userManager.delete(input.id);
+        return { success: true };
+      },
+      resetPassword: async (input) => {
+        if (!this.userManager) throw new Error("User management not available");
+        await this.userManager.resetPassword(input.id, input.newPassword);
+        return { success: true };
+      },
+      validateCredentials: async (input) => {
+        if (!this.userManager) return null;
+        const user = await this.userManager.validateCredentials(input.username, input.password);
+        return user ?? null;
+      },
+      listApiKeys: async () => {
+        if (!this.apiKeyManager) return [];
+        return this.apiKeyManager.listAll();
+      },
+      createApiKey: async (input) => {
+        if (!this.apiKeyManager) throw new Error("API key management not available");
+        const { record, token } = await this.apiKeyManager.create(input);
+        const { tokenHash: _, ...summary } = record;
+        return { token, record: summary };
+      },
+      revokeApiKey: async (input) => {
+        if (!this.apiKeyManager) throw new Error("API key management not available");
+        await this.apiKeyManager.revoke(input.id);
+        return { success: true };
+      },
+      validateApiKey: async (input) => {
+        if (!this.apiKeyManager) return null;
+        const record = await this.apiKeyManager.validateToken(input.token);
+        if (!record) return null;
+        const { tokenHash: _, ...summary } = record;
+        return summary;
+      },
+      createScopedToken: async (input) => {
+        if (!this.scopedTokenManager) throw new Error("Scoped token management not available");
+        const { token, record } = await this.scopedTokenManager.create("system", input.name, input.scopes, input.expiresAt);
+        return { token, record };
+      },
+      revokeScopedToken: async (input) => {
+        if (!this.scopedTokenManager) throw new Error("Scoped token management not available");
+        await this.scopedTokenManager.revoke(input.id);
+        return { success: true };
+      },
+      validateScopedToken: async (input) => {
+        if (!this.scopedTokenManager) return null;
+        return this.scopedTokenManager.validate(input.token);
+      },
+      listScopedTokens: async (input) => {
+        if (!this.scopedTokenManager) return [];
+        return this.scopedTokenManager.listForUser(input.userId);
+      }
+    };
+    this.ctx.logger.info("registered auth-provider + user-management capabilities");
+    return [
+      { capability: authProviderCapability, provider: authProvider },
+      { capability: userManagementCapability, provider: userMgmt }
+    ];
+  }
+  async onShutdown() {
+    this.authManager = null;
+    this.userManager = null;
+    this.apiKeyManager = null;
+    this.scopedTokenManager = null;
+  }
+};
+var local_auth_addon_default = LocalAuthAddon;
+
+export {
+  AuthManager,
+  UserManager,
+  ApiKeyManager,
+  ScopedTokenManager,
+  LocalAuthAddon,
+  local_auth_addon_default
+};
+//# sourceMappingURL=chunk-3BK2Y7GY.mjs.map