@codemation/host 0.6.0 → 0.8.0

package/src/audit/IAuditEmitter.ts

@@ -0,0 +1,32 @@
+/**
+ * Workspace-local audit emitter contract.
+ * Mirror of the CP-side IAuditEmitter shape; kept separate to avoid cross-repo coupling.
+ */
+export interface WorkflowAuditActor {
+  readonly userId: string;
+  readonly sessionId?: string;
+}
+
+export interface WorkflowAuditResource {
+  readonly type: string;
+  readonly id: string;
+}
+
+export interface WorkflowAuditEntry {
+  readonly id: string;
+  readonly occurredAt: string;
+  readonly actor: WorkflowAuditActor;
+  readonly action: string;
+  readonly resource: WorkflowAuditResource;
+  readonly outcome: "success" | "failure";
+  readonly errorCode?: string;
+  readonly correlationId?: string;
+  /** Denormalised on every row for query convenience. */
+  readonly workflowId: string;
+  readonly runId?: string;
+  readonly nodeId?: string;
+}
+
+export interface IWorkflowAuditEmitter {
+  emit(entry: WorkflowAuditEntry): Promise<void>;
+}

package/src/audit/PrismaWorkflowAuditLogRepository.ts

@@ -0,0 +1,34 @@
+import { inject, injectable } from "@codemation/core";
+import {
+  PrismaDatabaseClientToken,
+  type PrismaDatabaseClient,
+} from "../infrastructure/persistence/PrismaDatabaseClient";
+import type { IWorkflowAuditEmitter, WorkflowAuditEntry } from "./IAuditEmitter";
+
+@injectable()
+export class PrismaWorkflowAuditLogRepository implements IWorkflowAuditEmitter {
+  constructor(
+    @inject(PrismaDatabaseClientToken)
+    private readonly prisma: PrismaDatabaseClient,
+  ) {}
+
+  async emit(entry: WorkflowAuditEntry): Promise<void> {
+    await this.prisma.workflowAuditLog.create({
+      data: {
+        id: entry.id,
+        occurredAt: new Date(entry.occurredAt),
+        actorUserId: entry.actor.userId,
+        actorSessionId: entry.actor.sessionId ?? null,
+        action: entry.action,
+        resourceType: entry.resource.type,
+        resourceId: entry.resource.id,
+        outcome: entry.outcome,
+        errorCode: entry.errorCode ?? null,
+        correlationId: entry.correlationId ?? null,
+        workflowId: entry.workflowId,
+        runId: entry.runId ?? null,
+        nodeId: entry.nodeId ?? null,
+      },
+    });
+  }
+}

package/src/audit/WorkflowAuditLogWriter.ts

@@ -0,0 +1,125 @@
+import type { RunEvent, RunEventBus, RunEventSubscription } from "@codemation/core";
+import { CoreTokens, inject, injectable } from "@codemation/core";
+import { ApplicationTokens } from "../applicationTokens";
+import type { Logger, LoggerFactory } from "../application/logging/Logger";
+import type { IWorkflowAuditEmitter } from "./IAuditEmitter";
+
+/**
+ * RunEventBus subscriber that persists workspace run-events as WorkflowAuditLog rows.
+ * Best-effort: errors are logged and swallowed so workflow execution is never blocked.
+ * Actor is recorded as "system" in V1 — the run event bus carries no user context.
+ */
+@injectable()
+export class WorkflowAuditLogWriter {
+  private subscription: RunEventSubscription | null = null;
+  private readonly logger: Logger;
+
+  constructor(
+    @inject(CoreTokens.RunEventBus)
+    private readonly runEventBus: RunEventBus,
+    @inject(ApplicationTokens.WorkflowAuditEmitter)
+    private readonly auditEmitter: IWorkflowAuditEmitter,
+    @inject(ApplicationTokens.LoggerFactory)
+    loggerFactory: LoggerFactory,
+  ) {
+    this.logger = loggerFactory.create("codemation.audit.workflow");
+  }
+
+  async start(): Promise<void> {
+    if (this.subscription) {
+      return;
+    }
+    this.subscription = await this.runEventBus.subscribe(async (event) => {
+      try {
+        await this.handleEvent(event);
+      } catch (err) {
+        // Audit must remain best-effort so workflow execution does not fail on observer persistence races.
+        this.logger.error(
+          "WorkflowAuditLogWriter: failed to persist audit entry",
+          err instanceof Error ? err : undefined,
+        );
+      }
+    });
+  }
+
+  async stop(): Promise<void> {
+    if (!this.subscription) {
+      return;
+    }
+    await this.subscription.close();
+    this.subscription = null;
+  }
+
+  private async handleEvent(event: RunEvent): Promise<void> {
+    switch (event.kind) {
+      case "nodeCompleted":
+        await this.auditEmitter.emit({
+          id: globalThis.crypto.randomUUID(),
+          occurredAt: event.at,
+          actor: { userId: "system" },
+          action: "workflow.node.completed",
+          resource: { type: "node", id: event.snapshot.nodeId },
+          outcome: "success",
+          workflowId: event.workflowId,
+          runId: event.runId,
+          nodeId: event.snapshot.nodeId,
+        });
+        return;
+      case "nodeFailed":
+        await this.auditEmitter.emit({
+          id: globalThis.crypto.randomUUID(),
+          occurredAt: event.at,
+          actor: { userId: "system" },
+          action: "workflow.node.failed",
+          resource: { type: "node", id: event.snapshot.nodeId },
+          outcome: "failure",
+          errorCode: event.snapshot.error?.name,
+          workflowId: event.workflowId,
+          runId: event.runId,
+          nodeId: event.snapshot.nodeId,
+        });
+        return;
+      case "runSaved":
+        if (event.state.status === "completed") {
+          await this.auditEmitter.emit({
+            id: globalThis.crypto.randomUUID(),
+            occurredAt: event.at,
+            actor: { userId: "system" },
+            action: "workflow.run.completed",
+            resource: { type: "run", id: event.runId },
+            outcome: "success",
+            workflowId: event.workflowId,
+            runId: event.runId,
+          });
+        } else if (event.state.status === "failed") {
+          await this.auditEmitter.emit({
+            id: globalThis.crypto.randomUUID(),
+            occurredAt: event.at,
+            actor: { userId: "system" },
+            action: "workflow.run.failed",
+            resource: { type: "run", id: event.runId },
+            outcome: "failure",
+            workflowId: event.workflowId,
+            runId: event.runId,
+          });
+        }
+        return;
+      case "connectionInvocationStarted":
+        await this.auditEmitter.emit({
+          id: globalThis.crypto.randomUUID(),
+          occurredAt: event.at,
+          actor: { userId: "system" },
+          action: "workflow.credential.used",
+          resource: { type: "credential", id: event.record.connectionNodeId },
+          outcome: "success",
+          workflowId: event.workflowId,
+          runId: event.runId,
+        });
+        return;
+      default:
+        // runCreated, nodeQueued, nodeStarted, connectionInvocationCompleted/Failed, testSuite*, testCase*
+        // are not audit-relevant at this fidelity level.
+        return;
+    }
+  }
+}

package/src/auth/managed/ManagedAuthConfig.ts

@@ -0,0 +1,29 @@
+/**
+ * Env-derived configuration for managed auth mode.
+ *
+ * Required env vars when auth.kind === "managed":
+ *   CONTROL_PLANE_JWKS_URL  — JWKS endpoint URL for the control plane
+ *   CONTROL_PLANE_ISSUER    — expected JWT `iss` claim value
+ *   CP_WEB_ORIGIN           — single-origin CORS allowlist for the CP browser UI
+ */
+export interface ManagedAuthConfig {
+  readonly jwksUrl: string;
+  readonly issuer: string;
+  readonly cpWebOrigin: string;
+}
+
+export class ManagedAuthConfigFactory {
+  create(env: Readonly<NodeJS.ProcessEnv>): ManagedAuthConfig {
+    const jwksUrl = env["CONTROL_PLANE_JWKS_URL"];
+    const issuer = env["CONTROL_PLANE_ISSUER"];
+    const cpWebOrigin = env["CP_WEB_ORIGIN"];
+
+    if (!jwksUrl || !issuer || !cpWebOrigin) {
+      throw new Error(
+        "ManagedAuthConfigFactory: CONTROL_PLANE_JWKS_URL, CONTROL_PLANE_ISSUER, and CP_WEB_ORIGIN are required in managed auth mode.",
+      );
+    }
+
+    return { jwksUrl, issuer, cpWebOrigin };
+  }
+}

package/src/auth/managed/ManagedAuthMiddleware.ts

@@ -0,0 +1,52 @@
+import { injectable } from "@codemation/core";
+import type { AuthenticatedPrincipal } from "../../application/auth/AuthenticatedPrincipal";
+import type { SessionVerifier } from "../../application/auth/SessionVerifier";
+import type { ManagedJwtVerifier } from "@codemation/managed-auth";
+
+/**
+ * Session verifier for `auth.kind: "managed"`.
+ *
+ * Reads `Authorization: Bearer <token>`, delegates to `ManagedJwtVerifier`,
+ * and maps the verified principal to `AuthenticatedPrincipal`.
+ *
+ * Returns null (unauthorized) when the header is missing or the token fails
+ * verification — the API middleware converts this to 401.
+ */
+@injectable()
+export class ManagedAuthMiddleware implements SessionVerifier {
+  constructor(private readonly verifier: ManagedJwtVerifier) {}
+
+  async verify(request: Request): Promise<AuthenticatedPrincipal | null> {
+    const authorization = request.headers.get("authorization");
+    if (!authorization) {
+      return null;
+    }
+
+    const token = this.extractBearerToken(authorization);
+    if (!token) {
+      return null;
+    }
+
+    const result = await this.verifier.verify(token);
+    if ("failure" in result) {
+      return null;
+    }
+
+    return {
+      id: result.userId,
+      email: null,
+      name: null,
+      source: "managed-jwt",
+      workspaceId: result.workspaceId,
+    };
+  }
+
+  private extractBearerToken(authorization: string): string | null {
+    const lower = authorization.trimStart();
+    if (!lower.toLowerCase().startsWith("bearer ")) {
+      return null;
+    }
+    const token = authorization.slice(7).trim();
+    return token.length > 0 ? token : null;
+  }
+}

package/src/auth/managed/ManagedCorsMiddleware.ts

@@ -0,0 +1,43 @@
+import { injectable } from "@codemation/core";
+import type { MiddlewareHandler } from "hono";
+
+/**
+ * CORS allowlist middleware for managed mode.
+ *
+ * Only the single `CP_WEB_ORIGIN` value (provisioner-injected) is permitted.
+ * All other origins are refused on preflight with a 403.
+ */
+@injectable()
+export class ManagedCorsMiddleware {
+  constructor(private readonly allowedOrigin: string) {}
+
+  handle(): MiddlewareHandler {
+    return async (c, next) => {
+      const origin = c.req.header("origin");
+
+      // Respond to CORS preflight
+      if (c.req.method === "OPTIONS") {
+        if (origin === this.allowedOrigin) {
+          c.header("access-control-allow-origin", origin);
+          c.header("access-control-allow-methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
+          c.header("access-control-allow-headers", "content-type, authorization");
+          c.header("access-control-allow-credentials", "true");
+          c.header("vary", "Origin");
+          return c.body(null, 204);
+        }
+        return c.body(null, 403);
+      }
+
+      // For actual requests, set CORS headers after the handler runs
+      if (origin === this.allowedOrigin) {
+        await next();
+        c.header("access-control-allow-origin", origin);
+        c.header("access-control-allow-credentials", "true");
+        c.header("vary", "Origin");
+        return;
+      }
+
+      await next();
+    };
+  }
+}

package/src/auth/managed/ManagedModeBootGuard.ts

@@ -0,0 +1,27 @@
+/**
+ * Boot-time guard for `auth.kind: "managed"`.
+ *
+ * Validates that all required environment variables are present before the
+ * container boots. Throws a descriptive error listing every missing variable
+ * so operators can fix the config in one shot.
+ */
+export class ManagedModeBootGuard {
+  private static readonly requiredVars: ReadonlyArray<string> = [
+    "WORKSPACE_ID",
+    "WORKSPACE_PAIRING_SECRET",
+    "CONTROL_PLANE_URL",
+    "CONTROL_PLANE_JWKS_URL",
+    "CONTROL_PLANE_ISSUER",
+    "CP_WEB_ORIGIN",
+  ];
+
+  assertRequiredEnv(env: Readonly<NodeJS.ProcessEnv>): void {
+    const missing = ManagedModeBootGuard.requiredVars.filter((name) => !env[name]);
+    if (missing.length > 0) {
+      throw new Error(
+        `auth.kind "managed" requires the following environment variables which are not set: ${missing.join(", ")}.\n` +
+          "Set all of them before starting in managed mode.",
+      );
+    }
+  }
+}

package/src/auth/managed/index.ts

@@ -0,0 +1,5 @@
+export type { ManagedAuthConfig } from "./ManagedAuthConfig";
+export { ManagedAuthConfigFactory } from "./ManagedAuthConfig";
+export { ManagedAuthMiddleware } from "./ManagedAuthMiddleware";
+export { ManagedCorsMiddleware } from "./ManagedCorsMiddleware";
+export { ManagedModeBootGuard } from "./ManagedModeBootGuard";