@elizaos/agent 2.0.0-alpha.520 → 2.0.0-alpha.521

package/packages/app-core/src/api/auth/sessions.js

@@ -1,298 +0,0 @@
-/**
- * Session lifecycle on top of `AuthStore`.
- *
- * This module owns:
- *   - browser session creation + sliding-TTL math
- *   - machine session creation (absolute TTL)
- *   - session lookup with sliding-window refresh
- *   - revoke (single + all-but-current)
- *   - CSRF derive / verify (HMAC-SHA256 over `session.csrfSecret`)
- *   - cookie serialize / parse for the `milady_session` cookie
- *
- * Hard rule: every helper fails closed. A malformed cookie returns null;
- * a CSRF mismatch returns false; a session lookup error propagates. We do
- * NOT pretend bad input is good input.
- */
-import crypto from "node:crypto";
-import { isLoopbackBindHost, resolveApiBindHost, } from "@elizaos/shared";
-import { appendAuditEvent } from "./audit";
-import { tokenMatches } from "./tokens";
-// ── TTLs (plan §1.3, §4.4) ───────────────────────────────────────────────────
-/** Browser session sliding window: 12h. */
-export const BROWSER_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
-/** Browser session absolute cap when `rememberDevice=true`: 30 days. */
-export const BROWSER_SESSION_REMEMBER_CAP_MS = 30 * 24 * 60 * 60 * 1000;
-/** Machine session absolute TTL: 90 days. */
-export const MACHINE_SESSION_TTL_MS = 90 * 24 * 60 * 60 * 1000;
-// ── Cookie constants ─────────────────────────────────────────────────────────
-export const SESSION_COOKIE_NAME = "milady_session";
-export const CSRF_COOKIE_NAME = "milady_csrf";
-export const CSRF_HEADER_NAME = "x-milady-csrf";
-// ── ID + secret generation ───────────────────────────────────────────────────
-/** 256-bit hex session id. Cookie value. */
-function generateSessionId() {
-    return crypto.randomBytes(32).toString("hex");
-}
-/** 256-bit hex CSRF secret. Per-session, never sent to clients raw. */
-function generateCsrfSecret() {
-    return crypto.randomBytes(32).toString("hex");
-}
-// ── Creation ─────────────────────────────────────────────────────────────────
-/**
- * Mint a browser session. Uses sliding TTL (`BROWSER_SESSION_TTL_MS`) capped
- * at 30 days when `rememberDevice` is set; otherwise the cap equals the
- * sliding window.
- *
- * Returns the persisted session and a derived CSRF token suitable for the
- * `milady_csrf` cookie.
- */
-export async function createBrowserSession(store, options) {
-    const now = options.now ?? Date.now();
-    const id = generateSessionId();
-    const csrfSecret = generateCsrfSecret();
-    const expiresAt = now + BROWSER_SESSION_TTL_MS;
-    const session = await store.createSession({
-        id,
-        identityId: options.identityId,
-        kind: "browser",
-        createdAt: now,
-        lastSeenAt: now,
-        expiresAt,
-        rememberDevice: Boolean(options.rememberDevice),
-        csrfSecret,
-        ip: options.ip,
-        userAgent: options.userAgent,
-        scopes: [],
-    });
-    return { session, csrfToken: deriveCsrfToken(session) };
-}
-/**
- * Mint a machine session. Absolute TTL (`MACHINE_SESSION_TTL_MS`); no sliding
- * refresh on access. Scopes are persisted exactly as supplied — caller is
- * responsible for shaping them.
- */
-export async function createMachineSession(store, options) {
-    const now = options.now ?? Date.now();
-    const id = generateSessionId();
-    const csrfSecret = generateCsrfSecret();
-    const expiresAt = now + MACHINE_SESSION_TTL_MS;
-    const session = await store.createSession({
-        id,
-        identityId: options.identityId,
-        kind: "machine",
-        createdAt: now,
-        lastSeenAt: now,
-        expiresAt,
-        rememberDevice: false,
-        csrfSecret,
-        ip: options.ip ?? null,
-        userAgent: options.label ?? null,
-        scopes: [...options.scopes],
-    });
-    return { session, csrfToken: deriveCsrfToken(session) };
-}
-// ── Lookup with sliding refresh ──────────────────────────────────────────────
-/**
- * Look up an active session by id and slide its expiry forward when it is a
- * browser session. Machine sessions get `lastSeenAt` updated but no expiry
- * extension (absolute TTL by spec).
- *
- * Returns `null` for missing / expired / revoked sessions. Errors propagate;
- * we do NOT silently treat a DB error as "session valid".
- */
-export async function findActiveSession(store, sessionId, now = Date.now()) {
-    const found = await store.findSession(sessionId, now);
-    if (!found)
-        return null;
-    if (found.kind === "browser") {
-        const cap = found.rememberDevice
-            ? found.createdAt + BROWSER_SESSION_REMEMBER_CAP_MS
-            : found.createdAt + BROWSER_SESSION_TTL_MS;
-        const proposed = now + BROWSER_SESSION_TTL_MS;
-        const nextExpiresAt = Math.min(proposed, cap);
-        if (nextExpiresAt <= now)
-            return null;
-        if (nextExpiresAt !== found.expiresAt || now !== found.lastSeenAt) {
-            await store.touchSession(found.id, now, nextExpiresAt);
-        }
-        return { ...found, lastSeenAt: now, expiresAt: nextExpiresAt };
-    }
-    if (found.kind === "machine") {
-        if (now !== found.lastSeenAt) {
-            await store.touchSession(found.id, now, found.expiresAt);
-        }
-        return { ...found, lastSeenAt: now };
-    }
-    return found;
-}
-export async function revokeSession(sessionId, options) {
-    const now = options.now ?? Date.now();
-    const ok = await options.store.revokeSession(sessionId, now);
-    const audit = {
-        id: crypto.randomUUID(),
-        ts: now,
-        actorIdentityId: options.actorIdentityId,
-        ip: options.ip,
-        userAgent: options.userAgent,
-        action: "auth.session.revoke",
-        outcome: ok ? "success" : "failure",
-        metadata: { sessionId, reason: options.reason },
-    };
-    await appendAuditEvent(audit, { store: options.store });
-    return ok;
-}
-export async function revokeAllSessionsForIdentity(options) {
-    const now = options.now ?? Date.now();
-    const count = await options.store.revokeAllSessionsForIdentity(options.identityId, now, options.exceptSessionId);
-    await appendAuditEvent({
-        actorIdentityId: options.identityId,
-        ip: options.ip,
-        userAgent: options.userAgent,
-        action: "auth.session.revoke_all",
-        outcome: "success",
-        metadata: {
-            identityId: options.identityId,
-            reason: options.reason,
-            revoked: count,
-        },
-    }, { store: options.store });
-    return count;
-}
-// ── CSRF (double-submit) ─────────────────────────────────────────────────────
-/**
- * Derive the CSRF token for a session. HMAC-SHA256 over the literal
- * `csrf:<sessionId>` payload using the per-session `csrfSecret` as the key.
- * The derivation is stable, so repeated calls return the same token until
- * the session is rotated.
- */
-export function deriveCsrfToken(session) {
-    return crypto
-        .createHmac("sha256", session.csrfSecret)
-        .update(`csrf:${session.id}`)
-        .digest("hex");
-}
-/**
- * Timing-safe compare of an incoming CSRF header against the expected
- * derived token. Empty / missing headers fail closed.
- */
-export function verifyCsrfToken(session, provided) {
-    if (typeof provided !== "string" || provided.length === 0)
-        return false;
-    const expected = deriveCsrfToken(session);
-    return tokenMatches(expected, provided);
-}
-// ── Cookie serialize / parse ─────────────────────────────────────────────────
-/**
- * Should the cookie carry the `Secure` attribute? Plan §4.1: drop `Secure`
- * only when bound on loopback (the Electrobun shell). Detect via the same
- * env helpers as the rest of the runtime.
- */
-function shouldEmitSecureFlag(env) {
-    const bind = resolveApiBindHost(env);
-    return !isLoopbackBindHost(bind);
-}
-/**
- * Serialize the `milady_session` cookie. The value is the opaque session id;
- * attributes follow plan §4.1.
- *
- * Returns the full `Set-Cookie` header value (without the leading
- * `Set-Cookie:` token). Caller is responsible for `res.setHeader`.
- */
-export function serializeSessionCookie(session, options = {}) {
-    const env = options.env ?? process.env;
-    const now = Date.now();
-    const ageMs = options.maxAgeMs ?? Math.max(0, session.expiresAt - now);
-    const ageSec = Math.floor(ageMs / 1000);
-    const parts = [
-        `${SESSION_COOKIE_NAME}=${encodeURIComponent(session.id)}`,
-        "Path=/",
-        "HttpOnly",
-        "SameSite=Lax",
-        `Max-Age=${ageSec}`,
-    ];
-    if (shouldEmitSecureFlag(env))
-        parts.push("Secure");
-    return parts.join("; ");
-}
-/**
- * Serialize the readable companion CSRF cookie. Same lifetime as the
- * session cookie. NOT `HttpOnly` so the SPA can mirror it into the
- * `x-milady-csrf` header.
- */
-export function serializeCsrfCookie(session, options = {}) {
-    const env = options.env ?? process.env;
-    const now = Date.now();
-    const ageMs = options.maxAgeMs ?? Math.max(0, session.expiresAt - now);
-    const ageSec = Math.floor(ageMs / 1000);
-    const csrfToken = deriveCsrfToken(session);
-    const parts = [
-        `${CSRF_COOKIE_NAME}=${encodeURIComponent(csrfToken)}`,
-        "Path=/",
-        "SameSite=Lax",
-        `Max-Age=${ageSec}`,
-    ];
-    if (shouldEmitSecureFlag(env))
-        parts.push("Secure");
-    return parts.join("; ");
-}
-/** Build the cookie that destroys the session client-side (logout). */
-export function serializeSessionExpiryCookie(options = {}) {
-    const env = options.env ?? process.env;
-    const parts = [
-        `${SESSION_COOKIE_NAME}=`,
-        "Path=/",
-        "HttpOnly",
-        "SameSite=Lax",
-        "Max-Age=0",
-    ];
-    if (shouldEmitSecureFlag(env))
-        parts.push("Secure");
-    return parts.join("; ");
-}
-/** Companion expiry cookie for `milady_csrf`. */
-export function serializeCsrfExpiryCookie(options = {}) {
-    const env = options.env ?? process.env;
-    const parts = [`${CSRF_COOKIE_NAME}=`, "Path=/", "SameSite=Lax", "Max-Age=0"];
-    if (shouldEmitSecureFlag(env))
-        parts.push("Secure");
-    return parts.join("; ");
-}
-/**
- * Parse a raw `Cookie:` header into a typed map. Returns `Map<string,string>`
- * — keys are cookie names, values are URL-decoded raw values. Invalid or
- * empty cookies are dropped silently (per RFC 6265 §5.2 step 1).
- */
-export function parseCookieHeader(headerValue) {
-    const out = new Map();
-    if (!headerValue)
-        return out;
-    for (const part of headerValue.split(";")) {
-        const eq = part.indexOf("=");
-        if (eq < 0)
-            continue;
-        const k = part.slice(0, eq).trim();
-        if (!k)
-            continue;
-        const v = part.slice(eq + 1).trim();
-        if (v.length === 0)
-            continue;
-        try {
-            out.set(k, decodeURIComponent(v));
-        }
-        catch {
-            out.set(k, v);
-        }
-    }
-    return out;
-}
-/**
- * Read the milady session id from the request cookie header. Returns null
- * when the cookie is absent or empty.
- */
-export function parseSessionCookie(req) {
-    const raw = req.headers.cookie;
-    const headerValue = Array.isArray(raw) ? raw[0] : raw;
-    const cookies = parseCookieHeader(headerValue ?? null);
-    const value = cookies.get(SESSION_COOKIE_NAME);
-    return value && value.length > 0 ? value : null;
-}

package/packages/app-core/src/api/auth/tokens.d.ts

@@ -1,3 +0,0 @@
-/** Timing-safe token comparison (constant-time regardless of input length). */
-export declare function tokenMatches(expected: string, provided: string): boolean;
-//# sourceMappingURL=tokens.d.ts.map

package/packages/app-core/src/api/auth/tokens.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../../../../../app-core/src/api/auth/tokens.ts"],"names":[],"mappings":"AAEA,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAUxE"}

package/packages/app-core/src/api/auth/tokens.js

@@ -1,13 +0,0 @@
-import crypto from "node:crypto";
-/** Timing-safe token comparison (constant-time regardless of input length). */
-export function tokenMatches(expected, provided) {
-    const a = Buffer.from(expected, "utf8");
-    const b = Buffer.from(provided, "utf8");
-    const maxLen = Math.max(a.length, b.length);
-    const aPadded = Buffer.alloc(maxLen);
-    const bPadded = Buffer.alloc(maxLen);
-    a.copy(aPadded);
-    b.copy(bPadded);
-    const contentMatch = crypto.timingSafeEqual(aPadded, bPadded);
-    return a.length === b.length && contentMatch;
-}

package/packages/app-core/src/api/auth-client.d.ts

@@ -1,130 +0,0 @@
-/**
- * Typed client for P1 session auth endpoints.
- *
- * All state-changing calls go through `fetchWithCsrf` so the CSRF header is
- * attached automatically. GET requests use plain `fetch` with
- * `credentials: "include"`.
- *
- * This module is UI-only. It deliberately does NOT import ElizaClient so it
- * can be used in auth-gated components before the main client is initialised.
- */
-export interface AuthIdentity {
-    id: string;
-    displayName: string;
-    kind: "owner" | "machine";
-}
-export interface AuthSessionInfo {
-    id: string;
-    kind: "browser" | "machine" | "local";
-    expiresAt: number | null;
-}
-export interface AuthSessionListEntry {
-    id: string;
-    kind: "browser" | "machine" | "local";
-    ip: string | null;
-    userAgent: string | null;
-    lastSeenAt: number;
-    expiresAt: number | null;
-    current: boolean;
-}
-export interface AuthAccessInfo {
-    mode: "local" | "session" | "remote";
-    passwordConfigured: boolean;
-    ownerConfigured: boolean;
-}
-export type AuthSetupResult = {
-    ok: true;
-    identity: AuthIdentity;
-    session: AuthSessionInfo;
-    csrfToken: string;
-} | {
-    ok: false;
-    status: 400 | 409 | 429 | 500 | 503;
-    reason: "weak_password" | "invalid_display_name" | "already_initialized" | "rate_limited" | "server_error";
-    message: string;
-};
-export type AuthLoginResult = {
-    ok: true;
-    identity: AuthIdentity;
-    session: AuthSessionInfo;
-    csrfToken: string;
-} | {
-    ok: false;
-    status: 400 | 401 | 429 | 500;
-    reason: "invalid_credentials" | "rate_limited" | "server_error";
-    message: string;
-};
-export type AuthMeResult = {
-    ok: true;
-    identity: AuthIdentity;
-    session: AuthSessionInfo;
-    access: AuthAccessInfo;
-} | {
-    ok: false;
-    status: 401 | 503;
-    reason?: "remote_auth_required" | "remote_password_not_configured" | "server_error";
-    access?: AuthAccessInfo;
-};
-export type AuthSessionsResult = {
-    ok: true;
-    sessions: AuthSessionListEntry[];
-} | {
-    ok: false;
-    status: 401 | 503;
-};
-export type AuthRevokeResult = {
-    ok: true;
-} | {
-    ok: false;
-    status: 401 | 404 | 500;
-};
-export type AuthLogoutResult = {
-    ok: true;
-};
-export type AuthChangePasswordResult = {
-    ok: true;
-} | {
-    ok: false;
-    status: 400 | 401 | 404 | 429 | 500;
-    reason: "weak_password" | "invalid_credentials" | "owner_not_found" | "rate_limited" | "server_error";
-    message: string;
-};
-/**
- * POST /api/auth/setup — first-run owner identity creation.
- * Returns 409 if an owner identity already exists.
- */
-export declare function authSetup(params: {
-    displayName: string;
-    password: string;
-}): Promise<AuthSetupResult>;
-/**
- * POST /api/auth/login/password — password-based login.
- */
-export declare function authLoginPassword(params: {
-    displayName: string;
-    password: string;
-    rememberDevice?: boolean;
-}): Promise<AuthLoginResult>;
-/**
- * POST /api/auth/logout — destroys the current session.
- */
-export declare function authLogout(): Promise<AuthLogoutResult>;
-/**
- * GET /api/auth/me — returns the current identity + session, or 401.
- *
- * Fail closed: network errors are treated as 401 so the login gate renders.
- */
-export declare function authMe(): Promise<AuthMeResult>;
-/**
- * GET /api/auth/sessions — lists active sessions for the current identity.
- */
-export declare function authListSessions(): Promise<AuthSessionsResult>;
-/**
- * POST /api/auth/sessions/:id/revoke — revokes one session.
- */
-export declare function authRevokeSession(sessionId: string): Promise<AuthRevokeResult>;
-export declare function authChangePassword(params: {
-    currentPassword?: string;
-    newPassword: string;
-}): Promise<AuthChangePasswordResult>;
-//# sourceMappingURL=auth-client.d.ts.map

package/packages/app-core/src/api/auth-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-client.d.ts","sourceRoot":"","sources":["../../../../../../app-core/src/api/auth-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IACtC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IACtC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;IACrC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;CAC1B;AAID,MAAM,MAAM,eAAe,GACvB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,eAAe,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACpC,MAAM,EACF,eAAe,GACf,sBAAsB,GACtB,qBAAqB,GACrB,cAAc,GACd,cAAc,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN,MAAM,MAAM,eAAe,GACvB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,eAAe,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAC9B,MAAM,EAAE,qBAAqB,GAAG,cAAc,GAAG,cAAc,CAAC;IAChE,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN,MAAM,MAAM,YAAY,GACpB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,eAAe,CAAC;IACzB,MAAM,EAAE,cAAc,CAAC;CACxB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,MAAM,CAAC,EACH,sBAAsB,GACtB,gCAAgC,GAChC,cAAc,CAAC;IACnB,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB,CAAC;AAEN,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,oBAAoB,EAAE,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AAErC,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AAE3C,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACpC,MAAM,EACF,eAAe,GACf,qBAAqB,GACrB,iBAAiB,GACjB,cAAc,GACd,cAAc,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAyBN;;;GAGG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,eAAe,CAAC,CAuE3B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,OAAO,CAAC,eAAe,CAAC,CA8C3B;AAED;;GAEG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAQ5D;AAED;;;;GAIG;AACH,wBAAsB,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC,CAkDpD;AAED;;GAEG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAkBpE;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAgEpC"}