@elizaos/app-core 2.0.0-beta.3 → 2.0.3-beta.3

package/api/auth-pairing-routes.js

@@ -0,0 +1,299 @@
+import crypto from "node:crypto";
+import { loadElizaConfig } from "@elizaos/agent";
+import { logger } from "@elizaos/core";
+import { AuthStore } from "../services/auth-store.js";
+import { createMachineSession, findActiveSession, parseSessionCookie, } from "./auth/sessions.js";
+import { ensureRouteAuthorized, getCompatApiToken, getProvidedApiToken, tokenMatches, } from "./auth.js";
+import { getCompatDrizzleDb, hasCompatPersistedFirstRunState, isTrustedLocalRequest, readCompatJsonBody, } from "./compat-route-shared.js";
+import { sendJsonError as sendJsonErrorResponse, sendJson as sendJsonResponse, } from "./response.js";
+import { isCloudProvisioned } from "./server-first-run-helpers.js";
+// ---------------------------------------------------------------------------
+// Pairing state & helpers
+// ---------------------------------------------------------------------------
+const PAIRING_TTL_MS = 10 * 60 * 1000;
+const PAIRING_WINDOW_MS = 10 * 60 * 1000;
+const PAIRING_MAX_ATTEMPTS = 5;
+const PAIRING_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+let pairingCode = null;
+let pairingExpiresAt = 0;
+const pairingAttempts = new Map();
+// Periodic sweep to prevent unbounded memory growth
+const PAIRING_SWEEP_INTERVAL_MS = 5 * 60 * 1000;
+const pairingSweepTimer = setInterval(() => {
+    const now = Date.now();
+    for (const [key, entry] of pairingAttempts) {
+        if (now > entry.resetAt) {
+            pairingAttempts.delete(key);
+        }
+    }
+}, PAIRING_SWEEP_INTERVAL_MS);
+if (typeof pairingSweepTimer === "object" && "unref" in pairingSweepTimer) {
+    pairingSweepTimer.unref();
+}
+export function _resetAuthPairingStateForTests() {
+    pairingCode = null;
+    pairingExpiresAt = 0;
+    pairingAttempts.clear();
+}
+function pairingEnabled() {
+    return (Boolean(getCompatApiToken()) &&
+        process.env.ELIZA_PAIRING_DISABLED !== "1" &&
+        !isCloudProvisioned());
+}
+function normalizePairingCode(code) {
+    return code.replace(/[^a-zA-Z0-9]/g, "").toUpperCase();
+}
+function generatePairingCode() {
+    let raw = "";
+    for (let i = 0; i < 12; i += 1) {
+        raw += PAIRING_ALPHABET[crypto.randomInt(0, PAIRING_ALPHABET.length)];
+    }
+    return `${raw.slice(0, 4)}-${raw.slice(4, 8)}-${raw.slice(8, 12)}`;
+}
+function ensurePairingCode() {
+    if (!pairingEnabled()) {
+        return null;
+    }
+    const now = Date.now();
+    if (!pairingCode || now > pairingExpiresAt) {
+        pairingCode = generatePairingCode();
+        pairingExpiresAt = now + PAIRING_TTL_MS;
+        logger.warn(`[api] Pairing code for remote devices: ${pairingCode} (valid for 10 minutes)`);
+    }
+    return pairingCode;
+}
+export function ensureAuthPairingCodeForRemoteAccess() {
+    const code = ensurePairingCode();
+    return code ? { code, expiresAt: pairingExpiresAt } : null;
+}
+async function requestHasActiveSession(req, store) {
+    const cookieSessionId = parseSessionCookie(req);
+    if (cookieSessionId) {
+        const session = await findActiveSession(store, cookieSessionId).catch(() => null);
+        if (session)
+            return true;
+    }
+    const bearer = getProvidedApiToken(req);
+    if (bearer) {
+        const session = await findActiveSession(store, bearer).catch(() => null);
+        if (session)
+            return true;
+    }
+    return false;
+}
+function rateLimitPairing(ip) {
+    const key = ip ?? "unknown";
+    const now = Date.now();
+    const current = pairingAttempts.get(key);
+    if (!current || now > current.resetAt) {
+        pairingAttempts.set(key, { count: 1, resetAt: now + PAIRING_WINDOW_MS });
+        return true;
+    }
+    if (current.count >= PAIRING_MAX_ATTEMPTS) {
+        return false;
+    }
+    current.count += 1;
+    return true;
+}
+// ---------------------------------------------------------------------------
+// Identity bookkeeping for paired devices
+// ---------------------------------------------------------------------------
+const PAIRED_DEVICE_IDENTITY_DISPLAY_NAME = "paired-device";
+/**
+ * Resolve an identity id to bind a paired-device machine session to:
+ *   1. existing owner identity (typical password-configured deployments).
+ *   2. existing `paired-device` machine identity (idempotent on repeat pair).
+ *   3. otherwise create a fresh `paired-device` machine identity.
+ *
+ * The machine session itself is what authorizes requests; the identity is a
+ * stable parent row so audit logs + the security UI can group sessions
+ * minted by the pairing flow.
+ */
+async function ensurePairedDeviceIdentityId(store) {
+    const owner = (await store.listIdentitiesByKind("owner"))[0];
+    if (owner)
+        return owner.id;
+    const existing = await store.findIdentityByDisplayName(PAIRED_DEVICE_IDENTITY_DISPLAY_NAME);
+    if (existing)
+        return existing.id;
+    const id = crypto.randomUUID();
+    await store.createIdentity({
+        id,
+        kind: "machine",
+        displayName: PAIRED_DEVICE_IDENTITY_DISPLAY_NAME,
+        createdAt: Date.now(),
+        passwordHash: null,
+        cloudUserId: null,
+    });
+    return id;
+}
+// ---------------------------------------------------------------------------
+// Route handler
+// ---------------------------------------------------------------------------
+/**
+ * Auth / pairing routes:
+ *
+ * - `GET  /api/first-run/status`
+ * - `GET  /api/auth/status`
+ * - `GET  /api/auth/pair-code`
+ * - `POST /api/auth/pair`
+ */
+export async function handleAuthPairingCompatRoutes(req, res, state) {
+    const method = (req.method ?? "GET").toUpperCase();
+    const url = new URL(req.url ?? "/", "http://localhost");
+    // ── GET /api/first-run/status ──────────────────────────────────────
+    // Requires a trusted local request, a valid cookie session, an allowed
+    // bearer token, or a bootstrap exchange — no unauthenticated bypass.
+    if (method === "GET" && url.pathname === "/api/first-run/status") {
+        if (!(await ensureRouteAuthorized(req, res, state))) {
+            return true;
+        }
+        const config = loadElizaConfig();
+        sendJsonResponse(res, 200, {
+            complete: hasCompatPersistedFirstRunState(config),
+            // Metadata only — no auth implication. The client uses this to decide
+            // whether to show the bootstrap-token wizard step. Auth is enforced by
+            // the exchange endpoint itself; this flag never grants access.
+            cloudProvisioned: isCloudProvisioned(),
+        });
+        return true;
+    }
+    // ── GET /api/auth/status ────────────────────────────────────────────
+    // This is a public probe so unauthenticated clients can decide whether
+    // to show pairing UI. The response leaks no secrets — only whether auth
+    // is configured and whether pairing is currently open.
+    if (method === "GET" && url.pathname === "/api/auth/status") {
+        const localAccess = isTrustedLocalRequest(req);
+        const db = getCompatDrizzleDb(state);
+        let passwordConfigured = false;
+        let sessionAuthenticated = false;
+        if (db) {
+            const store = new AuthStore(db);
+            const owner = (await store.listIdentitiesByKind("owner"))[0];
+            passwordConfigured = Boolean(owner?.passwordHash);
+            sessionAuthenticated = await requestHasActiveSession(req, store);
+        }
+        const cloudProvisioned = isCloudProvisioned();
+        const tokenRequired = Boolean(getCompatApiToken());
+        const loginRequired = !localAccess && !tokenRequired && !cloudProvisioned;
+        // Did this request already authenticate? Surfaced as a separate
+        // `authenticated` field so the client can short-circuit pairing without
+        // overloading the existing `required` semantics.
+        const providedToken = getProvidedApiToken(req);
+        const configuredToken = getCompatApiToken();
+        const staticTokenAuthenticated = !cloudProvisioned &&
+            Boolean(providedToken &&
+                configuredToken &&
+                tokenMatches(configuredToken, providedToken));
+        const authenticated = sessionAuthenticated || staticTokenAuthenticated;
+        const required = !localAccess &&
+            !authenticated &&
+            (tokenRequired ||
+                passwordConfigured ||
+                cloudProvisioned ||
+                loginRequired);
+        const enabled = pairingEnabled();
+        if (enabled) {
+            ensurePairingCode();
+        }
+        sendJsonResponse(res, 200, {
+            required,
+            authenticated,
+            loginRequired,
+            bootstrapRequired: required && cloudProvisioned,
+            localAccess,
+            passwordConfigured,
+            pairingEnabled: enabled,
+            expiresAt: enabled ? pairingExpiresAt : null,
+        });
+        return true;
+    }
+    // ── GET /api/auth/pair-code ─────────────────────────────────────────
+    // Loopback-only helper for local dashboards/operators. External clients
+    // must use the normal pairing flow and never receive the code directly.
+    if (method === "GET" && url.pathname === "/api/auth/pair-code") {
+        if (!isTrustedLocalRequest(req)) {
+            sendJsonErrorResponse(res, 403, "Pair code visible on loopback only");
+            return true;
+        }
+        const code = ensurePairingCode();
+        if (!code) {
+            sendJsonErrorResponse(res, 503, "Pairing not enabled");
+            return true;
+        }
+        sendJsonResponse(res, 200, { code, expiresAt: pairingExpiresAt });
+        return true;
+    }
+    // ── POST /api/auth/pair ─────────────────────────────────────────────
+    if (method === "POST" && url.pathname === "/api/auth/pair") {
+        const body = await readCompatJsonBody(req, res);
+        if (body == null) {
+            return true;
+        }
+        const token = getCompatApiToken();
+        if (!token) {
+            sendJsonErrorResponse(res, 400, "Pairing not enabled");
+            return true;
+        }
+        if (!pairingEnabled()) {
+            sendJsonErrorResponse(res, 403, "Pairing disabled");
+            return true;
+        }
+        const remoteAddress = req.socket.remoteAddress;
+        if (!remoteAddress) {
+            sendJsonErrorResponse(res, 403, "Cannot determine client address");
+            return true;
+        }
+        if (!rateLimitPairing(remoteAddress)) {
+            sendJsonErrorResponse(res, 429, "Too many attempts. Try again later.");
+            return true;
+        }
+        const provided = normalizePairingCode(typeof body.code === "string" ? body.code : "");
+        const current = ensurePairingCode();
+        if (!current || Date.now() > pairingExpiresAt) {
+            ensurePairingCode();
+            sendJsonErrorResponse(res, 410, "Pairing code expired. Check server logs for a new code.");
+            return true;
+        }
+        if (!tokenMatches(normalizePairingCode(current), provided)) {
+            sendJsonErrorResponse(res, 403, "Invalid pairing code");
+            return true;
+        }
+        pairingCode = null;
+        pairingExpiresAt = 0;
+        // Mint a machine session so the paired client gets a session-id bearer
+        // token that authenticates against `ensureCompatApiAuthorizedAsync`.
+        // Returning the raw connection key here would auth `/api/auth/status`
+        // (static-token branch) but get rejected on every other route once the
+        // runtime DB is up. Sessions are TTL-bound and revocable; the static
+        // connection key is forever-valid until the operator rotates it.
+        const db = getCompatDrizzleDb(state);
+        if (db) {
+            try {
+                const store = new AuthStore(db);
+                const identityId = await ensurePairedDeviceIdentityId(store);
+                const { session } = await createMachineSession(store, {
+                    identityId,
+                    scopes: [],
+                    label: "paired-device",
+                    ip: remoteAddress,
+                });
+                sendJsonResponse(res, 200, { token: session.id });
+                return true;
+            }
+            catch (err) {
+                // Surface the failure rather than silently falling back to a path
+                // that mints a forever-valid static-token bearer. Operators should
+                // see the underlying error and fix it; clients retry pairing.
+                logger.error(`[api] pair: failed to mint machine session: ${err instanceof Error ? err.message : String(err)}`);
+                sendJsonErrorResponse(res, 500, "Failed to mint session");
+                return true;
+            }
+        }
+        // No DB yet — extremely unlikely once the runtime is up enough to serve
+        // requests, but preserve the legacy static-token return as a fallback.
+        sendJsonResponse(res, 200, { token });
+        return true;
+    }
+    return false;
+}

package/api/auth-session-routes.d.ts

@@ -17,8 +17,8 @@
  *     the body.
  */
 import type http from "node:http";
-import { SESSION_COOKIE_NAME } from "./auth/index";
-import { type CompatRuntimeState } from "./compat-route-shared";
+import { SESSION_COOKIE_NAME } from "./auth/index.js";
+import { type CompatRuntimeState } from "./compat-route-shared.js";
 /** Test-only reset. */
 export declare function _resetAuthSessionRoutesLimiter(): void;
 /**

package/api/auth-session-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-session-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth-session-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAQL,mBAAmB,EAOpB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,KAAK,kBAAkB,EAGxB,MAAM,uBAAuB,CAAC;AAiE/B,uBAAuB;AACvB,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAuBD;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAyElB;AAkfD,OAAO,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"auth-session-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth-session-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EASL,mBAAmB,EAOpB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,KAAK,kBAAkB,EAGxB,MAAM,uBAAuB,CAAC;AAkE/B,uBAAuB;AACvB,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAuBD;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CA6FlB;AAkfD,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/api/auth-session-routes.js

@@ -17,12 +17,12 @@
  *     the body.
  */
 import crypto from "node:crypto";
-import { AuthStore } from "../services/auth-store";
-import { appendAuditEvent, assertPasswordStrong, createBrowserSession, ensureSessionForRequest, hashPassword, parseSessionCookie, revokeSession, SESSION_COOKIE_NAME, serializeCsrfCookie, serializeCsrfExpiryCookie, serializeSessionCookie, serializeSessionExpiryCookie, verifyPassword, WeakPasswordError, } from "./auth/index";
-import { findActiveSession } from "./auth/sessions";
+import { AuthStore } from "../services/auth-store.js";
+import { appendAuditEvent, assertPasswordStrong, createBrowserSession, ensureSessionForRequest, getSensitiveLimiter, hashPassword, parseSessionCookie, revokeSession, SESSION_COOKIE_NAME, serializeCsrfCookie, serializeCsrfExpiryCookie, serializeSessionCookie, serializeSessionExpiryCookie, verifyPassword, WeakPasswordError, } from "./auth/index.js";
+import { findActiveSession } from "./auth/sessions.js";
 import { extractHeaderValue, getProvidedApiToken } from "./auth.js";
-import { isTrustedLocalRequest, readCompatJsonBody, } from "./compat-route-shared";
-import { sendJsonError as sendJsonErrorResponse, sendJson as sendJsonResponse, } from "./response";
+import { isTrustedLocalRequest, readCompatJsonBody, } from "./compat-route-shared.js";
+import { sendJsonError as sendJsonErrorResponse, sendJson as sendJsonResponse, } from "./response.js";
 function getDrizzleDb(state) {
     const runtime = state.current;
     if (!runtime)
@@ -39,6 +39,7 @@ function isValidDisplayName(value) {
 const AUTH_ATTEMPT_WINDOW_MS = 60_000;
 const AUTH_ATTEMPT_MAX = 20;
 const sessionRouteAttempts = new Map();
+const passwordChangeLimiter = getSensitiveLimiter("auth.password.change");
 function consumeAuthBucket(ip, now = Date.now()) {
     const key = ip ?? "unknown";
     const entry = sessionRouteAttempts.get(key);
@@ -96,6 +97,26 @@ export async function handleAuthSessionRoutes(req, res, state) {
     if (!db) {
         // Routes here all need the DB — return service unavailable rather than
         // routing further. The bootstrap-token endpoint behaves the same way.
+        if (url.pathname === "/api/auth/me" && isTrustedLocalRequest(req)) {
+            sendJsonResponse(res, 200, {
+                identity: {
+                    id: "local-loopback",
+                    displayName: "Local",
+                    kind: "owner",
+                },
+                session: {
+                    id: "local-loopback",
+                    kind: "local",
+                    expiresAt: null,
+                },
+                access: {
+                    mode: "local",
+                    passwordConfigured: false,
+                    ownerConfigured: false,
+                },
+            });
+            return true;
+        }
         if (url.pathname === "/api/auth/setup" ||
             url.pathname === "/api/auth/login/password" ||
             url.pathname === "/api/auth/password/change" ||
@@ -112,38 +133,38 @@ export async function handleAuthSessionRoutes(req, res, state) {
         return false;
     }
     const store = new AuthStore(db);
-    const ip = req.socket?.remoteAddress ?? null;
+    const ip = req.socket.remoteAddress ?? null;
     const userAgent = extractHeaderValue(req.headers["user-agent"]);
     // POST /api/auth/setup — first-run owner identity creation
     if (method === "POST" && url.pathname === "/api/auth/setup") {
-        return await handleSetup(req, res, store, { ip, userAgent });
+        return handleSetup(req, res, store, { ip, userAgent });
     }
     // POST /api/auth/login/password
     if (method === "POST" && url.pathname === "/api/auth/login/password") {
-        return await handleLoginPassword(req, res, store, { ip, userAgent });
+        return handleLoginPassword(req, res, store, { ip, userAgent });
     }
     // POST /api/auth/password/change
     if (method === "POST" && url.pathname === "/api/auth/password/change") {
-        return await handleChangePassword(req, res, store, { ip, userAgent });
+        return handleChangePassword(req, res, store, { ip, userAgent });
     }
     // POST /api/auth/logout
     if (method === "POST" && url.pathname === "/api/auth/logout") {
-        return await handleLogout(req, res, store, { ip, userAgent });
+        return handleLogout(req, res, store, { ip, userAgent });
     }
     // GET /api/auth/me
     if (method === "GET" && url.pathname === "/api/auth/me") {
-        return await handleMe(req, res, store);
+        return handleMe(req, res, store);
     }
     // GET /api/auth/sessions
     if (method === "GET" && url.pathname === "/api/auth/sessions") {
-        return await handleListSessions(req, res, store);
+        return handleListSessions(req, res, store);
     }
     // POST /api/auth/sessions/:id/revoke
     const revokeMatch = method === "POST"
         ? /^\/api\/auth\/sessions\/([^/]+)\/revoke$/.exec(url.pathname)
         : null;
     if (revokeMatch) {
-        return await handleRevoke(req, res, store, revokeMatch[1], {
+        return handleRevoke(req, res, store, revokeMatch[1], {
             ip,
             userAgent,
         });
@@ -152,7 +173,7 @@ export async function handleAuthSessionRoutes(req, res, state) {
 }
 // ── /api/auth/setup ─────────────────────────────────────────────────────────
 async function handleSetup(req, res, store, meta) {
-    if (!consumeAuthBucket(meta.ip)) {
+    if (!passwordChangeLimiter.consume(meta.ip)) {
         sendJsonErrorResponse(res, 429, "Too many requests");
         return true;
     }
@@ -484,7 +505,7 @@ async function handleListSessions(req, res, store) {
                 {
                     id: "local-loopback",
                     kind: "local",
-                    ip: req.socket?.remoteAddress ?? "127.0.0.1",
+                    ip: req.socket.remoteAddress ?? "127.0.0.1",
                     userAgent: extractHeaderValue(req.headers["user-agent"]),
                     lastSeenAt: Date.now(),
                     expiresAt: null,

package/api/auth.d.ts

@@ -5,7 +5,7 @@
  * timing-safe comparison so route handlers don't reimplement it.
  */
 import type http from "node:http";
-export { tokenMatches } from "./auth/tokens";
+export { tokenMatches } from "./auth/tokens.js";
 /**
  * Normalise a potentially multi-valued HTTP header into a single string.
  * Returns `null` when the header is absent or empty.
@@ -56,7 +56,7 @@ export declare function ensureCompatApiAuthorized(req: Pick<http.IncomingMessage
  * once per handler.
  */
 export declare function ensureCompatApiAuthorizedAsync(req: Pick<http.IncomingMessage, "headers" | "socket" | "method">, res: http.ServerResponse, options: {
-    store: import("../services/auth-store").AuthStore;
+    store: import("../services/auth-store.js").AuthStore;
     now?: number;
     /**
      * Skip CSRF enforcement for routes that ALWAYS handle CSRF themselves
@@ -105,14 +105,11 @@ export type AuthSessionOrBootstrapResult = {
 };
 /**
  * Decide whether a request carries a valid session cookie or a bootstrap
- * bearer eligible for exchange. This is the single chokepoint that replaces
- * the deleted "cloud-provisioned bypass" branches.
+ * bearer eligible for exchange.
  *
- * The function does NOT exchange the bootstrap token here — that's the job
+ * The function does NOT exchange the bootstrap token — that's the job
  * of `POST /api/auth/bootstrap/exchange`, which is rate-limited and audited.
- * On the legacy onboarding routes we treat a valid session OR an unconsumed
- * bootstrap bearer as authorisation to read; the exchange route is the
- * single place that flips bootstrap → session.
+ * The exchange route is the single place that flips bootstrap → session.
  *
  * Fails closed on every error path. There is no path through this function
  * that returns "session" without a real session row id.
@@ -131,20 +128,16 @@ interface CompatStateLike {
     } | null;
 }
 /**
- * Canonical async route guard. Replaces every call site of
- * {@link ensureCompatApiAuthorized}. Behaviour:
+ * Canonical async route guard.
  *
- *   - When the runtime DB is up, delegate to
- *     {@link ensureCompatApiAuthorizedAsync} so cookie + CSRF +
- *     machine-session paths all work.
- *   - When the runtime DB is not yet available (early boot), fall back
- *     to {@link ensureCompatApiAuthorized} (bearer-only). This preserves
- *     the existing behaviour for cold boot probes that ran before the
- *     auth subsystem was available.
+ * When the runtime DB is up, delegates to {@link ensureCompatApiAuthorizedAsync}
+ * so cookie + CSRF + machine-session paths work. During early boot before the
+ * DB is available, falls back to {@link ensureCompatApiAuthorized}
+ * (bearer-only).
  *
- * Pass `skipCsrf: true` for routes that mint cookies / handle their own
- * CSRF (login, setup, bootstrap exchange) where the SPA cannot present a
- * CSRF token because the session doesn't exist yet.
+ * Pass `skipCsrf: true` for routes that mint cookies / handle their own CSRF
+ * (login, setup, bootstrap exchange) where the SPA cannot present a CSRF
+ * token because the session doesn't exist yet.
  */
 export declare function ensureRouteAuthorized(req: Pick<http.IncomingMessage, "headers" | "socket" | "method">, res: http.ServerResponse, state: CompatStateLike, options?: {
     skipCsrf?: boolean;

package/api/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAWlC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GACnC,MAAM,GAAG,IAAI,CAGf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GACzC,MAAM,GAAG,IAAI,CAgBf;AAOD,mEAAmE;AACnE,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAqCD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,EACrD,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,OAAO,CAqBT;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAChE,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,OAAO,EAAE;IACP,KAAK,EAAE,OAAO,wBAAwB,EAAE,SAAS,CAAC;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GACA,OAAO,CAAC,OAAO,CAAC,CAiDlB;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAMD,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EAC1C,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAYf;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,4BAA4B,GACpC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACpD,4BAA4B,CAqB9B;AAED;;;GAGG;AACH,wBAAgB,oCAAoC,CAClD,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,EACrD,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,OAAO,CAeT;AAED,UAAU,eAAe;IACvB,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACvD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAChE,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GACjD,OAAO,CAAC,OAAO,CAAC,CAalB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../src/api/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAclC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GACnC,MAAM,GAAG,IAAI,CAGf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GACzC,MAAM,GAAG,IAAI,CAgBf;AAOD,mEAAmE;AACnE,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAqCD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,EACrD,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,OAAO,CAqBT;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAChE,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,OAAO,EAAE;IACP,KAAK,EAAE,OAAO,wBAAwB,EAAE,SAAS,CAAC;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GACA,OAAO,CAAC,OAAO,CAAC,CA8DlB;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAMD,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EAC1C,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAYf;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,4BAA4B,GACpC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACpD,4BAA4B,CAqB9B;AAED;;;GAGG;AACH,wBAAgB,oCAAoC,CAClD,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,EACrD,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,OAAO,CAeT;AAED,UAAU,eAAe;IACvB,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACvD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAChE,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GACjD,OAAO,CAAC,OAAO,CAAC,CAYlB"}

package/api/auth.js

@@ -5,11 +5,14 @@
  * timing-safe comparison so route handlers don't reimplement it.
  */
 import { resolveApiToken } from "@elizaos/shared";
-import { CSRF_HEADER_NAME, findActiveSession, verifyCsrfToken, } from "./auth/sessions";
-import { tokenMatches } from "./auth/tokens";
-import { isTrustedLocalRequest } from "./compat-route-shared";
-import { sendJsonError } from "./response";
-export { tokenMatches } from "./auth/tokens";
+// AuthStore is statically imported elsewhere in the package; the dynamic
+// import below was INEFFECTIVE_DYNAMIC_IMPORT.
+import { AuthStore } from "../services/auth-store.js";
+import { CSRF_HEADER_NAME, findActiveSession, verifyCsrfToken, } from "./auth/sessions.js";
+import { tokenMatches } from "./auth/tokens.js";
+import { isTrustedLocalRequest } from "./compat-route-shared.js";
+import { sendJsonError } from "./response.js";
+export { tokenMatches } from "./auth/tokens.js";
 /**
  * Normalise a potentially multi-valued HTTP header into a single string.
  * Returns `null` when the header is absent or empty.
@@ -107,7 +110,7 @@ export function ensureCompatApiAuthorized(req, res) {
         sendJsonError(res, 401, "Unauthorized");
         return false;
     }
-    const ip = req.socket?.remoteAddress ?? null;
+    const ip = req.socket.remoteAddress ?? null;
     if (isAuthRateLimited(ip)) {
         sendJsonError(res, 429, "Too many authentication attempts");
         return false;
@@ -139,7 +142,7 @@ const CSRF_REQUIRED_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
  * once per handler.
  */
 export async function ensureCompatApiAuthorizedAsync(req, res, options) {
-    const ip = req.socket?.remoteAddress ?? null;
+    const ip = req.socket.remoteAddress ?? null;
     if (isAuthRateLimited(ip)) {
         sendJsonError(res, 429, "Too many authentication attempts");
         return false;
@@ -170,6 +173,16 @@ export async function ensureCompatApiAuthorizedAsync(req, res, options) {
         const sessionFromBearer = await findActiveSession(options.store, provided, options.now).catch(() => null);
         if (sessionFromBearer)
             return true;
+        // Android local-agent mode sets ELIZA_REQUIRE_LOCAL_AUTH=1 because
+        // loopback is shared across apps on-device. In that mode the native
+        // service injects a per-boot ELIZA_API_TOKEN bearer for WebView requests;
+        // accept that configured token even after the runtime DB is available.
+        const expectedToken = getCompatApiToken();
+        if (process.env.ELIZA_REQUIRE_LOCAL_AUTH === "1" &&
+            expectedToken &&
+            tokenMatches(expectedToken, provided)) {
+            return true;
+        }
     }
     recordFailedAuth(ip);
     sendJsonError(res, 401, "Unauthorized");
@@ -211,20 +224,17 @@ export function readCookie(req, name) {
 }
 /**
  * Decide whether a request carries a valid session cookie or a bootstrap
- * bearer eligible for exchange. This is the single chokepoint that replaces
- * the deleted "cloud-provisioned bypass" branches.
+ * bearer eligible for exchange.
  *
- * The function does NOT exchange the bootstrap token here — that's the job
+ * The function does NOT exchange the bootstrap token — that's the job
  * of `POST /api/auth/bootstrap/exchange`, which is rate-limited and audited.
- * On the legacy onboarding routes we treat a valid session OR an unconsumed
- * bootstrap bearer as authorisation to read; the exchange route is the
- * single place that flips bootstrap → session.
+ * The exchange route is the single place that flips bootstrap → session.
  *
  * Fails closed on every error path. There is no path through this function
  * that returns "session" without a real session row id.
  */
 export function ensureAuthSessionOrBootstrap(req) {
-    const ip = req.socket?.remoteAddress ?? null;
+    const ip = req.socket.remoteAddress ?? null;
     if (isAuthRateLimited(ip)) {
         return { kind: "denied", status: 429, reason: "rate_limited" };
     }
@@ -259,20 +269,16 @@ export function ensureCompatSensitiveRouteAuthorized(req, res) {
     return ensureCompatApiAuthorized(req, res);
 }
 /**
- * Canonical async route guard. Replaces every call site of
- * {@link ensureCompatApiAuthorized}. Behaviour:
+ * Canonical async route guard.
  *
- *   - When the runtime DB is up, delegate to
- *     {@link ensureCompatApiAuthorizedAsync} so cookie + CSRF +
- *     machine-session paths all work.
- *   - When the runtime DB is not yet available (early boot), fall back
- *     to {@link ensureCompatApiAuthorized} (bearer-only). This preserves
- *     the existing behaviour for cold boot probes that ran before the
- *     auth subsystem was available.
+ * When the runtime DB is up, delegates to {@link ensureCompatApiAuthorizedAsync}
+ * so cookie + CSRF + machine-session paths work. During early boot before the
+ * DB is available, falls back to {@link ensureCompatApiAuthorized}
+ * (bearer-only).
  *
- * Pass `skipCsrf: true` for routes that mint cookies / handle their own
- * CSRF (login, setup, bootstrap exchange) where the SPA cannot present a
- * CSRF token because the session doesn't exist yet.
+ * Pass `skipCsrf: true` for routes that mint cookies / handle their own CSRF
+ * (login, setup, bootstrap exchange) where the SPA cannot present a CSRF
+ * token because the session doesn't exist yet.
  */
 export async function ensureRouteAuthorized(req, res, state, options = {}) {
     const adapter = state.current?.adapter;
@@ -280,7 +286,6 @@ export async function ensureRouteAuthorized(req, res, state, options = {}) {
     if (!db) {
         return ensureCompatApiAuthorized(req, res);
     }
-    const { AuthStore } = await import("../services/auth-store");
     const store = new AuthStore(db);
     return ensureCompatApiAuthorizedAsync(req, res, {
         store,

package/api/automations-compat-routes.d.ts

@@ -13,6 +13,6 @@
  * consumers without a workflow plugin dependency.
  */
 import type http from "node:http";
-import type { CompatRuntimeState } from "./compat-route-shared";
+import type { CompatRuntimeState } from "./compat-route-shared.js";
 export declare function handleAutomationsCompatRoutes(req: http.IncomingMessage, res: http.ServerResponse, state: CompatRuntimeState): Promise<boolean>;
 //# sourceMappingURL=automations-compat-routes.d.ts.map

package/api/automations-compat-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"automations-compat-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/automations-compat-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AASlC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAyThE,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAwBlB"}
+{"version":3,"file":"automations-compat-routes.d.ts","sourceRoot":"","sources":["../../../../../src/api/automations-compat-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AASlC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AA2ThE,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,OAAO,CAAC,CAwBlB"}