@equilateral_ai/mindmeld 3.0.0

package/src/handlers/github/githubOAuthCallback.js

@@ -0,0 +1,166 @@
+/**
+ * GitHub OAuth Callback Handler
+ * Receives GET redirect from GitHub, exchanges code for token, redirects to frontend
+ *
+ * GET /api/github/oauth/callback (No auth - GitHub redirect)
+ * Query: ?code=...&state=...
+ */
+
+const { wrapHandler, executeQuery } = require('../helpers');
+const crypto = require('crypto');
+const https = require('https');
+
+const FRONTEND_URL = process.env.FRONTEND_URL || 'https://app.mindmeld.dev';
+
+function redirect(url) {
+    return {
+        statusCode: 302,
+        headers: {
+            'Location': url,
+            'Access-Control-Allow-Origin': '*'
+        },
+        body: ''
+    };
+}
+
+function httpsRequest(options, postData) {
+    return new Promise((resolve, reject) => {
+        const req = https.request(options, (res) => {
+            let data = '';
+            res.on('data', chunk => data += chunk);
+            res.on('end', () => {
+                try {
+                    resolve({ statusCode: res.statusCode, body: JSON.parse(data) });
+                } catch (e) {
+                    // GitHub token endpoint may return form-encoded
+                    const parsed = {};
+                    data.split('&').forEach(pair => {
+                        const [key, val] = pair.split('=');
+                        if (key) parsed[decodeURIComponent(key)] = decodeURIComponent(val || '');
+                    });
+                    resolve({ statusCode: res.statusCode, body: parsed });
+                }
+            });
+        });
+        req.on('error', reject);
+        if (postData) req.write(postData);
+        req.end();
+    });
+}
+
+function encryptToken(token, key) {
+    const iv = crypto.randomBytes(16);
+    const cipher = crypto.createCipheriv('aes-256-cbc', Buffer.from(key, 'hex'), iv);
+    let encrypted = cipher.update(token, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    return iv.toString('hex') + ':' + encrypted;
+}
+
+async function githubOAuthCallback({ queryStringParameters }) {
+    try {
+        const code = queryStringParameters.code;
+        const state = queryStringParameters.state;
+
+        if (!code || !state) {
+            console.error('Missing code or state in callback');
+            return redirect(`${FRONTEND_URL}/onboarding?error=missing_params`);
+        }
+
+        // Look up state token in DB to identify user
+        const stateResult = await executeQuery(`
+            SELECT email_address FROM rapport.github_oauth_states
+            WHERE state_token = $1 AND used = FALSE
+            AND created_at > NOW() - INTERVAL '15 minutes'
+        `, [state]);
+
+        if (stateResult.rowCount === 0) {
+            console.error('Invalid or expired state token');
+            return redirect(`${FRONTEND_URL}/onboarding?error=invalid_state`);
+        }
+
+        const email = stateResult.rows[0].email_address;
+
+        // Mark state as used
+        await executeQuery(`
+            UPDATE rapport.github_oauth_states SET used = TRUE
+            WHERE state_token = $1
+        `, [state]);
+
+        // Exchange code for access token
+        const tokenPayload = JSON.stringify({
+            client_id: process.env.GITHUB_OAUTH_CLIENT_ID,
+            client_secret: process.env.GITHUB_OAUTH_CLIENT_SECRET,
+            code: code
+        });
+
+        const tokenResponse = await httpsRequest({
+            hostname: 'github.com',
+            path: '/login/oauth/access_token',
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Accept': 'application/json',
+                'Content-Length': Buffer.byteLength(tokenPayload)
+            }
+        }, tokenPayload);
+
+        const accessToken = tokenResponse.body.access_token;
+        if (!accessToken) {
+            console.error('GitHub token exchange failed:', tokenResponse.body);
+            return redirect(`${FRONTEND_URL}/onboarding?error=token_exchange_failed`);
+        }
+
+        const tokenScope = tokenResponse.body.scope || '';
+
+        // Get GitHub user info
+        const userResponse = await httpsRequest({
+            hostname: 'api.github.com',
+            path: '/user',
+            method: 'GET',
+            headers: {
+                'Authorization': `Bearer ${accessToken}`,
+                'User-Agent': 'MindMeld-App',
+                'Accept': 'application/json'
+            }
+        });
+
+        if (userResponse.statusCode !== 200) {
+            console.error('GitHub user fetch failed:', userResponse.statusCode);
+            return redirect(`${FRONTEND_URL}/onboarding?error=github_user_failed`);
+        }
+
+        const githubUser = userResponse.body;
+
+        // Encrypt the access token
+        const encryptionKey = process.env.GITHUB_TOKEN_ENCRYPTION_KEY;
+        if (!encryptionKey) {
+            console.error('GITHUB_TOKEN_ENCRYPTION_KEY not configured');
+            return redirect(`${FRONTEND_URL}/onboarding?error=config_error`);
+        }
+        const encryptedToken = encryptToken(accessToken, encryptionKey);
+
+        // Upsert GitHub connection
+        await executeQuery(`
+            INSERT INTO rapport.github_connections (
+                email_address, github_username, github_user_id,
+                access_token_encrypted, token_scope, connected_at
+            ) VALUES ($1, $2, $3, $4, $5, NOW())
+            ON CONFLICT (email_address) DO UPDATE SET
+                github_username = EXCLUDED.github_username,
+                github_user_id = EXCLUDED.github_user_id,
+                access_token_encrypted = EXCLUDED.access_token_encrypted,
+                token_scope = EXCLUDED.token_scope,
+                connected_at = NOW(),
+                revoked = FALSE
+        `, [email, githubUser.login, githubUser.id, encryptedToken, tokenScope]);
+
+        // Success - redirect to onboarding step 2
+        return redirect(`${FRONTEND_URL}/onboarding?step=2`);
+
+    } catch (error) {
+        console.error('GitHub OAuth Callback Error:', error);
+        return redirect(`${FRONTEND_URL}/onboarding?error=server_error`);
+    }
+}
+
+exports.handler = wrapHandler(githubOAuthCallback);

package/src/handlers/github/githubOAuthStart.js

@@ -0,0 +1,59 @@
+/**
+ * GitHub OAuth Start Handler
+ * Generates GitHub OAuth authorization URL
+ *
+ * GET /api/github/oauth/start (CognitoAuthorizer)
+ */
+
+const { wrapHandler, executeQuery, createSuccessResponse, createErrorResponse } = require('../helpers');
+const crypto = require('crypto');
+
+async function githubOAuthStart({ requestContext }) {
+    try {
+        const email = requestContext.authorizer?.claims?.email || requestContext.authorizer?.jwt?.claims?.email;
+
+        if (!email) {
+            return createErrorResponse(401, 'Authentication required');
+        }
+
+        const clientId = process.env.GITHUB_OAUTH_CLIENT_ID;
+        if (!clientId) {
+            return createErrorResponse(500, 'GitHub OAuth not configured');
+        }
+
+        // Generate unique state token and store in DB for CSRF verification
+        const stateToken = crypto.randomBytes(32).toString('hex');
+
+        // Clean up old unused states for this user, then insert new one
+        await executeQuery(`
+            DELETE FROM rapport.github_oauth_states
+            WHERE email_address = $1 OR created_at < NOW() - INTERVAL '15 minutes'
+        `, [email]);
+
+        await executeQuery(`
+            INSERT INTO rapport.github_oauth_states (state_token, email_address)
+            VALUES ($1, $2)
+        `, [stateToken, email]);
+
+        const callbackUrl = process.env.GITHUB_OAUTH_CALLBACK_URL || 'https://api.mindmeld.dev/api/github/oauth/callback';
+
+        const params = new URLSearchParams({
+            client_id: clientId,
+            redirect_uri: callbackUrl,
+            scope: 'repo',
+            state: stateToken
+        });
+
+        const authorization_url = `https://github.com/login/oauth/authorize?${params.toString()}`;
+
+        return createSuccessResponse(
+            { authorization_url },
+            'OAuth URL generated'
+        );
+    } catch (error) {
+        console.error('GitHub OAuth Start Error:', error);
+        return createErrorResponse(500, 'Failed to generate OAuth URL');
+    }
+}
+
+exports.handler = wrapHandler(githubOAuthStart);

package/src/handlers/github/githubPatternsReview.js

@@ -0,0 +1,109 @@
+/**
+ * GitHub Patterns Review Handler
+ * Processes user's approve/reject decisions on discovered patterns
+ *
+ * PUT /api/github/patterns/review (CognitoAuthorizer)
+ * Body: { project_id, approvals: [{ discovery_id, approved }] }
+ */
+
+const { wrapHandler, executeQuery, createSuccessResponse, createErrorResponse } = require('../helpers');
+
+async function githubPatternsReview({ body, requestContext }) {
+    try {
+        const email = requestContext.authorizer?.claims?.email || requestContext.authorizer?.jwt?.claims?.email;
+
+        if (!email) {
+            return createErrorResponse(401, 'Authentication required');
+        }
+
+        const { project_id, approvals } = body;
+        if (!project_id || !approvals || !Array.isArray(approvals)) {
+            return createErrorResponse(400, 'project_id and approvals array are required');
+        }
+
+        // Verify user has access to project
+        const accessResult = await executeQuery(`
+            SELECT role FROM rapport.project_collaborators
+            WHERE project_id = $1 AND email_address = $2
+        `, [project_id, email]);
+
+        if (accessResult.rowCount === 0) {
+            return createErrorResponse(403, 'Access denied to project');
+        }
+
+        let patterns_created = 0;
+        let patterns_rejected = 0;
+
+        for (const { discovery_id, approved } of approvals) {
+            if (!discovery_id) continue;
+
+            if (approved) {
+                // Get discovery details
+                const discoveryResult = await executeQuery(`
+                    SELECT discovery_type, pattern_name, pattern_description, evidence
+                    FROM rapport.onboarding_discoveries
+                    WHERE discovery_id = $1 AND project_id = $2
+                `, [discovery_id, project_id]);
+
+                if (discoveryResult.rowCount === 0) continue;
+
+                const discovery = discoveryResult.rows[0];
+
+                // Create pattern entry
+                const patternId = `pat_${project_id}_${Date.now()}_${patterns_created}`;
+                await executeQuery(`
+                    INSERT INTO rapport.patterns (
+                        pattern_id, project_id, intent, constraints, outcome_criteria,
+                        maturity, discovered_by, pattern_data
+                    ) VALUES ($1, $2, $3, $4, $5, 'provisional', $6, $7)
+                `, [
+                    patternId,
+                    project_id,
+                    discovery.pattern_name,
+                    JSON.stringify([discovery.pattern_description || '']),
+                    JSON.stringify([`Discovered via GitHub onboarding: ${discovery.discovery_type}`]),
+                    email,
+                    JSON.stringify({
+                        source: 'github_onboarding',
+                        discovery_type: discovery.discovery_type,
+                        evidence: discovery.evidence
+                    })
+                ]);
+
+                // Update discovery status
+                await executeQuery(`
+                    UPDATE rapport.onboarding_discoveries
+                    SET status = 'approved', reviewed_at = NOW(), pattern_id = $1
+                    WHERE discovery_id = $2
+                `, [patternId, discovery_id]);
+
+                patterns_created++;
+            } else {
+                // Reject
+                await executeQuery(`
+                    UPDATE rapport.onboarding_discoveries
+                    SET status = 'rejected', reviewed_at = NOW()
+                    WHERE discovery_id = $1 AND project_id = $2
+                `, [discovery_id, project_id]);
+
+                patterns_rejected++;
+            }
+        }
+
+        // Mark onboarding as completed
+        await executeQuery(`
+            UPDATE rapport.projects SET onboarding_completed = TRUE
+            WHERE project_id = $1
+        `, [project_id]);
+
+        return createSuccessResponse(
+            { patterns_created, patterns_rejected },
+            'Patterns reviewed successfully'
+        );
+    } catch (error) {
+        console.error('GitHub Patterns Review Error:', error);
+        return createErrorResponse(500, 'Failed to process pattern reviews');
+    }
+}
+
+exports.handler = wrapHandler(githubPatternsReview);

package/src/handlers/github/githubReposList.js

@@ -0,0 +1,105 @@
+/**
+ * GitHub Repos List Handler
+ * Lists user's GitHub repositories
+ *
+ * GET /api/github/repos (CognitoAuthorizer)
+ */
+
+const { wrapHandler, executeQuery, createSuccessResponse, createErrorResponse } = require('../helpers');
+const crypto = require('crypto');
+const https = require('https');
+
+function httpsGet(options) {
+    return new Promise((resolve, reject) => {
+        const req = https.request(options, (res) => {
+            let data = '';
+            res.on('data', chunk => data += chunk);
+            res.on('end', () => {
+                try {
+                    resolve({ statusCode: res.statusCode, body: JSON.parse(data) });
+                } catch (e) {
+                    resolve({ statusCode: res.statusCode, body: data });
+                }
+            });
+        });
+        req.on('error', reject);
+        req.end();
+    });
+}
+
+function decryptToken(encryptedData, key) {
+    const [ivHex, encrypted] = encryptedData.split(':');
+    const iv = Buffer.from(ivHex, 'hex');
+    const decipher = crypto.createDecipheriv('aes-256-cbc', Buffer.from(key, 'hex'), iv);
+    let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+    decrypted += decipher.final('utf8');
+    return decrypted;
+}
+
+async function githubReposList({ requestContext }) {
+    try {
+        const email = requestContext.authorizer?.claims?.email || requestContext.authorizer?.jwt?.claims?.email;
+
+        if (!email) {
+            return createErrorResponse(401, 'Authentication required');
+        }
+
+        // Get stored connection
+        const connResult = await executeQuery(`
+            SELECT access_token_encrypted FROM rapport.github_connections
+            WHERE email_address = $1 AND revoked = FALSE
+        `, [email]);
+
+        if (connResult.rowCount === 0) {
+            return createErrorResponse(404, 'No GitHub connection found. Please connect GitHub first.');
+        }
+
+        // Decrypt token
+        const encryptionKey = process.env.GITHUB_TOKEN_ENCRYPTION_KEY;
+        const accessToken = decryptToken(connResult.rows[0].access_token_encrypted, encryptionKey);
+
+        // Fetch repos from GitHub
+        const reposResponse = await httpsGet({
+            hostname: 'api.github.com',
+            path: '/user/repos?sort=updated&per_page=30&type=owner',
+            method: 'GET',
+            headers: {
+                'Authorization': `Bearer ${accessToken}`,
+                'User-Agent': 'MindMeld-App',
+                'Accept': 'application/json'
+            }
+        });
+
+        if (reposResponse.statusCode !== 200) {
+            console.error('GitHub repos fetch failed:', reposResponse.statusCode);
+            return createErrorResponse(502, 'Failed to fetch repositories from GitHub');
+        }
+
+        // Update last_used_at
+        await executeQuery(`
+            UPDATE rapport.github_connections SET last_used_at = NOW()
+            WHERE email_address = $1
+        `, [email]);
+
+        // Map to minimal repo info
+        const repos = reposResponse.body.map(repo => ({
+            name: repo.name,
+            full_name: repo.full_name,
+            language: repo.language,
+            default_branch: repo.default_branch,
+            private: repo.private,
+            html_url: repo.html_url,
+            updated_at: repo.updated_at
+        }));
+
+        return createSuccessResponse(
+            { repos },
+            'Repositories fetched successfully'
+        );
+    } catch (error) {
+        console.error('GitHub Repos List Error:', error);
+        return createErrorResponse(500, 'Failed to list repositories');
+    }
+}
+
+exports.handler = wrapHandler(githubReposList);

package/src/handlers/helpers/checkSuperAdmin.js

@@ -0,0 +1,85 @@
+/**
+ * Super Admin Check Helper
+ * Follows Tim-Combo pattern: simple boolean flag in Users table
+ */
+
+const { executeQuery } = require('./dbOperations');
+
+/**
+ * Check if user is a superadmin
+ * @param {string} email - User email
+ * @returns {Promise<boolean>}
+ */
+async function isSuperAdmin(email) {
+    const query = `
+        SELECT "Super_Admin"
+        FROM "Users"
+        WHERE "Email_Address" = $1
+    `;
+    const result = await executeQuery(query, [email]);
+    return result.rows.length > 0 && result.rows[0].Super_Admin === true;
+}
+
+/**
+ * Require superadmin access - throws 403 if not superadmin
+ * @param {string} email - User email
+ * @throws {Error} 403 Forbidden if not superadmin
+ */
+async function requireSuperAdmin(email) {
+    const isAdmin = await isSuperAdmin(email);
+    if (!isAdmin) {
+        const error = new Error('Superadmin access required');
+        error.statusCode = 403;
+        throw error;
+    }
+}
+
+/**
+ * Get user with superadmin status
+ * @param {string} email - User email
+ * @returns {Promise<Object|null>}
+ */
+async function getUserWithSuperAdminStatus(email) {
+    const query = `
+        SELECT
+            "Email_Address",
+            "Client_ID",
+            "User_Display_Name",
+            "First_Name",
+            "Last_Name",
+            "Super_Admin",
+            "User_Status"
+        FROM "Users"
+        WHERE "Email_Address" = $1
+    `;
+    const result = await executeQuery(query, [email]);
+    return result.rows.length > 0 ? result.rows[0] : null;
+}
+
+/**
+ * Log superadmin action to audit trail
+ * @param {Object} params - Audit parameters
+ */
+async function logSuperAdminAction({ email, action, targetType, targetId, details, ipAddress, userAgent }) {
+    const query = `
+        INSERT INTO superadmin_audit_log (
+            email, action, target_type, target_id, details, ip_address, user_agent
+        ) VALUES ($1, $2, $3, $4, $5, $6, $7)
+    `;
+    await executeQuery(query, [
+        email,
+        action,
+        targetType || null,
+        targetId || null,
+        details ? JSON.stringify(details) : null,
+        ipAddress || null,
+        userAgent || null
+    ]);
+}
+
+module.exports = {
+    isSuperAdmin,
+    requireSuperAdmin,
+    getUserWithSuperAdminStatus,
+    logSuperAdminAction
+};

package/src/handlers/helpers/dbOperations.js

@@ -0,0 +1,53 @@
+/**
+ * Database Operations Helper
+ * Cached PostgreSQL client (Lambda database standards compliant)
+ *
+ * CRITICAL: Uses single cached client (NOT connection pool)
+ * Follows lambda_database_standards.md
+ */
+
+const { Client } = require('pg');
+
+// Cached client for connection reuse across warm invocations
+let cachedClient = null;
+
+/**
+ * Get database client (cached)
+ * Reuses connection across Lambda invocations
+ */
+async function getClient() {
+    if (cachedClient && cachedClient._connected) {
+        return cachedClient;
+    }
+
+    // Create new client with environment variables (resolved at deployment)
+    // AWS RDS requires SSL for all connections
+    cachedClient = new Client({
+        host: process.env.DB_HOST,
+        port: parseInt(process.env.DB_PORT || '5432'),
+        database: process.env.DB_NAME,
+        user: process.env.DB_USER,
+        password: process.env.DB_PASS || process.env.DB_PASSWORD,  // Support both naming conventions
+        ssl: { rejectUnauthorized: false }  // Required for AWS RDS
+    });
+
+    await cachedClient.connect();
+    cachedClient._connected = true;
+
+    console.log('Database client connected');
+
+    return cachedClient;
+}
+
+/**
+ * Execute query using cached client
+ * @param {string} query - SQL query
+ * @param {array} params - Query parameters
+ * @returns {Promise<object>} Query result
+ */
+async function executeQuery(query, params = []) {
+    const client = await getClient();
+    return client.query(query, params);
+}
+
+module.exports = { executeQuery };

package/src/handlers/helpers/errorHandler.js

@@ -0,0 +1,49 @@
+/**
+ * Error Handler Helper
+ * Standard error handling and logging for all Rapport handlers
+ */
+
+/**
+ * Handle error with standard response
+ * @param {Error} error - Error object
+ * @returns {object} Lambda error response
+ */
+function handleError(error) {
+    console.error('Error:', error);
+
+    // Determine status code
+    const statusCode = error.statusCode || 500;
+
+    // Determine message
+    let message = 'Internal server error';
+    if (error.statusCode) {
+        message = error.message;
+    } else if (error.code === '23505') {
+        message = 'Resource already exists';
+    } else if (error.code === '23503') {
+        message = 'Referenced resource not found';
+    } else if (error.code === '23502') {
+        message = 'Required field missing';
+    }
+
+    return {
+        statusCode,
+        headers: {
+            'Content-Type': 'application/json',
+            'Access-Control-Allow-Origin': '*',
+            'Access-Control-Allow-Methods': 'GET,POST,PUT,DELETE,OPTIONS',
+            'Access-Control-Allow-Headers': 'Content-Type,Authorization'
+        },
+        body: JSON.stringify({
+            success: false,
+            message,
+            error: process.env.NODE_ENV === 'dev' ? {
+                code: error.code,
+                detail: error.detail,
+                stack: error.stack
+            } : undefined
+        })
+    };
+}
+
+module.exports = { handleError };