@geminixiang/mikan 0.4.8 → 0.5.0

package/dist/web/login/portal.js

@@ -1,11 +1,9 @@
 import { createHash, randomBytes } from "crypto";
-import { createServer } from "http";
-import { handleAdminRequest } from "../admin/portal.js";
 import { escapeHtml } from "../../utils/html.js";
 import { readRawBody } from "../../utils/http-body.js";
 import { renderPortalShell } from "../../portal-shell.js";
 import { resolveLinkBaseUrl } from "../../config.js";
-import { handleSessionViewRequest, } from "../session-view/portal.js";
+import { requestBaseUrl } from "../request.js";
 import { getOAuthServices, resolveOAuthService, } from "./oauth.js";
 import * as log from "../../log.js";
 import { reportUserFacingError } from "../../observability/sentry.js";
@@ -178,7 +176,7 @@ const SECRET_PRESETS = [
         ],
     },
 ];
-// ── startLinkServer ────────────────────────────────────────────────────────────
+// ── request handler ───────────────────────────────────────────────────────────
 /**
  * Start a small HTTP server that receives credential onboarding callbacks from the web portal.
  *
@@ -189,137 +187,62 @@ const SECRET_PRESETS = [
  *   POST /api/oauth/start     — creates provider OAuth redirect URL
  *   GET  /oauth/callback      — OAuth callback endpoint
  */
-export function startLinkServer(port, linkTokenStore, vaultManager, notify, sessionViewTokenStore, sessionViewInteractive, adminOptions) {
+export function createLoginRequestHandler(linkTokenStore, vaultManager, notify) {
     const oauthStates = new Map();
-    const server = createServer(async (req, res) => {
-        try {
-            const url = new URL(req.url ?? "/", requestBaseUrl(req));
-            if (req.method === "GET" && url.pathname === "/health") {
-                res.writeHead(200, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({ ok: true }));
-                return;
+    return (req, res, url) => {
+        if (req.method === "GET" && url.pathname === "/link") {
+            const rawToken = url.searchParams.get("token") ?? "";
+            const linkToken = linkTokenStore.peek(rawToken);
+            if (!linkToken) {
+                res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(renderErrorPage("This link is invalid or has expired. Ask the bot for a new /login link."));
+                return true;
             }
-            if (adminOptions?.adminTokenStore &&
-                handleAdminRequest(req, res, url, {
-                    vaultManager,
-                    linkTokenStore,
-                    sessionViewTokenStore,
-                    adminTokenStore: adminOptions.adminTokenStore,
-                    portalBaseUrl: resolveLinkBaseUrl() ?? undefined,
-                    workingDir: adminOptions.workingDir,
-                    runtime: adminOptions.runtime,
-                    sandbox: adminOptions.sandbox,
-                    botsByPlatform: adminOptions.botsByPlatform,
-                })) {
-                return;
-            }
-            if (await handleSessionViewRequest(req, res, url, sessionViewTokenStore, sessionViewInteractive)) {
-                return;
-            }
-            if (req.method === "GET" && url.pathname === "/link") {
-                const rawToken = url.searchParams.get("token") ?? "";
-                const linkToken = linkTokenStore.peek(rawToken);
-                if (!linkToken) {
-                    res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-                    res.end(renderErrorPage("This link is invalid or has expired. Ask the bot for a new /login link."));
-                    return;
-                }
-                const oauthServiceHint = linkToken.providerId
-                    ? resolveOAuthService(linkToken.providerId)
-                    : undefined;
-                const oauthServices = getOAuthServices();
-                const defaultMode = oauthServiceHint ? "oauth" : "api_key";
-                const existingSecrets = describeVaultSecrets(vaultManager, linkToken.vaultId);
-                const title = oauthServiceHint ? `${oauthServiceHint.label} OAuth` : "Store Secret";
-                const helpText = oauthServiceHint
-                    ? `Authorize ${oauthServiceHint.label} and store tokens in your vault.`
-                    : "Set any environment variable key/value pair in your vault.";
-                const secretLabel = "Secret value";
-                const placeholder = "sk-...";
-                const initialEnvKey = "";
-                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-                res.end(renderCredentialPage(rawToken, title, defaultMode, initialEnvKey, secretLabel, placeholder, helpText, oauthServices, oauthServiceHint?.id, existingSecrets));
-                return;
-            }
-            if (req.method === "POST" && url.pathname === "/api/link/complete") {
-                if (!enforceCsrf(req, res))
-                    return;
-                void readJsonBody(req, res, async (body) => {
-                    await handleLinkComplete(body, linkTokenStore, vaultManager, notify, res);
-                });
-                return;
-            }
-            if (req.method === "POST" && url.pathname === "/api/oauth/start") {
-                if (!enforceCsrf(req, res))
-                    return;
-                void readJsonBody(req, res, async (body) => {
-                    await handleOAuthStart(body, req, linkTokenStore, oauthStates, res);
-                });
-                return;
-            }
-            if (req.method === "GET" && url.pathname === "/oauth/callback") {
-                void handleOAuthCallback(url, req, linkTokenStore, vaultManager, notify, oauthStates, res).catch((err) => {
-                    log.logWarning("OAuth callback failed", err.message);
-                    reportUserFacingError(err, {
-                        domain: "login",
-                        surface: "oauth",
-                        operation: "oauth_callback",
-                        severity: "error",
-                        context: { route: "/oauth/callback" },
-                    });
-                    res.writeHead(500, { "Content-Type": "text/html; charset=utf-8" });
-                    res.end(renderErrorPage("OAuth callback failed. Please retry /login."));
-                });
-                return;
-            }
-            res.writeHead(404);
-            res.end();
+            const oauthServiceHint = linkToken.providerId
+                ? resolveOAuthService(linkToken.providerId)
+                : undefined;
+            const oauthServices = getOAuthServices();
+            const defaultMode = oauthServiceHint ? "oauth" : "api_key";
+            const existingSecrets = describeVaultSecrets(vaultManager, linkToken.vaultId);
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(renderCredentialPage(rawToken, oauthServiceHint ? `${oauthServiceHint.label} OAuth` : "Store Secret", defaultMode, "", "Secret value", "sk-...", oauthServiceHint
+                ? `Authorize ${oauthServiceHint.label} and store tokens in your vault.`
+                : "Set any environment variable key/value pair in your vault.", oauthServices, oauthServiceHint?.id, existingSecrets));
+            return true;
         }
-        catch (err) {
-            log.logWarning("Link server request error", err instanceof Error ? err.message : String(err));
-            if (!res.headersSent) {
-                res.writeHead(500, { "Content-Type": "application/json" });
-            }
-            res.end(JSON.stringify({ error: "Internal server error" }));
+        if (req.method === "POST" && url.pathname === "/api/link/complete") {
+            if (!enforceCsrf(req, res))
+                return true;
+            void readJsonBody(req, res, async (body) => {
+                await handleLinkComplete(body, linkTokenStore, vaultManager, notify, res);
+            });
+            return true;
         }
-    });
-    // Bind to loopback when MIKAN_LINK_URL is unset so the credential UI and OAuth
-    // callbacks are not exposed on public interfaces by default. Production
-    // deployments set MIKAN_LINK_URL and are expected to front this server with a
-    // reverse proxy, which can still reach it via 0.0.0.0.
-    const bindHost = resolveLinkBaseUrl() ? undefined : "127.0.0.1";
-    server.listen(port, bindHost, () => {
-        log.logInfo(`Link callback server listening on ${bindHost ?? "0.0.0.0"}:${port}`);
-        if (!resolveLinkBaseUrl()) {
-            log.logWarning("MIKAN_LINK_URL is not set — bound to 127.0.0.1 and OAuth redirect_uri will be " +
-                "derived from request headers (Host / X-Forwarded-*). Set " +
-                "MIKAN_LINK_URL=https://your-host.example.com for production.");
+        if (req.method === "POST" && url.pathname === "/api/oauth/start") {
+            if (!enforceCsrf(req, res))
+                return true;
+            void readJsonBody(req, res, async (body) => {
+                await handleOAuthStart(body, req, linkTokenStore, oauthStates, res);
+            });
+            return true;
         }
-    });
-    server.on("error", (err) => {
-        log.logWarning("Link server error", err.message);
-    });
-    return server;
-}
-/**
- * Resolve the externally-visible base URL of this server.
- *
- * Prefers MIKAN_LINK_URL (see config.ts) so the OAuth `redirect_uri` is
- * deterministic and not influenced by attacker-controlled request headers.
- * Falls back to Host / X-Forwarded-* only when no base URL is configured
- * — intended for local development.
- */
-function requestBaseUrl(req) {
-    const configured = resolveLinkBaseUrl();
-    if (configured)
-        return configured;
-    const protoRaw = req.headers["x-forwarded-proto"]?.split(",")[0]?.trim();
-    const proto = protoRaw || "http";
-    const host = (req.headers["x-forwarded-host"]?.split(",")[0]?.trim() ??
-        req.headers.host ??
-        `localhost`) ||
-        `localhost`;
-    return `${proto}://${host}`;
+        if (req.method === "GET" && url.pathname === "/oauth/callback") {
+            void handleOAuthCallback(url, req, linkTokenStore, vaultManager, notify, oauthStates, res).catch((err) => {
+                log.logWarning("OAuth callback failed", err.message);
+                reportUserFacingError(err, {
+                    domain: "login",
+                    surface: "oauth",
+                    operation: "oauth_callback",
+                    severity: "error",
+                    context: { route: "/oauth/callback" },
+                });
+                res.writeHead(500, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(renderErrorPage("OAuth callback failed. Please retry /login."));
+            });
+            return true;
+        }
+        return false;
+    };
 }
 /**
  * Block cross-site POSTs to the credential endpoints. Two defenses: