@goodandready/dsh-cron 0.3.24 → 0.3.26

package/lib/routes/api-item.js

@@ -0,0 +1,191 @@
+import { logStreamer } from '../log-streamer.js';
+import { applyTaskPatch } from '../task-patch.js';
+import { MANAGED_BY_CONFIG } from '../config-jobs.js';
+import { sendJson, rejectCrossOrigin, readBody, SCRIPT_CONFIRM_HEADER, redactTaskSecrets } from '../http-utils.js';
+import { normalizeTaskType } from '../runtimes.js';
+import { handleHeartbeatPing, handleDryRunTask } from './api-helpers.js';
+import { handleItemPost } from './api-actions.js';
+import { refuseConfigOwned, NOT_FOUND, NOT_ALLOWED } from './api-collection.js';
+
+// ------------------------------------------------------------ single task
+
+export async function handleTaskItem({ store, scheduler, req, res, url, id, action, subAction, apiToken, ctx }) {
+  if (action === 'heartbeat') {
+    handleHeartbeatPing({ store, req, res, taskId: id, apiToken, ctx });
+    return;
+  }
+
+  if (req.method === 'POST' && action === 'dry-run') {
+    await handleDryRunTask({ store, scheduler, req, res, id, apiToken, ctx });
+    return;
+  }
+
+  if (req.method === 'GET') {
+    // Both /dsh-cron/tasks/:id/stream and /dsh-cron/tasks/:id/logs/stream (#392)
+    if (action === 'stream' || (action === 'logs' && subAction === 'stream')) {
+      logStreamer.handleSseRequest(id, req, res);
+      return;
+    }
+    if (rejectCrossOrigin(req, res, { apiToken, ctx })) return;
+    if (action === 'archive') {
+      const limit = parseInt(url.searchParams.get('limit') || '50', 10);
+      const offset = parseInt(url.searchParams.get('offset') || '0', 10);
+      const search = url.searchParams.get('search') || '';
+      const result = typeof store.getArchivedRuns === 'function'
+        ? store.getArchivedRuns(id, { limit, offset, search })
+        : { runs: [], total: 0 };
+      sendJson(res, 200, { ok: true, taskId: id, ...result });
+      return;
+    }
+    if (action === 'stats') {
+      const stats = typeof store.getTaskStats === 'function' ? store.getTaskStats(id) : null;
+      sendJson(res, 200, { ok: true, taskId: id, stats });
+      return;
+    }
+    if (action === 'prompt-history') {
+      const task = store.get(id);
+      if (!task) {
+        sendJson(res, 404, NOT_FOUND);
+        return;
+      }
+      sendJson(res, 200, {
+        ok: true,
+        taskId: id,
+        promptVersion: task.promptVersion || 1,
+        promptHistory: task.promptHistory || [],
+      });
+      return;
+    }
+    if (action === 'history') {
+      const limit = parseInt(url.searchParams.get('limit') || '20', 10);
+      sendJson(res, 200, { ok: true, history: store.getHistory(id, limit) });
+      return;
+    }
+    if (action === 'git-diff') {
+      const task = store.get(id);
+      if (!task) {
+        sendJson(res, 404, NOT_FOUND);
+        return;
+      }
+      const runs = store.getHistory(id, 10);
+      const runId = url.searchParams.get('runId') || subAction;
+      const targetRun = runId ? runs.find((r) => r.id === runId) : runs[0];
+      const diffData = targetRun?.gitDiff || null;
+      sendJson(res, 200, {
+        ok: true,
+        taskId: id,
+        runId: targetRun?.id || null,
+        gitDiff: diffData,
+      });
+      return;
+    }
+    if (action === 'doctor') {
+      const task = store.get(id);
+      if (!task) {
+        sendJson(res, 404, NOT_FOUND);
+        return;
+      }
+      const runs = store.getHistory(id, 5);
+      const latestRun = runs[0] || null;
+      const reportRun = runs.find((r) => r.doctorReport) || latestRun;
+      sendJson(res, 200, {
+        ok: true,
+        taskId: id,
+        doctorReport: reportRun?.doctorReport || null,
+        revisions: task.revisions || [],
+        previousPrompt: task.previousPrompt || null,
+        autoHeal: Boolean(task.autoHeal || task.selfHealing?.autoApply),
+      });
+      return;
+    }
+    if (!action) {
+      const task = store.get(id);
+      if (!task) {
+        sendJson(res, 404, NOT_FOUND);
+        return;
+      }
+      sendJson(res, 200, {
+        ok: true,
+        task: {
+          ...redactTaskSecrets(task),
+          running: scheduler.isRunning(task.id),
+          runningSince: scheduler.runningSince(task.id),
+        },
+      });
+      return;
+    }
+  }
+  if (req.method === 'POST') {
+    const handled = await handleItemPost({ store, scheduler, req, res, url, id, action, subAction });
+    if (handled) return;
+  }
+  if (req.method === 'PATCH') {
+    await patchTask({ store, scheduler, req, res, id });
+    return;
+  }
+  if (req.method === 'DELETE' || (req.method === 'POST' && action === 'delete')) {
+    deleteTask({ store, scheduler, res, id });
+    return;
+  }
+  sendJson(res, 405, NOT_ALLOWED);
+}
+
+/** Task actions that are plain POSTs. Returns true when one matched. */
+
+export async function patchTask({ store, scheduler, req, res, id }) {
+  const current = store.get(id);
+  if (!current) {
+    sendJson(res, 404, NOT_FOUND);
+    return;
+  }
+  if (current.managedBy === MANAGED_BY_CONFIG) {
+    refuseConfigOwned(res, id);
+    return;
+  }
+  const { body, error } = await readBody(req, res);
+  if (error) return;
+  const result = applyTaskPatch({
+    store,
+    scheduler,
+    id,
+    body,
+    allowCodeSwitch: req.headers[SCRIPT_CONFIRM_HEADER] === 'script',
+  });
+  if (!result.ok) {
+    const status = result.status || (result.notFound ? 404 : (result.needsConfirmation ? 403 : 400));
+    const error = result.needsConfirmation
+      ? `Switching a task to the ${normalizeTaskType(body.type)} type over HTTP requires the ${SCRIPT_CONFIRM_HEADER}: script header`
+      : result.error;
+    sendJson(res, status, {
+      ok: false,
+      error,
+      ...(result.unknownChannels ? { unknownChannels: result.unknownChannels } : {}),
+    });
+    return;
+  }
+  sendJson(res, 200, { ok: true, task: redactTaskSecrets(result.task) });
+}
+
+
+export function deleteTask({ store, scheduler, res, id }) {
+  const current = store.get(id);
+  if (current && current.managedBy === MANAGED_BY_CONFIG) {
+    refuseConfigOwned(res, id);
+    return;
+  }
+  if (current) {
+    if (scheduler && typeof scheduler.removeTask === 'function') {
+      scheduler.removeTask(id);
+    } else if (scheduler) {
+      scheduler.pauseTask(id);
+    }
+    try {
+      store.delete(id);
+    } catch (err) {
+      sendJson(res, 500, { ok: false, error: 'Failed to delete task: ' + err.message });
+      return;
+    }
+  }
+  sendJson(res, 200, { ok: true });
+}
+

package/lib/routes/api-task-webhook.js

@@ -0,0 +1,247 @@
+/**
+ * lib/api-task-webhook.js — Incoming HTTP Webhook Triggers (#348).
+ *
+ * Implements POST /dsh-cron/webhook/:taskId and POST /dsh-cron/api/webhook/:taskId.
+ * Authenticates via HMAC SHA-256 signature (GitHub/Stripe style), per-task token,
+ * or master apiToken, applies debouncing, parses JSON/text payload, and triggers
+ * the task with variable interpolation.
+ */
+
+import crypto from 'node:crypto';
+import { logger } from '../logger.js';
+import { sendJson } from '../http-utils.js';
+
+const MAX_WEBHOOK_BYTES = 512 * 1024; // 512 KiB limit
+const NOT_ALLOWED = { ok: false, error: 'Method not allowed' };
+const lastWebhookRuns = new Map();
+
+/**
+ * Constant-time string/buffer comparison.
+ */
+export function safeCompare(a, b) {
+  if (!a || !b) return false;
+  const bufA = Buffer.from(String(a), 'utf8');
+  const bufB = Buffer.from(String(b), 'utf8');
+  if (bufA.length !== bufB.length) return false;
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+
+/**
+ * Verify HMAC SHA-256 signature from headers.
+ * Supports x-hub-signature-256 (sha256=...), x-signature-256, or x-dsh-cron-signature.
+ */
+export function verifyHmacSignature(rawBuffer, secret, signatureHeader) {
+  if (!secret || !signatureHeader) return false;
+  const expectedHex = crypto.createHmac('sha256', secret).update(rawBuffer).digest('hex');
+  const provided = String(signatureHeader).replace(/^sha256=/i, '').trim();
+  return safeCompare(expectedHex, provided);
+}
+
+/**
+ * Verify token from header or Bearer auth.
+ * Query parameter authentication is strictly rejected to prevent token leakage in proxy logs and browser history (#358).
+ */
+export function verifyToken(expectedToken, req, url) {
+  if (!expectedToken) return false;
+  const headers = req?.headers || {};
+  const headerToken = headers['x-dsh-cron-webhook-token'] || headers['x-webhook-token'];
+  const authHeader = headers['authorization'];
+  let bearerToken = '';
+  if (authHeader && /^Bearer\s+/i.test(authHeader)) {
+    bearerToken = authHeader.replace(/^Bearer\s+/i, '').trim();
+  }
+  const candidate = headerToken || bearerToken;
+  if (!candidate) return false;
+  return safeCompare(expectedToken, candidate);
+}
+
+/**
+ * Read request body with raw Buffer preserved for signature verification.
+ */
+export function readRawBody(req, limit = MAX_WEBHOOK_BYTES) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let bytes = 0;
+    let settled = false;
+
+    const fail = (err) => {
+      if (settled) return;
+      settled = true;
+      reject(err);
+    };
+
+    req.on('data', (chunk) => {
+      if (settled) return;
+      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      bytes += buf.length;
+      if (bytes > limit) {
+        fail(Object.assign(new Error('Webhook payload exceeds 512 KiB limit'), { statusCode: 413 }));
+        req.destroy();
+        return;
+      }
+      chunks.push(buf);
+    });
+
+    req.on('end', () => {
+      if (settled) return;
+      settled = true;
+      const raw = chunks.length ? Buffer.concat(chunks) : Buffer.alloc(0);
+      let parsed = null;
+      const text = raw.toString('utf8').trim();
+      if (text) {
+        try {
+          parsed = JSON.parse(text);
+        } catch {
+          parsed = text;
+        }
+      } else {
+        parsed = {};
+      }
+      resolve({ raw, parsed });
+    });
+
+    req.on('error', (err) => {
+      fail(Object.assign(err, { statusCode: 400 }));
+    });
+  });
+}
+
+/**
+ * Handle incoming webhook request for a task.
+ */
+export async function handleTaskWebhookRoute({ store, scheduler, req, res, taskId: explicitTaskId }) {
+  if (req.method !== 'POST') {
+    sendJson(res, 405, NOT_ALLOWED);
+    return;
+  }
+
+  const url = new URL(req.url, 'http://127.0.0.1');
+  let taskId = explicitTaskId;
+  if (!taskId) {
+    const parts = url.pathname.split('/').filter(Boolean);
+    // /dsh-cron/webhook/:taskId or /dsh-cron/api/webhook/:taskId
+    const webhookIdx = parts.indexOf('webhook');
+    if (webhookIdx !== -1 && parts[webhookIdx + 1]) {
+      taskId = parts[webhookIdx + 1];
+    }
+  }
+
+  if (!taskId) {
+    sendJson(res, 400, { ok: false, error: 'Task ID is required in webhook URL path' });
+    return;
+  }
+
+  const task = store.get(taskId);
+  if (!task) {
+    sendJson(res, 404, { ok: false, error: `Task "${taskId}" not found` });
+    return;
+  }
+
+  if (task.status !== 'active') {
+    sendJson(res, 400, { ok: false, error: `Task "${taskId}" is not active (current status: ${task.status})` });
+    return;
+  }
+
+  const isEnabled = Boolean(
+    task.webhookEnabled ||
+    (task.webhookTrigger && task.webhookTrigger.enabled)
+  );
+  if (!isEnabled) {
+    logger.warn(`[dsh-cron] Webhook received for task "${taskId}" but webhooks are not enabled for this task`);
+    sendJson(res, 403, { ok: false, error: `Webhooks are not enabled for task "${taskId}"` });
+    return;
+  }
+
+  // Read raw body
+  let bodyData;
+  try {
+    bodyData = await readRawBody(req);
+  } catch (err) {
+    sendJson(res, err.statusCode || 400, { ok: false, error: err.message });
+    return;
+  }
+
+  const { raw, parsed } = bodyData;
+  const headers = req.headers || {};
+  const settings = typeof store.getSettings === 'function' ? store.getSettings() : {};
+
+  // Authentication check (fail-closed)
+  const taskSecret = task.webhookSecret || (task.webhookTrigger && task.webhookTrigger.secret);
+  const taskToken = task.webhookToken || (task.webhookTrigger && task.webhookTrigger.token);
+  const masterToken = settings.apiToken;
+
+  let authenticated = false;
+
+  if (taskSecret) {
+    const sigHeader = headers['x-hub-signature-256'] || headers['x-signature-256'] || headers['x-dsh-cron-signature'];
+    if (sigHeader && verifyHmacSignature(raw, taskSecret, sigHeader)) {
+      authenticated = true;
+    } else {
+      logger.warn(`[dsh-cron] Invalid HMAC signature for webhook task "${taskId}"`);
+      sendJson(res, 401, { ok: false, error: 'Invalid HMAC signature' });
+      return;
+    }
+  } else if (taskToken) {
+    if (verifyToken(taskToken, req, url)) {
+      authenticated = true;
+    } else {
+      logger.warn(`[dsh-cron] Invalid webhook token for task "${taskId}"`);
+      sendJson(res, 401, { ok: false, error: 'Invalid webhook token' });
+      return;
+    }
+  } else if (masterToken) {
+    if (verifyToken(masterToken, req, url)) {
+      authenticated = true;
+    } else {
+      logger.warn(`[dsh-cron] Invalid API token for webhook task "${taskId}"`);
+      sendJson(res, 401, { ok: false, error: 'Unauthorized: missing or invalid token' });
+      return;
+    }
+  } else {
+    logger.warn(`[dsh-cron] Webhook task "${taskId}" rejected: no secret or token configured (fail-closed)`);
+    sendJson(res, 403, { ok: false, error: 'Webhook secret or token must be configured for security' });
+    return;
+  }
+
+  // Debounce check
+  const debounceMs = Math.max(0, Number(task.webhookDebounceMs || (task.webhookTrigger && task.webhookTrigger.debounceMs) || 0));
+  if (debounceMs > 0) {
+    const now = Date.now();
+    const last = lastWebhookRuns.get(taskId) || 0;
+    if (now - last < debounceMs) {
+      logger.info(`[dsh-cron] Webhook for task "${taskId}" debounced (${now - last}ms < ${debounceMs}ms)`);
+      sendJson(res, 200, { ok: true, debounced: true, message: `Webhook debounced (${debounceMs}ms cooldown)` });
+      return;
+    }
+    lastWebhookRuns.set(taskId, now);
+  } else {
+    lastWebhookRuns.set(taskId, Date.now());
+  }
+
+  const query = Object.fromEntries(url.searchParams.entries());
+  const webhookPayload = {
+    body: parsed,
+    raw: raw.toString('utf8'),
+    headers,
+    query,
+  };
+
+  logger.info(`[dsh-cron] Webhook accepted for task "${taskId}", triggering execution`);
+
+  try {
+    const runPromise = scheduler.triggerManualRun(taskId, {
+      webhook: webhookPayload,
+      triggeredBy: 'webhook',
+    });
+
+    sendJson(res, 200, {
+      ok: true,
+      triggered: true,
+      taskId,
+      message: `Webhook received and task "${task.title}" triggered`,
+    });
+  } catch (runErr) {
+    logger.error(`[dsh-cron] Failed to trigger task "${taskId}" from webhook: ${runErr.message}`);
+    sendJson(res, 500, { ok: false, error: `Failed to trigger task: ${runErr.message}` });
+  }
+}

package/lib/routes/api-webhook.js

@@ -0,0 +1,183 @@
+import crypto from 'node:crypto';
+import { logger } from '../logger.js';
+import { sendJson, readBody } from '../http-utils.js';
+import { answerTelegramCallbackQuery, sendTelegramMessage, getDshDefaultTelegramCredentials } from '../telegram.js';
+import { handleTelegramCommand } from '../telegram-commands.js';
+import { bestEffort } from '../best-effort.js';
+
+const NOT_ALLOWED = { ok: false, error: 'Method not allowed' };
+const seenUpdateIds = new Set();
+
+export async function handleTelegramWebhook({ store, scheduler, req, res }) {
+  if (req.method !== 'POST') {
+    sendJson(res, 405, NOT_ALLOWED);
+    return;
+  }
+  const { body, error } = await readBody(req, res);
+  if (error || !body) return;
+
+  const settings = typeof store.getSettings === 'function' ? store.getSettings() : {};
+  const defaults = getDshDefaultTelegramCredentials();
+  const botToken = settings.botToken || defaults.botToken;
+  const allowedChatId = String(settings.chatId || defaults.chatId || '').trim();
+
+  // Secret token verification (Issue #208) - fail-closed: secret MUST be configured
+  const webhookSecret = settings.telegramWebhookSecret || settings.webhookSecret || settings.secretToken || process.env.TELEGRAM_WEBHOOK_SECRET;
+  if (!webhookSecret) {
+    logger.warn('[dsh-cron] unauthorized telegram webhook: webhook secret is not configured (fail-closed)');
+    sendJson(res, 401, { ok: false, error: 'Unauthorized: webhook secret is not configured' });
+    return;
+  }
+  const headers = req.headers || {};
+  const receivedSecret = headers['x-telegram-bot-api-secret-token'] || headers['X-Telegram-Bot-Api-Secret-Token'];
+  if (!receivedSecret || typeof receivedSecret !== 'string') {
+    logger.warn('[dsh-cron] unauthorized telegram webhook: missing secret token header');
+    sendJson(res, 401, { ok: false, error: 'Unauthorized: missing secret token' });
+    return;
+  }
+  const secretBuf = Buffer.from(String(webhookSecret));
+  const receivedBuf = Buffer.from(String(receivedSecret));
+  if (secretBuf.length !== receivedBuf.length || !crypto.timingSafeEqual(secretBuf, receivedBuf)) {
+    logger.warn('[dsh-cron] unauthorized telegram webhook: invalid secret token');
+    sendJson(res, 401, { ok: false, error: 'Unauthorized: invalid secret token' });
+    return;
+  }
+
+  // Deduplicate updates by update_id (Issue #208)
+  if (body.update_id != null) {
+    if (seenUpdateIds.has(body.update_id)) {
+      sendJson(res, 200, { ok: true, duplicate: true });
+      return;
+    }
+    seenUpdateIds.add(body.update_id);
+    if (seenUpdateIds.size > 2000) {
+      const first = seenUpdateIds.values().next().value;
+      seenUpdateIds.delete(first);
+    }
+  }
+
+  // 1. Text command message (#175)
+  const message = body.message;
+  if (message && typeof message.text === 'string' && message.text.trim().startsWith('/')) {
+    const fromId = String(message.from?.id || '');
+    const chatId = String(message.chat?.id || fromId);
+    // Fail-closed: empty allowedChatId denies control (Issue #208)
+    if (!allowedChatId || (chatId !== allowedChatId && fromId !== allowedChatId)) {
+      logger.warn(`[dsh-cron] unauthorized telegram command from chat ${chatId} / user ${fromId} (allowedChatId: ${allowedChatId || 'NOT_CONFIGURED'})`);
+      sendJson(res, 403, { ok: false, error: 'Forbidden' });
+      return;
+    }
+    const result = await handleTelegramCommand({
+      store,
+      scheduler,
+      text: message.text,
+      chatId,
+      botToken,
+    });
+    sendJson(res, 200, result || { ok: true });
+    return;
+  }
+
+  // 2. Inline callback query (#137)
+  const callbackQuery = body.callback_query;
+  if (!callbackQuery) {
+    sendJson(res, 200, { ok: true, ignored: true });
+    return;
+  }
+
+  const queryId = callbackQuery.id;
+  const data = String(callbackQuery.data || '');
+  const fromId = String(callbackQuery.from?.id || '');
+  const chatId = String(callbackQuery.message?.chat?.id || fromId);
+
+  if (!allowedChatId || (chatId !== allowedChatId && fromId !== allowedChatId)) {
+    logger.warn(`[dsh-cron] unauthorized telegram callback from chat ${chatId} / user ${fromId} (allowedChatId: ${allowedChatId || 'NOT_CONFIGURED'})`);
+    if (botToken) {
+      await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: 'Unauthorized', showAlert: true });
+    }
+    sendJson(res, 403, { ok: false, error: 'Forbidden' });
+    return;
+  }
+
+  const parts = data.split(':');
+  if (parts[0] !== 'cron' || parts.length < 3) {
+    if (botToken) {
+      await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: 'Unknown action' });
+    }
+    sendJson(res, 200, { ok: true, ignored: true });
+    return;
+  }
+
+  const verb = parts[1];
+  const taskId = parts.slice(2).join(':');
+  const task = store.get(taskId);
+
+  if (!task) {
+    if (botToken) {
+      await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: 'Task not found', showAlert: true });
+    }
+    sendJson(res, 200, { ok: false, error: 'Task not found' });
+    return;
+  }
+
+  const isConfigTask = task.source === 'config' || task.origin === 'config' || task.readOnly || task.managedBy === 'config';
+  if ((verb === 'pause' || verb === 'resume') && isConfigTask) {
+    if (botToken) {
+      await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: 'Cannot modify config-owned task', showAlert: true });
+    }
+    sendJson(res, 400, { ok: false, error: 'Cannot modify config-owned task' });
+    return;
+  }
+
+  if (verb === 'run') {
+    try {
+      await scheduler.triggerManualRun(taskId);
+      if (botToken) {
+        await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: `🚀 Run triggered: ${task.title}` });
+      }
+    } catch (runErr) {
+      if (botToken) {
+        await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: `Run error: ${runErr.message}`, showAlert: true });
+      }
+    }
+  } else if (verb === 'pause') {
+    const isPaused = task.status === 'paused';
+    if (isPaused) {
+      scheduler.resumeTask(taskId);
+      if (botToken) {
+        await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: `▶️ Resumed: ${task.title}` });
+      }
+    } else {
+      scheduler.pauseTask(taskId, 'Paused via Telegram button');
+      if (botToken) {
+        await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: `⏸ Paused: ${task.title}` });
+      }
+    }
+  } else if (verb === 'log') {
+    const history = store.getHistory(taskId, 1);
+    const lastRun = history && history[0];
+    if (!lastRun) {
+      if (botToken) {
+        await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: `No runs recorded for ${task.title}`, showAlert: true });
+      }
+    } else {
+      const summary = `[${task.title}] Last run: ${lastRun.status} (${lastRun.durationMs}ms)\n${lastRun.output || lastRun.error || 'Empty output'}`;
+      if (botToken) {
+        await answerTelegramCallbackQuery({ botToken, callbackQueryId: queryId, text: summary.slice(0, 190) });
+        if (summary.length > 190 && chatId) {
+          await sendTelegramMessage({
+            botToken,
+            chatId,
+            text: `*Full Output for ${task.title}:*\n\`\`\`\n${summary.slice(0, 3000)}\n\`\`\``,
+            parseMode: 'Markdown',
+          }).catch(() => {
+            bestEffort('telegram-full-output', () => {}, scheduler?.logger);
+          });
+        }
+      }
+    }
+  }
+
+  sendJson(res, 200, { ok: true, verb, taskId });
+}
+