@goodandready/dsh-key-rotation 0.8.78 → 0.8.79

package/lib/ops-telemetry.js

@@ -1,276 +1,2 @@
-// lib/ops-telemetry.js — usage + snapshot operational routes (#312 split from routes-ops.js).
-import {
-  json,
-  readJson,
-  descriptorOf,
-  NS,
-} from './http-bridge.js';
-import { isTrustedBridgeRequest } from './pool.js';
-import {
-  usageRows,
-  usageCsv,
-} from './usage-report.js';
-import {
-  USAGE_PATH,
-  SNAPSHOT_PATH,
-  DIAG_PATH,
-  TRACE_PATH,
-  SIMULATE_PATH,
-} from './ops-paths.js';
-import { simulateRouting } from './simulator.js';
-import { getSelectionTraces, clearSelectionTraces } from './selection-trace.js';
-import { findSecrets } from './keycheck.js';
-import { mutateSettings, sectionOps } from './settings-write.js';
-import { compute24hAnalytics } from './ops-analytics.js';
-import { getPromptCacheSummary } from './prompt-cache.js';
-
-/**
- * @param {object} ctx cordis context
- * @param {object} deps live dependencies from apply()
- */
-
-const DIAG_BUFFER_LIMIT = 200;
-
-export class DiagBuffer {
-  constructor(limit = DIAG_BUFFER_LIMIT) {
-    this.limit = limit;
-    this.buffer = [];
-  }
-
-  push(entry) {
-    if (this.buffer.length >= this.limit) {
-      this.buffer.shift();
-    }
-    this.buffer.push({
-      timestamp: Date.now(),
-      ...entry,
-    });
-  }
-
-  get() {
-    return this.buffer.slice();
-  }
-
-  clear() {
-    this.buffer.length = 0;
-  }
-}
-
-const defaultDiagBuffer = new DiagBuffer();
-
-export function pushDiag(entry, buffer = null) {
-  (buffer || defaultDiagBuffer).push(entry);
-}
-
-export function getDiagBuffer(buffer = null) {
-  return (buffer || defaultDiagBuffer).get();
-}
-
-export function registerTelemetryRoutes(ctx, deps) {
-  const {
-    buildRuntime,
-  } = deps;
-
-ctx.effect(() => ctx.webServer.register({
-  kind: 'exact',
-  path: USAGE_PATH,
-  handler: (req, res) => {
-    if (req.method !== 'GET') { json(res, 405, { error: { code: 'method', message: 'GET only' } }); return; }
-    if (!isTrustedBridgeRequest(req)) { json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: usage is local-only' } }); return; }
-    const url = new URL(req.url ?? USAGE_PATH, 'http://localhost');
-    const days = Math.min(90, Math.max(1, Number(url.searchParams.get('days')) || 7));
-    const csv = url.searchParams.get('format') === 'csv';
-    const provider = url.searchParams.get('provider') ?? '';
-    const runtime = buildRuntime();
-    const now = Date.now();
-    const seen = new Set();
-    const report = [];
-    const poolsToScan = runtime.pools ?? runtime.poolByRef.values();
-    for (const pool of poolsToScan) {
-      if (seen.has(pool.base)) continue;
-      seen.add(pool.base);
-      if (provider && pool.base !== provider && pool.provider !== provider) continue;
-      report.push({
-        provider: pool.base,
-        rows: usageRows(pool, days, now),
-        promptCache: getPromptCacheSummary(pool, now),
-        analytics24h: compute24hAnalytics(pool, now),
-      });
-    }
-    if (csv) {
-      res.writeHead(200, { 'content-type': 'text/csv; charset=utf-8', 'content-disposition': 'attachment; filename="dsh-key-rotation-usage.csv"' });
-      const parts = [];
-      for (const p of report) {
-        if (parts.length > 0) parts.push('');
-        parts.push('# ' + p.provider);
-        parts.push(usageCsv(p.rows));
-      }
-      res.end(parts.join('\n') + '\n');
-      return;
-    }
-    json(res, 200, { at: now, days, providers: report });
-  },
-}), 'dsh-key-rotation: usage route');
-
-// #218: full config snapshot - one JSON file to move between machines.
-// Secret values never travel: only credential/env names. Token fields are
-// exported as empty strings; on import they keep existing values when empty.
-
-ctx.effect(() => ctx.webServer.register({
-  kind: 'exact',
-  path: SNAPSHOT_PATH,
-  handler: async (req, res) => {
-    if (req.method !== 'GET' && req.method !== 'POST') { json(res, 405, { error: { code: 'method', message: 'GET (export) or POST (import) only' } }); return; }
-    if (!isTrustedBridgeRequest(req)) { json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: snapshot is local-only' } }); return; }
-    if (req.method === 'GET') {
-      const descriptor = descriptorOf(ctx, NS);
-      const value = descriptor?.value ?? {};
-      const exportable = { ...value };
-      // token-shaped fields stay empty in the file; refs are names, not secrets
-      exportable.webhookActionToken = '';
-      json(res, 200, { at: Date.now(), version: 1, snapshot: exportable });
-      return;
-    }
-    // POST = import: { snapshot } -> merge with current section, PUT semantics
-    let body;
-    try { body = await readJson(req); } catch (e) { json(res, 400, { error: { code: 'bad-request', message: String(e?.message ?? e) } }); return; }
-    const snap = body?.snapshot;
-    if (!snap || typeof snap !== 'object' || Array.isArray(snap)) { json(res, 400, { error: { code: 'bad-format', message: 'dsh-key-rotation: POST requires {"snapshot": {...}}' } }); return; }
-    // #200 leak guard applies to imported content too
-    try {
-      const masked = structuredClone(snap);
-      if (masked.webhookActionToken) masked.webhookActionToken = '***';
-      if (masked.notifyWebhook) masked.notifyWebhook = '***';
-      const findings = findSecrets(JSON.stringify(masked));
-      if (findings.length > 0) { json(res, 400, { error: { code: 'secret-in-snapshot', message: 'dsh-key-rotation: snapshot carries a live-looking credential', findings } }); return; }
-    } catch { /* scanning must never block a valid import */ }
-    const settings = ctx.get('settings');
-    if (!settings) { json(res, 503, { error: { code: 'settings-rejected', message: 'dsh-key-rotation: no settings provider' } }); return; }
-    const desc = descriptorOf(ctx, NS);
-    if (desc === void 0) { json(res, 500, { error: { code: 'settings-rejected', message: 'dsh-key-rotation: namespace missing' } }); return; }
-    try {
-      // Empty exported tokens mean omitted, not erased. Never reconstruct a
-      // complete section from the redacted describe response.
-      const ops = sectionOps(snap, { preserveEmptySecrets: true });
-      await mutateSettings(settings, NS, ops, body.expectedRevision ?? desc.revision);
-      const after = descriptorOf(ctx, NS);
-      json(res, 200, { ok: true, revision: after?.revision });
-    } catch (e) {
-      json(res, e?.code === 'SETTINGS_CONFLICT' ? 409 : 400, { error: { code: 'settings-rejected', message: String(e?.message ?? e) } });
-    }
-  },
-}), 'dsh-key-rotation: snapshot route');
-
-
-ctx.effect(() => ctx.webServer.register({
-  kind: 'exact',
-  path: TRACE_PATH,
-  handler: (req, res) => {
-    if (req.method !== 'GET' && req.method !== 'DELETE') {
-      json(res, 405, { error: { code: 'method', message: 'GET or DELETE only' } });
-      return;
-    }
-    if (!isTrustedBridgeRequest(req)) {
-      json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: trace is local-only' } });
-      return;
-    }
-    const traceStore = deps.selectionTraceStore || null;
-    if (req.method === 'DELETE') {
-      clearSelectionTraces(traceStore);
-      json(res, 200, { ok: true, message: 'trace history cleared' });
-      return;
-    }
-    const url = new URL(req.url ?? TRACE_PATH, 'http://localhost');
-    const limit = Math.min(100, Math.max(1, Number(url.searchParams.get('limit')) || 50));
-    json(res, 200, { ok: true, traces: getSelectionTraces(limit, traceStore) });
-  },
-}), 'dsh-key-rotation: trace route');
-
-
-ctx.effect(() => ctx.webServer.register({
-  kind: 'exact',
-  path: SIMULATE_PATH,
-  handler: async (req, res) => {
-    if (req.method !== 'POST') {
-      json(res, 405, { error: { code: 'method', message: 'POST only' } });
-      return;
-    }
-    if (!isTrustedBridgeRequest(req)) {
-      json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: simulate is local-only' } });
-      return;
-    }
-    let body;
-    try { body = await readJson(req); } catch (e) {
-      json(res, 400, { error: { code: 'bad-request', message: String(e?.message ?? e) } });
-      return;
-    }
-
-    const runtime = buildRuntime();
-    const provider = body?.provider?.trim();
-    if (!provider) {
-      json(res, 400, { error: { code: 'bad-request', message: 'provider is required for simulation' } });
-      return;
-    }
-
-    let pool = null;
-    if (runtime.providerToPool instanceof Map) {
-      pool = runtime.providerToPool.get(provider);
-    } else if (runtime.providerToPool && typeof runtime.providerToPool === 'object') {
-      pool = runtime.providerToPool[provider];
-    }
-    if (!pool) {
-      const pools = runtime.pools ?? [];
-      pool = pools.find(p => p.provider === provider || p.base === provider);
-    }
-
-    if (!pool) {
-      json(res, 404, { error: { code: 'not-found', message: `Provider '${provider}' not found in configured pools` } });
-      return;
-    }
-
-    try {
-      const result = simulateRouting({
-        pool,
-        runtime,
-        events: Array.isArray(body?.events) ? body.events : [],
-        model: body?.model || '',
-        maxAttempts: Number(body?.maxAttempts) || 0,
-      });
-      json(res, 200, { ok: true, simulation: result });
-    } catch (e) {
-      json(res, 500, { error: { code: 'sim-error', message: String(e?.message ?? e) } });
-    }
-  },
-}), 'dsh-key-rotation: simulate route');
-
-ctx.effect(() => ctx.webServer.register({
-  kind: 'exact',
-  path: DIAG_PATH,
-  handler: async (req, res) => {
-    if (req.method !== 'GET' && req.method !== 'POST') {
-      json(res, 405, { error: { code: 'method', message: 'GET or POST only' } });
-      return;
-    }
-    if (!isTrustedBridgeRequest(req)) {
-      json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: diag is local-only' } });
-      return;
-    }
-    if (req.method === 'POST') {
-      let body;
-      try { body = await readJson(req); } catch (e) {
-        json(res, 400, { error: { code: 'bad-request', message: String(e?.message ?? e) } });
-        return;
-      }
-      pushDiag({
-        level: typeof body?.level === 'string' ? body.level : 'info',
-        message: typeof body?.message === 'string' ? body.message.slice(0, 500) : 'unknown',
-        details: body?.details ?? null,
-      });
-      json(res, 200, { ok: true, count: diagBuffer.length });
-      return;
-    }
-    json(res, 200, { diag: deps.diagBuffer ? deps.diagBuffer.get() : getDiagBuffer() });
-  },
-}), 'dsh-key-rotation: diag route');
-
-}
+// lib/ops-telemetry.js — Re-export facade for lib/routes/ (#522).
+export * from "./routes/telemetry.js";

package/lib/ops-test.js

@@ -1,255 +1,2 @@
-// lib/ops-test.js — sandbox test + sandbox cache routes (#312 split from routes-ops.js).
-import {
-  json,
-  readJson,
-} from './http-bridge.js';
-import {
-  isTrustedBridgeRequest,
-  isValidRef,
-  keyTail,
-  envValue,
-} from './pool.js';
-import { bestEffort } from './best-effort.js';
-import {
-  TEST_PATH,
-  SANDBOX_CACHE_PATH,
-  TEST_MATRIX_PATH,
-} from './ops-paths.js';
-import { decryptSecret } from './crypto-storage.js';
-
-/**
- * @param {object} ctx cordis context
- * @param {object} deps live dependencies from apply()
- */
-export function registerTestRoutes(ctx, deps) {
-  const {
-    lastTestCache,
-    ensureSandboxRunner,
-    poolState,
-  } = deps;
-
-// ── test route: dry-run a single key without rotation ──
-ctx.effect(() => ctx.webServer.register({
-  kind: 'exact',
-  path: TEST_PATH,
-  handler: async (req, res) => {
-    if (req.method !== 'POST') { json(res, 405, { error: { code: 'method', message: 'POST only' } }); return; }
-    if (!isTrustedBridgeRequest(req)) { json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: test is local-only' } }); return; }
-    let body; try { body = await readJson(req); } catch (e) { json(res, 400, { error: { code: 'bad-request', message: String(e?.message ?? e) } }); return; }
-    const ref = typeof body?.ref === 'string' ? body.ref.trim() : '';
-    if (!isValidRef(ref)) { json(res, 400, { error: { code: 'bad-ref', message: 'dsh-key-rotation: ref must be an environment variable name' } }); return; }
-    // Optional value for pre-save validation (issue #118)
-    const testValue = typeof body?.value === 'string' && body.value.length > 0 ? body.value : undefined;
-    const probe = body?.probe === 'models' || body?.probe === 'chat' ? body.probe : undefined;
-    const base = ctx.get('credentials');
-    try {
-      let hit = await (base?.__dshKeyRotationOriginalResolve ?? base?.resolve)?.call(base, ref);
-      let present = Boolean(hit && typeof hit.value === 'string' && hit.value.length > 0);
-      const rawValue = testValue || hit?.value;
-      if (typeof rawValue === 'string' && rawValue.startsWith('enc:v1:')) {
-        const decrypted = decryptSecret(rawValue);
-        if (!decrypted || decrypted === rawValue || decrypted.startsWith('enc:v1:')) {
-          json(res, 200, { ok: false, ref, code: 'decryption-failed', message: 'dsh-key-rotation: failed to decrypt credential (missing or invalid DSH_KEY_SECRET)' });
-          return;
-        }
-      }
-      const effectiveValue = rawValue ? decryptSecret(rawValue) : rawValue;
-      const valid = present ? Boolean(effectiveValue && typeof effectiveValue === 'string' && effectiveValue.length > 0) : Boolean(testValue);
-      const tail = valid ? keyTail(effectiveValue) : '';
-      let source = null;
-      await bestEffort('credentials.describe', async () => { const d = await base?.describe?.(ref); source = d?.source ?? null; }, ctx.logger);
-      if (!present && !testValue) { json(res, 200, { ok: false, ref, code: 'no-credential', message: 'no such credential' }); return; }
-      if (!present && testValue) { source = 'pre-save'; }
-      else if (!present) {
-        const ev = envValue(ref);
-        if (ev !== undefined) { present = true; json(res, 200, { ok: true, ref, tail: keyTail(ev), source: 'env' }); return; }
-      }
-      // sandbox probe (models is free; chat is hook-only, see sandbox.js)
-      if (probe) {
-        const keyForProbe = effectiveValue;
-        const runner = ensureSandboxRunner(ctx);
-        const result = probe === 'chat' ? await runner.probeChat(ref, keyForProbe) : await runner.probeModels(ref, keyForProbe);
-        const cached = { ...result, at: Date.now() };
-        lastTestCache.set(ref, cached);
-        if (cached.ok) {
-          for (const st of poolState.values()) {
-            st.failedUntil?.delete(ref);
-            st.failCounts?.delete(ref);
-            st.authFailCounts?.delete(ref);
-            st.brokenUntil?.delete(ref);
-            st.revokedRefs?.delete(ref);
-            if (st.pausedRefs instanceof Set) st.pausedRefs.delete(ref);
-            else if (Array.isArray(st.pausedRefs)) {
-              const pIdx = st.pausedRefs.indexOf(ref);
-              if (pIdx >= 0) st.pausedRefs.splice(pIdx, 1);
-            }
-            st.pauseReasons?.delete(ref);
-            if (Array.isArray(cached.models) && cached.models.length > 0) {
-              if (!st.modelCapabilities) st.modelCapabilities = new Map();
-              st.modelCapabilities.set(ref, new Set(cached.models));
-            }
-          }
-        }
-        json(res, 200, { ok: cached.ok, ref, tail, source, probe, code: cached.code, latencyMs: cached.latencyMs, modelsCount: cached.modelsCount, models: cached.models ?? [] });
-        return;
-      }
-      json(res, 200, { ok: true, ref, tail, source });
-    } catch (e) {
-      json(res, 200, { ok: false, ref, code: 'error', message: String(e?.message ?? e) });
-    }
-  },
-}), 'dsh-key-rotation: test route');
-
-// Intercept the llm/stream waterfall: rotate any request whose provider maps
-// to a configured key pool; pass everything else (and internal dispatches)
-// straight through.
-// Read-only cache snapshot for clients (badge polling).
-
-ctx.effect(() => ctx.webServer.register({
-  kind: 'exact',
-  path: SANDBOX_CACHE_PATH,
-  handler: (req, res) => {
-    if (req.method !== 'GET') { json(res, 405, { error: { code: 'method', message: 'GET only' } }); return; }
-    if (!isTrustedBridgeRequest(req)) { json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: cache is local-only' } }); return; }
-    const cacheSnap = typeof lastTestCache?.snapshot === 'function'
-      ? lastTestCache.snapshot()
-      : (lastTestCache instanceof Map ? Object.fromEntries(lastTestCache) : (lastTestCache ?? {}));
-    json(res, 200, cacheSnap);
-  },
-}), 'dsh-key-rotation: sandbox cache');
-
-
-
-// #199 webhook-action: interactive webhook buttons call back here.
-// Auth: bearer token from Config (external services like Telegram/Discord
-// cannot be same-origin, so a shared secret is the gate).
-
-// ── test matrix route: batch probe all configured keys (#490) ──
-ctx.effect(() => ctx.webServer.register({
-  kind: 'exact',
-  path: TEST_MATRIX_PATH,
-  handler: async (req, res) => {
-    if (req.method !== 'GET' && req.method !== 'POST') {
-      json(res, 405, { error: { code: 'method', message: 'GET or POST only' } });
-      return;
-    }
-    if (!isTrustedBridgeRequest(req)) {
-      json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: test-matrix is local-only' } });
-      return;
-    }
-    const base = ctx.get('credentials');
-    const runner = ensureSandboxRunner(ctx);
-    const runtime = deps.buildRuntime?.() ?? {};
-    const pools = runtime.pools || [];
-
-    const keyItems = [];
-    const seen = new Set();
-    for (const p of pools) {
-      const pName = p.provider ?? p.base ?? 'unknown';
-      for (const ref of (p.refs || [])) {
-        const id = `${pName}:${ref}`;
-        if (!seen.has(id)) {
-          seen.add(id);
-          keyItems.push({ provider: pName, ref });
-        }
-      }
-    }
-
-    const CONCURRENCY = 5;
-    const results = [];
-    let idx = 0;
-
-    async function worker() {
-      while (idx < keyItems.length) {
-        const item = keyItems[idx++];
-        if (!item) break;
-        const { provider, ref } = item;
-        try {
-          let hit = await (base?.__dshKeyRotationOriginalResolve ?? base?.resolve)?.call(base, ref);
-          let rawValue = hit?.value;
-          if (!rawValue) {
-            const ev = envValue(ref);
-            if (ev !== undefined) rawValue = ev;
-          }
-          if (typeof rawValue === 'string' && rawValue.startsWith('enc:v1:')) {
-            const dec = decryptSecret(rawValue);
-            if (!dec || dec === rawValue || dec.startsWith('enc:v1:')) {
-              results.push({ provider, ref, keyTail: '', ok: false, code: 'decryption-failed', message: 'failed to decrypt credential', latencyMs: 0 });
-              continue;
-            }
-            rawValue = dec;
-          }
-          let effectiveValue = rawValue;
-          const tail = effectiveValue ? keyTail(effectiveValue) : '';
-          if (!effectiveValue) {
-            results.push({ provider, ref, keyTail: tail, ok: false, code: 'no-credential', latencyMs: 0 });
-            continue;
-          }
-          const probeRes = await runner.probeModels(ref, effectiveValue);
-          const cached = { ...probeRes, at: Date.now() };
-          lastTestCache.set(ref, cached);
-          if (cached.ok) {
-            for (const st of poolState.values()) {
-              st.failedUntil?.delete(ref);
-              st.failCounts?.delete(ref);
-              st.authFailCounts?.delete(ref);
-              st.brokenUntil?.delete(ref);
-              st.revokedRefs?.delete(ref);
-              if (st.pausedRefs instanceof Set) st.pausedRefs.delete(ref);
-              else if (Array.isArray(st.pausedRefs)) {
-                const pIdx = st.pausedRefs.indexOf(ref);
-                if (pIdx >= 0) st.pausedRefs.splice(pIdx, 1);
-              }
-              st.pauseReasons?.delete(ref);
-              if (Array.isArray(cached.models) && cached.models.length > 0) {
-                if (!st.modelCapabilities) st.modelCapabilities = new Map();
-                st.modelCapabilities.set(ref, new Set(cached.models));
-              }
-            }
-          }
-          results.push({
-            provider,
-            ref,
-            keyTail: tail,
-            ok: cached.ok,
-            code: cached.code,
-            latencyMs: cached.latencyMs,
-            modelsCount: cached.modelsCount,
-            models: cached.models ?? [],
-          });
-        } catch (err) {
-          results.push({
-            provider,
-            ref,
-            keyTail: '',
-            ok: false,
-            code: 'error',
-            error: String(err?.message ?? err),
-            latencyMs: 0,
-          });
-        }
-      }
-    }
-
-    const workers = [];
-    for (let i = 0; i < Math.min(CONCURRENCY, keyItems.length); i++) {
-      workers.push(worker());
-    }
-    await Promise.all(workers);
-
-    const total = results.length;
-    const healthy = results.filter((r) => r.ok).length;
-    const failed = total - healthy;
-
-    json(res, 200, {
-      ok: true,
-      at: Date.now(),
-      total,
-      healthy,
-      failed,
-      results,
-    });
-  },
-}), 'dsh-key-rotation: test matrix route');
-
-}
+// lib/ops-test.js — Re-export facade for lib/routes/ (#522).
+export * from "./routes/testing.js";