@hivemagnus/magnus-server 0.0.0-stage → 1.0.2

package/dist/routes/security-integration.js

@@ -0,0 +1,71 @@
+import { SENTINEL_NODE_IDS } from '../utils/sentinel-nodes.js';
+import { securityInventoryTargetSchema } from '@hivemagnus/magnus-contracts';
+import { createHash } from 'node:crypto';
+import { Hono } from 'hono';
+import { getDb } from '../db/index.js';
+import { safeEqual, authMiddleware, requirePermission } from '../middleware/auth.js';
+import { getNodeBaseUrl } from '../utils/node-url.js';
+export const securityIntegrationRouter = new Hono();
+securityIntegrationRouter.get('/inventory', async (c) => {
+    const token = c.req.header('Authorization')?.replace(/^Bearer /, '') ?? '';
+    const expected = process.env['SECURITY_INVENTORY_TOKEN_SHA256'];
+    if (!expected || !token || !safeEqual(createHash('sha256').update(token).digest('hex'), expected))
+        return c.json({ error: 'Unauthorized' }, 401);
+    const nodes = await getDb().node.findMany({
+        where: { id: { notIn: SENTINEL_NODE_IDS }, agent: { isNot: null } },
+        select: {
+            id: true,
+            name: true,
+            hostname: true,
+            ipAddress: true,
+            port: true,
+            tags: true,
+            metadata: true,
+        },
+    });
+    return c.json({
+        success: true,
+        data: nodes.map((n) => {
+            let metadata = {};
+            try {
+                metadata = JSON.parse(n.metadata);
+            }
+            catch { }
+            return securityInventoryTargetSchema.parse({
+                id: n.id,
+                name: n.name,
+                hostname: n.hostname,
+                baseUrl: getNodeBaseUrl(n.ipAddress, n.port),
+                tags: n.tags,
+                metadata: JSON.stringify(Object.fromEntries([
+                    'securityIsolationPolicy',
+                    'securityIsolationCapable',
+                    'securityAegisChannelVerified',
+                ].map((k) => [k, metadata[k]]))),
+            });
+        }),
+    });
+});
+securityIntegrationRouter.get('/summary', authMiddleware, requirePermission('security-fusion:read'), async (c) => {
+    try {
+        const url = process.env['SECURITY_FUSION_API_URL'];
+        if (!url || new URL(url).protocol !== 'https:')
+            throw new Error('not configured');
+        const res = await fetch(`${url}/api/v1/security-fusion/summary`, {
+            headers: { Authorization: `Bearer ${process.env['SECURITY_SUMMARY_TOKEN']}` },
+            redirect: 'error',
+            signal: AbortSignal.timeout(5000),
+        });
+        if (!res.ok)
+            throw new Error('unavailable');
+        const body = await res.json();
+        return c.json(body);
+    }
+    catch {
+        return c.json({
+            success: false,
+            error: { code: 'SECURITY_UNAVAILABLE', message: 'The external security console is unavailable' },
+        }, 503);
+    }
+});
+//# sourceMappingURL=security-integration.js.map

package/dist/routes/self-update.js

@@ -0,0 +1,129 @@
+import { z } from 'zod';
+import { ApiLocalWorkError, apiLocalWorkStatus } from '../services/api-local-work.js';
+import { Hono } from 'hono';
+import { AGENT_VERSION, CONTROL_API_VERSION } from '../config/index.js';
+import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
+import { logAuditEvent } from '../services/audit-service.js';
+import { checkForUpdates, performSelfUpdate, scheduleRestart, getUpdateStatus, } from '../services/self-update-service.js';
+import { HttpError } from '../middleware/error-handler.js';
+export const selfUpdateRouter = new Hono();
+selfUpdateRouter.use('*', authMiddleware);
+selfUpdateRouter.use('*', async (c, next) => {
+    await next();
+    if (c.error instanceof ApiLocalWorkError) {
+        // An apply receipt already set on this response must survive a subsequent
+        // restart failure. Never trust an arbitrary exception's workId property.
+        c.header(c.res.headers.has('X-Magnus-Work-Id') ? 'X-Magnus-Restart-Work-Id' : 'X-Magnus-Work-Id', c.error.workId);
+    }
+});
+selfUpdateRouter.get('/work/:workId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
+    const id = z.string().guid().safeParse(c.req.param('workId'));
+    if (!id.success)
+        throw new HttpError(400, 'INVALID_WORK_ID', 'A durable work UUID is required');
+    c.header('Cache-Control', 'no-store');
+    return c.json({ success: true, data: await apiLocalWorkStatus(id.data) });
+});
+/**
+ * GET /self-update/status
+ * Return current Control Node version, git info, and update status.
+ */
+selfUpdateRouter.get('/status', async (c) => {
+    const status = await getUpdateStatus();
+    return c.json({ success: true, data: status });
+});
+/**
+ * GET /self-update/version
+ * Lightweight version check — returns just the versions.
+ */
+selfUpdateRouter.get('/version', async (c) => {
+    return c.json({
+        success: true,
+        data: {
+            controlApiVersion: CONTROL_API_VERSION,
+            agentVersion: AGENT_VERSION,
+        },
+    });
+});
+/**
+ * POST /self-update/check
+ * Check if updates are available (git fetch + compare).
+ */
+selfUpdateRouter.post('/check', requireRole('ADMIN', 'OPERATOR'), async (c) => {
+    try {
+        const result = await checkForUpdates();
+        return c.json({ success: true, data: result });
+    }
+    catch (err) {
+        if (err instanceof HttpError)
+            throw err;
+        const message = err instanceof Error ? err.message : String(err);
+        throw new HttpError(500, 'UPDATE_CHECK_FAILED', `Failed to check for updates: ${message}`);
+    }
+});
+/**
+ * POST /self-update/apply
+ * Pull latest code, rebuild, and optionally restart.
+ * Body: { restart?: boolean }
+ */
+selfUpdateRouter.post('/apply', requireRole('ADMIN'), async (c) => {
+    const user = getUser(c);
+    const body = await c.req.json().catch(() => ({ restart: false }));
+    await logAuditEvent({
+        action: 'control_node.update',
+        actorId: user.userId,
+        targetType: 'control_node',
+        targetId: 'self',
+        details: { restart: body.restart ?? false },
+    });
+    const result = await performSelfUpdate();
+    if (result.workId)
+        c.header('X-Magnus-Work-Id', result.workId);
+    if (!result.success) {
+        throw new HttpError(500, 'UPDATE_FAILED', result.error ?? 'Self-update failed');
+    }
+    let restartInfo = null;
+    if (body.restart && result.updated) {
+        await logAuditEvent({
+            action: 'control_node.restart',
+            actorId: user.userId,
+            targetType: 'control_node',
+            targetId: 'self',
+            details: {
+                previousVersion: result.previousVersion,
+                currentVersion: result.currentVersion,
+            },
+        });
+        restartInfo = await scheduleRestart();
+    }
+    return c.json({
+        success: true,
+        data: {
+            ...result,
+            restart: restartInfo,
+        },
+    });
+});
+/**
+ * POST /self-update/restart
+ * Just restart the Control Node process (no code update).
+ */
+selfUpdateRouter.post('/restart', requireRole('ADMIN'), async (c) => {
+    const user = getUser(c);
+    await logAuditEvent({
+        action: 'control_node.restart',
+        actorId: user.userId,
+        targetType: 'control_node',
+        targetId: 'self',
+        details: {},
+    });
+    const restartInfo = await scheduleRestart();
+    c.header('X-Magnus-Work-Id', restartInfo.workId);
+    return c.json({
+        success: true,
+        data: {
+            message: 'Restart requested. The durable work receipt records admission and any unresolved completion.',
+            ...restartInfo,
+        },
+    });
+});
+//# sourceMappingURL=self-update.js.map

package/dist/routes/shared-resource-leases.js

@@ -0,0 +1,78 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
+import { sharedResourceLeaseIdentitySchema, sharedResourceOperationIdSchema, sharedResourceReconciliationSchema, sharedResourceReserveSchema, sharedResourceTerminalEvidenceSchema, } from '../schemas/shared-resource-lease.js';
+import { logAuditEvent } from '../services/audit-service.js';
+import { inspectSharedResourceLease, recoverSharedResourceLease, reconcileSharedResourceLease, reserveSharedResources, retainUnknownSharedResourceLease, settleSharedResourceLease, startSharedResourceLease, } from '../services/shared-resource-leases.js';
+import { parseBody } from '../utils/validate.js';
+const leaseIdSchema = z.string().regex(/^[A-Za-z0-9_-]{16,64}$/);
+function leaseId(value) { return leaseIdSchema.parse(value); }
+export const sharedResourceLeasesRouter = new Hono();
+sharedResourceLeasesRouter.use('*', async (c, next) => {
+    c.header('Cache-Control', 'no-store');
+    await next();
+});
+sharedResourceLeasesRouter.use('*', authMiddleware);
+sharedResourceLeasesRouter.post('/reserve', requireRole('ADMIN', 'OPERATOR'), async (c) => {
+    const input = await parseBody(c, sharedResourceReserveSchema);
+    const actor = getUser(c).userId;
+    const data = await reserveSharedResources(input, actor);
+    await logAuditEvent({ action: 'resource.shared.reserve', actorId: actor,
+        targetType: 'shared-resource-lease', targetId: data.leaseId,
+        details: { operationId: data.operationId, resourceKeys: data.resources.map(resource => resource.resourceKey),
+            missionRootId: data.missionRootId, missionRevision: data.missionRevision, taskId: data.taskId,
+            actionClass: data.actionClass, callerKind: data.caller.kind, state: data.state } });
+    return c.json({ success: true, data }, 201);
+});
+sharedResourceLeasesRouter.get('/operation/:operationId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
+    const user = getUser(c);
+    const operationId = sharedResourceOperationIdSchema.parse(c.req.param('operationId'));
+    return c.json({ success: true,
+        data: await recoverSharedResourceLease(operationId, user.userId, user.role === 'ADMIN') });
+});
+sharedResourceLeasesRouter.get('/:leaseId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
+    const user = getUser(c);
+    return c.json({ success: true, data: await inspectSharedResourceLease(leaseId(c.req.param('leaseId')), user.userId, user.role === 'ADMIN') });
+});
+sharedResourceLeasesRouter.post('/:leaseId/start', requireRole('ADMIN', 'OPERATOR'), async (c) => {
+    const id = leaseId(c.req.param('leaseId'));
+    const actor = getUser(c).userId;
+    const data = await startSharedResourceLease(id, await parseBody(c, sharedResourceLeaseIdentitySchema), actor);
+    await logAuditEvent({ action: 'resource.shared.start', actorId: getUser(c).userId,
+        targetType: 'shared-resource-lease', targetId: id,
+        details: { operationId: data.operationId, resourceKeys: data.resources.map(resource => resource.resourceKey), state: data.state } });
+    return c.json({ success: true, data });
+});
+sharedResourceLeasesRouter.post('/:leaseId/unknown', requireRole('ADMIN', 'OPERATOR'), async (c) => {
+    const id = leaseId(c.req.param('leaseId'));
+    const actor = getUser(c).userId;
+    const data = await retainUnknownSharedResourceLease(id, await parseBody(c, sharedResourceLeaseIdentitySchema), actor);
+    await logAuditEvent({ action: 'resource.shared.unknown', actorId: getUser(c).userId,
+        targetType: 'shared-resource-lease', targetId: id,
+        details: { operationId: data.operationId, resourceKeys: data.resources.map(resource => resource.resourceKey), state: data.state } });
+    return c.json({ success: true, data });
+});
+sharedResourceLeasesRouter.post('/:leaseId/settle', requireRole('ADMIN', 'OPERATOR'), async (c) => {
+    const id = leaseId(c.req.param('leaseId'));
+    const input = await parseBody(c, sharedResourceTerminalEvidenceSchema);
+    const actor = getUser(c).userId;
+    const data = await settleSharedResourceLease(id, input, actor);
+    await logAuditEvent({ action: 'resource.shared.settle', actorId: getUser(c).userId,
+        targetType: 'shared-resource-lease', targetId: id,
+        details: { operationId: data.operationId, resourceKeys: data.resources.map(resource => resource.resourceKey),
+            state: data.state, settlement: data.settlement, evidenceSha256: data.evidenceSha256,
+            issuer: input.issuer, keyId: input.keyId } });
+    return c.json({ success: true, data });
+});
+sharedResourceLeasesRouter.post('/:leaseId/reconcile', requireRole('ADMIN'), async (c) => {
+    const id = leaseId(c.req.param('leaseId'));
+    const input = await parseBody(c, sharedResourceReconciliationSchema);
+    const data = await reconcileSharedResourceLease(id, input);
+    await logAuditEvent({ action: 'resource.shared.reconcile', actorId: getUser(c).userId,
+        targetType: 'shared-resource-lease', targetId: id,
+        details: { operationId: data.operationId, resourceKeys: data.resources.map(resource => resource.resourceKey),
+            state: data.state, settlement: data.settlement, evidenceSha256: data.evidenceSha256,
+            decisionId: input.decisionId, approvalRef: input.approvalRef } });
+    return c.json({ success: true, data });
+});
+//# sourceMappingURL=shared-resource-leases.js.map