@hotmeshio/long-tail 0.1.0

package/build/routes/oauth.js

@@ -0,0 +1,217 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setOAuthConfig = setOAuthConfig;
+const express_1 = require("express");
+const auth_1 = require("../modules/auth");
+const logger_1 = require("../services/logger");
+const oauth_1 = require("../services/oauth");
+const user_1 = require("../services/user");
+const router = (0, express_1.Router)();
+// ── OAuth startup config (set by initializeOAuth) ────────────────────────────
+let _oauthConfig = {
+    autoProvision: true,
+    defaultRoleType: 'member',
+    baseUrl: '',
+};
+function setOAuthConfig(cfg) {
+    if (cfg.autoProvision !== undefined)
+        _oauthConfig.autoProvision = cfg.autoProvision;
+    if (cfg.defaultRoleType)
+        _oauthConfig.defaultRoleType = cfg.defaultRoleType;
+    if (cfg.baseUrl)
+        _oauthConfig.baseUrl = cfg.baseUrl;
+}
+/**
+ * GET /api/auth/oauth/providers
+ * List configured OAuth providers (for login page buttons).
+ */
+router.get('/providers', (_req, res) => {
+    res.json((0, oauth_1.listProviders)());
+});
+/**
+ * GET /api/auth/oauth/connections
+ * List all OAuth connections for the authenticated user.
+ * Must be registered BEFORE /:provider to avoid catch-all match.
+ */
+router.get('/connections', auth_1.requireAuth, async (req, res) => {
+    const userId = req.auth?.userId;
+    if (!userId) {
+        res.status(401).json({ error: 'Unauthorized' });
+        return;
+    }
+    try {
+        const connections = await (0, oauth_1.listOAuthConnections)(userId);
+        res.json({ connections });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * GET /api/auth/oauth/:provider
+ * Initiate the OAuth flow — redirects the browser to the provider.
+ */
+router.get('/:provider', (req, res) => {
+    const { provider } = req.params;
+    const handler = (0, oauth_1.getProvider)(provider);
+    if (!handler) {
+        res.status(404).json({ error: `OAuth provider "${provider}" not configured` });
+        return;
+    }
+    const returnTo = req.query.returnTo || '/';
+    const { state, codeVerifier } = (0, oauth_1.createOAuthState)(provider, returnTo);
+    // Compute redirect URI dynamically if not set in provider config
+    const baseUrl = _oauthConfig.baseUrl || `${req.protocol}://${req.get('host')}`;
+    if (!handler.config.redirectUri) {
+        handler.config.redirectUri = `${baseUrl}/api/auth/oauth/${provider}/callback`;
+    }
+    const url = handler.createAuthorizationURL(state, codeVerifier);
+    res.redirect(url.toString());
+});
+/**
+ * GET /api/auth/oauth/:provider/callback
+ * Handle the OAuth callback — exchange code, provision user, issue JWT.
+ */
+router.get('/:provider/callback', async (req, res) => {
+    const { provider } = req.params;
+    const { code, state } = req.query;
+    if (!code || !state) {
+        res.status(400).json({ error: 'Missing code or state parameter' });
+        return;
+    }
+    // Validate state (CSRF protection)
+    const oauthState = (0, oauth_1.consumeOAuthState)(state);
+    if (!oauthState || oauthState.provider !== provider) {
+        res.status(400).json({ error: 'Invalid or expired OAuth state' });
+        return;
+    }
+    const handler = (0, oauth_1.getProvider)(provider);
+    if (!handler) {
+        res.status(404).json({ error: `OAuth provider "${provider}" not configured` });
+        return;
+    }
+    try {
+        // Exchange authorization code for tokens
+        const tokens = await handler.validateAuthorizationCode(code, oauthState.codeVerifier);
+        // Fetch user info from the provider
+        const userInfo = await handler.fetchUserInfo(tokens.accessToken);
+        // ── Credential-only providers (e.g., Anthropic) ──────────────────────
+        // These providers store API keys for an already-authenticated user.
+        // They don't create users or issue JWTs — the user must be logged in.
+        if (oauthState.connectOnly) {
+            const userId = oauthState.userId;
+            if (!userId) {
+                res.status(401).json({ error: 'Authentication required to connect a credential provider' });
+                return;
+            }
+            const label = oauthState.label || 'default';
+            await (0, oauth_1.upsertOAuthToken)(userId, provider, tokens, handler.config.scopes, userInfo.providerUserId, userInfo.email, { display_name: userInfo.displayName, ...userInfo.raw }, label);
+            logger_1.loggerRegistry.info(`[oauth] stored ${provider} credentials (label: ${label}) for user ${userId}`);
+            const returnTo = oauthState.returnTo || '/';
+            res.redirect(`${returnTo}${returnTo.includes('?') ? '&' : '?'}connected=${provider}&label=${encodeURIComponent(label)}`);
+            return;
+        }
+        // ── Identity providers (Google, GitHub, Microsoft, etc.) ─────────────
+        // Find or create the user
+        let user = await (0, oauth_1.getUserByOAuthProvider)(provider, userInfo.providerUserId);
+        if (!user && userInfo.email) {
+            // Try matching by email
+            user = await (0, user_1.getUserByEmail)(userInfo.email);
+        }
+        if (!user) {
+            if (!_oauthConfig.autoProvision) {
+                res.status(403).json({ error: 'No account found. Contact an administrator.' });
+                return;
+            }
+            // Auto-provision new user
+            user = await (0, user_1.createUser)({
+                external_id: `${provider}:${userInfo.providerUserId}`,
+                email: userInfo.email || undefined,
+                display_name: userInfo.displayName || undefined,
+                oauth_provider: provider,
+                oauth_provider_id: userInfo.providerUserId,
+                roles: [{ role: _oauthConfig.defaultRoleType, type: _oauthConfig.defaultRoleType }],
+            });
+            logger_1.loggerRegistry.info(`[oauth] auto-provisioned user ${user.id} from ${provider}`);
+        }
+        // Store the OAuth tokens (encrypted)
+        await (0, oauth_1.upsertOAuthToken)(user.id, provider, tokens, handler.config.scopes, userInfo.providerUserId, userInfo.email, { avatar: userInfo.raw?.picture || userInfo.raw?.avatar_url });
+        // Determine highest role type
+        const roles = user.roles || [];
+        const highestType = roles.some((r) => r.type === 'superadmin')
+            ? 'superadmin'
+            : roles.some((r) => r.type === 'admin')
+                ? 'admin'
+                : 'member';
+        // Issue JWT (same as password login)
+        const jwt = (0, auth_1.signToken)({
+            userId: user.id,
+            role: highestType,
+            roles: roles.map((r) => ({ role: r.role, type: r.type })),
+        }, '24h');
+        // Redirect to login page with token + user info — plays the comet animation, then navigates
+        const returnTo = oauthState.returnTo || '/';
+        const displayName = user.display_name || userInfo.displayName || '';
+        const userName = user.external_id || '';
+        res.redirect(`/login?token=${encodeURIComponent(jwt)}` +
+            `&returnTo=${encodeURIComponent(returnTo)}` +
+            `&displayName=${encodeURIComponent(displayName)}` +
+            `&username=${encodeURIComponent(userName)}`);
+    }
+    catch (err) {
+        logger_1.loggerRegistry.error(`[oauth] callback error for ${provider}: ${err.message}`);
+        res.redirect(`/login?error=${encodeURIComponent('OAuth login failed. Please try again.')}`);
+    }
+});
+/**
+ * GET /api/auth/oauth/connect/:provider
+ * Initiate a credential-only connection flow for an already-authenticated user.
+ * Unlike the login flow (GET /:provider), this stores the provider's token
+ * against the current user without issuing a new JWT or creating a user.
+ * Used for resource providers like Anthropic (API key storage).
+ */
+// Bridge for browser redirects: accept token from query param since browsers
+// can't set Authorization headers during navigation.
+router.get('/connect/:provider', (req, res, next) => {
+    const token = req.query.token;
+    if (token && !req.headers.authorization) {
+        req.headers.authorization = `Bearer ${token}`;
+    }
+    next();
+}, auth_1.requireAuth, (req, res) => {
+    const userId = req.auth.userId;
+    const provider = req.params.provider;
+    const handler = (0, oauth_1.getProvider)(provider);
+    if (!handler) {
+        res.status(404).json({ error: `OAuth provider "${provider}" not configured` });
+        return;
+    }
+    const returnTo = req.query.returnTo || '/';
+    const label = req.query.label || 'default';
+    const { state, codeVerifier } = (0, oauth_1.createOAuthState)(provider, returnTo, {
+        connectOnly: true,
+        userId,
+        label,
+    });
+    const baseUrl = _oauthConfig.baseUrl || `${req.protocol}://${req.get('host')}`;
+    if (!handler.config.redirectUri) {
+        handler.config.redirectUri = `${baseUrl}/api/auth/oauth/${provider}/callback`;
+    }
+    const url = handler.createAuthorizationURL(state, codeVerifier);
+    res.redirect(url.toString());
+});
+/**
+ * DELETE /api/auth/oauth/connections/:provider
+ * Revoke a stored OAuth connection (requires auth — applied by parent router).
+ */
+router.delete('/connections/:provider', async (req, res) => {
+    const userId = req.auth?.userId;
+    if (!userId) {
+        res.status(401).json({ error: 'Unauthorized' });
+        return;
+    }
+    const label = req.query.label || undefined;
+    const deleted = await (0, oauth_1.deleteOAuthConnection)(userId, req.params.provider, label);
+    res.json({ deleted });
+});
+exports.default = router;

package/build/routes/resolve.d.ts

@@ -0,0 +1,9 @@
+import type { Request, Response } from 'express';
+import type { ResolvedHandle } from '../services/task';
+/**
+ * Resolve the (taskQueue, workflowName) pair for a workflowId.
+ *
+ * Looks up the task record in lt_tasks — the workflowId is enough.
+ * Sends a 404 response and returns null if the workflow can't be found.
+ */
+export declare function resolveHandle(req: Request, res: Response): Promise<ResolvedHandle | null>;

package/build/routes/resolve.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveHandle = resolveHandle;
+const task_1 = require("../services/task");
+/**
+ * Resolve the (taskQueue, workflowName) pair for a workflowId.
+ *
+ * Looks up the task record in lt_tasks — the workflowId is enough.
+ * Sends a 404 response and returns null if the workflow can't be found.
+ */
+async function resolveHandle(req, res) {
+    try {
+        return await (0, task_1.resolveWorkflowHandle)(req.params.workflowId);
+    }
+    catch (err) {
+        res.status(404).json({ error: err.message });
+        return null;
+    }
+}

package/build/routes/roles.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/roles.js

@@ -0,0 +1,195 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const auth_1 = require("../modules/auth");
+const roleService = __importStar(require("../services/role"));
+const router = (0, express_1.Router)();
+/**
+ * GET /api/roles
+ * List all distinct roles known to the system.
+ */
+router.get('/', async (_req, res) => {
+    try {
+        const roles = await roleService.listDistinctRoles();
+        res.json({ roles });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * GET /api/roles/details
+ * List all roles with usage counts.
+ */
+router.get('/details', async (_req, res) => {
+    try {
+        const roles = await roleService.listRolesWithDetails();
+        res.json({ roles });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * POST /api/roles
+ * Create a standalone role. Requires admin.
+ * Body: { role: string }
+ */
+router.post('/', auth_1.requireAdmin, async (req, res) => {
+    try {
+        const { role } = req.body || {};
+        if (!role || typeof role !== 'string' || !role.trim()) {
+            res.status(400).json({ error: 'role is required' });
+            return;
+        }
+        const trimmed = role.trim().toLowerCase();
+        if (!/^[a-z][a-z0-9_-]*$/.test(trimmed)) {
+            res.status(400).json({ error: 'Role must start with a letter and contain only lowercase letters, numbers, hyphens, and underscores' });
+            return;
+        }
+        await roleService.createRole(trimmed);
+        res.status(201).json({ role: trimmed });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * GET /api/roles/escalation-chains
+ * Get all escalation chain pairs.
+ */
+router.get('/escalation-chains', async (_req, res) => {
+    try {
+        const chains = await roleService.getAllEscalationChains();
+        res.json({ chains });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * POST /api/roles/escalation-chains
+ * Add a single escalation chain entry. Requires admin.
+ * Body: { source_role: string, target_role: string }
+ */
+router.post('/escalation-chains', auth_1.requireAdmin, async (req, res) => {
+    try {
+        const { source_role, target_role } = req.body || {};
+        if (!source_role || !target_role) {
+            res.status(400).json({ error: 'source_role and target_role are required' });
+            return;
+        }
+        await roleService.addEscalationChain(source_role, target_role);
+        res.status(201).json({ source_role, target_role });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * DELETE /api/roles/escalation-chains
+ * Remove a single escalation chain entry. Requires admin.
+ * Body: { source_role: string, target_role: string }
+ */
+router.delete('/escalation-chains', auth_1.requireAdmin, async (req, res) => {
+    try {
+        const { source_role, target_role } = req.body || {};
+        if (!source_role || !target_role) {
+            res.status(400).json({ error: 'source_role and target_role are required' });
+            return;
+        }
+        const removed = await roleService.removeEscalationChain(source_role, target_role);
+        if (!removed) {
+            res.status(404).json({ error: 'Chain entry not found' });
+            return;
+        }
+        res.json({ removed: true });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// ── Parameterized routes (must come AFTER named routes) ───────────────────
+/**
+ * GET /api/roles/:role/escalation-targets
+ * Get allowed escalation targets for a specific role.
+ */
+router.get('/:role/escalation-targets', async (req, res) => {
+    try {
+        const targets = await roleService.getEscalationTargets(req.params.role);
+        res.json({ targets });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * PUT /api/roles/:role/escalation-targets
+ * Replace escalation targets for a role. Requires admin.
+ * Body: { targets: string[] }
+ */
+router.put('/:role/escalation-targets', auth_1.requireAdmin, async (req, res) => {
+    try {
+        const { targets } = req.body || {};
+        if (!Array.isArray(targets)) {
+            res.status(400).json({ error: 'targets must be an array of strings' });
+            return;
+        }
+        await roleService.replaceEscalationTargets(req.params.role, targets);
+        res.json({ role: req.params.role, targets });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * DELETE /api/roles/:role
+ * Delete a role if it has no references. Requires admin.
+ */
+router.delete('/:role', auth_1.requireAdmin, async (req, res) => {
+    try {
+        const result = await roleService.deleteRole(req.params.role);
+        if (!result.deleted) {
+            res.status(409).json({ error: result.error || 'Cannot delete role' });
+            return;
+        }
+        res.json({ deleted: true });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+exports.default = router;

package/build/routes/settings.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/settings.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const telemetry_1 = require("../services/telemetry");
+const events_1 = require("../services/events");
+const nats_1 = require("../services/events/nats");
+const socketio_1 = require("../services/events/socketio");
+const defaults_1 = require("../modules/defaults");
+const router = (0, express_1.Router)();
+/**
+ * GET /api/settings
+ * Returns frontend-relevant configuration (no secrets).
+ */
+router.get('/', (_req, res) => {
+    const hasSocketIO = !!events_1.eventRegistry.getAdapter(socketio_1.SocketIOEventAdapter);
+    const hasNats = !!events_1.eventRegistry.getAdapter(nats_1.NatsEventAdapter);
+    // Prefer socket.io (same-origin, no extra infrastructure)
+    // Fall back to NATS when socket.io is unavailable
+    const transport = hasSocketIO ? 'socketio' : hasNats ? 'nats' : 'none';
+    res.json({
+        telemetry: {
+            traceUrl: telemetry_1.telemetryRegistry.traceUrl ?? null,
+        },
+        escalation: {
+            claimDurations: defaults_1.CLAIM_DURATION_OPTIONS,
+        },
+        events: {
+            transport,
+            natsWsUrl: hasNats
+                ? (process.env.VITE_NATS_WS_URL || process.env.NATS_WS_URL || null)
+                : null,
+        },
+    });
+});
+exports.default = router;

package/build/routes/tasks.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/tasks.js

@@ -0,0 +1,133 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const taskService = __importStar(require("../services/task"));
+const escalationService = __importStar(require("../services/escalation"));
+const router = (0, express_1.Router)();
+/**
+ * GET /api/tasks
+ * List tasks with optional filters.
+ * Query: ?status=completed&workflow_type=reviewContent&workflow_id=abc&lt_type=...&origin_id=...&limit=50&offset=0
+ */
+router.get('/', async (req, res) => {
+    try {
+        const result = await taskService.listTasks({
+            status: req.query.status,
+            lt_type: req.query.lt_type,
+            workflow_type: req.query.workflow_type,
+            workflow_id: req.query.workflow_id,
+            parent_workflow_id: req.query.parent_workflow_id,
+            origin_id: req.query.origin_id,
+            limit: req.query.limit ? parseInt(req.query.limit, 10) : undefined,
+            offset: req.query.offset ? parseInt(req.query.offset, 10) : undefined,
+        });
+        res.json(result);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * GET /api/tasks/processes/stats
+ * Aggregated process statistics with optional time period.
+ */
+router.get('/processes/stats', async (req, res) => {
+    try {
+        const period = req.query.period || undefined;
+        const stats = await taskService.getProcessStats(period);
+        res.json(stats);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * GET /api/tasks/processes
+ * List distinct origin_id values with summary stats.
+ */
+router.get('/processes', async (req, res) => {
+    try {
+        const result = await taskService.listProcesses({
+            limit: req.query.limit ? parseInt(req.query.limit, 10) : undefined,
+            offset: req.query.offset ? parseInt(req.query.offset, 10) : undefined,
+            workflow_type: req.query.workflow_type || undefined,
+            status: req.query.status || undefined,
+            search: req.query.search || undefined,
+        });
+        res.json(result);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * GET /api/tasks/processes/:originId
+ * Get all tasks and escalations for a process (origin_id).
+ */
+router.get('/processes/:originId', async (req, res) => {
+    try {
+        const [tasks, escalations] = await Promise.all([
+            taskService.getProcessTasks(req.params.originId),
+            escalationService.getEscalationsByOriginId(req.params.originId),
+        ]);
+        res.json({
+            origin_id: req.params.originId,
+            tasks,
+            escalations,
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+/**
+ * GET /api/tasks/:id
+ * Get a single task by ID.
+ */
+router.get('/:id', async (req, res) => {
+    try {
+        const task = await taskService.getTask(req.params.id);
+        if (!task) {
+            res.status(404).json({ error: 'Task not found' });
+            return;
+        }
+        res.json(task);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+exports.default = router;

package/build/routes/users.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;