@inetafrica/open-claudia 3.5.19 → 3.5.23

package/web.js

@@ -375,6 +375,63 @@ async function liveChannels() {
 
 const USER_ACCESS_ROUTES = new Set(["/api/auth/approve", "/api/auth/deny", "/api/auth/remove"]);
 
+// Browser app routes (core/bot-apps.js, core/browser-control.js, core/browser-teach.js):
+//   POST /api/apps/check                                    may this person open the app (C1)
+//   POST /api/browser/control  GET /api/browser/control     take / renew / release, status (C2)
+//   POST /api/browser/input                                 the driver's input events (C3)
+//   POST /api/browser/teach                                 Teach me: start / stop / cancel (C4)
+//   GET  /api/browser/teach[/<id>[/pictures/<n>]]?userId=   that person's recordings only
+const BROWSER_APP_ROUTE = /^\/api\/(?:apps\/check|browser\/(?:control|input|teach))(?:[/?]|$)/;
+const BROWSER_APP_MAX_BODY = 64 * 1024;
+const BROWSER_APP_USER_ID = /^[A-Za-z0-9._:-]{1,100}$/;
+
+async function handleBrowserApp(req, res, body) {
+  const send = (status, obj) => {
+    res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+    return res.end(JSON.stringify(obj));
+  };
+  const answer = (result) => send(result.status, result.body);
+  const parsedUrl = new URL(req.url, "http://localhost");
+  const route = parsedUrl.pathname;
+  let parsed = {};
+  if (req.method === "POST") {
+    if (Buffer.byteLength(body || "") > BROWSER_APP_MAX_BODY) return send(413, { error: "too-large" });
+    try { parsed = JSON.parse(body || "{}"); } catch (e) { return send(400, { error: "bad-json" }); }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return send(400, { error: "bad-json" });
+  }
+  const control = require("./core/browser-control");
+  if (route === "/api/apps/check" && req.method === "POST") return send(200, require("./core/bot-apps").checkAccess(parsed));
+  if (route === "/api/browser/control" && req.method === "POST") return answer(await control.control(parsed));
+  if (route === "/api/browser/control" && req.method === "GET") return answer(control.status());
+  if (route === "/api/browser/input" && req.method === "POST") return answer(await control.input(parsed));
+  if (route === "/api/browser/teach" && req.method === "POST") return answer(await control.teachAction(parsed));
+  if (req.method === "GET" && (route === "/api/browser/teach" || route.startsWith("/api/browser/teach/"))) {
+    const teach = require("./core/browser-teach");
+    const userId = parsedUrl.searchParams.get("userId") || "";
+    if (!BROWSER_APP_USER_ID.test(userId)) return send(400, { error: "userId required" });
+    if (route === "/api/browser/teach") return send(200, teach.listRecordings({ userId }));
+    const match = route.match(/^\/api\/browser\/teach\/([a-z0-9-]{1,64})(?:\/pictures\/(\d{1,4}))?$/);
+    if (!match) return send(404, { error: "not-found" });
+    if (!match[2]) {
+      const rec = teach.getRecording(match[1], { userId });
+      return rec ? send(200, rec) : send(404, { error: "not-found" });
+    }
+    const file = teach.picturePath(match[1], Number(match[2]), { userId });
+    if (!file) return send(404, { error: "not-found" });
+    let data;
+    // Deleted a moment ago (teach finish, cancel, the sweeper): gone, like any deleted picture.
+    try { data = fs.readFileSync(file); } catch (_) { return send(404, { error: "not-found" }); }
+    res.writeHead(200, {
+      "Content-Type": "image/jpeg",
+      "Content-Length": data.length,
+      "Cache-Control": "no-store",
+      "X-Content-Type-Options": "nosniff",
+    });
+    return res.end(data);
+  }
+  return send(404, { error: "Not found" });
+}
+
 async function handleAPI(req, res, body, dependencies = {}) {
   const url = req.url;
 
@@ -643,6 +700,17 @@ async function handleAPI(req, res, body, dependencies = {}) {
     return res.end(JSON.stringify({ content: loadLogs() }));
   }
 
+  // Browser app in Kazee Chat (bot apps v1): who may open it, Take over, input and Teach me.
+  // Machine-to-machine for Agent Space, so the control token only: a dashboard session is
+  // refused, like /api/otp/mint.
+  if (BROWSER_APP_ROUTE.test(url)) {
+    if (!checkBearerAuth(req)) {
+      res.writeHead(403, { "Content-Type": "application/json" });
+      return res.end(JSON.stringify({ error: "Control token required" }));
+    }
+    return handleBrowserApp(req, res, body);
+  }
+
   // Live view of the bot's own browser, watch-only (core/browser-view.js): the running
   // agent-browser sessions, and one session's screen as server-sent events.
   if (url.split("?")[0] === "/api/browser/sessions" && req.method === "GET") {