@juspay/shooter 1.18.0 → 1.20.0

package/src/routes/api/terminals/[id]/share/+server.ts

@@ -0,0 +1,98 @@
+// /api/terminals/[id]/share — owner management of a terminal's share.
+// GET: current state. PUT: create/update. DELETE: revoke.
+// All methods require the API key (owners only).
+
+import type { ShareConfigRequest, ShareInfoResponse, ShareMode } from '$lib/types';
+
+import { validateAuth } from '$lib/modules/server/auth';
+import { ptyManager } from '$lib/modules/server/terminal/pty-manager.js';
+import { hashPassword, shareStore } from '$lib/modules/server/terminal/share-store';
+import { closeGuests } from '$lib/modules/server/ws/guest-registry';
+import { json } from '@sveltejs/kit';
+
+import type { RequestHandler } from './$types';
+
+const MIN_PASSWORD_LENGTH = 6;
+const MODES: ShareMode[] = ['view', 'control'];
+
+function toInfo(terminalId: string): ShareInfoResponse {
+  const share = shareStore.getShare(terminalId);
+  if (!share) {
+    return { active: false, createdAt: null, mode: null, updatedAt: null };
+  }
+  return { active: true, createdAt: share.createdAt, mode: share.mode, updatedAt: share.updatedAt };
+}
+
+export const GET: RequestHandler = ({ params, request }) => {
+  const authError = validateAuth(request);
+  if (authError) {
+    return authError;
+  }
+  return json(toInfo(params.id));
+};
+
+export const PUT: RequestHandler = async ({ params, request }) => {
+  const authError = validateAuth(request);
+  if (authError) {
+    return authError;
+  }
+  if (!ptyManager.get(params.id)) {
+    return json({ error: 'Terminal not found' }, { status: 404 });
+  }
+
+  let body: ShareConfigRequest;
+  try {
+    body = (await request.json()) as ShareConfigRequest;
+  } catch {
+    return json({ error: 'Invalid JSON' }, { status: 400 });
+  }
+  if (!MODES.includes(body.mode)) {
+    return json({ error: "mode must be 'view' or 'control'" }, { status: 400 });
+  }
+
+  const existing = shareStore.getShare(params.id);
+  const password = typeof body.password === 'string' ? body.password : '';
+  if (!existing && password.length < MIN_PASSWORD_LENGTH) {
+    return json(
+      { error: `password is required (min ${String(MIN_PASSWORD_LENGTH)} chars)` },
+      { status: 400 }
+    );
+  }
+  if (password && password.length < MIN_PASSWORD_LENGTH) {
+    return json(
+      { error: `password must be at least ${String(MIN_PASSWORD_LENGTH)} chars` },
+      { status: 400 }
+    );
+  }
+
+  const now = Date.now();
+  shareStore.setShare({
+    createdAt: existing?.createdAt ?? now,
+    mode: body.mode,
+    // `existing` is guaranteed non-null when password is empty (validated above).
+    passwordHash: password ? hashPassword(password) : (existing?.passwordHash ?? ''),
+    terminalId: params.id,
+    updatedAt: now,
+  });
+
+  // A new password invalidates existing guest sessions; any change to the
+  // share forces connected guests to reconnect under the new scope.
+  if (password) {
+    shareStore.deleteSessions(params.id);
+  }
+  if (password || existing?.mode !== body.mode) {
+    closeGuests(params.id);
+  }
+
+  return json(toInfo(params.id));
+};
+
+export const DELETE: RequestHandler = ({ params, request }) => {
+  const authError = validateAuth(request);
+  if (authError) {
+    return authError;
+  }
+  shareStore.deleteShare(params.id);
+  const closed = closeGuests(params.id);
+  return json({ closedConnections: closed, success: true });
+};

package/src/routes/api/terminals/[id]/share/auth/+server.ts

@@ -0,0 +1,81 @@
+// POST /api/terminals/[id]/share/auth — exchange the share password for a
+// guest session token. Public endpoint; brute-force-limited per IP+terminal.
+
+import type { ShareAuthRequest } from '$lib/types';
+
+import { shareStore, verifyPassword } from '$lib/modules/server/terminal/share-store';
+import { json } from '@sveltejs/kit';
+
+import type { RequestHandler } from './$types';
+
+const RATE_LIMIT_WINDOW_MS = 60_000;
+const RATE_LIMIT_MAX = 10;
+
+/** Maps "ip:terminalId" -> attempt timestamps (epoch ms). */
+const attempts = new Map<string, number[]>();
+
+function checkRateLimit(key: string): boolean {
+  const now = Date.now();
+  const recent = (attempts.get(key) ?? []).filter((t) => t > now - RATE_LIMIT_WINDOW_MS);
+  attempts.set(key, recent);
+  if (recent.length >= RATE_LIMIT_MAX) {
+    return false;
+  }
+  recent.push(now);
+  return true;
+}
+
+// Cleanup stale rate limit entries every 5 minutes
+setInterval(() => {
+  const cutoff = Date.now() - RATE_LIMIT_WINDOW_MS;
+  for (const [key, timestamps] of attempts) {
+    const recent = timestamps.filter((t) => t > cutoff);
+    if (recent.length === 0) {
+      attempts.delete(key);
+    } else {
+      attempts.set(key, recent);
+    }
+  }
+}, 300_000).unref();
+
+export const POST: RequestHandler = async (event) => {
+  const { params, request } = event;
+
+  const share = shareStore.getShare(params.id);
+  if (!share) {
+    return json({ error: 'Not shared' }, { status: 404 });
+  }
+
+  // Behind Cloudflare Tunnel the connecting IP arrives in headers.
+  let ip = 'unknown';
+  const cfIp = request.headers.get('cf-connecting-ip');
+  const fwd = request.headers.get('x-forwarded-for');
+  if (cfIp) {
+    ip = cfIp;
+  } else if (fwd) {
+    ip = fwd.split(',')[0].trim();
+  } else {
+    try {
+      ip = event.getClientAddress();
+    } catch {
+      // Keep 'unknown' — the rate limit still applies per terminal.
+    }
+  }
+
+  if (!checkRateLimit(`${ip}:${params.id}`)) {
+    return json({ error: 'Too many attempts. Try again in a minute.' }, { status: 429 });
+  }
+
+  let body: ShareAuthRequest;
+  try {
+    body = (await request.json()) as ShareAuthRequest;
+  } catch {
+    return json({ error: 'Invalid JSON' }, { status: 400 });
+  }
+  if (typeof body.password !== 'string' || !verifyPassword(body.password, share.passwordHash)) {
+    return json({ error: 'Invalid password' }, { status: 401 });
+  }
+
+  const { expiresAt, token } = shareStore.createSession(params.id);
+  return json({ expiresAt, mode: share.mode, token });
+};

package/src/routes/api/terminals/[id]/share/status/+server.ts

@@ -0,0 +1,11 @@
+// GET /api/terminals/[id]/share/status — public probe used by the page to
+// decide whether to show the password gate. Reveals only a boolean.
+
+import { shareStore } from '$lib/modules/server/terminal/share-store';
+import { json } from '@sveltejs/kit';
+
+import type { RequestHandler } from './$types';
+
+export const GET: RequestHandler = ({ params }) => {
+  return json({ shared: shareStore.getShare(params.id) !== null });
+};

package/src/routes/api/ws-ticket/+server.ts

@@ -8,6 +8,7 @@
 // Rate limited to 30 requests per minute per API key.
 
 import { validateAuth } from '$lib/modules/server/auth';
+import { shareStore } from '$lib/modules/server/terminal/share-store';
 import { generateTicket } from '$lib/modules/server/ws/ticket-store';
 import { json } from '@sveltejs/kit';
 
@@ -63,15 +64,35 @@ setInterval(() => {
 // ── Endpoint ────────────────────────────────────────────────────────
 
 export const POST: RequestHandler = ({ request }) => {
+  const bearer = (
+    request.headers.get('authorization') ??
+    request.headers.get('Authorization') ??
+    ''
+  )
+    .replace(/^Bearer\s+/i, '')
+    .trim();
+
   const authError = validateAuth(request);
   if (authError) {
-    return authError;
+    // Not the API key — maybe a guest share token (issues a scoped ticket).
+    const session = bearer ? shareStore.resolveToken(bearer) : null;
+    if (!session) {
+      return authError;
+    }
+    if (!checkRateLimit(bearer)) {
+      return json(
+        { error: 'Rate limit exceeded. Maximum 30 ticket requests per minute.' },
+        { status: 429 }
+      );
+    }
+    const ticket = generateTicket({
+      readOnly: session.mode === 'view',
+      terminalId: session.terminalId,
+    });
+    return json({ expiresIn: 30, ticket });
   }
 
-  // Extract the API key for rate limiting
-  const apiKey = (request.headers.get('authorization') ?? '').substring(7).trim();
-
-  if (!checkRateLimit(apiKey)) {
+  if (!checkRateLimit(bearer)) {
     return json(
       { error: 'Rate limit exceeded. Maximum 30 ticket requests per minute.' },
       { status: 429 }

package/src/routes/sos/+page.svelte

@@ -0,0 +1,195 @@
+<script lang="ts">
+  import type { ShooterConfig, SuperSession } from '$lib/types';
+
+  import { goto } from '$app/navigation';
+  import { Banner, Button, EmptyState, Input, Pill } from '@juspay/svelte-ui-components';
+  import { onMount } from 'svelte';
+
+  let sessions = $state<SuperSession[]>([]);
+  let loading = $state(true);
+  let error = $state('');
+  let newLabel = $state('');
+  let creating = $state(false);
+
+  function getConfig(): null | ShooterConfig {
+    try {
+      const saved = localStorage.getItem('shooter_config');
+      return saved ? (JSON.parse(saved) as ShooterConfig) : null;
+    } catch {
+      return null;
+    }
+  }
+
+  async function loadSessions(): Promise<void> {
+    const config = getConfig();
+    if (!config) {
+      error = 'No configuration found. Open Settings first.';
+      loading = false;
+      return;
+    }
+    try {
+      const res = await fetch('/api/sos', {
+        headers: { Authorization: `Bearer ${config.apiKey}` },
+      });
+      if (!res.ok) {
+        error = `Failed to load (${res.status})`;
+        return;
+      }
+      const data = (await res.json()) as { superSessions: SuperSession[] };
+      sessions = data.superSessions ?? [];
+    } catch {
+      error = 'Network error — is the server running?';
+    } finally {
+      loading = false;
+    }
+  }
+
+  async function create(): Promise<void> {
+    const config = getConfig();
+    if (!config || !newLabel.trim()) {
+      return;
+    }
+    creating = true;
+    try {
+      const res = await fetch('/api/sos', {
+        body: JSON.stringify({ label: newLabel.trim() }),
+        headers: { Authorization: `Bearer ${config.apiKey}`, 'Content-Type': 'application/json' },
+        method: 'POST',
+      });
+      if (res.ok) {
+        const created = (await res.json()) as SuperSession;
+        void goto(`/sos/${created.id}`);
+      } else {
+        const d = (await res.json().catch(() => ({}))) as { error?: string };
+        error = d.error ?? `Failed to create (${res.status})`;
+      }
+    } catch {
+      error = 'Network error — could not create super-session';
+    } finally {
+      creating = false;
+    }
+  }
+
+  onMount(() => {
+    void loadSessions();
+  });
+</script>
+
+<svelte:head><title>Session Over Sessions - Shooter</title></svelte:head>
+
+<main class="main sos-list">
+  <div class="page-head">
+    <div>
+      <h1>Session Over Sessions</h1>
+      <p class="subtitle">Coordinate multiple running agents as one super-session.</p>
+    </div>
+  </div>
+
+  <div class="create-row">
+    <Input
+      bind:value={newLabel}
+      dataType="text"
+      placeholder="New super-session label…"
+      classes="sos-create-input"
+    />
+    <Button
+      text={creating ? 'Creating…' : 'Create'}
+      disabled={creating || !newLabel.trim()}
+      onclick={create}
+      classes="btn-create"
+    />
+  </div>
+
+  {#if error}
+    <Banner text={error} classes="banner-error" />
+  {/if}
+
+  {#if loading}
+    <p class="muted">Loading…</p>
+  {:else if sessions.length === 0}
+    <EmptyState
+      title="No super-sessions yet"
+      description="Create one above, then add running agent sessions as members."
+    />
+  {:else}
+    <div class="ss-grid">
+      {#each sessions as ss (ss.id)}
+        <a class="ss-card" href={`/sos/${ss.id}`}>
+          <div class="ss-card-head">
+            <span class="ss-label">{ss.label}</span>
+            <Pill text={ss.status} classes="pill-status-unknown" />
+          </div>
+          <div class="ss-meta">
+            <span>{ss.members.length} member{ss.members.length === 1 ? '' : 's'}</span>
+            <span>{ss.routingRules.length} rule{ss.routingRules.length === 1 ? '' : 's'}</span>
+          </div>
+        </a>
+      {/each}
+    </div>
+  {/if}
+</main>
+
+<style>
+  .sos-list {
+    max-width: 720px;
+    margin: 0 auto;
+    padding: var(--space-5) var(--space-4);
+  }
+  .page-head h1 {
+    font-size: var(--text-2xl);
+    font-weight: 600;
+    color: var(--text-primary);
+    margin: 0;
+  }
+  .subtitle {
+    color: var(--text-secondary);
+    font-size: var(--text-sm);
+    margin: var(--space-1) 0 var(--space-4);
+  }
+  .create-row {
+    display: flex;
+    gap: var(--space-2);
+    align-items: center;
+    margin-bottom: var(--space-4);
+  }
+  :global(.sos-create-input) {
+    flex: 1;
+    --input-container-margin: 0;
+  }
+  .muted {
+    color: var(--text-tertiary);
+  }
+  .ss-grid {
+    display: grid;
+    gap: var(--space-3);
+  }
+  .ss-card {
+    display: block;
+    padding: var(--space-4);
+    background: var(--component-bg);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-lg);
+    text-decoration: none;
+    transition: border-color var(--transition-fast);
+  }
+  .ss-card:hover {
+    border-color: var(--border-hover);
+  }
+  .ss-card-head {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: var(--space-2);
+  }
+  .ss-label {
+    font-weight: 600;
+    color: var(--text-primary);
+  }
+  .ss-meta {
+    display: flex;
+    gap: var(--space-3);
+    color: var(--text-tertiary);
+    font-size: var(--text-xs);
+    margin-top: var(--space-2);
+  }
+</style>