@kb-labs/gateway-app 2.104.0 → 2.106.0

package/dist/index.js

@@ -85,6 +85,10 @@ var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
   "/auth/refresh",
   // User-auth public endpoints (ADR-0020, Phase 1.16).
   "/auth/login",
+  // CLI-only analogues of /auth/login and the cookie user-refresh path —
+  // return tokens in the body instead of cookies, see user-routes.ts.
+  "/auth/login/cli",
+  "/auth/refresh/cli",
   "/auth/activate",
   "/auth/providers",
   "/internal/dispatch",
@@ -256,13 +260,18 @@ var sendUnauthorized = (reply, message) => reply.code(401).send({ error: "Unauth
 var createUserAuthMiddleware = (deps) => {
   return async function userAuthMiddleware(request, reply) {
     const cookies = request.cookies;
-    const token = cookies?.[COOKIE_ACCESS];
+    const cookieToken = cookies?.[COOKIE_ACCESS];
+    const bearerToken = cookieToken ? void 0 : extractBearerToken(request.headers.authorization);
+    const token = cookieToken ?? bearerToken;
     if (!token) {
       return;
     }
     const payload = await verifyUserAccessToken(token, deps.jwtConfig);
     if (!payload) {
-      return sendUnauthorized(reply, "Invalid session");
+      if (cookieToken) {
+        return sendUnauthorized(reply, "Invalid session");
+      }
+      return;
     }
     const hostHeader = request.headers["host"];
     const resolvedTenant = deps.tenantResolver.resolve(
@@ -481,8 +490,34 @@ function createUserRefreshFn(deps) {
     }
   };
 }
+async function peekLoginRateLimit(reply, ip, emailNorm, rateLimiter, cfg) {
+  const [ipPeek, emailPeek] = await Promise.all([
+    rateLimiter.peek(`rl:login:ip:${ip}`, { max: cfg.loginPerIpPerMinute, windowMs: 6e4 }),
+    rateLimiter.peek(`rl:login:email:${emailNorm}`, { max: cfg.loginPerEmailPerMinute, windowMs: 6e4 })
+  ]);
+  if (!ipPeek.allowed || !emailPeek.allowed) {
+    const retryAfter = !ipPeek.allowed ? ipPeek.retryAfterSec : !emailPeek.allowed ? emailPeek.retryAfterSec : 60;
+    reply.header("Retry-After", String(retryAfter));
+    void reply.code(429).send({ error: "Too Many Requests", message: "Rate limit exceeded", retryAfterSec: retryAfter });
+    return false;
+  }
+  return true;
+}
+async function recordLoginFailure(reply, ip, emailNorm, rateLimiter, cfg) {
+  const [ipResult, emailResult] = await Promise.all([
+    rateLimiter.check(`rl:login:ip:${ip}`, { max: cfg.loginPerIpPerMinute, windowMs: 6e4 }),
+    rateLimiter.check(`rl:login:email:${emailNorm}`, { max: cfg.loginPerEmailPerMinute, windowMs: 6e4 })
+  ]);
+  if (!ipResult.allowed || !emailResult.allowed) {
+    const retryAfter = !ipResult.allowed ? ipResult.retryAfterSec : !emailResult.allowed ? emailResult.retryAfterSec : 60;
+    reply.header("Retry-After", String(retryAfter));
+    void reply.code(429).send({ error: "Too Many Requests", message: "Rate limit exceeded", retryAfterSec: retryAfter });
+    return false;
+  }
+  return true;
+}
 function registerUserAuthRoutes(app, deps) {
-  const { userAuthService, users, sessions, invites, providers, pdp, tenantResolver, cookieOpts, inviteTtlMs, rateLimiter, authRateLimit, oauthState, oauthCallbackPerIpPerMinute } = deps;
+  const { userAuthService, users, sessions, invites, providers, pdp, tenantResolver, bootstrapTenantId, cookieOpts, inviteTtlMs, rateLimiter, authRateLimit, oauthState, oauthCallbackPerIpPerMinute } = deps;
   const authRateLimitCfg = { loginPerIpPerMinute: 10, loginPerEmailPerMinute: 5, ...authRateLimit };
   if (oauthState) {
     registerOAuthRoutes(app, {
@@ -534,17 +569,11 @@ function registerUserAuthRoutes(app, deps) {
     }
     const host = typeof request.headers.host === "string" ? request.headers.host : "";
     const hostTenant = tenantResolver.resolve(host);
-    const tenantId = hostTenant ?? bodyTenantId ?? "";
+    const tenantId = hostTenant ?? bodyTenantId ?? bootstrapTenantId;
     if (rateLimiter) {
       const emailNorm = email.toLowerCase().trim();
-      const [ipPeek, emailPeek] = await Promise.all([
-        rateLimiter.peek(`rl:login:ip:${request.ip}`, { max: authRateLimitCfg.loginPerIpPerMinute, windowMs: 6e4 }),
-        rateLimiter.peek(`rl:login:email:${emailNorm}`, { max: authRateLimitCfg.loginPerEmailPerMinute, windowMs: 6e4 })
-      ]);
-      if (!ipPeek.allowed || !emailPeek.allowed) {
-        const retryAfter = !ipPeek.allowed ? ipPeek.retryAfterSec : !emailPeek.allowed ? emailPeek.retryAfterSec : 60;
-        reply.header("Retry-After", String(retryAfter));
-        return reply.code(429).send({ error: "Too Many Requests", message: "Rate limit exceeded", retryAfterSec: retryAfter });
+      if (!await peekLoginRateLimit(reply, request.ip, emailNorm, rateLimiter, authRateLimitCfg)) {
+        return;
       }
     }
     try {
@@ -564,17 +593,53 @@ function registerUserAuthRoutes(app, deps) {
     } catch (err) {
       if (err instanceof AuthError) {
         if (rateLimiter) {
-          const perIpMax = authRateLimitCfg.loginPerIpPerMinute;
-          const perEmailMax = authRateLimitCfg.loginPerEmailPerMinute;
           const emailNorm = email.toLowerCase().trim();
-          const [ipResult, emailResult] = await Promise.all([
-            rateLimiter.check(`rl:login:ip:${request.ip}`, { max: perIpMax, windowMs: 6e4 }),
-            rateLimiter.check(`rl:login:email:${emailNorm}`, { max: perEmailMax, windowMs: 6e4 })
-          ]);
-          if (!ipResult.allowed || !emailResult.allowed) {
-            const retryAfter = !ipResult.allowed ? ipResult.retryAfterSec : !emailResult.allowed ? emailResult.retryAfterSec : 60;
-            reply.header("Retry-After", String(retryAfter));
-            return reply.code(429).send({ error: "Too Many Requests", message: "Rate limit exceeded", retryAfterSec: retryAfter });
+          if (!await recordLoginFailure(reply, request.ip, emailNorm, rateLimiter, authRateLimitCfg)) {
+            return;
+          }
+        }
+        return reply.code(401).send({ error: "invalid_credentials" });
+      }
+      throw err;
+    }
+  });
+  app.post("/auth/login/cli", {
+    schema: { tags: ["Auth"], summary: "Login with email/password (CLI: returns tokens in body)" }
+  }, async (request, reply) => {
+    const { email, password, providerId, tenantId: bodyTenantId } = request.body ?? {};
+    if (typeof email !== "string" || !email) {
+      return reply.code(400).send({ error: "Bad Request", message: "email is required" });
+    }
+    if (typeof password !== "string" || !password) {
+      return reply.code(400).send({ error: "Bad Request", message: "password is required" });
+    }
+    const host = typeof request.headers.host === "string" ? request.headers.host : "";
+    const hostTenant = tenantResolver.resolve(host);
+    const tenantId = hostTenant ?? bodyTenantId ?? bootstrapTenantId;
+    if (rateLimiter) {
+      const emailNorm = email.toLowerCase().trim();
+      if (!await peekLoginRateLimit(reply, request.ip, emailNorm, rateLimiter, authRateLimitCfg)) {
+        return;
+      }
+    }
+    try {
+      const result = await userAuthService.login(
+        { providerId: providerId ?? "email-password", input: { email, password } },
+        tenantId,
+        { ip: request.ip, userAgent: request.headers["user-agent"] }
+      );
+      return reply.send({
+        accessToken: result.access.token,
+        refreshToken: result.refresh.token,
+        expiresIn: accessTtl2(result),
+        tenantId
+      });
+    } catch (err) {
+      if (err instanceof AuthError) {
+        if (rateLimiter) {
+          const emailNorm = email.toLowerCase().trim();
+          if (!await recordLoginFailure(reply, request.ip, emailNorm, rateLimiter, authRateLimitCfg)) {
+            return;
           }
         }
         return reply.code(401).send({ error: "invalid_credentials" });
@@ -582,6 +647,27 @@ function registerUserAuthRoutes(app, deps) {
       throw err;
     }
   });
+  app.post("/auth/refresh/cli", {
+    schema: { tags: ["Auth"], summary: "Refresh a CLI session token pair" }
+  }, async (request, reply) => {
+    const { refreshToken } = request.body ?? {};
+    if (typeof refreshToken !== "string" || !refreshToken) {
+      return reply.code(400).send({ error: "Bad Request", message: "refreshToken is required" });
+    }
+    try {
+      const result = await userAuthService.refresh(refreshToken);
+      return reply.send({
+        accessToken: result.access.token,
+        refreshToken: result.refresh.token,
+        expiresIn: accessTtl2(result)
+      });
+    } catch (err) {
+      if (err instanceof AuthError) {
+        return reply.code(401).send({ error: "Unauthorized", message: "Invalid or expired refresh token" });
+      }
+      throw err;
+    }
+  });
   app.post("/auth/logout", {
     schema: { tags: ["Auth"], summary: "Logout and clear session cookies" }
   }, async (request, reply) => {
@@ -3879,6 +3965,7 @@ async function createServer(config, cache, logger, jwtConfig, registry, serviceT
           providers: userAuth.providers,
           pdp: userAuth.pdp,
           tenantResolver: userAuth.tenantResolver,
+          bootstrapTenantId: userAuth.bootstrapTenantId,
           cookieOpts: { cookieSecure: userAuth.cookieSecure },
           accessTtlSec: userAuth.accessTtlSec,
           refreshTtlSec: userAuth.refreshTtlSec,
@@ -4164,11 +4251,7 @@ async function bootstrap(repoRoot = process.cwd()) {
   }
   let userAuth;
   {
-    const accessTtlSec = config.auth?.sessionAccessTtlSec ?? (process.env.AUTH_ACCESS_TTL_SEC ? parseInt(process.env.AUTH_ACCESS_TTL_SEC, 10) : 900);
-    const refreshTtlSec = config.auth?.sessionRefreshTtlSec ?? (process.env.AUTH_REFRESH_TTL_SEC ? parseInt(process.env.AUTH_REFRESH_TTL_SEC, 10) : 30 * 24 * 3600);
-    const graceWindowMs = (config.auth?.refreshGraceWindowSec ?? 5) * 1e3;
-    const bcryptCost = config.auth?.bcryptCost ?? 12;
-    const cookieSecure = config.auth?.cookieSecure ?? (process.env.AUTH_COOKIE_SECURE === "false" ? false : true);
+    const { accessTtlSec, refreshTtlSec, graceWindowMs, bcryptCost, cookieSecure } = resolveAuthRuntimeConfig(config.auth, process.env);
     const tenantPattern = config.tenants?.pattern ?? "{tenant}.kblabs.ru";
     const bootstrapTenantId = config.auth?.bootstrap?.tenantId ?? process.env.GATEWAY_BOOTSTRAP_TENANT_ID ?? "kblabs-cloud";
     const users = new UsersStore(docs);
@@ -4243,6 +4326,7 @@ async function bootstrap(repoRoot = process.cwd()) {
       providers,
       pdp,
       tenantResolver,
+      bootstrapTenantId,
       cookieSecure,
       accessTtlSec,
       refreshTtlSec,
@@ -4362,6 +4446,14 @@ async function bootstrap(repoRoot = process.cwd()) {
   process.on("SIGTERM", () => shutdown("SIGTERM"));
   process.on("SIGINT", () => shutdown("SIGINT"));
 }
+function resolveAuthRuntimeConfig(authConfig, env) {
+  const accessTtlSec = env.AUTH_ACCESS_TTL_SEC ? parseInt(env.AUTH_ACCESS_TTL_SEC, 10) : authConfig?.sessionAccessTtlSec ?? 900;
+  const refreshTtlSec = env.AUTH_REFRESH_TTL_SEC ? parseInt(env.AUTH_REFRESH_TTL_SEC, 10) : authConfig?.sessionRefreshTtlSec ?? 30 * 24 * 3600;
+  const graceWindowMs = (authConfig?.refreshGraceWindowSec ?? 5) * 1e3;
+  const bcryptCost = authConfig?.bcryptCost ?? 12;
+  const cookieSecure = env.AUTH_COOKIE_SECURE === "false" ? false : authConfig?.cookieSecure ?? true;
+  return { accessTtlSec, refreshTtlSec, graceWindowMs, bcryptCost, cookieSecure };
+}
 function isLoopbackHost(host) {
   const h = host.trim().toLowerCase();
   return h === "127.0.0.1" || h === "localhost" || h === "::1" || h === "[::1]" || h.startsWith("127.");