@kb-labs/gateway-app 2.119.1-canary.ee03bc25d → 2.120.0

package/dist/index.js

@@ -4,7 +4,7 @@ import { createInMemoryDocumentDatabase, createInMemoryKVStore } from '@kb-labs/
 import { makeAssemblyHook } from '@kb-labs/plugin-runtime';
 import { runService } from '@kb-labs/shared-daemon';
 import { HostStore, globalDispatcher, AdaptiveBuffer } from '@kb-labs/gateway-core';
-import { UsersStore, CredentialsStore, MembershipsStore, SessionsStore, InvitesStore, loadIdentityProviders, createPasswordPolicy, createStubPDP, createTenantResolver, createUserAuthService, ensureBootstrapAdmin, createRateLimiter, OAuthStateStore, AuthService, ensureBootstrapCliCredentials, verifyUserAccessToken, AuthError, getClientByHandle, issueCsrfToken, verifyCsrfToken, getClientByHostId } from '@kb-labs/gateway-auth';
+import { UsersStore, CredentialsStore, MembershipsStore, SessionsStore, InvitesStore, loadIdentityProviders, createPasswordPolicy, createStubPDP, createTenantResolver, createUserAuthService, ensureBootstrapAdmin, createRateLimiter, OAuthStateStore, AuthService, ensureBootstrapCliCredentials, verifyUserAccessToken, AuthError, getClientByHandle, issueCsrfToken, verifyCsrfToken, getClientByHostId, evaluateAuthReadiness } from '@kb-labs/gateway-auth';
 import { createRegistry, mergeOpenAPISpecs } from '@kb-labs/core-registry';
 import { loadEffectiveConfig } from '@kb-labs/core-config';
 import { GatewayConfigSchema, HostRegistrationSchema, RegisterRequestSchema, TokenRequestSchema, RefreshRequestSchema, ExecuteRequestSchema, ChatCompletionRequestSchema, TelemetryIngestRequestSchema, PlatformCallRequestSchema, HelloMessageSchema, SUPPORTED_PROTOCOL_VERSIONS, HostCapabilitySchema, AdapterCallMessageSchema, AdapterNameSchema, ClientHelloSchema, ClientCancelSchema, ClientUnsubscribeSchema, ClientSubscribeSchema, CLIENT_PROTOCOL_VERSION } from '@kb-labs/gateway-contracts';
@@ -30,6 +30,19 @@ async function loadGatewayConfig(repoRoot, platformRoot) {
   }
   return GatewayConfigSchema.parse({});
 }
+
+// src/access.ts
+var DEPLOYED_BIND_HOST = "0.0.0.0";
+var LOCAL_BIND_HOST = "127.0.0.1";
+var resolveAccess = (config) => {
+  const local = config.access?.mode === "local";
+  return {
+    authEnabled: config.auth?.enabled ?? !local,
+    bindHost: config.host ?? (local ? LOCAL_BIND_HOST : DEPLOYED_BIND_HOST)
+  };
+};
+var DEFAULT_BOOTSTRAP_TENANT = "kblabs-cloud";
+var resolveBootstrapTenantId = (config, env) => config.auth?.bootstrap?.tenantId ?? env.GATEWAY_BOOTSTRAP_TENANT_ID ?? DEFAULT_BOOTSTRAP_TENANT;
 async function resolveToken(token, cache, jwtConfig) {
   const authService = new AuthService(cache, jwtConfig);
   const jwtContext = await authService.verify(token);
@@ -69,6 +82,8 @@ var LOCAL_ADMIN_CONTEXT = {
 var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
   "/health",
   "/health/adapters",
+  // Self-gated to local, non-proxied requests inside the handler (see health-route.ts).
+  "/health/auth",
   "/ready",
   // Studio SPA shell (index.html) — the login page itself. There is no
   // session yet when a browser first hits this, so it can't be gated.
@@ -138,6 +153,46 @@ function createAuthMiddleware(cache, jwtConfig, options = {}) {
   };
 }
 
+// src/auth/health-route.ts
+var FORWARDING_HEADERS = ["x-forwarded-for", "x-real-ip", "forwarded", "x-forwarded-host", "x-forwarded-proto"];
+var LOOPBACK_IPV4 = /^127(?:\.(?:25[0-5]|2[0-4]\d|1?\d?\d)){3}$/;
+var isLoopbackIp = (ip) => {
+  const a = ip.toLowerCase();
+  return a === "::1" || LOOPBACK_IPV4.test(a) || a.startsWith("::ffff:") && LOOPBACK_IPV4.test(a.slice(7));
+};
+var isLoopbackAddress = (address) => address !== void 0 && isLoopbackIp(address);
+var hostnameOf = (hostHeader) => {
+  const h = hostHeader.trim().toLowerCase();
+  if (h.startsWith("[")) {
+    return h.slice(1, h.indexOf("]"));
+  }
+  const colon = h.indexOf(":");
+  return colon === -1 ? h : h.slice(0, colon);
+};
+var isLoopbackHostname = (hostname2) => hostname2 === "localhost" || isLoopbackIp(hostname2);
+var isLocalOperatorRequest = (request) => {
+  if (!isLoopbackAddress(request.socket.remoteAddress)) {
+    return false;
+  }
+  if (FORWARDING_HEADERS.some((name) => request.headers[name] !== void 0)) {
+    return false;
+  }
+  const host = request.headers.host;
+  return typeof host === "string" && isLoopbackHostname(hostnameOf(host));
+};
+var registerAuthHealthRoute = (app, getReadiness) => {
+  app.get(
+    "/health/auth",
+    { schema: { tags: ["System"], summary: "Auth readiness (local operator only)" } },
+    async (request, reply) => {
+      if (!isLocalOperatorRequest(request)) {
+        return reply.code(404).send({ error: "Not Found" });
+      }
+      return getReadiness();
+    }
+  );
+};
+
 // src/auth/user-cookies.ts
 var COOKIE_ACCESS = "kb_access";
 var COOKIE_REFRESH = "kb_refresh";
@@ -1870,12 +1925,17 @@ function registerAggregatedDocsRoutes(app, config, serviceTransport, cache) {
         (serviceId) => serviceTransport.call(serviceId, {
           path: "/openapi.json",
           signal: AbortSignal.timeout(3e3)
-        }).then((r) => r.payload)
+        }).then((r) => {
+          if (!r.ok) {
+            throw new Error(`${serviceId} /openapi.json returned ${r.statusCode}`);
+          }
+          return r.payload;
+        })
       )
     );
     const specs = results.filter((r) => r.status === "fulfilled").map((r) => r.value);
     const merged = mergeOpenAPISpecs(specs);
-    if (cache) {
+    if (cache && specs.length > 0) {
       try {
         await cache.set(MERGED_CACHE_KEY, merged, MERGED_CACHE_TTL);
       } catch {
@@ -3941,7 +4001,7 @@ async function createServer(config, cache, logger, jwtConfig, registry, serviceT
   app.addHook(
     "onRequest",
     createAuthMiddleware(cache, jwtConfig, {
-      authEnabled: config.auth?.enabled !== false
+      authEnabled: resolveAccess(config).authEnabled
     })
   );
   const socketWsUpstreams = [];
@@ -4151,6 +4211,9 @@ async function createServer(config, cache, logger, jwtConfig, registry, serviceT
         return getAdapterStatus();
       }
     );
+    if (userAuth?.authReadiness) {
+      registerAuthHealthRoute(scope, userAuth.authReadiness);
+    }
     scope.get(
       "/ready",
       { schema: { tags: ["System"], summary: "Gateway readiness check" } },
@@ -4428,6 +4491,7 @@ async function startGateway({
   const logger = serviceLogger.forComponent("gateway-bootstrap").forOperation("gateway.bootstrap");
   logger.info("Platform initialized", { projectRoot, platformRoot });
   const config = await loadGatewayConfig(projectRoot, platformRoot);
+  const access = resolveAccess(config);
   logger.info("Gateway config loaded", {
     port: config.port,
     upstreams: Object.keys(config.upstreams),
@@ -4456,7 +4520,7 @@ async function startGateway({
       cookieSecure
     } = resolveAuthRuntimeConfig(config.auth, process.env);
     const tenantPattern = config.tenants?.pattern ?? "{tenant}.kblabs.ru";
-    const bootstrapTenantId = config.auth?.bootstrap?.tenantId ?? process.env.GATEWAY_BOOTSTRAP_TENANT_ID ?? "kblabs-cloud";
+    const bootstrapTenantId = resolveBootstrapTenantId(config, process.env);
     const users = new UsersStore(docs);
     const credentials = new CredentialsStore(docs);
     const memberships = new MembershipsStore(docs);
@@ -4496,7 +4560,7 @@ async function startGateway({
     });
     const adminEmail = config.auth?.bootstrap?.adminEmail ?? process.env.GATEWAY_BOOTSTRAP_ADMIN_EMAIL;
     const adminPassword = process.env.GATEWAY_BOOTSTRAP_ADMIN_PASSWORD;
-    await ensureBootstrapAdmin({
+    const bootstrapStatus = await ensureBootstrapAdmin({
       bootstrap: adminEmail && adminPassword ? { adminEmail, adminPassword, tenantId: bootstrapTenantId } : void 0,
       users,
       credentials,
@@ -4504,9 +4568,12 @@ async function startGateway({
       bcryptCost,
       logger
     }).catch((err) => {
-      logger.warn("Bootstrap admin seed failed (non-fatal)", {
-        error: err instanceof Error ? err.message : String(err)
-      });
+      logger.error(
+        "Bootstrap admin seed failed (non-fatal)",
+        err instanceof Error ? err : new Error(String(err)),
+        { tenantId: bootstrapTenantId }
+      );
+      return "failed";
     });
     const inviteTtlMs = process.env.AUTH_INVITE_TTL_MS ? parseInt(process.env.AUTH_INVITE_TTL_MS, 10) : config.auth?.inviteTtlMs ?? 7 * 24 * 60 * 60 * 1e3;
     const kv = platform5.getAdapter("kvStore") ?? createInMemoryKVStore();
@@ -4525,6 +4592,16 @@ async function startGateway({
         "OAuth requires a shared kvStore (Redis) in multi-process/HA; in-memory state is per-process and callbacks may land on a different worker"
       );
     }
+    const authReadiness = () => evaluateAuthReadiness({
+      authEnabled: access.authEnabled,
+      loopbackOnly: isLoopbackHost(access.bindHost),
+      tenantId: bootstrapTenantId,
+      jwtSecretIsDefault: !process.env.GATEWAY_JWT_SECRET,
+      bootstrap: { status: bootstrapStatus, email: adminEmail },
+      users,
+      memberships
+    });
+    await logAuthReadiness(authReadiness, logger);
     userAuth = {
       userAuthService,
       users,
@@ -4540,7 +4617,8 @@ async function startGateway({
       inviteTtlMs,
       rateLimiter,
       authRateLimit: { loginPerIpPerMinute, loginPerEmailPerMinute },
-      oauthState
+      oauthState,
+      authReadiness
     };
     logger.info("User auth infrastructure initialised", {
       tenantPattern,
@@ -4648,8 +4726,8 @@ async function startGateway({
     userAuth,
     webhookManifests
   );
-  const bindHost = config.host ?? "0.0.0.0";
-  if (config.auth?.enabled === false && !isLoopbackHost(bindHost)) {
+  const { authEnabled, bindHost } = access;
+  if (!authEnabled && !isLoopbackHost(bindHost)) {
     throw new Error(
       `Refusing to start: auth is disabled but the gateway binds to "${bindHost}" (not loopback). A no-auth platform reachable on the network grants full access to anyone. Either set gateway.auth.enabled = true, or bind to 127.0.0.1 (gateway.host) for solo/local use.`
     );
@@ -4659,7 +4737,7 @@ async function startGateway({
   const address = await server.listen({ port: listenPort, host: bindHost });
   logger.info("Gateway listening", {
     address,
-    authEnabled: config.auth?.enabled !== false
+    authEnabled
   });
   return async () => {
     await server.close();
@@ -4684,6 +4762,29 @@ function isLoopbackHost(host) {
   const h = host.trim().toLowerCase();
   return h === "127.0.0.1" || h === "localhost" || h === "::1" || h === "[::1]" || h.startsWith("127.");
 }
+async function logAuthReadiness(evaluate, logger) {
+  try {
+    const readiness = await evaluate();
+    for (const issue of readiness.issues) {
+      const meta = { code: issue.code, hint: issue.hint };
+      if (issue.severity === "error") {
+        logger.error(`auth-readiness: ${issue.message}`, void 0, meta);
+      } else {
+        logger.warn(`auth-readiness: ${issue.message}`, meta);
+      }
+    }
+    if (readiness.ok && readiness.issues.length === 0) {
+      logger.info("auth-readiness: ok", {
+        authEnabled: readiness.authEnabled,
+        activeAdmins: readiness.activeAdmins
+      });
+    }
+  } catch (err) {
+    logger.warn("auth-readiness: check failed", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+  }
+}
 
 // src/index.ts
 bootstrap(process.cwd()).catch(() => {