@kb-labs/gateway-app 2.88.0 → 2.93.0

package/dist/index.js

@@ -121,7 +121,8 @@ function registerAuthRoutes(app, authService) {
     if (!parsed.success) {
       return reply.code(400).send({ error: "Bad Request", issues: parsed.error.issues });
     }
-    const result = await authService.register(parsed.data);
+    const { name, capabilities, publicKey } = parsed.data;
+    const result = await authService.register({ name, capabilities, publicKey });
     return reply.code(201).send(result);
   });
   app.post("/auth/token", { schema: { tags: ["Auth"], summary: "Issue JWT token pair" } }, async (request, reply) => {
@@ -2116,6 +2117,9 @@ function mergeTopOperations(httpOperations, domainOperations, limit = 5) {
   }
   return [...sliced.slice(0, Math.max(0, limit - 1)), firstDomainOperation];
 }
+function redactQueryToken(url) {
+  return url.replace(/([?&]access_token=)[^&]*/gi, "$1[REDACTED]");
+}
 async function createServer(config, cache, logger, jwtConfig, registry) {
   const gatewayLogger = createCorrelatedLogger(logger, {
     serviceId: "gateway",
@@ -2135,7 +2139,7 @@ async function createServer(config, cache, logger, jwtConfig, registry) {
     servers: [{ url: "http://localhost:4000", description: "Local dev" }],
     ui: !isProduction
   });
-  await app.register(fastifyCors, { origin: true });
+  await app.register(fastifyCors, { origin: false });
   const observability = new GatewayObservabilityCollector(config);
   observability.register(app);
   app.addHook("onRequest", async (request, reply) => {
@@ -2144,6 +2148,7 @@ async function createServer(config, cache, logger, jwtConfig, registry) {
     request.id = requestId;
     reply.header("X-Request-Id", requestId);
     reply.header("X-Trace-Id", traceId);
+    const safeUrl = redactQueryToken(request.url);
     request.kbLogger = createCorrelatedLogger(logger, {
       serviceId: "gateway",
       logsSource: "gateway",
@@ -2152,17 +2157,18 @@ async function createServer(config, cache, logger, jwtConfig, registry) {
       requestId,
       traceId,
       method: request.method,
-      url: request.url,
+      url: safeUrl,
       operation: "http.request"
     });
-    request.kbLogger.info(`\u2192 ${request.method.toUpperCase()} ${request.url}`);
+    request.kbLogger.info(`\u2192 ${request.method.toUpperCase()} ${safeUrl}`);
   });
   app.addHook("onResponse", async (request, reply) => {
     const requestLogger = request.kbLogger;
     if (!requestLogger) {
       return;
     }
-    requestLogger.info(`\u2713 ${request.method.toUpperCase()} ${request.url} ${reply.statusCode}`, {
+    const safeUrl = redactQueryToken(request.url);
+    requestLogger.info(`\u2713 ${request.method.toUpperCase()} ${safeUrl} ${reply.statusCode}`, {
       statusCode: reply.statusCode
     });
   });
@@ -2200,7 +2206,8 @@ async function createServer(config, cache, logger, jwtConfig, registry) {
         await observability.observeOperation(`gateway.adapter.${name}`, async () => {
           const probeStart = Date.now();
           try {
-            const adapter = platform[name];
+            const pf = platform;
+            const adapter = pf[name] ?? pf.getAdapter?.(name);
             adapters[name] = { available: !!adapter, latencyMs: Date.now() - probeStart };
           } catch {
             adapters[name] = { available: false, latencyMs: Date.now() - probeStart };
@@ -2486,11 +2493,18 @@ async function bootstrap(repoRoot = process.cwd()) {
     await platform.cache.set(`host:token:${token}`, entry);
     logger.info("Static token seeded", { hostId: entry.hostId, namespaceId: entry.namespaceId });
   }
+  const DEV_JWT_SECRET = "dev-insecure-secret-change-me";
   const jwtSecret = process.env.GATEWAY_JWT_SECRET;
+  const isProduction = process.env.NODE_ENV === "production";
+  if (!jwtSecret && isProduction) {
+    throw new Error(
+      `GATEWAY_JWT_SECRET must be set in production. Generate one with: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"`
+    );
+  }
   if (!jwtSecret) {
-    logger.warn("GATEWAY_JWT_SECRET not set \u2014 using insecure default (dev only!)");
+    logger.warn("GATEWAY_JWT_SECRET not set \u2014 using insecure default (dev only, never use in production!)");
   }
-  const jwtConfig = { secret: jwtSecret ?? "dev-insecure-secret-change-me" };
+  const jwtConfig = { secret: jwtSecret ?? DEV_JWT_SECRET };
   const server = await createServer(config, platform.cache, platform.logger, jwtConfig, registry);
   const address = await server.listen({ port: config.port, host: "0.0.0.0" });
   logger.info("Gateway listening", { address });