@kinqs/brainrouter-mcp-server 0.3.4

package/dist/api/middleware/auth.js

@@ -0,0 +1,90 @@
+import { memoryEngine } from "../../memory/engine.js";
+import { randomBytes } from "node:crypto";
+import { verifyJwt } from "../auth/crypto.js";
+const configuredJwtSecret = process.env.BRAINROUTER_JWT_SECRET?.trim();
+const generatedJwtSecret = randomBytes(32).toString("hex");
+export const USING_FALLBACK_JWT_SECRET = !configuredJwtSecret;
+export const JWT_SECRET = configuredJwtSecret || generatedJwtSecret;
+if (USING_FALLBACK_JWT_SECRET) {
+    console.error("[BrainRouter] WARNING: BRAINROUTER_JWT_SECRET not set. Using random secret — sessions will not survive restarts.");
+}
+export function requireAuth(req, res, next) {
+    const header = req.headers.authorization;
+    const key = header?.startsWith("Bearer ") ? header.slice(7).trim() : "";
+    if (!key) {
+        res.status(401).json({ error: "API key required" });
+        return;
+    }
+    const user = memoryEngine.getUserByApiKey(key);
+    if (!user) {
+        res.status(403).json({ error: "Invalid API key" });
+        return;
+    }
+    req.userId = user.userId;
+    req.isAdmin = user.isAdmin;
+    req.email = user.email;
+    next();
+}
+export function requireJwt(req, res, next) {
+    const header = req.headers.authorization;
+    const token = header?.startsWith("Bearer ") ? header.slice(7).trim() : "";
+    if (!token) {
+        res.status(401).json({ error: "JWT required" });
+        return;
+    }
+    const payload = verifyJwt(token, JWT_SECRET);
+    if (!payload) {
+        res.status(403).json({ error: "Invalid or expired token" });
+        return;
+    }
+    req.userId = typeof payload.userId === "string" ? payload.userId : undefined;
+    req.isAdmin = Boolean(payload.isAdmin);
+    req.email = typeof payload.email === "string" ? payload.email : undefined;
+    if (!req.userId) {
+        res.status(403).json({ error: "Invalid or expired token" });
+        return;
+    }
+    const user = memoryEngine.getUserById(req.userId);
+    if (!user) {
+        res.status(403).json({ error: "Invalid or expired token" });
+        return;
+    }
+    if (user.status === "disabled") {
+        res.status(403).json({ error: "Account disabled" });
+        return;
+    }
+    next();
+}
+export function requireAnyAuth(req, res, next) {
+    const header = req.headers.authorization;
+    const bearer = header?.startsWith("Bearer ") ? header.slice(7).trim() : "";
+    if (!bearer) {
+        res.status(401).json({ error: "Authentication required" });
+        return;
+    }
+    if (bearer.split(".").length === 3) {
+        const payload = verifyJwt(bearer, JWT_SECRET);
+        if (payload && typeof payload.userId === "string") {
+            req.userId = payload.userId;
+            req.isAdmin = Boolean(payload.isAdmin);
+            req.email = typeof payload.email === "string" ? payload.email : undefined;
+            return next();
+        }
+    }
+    const user = memoryEngine.getUserByApiKey(bearer);
+    if (!user) {
+        res.status(401).json({ error: "Authentication required" });
+        return;
+    }
+    req.userId = user.userId;
+    req.isAdmin = user.isAdmin;
+    req.email = user.email;
+    next();
+}
+export function requireAdmin(req, res, next) {
+    if (!req.isAdmin) {
+        res.status(403).json({ error: "Admin access required" });
+        return;
+    }
+    next();
+}

package/dist/api/pagination.d.ts

@@ -0,0 +1,18 @@
+import { z } from "zod";
+export declare const PaginationQuerySchema: z.ZodObject<{
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    limit: number;
+    cursor?: string | undefined;
+}, {
+    cursor?: string | undefined;
+    limit?: number | undefined;
+}>;
+export type PaginationQuery = z.infer<typeof PaginationQuerySchema>;
+export declare function encodeCursor(payload: Record<string, unknown>): string;
+export declare function decodeCursor<T extends Record<string, unknown>>(cursor?: string): T | undefined;
+export declare function pageItems<T>(items: T[], limit: number, getCursorPayload: (item: T) => Record<string, unknown>): {
+    items: T[];
+    nextCursor: string | null;
+};

package/dist/api/pagination.js

@@ -0,0 +1,32 @@
+import { z } from "zod";
+export const PaginationQuerySchema = z.object({
+    cursor: z.string().min(1).optional(),
+    limit: z.coerce.number().int().min(1).max(100).default(20),
+});
+export function encodeCursor(payload) {
+    return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+}
+export function decodeCursor(cursor) {
+    if (!cursor)
+        return undefined;
+    try {
+        const decoded = Buffer.from(cursor, "base64url").toString("utf8");
+        const parsed = JSON.parse(decoded);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("Cursor must decode to an object");
+        }
+        return parsed;
+    }
+    catch (error) {
+        throw new Error("Invalid cursor");
+    }
+}
+export function pageItems(items, limit, getCursorPayload) {
+    const page = items.slice(0, limit);
+    const hasMore = items.length > limit;
+    const last = page.at(-1);
+    return {
+        items: page,
+        nextCursor: hasMore && last ? encodeCursor(getCursorPayload(last)) : null,
+    };
+}

package/dist/api/routes/auth.d.ts

@@ -0,0 +1 @@
+export declare const authRouter: import("express-serve-static-core").Router;

package/dist/api/routes/auth.js

@@ -0,0 +1,130 @@
+import { Router } from "express";
+import { randomBytes } from "node:crypto";
+import path from "node:path";
+import { memoryEngine } from "../../memory/engine.js";
+import { hashPassword, signJwt, verifyPassword } from "../auth/crypto.js";
+import { JWT_SECRET, requireJwt } from "../middleware/auth.js";
+const jwtExpiry = Number.parseInt(process.env.BRAINROUTER_JWT_EXPIRES_SECS ?? "86400", 10);
+function createJwt(user) {
+    return signJwt({
+        userId: user.userId,
+        isAdmin: user.isAdmin,
+        email: user.email,
+        displayName: user.displayName,
+    }, JWT_SECRET, Number.isFinite(jwtExpiry) ? jwtExpiry : 86400);
+}
+function userIdFromEmail(email) {
+    const base = email
+        .split("@")[0]
+        ?.toLowerCase()
+        .replace(/[^a-z0-9_]+/g, "_")
+        .replace(/^_+|_+$/g, "") || "user";
+    let userId = base;
+    while (memoryEngine.getUserById(userId)) {
+        userId = `${base}_${randomBytes(3).toString("hex")}`;
+    }
+    return userId;
+}
+export const authRouter = Router();
+authRouter.post("/signin", async (req, res) => {
+    const email = String(req.body?.email ?? "").trim();
+    const password = String(req.body?.password ?? "");
+    if (!email || !password) {
+        res.status(400).json({ error: "email and password are required" });
+        return;
+    }
+    const user = memoryEngine.getUserByEmail(email);
+    if (!user || !user.passwordHash) {
+        res.status(401).json({ error: "Invalid email or password" });
+        return;
+    }
+    if (user.status === "disabled") {
+        res.status(403).json({ error: "Account disabled" });
+        return;
+    }
+    const ok = await verifyPassword(password, user.passwordHash);
+    if (!ok) {
+        res.status(401).json({ error: "Invalid email or password" });
+        return;
+    }
+    const jwt = createJwt(user);
+    res.json({ jwt, userId: user.userId, isAdmin: user.isAdmin, displayName: user.displayName, apiKey: user.apiKey });
+});
+authRouter.post("/signup", async (req, res) => {
+    const email = String(req.body?.email ?? "").trim();
+    const password = String(req.body?.password ?? "");
+    const displayName = String(req.body?.displayName ?? "").trim();
+    if (!email || !password) {
+        res.status(400).json({ error: "email and password are required" });
+        return;
+    }
+    if (email.length > 254) {
+        res.status(400).json({ error: "Email too long" });
+        return;
+    }
+    if (password.length < 8) {
+        res.status(400).json({ error: "Password must be at least 8 characters" });
+        return;
+    }
+    if (displayName.length > 100) {
+        res.status(400).json({ error: "Display name too long" });
+        return;
+    }
+    if (memoryEngine.getUserByEmail(email)) {
+        res.status(409).json({ error: "Email already registered" });
+        return;
+    }
+    const userId = userIdFromEmail(email);
+    const apiKey = `br_${randomBytes(24).toString("hex")}`;
+    const passwordHash = await hashPassword(password);
+    try {
+        const created = memoryEngine.createUser(userId, apiKey, displayName || userId, false);
+        memoryEngine.updateUserEmail(created.userId, email);
+        memoryEngine.updatePassword(created.userId, passwordHash);
+        const user = memoryEngine.getUserById(created.userId);
+        if (!user) {
+            res.status(500).json({ error: "Failed to load user after signup" });
+            return;
+        }
+        const jwt = createJwt(user);
+        res.status(201).json({ jwt, userId: user.userId, isAdmin: user.isAdmin, displayName: user.displayName });
+    }
+    catch (error) {
+        res.status(400).json({ error: error?.message ?? "Failed to create user" });
+    }
+});
+authRouter.get("/me", requireJwt, (req, res) => {
+    const user = memoryEngine.getUserById(req.userId);
+    if (!user) {
+        res.status(404).json({ error: "User not found" });
+        return;
+    }
+    res.json({
+        userId: user.userId,
+        displayName: user.displayName,
+        email: user.email,
+        isAdmin: user.isAdmin,
+        apiKey: user.apiKey,
+        createdAt: user.createdAt,
+        status: user.status,
+        mcpPath: path.resolve(process.cwd(), "dist/index.js")
+    });
+});
+authRouter.put("/me", requireJwt, (req, res) => {
+    const displayName = String(req.body?.displayName ?? "").trim();
+    if (!displayName) {
+        res.status(400).json({ error: "displayName required" });
+        return;
+    }
+    if (displayName.length > 100) {
+        res.status(400).json({ error: "Display name too long" });
+        return;
+    }
+    memoryEngine.updateUserDisplayName(req.userId, displayName);
+    res.json({ success: true });
+});
+authRouter.post("/rotate-key", requireJwt, (req, res) => {
+    const apiKey = `br_${randomBytes(24).toString("hex")}`;
+    memoryEngine.updateUserApiKey(req.userId, apiKey);
+    res.json({ apiKey });
+});

package/dist/api/routes/chat-completions.d.ts

@@ -0,0 +1,7 @@
+export declare const chatCompletionsRouter: import("express-serve-static-core").Router;
+/** Lightweight per-user memory counts for the chat status badge. */
+export declare function getMemoryStatusForUser(userId: string): {
+    cognitive: number;
+    scenes: number;
+    hasPersona: boolean;
+};