@lightupai/polaris 0.0.77 → 0.0.79

package/src/service/server.ts

@@ -14,14 +14,27 @@ import {
   setDriver,
   clearDriver,
   pushEvent,
+  getEventById,
   getProjectEvents,
   getSessionEvents,
+  getSessionEventsPage,
   getEventsSince,
+  searchEvents,
+  setSessionLabel,
+  addAnnotation,
+  listSessionAnnotations,
+  listDecisions,
+  deleteAnnotation,
+  setProjectVisibility,
+  addProjectMember,
+  removeProjectMember,
+  listProjectMembers,
+  userCanAccessProject,
   type Sql,
 } from "./db";
-import { verifyToken, type TokenPayload } from "./auth";
+import { verifyToken, assertSecretConfigured, type TokenPayload } from "./auth";
 import type { PolarisEvent, ParticipantId } from "../types";
-import { HookPayload, ParticipantId as ParticipantIdSchema } from "../types";
+import { AnnotationKind, HookPayload, ParticipantId as ParticipantIdSchema } from "../types";
 
 // --- WebSocket subscriber management ---
 
@@ -106,6 +119,44 @@ function broadcastSse(event: PolarisEvent) {
   }
 }
 
+// --- Realtime backbone: LISTEN/NOTIFY de-dup ---
+// Events broadcast inline by a POST handler record their id here so the echoed NOTIFY
+// (delivered via the LISTEN connection) is skipped. Module-level so in-process test
+// servers share one de-dup horizon.
+const recentlyBroadcast = new Map<string, number>(); // event id -> recorded-at ms
+const RECENTLY_BROADCAST_TTL_MS = 30_000;
+
+function markBroadcast(id: string) {
+  const now = Date.now();
+  recentlyBroadcast.set(id, now);
+  for (const [k, ts] of recentlyBroadcast) {
+    if (now - ts > RECENTLY_BROADCAST_TTL_MS) recentlyBroadcast.delete(k);
+  }
+}
+
+// --- Rate limiting (tiny in-memory fixed window; lenient by design) ---
+
+const RATE_WINDOW_MS = 60_000;
+const INJECT_LIMIT_PER_WINDOW = 60; // per token (or per IP when anonymous)
+const WRITE_LIMIT_PER_WINDOW = 600;
+const rateBuckets = new Map<string, { windowStart: number; count: number }>();
+
+function rateLimited(key: string, limit: number): boolean {
+  const now = Date.now();
+  let bucket = rateBuckets.get(key);
+  if (!bucket || now - bucket.windowStart >= RATE_WINDOW_MS) {
+    bucket = { windowStart: now, count: 0 };
+    rateBuckets.set(key, bucket);
+    if (rateBuckets.size > 10_000) {
+      for (const [k, b] of rateBuckets) {
+        if (now - b.windowStart >= RATE_WINDOW_MS) rateBuckets.delete(k);
+      }
+    }
+  }
+  bucket.count++;
+  return bucket.count > limit;
+}
+
 // --- Route matching ---
 
 type RouteParams = Record<string, string>;
@@ -149,14 +200,18 @@ function error(message: string, status: number): Response {
 
 // --- Auth helper ---
 
-async function resolveOrgId(req: Request, defaultOrgId: string): Promise<string> {
+async function authOrgId(req: Request, defaultOrgId: string): Promise<{ orgId: string; participantId: string | null } | Response> {
   const auth = req.headers.get("Authorization");
   if (auth?.startsWith("Bearer ")) {
     const token = auth.slice(7);
     const payload = await verifyToken(token);
-    if (payload) return payload.org_id;
+    if (payload) return { orgId: payload.org_id, participantId: payload.participant_id };
+  }
+  // No/invalid token: fall back to the default org outside production
+  if (process.env.NODE_ENV !== "production") {
+    return { orgId: defaultOrgId, participantId: null };
   }
-  return defaultOrgId;
+  return error("Unauthorized", 401);
 }
 
 // --- Server factory ---
@@ -171,6 +226,7 @@ export async function startServer(opts: {
   defaultOrgId: string;
   stop: () => Promise<void>;
 }> {
+  assertSecretConfigured();
   const sql = await createDb(opts.databaseUrl);
   const port = opts.port ?? Number(process.env.PORT ?? 4321);
   const defaultOrgId = opts.defaultOrgId ?? "default";
@@ -182,6 +238,23 @@ export async function startServer(opts: {
     // Already exists
   }
 
+  // One dedicated LISTEN connection per process. Delivers events not already broadcast
+  // inline (e.g. bridge-origin Slack injects) to WS/SSE subscribers, and enables
+  // multi-replica fan-out.
+  await sql.listen("polaris_event", (id) => {
+    if (!id || recentlyBroadcast.has(id)) return;
+    markBroadcast(id);
+    (async () => {
+      const found = await getEventById(sql, id);
+      if (!found) return;
+      const { org_id: _orgId, ...event } = found;
+      broadcastEvent(event);
+      broadcastSse(event);
+    })().catch((e) => {
+      console.error("[server] polaris_event listener failed:", e);
+    });
+  });
+
   const server = Bun.serve<WsData>({
     port,
     hostname: "0.0.0.0",
@@ -198,9 +271,6 @@ export async function startServer(opts: {
       const method = req.method;
       let params: RouteParams | null;
 
-      // Resolve org from auth token or use default
-      const orgId = await resolveOrgId(req, defaultOrgId);
-
       // --- WebSocket upgrade ---
       params = matchRoute(method, pathname, "/projects/:proj/ws", "GET");
       if (params) {
@@ -213,6 +283,43 @@ export async function startServer(opts: {
         return upgraded ? undefined : error("WebSocket upgrade failed", 400);
       }
 
+      if (method === "GET" && pathname === "/status") {
+        return json({ ok: true, version: "0.0.1" });
+      }
+
+      // Resolve org from auth token; falls back to default org outside production,
+      // returns 401 in production without a valid token
+      const a = await authOrgId(req, defaultOrgId);
+      if (a instanceof Response) return a;
+      const orgId = a.orgId;
+      const participantId = a.participantId;
+
+      // --- Rate limiting (write endpoints; per token, per IP when anonymous) ---
+      if (method !== "GET") {
+        const rateKey = participantId ?? `ip:${server.requestIP(req)?.address ?? "unknown"}`;
+        const isInject = /^\/projects\/[^/]+\/sessions\/[^/]+\/inject$/.test(pathname);
+        if (isInject) {
+          if (rateLimited(`inject:${rateKey}`, INJECT_LIMIT_PER_WINDOW)) {
+            return error("Rate limit exceeded: too many injects", 429);
+          }
+        } else if (rateLimited(`write:${rateKey}`, WRITE_LIMIT_PER_WINDOW)) {
+          return error("Rate limit exceeded", 429);
+        }
+      }
+
+      // --- Per-project ACL ---
+      // 403 non-members on project-scoped endpoints. Anonymous callers (null participant,
+      // dev/tests) and the ACL-admin endpoints (visibility/members) are exempt — so you
+      // can still add members after flipping a project to 'members'.
+      const aclMatch = pathname.match(/^\/projects\/([^/]+)(\/.*)?$/);
+      if (aclMatch && participantId) {
+        const aclRest = aclMatch[2] ?? "";
+        const isAclAdmin = aclRest === "/visibility" || aclRest === "/members" || aclRest.startsWith("/members/");
+        if (!isAclAdmin && !(await userCanAccessProject(sql, orgId, aclMatch[1], participantId))) {
+          return error("Forbidden: project is restricted to members", 403);
+        }
+      }
+
       // --- Project endpoints ---
 
       if (method === "GET" && pathname === "/projects") {
@@ -271,6 +378,49 @@ export async function startServer(opts: {
         return json({ status: "renamed", oldName: params.proj, newName: body.name });
       }
 
+      // --- Project ACL endpoints (visibility & members) ---
+
+      params = matchRoute(method, pathname, "/projects/:proj/visibility", "POST");
+      if (params) {
+        const project = await getProject(sql, orgId, params.proj);
+        if (!project) return error("Project not found", 404);
+        const body = await jsonBody(req);
+        const parsed = z.object({ visibility: z.enum(["org", "members"]) }).safeParse(body);
+        if (!parsed.success) return error("Invalid body: visibility must be 'org' or 'members'", 400);
+        await setProjectVisibility(sql, orgId, params.proj, parsed.data.visibility);
+        return json({ ok: true, visibility: parsed.data.visibility });
+      }
+
+      params = matchRoute(method, pathname, "/projects/:proj/members", "POST");
+      if (params) {
+        const project = await getProject(sql, orgId, params.proj);
+        if (!project) return error("Project not found", 404);
+        const body = await jsonBody(req);
+        const parsed = z
+          .object({ participant_id: z.string().min(1), role: z.string().optional() })
+          .safeParse(body);
+        if (!parsed.success) return error("Invalid body: participant_id is required", 400);
+        await addProjectMember(sql, orgId, params.proj, parsed.data.participant_id, parsed.data.role);
+        return json({ ok: true });
+      }
+
+      params = matchRoute(method, pathname, "/projects/:proj/members", "GET");
+      if (params) {
+        const project = await getProject(sql, orgId, params.proj);
+        if (!project) return error("Project not found", 404);
+        const members = await listProjectMembers(sql, orgId, params.proj);
+        return json({ members });
+      }
+
+      params = matchRoute(method, pathname, "/projects/:proj/members/:pid", "DELETE");
+      if (params) {
+        const project = await getProject(sql, orgId, params.proj);
+        if (!project) return error("Project not found", 404);
+        // Participant ids contain ':' which clients often percent-encode in paths
+        await removeProjectMember(sql, orgId, params.proj, decodeURIComponent(params.pid));
+        return json({ ok: true });
+      }
+
       params = matchRoute(method, pathname, "/projects/:proj/messages", "GET");
       if (params) {
         const project = await getProject(sql, orgId, params.proj);
@@ -346,6 +496,8 @@ export async function startServer(opts: {
           sender: parsed.data.sender,
           payload: parsed.data.payload,
         };
+        // Record before pushEvent so our own NOTIFY echo is de-duped (we broadcast inline below).
+        markBroadcast(event.id);
         await pushEvent(sql, orgId, event);
         broadcastEvent(event);
         broadcastSse(event);
@@ -374,6 +526,15 @@ export async function startServer(opts: {
       if (params) {
         const session = await getSession(sql, orgId, params.proj, params.sess);
         if (!session) return error("Session not found", 404);
+        // Paginated event history when limit/before is present; SSE stream otherwise
+        if (url.searchParams.has("limit") || url.searchParams.has("before")) {
+          const limitParam = url.searchParams.get("limit");
+          const parsedLimit = limitParam ? Number.parseInt(limitParam, 10) : NaN;
+          const limit = Number.isFinite(parsedLimit) ? parsedLimit : undefined;
+          const before = url.searchParams.get("before") ?? undefined;
+          const { events, nextCursor } = await getSessionEventsPage(sql, orgId, params.proj, params.sess, { limit, before });
+          return json({ events, nextCursor });
+        }
         const proj = params.proj;
         const sess = params.sess;
         let controller: SseController;
@@ -392,23 +553,28 @@ export async function startServer(opts: {
         if (!session) return error("Session not found", 404);
         const body = await jsonBody(req);
         const parsed = z
-          .object({ content: z.string().min(1), sender: ParticipantIdSchema })
+          .object({ content: z.string().min(1), sender: ParticipantIdSchema.optional() })
           .safeParse(body);
         if (!parsed.success) return error(`Invalid body: ${parsed.error.message}`, 400);
+        // Authenticated callers always inject as themselves; anonymous (non-prod) callers must supply a sender
+        const sender = participantId ?? parsed.data.sender;
+        if (!sender) return error("Invalid body: sender is required", 400);
         const event: PolarisEvent = {
           id: crypto.randomUUID(),
           project: params.proj,
           session: params.sess,
           timestamp: new Date().toISOString(),
           source: "inject",
-          sender: parsed.data.sender,
+          sender,
           payload: {
             type: "inject" as const,
             content: parsed.data.content,
-            sender: parsed.data.sender,
+            sender,
             target: params.sess,
           },
         };
+        // Record before pushEvent so our own NOTIFY echo is de-duped (we broadcast inline below).
+        markBroadcast(event.id);
         await pushEvent(sql, orgId, event);
         broadcastEvent(event);
         broadcastSse(event);
@@ -444,6 +610,96 @@ export async function startServer(opts: {
         return json({ status: "claimed", driver: parsed.data.driver, session: params.sess });
       }
 
+      params = matchRoute(method, pathname, "/projects/:proj/sessions/:sess/label", "POST");
+      if (params) {
+        const session = await getSession(sql, orgId, params.proj, params.sess);
+        if (!session) return error("Session not found", 404);
+        const body = await jsonBody(req);
+        const parsed = z.object({ label: z.string() }).safeParse(body);
+        if (!parsed.success) return error("Invalid body: label is required", 400);
+        await setSessionLabel(sql, orgId, params.proj, params.sess, parsed.data.label);
+        return json({ ok: true });
+      }
+
+      // --- Annotations (curation: stars, tags, decisions) ---
+
+      params = matchRoute(method, pathname, "/projects/:proj/sessions/:sess/annotations", "POST");
+      if (params) {
+        const session = await getSession(sql, orgId, params.proj, params.sess);
+        if (!session) return error("Session not found", 404);
+        const body = await jsonBody(req);
+        const parsed = z
+          .object({
+            event_id: z.string().uuid().optional(),
+            kind: AnnotationKind,
+            value: z.string().optional(),
+          })
+          .safeParse(body);
+        if (!parsed.success) return error(`Invalid body: ${parsed.error.message}`, 400);
+        const { id } = await addAnnotation(sql, orgId, {
+          event_id: parsed.data.event_id ?? null,
+          project: params.proj,
+          session: params.sess,
+          participant_id: participantId,
+          kind: parsed.data.kind,
+          value: parsed.data.value ?? null,
+        });
+        return json({ id }, 201);
+      }
+
+      params = matchRoute(method, pathname, "/projects/:proj/sessions/:sess/annotations", "GET");
+      if (params) {
+        const session = await getSession(sql, orgId, params.proj, params.sess);
+        if (!session) return error("Session not found", 404);
+        const annotations = await listSessionAnnotations(sql, orgId, params.proj, params.sess);
+        return json({ annotations });
+      }
+
+      params = matchRoute(method, pathname, "/annotations/:id", "DELETE");
+      if (params) {
+        await deleteAnnotation(sql, orgId, params.id);
+        return json({ ok: true });
+      }
+
+      if (method === "GET" && pathname === "/decisions") {
+        const project = url.searchParams.get("project") ?? undefined;
+        if (project && !(await userCanAccessProject(sql, orgId, project, participantId))) {
+          return error("Forbidden: project is restricted to members", 403);
+        }
+        const limitParam = url.searchParams.get("limit");
+        const parsedLimit = limitParam ? Number.parseInt(limitParam, 10) : NaN;
+        const decisions = await listDecisions(sql, orgId, {
+          project,
+          limit: Number.isFinite(parsedLimit) ? parsedLimit : undefined,
+          participantId,
+        });
+        return json({ decisions });
+      }
+
+      // --- Search ---
+
+      if (method === "GET" && pathname === "/search") {
+        const q = url.searchParams.get("q");
+        if (!q || !q.trim()) return error("q is required", 400);
+        const project = url.searchParams.get("project") ?? undefined;
+        if (project && !(await userCanAccessProject(sql, orgId, project, participantId))) {
+          return error("Forbidden: project is restricted to members", 403);
+        }
+        const limitParam = url.searchParams.get("limit");
+        const parsedLimit = limitParam ? Number.parseInt(limitParam, 10) : NaN;
+        const { results } = await searchEvents(sql, orgId, {
+          q,
+          project,
+          session: url.searchParams.get("session") ?? undefined,
+          sender: url.searchParams.get("sender") ?? undefined,
+          source: url.searchParams.get("source") ?? undefined,
+          tag: url.searchParams.get("tag") ?? undefined,
+          limit: Number.isFinite(parsedLimit) ? parsedLimit : undefined,
+          participantId,
+        });
+        return json({ results });
+      }
+
       // GET /team — list org members with Slack identities
       if (method === "GET" && pathname === "/team") {
         const { listUsers, getOrg: getOrgFn } = await import("./db");