@lobu/gateway 3.0.5 → 3.0.6

package/src/auth/settings/auth-profiles-manager.ts

@@ -0,0 +1,216 @@
+import { type AuthProfile, createLogger } from "@lobu/core";
+import type { AgentSettingsStore } from "./agent-settings-store";
+
+const logger = createLogger("auth-profiles-manager");
+
+const ANY_MODEL_SCOPE = "*";
+
+export interface UpsertAuthProfileInput {
+  agentId: string;
+  provider: string;
+  credential: string;
+  authType: AuthProfile["authType"];
+  label: string;
+  model?: string;
+  metadata?: AuthProfile["metadata"];
+  makePrimary?: boolean;
+  id?: string;
+}
+
+export class AuthProfilesManager {
+  constructor(private readonly agentSettingsStore: AgentSettingsStore) {}
+
+  async listProfiles(agentId: string): Promise<AuthProfile[]> {
+    const settings =
+      await this.agentSettingsStore.getEffectiveSettings(agentId);
+    return this.normalizeProfiles(settings?.authProfiles);
+  }
+
+  async hasProviderProfiles(
+    agentId: string,
+    provider: string
+  ): Promise<boolean> {
+    const profiles = await this.listProfiles(agentId);
+    return profiles.some((profile) => profile.provider === provider);
+  }
+
+  async getProviderProfiles(
+    agentId: string,
+    provider: string
+  ): Promise<AuthProfile[]> {
+    const profiles = await this.listProfiles(agentId);
+    return profiles.filter((profile) => profile.provider === provider);
+  }
+
+  async getBestProfile(
+    agentId: string,
+    provider: string,
+    model?: string
+  ): Promise<AuthProfile | null> {
+    const providerProfiles = await this.getProviderProfiles(agentId, provider);
+    if (providerProfiles.length === 0) {
+      return null;
+    }
+
+    const now = Date.now();
+    const validProfiles = providerProfiles.filter((profile) => {
+      const expiresAt = profile.metadata?.expiresAt;
+      return !expiresAt || expiresAt > now;
+    });
+
+    if (validProfiles.length === 0) {
+      logger.warn(
+        { agentId, provider, profileCount: providerProfiles.length },
+        "All auth profiles for provider are expired"
+      );
+      return null;
+    }
+
+    const candidates = validProfiles;
+    if (!model) {
+      return candidates[0] || null;
+    }
+
+    const exact = candidates.find((profile) => profile.model === model);
+    if (exact) return exact;
+
+    const wildcard = candidates.find(
+      (profile) => profile.model === ANY_MODEL_SCOPE
+    );
+    return wildcard || candidates[0] || null;
+  }
+
+  async upsertProfile(input: UpsertAuthProfileInput): Promise<AuthProfile> {
+    const settings = await this.agentSettingsStore.getSettings(input.agentId);
+    const current = this.normalizeProfiles(settings?.authProfiles);
+    const modelScope = input.model?.trim() || ANY_MODEL_SCOPE;
+
+    const nextProfile: AuthProfile = {
+      id: input.id || crypto.randomUUID(),
+      provider: input.provider,
+      credential: input.credential,
+      authType: input.authType,
+      label: input.label,
+      model: modelScope,
+      metadata: input.metadata,
+      createdAt: Date.now(),
+    };
+
+    let replaced = false;
+    const withoutExisting = current.filter((profile) => {
+      if (input.id && profile.id === input.id) {
+        replaced = true;
+        nextProfile.createdAt = profile.createdAt;
+        return false;
+      }
+      return true;
+    });
+
+    if (!input.id) {
+      const existingPrimary = withoutExisting.find(
+        (profile) =>
+          profile.provider === input.provider && profile.model === modelScope
+      );
+      if (existingPrimary) {
+        replaced = true;
+        nextProfile.createdAt = existingPrimary.createdAt;
+      }
+    }
+
+    const withoutSameScope = withoutExisting.filter(
+      (profile) =>
+        !(
+          profile.provider === input.provider &&
+          profile.model === modelScope &&
+          (!input.id || profile.id !== input.id)
+        )
+    );
+
+    const nextProfiles: AuthProfile[] = [];
+    const providerProfiles: AuthProfile[] = [];
+    const otherProfiles: AuthProfile[] = [];
+
+    for (const profile of withoutSameScope) {
+      if (profile.provider === input.provider) {
+        providerProfiles.push(profile);
+      } else {
+        otherProfiles.push(profile);
+      }
+    }
+
+    if (input.makePrimary !== false) {
+      nextProfiles.push(nextProfile, ...providerProfiles, ...otherProfiles);
+    } else {
+      nextProfiles.push(...providerProfiles, nextProfile, ...otherProfiles);
+    }
+
+    await this.agentSettingsStore.updateSettings(input.agentId, {
+      authProfiles: nextProfiles,
+    });
+
+    logger.info(
+      {
+        agentId: input.agentId,
+        provider: input.provider,
+        profileId: nextProfile.id,
+        replaced,
+      },
+      "Saved auth profile"
+    );
+
+    return nextProfile;
+  }
+
+  async deleteProviderProfiles(
+    agentId: string,
+    provider: string,
+    profileId?: string
+  ): Promise<void> {
+    const settings = await this.agentSettingsStore.getSettings(agentId);
+    const current = this.normalizeProfiles(settings?.authProfiles);
+    const filtered = current.filter((profile) => {
+      if (profile.provider !== provider) return true;
+      if (!profileId) return false;
+      return profile.id !== profileId;
+    });
+
+    await this.agentSettingsStore.updateSettings(agentId, {
+      authProfiles: filtered,
+    });
+
+    logger.info(
+      { agentId, provider, profileId: profileId || "all" },
+      "Deleted auth profiles"
+    );
+  }
+
+  private normalizeProfiles(
+    profiles: AuthProfile[] | undefined
+  ): AuthProfile[] {
+    if (!Array.isArray(profiles)) return [];
+    return profiles.filter(
+      (profile) =>
+        typeof profile?.id === "string" &&
+        typeof profile?.provider === "string" &&
+        typeof profile?.credential === "string" &&
+        typeof profile?.authType === "string"
+    );
+  }
+}
+
+export function createAuthProfileLabel(
+  providerDisplayName: string,
+  credential: string,
+  accountHint?: string
+): string {
+  if (accountHint?.trim()) {
+    return accountHint.trim();
+  }
+
+  const trimmed = credential.trim();
+  if (trimmed.length <= 8) {
+    return `${providerDisplayName} key`;
+  }
+
+  return `${providerDisplayName} ${trimmed.slice(0, 4)}...${trimmed.slice(-4)}`;
+}

package/src/auth/settings/index.ts

@@ -0,0 +1,12 @@
+export { type AgentSettings, AgentSettingsStore } from "./agent-settings-store";
+export {
+  AuthProfilesManager,
+  createAuthProfileLabel,
+  type UpsertAuthProfileInput,
+} from "./auth-profiles-manager";
+export type {
+  PrefillMcpServer,
+  PrefillSkill,
+  SettingsSourceContext,
+  SettingsTokenPayload,
+} from "./token-service";

package/src/auth/settings/model-preference-store.ts

@@ -0,0 +1,52 @@
+import { BaseRedisStore } from "@lobu/core";
+import type Redis from "ioredis";
+
+/**
+ * Store and retrieve user's model preference from Redis
+ * Pattern: {providerId}:model_preference:{userId}
+ */
+export class ModelPreferenceStore extends BaseRedisStore<string> {
+  constructor(redis: Redis, providerId: string) {
+    super({
+      redis,
+      keyPrefix: `${providerId}:model_preference`,
+      loggerName: `${providerId}-model-preference`,
+    });
+  }
+
+  /**
+   * Set user's model preference
+   */
+  async setModelPreference(userId: string, model: string): Promise<void> {
+    const key = this.buildKey(userId);
+    await this.set(key, model);
+    this.logger.info(`Set model preference for user ${userId}: ${model}`);
+  }
+
+  /**
+   * Get user's model preference
+   * Returns null if no preference is set
+   */
+  async getModelPreference(userId: string): Promise<string | null> {
+    const key = this.buildKey(userId);
+    return this.get(key);
+  }
+
+  /**
+   * Delete user's model preference
+   */
+  async deleteModelPreference(userId: string): Promise<void> {
+    const key = this.buildKey(userId);
+    await this.delete(key);
+    this.logger.info(`Deleted model preference for user ${userId}`);
+  }
+
+  // Override serialize/deserialize for simple string values
+  protected override serialize(value: string): string {
+    return value; // Store as plain string, not JSON
+  }
+
+  protected override deserialize(data: string): string {
+    return data; // Return as plain string
+  }
+}

package/src/auth/settings/model-selection.ts

@@ -0,0 +1,135 @@
+import type { AgentSettings } from "./agent-settings-store";
+
+export type ModelSelectionMode = "auto" | "pinned";
+
+export interface ModelSelectionState {
+  mode: ModelSelectionMode;
+  pinnedModel?: string;
+}
+
+export type ProviderModelPreferences = Record<string, string>;
+
+function normalizePreferenceMap(
+  map: ProviderModelPreferences | undefined
+): ProviderModelPreferences {
+  const normalized: ProviderModelPreferences = {};
+  for (const [providerId, modelRef] of Object.entries(map || {})) {
+    const cleanProviderId = providerId.trim();
+    const cleanModelRef = modelRef.trim();
+    if (!cleanProviderId || !cleanModelRef) continue;
+    normalized[cleanProviderId] = cleanModelRef;
+  }
+  return normalized;
+}
+
+function extractProviderIdFromModelRef(
+  modelRef: string | undefined
+): string | undefined {
+  const clean = modelRef?.trim();
+  if (!clean) return undefined;
+  const slashIndex = clean.indexOf("/");
+  if (slashIndex <= 0) return undefined;
+  return clean.slice(0, slashIndex);
+}
+
+export function getModelSelectionState(
+  settings: Pick<AgentSettings, "model" | "modelSelection"> | null | undefined
+): ModelSelectionState {
+  const mode = settings?.modelSelection?.mode;
+  const explicitPinnedModel = settings?.modelSelection?.pinnedModel?.trim();
+  const legacyModel = settings?.model?.trim();
+
+  if (mode === "auto") {
+    return { mode: "auto" };
+  }
+
+  if (mode === "pinned" && explicitPinnedModel) {
+    return { mode: "pinned", pinnedModel: explicitPinnedModel };
+  }
+
+  if (legacyModel) {
+    return { mode: "pinned", pinnedModel: legacyModel };
+  }
+
+  return { mode: "auto" };
+}
+
+export function resolveEffectiveModelRef(
+  settings:
+    | Pick<
+        AgentSettings,
+        | "model"
+        | "modelSelection"
+        | "installedProviders"
+        | "providerModelPreferences"
+      >
+    | null
+    | undefined
+): string | undefined {
+  if (!settings) return undefined;
+
+  const state = getModelSelectionState(settings);
+  const installedProviderIds = new Set(
+    (settings.installedProviders || []).map((p) => p.providerId)
+  );
+
+  if (state.mode === "pinned" && state.pinnedModel) {
+    const pinnedProviderId = extractProviderIdFromModelRef(state.pinnedModel);
+    if (pinnedProviderId && installedProviderIds.has(pinnedProviderId)) {
+      return state.pinnedModel;
+    }
+  }
+
+  const primaryProviderId = settings.installedProviders?.[0]?.providerId;
+  if (!primaryProviderId) return undefined;
+
+  const preferences = normalizePreferenceMap(settings.providerModelPreferences);
+  return preferences[primaryProviderId];
+}
+
+export function reconcileModelSelectionForInstalledProviders(
+  settings: Pick<
+    AgentSettings,
+    | "model"
+    | "modelSelection"
+    | "installedProviders"
+    | "providerModelPreferences"
+  >
+): Pick<
+  AgentSettings,
+  "model" | "modelSelection" | "providerModelPreferences"
+> {
+  const installedProviderIds = new Set(
+    (settings.installedProviders || []).map((p) => p.providerId)
+  );
+  const currentState = getModelSelectionState(settings);
+  const normalizedPrefs = normalizePreferenceMap(
+    settings.providerModelPreferences
+  );
+  const filteredPrefs: ProviderModelPreferences = {};
+
+  for (const [providerId, modelRef] of Object.entries(normalizedPrefs)) {
+    if (installedProviderIds.has(providerId)) {
+      filteredPrefs[providerId] = modelRef;
+    }
+  }
+
+  const pinnedProviderId = extractProviderIdFromModelRef(
+    currentState.pinnedModel
+  );
+  const hasPinnedProvider =
+    currentState.mode === "pinned" &&
+    !!pinnedProviderId &&
+    installedProviderIds.has(pinnedProviderId);
+
+  const nextState: ModelSelectionState = hasPinnedProvider
+    ? { mode: "pinned", pinnedModel: currentState.pinnedModel }
+    : { mode: "auto" };
+
+  return {
+    modelSelection: nextState,
+    model: nextState.mode === "pinned" ? nextState.pinnedModel : undefined,
+    providerModelPreferences:
+      Object.keys(filteredPrefs).length > 0 ? filteredPrefs : undefined,
+  };
+}

package/src/auth/settings/resolved-settings-view.ts

@@ -0,0 +1,298 @@
+import type { AgentMetadataStore } from "../agent-metadata-store";
+import type {
+  AgentSettings,
+  AgentSettingsContext,
+  AgentSettingsStore,
+} from "./agent-settings-store";
+
+export const SETTINGS_SECTION_KEYS = [
+  "model",
+  "system-prompt",
+  "skills",
+  "packages",
+  "permissions",
+  "schedules",
+  "logging",
+] as const;
+
+export type SettingsSectionKey = (typeof SETTINGS_SECTION_KEYS)[number];
+export type SettingsScope = "agent" | "sandbox";
+export type SettingsSource = "local" | "inherited" | "mixed";
+
+export interface ResolvedSectionView {
+  source: SettingsSource;
+  editable: boolean;
+  canReset: boolean;
+  hasLocalOverride: boolean;
+}
+
+export interface ResolvedProviderView {
+  id: string;
+  source: SettingsSource;
+  canEdit: boolean;
+  canReset: boolean;
+  hasLocalOverride: boolean;
+}
+
+export interface ResolvedSettingsView {
+  agentId: string;
+  scope: SettingsScope;
+  isSandbox: boolean;
+  templateAgentId?: string;
+  templateAgentName?: string;
+  localSettings: AgentSettings | null;
+  effectiveSettings: AgentSettings | null;
+  sections: Record<SettingsSectionKey, ResolvedSectionView>;
+  providerSources: Record<string, ResolvedProviderView>;
+}
+
+export interface ResolvedSettingsViewer {
+  settingsMode?: "admin" | "user";
+  allowedScopes?: string[];
+  isAdmin?: boolean;
+}
+
+export interface ResolvedSettingsViewInput {
+  agentId: string;
+  agentSettingsStore: AgentSettingsStore;
+  agentMetadataStore?: AgentMetadataStore;
+  viewer?: ResolvedSettingsViewer;
+}
+
+const SECTION_SETTING_KEYS: Record<
+  Exclude<SettingsSectionKey, "permissions" | "schedules">,
+  Array<keyof AgentSettings>
+> = {
+  model: [
+    "installedProviders",
+    "authProfiles",
+    "model",
+    "modelSelection",
+    "providerModelPreferences",
+  ],
+  "system-prompt": ["identityMd", "soulMd", "userMd"],
+  skills: ["skillsConfig", "mcpServers", "pluginsConfig"],
+  packages: ["nixConfig"],
+  logging: ["verboseLogging"],
+};
+
+function hasOwnSetting(
+  settings: AgentSettings | null | undefined,
+  key: keyof AgentSettings
+): boolean {
+  return !!settings && Object.hasOwn(settings, key);
+}
+
+function sectionHasLocalOverride(
+  section: SettingsSectionKey,
+  localSettings: AgentSettings | null | undefined
+): boolean {
+  if (section === "permissions" || section === "schedules") {
+    return false;
+  }
+  return SECTION_SETTING_KEYS[section].some((key) =>
+    hasOwnSetting(localSettings, key)
+  );
+}
+
+function sectionHasTemplateValue(
+  section: SettingsSectionKey,
+  templateSettings: AgentSettings | null | undefined
+): boolean {
+  if (section === "permissions" || section === "schedules") {
+    return false;
+  }
+  return SECTION_SETTING_KEYS[section].some((key) =>
+    hasOwnSetting(templateSettings, key)
+  );
+}
+
+export function canViewSettingsSection(
+  section: SettingsSectionKey,
+  viewer?: ResolvedSettingsViewer
+): boolean {
+  if (!viewer || viewer.isAdmin || viewer.settingsMode === "admin") {
+    return true;
+  }
+
+  const allowedScopes = viewer.allowedScopes || [];
+  if (section === "model") {
+    return (
+      allowedScopes.includes("model") || allowedScopes.includes("view-model")
+    );
+  }
+
+  if (allowedScopes.includes(section)) {
+    return true;
+  }
+
+  if (section === "skills") {
+    return (
+      allowedScopes.includes("tools") || allowedScopes.includes("mcp-servers")
+    );
+  }
+
+  if (section === "permissions" || section === "packages") {
+    return allowedScopes.includes("tools");
+  }
+
+  return false;
+}
+
+export function canEditSettingsSection(
+  section: SettingsSectionKey,
+  viewer?: ResolvedSettingsViewer
+): boolean {
+  if (!viewer || viewer.isAdmin || viewer.settingsMode === "admin") {
+    return true;
+  }
+
+  const allowedScopes = viewer.allowedScopes || [];
+  if (section === "model") {
+    return allowedScopes.includes("model");
+  }
+
+  if (allowedScopes.includes(section)) {
+    return true;
+  }
+
+  if (section === "skills") {
+    return (
+      allowedScopes.includes("tools") || allowedScopes.includes("mcp-servers")
+    );
+  }
+
+  if (section === "permissions" || section === "packages") {
+    return allowedScopes.includes("tools");
+  }
+
+  return false;
+}
+
+function resolveSectionSource(
+  isSandbox: boolean,
+  hasLocalOverride: boolean,
+  hasTemplateValue: boolean
+): SettingsSource {
+  if (!isSandbox) return "local";
+  if (!hasLocalOverride && hasTemplateValue) return "inherited";
+  if (hasLocalOverride && hasTemplateValue) return "mixed";
+  return "local";
+}
+
+function resolveProviderSources(
+  context: AgentSettingsContext,
+  templateSettings: AgentSettings | null,
+  viewer?: ResolvedSettingsViewer
+): Record<string, ResolvedProviderView> {
+  const effectiveSettings = context.effectiveSettings;
+  const localSettings = context.localSettings;
+  const isSandbox = !!context.templateAgentId;
+
+  const effectiveProviderIds = (
+    effectiveSettings?.installedProviders || []
+  ).map((provider) => provider.providerId);
+  const localProviderIds = new Set(
+    (localSettings?.installedProviders || []).map(
+      (provider) => provider.providerId
+    )
+  );
+  const localProfileProviders = new Set(
+    (localSettings?.authProfiles || []).map((profile) => profile.provider)
+  );
+  const localPreferenceProviders = new Set(
+    Object.keys(localSettings?.providerModelPreferences || {})
+  );
+  const templateProviderIds = new Set(
+    (templateSettings?.installedProviders || []).map(
+      (provider) => provider.providerId
+    )
+  );
+
+  return Object.fromEntries(
+    effectiveProviderIds.map((providerId) => {
+      const hasLocalOverride =
+        localProviderIds.has(providerId) ||
+        localProfileProviders.has(providerId) ||
+        localPreferenceProviders.has(providerId);
+
+      const source = resolveSectionSource(
+        isSandbox,
+        hasLocalOverride,
+        templateProviderIds.has(providerId)
+      );
+
+      return [
+        providerId,
+        {
+          id: providerId,
+          source,
+          canEdit: canEditSettingsSection("model", viewer),
+          canReset: isSandbox && hasLocalOverride,
+          hasLocalOverride,
+        } satisfies ResolvedProviderView,
+      ];
+    })
+  );
+}
+
+export async function resolveSettingsView(
+  input: ResolvedSettingsViewInput
+): Promise<ResolvedSettingsView> {
+  const context = await input.agentSettingsStore.getSettingsContext(
+    input.agentId
+  );
+  const templateAgentName =
+    context.templateAgentId && input.agentMetadataStore
+      ? (await input.agentMetadataStore.getMetadata(context.templateAgentId))
+          ?.name
+      : undefined;
+
+  const templateSettings = context.templateAgentId
+    ? await input.agentSettingsStore.getSettings(context.templateAgentId)
+    : null;
+  const isSandbox = !!context.templateAgentId;
+
+  const sections = Object.fromEntries(
+    SETTINGS_SECTION_KEYS.map((section) => {
+      const hasLocalOverride = sectionHasLocalOverride(
+        section,
+        context.localSettings
+      );
+      const hasTemplateValue = sectionHasTemplateValue(
+        section,
+        templateSettings
+      );
+
+      return [
+        section,
+        {
+          source: resolveSectionSource(
+            isSandbox,
+            hasLocalOverride,
+            hasTemplateValue
+          ),
+          editable: canEditSettingsSection(section, input.viewer),
+          canReset: isSandbox && hasLocalOverride,
+          hasLocalOverride,
+        } satisfies ResolvedSectionView,
+      ];
+    })
+  ) as Record<SettingsSectionKey, ResolvedSectionView>;
+
+  return {
+    agentId: input.agentId,
+    scope: isSandbox ? "sandbox" : "agent",
+    isSandbox,
+    templateAgentId: context.templateAgentId,
+    templateAgentName,
+    localSettings: context.localSettings,
+    effectiveSettings: context.effectiveSettings,
+    sections,
+    providerSources: resolveProviderSources(
+      context,
+      templateSettings,
+      input.viewer
+    ),
+  };
+}