@lobu/gateway 3.0.5 → 3.0.7

package/src/routes/public/agents.ts

@@ -0,0 +1,373 @@
+/**
+ * Agent Management Routes - Create, list, update, and delete user agents
+ *
+ * Routes:
+ * - POST /api/v1/agents - Create a new agent
+ * - GET /api/v1/agents - List user's agents (requires token)
+ * - PATCH /api/v1/agents/{agentId} - Update agent name/description
+ * - DELETE /api/v1/agents/{agentId} - Delete an agent
+ */
+
+import { createLogger } from "@lobu/core";
+import { Hono } from "hono";
+import type { AgentMetadataStore } from "../../auth/agent-metadata-store";
+import type { AgentSettings, AgentSettingsStore } from "../../auth/settings";
+import { buildDefaultSettingsFromSource } from "../../auth/settings/template-utils";
+import type { SettingsTokenPayload } from "../../auth/settings/token-service";
+import type { UserAgentsStore } from "../../auth/user-agents-store";
+import type { ChannelBindingService } from "../../channels";
+import {
+  resolveSettingsLookupUserId,
+  verifyOwnedAgentAccess,
+} from "../shared/agent-ownership";
+import { verifySettingsSession } from "./settings-auth";
+
+const logger = createLogger("agent-routes");
+
+/** Environment-configurable limits */
+const MAX_AGENTS_PER_USER = parseInt(
+  process.env.MAX_AGENTS_PER_USER || "0",
+  10
+);
+
+export interface AgentRoutesConfig {
+  userAgentsStore: UserAgentsStore;
+  agentMetadataStore: AgentMetadataStore;
+  agentSettingsStore: AgentSettingsStore;
+  channelBindingService: ChannelBindingService;
+}
+
+async function listOwnedAgentIds(
+  payload: SettingsTokenPayload,
+  config: Pick<AgentRoutesConfig, "userAgentsStore" | "agentMetadataStore">
+): Promise<string[]> {
+  const lookupUserId = resolveSettingsLookupUserId(payload);
+  const agentIds = new Set(
+    await config.userAgentsStore.listAgents(payload.platform, lookupUserId)
+  );
+
+  if (payload.platform === "external") {
+    const allAgents = await config.agentMetadataStore.listAllAgents();
+    for (const agent of allAgents) {
+      if (agent.owner.userId === lookupUserId) {
+        agentIds.add(agent.agentId);
+      }
+    }
+  }
+
+  return [...agentIds];
+}
+
+/**
+ * Sanitize user-provided agentId.
+ * Lowercase alphanumeric with hyphens, 3-60 chars, must start with a letter.
+ */
+function sanitizeAgentId(input: string): string | null {
+  const cleaned = input.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  if (cleaned.length < 3 || cleaned.length > 60) return null;
+  if (!/^[a-z]/.test(cleaned)) return null;
+  return cleaned;
+}
+
+export function createAgentRoutes(config: AgentRoutesConfig): Hono {
+  const router = new Hono();
+
+  // POST /api/v1/agents - Create a new agent
+  router.post("/", async (c) => {
+    const payload = verifySettingsSession(c);
+    if (!payload) {
+      return c.json({ error: "Invalid or expired token" }, 401);
+    }
+
+    try {
+      const lookupUserId = resolveSettingsLookupUserId(payload);
+      const body = await c.req.json<{
+        agentId: string;
+        name: string;
+        description?: string;
+        channelId?: string;
+      }>();
+
+      if (!body.agentId || !body.name) {
+        return c.json({ error: "agentId and name are required" }, 400);
+      }
+
+      const agentId = sanitizeAgentId(body.agentId);
+      if (!agentId) {
+        return c.json(
+          {
+            error:
+              "Invalid agentId. Must be 3-40 chars, lowercase alphanumeric with hyphens, starting with a letter.",
+          },
+          400
+        );
+      }
+
+      // Check if agentId already exists
+      const existing = await config.agentMetadataStore.hasAgent(agentId);
+      if (existing) {
+        return c.json({ error: "An agent with this ID already exists" }, 409);
+      }
+
+      // Check per-user limit (admins bypass)
+      if (!payload.isAdmin && MAX_AGENTS_PER_USER > 0) {
+        const userAgents = await listOwnedAgentIds(payload, config);
+        if (userAgents.length >= MAX_AGENTS_PER_USER) {
+          return c.json(
+            {
+              error: `Agent limit reached (${MAX_AGENTS_PER_USER}). Delete an existing agent first.`,
+            },
+            429
+          );
+        }
+      }
+
+      // Create metadata
+      await config.agentMetadataStore.createAgent(
+        agentId,
+        body.name,
+        payload.platform,
+        lookupUserId,
+        { description: body.description }
+      );
+
+      // Create default settings, seeded from the current workspace/channel agent when available.
+      let defaultSettings: Omit<AgentSettings, "updatedAt"> = {};
+      try {
+        let sourceAgentId = payload.agentId;
+        if (!sourceAgentId && body.channelId) {
+          const binding = await config.channelBindingService.getBinding(
+            payload.platform,
+            body.channelId,
+            payload.teamId
+          );
+          sourceAgentId = binding?.agentId;
+        }
+
+        if (sourceAgentId) {
+          const sourceSettings =
+            await config.agentSettingsStore.getSettings(sourceAgentId);
+          defaultSettings = buildDefaultSettingsFromSource(sourceSettings);
+        }
+      } catch (error) {
+        logger.warn("Failed to derive source defaults for new agent", {
+          error,
+        });
+      }
+      await config.agentSettingsStore.saveSettings(agentId, defaultSettings);
+
+      // Associate with user
+      await config.userAgentsStore.addAgent(
+        payload.platform,
+        lookupUserId,
+        agentId
+      );
+
+      // Auto-bind to channel if channelId provided (from session context)
+      if (body.channelId) {
+        await config.channelBindingService.createBinding(
+          agentId,
+          payload.platform,
+          body.channelId,
+          payload.teamId,
+          { configuredBy: payload.userId }
+        );
+      }
+
+      logger.info(
+        `Created agent ${agentId} for user ${payload.platform}/${payload.userId}${body.channelId ? ` (bound to ${body.channelId})` : ""}`
+      );
+
+      return c.json({
+        agentId,
+        name: body.name,
+        settingsUrl: `/api/v1/agents/${encodeURIComponent(agentId)}/config`,
+      });
+    } catch (error) {
+      logger.error("Failed to create agent", { error });
+      return c.json(
+        {
+          error: "Internal server error",
+        },
+        500
+      );
+    }
+  });
+
+  // GET /api/v1/agents - List user's agents
+  router.get("/", async (c) => {
+    const payload = verifySettingsSession(c);
+    if (!payload) {
+      return c.json({ error: "Invalid or expired token" }, 401);
+    }
+
+    try {
+      const agentIds = await listOwnedAgentIds(payload, config);
+
+      const agents = [];
+      for (const agentId of agentIds) {
+        const metadata = await config.agentMetadataStore.getMetadata(agentId);
+        if (metadata) {
+          // Skip sandbox agents (auto-created under a connection)
+          if (metadata.parentConnectionId) continue;
+
+          const bindings =
+            await config.channelBindingService.listBindings(agentId);
+          agents.push({
+            agentId,
+            name: metadata.name,
+            description: metadata.description,
+            isWorkspaceAgent: metadata.isWorkspaceAgent,
+            createdAt: metadata.createdAt,
+            lastUsedAt: metadata.lastUsedAt,
+            channelCount: bindings.length,
+          });
+        }
+      }
+
+      return c.json({ agents });
+    } catch (error) {
+      logger.error("Failed to list agents", { error });
+      return c.json({ error: "Failed to list agents" }, 500);
+    }
+  });
+
+  // PATCH /api/v1/agents/{agentId} - Update agent name/description
+  router.patch("/:agentId", async (c) => {
+    const payload = verifySettingsSession(c);
+    if (!payload) {
+      return c.json({ error: "Invalid or expired token" }, 401);
+    }
+
+    const agentId = c.req.param("agentId");
+    if (!agentId) {
+      return c.json({ error: "Missing agentId" }, 400);
+    }
+
+    try {
+      // Verify ownership (admins bypass)
+      if (!payload.isAdmin) {
+        const access = await verifyOwnedAgentAccess(payload, agentId, {
+          userAgentsStore: config.userAgentsStore,
+          agentMetadataStore: config.agentMetadataStore,
+        });
+        if (!access.authorized) {
+          return c.json({ error: "Agent not found or not owned by you" }, 404);
+        }
+      }
+
+      const body = await c.req.json<{ name?: string; description?: string }>();
+      const updates: { name?: string; description?: string } = {};
+
+      if (body.name !== undefined) {
+        const name = body.name.trim();
+        if (!name || name.length > 100) {
+          return c.json({ error: "Name must be 1-100 characters" }, 400);
+        }
+        updates.name = name;
+      }
+
+      if (body.description !== undefined) {
+        const desc = body.description.trim();
+        if (desc.length > 200) {
+          return c.json(
+            { error: "Description must be at most 200 characters" },
+            400
+          );
+        }
+        updates.description = desc;
+      }
+
+      if (Object.keys(updates).length === 0) {
+        return c.json({ error: "No fields to update" }, 400);
+      }
+
+      await config.agentMetadataStore.updateMetadata(agentId, updates);
+      logger.info(`Updated agent identity for ${agentId}`);
+      return c.json({ success: true });
+    } catch (error) {
+      logger.error("Failed to update agent", { error, agentId });
+      return c.json(
+        {
+          error: "Internal server error",
+        },
+        500
+      );
+    }
+  });
+
+  // DELETE /api/v1/agents/{agentId} - Delete an agent
+  router.delete("/:agentId", async (c) => {
+    const payload = verifySettingsSession(c);
+    if (!payload) {
+      return c.json({ error: "Invalid or expired token" }, 401);
+    }
+
+    const agentId = c.req.param("agentId");
+    if (!agentId) {
+      return c.json({ error: "Missing agentId" }, 400);
+    }
+
+    try {
+      // Verify ownership (admins bypass)
+      let ownerPlatform: string | undefined;
+      let ownerUserId: string | undefined;
+      if (!payload.isAdmin) {
+        const access = await verifyOwnedAgentAccess(payload, agentId, {
+          userAgentsStore: config.userAgentsStore,
+          agentMetadataStore: config.agentMetadataStore,
+        });
+        if (!access.authorized) {
+          return c.json({ error: "Agent not found or not owned by you" }, 404);
+        }
+        ownerPlatform = access.ownerPlatform;
+        ownerUserId = access.ownerUserId;
+      }
+
+      // Auto-unbind all channels
+      const unboundCount =
+        await config.channelBindingService.deleteAllBindings(agentId);
+
+      // Delete settings
+      await config.agentSettingsStore.deleteSettings(agentId);
+
+      // Delete metadata
+      await config.agentMetadataStore.deleteAgent(agentId);
+
+      // Remove from user's list
+      await config.userAgentsStore.removeAgent(
+        payload.platform,
+        resolveSettingsLookupUserId(payload),
+        agentId
+      );
+      if (
+        ownerPlatform &&
+        ownerUserId &&
+        (ownerPlatform !== payload.platform || ownerUserId !== payload.userId)
+      ) {
+        await config.userAgentsStore.removeAgent(
+          ownerPlatform,
+          ownerUserId,
+          agentId
+        );
+      }
+
+      logger.info(
+        `Deleted agent ${agentId} (unbound ${unboundCount} channels)`
+      );
+
+      return c.json({ success: true, unboundChannels: unboundCount });
+    } catch (error) {
+      logger.error("Failed to delete agent", { error, agentId });
+      return c.json(
+        {
+          error: "Internal server error",
+        },
+        500
+      );
+    }
+  });
+
+  logger.debug("Agent management routes registered");
+  return router;
+}

package/src/routes/public/channels.ts

@@ -0,0 +1,191 @@
+/**
+ * Channel Binding Routes - Manage channel-to-agent bindings
+ *
+ * Routes (under /api/v1/agents/{agentId}/channels):
+ * - GET / - List all bindings for an agent
+ * - POST / - Create a new binding
+ * - DELETE /{platform}/{channelId} - Delete a binding
+ */
+
+import { createLogger } from "@lobu/core";
+import { Hono } from "hono";
+import type { AgentMetadataStore } from "../../auth/agent-metadata-store";
+import type { UserAgentsStore } from "../../auth/user-agents-store";
+import type { ChannelBindingService } from "../../channels";
+import { createTokenVerifier } from "../shared/token-verifier";
+import { verifySettingsSession } from "./settings-auth";
+
+const logger = createLogger("channel-binding-routes");
+
+export interface ChannelBindingRoutesConfig {
+  channelBindingService: ChannelBindingService;
+  userAgentsStore?: UserAgentsStore;
+  agentMetadataStore?: AgentMetadataStore;
+}
+
+/**
+ * Create channel binding routes
+ * These are mounted under /api/v1/agents/{agentId}/channels
+ */
+export function createChannelBindingRoutes(
+  config: ChannelBindingRoutesConfig
+): Hono {
+  const router = new Hono();
+
+  const verifyToken = createTokenVerifier(config);
+
+  const verifyAuth = async (c: any, agentId: string) => {
+    return verifyToken(verifySettingsSession(c), agentId);
+  };
+
+  // GET /api/v1/agents/{agentId}/channels - List all bindings for an agent
+  router.get("/", async (c) => {
+    const agentId = c.req.param("agentId");
+
+    if (!agentId) {
+      return c.json({ error: "Missing agentId" }, 400);
+    }
+
+    if (!(await verifyAuth(c, agentId))) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
+
+    try {
+      const bindings = await config.channelBindingService.listBindings(agentId);
+
+      return c.json({
+        agentId,
+        bindings: bindings.map((b) => ({
+          platform: b.platform,
+          channelId: b.channelId,
+          teamId: b.teamId,
+          createdAt: b.createdAt,
+        })),
+      });
+    } catch (error) {
+      logger.error("Failed to list bindings", { error, agentId });
+      return c.json({ error: "Failed to list bindings" }, 500);
+    }
+  });
+
+  // POST /api/v1/agents/{agentId}/channels - Create a new binding
+  router.post("/", async (c) => {
+    const agentId = c.req.param("agentId");
+
+    if (!agentId) {
+      return c.json({ error: "Missing agentId" }, 400);
+    }
+
+    const authPayload = await verifyAuth(c, agentId);
+    if (!authPayload) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
+
+    try {
+      const body = await c.req.json<{
+        platform: string;
+        channelId: string;
+        teamId?: string;
+      }>();
+
+      // Validate required fields
+      if (!body.platform || !body.channelId) {
+        return c.json(
+          { error: "Missing required fields: platform, channelId" },
+          400
+        );
+      }
+
+      // Validate platform format (alphanumeric, lowercase)
+      if (!/^[a-z][a-z0-9_-]*$/.test(body.platform)) {
+        return c.json(
+          { error: "Invalid platform format. Must be lowercase alphanumeric." },
+          400
+        );
+      }
+
+      // Validate channelId format
+      if (typeof body.channelId !== "string" || !body.channelId.trim()) {
+        return c.json({ error: "Invalid channelId" }, 400);
+      }
+
+      // Validate optional teamId
+      if (
+        body.teamId &&
+        (typeof body.teamId !== "string" || !body.teamId.trim())
+      ) {
+        return c.json({ error: "Invalid teamId" }, 400);
+      }
+
+      await config.channelBindingService.createBinding(
+        agentId,
+        body.platform,
+        body.channelId.trim(),
+        body.teamId?.trim(),
+        { configuredBy: authPayload.userId }
+      );
+
+      logger.info(
+        `Created binding: ${body.platform}/${body.channelId} -> ${agentId}`
+      );
+
+      return c.json({
+        success: true,
+        agentId,
+        platform: body.platform,
+        channelId: body.channelId,
+        teamId: body.teamId,
+      });
+    } catch (error) {
+      logger.error("Failed to create binding", { error, agentId });
+      return c.json(
+        {
+          error: "Failed to create binding",
+        },
+        400
+      );
+    }
+  });
+
+  // DELETE /api/v1/agents/{agentId}/channels/{platform}/{channelId} - Delete a binding
+  router.delete("/:platform/:channelId", async (c) => {
+    const agentId = c.req.param("agentId");
+    const platform = c.req.param("platform");
+    const channelId = c.req.param("channelId");
+    const teamId = c.req.query("teamId"); // Optional query param for multi-tenant platforms
+
+    if (!agentId || !platform || !channelId) {
+      return c.json({ error: "Missing required parameters" }, 400);
+    }
+
+    if (!(await verifyAuth(c, agentId))) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
+
+    // Validate platform format
+    if (!/^[a-z][a-z0-9_-]*$/.test(platform)) {
+      return c.json({ error: "Invalid platform format" }, 400);
+    }
+
+    try {
+      const deleted = await config.channelBindingService.deleteBinding(
+        agentId,
+        platform,
+        channelId,
+        teamId || undefined
+      );
+
+      if (!deleted) {
+        return c.json({ error: "Binding not found" }, 404);
+      }
+
+      logger.info(`Deleted binding: ${platform}/${channelId} -> ${agentId}`);
+      return c.json({ success: true });
+    } catch (error) {
+      logger.error("Failed to delete binding", { error, agentId });
+      return c.json({ error: "Failed to delete binding" }, 500);
+    }
+  });
+
+  return router;
+}