@lobu/gateway 3.0.9 → 3.0.12

package/src/routes/public/agents.ts

@@ -1,373 +0,0 @@
-/**
- * Agent Management Routes - Create, list, update, and delete user agents
- *
- * Routes:
- * - POST /api/v1/agents - Create a new agent
- * - GET /api/v1/agents - List user's agents (requires token)
- * - PATCH /api/v1/agents/{agentId} - Update agent name/description
- * - DELETE /api/v1/agents/{agentId} - Delete an agent
- */
-
-import { createLogger } from "@lobu/core";
-import { Hono } from "hono";
-import type { AgentMetadataStore } from "../../auth/agent-metadata-store";
-import type { AgentSettings, AgentSettingsStore } from "../../auth/settings";
-import { buildDefaultSettingsFromSource } from "../../auth/settings/template-utils";
-import type { SettingsTokenPayload } from "../../auth/settings/token-service";
-import type { UserAgentsStore } from "../../auth/user-agents-store";
-import type { ChannelBindingService } from "../../channels";
-import {
-  resolveSettingsLookupUserId,
-  verifyOwnedAgentAccess,
-} from "../shared/agent-ownership";
-import { verifySettingsSession } from "./settings-auth";
-
-const logger = createLogger("agent-routes");
-
-/** Environment-configurable limits */
-const MAX_AGENTS_PER_USER = parseInt(
-  process.env.MAX_AGENTS_PER_USER || "0",
-  10
-);
-
-export interface AgentRoutesConfig {
-  userAgentsStore: UserAgentsStore;
-  agentMetadataStore: AgentMetadataStore;
-  agentSettingsStore: AgentSettingsStore;
-  channelBindingService: ChannelBindingService;
-}
-
-async function listOwnedAgentIds(
-  payload: SettingsTokenPayload,
-  config: Pick<AgentRoutesConfig, "userAgentsStore" | "agentMetadataStore">
-): Promise<string[]> {
-  const lookupUserId = resolveSettingsLookupUserId(payload);
-  const agentIds = new Set(
-    await config.userAgentsStore.listAgents(payload.platform, lookupUserId)
-  );
-
-  if (payload.platform === "external") {
-    const allAgents = await config.agentMetadataStore.listAllAgents();
-    for (const agent of allAgents) {
-      if (agent.owner.userId === lookupUserId) {
-        agentIds.add(agent.agentId);
-      }
-    }
-  }
-
-  return [...agentIds];
-}
-
-/**
- * Sanitize user-provided agentId.
- * Lowercase alphanumeric with hyphens, 3-60 chars, must start with a letter.
- */
-function sanitizeAgentId(input: string): string | null {
-  const cleaned = input.toLowerCase().replace(/[^a-z0-9-]/g, "-");
-  if (cleaned.length < 3 || cleaned.length > 60) return null;
-  if (!/^[a-z]/.test(cleaned)) return null;
-  return cleaned;
-}
-
-export function createAgentRoutes(config: AgentRoutesConfig): Hono {
-  const router = new Hono();
-
-  // POST /api/v1/agents - Create a new agent
-  router.post("/", async (c) => {
-    const payload = verifySettingsSession(c);
-    if (!payload) {
-      return c.json({ error: "Invalid or expired token" }, 401);
-    }
-
-    try {
-      const lookupUserId = resolveSettingsLookupUserId(payload);
-      const body = await c.req.json<{
-        agentId: string;
-        name: string;
-        description?: string;
-        channelId?: string;
-      }>();
-
-      if (!body.agentId || !body.name) {
-        return c.json({ error: "agentId and name are required" }, 400);
-      }
-
-      const agentId = sanitizeAgentId(body.agentId);
-      if (!agentId) {
-        return c.json(
-          {
-            error:
-              "Invalid agentId. Must be 3-40 chars, lowercase alphanumeric with hyphens, starting with a letter.",
-          },
-          400
-        );
-      }
-
-      // Check if agentId already exists
-      const existing = await config.agentMetadataStore.hasAgent(agentId);
-      if (existing) {
-        return c.json({ error: "An agent with this ID already exists" }, 409);
-      }
-
-      // Check per-user limit (admins bypass)
-      if (!payload.isAdmin && MAX_AGENTS_PER_USER > 0) {
-        const userAgents = await listOwnedAgentIds(payload, config);
-        if (userAgents.length >= MAX_AGENTS_PER_USER) {
-          return c.json(
-            {
-              error: `Agent limit reached (${MAX_AGENTS_PER_USER}). Delete an existing agent first.`,
-            },
-            429
-          );
-        }
-      }
-
-      // Create metadata
-      await config.agentMetadataStore.createAgent(
-        agentId,
-        body.name,
-        payload.platform,
-        lookupUserId,
-        { description: body.description }
-      );
-
-      // Create default settings, seeded from the current workspace/channel agent when available.
-      let defaultSettings: Omit<AgentSettings, "updatedAt"> = {};
-      try {
-        let sourceAgentId = payload.agentId;
-        if (!sourceAgentId && body.channelId) {
-          const binding = await config.channelBindingService.getBinding(
-            payload.platform,
-            body.channelId,
-            payload.teamId
-          );
-          sourceAgentId = binding?.agentId;
-        }
-
-        if (sourceAgentId) {
-          const sourceSettings =
-            await config.agentSettingsStore.getSettings(sourceAgentId);
-          defaultSettings = buildDefaultSettingsFromSource(sourceSettings);
-        }
-      } catch (error) {
-        logger.warn("Failed to derive source defaults for new agent", {
-          error,
-        });
-      }
-      await config.agentSettingsStore.saveSettings(agentId, defaultSettings);
-
-      // Associate with user
-      await config.userAgentsStore.addAgent(
-        payload.platform,
-        lookupUserId,
-        agentId
-      );
-
-      // Auto-bind to channel if channelId provided (from session context)
-      if (body.channelId) {
-        await config.channelBindingService.createBinding(
-          agentId,
-          payload.platform,
-          body.channelId,
-          payload.teamId,
-          { configuredBy: payload.userId }
-        );
-      }
-
-      logger.info(
-        `Created agent ${agentId} for user ${payload.platform}/${payload.userId}${body.channelId ? ` (bound to ${body.channelId})` : ""}`
-      );
-
-      return c.json({
-        agentId,
-        name: body.name,
-        settingsUrl: `/api/v1/agents/${encodeURIComponent(agentId)}/config`,
-      });
-    } catch (error) {
-      logger.error("Failed to create agent", { error });
-      return c.json(
-        {
-          error: "Internal server error",
-        },
-        500
-      );
-    }
-  });
-
-  // GET /api/v1/agents - List user's agents
-  router.get("/", async (c) => {
-    const payload = verifySettingsSession(c);
-    if (!payload) {
-      return c.json({ error: "Invalid or expired token" }, 401);
-    }
-
-    try {
-      const agentIds = await listOwnedAgentIds(payload, config);
-
-      const agents = [];
-      for (const agentId of agentIds) {
-        const metadata = await config.agentMetadataStore.getMetadata(agentId);
-        if (metadata) {
-          // Skip sandbox agents (auto-created under a connection)
-          if (metadata.parentConnectionId) continue;
-
-          const bindings =
-            await config.channelBindingService.listBindings(agentId);
-          agents.push({
-            agentId,
-            name: metadata.name,
-            description: metadata.description,
-            isWorkspaceAgent: metadata.isWorkspaceAgent,
-            createdAt: metadata.createdAt,
-            lastUsedAt: metadata.lastUsedAt,
-            channelCount: bindings.length,
-          });
-        }
-      }
-
-      return c.json({ agents });
-    } catch (error) {
-      logger.error("Failed to list agents", { error });
-      return c.json({ error: "Failed to list agents" }, 500);
-    }
-  });
-
-  // PATCH /api/v1/agents/{agentId} - Update agent name/description
-  router.patch("/:agentId", async (c) => {
-    const payload = verifySettingsSession(c);
-    if (!payload) {
-      return c.json({ error: "Invalid or expired token" }, 401);
-    }
-
-    const agentId = c.req.param("agentId");
-    if (!agentId) {
-      return c.json({ error: "Missing agentId" }, 400);
-    }
-
-    try {
-      // Verify ownership (admins bypass)
-      if (!payload.isAdmin) {
-        const access = await verifyOwnedAgentAccess(payload, agentId, {
-          userAgentsStore: config.userAgentsStore,
-          agentMetadataStore: config.agentMetadataStore,
-        });
-        if (!access.authorized) {
-          return c.json({ error: "Agent not found or not owned by you" }, 404);
-        }
-      }
-
-      const body = await c.req.json<{ name?: string; description?: string }>();
-      const updates: { name?: string; description?: string } = {};
-
-      if (body.name !== undefined) {
-        const name = body.name.trim();
-        if (!name || name.length > 100) {
-          return c.json({ error: "Name must be 1-100 characters" }, 400);
-        }
-        updates.name = name;
-      }
-
-      if (body.description !== undefined) {
-        const desc = body.description.trim();
-        if (desc.length > 200) {
-          return c.json(
-            { error: "Description must be at most 200 characters" },
-            400
-          );
-        }
-        updates.description = desc;
-      }
-
-      if (Object.keys(updates).length === 0) {
-        return c.json({ error: "No fields to update" }, 400);
-      }
-
-      await config.agentMetadataStore.updateMetadata(agentId, updates);
-      logger.info(`Updated agent identity for ${agentId}`);
-      return c.json({ success: true });
-    } catch (error) {
-      logger.error("Failed to update agent", { error, agentId });
-      return c.json(
-        {
-          error: "Internal server error",
-        },
-        500
-      );
-    }
-  });
-
-  // DELETE /api/v1/agents/{agentId} - Delete an agent
-  router.delete("/:agentId", async (c) => {
-    const payload = verifySettingsSession(c);
-    if (!payload) {
-      return c.json({ error: "Invalid or expired token" }, 401);
-    }
-
-    const agentId = c.req.param("agentId");
-    if (!agentId) {
-      return c.json({ error: "Missing agentId" }, 400);
-    }
-
-    try {
-      // Verify ownership (admins bypass)
-      let ownerPlatform: string | undefined;
-      let ownerUserId: string | undefined;
-      if (!payload.isAdmin) {
-        const access = await verifyOwnedAgentAccess(payload, agentId, {
-          userAgentsStore: config.userAgentsStore,
-          agentMetadataStore: config.agentMetadataStore,
-        });
-        if (!access.authorized) {
-          return c.json({ error: "Agent not found or not owned by you" }, 404);
-        }
-        ownerPlatform = access.ownerPlatform;
-        ownerUserId = access.ownerUserId;
-      }
-
-      // Auto-unbind all channels
-      const unboundCount =
-        await config.channelBindingService.deleteAllBindings(agentId);
-
-      // Delete settings
-      await config.agentSettingsStore.deleteSettings(agentId);
-
-      // Delete metadata
-      await config.agentMetadataStore.deleteAgent(agentId);
-
-      // Remove from user's list
-      await config.userAgentsStore.removeAgent(
-        payload.platform,
-        resolveSettingsLookupUserId(payload),
-        agentId
-      );
-      if (
-        ownerPlatform &&
-        ownerUserId &&
-        (ownerPlatform !== payload.platform || ownerUserId !== payload.userId)
-      ) {
-        await config.userAgentsStore.removeAgent(
-          ownerPlatform,
-          ownerUserId,
-          agentId
-        );
-      }
-
-      logger.info(
-        `Deleted agent ${agentId} (unbound ${unboundCount} channels)`
-      );
-
-      return c.json({ success: true, unboundChannels: unboundCount });
-    } catch (error) {
-      logger.error("Failed to delete agent", { error, agentId });
-      return c.json(
-        {
-          error: "Internal server error",
-        },
-        500
-      );
-    }
-  });
-
-  logger.debug("Agent management routes registered");
-  return router;
-}

package/src/routes/public/channels.ts

@@ -1,191 +0,0 @@
-/**
- * Channel Binding Routes - Manage channel-to-agent bindings
- *
- * Routes (under /api/v1/agents/{agentId}/channels):
- * - GET / - List all bindings for an agent
- * - POST / - Create a new binding
- * - DELETE /{platform}/{channelId} - Delete a binding
- */
-
-import { createLogger } from "@lobu/core";
-import { Hono } from "hono";
-import type { AgentMetadataStore } from "../../auth/agent-metadata-store";
-import type { UserAgentsStore } from "../../auth/user-agents-store";
-import type { ChannelBindingService } from "../../channels";
-import { createTokenVerifier } from "../shared/token-verifier";
-import { verifySettingsSession } from "./settings-auth";
-
-const logger = createLogger("channel-binding-routes");
-
-export interface ChannelBindingRoutesConfig {
-  channelBindingService: ChannelBindingService;
-  userAgentsStore?: UserAgentsStore;
-  agentMetadataStore?: AgentMetadataStore;
-}
-
-/**
- * Create channel binding routes
- * These are mounted under /api/v1/agents/{agentId}/channels
- */
-export function createChannelBindingRoutes(
-  config: ChannelBindingRoutesConfig
-): Hono {
-  const router = new Hono();
-
-  const verifyToken = createTokenVerifier(config);
-
-  const verifyAuth = async (c: any, agentId: string) => {
-    return verifyToken(verifySettingsSession(c), agentId);
-  };
-
-  // GET /api/v1/agents/{agentId}/channels - List all bindings for an agent
-  router.get("/", async (c) => {
-    const agentId = c.req.param("agentId");
-
-    if (!agentId) {
-      return c.json({ error: "Missing agentId" }, 400);
-    }
-
-    if (!(await verifyAuth(c, agentId))) {
-      return c.json({ error: "Unauthorized" }, 401);
-    }
-
-    try {
-      const bindings = await config.channelBindingService.listBindings(agentId);
-
-      return c.json({
-        agentId,
-        bindings: bindings.map((b) => ({
-          platform: b.platform,
-          channelId: b.channelId,
-          teamId: b.teamId,
-          createdAt: b.createdAt,
-        })),
-      });
-    } catch (error) {
-      logger.error("Failed to list bindings", { error, agentId });
-      return c.json({ error: "Failed to list bindings" }, 500);
-    }
-  });
-
-  // POST /api/v1/agents/{agentId}/channels - Create a new binding
-  router.post("/", async (c) => {
-    const agentId = c.req.param("agentId");
-
-    if (!agentId) {
-      return c.json({ error: "Missing agentId" }, 400);
-    }
-
-    const authPayload = await verifyAuth(c, agentId);
-    if (!authPayload) {
-      return c.json({ error: "Unauthorized" }, 401);
-    }
-
-    try {
-      const body = await c.req.json<{
-        platform: string;
-        channelId: string;
-        teamId?: string;
-      }>();
-
-      // Validate required fields
-      if (!body.platform || !body.channelId) {
-        return c.json(
-          { error: "Missing required fields: platform, channelId" },
-          400
-        );
-      }
-
-      // Validate platform format (alphanumeric, lowercase)
-      if (!/^[a-z][a-z0-9_-]*$/.test(body.platform)) {
-        return c.json(
-          { error: "Invalid platform format. Must be lowercase alphanumeric." },
-          400
-        );
-      }
-
-      // Validate channelId format
-      if (typeof body.channelId !== "string" || !body.channelId.trim()) {
-        return c.json({ error: "Invalid channelId" }, 400);
-      }
-
-      // Validate optional teamId
-      if (
-        body.teamId &&
-        (typeof body.teamId !== "string" || !body.teamId.trim())
-      ) {
-        return c.json({ error: "Invalid teamId" }, 400);
-      }
-
-      await config.channelBindingService.createBinding(
-        agentId,
-        body.platform,
-        body.channelId.trim(),
-        body.teamId?.trim(),
-        { configuredBy: authPayload.userId }
-      );
-
-      logger.info(
-        `Created binding: ${body.platform}/${body.channelId} -> ${agentId}`
-      );
-
-      return c.json({
-        success: true,
-        agentId,
-        platform: body.platform,
-        channelId: body.channelId,
-        teamId: body.teamId,
-      });
-    } catch (error) {
-      logger.error("Failed to create binding", { error, agentId });
-      return c.json(
-        {
-          error: "Failed to create binding",
-        },
-        400
-      );
-    }
-  });
-
-  // DELETE /api/v1/agents/{agentId}/channels/{platform}/{channelId} - Delete a binding
-  router.delete("/:platform/:channelId", async (c) => {
-    const agentId = c.req.param("agentId");
-    const platform = c.req.param("platform");
-    const channelId = c.req.param("channelId");
-    const teamId = c.req.query("teamId"); // Optional query param for multi-tenant platforms
-
-    if (!agentId || !platform || !channelId) {
-      return c.json({ error: "Missing required parameters" }, 400);
-    }
-
-    if (!(await verifyAuth(c, agentId))) {
-      return c.json({ error: "Unauthorized" }, 401);
-    }
-
-    // Validate platform format
-    if (!/^[a-z][a-z0-9_-]*$/.test(platform)) {
-      return c.json({ error: "Invalid platform format" }, 400);
-    }
-
-    try {
-      const deleted = await config.channelBindingService.deleteBinding(
-        agentId,
-        platform,
-        channelId,
-        teamId || undefined
-      );
-
-      if (!deleted) {
-        return c.json({ error: "Binding not found" }, 404);
-      }
-
-      logger.info(`Deleted binding: ${platform}/${channelId} -> ${agentId}`);
-      return c.json({ success: true });
-    } catch (error) {
-      logger.error("Failed to delete binding", { error, agentId });
-      return c.json({ error: "Failed to delete binding" }, 500);
-    }
-  });
-
-  return router;
-}