@mmmbuto/nexuscrew 0.1.0-beta.1 → 0.2.1

package/lib/server/db/drivers/sql-js.js

@@ -0,0 +1,75 @@
+const initSqlJs = require('sql.js');
+const fs = require('fs');
+
+class SqlJsDriver {
+  constructor(dbPath) {
+    this.dbPath = dbPath;
+    this.db = null;
+    this.saveInterval = null;
+  }
+
+  async init() {
+    const SQL = await initSqlJs();
+
+    if (fs.existsSync(this.dbPath)) {
+      const buffer = fs.readFileSync(this.dbPath);
+      this.db = new SQL.Database(buffer);
+    } else {
+      this.db = new SQL.Database();
+    }
+
+    // Auto-save every 5 seconds
+    this.saveInterval = setInterval(() => this.save(), 5000);
+  }
+
+  save() {
+    if (!this.db) return;
+    const data = this.db.export();
+    const buffer = Buffer.from(data);
+    fs.writeFileSync(this.dbPath, buffer);
+  }
+
+  exec(sql) {
+    return this.db.run(sql);
+  }
+
+  prepare(sql) {
+    const stmt = this.db.prepare(sql);
+    return {
+      run: (...params) => {
+        stmt.bind(params);
+        stmt.step();
+        stmt.reset();
+        this.save();
+      },
+      get: (...params) => {
+        stmt.bind(params);
+        const result = stmt.step() ? stmt.getAsObject() : null;
+        stmt.reset();
+        return result;
+      },
+      all: (...params) => {
+        stmt.bind(params);
+        const results = [];
+        while (stmt.step()) {
+          results.push(stmt.getAsObject());
+        }
+        stmt.reset();
+        return results;
+      }
+    };
+  }
+
+  close() {
+    if (this.db) {
+      this.save();
+      this.db.close();
+    }
+    if (this.saveInterval) {
+      clearInterval(this.saveInterval);
+      this.saveInterval = null;
+    }
+  }
+}
+
+module.exports = SqlJsDriver;

package/lib/server/db/migrate.js

@@ -0,0 +1,174 @@
+const fs = require('fs');
+const path = require('path');
+const { initDb, getDb, saveDb } = require('./adapter');
+
+const MIGRATIONS_DIR = path.join(__dirname, 'migrations');
+
+/**
+ * Get list of migration files in order
+ */
+function getMigrationFiles() {
+  const files = fs.readdirSync(MIGRATIONS_DIR)
+    .filter(f => f.endsWith('.sql'))
+    .sort(); // Alphabetical order ensures numeric order (001_, 002_, etc.)
+  return files;
+}
+
+/**
+ * Normalize and split SQL into executable statements.
+ * Keeps CREATE/INSERT blocks while stripping comment-only lines.
+ */
+function parseSqlStatements(sql) {
+  return sql
+    .replace(/\r\n/g, '\n')
+    .split(';')
+    .map(stmt => stmt.trim())
+    .map(stmt => {
+      const lines = stmt
+        .split('\n')
+        .map(line => line.trim())
+        .filter(line => line.length > 0 && !line.startsWith('--'));
+      return lines.join('\n').trim();
+    })
+    .filter(stmt => stmt.length > 0);
+}
+
+/**
+ * Get applied migrations from DB
+ */
+function getAppliedMigrations(db) {
+  try {
+    // Ensure migrations table exists
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS _migrations (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        name TEXT UNIQUE NOT NULL,
+        applied_at INTEGER NOT NULL
+      )
+    `);
+
+    const stmt = db.prepare('SELECT name FROM _migrations ORDER BY id');
+    return stmt.all().map(row => row.name);
+  } catch (error) {
+    console.error('[Migration] Error getting applied migrations:', error.message);
+    return [];
+  }
+}
+
+/**
+ * Mark migration as applied
+ */
+function markMigrationApplied(db, name) {
+  const stmt = db.prepare('INSERT INTO _migrations (name, applied_at) VALUES (?, ?)');
+  stmt.run(name, Date.now());
+}
+
+/**
+ * Run a single migration file
+ */
+function runMigrationFile(db, filename) {
+  const filePath = path.join(MIGRATIONS_DIR, filename);
+  const migrationSql = fs.readFileSync(filePath, 'utf8');
+  const statements = parseSqlStatements(migrationSql);
+
+  console.log(`[Migration] Running ${filename} (${statements.length} statements)`);
+
+  for (let i = 0; i < statements.length; i++) {
+    const stmt = statements[i];
+
+    if (/^SELECT/i.test(stmt)) {
+      // Skip verification SELECT statements
+      continue;
+    }
+
+    try {
+      db.exec(stmt);
+    } catch (error) {
+      // Handle "duplicate column" errors gracefully
+      if (error.message.includes('duplicate column')) {
+        console.log(`[Migration] Column already exists (skipping): ${error.message}`);
+        continue;
+      }
+      console.error(`[Migration] Failed at statement ${i + 1}: ${error.message}`);
+      console.error('Statement preview:', stmt.substring(0, 200));
+      throw error;
+    }
+  }
+
+  markMigrationApplied(db, filename);
+  console.log(`[Migration] ✅ ${filename} applied`);
+}
+
+/**
+ * Run database migrations.
+ * @param {Object} options
+ * @param {boolean} options.skipInit - skip initDb (adapter already initialized)
+ */
+async function runMigrations(options = {}) {
+  const { skipInit = false } = options;
+
+  console.log('[Migration] Starting database migration...');
+
+  if (!skipInit && !getDb()) {
+    await initDb({ skipMigrationCheck: true });
+  }
+
+  const db = getDb();
+
+  if (!db) {
+    throw new Error('[Migration] Database instance not initialized');
+  }
+
+  const migrationFiles = getMigrationFiles();
+  const appliedMigrations = getAppliedMigrations(db);
+
+  console.log(`[Migration] Found ${migrationFiles.length} migration files`);
+  console.log(`[Migration] Already applied: ${appliedMigrations.length}`);
+
+  const pendingMigrations = migrationFiles.filter(f => !appliedMigrations.includes(f));
+
+  if (pendingMigrations.length === 0) {
+    console.log('[Migration] No pending migrations');
+    return;
+  }
+
+  console.log(`[Migration] Pending: ${pendingMigrations.join(', ')}`);
+
+  for (const file of pendingMigrations) {
+    runMigrationFile(db, file);
+  }
+
+  saveDb();
+
+  console.log('[Migration] All migrations completed');
+
+  // Verification counts
+  try {
+    const verifyStmt = db.prepare(`
+      SELECT 'conversations' as table_name, COUNT(*) as count FROM conversations
+      UNION ALL
+      SELECT 'messages' as table_name, COUNT(*) as count FROM messages
+    `);
+
+    const counts = verifyStmt.all();
+    console.log('[Migration] Verification:');
+    counts.forEach(row => console.log(`  ${row.table_name}: ${row.count} rows`));
+  } catch (error) {
+    console.error('[Migration] Verification failed:', error.message);
+  }
+}
+
+// Run if called directly
+if (require.main === module) {
+  runMigrations()
+    .then(() => {
+      console.log('[Migration] Complete');
+      process.exit(0);
+    })
+    .catch(error => {
+      console.error('[Migration] Failed:', error);
+      process.exit(1);
+    });
+}
+
+module.exports = { runMigrations };

package/lib/server/db/migrations/001_base_schema.sql

@@ -0,0 +1,70 @@
+-- NexusCrew Base Schema Migration
+-- This migration creates the initial database schema for NexusCrew
+
+-- Conversations table (NexusCrew + auth schema)
+CREATE TABLE IF NOT EXISTS conversations (
+  id TEXT PRIMARY KEY,
+  title TEXT DEFAULT 'New Chat',
+  engine TEXT NOT NULL DEFAULT 'claude',
+  model TEXT,
+  tmux_window TEXT,
+  log_path TEXT,
+  workspace TEXT DEFAULT '',
+  host TEXT DEFAULT 'local',
+  status TEXT DEFAULT 'active',
+  pinned INTEGER DEFAULT 0,
+  metadata TEXT,
+  created_at INTEGER DEFAULT (unixepoch()),
+  updated_at INTEGER DEFAULT (unixepoch())
+);
+
+-- Messages table
+CREATE TABLE IF NOT EXISTS messages (
+  id TEXT PRIMARY KEY,
+  conversation_id TEXT NOT NULL,
+  role TEXT NOT NULL,
+  content TEXT DEFAULT '',
+  engine TEXT,
+  model TEXT,
+  tokens_in INTEGER DEFAULT 0,
+  tokens_out INTEGER DEFAULT 0,
+  created_at INTEGER DEFAULT (unixepoch()),
+  FOREIGN KEY (conversation_id) REFERENCES conversations(id)
+);
+
+-- Users table (auth)
+CREATE TABLE IF NOT EXISTS users (
+  id TEXT PRIMARY KEY,
+  username TEXT UNIQUE NOT NULL,
+  password_hash TEXT NOT NULL,
+  role TEXT NOT NULL DEFAULT 'user',
+  is_locked INTEGER NOT NULL DEFAULT 0,
+  failed_attempts INTEGER NOT NULL DEFAULT 0,
+  last_failed_attempt INTEGER,
+  locked_until INTEGER,
+  created_at INTEGER NOT NULL,
+  last_login INTEGER
+);
+
+-- API Keys table
+CREATE TABLE IF NOT EXISTS api_keys (
+  provider TEXT PRIMARY KEY,
+  api_key TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+-- Session summaries table
+CREATE TABLE IF NOT EXISTS session_summaries (
+  conversation_id TEXT PRIMARY KEY,
+  summary_short TEXT,
+  key_decisions TEXT,
+  files_modified TEXT,
+  updated_at INTEGER,
+  FOREIGN KEY (conversation_id) REFERENCES conversations(id)
+);
+
+-- Indexes
+CREATE INDEX IF NOT EXISTS idx_messages_conv ON messages(conversation_id, created_at);
+CREATE INDEX IF NOT EXISTS idx_conversations_status ON conversations(status, updated_at);
+CREATE INDEX IF NOT EXISTS idx_users_username ON users(username);

package/lib/server/middleware/auth.js

@@ -0,0 +1,134 @@
+const crypto = require('crypto');
+const jwt = require('jsonwebtoken');
+const User = require('../models/User');
+const { getConfig } = require('../../config/manager');
+
+let warnedEphemeralSecret = false;
+
+function getJwtSecret() {
+  if (process.env.JWT_SECRET) {
+    return process.env.JWT_SECRET;
+  }
+
+  const config = getConfig();
+  if (config.auth?.jwt_secret) {
+    return config.auth.jwt_secret;
+  }
+
+  if (!global.__NEXUSCREW_EPHEMERAL_JWT_SECRET__) {
+    global.__NEXUSCREW_EPHEMERAL_JWT_SECRET__ = crypto.randomBytes(48).toString('hex');
+  }
+
+  if (!warnedEphemeralSecret) {
+    warnedEphemeralSecret = true;
+    console.warn('[Auth] JWT secret missing from env and config; using ephemeral in-memory secret for this process');
+  }
+
+  return global.__NEXUSCREW_EPHEMERAL_JWT_SECRET__;
+}
+
+/**
+ * Get config user (admin from init) by id
+ */
+function findConfigUserById(id) {
+  if (id !== 'config-admin') return null;
+
+  const config = getConfig();
+  if (config.auth && config.auth.user) {
+    return {
+      id: 'config-admin',
+      username: config.auth.user,
+      role: 'admin',
+      is_locked: false,
+      created_at: Date.now()
+    };
+  }
+  return null;
+}
+
+const JWT_EXPIRES_IN = process.env.JWT_EXPIRES_IN || '7d';
+
+function generateToken(user) {
+  return jwt.sign(
+    {
+      id: user.id,
+      username: user.username,
+      role: user.role
+    },
+    getJwtSecret(),
+    { expiresIn: JWT_EXPIRES_IN }
+  );
+}
+
+function verifyToken(token) {
+  try {
+    return jwt.verify(token, getJwtSecret());
+  } catch (err) {
+    return null;
+  }
+}
+
+function authMiddleware(req, res, next) {
+  // BYPASS for localhost
+  const clientIp = req.ip || req.connection.remoteAddress || req.socket.remoteAddress;
+  if (clientIp === '127.0.0.1' || clientIp === '::1' || clientIp === '::ffff:127.0.0.1') {
+    req.user = { id: 'localhost', username: 'local', role: 'admin' };
+    return next();
+  }
+
+  const authHeader = req.headers.authorization;
+
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    return res.status(401).json({ error: 'No token provided' });
+  }
+
+  const token = authHeader.substring(7);
+  const decoded = verifyToken(token);
+
+  if (!decoded) {
+    return res.status(401).json({ error: 'Invalid or expired token' });
+  }
+
+  // Verify user still exists - check config user first, then database
+  let user = findConfigUserById(decoded.id);
+  let isConfigUser = !!user;
+
+  if (!user) {
+    user = User.findById(decoded.id);
+  }
+
+  if (!user) {
+    return res.status(401).json({ error: 'User not found' });
+  }
+
+  // Check if account is locked (only for DB users)
+  if (!isConfigUser && User.isAccountLocked(user)) {
+    return res.status(403).json({
+      error: 'Account locked',
+      locked_until: user.locked_until
+    });
+  }
+
+  req.user = {
+    id: user.id,
+    username: user.username,
+    role: user.role
+  };
+
+  next();
+}
+
+function adminOnly(req, res, next) {
+  if (req.user.role !== 'admin') {
+    return res.status(403).json({ error: 'Admin access required' });
+  }
+  next();
+}
+
+module.exports = {
+  generateToken,
+  verifyToken,
+  authMiddleware,
+  adminOnly,
+  getJwtSecret
+};

package/lib/server/middleware/rate-limit.js

@@ -0,0 +1,63 @@
+/**
+ * Rate Limiting Middleware for Chat Endpoints
+ *
+ * Protects AI chat endpoints from abuse by limiting requests per user.
+ * Uses express-rate-limit with user-based keying via JWT.
+ */
+
+const rateLimit = require('express-rate-limit');
+
+/**
+ * Chat endpoints rate limiter
+ * - 10 requests per minute per user
+ * - Applies to: /api/v1/chat, /api/v1/codex, /api/v1/gemini, /api/v1/qwen
+ */
+const chatRateLimiter = rateLimit({
+  windowMs: 60 * 1000, // 1 minute window
+  max: 10, // 10 requests per window
+  standardHeaders: true, // Return rate limit info in headers
+  legacyHeaders: false,
+
+  // Key by user ID from JWT (set by authMiddleware)
+  keyGenerator: (req) => {
+    return req.user?.id || req.ip;
+  },
+
+  // Custom error response
+  handler: (req, res) => {
+    res.status(429).json({
+      error: 'Too many requests',
+      message: 'Rate limit exceeded. Please wait before sending more messages.',
+      retryAfter: Math.ceil(req.rateLimit.resetTime / 1000)
+    });
+  },
+
+  // Skip rate limiting for interrupt endpoints
+  skip: (req) => {
+    return req.path.endsWith('/interrupt');
+  }
+});
+
+/**
+ * General API rate limiter (for non-chat endpoints)
+ * - 60 requests per minute per IP
+ */
+const apiRateLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 60,
+  standardHeaders: true,
+  legacyHeaders: false,
+  keyGenerator: (req) => req.user?.id || req.ip,
+  handler: (req, res) => {
+    res.status(429).json({
+      error: 'Too many requests',
+      message: 'API rate limit exceeded.',
+      retryAfter: Math.ceil(req.rateLimit.resetTime / 1000)
+    });
+  }
+});
+
+module.exports = {
+  chatRateLimiter,
+  apiRateLimiter
+};

package/lib/server/models/User.js

@@ -0,0 +1,128 @@
+const { prepare, saveDb } = require('../db/adapter');
+const bcrypt = require('bcryptjs');
+const { v4: uuidv4 } = require('uuid');
+
+class User {
+  static create(username, password, role = 'user') {
+    const id = uuidv4();
+    const passwordHash = bcrypt.hashSync(password, 10);
+    const now = Date.now();
+
+    const stmt = prepare(`
+      INSERT INTO users (id, username, password_hash, role, created_at)
+      VALUES (?, ?, ?, ?, ?)
+    `);
+
+    stmt.run(id, username, passwordHash, role, now);
+    saveDb();
+
+    return { id, username, role, created_at: now };
+  }
+
+  static findByUsername(username) {
+    const stmt = prepare('SELECT * FROM users WHERE username = ?');
+    return stmt.get(username);
+  }
+
+  static findById(id) {
+    const stmt = prepare('SELECT * FROM users WHERE id = ?');
+    return stmt.get(id);
+  }
+
+  static count() {
+    const stmt = prepare('SELECT COUNT(*) as count FROM users');
+    const result = stmt.get();
+    return result ? result.count : 0;
+  }
+
+  static verifyPassword(user, password) {
+    return bcrypt.compareSync(password, user.password_hash);
+  }
+
+  static updateLastLogin(userId) {
+    const stmt = prepare('UPDATE users SET last_login = ? WHERE id = ?');
+    stmt.run(Date.now(), userId);
+    saveDb();
+  }
+
+  static incrementFailedAttempts(userId) {
+    const now = Date.now();
+    const stmt = prepare(`
+      UPDATE users
+      SET failed_attempts = failed_attempts + 1,
+          last_failed_attempt = ?
+      WHERE id = ?
+    `);
+    stmt.run(now, userId);
+    saveDb();
+
+    // Lock account after 5 failed attempts for 15 minutes
+    const user = this.findById(userId);
+    if (user.failed_attempts >= 5) {
+      const lockUntil = now + (15 * 60 * 1000); // 15 minutes
+      const lockStmt = prepare(`
+        UPDATE users
+        SET is_locked = 1, locked_until = ?
+        WHERE id = ?
+      `);
+      lockStmt.run(lockUntil, userId);
+      saveDb();
+    }
+  }
+
+  static resetFailedAttempts(userId) {
+    const stmt = prepare(`
+      UPDATE users
+      SET failed_attempts = 0,
+          is_locked = 0,
+          locked_until = NULL
+      WHERE id = ?
+    `);
+    stmt.run(userId);
+    saveDb();
+  }
+
+  static isAccountLocked(user) {
+    if (!user.is_locked) return false;
+    if (!user.locked_until) return true;
+
+    const now = Date.now();
+    if (now < user.locked_until) {
+      return true;
+    }
+
+    // Unlock account if lock period expired
+    this.resetFailedAttempts(user.id);
+    return false;
+  }
+
+  static logLoginAttempt(ipAddress, username, success) {
+    const stmt = prepare(`
+      INSERT INTO login_attempts (ip_address, username, success, timestamp)
+      VALUES (?, ?, ?, ?)
+    `);
+    stmt.run(ipAddress, username, success ? 1 : 0, Date.now());
+    saveDb();
+  }
+
+  static getRecentLoginAttempts(ipAddress, windowMs = 15 * 60 * 1000) {
+    const since = Date.now() - windowMs;
+    const stmt = prepare(`
+      SELECT COUNT(*) as count
+      FROM login_attempts
+      WHERE ip_address = ? AND timestamp > ?
+    `);
+    const result = stmt.get(ipAddress, since);
+    return result ? result.count : 0;
+  }
+
+  static cleanupOldLoginAttempts(daysToKeep = 7) {
+    const cutoff = Date.now() - (daysToKeep * 24 * 60 * 60 * 1000);
+    const stmt = prepare('DELETE FROM login_attempts WHERE timestamp < ?');
+    stmt.run(cutoff);
+    saveDb();
+    return 0; // sql.js doesn't return changes count easily
+  }
+}
+
+module.exports = User;