@mondaydotcomorg/atp-server 0.17.14

package/src/client-sessions.ts

@@ -0,0 +1,234 @@
+/**
+ * Client Session Management
+ */
+import { randomBytes } from 'node:crypto';
+import { nanoid } from 'nanoid';
+import jwt from 'jsonwebtoken';
+import type { CacheProvider, ClientToolDefinition } from '@mondaydotcomorg/atp-protocol';
+
+export interface ClientSession {
+	clientId: string;
+	createdAt: number;
+	expiresAt: number;
+	clientInfo?: {
+		name?: string;
+		version?: string;
+		[key: string]: unknown;
+	};
+	guidance?: string;
+	/** Client-provided tool definitions */
+	tools?: ClientToolDefinition[];
+}
+
+export interface ClientInitRequest {
+	clientInfo?: {
+		name?: string;
+		version?: string;
+		[key: string]: unknown;
+	};
+	guidance?: string;
+	/** Client tool definitions to register */
+	tools?: ClientToolDefinition[];
+}
+
+export interface ClientInitResponse {
+	clientId: string;
+	token: string;
+	expiresAt: number;
+	tokenRotateAt?: number;
+}
+
+/**
+ * Client session manager with JWT-based authentication
+ */
+export class ClientSessionManager {
+	private cache?: CacheProvider;
+	private inMemorySessions: Map<string, ClientSession> = new Map();
+	private cleanupTimers: Map<string, NodeJS.Timeout> = new Map();
+	private tokenTTL: number;
+	private jwtSecret: string;
+
+	constructor(options: { cache?: CacheProvider; tokenTTL: number; tokenRotation: number }) {
+		this.cache = options.cache;
+		this.tokenTTL = options.tokenTTL;
+
+		const secret = process.env.ATP_JWT_SECRET;
+		if (!secret) {
+			throw new Error(
+				'ATP_JWT_SECRET environment variable is required. Generate one with: openssl rand -base64 32'
+			);
+		}
+
+		this.jwtSecret = secret;
+	}
+
+	/**
+	 * Initialize a new client session
+	 */
+	async initClient(request: ClientInitRequest): Promise<ClientInitResponse> {
+		const clientId = this.generateClientId();
+
+		const now = Date.now();
+		const expiresAt = now + this.tokenTTL;
+		const tokenRotateAt = now + this.tokenTTL / 2;
+
+		const token = this.generateToken(clientId);
+
+		const session: ClientSession = {
+			clientId,
+			createdAt: now,
+			expiresAt,
+			clientInfo: request.clientInfo,
+			guidance: request.guidance,
+			tools: request.tools || [],
+		};
+
+		if (this.cache) {
+			const ttlSeconds = Math.floor(this.tokenTTL / 1000);
+			await this.cache.set(`session:${clientId}`, session, ttlSeconds);
+		} else {
+			this.inMemorySessions.set(clientId, session);
+			this.scheduleCleanup(clientId, this.tokenTTL);
+		}
+
+		return {
+			clientId,
+			token,
+			expiresAt,
+			tokenRotateAt,
+		};
+	}
+
+	/**
+	 * Verify client token (JWT-based, stateless)
+	 */
+	async verifyClient(clientId: string, token: string): Promise<boolean> {
+		try {
+			// Prevent algorithm confusion attacks - only allow HS256
+			const decoded = jwt.verify(token, this.jwtSecret, {
+				algorithms: ['HS256'],
+			}) as { clientId: string; type: string };
+
+			if (decoded.clientId !== clientId || decoded.type !== 'client') {
+				return false;
+			}
+
+			const session = await this.getSession(clientId);
+			return session !== null;
+		} catch (error) {
+			return false;
+		}
+	}
+
+	/**
+	 * Get client session
+	 */
+	async getSession(clientId: string): Promise<ClientSession | null> {
+		let session: ClientSession | null = null;
+
+		if (this.cache) {
+			session = await this.cache.get<ClientSession>(`session:${clientId}`);
+		} else {
+			session = this.inMemorySessions.get(clientId) || null;
+		}
+
+		if (!session) {
+			return null;
+		}
+
+		if (Date.now() > session.expiresAt) {
+			if (this.cache) {
+				await this.cache.delete(`session:${clientId}`);
+			} else {
+				this.inMemorySessions.delete(clientId);
+			}
+			return null;
+		}
+
+		return session;
+	}
+
+	/**
+	 * Revoke client session
+	 */
+	async revokeClient(clientId: string): Promise<void> {
+		if (this.cache) {
+			await this.cache.delete(`session:${clientId}`);
+		} else {
+			this.inMemorySessions.delete(clientId);
+		}
+	}
+
+	/**
+	 * Generate cryptographically secure client ID
+	 */
+	private generateClientId(): string {
+		const random = randomBytes(16).toString('hex');
+		return `cli_${random}`;
+	}
+
+	/**
+	 * Generate JWT token for client
+	 */
+	generateToken(clientId: string): string {
+		return jwt.sign(
+			{
+				clientId,
+				type: 'client',
+				jti: nanoid(),
+			},
+			this.jwtSecret,
+			{
+				expiresIn: 3600,
+			}
+		);
+	}
+
+	/**
+	 * Schedule cleanup of expired in-memory session
+	 */
+	private scheduleCleanup(clientId: string, ttl: number): void {
+		const existingTimer = this.cleanupTimers.get(clientId);
+		if (existingTimer) {
+			clearTimeout(existingTimer);
+		}
+
+		const timer = setTimeout(() => {
+			this.inMemorySessions.delete(clientId);
+			this.cleanupTimers.delete(clientId);
+		}, ttl);
+
+		this.cleanupTimers.set(clientId, timer);
+	}
+
+	/**
+	 * Manually cleanup a session (useful for tests and explicit cleanup)
+	 */
+	async cleanup(clientId: string): Promise<void> {
+		const timer = this.cleanupTimers.get(clientId);
+		if (timer) {
+			clearTimeout(timer);
+			this.cleanupTimers.delete(clientId);
+		}
+
+		if (this.cache) {
+			await this.cache.delete(`session:${clientId}`);
+		} else {
+			this.inMemorySessions.delete(clientId);
+		}
+	}
+
+	/**
+	 * Cleanup all sessions (useful for shutdown)
+	 */
+	async cleanupAll(): Promise<void> {
+		for (const timer of this.cleanupTimers.values()) {
+			clearTimeout(timer);
+		}
+		this.cleanupTimers.clear();
+
+		if (!this.cache) {
+			this.inMemorySessions.clear();
+		}
+	}
+}

package/src/controllers/definitions.controller.ts

@@ -0,0 +1,19 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { APIAggregator } from '../aggregator/index.js';
+import { sendJson } from '../utils/response.js';
+
+export async function handleDefinitions(
+	req: IncomingMessage,
+	res: ServerResponse,
+	aggregator: APIAggregator,
+	url: URL
+): Promise<void> {
+	const apiGroups = url.searchParams.get('apiGroups')?.split(',');
+	const typescript = await aggregator.generateTypeScript(apiGroups);
+
+	sendJson(res, {
+		typescript,
+		apiGroups: aggregator.getApiGroups(),
+		version: '1.0.0',
+	});
+}

package/src/controllers/execute.controller.ts

@@ -0,0 +1,166 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { ExecutionConfig } from '@mondaydotcomorg/atp-protocol';
+import { ExecutionErrorCode, sanitizeInput, MAX_CODE_SIZE } from '@mondaydotcomorg/atp-protocol';
+import type { CodeValidator } from '../validator/index.js';
+import type { SandboxExecutor } from '../executor/index.js';
+import type { ExecutionStateManager } from '../execution-state/index.js';
+import type { AuditConfig } from '../middleware/audit.js';
+import { auditExecution } from '../middleware/audit.js';
+import { clientCallbackManager } from '../callback/index.js';
+import { nanoid } from 'nanoid';
+import type { log } from '@mondaydotcomorg/atp-runtime';
+
+interface ExecuteContext {
+	validator: CodeValidator;
+	executor: SandboxExecutor;
+	stateManager: ExecutionStateManager;
+	auditConfig?: AuditConfig;
+	defaultTimeout: number;
+	defaultMemoryLimit: number;
+	defaultLLMCallLimit: number;
+}
+
+export async function handleExecute(
+	req: IncomingMessage,
+	res: ServerResponse,
+	context: ExecuteContext,
+	body: string,
+	clientId: string | undefined,
+	logger: ReturnType<typeof log.child>
+): Promise<void> {
+	let request: { code: string; config?: Partial<ExecutionConfig> };
+
+	try {
+		request = JSON.parse(body);
+	} catch (error) {
+		logger.warn('Invalid request body', { error });
+		res.writeHead(400, { 'Content-Type': 'application/json' });
+		res.end(
+			JSON.stringify({
+				error: 'Invalid request body',
+				message: error instanceof Error ? error.message : 'Failed to parse request',
+			})
+		);
+		return;
+	}
+
+	request.code = sanitizeInput(request.code, MAX_CODE_SIZE);
+
+	if (clientId && request.config?.clientServices) {
+		clientCallbackManager.registerClient(clientId, request.config.clientServices);
+		logger.info('Client services registered', {
+			clientId,
+			services: request.config.clientServices,
+		});
+	}
+
+	if (clientId) {
+		clientCallbackManager.updateClientActivity(clientId);
+	}
+
+	const executionConfig: ExecutionConfig = {
+		timeout: request.config?.timeout ?? context.defaultTimeout,
+		maxMemory: request.config?.maxMemory ?? context.defaultMemoryLimit,
+		maxLLMCalls: request.config?.maxLLMCalls ?? context.defaultLLMCallLimit,
+		allowedAPIs: request.config?.allowedAPIs ?? [],
+		allowLLMCalls: request.config?.allowLLMCalls ?? true,
+		clientServices: request.config?.clientServices,
+		provenanceMode: request.config?.provenanceMode,
+		securityPolicies: request.config?.securityPolicies,
+		provenanceHints: request.config?.provenanceHints,
+	};
+
+	logger.info('Validating code for execution', {
+		codeLength: request.code.length,
+		timeout: executionConfig.timeout,
+		clientServices: executionConfig.clientServices,
+	});
+
+	const validationResult = await context.validator.validate(request.code, executionConfig);
+
+	if (!validationResult.valid) {
+		logger.warn('Code validation failed', {
+			errors: validationResult.errors?.length,
+			securityIssues: validationResult.securityIssues?.length,
+		});
+
+		const hasSecurityIssues =
+			validationResult.securityIssues && validationResult.securityIssues.length > 0;
+
+		res.writeHead(200, { 'Content-Type': 'application/json' });
+		res.end(
+			JSON.stringify({
+				executionId: nanoid(),
+				status: hasSecurityIssues ? 'security_violation' : 'validation_failed',
+				error: {
+					message: 'Code validation failed',
+					code: hasSecurityIssues
+						? ExecutionErrorCode.SECURITY_VIOLATION
+						: ExecutionErrorCode.VALIDATION_FAILED,
+					context: {
+						errors: validationResult.errors,
+						securityIssues: validationResult.securityIssues,
+					},
+					retryable: false,
+					suggestion: hasSecurityIssues
+						? 'Remove forbidden operations and use only allowed APIs'
+						: 'Fix syntax errors and validation issues in your code',
+				},
+				stats: {
+					duration: 0,
+					memoryUsed: 0,
+					llmCallsCount: 0,
+					approvalCallsCount: 0,
+					httpCallsCount: 0,
+				},
+			})
+		);
+		return;
+	}
+
+	logger.info('Executing code in sandbox');
+	const result = await context.executor.execute(request.code, executionConfig, clientId);
+
+	logger.info('Code execution completed', {
+		executionId: result.executionId,
+		status: result.status,
+		duration: result.stats.duration,
+		memoryUsed: result.stats.memoryUsed,
+		llmCalls: result.stats.llmCallsCount,
+		approvalCalls: result.stats.approvalCallsCount,
+	});
+
+	if (result.status === 'paused' && result.needsCallback && clientId && result.callbackHistory) {
+		await context.stateManager.pause({
+			executionId: result.executionId,
+			code: request.code,
+			config: executionConfig,
+			clientId,
+			callbackRequest: result.needsCallback,
+			pausedAt: Date.now(),
+			callbackHistory: result.callbackHistory,
+			currentCallbackIndex: result.callbackHistory.length - 1,
+			context: {},
+		});
+
+		logger.info('Execution state saved', {
+			executionId: result.executionId,
+			callbackType: result.needsCallback.type,
+			storage: context.stateManager.getStorageType(),
+			historyLength: result.callbackHistory.length,
+		});
+	}
+
+	if (context.auditConfig?.enabled) {
+		await auditExecution({
+			executionId: result.executionId,
+			apiKey: (req as any).apiKey,
+			ip: req.socket.remoteAddress,
+			code: request.code,
+			result,
+		});
+	}
+
+	res.writeHead(200, { 'Content-Type': 'application/json' });
+	res.end(JSON.stringify(result));
+}

package/src/controllers/info.controller.ts

@@ -0,0 +1,14 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { sendJson } from '../utils/response.js';
+
+export async function handleInfo(req: IncomingMessage, res: ServerResponse): Promise<void> {
+	sendJson(res, {
+		version: '1.0.0',
+		capabilities: {
+			execution: true,
+			search: true,
+			streaming: true,
+			llmCalls: true,
+		},
+	});
+}

package/src/controllers/resume.controller.ts

@@ -0,0 +1,92 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { SandboxExecutor } from '../executor/index.js';
+import type { ExecutionStateManager } from '../execution-state/index.js';
+import type { log } from '@mondaydotcomorg/atp-runtime';
+
+interface ResumeContext {
+	executor: SandboxExecutor;
+	stateManager: ExecutionStateManager;
+}
+
+export async function handleResume(
+	req: IncomingMessage,
+	res: ServerResponse,
+	context: ResumeContext,
+	executionId: string,
+	body: string,
+	logger: ReturnType<typeof log.child>
+): Promise<void> {
+	logger.info('Resuming paused execution', { executionId });
+
+	const pausedState = await context.stateManager.get(executionId);
+
+	if (!pausedState) {
+		logger.warn('Execution not found or expired', { executionId });
+		res.writeHead(404, { 'Content-Type': 'application/json' });
+		res.end(JSON.stringify({ error: 'Execution not found or expired' }));
+		return;
+	}
+
+	const { result: callbackResult } = JSON.parse(body) as { result: unknown };
+
+	logger.info('Client callback result received', {
+		executionId,
+		callbackType: pausedState.callbackRequest.type,
+		operation: pausedState.callbackRequest.operation,
+	});
+
+	const updatedHistory = pausedState.callbackHistory.map((record, index) => {
+		if (index === pausedState.currentCallbackIndex) {
+			return { ...record, result: callbackResult };
+		}
+		return record;
+	});
+
+	logger.info('Re-executing with replay', {
+		executionId,
+		historyLength: updatedHistory.length,
+	});
+
+	const result = await context.executor.execute(
+		pausedState.code,
+		pausedState.config,
+		pausedState.clientId,
+		{
+			callbackHistory: updatedHistory,
+			newCallbackResult: callbackResult,
+			executionId,
+		}
+	);
+
+	logger.info('Resumed execution completed', {
+		executionId: result.executionId,
+		status: result.status,
+		duration: result.stats.duration,
+	});
+
+	if (result.status === 'paused' && result.needsCallback && result.callbackHistory) {
+		await context.stateManager.pause({
+			executionId: result.executionId,
+			code: pausedState.code,
+			config: pausedState.config,
+			clientId: pausedState.clientId,
+			callbackRequest: result.needsCallback,
+			pausedAt: Date.now(),
+			callbackHistory: result.callbackHistory,
+			currentCallbackIndex: result.callbackHistory.length - 1,
+			context: {},
+		});
+
+		logger.info('Execution paused again (multi-callback)', {
+			executionId: result.executionId,
+			callbackType: result.needsCallback.type,
+			totalCallbacks: result.callbackHistory.length,
+		});
+	} else {
+		await context.stateManager.delete(executionId);
+		logger.debug('Execution state cleaned up', { executionId });
+	}
+
+	res.writeHead(200, { 'Content-Type': 'application/json' });
+	res.end(JSON.stringify(result));
+}

package/src/controllers/search.controller.ts

@@ -0,0 +1,16 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { SearchOptions } from '@mondaydotcomorg/atp-protocol';
+import type { SearchEngine } from '../search/index.js';
+import { sendJson } from '../utils/response.js';
+
+export async function handleSearch(
+	req: IncomingMessage,
+	res: ServerResponse,
+	searchEngine: SearchEngine,
+	body: string
+): Promise<void> {
+	const searchOptions = JSON.parse(body) as SearchOptions;
+	const results = await searchEngine.search(searchOptions);
+
+	sendJson(res, { results });
+}