@mycadet/credential-executor 0.0.1 → 0.12.6-dev.202610072225.d7acd73

package/src/cli.ts

@@ -0,0 +1,158 @@
+#!/usr/bin/env bun
+/**
+ * CES CLI — lightweight credential CRUD for the CES container.
+ *
+ * Operates directly on the encrypted key store (`keys.enc` + `store.key`)
+ * without requiring the RPC server, HTTP routes, or a running assistant.
+ *
+ * Usage:
+ *   ces list
+ *   ces get <account>
+ *   ces set <account> <value>
+ *   ces delete <account>
+ *
+ * Account format: `credential/<service>/<field>` (e.g. `credential/cadet/platform_organization_id`)
+ *
+ * Environment variables:
+ *   CREDENTIAL_SECURITY_DIR — directory containing `keys.enc` + `store.key`
+ *   CES_ASSISTANT_DATA_MOUNT — fallback root for `<mount>/.cadet/protected/`
+ *
+ * When neither is set, defaults to `~/.cadet/protected/` (local mode).
+ */
+
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { createLocalSecureKeyBackend } from "./materializers/local-secure-key-backend.js";
+
+// ---------------------------------------------------------------------------
+// Path resolution (mirrors the managed-mode path in main.ts)
+// ---------------------------------------------------------------------------
+
+function resolveCadetRoot(): string {
+  const secDir = process.env["CREDENTIAL_SECURITY_DIR"]?.trim();
+  if (secDir) {
+    // CREDENTIAL_SECURITY_DIR points directly at the dir containing
+    // keys.enc, but createLocalSecureKeyBackend wants the parent
+    // (.cadet root) and appends /protected/ itself — unless
+    // CREDENTIAL_SECURITY_DIR is set, in which case the backend reads
+    // from that dir directly. So we pass dirname(secDir) as cadetRoot.
+    // Actually, looking at resolveSecurityDir(): if CREDENTIAL_SECURITY_DIR
+    // is set it uses that directly, ignoring cadetRoot. So cadetRoot
+    // can be anything — the env var takes precedence.
+    return join(secDir, "..");
+  }
+
+  const mount = process.env["CES_ASSISTANT_DATA_MOUNT"]?.trim();
+  if (mount) {
+    return join(mount, ".cadet");
+  }
+
+  return join(homedir(), ".cadet");
+}
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+
+async function main(): Promise<void> {
+  const [command, ...args] = process.argv.slice(2);
+
+  if (!command || command === "--help" || command === "-h") {
+    printUsage();
+    process.exit(0);
+  }
+
+  const cadetRoot = resolveCadetRoot();
+  const backend = createLocalSecureKeyBackend(cadetRoot);
+
+  switch (command) {
+    case "list": {
+      const accounts = await backend.list();
+      if (accounts.length === 0) {
+        console.log("(no credentials stored)");
+      } else {
+        for (const account of accounts.sort()) {
+          console.log(account);
+        }
+      }
+      break;
+    }
+
+    case "get": {
+      const account = args[0];
+      if (!account) {
+        console.error("Usage: ces get <account>");
+        process.exit(1);
+      }
+      const value = await backend.get(account);
+      if (value === undefined) {
+        console.error(`Not found: ${account}`);
+        process.exit(1);
+      }
+      // Write raw value to stdout (no trailing newline for piping)
+      process.stdout.write(value);
+      break;
+    }
+
+    case "set": {
+      const account = args[0];
+      const value = args[1];
+      if (!account || value === undefined) {
+        console.error("Usage: ces set <account> <value>");
+        process.exit(1);
+      }
+      const ok = await backend.set(account, value);
+      if (ok) {
+        console.log(`Set: ${account}`);
+      } else {
+        console.error(`Failed to set: ${account}`);
+        process.exit(1);
+      }
+      break;
+    }
+
+    case "delete": {
+      const account = args[0];
+      if (!account) {
+        console.error("Usage: ces delete <account>");
+        process.exit(1);
+      }
+      const result = await backend.delete(account);
+      if (result === "deleted") {
+        console.log(`Deleted: ${account}`);
+      } else {
+        console.error(`Not found: ${account}`);
+        process.exit(1);
+      }
+      break;
+    }
+
+    default:
+      console.error(`Unknown command: ${command}`);
+      printUsage();
+      process.exit(1);
+  }
+}
+
+function printUsage(): void {
+  console.log(`CES CLI — credential CRUD for the encrypted key store
+
+Usage:
+  ces list                     List all credential accounts
+  ces get <account>            Get a credential value
+  ces set <account> <value>    Set a credential value
+  ces delete <account>         Delete a credential
+
+Account format:
+  credential/<service>/<field>
+  Example: credential/cadet/platform_organization_id
+
+Environment:
+  CREDENTIAL_SECURITY_DIR    Directory containing keys.enc + store.key
+  CES_ASSISTANT_DATA_MOUNT   Fallback: <mount>/.cadet/protected/`);
+}
+
+main().catch((err) => {
+  console.error(`Fatal: ${err instanceof Error ? err.message : err}`);
+  process.exit(1);
+});

package/src/http/__tests__/credential-routes-bulk.test.ts

@@ -0,0 +1,247 @@
+/**
+ * Tests for the POST /v1/credentials/bulk endpoint.
+ *
+ * Verifies:
+ * - Successful bulk set with multiple credentials
+ * - Validation failure (missing fields, non-array body)
+ * - Auth requirement (401 without token)
+ */
+
+import { describe, it, expect } from "bun:test";
+
+import { handleCredentialRoute } from "../credential-routes.js";
+import type { CredentialRouteDeps } from "../credential-routes.js";
+import type { SecureKeyBackend } from "@mycadet/credential-storage";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const SERVICE_TOKEN = "test-ces-service-token-12345";
+
+function makeDeps(
+  overrides: Partial<SecureKeyBackend> = {},
+): CredentialRouteDeps {
+  const store = new Map<string, string>();
+  const backend: SecureKeyBackend = {
+    get: async (account: string) => store.get(account),
+    set: async (account: string, value: string) => {
+      store.set(account, value);
+      return true;
+    },
+    delete: async (account: string) => {
+      if (!store.has(account)) return "not-found";
+      store.delete(account);
+      return "deleted";
+    },
+    list: async () => [...store.keys()],
+    ...overrides,
+  };
+  return { backend, serviceToken: SERVICE_TOKEN };
+}
+
+function makeRequest(
+  opts: {
+    body?: unknown;
+    token?: string | null;
+    method?: string;
+  } = {},
+): Request {
+  const url = "http://localhost:8090/v1/credentials/bulk";
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+  };
+  if (opts.token !== null) {
+    headers["Authorization"] = `Bearer ${opts.token ?? SERVICE_TOKEN}`;
+  }
+
+  return new Request(url, {
+    method: opts.method ?? "POST",
+    headers,
+    body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("POST /v1/credentials/bulk", () => {
+  it("sets multiple credentials and returns per-credential results", async () => {
+    const deps = makeDeps();
+    const res = await handleCredentialRoute(
+      makeRequest({
+        body: {
+          credentials: [
+            { account: "openai", value: "sk-abc" },
+            { account: "anthropic", value: "sk-xyz" },
+          ],
+        },
+      }),
+      deps,
+    );
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(200);
+
+    const body = await res!.json();
+    expect(body.results).toEqual([
+      { account: "openai", ok: true },
+      { account: "anthropic", ok: true },
+    ]);
+
+    // Verify credentials were actually stored
+    expect(await deps.backend.get("openai")).toBe("sk-abc");
+    expect(await deps.backend.get("anthropic")).toBe("sk-xyz");
+  });
+
+  it("reports per-credential failure when backend.set returns false", async () => {
+    let callCount = 0;
+    const deps = makeDeps({
+      set: async () => {
+        callCount++;
+        // Fail on the second call
+        return callCount !== 2;
+      },
+    });
+
+    const res = await handleCredentialRoute(
+      makeRequest({
+        body: {
+          credentials: [
+            { account: "a", value: "1" },
+            { account: "b", value: "2" },
+            { account: "c", value: "3" },
+          ],
+        },
+      }),
+      deps,
+    );
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(200);
+
+    const body = await res!.json();
+    expect(body.results).toEqual([
+      { account: "a", ok: true },
+      { account: "b", ok: false },
+      { account: "c", ok: true },
+    ]);
+  });
+
+  it("returns 400 when credentials field is not an array", async () => {
+    const deps = makeDeps();
+    const res = await handleCredentialRoute(
+      makeRequest({ body: { credentials: "not-an-array" } }),
+      deps,
+    );
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(400);
+
+    const body = await res!.json();
+    expect(body.error).toMatch(/credentials.*array/i);
+  });
+
+  it("returns 400 when credentials field is missing", async () => {
+    const deps = makeDeps();
+    const res = await handleCredentialRoute(makeRequest({ body: {} }), deps);
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(400);
+
+    const body = await res!.json();
+    expect(body.error).toMatch(/credentials.*array/i);
+  });
+
+  it("returns 400 when an entry is missing account field", async () => {
+    const deps = makeDeps();
+    const res = await handleCredentialRoute(
+      makeRequest({
+        body: {
+          credentials: [{ value: "sk-abc" }],
+        },
+      }),
+      deps,
+    );
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(400);
+
+    const body = await res!.json();
+    expect(body.error).toMatch(/account.*value/i);
+  });
+
+  it("returns 400 when an entry is missing value field", async () => {
+    const deps = makeDeps();
+    const res = await handleCredentialRoute(
+      makeRequest({
+        body: {
+          credentials: [{ account: "openai" }],
+        },
+      }),
+      deps,
+    );
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(400);
+
+    const body = await res!.json();
+    expect(body.error).toMatch(/account.*value/i);
+  });
+
+  it("returns 401 without Authorization header", async () => {
+    const deps = makeDeps();
+    const res = await handleCredentialRoute(
+      makeRequest({ token: null, body: { credentials: [] } }),
+      deps,
+    );
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(401);
+
+    const body = await res!.json();
+    expect(body.error).toMatch(/Missing Authorization/i);
+  });
+
+  it("returns 403 with wrong service token", async () => {
+    const deps = makeDeps();
+    const res = await handleCredentialRoute(
+      makeRequest({ token: "wrong-token", body: { credentials: [] } }),
+      deps,
+    );
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(403);
+
+    const body = await res!.json();
+    expect(body.error).toMatch(/Invalid service token/i);
+  });
+
+  it("non-POST methods fall through to single-account handler (bulk treated as account name)", async () => {
+    const deps = makeDeps();
+    const res = await handleCredentialRoute(
+      makeRequest({ method: "GET", body: undefined }),
+      deps,
+    );
+
+    expect(res).not.toBeNull();
+    // "bulk" is interpreted as an account name by the :account handler;
+    // no such credential exists, so we get 404.
+    expect(res!.status).toBe(404);
+  });
+
+  it("handles empty credentials array", async () => {
+    const deps = makeDeps();
+    const res = await handleCredentialRoute(
+      makeRequest({ body: { credentials: [] } }),
+      deps,
+    );
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(200);
+
+    const body = await res!.json();
+    expect(body.results).toEqual([]);
+  });
+});

package/src/http/__tests__/credential-routes-normalization.test.ts

@@ -0,0 +1,202 @@
+/**
+ * Tests for credential account key normalization in the HTTP routes.
+ *
+ * Verifies that colon-separated account names (e.g. `cadet:platform_organization_id`)
+ * are transparently normalized to the internal slash-separated format
+ * (e.g. `credential/cadet/platform_organization_id`) so that credentials
+ * stored via direct HTTP are findable by the gateway and assistant.
+ */
+
+import { describe, it, expect } from "bun:test";
+
+import { handleCredentialRoute } from "../credential-routes.js";
+import type { CredentialRouteDeps } from "../credential-routes.js";
+import type { SecureKeyBackend } from "@mycadet/credential-storage";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const SERVICE_TOKEN = "test-token-normalization";
+
+function makeDeps(): { deps: CredentialRouteDeps; store: Map<string, string> } {
+  const store = new Map<string, string>();
+  const backend: SecureKeyBackend = {
+    get: async (account: string) => store.get(account),
+    set: async (account: string, value: string) => {
+      store.set(account, value);
+      return true;
+    },
+    delete: async (account: string) => {
+      if (!store.has(account)) return "not-found";
+      store.delete(account);
+      return "deleted";
+    },
+    list: async () => [...store.keys()],
+  };
+  return { deps: { backend, serviceToken: SERVICE_TOKEN }, store };
+}
+
+function makeRequest(method: string, path: string, body?: unknown): Request {
+  const url = `http://localhost:8090${path}`;
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+    Authorization: `Bearer ${SERVICE_TOKEN}`,
+  };
+  const init: RequestInit = { method, headers };
+  if (body !== undefined) {
+    init.body = JSON.stringify(body);
+  }
+  return new Request(url, init);
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("credential route key normalization", () => {
+  it("normalizes colon-separated key on POST (set)", async () => {
+    const { deps, store } = makeDeps();
+
+    const req = makeRequest(
+      "POST",
+      "/v1/credentials/cadet%3Aplatform_organization_id",
+      { value: "org-uuid-123" },
+    );
+    const res = await handleCredentialRoute(req, deps);
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(200);
+    const body = await res!.json();
+    expect(body.ok).toBe(true);
+    expect(body.account).toBe("credential/cadet/platform_organization_id");
+
+    // Verify it was stored under the normalized key
+    expect(store.get("credential/cadet/platform_organization_id")).toBe(
+      "org-uuid-123",
+    );
+    expect(store.has("cadet:platform_organization_id")).toBe(false);
+  });
+
+  it("normalizes colon-separated key on GET", async () => {
+    const { deps, store } = makeDeps();
+    store.set("credential/cadet/platform_user_id", "user-uuid-456");
+
+    const req = makeRequest("GET", "/v1/credentials/cadet%3Aplatform_user_id");
+    const res = await handleCredentialRoute(req, deps);
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(200);
+    const body = await res!.json();
+    expect(body.value).toBe("user-uuid-456");
+  });
+
+  it("normalizes colon-separated key on DELETE", async () => {
+    const { deps, store } = makeDeps();
+    store.set("credential/cadet/temp_cred", "temp-value");
+
+    const req = makeRequest("DELETE", "/v1/credentials/cadet%3Atemp_cred");
+    const res = await handleCredentialRoute(req, deps);
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(200);
+    expect(store.has("credential/cadet/temp_cred")).toBe(false);
+  });
+
+  it("passes through keys already in credential/ format", async () => {
+    const { deps, store } = makeDeps();
+
+    const req = makeRequest(
+      "POST",
+      "/v1/credentials/credential%2Fcadet%2Fassistant_api_key",
+      { value: "api-key-789" },
+    );
+    const res = await handleCredentialRoute(req, deps);
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(200);
+    expect(store.get("credential/cadet/assistant_api_key")).toBe(
+      "api-key-789",
+    );
+  });
+
+  it("passes through oauth/ prefixed keys", async () => {
+    const { deps, store } = makeDeps();
+
+    const req = makeRequest(
+      "POST",
+      "/v1/credentials/oauth%2Fconnection%2Faccess_token",
+      { value: "token-abc" },
+    );
+    const res = await handleCredentialRoute(req, deps);
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(200);
+    expect(store.get("oauth/connection/access_token")).toBe("token-abc");
+  });
+
+  it("normalizes colon-separated keys in bulk set", async () => {
+    const { deps, store } = makeDeps();
+
+    const req = makeRequest("POST", "/v1/credentials/bulk", {
+      credentials: [
+        { account: "cadet:platform_organization_id", value: "org-1" },
+        { account: "cadet:platform_user_id", value: "user-1" },
+        { account: "credential/cadet/assistant_api_key", value: "key-1" },
+      ],
+    });
+    const res = await handleCredentialRoute(req, deps);
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(200);
+    const body = await res!.json();
+
+    expect(body.results).toHaveLength(3);
+    expect(body.results[0].account).toBe(
+      "credential/cadet/platform_organization_id",
+    );
+    expect(body.results[1].account).toBe("credential/cadet/platform_user_id");
+    expect(body.results[2].account).toBe("credential/cadet/assistant_api_key");
+
+    expect(store.get("credential/cadet/platform_organization_id")).toBe(
+      "org-1",
+    );
+    expect(store.get("credential/cadet/platform_user_id")).toBe("user-1");
+    expect(store.get("credential/cadet/assistant_api_key")).toBe("key-1");
+  });
+
+  it("splits multi-colon keys at the last colon", async () => {
+    const { deps, store } = makeDeps();
+
+    const req = makeRequest(
+      "POST",
+      "/v1/credentials/integration%3Agoogle%3Aaccess_token",
+      { value: "google-token" },
+    );
+    const res = await handleCredentialRoute(req, deps);
+
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(200);
+    const body = await res!.json();
+    // "integration:google:access_token" splits at last colon →
+    // service="integration:google", field="access_token"
+    expect(body.account).toBe("credential/integration:google/access_token");
+    expect(store.get("credential/integration:google/access_token")).toBe(
+      "google-token",
+    );
+  });
+
+  it("returns normalized key in response body", async () => {
+    const { deps } = makeDeps();
+
+    const req = makeRequest(
+      "POST",
+      "/v1/credentials/slack_channel%3Abot_token",
+      { value: "xoxb-test" },
+    );
+    const res = await handleCredentialRoute(req, deps);
+
+    const body = await res!.json();
+    expect(body.account).toBe("credential/slack_channel/bot_token");
+  });
+});

package/src/http/__tests__/metadata-routes.test.ts

@@ -0,0 +1,84 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import type { CredentialRecord } from "@mycadet/service-contracts/credential-rpc";
+
+import { handleMetadataRoute } from "../metadata-routes.js";
+import {
+  initMetadataStore,
+  resetMetadataStoreForTests,
+} from "../../records/metadata-store.js";
+
+const SERVICE_TOKEN = "test-metadata-token";
+
+function makeRecord(): CredentialRecord {
+  return {
+    credentialId: "id-1",
+    service: "github",
+    field: "token",
+    allowedTools: ["assistant_browser_fill_credential"],
+    allowedDomains: ["github.com"],
+    createdAt: 10,
+    updatedAt: 20,
+  };
+}
+
+function makeRequest(method: string, path: string, body?: unknown): Request {
+  return new Request(`http://localhost:8090${path}`, {
+    method,
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${SERVICE_TOKEN}`,
+    },
+    ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+  });
+}
+
+describe("credential metadata HTTP routes", () => {
+  afterEach(() => {
+    resetMetadataStoreForTests();
+    delete process.env.CES_SERVICE_TOKEN;
+  });
+
+  test("put, get, list, and delete a record", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "ces-metadata-http-"));
+    initMetadataStore(dir);
+    process.env.CES_SERVICE_TOKEN = SERVICE_TOKEN;
+    const account = "credential/github/token";
+    const record = makeRecord();
+
+    const put = await handleMetadataRoute(
+      makeRequest("PUT", `/v1/metadata/${encodeURIComponent(account)}`, {
+        record,
+      }),
+    );
+    expect(put?.status).toBe(200);
+
+    const get = await handleMetadataRoute(
+      makeRequest("GET", `/v1/metadata/${encodeURIComponent(account)}`),
+    );
+    expect(get?.status).toBe(200);
+    expect(await get!.json()).toEqual({ account, record });
+
+    const list = await handleMetadataRoute(makeRequest("GET", "/v1/metadata"));
+    expect(list?.status).toBe(200);
+    expect(await list!.json()).toEqual({ records: [{ account, record }] });
+
+    const del = await handleMetadataRoute(
+      makeRequest("DELETE", `/v1/metadata/${encodeURIComponent(account)}`),
+    );
+    expect(del?.status).toBe(200);
+  });
+
+  test("rejects requests without a bearer token", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "ces-metadata-http-"));
+    initMetadataStore(dir);
+    process.env.CES_SERVICE_TOKEN = SERVICE_TOKEN;
+    const res = await handleMetadataRoute(
+      new Request("http://localhost:8090/v1/metadata", { method: "GET" }),
+    );
+    expect(res?.status).toBe(401);
+  });
+});