@mycadet/credential-executor 0.0.1 → 0.12.6-dev.202610080043.b727a33

package/src/http/credential-routes.ts

@@ -0,0 +1,310 @@
+/**
+ * Credential CRUD HTTP endpoints for the CES managed service.
+ *
+ * Exposes credential management over HTTP so the assistant and gateway
+ * can access credentials via the network instead of reading keys.enc
+ * directly from a shared volume.
+ *
+ * Endpoints:
+ * - `GET  /v1/credentials`           — list credential account names
+ * - `POST /v1/credentials/bulk`      — bulk set credentials
+ * - `GET  /v1/credentials/:account`  — get a credential value
+ * - `POST /v1/credentials/:account`  — set a credential value
+ * - `DELETE /v1/credentials/:account` — delete a credential
+ *
+ * Auth: All endpoints require a `CES_SERVICE_TOKEN` bearer token in the
+ * `Authorization` header. Both the CES and its callers share this token
+ * via the environment.
+ */
+
+import { timingSafeEqual } from "node:crypto";
+
+import type { SecureKeyBackend } from "@mycadet/credential-storage";
+
+// ---------------------------------------------------------------------------
+// Account key normalization
+// ---------------------------------------------------------------------------
+
+/**
+ * Known internal key prefixes. Keys in the encrypted store use slash-separated
+ * paths (e.g. `credential/cadet/platform_organization_id`), but callers
+ * (especially manual `curl` invocations) often use the colon-separated format
+ * visible in the CLI (e.g. `cadet:platform_organization_id`).
+ *
+ * This normalizer transparently converts colon-separated credential names
+ * to the internal format so writes land under the correct key. Without this,
+ * a credential stored as `cadet:platform_organization_id` would silently
+ * succeed but be invisible to the gateway and assistant, which look up
+ * `credential/cadet/platform_organization_id`.
+ */
+const CREDENTIAL_PREFIX = "credential/";
+
+function normalizeAccountKey(account: string): string {
+  // Already in internal format — pass through
+  if (account.startsWith(CREDENTIAL_PREFIX)) {
+    return account;
+  }
+
+  // Other known internal prefixes — pass through as-is
+  if (account.startsWith("oauth/")) {
+    return account;
+  }
+
+  // Convert "service:field" → "credential/service/field"
+  // Use lastIndexOf to match the canonical split in secret-routes.ts
+  // (e.g. "integration:google:access_token" → service="integration:google", field="access_token")
+  const colonIdx = account.lastIndexOf(":");
+  if (colonIdx > 0 && colonIdx < account.length - 1) {
+    const service = account.slice(0, colonIdx);
+    const field = account.slice(colonIdx + 1);
+    return `${CREDENTIAL_PREFIX}${service}/${field}`;
+  }
+
+  // Unrecognized format — return as-is (will likely fail lookup, which is fine)
+  return account;
+}
+
+// ---------------------------------------------------------------------------
+// Auth
+// ---------------------------------------------------------------------------
+
+/**
+ * Validate the Authorization header against the configured service token.
+ * Returns an error Response if auth fails, or null if auth succeeds.
+ */
+function checkAuth(req: Request, serviceToken: string): Response | null {
+  const authHeader = req.headers.get("authorization");
+  if (!authHeader) {
+    return new Response(
+      JSON.stringify({ error: "Missing Authorization header" }),
+      { status: 401, headers: { "Content-Type": "application/json" } },
+    );
+  }
+
+  const parts = authHeader.split(" ");
+  if (parts.length !== 2 || parts[0]!.toLowerCase() !== "bearer") {
+    return new Response(
+      JSON.stringify({
+        error: "Invalid Authorization header format. Expected: Bearer <token>",
+      }),
+      { status: 401, headers: { "Content-Type": "application/json" } },
+    );
+  }
+
+  const provided = Buffer.from(parts[1]!);
+  const expected = Buffer.from(serviceToken);
+  if (
+    provided.length !== expected.length ||
+    !timingSafeEqual(provided, expected)
+  ) {
+    return new Response(JSON.stringify({ error: "Invalid service token" }), {
+      status: 403,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// Route handler
+// ---------------------------------------------------------------------------
+
+export interface CredentialRouteDeps {
+  /** The secure key backend to wrap. */
+  backend: SecureKeyBackend;
+  /** Service token for authenticating requests. */
+  serviceToken: string;
+}
+
+const CREDENTIAL_PATH_PREFIX = "/v1/credentials";
+
+/**
+ * Try to handle a credential CRUD request. Returns a Response if the
+ * request matches a credential route, or null if it doesn't match
+ * (allowing the caller to fall through to other routes).
+ */
+export async function handleCredentialRoute(
+  req: Request,
+  deps: CredentialRouteDeps,
+): Promise<Response | null> {
+  const url = new URL(req.url);
+  const { pathname } = url;
+
+  // Only handle /v1/credentials paths
+  if (!pathname.startsWith(CREDENTIAL_PATH_PREFIX)) {
+    return null;
+  }
+
+  // Auth check
+  const authError = checkAuth(req, deps.serviceToken);
+  if (authError) return authError;
+
+  const { backend } = deps;
+
+  // Extract account from path: /v1/credentials/:account
+  const accountSegment = pathname.slice(CREDENTIAL_PATH_PREFIX.length);
+
+  // POST /v1/credentials/bulk — bulk set credentials
+  // Only intercept POST; other methods (GET, DELETE) fall through to the
+  // :account handler so a credential literally named "bulk" stays accessible.
+  if (accountSegment === "/bulk" && req.method === "POST") {
+    let body: { credentials?: unknown };
+    try {
+      body = await req.json();
+    } catch {
+      return new Response(JSON.stringify({ error: "Invalid JSON body" }), {
+        status: 400,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+
+    if (!Array.isArray(body.credentials)) {
+      return new Response(
+        JSON.stringify({
+          error: "Body must contain a 'credentials' array field",
+        }),
+        { status: 400, headers: { "Content-Type": "application/json" } },
+      );
+    }
+
+    for (const entry of body.credentials) {
+      if (
+        typeof entry !== "object" ||
+        entry === null ||
+        typeof entry.account !== "string" ||
+        typeof entry.value !== "string"
+      ) {
+        return new Response(
+          JSON.stringify({
+            error:
+              "Each credential entry must have string 'account' and 'value' fields",
+          }),
+          { status: 400, headers: { "Content-Type": "application/json" } },
+        );
+      }
+    }
+
+    const results: Array<{ account: string; ok: boolean }> = [];
+    for (const entry of body.credentials as Array<{
+      account: string;
+      value: string;
+    }>) {
+      const normalized = normalizeAccountKey(entry.account);
+      const ok = await backend.set(normalized, entry.value);
+      results.push({ account: normalized, ok: !!ok });
+    }
+
+    return new Response(JSON.stringify({ results }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  // GET /v1/credentials — list all credential account names
+  if (accountSegment === "" || accountSegment === "/") {
+    if (req.method !== "GET") {
+      return new Response(JSON.stringify({ error: "Method not allowed" }), {
+        status: 405,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+
+    const accounts = await backend.list();
+    return new Response(JSON.stringify({ accounts }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  // Remaining routes require /:account
+  if (!accountSegment.startsWith("/")) {
+    return null; // Not a credential route
+  }
+
+  const rawAccount = decodeURIComponent(accountSegment.slice(1));
+  if (!rawAccount) {
+    return new Response(JSON.stringify({ error: "Account name is required" }), {
+      status: 400,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const account = normalizeAccountKey(rawAccount);
+
+  switch (req.method) {
+    // GET /v1/credentials/:account — get credential value
+    case "GET": {
+      const value = await backend.get(account);
+      if (value === undefined) {
+        return new Response(
+          JSON.stringify({ error: "Credential not found", account }),
+          { status: 404, headers: { "Content-Type": "application/json" } },
+        );
+      }
+      return new Response(JSON.stringify({ account, value }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+
+    // POST /v1/credentials/:account — set credential value
+    case "POST": {
+      let body: { value?: string };
+      try {
+        body = await req.json();
+      } catch {
+        return new Response(JSON.stringify({ error: "Invalid JSON body" }), {
+          status: 400,
+          headers: { "Content-Type": "application/json" },
+        });
+      }
+
+      if (typeof body.value !== "string") {
+        return new Response(
+          JSON.stringify({ error: "Body must contain a 'value' string field" }),
+          { status: 400, headers: { "Content-Type": "application/json" } },
+        );
+      }
+
+      const ok = await backend.set(account, body.value);
+      if (!ok) {
+        return new Response(
+          JSON.stringify({ error: "Failed to set credential", account }),
+          { status: 500, headers: { "Content-Type": "application/json" } },
+        );
+      }
+      return new Response(JSON.stringify({ ok: true, account }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+
+    // DELETE /v1/credentials/:account — delete credential
+    case "DELETE": {
+      const result = await backend.delete(account);
+      if (result === "not-found") {
+        return new Response(
+          JSON.stringify({ error: "Credential not found", account }),
+          { status: 404, headers: { "Content-Type": "application/json" } },
+        );
+      }
+      if (result === "error") {
+        return new Response(
+          JSON.stringify({ error: "Failed to delete credential", account }),
+          { status: 500, headers: { "Content-Type": "application/json" } },
+        );
+      }
+      return new Response(JSON.stringify({ ok: true, account }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+
+    default:
+      return new Response(JSON.stringify({ error: "Method not allowed" }), {
+        status: 405,
+        headers: { "Content-Type": "application/json" },
+      });
+  }
+}

package/src/http/log-export-routes.test.ts

@@ -0,0 +1,249 @@
+/**
+ * Tests for the CES log export route handler.
+ *
+ * Verifies:
+ * - Returns a valid tar.gz archive containing CES log files
+ * - Filters log files by startTime query param
+ * - Filters log files by endTime query param
+ * - Returns an empty archive (manifest only) when no logs exist
+ * - Returns 401/403 without a valid service token
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from "bun:test";
+import {
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+
+import { handleLogExportRoute } from "./log-export-routes.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const SERVICE_TOKEN = "test-ces-service-token-12345";
+
+let tmpLogDir: string;
+
+function makeRequest(
+  opts: {
+    startTime?: number;
+    endTime?: number;
+    token?: string | null;
+    method?: string;
+  } = {},
+): Request {
+  const params = new URLSearchParams();
+  if (opts.startTime !== undefined)
+    params.set("startTime", String(opts.startTime));
+  if (opts.endTime !== undefined) params.set("endTime", String(opts.endTime));
+
+  const qs = params.toString();
+  const url = `http://localhost:8090/v1/logs/export${qs ? `?${qs}` : ""}`;
+
+  const headers: Record<string, string> = {};
+  if (opts.token !== null) {
+    headers["Authorization"] = `Bearer ${opts.token ?? SERVICE_TOKEN}`;
+  }
+
+  return new Request(url, { method: opts.method ?? "GET", headers });
+}
+
+/**
+ * Extract a tar.gz buffer and return the list of file paths inside.
+ */
+function extractTarGzEntries(buf: ArrayBuffer): string[] {
+  const staging = mkdtempSync(join(tmpdir(), "ces-test-extract-"));
+  try {
+    const tarGzPath = join(staging, "archive.tar.gz");
+    writeFileSync(tarGzPath, Buffer.from(buf));
+
+    const extractDir = join(staging, "out");
+    mkdirSync(extractDir, { recursive: true });
+
+    const proc = spawnSync("tar", ["xzf", tarGzPath, "-C", extractDir]);
+    if (proc.status !== 0) {
+      throw new Error(
+        `tar extraction failed: ${proc.stderr?.toString() ?? "unknown"}`,
+      );
+    }
+
+    // Recursively list all files
+    const files: string[] = [];
+    function walk(dir: string, prefix: string) {
+      for (const entry of readdirSync(dir)) {
+        const full = join(dir, entry);
+        const rel = prefix ? `${prefix}/${entry}` : entry;
+        if (statSync(full).isDirectory()) {
+          walk(full, rel);
+        } else {
+          files.push(rel);
+        }
+      }
+    }
+    walk(extractDir, "");
+    return files.sort();
+  } finally {
+    rmSync(staging, { recursive: true, force: true });
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Setup / Teardown
+// ---------------------------------------------------------------------------
+
+beforeEach(() => {
+  tmpLogDir = mkdtempSync(join(tmpdir(), "ces-log-export-test-"));
+  process.env["CES_SERVICE_TOKEN"] = SERVICE_TOKEN;
+});
+
+afterEach(() => {
+  rmSync(tmpLogDir, { recursive: true, force: true });
+  delete process.env["CES_SERVICE_TOKEN"];
+});
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("CES log export route", () => {
+  it("returns tar.gz with CES log files", async () => {
+    // Create test log files
+    writeFileSync(join(tmpLogDir, "ces-2025-01-15.log"), "log line 1\n");
+    writeFileSync(join(tmpLogDir, "ces-2025-01-16.log"), "log line 2\n");
+
+    const res = await handleLogExportRoute(makeRequest(), tmpLogDir);
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(200);
+    expect(res!.headers.get("Content-Type")).toBe("application/gzip");
+
+    const buf = await res!.arrayBuffer();
+    const entries = extractTarGzEntries(buf);
+
+    // Should contain the manifest and the two log files
+    expect(entries).toContain("ces-export-manifest.json");
+    expect(entries).toContain("ces-logs/ces-2025-01-15.log");
+    expect(entries).toContain("ces-logs/ces-2025-01-16.log");
+  });
+
+  it("filters by startTime query param", async () => {
+    // 2025-01-15 = 1736899200000 (start of day UTC)
+    // 2025-01-16 = 1736985600000 (start of day UTC)
+    // 2025-01-17 = 1737072000000 (start of day UTC)
+    writeFileSync(join(tmpLogDir, "ces-2025-01-15.log"), "old log\n");
+    writeFileSync(join(tmpLogDir, "ces-2025-01-16.log"), "recent log\n");
+    writeFileSync(join(tmpLogDir, "ces-2025-01-17.log"), "newest log\n");
+
+    // startTime at 2025-01-16 12:00:00 UTC — should include 01-16 and 01-17
+    // because 01-16 day end (23:59:59.999) >= startTime
+    const startTime = new Date("2025-01-16T12:00:00Z").getTime();
+    const res = await handleLogExportRoute(
+      makeRequest({ startTime }),
+      tmpLogDir,
+    );
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(200);
+
+    const entries = extractTarGzEntries(await res!.arrayBuffer());
+    expect(entries).not.toContain("ces-logs/ces-2025-01-15.log");
+    expect(entries).toContain("ces-logs/ces-2025-01-16.log");
+    expect(entries).toContain("ces-logs/ces-2025-01-17.log");
+  });
+
+  it("filters by endTime query param", async () => {
+    writeFileSync(join(tmpLogDir, "ces-2025-01-15.log"), "old log\n");
+    writeFileSync(join(tmpLogDir, "ces-2025-01-16.log"), "recent log\n");
+    writeFileSync(join(tmpLogDir, "ces-2025-01-17.log"), "newest log\n");
+
+    // endTime at 2025-01-16 00:00:00 UTC — should include 01-15 and 01-16
+    // because 01-16 day start (00:00:00) <= endTime, but 01-17 day start > endTime
+    const endTime = new Date("2025-01-16T00:00:00Z").getTime();
+    const res = await handleLogExportRoute(makeRequest({ endTime }), tmpLogDir);
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(200);
+
+    const entries = extractTarGzEntries(await res!.arrayBuffer());
+    expect(entries).toContain("ces-logs/ces-2025-01-15.log");
+    expect(entries).toContain("ces-logs/ces-2025-01-16.log");
+    expect(entries).not.toContain("ces-logs/ces-2025-01-17.log");
+  });
+
+  it("returns empty archive when no logs exist", async () => {
+    // tmpLogDir exists but has no log files
+    const res = await handleLogExportRoute(makeRequest(), tmpLogDir);
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(200);
+
+    const entries = extractTarGzEntries(await res!.arrayBuffer());
+    // Should still contain the manifest
+    expect(entries).toContain("ces-export-manifest.json");
+    // No log files in ces-logs/
+    const logFiles = entries.filter((e) => e.startsWith("ces-logs/"));
+    expect(logFiles.length).toBe(0);
+  });
+
+  it("returns 401 without Authorization header", async () => {
+    const res = await handleLogExportRoute(
+      makeRequest({ token: null }),
+      tmpLogDir,
+    );
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(401);
+
+    const body = await res!.json();
+    expect(body.error).toMatch(/Missing Authorization/i);
+  });
+
+  it("returns 403 with wrong service token", async () => {
+    const res = await handleLogExportRoute(
+      makeRequest({ token: "wrong-token-value" }),
+      tmpLogDir,
+    );
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(403);
+
+    const body = await res!.json();
+    expect(body.error).toMatch(/Invalid service token/i);
+  });
+
+  it("returns null for non-matching paths", async () => {
+    const req = new Request("http://localhost:8090/v1/other", {
+      method: "GET",
+      headers: { Authorization: `Bearer ${SERVICE_TOKEN}` },
+    });
+    const res = await handleLogExportRoute(req, tmpLogDir);
+    expect(res).toBeNull();
+  });
+
+  it("returns 405 for non-GET methods on the export path", async () => {
+    const res = await handleLogExportRoute(
+      makeRequest({ method: "POST" }),
+      tmpLogDir,
+    );
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(405);
+  });
+
+  it("ignores non-log files in the directory", async () => {
+    writeFileSync(join(tmpLogDir, "ces-2025-01-15.log"), "real log\n");
+    writeFileSync(join(tmpLogDir, "random-file.txt"), "not a log\n");
+    writeFileSync(join(tmpLogDir, "ces-bad-date.log"), "bad pattern\n");
+
+    const res = await handleLogExportRoute(makeRequest(), tmpLogDir);
+    expect(res).not.toBeNull();
+    expect(res!.status).toBe(200);
+
+    const entries = extractTarGzEntries(await res!.arrayBuffer());
+    expect(entries).toContain("ces-logs/ces-2025-01-15.log");
+    // Non-matching files should not be included
+    const logFiles = entries.filter((e) => e.startsWith("ces-logs/"));
+    expect(logFiles.length).toBe(1);
+  });
+});