@mycadet/credential-executor 0.0.1 → 0.12.6-dev.202610080043.b727a33

package/src/http/log-export-routes.ts

@@ -0,0 +1,220 @@
+/**
+ * Log export HTTP endpoint for the CES managed service.
+ *
+ * Exposes a single `GET /v1/logs/export` endpoint that collects CES log
+ * files, archives them as a tar.gz, and returns the archive. The gateway
+ * calls this endpoint to collect CES logs alongside daemon and gateway
+ * logs during a diagnostic log export.
+ *
+ * Auth: Requires a `CES_SERVICE_TOKEN` bearer token in the
+ * `Authorization` header (same token used for credential CRUD).
+ */
+
+import { spawnSync } from "node:child_process";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { timingSafeEqual } from "node:crypto";
+
+import { LOG_FILE_PATTERN } from "../logger.js";
+
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+
+/** Maximum cumulative size of collected log files (5 MB). */
+const MAX_LOG_BYTES = 5 * 1024 * 1024;
+
+// ---------------------------------------------------------------------------
+// Auth
+// ---------------------------------------------------------------------------
+
+/**
+ * Validate the Authorization header against the configured service token.
+ * Returns an error Response if auth fails, or null if auth succeeds.
+ */
+function checkAuth(req: Request, serviceToken: string): Response | null {
+  const authHeader = req.headers.get("authorization");
+  if (!authHeader) {
+    return new Response(
+      JSON.stringify({ error: "Missing Authorization header" }),
+      { status: 401, headers: { "Content-Type": "application/json" } },
+    );
+  }
+
+  const parts = authHeader.split(" ");
+  if (parts.length !== 2 || parts[0]!.toLowerCase() !== "bearer") {
+    return new Response(
+      JSON.stringify({ error: "Invalid Authorization header format. Expected: Bearer <token>" }),
+      { status: 401, headers: { "Content-Type": "application/json" } },
+    );
+  }
+
+  const provided = Buffer.from(parts[1]!);
+  const expected = Buffer.from(serviceToken);
+  if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {
+    return new Response(
+      JSON.stringify({ error: "Invalid service token" }),
+      { status: 403, headers: { "Content-Type": "application/json" } },
+    );
+  }
+
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// Route handler
+// ---------------------------------------------------------------------------
+
+/**
+ * Try to handle a log export request. Returns a Response if the request
+ * matches `GET /v1/logs/export`, or null if it doesn't match (allowing the
+ * caller to fall through to other routes).
+ */
+export async function handleLogExportRoute(
+  req: Request,
+  logDir: string,
+): Promise<Response | null> {
+  const url = new URL(req.url);
+
+  // Only handle GET /v1/logs/export
+  if (url.pathname !== "/v1/logs/export") {
+    return null;
+  }
+
+  if (req.method !== "GET") {
+    return new Response(
+      JSON.stringify({ error: "Method not allowed" }),
+      { status: 405, headers: { "Content-Type": "application/json" } },
+    );
+  }
+
+  // Auth check
+  const serviceToken = process.env["CES_SERVICE_TOKEN"] ?? "";
+  if (!serviceToken) {
+    return new Response(
+      JSON.stringify({ error: "CES_SERVICE_TOKEN not configured" }),
+      { status: 500, headers: { "Content-Type": "application/json" } },
+    );
+  }
+
+  const authError = checkAuth(req, serviceToken);
+  if (authError) return authError;
+
+  // Parse optional time range query params
+  const startTimeParam = url.searchParams.get("startTime");
+  const endTimeParam = url.searchParams.get("endTime");
+  const startTime = startTimeParam ? Number(startTimeParam) : undefined;
+  const endTime = endTimeParam ? Number(endTimeParam) : undefined;
+
+  const staging = mkdtempSync(join(tmpdir(), "ces-log-export-"));
+
+  try {
+    const logsStaging = join(staging, "ces-logs");
+    mkdirSync(logsStaging, { recursive: true });
+
+    let totalBytes = 0;
+    let filesCollected = 0;
+
+    if (existsSync(logDir)) {
+      const entries = readdirSync(logDir);
+      for (const entry of entries) {
+        const dateMatch = LOG_FILE_PATTERN.exec(entry);
+        if (!dateMatch) continue;
+
+        // Filter by date when startTime/endTime are provided.
+        // Parse the date from the filename and compare start-of-day / end-of-day
+        // against the time bounds.
+        const fileDateStr = dateMatch[1]!;
+        const fileDayStartMs = new Date(fileDateStr + "T00:00:00.000Z").getTime();
+        const fileDayEndMs = new Date(fileDateStr + "T23:59:59.999Z").getTime();
+
+        if (startTime !== undefined && fileDayEndMs < startTime) continue; // entire day before range
+        if (endTime !== undefined && fileDayStartMs > endTime) continue; // entire day after range
+
+        const filePath = join(logDir, entry);
+        try {
+          const stat = statSync(filePath);
+          if (!stat.isFile()) continue;
+          if (totalBytes + stat.size > MAX_LOG_BYTES) continue;
+
+          // Copy the file to the staging directory via Bun.file for efficiency,
+          // but fall back to sync fs for portability in the spawnSync-based flow.
+          const content = await Bun.file(filePath).arrayBuffer();
+          writeFileSync(join(logsStaging, entry), Buffer.from(content));
+          totalBytes += stat.size;
+          filesCollected++;
+        } catch {
+          // Skip unreadable files
+        }
+      }
+    }
+
+    // Always write a manifest so the consumer knows what was collected
+    const manifest = {
+      type: "ces-log-export",
+      exportedAt: new Date().toISOString(),
+      filesCollected,
+      totalBytes,
+      ...(startTime !== undefined ? { startTime } : {}),
+      ...(endTime !== undefined ? { endTime } : {}),
+    };
+    writeFileSync(
+      join(staging, "ces-export-manifest.json"),
+      JSON.stringify(manifest, null, 2),
+      "utf-8",
+    );
+
+    // Create tar.gz archive of the staging directory
+    const proc = spawnSync("tar", ["czf", "-", "-C", staging, "."], {
+      maxBuffer: MAX_LOG_BYTES * 2, // allow headroom for tar overhead
+      timeout: 30_000,
+      windowsHide: true,
+    });
+
+    if (proc.status !== 0) {
+      const stderr = proc.stderr
+        ? Buffer.isBuffer(proc.stderr)
+          ? proc.stderr.toString("utf-8")
+          : String(proc.stderr)
+        : "unknown error";
+      return new Response(
+        JSON.stringify({ error: "Failed to create archive", detail: stderr }),
+        { status: 500, headers: { "Content-Type": "application/json" } },
+      );
+    }
+
+    const archiveBuffer = Buffer.isBuffer(proc.stdout)
+      ? proc.stdout
+      : Buffer.from(proc.stdout);
+
+    return new Response(
+      archiveBuffer.buffer.slice(
+        archiveBuffer.byteOffset,
+        archiveBuffer.byteOffset + archiveBuffer.byteLength,
+      ),
+      {
+        status: 200,
+        headers: {
+          "Content-Type": "application/gzip",
+          "Content-Disposition": 'attachment; filename="ces-logs.tar.gz"',
+          "Content-Length": String(archiveBuffer.byteLength),
+        },
+      },
+    );
+  } finally {
+    try {
+      rmSync(staging, { recursive: true, force: true });
+    } catch {
+      // Best-effort cleanup
+    }
+  }
+}

package/src/http/loopback-address.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  isCesHttpProbePath,
+  isLoopbackAddress,
+} from "./loopback-address.js";
+
+describe("isLoopbackAddress", () => {
+  test("accepts IPv4 loopback", () => {
+    expect(isLoopbackAddress("127.0.0.1")).toBe(true);
+    expect(isLoopbackAddress("127.0.0.2")).toBe(true);
+  });
+
+  test("accepts IPv6 loopback and IPv4-mapped loopback", () => {
+    expect(isLoopbackAddress("::1")).toBe(true);
+    expect(isLoopbackAddress("::ffff:127.0.0.1")).toBe(true);
+  });
+
+  test("rejects non-loopback addresses", () => {
+    expect(isLoopbackAddress("10.0.0.1")).toBe(false);
+    expect(isLoopbackAddress("192.168.1.10")).toBe(false);
+    expect(isLoopbackAddress("8.8.8.8")).toBe(false);
+    expect(isLoopbackAddress("::ffff:10.0.0.1")).toBe(false);
+    expect(isLoopbackAddress("2001:db8::1")).toBe(false);
+  });
+});
+
+describe("isCesHttpProbePath", () => {
+  test("matches kubelet probe paths only", () => {
+    expect(isCesHttpProbePath("/healthz")).toBe(true);
+    expect(isCesHttpProbePath("/readyz")).toBe(true);
+    expect(isCesHttpProbePath("/v1/credentials")).toBe(false);
+    expect(isCesHttpProbePath("/v1/logs/export")).toBe(false);
+  });
+});

package/src/http/loopback-address.ts

@@ -0,0 +1,25 @@
+/**
+ * Strict loopback check for CES HTTP peers: 127.0.0.0/8 and ::1.
+ * IPv4-mapped IPv6 (`::ffff:127.0.0.1`) is treated as IPv4.
+ */
+export function isLoopbackAddress(addr: string): boolean {
+  const v4Mapped = addr.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
+  const normalized = v4Mapped ? v4Mapped[1] : addr;
+
+  if (normalized.includes(".")) {
+    const parts = normalized.split(".").map(Number);
+    if (
+      parts.length !== 4 ||
+      parts.some((p) => Number.isNaN(p) || p < 0 || p > 255)
+    ) {
+      return false;
+    }
+    return parts[0] === 127;
+  }
+
+  return normalized.toLowerCase() === "::1";
+}
+
+export function isCesHttpProbePath(pathname: string): boolean {
+  return pathname === "/healthz" || pathname === "/readyz";
+}

package/src/http/metadata-routes.ts

@@ -0,0 +1,200 @@
+/**
+ * HTTP endpoints for CES credential metadata (identity + policy).
+ *
+ * - `GET    /v1/metadata`              : list records
+ * - `POST   /v1/metadata/bulk`         : bulk set records
+ * - `GET    /v1/metadata/:account`     : get one record
+ * - `PUT    /v1/metadata/:account`     : set one record
+ * - `DELETE /v1/metadata/:account`     : delete one record
+ *
+ * Auth: same `CES_SERVICE_TOKEN` bearer as secret CRUD.
+ */
+
+import { timingSafeEqual } from "node:crypto";
+
+import { CredentialRecordSchema } from "@mycadet/service-contracts/credential-rpc";
+
+import { getMetadataStore } from "../records/metadata-store.js";
+
+const METADATA_PATH_PREFIX = "/v1/metadata";
+
+function serviceToken(): string {
+  return process.env["CES_SERVICE_TOKEN"] ?? "";
+}
+
+function checkAuth(req: Request): Response | null {
+  const expectedToken = serviceToken();
+  if (!expectedToken) {
+    return new Response(JSON.stringify({ error: "Missing service token" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const authHeader = req.headers.get("authorization");
+  if (!authHeader) {
+    return new Response(
+      JSON.stringify({ error: "Missing Authorization header" }),
+      { status: 401, headers: { "Content-Type": "application/json" } },
+    );
+  }
+
+  const parts = authHeader.split(" ");
+  if (parts.length !== 2 || parts[0]!.toLowerCase() !== "bearer") {
+    return new Response(
+      JSON.stringify({
+        error: "Invalid Authorization header format. Expected: Bearer <token>",
+      }),
+      { status: 401, headers: { "Content-Type": "application/json" } },
+    );
+  }
+
+  const provided = Buffer.from(parts[1]!);
+  const expected = Buffer.from(expectedToken);
+  if (
+    provided.length !== expected.length ||
+    !timingSafeEqual(provided, expected)
+  ) {
+    return new Response(JSON.stringify({ error: "Invalid service token" }), {
+      status: 403,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  return null;
+}
+
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+export async function handleMetadataRoute(
+  req: Request,
+): Promise<Response | null> {
+  const url = new URL(req.url);
+  const { pathname } = url;
+
+  if (!pathname.startsWith(METADATA_PATH_PREFIX)) {
+    return null;
+  }
+
+  const authError = checkAuth(req);
+  if (authError) {
+    return authError;
+  }
+
+  const recordStore = getMetadataStore();
+  const rest = pathname.slice(METADATA_PATH_PREFIX.length);
+
+  if ((rest === "" || rest === "/") && req.method === "GET") {
+    return json({ records: recordStore.list() });
+  }
+
+  if (rest === "/bulk" && req.method === "POST") {
+    let body: { records?: unknown };
+    try {
+      body = await req.json();
+    } catch {
+      return json({ error: "Invalid JSON body" }, 400);
+    }
+    if (!Array.isArray(body.records)) {
+      return json({ error: "Body must contain a 'records' array field" }, 400);
+    }
+    const results: Array<{ account: string; ok: boolean }> = [];
+    for (const entry of body.records) {
+      if (
+        typeof entry !== "object" ||
+        entry === null ||
+        typeof (entry as { account?: unknown }).account !== "string"
+      ) {
+        return json(
+          { error: "Each record entry must have a string 'account' field" },
+          400,
+        );
+      }
+      const parsed = CredentialRecordSchema.safeParse(
+        (entry as { record?: unknown }).record,
+      );
+      if (!parsed.success) {
+        return json(
+          { error: "Each record entry must have a valid record" },
+          400,
+        );
+      }
+      const account = (entry as { account: string }).account;
+      const ok = recordStore.setByAccount(account, parsed.data);
+      results.push({ account, ok });
+    }
+    return json({ results });
+  }
+
+  if (!rest.startsWith("/")) {
+    return null;
+  }
+
+  const rawAccount = decodeURIComponent(rest.slice(1));
+  if (!rawAccount) {
+    return json({ error: "Account name is required" }, 400);
+  }
+
+  switch (req.method) {
+    case "GET": {
+      const record = recordStore.getByAccount(rawAccount);
+      if (!record) {
+        return json(
+          { error: "Credential metadata not found", account: rawAccount },
+          404,
+        );
+      }
+      return json({ account: rawAccount, record });
+    }
+    case "PUT": {
+      let body: { record?: unknown };
+      try {
+        body = await req.json();
+      } catch {
+        return json({ error: "Invalid JSON body" }, 400);
+      }
+      const parsed = CredentialRecordSchema.safeParse(body.record);
+      if (!parsed.success) {
+        return json({ error: "Body must contain a valid 'record'" }, 400);
+      }
+      const ok = recordStore.setByAccount(rawAccount, parsed.data);
+      if (!ok) {
+        return json(
+          {
+            error:
+              "Failed to set credential metadata (account must match record service/field)",
+            account: rawAccount,
+          },
+          400,
+        );
+      }
+      return json({ ok: true, account: rawAccount });
+    }
+    case "DELETE": {
+      const result = recordStore.deleteByAccount(rawAccount);
+      if (result === "not-found") {
+        return json(
+          { error: "Credential metadata not found", account: rawAccount },
+          404,
+        );
+      }
+      if (result === "error") {
+        return json(
+          {
+            error: "Failed to delete credential metadata",
+            account: rawAccount,
+          },
+          400,
+        );
+      }
+      return json({ ok: true, account: rawAccount });
+    }
+    default:
+      return json({ error: "Method not allowed" }, 405);
+  }
+}

package/src/index.ts

@@ -0,0 +1,29 @@
+#!/usr/bin/env bun
+/**
+ * @mycadet/credential-executor
+ *
+ * Credential Execution Service (CES) — an isolated runtime that stores and
+ * serves credentials on behalf of the assistant daemon over RPC. The CES owns
+ * the credential store and exposes credential CRUD operations (get, set,
+ * delete, list, bulk-set) plus the managed-credential update handshake.
+ *
+ * This module re-exports the public API surface. For the entrypoint see
+ * `main.ts` — unified for both local (bare-metal sibling) and managed
+ * (Kubernetes sidecar) modes, selected by `getCesMode()`.
+ */
+
+export { CesRpcServer, createCesServer } from "./server.js";
+export type {
+  CesServerOptions,
+  RpcHandlerRegistry,
+  RpcMethodHandler,
+  SessionContext,
+} from "./server.js";
+
+export {
+  getCesDataRoot,
+  getCesMode,
+  getBootstrapSocketPath,
+  getHealthPort,
+} from "./paths.js";
+export type { CesMode } from "./paths.js";

package/src/log-redact.ts

@@ -0,0 +1,133 @@
+/**
+ * Pino log serializers that scrub sensitive data (bearer tokens, API keys,
+ * authorization headers) from logged values.
+ *
+ * Standalone copy for the credential-executor package — kept in sync with
+ * gateway/src/log-redact.ts and assistant/src/util/log-redact.ts.
+ */
+
+// ---------------------------------------------------------------------------
+// Sensitive-value patterns
+// ---------------------------------------------------------------------------
+
+const BEARER_RE = /Bearer [A-Za-z0-9._\-]+/g;
+
+const API_KEY_PATTERNS: RegExp[] = [
+  /AKIA[0-9A-Z]{16}/g,
+  /gh[pousr]_[A-Za-z0-9_]{36,255}/g,
+  /github_pat_[A-Za-z0-9_]{22,255}/g,
+  /glpat-[A-Za-z0-9\-_]{20,}/g,
+  /sk_live_[A-Za-z0-9]{24,}/g,
+  /rk_live_[A-Za-z0-9]{24,}/g,
+  /xoxb-[0-9]{10,}-[0-9]{10,}-[A-Za-z0-9]{24,}/g,
+  /xoxp-[0-9]{10,}-[0-9]{10,}-[0-9]{10,}-[a-f0-9]{32}/g,
+  /sk-ant-[A-Za-z0-9\-_]{80,}/g,
+  /sk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}/g,
+  /sk-proj-[A-Za-z0-9\-_]{40,}/g,
+  /AIza[A-Za-z0-9\-_]{35}/g,
+  /GOCSPX-[A-Za-z0-9\-_]{28}/g,
+  /SG\.[A-Za-z0-9\-_]{22}\.[A-Za-z0-9\-_]{43}/g,
+  /[0-9]{8,10}:[A-Za-z0-9_-]{35}/g,
+  /npm_[A-Za-z0-9]{36}/g,
+];
+
+const SENSITIVE_HEADERS = new Set([
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "x-auth-token",
+]);
+
+// ---------------------------------------------------------------------------
+// String redaction
+// ---------------------------------------------------------------------------
+
+function redactString(value: string): string {
+  let result = value;
+  result = result.replace(BEARER_RE, "Bearer [REDACTED]");
+  for (const pattern of API_KEY_PATTERNS) {
+    pattern.lastIndex = 0;
+    result = result.replace(pattern, "[REDACTED]");
+  }
+  return result;
+}
+
+// ---------------------------------------------------------------------------
+// Deep value redaction
+// ---------------------------------------------------------------------------
+
+function redactValue(value: unknown, depth: number): unknown {
+  if (depth > 8) return value;
+
+  if (typeof value === "string") {
+    return redactString(value);
+  }
+
+  if (Array.isArray(value)) {
+    return value.map((item) => redactValue(item, depth + 1));
+  }
+
+  if (value !== null && typeof value === "object") {
+    const result: Record<string, unknown> = {};
+    for (const [key, val] of Object.entries(value as Record<string, unknown>)) {
+      if (SENSITIVE_HEADERS.has(key.toLowerCase())) {
+        result[key] = "[REDACTED]";
+      } else {
+        result[key] = redactValue(val, depth + 1);
+      }
+    }
+    return result;
+  }
+
+  return value;
+}
+
+// ---------------------------------------------------------------------------
+// Error serialization — extracts non-enumerable Error fields and cause chain
+// ---------------------------------------------------------------------------
+
+function serializeError(err: unknown, depth: number): unknown {
+  if (depth > 8 || err == null) return err;
+
+  if (!(err instanceof Error)) {
+    return err;
+  }
+
+  const serialized: Record<string, unknown> = {
+    name: err.name,
+    message: err.message,
+  };
+
+  if ("code" in err && typeof (err as { code: unknown }).code === "string") {
+    serialized.code = (err as { code: string }).code;
+  }
+
+  if (err.stack) {
+    serialized.stack = err.stack;
+  }
+
+  if (err.cause !== undefined) {
+    serialized.cause = serializeError(err.cause, depth + 1);
+  }
+
+  // Preserve any additional enumerable properties
+  for (const [key, val] of Object.entries(err)) {
+    if (!(key in serialized)) {
+      serialized[key] = val;
+    }
+  }
+
+  return serialized;
+}
+
+// ---------------------------------------------------------------------------
+// Pino serializers
+// ---------------------------------------------------------------------------
+
+export const logSerializers: Record<string, (value: unknown) => unknown> = {
+  err: (err) => redactValue(serializeError(err, 0), 0),
+  req: (req) => redactValue(req, 0),
+  res: (res) => redactValue(res, 0),
+};