@mycadet/gateway 0.12.11 → 0.13.0

package/src/schema.ts

@@ -3989,309 +3989,6 @@ export function buildSchema(): Record<string, unknown> {
           },
         },
       },
-      "/v1/migrations/export": {
-        post: {
-          summary: "Export workspace backup",
-          description:
-            "Proxies a migration export request to the assistant daemon. Returns a binary .vbundle backup of the workspace. Authenticated with an edge JWT. Timeout is 120 seconds to accommodate large workspaces.",
-          operationId: "migrationExport",
-          security: [{ BearerAuth: [] }],
-          requestBody: {
-            required: false,
-            content: {
-              "application/json": {
-                schema: { type: "object", additionalProperties: true },
-              },
-            },
-          },
-          responses: {
-            "200": {
-              description: "Binary .vbundle backup file",
-              content: {
-                "application/octet-stream": {
-                  schema: { type: "string", format: "binary" },
-                },
-              },
-            },
-            "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "502": { description: "Failed to reach assistant daemon" },
-            "504": { description: "Assistant daemon request timed out" },
-          },
-        },
-      },
-      "/v1/migrations/import": {
-        post: {
-          summary: "Import workspace backup",
-          description:
-            "Proxies a migration import request to the assistant. Request shapes:\n" +
-            "\n" +
-            "  - `application/octet-stream`: raw .vbundle body. The request is proxied synchronously and the caller's connection stays open for the full import duration (returns 200 on success).\n" +
-            '  - `application/json` with `{ "url": "<signed GCS URL>" }` or `{ "path": "<staged workspace path>" }`: the gateway generates a jobId, kicks off the upstream assistant call in the background, and returns `202 Accepted` with `{ job_id, status: "pending" }` immediately. Callers poll `GET /v1/migrations/import/{jobId}/status` for progress. The path form points at a `.vbundle` staged under the assistant workspace `.restore-staging` directory.\n' +
-            "\n" +
-            "Authenticated with an edge JWT. Synchronous-path timeout is 60 minutes to accommodate large 8 GB backups; the async path returns immediately.",
-          operationId: "migrationImport",
-          security: [{ BearerAuth: [] }],
-          requestBody: {
-            required: true,
-            content: {
-              "application/octet-stream": {
-                schema: { type: "string", format: "binary" },
-              },
-              "application/json": {
-                schema: {
-                  oneOf: [
-                    {
-                      type: "object",
-                      required: ["url"],
-                      properties: {
-                        url: {
-                          type: "string",
-                          format: "uri",
-                          description:
-                            "Signed GCS URL pointing at a .vbundle archive.",
-                        },
-                      },
-                    },
-                    {
-                      type: "object",
-                      required: ["path"],
-                      properties: {
-                        path: {
-                          type: "string",
-                          minLength: 1,
-                          description:
-                            "Workspace-relative or absolute path to a staged .vbundle under .restore-staging.",
-                        },
-                      },
-                    },
-                  ],
-                },
-              },
-            },
-          },
-          responses: {
-            "200": {
-              description:
-                "Backup imported successfully (synchronous byte path).",
-            },
-            "202": {
-              description:
-                "Import accepted for async processing (JSON url or path body). Poll `/v1/migrations/import/{jobId}/status` for progress.",
-              content: {
-                "application/json": {
-                  schema: {
-                    type: "object",
-                    required: ["job_id", "status"],
-                    properties: {
-                      job_id: { type: "string" },
-                      status: { type: "string", enum: ["pending"] },
-                    },
-                  },
-                },
-              },
-            },
-            "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "502": { description: "Failed to reach assistant daemon" },
-            "504": { description: "Assistant daemon request timed out" },
-          },
-        },
-      },
-      "/v1/migrations/import/{jobId}/status": {
-        get: {
-          summary: "Poll async import job status",
-          description:
-            "Returns the current status of an async `.vbundle` import kicked off by `POST /v1/migrations/import` with a JSON `{url}` or `{path}` body. Finished jobs remain queryable for 30 minutes before being pruned.",
-          operationId: "migrationImportStatus",
-          security: [{ BearerAuth: [] }],
-          parameters: [
-            {
-              in: "path",
-              name: "jobId",
-              required: true,
-              schema: { type: "string" },
-              description:
-                "The `job_id` returned by the 202 response from `POST /v1/migrations/import`.",
-            },
-          ],
-          responses: {
-            "200": {
-              description: "Current job status.",
-              content: {
-                "application/json": {
-                  schema: {
-                    type: "object",
-                    required: ["job_id", "status"],
-                    properties: {
-                      job_id: { type: "string" },
-                      status: {
-                        type: "string",
-                        enum: ["pending", "processing", "complete", "failed"],
-                      },
-                      error: { type: "string" },
-                      result: {},
-                    },
-                  },
-                },
-              },
-            },
-            "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "404": {
-              description:
-                "Unknown job — never issued, or pruned after 30-minute TTL.",
-            },
-          },
-        },
-      },
-      "/v1/migrations/export-to-gcs": {
-        post: {
-          summary: "Kick off an async export-to-GCS job",
-          description:
-            "Transparent proxy to the assistant daemon's `POST /v1/migrations/export-to-gcs` endpoint. The daemon schedules a background export job that streams the workspace backup to the supplied signed GCS upload URL and returns `202 Accepted` with a `job_id`. Callers poll `GET /v1/migrations/jobs/{jobId}` for progress. Registered explicitly, not via the runtime-proxy catch-all, for dedicated auth and timeout handling.",
-          operationId: "migrationExportToGcs",
-          security: [{ BearerAuth: [] }],
-          requestBody: {
-            required: true,
-            content: {
-              "application/json": {
-                schema: { type: "object", additionalProperties: true },
-              },
-            },
-          },
-          responses: {
-            "202": {
-              description: "Export job accepted.",
-              content: {
-                "application/json": {
-                  schema: {
-                    type: "object",
-                    required: ["job_id"],
-                    properties: { job_id: { type: "string" } },
-                  },
-                },
-              },
-            },
-            "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "409": {
-              description: "Another export is already in flight.",
-            },
-            "502": { description: "Failed to reach assistant daemon" },
-            "504": { description: "Assistant daemon request timed out" },
-          },
-        },
-      },
-      "/v1/migrations/import-from-gcs": {
-        post: {
-          summary: "Kick off an async import-from-GCS job",
-          description:
-            "Transparent proxy to the assistant daemon's `POST /v1/migrations/import-from-gcs` endpoint. The daemon schedules a background import job that fetches a `.vbundle` archive at the supplied `bundle_url` and streams it through the importer, returning `202 Accepted` with a `job_id`. Callers poll `GET /v1/migrations/jobs/{jobId}` for progress. Registered explicitly, not via the runtime-proxy catch-all, for dedicated auth and timeout handling.",
-          operationId: "migrationImportFromGcs",
-          security: [{ BearerAuth: [] }],
-          requestBody: {
-            required: true,
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  required: ["bundle_url"],
-                  properties: {
-                    bundle_url: {
-                      type: "string",
-                      format: "uri",
-                      description:
-                        "Signed GCS URL pointing at a .vbundle archive.",
-                    },
-                  },
-                },
-              },
-            },
-          },
-          responses: {
-            "202": {
-              description: "Import job accepted.",
-              content: {
-                "application/json": {
-                  schema: {
-                    type: "object",
-                    required: ["job_id"],
-                    properties: { job_id: { type: "string" } },
-                  },
-                },
-              },
-            },
-            "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "409": {
-              description: "Another import is already in flight.",
-            },
-            "502": { description: "Failed to reach assistant daemon" },
-            "504": { description: "Assistant daemon request timed out" },
-          },
-        },
-      },
-      "/v1/migrations/jobs/{jobId}": {
-        get: {
-          summary: "Poll unified migration job status",
-          description:
-            "Transparent proxy to the assistant daemon's `GET /v1/migrations/jobs/{job_id}` endpoint. Returns the current status of an async export-to-GCS or import-from-GCS job tracked by the daemon's migration job registry. Registered explicitly, not via the runtime-proxy catch-all, for dedicated auth and timeout handling.",
-          operationId: "migrationJobStatus",
-          security: [{ BearerAuth: [] }],
-          parameters: [
-            {
-              in: "path",
-              name: "jobId",
-              required: true,
-              schema: { type: "string" },
-              description:
-                "The `job_id` returned by the 202 response from `POST /v1/migrations/export-to-gcs` or `POST /v1/migrations/import-from-gcs`.",
-            },
-          ],
-          responses: {
-            "200": {
-              description: "Current job status.",
-              content: {
-                "application/json": {
-                  schema: {
-                    type: "object",
-                    required: ["job_id", "type", "status"],
-                    properties: {
-                      job_id: { type: "string" },
-                      type: {
-                        type: "string",
-                        enum: ["export", "import"],
-                      },
-                      status: {
-                        type: "string",
-                        enum: ["processing", "complete", "failed"],
-                      },
-                      result: {},
-                      error: { type: "string" },
-                      error_code: { type: "string" },
-                      upstream_status: { type: "integer" },
-                    },
-                  },
-                },
-              },
-            },
-            "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "404": {
-              description: "Unknown job_id.",
-            },
-            "502": { description: "Failed to reach assistant daemon" },
-            "504": { description: "Assistant daemon request timed out" },
-          },
-        },
-      },
       "/v1/admin/workspace-commit": {
         post: {
           summary: "Commit workspace changes",
@@ -4431,50 +4128,37 @@ export function buildSchema(): Record<string, unknown> {
           },
         },
       },
-      "/v1/backups": {
+      "/v1/devices/mine": {
         get: {
-          summary: "List backup snapshots",
+          summary: "The caller's own paired-device row",
           description:
-            "Lists local and offsite backup snapshots. The gateway owns the backup encryption key and performs all encrypt/decrypt operations.",
-          operationId: "backupsList",
+            "Returns the paired-device row matching the presenting bearer token, so the paired web UI can surface 'this device' for matching against the host-side `cadet devices` list. Browser-reachable: the bearer is the credential, and the route answers only for the token presenting it. Not available on cloud-hosted assistants (they have no paired-device rows).",
+          operationId: "getMyDevice",
           security: [{ BearerAuth: [] }],
           responses: {
             "200": {
-              description: "Backup snapshots listed",
+              description: "The caller's paired-device row",
               content: {
                 "application/json": {
                   schema: {
                     type: "object",
-                    required: ["local", "offsite"],
+                    required: ["device"],
                     properties: {
-                      local: {
+                      device: {
                         type: "object",
-                        required: ["directory", "snapshots"],
+                        required: ["hashedDeviceId", "platform", "issuedAt"],
                         properties: {
-                          directory: { type: "string" },
-                          snapshots: {
-                            type: "array",
-                            items: {
-                              $ref: "#/components/schemas/BackupSnapshot",
-                            },
+                          hashedDeviceId: { type: "string" },
+                          platform: { type: "string" },
+                          pairingUserAgent: {
+                            type: ["string", "null"],
                           },
-                        },
-                      },
-                      offsite: {
-                        type: "array",
-                        items: {
-                          type: "object",
-                          required: ["directory", "encrypted", "snapshots"],
-                          properties: {
-                            directory: { type: "string" },
-                            encrypted: { type: "boolean" },
-                            snapshots: {
-                              type: "array",
-                              items: {
-                                $ref: "#/components/schemas/BackupSnapshot",
-                              },
-                            },
+                          clientReportedName: {
+                            type: ["string", "null"],
                           },
+                          issuedAt: { type: "string" },
+                          expiresAt: { type: ["string", "null"] },
+                          lastUsedAt: { type: ["string", "null"] },
                         },
                       },
                     },
@@ -4483,51 +4167,22 @@ export function buildSchema(): Record<string, unknown> {
               },
             },
             "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "403": { description: "Insufficient scope" },
-            "500": { description: "Internal server error" },
-          },
-        },
-      },
-      "/v1/backups/create": {
-        post: {
-          summary: "Create backup snapshot",
-          description:
-            "Triggers a manual backup snapshot. The gateway exports a plaintext vbundle from the daemon, writes it locally, and encrypts + mirrors to offsite destinations.",
-          operationId: "backupsCreate",
-          security: [{ BearerAuth: [] }],
-          responses: {
-            "200": {
-              description: "Backup snapshot created",
+              description: "Missing or invalid bearer token",
               content: {
                 "application/json": {
-                  schema: {
-                    type: "object",
-                    required: ["success", "local", "offsite", "duration_ms"],
-                    properties: {
-                      success: { type: "boolean" },
-                      local: {
-                        $ref: "#/components/schemas/BackupSnapshot",
-                      },
-                      offsite: {
-                        type: "array",
-                        items: { type: "object", additionalProperties: true },
-                      },
-                      duration_ms: { type: "number" },
-                    },
-                  },
+                  schema: { $ref: "#/components/schemas/ErrorResponse" },
                 },
               },
             },
-            "401": {
-              description: "Unauthorized — missing or invalid bearer token",
-            },
-            "403": { description: "Insufficient scope" },
-            "409": {
-              description: "A backup snapshot is already in progress",
+            "404": {
+              description:
+                "No paired-device row for this token, or the gateway is cloud-hosted",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/ErrorResponse" },
+                },
+              },
             },
-            "500": { description: "Internal server error" },
           },
         },
       },
@@ -4628,6 +4283,23 @@ export function buildSchema(): Record<string, unknown> {
                 },
               },
             },
+            "404": {
+              description: "Route not found on upstream runtime",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/ErrorResponse" },
+                },
+              },
+            },
+            "500": {
+              description:
+                "Server misconfigured (proxy auth enabled without token)",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/ErrorResponse" },
+                },
+              },
+            },
             "502": {
               description: "Upstream connection failed",
               content: {

package/src/__tests__/auth-fallback-count-tracker.test.ts

@@ -1,92 +0,0 @@
-import { describe, expect, test } from "bun:test";
-
-import { AuthFallbackCountTracker } from "../auth-fallback-count-tracker.js";
-
-describe("AuthFallbackCountTracker", () => {
-  test("increments per (guard, path, failureKind) key", () => {
-    const t = new AuthFallbackCountTracker(0);
-    t.increment("edge", "/v1/chat", "missing_authorization");
-    t.increment("edge", "/v1/chat", "missing_authorization");
-    t.increment("edge", "/v1/chat", "token_validation_failed");
-    t.increment("edge-guardian", "/v1/chat", "missing_authorization");
-
-    const snap = t.snapshot();
-    expect(snap.length).toBe(3);
-    const find = (g: string, p: string, f: string) =>
-      snap.find((c) => c.guard === g && c.path === p && c.failureKind === f)
-        ?.count;
-    expect(find("edge", "/v1/chat", "missing_authorization")).toBe(2);
-    expect(find("edge", "/v1/chat", "token_validation_failed")).toBe(1);
-    expect(find("edge-guardian", "/v1/chat", "missing_authorization")).toBe(1);
-  });
-
-  test("drain returns the window + counts and resets", () => {
-    const t = new AuthFallbackCountTracker(1000);
-    t.increment("edge", "/v1/a", "missing_authorization");
-    t.increment("edge", "/v1/a", "missing_authorization");
-
-    const batch = t.drain(2000);
-    expect(batch.windowStart).toBe(1000);
-    expect(batch.windowEnd).toBe(2000);
-    expect(batch.counts).toEqual([
-      {
-        guard: "edge",
-        path: "/v1/a",
-        failureKind: "missing_authorization",
-        count: 2,
-      },
-    ]);
-
-    // Drained — tracker is empty and the window is re-anchored to the drain.
-    expect(t.snapshot()).toEqual([]);
-    const empty = t.drain(3000);
-    expect(empty.counts).toEqual([]);
-    expect(empty.windowStart).toBe(2000);
-    expect(empty.windowEnd).toBe(3000);
-  });
-
-  test("an empty drain leaves the window start anchored", () => {
-    const t = new AuthFallbackCountTracker(1000);
-    // Nothing recorded yet — draining must not shift windowStart forward.
-    expect(t.drain(2000)).toMatchObject({ windowStart: 1000, windowEnd: 2000 });
-    t.increment("edge", "/v1/a", "missing_authorization");
-    expect(t.drain(3000).windowStart).toBe(1000);
-  });
-
-  test("merge folds a drained batch back in", () => {
-    const t = new AuthFallbackCountTracker(0);
-    t.increment("edge", "/v1/a", "missing_authorization");
-    const batch = t.drain(100);
-
-    // Simulate a failed flush: counts come back, plus a newer count for the
-    // same key that accumulated after the drain.
-    t.increment("edge", "/v1/a", "missing_authorization");
-    t.merge(batch.counts);
-
-    const snap = t.snapshot();
-    expect(snap.length).toBe(1);
-    expect(snap[0].count).toBe(2);
-  });
-
-  test("caps distinct keys but keeps counting existing ones", () => {
-    const t = new AuthFallbackCountTracker(0);
-    // MAX_TRACKED_KEYS is 10_000; exceed it with distinct paths.
-    for (let i = 0; i < 10_050; i++) {
-      t.increment("edge", `/v1/p${i}`, "missing_authorization");
-    }
-    const snap = t.snapshot();
-    expect(snap.length).toBe(10_000);
-
-    // An already-tracked key still increments past the cap.
-    t.increment("edge", "/v1/p0", "missing_authorization");
-    expect(t.snapshot().find((c) => c.path === "/v1/p0")?.count).toBe(2);
-  });
-
-  test("reset clears counts", () => {
-    const t = new AuthFallbackCountTracker(0);
-    t.increment("edge", "/v1/a", "missing_authorization");
-    t.reset(500);
-    expect(t.snapshot()).toEqual([]);
-    expect(t.drain(600).windowStart).toBe(500);
-  });
-});

package/src/__tests__/auth-fallback-reporter.test.ts

@@ -1,101 +0,0 @@
-import { describe, expect, mock, test } from "bun:test";
-
-import { AuthFallbackCountTracker } from "../auth-fallback-count-tracker.js";
-import { AuthFallbackReporter } from "../auth-fallback-reporter.js";
-
-const BASE_URL = "http://127.0.0.1:7821";
-
-function makeReporter(
-  tracker: AuthFallbackCountTracker,
-  fetchImpl: typeof import("../fetch.js").fetchImpl,
-) {
-  return new AuthFallbackReporter({
-    tracker,
-    baseUrl: BASE_URL,
-    intervalMs: 60_000,
-    fetchImpl,
-    mintToken: () => "test-service-token",
-  });
-}
-
-describe("AuthFallbackReporter", () => {
-  test("does nothing when there is nothing to flush", async () => {
-    const tracker = new AuthFallbackCountTracker(0);
-    const fetchMock = mock(async () => new Response("{}", { status: 200 }));
-    await makeReporter(tracker, fetchMock as never).flush();
-    expect(fetchMock).not.toHaveBeenCalled();
-  });
-
-  test("drains and POSTs the counts to the daemon route with a service token", async () => {
-    const tracker = new AuthFallbackCountTracker(0);
-    tracker.increment("edge", "/v1/chat", "missing_authorization");
-    tracker.increment("edge", "/v1/chat", "missing_authorization");
-    tracker.increment("edge-guardian", "/v1/sync", "guardian_mismatch");
-
-    const fetchMock = mock(async () => new Response("{}", { status: 200 }));
-    await makeReporter(tracker, fetchMock as never).flush();
-
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    const [url, init] = fetchMock.mock.calls[0] as unknown as [
-      string,
-      RequestInit,
-    ];
-    expect(url).toBe(`${BASE_URL}/v1/internal/telemetry/auth-fallback`);
-    expect(init.method).toBe("POST");
-    const headers = init.headers as Record<string, string>;
-    expect(headers["Content-Type"]).toBe("application/json");
-    expect(headers["Authorization"]).toBe("Bearer test-service-token");
-
-    const body = JSON.parse(init.body as string);
-    expect(typeof body.window_start).toBe("number");
-    expect(typeof body.window_end).toBe("number");
-    expect(body.counts).toEqual(
-      expect.arrayContaining([
-        {
-          guard: "edge",
-          path: "/v1/chat",
-          failure_kind: "missing_authorization",
-          count: 2,
-        },
-        {
-          guard: "edge-guardian",
-          path: "/v1/sync",
-          failure_kind: "guardian_mismatch",
-          count: 1,
-        },
-      ]),
-    );
-
-    // Successful flush drains the tracker.
-    expect(tracker.snapshot()).toEqual([]);
-  });
-
-  test("re-queues counts when the daemon returns a non-OK status", async () => {
-    const tracker = new AuthFallbackCountTracker(0);
-    tracker.increment("edge", "/v1/chat", "missing_authorization");
-
-    const fetchMock = mock(async () => new Response("nope", { status: 404 }));
-    await makeReporter(tracker, fetchMock as never).flush();
-
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    // Counts merged back so the next flush retries them.
-    const snap = tracker.snapshot();
-    expect(snap.length).toBe(1);
-    expect(snap[0].count).toBe(1);
-  });
-
-  test("re-queues counts when the POST throws", async () => {
-    const tracker = new AuthFallbackCountTracker(0);
-    tracker.increment("edge", "/v1/chat", "missing_authorization");
-    tracker.increment("edge", "/v1/chat", "missing_authorization");
-
-    const fetchMock = mock(async () => {
-      throw new Error("connection refused");
-    });
-    await makeReporter(tracker, fetchMock as never).flush();
-
-    const snap = tracker.snapshot();
-    expect(snap.length).toBe(1);
-    expect(snap[0].count).toBe(2);
-  });
-});