@obsunified/collector 2.0.1

package/src/auth/dashboard-auth.ts

@@ -0,0 +1,269 @@
+import type { MiddlewareHandler } from "hono";
+import type { CollectorEnv } from "../framework/env";
+import { ProjectsStore } from "../lib/projects-store";
+import { type SqlDb, sqlDbFor } from "../lib/sql-db";
+
+const SESSION_COOKIE = "obs_session";
+const SESSION_MAX_AGE = 7 * 24 * 60 * 60; // 7 days in seconds
+const PROJECT_CACHE_TTL_MS = 30_000;
+
+interface ProjectCacheEntry {
+	ids: Set<string>;
+	expiresAt: number;
+}
+
+let projectCache = new WeakMap<object, ProjectCacheEntry>();
+
+async function knownProjectIds(
+	dbKey: object,
+	db: SqlDb,
+	now: number,
+): Promise<Set<string>> {
+	const cached = projectCache.get(dbKey);
+	if (cached && cached.expiresAt > now) {
+		return cached.ids;
+	}
+	const store = new ProjectsStore(db);
+	const projects = await store.listProjects();
+	const ids = new Set(projects.map((p) => p.id));
+	projectCache.set(dbKey, { ids, expiresAt: now + PROJECT_CACHE_TTL_MS });
+	return ids;
+}
+
+/** Test helper — clears the project list cache. */
+export function resetDashboardProjectCache(): void {
+	projectCache = new WeakMap();
+}
+
+/**
+ * Sign a payload using HMAC-SHA256.
+ * Works across all runtimes that support Web Crypto API (CF Workers, Node 20+, Deno, Bun).
+ */
+async function sign(payload: string, secret: string): Promise<string> {
+	const encoder = new TextEncoder();
+	const key = await crypto.subtle.importKey(
+		"raw",
+		encoder.encode(secret),
+		{ name: "HMAC", hash: "SHA-256" },
+		false,
+		["sign"],
+	);
+	const signature = await crypto.subtle.sign(
+		"HMAC",
+		key,
+		encoder.encode(payload),
+	);
+	return btoa(String.fromCharCode(...new Uint8Array(signature)));
+}
+
+async function verify(
+	payload: string,
+	signature: string,
+	secret: string,
+): Promise<boolean> {
+	const expected = await sign(payload, secret);
+	return timingSafeEqualStr(expected, signature);
+}
+
+// Constant-time comparison. Both inputs are SHA-256-digested first so the
+// XOR loop runs over fixed-length (32-byte) buffers — this removes the
+// early-exit timing oracle of `===` and any length-based side channel.
+async function timingSafeEqualStr(a: string, b: string): Promise<boolean> {
+	const enc = new TextEncoder();
+	const [da, db] = await Promise.all([
+		crypto.subtle.digest("SHA-256", enc.encode(a)),
+		crypto.subtle.digest("SHA-256", enc.encode(b)),
+	]);
+	const ha = new Uint8Array(da);
+	const hb = new Uint8Array(db);
+	let diff = 0;
+	for (let i = 0; i < ha.length; i++) diff |= ha[i] ^ hb[i];
+	return diff === 0;
+}
+
+function createSessionToken(expiresAt: number): string {
+	return JSON.stringify({ exp: expiresAt });
+}
+
+function parseSessionToken(token: string): { exp: number } | null {
+	try {
+		const parsed = JSON.parse(token);
+		if (typeof parsed.exp === "number") return parsed;
+		return null;
+	} catch {
+		return null;
+	}
+}
+
+function getCookie(
+	cookieHeader: string | undefined,
+	name: string,
+): string | undefined {
+	if (!cookieHeader) return undefined;
+	const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
+	return match ? decodeURIComponent(match[1]) : undefined;
+}
+
+/**
+ * Creates auth routes and middleware for dashboard password login.
+ *
+ * Routes added:
+ *   POST /auth/login  — accepts { password }, sets session cookie
+ *   GET  /auth/check  — returns { authenticated: true/false }
+ *   POST /auth/logout — clears session cookie
+ *
+ * The returned middleware validates the session cookie on protected routes.
+ */
+export function createDashboardAuth(config: { password: string }): {
+	middleware: MiddlewareHandler<{
+		Bindings: CollectorEnv;
+		Variables: { projectId: string };
+	}>;
+	registerRoutes: (
+		app: import("hono").Hono<{ Bindings: CollectorEnv }>,
+	) => void;
+} {
+	const middleware: MiddlewareHandler<{
+		Bindings: CollectorEnv;
+		Variables: { projectId: string };
+	}> = async (c, next) => {
+		if (!config.password) {
+			return c.json(
+				{
+					error:
+						"DASHBOARD_PASSWORD is not configured. Set the DASHBOARD_PASSWORD environment variable.",
+				},
+				500,
+			);
+		}
+
+		const cookieHeader = c.req.header("Cookie");
+		const sessionValue = getCookie(cookieHeader, SESSION_COOKIE);
+
+		if (!sessionValue) {
+			// For API requests, return 401. For page requests, redirect to login.
+			const accept = c.req.header("Accept") || "";
+			if (accept.includes("text/html")) {
+				return c.redirect("/dashboard/login");
+			}
+			return c.json({ error: "Unauthorized" }, 401);
+		}
+
+		// Session cookie format: payload.signature
+		const dotIndex = sessionValue.lastIndexOf(".");
+		if (dotIndex === -1) {
+			return c.json({ error: "Invalid session" }, 401);
+		}
+
+		const payload = sessionValue.substring(0, dotIndex);
+		const sig = sessionValue.substring(dotIndex + 1);
+
+		const valid = await verify(payload, sig, config.password);
+		if (!valid) {
+			return c.json({ error: "Invalid session" }, 401);
+		}
+
+		const token = parseSessionToken(payload);
+		if (!token || token.exp < Math.floor(Date.now() / 1000)) {
+			return c.json({ error: "Session expired" }, 401);
+		}
+
+		// Resolve project for data-scoped routes. /internal/projects/* is exempt
+		// because that's where projects are managed (and where the first
+		// project is created before the user has selected anything).
+		const path = c.req.path;
+		const needsProject =
+			path.startsWith("/internal/") && !path.startsWith("/internal/projects");
+
+		if (needsProject) {
+			const headerProject = c.req.header("X-Project-Id");
+			const projectId = headerProject?.trim() || "default";
+			const known = await knownProjectIds(
+				c.env.DB,
+				sqlDbFor(c.env),
+				Date.now(),
+			);
+			// Always allow 'default' so fresh installs don't 400 before any
+			// project is seeded (ensure_default_project runs via migration).
+			if (projectId !== "default" && !known.has(projectId)) {
+				return c.json({ error: `Unknown project: ${projectId}` }, 400);
+			}
+			c.set("projectId", projectId);
+		}
+
+		await next();
+	};
+
+	const registerRoutes = (
+		app: import("hono").Hono<{ Bindings: CollectorEnv }>,
+	) => {
+		app.post("/auth/login", async (c) => {
+			if (!config.password) {
+				return c.json({ error: "Dashboard password not configured" }, 500);
+			}
+
+			const body = await c.req
+				.json<{ password?: string }>()
+				.catch(() => ({ password: undefined }));
+			if (
+				!body.password ||
+				!(await timingSafeEqualStr(body.password, config.password))
+			) {
+				return c.json({ error: "Invalid password" }, 401);
+			}
+
+			const expiresAt = Math.floor(Date.now() / 1000) + SESSION_MAX_AGE;
+			const payload = createSessionToken(expiresAt);
+			const sig = await sign(payload, config.password);
+			const cookieValue = `${payload}.${sig}`;
+
+			const isSecure = c.req.url.startsWith("https:");
+			c.header(
+				"Set-Cookie",
+				`${SESSION_COOKIE}=${encodeURIComponent(cookieValue)}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${SESSION_MAX_AGE}${isSecure ? "; Secure" : ""}`,
+			);
+
+			return c.json({ success: true });
+		});
+
+		app.get("/auth/check", async (c) => {
+			const cookieHeader = c.req.header("Cookie");
+			const sessionValue = getCookie(cookieHeader, SESSION_COOKIE);
+
+			if (!sessionValue) {
+				return c.json({ authenticated: false });
+			}
+
+			const dotIndex = sessionValue.lastIndexOf(".");
+			if (dotIndex === -1) {
+				return c.json({ authenticated: false });
+			}
+
+			const payload = sessionValue.substring(0, dotIndex);
+			const sig = sessionValue.substring(dotIndex + 1);
+
+			const valid = await verify(payload, sig, config.password);
+			if (!valid) {
+				return c.json({ authenticated: false });
+			}
+
+			const token = parseSessionToken(payload);
+			if (!token || token.exp < Math.floor(Date.now() / 1000)) {
+				return c.json({ authenticated: false });
+			}
+
+			return c.json({ authenticated: true });
+		});
+
+		app.post("/auth/logout", (c) => {
+			const isSecure = c.req.url.startsWith("https:");
+			c.header(
+				"Set-Cookie",
+				`${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0${isSecure ? "; Secure" : ""}`,
+			);
+			return c.json({ success: true });
+		});
+	};
+
+	return { middleware, registerRoutes };
+}

package/src/auth/ingest-auth.ts

@@ -0,0 +1,147 @@
+import type { MiddlewareHandler } from "hono";
+import type { CollectorEnv } from "../framework/env";
+import { sha256Hex } from "../lib/hash";
+import { ProjectsStore } from "../lib/projects-store";
+import { sqlDbFor } from "../lib/sql-db";
+
+const CACHE_TTL_MS = 60_000; // 60 seconds
+const CACHE_MAX_ENTRIES = 500;
+
+interface CacheEntry {
+	projectId: string;
+	expiresAt: number;
+}
+
+let keyCaches = new WeakMap<object, Map<string, CacheEntry>>();
+let bootstrapDone = false;
+
+function cacheFor(dbKey: object): Map<string, CacheEntry> {
+	let cache = keyCaches.get(dbKey);
+	if (!cache) {
+		cache = new Map();
+		keyCaches.set(dbKey, cache);
+	}
+	return cache;
+}
+
+function getCached(
+	cache: Map<string, CacheEntry>,
+	hash: string,
+	now: number,
+): string | null {
+	pruneKeyCache(cache, now);
+	const entry = cache.get(hash);
+	if (!entry) return null;
+	if (entry.expiresAt <= now) {
+		cache.delete(hash);
+		return null;
+	}
+	return entry.projectId;
+}
+
+function setCached(
+	cache: Map<string, CacheEntry>,
+	hash: string,
+	projectId: string,
+	now: number,
+): void {
+	pruneKeyCache(cache, now);
+	while (cache.size >= CACHE_MAX_ENTRIES) {
+		const oldestKey = cache.keys().next().value;
+		if (!oldestKey) break;
+		cache.delete(oldestKey);
+	}
+	cache.set(hash, { projectId, expiresAt: now + CACHE_TTL_MS });
+}
+
+function pruneKeyCache(cache: Map<string, CacheEntry>, now: number): void {
+	for (const [hash, entry] of cache) {
+		if (entry.expiresAt <= now) cache.delete(hash);
+	}
+}
+
+/** Test helper — clears the in-memory cache and bootstrap flag. */
+export function resetIngestAuthCache(): void {
+	keyCaches = new WeakMap();
+	bootstrapDone = false;
+}
+
+/**
+ * Creates middleware that validates ingest API keys against the ingest_keys table.
+ *
+ * Accepts the key from either:
+ *   - Authorization: Bearer <key>
+ *   - X-API-Key: <key>
+ *
+ * On success, sets `projectId` on the Hono context via `c.set('projectId', ...)`.
+ *
+ * On the first request per isolate, if `env.INGEST_KEY` is set, the middleware
+ * registers it as a `bootstrap` key on the default project — so existing
+ * single-tenant deployments continue to work without manual migration.
+ */
+export function createIngestAuth(config?: {
+	allowUnauthenticated?: boolean;
+}): MiddlewareHandler<{
+	Bindings: CollectorEnv;
+	Variables: { projectId: string };
+}> {
+	return async (c, next) => {
+		// Lazy bootstrap of legacy env key (idempotent).
+		if (!bootstrapDone) {
+			const legacy = c.env.INGEST_KEY || c.env.TELEMETRY_INGEST_TOKEN;
+			if (legacy) {
+				const store = new ProjectsStore(sqlDbFor(c.env));
+				try {
+					await store.bootstrapEnvKey(legacy);
+					// Latch only after success: a transient DB error on the first
+					// request must not permanently disable legacy-key bootstrap for
+					// the isolate. bootstrapEnvKey is idempotent, so concurrent
+					// first-requests racing here are harmless.
+					bootstrapDone = true;
+				} catch (err) {
+					console.error("[ingest-auth] bootstrap failed:", err);
+				}
+			} else {
+				// Nothing to bootstrap — don't keep re-checking on every request.
+				bootstrapDone = true;
+			}
+		}
+
+		const bearer = c.req.header("Authorization")?.replace(/^Bearer\s+/i, "");
+		const apiKey = c.req.header("X-API-Key");
+		const token = bearer || apiKey;
+
+		if (!token) {
+			if (
+				config?.allowUnauthenticated ||
+				c.env.ALLOW_UNAUTHENTICATED === "true"
+			) {
+				c.set("projectId", "default");
+				return next();
+			}
+			return c.json({ error: "Unauthorized" }, 401);
+		}
+
+		const now = Date.now();
+		const hash = await sha256Hex(token);
+		const rawDb =
+			(c.env.DB as unknown as Record<string, unknown>)?.__unwrapped_db ||
+			c.env.DB;
+		const cache = cacheFor(rawDb);
+		const cached = getCached(cache, hash, now);
+		if (cached) {
+			c.set("projectId", cached);
+			return next();
+		}
+
+		const store = new ProjectsStore(sqlDbFor(c.env));
+		const match = await store.findByKeyHash(hash);
+		if (!match) {
+			return c.json({ error: "Unauthorized" }, 401);
+		}
+
+		setCached(cache, hash, match.projectId, now);
+		c.set("projectId", match.projectId);
+		return next();
+	};
+}

package/src/durable-objects/tail-hub.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+import { TailHub } from "./tail-hub";
+
+describe("TailHub", () => {
+	it("rejects publish payloads with invalid project ids", async () => {
+		const hub = new TailHub();
+		const res = await hub.fetch(
+			new Request("https://hub/publish", {
+				method: "POST",
+				body: JSON.stringify([
+					{
+						kind: "span",
+						projectId: "../other-project",
+						row: { spanId: "s1" },
+						t: "2026-05-31T00:00:00.000Z",
+					},
+				]),
+			}),
+		);
+
+		expect(res.status).toBe(400);
+	});
+
+	it("rejects subscriptions with invalid project ids", async () => {
+		const hub = new TailHub();
+		const res = await hub.fetch(
+			new Request("https://hub/subscribe?projectId=../other-project"),
+		);
+
+		expect(res.status).toBe(400);
+	});
+});

package/src/durable-objects/tail-hub.ts

@@ -0,0 +1,158 @@
+/**
+ * In-memory SSE pub/sub hub for live-tailing spans and logs.
+ *
+ * Ingest plugins call `/publish` after writing to D1; the dashboard opens an
+ * EventSource on `/internal/telemetry/tail` which proxies here via `/subscribe`.
+ *
+ * One singleton DO instance is used (idFromName("singleton")); it fans out to
+ * every connected subscriber, filtering by projectId and kind server-side so
+ * clients don't see other tenants' data.
+ *
+ * Heartbeat frames keep the connection alive through proxies with idle
+ * timeouts (Vite dev proxy, Cloudflare edge).
+ */
+
+export type TailKind = "span" | "log";
+
+export interface TailEvent {
+	kind: TailKind;
+	projectId: string;
+	row: Record<string, unknown>;
+	t: string;
+}
+
+interface Subscriber {
+	id: string;
+	projectId: string;
+	kinds: Set<TailKind>;
+	writer: WritableStreamDefaultWriter<Uint8Array>;
+	heartbeat: ReturnType<typeof setInterval>;
+}
+
+const HEARTBEAT_MS = 20_000;
+const MAX_SUBSCRIBERS = 200;
+const PROJECT_ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isTailEvent(value: unknown): value is TailEvent {
+	if (!isRecord(value)) return false;
+	const { kind, projectId, row, t } = value;
+	return (
+		(kind === "span" || kind === "log") &&
+		typeof projectId === "string" &&
+		PROJECT_ID_RE.test(projectId) &&
+		isRecord(row) &&
+		typeof t === "string" &&
+		t.length > 0
+	);
+}
+
+export class TailHub {
+	private readonly subscribers = new Map<string, Subscriber>();
+	private readonly encoder = new TextEncoder();
+
+	async fetch(req: Request): Promise<Response> {
+		const url = new URL(req.url);
+		if (req.method === "POST" && url.pathname === "/publish") {
+			let events: TailEvent[];
+			try {
+				events = (await req.json()) as TailEvent[];
+			} catch {
+				return new Response(null, { status: 400 });
+			}
+			if (!Array.isArray(events)) {
+				return new Response(null, { status: 400 });
+			}
+			if (!events.every(isTailEvent)) {
+				return new Response(null, { status: 400 });
+			}
+			await this.broadcast(events);
+			return new Response(null, { status: 204 });
+		}
+		if (req.method === "GET" && url.pathname === "/subscribe") {
+			const projectId = url.searchParams.get("projectId") ?? "default";
+			if (!PROJECT_ID_RE.test(projectId)) {
+				return new Response("bad projectId", { status: 400 });
+			}
+			const kindsParam = url.searchParams.get("kinds") ?? "span,log";
+			const kinds = new Set(
+				kindsParam
+					.split(",")
+					.map((s) => s.trim())
+					.filter(Boolean),
+			) as Set<TailKind>;
+			if (![...kinds].every((kind) => kind === "span" || kind === "log")) {
+				return new Response("bad kinds", { status: 400 });
+			}
+			return this.subscribe(projectId, kinds, req);
+		}
+		return new Response("not found", { status: 404 });
+	}
+
+	private subscribe(
+		projectId: string,
+		kinds: Set<TailKind>,
+		req: Request,
+	): Response {
+		if (req.signal.aborted) {
+			return new Response(null, { status: 499 });
+		}
+		if (this.subscribers.size >= MAX_SUBSCRIBERS) {
+			return new Response("too many subscribers", { status: 429 });
+		}
+		const { readable, writable } = new TransformStream<
+			Uint8Array,
+			Uint8Array
+		>();
+		const writer = writable.getWriter();
+		const id = crypto.randomUUID();
+
+		writer.write(this.encoder.encode(`: connected\n\n`)).catch(() => {});
+
+		const heartbeat = setInterval(() => {
+			writer
+				.write(this.encoder.encode(`: heartbeat\n\n`))
+				.catch(() => this.drop(id));
+		}, HEARTBEAT_MS);
+
+		req.signal.addEventListener("abort", () => this.drop(id));
+		this.subscribers.set(id, { id, projectId, kinds, writer, heartbeat });
+
+		return new Response(readable, {
+			headers: {
+				"content-type": "text/event-stream",
+				"cache-control": "no-cache",
+				"x-accel-buffering": "no",
+			},
+		});
+	}
+
+	private drop(id: string): void {
+		const sub = this.subscribers.get(id);
+		if (!sub) return;
+		clearInterval(sub.heartbeat);
+		sub.writer.close().catch(() => {});
+		this.subscribers.delete(id);
+	}
+
+	private async broadcast(events: TailEvent[]): Promise<void> {
+		if (events.length === 0 || this.subscribers.size === 0) return;
+		for (const sub of this.subscribers.values()) {
+			const payload = events.filter(
+				(e) => e.projectId === sub.projectId && sub.kinds.has(e.kind),
+			);
+			if (payload.length === 0) continue;
+			const frame = this.encoder.encode(
+				`event: tail\ndata: ${JSON.stringify(payload)}\n\n`,
+			);
+			try {
+				await sub.writer.write(frame);
+			} catch {
+				this.drop(sub.id);
+			}
+		}
+	}
+}