@opendatalabs/personal-server-ts-server 1.5.0 → 1.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api-auth.d.ts +15 -0
- package/dist/api-auth.d.ts.map +1 -1
- package/dist/api-auth.js +70 -13
- package/dist/api-auth.js.map +1 -1
- package/dist/app.d.ts +12 -0
- package/dist/app.d.ts.map +1 -1
- package/dist/app.js +22 -8
- package/dist/app.js.map +1 -1
- package/dist/logging/access-log.d.ts +1 -1
- package/dist/logging/access-log.d.ts.map +1 -1
- package/dist/middleware/cors.d.ts +18 -0
- package/dist/middleware/cors.d.ts.map +1 -0
- package/dist/middleware/cors.js +51 -0
- package/dist/middleware/cors.js.map +1 -0
- package/dist/routes/data.d.ts +9 -0
- package/dist/routes/data.d.ts.map +1 -1
- package/dist/routes/data.js +2 -0
- package/dist/routes/data.js.map +1 -1
- package/dist/routes/write-session.d.ts +33 -0
- package/dist/routes/write-session.d.ts.map +1 -0
- package/dist/routes/write-session.js +108 -0
- package/dist/routes/write-session.js.map +1 -0
- package/dist/ui/ps-lite-debug.js +7587 -7495
- package/package.json +3 -3
package/dist/api-auth.d.ts
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { type SessionTokenVerifierPort } from "@opendatalabs/personal-server-ts-core/auth";
|
|
2
2
|
import type { PersonalServerApiAuthPort } from "@opendatalabs/personal-server-ts-core/api";
|
|
3
|
+
import { type WriteProofReplayStore, type WriteSessionStore } from "@opendatalabs/personal-server-ts-core/write";
|
|
3
4
|
import type { DataStoragePort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
|
|
4
5
|
import type { GatewayClient } from "@opendatalabs/vana-sdk/node";
|
|
5
6
|
export interface ServerApiAuthDeps {
|
|
@@ -11,6 +12,20 @@ export interface ServerApiAuthDeps {
|
|
|
11
12
|
tokenStore?: SessionTokenVerifierPort;
|
|
12
13
|
dataStorage?: Pick<DataStoragePort, "findEntry">;
|
|
13
14
|
runtimeAvailability?: RuntimeAvailabilityPort;
|
|
15
|
+
/**
|
|
16
|
+
* Write API sessions. When present, POST /v1/data/:scope accepts a bearer
|
|
17
|
+
* write-session token (minted by POST /v1/write/session) and authorizes the
|
|
18
|
+
* write as the session's builder via verifyDataWritePolicy + the
|
|
19
|
+
* X-Vana-Write-Signature attribution proof. Absent = owner-only ingest,
|
|
20
|
+
* exactly as before.
|
|
21
|
+
*/
|
|
22
|
+
writeSessionStore?: WriteSessionStore;
|
|
23
|
+
/**
|
|
24
|
+
* Replay guard for per-write proofs (X-Vana-Write-Signature). Defaults to
|
|
25
|
+
* an in-memory store so replay protection is always on when write sessions
|
|
26
|
+
* are enabled; hosts may supply a shared store.
|
|
27
|
+
*/
|
|
28
|
+
writeProofReplayStore?: WriteProofReplayStore;
|
|
14
29
|
}
|
|
15
30
|
export declare function createServerApiAuth(deps: ServerApiAuthDeps): PersonalServerApiAuthPort;
|
|
16
31
|
//# sourceMappingURL=api-auth.d.ts.map
|
package/dist/api-auth.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api-auth.d.ts","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,yBAAyB,
|
|
1
|
+
{"version":3,"file":"api-auth.d.ts","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,yBAAyB,EAI1B,MAAM,2CAA2C,CAAC;AAKnD,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AAMrD,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACjD,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CAC/C;AAmDD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GACtB,yBAAyB,CA2I3B"}
|
package/dist/api-auth.js
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { authenticateRequest, } from "@opendatalabs/personal-server-ts-core/auth";
|
|
2
|
-
import { verifyDataReadPolicy } from "@opendatalabs/personal-server-ts-core/policy";
|
|
2
|
+
import { verifyDataReadPolicy, verifyDataWritePolicy, } from "@opendatalabs/personal-server-ts-core/policy";
|
|
3
|
+
import { createInMemoryWriteProofReplayStore, hashWriteSessionToken, verifyWriterAttribution, } from "@opendatalabs/personal-server-ts-core/write";
|
|
3
4
|
import { NotOwnerError, ProtocolError, UnregisteredBuilderError, } from "@opendatalabs/personal-server-ts-core/errors";
|
|
4
5
|
function serverNotConfigured() {
|
|
5
6
|
return new ProtocolError(500, "SERVER_NOT_CONFIGURED", "Server owner address not configured. Set VANA_MASTER_KEY_SIGNATURE environment variable.");
|
|
@@ -26,21 +27,77 @@ async function assertRegisteredBuilder(gateway, signer) {
|
|
|
26
27
|
return;
|
|
27
28
|
throw new UnregisteredBuilderError();
|
|
28
29
|
}
|
|
30
|
+
function bearerToken(request) {
|
|
31
|
+
const header = request.headers.get("authorization");
|
|
32
|
+
if (!header?.startsWith("Bearer "))
|
|
33
|
+
return null;
|
|
34
|
+
return header.slice(7);
|
|
35
|
+
}
|
|
29
36
|
export function createServerApiAuth(deps) {
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
37
|
+
const writeProofReplayStore = deps.writeProofReplayStore ?? createInMemoryWriteProofReplayStore();
|
|
38
|
+
async function authorizeOwner(request) {
|
|
39
|
+
const result = await authenticate(request, deps);
|
|
40
|
+
if (result.isPolicyBypass)
|
|
41
|
+
return;
|
|
42
|
+
if (!deps.serverOwner)
|
|
43
|
+
throw serverNotConfigured();
|
|
44
|
+
if (!isOwner(result.auth.signer, deps.serverOwner)) {
|
|
45
|
+
throw new NotOwnerError({
|
|
46
|
+
signer: result.auth.signer,
|
|
47
|
+
expected: deps.serverOwner,
|
|
48
|
+
});
|
|
49
|
+
}
|
|
50
|
+
}
|
|
51
|
+
/**
|
|
52
|
+
* Delegated ingest. A bearer token that resolves to a live write session
|
|
53
|
+
* authorizes as the session builder: the write policy re-runs against the
|
|
54
|
+
* LIVE grant (revocation / expiry / scope coverage stay authoritative per
|
|
55
|
+
* write), and the builder's X-Vana-Write-Signature payload proof is
|
|
56
|
+
* verified and returned for the handler to store with the record. Any
|
|
57
|
+
* other credential (owner Web3Signed, dev token, control-plane token,
|
|
58
|
+
* unknown bearer) falls through to the owner path unchanged.
|
|
59
|
+
*/
|
|
60
|
+
async function authorizeWrite(input) {
|
|
61
|
+
const token = bearerToken(input.request);
|
|
62
|
+
if (token && deps.writeSessionStore) {
|
|
63
|
+
const session = await deps.writeSessionStore.getByTokenHash(await hashWriteSessionToken(token));
|
|
64
|
+
if (session) {
|
|
65
|
+
if (!deps.serverOwner)
|
|
66
|
+
throw serverNotConfigured();
|
|
67
|
+
const grant = await verifyDataWritePolicy({
|
|
68
|
+
signer: session.builderAddress,
|
|
69
|
+
grantId: session.grantId,
|
|
70
|
+
requestedScope: input.scope,
|
|
71
|
+
serverOwner: deps.serverOwner,
|
|
72
|
+
}, {
|
|
73
|
+
authSessionVerifier: deps.gateway,
|
|
74
|
+
grantVerifier: deps.gateway,
|
|
75
|
+
runtimeAvailability: deps.runtimeAvailability,
|
|
76
|
+
// Fee seam intentionally not wired: builder writes are free in
|
|
77
|
+
// the demo slice (write fee mechanics undecided).
|
|
78
|
+
});
|
|
79
|
+
// releaseProof is a rollback hook for the handler, never part of the
|
|
80
|
+
// stored attribution record.
|
|
81
|
+
const { releaseProof, ...attribution } = await verifyWriterAttribution({
|
|
82
|
+
request: input.request,
|
|
83
|
+
builderAddress: session.builderAddress,
|
|
84
|
+
grantId: grant.id,
|
|
85
|
+
serverOrigin: deps.serverOrigin,
|
|
86
|
+
replayStore: writeProofReplayStore,
|
|
41
87
|
});
|
|
88
|
+
return {
|
|
89
|
+
builder: session.builderAddress,
|
|
90
|
+
grantId: grant.id,
|
|
91
|
+
attribution,
|
|
92
|
+
releaseProof,
|
|
93
|
+
};
|
|
42
94
|
}
|
|
43
|
-
}
|
|
95
|
+
}
|
|
96
|
+
await authorizeOwner(input.request);
|
|
97
|
+
}
|
|
98
|
+
return {
|
|
99
|
+
authorizeOwner,
|
|
100
|
+
authorizeWrite,
|
|
44
101
|
async authorizeBuilderList(request) {
|
|
45
102
|
const result = await authenticate(request, deps);
|
|
46
103
|
if (result.isPolicyBypass ||
|
package/dist/api-auth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api-auth.js","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAC;
|
|
1
|
+
{"version":3,"file":"api-auth.js","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAC;AAOpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,mCAAmC,EACnC,qBAAqB,EACrB,uBAAuB,GAGxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,GACzB,MAAM,8CAA8C,CAAC;AAgCtD,SAAS,mBAAmB;IAC1B,OAAO,IAAI,aAAa,CACtB,GAAG,EACH,uBAAuB,EACvB,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,WAAsC;IAEtC,OAAO,OAAO,CACZ,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,IAAuB;IAEvB,OAAO,mBAAmB,CAAC;QACzB,OAAO;QACP,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,OAAsB,EACtB,MAAqB;IAErB,6EAA6E;IAC7E,yEAAyE;IACzE,+EAA+E;IAC/E,+BAA+B;IAC/B,IAAI,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAO;IACtD,MAAM,IAAI,wBAAwB,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAuB;IAEvB,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,mCAAmC,EAAE,CAAC;IAEtE,KAAK,UAAU,cAAc,CAAC,OAAgB;QAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,cAAc;YAAE,OAAO;QAClC,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,mBAAmB,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,aAAa,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,QAAQ,EAAE,IAAI,CAAC,WAAW;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,cAAc,CAC3B,KAAmC;QAEnC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,CACzD,MAAM,qBAAqB,CAAC,KAAK,CAAC,CACnC,CAAC;YACF,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,IAAI,CAAC,WAAW;oBAAE,MAAM,mBAAmB,EAAE,CAAC;gBACnD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CACvC;oBACE,MAAM,EAAE,OAAO,CAAC,cAAc;oBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,cAAc,EAAE,KAAK,CAAC,KAAK;oBAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,EACD;oBACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;oBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;oBAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,+DAA+D;oBAC/D,kDAAkD;iBACnD,CACF,CAAC;gBACF,qEAAqE;gBACrE,6BAA6B;gBAC7B,MAAM,EAAE,YAAY,EAAE,GAAG,WAAW,EAAE,GAAG,MAAM,uBAAuB,CAAC;oBACrE,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,WAAW,EAAE,qBAAqB;iBACnC,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE,OAAO,CAAC,cAAc;oBAC/B,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,WAAW;oBACX,YAAY;iBACb,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,OAAO;QACL,cAAc;QACd,cAAc;QAEd,KAAK,CAAC,oBAAoB,CAAC,OAAO;YAChC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IACE,MAAM,CAAC,cAAc;gBACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAC7C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAkC;YAC3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACnE,CAAC;YACD,yDAAyD;YACzD,sEAAsE;YACtE,wDAAwD;YACxD,kEAAkE;YAClE,mEAAmE;YACnE,4DAA4D;YAC5D,8BAA8B;YAC9B,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD;YACzD,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,iEAAiE;YACjE,oEAAoE;YACpE,IACE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;gBAC7C,CAAC,MAAM,CAAC,SAAS,KAAK,aAAa;oBACjC,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,EAC7C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC3D,CAAC;YAED,oEAAoE;YACpE,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAEnD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;gBAChD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC;gBACE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;gBACrD,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,MAAM,IAAI,SAAS;gBAC1D,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,EACD;gBACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CACF,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/app.d.ts
CHANGED
|
@@ -7,6 +7,7 @@ import type { AccessLogWriter } from "@opendatalabs/personal-server-ts-core/logg
|
|
|
7
7
|
import type { AccessLogReader } from "@opendatalabs/personal-server-ts-core/logging/access-reader";
|
|
8
8
|
import type { PersonalServerReadFulfillmentReporter } from "@opendatalabs/personal-server-ts-core/api";
|
|
9
9
|
import { type HealthDeps } from "./routes/health.js";
|
|
10
|
+
import { type WriteProofReplayStore, type WriteSessionStore } from "@opendatalabs/personal-server-ts-core/write";
|
|
10
11
|
import { McpActivityRecorder, type McpConnectionStore, type McpOAuthAuthorizationStore } from "@opendatalabs/personal-server-ts-core/mcp";
|
|
11
12
|
import type { SyncManager } from "@opendatalabs/personal-server-ts-core/sync";
|
|
12
13
|
import type { ServerSigner } from "@opendatalabs/personal-server-ts-core/signing";
|
|
@@ -75,6 +76,17 @@ export interface AppDeps {
|
|
|
75
76
|
mcpOAuthAuthorizationStore?: McpOAuthAuthorizationStore;
|
|
76
77
|
mcpOAuthApprovalUrl?: string | (() => string);
|
|
77
78
|
mcpActivityRecorder?: McpActivityRecorder;
|
|
79
|
+
/**
|
|
80
|
+
* Write API session store shared between POST /v1/write/session (which
|
|
81
|
+
* mints tokens) and the ingest endpoint (which redeems them). Defaults to
|
|
82
|
+
* an in-memory store, mirroring the MCP connection store default.
|
|
83
|
+
*/
|
|
84
|
+
writeSessionStore?: WriteSessionStore;
|
|
85
|
+
/**
|
|
86
|
+
* Replay guard for per-write proofs on delegated ingest. Defaults to an
|
|
87
|
+
* in-memory store (api-auth); hosts may supply a shared one.
|
|
88
|
+
*/
|
|
89
|
+
writeProofReplayStore?: WriteProofReplayStore;
|
|
78
90
|
}
|
|
79
91
|
export declare function createApp(deps: AppDeps): Hono;
|
|
80
92
|
//# sourceMappingURL=app.d.ts.map
|
package/dist/app.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAIlE,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AAUrD,OAAO,EACL,mBAAmB,EAGnB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAChC,MAAM,2CAA2C,CAAC;AASnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,4BAA4B,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAChD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IAC9C,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CAC/C;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CA2Q7C"}
|
package/dist/app.js
CHANGED
|
@@ -1,8 +1,10 @@
|
|
|
1
1
|
import { Hono } from "hono";
|
|
2
|
-
import { cors } from "hono/cors";
|
|
3
2
|
import { ProtocolError } from "@opendatalabs/personal-server-ts-core/errors";
|
|
4
3
|
import { healthRoute } from "./routes/health.js";
|
|
4
|
+
import { corsMiddleware } from "./middleware/cors.js";
|
|
5
5
|
import { dataRoutes } from "./routes/data.js";
|
|
6
|
+
import { writeSessionRoutes } from "./routes/write-session.js";
|
|
7
|
+
import { createInMemoryWriteSessionStore, } from "@opendatalabs/personal-server-ts-core/write";
|
|
6
8
|
import { grantsRoutes } from "./routes/grants.js";
|
|
7
9
|
import { accessLogsRoutes } from "./routes/access-logs.js";
|
|
8
10
|
import { syncRoutes } from "./routes/sync.js";
|
|
@@ -15,13 +17,12 @@ import { authDeviceRoutes, createDeviceSessionLookup, } from "./routes/auth-devi
|
|
|
15
17
|
import { oauthTokenRoutes } from "./routes/oauth-token.js";
|
|
16
18
|
export function createApp(deps) {
|
|
17
19
|
const app = new Hono();
|
|
18
|
-
//
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
}));
|
|
20
|
+
// One store for mint (POST /v1/write/session) and redeem (data ingest).
|
|
21
|
+
const writeSessionStore = deps.writeSessionStore ?? createInMemoryWriteSessionStore();
|
|
22
|
+
// CORS — allow all origins for browser-based clients. Registered first so
|
|
23
|
+
// OPTIONS preflights are answered before any route or auth code runs
|
|
24
|
+
// (route sub-apps only register their real methods).
|
|
25
|
+
app.use("*", corsMiddleware());
|
|
25
26
|
// Mount health route
|
|
26
27
|
app.route("/", healthRoute({
|
|
27
28
|
version: deps.version,
|
|
@@ -61,8 +62,21 @@ export function createApp(deps) {
|
|
|
61
62
|
gatewayConfig: deps.gatewayConfig,
|
|
62
63
|
gatewayUrl: deps.gatewayUrl ?? deps.config?.gateway.url ?? deps.gatewayConfig?.url,
|
|
63
64
|
paymentEnabled: deps.paymentEnabled,
|
|
65
|
+
writeSessionStore,
|
|
66
|
+
writeProofReplayStore: deps.writeProofReplayStore,
|
|
64
67
|
mountPath: "/v1/data",
|
|
65
68
|
}));
|
|
69
|
+
// Mount the Write API session handshake (delegated builder writes).
|
|
70
|
+
app.route("/v1/write", writeSessionRoutes({
|
|
71
|
+
logger: deps.logger,
|
|
72
|
+
serverOrigin: deps.serverOrigin,
|
|
73
|
+
serverOwner: deps.serverOwner,
|
|
74
|
+
gateway: deps.gateway,
|
|
75
|
+
devToken: deps.devToken,
|
|
76
|
+
accessToken: deps.accessToken,
|
|
77
|
+
tokenStore: deps.tokenStore,
|
|
78
|
+
sessionStore: writeSessionStore,
|
|
79
|
+
}));
|
|
66
80
|
// Mount grants routes (POST /verify is public, GET / and POST / need owner auth)
|
|
67
81
|
app.route("/v1/grants", grantsRoutes({
|
|
68
82
|
logger: deps.logger,
|
package/dist/app.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAW7E,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,+BAA+B,GAGhC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,wCAAwC,GAGzC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAoF3D,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,wEAAwE;IACxE,MAAM,iBAAiB,GACrB,IAAI,CAAC,iBAAiB,IAAI,+BAA+B,EAAE,CAAC;IAE9D,0EAA0E;IAC1E,qEAAqE;IACrE,qDAAqD;IACrD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;IAE/B,qBAAqB;IACrB,GAAG,CAAC,KAAK,CACP,GAAG,EACH,WAAW,CAAC;QACV,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;KAC9C,CAAC,CACH,CAAC;IAEF,6CAA6C;IAC7C,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yEAAyE;QACzE,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO;QACrC,mEAAmE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,mDAAmD;QACnD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EACR,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,GAAG;QACxE,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB;QACjB,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,SAAS,EAAE,UAAU;KACtB,CAAC,CACH,CAAC;IAEF,oEAAoE;IACpE,GAAG,CAAC,KAAK,CACP,WAAW,EACX,kBAAkB,CAAC;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,iBAAiB;KAChC,CAAC,CACH,CAAC;IAEF,iFAAiF;IACjF,GAAG,CAAC,KAAK,CACP,YAAY,EACZ,YAAY,CAAC;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,YAAY;KACxB,CAAC,CACH,CAAC;IAEF,4CAA4C;IAC5C,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,gBAAgB,CAAC;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CACH,CAAC;IAEF,qCAAqC;IACrC,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,SAAS,EAAE,UAAU;KACtB,CAAC,CACH,CAAC;IAEF,2DAA2D;IAC3D,0EAA0E;IAC1E,0EAA0E;IAC1E,qBAAqB;IACrB,MAAM,kBAAkB,GACtB,IAAI,CAAC,kBAAkB,IAAI,gCAAgC,EAAE,CAAC;IAChE,MAAM,0BAA0B,GAC9B,IAAI,CAAC,0BAA0B;QAC/B,wCAAwC,EAAE,CAAC;IAC7C,MAAM,mBAAmB,GACvB,IAAI,CAAC,mBAAmB,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACxD,MAAM,YAAY,GAAG;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,eAAe,EAAE,kBAAkB;QACnC,uBAAuB,EAAE,0BAA0B;QACnD,gBAAgB,EAAE,IAAI,CAAC,mBAAmB;QAC1C,gBAAgB,EAAE,mBAAmB;KACtC,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7C,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC;IAEzD,sEAAsE;IACtE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,qBAAqB,EAAE,CAAC,IAAI,CAAC,SAAS;SACvC,CAAC,CACH,CAAC;QAEF,0EAA0E;QAC1E,8DAA8D;QAC9D,0EAA0E;QAC1E,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,kBAAkB,EAAE,IAAI,CAAC,WAAW;YACpC,cAAc,EAAE,yBAAyB,EAAE;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CACP,KAAK,EACL,OAAO,CAAC;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,cAAc;gBAClC,CAAC,CAAC;oBACE,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB;gBACH,CAAC,CAAC,IAAI;SACT,CAAC,CACH,CAAC;QAEF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CACP,SAAS,EACT,cAAc,CAAC;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,KAAK,CACP,SAAS,EACT,oBAAoB,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,YAAY,EAAE,IAAI,CAAC,kBAAkB;SACtC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,uBAAuB;IACvB,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAA6B,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,uBAAuB;aACjC;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,WAAW;gBACtB,OAAO,EAAE,WAAW;aACrB;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"access-log.d.ts","sourceRoot":"","sources":["../../src/logging/access-log.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"access-log.d.ts","sourceRoot":"","sources":["../../src/logging/access-log.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAUD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAiBtE"}
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* CORS for browser-based clients (allow all origins).
|
|
3
|
+
*
|
|
4
|
+
* A browser preflight only passes when every non-safelisted request header is
|
|
5
|
+
* listed in Access-Control-Allow-Headers, and a browser can only read a
|
|
6
|
+
* non-safelisted response header that is listed in
|
|
7
|
+
* Access-Control-Expose-Headers. Both lists therefore have to track every
|
|
8
|
+
* custom header the API reads or writes on a browser-reachable route; the
|
|
9
|
+
* Write API (delegated ingest) is the first path a builder app calls straight
|
|
10
|
+
* from the browser. Header names are case-insensitive (Fetch).
|
|
11
|
+
*/
|
|
12
|
+
/** Request headers the API reads that are not CORS-safelisted. */
|
|
13
|
+
export declare const CORS_ALLOW_HEADERS: readonly string[];
|
|
14
|
+
/** Response headers a browser client must be able to read back. */
|
|
15
|
+
export declare const CORS_EXPOSE_HEADERS: readonly string[];
|
|
16
|
+
export declare const CORS_ALLOW_METHODS: readonly string[];
|
|
17
|
+
export declare function corsMiddleware(): import("hono").MiddlewareHandler;
|
|
18
|
+
//# sourceMappingURL=cors.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAa/C,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAIhD,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAM/C,CAAC;AAEF,wBAAgB,cAAc,qCAQ7B"}
|
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* CORS for browser-based clients (allow all origins).
|
|
3
|
+
*
|
|
4
|
+
* A browser preflight only passes when every non-safelisted request header is
|
|
5
|
+
* listed in Access-Control-Allow-Headers, and a browser can only read a
|
|
6
|
+
* non-safelisted response header that is listed in
|
|
7
|
+
* Access-Control-Expose-Headers. Both lists therefore have to track every
|
|
8
|
+
* custom header the API reads or writes on a browser-reachable route; the
|
|
9
|
+
* Write API (delegated ingest) is the first path a builder app calls straight
|
|
10
|
+
* from the browser. Header names are case-insensitive (Fetch).
|
|
11
|
+
*/
|
|
12
|
+
import { cors } from "hono/cors";
|
|
13
|
+
import { WRITE_SIGNATURE_HEADER } from "@opendatalabs/personal-server-ts-core/write";
|
|
14
|
+
/** Request headers the API reads that are not CORS-safelisted. */
|
|
15
|
+
export const CORS_ALLOW_HEADERS = [
|
|
16
|
+
"Content-Type",
|
|
17
|
+
"Authorization",
|
|
18
|
+
// Write API: builder-signed payload proof on delegated ingest
|
|
19
|
+
// (api-auth authorizeWrite -> verifyWriterAttribution).
|
|
20
|
+
WRITE_SIGNATURE_HEADER,
|
|
21
|
+
// Ingest hints (core handlePersonalServerDataRequest).
|
|
22
|
+
"X-Vana-Metadata",
|
|
23
|
+
"X-Filename",
|
|
24
|
+
"Content-Disposition",
|
|
25
|
+
// Granted / paid reads.
|
|
26
|
+
"X-PS-Grant-Id",
|
|
27
|
+
"X-PAYMENT",
|
|
28
|
+
];
|
|
29
|
+
/** Response headers a browser client must be able to read back. */
|
|
30
|
+
export const CORS_EXPOSE_HEADERS = [
|
|
31
|
+
"X-Vana-Metadata",
|
|
32
|
+
"X-PAYMENT-RESPONSE",
|
|
33
|
+
"Content-Disposition",
|
|
34
|
+
];
|
|
35
|
+
export const CORS_ALLOW_METHODS = [
|
|
36
|
+
"GET",
|
|
37
|
+
"POST",
|
|
38
|
+
"PUT",
|
|
39
|
+
"DELETE",
|
|
40
|
+
"OPTIONS",
|
|
41
|
+
];
|
|
42
|
+
export function corsMiddleware() {
|
|
43
|
+
return cors({
|
|
44
|
+
origin: "*",
|
|
45
|
+
allowHeaders: [...CORS_ALLOW_HEADERS],
|
|
46
|
+
exposeHeaders: [...CORS_EXPOSE_HEADERS],
|
|
47
|
+
allowMethods: [...CORS_ALLOW_METHODS],
|
|
48
|
+
maxAge: 86400,
|
|
49
|
+
});
|
|
50
|
+
}
|
|
51
|
+
//# sourceMappingURL=cors.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAErF,kEAAkE;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,cAAc;IACd,eAAe;IACf,8DAA8D;IAC9D,wDAAwD;IACxD,sBAAsB;IACtB,uDAAuD;IACvD,iBAAiB;IACjB,YAAY;IACZ,qBAAqB;IACrB,wBAAwB;IACxB,eAAe;IACf,WAAW;CACZ,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,iBAAiB;IACjB,oBAAoB;IACpB,qBAAqB;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,SAAS;CACV,CAAC;AAEF,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC;QACV,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,CAAC,GAAG,kBAAkB,CAAC;QACrC,aAAa,EAAE,CAAC,GAAG,mBAAmB,CAAC;QACvC,YAAY,EAAE,CAAC,GAAG,kBAAkB,CAAC;QACrC,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC"}
|
package/dist/routes/data.d.ts
CHANGED
|
@@ -8,6 +8,7 @@ import type { SyncManager } from "@opendatalabs/personal-server-ts-core/sync";
|
|
|
8
8
|
import type { DataStoragePort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
|
|
9
9
|
import type { ServerSigner } from "@opendatalabs/personal-server-ts-core/signing";
|
|
10
10
|
import type { TokenStore } from "../token-store.js";
|
|
11
|
+
import type { WriteProofReplayStore, WriteSessionStore } from "@opendatalabs/personal-server-ts-core/write";
|
|
11
12
|
import type { Logger } from "pino";
|
|
12
13
|
export interface DataRouteDeps {
|
|
13
14
|
indexManager: IndexManager;
|
|
@@ -42,6 +43,14 @@ export interface DataRouteDeps {
|
|
|
42
43
|
tokenStore?: TokenStore;
|
|
43
44
|
dataStorage?: DataStoragePort;
|
|
44
45
|
runtimeAvailability?: RuntimeAvailabilityPort;
|
|
46
|
+
/**
|
|
47
|
+
* Write API sessions (POST /v1/write/session). When present, the ingest
|
|
48
|
+
* endpoint accepts write-session bearer tokens for delegated builder
|
|
49
|
+
* writes; absent = owner-only ingest, unchanged.
|
|
50
|
+
*/
|
|
51
|
+
writeSessionStore?: WriteSessionStore;
|
|
52
|
+
/** Replay guard for per-write proofs; defaults to in-memory (api-auth). */
|
|
53
|
+
writeProofReplayStore?: WriteProofReplayStore;
|
|
45
54
|
/**
|
|
46
55
|
* Powers the RECORD_DATA_ACCESS attestation embedded in 402 challenges.
|
|
47
56
|
* When supplied alongside serverOwner + paymentEnabled, every challenge
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../src/routes/data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAEL,KAAK,gCAAgC,EACrC,KAAK,qCAAqC,EAC3C,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAQnC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB;;;;OAIG;IACH,aAAa,CAAC,EAAE,4BAA4B,CAAC;IAC7C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,gCAAgC,CAAC,UAAU,CAAC,CAAC;CAC1D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,
|
|
1
|
+
{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../src/routes/data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAEL,KAAK,gCAAgC,EACrC,KAAK,qCAAqC,EAC3C,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAQnC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB;;;;OAIG;IACH,aAAa,CAAC,EAAE,4BAA4B,CAAC;IAC7C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,2EAA2E;IAC3E,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,gCAAgC,CAAC,UAAU,CAAC,CAAC;CAC1D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAqDpD"}
|
package/dist/routes/data.js
CHANGED
|
@@ -19,6 +19,8 @@ export function dataRoutes(deps) {
|
|
|
19
19
|
tokenStore: deps.tokenStore,
|
|
20
20
|
dataStorage,
|
|
21
21
|
runtimeAvailability: deps.runtimeAvailability,
|
|
22
|
+
writeSessionStore: deps.writeSessionStore,
|
|
23
|
+
writeProofReplayStore: deps.writeProofReplayStore,
|
|
22
24
|
});
|
|
23
25
|
app.use("/:scope", createBodyLimit(DATA_INGEST_MAX_SIZE));
|
|
24
26
|
app.all("*", (c) => handlePersonalServerDataRequest(c.req.raw, {
|
package/dist/routes/data.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"data.js","sourceRoot":"","sources":["../../src/routes/data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,+BAA+B,GAGhC,MAAM,2CAA2C,CAAC;
|
|
1
|
+
{"version":3,"file":"data.js","sourceRoot":"","sources":["../../src/routes/data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,+BAA+B,GAGhC,MAAM,2CAA2C,CAAC;AAoBnD,OAAO,EACL,eAAe,EACf,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AA2DrD,MAAM,UAAU,UAAU,CAAC,IAAmB;IAC5C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,WAAW,GACf,IAAI,CAAC,WAAW;QAChB,qBAAqB,CAAC;YACpB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC,CAAC;IACL,MAAM,IAAI,GAAG,mBAAmB,CAAC;QAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW;QACX,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;KAClD,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACjB,+BAA+B,CAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,EACT;QACE,OAAO,EAAE,WAAW;QACpB,IAAI;QACJ,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,kEAAkE;QAClE,kEAAkE;QAClE,8DAA8D;QAC9D,OAAO,EAAE,IAAI,CAAC,aAAa;YACzB,CAAC,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;YACtC,CAAC,CAAC,SAAS;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,EACD,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAC7B,CACF,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC"}
|
|
@@ -0,0 +1,33 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Write API session route — POST /v1/write/session.
|
|
3
|
+
*
|
|
4
|
+
* The builder proves control of its key + write-grant with a Web3Signed proof
|
|
5
|
+
* (same handshake shape as the self-signing MCP session, routes/mcp.ts) and
|
|
6
|
+
* gets a short-lived bearer token. The token then gates delegated writes on
|
|
7
|
+
* the EXISTING ingest endpoint (POST /v1/data/:scope) — see api-auth.ts
|
|
8
|
+
* authorizeWrite. The PS keeps signing AddData as the owner; the builder
|
|
9
|
+
* never holds the owner key.
|
|
10
|
+
*/
|
|
11
|
+
import { Hono } from "hono";
|
|
12
|
+
import type { Logger } from "pino";
|
|
13
|
+
import type { GatewayClient } from "@opendatalabs/vana-sdk/node";
|
|
14
|
+
import { type WriteProofReplayStore, type WriteSessionStore } from "@opendatalabs/personal-server-ts-core/write";
|
|
15
|
+
import type { TokenStore } from "../token-store.js";
|
|
16
|
+
export interface WriteSessionRouteDeps {
|
|
17
|
+
logger: Logger;
|
|
18
|
+
serverOrigin: string | (() => string);
|
|
19
|
+
serverOwner?: `0x${string}`;
|
|
20
|
+
gateway: GatewayClient;
|
|
21
|
+
devToken?: string;
|
|
22
|
+
accessToken?: string;
|
|
23
|
+
tokenStore?: TokenStore;
|
|
24
|
+
/**
|
|
25
|
+
* Session store shared with the data routes (api-auth authorizeWrite reads
|
|
26
|
+
* the tokens this route mints). The caller wires ONE store into both.
|
|
27
|
+
*/
|
|
28
|
+
sessionStore: WriteSessionStore;
|
|
29
|
+
/** Defaults to a per-route in-memory replay guard. */
|
|
30
|
+
proofReplayStore?: WriteProofReplayStore;
|
|
31
|
+
}
|
|
32
|
+
export declare function writeSessionRoutes(deps: WriteSessionRouteDeps): Hono;
|
|
33
|
+
//# sourceMappingURL=write-session.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"write-session.d.ts","sourceRoot":"","sources":["../../src/routes/write-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;OAGG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAsBD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,CA4GpE"}
|
|
@@ -0,0 +1,108 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Write API session route — POST /v1/write/session.
|
|
3
|
+
*
|
|
4
|
+
* The builder proves control of its key + write-grant with a Web3Signed proof
|
|
5
|
+
* (same handshake shape as the self-signing MCP session, routes/mcp.ts) and
|
|
6
|
+
* gets a short-lived bearer token. The token then gates delegated writes on
|
|
7
|
+
* the EXISTING ingest endpoint (POST /v1/data/:scope) — see api-auth.ts
|
|
8
|
+
* authorizeWrite. The PS keeps signing AddData as the owner; the builder
|
|
9
|
+
* never holds the owner key.
|
|
10
|
+
*/
|
|
11
|
+
import { createHash, randomBytes } from "node:crypto";
|
|
12
|
+
import { Hono } from "hono";
|
|
13
|
+
import { authenticateRequest } from "@opendatalabs/personal-server-ts-core/auth";
|
|
14
|
+
import { ProtocolError } from "@opendatalabs/personal-server-ts-core/errors";
|
|
15
|
+
import { createInMemoryWriteProofReplayStore, createWriteSession, } from "@opendatalabs/personal-server-ts-core/write";
|
|
16
|
+
function jsonError(status, errorCode, message) {
|
|
17
|
+
return {
|
|
18
|
+
error: { code: status, errorCode, message },
|
|
19
|
+
};
|
|
20
|
+
}
|
|
21
|
+
/**
|
|
22
|
+
* Only ProtocolErrors are client-facing. Anything else (gateway, store,
|
|
23
|
+
* runtime failures) is logged with its cause and answered generically so
|
|
24
|
+
* internal details never reach the caller. Same mapping as the core data
|
|
25
|
+
* handler.
|
|
26
|
+
*/
|
|
27
|
+
function internalError(logger, err, stage) {
|
|
28
|
+
logger.error({ err, stage }, "Write session handshake failed with an unexpected error");
|
|
29
|
+
return jsonError(500, "INTERNAL_ERROR", "Internal server error");
|
|
30
|
+
}
|
|
31
|
+
export function writeSessionRoutes(deps) {
|
|
32
|
+
const app = new Hono();
|
|
33
|
+
const proofReplayStore = deps.proofReplayStore ?? createInMemoryWriteProofReplayStore();
|
|
34
|
+
app.post("/session", async (c) => {
|
|
35
|
+
// Fail closed: minting a session requires this server's owner to bind
|
|
36
|
+
// the grant to (createWriteSession rejects wrong-owner grants).
|
|
37
|
+
if (!deps.serverOwner) {
|
|
38
|
+
return c.json(jsonError(500, "SERVER_NOT_CONFIGURED", "Server owner is not configured"), 500);
|
|
39
|
+
}
|
|
40
|
+
let authResult;
|
|
41
|
+
try {
|
|
42
|
+
authResult = await authenticateRequest({
|
|
43
|
+
request: c.req.raw,
|
|
44
|
+
serverOrigin: deps.serverOrigin,
|
|
45
|
+
devToken: deps.devToken,
|
|
46
|
+
accessToken: deps.accessToken,
|
|
47
|
+
sessionTokenVerifier: deps.tokenStore,
|
|
48
|
+
serverOwner: deps.serverOwner,
|
|
49
|
+
});
|
|
50
|
+
}
|
|
51
|
+
catch (err) {
|
|
52
|
+
if (!(err instanceof ProtocolError)) {
|
|
53
|
+
return c.json(internalError(deps.logger, err, "authenticate"), 500);
|
|
54
|
+
}
|
|
55
|
+
return c.json(jsonError(401, "WRITE_SESSION_AUTH_FAILED", err.message), 401);
|
|
56
|
+
}
|
|
57
|
+
if (authResult.mechanism !== "web3-signed") {
|
|
58
|
+
return c.json(jsonError(401, "WRITE_SESSION_PROOF_REQUIRED", "POST /v1/write/session requires a Web3Signed proof signed by the builder key"), 401);
|
|
59
|
+
}
|
|
60
|
+
const grantId = authResult.auth.payload.grantId;
|
|
61
|
+
if (!grantId) {
|
|
62
|
+
return c.json(jsonError(400, "GRANT_ID_REQUIRED", "The Web3Signed proof must carry a grantId (the write-grant issued to the builder)"), 400);
|
|
63
|
+
}
|
|
64
|
+
// Replay guard: bind to a digest of the exact proof header, remembered
|
|
65
|
+
// until the proof's own expiry (a replay only matters while still valid).
|
|
66
|
+
const proofHeader = c.req.raw.headers.get("authorization") ?? "";
|
|
67
|
+
const proofId = createHash("sha256").update(proofHeader).digest("hex");
|
|
68
|
+
const expSec = authResult.auth.payload.exp;
|
|
69
|
+
const expiresAtMs = (typeof expSec === "number"
|
|
70
|
+
? expSec
|
|
71
|
+
: Math.floor(Date.now() / 1000) + 300) * 1000;
|
|
72
|
+
try {
|
|
73
|
+
const session = await createWriteSession({
|
|
74
|
+
builderAddress: authResult.auth.signer,
|
|
75
|
+
grantId,
|
|
76
|
+
proof: { id: proofId, expiresAtMs },
|
|
77
|
+
}, {
|
|
78
|
+
store: deps.sessionStore,
|
|
79
|
+
authSessionVerifier: deps.gateway,
|
|
80
|
+
grantVerifier: deps.gateway,
|
|
81
|
+
serverOwner: deps.serverOwner,
|
|
82
|
+
randomToken: () => `vana_write_${randomBytes(32).toString("hex")}`,
|
|
83
|
+
replayStore: proofReplayStore,
|
|
84
|
+
});
|
|
85
|
+
deps.logger.info({
|
|
86
|
+
builder: authResult.auth.signer,
|
|
87
|
+
grantId: session.grantId,
|
|
88
|
+
writeScopes: session.writeScopes,
|
|
89
|
+
}, "Write session minted");
|
|
90
|
+
return c.json({
|
|
91
|
+
access_token: session.accessToken,
|
|
92
|
+
token_type: "Bearer",
|
|
93
|
+
expires_in: session.expiresInSeconds,
|
|
94
|
+
// Write patterns, prefix stripped — what POST /v1/data/:scope will
|
|
95
|
+
// accept under this token.
|
|
96
|
+
scope: session.writeScopes.join(" "),
|
|
97
|
+
});
|
|
98
|
+
}
|
|
99
|
+
catch (err) {
|
|
100
|
+
if (err instanceof ProtocolError) {
|
|
101
|
+
return c.json(err.toJSON(), err.code);
|
|
102
|
+
}
|
|
103
|
+
return c.json(internalError(deps.logger, err, "create-session"), 500);
|
|
104
|
+
}
|
|
105
|
+
});
|
|
106
|
+
return app;
|
|
107
|
+
}
|
|
108
|
+
//# sourceMappingURL=write-session.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"write-session.js","sourceRoot":"","sources":["../../src/routes/write-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAC7E,OAAO,EACL,mCAAmC,EACnC,kBAAkB,GAGnB,MAAM,6CAA6C,CAAC;AAoBrD,SAAS,SAAS,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAe;IACnE,OAAO;QACL,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,MAAc,EAAE,GAAY,EAAE,KAAa;IAChE,MAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,KAAK,EAAE,EACd,yDAAyD,CAC1D,CAAC;IACF,OAAO,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAA2B;IAC5D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,gBAAgB,GACpB,IAAI,CAAC,gBAAgB,IAAI,mCAAmC,EAAE,CAAC;IAEjE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,sEAAsE;QACtE,gEAAgE;QAChE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,IAAI,CACX,SAAS,CACP,GAAG,EACH,uBAAuB,EACvB,gCAAgC,CACjC,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC;QACf,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,mBAAmB,CAAC;gBACrC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;gBAClB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;gBACrC,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,aAAa,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,GAAG,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX,SAAS,CAAC,GAAG,EAAE,2BAA2B,EAAE,GAAG,CAAC,OAAO,CAAC,EACxD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CACX,SAAS,CACP,GAAG,EACH,8BAA8B,EAC9B,8EAA8E,CAC/E,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAChD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX,SAAS,CACP,GAAG,EACH,mBAAmB,EACnB,mFAAmF,CACpF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QAC3C,MAAM,WAAW,GACf,CAAC,OAAO,MAAM,KAAK,QAAQ;YACzB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC;gBACE,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM;gBACtC,OAAO;gBACP,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;aACpC,EACD;gBACE,KAAK,EAAE,IAAI,CAAC,YAAY;gBACxB,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAClE,WAAW,EAAE,gBAAgB;aAC9B,CACF,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;gBACE,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM;gBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,EACD,sBAAsB,CACvB,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,YAAY,EAAE,OAAO,CAAC,WAAW;gBACjC,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,OAAO,CAAC,gBAAgB;gBACpC,mEAAmE;gBACnE,2BAA2B;gBAC3B,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACjC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAA6B,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,gBAAgB,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
|