@opendatalabs/personal-server-ts-server 1.5.0 → 1.7.0

package/dist/routes/write-session.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Write API session route — POST /v1/write/session.
+ *
+ * The builder proves control of its key + write-grant with a Web3Signed proof
+ * (same handshake shape as the self-signing MCP session, routes/mcp.ts) and
+ * gets a short-lived bearer token. The token then gates delegated writes on
+ * the EXISTING ingest endpoint (POST /v1/data/:scope) — see api-auth.ts
+ * authorizeWrite. The PS keeps signing AddData as the owner; the builder
+ * never holds the owner key.
+ */
+import { Hono } from "hono";
+import type { Logger } from "pino";
+import type { GatewayClient } from "@opendatalabs/vana-sdk/node";
+import { type WriteProofReplayStore, type WriteSessionStore } from "@opendatalabs/personal-server-ts-core/write";
+import type { TokenStore } from "../token-store.js";
+export interface WriteSessionRouteDeps {
+    logger: Logger;
+    serverOrigin: string | (() => string);
+    serverOwner?: `0x${string}`;
+    gateway: GatewayClient;
+    devToken?: string;
+    accessToken?: string;
+    tokenStore?: TokenStore;
+    /**
+     * Session store shared with the data routes (api-auth authorizeWrite reads
+     * the tokens this route mints). The caller wires ONE store into both.
+     */
+    sessionStore: WriteSessionStore;
+    /** Defaults to a per-route in-memory replay guard. */
+    proofReplayStore?: WriteProofReplayStore;
+}
+export declare function writeSessionRoutes(deps: WriteSessionRouteDeps): Hono;
+//# sourceMappingURL=write-session.d.ts.map

package/dist/routes/write-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-session.d.ts","sourceRoot":"","sources":["../../src/routes/write-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;OAGG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAsBD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,CA4GpE"}

package/dist/routes/write-session.js

@@ -0,0 +1,108 @@
+/**
+ * Write API session route — POST /v1/write/session.
+ *
+ * The builder proves control of its key + write-grant with a Web3Signed proof
+ * (same handshake shape as the self-signing MCP session, routes/mcp.ts) and
+ * gets a short-lived bearer token. The token then gates delegated writes on
+ * the EXISTING ingest endpoint (POST /v1/data/:scope) — see api-auth.ts
+ * authorizeWrite. The PS keeps signing AddData as the owner; the builder
+ * never holds the owner key.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { Hono } from "hono";
+import { authenticateRequest } from "@opendatalabs/personal-server-ts-core/auth";
+import { ProtocolError } from "@opendatalabs/personal-server-ts-core/errors";
+import { createInMemoryWriteProofReplayStore, createWriteSession, } from "@opendatalabs/personal-server-ts-core/write";
+function jsonError(status, errorCode, message) {
+    return {
+        error: { code: status, errorCode, message },
+    };
+}
+/**
+ * Only ProtocolErrors are client-facing. Anything else (gateway, store,
+ * runtime failures) is logged with its cause and answered generically so
+ * internal details never reach the caller. Same mapping as the core data
+ * handler.
+ */
+function internalError(logger, err, stage) {
+    logger.error({ err, stage }, "Write session handshake failed with an unexpected error");
+    return jsonError(500, "INTERNAL_ERROR", "Internal server error");
+}
+export function writeSessionRoutes(deps) {
+    const app = new Hono();
+    const proofReplayStore = deps.proofReplayStore ?? createInMemoryWriteProofReplayStore();
+    app.post("/session", async (c) => {
+        // Fail closed: minting a session requires this server's owner to bind
+        // the grant to (createWriteSession rejects wrong-owner grants).
+        if (!deps.serverOwner) {
+            return c.json(jsonError(500, "SERVER_NOT_CONFIGURED", "Server owner is not configured"), 500);
+        }
+        let authResult;
+        try {
+            authResult = await authenticateRequest({
+                request: c.req.raw,
+                serverOrigin: deps.serverOrigin,
+                devToken: deps.devToken,
+                accessToken: deps.accessToken,
+                sessionTokenVerifier: deps.tokenStore,
+                serverOwner: deps.serverOwner,
+            });
+        }
+        catch (err) {
+            if (!(err instanceof ProtocolError)) {
+                return c.json(internalError(deps.logger, err, "authenticate"), 500);
+            }
+            return c.json(jsonError(401, "WRITE_SESSION_AUTH_FAILED", err.message), 401);
+        }
+        if (authResult.mechanism !== "web3-signed") {
+            return c.json(jsonError(401, "WRITE_SESSION_PROOF_REQUIRED", "POST /v1/write/session requires a Web3Signed proof signed by the builder key"), 401);
+        }
+        const grantId = authResult.auth.payload.grantId;
+        if (!grantId) {
+            return c.json(jsonError(400, "GRANT_ID_REQUIRED", "The Web3Signed proof must carry a grantId (the write-grant issued to the builder)"), 400);
+        }
+        // Replay guard: bind to a digest of the exact proof header, remembered
+        // until the proof's own expiry (a replay only matters while still valid).
+        const proofHeader = c.req.raw.headers.get("authorization") ?? "";
+        const proofId = createHash("sha256").update(proofHeader).digest("hex");
+        const expSec = authResult.auth.payload.exp;
+        const expiresAtMs = (typeof expSec === "number"
+            ? expSec
+            : Math.floor(Date.now() / 1000) + 300) * 1000;
+        try {
+            const session = await createWriteSession({
+                builderAddress: authResult.auth.signer,
+                grantId,
+                proof: { id: proofId, expiresAtMs },
+            }, {
+                store: deps.sessionStore,
+                authSessionVerifier: deps.gateway,
+                grantVerifier: deps.gateway,
+                serverOwner: deps.serverOwner,
+                randomToken: () => `vana_write_${randomBytes(32).toString("hex")}`,
+                replayStore: proofReplayStore,
+            });
+            deps.logger.info({
+                builder: authResult.auth.signer,
+                grantId: session.grantId,
+                writeScopes: session.writeScopes,
+            }, "Write session minted");
+            return c.json({
+                access_token: session.accessToken,
+                token_type: "Bearer",
+                expires_in: session.expiresInSeconds,
+                // Write patterns, prefix stripped — what POST /v1/data/:scope will
+                // accept under this token.
+                scope: session.writeScopes.join(" "),
+            });
+        }
+        catch (err) {
+            if (err instanceof ProtocolError) {
+                return c.json(err.toJSON(), err.code);
+            }
+            return c.json(internalError(deps.logger, err, "create-session"), 500);
+        }
+    });
+    return app;
+}
+//# sourceMappingURL=write-session.js.map

package/dist/routes/write-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-session.js","sourceRoot":"","sources":["../../src/routes/write-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAC7E,OAAO,EACL,mCAAmC,EACnC,kBAAkB,GAGnB,MAAM,6CAA6C,CAAC;AAoBrD,SAAS,SAAS,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAe;IACnE,OAAO;QACL,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,MAAc,EAAE,GAAY,EAAE,KAAa;IAChE,MAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,KAAK,EAAE,EACd,yDAAyD,CAC1D,CAAC;IACF,OAAO,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAA2B;IAC5D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,gBAAgB,GACpB,IAAI,CAAC,gBAAgB,IAAI,mCAAmC,EAAE,CAAC;IAEjE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,sEAAsE;QACtE,gEAAgE;QAChE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,IAAI,CACX,SAAS,CACP,GAAG,EACH,uBAAuB,EACvB,gCAAgC,CACjC,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC;QACf,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,mBAAmB,CAAC;gBACrC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;gBAClB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;gBACrC,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,aAAa,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,GAAG,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CACX,SAAS,CAAC,GAAG,EAAE,2BAA2B,EAAE,GAAG,CAAC,OAAO,CAAC,EACxD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CACX,SAAS,CACP,GAAG,EACH,8BAA8B,EAC9B,8EAA8E,CAC/E,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAChD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX,SAAS,CACP,GAAG,EACH,mBAAmB,EACnB,mFAAmF,CACpF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QAC3C,MAAM,WAAW,GACf,CAAC,OAAO,MAAM,KAAK,QAAQ;YACzB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC;gBACE,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM;gBACtC,OAAO;gBACP,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;aACpC,EACD;gBACE,KAAK,EAAE,IAAI,CAAC,YAAY;gBACxB,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAClE,WAAW,EAAE,gBAAgB;aAC9B,CACF,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;gBACE,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM;gBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,EACD,sBAAsB,CACvB,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,YAAY,EAAE,OAAO,CAAC,WAAW;gBACjC,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,OAAO,CAAC,gBAAgB;gBACpC,mEAAmE;gBACnE,2BAA2B;gBAC3B,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACjC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAA6B,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,gBAAgB,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}