@pellux/goodvibes-sdk 0.18.14 → 0.18.16

package/dist/_internal/platform/daemon/http-listener.js

@@ -0,0 +1,246 @@
+import { logger } from '@pellux/goodvibes-sdk/platform/utils/logger';
+import { HookDispatcher } from '../hooks/dispatcher.js';
+import { authenticateOperatorRequest, buildOperatorSessionCookie, } from '@pellux/goodvibes-sdk/platform/security/http-auth';
+import { UserAuthManager } from '@pellux/goodvibes-sdk/platform/security/user-auth';
+import { ConfigManager } from '../config/manager.js';
+import { extractForwardedClientIp, resolveInboundTlsContext } from '../runtime/network/index.js';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils/error-display';
+// ---------------------------------------------------------------------------
+// Rate limiter (sliding window per IP, in-memory)
+// ---------------------------------------------------------------------------
+const RATE_WINDOW_MS = 60_000;
+class RateLimiter {
+    limit;
+    counts = new Map();
+    constructor(limit) {
+        this.limit = limit;
+    }
+    /** Returns true if the request is allowed, false if rate-limited. */
+    check(ip) {
+        const now = Date.now();
+        const windowStart = now - RATE_WINDOW_MS;
+        const hits = (this.counts.get(ip) ?? []).filter((t) => t > windowStart);
+        hits.push(now);
+        this.counts.set(ip, hits);
+        return hits.length <= this.limit;
+    }
+}
+// ---------------------------------------------------------------------------
+// HttpListener
+// ---------------------------------------------------------------------------
+/**
+ * HttpListener — webhook listener, disabled by default.
+ *
+ * Enable via: danger.httpListener = true in config.
+ * All routes require Bearer token auth (set via enable()).
+ * POST /webhook — parse hook event, fire through HookDispatcher.
+ * GET  /health  — liveness check.
+ * Rate limited to 60 requests/minute per IP by default.
+ */
+export class HttpListener {
+    config;
+    enabled = false;
+    server = null;
+    port;
+    host;
+    allowedOrigins;
+    hookDispatcher;
+    authToken = null;
+    userAuth;
+    rateLimiter;
+    configManager;
+    serveFactory;
+    tlsState = null;
+    constructor(config) {
+        this.config = config;
+        this.configManager = config.configManager;
+        this.port = config.port ?? Number(this.configManager.get('httpListener.port') ?? 3422);
+        this.host = config.host ?? String(this.configManager.get('httpListener.host') ?? '127.0.0.1');
+        this.allowedOrigins = config.allowedOrigins ?? [];
+        this.hookDispatcher = config.hookDispatcher ?? null;
+        this.userAuth = config.userAuth;
+        this.rateLimiter = new RateLimiter(config.rateLimit ?? 60);
+        this.serveFactory = config.serveFactory ?? Bun.serve;
+    }
+    /**
+     * Enable the listener. Requires danger.httpListener = true in config.
+     * The provided token is used to authenticate all incoming requests.
+     * Returns true if enabled, false if the config forbids it.
+     */
+    enable(dangerConfig, token) {
+        if (!dangerConfig.httpListener) {
+            logger.info('HttpListener.enable: danger.httpListener is false — not enabling');
+            return false;
+        }
+        this.enabled = true;
+        this.authToken = token ?? null;
+        return true;
+    }
+    /**
+     * Start listening. Refuses to start if not enabled.
+     */
+    async start() {
+        if (!this.enabled) {
+            logger.info('HTTP listener is disabled. Enable via danger.httpListener config.');
+            return;
+        }
+        if (this.authToken === null) {
+            logger.info('HttpListener: starting with session-based authentication via UserAuth');
+        }
+        if (this.server !== null) {
+            logger.info('HttpListener: already running');
+            return;
+        }
+        const self = this;
+        this.tlsState = resolveInboundTlsContext(this.configManager, 'httpListener');
+        this.server = this.serveFactory({
+            port: this.port,
+            hostname: this.host,
+            ...(this.tlsState.tls ? { tls: this.tlsState.tls } : {}),
+            async fetch(req) {
+                return self.handleRequest(req);
+            },
+        });
+        logger.info('HttpListener started', {
+            port: this.port,
+            host: this.host,
+            tlsMode: this.tlsState.mode,
+            scheme: this.tlsState.scheme,
+            trustProxy: this.tlsState.trustProxy,
+        });
+    }
+    /**
+     * Stop the listener.
+     */
+    async stop() {
+        if (this.server === null)
+            return;
+        this.server.stop(true);
+        this.server = null;
+        this.tlsState = null;
+        logger.info('HttpListener stopped');
+    }
+    /**
+     * Returns true if the listener is currently running.
+     */
+    get isRunning() {
+        return this.server !== null;
+    }
+    // -------------------------------------------------------------------------
+    // Auth
+    // -------------------------------------------------------------------------
+    checkAuth(req) {
+        return authenticateOperatorRequest(req, {
+            sharedToken: this.authToken,
+            userAuth: this.userAuth,
+        }) !== null;
+    }
+    async parseJsonBody(req) {
+        try {
+            return await req.json();
+        }
+        catch {
+            return Response.json({ error: 'Invalid JSON body' }, { status: 400 });
+        }
+    }
+    // -------------------------------------------------------------------------
+    // Request handling
+    // -------------------------------------------------------------------------
+    async handleRequest(req) {
+        // Handle login route before auth check
+        const url = new URL(req.url);
+        if (url.pathname === '/login' && req.method === 'POST') {
+            return this.handleLogin(req);
+        }
+        // CORS origin check when allowedOrigins is configured
+        const origin = req.headers.get('origin') ?? '';
+        if (this.allowedOrigins.length > 0 && origin && !this.allowedOrigins.includes(origin)) {
+            return Response.json({ error: 'Origin not allowed' }, { status: 403 });
+        }
+        // Rate limiting (keyed by a synthetic IP-like string from headers)
+        // Note: x-forwarded-for is only trustworthy when running behind a trusted reverse proxy.
+        // If exposed directly to the internet, clients can spoof this header.
+        const clientIp = extractForwardedClientIp(req, this.tlsState?.trustProxy ?? Boolean(this.configManager.get('httpListener.trustProxy'))) ?? 'unknown';
+        if (!this.rateLimiter.check(clientIp)) {
+            return Response.json({ error: 'Too many requests' }, { status: 429 });
+        }
+        // Auth check
+        if (!this.checkAuth(req)) {
+            return Response.json({ error: 'Unauthorized' }, { status: 401 });
+        }
+        const { pathname, method } = { pathname: url.pathname, method: req.method };
+        if (pathname === '/webhook' && method === 'POST') {
+            return this.handleWebhook(req);
+        }
+        if (pathname === '/health' && method === 'GET') {
+            return Response.json({ status: 'ok' });
+        }
+        return Response.json({ error: 'Not found' }, { status: 404 });
+    }
+    async handleLogin(req) {
+        const body = await this.parseJsonBody(req);
+        if (body instanceof Response)
+            return body;
+        const username = typeof body.username === 'string' ? body.username : '';
+        const password = typeof body.password === 'string' ? body.password : '';
+        const user = this.userAuth.authenticate(username, password);
+        if (!user) {
+            return Response.json({ error: 'Invalid credentials' }, { status: 401 });
+        }
+        const session = this.userAuth.createSession(user.username);
+        return Response.json({
+            authenticated: true,
+            token: session.token,
+            username: session.username,
+            expiresAt: session.expiresAt,
+        }, {
+            headers: {
+                'Set-Cookie': buildOperatorSessionCookie(session.token, {
+                    req,
+                    expiresAt: session.expiresAt,
+                    trustProxy: this.tlsState?.trustProxy ?? Boolean(this.configManager.get('httpListener.trustProxy')),
+                }),
+            },
+        });
+    }
+    async handleWebhook(req) {
+        const body = await this.parseJsonBody(req);
+        if (body instanceof Response)
+            return body;
+        // Construct a HookEvent from the incoming payload
+        const eventType = typeof body.event === 'string' ? body.event : 'webhook';
+        const phase = typeof body.phase === 'string' ? body.phase : 'Post';
+        const hookEvent = {
+            path: `${phase}:webhook:${eventType}`,
+            phase: phase,
+            category: 'workflow',
+            specific: eventType,
+            sessionId: '',
+            timestamp: Date.now(),
+            payload: body,
+        };
+        if (!this.hookDispatcher) {
+            // No dispatcher wired — acknowledge without processing
+            logger.info('HttpListener: no HookDispatcher wired, acknowledging without processing', {
+                event: eventType,
+            });
+            return Response.json({ acknowledged: true, fired: false, reason: 'No HookDispatcher configured' }, { status: 202 });
+        }
+        try {
+            const result = await this.hookDispatcher.fire(hookEvent);
+            return Response.json({
+                acknowledged: true,
+                fired: true,
+                ok: result.ok,
+                decision: result.decision ?? null,
+                reason: result.reason ?? null,
+                error: result.error ?? null,
+            }, { status: result.ok ? 200 : 422 });
+        }
+        catch (err) {
+            const message = summarizeError(err);
+            logger.error('HttpListener: hook dispatch failed', { error: message });
+            return Response.json({ error: `Hook dispatch failed: ${message}` }, { status: 500 });
+        }
+    }
+}

package/dist/_internal/platform/daemon/index.d.ts

@@ -0,0 +1,4 @@
+export { DaemonServer } from './server.js';
+export { HttpListener } from './http-listener.js';
+export { PlatformServiceManager } from './service-manager.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/_internal/platform/daemon/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/daemon/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/_internal/platform/daemon/index.js

@@ -0,0 +1,3 @@
+export { DaemonServer } from './server.js';
+export { HttpListener } from './http-listener.js';
+export { PlatformServiceManager } from './service-manager.js';

package/dist/_internal/platform/daemon/server.d.ts

@@ -0,0 +1,2 @@
+export { DaemonServer } from './facade.js';
+//# sourceMappingURL=server.d.ts.map

package/dist/_internal/platform/daemon/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/daemon/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/dist/_internal/platform/daemon/server.js

@@ -0,0 +1 @@
+export { DaemonServer } from './facade.js';

package/dist/_internal/platform/daemon/service-manager.d.ts

@@ -0,0 +1,61 @@
+import { ConfigManager } from '../config/manager.js';
+export type ManagedServicePlatform = 'systemd' | 'launchd' | 'windows' | 'manual';
+export interface ManagedServiceDefinition {
+    readonly name: string;
+    readonly description: string;
+    readonly workingDirectory: string;
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly env: Readonly<Record<string, string>>;
+    readonly restartOnFailure: boolean;
+}
+export interface ManagedServiceStatus {
+    readonly platform: ManagedServicePlatform;
+    readonly path: string;
+    readonly installed: boolean;
+    readonly autostart: boolean;
+    readonly running: boolean;
+    readonly pid?: number;
+    readonly logPath?: string;
+    readonly commandPreview: string;
+    readonly contents?: string;
+    readonly suggestedCommands: readonly string[];
+    readonly lastAction?: 'install' | 'uninstall' | 'start' | 'stop' | 'restart' | 'status';
+    readonly actionError?: string;
+}
+export interface ManagedServiceActionResult {
+    readonly status: number | null;
+    readonly stdout?: string;
+    readonly stderr?: string;
+}
+interface ManagedServicePaths {
+    readonly workingDirectory: string;
+    readonly homeDirectory: string;
+}
+export interface ManagedServiceManagerOptions extends ManagedServicePaths {
+    readonly definitionOverride?: ManagedServiceDefinition;
+    readonly actionRunner?: (command: string, args: readonly string[]) => ManagedServiceActionResult;
+}
+export declare class PlatformServiceManager {
+    private readonly configManager;
+    private readonly workingDirectory;
+    private readonly homeDirectory;
+    private readonly definitionOverride?;
+    private readonly actionRunner?;
+    constructor(configManager: ConfigManager, options: ManagedServiceManagerOptions);
+    private getPaths;
+    status(): ManagedServiceStatus;
+    install(): ManagedServiceStatus;
+    uninstall(): ManagedServiceStatus;
+    start(): ManagedServiceStatus;
+    stop(): ManagedServiceStatus;
+    restart(): ManagedServiceStatus;
+    private resolveDefinition;
+    private startManual;
+    private stopManual;
+    private runPlatformAction;
+    private readPid;
+    private isPidRunning;
+}
+export {};
+//# sourceMappingURL=service-manager.d.ts.map

package/dist/_internal/platform/daemon/service-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-manager.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/daemon/service-manager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAElF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,4BAA6B,SAAQ,mBAAmB;IACvE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,0BAA0B,CAAC;CAClG;AAgKD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAA2B;IAC/D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAA2E;gBAE7F,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B;IAQ/E,OAAO,CAAC,QAAQ;IAOhB,MAAM,IAAI,oBAAoB;IA2B9B,OAAO,IAAI,oBAAoB;IAoB/B,SAAS,IAAI,oBAAoB;IAejC,KAAK,IAAI,oBAAoB;IAQ7B,IAAI,IAAI,oBAAoB;IAQ5B,OAAO,IAAI,oBAAoB;IAS/B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,WAAW;IAiCnB,OAAO,CAAC,UAAU;IAmBlB,OAAO,CAAC,iBAAiB;IA2BzB,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,YAAY;CAQrB"}