@polderlabs/bizar 4.9.0 → 5.0.0

package/bizar-dash/src/server/routes/plugins.mjs

@@ -0,0 +1,220 @@
+/**
+ * src/server/routes/plugins.mjs
+ *
+ * v5.0.0 — Plugin marketplace REST surface.
+ *
+ *   GET    /api/plugins/registry?q=&category=&tag=
+ *                                             — search the public registry
+ *   GET    /api/plugins/registry/:id          — get one plugin's details
+ *   GET    /api/plugins/installed             — list installed plugins
+ *   POST   /api/plugins/install               — install from registry
+ *         body { pluginId, force? }
+ *   DELETE /api/plugins/:id                   — uninstall
+ *   PUT    /api/plugins/:id                   — update OR set config
+ *         body { action: 'update' | 'config', config? }
+ *   POST   /api/plugins/:id/invoke            — invoke a method in the sandbox
+ *         body { method, args? }
+ *
+ * Express-ordering note: /registry and /installed must come BEFORE the
+ * `:id` wildcard routes so Express doesn't match "registry" as an id.
+ */
+import { Router } from 'express';
+import { wrap } from './_shared.mjs';
+import * as registry from '../plugins/registry.mjs';
+import * as store from '../plugins/store.mjs';
+
+/**
+ * @returns {import('express').Router}
+ */
+export function createPluginsRouter() {
+  const router = Router();
+
+  // ── GET /api/plugins/registry?q=&category=&tag= ──────────────────────
+  router.get('/plugins/registry', wrap(async (req, res) => {
+    const q = typeof req.query.q === 'string' ? req.query.q : '';
+    const category = typeof req.query.category === 'string' ? req.query.category : undefined;
+    const tag = typeof req.query.tag === 'string' ? req.query.tag : undefined;
+    try {
+      const plugins = await registry.searchPlugins(q, { category, tag });
+      // Annotate each entry with installed flag for the UI.
+      const installed = new Map(store.listInstalled().map((p) => [p.id, p]));
+      res.json({
+        registry: {
+          source: registry.getRegistryUrl(),
+          updatedAt: null, // populated only on a full fetchRegistry; ok to be null here
+        },
+        plugins: plugins.map((p) => {
+          const local = installed.get(p.id);
+          return {
+            ...p,
+            installed: !!local,
+            installedVersion: local ? local.version : null,
+            upgradeAvailable:
+              local && local.version !== p.version ? p.version : null,
+          };
+        }),
+      });
+    } catch (err) {
+      const status = err.code === 'registry_unreachable' ? 502 : 500;
+      res.status(status).json({
+        error: err.code || 'registry_error',
+        message: err.message,
+        registryUrl: registry.getRegistryUrl(),
+      });
+    }
+  }));
+
+  // ── GET /api/plugins/registry/:id ────────────────────────────────────
+  router.get('/plugins/registry/:id', wrap(async (req, res) => {
+    try {
+      const plugin = await registry.getPlugin(req.params.id);
+      if (!plugin) {
+        res.status(404).json({ error: 'not_found' });
+        return;
+      }
+      const local = store.getInstalled(plugin.id);
+      res.json({
+        ...plugin,
+        installed: !!local,
+        installedVersion: local ? local.version : null,
+        upgradeAvailable:
+          local && local.version !== plugin.version ? plugin.version : null,
+      });
+    } catch (err) {
+      const status = err.code === 'registry_unreachable' ? 502 : 500;
+      res.status(status).json({
+        error: err.code || 'registry_error',
+        message: err.message,
+      });
+    }
+  }));
+
+  // ── GET /api/plugins/installed ───────────────────────────────────────
+  router.get('/plugins/installed', wrap(async (_req, res) => {
+    res.json({ plugins: store.listInstalled() });
+  }));
+
+  // ── POST /api/plugins/install ────────────────────────────────────────
+  router.post('/plugins/install', wrap(async (req, res) => {
+    const pluginId = req.body?.pluginId || req.body?.id;
+    if (!pluginId || typeof pluginId !== 'string') {
+      res.status(400).json({
+        error: 'bad_request',
+        message: 'pluginId is required',
+      });
+      return;
+    }
+    const force = !!req.body?.force;
+    try {
+      const installed = await store.installPlugin(pluginId, { force });
+      res.status(201).json(installed);
+    } catch (err) {
+      const map = {
+        not_found: 404,
+        already_installed: 409,
+        checksum_mismatch: 422,
+        download_failed: 502,
+        bad_manifest: 422,
+      };
+      const status = map[err.code] || 500;
+      res.status(status).json({
+        error: err.code || 'install_failed',
+        message: err.message,
+      });
+    }
+  }));
+
+  // ── PUT /api/plugins/:id (update OR set config) ──────────────────────
+  router.put('/plugins/:id', wrap(async (req, res) => {
+    const action = req.body?.action;
+    if (action === 'update') {
+      try {
+        const result = await store.updatePlugin(req.params.id);
+        res.json({
+          ok: true,
+          from: result.from,
+          to: result.to,
+          plugin: result.plugin,
+        });
+      } catch (err) {
+        const status = err.code === 'not_installed' ? 404 : 500;
+        res.status(status).json({
+          error: err.code || 'update_failed',
+          message: err.message,
+        });
+      }
+      return;
+    }
+    if (action === 'config') {
+      const config = req.body?.config;
+      if (!config || typeof config !== 'object' || Array.isArray(config)) {
+        res.status(400).json({
+          error: 'bad_request',
+          message: 'config must be an object',
+        });
+        return;
+      }
+      try {
+        const updated = store.replaceConfig(req.params.id, config);
+        res.json(updated);
+      } catch (err) {
+        const status = err.code === 'not_installed' ? 404 : 400;
+        res.status(status).json({
+          error: err.code || 'config_failed',
+          message: err.message,
+        });
+      }
+      return;
+    }
+    res.status(400).json({
+      error: 'bad_request',
+      message: 'action must be "update" or "config"',
+    });
+  }));
+
+  // ── DELETE /api/plugins/:id ──────────────────────────────────────────
+  router.delete('/plugins/:id', wrap(async (req, res) => {
+    const ok = store.uninstallPlugin(req.params.id);
+    if (!ok) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    res.status(204).end();
+  }));
+
+  // ── POST /api/plugins/:id/invoke ─────────────────────────────────────
+  router.post('/plugins/:id/invoke', wrap(async (req, res) => {
+    const method = req.body?.method;
+    const args = Array.isArray(req.body?.args) ? req.body.args : [];
+    if (!method || typeof method !== 'string') {
+      res.status(400).json({
+        error: 'bad_request',
+        message: 'method (string) is required',
+      });
+      return;
+    }
+    const timeoutMs = Number.isFinite(req.body?.timeoutMs)
+      ? req.body.timeoutMs
+      : undefined;
+    const result = await store.invokePlugin(req.params.id, method, args, {
+      timeoutMs,
+    });
+    if (result.ok) {
+      res.json(result);
+      return;
+    }
+    // Distinguish "this is a plugin bug" (500) from "this is a usage
+    // error" (400/404) so the client can decide whether to retry.
+    const usageCodes = new Set([
+      'not_installed',
+      'no_such_method',
+      'bad_manifest',
+      'permission_denied',
+      'corrupt_install',
+    ]);
+    const status = usageCodes.has(result.code) ? 400 : 500;
+    res.status(status).json(result);
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/users.mjs

@@ -0,0 +1,84 @@
+/**
+ * src/server/routes/users.mjs
+ *
+ * v5.0.0 — User management REST API.
+ *
+ * Endpoints:
+ *   GET    /api/users/me        — current user info
+ *   PATCH  /api/users/me        — update profile (name, email)
+ *   GET    /api/users/:id       — get user (workspace member only)
+ */
+import { Router } from 'express';
+import { getUser, updateUser, listWorkspacesWithRoles } from '../workspaces.mjs';
+import { getCurrentUserId } from '../auth.mjs';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @returns {import('express').Router}
+ */
+export function createUsersRouter() {
+  const router = Router();
+
+  // GET /api/users/me — current user info
+  router.get('/users/me', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const user = await getUser(userId);
+    if (!user) {
+      return res.status(404).json({ error: 'not_found', message: 'User not found' });
+    }
+    const workspaces = await listWorkspacesWithRoles(userId);
+    res.json({
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+      },
+      workspaces,
+    });
+  }));
+
+  // PATCH /api/users/me — update profile
+  router.patch('/users/me', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const { name, email } = req.body || {};
+    if (!name && !email) {
+      return res.status(400).json({ error: 'bad_request', message: 'name or email required' });
+    }
+    const updates = {};
+    if (name !== undefined) updates.name = name;
+    if (email !== undefined) updates.email = email;
+    const user = await updateUser(userId, updates);
+    res.json({ user });
+  }));
+
+  // GET /api/users/:id — get user (workspace member only)
+  router.get('/users/:id', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const { id } = req.params;
+    const user = await getUser(id);
+    if (!user) {
+      return res.status(404).json({ error: 'not_found', message: 'User not found' });
+    }
+    // Only return user if both are members of at least one common workspace
+    // For simplicity, we check if the requesting user exists (they're authenticated)
+    // In a real implementation, we'd check shared workspace membership
+    res.json({
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+      },
+    });
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/voice.mjs

@@ -0,0 +1,131 @@
+/**
+ * src/server/routes/voice.mjs
+ *
+ * v5.0.0 — Voice notes REST API.
+ *
+ * Endpoints:
+ *   POST   /api/voice/upload            — multipart upload, transcribe, save
+ *   GET    /api/voice/list?vaultPath=   — list notes (optionally filtered)
+ *   GET    /api/voice/:id              — get note details
+ *   DELETE /api/voice/:id              — delete note + audio + transcript
+ *   GET    /api/voice/:id/audio        — stream audio file
+ */
+
+import { Router } from 'express';
+import { createReadStream, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { info, warn, child } from '../logger.mjs';
+import { saveVoiceNote, listVoiceNotes, getVoiceNote, deleteVoiceNote } from '../voice-store.mjs';
+import { transcribe } from '../voice-transcribe.mjs';
+import { wrap } from './_shared.mjs';
+import formidable from 'formidable';
+
+const log = child({ module: 'voice-routes' });
+
+/**
+ * @param {object} _deps
+ * @returns {import('express').Router}
+ */
+export function createVoiceRouter(_deps) {
+  const router = Router();
+
+  // POST /api/voice/upload — multipart: audio file + vaultPath field
+  router.post('/voice/upload', wrap(async (req, res) => {
+    const form = formidable({ maxFileSize: 50 * 1024 * 1024 }); // 50 MB limit
+    form.parse(req, async (err, fields, files) => {
+      if (err) {
+        warn('voice upload: parse error', { err: err.message });
+        res.status(400).json({ error: 'upload_error', message: err.message });
+        return;
+      }
+
+      const vaultPath = Array.isArray(fields.vaultPath)
+        ? fields.vaultPath[0]
+        : fields.vaultPath || null;
+
+      const audioFile = files.audio?.[0];
+      if (!audioFile) {
+        res.status(400).json({ error: 'missing_audio', message: 'No audio file in upload' });
+        return;
+      }
+
+      // Read audio bytes
+      let audioBuffer;
+      try {
+        const { readFileSync } = await import('node:fs');
+        audioBuffer = readFileSync(audioFile.filepath);
+      } catch (readErr) {
+        warn('voice upload: failed to read audio file', { err: readErr.message });
+        res.status(500).json({ error: 'read_error', message: 'Could not read audio file' });
+        return;
+      }
+
+      // Transcribe
+      const transcript = await transcribe(audioBuffer, { mimeType: 'audio/webm' });
+
+      // Duration from audioFile (formidable provides size but not duration — we
+      // store null and the frontmatter will show '?')
+      const durationSec = null;
+
+      // Save
+      let saved;
+      try {
+        saved = await saveVoiceNote({ audioBuffer, transcript, durationSec, vaultPath });
+      } catch (saveErr) {
+        warn('voice upload: save failed', { err: saveErr.message });
+        res.status(500).json({ error: 'save_error', message: saveErr.message });
+        return;
+      }
+
+      log.info('voice note saved via upload', { id: saved.id, transcriptLength: transcript?.length ?? 0 });
+      res.json({ notePath: saved.notePath, audioPath: saved.audioPath, id: saved.id, transcription: transcript });
+    });
+  }));
+
+  // GET /api/voice/list?vaultPath=
+  router.get('/voice/list', wrap(async (req, res) => {
+    const vaultPath = req.query.vaultPath || null;
+    const limit = Math.min(200, Math.max(1, parseInt(req.query.limit || '50', 10) || 50));
+    const notes = listVoiceNotes({ vaultPath, limit });
+    res.json({ notes });
+  }));
+
+  // GET /api/voice/:id
+  router.get('/voice/:id', wrap(async (req, res) => {
+    const note = getVoiceNote(req.params.id);
+    if (!note) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    res.json({ note });
+  }));
+
+  // DELETE /api/voice/:id
+  router.delete('/voice/:id', wrap(async (req, res) => {
+    const ok = deleteVoiceNote(req.params.id);
+    if (!ok) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    res.status(204).end();
+  }));
+
+  // GET /api/voice/:id/audio — stream audio file
+  router.get('/voice/:id/audio', wrap(async (req, res) => {
+    const note = getVoiceNote(req.params.id);
+    if (!note) {
+      res.status(404).json({ error: 'not_found' });
+      return;
+    }
+    if (!existsSync(note.audioPath)) {
+      warn('voice audio file missing', { id: req.params.id, path: note.audioPath });
+      res.status(404).json({ error: 'audio_missing' });
+      return;
+    }
+    res.setHeader('Content-Type', 'audio/webm');
+    res.setHeader('Cache-Control', 'no-cache');
+    createReadStream(note.audioPath).pipe(res);
+  }));
+
+  return router;
+}

package/bizar-dash/src/server/routes/workspaces.mjs

@@ -0,0 +1,204 @@
+/**
+ * src/server/routes/workspaces.mjs
+ *
+ * v5.0.0 — Workspace management REST API.
+ *
+ * Endpoints:
+ *   GET    /api/workspaces                    — list user's workspaces
+ *   POST   /api/workspaces                    — create workspace
+ *   GET    /api/workspaces/:id                — get workspace details
+ *   DELETE /api/workspaces/:id                 — delete workspace (admin only)
+ *   POST   /api/workspaces/:id/invites        — create invite
+ *   GET    /api/workspaces/:id/invites        — list pending invites
+ *   DELETE /api/workspaces/:id/invites/:token — revoke invite
+ *   POST   /api/workspaces/:id/members/:userId — update member role
+ *   DELETE /api/workspaces/:id/members/:userId — remove member
+ *   POST   /api/invites/:token/accept         — accept invite
+ */
+import { Router } from 'express';
+import {
+  createWorkspace,
+  getWorkspace,
+  listWorkspacesWithRoles,
+  deleteWorkspace,
+  createInvite,
+  listInvites,
+  revokeInvite,
+  addMember,
+  removeMember,
+  updateMemberRole,
+  acceptInvite,
+  checkPermission,
+  listMembers,
+  ROLES,
+} from '../workspaces.mjs';
+import { getCurrentUserId, getCurrentWorkspaceId } from '../auth.mjs';
+import { wrap } from './_shared.mjs';
+
+/**
+ * @returns {import('express').Router}
+ */
+export function createWorkspacesRouter() {
+  const router = Router();
+
+  // GET /api/workspaces — list user's workspaces
+  router.get('/workspaces', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const workspaces = await listWorkspacesWithRoles(userId);
+    res.json({ workspaces });
+  }));
+
+  // POST /api/workspaces — create workspace
+  router.post('/workspaces', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const { name } = req.body || {};
+    if (!name || typeof name !== 'string' || !name.trim()) {
+      return res.status(400).json({ error: 'bad_request', message: 'Workspace name is required' });
+    }
+    const workspace = await createWorkspace({ name: name.trim(), ownerId: userId });
+    res.status(201).json({ workspace });
+  }));
+
+  // GET /api/workspaces/:id — get workspace details
+  router.get('/workspaces/:id', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const { id } = req.params;
+    const workspace = await getWorkspace(id);
+    if (!workspace) {
+      return res.status(404).json({ error: 'not_found', message: 'Workspace not found' });
+    }
+    const hasAccess = await checkPermission(id, userId, ROLES.VIEWER);
+    if (!hasAccess) {
+      return res.status(403).json({ error: 'forbidden', message: 'Not a member of this workspace' });
+    }
+    const members = await listMembers(id);
+    res.json({ workspace, members });
+  }));
+
+  // DELETE /api/workspaces/:id — delete workspace (admin only)
+  router.delete('/workspaces/:id', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const { id } = req.params;
+    const canDelete = await checkPermission(id, userId, ROLES.ADMIN);
+    if (!canDelete) {
+      return res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+    }
+    await deleteWorkspace(id);
+    res.json({ ok: true });
+  }));
+
+  // POST /api/workspaces/:id/invites — create invite
+  router.post('/workspaces/:id/invites', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const { id } = req.params;
+    const { email, role } = req.body || {};
+    if (!email || typeof email !== 'string') {
+      return res.status(400).json({ error: 'bad_request', message: 'Email is required' });
+    }
+    if (!role || !Object.values(ROLES).includes(role)) {
+      return res.status(400).json({ error: 'bad_request', message: 'Valid role is required' });
+    }
+    const canInvite = await checkPermission(id, userId, ROLES.ADMIN);
+    if (!canInvite) {
+      return res.status(403).json({ error: 'forbidden', message: 'Admin role required to invite' });
+    }
+    const result = await createInvite(id, email, role, userId);
+    res.status(201).json(result);
+  }));
+
+  // GET /api/workspaces/:id/invites — list pending invites
+  router.get('/workspaces/:id/invites', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const { id } = req.params;
+    const canView = await checkPermission(id, userId, ROLES.ADMIN);
+    if (!canView) {
+      return res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+    }
+    const invites = await listInvites(id);
+    res.json({ invites });
+  }));
+
+  // DELETE /api/workspaces/:id/invites/:token — revoke invite
+  router.delete('/workspaces/:id/invites/:token', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const { id, token } = req.params;
+    const canRevoke = await checkPermission(id, userId, ROLES.ADMIN);
+    if (!canRevoke) {
+      return res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+    }
+    await revokeInvite(id, token);
+    res.json({ ok: true });
+  }));
+
+  // POST /api/workspaces/:id/members/:userId — update member role
+  router.post('/workspaces/:id/members/:userId', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const { id, userId: targetUserId } = req.params;
+    const { role } = req.body || {};
+    if (!role || !Object.values(ROLES).includes(role)) {
+      return res.status(400).json({ error: 'bad_request', message: 'Valid role is required' });
+    }
+    const canUpdate = await checkPermission(id, userId, ROLES.ADMIN);
+    if (!canUpdate) {
+      return res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+    }
+    await updateMemberRole(id, targetUserId, role);
+    res.json({ ok: true, role });
+  }));
+
+  // DELETE /api/workspaces/:id/members/:userId — remove member
+  router.delete('/workspaces/:id/members/:userId', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const { id, userId: targetUserId } = req.params;
+    const canRemove = await checkPermission(id, userId, ROLES.ADMIN);
+    if (!canRemove) {
+      return res.status(403).json({ error: 'forbidden', message: 'Admin role required' });
+    }
+    await removeMember(id, targetUserId);
+    res.json({ ok: true });
+  }));
+
+  // POST /api/invites/:token/accept — accept invite
+  router.post('/invites/:token/accept', wrap(async (req, res) => {
+    const userId = getCurrentUserId(req);
+    if (!userId) {
+      return res.status(401).json({ error: 'unauthorized', message: 'Not authenticated' });
+    }
+    const { token } = req.params;
+    const { email, name } = req.body || {};
+    if (!email || !name) {
+      return res.status(400).json({ error: 'bad_request', message: 'Email and name are required' });
+    }
+    const result = await acceptInvite(token, userId, email, name);
+    res.json({ ok: true, workspace: result.workspace, role: result.role });
+  }));
+
+  return router;
+}