@promptbook/cli 0.103.0-10 → 0.103.0-100

package/apps/agents-server/src/utils/isIpAllowed.ts

@@ -0,0 +1,101 @@
+import { isIPv4, isIPv6 } from 'net';
+
+/**
+ * Checks if the IP address is allowed based on the allowed IPs list
+ *
+ * @param clientIp - The IP address of the client
+ * @param allowedIps - Comma separated list of allowed IPs or CIDR ranges
+ * @returns true if the IP is allowed, false otherwise
+ */
+export function isIpAllowed(clientIp: string, allowedIps: string | null | undefined): boolean {
+    if (!allowedIps || allowedIps.trim() === '') {
+        return true;
+    }
+
+    const allowedList = allowedIps.split(',').map((ip) => ip.trim());
+
+    for (const allowed of allowedList) {
+        if (allowed === '') {
+            continue;
+        }
+
+        if (allowed.includes('/')) {
+            // CIDR
+            if (isIpInCidr(clientIp, allowed)) {
+                return true;
+            }
+        } else {
+            // Single IP
+            if (clientIp === allowed) {
+                return true;
+            }
+        }
+    }
+
+    return false;
+}
+
+function isIpInCidr(ip: string, cidr: string): boolean {
+    try {
+        const [range, bitsStr] = cidr.split('/');
+        const bits = parseInt(bitsStr, 10);
+
+        if (isIPv4(ip) && isIPv4(range)) {
+            return isIPv4InCidr(ip, range, bits);
+        } else if (isIPv6(ip) && isIPv6(range)) {
+            return isIPv6InCidr(ip, range, bits);
+        } else if (isIPv6(ip) && isIPv4(range)) {
+            // Check if IPv6 is IPv4-mapped
+            if (ip.startsWith('::ffff:')) {
+                return isIPv4InCidr(ip.substring(7), range, bits);
+            }
+        }
+    } catch (error) {
+        console.error(`Error checking CIDR ${cidr} for IP ${ip}:`, error);
+    }
+    return false;
+}
+
+function ipToLong(ip: string): number {
+    return (
+        ip.split('.').reduce((acc, octet) => {
+            return (acc << 8) + parseInt(octet, 10);
+        }, 0) >>> 0
+    );
+}
+
+function isIPv4InCidr(ip: string, range: string, bits: number): boolean {
+    const mask = ~((1 << (32 - bits)) - 1);
+    const ipLong = ipToLong(ip);
+    const rangeLong = ipToLong(range);
+
+    return (ipLong & mask) === (rangeLong & mask);
+}
+
+function parseIPv6(ip: string): bigint {
+    // Expand ::
+    let fullIp = ip;
+    if (ip.includes('::')) {
+        const parts = ip.split('::');
+        const left = parts[0].split(':').filter(Boolean);
+        const right = parts[1].split(':').filter(Boolean);
+        const missing = 8 - (left.length + right.length);
+        const zeros = Array(missing).fill('0');
+        fullIp = [...left, ...zeros, ...right].join(':');
+    }
+
+    const parts = fullIp.split(':');
+    let value = BigInt(0);
+    for (const part of parts) {
+        value = (value << BigInt(16)) + BigInt(parseInt(part || '0', 16));
+    }
+    return value;
+}
+
+function isIPv6InCidr(ip: string, range: string, bits: number): boolean {
+    const ipBigInt = parseIPv6(ip);
+    const rangeBigInt = parseIPv6(range);
+    const mask = (BigInt(1) << BigInt(128)) - BigInt(1) ^ ((BigInt(1) << BigInt(128 - bits)) - BigInt(1));
+
+    return (ipBigInt & mask) === (rangeBigInt & mask);
+}

package/apps/agents-server/src/utils/isUserAdmin.ts

@@ -0,0 +1,31 @@
+import { cookies } from 'next/headers';
+import { getSession } from './session';
+
+/**
+ * Checks if the current user is an admin
+ * 
+ * Note: If `process.env.ADMIN_PASSWORD` is not set, no one is admin
+ * 
+ * @returns true if the user is admin
+ */
+export async function isUserAdmin(): Promise<boolean> {
+    if (!process.env.ADMIN_PASSWORD) {
+        return false;
+    }
+
+    // Check legacy admin token
+    const cookieStore = await cookies();
+    const adminToken = cookieStore.get('adminToken');
+
+    if (adminToken?.value === process.env.ADMIN_PASSWORD) {
+        return true;
+    }
+
+    // Check session
+    const session = await getSession();
+    if (session?.isAdmin) {
+        return true;
+    }
+
+    return false;
+}

package/apps/agents-server/src/utils/resolveInheritedAgentSource.ts

@@ -0,0 +1,100 @@
+import { createAgentModelRequirements } from '@promptbook-local/core';
+import type { AgentCollection } from '@promptbook-local/types';
+type string_book = string & { readonly __type: 'book' };
+
+/**
+ * Resolves agent source with inheritance (FROM commitment)
+ *
+ * It recursively fetches the parent agent source and merges it with the current source.
+ *
+ * @param agentSource The initial agent source
+ * @param collection Optional agent collection to resolve local agents efficiently
+ * @returns The resolved agent source with inheritance applied
+ */
+export async function resolveInheritedAgentSource(
+    agentSource: string_book,
+    collection?: AgentCollection,
+): Promise<string_book> {
+    // Check if the source has FROM commitment
+    // We use createAgentModelRequirements to parse commitments
+    // Note: We don't provide tools/models here as we only care about parsing commitments
+    const requirements = await createAgentModelRequirements(agentSource);
+
+    if (!requirements.parentAgentUrl) {
+        return agentSource;
+    }
+
+    const parentUrl = requirements.parentAgentUrl;
+    let parentSource: string_book;
+
+    try {
+        // 1. Try to resolve locally using collection if possible
+        // This is an optimization for internal agents
+        // We assume the URL might be relative or contain the agent name, or we just check if it's a full URL
+        // If it's a full URL, we need to check if it matches our server, but without knowing our server URL it's hard.
+        // So we might need to parse the URL to extract agent name if it matches expected pattern.
+        // For now, let's rely on fetch for external and check collection if it looks like a local reference (though FROM expects URL)
+
+    // If the URL is valid, we try to fetch it
+    // TODO: Handle authentication/tokens for private agents if needed
+
+    // TODO: [🧠] Do this logic more robustly
+    let fetchUrl = parentUrl;
+    if (!fetchUrl.endsWith('/api/book') && !fetchUrl.endsWith('.book') && !fetchUrl.endsWith('.md')) {
+        fetchUrl = `${fetchUrl.replace(/\/$/, '')}/api/book`;
+    }
+
+    const response = await fetch(fetchUrl);
+
+    if (!response.ok) {
+        throw new Error(`Failed to fetch parent agent from ${fetchUrl}: ${response.status} ${response.statusText}`);
+    }
+
+        // We assume the response is the agent source text
+        // TODO: Handle content negotiation or JSON responses if the server returns JSON
+        const contentType = response.headers.get('content-type');
+        if (contentType && contentType.includes('application/json')) {
+             const data = await response.json();
+             // Assume some structure or that the API returns source in a property
+             // For Agents Server API modelRequirements/route.ts returns AgentModelRequirements, not source.
+             // If we point to a raw source endpoint, it returns text.
+             // If we point to the agent page, it returns HTML.
+             // We need a standard way to get source.
+                 // For now, let's assume the URL points to the source or an API returning source.
+             if (typeof data === 'string') {
+                 parentSource = data as string_book;
+             } else if (data.source) {
+                 parentSource = data.source as string_book;
+             } else {
+                 // Fallback or error
+                 console.warn(`Received JSON from ${parentUrl} but couldn't determine source property. Using text.`);
+                 // Re-fetch as text? Or assume body text was read? response.json() consumes body.
+                 // So we might have failed here.
+                 throw new Error(`Received JSON from ${parentUrl} but structure is unknown.`);
+             }
+        } else {
+            parentSource = (await response.text()) as string_book;
+        }
+
+    } catch (error) {
+        console.warn(`Failed to resolve parent agent ${parentUrl}`, error);
+        // If we fail to resolve parent, we return the original source (maybe with a warning or error commitment?)
+        // Or we could throw to fail the build.
+        // For robustness, let's append a warning comment
+        return `${agentSource}\n\n# Warning: Failed to inherit from ${parentUrl}: ${error}` as string_book;
+    }
+
+    // Recursively resolve the parent source
+    const effectiveParentSource = await resolveInheritedAgentSource(parentSource, collection);
+
+    // Strip the FROM commitment from the child source to avoid infinite recursion or re-processing
+    // We can filter lines starting with FROM
+    const childSourceLines = agentSource.split('\n');
+    const filteredChildSource = childSourceLines
+        .filter((line: string) => !line.trim().startsWith('FROM ')) // Simple string check, ideally should use parser location
+        .join('\n');
+
+    // Append child source to parent source
+    // "appends the RULE commitment to its source" -> Parent + Child
+    return `${effectiveParentSource}\n\n${filteredChildSource}` as string_book;
+}

package/apps/agents-server/src/utils/session.ts

@@ -0,0 +1,50 @@
+import { createHmac } from 'crypto';
+import { cookies } from 'next/headers';
+
+const SESSION_COOKIE_NAME = 'sessionToken';
+const SECRET_KEY = process.env.ADMIN_PASSWORD || 'default-secret-key-change-me';
+
+type SessionUser = {
+    username: string;
+    isAdmin: boolean;
+};
+
+export async function setSession(user: SessionUser) {
+    const payload = JSON.stringify(user);
+    const signature = createHmac('sha256', SECRET_KEY).update(payload).digest('hex');
+    const token = `${Buffer.from(payload).toString('base64')}.${signature}`;
+    
+    (await cookies()).set(SESSION_COOKIE_NAME, token, {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        path: '/',
+        maxAge: 60 * 60 * 24 * 7, // 1 week
+    });
+}
+
+export async function clearSession() {
+    (await cookies()).delete(SESSION_COOKIE_NAME);
+    // Also clear legacy adminToken
+    (await cookies()).delete('adminToken');
+}
+
+export async function getSession(): Promise<SessionUser | null> {
+    const cookieStore = await cookies();
+    const token = cookieStore.get(SESSION_COOKIE_NAME)?.value;
+
+    if (!token) return null;
+
+    const [payloadBase64, signature] = token.split('.');
+    if (!payloadBase64 || !signature) return null;
+
+    const payload = Buffer.from(payloadBase64, 'base64').toString('utf-8');
+    const expectedSignature = createHmac('sha256', SECRET_KEY).update(payload).digest('hex');
+
+    if (signature !== expectedSignature) return null;
+
+    try {
+        return JSON.parse(payload) as SessionUser;
+    } catch {
+        return null;
+    }
+}

package/apps/agents-server/src/utils/validateApiKey.ts

@@ -0,0 +1,128 @@
+import { createClient } from '@supabase/supabase-js';
+import { NextRequest } from 'next/server';
+import { SERVERS, SUPABASE_TABLE_PREFIX } from '../../config';
+
+// Note: Re-implementing normalizeTo_PascalCase to avoid importing from @promptbook-local/utils which might have Node.js dependencies
+function normalizeTo_PascalCase(text: string): string {
+    return text
+        .replace(/(?:^\w|[A-Z]|\b\w)/g, (word) => {
+            return word.toUpperCase();
+        })
+        .replace(/\s+/g, '');
+}
+
+export type ApiKeyValidationResult = {
+    isValid: boolean;
+    token?: string;
+    error?: string;
+};
+
+/**
+ * Validates an API key from the Authorization header.
+ * Returns validation result with status and optional error message.
+ *
+ * Note: This function provides explicit API key validation in addition to middleware.
+ * Use this when you need to verify API key validity and return specific error messages.
+ */
+export async function validateApiKey(request: NextRequest): Promise<ApiKeyValidationResult> {
+    const authHeader = request.headers.get('authorization');
+
+    // If no auth header, check if user has a session cookie (logged in via web)
+    if (!authHeader) {
+        const hasSession = request.cookies.has('sessionToken');
+        if (hasSession) {
+            return { isValid: true };
+        }
+        return {
+            isValid: false,
+            error: 'Missing Authorization header. Provide a valid API key using "Authorization: Bearer ptbk_..."',
+        };
+    }
+
+    if (!authHeader.startsWith('Bearer ')) {
+        return {
+            isValid: false,
+            error: 'Invalid Authorization header format. Expected "Bearer <token>"',
+        };
+    }
+
+    const token = authHeader.split(' ')[1];
+
+    if (!token) {
+        return {
+            isValid: false,
+            error: 'No token provided in Authorization header',
+        };
+    }
+
+    if (!token.startsWith('ptbk_')) {
+        return {
+            isValid: false,
+            error: 'Invalid API key format. API keys must start with "ptbk_"',
+        };
+    }
+
+    // Determine the table prefix based on the host
+    const host = request.headers.get('host');
+    let tablePrefix = SUPABASE_TABLE_PREFIX;
+
+    if (host && SERVERS && SERVERS.length > 0) {
+        if (SERVERS.some((server) => server === host)) {
+            let serverName = host;
+            serverName = serverName.replace(/\.ptbk\.io$/, '');
+            serverName = normalizeTo_PascalCase(serverName);
+            tablePrefix = `server_${serverName}_`;
+        }
+    }
+
+    const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
+    const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
+
+    if (!supabaseUrl || !supabaseKey) {
+        console.error('Supabase configuration missing for API key validation');
+        return {
+            isValid: false,
+            error: 'Server configuration error',
+        };
+    }
+
+    try {
+        const supabase = createClient(supabaseUrl, supabaseKey, {
+            auth: {
+                persistSession: false,
+                autoRefreshToken: false,
+            },
+        });
+
+        const { data, error } = await supabase
+            .from(`${tablePrefix}ApiTokens`)
+            .select('id, isRevoked')
+            .eq('token', token)
+            .single();
+
+        if (error || !data) {
+            return {
+                isValid: false,
+                error: 'Invalid API key',
+            };
+        }
+
+        if (data.isRevoked) {
+            return {
+                isValid: false,
+                error: 'API key has been revoked',
+            };
+        }
+
+        return {
+            isValid: true,
+            token,
+        };
+    } catch (error) {
+        console.error('Error validating API key:', error);
+        return {
+            isValid: false,
+            error: 'Error validating API key',
+        };
+    }
+}

package/apps/agents-server/src/utils/validators/validateMimeType.ts

@@ -0,0 +1,24 @@
+import type { string_mime_type } from '../../../../../src/types/typeAliases';
+
+/**
+ * Checks if the value is valid mime-type
+ *
+ * @param value candidate for mime-type
+ * @returns the value if it is valid mime-type
+ * @throws TypeError if the value is not valid mime-type
+ */
+export function validateMimeType(value: unknown): string_mime_type {
+    if (typeof value !== 'string') {
+        throw new TypeError(`Mime-type must be string, but it is ${typeof value}`);
+    }
+
+    if (!/^[a-z]+\/(?:[a-z0-9]+[.-])*[a-z0-9]+$/i.test(value)) {
+        throw new TypeError(`Invalid mime-type "${value}"`);
+    }
+
+    return value as string_mime_type;
+}
+
+/**
+ * TODO: [🧠] Move to main Promptbook utils
+ */

package/apps/agents-server/tailwind.config.ts

@@ -0,0 +1,26 @@
+import type { Config } from 'tailwindcss';
+
+const config: Config = {
+    content: [
+        './src/pages/**/*.{js,ts,jsx,tsx,mdx}',
+        './src/components/**/*.{js,ts,jsx,tsx,mdx}',
+        './src/app/**/*.{js,ts,jsx,tsx,mdx}',
+    ],
+    theme: {
+        extend: {
+            fontFamily: {
+                sans: ['var(--font-geist-sans)', 'Arial', 'Helvetica', 'sans-serif'],
+                mono: ['var(--font-geist-mono)', 'Courier New', 'monospace'],
+            },
+            colors: {
+                background: 'var(--background)',
+                foreground: 'var(--foreground)',
+                'promptbook-blue': '#7aebff',
+                'promptbook-blue-dark': '#30a8bd',
+            },
+        },
+    },
+    plugins: [require('@tailwindcss/typography')],
+};
+
+export default config;

package/apps/agents-server/tsconfig.json

@@ -0,0 +1,29 @@
+{
+    "compilerOptions": {
+        "target": "esnext",
+        "lib": ["dom", "dom.iterable", "esnext"],
+        "allowJs": true,
+        "skipLibCheck": true,
+        "strict": true,
+        "noEmit": true,
+        "esModuleInterop": true,
+        "module": "esnext",
+        "moduleResolution": "bundler",
+        "resolveJsonModule": true,
+        "isolatedModules": true,
+        "jsx": "preserve",
+        "incremental": true,
+        "plugins": [
+            {
+                "name": "next"
+            }
+        ],
+        "paths": {
+            "@/*": ["./*"],
+            "@common/*": ["../_common/*"],
+            "@promptbook-local/*": ["../../src/_packages/*.index"]
+        }
+    },
+    "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts", "../_common/hooks/usePromise.ts"],
+    "exclude": ["node_modules"]
+}

package/apps/agents-server/vercel.json

@@ -0,0 +1,7 @@
+{
+    "build": {
+        "env": {
+            "VERCEL_FORCE_NO_BUILD_CACHE": "1"
+        }
+    }
+}