@promptbook/cli 0.112.0-99 → 0.112.0

package/apps/agents-server/src/app/api/agents/import/route.ts

@@ -0,0 +1,168 @@
+import { AuthenticationError, DatabaseError, ParseError, UnexpectedError } from '@promptbook-local/core';
+import { NextResponse } from 'next/server';
+import {
+    importAgentsFromFiles,
+    type AgentsImportConflictResolution,
+    type AgentsImportFile,
+} from '../../../../utils/agentsTransfer/importAgentsFromFiles';
+import { isUserAdmin } from '../../../../utils/isUserAdmin';
+
+/**
+ * This route is always dynamic because it depends on live DB state and auth.
+ */
+export const dynamic = 'force-dynamic';
+
+/**
+ * ZIP parsing and database writes require the Node.js runtime.
+ */
+export const runtime = 'nodejs';
+
+/**
+ * Form field containing uploaded book or ZIP files.
+ */
+const FILES_FORM_FIELD = 'files';
+
+/**
+ * Form field containing the optional target folder id.
+ */
+const TARGET_FOLDER_ID_FORM_FIELD = 'targetFolderId';
+
+/**
+ * Form field containing duplicate conflict handling.
+ */
+const CONFLICT_RESOLUTION_FORM_FIELD = 'conflictResolution';
+
+/**
+ * Default duplicate conflict handling.
+ */
+const DEFAULT_CONFLICT_RESOLUTION: AgentsImportConflictResolution = 'ASK';
+
+/**
+ * Imports `.book` files and ZIP archives into the current Agents Server.
+ *
+ * @param request - Multipart request containing one or more files.
+ * @returns Import summary or duplicate-conflict response.
+ */
+export async function POST(request: Request) {
+    if (!(await isUserAdmin())) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    try {
+        const formData = await request.formData();
+        const files = await readImportFilesFromFormData(formData);
+        const result = await importAgentsFromFiles({
+            files,
+            targetFolderId: parseImportTargetFolderId(formData.get(TARGET_FOLDER_ID_FORM_FIELD)),
+            conflictResolution: parseImportConflictResolution(formData.get(CONFLICT_RESOLUTION_FORM_FIELD)),
+        });
+
+        if (result.conflicts.length > 0) {
+            return NextResponse.json(
+                {
+                    success: false,
+                    code: 'agent_import_conflicts',
+                    message: 'Some dropped books have the same agent name as existing agents but different book source.',
+                    ...result,
+                },
+                { status: 409 },
+            );
+        }
+
+        return NextResponse.json({ success: true, ...result });
+    } catch (error) {
+        return createAgentsImportErrorResponse(error);
+    }
+}
+
+/**
+ * Reads uploaded files from multipart form data.
+ *
+ * @param formData - Parsed multipart form data.
+ * @returns Import files with binary content.
+ */
+async function readImportFilesFromFormData(formData: FormData): Promise<Array<AgentsImportFile>> {
+    const files = formData.getAll(FILES_FORM_FIELD).filter(isUploadedFileLike);
+
+    if (files.length === 0) {
+        throw new ParseError('No files were uploaded.');
+    }
+
+    return Promise.all(
+        files.map(async (file) => ({
+            name: file.name,
+            content: await file.arrayBuffer(),
+        })),
+    );
+}
+
+/**
+ * Checks whether a form value behaves like an uploaded file.
+ *
+ * @param value - Form data value.
+ * @returns `true` when the value has a file name and content reader.
+ */
+function isUploadedFileLike(value: FormDataEntryValue): value is File {
+    return typeof value !== 'string' && typeof value.name === 'string' && typeof value.arrayBuffer === 'function';
+}
+
+/**
+ * Parses the optional target folder form field.
+ *
+ * @param value - Raw form field value.
+ * @returns Target folder id or `null` for root.
+ */
+function parseImportTargetFolderId(value: FormDataEntryValue | null): number | null {
+    if (value === null || value === '' || value === 'null') {
+        return null;
+    }
+
+    if (typeof value !== 'string') {
+        throw new ParseError('Invalid target folder id.');
+    }
+
+    const parsedValue = Number(value);
+    if (!Number.isInteger(parsedValue) || parsedValue <= 0) {
+        throw new ParseError('Invalid target folder id.');
+    }
+
+    return parsedValue;
+}
+
+/**
+ * Parses duplicate conflict handling from the import form.
+ *
+ * @param value - Raw form field value.
+ * @returns Conflict resolution mode.
+ */
+function parseImportConflictResolution(value: FormDataEntryValue | null): AgentsImportConflictResolution {
+    if (value === 'SKIP' || value === 'DUPLICATE' || value === 'ASK') {
+        return value;
+    }
+
+    return DEFAULT_CONFLICT_RESOLUTION;
+}
+
+/**
+ * Maps branded import errors into HTTP JSON responses.
+ *
+ * @param error - Unknown thrown error.
+ * @returns JSON error response.
+ */
+function createAgentsImportErrorResponse(error: unknown): NextResponse {
+    if (error instanceof AuthenticationError) {
+        return NextResponse.json({ success: false, error: error.message }, { status: 401 });
+    }
+
+    if (error instanceof ParseError) {
+        return NextResponse.json({ success: false, error: error.message }, { status: 400 });
+    }
+
+    if (error instanceof DatabaseError || error instanceof UnexpectedError) {
+        console.error('Agents import error:', error);
+        return NextResponse.json({ success: false, error: 'Failed to import agents.' }, { status: 500 });
+    }
+
+    console.error('Agents import error:', error);
+    return NextResponse.json({ success: false, error: 'Failed to import agents.' }, { status: 500 });
+}

package/apps/agents-server/src/app/api/auth/change-password/route.ts

@@ -1,14 +1,32 @@
-import { NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server';
 import { $getTableName } from '../../../../database/$getTableName';
 import { $provideSupabaseForServer } from '../../../../database/$provideSupabaseForServer';
-import { AgentsServerDatabase } from '../../../../database/schema';
+import type { AgentsServerDatabase } from '../../../../database/schema';
 import { getPasswordValidationMessage, hashPassword, verifyPassword } from '../../../../utils/auth';
+import {
+    AUTHENTICATION_ATTEMPT_PURPOSES,
+    checkAuthenticationAttemptRateLimit,
+    createAuthenticationAttemptRateLimitResponse,
+    recordAuthenticationAttempt,
+    recordRateLimitedAuthenticationAttempt,
+    resolveAuthenticationAttemptRequestIp,
+} from '../../../../utils/authenticationAttemptRateLimit';
 import { getCurrentUser } from '../../../../utils/getCurrentUser';
 
+/**
+ * User row shape needed to verify and update a password change.
+ */
+type ChangePasswordUserRow = Pick<AgentsServerDatabase['public']['Tables']['User']['Row'], 'id' | 'passwordHash'>;
+
+/**
+ * Supabase projection for user fields needed by password changes.
+ */
+const CHANGE_PASSWORD_USER_SELECT_COLUMNS = 'id, passwordHash';
+
 /**
  * Handles post.
  */
-export async function POST(request: Request) {
+export async function POST(request: NextRequest) {
     try {
         const user = await getCurrentUser();
         if (!user) {
@@ -18,7 +36,12 @@ export async function POST(request: Request) {
         const body = await request.json();
         const { currentPassword, newPassword } = body;
 
-        if (!currentPassword || !newPassword) {
+        if (
+            typeof currentPassword !== 'string' ||
+            typeof newPassword !== 'string' ||
+            !currentPassword ||
+            !newPassword
+        ) {
             return NextResponse.json({ error: 'Missing password fields' }, { status: 400 });
         }
 
@@ -34,10 +57,27 @@ export async function POST(request: Request) {
             );
         }
 
+        const requestIp = resolveAuthenticationAttemptRequestIp(request);
+        const rateLimitDecision = checkAuthenticationAttemptRateLimit({
+            requestIp,
+            username: user.username,
+        });
+
+        if (!rateLimitDecision.isAllowed) {
+            recordRateLimitedAuthenticationAttempt({
+                requestIp,
+                username: user.username,
+                purpose: AUTHENTICATION_ATTEMPT_PURPOSES.CHANGE_PASSWORD,
+                rejection: rateLimitDecision,
+            });
+
+            return createAuthenticationAttemptRateLimitResponse(rateLimitDecision);
+        }
+
         const supabase = $provideSupabaseForServer();
         const { data: userData, error: fetchError } = await supabase
             .from(await $getTableName('User'))
-            .select('*')
+            .select(CHANGE_PASSWORD_USER_SELECT_COLUMNS)
             .eq('username', user.username)
             .single();
 
@@ -45,10 +85,17 @@ export async function POST(request: Request) {
             return NextResponse.json({ error: 'User not found' }, { status: 404 });
         }
 
-        const userRow = userData as AgentsServerDatabase['public']['Tables']['User']['Row'];
+        const userRow = userData as ChangePasswordUserRow;
 
         // Verify current password
         const isValid = await verifyPassword(currentPassword, userRow.passwordHash);
+        recordAuthenticationAttempt({
+            requestIp,
+            username: user.username,
+            purpose: AUTHENTICATION_ATTEMPT_PURPOSES.CHANGE_PASSWORD,
+            isSuccessful: isValid,
+        });
+
         if (!isValid) {
             return NextResponse.json({ error: 'Invalid current password' }, { status: 401 });
         }

package/apps/agents-server/src/app/api/auth/login/route.ts

@@ -1,36 +1,37 @@
-import { authenticateUser } from '../../../../utils/authenticateUser';
+import { authenticateUserWithRateLimit } from '../../../../utils/authenticateUser';
+import {
+    createAuthenticationAttemptRateLimitResponse,
+    resolveAuthenticationAttemptRequestIp,
+} from '../../../../utils/authenticationAttemptRateLimit';
 import { setSession } from '../../../../utils/session';
-import { writeShibbolethAuthenticationLog } from '../../../../utils/shibboleth/writeShibbolethAuthenticationLog';
-import { NextResponse } from 'next/server';
+import { NextRequest, NextResponse } from 'next/server';
 
 /**
  * Handles post.
  */
-export async function POST(request: Request) {
+export async function POST(request: NextRequest) {
     try {
-        writeShibbolethAuthenticationLog(request.headers, {
-            event: 'login-route-request',
-            pathname: '/api/auth/login',
-            method: request.method,
-            hasSessionCookie: (request.headers.get('cookie') || '').includes('sessionToken='),
-        });
-
         const body = await request.json();
         const { username, password } = body;
 
-        if (!username || !password) {
+        if (typeof username !== 'string' || typeof password !== 'string' || !username || !password) {
             return NextResponse.json({ error: 'Username and password are required' }, { status: 400 });
         }
 
-        const user = await authenticateUser(username, password);
+        const authenticationResult = await authenticateUserWithRateLimit(username, password, {
+            requestIp: resolveAuthenticationAttemptRequestIp(request),
+        });
+
+        if (authenticationResult.isRateLimited) {
+            return createAuthenticationAttemptRateLimitResponse(authenticationResult.rateLimitRejection);
+        }
 
-        if (user) {
-            await setSession(user);
+        if (authenticationResult.user) {
+            await setSession(authenticationResult.user);
             return NextResponse.json({ success: true });
         } else {
             return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 });
         }
-
     } catch (error) {
         console.error('Login error:', error);
         return NextResponse.json({ error: 'Internal server error' }, { status: 500 });

package/apps/agents-server/src/app/api/auth/logout/route.ts

@@ -1,18 +1,10 @@
-import { NextResponse } from 'next/server';
 import { clearSession } from '../../../../utils/session';
-import { writeShibbolethAuthenticationLog } from '../../../../utils/shibboleth/writeShibbolethAuthenticationLog';
+import { NextResponse } from 'next/server';
 
 /**
  * Handles post.
  */
-export async function POST(request: Request) {
-    writeShibbolethAuthenticationLog(request.headers, {
-        event: 'logout-route-request',
-        pathname: '/api/auth/logout',
-        method: request.method,
-        hasSessionCookie: (request.headers.get('cookie') || '').includes('sessionToken='),
-    });
-
+export async function POST() {
     await clearSession();
     return NextResponse.json({ success: true });
 }

package/apps/agents-server/src/app/api/auth/shibboleth/acs/route.ts

@@ -0,0 +1,112 @@
+import { revalidatePath } from 'next/cache';
+import { NextResponse } from 'next/server';
+import {
+    createShibbolethSamlClient,
+    findOrCreateShibbolethUser,
+    getShibbolethRequestDetails,
+    recordShibbolethAuthenticationAttempt,
+    resolveShibbolethAuthenticationConfiguration,
+    sanitizeShibbolethRelayState,
+} from '../../../../../utils/shibbolethAuthentication';
+import { setSession } from '../../../../../utils/session';
+
+/**
+ * Handles post.
+ */
+export async function POST(request: Request) {
+    const requestDetails = getShibbolethRequestDetails(request);
+    let relayState = '/';
+
+    try {
+        const formData = await request.formData();
+        const samlResponse = formData.get('SAMLResponse');
+        relayState = sanitizeShibbolethRelayState(formData.get('RelayState')?.toString());
+
+        if (typeof samlResponse !== 'string' || !samlResponse) {
+            await recordShibbolethAuthenticationAttempt({
+                stage: 'ASSERTION_CONSUMER_SERVICE',
+                status: 'FAILED',
+                requestDetails,
+                relayState,
+                errorMessage: 'Missing SAMLResponse.',
+            });
+            return NextResponse.json({ error: 'Missing SAMLResponse.' }, { status: 400 });
+        }
+
+        const configuration = await resolveShibbolethAuthenticationConfiguration({
+            requestUrl: request.url,
+            isIdentityProviderMetadataValidationEnabled: true,
+        });
+
+        if (!configuration.isActive) {
+            await recordShibbolethAuthenticationAttempt({
+                stage: 'ASSERTION_CONSUMER_SERVICE',
+                status: 'REJECTED',
+                requestDetails,
+                relayState,
+                errorMessage: 'Shibboleth authentication is not active.',
+            });
+            return NextResponse.json({ error: 'Shibboleth authentication is not active.' }, { status: 404 });
+        }
+
+        if (!configuration.isConfigured) {
+            const errorMessage = configuration.errors.join(' ');
+            await recordShibbolethAuthenticationAttempt({
+                stage: 'ASSERTION_CONSUMER_SERVICE',
+                status: 'FAILED',
+                requestDetails,
+                relayState,
+                errorMessage,
+            });
+            return NextResponse.json({ error: errorMessage }, { status: 503 });
+        }
+
+        const saml = createShibbolethSamlClient(configuration);
+        const { profile } = await saml.validatePostResponseAsync({ SAMLResponse: samlResponse });
+
+        if (!profile) {
+            await recordShibbolethAuthenticationAttempt({
+                stage: 'ASSERTION_CONSUMER_SERVICE',
+                status: 'FAILED',
+                requestDetails,
+                relayState,
+                errorMessage: 'Shibboleth response did not include a user profile.',
+            });
+            return NextResponse.json({ error: 'Shibboleth response did not include a user profile.' }, { status: 401 });
+        }
+
+        const linkedUser = await findOrCreateShibbolethUser(profile);
+        await setSession({
+            username: linkedUser.user.username,
+            isAdmin: linkedUser.user.isAdmin,
+            isGlobalAdmin: false,
+        });
+        revalidatePath('/', 'layout');
+
+        await recordShibbolethAuthenticationAttempt({
+            stage: 'ASSERTION_CONSUMER_SERVICE',
+            status: 'SUCCESS',
+            requestDetails,
+            relayState,
+            userId: linkedUser.user.id,
+            email: linkedUser.profileAttributes.email,
+            displayName: linkedUser.profileAttributes.displayName,
+            nameId: linkedUser.profileAttributes.nameId,
+            rawAttributes: linkedUser.profileAttributes.rawAttributes,
+        });
+
+        return NextResponse.redirect(new URL(relayState, request.url), 303);
+    } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Failed to finish Shibboleth authentication.';
+        await recordShibbolethAuthenticationAttempt({
+            stage: 'ASSERTION_CONSUMER_SERVICE',
+            status: 'FAILED',
+            requestDetails,
+            relayState,
+            errorMessage,
+        });
+
+        console.error('Shibboleth assertion consumer service error:', error);
+        return NextResponse.json({ error: errorMessage }, { status: 401 });
+    }
+}

package/apps/agents-server/src/app/api/auth/shibboleth/login/route.ts

@@ -0,0 +1,70 @@
+import { NextResponse } from 'next/server';
+import {
+    createShibbolethSamlClient,
+    getShibbolethRequestDetails,
+    recordShibbolethAuthenticationAttempt,
+    resolveShibbolethAuthenticationConfiguration,
+    sanitizeShibbolethRelayState,
+} from '../../../../../utils/shibbolethAuthentication';
+
+/**
+ * Handles get.
+ */
+export async function GET(request: Request) {
+    const requestDetails = getShibbolethRequestDetails(request);
+    const relayState = sanitizeShibbolethRelayState(new URL(request.url).searchParams.get('returnTo'));
+
+    try {
+        const configuration = await resolveShibbolethAuthenticationConfiguration({
+            requestUrl: request.url,
+            isIdentityProviderMetadataValidationEnabled: true,
+        });
+
+        if (!configuration.isActive) {
+            await recordShibbolethAuthenticationAttempt({
+                stage: 'LOGIN_REQUEST',
+                status: 'REJECTED',
+                requestDetails,
+                relayState,
+                errorMessage: 'Shibboleth authentication is not active.',
+            });
+            return NextResponse.json({ error: 'Shibboleth authentication is not active.' }, { status: 404 });
+        }
+
+        if (!configuration.isConfigured) {
+            const errorMessage = configuration.errors.join(' ');
+            await recordShibbolethAuthenticationAttempt({
+                stage: 'LOGIN_REQUEST',
+                status: 'FAILED',
+                requestDetails,
+                relayState,
+                errorMessage,
+            });
+            return NextResponse.json({ error: errorMessage }, { status: 503 });
+        }
+
+        const saml = createShibbolethSamlClient(configuration);
+        const authorizeUrl = await saml.getAuthorizeUrlAsync(relayState, undefined, {});
+
+        await recordShibbolethAuthenticationAttempt({
+            stage: 'LOGIN_REQUEST',
+            status: 'REDIRECTED',
+            requestDetails,
+            relayState,
+        });
+
+        return NextResponse.redirect(authorizeUrl);
+    } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Failed to start Shibboleth authentication.';
+        await recordShibbolethAuthenticationAttempt({
+            stage: 'LOGIN_REQUEST',
+            status: 'FAILED',
+            requestDetails,
+            relayState,
+            errorMessage,
+        });
+
+        console.error('Shibboleth login start error:', error);
+        return NextResponse.json({ error: errorMessage }, { status: 500 });
+    }
+}

package/apps/agents-server/src/app/api/auth/shibboleth/metadata/route.ts

@@ -0,0 +1,15 @@
+import { NextResponse } from 'next/server';
+import { createShibbolethServiceProviderMetadataXml } from '../../../../../utils/shibbolethAuthentication';
+
+/**
+ * Handles get.
+ */
+export async function GET(request: Request) {
+    const metadataXml = await createShibbolethServiceProviderMetadataXml(request.url);
+
+    return new NextResponse(metadataXml, {
+        headers: {
+            'Content-Type': 'application/samlmetadata+xml; charset=utf-8',
+        },
+    });
+}

package/apps/agents-server/src/app/api/auth/shibboleth/status/route.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from 'next/server';
+import { resolveShibbolethAuthenticationConfiguration } from '../../../../../utils/shibbolethAuthentication';
+
+/**
+ * Handles get.
+ */
+export async function GET(request: Request) {
+    const configuration = await resolveShibbolethAuthenticationConfiguration({
+        requestUrl: request.url,
+        isIdentityProviderMetadataValidationEnabled: false,
+    });
+
+    return NextResponse.json({
+        isActive: configuration.isActive,
+        isConfigured: configuration.isConfigured,
+    });
+}

package/apps/agents-server/src/app/api/chat/citation-label/route.ts

@@ -0,0 +1,133 @@
+import { serializeError } from '@promptbook-local/utils';
+import type { NextRequest } from 'next/server';
+import { NextResponse } from 'next/server';
+import { assertsError } from '../../../../../../../src/errors/assertsError';
+import { assertSafeUrl } from '../../../../utils/assertSafeUrl';
+import {
+    resolveCitationLabelTargetUrl,
+    resolveCitationSourceLabel,
+    type CitationSourceLabelPayload,
+} from '../../../../utils/chat/resolveCitationSourceLabel';
+import { getCurrentUser } from '../../../../utils/getCurrentUser';
+
+/**
+ * Maximum accepted citation field length in the label resolver endpoint.
+ *
+ * @private API route constant
+ */
+const MAX_CITATION_LABEL_FIELD_LENGTH = 2_000;
+
+/**
+ * Raw request body accepted by citation label resolver endpoint.
+ *
+ * @private API route type
+ */
+type CitationLabelRequestBody = {
+    /**
+     * Raw citation source.
+     */
+    readonly source?: unknown;
+
+    /**
+     * Optional source URL.
+     */
+    readonly url?: unknown;
+
+    /**
+     * Optional source title.
+     */
+    readonly title?: unknown;
+};
+
+/**
+ * Resolves nicer labels for chat source citations.
+ *
+ * Requires authentication because the endpoint fetches user-provided URLs.
+ *
+ * @route POST /api/chat/citation-label
+ */
+export async function POST(request: NextRequest): Promise<NextResponse> {
+    const currentUser = await getCurrentUser();
+    if (!currentUser) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    try {
+        const body = (await request.json()) as CitationLabelRequestBody;
+        const citation = parseCitationLabelRequestBody(body);
+        const targetUrl = resolveCitationLabelTargetUrl(citation);
+
+        if (targetUrl) {
+            try {
+                assertSafeUrl(targetUrl);
+            } catch (error) {
+                assertsError(error);
+                return NextResponse.json({ error: error.message, label: null }, { status: 400 });
+            }
+        }
+
+        const label = await resolveCitationSourceLabel(citation);
+
+        return NextResponse.json({ label });
+    } catch (error) {
+        assertsError(error);
+        const status = error.name === 'SyntaxError' || error.message.startsWith('Invalid ') ? 400 : 500;
+
+        return NextResponse.json(
+            {
+                error: status === 400 ? error.message : serializeError(error),
+                label: null,
+            },
+            { status },
+        );
+    }
+}
+
+/**
+ * Parses and validates one label resolver request body.
+ *
+ * @param body - Raw request body.
+ * @returns Validated citation payload.
+ *
+ * @private API route helper
+ */
+function parseCitationLabelRequestBody(body: CitationLabelRequestBody): CitationSourceLabelPayload {
+    const source = parseOptionalString(body.source, 'source');
+    if (!source) {
+        throw new Error('Invalid source: expected a non-empty string.');
+    }
+
+    return {
+        source,
+        url: parseOptionalString(body.url, 'url'),
+        title: parseOptionalString(body.title, 'title'),
+    };
+}
+
+/**
+ * Parses an optional request body string field.
+ *
+ * @param value - Raw field value.
+ * @param fieldName - Field name used in validation messages.
+ * @returns Trimmed string or undefined.
+ *
+ * @private API route helper
+ */
+function parseOptionalString(value: unknown, fieldName: string): string | undefined {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+
+    if (typeof value !== 'string') {
+        throw new Error(`Invalid ${fieldName}: expected a string.`);
+    }
+
+    const trimmedValue = value.trim();
+    if (trimmedValue.length > MAX_CITATION_LABEL_FIELD_LENGTH) {
+        throw new Error(`Invalid ${fieldName}: value is too long.`);
+    }
+
+    return trimmedValue || undefined;
+}
+
+// Note: [🟢] Code for Agents Server citation label API route should never be published into packages that could be imported into browser environment