@robodev-ai/runtime 0.2.0 → 0.4.0

package/src/local-google.test.ts

@@ -0,0 +1,93 @@
+import assert from "node:assert/strict";
+import { createLocalJWKSet, exportJWK, generateKeyPair, SignJWT } from "jose";
+import { test } from "node:test";
+import {
+  LOCAL_DEV_IDENTITY_AUD,
+  LOCAL_DEV_IDENTITY_TYP,
+  resetLocalDevAssertionReplayForTests,
+  verifyLocalDevIdentityAssertion,
+} from "./local-google.js";
+
+async function signedAssertion(input: {
+  typ?: string;
+  iss?: string;
+  aud?: string;
+  callback?: string;
+  redirect?: string;
+  jti?: string;
+}) {
+  const { privateKey, publicKey } = await generateKeyPair("EdDSA", { crv: "Ed25519" });
+  const jwk = await exportJWK(publicKey);
+  const now = Math.floor(Date.now() / 1000);
+  const token = await new SignJWT({
+    typ: input.typ ?? LOCAL_DEV_IDENTITY_TYP,
+    email: "a@b.com",
+    name: "A",
+    google_subject: "sub",
+    callback_uri: input.callback ?? "http://localhost:4000/api/user/auth/google/callback",
+    redirect_uri: input.redirect ?? "http://localhost:5173/",
+  })
+    .setProtectedHeader({ alg: "EdDSA", typ: "JWT", kid: "k" })
+    .setIssuer(input.iss ?? "https://robodev.povio.dev")
+    .setAudience(input.aud ?? LOCAL_DEV_IDENTITY_AUD)
+    .setJti(input.jti ?? "jti-a")
+    .setIssuedAt(now)
+    .setExpirationTime(now + 120)
+    .sign(privateKey);
+  return {
+    token,
+    jwks: createLocalJWKSet({ keys: [{ ...jwk, kid: "k", use: "sig", alg: "EdDSA" }] }),
+  };
+}
+
+test("verifyLocalDevIdentityAssertion rejects wrong aud, iss, typ, and replay", async () => {
+  resetLocalDevAssertionReplayForTests();
+  const ok = await signedAssertion({});
+  const identity = await verifyLocalDevIdentityAssertion(ok.token, {
+    brokerBaseUrl: "https://robodev.povio.dev",
+    callbackUri: "http://localhost:4000/api/user/auth/google/callback",
+    jwks: ok.jwks,
+  });
+  assert.equal(identity.email, "a@b.com");
+
+  await assert.rejects(
+    () =>
+      verifyLocalDevIdentityAssertion(ok.token, {
+        brokerBaseUrl: "https://robodev.povio.dev",
+        callbackUri: "http://localhost:4000/api/user/auth/google/callback",
+        jwks: ok.jwks,
+      }),
+    /invalid_assertion/,
+  );
+
+  resetLocalDevAssertionReplayForTests();
+  const badAud = await signedAssertion({ aud: "someone-else" });
+  await assert.rejects(() =>
+    verifyLocalDevIdentityAssertion(badAud.token, {
+      brokerBaseUrl: "https://robodev.povio.dev",
+      callbackUri: "http://localhost:4000/api/user/auth/google/callback",
+      jwks: badAud.jwks,
+    }),
+  );
+
+  const badIss = await signedAssertion({ iss: "https://evil.example" });
+  await assert.rejects(() =>
+    verifyLocalDevIdentityAssertion(badIss.token, {
+      brokerBaseUrl: "https://robodev.povio.dev",
+      callbackUri: "http://localhost:4000/api/user/auth/google/callback",
+      jwks: badIss.jwks,
+    }),
+  );
+
+  const badTyp = await signedAssertion({ typ: "not_identity" });
+  await assert.rejects(
+    () =>
+      verifyLocalDevIdentityAssertion(badTyp.token, {
+        brokerBaseUrl: "https://robodev.povio.dev",
+        callbackUri: "http://localhost:4000/api/user/auth/google/callback",
+        jwks: badTyp.jwks,
+      }),
+    /invalid_assertion/,
+  );
+  resetLocalDevAssertionReplayForTests();
+});

package/src/local-google.ts

@@ -0,0 +1,232 @@
+import { createRemoteJWKSet, jwtVerify, SignJWT, type JWTVerifyGetKey } from "jose";
+
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+const LOCAL_STATE_TYP = "local_google_oauth_state";
+export const LOCAL_DEV_IDENTITY_TYP = "robodev_local_dev_identity";
+export const LOCAL_DEV_IDENTITY_AUD = "robodev-local-dev";
+const JTI_TTL_MS = 3 * 60 * 1000;
+
+const usedJti = new Map<string, number>();
+
+function invalidRedirect(message: string): Error {
+  return Object.assign(new Error(message), {
+    statusCode: 400,
+    code: "invalid_redirect_uri",
+  });
+}
+
+function invalidAssertion(message = "invalid_assertion"): Error {
+  return Object.assign(new Error(message), {
+    statusCode: 400,
+    code: "invalid_assertion",
+  });
+}
+
+function parseLoopbackUrl(raw: string): URL {
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw invalidRedirect("redirect_uri is not a valid URL");
+  }
+  if (url.username || url.password) {
+    throw invalidRedirect("redirect_uri must not include credentials");
+  }
+  if (!LOOPBACK_HOSTS.has(url.hostname)) {
+    throw invalidRedirect("redirect_uri must be a loopback host");
+  }
+  url.hash = "";
+  return url;
+}
+
+/** http-only loopback URL. Starbase bounce target. */
+export function assertLocalBrokerRedirectUri(raw: string): string {
+  const url = parseLoopbackUrl(raw);
+  if (url.protocol !== "http:") {
+    throw invalidRedirect("callback_uri must be http on a loopback host");
+  }
+  return url.toString();
+}
+
+/** Loopback http or https. Local app `redirect_uri` (Vite may be https). */
+export function assertLocalAppRedirectUri(raw: string): string {
+  const url = parseLoopbackUrl(raw);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw invalidRedirect("redirect_uri must be http or https on a loopback host");
+  }
+  return url.toString();
+}
+
+export function localGoogleCallbackUri(listenOrigin: string): string {
+  return `${listenOrigin.replace(/\/$/, "")}/api/user/auth/google/callback`;
+}
+
+export function projectGoogleOverrideMode(
+  clientId?: string,
+  clientSecret?: string,
+): "both" | "one" | "none" {
+  const id = clientId?.trim() ?? "";
+  const secret = clientSecret?.trim() ?? "";
+  if (id && secret) return "both";
+  if (id || secret) return "one";
+  return "none";
+}
+
+export function brokerDevStartUrl(
+  brokerBaseUrl: string,
+  input: { callbackUri: string; redirectUri: string },
+): string {
+  const url = new URL(`${brokerBaseUrl.replace(/\/$/, "")}/internal/auth/google/dev`);
+  url.searchParams.set("callback_uri", input.callbackUri);
+  url.searchParams.set("redirect_uri", input.redirectUri);
+  return url.toString();
+}
+
+export function redirectWithQuery(redirectUri: string, params: Record<string, string>): string {
+  const url = new URL(redirectUri);
+  for (const [key, value] of Object.entries(params)) {
+    url.searchParams.set(key, value);
+  }
+  return url.toString();
+}
+
+/** Google authorize URL with a caller-supplied redirect (local override). */
+export function localGoogleAuthorizeUrl(
+  state: string,
+  creds: { clientId: string; redirectUri: string },
+): string {
+  const url = new URL("https://accounts.google.com/o/oauth2/v2/auth");
+  url.searchParams.set("client_id", creds.clientId);
+  url.searchParams.set("redirect_uri", creds.redirectUri);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("scope", "openid email profile");
+  url.searchParams.set("state", state);
+  url.searchParams.set("prompt", "select_account");
+  return url.toString();
+}
+
+export async function exchangeLocalGoogleCode(
+  code: string,
+  creds: { clientId: string; clientSecret: string; redirectUri: string },
+): Promise<{ email: string; name: string | null; subject: string }> {
+  const body = new URLSearchParams({
+    code,
+    client_id: creds.clientId,
+    client_secret: creds.clientSecret,
+    redirect_uri: creds.redirectUri,
+    grant_type: "authorization_code",
+  });
+  const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body,
+  });
+  if (!tokenRes.ok) {
+    throw new Error("google token exchange failed");
+  }
+  const tokens = (await tokenRes.json()) as { access_token?: string };
+  if (!tokens.access_token) {
+    throw new Error("google token exchange failed");
+  }
+  const profileRes = await fetch("https://www.googleapis.com/oauth2/v2/userinfo", {
+    headers: { Authorization: `Bearer ${tokens.access_token}` },
+  });
+  if (!profileRes.ok) {
+    throw new Error("google profile failed");
+  }
+  const profile = (await profileRes.json()) as {
+    id?: string;
+    email?: string;
+    name?: string;
+  };
+  if (!profile.email || !profile.id) {
+    throw new Error("google profile missing email");
+  }
+  return {
+    email: profile.email,
+    name: profile.name?.trim() || null,
+    subject: profile.id,
+  };
+}
+
+export async function signLocalGoogleState(
+  jwtSecret: string,
+  redirectUri: string,
+): Promise<string> {
+  return new SignJWT({ typ: LOCAL_STATE_TYP, redirectUri })
+    .setProtectedHeader({ alg: "HS256" })
+    .setIssuedAt()
+    .setExpirationTime("10m")
+    .sign(new TextEncoder().encode(jwtSecret));
+}
+
+export async function verifyLocalGoogleState(
+  jwtSecret: string,
+  token: string,
+): Promise<{ redirectUri: string }> {
+  const { payload } = await jwtVerify(token, new TextEncoder().encode(jwtSecret));
+  if (payload.typ !== LOCAL_STATE_TYP || typeof payload.redirectUri !== "string") {
+    throw new Error("invalid local google oauth state");
+  }
+  return { redirectUri: payload.redirectUri };
+}
+
+function pruneUsedJti(now: number): void {
+  for (const [jti, expires] of usedJti) {
+    if (expires <= now) usedJti.delete(jti);
+  }
+}
+
+export function resetLocalDevAssertionReplayForTests(): void {
+  usedJti.clear();
+}
+
+export async function verifyLocalDevIdentityAssertion(
+  assertion: string,
+  options: {
+    brokerBaseUrl: string;
+    callbackUri: string;
+    jwks?: JWTVerifyGetKey;
+  },
+): Promise<{
+  email: string;
+  name: string | null;
+  googleSubject: string;
+  redirectUri: string;
+}> {
+  const issuer = options.brokerBaseUrl.replace(/\/$/, "");
+  const jwks = options.jwks ?? createRemoteJWKSet(new URL(`${issuer}/internal/auth/jwks.json`));
+  const { payload } = await jwtVerify(assertion, jwks, {
+    issuer,
+    audience: LOCAL_DEV_IDENTITY_AUD,
+  });
+  if (payload.typ !== LOCAL_DEV_IDENTITY_TYP) {
+    throw invalidAssertion();
+  }
+  if (payload.callback_uri !== options.callbackUri) {
+    throw invalidAssertion();
+  }
+  if (typeof payload.email !== "string" || typeof payload.google_subject !== "string") {
+    throw invalidAssertion();
+  }
+  if (typeof payload.redirect_uri !== "string") {
+    throw invalidAssertion();
+  }
+  const redirectUri = assertLocalAppRedirectUri(payload.redirect_uri);
+  const jti = payload.jti;
+  if (typeof jti !== "string" || !jti) {
+    throw invalidAssertion();
+  }
+  const now = Date.now();
+  pruneUsedJti(now);
+  if (usedJti.has(jti)) {
+    throw invalidAssertion();
+  }
+  usedJti.set(jti, now + JTI_TTL_MS);
+  return {
+    email: payload.email.toLowerCase(),
+    name: typeof payload.name === "string" ? payload.name : null,
+    googleSubject: payload.google_subject,
+    redirectUri,
+  };
+}

package/src/local-jobs.test.ts

@@ -21,8 +21,8 @@ function jobDef(
   return { _kind: JOB_KIND, handler, ...extras };
 }
 
-function unavailable(feature: string): never {
-  throw new Error(`ctx.${feature} needs hosted Starbase. Run robodev deploy to use it.`);
+function notConfigured(code: string): never {
+  throw Object.assign(new Error(code), { statusCode: 400, code });
 }
 
 function mockClients(): RouteClients {
@@ -32,26 +32,45 @@ function mockClients(): RouteClients {
         return { id: "local_mail", status: "sent" };
       },
     },
-    llm: { complete: () => unavailable("llm"), stream: () => unavailable("llm") },
+    llm: {
+      complete: () => notConfigured("llm_not_configured"),
+      stream: () => notConfigured("llm_not_configured"),
+    },
     agent: {
-      createSession: () => unavailable("agent"),
-      start: () => unavailable("agent"),
-      events: () => unavailable("agent"),
-      subscribe: () => unavailable("agent"),
-      destroy: () => unavailable("agent"),
+      createSession: () => notConfigured("llm_not_configured"),
+      start: () => notConfigured("llm_not_configured"),
+      events: () => notConfigured("llm_not_configured"),
+      subscribe: () => notConfigured("llm_not_configured"),
+      destroy: () => notConfigured("llm_not_configured"),
     },
     storage: {
-      upload: () => unavailable("storage"),
-      get: () => unavailable("storage"),
-      getUrl: () => unavailable("storage"),
-      delete: () => unavailable("storage"),
-      list: () => unavailable("storage"),
+      async upload() {
+        return {
+          key: "x",
+          public: false,
+          size: 0,
+          contentType: "application/octet-stream",
+          url: "",
+        };
+      },
+      async get() {
+        return { body: Buffer.alloc(0), contentType: "application/octet-stream", public: false };
+      },
+      async getUrl() {
+        return "";
+      },
+      async delete() {
+        return undefined;
+      },
+      async list() {
+        return { objects: [], total: 0 };
+      },
     },
-    push: { send: () => unavailable("push") },
+    push: { send: () => notConfigured("push_not_configured") },
     jobs: { enqueue: async () => ({ id: "nested" }) },
     sockets: {
-      send: () => unavailable("sockets"),
-      broadcast: () => unavailable("sockets"),
+      send: () => undefined,
+      broadcast: () => undefined,
     },
     env: {},
   };
@@ -418,7 +437,7 @@ test("hosted-only clients still throw in job handlers; email is real", async ()
   await engine.tickJobs();
   await waitUntil(() => store.jobs[0]?.status === "succeeded");
   assert.equal(seen[0], "email");
-  assert.match(seen[1] ?? "", /ctx\.llm needs hosted Starbase/);
+  assert.equal(seen[1], "llm_not_configured");
 });
 
 test("start resets running rows; stop clears timers", async () => {

package/src/local-storage.test.ts

@@ -0,0 +1,217 @@
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import {
+  createLocalStorageClient,
+  ensureStorageSchema,
+  resolveLocalObject,
+  type LocalObjectRow,
+  type StorageQueryable,
+} from "./local-storage.js";
+import { MAX_OBJECT_BYTES, verifyStorageServeToken } from "./storage-rules.js";
+
+const SECRET = "robodev-dev-local-secret";
+const PROJECT_ID = "prj-local";
+const BASE = "http://localhost:4000";
+
+function memoryStorage() {
+  const objects: LocalObjectRow[] = [];
+
+  const query: StorageQueryable["query"] = async (text, values = []) => {
+    const sql = text.replace(/\s+/g, " ").trim();
+    if (/^(CREATE SCHEMA|CREATE TABLE)/.test(sql)) return { rows: [] };
+
+    if (sql.includes("INSERT INTO robodev_storage.objects")) {
+      const key = String(values[0]);
+      const existing = objects.find((row) => row.key === key);
+      const created = existing?.created_at ?? new Date();
+      const row: LocalObjectRow = {
+        key,
+        public: Boolean(values[1]),
+        size_bytes: Number(values[2]),
+        content_type: String(values[3]),
+        created_at: created,
+      };
+      if (existing) {
+        existing.public = row.public;
+        existing.size_bytes = row.size_bytes;
+        existing.content_type = row.content_type;
+        return { rows: [existing] };
+      }
+      objects.push(row);
+      return { rows: [row] };
+    }
+
+    if (sql.includes("FROM robodev_storage.objects WHERE key =")) {
+      const row = objects.find((entry) => entry.key === values[0]);
+      return { rows: row ? [row] : [] };
+    }
+
+    if (sql.includes("DELETE FROM robodev_storage.objects")) {
+      const index = objects.findIndex((entry) => entry.key === values[0]);
+      if (index >= 0) objects.splice(index, 1);
+      return { rows: [] };
+    }
+
+    if (sql.includes("SELECT count(*)")) {
+      const like = String(values[0]).replace(/%$/, "");
+      const prefix = like.replace(/\\([\\%_])/g, "$1");
+      const matched = objects.filter((row) => row.key.startsWith(prefix));
+      return { rows: [{ count: String(matched.length) }] };
+    }
+
+    if (sql.includes("FROM robodev_storage.objects") && sql.includes("ORDER BY created_at")) {
+      const like = String(values[0]).replace(/%$/, "");
+      const prefix = like.replace(/\\([\\%_])/g, "$1");
+      const limit = Number(values[1]);
+      const offset = Number(values[2]);
+      const matched = objects
+        .filter((row) => row.key.startsWith(prefix))
+        .sort((a, b) => b.created_at.getTime() - a.created_at.getTime())
+        .slice(offset, offset + limit);
+      return { rows: matched };
+    }
+
+    throw new Error(`unhandled sql: ${sql}`);
+  };
+
+  return { objects, query };
+}
+
+async function withClient(
+  run: (
+    client: ReturnType<typeof createLocalStorageClient>,
+    objectsDir: string,
+    query: StorageQueryable["query"],
+  ) => Promise<void>,
+) {
+  const objectsDir = await mkdtemp(join(tmpdir(), "robodev-storage-"));
+  const store = memoryStorage();
+  const client = createLocalStorageClient({
+    query: store.query,
+    objectsDir,
+    publicBaseUrl: BASE,
+    projectId: PROJECT_ID,
+    jwtSecret: SECRET,
+  });
+  try {
+    await ensureStorageSchema({ query: store.query });
+    await run(client, objectsDir, store.query);
+  } finally {
+    await rm(objectsDir, { recursive: true, force: true });
+  }
+}
+
+test("upload get getUrl delete and list", async () => {
+  await withClient(async (client) => {
+    const uploaded = await client.upload("notes/hello.txt", "hello", {
+      public: true,
+      contentType: "text/plain",
+    });
+    assert.equal(uploaded.key, "notes/hello.txt");
+    assert.equal(uploaded.public, true);
+    assert.equal(uploaded.size, 5);
+    assert.equal(uploaded.contentType, "text/plain");
+    assert.equal(uploaded.url, `${BASE}/storage/objects/notes/hello.txt`);
+
+    const got = await client.get("notes/hello.txt");
+    assert.equal(got.body.toString("utf8"), "hello");
+    assert.equal(got.contentType, "text/plain");
+    assert.equal(got.public, true);
+
+    const listed = await client.list({ prefix: "notes/" });
+    assert.equal(listed.total, 1);
+    assert.equal(listed.objects[0]?.key, "notes/hello.txt");
+
+    await client.delete("notes/hello.txt");
+    await assert.rejects(
+      () => client.get("notes/hello.txt"),
+      (err: Error) => err.message === "Storage object not found: notes/hello.txt",
+    );
+  });
+});
+
+test("public URL has no query; private URL has exp and sig", async () => {
+  await withClient(async (client) => {
+    await client.upload("pub.bin", "a", { public: true });
+    await client.upload("priv.bin", "b", { public: false });
+    const publicUrl = await client.getUrl("pub.bin");
+    const privateUrl = await client.getUrl("priv.bin");
+    assert.equal(publicUrl, `${BASE}/storage/objects/pub.bin`);
+    assert.equal(publicUrl.includes("?"), false);
+    const parsed = new URL(privateUrl);
+    assert.equal(parsed.origin + parsed.pathname, `${BASE}/storage/objects/priv.bin`);
+    assert.ok(parsed.searchParams.get("exp"));
+    assert.ok(parsed.searchParams.get("sig"));
+    assert.equal(
+      verifyStorageServeToken(SECRET, PROJECT_ID, "priv.bin", {
+        exp: parsed.searchParams.get("exp"),
+        sig: parsed.searchParams.get("sig"),
+      }),
+      true,
+    );
+  });
+});
+
+test("overwrite updates metadata and keeps created_at", async () => {
+  await withClient(async (client, objectsDir, query) => {
+    await client.upload("same.txt", "one", { public: false, contentType: "text/plain" });
+    const first = await resolveLocalObject({ query, objectsDir, key: "same.txt" });
+    assert.ok(first);
+    await new Promise((resolve) => setTimeout(resolve, 5));
+    const second = await client.upload("same.txt", "two-two", {
+      public: true,
+      contentType: "text/html",
+    });
+    assert.equal(second.public, true);
+    assert.equal(second.size, 7);
+    assert.equal(second.contentType, "text/html");
+    const after = await resolveLocalObject({ query, objectsDir, key: "same.txt" });
+    assert.ok(after);
+    assert.equal(after.row.created_at.getTime(), first.row.created_at.getTime());
+    assert.equal(after.body.toString("utf8"), "two-two");
+  });
+});
+
+test("missing key throws Storage object not found", async () => {
+  await withClient(async (client) => {
+    await assert.rejects(
+      () => client.get("missing.txt"),
+      (err: Error & { code?: string; statusCode?: number }) =>
+        err.message === "Storage object not found: missing.txt" &&
+        err.code === "not_found" &&
+        err.statusCode === 404,
+    );
+    await assert.rejects(
+      () => client.delete("missing.txt"),
+      (err: Error) => err.message === "Storage object not found: missing.txt",
+    );
+    await assert.rejects(
+      () => client.getUrl("missing.txt"),
+      (err: Error) => err.message === "Storage object not found: missing.txt",
+    );
+  });
+});
+
+test("object over 25MB is rejected", async () => {
+  await withClient(async (client) => {
+    await assert.rejects(
+      () => client.upload("big.bin", Buffer.alloc(MAX_OBJECT_BYTES + 1)),
+      (err: { code?: string; statusCode?: number }) =>
+        err.code === "object_too_large" && err.statusCode === 400,
+    );
+  });
+});
+
+test("list defaults to 50", async () => {
+  await withClient(async (client) => {
+    for (let i = 0; i < 52; i++) {
+      await client.upload(`n${String(i).padStart(2, "0")}.txt`, "x");
+    }
+    const listed = await client.list();
+    assert.equal(listed.objects.length, 50);
+    assert.equal(listed.total, 52);
+  });
+});