@robosystems/core 0.8.5 → 0.8.7

package/auth-core/sso.js

@@ -9,6 +9,28 @@ const debugLog = (message, error) => {
         console.debug(`[SSO] ${message}`, error);
     }
 };
+/**
+ * Reduce a `returnUrl` to a same-origin path, or reject it.
+ *
+ * The value reaches us from a query parameter (or the sessionStorage mirror of
+ * one), so it is attacker-controlled on any crafted SSO link: an absolute URL
+ * would bounce the freshly authenticated user to another site, and a
+ * `javascript:` payload would execute as this origin. Cross-app returns don't
+ * need the escape hatch — `getSSORedirectUrl` hands the path to the *target*
+ * app, which resolves it against its own origin — so a bare absolute path is
+ * the only shape we ever legitimately produce.
+ */
+const sanitizeReturnUrl = (returnUrl) => {
+    if (!returnUrl)
+        return null;
+    // `//host` and `/\host` are both protocol-relative once a browser
+    // normalises them, so a leading slash alone isn't enough.
+    if (!returnUrl.startsWith('/'))
+        return null;
+    if (returnUrl.startsWith('//') || returnUrl.startsWith('/\\'))
+        return null;
+    return returnUrl;
+};
 export class SSOManager {
     constructor(apiUrl) {
         this.authClient = new RoboSystemsAuthClient(apiUrl);
@@ -84,7 +106,7 @@ export class SSOManager {
             debugLog('sessionStorage read failed during SSO login', error);
         }
         const finalSessionId = sessionId; // Only use URL parameter for session ID
-        const finalReturnUrl = returnUrl || sessionStorageReturn;
+        const finalReturnUrl = sanitizeReturnUrl(returnUrl || sessionStorageReturn);
         if (!finalSessionId) {
             return null;
         }

package/components/console/graphAwareConfig.d.ts

@@ -3,7 +3,7 @@ import type { ConsoleConfig, SampleQuery } from './types';
 /**
  * Graph-aware console configuration.
  *
- * The console's natural-language agent (the "cypher operator") and its example
+ * The console's natural-language agent (the Analyst Operator) and its example
  * queries only make sense against the schema of the *selected* graph. A shared
  * SEC repository, a RoboLedger accounting graph, a RoboInvestor portfolio
  * graph, and a generic custom graph each expose completely different nodes —
@@ -19,7 +19,7 @@ export interface GraphExampleSet {
      *  builder swaps for the graph's display name when available. */
     description: string;
     /** Natural-language prompts shown in the USAGE section. Must be answerable by
-     *  the cypher operator against THIS graph's schema. */
+     *  the Analyst Operator against THIS graph's schema. */
     naturalLanguageExamples: string[];
     /** `/query <cypher>` one-liners shown in the USAGE section. */
     directQueryExamples: string[];

package/index.d.ts

@@ -14,7 +14,7 @@ export { buildGraphAwareConsoleConfig, ConsoleContent, EXAMPLE_SETS, getGraphExa
 export type { ConsoleBranding, ConsoleCommandContext, ConsoleConfig, ConsoleExtraCommand, ConsoleHeaderConfig, ConsoleMcpConfig, ConsoleWelcomeConfig, GraphExampleKind, GraphExampleSet, SampleQuery, } from './components/console';
 export { ActiveSubscriptions, BrowseRepositories, EntitySelector, EntitySelectorCore, GraphSelectorCore, PageLayout, RepositoryGuard, SearchBar, SearchContent, SearchHitCard, SearchPagination, SearchResultsMeta, useIsRepository, type ActiveSubscriptionsProps, type BrowseRepositoriesProps, type EntityGroup, type EntityLike, type EntityRecord, type EntitySelectorProps, type GraphSelectorProps, type GraphWithEntities, type SearchBarProps, type SearchConfig, type SearchFilterConfig, type SearchHitCardProps, type SearchPaginationProps, type SearchResultsMetaProps, type SelectableEntity, } from './components';
 export { composeFilters, excludeRepositories, excludeSubgraphs, GraphFilters, hasSchemaExtension, onlyRepositories, onlyUserGraphs, } from './components/graph-filters';
-export { ApiKeyDisplay, ApiKeysCard, ApiKeyTable, BrandSpinner, categorizeError, CategoryInput, ChatHeader, ChatInputArea, ChatMessage, ConfirmModal, CoreNavbar, CoreSidebar, CreateApiKeyModal, DeepResearchToggle, EmptyState, ErrorType, GeneralInformationCard, generateMessageId, getErrorMessage, LandingFooter, LoadingState, MarkdownProse, PageContainer, PageHeader, PasswordInformationCard, PasswordRequirements, SecureApiKeyField, SettingsCard, SettingsContainer, SettingsFormField, SettingsPageHeader, Spinner, StatCard, StatusAlert, SupportModal, TagInput, ThemeToggle, } from './ui-components';
+export { ApiKeyDisplay, BrandSpinner, categorizeError, CategoryInput, ChatHeader, ChatInputArea, ChatMessage, ConfirmModal, CoreNavbar, CoreSidebar, CreateApiKeyModal, DeepResearchToggle, EmptyState, ErrorType, GeneralInformationCard, generateMessageId, getErrorMessage, LandingFooter, LoadingState, MarkdownProse, PageContainer, PageHeader, PasswordInformationCard, PasswordRequirements, SecureApiKeyField, SettingsCard, SettingsContainer, SettingsFormField, SettingsPageHeader, Spinner, StatCard, StatusAlert, SupportModal, TagInput, ThemeToggle, } from './ui-components';
 export type { CategoryInputProps, MarkdownProseProps, TagInputProps, } from './ui-components';
 export type { AgentType, FooterLink, LandingFooterProps, Message, PageHeaderProps, SidebarItemData, SupportMetadata, } from './ui-components';
 export * from './library';

package/index.js

@@ -35,7 +35,7 @@ export { ActiveSubscriptions, BrowseRepositories, EntitySelector, EntitySelector
 // Export graph filters
 export { composeFilters, excludeRepositories, excludeSubgraphs, GraphFilters, hasSchemaExtension, onlyRepositories, onlyUserGraphs, } from './components/graph-filters';
 // Export app-components
-export { ApiKeyDisplay, ApiKeysCard, ApiKeyTable, BrandSpinner, categorizeError, CategoryInput, ChatHeader, ChatInputArea, 
+export { ApiKeyDisplay, BrandSpinner, categorizeError, CategoryInput, ChatHeader, ChatInputArea, 
 // Chat components
 ChatMessage, ConfirmModal, CoreNavbar, CoreSidebar, CreateApiKeyModal, DeepResearchToggle, EmptyState, ErrorType, GeneralInformationCard, generateMessageId, getErrorMessage, LandingFooter, LoadingState, MarkdownProse, PageContainer, PageHeader, PasswordInformationCard, PasswordRequirements, SecureApiKeyField, SettingsCard, SettingsContainer, SettingsFormField, SettingsPageHeader, Spinner, StatCard, StatusAlert, SupportModal, TagInput, ThemeToggle, } from './ui-components';
 // Export library components, types, and helpers

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robosystems/core",
-  "version": "0.8.5",
+  "version": "0.8.7",
   "description": "Shared RoboSystems frontend core library (auth, contexts, task monitoring, UI components) for the RoboSystems Next.js apps",
   "license": "MIT",
   "private": false,

package/ui-components/api-keys/index.d.ts

@@ -1,5 +1,3 @@
 export { ApiKeyDisplay } from './ApiKeyDisplay';
-export { ApiKeysCard } from './ApiKeysCard';
-export { ApiKeyTable } from './ApiKeyTable';
 export { CreateApiKeyModal } from './CreateApiKeyModal';
 export { SecureApiKeyField } from './SecureApiKeyField';

package/ui-components/api-keys/index.js

@@ -1,5 +1,3 @@
 export { ApiKeyDisplay } from './ApiKeyDisplay';
-export { ApiKeysCard } from './ApiKeysCard';
-export { ApiKeyTable } from './ApiKeyTable';
 export { CreateApiKeyModal } from './CreateApiKeyModal';
 export { SecureApiKeyField } from './SecureApiKeyField';

package/ui-components/api-keys/ApiKeyTable.d.ts

@@ -1,9 +0,0 @@
-import React from 'react';
-import type { ApiKey } from '../types';
-export interface ApiKeyTableProps {
-    apiKeys: ApiKey[];
-    onRevokeKey: (keyId: string) => void;
-    theme?: any;
-    formatDate?: (date: Date | string | null | undefined) => string;
-}
-export declare const ApiKeyTable: React.FC<ApiKeyTableProps>;

package/ui-components/api-keys/ApiKeyTable.js

@@ -1,17 +0,0 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { Button, Dropdown, DropdownItem, Table, TableBody, TableCell, TableHead, TableHeadCell, TableRow, } from 'flowbite-react';
-import { HiCheckCircle, HiDotsVertical, HiExclamationCircle, HiKey, HiTrash, } from 'react-icons/hi';
-const defaultFormatDate = (date) => {
-    if (!date)
-        return 'Never';
-    return new Date(date).toLocaleDateString('en-US', {
-        year: 'numeric',
-        month: 'short',
-        day: 'numeric',
-    });
-};
-export const ApiKeyTable = ({ apiKeys = [], onRevokeKey, theme, formatDate = defaultFormatDate, }) => {
-    // Defensive check to ensure apiKeys is always an array
-    const safeApiKeys = Array.isArray(apiKeys) ? apiKeys : [];
-    return (_jsx("div", { className: "overflow-x-auto", children: _jsxs(Table, { className: "table-fixed", children: [_jsxs(TableHead, { children: [_jsx(TableHeadCell, { className: "w-[40%]", children: "Name" }), _jsx(TableHeadCell, { className: "w-[15%] whitespace-nowrap", children: "Created" }), _jsx(TableHeadCell, { className: "w-[15%] whitespace-nowrap", children: "Last Used" }), _jsx(TableHeadCell, { className: "w-[15%] whitespace-nowrap", children: "Status" }), _jsx(TableHeadCell, { className: "w-[15%] text-right", children: "Actions" })] }), _jsx(TableBody, { className: "divide-y", children: safeApiKeys.map((key) => (_jsxs(TableRow, { className: "dark:border-zinc-700", children: [_jsx(TableCell, { className: "font-medium text-zinc-900 dark:text-zinc-100", children: _jsxs("div", { className: "flex min-w-0 items-center gap-2", children: [_jsx(HiKey, { className: "h-5 w-5 shrink-0 text-zinc-600 dark:text-zinc-400" }), _jsx("span", { className: "truncate", title: key.name, children: key.name }), key.isSystem && (_jsx("span", { className: "bg-primary-100 text-primary-800 dark:bg-primary-900 dark:text-primary-300 shrink-0 rounded-full px-2.5 py-0.5 text-xs font-medium", children: "System" })), key.graphId && (_jsx("span", { className: "max-w-40 shrink-0 truncate rounded-full bg-blue-100 px-2.5 py-0.5 text-xs font-medium text-blue-800 dark:bg-blue-900 dark:text-blue-300", title: `Scoped to graph ${key.graphId} — valid only for that graph and its subgraphs`, children: key.graphId }))] }) }), _jsx(TableCell, { className: "whitespace-nowrap text-zinc-600 dark:text-zinc-400", children: formatDate(key.createdAt) }), _jsx(TableCell, { className: "whitespace-nowrap text-zinc-600 dark:text-zinc-400", children: formatDate(key.lastUsedAt) }), _jsx(TableCell, { className: "whitespace-nowrap", children: key.isActive ? (_jsxs("div", { className: "inline-flex items-center rounded-full bg-green-100 px-2 py-0.5 text-xs font-medium text-green-800 dark:bg-green-800 dark:text-green-100", children: [_jsx(HiCheckCircle, { className: "mr-1 h-3 w-3" }), "Active"] })) : (_jsxs("div", { className: "inline-flex items-center rounded-full bg-red-100 px-2 py-0.5 text-xs font-medium text-red-800 dark:bg-red-800 dark:text-red-100", children: [_jsx(HiExclamationCircle, { className: "mr-1 h-3 w-3" }), "Revoked"] })) }), _jsx(TableCell, { className: "text-right", children: _jsx("div", { className: "inline-flex justify-end", children: _jsx(Dropdown, { theme: theme === null || theme === void 0 ? void 0 : theme.dropdown, label: "", dismissOnClick: true, renderTrigger: () => (_jsx(Button, { theme: theme === null || theme === void 0 ? void 0 : theme.button, size: "sm", pill: true, className: "bg-zinc-100 text-zinc-900 hover:bg-zinc-200 dark:bg-zinc-700 dark:text-zinc-100 dark:hover:bg-zinc-600", children: _jsx(HiDotsVertical, { className: "h-4 w-4" }) })), children: _jsx(DropdownItem, { onClick: () => onRevokeKey(key.id), disabled: !key.isActive || key.isSystem, icon: HiTrash, className: "hover:bg-zinc-100 dark:hover:bg-zinc-700", children: "Revoke" }) }) }) })] }, key.id))) })] }) }));
-};

package/ui-components/api-keys/ApiKeysCard.d.ts

@@ -1,11 +0,0 @@
-import React from 'react';
-export interface ApiKeysCardProps {
-    theme?: any;
-    className?: string;
-    /**
-     * When set, the card links MCP users to the app's Connect page (the
-     * ready-made connector-URL flow) — e.g. "/connect" in robosystems-app.
-     */
-    connectHref?: string;
-}
-export declare const ApiKeysCard: React.FC<ApiKeysCardProps>;

package/ui-components/api-keys/ApiKeysCard.js

@@ -1,112 +0,0 @@
-'use client';
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import * as SDK from '@robosystems/client';
-import { Button } from 'flowbite-react';
-import { useContext, useEffect, useState } from 'react';
-import { HiKey, HiPlusCircle } from 'react-icons/hi';
-import { GraphContext } from '../../contexts';
-import { Spinner } from '../Spinner';
-import { SettingsCard } from '../forms/SettingsCard';
-import { StatusAlert } from '../forms/StatusAlert';
-import { ApiKeyTable } from './ApiKeyTable';
-import { CreateApiKeyModal } from './CreateApiKeyModal';
-export const ApiKeysCard = ({ theme, className = '', connectHref, }) => {
-    var _a;
-    // Read the graph context leniently: outside a GraphProvider the scope
-    // selector simply doesn't render, preserving the card's old standalone
-    // contract instead of throwing.
-    const graphContext = useContext(GraphContext);
-    const availableGraphs = (_a = graphContext === null || graphContext === void 0 ? void 0 : graphContext.state.graphs) !== null && _a !== void 0 ? _a : [];
-    const [apiKeys, setApiKeys] = useState([]);
-    const [isLoading, setIsLoading] = useState(false);
-    const [isOpenCreateModal, setIsOpenCreateModal] = useState(false);
-    const [error, setError] = useState(null);
-    useEffect(() => {
-        fetchApiKeys();
-    }, []);
-    const fetchApiKeys = async () => {
-        var _a;
-        setIsLoading(true);
-        setError(null);
-        try {
-            // Always use SDK
-            const response = await SDK.listUserApiKeys();
-            const sdkKeys = ((_a = response.data) === null || _a === void 0 ? void 0 : _a.api_keys) || [];
-            // Map SDK response to component format
-            const keys = sdkKeys.map((key) => {
-                var _a, _b;
-                return ({
-                    id: key.id,
-                    name: key.name,
-                    graphId: key.graph_id,
-                    createdAt: key.created_at,
-                    lastUsedAt: key.last_used_at,
-                    expiresAt: key.expires_at,
-                    isActive: (_a = key.is_active) !== null && _a !== void 0 ? _a : true,
-                    isSystem: (_b = key.is_system) !== null && _b !== void 0 ? _b : false,
-                });
-            });
-            setApiKeys(keys);
-        }
-        catch (_b) {
-            setError('Failed to load API keys. Please try again.');
-        }
-        finally {
-            setIsLoading(false);
-        }
-    };
-    const handleCreateKey = async (data) => {
-        var _a, _b;
-        // Always use SDK to create key
-        const response = await SDK.createUserApiKey({
-            body: {
-                name: data.name,
-                description: `API key for ${data.name}`,
-                graph_id: data.graphId,
-            },
-        });
-        await fetchApiKeys(); // Refresh the list
-        // Map SDK response to component format
-        const responseData = response.data;
-        const apiKeyInfo = responseData === null || responseData === void 0 ? void 0 : responseData.api_key;
-        return {
-            id: (apiKeyInfo === null || apiKeyInfo === void 0 ? void 0 : apiKeyInfo.id) || '',
-            name: (apiKeyInfo === null || apiKeyInfo === void 0 ? void 0 : apiKeyInfo.name) || data.name,
-            graphId: (_a = apiKeyInfo === null || apiKeyInfo === void 0 ? void 0 : apiKeyInfo.graph_id) !== null && _a !== void 0 ? _a : data.graphId,
-            key: (responseData === null || responseData === void 0 ? void 0 : responseData.key) || '', // The actual API key value
-            createdAt: (apiKeyInfo === null || apiKeyInfo === void 0 ? void 0 : apiKeyInfo.created_at) || new Date().toISOString(),
-            lastUsedAt: (apiKeyInfo === null || apiKeyInfo === void 0 ? void 0 : apiKeyInfo.last_used_at) || null,
-            expiresAt: null,
-            isActive: (_b = apiKeyInfo === null || apiKeyInfo === void 0 ? void 0 : apiKeyInfo.is_active) !== null && _b !== void 0 ? _b : true,
-            isSystem: false,
-        };
-    };
-    const handleRevokeKey = async (keyId) => {
-        try {
-            // Always use SDK to revoke key
-            await SDK.revokeUserApiKey({
-                path: { api_key_id: keyId },
-            });
-            await fetchApiKeys(); // Refresh the list
-        }
-        catch (_a) {
-            setError('Failed to revoke API key. Please try again.');
-        }
-    };
-    const formatDate = (date) => {
-        if (!date)
-            return 'Never';
-        return new Date(date).toLocaleDateString('en-US', {
-            year: 'numeric',
-            month: 'short',
-            day: 'numeric',
-        });
-    };
-    return (_jsxs(SettingsCard, { title: "API Keys", description: "Manage your API keys for programmatic access", icon: HiKey, theme: theme === null || theme === void 0 ? void 0 : theme.card, className: className, children: [_jsx("div", { className: "mb-4 flex items-center justify-end", children: _jsxs(Button, { theme: theme === null || theme === void 0 ? void 0 : theme.button, color: "blue", onClick: () => setIsOpenCreateModal(true), children: [_jsx(HiPlusCircle, { className: "mr-2 h-5 w-5" }), "Create API Key"] }) }), error && (_jsx(StatusAlert, { type: "error", message: error, theme: theme === null || theme === void 0 ? void 0 : theme.alert })), isLoading ? (_jsx("div", { className: "flex justify-center py-4", children: _jsx(Spinner, { size: "lg" }) })) : !Array.isArray(apiKeys) || apiKeys.length === 0 ? (_jsxs("div", { className: "rounded-lg border border-zinc-200 bg-zinc-50 p-8 text-center dark:border-zinc-700 dark:bg-zinc-800", children: [_jsx(HiKey, { className: "mx-auto mb-3 h-12 w-12 text-zinc-400" }), _jsx("h3", { className: "mb-2 text-lg font-semibold text-zinc-900 dark:text-zinc-100", children: "No API keys yet" }), _jsx("p", { className: "text-sm text-zinc-500 dark:text-zinc-400", children: "Create an API key to access your graphs programmatically" })] })) : (_jsx(ApiKeyTable, { apiKeys: apiKeys, onRevokeKey: handleRevokeKey, theme: theme, formatDate: formatDate })), connectHref && (_jsxs("p", { className: "mt-4 text-sm text-zinc-500 dark:text-zinc-400", children: ["Connecting Claude or another MCP client? Generate a ready-made connector URL from the", ' ', _jsx("a", { href: connectHref, className: "text-primary-600 dark:text-primary-400 font-medium hover:underline", children: "Connect page" }), "."] })), _jsx(CreateApiKeyModal, { isOpen: isOpenCreateModal, onClose: () => setIsOpenCreateModal(false), onCreateKey: handleCreateKey, theme: theme, graphs: availableGraphs.map((g) => {
-                    var _a;
-                    return ({
-                        graphId: g.graphId,
-                        graphName: (_a = g.graphName) !== null && _a !== void 0 ? _a : g.graphId,
-                    });
-                }) })] }));
-};