@saluzi/saluzi-edu 0.2.9 → 0.2.11

package/packages/remote-control-server/src/auth/middleware.ts

@@ -1,10 +1,10 @@
-import { createHash, timingSafeEqual } from 'node:crypto'
 import type { Context, Next } from 'hono'
 import { validateApiKey } from './api-key'
 import { verifyWorkerJwt } from './jwt'
 import { resolveToken } from './token'
-import { getSession, resolveOwnedWebSessionId } from '../services/session'
-import { storeGetEnvironment } from '../store'
+import { resolveSessionToken } from './session'
+import { getDb } from '../db/sqlite'
+import { SYSTEM_USER_ID } from './constants'
 
 const WS_AUTH_PROTOCOL_PREFIX = 'rcs.auth.'
 
@@ -149,177 +149,87 @@ export async function acceptCliHeaders(c: Context, next: Next) {
 }
 
 /**
- * Extract UUID from request — query param ?uuid= or header X-UUID
- */
-export function getUuidFromRequest(c: Context): string | undefined {
-  return c.req.query('uuid') || c.req.header('X-UUID')
-}
-
-/**
- * Environment statuses in which the worker is gone and the per-environment
- * worker token no longer gates access. The token's purpose is to gate Web UI
- * access while a worker is live; once the worker is offline/disconnected/
- * deregistered, the owner UUID (and admin API key) is sufficient — otherwise
- * users can't delete or inspect leftover sessions from a dead worker.
- */
-const ENV_DEAD_STATUSES = new Set(['offline', 'disconnected', 'deregistered'])
-
-/**
- * Verify a plaintext worker token against an environment's stored hash.
- * Returns true if: token is a valid admin API key (full access bypass), OR
- * environment has no workerTokenHash (open access), OR env is offline/
- * disconnected/deregistered (worker gone, token no longer meaningful), OR
- * hash matches. False otherwise (including timing-safe mismatch).
- */
-export function verifyWorkerTokenForEnv(
-  env:
-    | { workerTokenHash: string | null; status?: string | null }
-    | null
-    | undefined,
-  token: string | undefined,
-): boolean {
-  // Admin API key bypasses per-environment token check (full access).
-  if (token && validateApiKey(token)) return true
-  // No environment or no token hash registered = open access.
-  if (!env || !env.workerTokenHash) return true
-  // Worker gone — token no longer gates access; UUID/auth still applies upstream.
-  if (env.status && ENV_DEAD_STATUSES.has(env.status)) return true
-  if (!token) return false
-  const tokenHash = createHash('sha256').update(token).digest('hex')
-  const a = Buffer.from(tokenHash, 'utf8')
-  const b = Buffer.from(env.workerTokenHash, 'utf8')
-  return a.length === b.length && timingSafeEqual(a, b)
-}
-
-/**
- * Per-environment worker token verification.
+ * Session-based authentication (Phase 1+).
  *
- * Web UI users must enter the environment's worker token (RCS_WORKER_TOKENS,
- * set on the worker side) to access session routes. The server stores only
- * the SHA256 hash (registered by the worker); this middleware hashes the
- * user-supplied token and compares. Admin API keys (RCS_API_KEYS) bypass
- * this check — they have full access to all environments.
+ * Priority:
+ * 1. Admin API key bypass (Bearer token matching RCS_API_KEYS) → SYSTEM_USER_ID
+ *    (operations via API key are attributed to the system, not a specific admin)
+ *    If DB is unavailable, returns 503 to avoid silent misattribution.
+ * 2. Cookie access token (rcs_access) — in-memory or SQLite resolution
+ * 3. Bearer session token — in-memory or SQLite resolution
+ * 4. 401 if no valid credentials
  *
- * Token is read from X-Worker-Token header, ?worker_token= query param, or
- * Authorization: Bearer (admin API key bypass only). Routes must have :id
- * (session id) param so the environment can be resolved.
+ * Injects `userId` (string) and `isAdmin` (boolean) into context.
  */
-export async function requireWorkerToken(c: Context, next: Next) {
-  const token = c.req.header('X-Worker-Token') || c.req.query('worker_token')
-  // Admin API key bypasses per-environment token check (full access).
-  if (token && validateApiKey(token)) {
-    await next()
-    return
-  }
-  // Fall back to Authorization: Bearer — the Web UI's API Key tab only sends
-  // Bearer, so without this branch the admin bypass never fires for browser
-  // session routes.
+export async function sessionAuth(c: Context, next: Next) {
   const bearer = extractBearerToken(c)
-  if (bearer && validateApiKey(bearer)) {
-    await next()
-    return
-  }
-  const requestedSessionId = c.req.param('id')
-  if (!requestedSessionId) {
-    return c.json(
-      { error: { type: 'bad_request', message: 'Missing session id' } },
-      400,
-    )
-  }
-  const uuid = c.get('uuid')
-  const resolvedSessionId = uuid
-    ? resolveOwnedWebSessionId(requestedSessionId, uuid)
-    : requestedSessionId
-  if (!resolvedSessionId) {
-    return c.json(
-      { error: { type: 'forbidden', message: 'Not your session' } },
-      403,
-    )
-  }
-  const session = getSession(resolvedSessionId)
-  if (!session) {
-    return c.json(
-      { error: { type: 'not_found', message: 'Session not found' } },
-      404,
-    )
-  }
-  // Session without environment_id = no per-environment token to verify,
-  // open access (test/legacy sessions). Only verify when an environment is
-  // linked AND has a workerTokenHash registered.
-  if (!session.environment_id) {
-    await next()
-    return
-  }
-  const env = storeGetEnvironment(session.environment_id)
-  if (!env) {
-    return c.json(
-      { error: { type: 'not_found', message: 'Environment not found' } },
-      404,
-    )
-  }
-  // No token hash registered = open access (legacy/claude.ai path).
-  if (!env.workerTokenHash) {
-    await next()
-    return
-  }
-  // Worker gone — token no longer gates access. Lets users delete/inspect
-  // leftover sessions from a dead worker (env offline/disconnected/deregistered).
-  if (ENV_DEAD_STATUSES.has(env.status)) {
-    await next()
-    return
-  }
-  if (!token) {
-    return c.json(
-      {
-        error: {
-          type: 'worker_token_required',
-          message:
-            '该 environment 需要 worker token 才能访问，请输入 RCS_WORKER_TOKENS 对应的 token',
-        },
-      },
-      401,
-    )
-  }
-  const tokenHash = createHash('sha256').update(token).digest('hex')
-  const a = Buffer.from(tokenHash, 'utf8')
-  const b = Buffer.from(env.workerTokenHash, 'utf8')
-  if (a.length !== b.length || !timingSafeEqual(a, b)) {
-    return c.json(
-      {
-        error: {
-          type: 'worker_token_mismatch',
-          message: 'Worker token 不匹配',
-        },
-      },
-      403,
-    )
-  }
-  await next()
-}
 
-/**
- * UUID-based auth for Web UI routes (no-login mode).
- * Accepts UUID in query param/header, OR a valid API key via Authorization header.
- */
-export async function uuidAuth(c: Context, next: Next) {
-  // Try API key auth via Authorization header
-  const bearer = extractBearerToken(c)
+  // Admin API key bypass — attribute to __system__ identity.
+  // Verify DB connectivity first: if the DB is unreachable we cannot
+  // reliably serve requests, so return 503 rather than silently
+  // impersonating a system identity without audit trail.
   if (bearer && validateApiKey(bearer)) {
-    // Valid API key — generate a stable UUID from the key for downstream use
-    const uuid = getUuidFromRequest(c)
-    c.set('uuid', uuid || bearer)
+    try {
+      const db = getDb()
+      // Verify the DB is reachable with a simple query
+      db.query('SELECT 1').get()
+    } catch (err) {
+      console.warn('[sessionAuth] DB unavailable for API key auth:', err)
+      return c.json(
+        {
+          error: {
+            type: 'service_unavailable',
+            message: 'Database unavailable — cannot process API key request',
+          },
+        },
+        503,
+      )
+    }
+    c.set('userId', SYSTEM_USER_ID)
+    c.set('isAdmin', true)
     await next()
     return
   }
 
-  // Fall back to UUID auth
-  const uuid = getUuidFromRequest(c)
-  if (!uuid) {
-    return c.json(
-      { error: { type: 'unauthorized', message: 'Missing UUID' } },
-      401,
-    )
+  // Try cookie-based token
+  const cookieHeader = c.req.header('Cookie') || ''
+  const accessMatch = cookieHeader.match(/rcs_access=([^;]+)/)
+  const cookieToken = accessMatch ? accessMatch[1] : undefined
+
+  const tokenToResolve = cookieToken || bearer
+
+  if (tokenToResolve) {
+    // Try in-memory token resolution (existing issueToken flow)
+    const username = resolveToken(tokenToResolve)
+    if (username) {
+      c.set('userId', username)
+      c.set('isAdmin', false)
+      await next()
+      return
+    }
+
+    // Try SQLite-backed session token resolution
+    try {
+      const db = getDb()
+      const userId = resolveSessionToken(tokenToResolve, db)
+      if (userId) {
+        c.set('userId', userId)
+        c.set('isAdmin', false)
+        await next()
+        return
+      }
+    } catch (err) {
+      console.warn('[sessionAuth] DB resolution failed:', err)
+    }
   }
-  c.set('uuid', uuid)
-  await next()
+
+  return c.json(
+    {
+      error: {
+        type: 'unauthorized',
+        message: 'Invalid or missing credentials',
+      },
+    },
+    401,
+  )
 }

package/packages/remote-control-server/src/auth/password.ts

@@ -0,0 +1,116 @@
+import { argon2id } from '@noble/hashes/argon2.js'
+import { randomBytes, timingSafeEqual } from 'node:crypto'
+
+// Argon2id parameters
+const MEMORY_COST = 65536 // 64 MB
+const TIME_COST = 3
+const PARALLELISM = 1
+const SALT_LENGTH = 16
+const HASH_LENGTH = 32
+
+function base64NoPadding(buf: Uint8Array): string {
+  return Buffer.from(buf).toString('base64').replace(/=+$/, '')
+}
+
+function fromBase64NoPadding(s: string): Buffer {
+  // Add padding back if needed
+  const pad = s.length % 4
+  const padded = pad ? s + '='.repeat(4 - pad) : s
+  return Buffer.from(padded, 'base64')
+}
+
+/**
+ * Hash a password using argon2id.
+ * Returns a PHC-formatted string:
+ * $argon2id$v=19$m=65536,t=3,p=1$<salt>$<hash>
+ *
+ * @deprecated Use {@link hashPasswordAsync} instead. This synchronous version
+ * blocks the event loop for 100-300ms due to argon2id computation. Kept for
+ * backward compatibility; will be removed in a future release.
+ */
+export function hashPassword(password: string): string {
+  const salt = randomBytes(SALT_LENGTH)
+  const hash = argon2id(password, salt, {
+    m: MEMORY_COST,
+    t: TIME_COST,
+    p: PARALLELISM,
+  })
+  const saltB64 = base64NoPadding(salt)
+  const hashB64 = base64NoPadding(hash)
+  return `$argon2id$v=19$m=${MEMORY_COST},t=${TIME_COST},p=${PARALLELISM}$${saltB64}$${hashB64}`
+}
+
+/**
+ * Verify a password against an argon2id hash string.
+ * Returns true if the password matches.
+ *
+ * @deprecated Use {@link verifyPasswordAsync} instead. This synchronous version
+ * blocks the event loop for 100-300ms due to argon2id computation. Kept for
+ * backward compatibility; will be removed in a future release.
+ */
+export function verifyPassword(password: string, hash: string): boolean {
+  if (!password || !hash) return false
+
+  try {
+    // Parse PHC format: $argon2id$v=19$m=65536,t=3,p=1$<salt>$<hash>
+    const parts = hash.split('$')
+    // parts[0] = '' (empty before first $)
+    // parts[1] = 'argon2id'
+    // parts[2] = 'v=19'
+    // parts[3] = 'm=65536,t=3,p=1'
+    // parts[4] = salt (base64)
+    // parts[5] = hash (base64)
+    if (parts.length !== 6 || parts[1] !== 'argon2id') return false
+
+    const paramParts = parts[3].split(',')
+    const params: Record<string, number> = {}
+    for (const p of paramParts) {
+      const [key, val] = p.split('=')
+      params[key] = parseInt(val, 10)
+    }
+
+    const salt = fromBase64NoPadding(parts[4])
+    const expectedHash = fromBase64NoPadding(parts[5])
+
+    const candidateHash = argon2id(password, salt, {
+      m: params.m || MEMORY_COST,
+      t: params.t || TIME_COST,
+      p: params.p || PARALLELISM,
+    })
+
+    const a = Buffer.from(candidateHash)
+    const b = Buffer.from(expectedHash)
+    if (a.length !== b.length) return false
+    return timingSafeEqual(a, b)
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Async version of {@link hashPassword}.
+ *
+ * Currently delegates to the synchronous implementation (argon2id is CPU-bound
+ * and login/signup are low-frequency operations, so brief blocking is
+ * acceptable). The async signature allows callers to `await` and makes it
+ * straightforward to swap in a Worker-based implementation later without
+ * touching call sites.
+ */
+export async function hashPasswordAsync(password: string): Promise<string> {
+  // Yield once to avoid blocking the microtask queue before the heavy compute.
+  await Promise.resolve()
+  return hashPassword(password)
+}
+
+/**
+ * Async version of {@link verifyPassword}.
+ *
+ * See {@link hashPasswordAsync} for the design rationale.
+ */
+export async function verifyPasswordAsync(
+  password: string,
+  hash: string,
+): Promise<boolean> {
+  await Promise.resolve()
+  return verifyPassword(password, hash)
+}

package/packages/remote-control-server/src/auth/session.ts

@@ -0,0 +1,130 @@
+import { createHash, randomBytes } from 'node:crypto'
+import type { Database } from 'bun:sqlite'
+
+const ACCESS_TTL_SECONDS = 3600 // 1 hour
+const REFRESH_TTL_SECONDS = 2592000 // 30 days
+
+function generateToken(): string {
+  const bytes = randomBytes(32)
+  return `rct_${bytes.toString('hex')}`
+}
+
+function sha256hex(value: string): string {
+  return createHash('sha256').update(value).digest('hex')
+}
+
+function insertToken(
+  db: Database,
+  token: string,
+  userId: string,
+  kind: 'access' | 'refresh',
+  ttlSeconds: number,
+): void {
+  const tokenHash = sha256hex(token)
+  const now = new Date()
+  const expiresAt = new Date(now.getTime() + ttlSeconds * 1000)
+  db.query(
+    `INSERT INTO session_tokens (token_hash, user_id, kind, expires_at, created_at)
+     VALUES ($tokenHash, $userId, $kind, $expiresAt, $createdAt)`,
+  ).run({
+    $tokenHash: tokenHash,
+    $userId: userId,
+    $kind: kind,
+    $expiresAt: expiresAt.toISOString(),
+    $createdAt: now.toISOString(),
+  })
+}
+
+/**
+ * Issue a new access + refresh token pair for the given user.
+ * Stores sha256(token) in the session_tokens table.
+ */
+export function issueSessionToken(
+  userId: string,
+  db: Database,
+): { accessToken: string; refreshToken: string } {
+  const accessToken = generateToken()
+  const refreshToken = generateToken()
+
+  insertToken(db, accessToken, userId, 'access', ACCESS_TTL_SECONDS)
+  insertToken(db, refreshToken, userId, 'refresh', REFRESH_TTL_SECONDS)
+
+  return { accessToken, refreshToken }
+}
+
+/**
+ * Resolve a session token to a userId.
+ * Returns null if token is invalid, expired, or revoked.
+ *
+ * @param kind - The expected token kind. Defaults to `'access'`.
+ *   Pass `'refresh'` when resolving a refresh token (e.g. in the
+ *   `/refresh` endpoint). This prevents an access token from being
+ *   accepted where a refresh token is expected, and vice versa.
+ */
+export function resolveSessionToken(
+  token: string,
+  db: Database,
+  kind: 'access' | 'refresh' = 'access',
+): string | null {
+  if (!token) return null
+
+  const tokenHash = sha256hex(token)
+  const row = db
+    .query(
+      `SELECT user_id, expires_at, revoked_at FROM session_tokens
+       WHERE token_hash = $tokenHash AND kind = $kind`,
+    )
+    .get({ $tokenHash: tokenHash, $kind: kind }) as {
+    user_id: string
+    expires_at: string
+    revoked_at: string | null
+  } | null
+
+  if (!row) return null
+
+  // Check revoked
+  if (row.revoked_at) return null
+
+  // Check expired
+  const expiresAt = new Date(row.expires_at).getTime()
+  if (expiresAt < Date.now()) return null
+
+  return row.user_id
+}
+
+/**
+ * Revoke a specific session token.
+ */
+export function revokeSessionToken(token: string, db: Database): void {
+  const tokenHash = sha256hex(token)
+  const now = new Date().toISOString()
+  db.query(
+    `UPDATE session_tokens SET revoked_at = $now WHERE token_hash = $tokenHash`,
+  ).run({ $now: now, $tokenHash: tokenHash })
+}
+
+/**
+ * Revoke all tokens for a given user.
+ */
+export function revokeAllUserTokens(userId: string, db: Database): void {
+  const now = new Date().toISOString()
+  db.query(
+    `UPDATE session_tokens SET revoked_at = $now WHERE user_id = $userId`,
+  ).run({ $now: now, $userId: userId })
+}
+
+/**
+ * Delete all expired session tokens from the database.
+ * Returns the number of deleted rows.
+ *
+ * Should be called once at server startup and optionally on a periodic
+ * timer (e.g. every hour) to keep the session_tokens table tidy.
+ */
+export function reapExpiredSessions(db: Database): number {
+  const result = db
+    .query(
+      `DELETE FROM session_tokens WHERE expires_at < strftime('%Y-%m-%dT%H:%M:%S.000Z', 'now')`,
+    )
+    .run()
+  return result.changes
+}

package/packages/remote-control-server/src/db/schema.sql

@@ -0,0 +1,116 @@
+-- RCS Authentication & Session Schema
+-- Phase 1: users, session_tokens, invitations
+-- Phase 2: teams, team_members, team_environments, session_owners, session_shares, sessions
+
+CREATE TABLE IF NOT EXISTS users (
+  id TEXT NOT NULL PRIMARY KEY,
+  username TEXT UNIQUE NOT NULL,
+  password_hash TEXT NOT NULL,
+  role TEXT NOT NULL CHECK (role IN ('admin', 'member', 'guest')),
+  created_at TEXT NOT NULL,
+  last_login_at TEXT
+);
+
+CREATE TABLE IF NOT EXISTS session_tokens (
+  token_hash TEXT NOT NULL PRIMARY KEY,
+  user_id TEXT NOT NULL REFERENCES users(id),
+  kind TEXT NOT NULL CHECK (kind IN ('access', 'refresh')),
+  expires_at TEXT NOT NULL,
+  revoked_at TEXT,
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS invitations (
+  token_hash TEXT NOT NULL PRIMARY KEY,
+  team_id TEXT,
+  role TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  max_uses INTEGER DEFAULT 1,
+  uses INTEGER DEFAULT 0,
+  created_by TEXT NOT NULL REFERENCES users(id),
+  consumed_at TEXT,
+  consumed_by TEXT REFERENCES users(id)
+);
+
+-- Phase 2 tables
+
+CREATE TABLE IF NOT EXISTS teams (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  slug TEXT UNIQUE NOT NULL,
+  description TEXT,
+  created_by TEXT NOT NULL REFERENCES users(id),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  deleted_at TEXT
+);
+
+CREATE TABLE IF NOT EXISTS team_members (
+  team_id TEXT NOT NULL REFERENCES teams(id),
+  user_id TEXT NOT NULL REFERENCES users(id),
+  role TEXT NOT NULL CHECK (role IN ('owner', 'admin', 'member')),
+  added_at TEXT NOT NULL,
+  added_by TEXT NOT NULL REFERENCES users(id),
+  PRIMARY KEY (team_id, user_id)
+);
+
+CREATE TABLE IF NOT EXISTS team_environments (
+  team_id TEXT NOT NULL REFERENCES teams(id),
+  environment_id TEXT NOT NULL,
+  PRIMARY KEY (team_id, environment_id)
+);
+
+CREATE TABLE IF NOT EXISTS session_owners (
+  session_id TEXT NOT NULL,
+  owner_type TEXT NOT NULL CHECK (owner_type IN ('user', 'team')),
+  owner_id TEXT NOT NULL,
+  PRIMARY KEY (session_id, owner_type, owner_id)
+);
+
+CREATE TABLE IF NOT EXISTS session_shares (
+  id TEXT PRIMARY KEY,
+  session_id TEXT NOT NULL,
+  granted_to_user TEXT REFERENCES users(id),
+  granted_to_team TEXT REFERENCES teams(id),
+  permission TEXT NOT NULL CHECK (permission IN ('read', 'write')),
+  expires_at TEXT,
+  granted_by TEXT NOT NULL REFERENCES users(id),
+  granted_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS environments (
+  id TEXT PRIMARY KEY,
+  secret_hash TEXT NOT NULL,
+  team_id TEXT,
+  registered_by TEXT,
+  machine_name TEXT,
+  worker_type TEXT NOT NULL DEFAULT 'claude_code',
+  status TEXT NOT NULL DEFAULT 'active',
+  last_poll_at TEXT,
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS sessions (
+  id TEXT PRIMARY KEY,
+  environment_id TEXT,
+  title TEXT,
+  status TEXT NOT NULL DEFAULT 'idle',
+  source TEXT NOT NULL DEFAULT 'remote-control',
+  visibility TEXT NOT NULL DEFAULT 'private',
+  permission_mode TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+-- Performance indexes
+CREATE INDEX IF NOT EXISTS idx_session_owners_owner ON session_owners(owner_type, owner_id);
+CREATE INDEX IF NOT EXISTS idx_session_owners_session ON session_owners(session_id);
+CREATE INDEX IF NOT EXISTS idx_team_members_user ON team_members(user_id);
+CREATE INDEX IF NOT EXISTS idx_team_members_team ON team_members(team_id);
+CREATE INDEX IF NOT EXISTS idx_session_shares_user ON session_shares(granted_to_user);
+CREATE INDEX IF NOT EXISTS idx_session_shares_team ON session_shares(granted_to_team);
+CREATE INDEX IF NOT EXISTS idx_session_shares_session ON session_shares(session_id);
+CREATE INDEX IF NOT EXISTS idx_sessions_visibility ON sessions(visibility);
+CREATE INDEX IF NOT EXISTS idx_sessions_environment ON sessions(environment_id);
+CREATE INDEX IF NOT EXISTS idx_session_tokens_user ON session_tokens(user_id);
+CREATE INDEX IF NOT EXISTS idx_environments_team ON environments(team_id);