@saluzi/saluzi-edu 0.2.9 → 0.2.11

package/packages/remote-control-server/src/db/sqlite.ts

@@ -0,0 +1,99 @@
+import { Database } from 'bun:sqlite'
+import { readFileSync, existsSync, unlinkSync } from 'node:fs'
+import { resolve, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { tmpdir } from 'node:os'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+
+let _db: Database | null = null
+let _dbPath: string | null = null
+
+/**
+ * Run all schema migrations on the given database.
+ * Idempotent — uses CREATE TABLE IF NOT EXISTS.
+ * Reads schema.sql and executes as a single db.exec() call,
+ * which correctly handles semicolons inside CHECK constraints.
+ */
+export function migrateDatabase(db: Database): void {
+  const schemaPath = resolve(__dirname, 'schema.sql')
+  const schema = readFileSync(schemaPath, 'utf8')
+
+  db.exec('PRAGMA foreign_keys = ON')
+  db.exec(schema)
+}
+
+/**
+ * Resolve the default database path.
+ * - Uses RCS_DB_PATH env var if set
+ * - Uses /app/data/rcs.db if the directory exists (production)
+ * - Falls back to a temp file otherwise (test/development)
+ */
+function resolveDefaultPath(): string {
+  const configured = process.env.RCS_DB_PATH
+  if (configured) return configured
+
+  const defaultDir = '/app/data'
+  if (existsSync(defaultDir)) {
+    return resolve(defaultDir, 'rcs.db')
+  }
+
+  // Use a temp file for test/development environments
+  // (supports WAL mode, unlike :memory:)
+  return resolve(tmpdir(), 'rcs-dev.db')
+}
+
+/**
+ * Initialize a database connection at the given path.
+ * Enables WAL mode and runs migrations.
+ */
+export function initDatabase(path?: string): Database {
+  const dbPath = path || resolveDefaultPath()
+  const db = new Database(dbPath)
+  db.exec('PRAGMA journal_mode = WAL')
+  db.exec('PRAGMA foreign_keys = ON')
+  migrateDatabase(db)
+  _db = db
+  _dbPath = dbPath
+  return db
+}
+
+/**
+ * Get the singleton database connection.
+ * Initializes on first call.
+ */
+export function getDb(): Database {
+  if (!_db) {
+    initDatabase()
+  }
+  return _db!
+}
+
+/**
+ * Reset the singleton — for testing only.
+ * Closes the connection and removes the file if it was
+ * a temp/development file (not :memory:).
+ */
+export function resetDbSingleton(): void {
+  if (_db) {
+    try {
+      _db.close()
+    } catch {
+      // already closed
+    }
+  }
+  // Clean up temp file and WAL/SHM companion files
+  if (_dbPath && _dbPath !== ':memory:') {
+    for (const suffix of ['', '-wal', '-shm']) {
+      try {
+        if (existsSync(_dbPath + suffix)) {
+          unlinkSync(_dbPath + suffix)
+        }
+      } catch {
+        // ignore cleanup errors
+      }
+    }
+  }
+  _db = null
+  _dbPath = null
+}

package/packages/remote-control-server/src/routes/acp/index.ts

@@ -13,6 +13,7 @@ import {
   extractWebSocketAuthToken,
 } from '../../auth/middleware'
 import { validateApiKey } from '../../auth/api-key'
+import { resolveToken } from '../../auth/token'
 import {
   handleAcpWsOpen,
   handleAcpWsMessage,
@@ -60,23 +61,17 @@ function hasAcpReadAuth(c: Context): boolean {
 }
 
 /**
- * Relay auth: accept admin API key (RCS_API_KEYS) OR a web UI UUID token.
+ * Relay auth: accept admin API key (RCS_API_KEYS) or valid session token.
  *
- * The web UI's default token is the user's rcs_uuid (a random UUID stored in
- * localStorage), NOT an admin key — see hooks/useTokens.ts and
- * api/client.ts:getActiveApiToken. /web/* routes accept UUIDs via uuidAuth,
- * but the relay endpoint previously only accepted admin keys, so the default
- * web UI flow was rejected with 4003. Matching uuidAuth's behavior here:
- * admin key bypasses, otherwise any non-empty token is treated as a UUID
- * (UUIDs are identity labels, not secrets — same as uuidAuth).
+ * After Phase 4 cleanup, arbitrary non-empty tokens (UUIDs) are no longer
+ * accepted. Only validated credentials pass.
  */
 export function hasAcpRelayAuth(c: Context): boolean {
   const token = extractWebSocketAuthToken(c)
   if (!token) return false
   if (validateApiKey(token)) return true
-  // Treat any other non-empty token as a web UI UUID (same as uuidAuth,
-  // which also doesn't validate UUID shape).
-  return true
+  // Try session token resolution (in-memory issueToken tokens)
+  return !!resolveToken(token)
 }
 
 function acpReadUnauthorized(c: Context) {

package/packages/remote-control-server/src/routes/v1/environments.ts

@@ -1,23 +1,126 @@
 import { Hono } from 'hono'
+import type { Context, Next } from 'hono'
 import {
   registerEnvironment,
   deregisterEnvironment,
   reconnectEnvironment,
 } from '../../services/environment'
-import { apiKeyAuth, acceptCliHeaders } from '../../auth/middleware'
+import {
+  apiKeyAuth,
+  acceptCliHeaders,
+  extractBearerToken,
+} from '../../auth/middleware'
+import { validateApiKey } from '../../auth/api-key'
+import { resolveToken } from '../../auth/token'
+import { resolveSessionToken } from '../../auth/session'
+import { getDb } from '../../db/sqlite'
 
 const app = new Hono()
 
+/**
+ * Combined auth for bridge endpoint: accepts session tokens (rct_*),
+ * in-memory issueToken tokens, or admin API keys. Also falls back to
+ * apiKeyAuth's X-Username header support for CLI bridges.
+ */
+async function bridgeAuth(c: Context, next: Next) {
+  const bearer = extractBearerToken(c)
+  if (bearer) {
+    // Admin API key
+    if (validateApiKey(bearer)) {
+      c.set('username', c.req.header('X-Username') || c.req.query('username'))
+      await next()
+      return
+    }
+    // In-memory token
+    const username = resolveToken(bearer)
+    if (username) {
+      c.set('username', username)
+      await next()
+      return
+    }
+    // SQLite session token
+    try {
+      const db = getDb()
+      const userId = resolveSessionToken(bearer, db)
+      if (userId) {
+        c.set('userId', userId)
+        await next()
+        return
+      }
+    } catch {
+      // DB not available
+    }
+  }
+  // Fall back to apiKeyAuth (handles X-Username + API key from body/header)
+  return apiKeyAuth(c, next)
+}
+
 /** POST /v1/environments/bridge — Register an environment */
-app.post('/bridge', acceptCliHeaders, apiKeyAuth, async c => {
+app.post('/bridge', acceptCliHeaders, bridgeAuth, async c => {
   const body = await c.req.json()
-  const username = c.get('username')
+  const userId = c.get('userId') as string | undefined
+  const username = (c.get('username') as string | undefined) || userId
+  const teamId = c.req.header('X-Team-Id')
+
+  // Validate team if X-Team-Id is provided
+  if (teamId && userId) {
+    try {
+      const db = getDb()
+
+      // Check team exists
+      const team = db
+        .query('SELECT id FROM teams WHERE id = $id AND deleted_at IS NULL')
+        .get({ $id: teamId }) as { id: string } | null
+      if (!team) {
+        return c.json(
+          { error: { type: 'bad_request', message: 'Team not found' } },
+          400,
+        )
+      }
+
+      // Check membership (admin users are implicit members of all teams)
+      const user = db
+        .query('SELECT role FROM users WHERE id = $id')
+        .get({ $id: userId }) as { role: string } | null
+      const isAdmin = user?.role === 'admin'
+
+      if (!isAdmin) {
+        const membership = db
+          .query(
+            'SELECT 1 FROM team_members WHERE team_id = $teamId AND user_id = $userId',
+          )
+          .get({ $teamId: teamId, $userId: userId })
+        if (!membership) {
+          return c.json(
+            {
+              error: {
+                type: 'forbidden',
+                message: 'User is not a member of this team',
+              },
+            },
+            403,
+          )
+        }
+      }
+    } catch {
+      // DB not available — skip team validation
+    }
+  }
+
   const result = registerEnvironment({ ...body, username })
-  // ACP auto-created session stays orphaned (no owner) so that
-  // storeListSessionsByOwnerUuid's auto-bind can claim it for the first
-  // web UI user who lists sessions. bridge_id is already stored on the
-  // EnvironmentRecord and should NOT be used as a session owner — that
-  // would hide the session from every real user UUID.
+
+  // Link environment to team if X-Team-Id was provided
+  if (teamId) {
+    try {
+      const db = getDb()
+      db.query(
+        'INSERT OR IGNORE INTO team_environments (team_id, environment_id) VALUES ($teamId, $envId)',
+      ).run({ $teamId: teamId, $envId: result.environment_id })
+    } catch {
+      // DB not available
+    }
+  }
+
   return c.json(result, 200)
 })