@saluzi/saluzi-edu 0.3.0 → 0.3.2

package/packages/remote-control-server/src/__tests__/single-user.test.ts

@@ -0,0 +1,333 @@
+import { describe, test, expect, beforeEach, mock } from 'bun:test'
+import { createMockConfig } from './helpers/mock-config'
+
+// Mutable config mock — individual describes flip `singleUser` (and the
+// derived `allowRegistration`) to exercise both modes against the same
+// route modules.
+const configState = createMockConfig()
+mock.module('../config', () => ({
+  config: configState,
+  getBaseUrl: () => configState.baseUrl,
+}))
+
+import { Hono } from 'hono'
+import type { Database } from 'bun:sqlite'
+import { randomUUID } from 'node:crypto'
+import { tmpdir } from 'node:os'
+import { resolve } from 'node:path'
+import v1Environments from '../routes/v1/environments'
+import webAuthRoutes from '../routes/web/auth-routes'
+import { storeReset } from '../store'
+import { initDatabase, resetDbSingleton, getDb } from '../db/sqlite'
+import {
+  ensureSingleUserAdmin,
+  getSingleUserAdminUuid,
+  SINGLE_USER_DEFAULT_PASSWORD,
+  SINGLE_USER_USERNAME,
+} from '../services/single-user'
+import { createUserDirectly } from './helpers/fixtures'
+
+/**
+ * Single-user mode (`slz rcs one`):
+ * - First deployment auto-initializes the sole admin account
+ *   (admin / admin123) — login with those credentials works immediately.
+ * - Any worker binding is auto-owned by that account: no X-User-Id, no
+ *   X-Username, no claim_token in the register response.
+ * - Self-registration and invitation joins are refused; register-status
+ *   reports closed registration so the Web UI hides the sign-up link.
+ * - Full mode (singleUser=false) keeps the claim flow.
+ */
+
+function freshDb(): Database {
+  try {
+    resetDbSingleton()
+  } catch {
+    // ignore cleanup errors
+  }
+  const path = resolve(
+    tmpdir(),
+    `rcs-single-user-${randomUUID().replace(/-/g, '').slice(0, 8)}.db`,
+  )
+  return initDatabase(path)
+}
+
+const ADMIN_KEY = {
+  Authorization: 'Bearer test-api-key',
+  'Content-Type': 'application/json',
+}
+
+function createBridgeApp(): Hono {
+  const app = new Hono()
+  app.route('/v1/environments', v1Environments)
+  return app
+}
+
+function createAuthApp(): Hono {
+  const app = new Hono()
+  app.route('/web/auth', webAuthRoutes)
+  return app
+}
+
+describe('ensureSingleUserAdmin', () => {
+  beforeEach(() => {
+    freshDb()
+    storeReset()
+    configState.singleUser = true
+    configState.allowRegistration = false
+  })
+
+  test('creates admin/admin123 on an empty users table (first deployment)', async () => {
+    const admin = await ensureSingleUserAdmin()
+    expect(admin).not.toBeNull()
+    expect(admin!.created).toBe(true)
+    expect(admin!.username).toBe(SINGLE_USER_USERNAME)
+
+    const row = getDb().query('SELECT id, username, role FROM users').get() as {
+      id: string
+      username: string
+      role: string
+    }
+    expect(row.id).toBe(admin!.userId)
+    expect(row.username).toBe(SINGLE_USER_USERNAME)
+    expect(row.role).toBe('admin')
+
+    // The default credential verifies against the stored argon2id hash.
+    const { verifyPassword } = await import('../auth/password')
+    const hashRow = getDb()
+      .query('SELECT password_hash FROM users WHERE username = $u')
+      .get({ $u: SINGLE_USER_USERNAME }) as { password_hash: string }
+    expect(
+      verifyPassword(SINGLE_USER_DEFAULT_PASSWORD, hashRow.password_hash),
+    ).toBe(true)
+  })
+
+  test('is idempotent — second call reuses the account, no duplicates', async () => {
+    const first = await ensureSingleUserAdmin()
+    const second = await ensureSingleUserAdmin()
+    expect(second!.created).toBe(false)
+    expect(second!.userId).toBe(first!.userId)
+
+    const count = getDb()
+      .query('SELECT COUNT(*) as count FROM users')
+      .get() as { count: number }
+    expect(count.count).toBe(1)
+  })
+
+  test('reuses an existing admin instead of creating a second account', async () => {
+    createUserDirectly(getDb(), { username: 'alice', role: 'admin' })
+    const admin = await ensureSingleUserAdmin()
+    expect(admin!.created).toBe(false)
+    expect(admin!.username).toBe('alice')
+
+    const count = getDb()
+      .query('SELECT COUNT(*) as count FROM users')
+      .get() as { count: number }
+    expect(count.count).toBe(1)
+  })
+
+  test('returns null when users exist but none is an admin', async () => {
+    createUserDirectly(getDb(), { username: 'bob', role: 'member' })
+    const admin = await ensureSingleUserAdmin()
+    expect(admin).toBeNull()
+  })
+
+  test('getSingleUserAdminUuid resolves the admin id', async () => {
+    expect(getSingleUserAdminUuid()).toBeNull() // empty DB
+    const admin = await ensureSingleUserAdmin()
+    expect(getSingleUserAdminUuid()).toBe(admin!.userId)
+  })
+})
+
+describe('POST /v1/environments/bridge — single-user auto-ownership', () => {
+  let app: Hono
+  let db: Database
+
+  beforeEach(() => {
+    db = freshDb()
+    storeReset()
+    app = createBridgeApp()
+  })
+
+  test('bare API key registration is owned by the single admin, no claim', async () => {
+    configState.singleUser = true
+    const admin = await ensureSingleUserAdmin()
+    expect(admin).not.toBeNull()
+
+    const res = await app.request('/v1/environments/bridge', {
+      method: 'POST',
+      headers: ADMIN_KEY,
+      body: JSON.stringify({ machine_name: 'local-worker' }),
+    })
+    expect(res.status).toBe(200)
+    const body = (await res.json()) as {
+      environment_id: string
+      claim_token?: string
+      claim_url?: string
+    }
+    expect(body.environment_id).toMatch(/^env_/)
+    // No claim flow in single-user mode — the env already has an owner.
+    expect(body.claim_token).toBeUndefined()
+    expect(body.claim_url).toBeUndefined()
+
+    const row = db
+      .query('SELECT owner_user_id, claim_token FROM environments')
+      .get() as { owner_user_id: string; claim_token: string | null }
+    expect(row.owner_user_id).toBe(admin!.userId)
+    expect(row.claim_token).toBeNull()
+  })
+
+  test('reattach keeps the env owned by the single admin', async () => {
+    configState.singleUser = true
+    const admin = await ensureSingleUserAdmin()
+
+    const first = await app.request('/v1/environments/bridge', {
+      method: 'POST',
+      headers: ADMIN_KEY,
+      body: JSON.stringify({ machine_name: 'w1' }),
+    })
+    const { environment_id } = (await first.json()) as {
+      environment_id: string
+    }
+
+    // Restart with the bridge pointer — reattach must not fork or un-own.
+    const second = await app.request('/v1/environments/bridge', {
+      method: 'POST',
+      headers: ADMIN_KEY,
+      body: JSON.stringify({ environment_id, machine_name: 'w1' }),
+    })
+    expect(second.status).toBe(200)
+    const count = db
+      .query('SELECT COUNT(*) as count FROM environments')
+      .get() as { count: number }
+    expect(count.count).toBe(1)
+    const row = db.query('SELECT owner_user_id FROM environments').get() as {
+      owner_user_id: string
+    }
+    expect(row.owner_user_id).toBe(admin!.userId)
+  })
+
+  test('ACP worker session is bound to the single admin', async () => {
+    configState.singleUser = true
+    const admin = await ensureSingleUserAdmin()
+
+    const res = await app.request('/v1/environments/bridge', {
+      method: 'POST',
+      headers: ADMIN_KEY,
+      body: JSON.stringify({
+        machine_name: 'acp-agent',
+        worker_type: 'acp',
+        bridge_id: 'grp_local',
+      }),
+    })
+    expect(res.status).toBe(200)
+    const { session_id } = (await res.json()) as { session_id: string }
+    expect(session_id).toBeDefined()
+
+    const owner = db
+      .query(
+        `SELECT owner_id FROM session_owners
+         WHERE session_id = $s AND owner_type = 'user'`,
+      )
+      .get({ $s: session_id }) as { owner_id: string }
+    expect(owner.owner_id).toBe(admin!.userId)
+  })
+
+  test('full mode (singleUser=false) keeps the claim flow', async () => {
+    configState.singleUser = false
+    const res = await app.request('/v1/environments/bridge', {
+      method: 'POST',
+      headers: ADMIN_KEY,
+      body: JSON.stringify({ machine_name: 'w1' }),
+    })
+    expect(res.status).toBe(200)
+    const body = (await res.json()) as { claim_token: string }
+    expect(body.claim_token).toMatch(/^clm_/)
+
+    const row = db.query('SELECT owner_user_id FROM environments').get() as {
+      owner_user_id: string | null
+    }
+    expect(row.owner_user_id).toBeNull()
+  })
+})
+
+describe('web auth routes — single-user mode', () => {
+  let app: Hono
+
+  beforeEach(() => {
+    freshDb()
+    storeReset()
+    app = createAuthApp()
+    configState.singleUser = true
+    configState.allowRegistration = false
+  })
+
+  test('first deployment: bootstrap → login with admin/admin123 works', async () => {
+    const admin = await ensureSingleUserAdmin()
+    expect(admin!.created).toBe(true)
+
+    const res = await app.request('/web/auth/login', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        username: SINGLE_USER_USERNAME,
+        password: SINGLE_USER_DEFAULT_PASSWORD,
+      }),
+    })
+    expect(res.status).toBe(200)
+    const body = (await res.json()) as { accessToken: string }
+    expect(body.accessToken).toBeDefined()
+  })
+
+  test('register-status reports closed registration', async () => {
+    const res = await app.request('/web/auth/register-status')
+    expect(res.status).toBe(200)
+    const body = (await res.json()) as { allowed: boolean }
+    expect(body.allowed).toBe(false)
+  })
+
+  test('self-registration is refused', async () => {
+    const res = await app.request('/web/auth/register', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ username: 'intruder', password: 'password123' }),
+    })
+    expect(res.status).toBe(403)
+    const count = getDb()
+      .query('SELECT COUNT(*) as count FROM users')
+      .get() as { count: number }
+    expect(count.count).toBe(0)
+  })
+
+  test('invitation join is refused', async () => {
+    const res = await app.request('/web/auth/join', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        inviteToken: 'inv_whatever',
+        username: 'guest',
+        password: 'password123',
+      }),
+    })
+    expect(res.status).toBe(403)
+  })
+
+  test('setup-status reports no setup needed and the single-user mode', async () => {
+    await ensureSingleUserAdmin()
+    const res = await app.request('/web/auth/setup-status')
+    expect(res.status).toBe(200)
+    const body = (await res.json()) as {
+      needsSetup: boolean
+      singleUser: boolean
+    }
+    expect(body.needsSetup).toBe(false)
+    expect(body.singleUser).toBe(true)
+  })
+
+  test('full mode keeps registration open (contrast)', async () => {
+    configState.singleUser = false
+    configState.allowRegistration = true
+    const res = await app.request('/web/auth/register-status')
+    const body = (await res.json()) as { allowed: boolean }
+    expect(body.allowed).toBe(true)
+  })
+})

package/packages/remote-control-server/src/__tests__/web-login.test.ts

@@ -0,0 +1,84 @@
+import { describe, test, expect, beforeEach } from 'bun:test'
+import {
+  MAX_PENDING_CODES,
+  consumeWebLoginCode,
+  issueWebLoginCode,
+  _resetWebLoginCodes,
+} from '../services/web-login'
+
+/**
+ * One-time web login codes (`slz rcs one` browser auto-open):
+ * - single use — the first consume returns the record, the second null
+ * - 2-minute TTL — expired codes are rejected and pruned
+ * - target paths are clamped to same-origin paths (no '//host' open redirect)
+ * - the pending map is bounded
+ */
+
+describe('web-login codes', () => {
+  beforeEach(() => {
+    _resetWebLoginCodes()
+  })
+
+  test('consume returns the record exactly once (single use)', () => {
+    const issued = issueWebLoginCode('usr_abc', '/code/session_1')
+    expect(issued.code).toMatch(/^wlc_[0-9a-f]{32}$/)
+    expect(issued.targetPath).toBe('/code/session_1')
+    expect(issued.userId).toBe('usr_abc')
+
+    const consumed = consumeWebLoginCode(issued.code)
+    expect(consumed).not.toBeNull()
+    expect(consumed?.userId).toBe('usr_abc')
+    expect(consumed?.targetPath).toBe('/code/session_1')
+
+    // Second consume — already used.
+    expect(consumeWebLoginCode(issued.code)).toBeNull()
+  })
+
+  test('unknown code returns null', () => {
+    expect(
+      consumeWebLoginCode('wlc_deadbeefdeadbeefdeadbeefdeadbeef'),
+    ).toBeNull()
+  })
+
+  test('targetPath is clamped to a same-origin path', () => {
+    expect(issueWebLoginCode('usr_abc', '/code/session_1').targetPath).toBe(
+      '/code/session_1',
+    )
+    // No leading slash → root.
+    expect(issueWebLoginCode('usr_abc', 'code/session_1').targetPath).toBe('/')
+    // Protocol-relative would be an open redirect — clamp.
+    expect(issueWebLoginCode('usr_abc', '//evil.example/x').targetPath).toBe(
+      '/',
+    )
+    // Absolute URL → root.
+    expect(
+      issueWebLoginCode('usr_abc', 'https://evil.example/x').targetPath,
+    ).toBe('/')
+  })
+
+  test('expired code is rejected', () => {
+    const issued = issueWebLoginCode('usr_abc', '/code/')
+    const realNow = Date.now
+    // Jump past the 2-minute TTL.
+    Date.now = () => realNow() + 3 * 60 * 1000
+    try {
+      expect(consumeWebLoginCode(issued.code)).toBeNull()
+    } finally {
+      Date.now = realNow
+    }
+  })
+
+  test('pending map is bounded — oldest entries are evicted', () => {
+    const oldest = issueWebLoginCode('usr_abc', '/code/oldest')
+    // Fill to exactly the cap without exceeding it.
+    let last: ReturnType<typeof issueWebLoginCode> | undefined
+    for (let i = 1; i < MAX_PENDING_CODES; i++) {
+      last = issueWebLoginCode('usr_abc', `/code/fill-${i}`)
+    }
+    // One more beyond the cap — the oldest was evicted to make room…
+    issueWebLoginCode('usr_abc', '/code/overflow')
+    expect(consumeWebLoginCode(oldest.code)).toBeNull()
+    // …while recent entries stay intact.
+    expect(consumeWebLoginCode(last!.code)).not.toBeNull()
+  })
+})

package/packages/remote-control-server/src/config.ts

@@ -5,7 +5,49 @@
  */
 export const DEFAULT_RCS_API_KEY = 'sk-slz'
 
-export const config = {
+export interface RcsConfig {
+  version: string
+  port: number
+  host: string
+  apiKeys: string[]
+  baseUrl: string
+  pollTimeout: number
+  heartbeatInterval: number
+  jwtExpiresIn: number
+  disconnectTimeout: number
+  webCorsOrigins: string[]
+  /** Whether the web UI allows open user self-registration (POST /web/auth/register).
+   *  When false, only admin invitation (/join) can create new users. Default true.
+   *  Forced false in single-user mode — exactly one account exists. */
+  allowRegistration: boolean
+  /** Single-user mode (`slz rcs one`): exactly one admin account
+   *  (auto-created admin/admin123 on first deployment), every worker
+   *  auto-owned by it, registration/join disabled, host defaults to
+   *  127.0.0.1. Local deployments only — convenience over auth.
+   *  See services/single-user.ts. */
+  singleUser: boolean
+  /** Bun WebSocket idle timeout (seconds). Bun sends protocol-level pings after
+   *  this many seconds of no received data. Must be shorter than any reverse
+   *  proxy's idle timeout (nginx default 60s, Cloudflare 100s). Default 30s. */
+  wsIdleTimeout: number
+  /** Server→client keep_alive data-frame interval (seconds). Keeps reverse
+   *  proxies from closing idle connections. Default 20s. */
+  wsKeepaliveInterval: number
+  /** Server-side client-inactivity timeout (seconds). If the bridge child
+   *  process sends no data frame within this window, the server closes the
+   *  WebSocket as dead. Must exceed the child's keep_alive interval
+   *  (session_keepalive_interval_v2_ms, default 120s) plus jitter, otherwise
+   *  healthy idle sessions get torn down between keepalives. Default 300s. */
+  wsClientInactivityTimeout: number
+  /** Whether artifact content (GET /v1/artifacts/:id/content) is served
+   *  without authentication. Default true — the unguessable artifact id is
+   *  the secret, same trust model as the upstream cloud-artifacts service.
+   *  Set RCS_ARTIFACTS_PUBLIC_ACCESS=false to gate reads behind web session
+   *  or worker credentials. */
+  artifactsPublicAccess: boolean
+}
+
+export const config: RcsConfig = {
   version: process.env.RCS_VERSION || '0.1.0',
   port: parseInt(process.env.RCS_PORT || '3000', 10),
   host: process.env.RCS_HOST || '0.0.0.0',
@@ -22,34 +64,28 @@ export const config = {
     .map(origin => origin.trim())
     .filter(Boolean),
   /** Whether the web UI allows open user self-registration (POST /web/auth/register).
-   *  When false, only admin invitation (/join) can create new users. Default true. */
-  allowRegistration: process.env.RCS_ALLOW_REGISTRATION !== 'false',
-  /** Bun WebSocket idle timeout (seconds). Bun sends protocol-level pings after
-   *  this many seconds of no received data. Must be shorter than any reverse
-   *  proxy's idle timeout (nginx default 60s, Cloudflare 100s). Default 30s. */
+   *  When false, only admin invitation (/join) can create new users. Default true.
+   *  Forced false in single-user mode — exactly one account exists. */
+  allowRegistration:
+    process.env.RCS_SINGLE_USER === 'true'
+      ? false
+      : process.env.RCS_ALLOW_REGISTRATION !== 'false',
+  /** Single-user mode (`slz rcs one`): exactly one admin account
+   *  (auto-created admin/admin123 on first deployment), every worker
+   *  auto-owned by it, registration/join disabled, host defaults to
+   *  127.0.0.1. Local deployments only — convenience over auth. */
+  singleUser: process.env.RCS_SINGLE_USER === 'true',
   wsIdleTimeout: parseInt(process.env.RCS_WS_IDLE_TIMEOUT || '30', 10),
-  /** Server→client keep_alive data-frame interval (seconds). Keeps reverse
-   *  proxies from closing idle connections. Default 20s. */
   wsKeepaliveInterval: parseInt(
     process.env.RCS_WS_KEEPALIVE_INTERVAL || '20',
     10,
   ),
-  /** Server-side client-inactivity timeout (seconds). If the bridge child
-   *  process sends no data frame within this window, the server closes the
-   *  WebSocket as dead. Must exceed the child's keep_alive interval
-   *  (session_keepalive_interval_v2_ms, default 120s) plus jitter, otherwise
-   *  healthy idle sessions get torn down between keepalives. Default 300s. */
   wsClientInactivityTimeout: parseInt(
     process.env.RCS_WS_CLIENT_INACTIVITY_TIMEOUT || '300',
     10,
   ),
-  /** Whether artifact content (GET /v1/artifacts/:id/content) is served
-   *  without authentication. Default true — the unguessable artifact id is
-   *  the secret, same trust model as the upstream cloud-artifacts service.
-   *  Set RCS_ARTIFACTS_PUBLIC_ACCESS=false to gate reads behind web session
-   *  or worker credentials. */
   artifactsPublicAccess: process.env.RCS_ARTIFACTS_PUBLIC_ACCESS !== 'false',
-} as const
+}
 
 export function getBaseUrl(): string {
   const url = config.baseUrl || `http://localhost:${config.port}`

package/packages/remote-control-server/src/index.ts

@@ -13,6 +13,11 @@ import { websocket } from './transport/ws-shared'
 import { getDb } from './db/sqlite'
 import { reapExpiredSessions } from './auth/session'
 import { cleanupExpiredArtifacts } from './services/artifacts'
+import {
+  ensureSingleUserAdmin,
+  SINGLE_USER_DEFAULT_PASSWORD,
+  SINGLE_USER_USERNAME,
+} from './services/single-user'
 
 console.log('[RCS] In-memory store ready (no SQLite)')
 
@@ -39,6 +44,12 @@ app.get('/health', c => c.json({ status: 'ok', version: config.version }))
 // Register all routes with Bun's serveStatic and upgradeWebSocket
 registerRoutes(app, serveStatic, upgradeWebSocket)
 
+// Single-user mode: local convenience — bind loopback unless the operator
+// explicitly chose a host via RCS_HOST.
+if (config.singleUser && !process.env.RCS_HOST) {
+  config.host = '127.0.0.1'
+}
+
 const port = config.port
 const host = config.host
 
@@ -56,6 +67,36 @@ console.log(
 // Start disconnect monitor
 startDisconnectMonitor()
 
+// Single-user mode (`slz rcs one` via bun run rcs one): bootstrap the sole
+// admin account (admin/admin123 on first deployment) before serving
+// requests, so worker registrations always resolve an owner.
+if (config.singleUser) {
+  const admin = await ensureSingleUserAdmin()
+  if (!admin) {
+    console.error(
+      '[RCS] Single-user mode requires an empty or admin-bearing users ' +
+        'table, but the existing DB has neither. Run full mode (no `one` ' +
+        'argument) or point RCS_DB_PATH at a fresh database.',
+    )
+    process.exit(1)
+  }
+  console.log('[RCS] Single-user mode (one):')
+  if (admin.created) {
+    console.log(
+      `[RCS]   admin account initialized — username: ${SINGLE_USER_USERNAME} password: ${SINGLE_USER_DEFAULT_PASSWORD}`,
+    )
+    console.log(
+      '[RCS]   (local convenience default — change it after first login)',
+    )
+  } else {
+    console.log(`[RCS]   using existing account: ${admin.username}`)
+  }
+  console.log('[RCS]   registration disabled — this is the only account')
+  console.log(
+    '[RCS]   workers bind zero-config and are owned by this account (no claim)',
+  )
+}
+
 // Reap expired session tokens at startup and periodically
 try {
   const db = getDb()