@shawnstack/quickforge 1.7.3 → 1.7.5

package/server/cloud/client.mjs

@@ -0,0 +1,102 @@
+import { cloudEndpoint } from './config.mjs'
+
+export class CloudApiError extends Error {
+  constructor(message, { status = 0, code = 'cloud_request_failed', retryable = false, details } = {}) {
+    super(message)
+    this.name = 'CloudApiError'
+    this.status = status
+    this.code = code
+    this.retryable = retryable
+    this.details = details
+  }
+}
+
+async function parseError(response) {
+  let payload
+  try { payload = await response.json() } catch { payload = undefined }
+  const error = payload?.error
+  const structured = error && typeof error === 'object' ? error : undefined
+  const oauthCode = typeof error === 'string' ? error : undefined
+  return new CloudApiError(
+    structured?.message || payload?.error_description || `QuickForge Cloud request failed (${response.status}).`,
+    {
+      status: response.status,
+      code: structured?.code || payload?.code || oauthCode || 'cloud_request_failed',
+      retryable: Boolean(structured?.retryable || payload?.retryable),
+      details: structured?.details || payload?.details,
+    },
+  )
+}
+
+function timeoutSignal(timeoutMs, outerSignal) {
+  const timeout = AbortSignal.timeout(timeoutMs)
+  return outerSignal ? AbortSignal.any([outerSignal, timeout]) : timeout
+}
+
+export class CloudClient {
+  constructor({ baseUrl, timeoutMs = 10_000, fetchImpl = fetch } = {}) {
+    if (!(baseUrl instanceof URL)) throw new Error('CloudClient requires a configured base URL.')
+    this.baseUrl = baseUrl
+    this.timeoutMs = timeoutMs
+    this.fetch = fetchImpl
+  }
+
+  async request(pathname, { method = 'GET', token, body, headers, signal, raw = false, timeout = true } = {}) {
+    const requestHeaders = { Accept: 'application/json', ...headers }
+    if (body !== undefined) requestHeaders['Content-Type'] = 'application/json'
+    if (token) requestHeaders.Authorization = `Bearer ${token}`
+    const response = await this.fetch(cloudEndpoint(this.baseUrl, pathname), {
+      method,
+      headers: requestHeaders,
+      body: body === undefined ? undefined : JSON.stringify(body),
+      signal: timeout ? timeoutSignal(this.timeoutMs, signal) : signal,
+      redirect: 'error',
+    })
+    if (!response.ok) throw await parseError(response)
+    if (raw) return response
+    if (response.status === 204) return undefined
+    return response.json()
+  }
+
+  health(signal) { return this.request('healthz', { signal }) }
+  ready(signal) { return this.request('readyz', { signal }) }
+  registerGuest(input, idempotencyKey, signal) {
+    return this.request('v1/guest/installations', {
+      method: 'POST', body: input, headers: { 'Idempotency-Key': idempotencyKey }, signal,
+    })
+  }
+  refresh(refreshToken, signal) {
+    return this.request('oauth/token', {
+      method: 'POST', body: { grantType: 'refresh_token', refreshToken }, signal,
+    })
+  }
+  authorizeDevice(token, installationId, clientId = 'quickforge-desktop', signal) {
+    return this.request('oauth/device_authorization', {
+      method: 'POST', token, body: { installationId, clientId }, signal,
+    })
+  }
+  exchangeDeviceCode(deviceCode, clientId = 'quickforge-desktop', signal) {
+    return this.request('oauth/token', {
+      method: 'POST',
+      body: {
+        grantType: 'urn:ietf:params:oauth:grant-type:device_code',
+        deviceCode,
+        clientId,
+      },
+      signal,
+    })
+  }
+  me(token, signal) { return this.request('v1/me', { token, signal }) }
+  models(token, signal) { return this.request('v1/models', { token, signal }) }
+  usage(token, signal) { return this.request('v1/usage', { token, signal }) }
+  installations(token, signal) { return this.request('v1/installations', { token, signal }) }
+  revokeInstallation(token, installationId, signal) {
+    return this.request(`v1/installations/${encodeURIComponent(installationId)}`, { method: 'DELETE', token, signal })
+  }
+  chat(token, payload, idempotencyKey, signal) {
+    return this.request('v1/chat/completions', {
+      method: 'POST', token, body: payload,
+      headers: { 'Idempotency-Key': idempotencyKey }, signal, raw: true, timeout: false,
+    })
+  }
+}

package/server/cloud/config.mjs

@@ -0,0 +1,53 @@
+import net from 'node:net'
+
+const DEFAULT_TIMEOUT_MS = 10_000
+
+function isLoopbackHost(hostname) {
+  const host = String(hostname || '').toLowerCase()
+  if (host === 'localhost' || host.endsWith('.localhost')) return true
+  const ip = net.isIP(host)
+  if (ip === 4) return host.startsWith('127.')
+  if (ip === 6) return host === '::1' || host === '0:0:0:0:0:0:0:1'
+  return false
+}
+
+export function parseCloudBaseUrl(value, _options = {}) {
+  const raw = typeof value === 'string' ? value.trim() : ''
+  if (!raw) return undefined
+
+  let url
+  try {
+    url = new URL(raw)
+  } catch {
+    throw new Error('QUICKFORGE_CLOUD_URL must be a valid URL.')
+  }
+
+  if (url.username || url.password || url.search || url.hash) {
+    throw new Error('QUICKFORGE_CLOUD_URL must not contain credentials, query parameters, or fragments.')
+  }
+  if (url.protocol !== 'https:') {
+    if (!(url.protocol === 'http:' && isLoopbackHost(url.hostname))) {
+      throw new Error('QUICKFORGE_CLOUD_URL must use HTTPS. HTTP is allowed only for loopback addresses.')
+    }
+  }
+  if (url.pathname.includes('..')) throw new Error('QUICKFORGE_CLOUD_URL contains an unsafe path.')
+  url.pathname = `${url.pathname.replace(/\/+$/, '')}/`
+  return url
+}
+
+export function cloudEndpoint(baseUrl, pathname) {
+  if (!(baseUrl instanceof URL)) throw new Error('QuickForge Cloud is not configured.')
+  const relative = String(pathname || '').replace(/^\/+/, '')
+  if (!relative || relative.split('/').includes('..')) throw new Error('Invalid QuickForge Cloud endpoint.')
+  return new URL(relative, baseUrl)
+}
+
+export function readCloudConfig(env = process.env) {
+  const baseUrl = parseCloudBaseUrl(env.QUICKFORGE_CLOUD_URL)
+  const timeoutValue = Number(env.QUICKFORGE_CLOUD_TIMEOUT_MS || DEFAULT_TIMEOUT_MS)
+  return {
+    enabled: Boolean(baseUrl),
+    baseUrl,
+    timeoutMs: Number.isFinite(timeoutValue) ? Math.min(60_000, Math.max(1_000, timeoutValue)) : DEFAULT_TIMEOUT_MS,
+  }
+}

package/server/cloud/credential-store.mjs

@@ -0,0 +1,193 @@
+import { generateKeyPair } from 'node:crypto'
+import { promises as fs } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { promisify } from 'node:util'
+import { createRandomToken } from '../utils/password-auth.mjs'
+import { ensureStorage, storageDir } from '../storage.mjs'
+
+const generateKeyPairAsync = promisify(generateKeyPair)
+const SCHEMA_VERSION = 1
+const ACCOUNT_FIELDS = ['id', 'email', 'plan']
+
+function publicAccount(value) {
+  if (!value || typeof value !== 'object') return undefined
+  const account = {}
+  for (const field of ACCOUNT_FIELDS) {
+    const candidate = value[field]
+    if (typeof candidate === 'string' && candidate) account[field] = candidate
+  }
+  return Object.keys(account).length ? account : undefined
+}
+
+function publicPendingDeviceFlow(value) {
+  if (!value || typeof value !== 'object') return undefined
+  const expiresAt = Number(value.expiresAt)
+  if (!Number.isFinite(expiresAt)) return undefined
+  return {
+    userCode: String(value.userCode || ''),
+    verificationUri: String(value.verificationUri || ''),
+    verificationUriComplete: String(value.verificationUriComplete || ''),
+    expiresAt,
+    interval: Math.max(1, Number(value.interval) || 5),
+    status: String(value.status || 'pending'),
+  }
+}
+
+function platformName(platform = process.platform) {
+  if (platform === 'win32') return 'windows'
+  if (platform === 'darwin') return 'macos'
+  return 'linux'
+}
+
+function defaultRecord({ installationName, platform, clientVersion } = {}) {
+  return {
+    schemaVersion: SCHEMA_VERSION,
+    mode: 'local',
+    installationName: installationName || os.hostname() || 'QuickForge',
+    platform: platformName(platform),
+    clientVersion: clientVersion || 'unknown',
+    updatedAt: new Date().toISOString(),
+  }
+}
+
+function normalizeRecord(value, defaults) {
+  const input = value && typeof value === 'object' ? value : {}
+  const base = defaultRecord(defaults)
+  return {
+    ...base,
+    ...input,
+    schemaVersion: SCHEMA_VERSION,
+    mode: ['local', 'guest', 'account'].includes(input.mode) ? input.mode : 'local',
+    installationName: String(input.installationName || base.installationName).slice(0, 120),
+    platform: ['windows', 'macos', 'linux'].includes(input.platform) ? input.platform : base.platform,
+    clientVersion: String(input.clientVersion || base.clientVersion).slice(0, 80),
+  }
+}
+
+function publicRecord(record) {
+  return {
+    configured: true,
+    mode: record.mode,
+    installationId: record.installationId,
+    installationName: record.installationName,
+    platform: record.platform,
+    clientVersion: record.clientVersion,
+    hasInstallationKey: Boolean(record.publicKey && record.privateKeyPkcs8),
+    hasSession: Boolean(record.refreshToken),
+    account: publicAccount(record.account),
+    pendingDeviceFlow: publicPendingDeviceFlow(record.pendingDeviceFlow),
+    updatedAt: record.updatedAt,
+  }
+}
+
+async function generateInstallationKeyPair() {
+  const { publicKey, privateKey } = await generateKeyPairAsync('ed25519')
+  const publicJwk = publicKey.export({ format: 'jwk' })
+  return {
+    publicKey: publicJwk.x,
+    privateKeyPkcs8: privateKey.export({ format: 'der', type: 'pkcs8' }).toString('base64url'),
+  }
+}
+
+export function createCloudCredentialStore({
+  filePath = path.join(storageDir, 'security', 'cloud-identity.json'),
+  ensureBaseStorage = ensureStorage,
+  installationName,
+  platform,
+  clientVersion,
+} = {}) {
+  let queue = Promise.resolve()
+  const defaults = { installationName, platform, clientVersion }
+
+  async function ensureDirectory() {
+    await ensureBaseStorage()
+    await fs.mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 })
+  }
+
+  async function read() {
+    await ensureDirectory()
+    try {
+      const raw = await fs.readFile(filePath, 'utf8')
+      return normalizeRecord(raw.trim() ? JSON.parse(raw) : {}, defaults)
+    } catch (error) {
+      if (error?.code === 'ENOENT') return defaultRecord(defaults)
+      throw error
+    }
+  }
+
+  async function writeNow(record) {
+    await ensureDirectory()
+    const normalized = normalizeRecord({ ...record, updatedAt: new Date().toISOString() }, defaults)
+    const temporary = `${filePath}.${process.pid}.${createRandomToken(8)}.tmp`
+    await fs.writeFile(temporary, `${JSON.stringify(normalized, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 })
+    try { await fs.chmod(temporary, 0o600) } catch { /* best effort on Windows */ }
+    try {
+      await fs.rename(temporary, filePath)
+    } catch (error) {
+      if (!['EEXIST', 'EPERM'].includes(error?.code)) throw error
+      await fs.rm(filePath, { force: true })
+      await fs.rename(temporary, filePath)
+    }
+    try { await fs.chmod(filePath, 0o600) } catch { /* best effort on Windows */ }
+    return normalized
+  }
+
+  function update(mutator) {
+    const next = queue.catch(() => undefined).then(async () => {
+      const current = await read()
+      const result = await mutator({ ...current })
+      return writeNow(result || current)
+    })
+    queue = next
+    return next
+  }
+
+  async function ensureInstallation() {
+    const current = await read()
+    if (current.publicKey && current.privateKeyPkcs8) return current
+    return update(async (record) => ({ ...record, ...(await generateInstallationKeyPair()) }))
+  }
+
+  async function rotateInstallation() {
+    const keyPair = await generateInstallationKeyPair()
+    return update((record) => ({
+      ...record,
+      ...keyPair,
+      mode: 'local',
+      installationId: undefined,
+      refreshToken: undefined,
+      sessionCloudUrl: undefined,
+      pendingRegistrationKey: undefined,
+      pendingRegistrationHash: undefined,
+      pendingDeviceFlow: undefined,
+      account: undefined,
+      rotateInstallationBeforeRegistration: undefined,
+    }))
+  }
+
+  return {
+    filePath,
+    read,
+    update,
+    ensureInstallation,
+    rotateInstallation,
+    async readPublic() { return publicRecord(await read()) },
+    async clearSession({ rotateInstallationBeforeRegistration = false } = {}) {
+      return update((record) => ({
+        ...record,
+        mode: 'local',
+        installationId: undefined,
+        refreshToken: undefined,
+        sessionCloudUrl: undefined,
+        pendingRegistrationKey: undefined,
+        pendingRegistrationHash: undefined,
+        pendingDeviceFlow: undefined,
+        account: undefined,
+        rotateInstallationBeforeRegistration: rotateInstallationBeforeRegistration || undefined,
+      }))
+    },
+  }
+}
+
+export { publicRecord as publicCloudCredentialRecord }