@stacksjs/defaults 0.70.58 → 0.70.60

package/app/Actions/Auth/RevokeTokenAction.ts

@@ -0,0 +1,43 @@
+import { Action } from '@stacksjs/actions'
+import { currentAccessToken, revokeTokenById, tokens } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
+
+export default new Action({
+  name: 'RevokeTokenAction',
+  description: 'Revoke a specific access token',
+  method: 'DELETE',
+  async handle(request: RequestInstance) {
+    const user = await request.user()
+
+    if (!user) {
+      return response.unauthorized('Authentication required')
+    }
+
+    const tokenId = Number(request.getParam('id'))
+
+    if (!tokenId || Number.isNaN(tokenId)) {
+      return response.badRequest('Invalid token ID')
+    }
+
+    // Verify the token belongs to the user
+    const userTokens = await tokens(user.id)
+    const tokenToRevoke = userTokens.find(t => t.id === tokenId)
+
+    if (!tokenToRevoke) {
+      return response.notFound('Token not found')
+    }
+
+    // Check if trying to revoke current token
+    const current = await currentAccessToken()
+    if (current && current.id === tokenId) {
+      return response.badRequest('Cannot revoke the current token. Use /logout instead.')
+    }
+
+    await revokeTokenById(tokenId)
+
+    return response.json({
+      message: 'Token revoked successfully',
+      token_id: tokenId,
+    })
+  },
+})

package/app/Actions/Auth/TestAbilitiesAction.ts

@@ -0,0 +1,61 @@
+import { Action } from '@stacksjs/actions'
+import { currentAccessToken, tokenAbilities, tokenCan, tokenCanAll, tokenCanAny } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
+
+export default new Action({
+  name: 'TestAbilitiesAction',
+  description: 'Test token abilities/scopes - useful for debugging',
+  method: 'GET',
+  async handle(request: RequestInstance) {
+    const user = await request.user()
+
+    if (!user) {
+      return response.unauthorized('Authentication required')
+    }
+
+    const accessToken = await currentAccessToken()
+    const abilities = await tokenAbilities()
+
+    // Get test scopes from query params
+    const testScope = request.get('scope') as string | undefined
+    const testScopes = request.get('scopes') as string | undefined
+
+    const result: any = {
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+      },
+      token: accessToken
+        ? {
+            id: accessToken.id,
+            name: accessToken.name,
+            scopes: accessToken.scopes,
+            expires_at: accessToken.expiresAt?.toISOString() || null,
+          }
+        : null,
+      abilities,
+      has_wildcard: abilities.includes('*'),
+    }
+
+    // Test specific scope if provided
+    if (testScope) {
+      result.test = {
+        scope: testScope,
+        can: await tokenCan(testScope),
+      }
+    }
+
+    // Test multiple scopes if provided (comma-separated)
+    if (testScopes) {
+      const scopeList = testScopes.split(',').map(s => s.trim())
+      result.test_multiple = {
+        scopes: scopeList,
+        can_all: await tokenCanAll(scopeList),
+        can_any: await tokenCanAny(scopeList),
+      }
+    }
+
+    return response.json(result)
+  },
+})

package/app/Actions/Auth/VerifyAuthenticationAction.ts

@@ -0,0 +1,94 @@
+import type { AuthenticationCredential } from '@stacksjs/auth'
+import { Action } from '@stacksjs/actions'
+import {
+  consumeWebAuthnChallenge,
+  getUserPasskey,
+  updatePasskeyCounter,
+  verifyAuthenticationResponse,
+} from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { response } from '@stacksjs/router'
+import { User } from '@stacksjs/orm'
+
+export default new Action({
+  name: 'VerifyAuthenticationAction',
+  description: 'Verify authentication from passkey',
+  method: 'POST',
+  async handle(request: RequestInstance) {
+    const body = request.all()
+    const credential = body.res as AuthenticationCredential
+
+    const email = request.get('email') ?? ''
+
+    const user = await User.where('email', email).first()
+
+    if (!user)
+      return response.notFound('User not found')
+
+    const userPasskey = await getUserPasskey(user.id as number, credential.id)
+
+    if (!userPasskey)
+      return response.notFound('Passkey not found')
+
+    // Read + delete the server-stored challenge for this user. The
+    // previous flow trusted `body.challenge` from the client, which
+    // let an attacker replay a captured assertion as long as they
+    // had the original challenge. Closing this gap was stacksjs/stacks#1866.
+    const expectedChallenge = await consumeWebAuthnChallenge(user.id as number, 'authentication')
+    if (!expectedChallenge)
+      return response.unauthorized('Authentication challenge missing or expired — please retry from the start.')
+
+    const pubkeyString = userPasskey.cred_public_key
+    let jsonParse: Record<string, number>
+    try {
+      jsonParse = JSON.parse(pubkeyString) as Record<string, number>
+    }
+    catch {
+      return response.serverError('Invalid public key format')
+    }
+    const publicKey = new Uint8Array(Object.values(jsonParse)).buffer
+
+    // Convert challenge string to Uint8Array. The challenge is stored
+    // as base64url (the same form generateAuthenticationOptions emits).
+    const challengeBytes = Uint8Array.from(atob(expectedChallenge), c => c.charCodeAt(0))
+
+    // Derive origin and rpID from app config instead of hardcoding localhost
+    const appUrl = config.app?.url || 'http://localhost:3333'
+    const expectedOrigin = appUrl.startsWith('http') ? appUrl : `https://${appUrl}`
+    const expectedRPID = new URL(expectedOrigin).hostname
+
+    try {
+      const verification = await verifyAuthenticationResponse(
+        credential,
+        challengeBytes,
+        expectedOrigin,
+        expectedRPID,
+        publicKey,
+        userPasskey.counter,
+      )
+
+      if (!verification.verified)
+        return response.unauthorized('Authentication failed')
+
+      // Anti-cloning: persist the new counter and reject if it didn't
+      // advance. WebAuthn authenticators monotonically increment on
+      // every use; a counter that's not strictly greater than the
+      // stored value indicates a cloned/replayed credential. See
+      // updatePasskeyCounter() and stacksjs/stacks#1861 A-4.
+      const newCounter = verification.authenticationInfo?.newCounter
+      if (typeof newCounter === 'number') {
+        const advanced = await updatePasskeyCounter(user.id as number, credential.id, newCounter)
+        if (!advanced) {
+          console.warn(`[VerifyAuthenticationAction] Refusing passkey login for user ${user.id} (${credential.id}): counter did not advance (stored=${userPasskey.counter}, received=${newCounter}) — possible cloned authenticator`)
+          return response.unauthorized('Authentication failed')
+        }
+      }
+
+      return response.json(verification)
+    }
+    catch (error) {
+      console.error('Authentication verification failed:', error)
+      return response.serverError('Authentication verification failed')
+    }
+  },
+})

package/app/Actions/Auth/VerifyEmailAction.ts

@@ -0,0 +1,25 @@
+// No imports needed - everything is auto-imported!
+
+export default new Action({
+  name: 'VerifyEmailAction',
+  description: 'Verify user email address',
+  method: 'GET',
+
+  async handle(request: RequestInstance) {
+    const userId = request.getParamAsInt('id')
+    const token = request.getParam('token')
+
+    if (!userId || !token) {
+      return response.json({ success: false, message: 'Invalid verification link.' }, 422)
+    }
+
+    const { verifyEmail } = await import('@stacksjs/auth')
+    const result = await verifyEmail(userId, token)
+
+    if (!result.success) {
+      return response.json({ success: false, message: result.message }, 422)
+    }
+
+    return response.json({ success: true, message: 'Email verified successfully.' })
+  },
+})

package/app/Actions/Auth/VerifyRegistrationAction.ts

@@ -0,0 +1,59 @@
+import { Action } from '@stacksjs/actions'
+import {
+  consumeWebAuthnChallenge,
+  setCurrentRegistrationOptions,
+  verifyRegistrationResponse,
+} from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+
+export default new Action({
+  name: 'VerifyRegistrationAction',
+  description: 'Verify the registration passkey',
+  method: 'POST',
+  async handle(request: RequestInstance) {
+    const body = request.all()
+
+    // Same identity rule as GenerateRegistrationAction: the account a
+    // passkey gets attached to must be the caller's own authenticated
+    // session, never a client-supplied `email` field. This route must
+    // stay behind `middleware('auth')` — see routes/dashboard.ts.
+    const user = await request.user()
+
+    if (!user)
+      return Response.json({ error: 'Unauthorized' }, { status: 401 })
+
+    // Read + delete the server-stored registration challenge for this
+    // user. The previous flow accepted `body.challenge` from the
+    // client; persisting it here closes the same replay vector that
+    // the authentication path closed in stacksjs/stacks#1866.
+    const expectedChallenge = await consumeWebAuthnChallenge(user.id as number, 'registration')
+    if (!expectedChallenge) {
+      return Response.json(
+        { error: 'Registration challenge missing or expired — please retry from the start.' },
+        { status: 401 },
+      )
+    }
+
+    // Derive origin and rpID from app config instead of hardcoding localhost
+    const appUrl = config.app?.url || 'http://localhost:3333'
+    const expectedOrigin = appUrl.startsWith('http') ? appUrl : `https://${appUrl}`
+    const expectedRPID = new URL(expectedOrigin).hostname
+
+    try {
+      const verification = await verifyRegistrationResponse({
+        response: body.attResp,
+        expectedChallenge,
+        expectedOrigin,
+        expectedRPID,
+      })
+
+      await setCurrentRegistrationOptions(user, verification)
+
+      return verification
+    }
+    catch (error) {
+      console.error('Passkey verification failed:', error)
+      return Response.json({ error: 'Registration verification failed' }, { status: 400 })
+    }
+  },
+})

package/app/Actions/Auth/VerifyTwoFactorLoginAction.ts

@@ -0,0 +1,57 @@
+import { Action } from '@stacksjs/actions'
+import { Auth, consumeTwoFactorChallenge, verifyTwoFactorLoginCode } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
+import { schema } from '@stacksjs/validation'
+
+export default new Action({
+  name: 'VerifyTwoFactorLoginAction',
+  description: 'Exchange a LoginAction 2FA challenge + TOTP code for a real token pack',
+  method: 'POST',
+
+  validations: {
+    challenge_token: {
+      rule: schema.string().min(1),
+      message: 'A challenge token is required.',
+    },
+    code: {
+      rule: schema.string().min(6).max(6),
+      message: 'Code must be a 6-digit TOTP code.',
+    },
+  },
+
+  async handle(request: RequestInstance) {
+    const challengeToken = request.get('challenge_token')
+    const code = request.get('code')
+
+    // Single-use: a second attempt with the same challenge token
+    // (whether the code was right or wrong) must start over from
+    // LoginAction, not retry — mirrors the WebAuthn challenge
+    // delete-on-read semantics in passkey.ts (stacksjs/stacks#1866).
+    const userId = await consumeTwoFactorChallenge(challengeToken)
+    if (!userId)
+      return response.unauthorized('This login attempt has expired — please sign in again.')
+
+    const valid = await verifyTwoFactorLoginCode(userId, code)
+    if (!valid)
+      return response.unauthorized('Invalid code — please sign in again.')
+
+    const result = await Auth.loginUsingId(userId)
+    if (!result)
+      return response.unauthorized('Invalid code — please sign in again.')
+
+    const user = result.user
+
+    return response.json({
+      access_token: result.token,
+      refresh_token: result.refreshToken,
+      token_type: 'Bearer',
+      expires_in: result.expiresIn,
+      token: result.token,
+      user: {
+        id: user?.id,
+        email: user?.email,
+        name: user?.name,
+      },
+    })
+  },
+})

package/app/Actions/Billable/CheckoutAction.ts

@@ -0,0 +1,25 @@
+import { Action } from '@stacksjs/actions'
+import { manageCheckout } from '@stacksjs/payments'
+import { response } from '@stacksjs/router'
+
+export default new Action({
+  name: 'Checkout',
+  description: 'Checkout Action',
+  method: 'POST',
+  async handle(request: RequestInstance) {
+    const user = await request.user()
+
+    if (!user) {
+      return response.json({ message: 'User not found' }, 404)
+    }
+
+    const params = {
+      success_url: 'https://localhost:3000/success',
+      cancel_url: 'https://localhost:3000/cancel',
+    }
+
+    const session = await manageCheckout.create(user, params)
+
+    return response.json({ url: session.url })
+  },
+})

package/app/Actions/Buddy/BuddyBrowseAction.ts

@@ -0,0 +1,34 @@
+import { Action } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+
+/**
+ * Open a native folder picker dialog (macOS)
+ *
+ * Uses osascript to display a native folder selection dialog
+ * and returns the selected path.
+ */
+export default new Action({
+  name: 'BuddyBrowseAction',
+  description: 'Open folder picker dialog',
+  method: 'POST',
+  async handle(_request: RequestInstance) {
+    try {
+      const { $: _$ } = await import('bun')
+
+      // Use osascript to open native folder picker on macOS
+      const script = `osascript -e 'POSIX path of (choose folder with prompt "Select project folder")'`
+      const result = await _$`sh -c ${script}`.quiet()
+      const selectedPath = result.text().trim().replace(/\/$/, '') // Remove trailing slash
+
+      if (selectedPath) {
+        return response.json({ path: selectedPath })
+      }
+
+      return response.json({ error: 'No folder selected' })
+    }
+    catch (error) {
+      // User cancelled the dialog
+      return response.json({ error: 'Folder selection cancelled' })
+    }
+  },
+})

package/app/Actions/Buddy/BuddyCancelAction.ts

@@ -0,0 +1,32 @@
+import { Action } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+
+/**
+ * Cancel the current running AI query
+ *
+ * This attempts to terminate any running claude CLI processes.
+ */
+export default new Action({
+  name: 'BuddyCancelAction',
+  description: 'Cancel the current AI query',
+  method: 'POST',
+  async handle(_request: RequestInstance) {
+    try {
+      const { $: _$ } = await import('bun')
+
+      // Find and kill claude CLI processes
+      const _result = await _$`pkill -f "claude --print" || true`.quiet().nothrow()
+
+      return response.json({
+        success: true,
+        message: 'Cancel signal sent',
+      })
+    }
+    catch (error) {
+      return response.json({
+        success: false,
+        error: (error as Error).message,
+      })
+    }
+  },
+})

package/app/Actions/Buddy/BuddyCommitAction.ts

@@ -0,0 +1,25 @@
+import { Action } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+import { commitChanges, CONFIG } from '@stacksjs/ai'
+
+/**
+ * Stage and commit all changes in the repository
+ */
+export default new Action({
+  name: 'BuddyCommitAction',
+  description: 'Commit all staged changes in the repository',
+  method: 'POST',
+  async handle(_request: RequestInstance) {
+    try {
+      const hash = await commitChanges()
+      return response.json({
+        success: true,
+        hash,
+        message: CONFIG.commitMessage,
+      })
+    }
+    catch (error) {
+      return response.json({ success: false, error: (error as Error).message }, { status: 400 })
+    }
+  },
+})

package/app/Actions/Buddy/BuddyGitHubConnectAction.ts

@@ -0,0 +1,40 @@
+import { Action } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+import type { GitHubCredentials } from '@stacksjs/ai'
+import { buddyState } from '@stacksjs/ai'
+
+/**
+ * Connect a GitHub account for commits
+ *
+ * Request body:
+ * - token: GitHub personal access token
+ * - username: GitHub username
+ * - name: Display name for git commits
+ * - email: Email for git commits
+ */
+export default new Action({
+  name: 'BuddyGitHubConnectAction',
+  description: 'Connect a GitHub account for authenticated operations',
+  method: 'POST',
+  async handle(request: RequestInstance) {
+    try {
+      const body = await request.json() as GitHubCredentials
+      const { token, username, name, email } = body
+
+      if (!token || !username || !name || !email) {
+        return response.json({
+          success: false,
+          error: 'token, username, name, and email are required',
+        }, { status: 400 })
+      }
+
+      buddyState.setGitHub({ token, username, name, email })
+      console.log(`GitHub connected: ${username} <${email}>`)
+
+      return response.json({ success: true, username, name, email })
+    }
+    catch (error) {
+      return response.json({ success: false, error: (error as Error).message }, { status: 400 })
+    }
+  },
+})

package/app/Actions/Buddy/BuddyGitHubDisconnectAction.ts

@@ -0,0 +1,19 @@
+import { Action } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+import { buddyState } from '@stacksjs/ai'
+
+/**
+ * Disconnect the GitHub account
+ */
+export default new Action({
+  name: 'BuddyGitHubDisconnectAction',
+  description: 'Disconnect the GitHub account',
+  method: 'POST',
+  async handle(_request: RequestInstance) {
+    const state = buddyState.getState()
+    const previousUser = state.github?.username
+    buddyState.setGitHub(null)
+    console.log(`GitHub disconnected: ${previousUser || 'unknown'}`)
+    return response.json({ success: true })
+  },
+})

package/app/Actions/Buddy/BuddyProcessAction.ts

@@ -0,0 +1,65 @@
+import { Action } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+import { schema } from '@stacksjs/validation'
+import { applyChanges, buddyState, openRepository, processCommand } from '@stacksjs/ai'
+
+/**
+ * Process a command with the AI driver
+ *
+ * Accepts params via JSON body OR query string:
+ * - command: The user's command/instruction (required)
+ * - repo/repository: Repository path or GitHub URL (required if no repo is currently open)
+ * - driver: (optional) AI driver to use (claude-cli-local, claude-cli-ec2, claude, openai, ollama, mock)
+ */
+export default new Action({
+  name: 'BuddyProcessAction',
+  description: 'Process a command with the selected AI driver',
+  method: 'POST',
+
+  validations: {
+    command: {
+      rule: schema.string().min(1).required(),
+      message: 'Command is required',
+    }
+  },
+
+  async handle(request: RequestInstance) {
+    try {
+      // Get params using Laravel-style methods (body is already parsed by stacks-router)
+      const command = request.get<string>('command')
+      const repo = request.get<string>('repo') || request.get<string>('repository')
+      const driver = request.get<string>('driver')
+
+      // Check if we need to open a repo
+      const currentState = buddyState.getState()
+      if (!currentState.repo) {
+        if (!repo) {
+          return response.unprocessableEntity('No repository is currently open. Please provide a repo path or URL.', {
+            repo: ['Repository path or URL is required when no repo is currently open'],
+          })
+        }
+        // Open the repo
+        await openRepository(repo)
+      }
+      else if (repo && repo !== currentState.repo.path) {
+        // User wants to switch to a different repo
+        await openRepository(repo)
+      }
+
+      const aiResponse = await processCommand(command!, driver)
+      const modifiedFiles = await applyChanges(aiResponse)
+
+      return response.success({
+        message: aiResponse,
+        hasChanges: modifiedFiles.length > 0,
+        modifiedFiles,
+        repo: buddyState.getState().repo,
+      })
+    }
+    catch (error) {
+      console.error('[BuddyProcessAction] Error:', error)
+      console.error('[BuddyProcessAction] Stack:', (error as Error).stack)
+      return response.serverError((error as Error).message)
+    }
+  },
+})