@standardagents/builder 0.17.2 → 0.18.0

package/dist/plugin.js

@@ -7205,8 +7205,10 @@ import { isThreadEndpoint } from "@standardagents/spec";
 const PUBLIC_ROUTES = [
   '/api/auth/bootstrap',
   '/api/auth/login',
-  '/api/auth/bootstrap',
   '/api/auth/config',
+  '/api/auth/platform-replica',
+  '/api/auth/sa/start',     // Login with Standard Agents (OAuth) \u2014 unauthenticated entry
+  '/api/auth/sa/callback',  // OAuth callback (sets the session cookie)
   '/api/config',
   '/api/auth/oauth/github',
   '/api/auth/oauth/google',
@@ -7219,15 +7221,31 @@ const PUBLIC_ROUTES = [
   '/api/hooks'  // Hook metadata is safe to expose publicly
 ];
 
+// True when the platform deployed this instance (injects STANDARD_AGENTS_HOSTED).
+// Hosted instances are internet-reachable and multi-tenant, so the thread data
+// API and event/stream WebSockets must NOT be anonymously public the way they
+// are in single-user local dev \u2014 they require a session (admin) or API key (SDK).
+function isHostedInstance(env) {
+  const value = env && env.STANDARD_AGENTS_HOSTED;
+  if (typeof value === 'string') {
+    const trimmed = value.trim().toLowerCase();
+    return trimmed !== '' && trimmed !== '0' && trimmed !== 'false';
+  }
+  return Boolean(value);
+}
+
 // Check if a route is public (no auth required)
-function isPublicRoute(routePath) {
+function isPublicRoute(routePath, hosted) {
   // Exact match for auth routes
   if (PUBLIC_ROUTES.includes(routePath)) {
     return true;
   }
 
-  // Thread routes are always public
-  if (routePath.startsWith('/api/threads/') || routePath === '/api/threads') {
+  // Thread routes (REST + message/log stream WebSockets) are public in local
+  // single-user dev, but on a hosted deployment they require auth \u2014 requireAuth
+  // accepts the admin's session (cookie or token) or the SDK's API key, so this
+  // only blocks anonymous access to another tenant's threads/messages/files.
+  if (!hosted && (routePath.startsWith('/api/threads/') || routePath === '/api/threads')) {
     return true;
   }
 
@@ -7236,16 +7254,25 @@ function isPublicRoute(routePath) {
     return true;
   }
 
-  // Platform proxy routes handle their own auth.
+  // Platform proxy routes handle their own auth in local dev only.
+  if (hosted && (routePath.startsWith('/api/platform/') || routePath === '/api/platform')) {
+    return false;
+  }
   if (routePath.startsWith('/api/platform/') || routePath === '/api/platform') {
     return true;
   }
 
-  // Platform session proxy and auth bridge handle auth via platform cookies.
+  // Platform session proxy and auth bridge are local-dev helpers only.
+  if (hosted && (routePath.startsWith('/api/platform-session/') || routePath === '/api/platform-session')) {
+    return false;
+  }
   if (routePath.startsWith('/api/platform-session/') || routePath === '/api/platform-session') {
     return true;
   }
 
+  if (hosted && (routePath.startsWith('/api/platform-auth/') || routePath === '/api/platform-auth')) {
+    return false;
+  }
   if (routePath.startsWith('/api/platform-auth/') || routePath === '/api/platform-auth') {
     return true;
   }
@@ -7253,6 +7280,36 @@ function isPublicRoute(routePath) {
   return false;
 }
 
+function platformEndpoint(env) {
+  const configured =
+    env && (env.PLATFORM_ENDPOINT || env.STANDARD_AGENTS_PLATFORM_URL || env.PLATFORM_URL || env.STANDARD_AGENTS_PUBLIC_URL);
+  if (typeof configured === 'string' && configured.trim()) {
+    return configured.trim().replace(/\\/+$/, '');
+  }
+  return 'https://platform.standardagents.ai';
+}
+
+function hostedInstanceRedirectId(request, env) {
+  const configured = env && (env.STANDARD_AGENTS_PROJECT_ID || env.STANDARD_AGENTS_INSTANCE_ID || env.STANDARD_AGENTS_INSTANCE_SUBDOMAIN);
+  if (typeof configured === 'string' && configured.trim()) {
+    return configured.trim();
+  }
+  return new URL(request.url).hostname;
+}
+
+function platformLoginUrl(request, env) {
+  const requestUrl = new URL(request.url);
+  const url = new URL('/login', platformEndpoint(env));
+  url.searchParams.set('redirect', hostedInstanceRedirectId(request, env));
+  url.searchParams.set('return_to', requestUrl.pathname + requestUrl.search || '/');
+  return url.toString();
+}
+
+function isHtmlNavigationRequest(request) {
+  if (request.method !== 'GET' && request.method !== 'HEAD') return false;
+  return (request.headers.get('Accept') || '').includes('text/html');
+}
+
 // CORS headers for API responses
 const CORS_HEADERS = {
   "Access-Control-Allow-Origin": "*",
@@ -7329,7 +7386,7 @@ ${packedThreadRouteCode}
 
   if (routeMatch) {
     // Check if authentication is required for this route
-    const publicRoute = isPublicRoute(routePath);
+    const publicRoute = isPublicRoute(routePath, isHostedInstance(env));
     const isApiRoute = routePath.startsWith('/api/');
 
     let authContext = null;
@@ -7344,6 +7401,21 @@ ${packedThreadRouteCode}
       }
 
       authContext = authResult;
+
+      if (routePath.startsWith('/api/threads/')) {
+        const threadId = routeMatch.params?.id || routeMatch.params?.threadId;
+        if (threadId) {
+          const agentBuilderId = env.AGENT_BUILDER.idFromName('singleton');
+          const agentBuilder = env.AGENT_BUILDER.get(agentBuilderId);
+          const thread = await agentBuilder.getThread(threadId);
+          if (!thread) {
+            return addCorsHeaders(Response.json({ error: \`Thread not found: \${threadId}\` }, { status: 404 }));
+          }
+          if (authContext.user.role !== 'admin' && (thread.user_id === null || thread.user_id !== authContext.user.id)) {
+            return addCorsHeaders(Response.json({ error: "Forbidden: You don't have access to this thread" }, { status: 403 }));
+          }
+        }
+      }
     }
 
     let controller = await routeMatch.data();
@@ -7379,6 +7451,19 @@ ${packedThreadRouteCode}
     });
   }
 
+  // Hosted browser navigations do not render a local login page. Redirect
+  // anonymous users directly to the platform, where the instance membership is
+  // resolved and returned as a signed handoff token.
+  if (isHostedInstance(env) && isHtmlNavigationRequest(request)) {
+    const authResult = await requireAuth(request, env);
+    if (authResult instanceof Response) {
+      return new Response(null, {
+        status: 302,
+        headers: { Location: platformLoginUrl(request, env) },
+      });
+    }
+  }
+
   // Serve UI for all other routes (SPA fallback)
   return serveUI(routePath, env);
 }