@standardagents/builder 0.41.15 → 0.41.16

package/dist/built-in-routes.js

@@ -79698,7 +79698,7 @@ var config_get_default = defineController2(async ({ config, env: env2, req }) =>
 });
 
 // src/version.ts
-var BUILDER_VERSION = "0.41.15".length > 0 ? "0.41.15" : "dev";
+var BUILDER_VERSION = "0.41.16".length > 0 ? "0.41.16" : "dev";
 
 // src/api/diagnostics.get.ts
 init_LLMRequest();
@@ -82109,6 +82109,101 @@ function authRateLimitedResponse(result) {
   );
 }
 
+// src/utils/key-exchange.ts
+var HOST_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function validHost(host) {
+  return host.length <= 253 && host.split(".").length >= 2 && host.split(".").every((label) => HOST_LABEL.test(label));
+}
+function canonicalSourceOrigin(value) {
+  if (typeof value !== "string" || value.length > 300) return null;
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.port || parsed.search || parsed.hash || parsed.pathname !== "/" && parsed.pathname !== "" || !validHost(parsed.hostname) || value.replace(/\/$/, "") !== parsed.origin) {
+    return null;
+  }
+  return parsed.origin;
+}
+function isTrustedOrigin(origin, trustedOrigins) {
+  const host = origin.slice("https://".length);
+  return trustedOrigins.some((entry) => {
+    const trusted = entry.slice("https://".length);
+    return trusted.startsWith("*.") ? host.endsWith(trusted.slice(1)) && host.length > trusted.length - 1 : host === trusted;
+  });
+}
+
+// src/api/auth/exchange.post.ts
+var ADDRESS_LIMIT = { limit: 30, window_seconds: 60 * 60 };
+var SOURCE_TIMEOUT_MS = 5e3;
+function refused(status, error, message) {
+  return Response.json({ error, message }, { status, headers: { "Cache-Control": "no-store" } });
+}
+var exchange_post_default = defineController2(async ({ req, env: env2, config }) => {
+  const trustedOrigins = config?.keyExchange?.trustedOrigins;
+  if (!trustedOrigins?.length) {
+    return refused(404, "key_exchange_unsupported", "This instance does not exchange keys.");
+  }
+  const body = await req.json().catch(() => null);
+  const sourceOrigin = canonicalSourceOrigin(body?.source_origin);
+  const sourceKey = typeof body?.source_key === "string" ? body.source_key.trim() : "";
+  if (!sourceOrigin || !sourceKey || sourceKey.length > 512) {
+    return refused(400, "invalid_request", "source_origin and source_key are required.");
+  }
+  if (sourceOrigin === new URL(req.url).origin || !isTrustedOrigin(sourceOrigin, trustedOrigins)) {
+    return refused(403, "untrusted_origin", "This instance does not trust that origin.");
+  }
+  const agentBuilder = env2.AGENT_BUILDER.get(env2.AGENT_BUILDER.idFromName("singleton"));
+  const addressLimit = await agentBuilder.consumeAuthRateLimit({
+    key: await authRateLimitKey("key-exchange-address", authClientAddress(req)),
+    ...ADDRESS_LIMIT
+  });
+  if (!addressLimit.allowed) return authRateLimitedResponse(addressLimit);
+  let identity;
+  try {
+    const response = await fetch(`${sourceOrigin}/api/auth/me`, {
+      headers: { Authorization: `Bearer ${sourceKey}`, Accept: "application/json" },
+      redirect: "manual",
+      signal: AbortSignal.timeout(SOURCE_TIMEOUT_MS)
+    });
+    if (response.status === 401 || response.status === 403) {
+      return refused(401, "source_key_rejected", "The source deployment rejected the key.");
+    }
+    if (!response.ok) {
+      return refused(502, "source_unavailable", `The source deployment answered ${response.status}.`);
+    }
+    identity = await response.json();
+  } catch {
+    return refused(502, "source_unavailable", "The source deployment could not be reached.");
+  }
+  if (identity?.authType !== "api_key") {
+    return refused(401, "source_key_rejected", "Only API keys can be exchanged.");
+  }
+  const platformUserId = identity.user?.platform_user_id;
+  if (typeof platformUserId !== "string" || !platformUserId) {
+    return refused(403, "unknown_user", "The key does not belong to a platform user.");
+  }
+  const user = await agentBuilder.getUserByPlatformUserId(platformUserId);
+  if (!user) {
+    return refused(403, "unknown_user", "That user has not signed in to this instance.");
+  }
+  const token = generateApiKey();
+  const sourceHost = new URL(sourceOrigin).hostname;
+  await agentBuilder.createApiKey({
+    name: `Key exchange from ${sourceHost}`.slice(0, 100),
+    key_hash: await hashToken(token),
+    key_prefix: getTokenPrefix(token),
+    last_five: getLastChars(token, 5),
+    user_id: user.id
+  });
+  return Response.json(
+    { token, endpoint: new URL(req.url).origin, user: { id: user.id, username: user.username } },
+    { status: 201, headers: { "Cache-Control": "no-store" } }
+  );
+});
+
 // src/api/auth/login.post.ts
 var LOGIN_ADDRESS_LIMIT = { limit: 10, window_seconds: 5 * 60 };
 var LOGIN_IDENTITY_LIMIT = { limit: 25, window_seconds: 15 * 60 };
@@ -88079,6 +88174,7 @@ var routeHandlers = {
   "POST:/auth/brolly-control": brolly_control_post_default,
   "GET:/auth/config": config_get_default2,
   "DELETE:/auth/current-key": current_key_delete_default,
+  "POST:/auth/exchange": exchange_post_default,
   "POST:/auth/login": login_post_default,
   "POST:/auth/logout": logout_post_default,
   "GET:/auth/me": me_get_default,