@way_marks/server 0.9.0 → 1.0.0

package/dist/api/server.js

@@ -41,8 +41,11 @@ const express_1 = __importDefault(require("express"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const database_1 = require("../db/database");
+const manager_1 = require("../rollback/manager");
 const engine_1 = require("../policies/engine");
 const handler_1 = require("../approvals/handler");
+const manager_2 = require("../approval/manager");
+const manager_3 = require("../escalation/manager");
 // Import registry for Phase 2 hub navigation
 const registryPath = path.join(process.env.HOME || process.env.USERPROFILE || '', '.waymark', 'registry.json');
 function getRegistryProjects() {
@@ -317,6 +320,104 @@ app.get('/api/sessions', (req, res) => {
         res.status(500).json({ error: err.message });
     }
 });
+// Phase 1: GET /api/sessions/:session_id — get session details
+app.get('/api/sessions/:session_id', (req, res) => {
+    try {
+        const { session_id } = req.params;
+        const session = (0, database_1.getSession)(session_id);
+        if (!session) {
+            return res.status(404).json({ error: `Session ${session_id} not found` });
+        }
+        res.json(session);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// Phase 1: GET /api/sessions/:session_id/actions — get all actions in session
+app.get('/api/sessions/:session_id/actions', (req, res) => {
+    try {
+        const { session_id } = req.params;
+        const actions = (0, database_1.getSessionActions)(session_id);
+        res.json({
+            session_id,
+            action_count: actions.length,
+            actions,
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// Phase 1: POST /api/sessions/:session_id/rollback — rollback entire session
+app.post('/api/sessions/:session_id/rollback', (req, res) => {
+    try {
+        const { session_id } = req.params;
+        // Get session
+        const session = (0, database_1.getSession)(session_id);
+        if (!session) {
+            return res.status(404).json({ error: `Session ${session_id} not found` });
+        }
+        // Prevent rolling back already rolled back sessions
+        if (session.status === 'rolled_back') {
+            return res.status(400).json({ error: 'Session already rolled back' });
+        }
+        // Get all actions in session
+        const actions = (0, database_1.getSessionActions)(session_id);
+        if (actions.length === 0) {
+            return res.status(400).json({ error: 'Session has no actions to rollback' });
+        }
+        // Validate all actions are reversible
+        const validation = (0, manager_1.validateRollbackable)(actions);
+        if (!validation.isValid) {
+            return res.status(400).json({
+                error: 'Cannot rollback session',
+                validation,
+            });
+        }
+        // Create and execute rollback transaction
+        const transaction = (0, manager_1.createRollbackTransaction)(session_id, actions);
+        const result = (0, manager_1.executeRollbackTransaction)(transaction);
+        if (!result.success) {
+            return res.status(500).json({
+                error: result.error,
+                message: 'Rollback failed',
+            });
+        }
+        res.json({
+            success: true,
+            message: `Rolled back session ${session_id}`,
+            actions_rolled_back: actions.length,
+            files_restored: result.filesRestored,
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// Phase 1: GET /api/sessions/:session_id/status — check rollback status
+app.get('/api/sessions/:session_id/status', (req, res) => {
+    try {
+        const { session_id } = req.params;
+        const session = (0, database_1.getSession)(session_id);
+        if (!session) {
+            return res.status(404).json({ error: `Session ${session_id} not found` });
+        }
+        const actions = (0, database_1.getSessionActions)(session_id);
+        const rolledBackCount = actions.filter((a) => a.rolled_back === 1).length;
+        res.json({
+            session_id,
+            status: session.status,
+            total_actions: actions.length,
+            rolled_back_actions: rolledBackCount,
+            rolled_back_at: session.rolled_back_at,
+            is_rolled_back: session.status === 'rolled_back',
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
 // GET /api/config
 app.get('/api/config', (req, res) => {
     try {
@@ -360,6 +461,503 @@ app.post('/api/registry/cleanup', (req, res) => {
         res.status(500).json({ error: err.message });
     }
 });
+// ============================================================================
+// PHASE 2: Team Approval Routing Endpoints
+// ============================================================================
+// GET /api/team/members — list all team members
+app.get('/api/team/members', (req, res) => {
+    try {
+        const members = (0, database_1.getAllTeamMembers)();
+        res.json(members);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// POST /api/team/members — add team member
+app.post('/api/team/members', (req, res) => {
+    try {
+        const { member_id, name, email, slack_id } = req.body;
+        const added_by = req.body.added_by || 'system';
+        if (!member_id || !name || !email) {
+            return res.status(400).json({ error: 'Missing required fields: member_id, name, email' });
+        }
+        // Check if email already exists
+        const existing = (0, database_1.getAllTeamMembers)().find(m => m.email === email);
+        if (existing) {
+            return res.status(400).json({ error: `Email ${email} already in use` });
+        }
+        (0, database_1.addTeamMember)(member_id, name, email, added_by, slack_id);
+        res.json({ success: true, member_id, message: `Added team member: ${name}` });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// DELETE /api/team/members/:member_id — remove team member
+app.delete('/api/team/members/:member_id', (req, res) => {
+    try {
+        const { member_id } = req.params;
+        const member = (0, database_1.getTeamMember)(member_id);
+        if (!member) {
+            return res.status(404).json({ error: `Team member ${member_id} not found` });
+        }
+        (0, database_1.removeTeamMember)(member_id);
+        res.json({ success: true, message: `Removed team member: ${member.name}` });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// GET /api/approval-routes — list all approval routing rules
+app.get('/api/approval-routes', (req, res) => {
+    try {
+        const routes = (0, database_1.getAllApprovalRoutes)();
+        res.json(routes);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// POST /api/approval-routes — create approval routing rule
+app.post('/api/approval-routes', (req, res) => {
+    try {
+        const { route_id, name, approver_ids, description, condition_type, condition_json } = req.body;
+        const created_by = req.body.created_by || 'system';
+        if (!route_id || !name || !Array.isArray(approver_ids) || approver_ids.length === 0) {
+            return res.status(400).json({ error: 'Missing required fields: route_id, name, approver_ids (array)' });
+        }
+        (0, database_1.addApprovalRoute)(route_id, name, approver_ids, created_by, description, condition_type, condition_json);
+        res.json({ success: true, route_id, message: `Created approval route: ${name}` });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// PUT /api/approval-routes/:route_id — update approval routing rule
+app.put('/api/approval-routes/:route_id', (req, res) => {
+    try {
+        const { route_id } = req.params;
+        const { name, description, approver_ids } = req.body;
+        const route = (0, database_1.getApprovalRoute)(route_id);
+        if (!route) {
+            return res.status(404).json({ error: `Approval route ${route_id} not found` });
+        }
+        (0, database_1.updateApprovalRoute)(route_id, { name, description, approver_ids });
+        res.json({ success: true, message: `Updated approval route: ${route_id}` });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// DELETE /api/approval-routes/:route_id — delete approval routing rule
+app.delete('/api/approval-routes/:route_id', (req, res) => {
+    try {
+        const { route_id } = req.params;
+        const route = (0, database_1.getApprovalRoute)(route_id);
+        if (!route) {
+            return res.status(404).json({ error: `Approval route ${route_id} not found` });
+        }
+        (0, database_1.deleteApprovalRoute)(route_id);
+        res.json({ success: true, message: `Deleted approval route: ${route_id}` });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// GET /api/approvals/pending — get pending approvals for current user
+app.get('/api/approvals/pending', (req, res) => {
+    try {
+        const approver_id = req.query.approver_id;
+        const pending = (0, database_1.getPendingApprovals)(approver_id);
+        res.json(pending);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// GET /api/approvals/:request_id — get approval request details and status
+app.get('/api/approvals/:request_id', (req, res) => {
+    try {
+        const { request_id } = req.params;
+        const request = (0, database_1.getApprovalRequest)(request_id);
+        if (!request) {
+            return res.status(404).json({ error: `Approval request ${request_id} not found` });
+        }
+        try {
+            const status = (0, manager_2.getApprovalStatus)(request_id);
+            res.json({
+                request,
+                status,
+            });
+        }
+        catch (err) {
+            res.json({ request, status_error: err.message });
+        }
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// POST /api/approvals/:request_id/approve — submit approval decision
+app.post('/api/approvals/:request_id/approve', (req, res) => {
+    try {
+        const { request_id } = req.params;
+        const { approver_id, reason } = req.body;
+        if (!approver_id) {
+            return res.status(400).json({ error: 'Missing required field: approver_id' });
+        }
+        const status = (0, manager_2.submitApprovalDecision)(request_id, approver_id, 'approve', reason);
+        res.json({
+            success: true,
+            message: `Approved by ${approver_id}`,
+            status,
+        });
+    }
+    catch (err) {
+        res.status(400).json({ error: err.message });
+    }
+});
+// POST /api/approvals/:request_id/reject — submit rejection decision
+app.post('/api/approvals/:request_id/reject', (req, res) => {
+    try {
+        const { request_id } = req.params;
+        const { approver_id, reason } = req.body;
+        if (!approver_id) {
+            return res.status(400).json({ error: 'Missing required field: approver_id' });
+        }
+        const status = (0, manager_2.submitApprovalDecision)(request_id, approver_id, 'reject', reason);
+        res.json({
+            success: true,
+            message: `Rejected by ${approver_id}`,
+            status,
+        });
+    }
+    catch (err) {
+        res.status(400).json({ error: err.message });
+    }
+});
+// GET /api/approvals/history/:session_id — get approval history for session
+app.get('/api/approvals/history/:session_id', (req, res) => {
+    try {
+        const { session_id } = req.params;
+        const requests = (0, database_1.getSessionApprovalRequests)(session_id);
+        res.json({
+            session_id,
+            approval_requests: requests,
+            total: requests.length,
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// ============================================================================
+// PHASE 3: Approval Escalation Endpoints
+// ============================================================================
+// GET /api/escalations/rules — list all escalation rules
+app.get('/api/escalations/rules', (req, res) => {
+    try {
+        const rules = (0, database_1.getAllEscalationRules)();
+        res.json(rules);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// POST /api/escalations/rules — create escalation rule
+app.post('/api/escalations/rules', (req, res) => {
+    try {
+        const { rule_id, name, escalation_targets, description, timeout_hours } = req.body;
+        const created_by = req.body.created_by || 'system';
+        if (!rule_id || !name || !Array.isArray(escalation_targets) || escalation_targets.length === 0) {
+            return res.status(400).json({ error: 'Missing required fields: rule_id, name, escalation_targets (array)' });
+        }
+        (0, database_1.addEscalationRule)(rule_id, name, escalation_targets, created_by, description, timeout_hours);
+        res.json({ success: true, rule_id, message: `Created escalation rule: ${name}` });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// PUT /api/escalations/rules/:rule_id — update escalation rule
+app.put('/api/escalations/rules/:rule_id', (req, res) => {
+    try {
+        const { rule_id } = req.params;
+        const { name, description, escalation_targets, timeout_hours } = req.body;
+        const rule = (0, database_1.getEscalationRule)(rule_id);
+        if (!rule) {
+            return res.status(404).json({ error: `Escalation rule ${rule_id} not found` });
+        }
+        (0, database_1.updateEscalationRule)(rule_id, { name, description, escalation_targets, timeout_hours });
+        res.json({ success: true, message: `Updated escalation rule: ${rule_id}` });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// DELETE /api/escalations/rules/:rule_id — delete escalation rule
+app.delete('/api/escalations/rules/:rule_id', (req, res) => {
+    try {
+        const { rule_id } = req.params;
+        const rule = (0, database_1.getEscalationRule)(rule_id);
+        if (!rule) {
+            return res.status(404).json({ error: `Escalation rule ${rule_id} not found` });
+        }
+        (0, database_1.deleteEscalationRule)(rule_id);
+        res.json({ success: true, message: `Deleted escalation rule: ${rule_id}` });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// GET /api/escalations/pending — get pending escalations
+app.get('/api/escalations/pending', (req, res) => {
+    try {
+        const pending = (0, database_1.getPendingEscalations)();
+        res.json(pending);
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// GET /api/escalations/:request_id — get escalation details and status
+app.get('/api/escalations/:request_id', (req, res) => {
+    try {
+        const { request_id } = req.params;
+        const request = (0, database_1.getEscalationRequest)(request_id);
+        if (!request) {
+            return res.status(404).json({ error: `Escalation request ${request_id} not found` });
+        }
+        try {
+            const status = (0, manager_3.getEscalationStatus)(request_id);
+            res.json({
+                request,
+                status,
+            });
+        }
+        catch (err) {
+            res.json({ request, status_error: err.message });
+        }
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// POST /api/escalations/:request_id/decide — submit escalation decision
+app.post('/api/escalations/:request_id/decide', (req, res) => {
+    try {
+        const { request_id } = req.params;
+        const { target_id, decision, reason } = req.body;
+        if (!target_id || !decision) {
+            return res.status(400).json({ error: 'Missing required fields: target_id, decision' });
+        }
+        if (!['proceed', 'block'].includes(decision)) {
+            return res.status(400).json({ error: 'Decision must be "proceed" or "block"' });
+        }
+        const status = (0, manager_3.submitEscalationDecision)(request_id, target_id, decision, reason);
+        res.json({
+            success: true,
+            message: `${target_id} decided to ${decision}`,
+            status,
+        });
+    }
+    catch (err) {
+        res.status(400).json({ error: err.message });
+    }
+});
+// GET /api/escalations/history/:session_id — get escalation history for session
+app.get('/api/escalations/history/:session_id', (req, res) => {
+    try {
+        const { session_id } = req.params;
+        const history = (0, manager_3.getEscalationHistoryForSession)(session_id);
+        res.json({
+            session_id,
+            escalation_requests: history,
+            total: history.length,
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// ============================================================================
+// Phase 4: Remediation Endpoints
+// ============================================================================
+// POST /api/remediation/assess — analyze risk of session
+app.post('/api/remediation/assess', (req, res) => {
+    try {
+        const { session_id } = req.body;
+        if (!session_id) {
+            return res.status(400).json({ error: 'Missing required field: session_id' });
+        }
+        // Get session and actions
+        const session = (0, database_1.getSession)(session_id);
+        if (!session) {
+            return res.status(404).json({ error: `Session ${session_id} not found` });
+        }
+        const actions = (0, database_1.getSessionActions)(session_id);
+        // Note: In production, would import and use actual Risk Assessment Engine
+        // For now, return placeholder
+        res.json({
+            session_id,
+            action_count: actions.length,
+            risk_assessment: {
+                score: 5.0,
+                level: 'medium',
+                message: 'Risk assessment module available in Phase 4A implementation',
+            },
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// POST /api/remediation/evaluate-policy — check policy compliance
+app.post('/api/remediation/evaluate-policy', (req, res) => {
+    try {
+        const { session_id } = req.body;
+        if (!session_id) {
+            return res.status(400).json({ error: 'Missing required field: session_id' });
+        }
+        // Get session and actions
+        const session = (0, database_1.getSession)(session_id);
+        if (!session) {
+            return res.status(404).json({ error: `Session ${session_id} not found` });
+        }
+        res.json({
+            session_id,
+            violations: [],
+            message: 'Policy evaluation module available in Phase 4B implementation',
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// POST /api/remediation/recommend — get remediation strategies
+app.post('/api/remediation/recommend', (req, res) => {
+    try {
+        const { session_id } = req.body;
+        if (!session_id) {
+            return res.status(400).json({ error: 'Missing required field: session_id' });
+        }
+        // Get session and actions
+        const session = (0, database_1.getSession)(session_id);
+        if (!session) {
+            return res.status(404).json({ error: `Session ${session_id} not found` });
+        }
+        res.json({
+            session_id,
+            recommendations: {
+                primary_strategy: 'escalation',
+                alternatives: [],
+                message: 'Remediation recommender available in Phase 4C implementation',
+            },
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// GET /api/remediation/blocks — list blocked sessions
+app.get('/api/remediation/blocks', (req, res) => {
+    try {
+        res.json({
+            blocks: [],
+            total: 0,
+            message: 'Auto-block storage available in Phase 4D implementation',
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// POST /api/remediation/blocks/:block_id/unblock — admin override
+app.post('/api/remediation/blocks/:block_id/unblock', (req, res) => {
+    try {
+        const { block_id } = req.params;
+        const { reason } = req.body;
+        // Check admin role (placeholder)
+        const isAdmin = req.headers['x-user-role'] === 'admin';
+        if (!isAdmin) {
+            return res.status(401).json({ error: 'Admin role required to override blocks' });
+        }
+        res.json({
+            block_id,
+            unblocked: true,
+            unblock_reason: reason,
+            message: 'Block override recorded',
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// GET /api/remediation/policies — list active policies
+app.get('/api/remediation/policies', (req, res) => {
+    try {
+        res.json({
+            policies: [],
+            total: 0,
+            message: 'Policy storage available in Phase 4B implementation',
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// POST /api/remediation/policies — create policy
+app.post('/api/remediation/policies', (req, res) => {
+    try {
+        const { name, description, category, rules } = req.body;
+        if (!name || !category) {
+            return res.status(400).json({ error: 'Missing required fields: name, category' });
+        }
+        res.status(201).json({
+            policy_id: `policy-${Date.now()}`,
+            name,
+            description,
+            category,
+            rules: rules || [],
+            enabled: true,
+            created_at: new Date().toISOString(),
+            message: 'Policy creation implemented in Phase 4B',
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// PUT /api/remediation/policies/:policy_id — update policy
+app.put('/api/remediation/policies/:policy_id', (req, res) => {
+    try {
+        const { policy_id } = req.params;
+        const { name, description, enabled, rules } = req.body;
+        res.json({
+            policy_id,
+            name,
+            description,
+            enabled,
+            rules,
+            updated_at: new Date().toISOString(),
+            message: 'Policy update implemented in Phase 4B',
+        });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// DELETE /api/remediation/policies/:policy_id — delete policy
+app.delete('/api/remediation/policies/:policy_id', (req, res) => {
+    try {
+        const { policy_id } = req.params;
+        res.status(204).send();
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
 // Fallback: serve UI for any unmatched route
 app.get('*', (req, res) => {
     res.sendFile(path.join(UI_DIR, 'index.html'));