@wopr-network/platform-core 1.13.0 → 1.13.2

package/src/api/routes/secrets.ts

@@ -0,0 +1,178 @@
+import { Hono } from "hono";
+import type { AuthEnv } from "../../auth/index.js";
+import { validateTenantOwnership } from "../../auth/index.js";
+import { decrypt as defaultDecrypt, deriveInstanceKey as defaultDeriveInstanceKey } from "../../security/encryption.js";
+import {
+  forwardSecretsToInstance as defaultForwardSecrets,
+  writeEncryptedSeed as defaultWriteSeed,
+} from "../../security/key-injection.js";
+import { validateProviderKey as defaultValidateKey } from "../../security/key-validation.js";
+import { validateKeyRequestSchema, writeSecretsRequestSchema } from "../../security/types.js";
+
+/** Allowlist: only alphanumeric, hyphens, and underscores. */
+const INSTANCE_ID_RE = /^[a-zA-Z0-9_-]+$/;
+
+function isValidInstanceId(id: string): boolean {
+  return INSTANCE_ID_RE.test(id);
+}
+
+export interface IProfileLookup {
+  getInstanceTenantId(instanceId: string): Promise<string | undefined>;
+}
+
+export interface SecretsSecurityFns {
+  decrypt: typeof defaultDecrypt;
+  deriveInstanceKey: typeof defaultDeriveInstanceKey;
+  writeEncryptedSeed: typeof defaultWriteSeed;
+  forwardSecretsToInstance: typeof defaultForwardSecrets;
+  validateProviderKey: typeof defaultValidateKey;
+}
+
+export interface SecretsDeps {
+  profileLookup: IProfileLookup;
+  platformSecret?: string;
+  instanceDataDir?: string;
+  logger?: { error(msg: string, meta?: Record<string, unknown>): void };
+  /** Override security functions (useful for testing). Falls back to platform-core defaults. */
+  security?: Partial<SecretsSecurityFns>;
+}
+
+/**
+ * Create secrets management routes.
+ *
+ * @param deps - Dependencies for secret operations
+ */
+export function createSecretsRoutes(deps: SecretsDeps): Hono<AuthEnv> {
+  const routes = new Hono<AuthEnv>();
+  const instanceDataDir = deps.instanceDataDir ?? "/data/instances";
+
+  // Resolve security functions with defaults
+  const decryptFn = deps.security?.decrypt ?? defaultDecrypt;
+  const deriveInstanceKeyFn = deps.security?.deriveInstanceKey ?? defaultDeriveInstanceKey;
+  const writeEncryptedSeedFn = deps.security?.writeEncryptedSeed ?? defaultWriteSeed;
+  const forwardSecretsFn = deps.security?.forwardSecretsToInstance ?? defaultForwardSecrets;
+  const validateKeyFn = deps.security?.validateProviderKey ?? defaultValidateKey;
+
+  /**
+   * PUT /instances/:id/config/secrets
+   *
+   * Writes secrets to a running instance by forwarding the body opaquely,
+   * or writes an encrypted seed file if the instance is not running.
+   */
+  routes.put("/instances/:id/config/secrets", async (c) => {
+    const instanceId = c.req.param("id");
+    if (!isValidInstanceId(instanceId)) {
+      return c.json({ error: "Invalid instance ID" }, 400);
+    }
+
+    // Validate tenant ownership of the instance
+    const tenantId = await deps.profileLookup.getInstanceTenantId(instanceId);
+    const ownershipError = validateTenantOwnership(c, instanceId, tenantId);
+    if (ownershipError) {
+      return ownershipError;
+    }
+
+    const mode = c.req.query("mode") || "proxy";
+
+    if (mode === "seed") {
+      // Pre-boot: parse body to encrypt, then discard plaintext
+      let body: unknown;
+      try {
+        body = await c.req.json();
+      } catch {
+        return c.json({ error: "Invalid JSON body" }, 400);
+      }
+
+      const parsed = writeSecretsRequestSchema.safeParse(body);
+      if (!parsed.success) {
+        return c.json({ error: "Validation failed", details: parsed.error.flatten() }, 400);
+      }
+
+      if (!deps.platformSecret) {
+        return c.json({ error: "Platform secret not configured" }, 500);
+      }
+
+      try {
+        const instanceKey = deriveInstanceKeyFn(instanceId, deps.platformSecret);
+        const woprHome = `${instanceDataDir}/${instanceId}`;
+        await writeEncryptedSeedFn(woprHome, parsed.data, instanceKey);
+        return c.json({ ok: true, mode: "seed" });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Failed to write seed";
+        deps.logger?.error("Failed to write encrypted seed", { instanceId, error: message });
+        return c.json({ error: "Failed to write encrypted seed" }, 500);
+      }
+    }
+
+    // Default: proxy mode — forward body opaquely to the instance container
+    const rawBody = await c.req.text();
+    const instanceUrl = `http://wopr-${instanceId}:3000`;
+    const authHeader = c.req.header("Authorization") || "";
+    const sessionToken = authHeader.replace(/^Bearer\s+/i, "");
+
+    const result = await forwardSecretsFn(instanceUrl, sessionToken, rawBody);
+    if (result.ok) {
+      return c.json({ ok: true, mode: "proxy" });
+    }
+    const status = result.status === 502 ? 502 : result.status === 503 ? 503 : result.status === 404 ? 404 : 500;
+    return c.json({ error: result.error || "Proxy failed" }, status);
+  });
+
+  /**
+   * POST /validate-key
+   *
+   * Validates a provider API key without logging or persisting it.
+   */
+  routes.post("/validate-key", async (c) => {
+    let body: unknown;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ error: "Invalid JSON body" }, 400);
+    }
+
+    const parsed = validateKeyRequestSchema.safeParse(body);
+    if (!parsed.success) {
+      return c.json({ error: "Validation failed", details: parsed.error.flatten() }, 400);
+    }
+
+    const { provider, encryptedKey } = parsed.data;
+
+    // Decrypt the key in memory
+    let plaintextKey: string;
+    try {
+      const encryptedPayload = JSON.parse(encryptedKey);
+      const instanceId = c.req.query("instanceId");
+      if (!instanceId) {
+        return c.json({ error: "instanceId query parameter required" }, 400);
+      }
+      if (!isValidInstanceId(instanceId)) {
+        return c.json({ error: "Invalid instance ID" }, 400);
+      }
+
+      // Validate tenant ownership of the instance
+      const tenantId = await deps.profileLookup.getInstanceTenantId(instanceId);
+      const ownershipError = validateTenantOwnership(c, instanceId, tenantId);
+      if (ownershipError) {
+        return ownershipError;
+      }
+      if (!deps.platformSecret) {
+        return c.json({ error: "Platform secret not configured" }, 500);
+      }
+      const instanceKey = deriveInstanceKeyFn(instanceId, deps.platformSecret);
+      plaintextKey = decryptFn(encryptedPayload, instanceKey);
+    } catch {
+      return c.json({ error: "Failed to decrypt key payload" }, 400);
+    }
+
+    // Validate against the provider API
+    const result = await validateKeyFn(provider, plaintextKey);
+
+    // Explicitly discard the key reference
+    plaintextKey = "";
+
+    return c.json({ valid: result.valid, error: result.error });
+  });
+
+  return routes;
+}

package/src/api/routes/tenant-keys.ts

@@ -0,0 +1,178 @@
+import { createHmac } from "node:crypto";
+import { Hono } from "hono";
+import { z } from "zod";
+import { encrypt } from "../../security/encryption.js";
+import type { ITenantKeyRepository } from "../../security/tenant-keys/tenant-key-repository.js";
+import { providerSchema } from "../../security/types.js";
+
+// ---------------------------------------------------------------------------
+// Request schemas
+// ---------------------------------------------------------------------------
+
+const storeKeySchema = z.object({
+  provider: providerSchema,
+  apiKey: z.string().min(1, "API key is required"),
+  label: z.string().max(100).optional(),
+});
+
+// ---------------------------------------------------------------------------
+// Deps
+// ---------------------------------------------------------------------------
+
+export interface TenantKeyDeps {
+  repo: () => ITenantKeyRepository;
+  /** Platform secret for key derivation. If not provided, encrypt operations will fail with 500. */
+  platformSecret?: string;
+  logger?: { warn(msg: string): void };
+}
+
+/** Derive a per-tenant encryption key from tenant ID and platform secret. */
+function deriveTenantKey(tenantId: string, platformSecret: string): Buffer {
+  return createHmac("sha256", platformSecret).update(`tenant:${tenantId}`).digest();
+}
+
+/**
+ * Create tenant key management routes.
+ *
+ * @param deps - Dependencies for tenant key operations
+ */
+export function createTenantKeyRoutes(deps: TenantKeyDeps): Hono {
+  const routes = new Hono();
+
+  /**
+   * GET /
+   *
+   * List all API keys for the authenticated tenant.
+   * Returns metadata only (never the encrypted key material).
+   */
+  routes.get("/", async (c) => {
+    const tenantId = getTenantId(c);
+    if (!tenantId) {
+      return c.json({ error: "Tenant context required" }, 400);
+    }
+
+    const keys = await deps.repo().listForTenant(tenantId);
+    return c.json({ keys });
+  });
+
+  /**
+   * GET /:provider
+   *
+   * Check whether the tenant has a stored key for a specific provider.
+   * Returns metadata only.
+   */
+  routes.get("/:provider", async (c) => {
+    const tenantId = getTenantId(c);
+    if (!tenantId) {
+      return c.json({ error: "Tenant context required" }, 400);
+    }
+
+    const provider = c.req.param("provider");
+    const parsed = providerSchema.safeParse(provider);
+    if (!parsed.success) {
+      return c.json({ error: "Invalid provider" }, 400);
+    }
+
+    const record = await deps.repo().get(tenantId, parsed.data);
+    if (!record) {
+      return c.json({ error: "No key stored for this provider" }, 404);
+    }
+
+    // Return metadata only, never the encrypted key
+    return c.json({
+      id: record.id,
+      tenant_id: record.tenant_id,
+      provider: record.provider,
+      label: record.label,
+      created_at: record.created_at,
+      updated_at: record.updated_at,
+    });
+  });
+
+  /**
+   * PUT /:provider
+   *
+   * Store or replace a tenant's API key for a provider.
+   * The key is encrypted at rest using AES-256-GCM with a tenant-derived key.
+   */
+  routes.put("/:provider", async (c) => {
+    const tenantId = getTenantId(c);
+    if (!tenantId) {
+      return c.json({ error: "Tenant context required" }, 400);
+    }
+
+    const provider = c.req.param("provider");
+    const providerParsed = providerSchema.safeParse(provider);
+    if (!providerParsed.success) {
+      return c.json({ error: "Invalid provider" }, 400);
+    }
+
+    let body: unknown;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ error: "Invalid JSON body" }, 400);
+    }
+
+    const parsed = storeKeySchema.safeParse(body);
+    if (!parsed.success) {
+      return c.json({ error: "Validation failed", details: parsed.error.flatten() }, 400);
+    }
+
+    if (parsed.data.provider !== providerParsed.data) {
+      return c.json({ error: "Provider in body must match URL parameter" }, 400);
+    }
+
+    if (!deps.platformSecret) {
+      return c.json({ error: "Platform secret not configured" }, 500);
+    }
+
+    // Encrypt the key in memory, then discard the plaintext
+    const tenantKey = deriveTenantKey(tenantId, deps.platformSecret);
+    const encryptedPayload = encrypt(parsed.data.apiKey, tenantKey);
+
+    const id = await deps.repo().upsert(tenantId, providerParsed.data, encryptedPayload, parsed.data.label ?? "");
+
+    return c.json({ ok: true, id, provider: providerParsed.data });
+  });
+
+  /**
+   * DELETE /:provider
+   *
+   * Delete a tenant's stored API key for a provider.
+   */
+  routes.delete("/:provider", async (c) => {
+    const tenantId = getTenantId(c);
+    if (!tenantId) {
+      return c.json({ error: "Tenant context required" }, 400);
+    }
+
+    const provider = c.req.param("provider");
+    const parsed = providerSchema.safeParse(provider);
+    if (!parsed.success) {
+      return c.json({ error: "Invalid provider" }, 400);
+    }
+
+    const deleted = await deps.repo().delete(tenantId, parsed.data);
+    if (!deleted) {
+      return c.json({ error: "No key stored for this provider" }, 404);
+    }
+
+    return c.json({ ok: true, provider: parsed.data });
+  });
+
+  return routes;
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** Extract the tenant ID from the auth context. */
+function getTenantId(c: { get: (key: string) => unknown }): string | undefined {
+  try {
+    return c.get("tokenTenantId") as string | undefined;
+  } catch {
+    return undefined;
+  }
+}

package/src/api/routes/verify-email.ts

@@ -0,0 +1,102 @@
+import { Hono } from "hono";
+import type { Pool } from "pg";
+import { logger } from "../../config/logger.js";
+import type { ICreditLedger } from "../../credits/index.js";
+import { grantSignupCredits } from "../../credits/index.js";
+import { getEmailClient } from "../../email/client.js";
+import { verifyToken, welcomeTemplate } from "../../email/index.js";
+
+export interface VerifyEmailRouteDeps {
+  pool: Pool;
+  creditLedger: ICreditLedger;
+}
+
+export interface VerifyEmailRouteConfig {
+  /** UI origin for redirect URLs (default: http://localhost:3001) */
+  uiOrigin?: string;
+}
+
+/**
+ * Create verify-email routes with explicit dependencies (for testing).
+ */
+export function createVerifyEmailRoutes(deps: VerifyEmailRouteDeps, config?: VerifyEmailRouteConfig): Hono {
+  return buildRoutes(
+    () => deps.pool,
+    () => deps.creditLedger,
+    config,
+  );
+}
+
+/**
+ * Create verify-email routes with factory functions (for lazy init).
+ */
+export function createVerifyEmailRoutesLazy(
+  poolFactory: () => Pool,
+  creditLedgerFactory: () => ICreditLedger,
+  config?: VerifyEmailRouteConfig,
+): Hono {
+  return buildRoutes(poolFactory, creditLedgerFactory, config);
+}
+
+function buildRoutes(
+  poolFactory: () => Pool,
+  creditLedgerFactory: () => ICreditLedger,
+  config?: VerifyEmailRouteConfig,
+): Hono {
+  const uiOrigin = config?.uiOrigin ?? process.env.UI_ORIGIN ?? "http://localhost:3001";
+  const routes = new Hono();
+
+  routes.get("/verify", async (c) => {
+    const token = c.req.query("token");
+
+    if (!token) {
+      return c.redirect(`${uiOrigin}/auth/verify?status=error&reason=missing_token`);
+    }
+
+    const pool = poolFactory();
+    const result = await verifyToken(pool, token);
+
+    if (!result) {
+      return c.redirect(`${uiOrigin}/auth/verify?status=error&reason=invalid_or_expired`);
+    }
+
+    // Grant $5 signup credit (idempotent — safe on link re-click)
+    try {
+      const ledger = creditLedgerFactory();
+      const granted = await grantSignupCredits(ledger, result.userId);
+      if (granted) {
+        logger.info("Signup credit granted", { userId: result.userId });
+      } else {
+        logger.info("Signup credit already granted, skipping", { userId: result.userId });
+      }
+    } catch (err) {
+      logger.error("Failed to grant signup credit", {
+        userId: result.userId,
+        error: err instanceof Error ? err.message : String(err),
+      });
+      // Don't block verification if credit grant fails
+    }
+
+    // Send welcome email
+    try {
+      const emailClient = getEmailClient();
+      const template = welcomeTemplate(result.email);
+      await emailClient.send({
+        to: result.email,
+        ...template,
+        userId: result.userId,
+        templateName: "welcome",
+      });
+    } catch (err) {
+      logger.error("Failed to send welcome email", {
+        userId: result.userId,
+        error: err instanceof Error ? err.message : String(err),
+      });
+      // Don't block verification if welcome email fails
+    }
+
+    return c.redirect(`${uiOrigin}/auth/verify?status=success`);
+  });
+
+  return routes;
+}

package/src/api/routes/ws-auth.ts

@@ -0,0 +1,44 @@
+export interface WsAuthRequest {
+  nodeId: string;
+  authHeader: string | undefined;
+}
+
+export interface WsAuthResult {
+  authenticated: boolean;
+  nodeId?: string;
+  reason?: string;
+}
+
+export interface NodeSecretVerifier {
+  verifyNodeSecret(nodeId: string, secret: string): Promise<boolean | null>;
+}
+
+/**
+ * Authenticate a WebSocket upgrade request for a node agent connection.
+ *
+ * The bearer token resolves to a specific node via per-node persistent secret;
+ * the resolved nodeId must match the URL nodeId.
+ *
+ * @param verifier - object with verifyNodeSecret method (typically a node repository)
+ */
+export async function authenticateWebSocketUpgrade(
+  req: WsAuthRequest,
+  verifier: NodeSecretVerifier,
+): Promise<WsAuthResult> {
+  const { nodeId, authHeader } = req;
+  const bearer = authHeader?.replace(/^Bearer\s+/i, "");
+
+  // Per-node persistent secret — timing-safe comparison via verifyNodeSecret
+  if (bearer) {
+    const verified = await verifier.verifyNodeSecret(nodeId, bearer);
+    if (verified === true) {
+      return { authenticated: true, nodeId };
+    }
+  }
+
+  // No valid auth
+  if (!bearer) {
+    return { authenticated: false, reason: "unauthorized" };
+  }
+  return { authenticated: false, reason: "unauthorized" };
+}