agent-relay 1.2.0 → 1.3.0

package/dist/cloud/api/repos.js

@@ -2,10 +2,62 @@
  * Repos API Routes
  *
  * GitHub repository management - list, import, sync.
+ * Includes Nango-based GitHub permission checking for dashboard access control.
  */
+import crypto from 'crypto';
 import { Router } from 'express';
 import { requireAuth } from './auth.js';
 import { db } from '../db/index.js';
+import { nangoService } from '../services/nango.js';
+import { getConfig } from '../config.js';
+/**
+ * Generate workspace token for API calls to workspace containers
+ */
+function generateWorkspaceToken(workspaceId) {
+    const config = getConfig();
+    return crypto
+        .createHmac('sha256', config.sessionSecret)
+        .update(`workspace:${workspaceId}`)
+        .digest('hex');
+}
+/**
+ * Call workspace API endpoint
+ */
+async function callWorkspaceApi(publicUrl, workspaceId, method, endpoint, body) {
+    const token = generateWorkspaceToken(workspaceId);
+    const url = `${publicUrl.replace(/\/$/, '')}${endpoint}`;
+    try {
+        const response = await fetch(url, {
+            method,
+            headers: {
+                'Content-Type': 'application/json',
+                'Authorization': `Bearer ${token}`,
+            },
+            body: body ? JSON.stringify(body) : undefined,
+        });
+        const data = await response.json().catch((parseError) => {
+            console.error('Failed to parse JSON from workspace response', {
+                url,
+                status: response.status,
+                error: parseError instanceof Error ? parseError.message : parseError,
+            });
+            return null;
+        });
+        return {
+            ok: response.ok,
+            status: response.status,
+            data,
+            error: response.ok ? undefined : (data?.error || `HTTP ${response.status}`),
+        };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            status: 0,
+            error: err instanceof Error ? err.message : 'Network error',
+        };
+    }
+}
 export const reposRouter = Router();
 // All routes require authentication
 reposRouter.use(requireAuth);
@@ -187,6 +239,228 @@ reposRouter.post('/bulk', async (req, res) => {
         results,
     });
 });
+/**
+ * GET /api/repos/accessible
+ * List all GitHub repositories the authenticated user has access to.
+ * Uses Nango proxy with user's GitHub OAuth token.
+ */
+reposRouter.get('/accessible', async (req, res) => {
+    const userId = req.session.userId;
+    const { page, perPage, type, sort } = req.query;
+    try {
+        // Get user's Nango connection ID
+        const user = await db.users.findById(userId);
+        if (!user) {
+            return res.status(404).json({ error: 'User not found' });
+        }
+        if (!user.nangoConnectionId) {
+            return res.status(400).json({
+                error: 'GitHub not connected via Nango',
+                code: 'NANGO_NOT_CONNECTED',
+                message: 'Please reconnect your GitHub account',
+            });
+        }
+        // List accessible repos via Nango proxy
+        const result = await nangoService.listUserAccessibleRepos(user.nangoConnectionId, {
+            page: page ? parseInt(page, 10) : undefined,
+            perPage: perPage ? Math.min(parseInt(perPage, 10), 100) : undefined,
+            type: type,
+            sort: sort,
+        });
+        res.json({
+            repositories: result.repositories,
+            pagination: {
+                page: page ? parseInt(page, 10) : 1,
+                perPage: perPage ? Math.min(parseInt(perPage, 10), 100) : 100,
+                hasMore: result.hasMore,
+            },
+            checkedBy: {
+                userId: user.id,
+                githubUsername: user.githubUsername,
+            },
+        });
+    }
+    catch (error) {
+        console.error('Error listing accessible repos:', error);
+        res.status(500).json({ error: 'Failed to list accessible repositories' });
+    }
+});
+/**
+ * GET /api/repos/search
+ * Search GitHub repos by name
+ */
+reposRouter.get('/search', async (req, res) => {
+    const githubToken = req.session.githubToken;
+    const { q } = req.query;
+    if (!q || typeof q !== 'string') {
+        return res.status(400).json({ error: 'Search query (q) is required' });
+    }
+    if (!githubToken) {
+        return res.status(401).json({ error: 'GitHub not connected' });
+    }
+    try {
+        // Search user's repos
+        const response = await fetch(`https://api.github.com/search/repositories?q=${encodeURIComponent(q)}+user:@me&sort=updated&per_page=20`, {
+            headers: {
+                Authorization: `Bearer ${githubToken}`,
+                Accept: 'application/vnd.github.v3+json',
+            },
+        });
+        if (!response.ok) {
+            throw new Error('GitHub search failed');
+        }
+        const data = await response.json();
+        res.json({
+            repositories: data.items.map((r) => ({
+                githubId: r.id,
+                fullName: r.full_name,
+                name: r.name,
+                owner: r.owner.login,
+                description: r.description,
+                defaultBranch: r.default_branch,
+                isPrivate: r.private,
+                language: r.language,
+            })),
+            total: data.total_count,
+        });
+    }
+    catch (error) {
+        console.error('Error searching repos:', error);
+        res.status(500).json({ error: 'Failed to search repositories' });
+    }
+});
+// ============================================================================
+// Nango-based GitHub Permission APIs (for dashboard access control)
+// ============================================================================
+/**
+ * GET /api/repos/check-access/:owner/:repo
+ * Check if authenticated user has access to a specific GitHub repository.
+ * Uses Nango proxy with user's GitHub OAuth token.
+ *
+ * Response:
+ * - hasAccess: boolean - Whether user can access this repo
+ * - permission: 'admin' | 'write' | 'read' | 'none' - User's permission level
+ * - repository: Repository details if user has access
+ *
+ * Use this for dashboard access control - grant access if hasAccess is true.
+ */
+reposRouter.get('/check-access/:owner/:repo', async (req, res) => {
+    const userId = req.session.userId;
+    const { owner, repo } = req.params;
+    if (!owner || !repo) {
+        return res.status(400).json({ error: 'Owner and repo parameters are required' });
+    }
+    try {
+        // Get user's Nango connection ID
+        const user = await db.users.findById(userId);
+        if (!user) {
+            return res.status(404).json({ error: 'User not found' });
+        }
+        if (!user.nangoConnectionId) {
+            return res.status(400).json({
+                error: 'GitHub not connected via Nango',
+                code: 'NANGO_NOT_CONNECTED',
+                message: 'Please reconnect your GitHub account',
+            });
+        }
+        // Check access via Nango proxy
+        const accessResult = await nangoService.checkUserRepoAccess(user.nangoConnectionId, owner, repo);
+        res.json({
+            hasAccess: accessResult.hasAccess,
+            permission: accessResult.permission,
+            repository: accessResult.repository,
+            // Include user info for dashboard context
+            checkedBy: {
+                userId: user.id,
+                githubUsername: user.githubUsername,
+            },
+        });
+    }
+    catch (error) {
+        console.error('Error checking repo access:', error);
+        res.status(500).json({ error: 'Failed to check repository access' });
+    }
+});
+/**
+ * POST /api/repos/check-access-bulk
+ * Check access to multiple repositories at once.
+ * Useful for determining which workspaces a user can view.
+ *
+ * Body:
+ * - repositories: Array of "owner/repo" strings
+ *
+ * Response:
+ * - results: Array of { fullName, hasAccess, permission }
+ */
+reposRouter.post('/check-access-bulk', async (req, res) => {
+    const userId = req.session.userId;
+    const { repositories } = req.body;
+    if (!repositories || !Array.isArray(repositories)) {
+        return res.status(400).json({ error: 'repositories array is required' });
+    }
+    if (repositories.length > 50) {
+        return res.status(400).json({ error: 'Maximum 50 repositories per request' });
+    }
+    try {
+        // Get user's Nango connection ID
+        const user = await db.users.findById(userId);
+        if (!user) {
+            return res.status(404).json({ error: 'User not found' });
+        }
+        if (!user.nangoConnectionId) {
+            return res.status(400).json({
+                error: 'GitHub not connected via Nango',
+                code: 'NANGO_NOT_CONNECTED',
+                message: 'Please reconnect your GitHub account',
+            });
+        }
+        // Check access for each repo (in parallel with concurrency limit)
+        const results = [];
+        // Process in batches of 10 to avoid rate limiting
+        const batchSize = 10;
+        for (let i = 0; i < repositories.length; i += batchSize) {
+            const batch = repositories.slice(i, i + batchSize);
+            const batchResults = await Promise.all(batch.map(async (fullName) => {
+                try {
+                    const [owner, repo] = fullName.split('/');
+                    if (!owner || !repo) {
+                        return { fullName, hasAccess: false, error: 'Invalid repository format' };
+                    }
+                    const accessResult = await nangoService.checkUserRepoAccess(user.nangoConnectionId, owner, repo);
+                    return {
+                        fullName,
+                        hasAccess: accessResult.hasAccess,
+                        permission: accessResult.permission,
+                    };
+                }
+                catch (_err) {
+                    return { fullName, hasAccess: false, error: 'Check failed' };
+                }
+            }));
+            results.push(...batchResults);
+        }
+        const accessibleCount = results.filter(r => r.hasAccess).length;
+        res.json({
+            results,
+            summary: {
+                total: repositories.length,
+                accessible: accessibleCount,
+                denied: repositories.length - accessibleCount,
+            },
+            checkedBy: {
+                userId: user.id,
+                githubUsername: user.githubUsername,
+            },
+        });
+    }
+    catch (error) {
+        console.error('Error checking bulk repo access:', error);
+        res.status(500).json({ error: 'Failed to check repository access' });
+    }
+});
+// ============================================================================
+// WILDCARD ROUTES BELOW - All specific routes must be defined ABOVE this line
+// ============================================================================
 /**
  * GET /api/repos/:id
  * Get repository details
@@ -219,6 +493,9 @@ reposRouter.get('/:id', async (req, res) => {
 /**
  * POST /api/repos/:id/sync
  * Trigger repository sync (clone/pull to workspace)
+ *
+ * Calls the workspace's /repos/sync API endpoint to clone or update the repo.
+ * This enables dynamic repo management without workspace restart.
  */
 reposRouter.post('/:id/sync', async (req, res) => {
     const userId = req.session.userId;
@@ -232,14 +509,43 @@ reposRouter.post('/:id/sync', async (req, res) => {
         if (!repo.workspaceId) {
             return res.status(400).json({ error: 'Repository not assigned to a workspace' });
         }
+        // Get the workspace to find its public URL
+        const workspace = await db.workspaces.findById(repo.workspaceId);
+        if (!workspace) {
+            return res.status(404).json({ error: 'Workspace not found' });
+        }
+        if (workspace.status !== 'running') {
+            return res.status(400).json({
+                error: 'Workspace is not running',
+                workspaceStatus: workspace.status,
+            });
+        }
+        if (!workspace.publicUrl) {
+            return res.status(400).json({ error: 'Workspace has no public URL' });
+        }
         // Update sync status
         await db.repositories.updateSyncStatus(id, 'syncing');
-        // In production, this would trigger the workspace to pull the repo
-        // For now, simulate success after a short delay
-        setTimeout(async () => {
+        // Call the workspace's repo sync API
+        const result = await callWorkspaceApi(workspace.publicUrl, workspace.id, 'POST', '/repos/sync', { repo: repo.githubFullName });
+        if (result.ok) {
+            // Update sync status to synced
             await db.repositories.updateSyncStatus(id, 'synced', new Date());
-        }, 2000);
-        res.json({ message: 'Sync started', syncStatus: 'syncing' });
+            res.json({
+                message: 'Repository synced successfully',
+                syncStatus: 'synced',
+                result: result.data,
+            });
+        }
+        else {
+            // Update sync status to error
+            await db.repositories.updateSyncStatus(id, 'error');
+            console.error('Workspace sync failed:', result.error);
+            res.status(502).json({
+                error: 'Failed to sync repository to workspace',
+                details: result.error,
+                syncStatus: 'error',
+            });
+        }
     }
     catch (error) {
         console.error('Error syncing repo:', error);
@@ -267,48 +573,4 @@ reposRouter.delete('/:id', async (req, res) => {
         res.status(500).json({ error: 'Failed to delete repository' });
     }
 });
-/**
- * GET /api/repos/search
- * Search GitHub repos by name
- */
-reposRouter.get('/search', async (req, res) => {
-    const githubToken = req.session.githubToken;
-    const { q } = req.query;
-    if (!q || typeof q !== 'string') {
-        return res.status(400).json({ error: 'Search query (q) is required' });
-    }
-    if (!githubToken) {
-        return res.status(401).json({ error: 'GitHub not connected' });
-    }
-    try {
-        // Search user's repos
-        const response = await fetch(`https://api.github.com/search/repositories?q=${encodeURIComponent(q)}+user:@me&sort=updated&per_page=20`, {
-            headers: {
-                Authorization: `Bearer ${githubToken}`,
-                Accept: 'application/vnd.github.v3+json',
-            },
-        });
-        if (!response.ok) {
-            throw new Error('GitHub search failed');
-        }
-        const data = await response.json();
-        res.json({
-            repositories: data.items.map((r) => ({
-                githubId: r.id,
-                fullName: r.full_name,
-                name: r.name,
-                owner: r.owner.login,
-                description: r.description,
-                defaultBranch: r.default_branch,
-                isPrivate: r.private,
-                language: r.language,
-            })),
-            total: data.total_count,
-        });
-    }
-    catch (error) {
-        console.error('Error searching repos:', error);
-        res.status(500).json({ error: 'Failed to search repositories' });
-    }
-});
 //# sourceMappingURL=repos.js.map

package/dist/cloud/api/test-helpers.js

@@ -227,6 +227,46 @@ testHelpersRouter.post('/create-mock-repo', async (req, res) => {
         res.status(500).json({ error: 'Failed to create mock repo' });
     }
 });
+/**
+ * GET /api/test/auto-login
+ * Browser-friendly auto-login - visit this URL to login and redirect
+ * Usage: /api/test/auto-login?redirect=/providers/setup/claude?workspace=xxx
+ */
+testHelpersRouter.get('/auto-login', async (req, res) => {
+    if (!isTestMode) {
+        return res.status(403).json({ error: 'Test endpoints disabled in production' });
+    }
+    try {
+        const db = getDb();
+        const redirect = req.query.redirect || '/app';
+        // Find or create test user
+        let user;
+        const existingUsers = await db.select().from(users).limit(1);
+        if (existingUsers.length > 0) {
+            user = existingUsers[0];
+        }
+        else {
+            const testId = `test-${randomUUID()}`;
+            const [newUser] = await db.insert(users).values({
+                email: `${testId}@test.local`,
+                githubId: testId,
+                githubUsername: 'test-user',
+                avatarUrl: null,
+                plan: 'free',
+            }).returning();
+            user = newUser;
+        }
+        // Set session and CSRF token
+        req.session.userId = user.id;
+        req.session.csrfToken = randomUUID();
+        // Redirect to requested page
+        res.redirect(redirect);
+    }
+    catch (error) {
+        console.error('Error in auto-login:', error);
+        res.status(500).json({ error: 'Failed to auto-login' });
+    }
+});
 /**
  * POST /api/test/login-as
  * Quick login for testing - creates session for existing or new test user

package/dist/cloud/api/usage.js

@@ -6,6 +6,7 @@
 import { Router } from 'express';
 import { requireAuth } from './auth.js';
 import { getRemainingQuota, getUserUsage, getPlanLimits } from '../services/planLimits.js';
+import { getIntroStatus } from '../services/intro-expiration.js';
 import { db } from '../db/index.js';
 export const usageRouter = Router();
 // All routes require authentication
@@ -23,6 +24,8 @@ usageRouter.get('/', async (req, res) => {
         }
         const plan = user.plan || 'free';
         const quota = await getRemainingQuota(userId);
+        // Get intro period status for free tier users
+        const introStatus = getIntroStatus(user.createdAt, plan);
         const calcPercent = (current, limit) => limit === Infinity ? 0 : Math.round((current / limit) * 100);
         res.json({
             plan,
@@ -51,6 +54,16 @@ usageRouter.get('/', async (req, res) => {
                 concurrentAgents: calcPercent(quota.usage.concurrentAgents, quota.limits.maxConcurrentAgents),
                 computeHours: calcPercent(quota.usage.computeHoursThisMonth, quota.limits.maxComputeHoursPerMonth),
             },
+            // Intro period bonus for free tier users (2 CPU / 4GB for first 14 days)
+            introBonus: {
+                isActive: introStatus.isIntroPeriod,
+                daysRemaining: introStatus.daysRemaining,
+                totalDays: introStatus.introPeriodDays,
+                expiresAt: introStatus.expiresAt?.toISOString() || null,
+                resources: introStatus.isIntroPeriod
+                    ? { cpus: 2, memoryGb: 4, description: 'Pro-level resources' }
+                    : { cpus: 1, memoryGb: 2, description: 'Standard free tier' },
+            },
         });
     }
     catch (error) {

package/dist/cloud/api/webhooks.d.ts

@@ -2,6 +2,7 @@
  * Webhook API Routes
  *
  * Handles GitHub App webhooks for installation events.
+ * Also provides workspace webhook forwarding for external integrations.
  */
 export declare const webhooksRouter: import("express-serve-static-core").Router;
 //# sourceMappingURL=webhooks.d.ts.map

package/dist/cloud/api/webhooks.js

@@ -2,12 +2,161 @@
  * Webhook API Routes
  *
  * Handles GitHub App webhooks for installation events.
+ * Also provides workspace webhook forwarding for external integrations.
  */
 import { Router } from 'express';
 import crypto from 'crypto';
 import { getConfig } from '../config.js';
 import { db } from '../db/index.js';
 export const webhooksRouter = Router();
+// ============================================================================
+// Workspace Webhook Forwarding
+// ============================================================================
+/**
+ * Convert workspace public URL to internal Fly.io URL
+ */
+function getWorkspaceInternalUrl(publicUrl) {
+    const isOnFly = !!process.env.FLY_APP_NAME;
+    let url = publicUrl.replace(/\/$/, '');
+    if (isOnFly && url.includes('.fly.dev')) {
+        // Use Fly.io internal networking
+        // ar-583f273b.fly.dev -> http://ar-583f273b.internal:3888
+        // .internal uses IPv6 and works by default for apps in the same org
+        const appName = url.match(/https?:\/\/([^.]+)\.fly\.dev/)?.[1];
+        if (appName) {
+            url = `http://${appName}.internal:3888`;
+        }
+    }
+    return url;
+}
+/**
+ * Wake a suspended Fly.io workspace machine
+ */
+async function wakeWorkspaceMachine(workspaceId) {
+    const workspace = await db.workspaces.findById(workspaceId);
+    if (!workspace?.computeId)
+        return false;
+    const appName = `ar-${workspaceId.substring(0, 8)}`;
+    const apiToken = process.env.FLY_API_TOKEN;
+    if (!apiToken) {
+        console.warn('[webhooks] FLY_API_TOKEN not set, cannot wake machine');
+        return false;
+    }
+    try {
+        const response = await fetch(`https://api.machines.dev/v1/apps/${appName}/machines/${workspace.computeId}/start`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${apiToken}` },
+        });
+        if (response.ok) {
+            console.log(`[webhooks] Started workspace machine ${workspace.computeId}`);
+            // Wait a bit for machine to start
+            await new Promise(resolve => setTimeout(resolve, 5000));
+            return true;
+        }
+        // 200 OK means already running
+        if (response.status === 200) {
+            return true;
+        }
+        console.warn(`[webhooks] Failed to start machine: ${response.status}`);
+        return false;
+    }
+    catch (error) {
+        console.error('[webhooks] Error waking machine:', error);
+        return false;
+    }
+}
+/**
+ * POST /api/webhooks/workspace/:workspaceId/*
+ * Forward webhooks to a specific workspace
+ *
+ * External services can send webhooks to:
+ *   https://agent-relay.com/api/webhooks/workspace/{workspaceId}/your/path
+ *
+ * This will be forwarded to:
+ *   http://{workspace-internal}/webhooks/your/path
+ */
+// Handler for workspace webhook forwarding - matches any path under /workspace/:workspaceId
+async function _handleWorkspaceWebhook(req, res) {
+    // Extract workspaceId from URL path
+    const pathMatch = req.originalUrl.match(/\/workspace\/([^/]+)\/?(.*)$/);
+    if (!pathMatch) {
+        res.status(400).json({ error: 'Invalid workspace webhook URL' });
+        return;
+    }
+    const workspaceId = pathMatch[1];
+    const forwardPath = pathMatch[2] || '';
+    console.log(`[webhooks] Forwarding to workspace ${workspaceId}: ${req.method} /${forwardPath}`);
+    try {
+        // Find the workspace
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            res.status(404).json({ error: 'Workspace not found' });
+            return;
+        }
+        if (!workspace.publicUrl) {
+            res.status(400).json({ error: 'Workspace has no public URL' });
+            return;
+        }
+        // Try to wake the machine if it might be suspended
+        if (workspace.status === 'running' || workspace.status === 'suspended') {
+            await wakeWorkspaceMachine(workspaceId);
+        }
+        // Get internal URL for server-to-server communication
+        const internalUrl = getWorkspaceInternalUrl(workspace.publicUrl);
+        const targetUrl = `${internalUrl}/webhooks/${forwardPath}`;
+        console.log(`[webhooks] Forwarding to: ${targetUrl}`);
+        // Forward the request with original headers and body
+        const forwardHeaders = {};
+        // Copy relevant headers
+        const headersToForward = [
+            'content-type',
+            'x-hub-signature-256',
+            'x-hub-signature',
+            'x-github-event',
+            'x-github-delivery',
+            'x-gitlab-token',
+            'x-gitlab-event',
+            'user-agent',
+        ];
+        for (const header of headersToForward) {
+            const value = req.get(header);
+            if (value) {
+                forwardHeaders[header] = value;
+            }
+        }
+        // Add workspace context header
+        forwardHeaders['x-forwarded-for-workspace'] = workspaceId;
+        forwardHeaders['x-original-host'] = req.get('host') || '';
+        // Get raw body if available, otherwise use JSON stringified body
+        const rawBody = req.rawBody || JSON.stringify(req.body);
+        const response = await fetch(targetUrl, {
+            method: req.method,
+            headers: forwardHeaders,
+            body: ['GET', 'HEAD'].includes(req.method) ? undefined : rawBody,
+        });
+        // Forward response back
+        const responseBody = await response.text();
+        res.status(response.status);
+        // Copy response headers
+        response.headers.forEach((value, key) => {
+            if (!['content-encoding', 'transfer-encoding', 'content-length'].includes(key.toLowerCase())) {
+                res.set(key, value);
+            }
+        });
+        res.send(responseBody);
+    }
+    catch (error) {
+        console.error(`[webhooks] Error forwarding to workspace ${workspaceId}:`, error);
+        res.status(502).json({
+            error: 'Failed to forward webhook to workspace',
+            details: error.message,
+        });
+    }
+}
+// TODO: Re-enable workspace webhook forwarding once route pattern issue is resolved
+// The newer path-to-regexp version doesn't support wildcard patterns like /workspace/*
+// See: https://git.new/pathToRegexpError
+// webhooksRouter.all('/workspace/*', handleWorkspaceWebhook);
 // GitHub webhook signature verification
 function verifyGitHubSignature(payload, signature) {
     if (!signature)

package/dist/cloud/api/workspaces.d.ts

@@ -2,6 +2,24 @@
  * Workspaces API Routes
  *
  * One-click workspace provisioning and management.
+ * Includes auto-access based on GitHub repo permissions.
  */
+import { Request, Response, NextFunction } from 'express';
+/**
+ * Check if user has access to a workspace via:
+ * 1. Workspace ownership (userId matches)
+ * 2. Explicit workspace_members record
+ * 3. GitHub repo access (just-in-time check via Nango)
+ */
+export declare function checkWorkspaceAccess(userId: string, workspaceId: string): Promise<{
+    hasAccess: boolean;
+    accessType: 'owner' | 'member' | 'contributor' | 'none';
+    permission?: 'admin' | 'write' | 'read';
+}>;
+/**
+ * Middleware to require workspace access.
+ * Checks ownership, membership, or GitHub repo access.
+ */
+export declare function requireWorkspaceAccess(req: Request, res: Response, next: NextFunction): void;
 export declare const workspacesRouter: import("express-serve-static-core").Router;
 //# sourceMappingURL=workspaces.d.ts.map