agent-relay 1.6.0 → 2.0.4

package/packages/cloud/dist/api/sessions.js

@@ -0,0 +1,302 @@
+/**
+ * Agent Session Persistence API Routes
+ *
+ * Provides endpoints for workspace containers to persist agent session data.
+ * Workspaces call these endpoints instead of accessing the database directly,
+ * which provides better security isolation (workspaces can only write their own data).
+ *
+ * Authentication: Workspace token (same as git gateway)
+ */
+import crypto from 'crypto';
+import { Router } from 'express';
+import { eq } from 'drizzle-orm';
+import { getDb } from '../db/drizzle.js';
+import { agentSessions, agentSummaries } from '../db/schema.js';
+import { getConfig } from '../config.js';
+export const sessionsRouter = Router();
+// Validation patterns
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const AGENT_NAME_REGEX = /^[a-zA-Z0-9_-]+$/;
+const MAX_AGENT_NAME_LENGTH = 255;
+/**
+ * Generate expected workspace token using HMAC
+ */
+function generateExpectedToken(workspaceId) {
+    const config = getConfig();
+    return crypto
+        .createHmac('sha256', config.sessionSecret)
+        .update(`workspace:${workspaceId}`)
+        .digest('hex');
+}
+/**
+ * Verify workspace access token
+ */
+function verifyWorkspaceToken(req, workspaceId) {
+    const authHeader = req.get('authorization');
+    if (!authHeader) {
+        return { valid: false, reason: 'No Authorization header. WORKSPACE_TOKEN may not be set in the container.' };
+    }
+    if (!authHeader.startsWith('Bearer ')) {
+        return { valid: false, reason: 'Invalid Authorization header format. Expected: Bearer <token>' };
+    }
+    const providedToken = authHeader.slice(7);
+    if (!providedToken) {
+        return { valid: false, reason: 'Empty bearer token provided.' };
+    }
+    const expectedToken = generateExpectedToken(workspaceId);
+    try {
+        const isValid = crypto.timingSafeEqual(Buffer.from(providedToken), Buffer.from(expectedToken));
+        if (!isValid) {
+            return { valid: false, reason: 'Token mismatch. Workspace may need reprovisioning or SESSION_SECRET changed.' };
+        }
+        return { valid: true };
+    }
+    catch {
+        return { valid: false, reason: 'Token comparison failed (length mismatch). Workspace may need reprovisioning.' };
+    }
+}
+/**
+ * Validate UUID format
+ */
+function isValidUUID(value) {
+    return UUID_REGEX.test(value);
+}
+/**
+ * Validate agent name format
+ */
+function isValidAgentName(name) {
+    if (name.length > MAX_AGENT_NAME_LENGTH) {
+        return { valid: false, reason: `agentName exceeds maximum length of ${MAX_AGENT_NAME_LENGTH} characters` };
+    }
+    if (!AGENT_NAME_REGEX.test(name)) {
+        return { valid: false, reason: 'agentName contains invalid characters (only alphanumeric, underscore, and hyphen allowed)' };
+    }
+    return { valid: true };
+}
+/**
+ * Validate summary object structure
+ */
+function validateSummary(summary) {
+    if (typeof summary !== 'object' || summary === null || Array.isArray(summary)) {
+        return { valid: false, reason: 'summary must be an object' };
+    }
+    const s = summary;
+    const allowedKeys = ['currentTask', 'completedTasks', 'decisions', 'context', 'files'];
+    for (const key of Object.keys(s)) {
+        if (!allowedKeys.includes(key)) {
+            // Allow extra keys but log warning (don't reject - for forward compatibility)
+            continue;
+        }
+    }
+    // Validate types of known fields
+    if (s.currentTask !== undefined && typeof s.currentTask !== 'string') {
+        return { valid: false, reason: 'summary.currentTask must be a string' };
+    }
+    if (s.completedTasks !== undefined && !Array.isArray(s.completedTasks)) {
+        return { valid: false, reason: 'summary.completedTasks must be an array' };
+    }
+    if (s.decisions !== undefined && !Array.isArray(s.decisions)) {
+        return { valid: false, reason: 'summary.decisions must be an array' };
+    }
+    if (s.context !== undefined && typeof s.context !== 'string') {
+        return { valid: false, reason: 'summary.context must be a string' };
+    }
+    if (s.files !== undefined && !Array.isArray(s.files)) {
+        return { valid: false, reason: 'summary.files must be an array' };
+    }
+    return { valid: true };
+}
+/**
+ * POST /api/sessions/create
+ * Create a new agent session
+ *
+ * Body: { workspaceId: string, agentName: string }
+ * Returns: { sessionId: string }
+ */
+sessionsRouter.post('/create', async (req, res) => {
+    const { workspaceId, agentName } = req.body;
+    if (!workspaceId || typeof workspaceId !== 'string') {
+        return res.status(400).json({ error: 'workspaceId is required', code: 'MISSING_WORKSPACE_ID' });
+    }
+    if (!isValidUUID(workspaceId)) {
+        return res.status(400).json({ error: 'workspaceId must be a valid UUID', code: 'INVALID_WORKSPACE_ID' });
+    }
+    if (!agentName || typeof agentName !== 'string') {
+        return res.status(400).json({ error: 'agentName is required', code: 'MISSING_AGENT_NAME' });
+    }
+    const agentNameValidation = isValidAgentName(agentName);
+    if (!agentNameValidation.valid) {
+        return res.status(400).json({ error: agentNameValidation.reason, code: 'INVALID_AGENT_NAME' });
+    }
+    const tokenVerification = verifyWorkspaceToken(req, workspaceId);
+    if (!tokenVerification.valid) {
+        console.warn(`[sessions] Token verification failed for workspace ${workspaceId.substring(0, 8)}: ${tokenVerification.reason}`);
+        return res.status(401).json({
+            error: 'Invalid workspace token',
+            code: 'INVALID_WORKSPACE_TOKEN',
+            hint: tokenVerification.reason,
+        });
+    }
+    try {
+        const db = getDb();
+        const result = await db.insert(agentSessions).values({
+            workspaceId,
+            agentName,
+            status: 'active',
+            startedAt: new Date(),
+        }).returning();
+        const session = result[0];
+        if (!session) {
+            return res.status(500).json({ error: 'Failed to create session', code: 'CREATE_FAILED' });
+        }
+        console.log(`[sessions] Created session ${session.id.substring(0, 8)} for ${agentName} in workspace ${workspaceId.substring(0, 8)}`);
+        return res.json({ sessionId: session.id });
+    }
+    catch (err) {
+        console.error(`[sessions] Failed to create session:`, err);
+        return res.status(500).json({ error: 'Internal server error', code: 'INTERNAL_ERROR' });
+    }
+});
+/**
+ * POST /api/sessions/summary
+ * Add a summary to an existing session
+ *
+ * Body: {
+ *   workspaceId: string,
+ *   sessionId: string,
+ *   agentName: string,
+ *   summary: { currentTask?: string, completedTasks?: string[], ... }
+ * }
+ * Returns: { summaryId: string }
+ */
+sessionsRouter.post('/summary', async (req, res) => {
+    const { workspaceId, sessionId, agentName, summary } = req.body;
+    if (!workspaceId || typeof workspaceId !== 'string') {
+        return res.status(400).json({ error: 'workspaceId is required', code: 'MISSING_WORKSPACE_ID' });
+    }
+    if (!isValidUUID(workspaceId)) {
+        return res.status(400).json({ error: 'workspaceId must be a valid UUID', code: 'INVALID_WORKSPACE_ID' });
+    }
+    if (!sessionId || typeof sessionId !== 'string') {
+        return res.status(400).json({ error: 'sessionId is required', code: 'MISSING_SESSION_ID' });
+    }
+    if (!isValidUUID(sessionId)) {
+        return res.status(400).json({ error: 'sessionId must be a valid UUID', code: 'INVALID_SESSION_ID' });
+    }
+    if (!agentName || typeof agentName !== 'string') {
+        return res.status(400).json({ error: 'agentName is required', code: 'MISSING_AGENT_NAME' });
+    }
+    const agentNameValidation = isValidAgentName(agentName);
+    if (!agentNameValidation.valid) {
+        return res.status(400).json({ error: agentNameValidation.reason, code: 'INVALID_AGENT_NAME' });
+    }
+    if (!summary) {
+        return res.status(400).json({ error: 'summary is required', code: 'MISSING_SUMMARY' });
+    }
+    const summaryValidation = validateSummary(summary);
+    if (!summaryValidation.valid) {
+        return res.status(400).json({ error: summaryValidation.reason, code: 'INVALID_SUMMARY' });
+    }
+    const tokenVerification = verifyWorkspaceToken(req, workspaceId);
+    if (!tokenVerification.valid) {
+        console.warn(`[sessions] Summary: Token verification failed for workspace ${workspaceId.substring(0, 8)}`);
+        return res.status(401).json({
+            error: 'Invalid workspace token',
+            code: 'INVALID_WORKSPACE_TOKEN',
+            hint: tokenVerification.reason,
+        });
+    }
+    try {
+        const db = getDb();
+        // Verify the session exists and belongs to this workspace
+        const existingSession = await db.select()
+            .from(agentSessions)
+            .where(eq(agentSessions.id, sessionId))
+            .limit(1);
+        if (!existingSession[0]) {
+            return res.status(404).json({ error: 'Session not found', code: 'SESSION_NOT_FOUND' });
+        }
+        if (existingSession[0].workspaceId !== workspaceId) {
+            return res.status(403).json({ error: 'Session does not belong to this workspace', code: 'SESSION_FORBIDDEN' });
+        }
+        const result = await db.insert(agentSummaries).values({
+            sessionId,
+            agentName,
+            summary,
+            createdAt: new Date(),
+        }).returning();
+        const summaryRecord = result[0];
+        if (!summaryRecord) {
+            return res.status(500).json({ error: 'Failed to create summary', code: 'CREATE_FAILED' });
+        }
+        console.log(`[sessions] Saved summary for ${agentName}: ${summary.currentTask || 'no task'}`);
+        return res.json({ summaryId: summaryRecord.id });
+    }
+    catch (err) {
+        console.error(`[sessions] Failed to save summary:`, err);
+        return res.status(500).json({ error: 'Internal server error', code: 'INTERNAL_ERROR' });
+    }
+});
+/**
+ * POST /api/sessions/end
+ * Mark a session as ended
+ *
+ * Body: {
+ *   workspaceId: string,
+ *   sessionId: string,
+ *   endMarker: { summary?: string, completedTasks?: string[] }
+ * }
+ * Returns: { success: true }
+ */
+sessionsRouter.post('/end', async (req, res) => {
+    const { workspaceId, sessionId, endMarker } = req.body;
+    if (!workspaceId || typeof workspaceId !== 'string') {
+        return res.status(400).json({ error: 'workspaceId is required', code: 'MISSING_WORKSPACE_ID' });
+    }
+    if (!isValidUUID(workspaceId)) {
+        return res.status(400).json({ error: 'workspaceId must be a valid UUID', code: 'INVALID_WORKSPACE_ID' });
+    }
+    if (!sessionId || typeof sessionId !== 'string') {
+        return res.status(400).json({ error: 'sessionId is required', code: 'MISSING_SESSION_ID' });
+    }
+    if (!isValidUUID(sessionId)) {
+        return res.status(400).json({ error: 'sessionId must be a valid UUID', code: 'INVALID_SESSION_ID' });
+    }
+    const tokenVerification = verifyWorkspaceToken(req, workspaceId);
+    if (!tokenVerification.valid) {
+        console.warn(`[sessions] End: Token verification failed for workspace ${workspaceId.substring(0, 8)}`);
+        return res.status(401).json({
+            error: 'Invalid workspace token',
+            code: 'INVALID_WORKSPACE_TOKEN',
+            hint: tokenVerification.reason,
+        });
+    }
+    try {
+        const db = getDb();
+        // Verify the session exists and belongs to this workspace
+        const existingSession = await db.select()
+            .from(agentSessions)
+            .where(eq(agentSessions.id, sessionId))
+            .limit(1);
+        if (!existingSession[0]) {
+            return res.status(404).json({ error: 'Session not found', code: 'SESSION_NOT_FOUND' });
+        }
+        if (existingSession[0].workspaceId !== workspaceId) {
+            return res.status(403).json({ error: 'Session does not belong to this workspace', code: 'SESSION_FORBIDDEN' });
+        }
+        await db.update(agentSessions)
+            .set({
+            status: 'ended',
+            endedAt: new Date(),
+            endMarker: endMarker || {},
+        })
+            .where(eq(agentSessions.id, sessionId));
+        console.log(`[sessions] Session ended for workspace ${workspaceId.substring(0, 8)}: ${endMarker?.summary || 'no summary'}`);
+        return res.json({ success: true });
+    }
+    catch (err) {
+        console.error(`[sessions] Failed to end session:`, err);
+        return res.status(500).json({ error: 'Internal server error', code: 'INTERNAL_ERROR' });
+    }
+});
+//# sourceMappingURL=sessions.js.map

package/packages/cloud/dist/api/teams.js

@@ -0,0 +1,281 @@
+/**
+ * Teams API Routes
+ *
+ * Manage workspace members, invitations, and roles.
+ */
+import { Router } from 'express';
+import { requireAuth } from './auth.js';
+import { db } from '../db/index.js';
+export const teamsRouter = Router();
+// All routes require authentication
+teamsRouter.use(requireAuth);
+/**
+ * GET /api/workspaces/:workspaceId/members
+ * List workspace members
+ */
+teamsRouter.get('/workspaces/:workspaceId/members', async (req, res) => {
+    const userId = req.session.userId;
+    const workspaceId = req.params.workspaceId;
+    try {
+        // Check user has access to workspace
+        const canView = await db.workspaceMembers.canView(workspaceId, userId);
+        if (!canView) {
+            // Also check if user is the workspace owner (legacy single-user workspaces)
+            const workspace = await db.workspaces.findById(workspaceId);
+            if (!workspace || workspace.userId !== userId) {
+                return res.status(403).json({ error: 'Access denied' });
+            }
+        }
+        const members = await db.workspaceMembers.findByWorkspaceId(workspaceId);
+        // Fetch user info for each member
+        const membersWithUsers = await Promise.all(members.map(async (m) => {
+            const user = await db.users.findById(m.userId);
+            return {
+                id: m.id,
+                userId: m.userId,
+                role: m.role,
+                invitedAt: m.invitedAt,
+                acceptedAt: m.acceptedAt,
+                isPending: !m.acceptedAt,
+                user: user
+                    ? {
+                        githubUsername: user.githubUsername,
+                        email: user.email ?? undefined,
+                        avatarUrl: user.avatarUrl ?? undefined,
+                    }
+                    : undefined,
+            };
+        }));
+        res.json({ members: membersWithUsers });
+    }
+    catch (error) {
+        console.error('Error listing members:', error);
+        res.status(500).json({ error: 'Failed to list members' });
+    }
+});
+/**
+ * POST /api/workspaces/:workspaceId/members
+ * Invite a user to workspace
+ */
+teamsRouter.post('/workspaces/:workspaceId/members', async (req, res) => {
+    const userId = req.session.userId;
+    const workspaceId = req.params.workspaceId;
+    const { githubUsername, role = 'member' } = req.body;
+    if (!githubUsername) {
+        return res.status(400).json({ error: 'GitHub username is required' });
+    }
+    const validRoles = ['admin', 'member', 'viewer'];
+    if (!validRoles.includes(role)) {
+        return res.status(400).json({ error: 'Invalid role. Must be admin, member, or viewer' });
+    }
+    try {
+        // Check user is owner or admin
+        const isOwner = await db.workspaceMembers.isOwner(workspaceId, userId);
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!isOwner && workspace?.userId !== userId) {
+            const membership = await db.workspaceMembers.findMembership(workspaceId, userId);
+            if (!membership || membership.role !== 'admin') {
+                return res.status(403).json({ error: 'Only owners and admins can invite members' });
+            }
+        }
+        // Check plan allows team members
+        const owner = await db.users.findById(workspace.userId);
+        if (owner?.plan !== 'team' && owner?.plan !== 'enterprise') {
+            return res.status(402).json({
+                error: 'Team members require Team or Enterprise plan',
+                upgrade: '/settings/billing',
+            });
+        }
+        // Find user by GitHub username
+        const invitee = await db.users.findByGithubUsername(githubUsername);
+        if (!invitee) {
+            return res.status(404).json({
+                error: 'User not found. They must sign up first.',
+                inviteLink: `https://agent-relay.com/invite?workspace=${workspaceId}`,
+            });
+        }
+        // Check if already a member
+        const existing = await db.workspaceMembers.findMembership(workspaceId, invitee.id);
+        if (existing) {
+            return res.status(409).json({ error: 'User is already a member' });
+        }
+        // Add member (pending acceptance)
+        const member = await db.workspaceMembers.addMember({
+            workspaceId,
+            userId: invitee.id,
+            role,
+            invitedBy: userId,
+        });
+        // TODO: Send email notification to invitee
+        res.status(201).json({
+            success: true,
+            member: {
+                id: member.id,
+                userId: member.userId,
+                role: member.role,
+                isPending: true,
+                user: {
+                    githubUsername: invitee.githubUsername,
+                    email: invitee.email,
+                    avatarUrl: invitee.avatarUrl,
+                },
+            },
+        });
+    }
+    catch (error) {
+        console.error('Error inviting member:', error);
+        res.status(500).json({ error: 'Failed to invite member' });
+    }
+});
+/**
+ * PATCH /api/workspaces/:workspaceId/members/:memberId
+ * Update member role
+ */
+teamsRouter.patch('/workspaces/:workspaceId/members/:memberId', async (req, res) => {
+    const userId = req.session.userId;
+    const workspaceId = req.params.workspaceId;
+    const memberId = req.params.memberId;
+    const { role } = req.body;
+    const validRoles = ['admin', 'member', 'viewer'];
+    if (!validRoles.includes(role)) {
+        return res.status(400).json({ error: 'Invalid role' });
+    }
+    try {
+        // Check user is owner or admin
+        const isOwner = await db.workspaceMembers.isOwner(workspaceId, userId);
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!isOwner && workspace?.userId !== userId) {
+            return res.status(403).json({ error: 'Only owners can change roles' });
+        }
+        // Get the member to update
+        const members = await db.workspaceMembers.findByWorkspaceId(workspaceId);
+        const member = members.find((m) => m.id === memberId);
+        if (!member) {
+            return res.status(404).json({ error: 'Member not found' });
+        }
+        // Can't change owner role
+        if (member.role === 'owner') {
+            return res.status(400).json({ error: 'Cannot change owner role' });
+        }
+        await db.workspaceMembers.updateRole(workspaceId, member.userId, role);
+        res.json({ success: true, role });
+    }
+    catch (error) {
+        console.error('Error updating role:', error);
+        res.status(500).json({ error: 'Failed to update role' });
+    }
+});
+/**
+ * DELETE /api/workspaces/:workspaceId/members/:memberId
+ * Remove member from workspace
+ */
+teamsRouter.delete('/workspaces/:workspaceId/members/:memberId', async (req, res) => {
+    const userId = req.session.userId;
+    const workspaceId = req.params.workspaceId;
+    const memberId = req.params.memberId;
+    try {
+        const members = await db.workspaceMembers.findByWorkspaceId(workspaceId);
+        const member = members.find((m) => m.id === memberId);
+        if (!member) {
+            return res.status(404).json({ error: 'Member not found' });
+        }
+        // Users can remove themselves
+        if (member.userId === userId) {
+            if (member.role === 'owner') {
+                return res.status(400).json({ error: 'Owner cannot leave. Transfer ownership first.' });
+            }
+            await db.workspaceMembers.removeMember(workspaceId, userId);
+            return res.json({ success: true });
+        }
+        // Otherwise, must be owner or admin
+        const isOwner = await db.workspaceMembers.isOwner(workspaceId, userId);
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!isOwner && workspace?.userId !== userId) {
+            const myMembership = await db.workspaceMembers.findMembership(workspaceId, userId);
+            if (!myMembership || myMembership.role !== 'admin') {
+                return res.status(403).json({ error: 'Permission denied' });
+            }
+        }
+        // Can't remove owner
+        if (member.role === 'owner') {
+            return res.status(400).json({ error: 'Cannot remove owner' });
+        }
+        await db.workspaceMembers.removeMember(workspaceId, member.userId);
+        res.json({ success: true });
+    }
+    catch (error) {
+        console.error('Error removing member:', error);
+        res.status(500).json({ error: 'Failed to remove member' });
+    }
+});
+/**
+ * GET /api/invites
+ * Get pending invites for current user
+ */
+teamsRouter.get('/invites', async (req, res) => {
+    const userId = req.session.userId;
+    try {
+        const invites = await db.workspaceMembers.getPendingInvites(userId);
+        res.json({
+            invites: invites.map((inv) => ({
+                id: inv.id,
+                workspaceId: inv.workspaceId,
+                workspaceName: inv.workspace_name,
+                role: inv.role,
+                invitedAt: inv.invitedAt,
+                invitedBy: inv.inviter_username,
+            })),
+        });
+    }
+    catch (error) {
+        console.error('Error getting invites:', error);
+        res.status(500).json({ error: 'Failed to get invites' });
+    }
+});
+/**
+ * POST /api/invites/:inviteId/accept
+ * Accept workspace invitation
+ */
+teamsRouter.post('/invites/:inviteId/accept', async (req, res) => {
+    const userId = req.session.userId;
+    const inviteId = req.params.inviteId;
+    try {
+        const invites = await db.workspaceMembers.getPendingInvites(userId);
+        const invite = invites.find((i) => i.id === inviteId);
+        if (!invite) {
+            return res.status(404).json({ error: 'Invite not found' });
+        }
+        await db.workspaceMembers.acceptInvite(invite.workspaceId, userId);
+        res.json({
+            success: true,
+            workspaceId: invite.workspaceId,
+            message: 'Invitation accepted',
+        });
+    }
+    catch (error) {
+        console.error('Error accepting invite:', error);
+        res.status(500).json({ error: 'Failed to accept invite' });
+    }
+});
+/**
+ * POST /api/invites/:inviteId/decline
+ * Decline workspace invitation
+ */
+teamsRouter.post('/invites/:inviteId/decline', async (req, res) => {
+    const userId = req.session.userId;
+    const inviteId = req.params.inviteId;
+    try {
+        const invites = await db.workspaceMembers.getPendingInvites(userId);
+        const invite = invites.find((i) => i.id === inviteId);
+        if (!invite) {
+            return res.status(404).json({ error: 'Invite not found' });
+        }
+        await db.workspaceMembers.removeMember(invite.workspaceId, userId);
+        res.json({ success: true, message: 'Invitation declined' });
+    }
+    catch (error) {
+        console.error('Error declining invite:', error);
+        res.status(500).json({ error: 'Failed to decline invite' });
+    }
+});
+//# sourceMappingURL=teams.js.map