agent-tower 0.5.4-beta.0 → 0.5.4-beta.1

package/dist/middleware/__tests__/access-auth.test.js

@@ -0,0 +1,249 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import fastifyCookie from '@fastify/cookie';
+import Fastify from 'fastify';
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest';
+const testDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-tower-access-auth-middleware-'));
+const dbPath = path.join(testDir, 'test.db');
+process.env.AGENT_TOWER_DATABASE_URL = `file:${dbPath}`;
+process.env.AGENT_TOWER_DATA_DIR = testDir;
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const serverRoot = path.resolve(__dirname, '../../..');
+const schemaPath = path.join(serverRoot, 'prisma/schema.prisma');
+let prisma;
+let accessAuthHook;
+let accessAuthRoutes;
+let AccessAuthService;
+let INTERNAL_API_TOKEN_HEADER;
+let INTERNAL_API_TOKEN_ENV;
+let getOrCreateInternalApiToken;
+async function buildTestApp() {
+    const app = Fastify();
+    await app.register(fastifyCookie);
+    app.addHook('onRequest', accessAuthHook);
+    await app.register(accessAuthRoutes, { prefix: '/api' });
+    app.get('/api/private', async () => ({ ok: true }));
+    app.post('/api/private', async () => ({ ok: true }));
+    app.get('/api/tunnel/bootstrap', async () => ({ ok: true }));
+    app.get('/view/:workspaceId/*', async () => ({ ok: true }));
+    return app;
+}
+describe('accessAuthHook', () => {
+    beforeAll(async () => {
+        execFileSync('pnpm', ['exec', 'prisma', 'db', 'push', '--skip-generate', `--schema=${schemaPath}`], {
+            cwd: serverRoot,
+            env: { ...process.env, AGENT_TOWER_DATABASE_URL: `file:${dbPath}` },
+            stdio: 'pipe',
+        });
+        const middlewareModule = await import('../access-auth.js');
+        const routesModule = await import('../../routes/access-auth.js');
+        const serviceModule = await import('../../services/access-auth.service.js');
+        const tokenModule = await import('../../utils/internal-api-token.js');
+        const utilsModule = await import('../../utils/index.js');
+        accessAuthHook = middlewareModule.accessAuthHook;
+        accessAuthRoutes = routesModule.accessAuthRoutes;
+        AccessAuthService = serviceModule.AccessAuthService;
+        INTERNAL_API_TOKEN_HEADER = tokenModule.INTERNAL_API_TOKEN_HEADER;
+        INTERNAL_API_TOKEN_ENV = tokenModule.INTERNAL_API_TOKEN_ENV;
+        getOrCreateInternalApiToken = tokenModule.getOrCreateInternalApiToken;
+        prisma = utilsModule.prisma;
+    });
+    beforeEach(async () => {
+        await prisma.accessAuthSettings.deleteMany();
+        delete process.env.AGENT_TOWER_INTERNAL_TOKEN;
+        AccessAuthService.__test.resetLoginRateLimit();
+        AccessAuthService.__test.resetSessionSecretGeneration();
+    });
+    afterAll(async () => {
+        await prisma.$disconnect();
+        fs.rmSync(testDir, { recursive: true, force: true });
+    });
+    it('allows API requests when access password is disabled', async () => {
+        const app = await buildTestApp();
+        try {
+            const response = await app.inject({ method: 'GET', url: '/api/private' });
+            expect(response.statusCode).toBe(200);
+        }
+        finally {
+            await app.close();
+        }
+    });
+    it('handles concurrent initial access auth status requests on a fresh database', async () => {
+        const app = await buildTestApp();
+        try {
+            const responses = await Promise.all(Array.from({ length: 8 }, () => app.inject({ method: 'GET', url: '/api/access-auth/status' })));
+            expect(responses.map((response) => response.statusCode)).toEqual(Array.from({ length: 8 }, () => 200));
+            for (const response of responses) {
+                expect(response.json()).toEqual({ enabled: false, authenticated: true });
+            }
+            await expect(prisma.accessAuthSettings.count()).resolves.toBe(1);
+        }
+        finally {
+            await app.close();
+        }
+    });
+    it('rejects protected APIs when enabled and allows status/login/tunnel bootstrap', async () => {
+        await AccessAuthService.updateSettings({ enabled: true, newPassword: 'secret-pass' });
+        const app = await buildTestApp();
+        try {
+            const privateResponse = await app.inject({ method: 'GET', url: '/api/private' });
+            expect(privateResponse.statusCode).toBe(401);
+            expect(privateResponse.json()).toMatchObject({ code: 'ACCESS_AUTH_REQUIRED' });
+            const statusResponse = await app.inject({ method: 'GET', url: '/api/access-auth/status' });
+            expect(statusResponse.statusCode).toBe(200);
+            expect(statusResponse.json()).toEqual({ enabled: true, authenticated: false });
+            const tunnelResponse = await app.inject({ method: 'GET', url: '/api/tunnel/bootstrap' });
+            expect(tunnelResponse.statusCode).toBe(200);
+        }
+        finally {
+            await app.close();
+        }
+    });
+    it('sets a session cookie on login and allows same-origin writes', async () => {
+        await AccessAuthService.updateSettings({ enabled: true, newPassword: 'secret-pass' });
+        const app = await buildTestApp();
+        try {
+            const loginResponse = await app.inject({
+                method: 'POST',
+                url: '/api/access-auth/login',
+                payload: { password: 'secret-pass' },
+            });
+            expect(loginResponse.statusCode).toBe(200);
+            const cookie = String(loginResponse.headers['set-cookie']);
+            expect(cookie).toContain('agent-tower-access=');
+            const writeResponse = await app.inject({
+                method: 'POST',
+                url: '/api/private',
+                headers: {
+                    cookie,
+                    origin: 'http://localhost:12580',
+                    host: 'localhost:12580',
+                },
+            });
+            expect(writeResponse.statusCode).toBe(200);
+            const csrfResponse = await app.inject({
+                method: 'POST',
+                url: '/api/private',
+                headers: {
+                    cookie,
+                    origin: 'http://evil.example',
+                    host: 'localhost:12580',
+                },
+            });
+            expect(csrfResponse.statusCode).toBe(403);
+        }
+        finally {
+            await app.close();
+        }
+    });
+    it('allows internal token requests without a browser session', async () => {
+        await AccessAuthService.updateSettings({ enabled: true, newPassword: 'secret-pass' });
+        const app = await buildTestApp();
+        const originalDataDir = process.env.AGENT_TOWER_DATA_DIR;
+        const token = getOrCreateInternalApiToken(testDir);
+        process.env[INTERNAL_API_TOKEN_ENV] = token;
+        process.env.AGENT_TOWER_DATA_DIR = path.join(testDir, 'wrong-data-dir');
+        try {
+            const response = await app.inject({
+                method: 'GET',
+                url: '/api/private',
+                headers: {
+                    [INTERNAL_API_TOKEN_HEADER]: token,
+                },
+            });
+            expect(response.statusCode).toBe(200);
+        }
+        finally {
+            if (originalDataDir === undefined) {
+                delete process.env.AGENT_TOWER_DATA_DIR;
+            }
+            else {
+                process.env.AGENT_TOWER_DATA_DIR = originalDataDir;
+            }
+            await app.close();
+        }
+    });
+    it('rejects missing or incorrect internal token requests when access password is enabled', async () => {
+        await AccessAuthService.updateSettings({ enabled: true, newPassword: 'secret-pass' });
+        process.env[INTERNAL_API_TOKEN_ENV] = 'expected-internal-token';
+        const app = await buildTestApp();
+        try {
+            const missingResponse = await app.inject({
+                method: 'GET',
+                url: '/api/private',
+            });
+            expect(missingResponse.statusCode).toBe(401);
+            expect(missingResponse.json()).toMatchObject({ code: 'ACCESS_AUTH_REQUIRED' });
+            const wrongResponse = await app.inject({
+                method: 'GET',
+                url: '/api/private',
+                headers: {
+                    [INTERNAL_API_TOKEN_HEADER]: 'wrong-internal-token',
+                },
+            });
+            expect(wrongResponse.statusCode).toBe(401);
+            expect(wrongResponse.json()).toMatchObject({ code: 'ACCESS_AUTH_INVALID_INTERNAL_TOKEN' });
+        }
+        finally {
+            await app.close();
+        }
+    });
+    it('allows tokenized preview proxy requests without allowing main API requests', async () => {
+        await AccessAuthService.updateSettings({ enabled: true, newPassword: 'secret-pass' });
+        const previewToken = await AccessAuthService.createPreviewAccessToken('workspace-1');
+        const app = await buildTestApp();
+        try {
+            const previewResponse = await app.inject({
+                method: 'GET',
+                url: `/view/workspace-1/__agent_tower_preview/${previewToken}/api/echo`,
+            });
+            expect(previewResponse.statusCode).toBe(200);
+            const mismatchedPreviewResponse = await app.inject({
+                method: 'GET',
+                url: `/view/workspace-2/__agent_tower_preview/${previewToken}/api/echo`,
+            });
+            expect(mismatchedPreviewResponse.statusCode).toBe(401);
+            const apiResponse = await app.inject({
+                method: 'GET',
+                url: '/api/private',
+                headers: {
+                    'x-preview-token': previewToken,
+                },
+            });
+            expect(apiResponse.statusCode).toBe(401);
+        }
+        finally {
+            await app.close();
+        }
+    });
+    it('rate limits repeated login failures at the route boundary', async () => {
+        await AccessAuthService.updateSettings({ enabled: true, newPassword: 'secret-pass' });
+        const app = await buildTestApp();
+        try {
+            for (let i = 0; i < AccessAuthService.__test.MAX_FAILED_LOGIN_ATTEMPTS; i += 1) {
+                const response = await app.inject({
+                    method: 'POST',
+                    url: '/api/access-auth/login',
+                    payload: { password: 'wrong-pass' },
+                });
+                expect(response.statusCode).toBe(401);
+            }
+            const limited = await app.inject({
+                method: 'POST',
+                url: '/api/access-auth/login',
+                payload: { password: 'secret-pass' },
+            });
+            expect(limited.statusCode).toBe(429);
+            expect(limited.json()).toMatchObject({ code: 'ACCESS_AUTH_RATE_LIMITED' });
+            expect(limited.headers['set-cookie']).toBeUndefined();
+        }
+        finally {
+            await app.close();
+        }
+    });
+});
+//# sourceMappingURL=access-auth.test.js.map

package/dist/middleware/__tests__/access-auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-auth.test.js","sourceRoot":"","sources":["../../../src/middleware/__tests__/access-auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG/E,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qCAAqC,CAAC,CAAC,CAAC;AAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAC7C,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,QAAQ,MAAM,EAAE,CAAC;AACxD,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,OAAO,CAAC;AAE3C,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AACvD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;AAEjE,IAAI,MAAoB,CAAC;AACzB,IAAI,cAAiE,CAAC;AACtE,IAAI,gBAA+E,CAAC;AACpF,IAAI,iBAA2F,CAAC;AAChG,IAAI,yBAAuG,CAAC;AAC5G,IAAI,sBAAiG,CAAC;AACtG,IAAI,2BAA2G,CAAC;AAEhH,KAAK,UAAU,YAAY;IACzB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAClC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACzC,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACzD,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrD,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,YAAY,CACV,MAAM,EACN,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,UAAU,EAAE,CAAC,EAC7E;YACE,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,wBAAwB,EAAE,QAAQ,MAAM,EAAE,EAAE;YACnE,KAAK,EAAE,MAAM;SACd,CACF,CAAC;QAEF,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QACjE,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;QACtE,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACzD,cAAc,GAAG,gBAAgB,CAAC,cAAc,CAAC;QACjD,gBAAgB,GAAG,YAAY,CAAC,gBAAgB,CAAC;QACjD,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,CAAC;QACpD,yBAAyB,GAAG,WAAW,CAAC,yBAAyB,CAAC;QAClE,sBAAsB,GAAG,WAAW,CAAC,sBAAsB,CAAC;QAC5D,2BAA2B,GAAG,WAAW,CAAC,2BAA2B,CAAC;QACtE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;QAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;QAC9C,iBAAiB,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/C,iBAAiB,CAAC,MAAM,CAAC,4BAA4B,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3B,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1E,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAC/F,CAAC;YAEF,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvG,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnE,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,iBAAiB,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;YACjF,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAE/E,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3F,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YAE/E,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACzF,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,iBAAiB,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBACrC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,wBAAwB;gBAC7B,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;aACrC,CAAC,CAAC;YACH,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAEhD,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBACrC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,cAAc;gBACnB,OAAO,EAAE;oBACP,MAAM;oBACN,MAAM,EAAE,wBAAwB;oBAChC,IAAI,EAAE,iBAAiB;iBACxB;aACF,CAAC,CAAC;YACH,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE3C,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBACpC,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,cAAc;gBACnB,OAAO,EAAE;oBACP,MAAM;oBACN,MAAM,EAAE,qBAAqB;oBAC7B,IAAI,EAAE,iBAAiB;iBACxB;aACF,CAAC,CAAC;YACH,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,iBAAiB,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QACjC,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACzD,MAAM,KAAK,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,KAAK,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,cAAc;gBACnB,OAAO,EAAE;oBACP,CAAC,yBAAyB,CAAC,EAAE,KAAK;iBACnC;aACF,CAAC,CAAC;YACH,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;gBAAS,CAAC;YACT,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,eAAe,CAAC;YACrD,CAAC;YACD,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,iBAAiB,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,GAAG,yBAAyB,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBACvC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,cAAc;aACpB,CAAC,CAAC;YACH,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAE/E,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBACrC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,cAAc;gBACnB,OAAO,EAAE;oBACP,CAAC,yBAAyB,CAAC,EAAE,sBAAsB;iBACpD;aACF,CAAC,CAAC;YACH,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAC7F,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,iBAAiB,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC;QACrF,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBACvC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,2CAA2C,YAAY,WAAW;aACxE,CAAC,CAAC;YACH,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE7C,MAAM,yBAAyB,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBACjD,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,2CAA2C,YAAY,WAAW;aACxE,CAAC,CAAC;YACH,MAAM,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEvD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBACnC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,cAAc;gBACnB,OAAO,EAAE;oBACP,iBAAiB,EAAE,YAAY;iBAChC;aACF,CAAC,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,iBAAiB,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACtF,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QAEjC,IAAI,CAAC;YACH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/E,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;oBAChC,MAAM,EAAE,MAAM;oBACd,GAAG,EAAE,wBAAwB;oBAC7B,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;iBACpC,CAAC,CAAC;gBACH,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAC/B,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,wBAAwB;gBAC7B,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;aACrC,CAAC,CAAC;YAEH,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACxD,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/middleware/access-auth.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyReply, FastifyRequest } from 'fastify';
+export declare function accessAuthHook(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+//# sourceMappingURL=access-auth.d.ts.map

package/dist/middleware/access-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-auth.d.ts","sourceRoot":"","sources":["../../src/middleware/access-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AA4F5D,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/middleware/access-auth.js

@@ -0,0 +1,110 @@
+import { AccessAuthService } from '../services/access-auth.service.js';
+import { INTERNAL_API_TOKEN_HEADER, validateInternalApiToken, } from '../utils/internal-api-token.js';
+import { parsePreviewPath } from '../utils/preview-path.js';
+function firstHeaderValue(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+function isPublicAccessAuthEndpoint(request) {
+    const pathname = new URL(request.url, 'http://agent-tower.local').pathname;
+    if (pathname === '/api/access-auth/status')
+        return request.method === 'GET';
+    if (pathname === '/api/access-auth/login')
+        return request.method === 'POST';
+    if (pathname === '/api/access-auth/logout')
+        return request.method === 'POST';
+    return false;
+}
+function isPublicEndpoint(request) {
+    const pathname = new URL(request.url, 'http://agent-tower.local').pathname;
+    if (isPublicAccessAuthEndpoint(request))
+        return true;
+    if (pathname === '/api/health')
+        return true;
+    if (pathname === '/api/tunnel/bootstrap')
+        return true;
+    if (pathname === '/api/tunnel/health')
+        return true;
+    return false;
+}
+function isProtectedEndpoint(request) {
+    const pathname = new URL(request.url, 'http://agent-tower.local').pathname;
+    return pathname.startsWith('/api/') || pathname === '/api' || pathname.startsWith('/view/');
+}
+async function hasValidPreviewAccessToken(request) {
+    const parsed = parsePreviewPath(request.url);
+    if (!parsed?.previewToken)
+        return false;
+    return AccessAuthService.validatePreviewAccessToken(parsed.previewToken, parsed.workspaceId);
+}
+function requestOriginMatchesHost(request, value) {
+    let origin;
+    try {
+        origin = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    const host = request.headers.host;
+    if (!host)
+        return false;
+    return origin.host.toLowerCase() === host.toLowerCase();
+}
+function hasValidSameOriginSignal(request) {
+    const origin = firstHeaderValue(request.headers.origin);
+    if (origin)
+        return requestOriginMatchesHost(request, origin);
+    const referer = firstHeaderValue(request.headers.referer);
+    if (referer)
+        return requestOriginMatchesHost(request, referer);
+    return true;
+}
+function shouldCheckCsrf(request) {
+    const method = request.method.toUpperCase();
+    return method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS';
+}
+function sendUnauthorized(reply) {
+    reply.code(401).send({
+        error: 'Unauthorized',
+        code: 'ACCESS_AUTH_REQUIRED',
+        message: 'Access password required',
+    });
+}
+function sendInvalidInternalToken(reply) {
+    reply.code(401).send({
+        error: 'Unauthorized',
+        code: 'ACCESS_AUTH_INVALID_INTERNAL_TOKEN',
+        message: 'Invalid internal token',
+    });
+}
+function sendCsrfRejected(reply) {
+    reply.code(403).send({
+        error: 'Forbidden',
+        code: 'ACCESS_AUTH_CSRF_REJECTED',
+        message: 'Request origin is not allowed',
+    });
+}
+export async function accessAuthHook(request, reply) {
+    if (!isProtectedEndpoint(request) || isPublicEndpoint(request))
+        return;
+    const internalToken = firstHeaderValue(request.headers[INTERNAL_API_TOKEN_HEADER]);
+    if (internalToken) {
+        if (validateInternalApiToken(internalToken))
+            return;
+        sendInvalidInternalToken(reply);
+        return;
+    }
+    if (!await AccessAuthService.isEnabled())
+        return;
+    if (await hasValidPreviewAccessToken(request))
+        return;
+    const cookieToken = request.cookies[AccessAuthService.cookieName]
+        ?? AccessAuthService.extractCookieFromHeader(request.headers.cookie);
+    if (!await AccessAuthService.validateSessionToken(cookieToken)) {
+        sendUnauthorized(reply);
+        return;
+    }
+    if (shouldCheckCsrf(request) && !hasValidSameOriginSignal(request)) {
+        sendCsrfRejected(reply);
+    }
+}
+//# sourceMappingURL=access-auth.js.map

package/dist/middleware/access-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-auth.js","sourceRoot":"","sources":["../../src/middleware/access-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,SAAS,gBAAgB,CAAC,KAAoC;IAC5D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAuB;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC;IAC3E,IAAI,QAAQ,KAAK,yBAAyB;QAAE,OAAO,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC5E,IAAI,QAAQ,KAAK,wBAAwB;QAAE,OAAO,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;IAC5E,IAAI,QAAQ,KAAK,yBAAyB;QAAE,OAAO,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;IAC7E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC;IAC3E,IAAI,0BAA0B,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,QAAQ,KAAK,uBAAuB;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,QAAQ,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAuB;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC;IAC3E,OAAO,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,OAAuB;IAC/D,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,YAAY;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,iBAAiB,CAAC,0BAA0B,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAuB,EAAE,KAAa;IACtE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAuB;IACvD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,MAAM;QAAE,OAAO,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE7D,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,OAAO;QAAE,OAAO,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE/D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,OAAuB;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB;IAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,KAAK,EAAE,cAAc;QACrB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,0BAA0B;KACpC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAmB;IACnD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,KAAK,EAAE,cAAc;QACrB,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,wBAAwB;KAClC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB;IAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,+BAA+B;KACzC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAuB,EACvB,KAAmB;IAEnB,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO;IAEvE,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACnF,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,wBAAwB,CAAC,aAAa,CAAC;YAAE,OAAO;QACpD,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,iBAAiB,CAAC,SAAS,EAAE;QAAE,OAAO;IAEjD,IAAI,MAAM,0BAA0B,CAAC,OAAO,CAAC;QAAE,OAAO;IAEtD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC;WAC5D,iBAAiB,CAAC,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvE,IAAI,CAAC,MAAM,iBAAiB,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IAED,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/routes/__tests__/files.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=files.test.d.ts.map

package/dist/routes/__tests__/files.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.test.d.ts","sourceRoot":"","sources":["../../../src/routes/__tests__/files.test.ts"],"names":[],"mappings":""}

package/dist/routes/__tests__/files.test.js

@@ -0,0 +1,101 @@
+import Fastify from 'fastify';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { filesRoutes } from '../files.js';
+let tempRoot = '';
+let workspaceDir = '';
+let dataDir = '';
+const originalDataDir = process.env.AGENT_TOWER_DATA_DIR;
+async function buildTestApp() {
+    const app = Fastify();
+    await app.register(filesRoutes);
+    return app;
+}
+describe('files routes', () => {
+    beforeEach(() => {
+        tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-tower-files-route-'));
+        workspaceDir = path.join(tempRoot, 'workspace');
+        dataDir = path.join(tempRoot, 'data');
+        fs.mkdirSync(workspaceDir, { recursive: true });
+        fs.mkdirSync(dataDir, { recursive: true });
+        process.env.AGENT_TOWER_DATA_DIR = dataDir;
+    });
+    afterEach(() => {
+        if (originalDataDir === undefined) {
+            delete process.env.AGENT_TOWER_DATA_DIR;
+        }
+        else {
+            process.env.AGENT_TOWER_DATA_DIR = originalDataDir;
+        }
+        if (tempRoot) {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+    it('reads regular workspace files', async () => {
+        fs.writeFileSync(path.join(workspaceDir, 'hello.txt'), 'hello\n', 'utf-8');
+        const app = await buildTestApp();
+        try {
+            const response = await app.inject({
+                method: 'GET',
+                url: `/read?workingDir=${encodeURIComponent(workspaceDir)}&path=hello.txt`,
+            });
+            expect(response.statusCode).toBe(200);
+            expect(response.json()).toMatchObject({ content: 'hello\n' });
+        }
+        finally {
+            await app.close();
+        }
+    });
+    it('blocks browser-readable file APIs from reading the internal API token', async () => {
+        fs.writeFileSync(path.join(dataDir, 'internal-api-token'), 'secret-internal-token\n', 'utf-8');
+        const app = await buildTestApp();
+        try {
+            const response = await app.inject({
+                method: 'GET',
+                url: `/read?workingDir=${encodeURIComponent(dataDir)}&path=internal-api-token`,
+            });
+            expect(response.statusCode).toBe(403);
+            expect(response.json()).toMatchObject({ code: 'INTERNAL_PATH_FORBIDDEN' });
+            expect(response.body).not.toContain('secret-internal-token');
+        }
+        finally {
+            await app.close();
+        }
+    });
+    it('blocks workspace symlinks that point at internal Agent Tower files', async () => {
+        fs.writeFileSync(path.join(dataDir, 'internal-api-token'), 'secret-internal-token\n', 'utf-8');
+        fs.symlinkSync(path.join(dataDir, 'internal-api-token'), path.join(workspaceDir, 'linked-token'), 'file');
+        const app = await buildTestApp();
+        try {
+            const response = await app.inject({
+                method: 'GET',
+                url: `/read?workingDir=${encodeURIComponent(workspaceDir)}&path=linked-token`,
+            });
+            expect(response.statusCode).toBe(403);
+            expect(response.json()).toMatchObject({ code: 'INTERNAL_PATH_FORBIDDEN' });
+            expect(response.body).not.toContain('secret-internal-token');
+        }
+        finally {
+            await app.close();
+        }
+    });
+    it('blocks listing Agent Tower dataDir contents', async () => {
+        fs.writeFileSync(path.join(dataDir, 'data.db'), 'sqlite bytes', 'utf-8');
+        const app = await buildTestApp();
+        try {
+            const response = await app.inject({
+                method: 'GET',
+                url: `/tree?workingDir=${encodeURIComponent(dataDir)}&path=/`,
+            });
+            expect(response.statusCode).toBe(403);
+            expect(response.json()).toMatchObject({ code: 'INTERNAL_PATH_FORBIDDEN' });
+            expect(response.body).not.toContain('data.db');
+        }
+        finally {
+            await app.close();
+        }
+    });
+});
+//# sourceMappingURL=files.test.js.map

package/dist/routes/__tests__/files.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.test.js","sourceRoot":"","sources":["../../../src/routes/__tests__/files.test.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,IAAI,QAAQ,GAAG,EAAE,CAAC;AAClB,IAAI,YAAY,GAAG,EAAE,CAAC;AACtB,IAAI,OAAO,GAAG,EAAE,CAAC;AACjB,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;AAEzD,KAAK,UAAU,YAAY;IACzB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,UAAU,CAAC,GAAG,EAAE;QACd,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;QAC9E,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAChD,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtC,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,OAAO,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,eAAe,CAAC;QACrD,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,oBAAoB,kBAAkB,CAAC,YAAY,CAAC,iBAAiB;aAC3E,CAAC,CAAC;YAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAChE,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,0BAA0B;aAC/E,CAAC,CAAC;YAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAC;QAC/F,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1G,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,oBAAoB,kBAAkB,CAAC,YAAY,CAAC,oBAAoB;aAC9E,CAAC,CAAC;YAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,SAAS;aAC9D,CAAC,CAAC;YAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/routes/__tests__/previews.integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=previews.integration.test.d.ts.map

package/dist/routes/__tests__/previews.integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"previews.integration.test.d.ts","sourceRoot":"","sources":["../../../src/routes/__tests__/previews.integration.test.ts"],"names":[],"mappings":""}