agentdev-webui 1.0.0

package/lib/routes.js

@@ -0,0 +1,680 @@
+const agentApi = require('./agent-api');
+const deviceFlow = require('./device-flow');
+const db = require('./database');
+const encryption = require('./encryption');
+const auth = require('./auth');
+
+/**
+ * Register all API routes
+ */
+function registerRoutes(req, res) {
+  const url = req.url.split('?')[0];
+  const method = req.method;
+
+  // ============================================================================
+  // Agent API Routes (require JWT authentication)
+  // ============================================================================
+
+  if (url === '/api/agent/device/code' && method === 'POST') {
+    return agentApi.handleDeviceCodeRequest(req, res);
+  }
+
+  if (url === '/api/agent/device/token' && method === 'POST') {
+    return agentApi.handleDeviceTokenPoll(req, res);
+  }
+
+  if (url === '/api/agent/heartbeat' && method === 'POST') {
+    return agentApi.handleHeartbeat(req, res);
+  }
+
+  if (url === '/api/agent/work' && method === 'GET') {
+    return agentApi.handleWorkRequest(req, res);
+  }
+
+  if (url === '/api/agent/logs' && method === 'POST') {
+    return agentApi.handleLogUpload(req, res);
+  }
+
+  if (url === '/api/agent/complete' && method === 'POST') {
+    return agentApi.handleWorkComplete(req, res);
+  }
+
+  if (url === '/api/agent/oauth' && method === 'GET') {
+    return agentApi.handleOAuthRequest(req, res);
+  }
+
+  if (url === '/api/agent/ensure-ticket' && method === 'POST') {
+    return agentApi.handleEnsureTicket(req, res);
+  }
+
+  if (url === '/api/agent/should-stop' && method === 'GET') {
+    return agentApi.handleShouldStop(req, res);
+  }
+
+  // Project board configuration (no auth — agents need this during registration)
+  if (url === '/api/agent/project-config' && method === 'GET') {
+    const config = require('./config');
+    const urlObj = new URL(req.url, `http://${req.headers.host}`);
+    const projectId = urlObj.searchParams.get('project_id');
+
+    (async () => {
+      try {
+        let projectData = null;
+        if (projectId) {
+          projectData = await db.getProjectById(parseInt(projectId));
+        }
+        if (!projectData) {
+          // Try project 1 from DB, fallback to config
+          projectData = await db.getProjectById(1);
+        }
+
+        if (projectData) {
+          const statusOptions = typeof projectData.status_options === 'string'
+            ? JSON.parse(projectData.status_options)
+            : projectData.status_options;
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({
+            github_org: projectData.github_org,
+            project_id: projectData.github_project_id,
+            project_number: projectData.project_number,
+            status_field_id: projectData.status_field_id,
+            status_options: statusOptions
+          }));
+        } else {
+          // Fallback to hardcoded config
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({
+            github_org: config.GITHUB_ORG,
+            project_id: config.PROJECT_ID,
+            project_number: config.PROJECT_NUMBER,
+            status_field_id: config.STATUS_FIELD_ID,
+            status_options: config.STATUS_OPTIONS
+          }));
+        }
+      } catch (error) {
+        console.error('Project config error:', error);
+        // Fallback to hardcoded config
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+          github_org: config.GITHUB_ORG,
+          project_id: config.PROJECT_ID,
+          project_number: config.PROJECT_NUMBER,
+          status_field_id: config.STATUS_FIELD_ID,
+          status_options: config.STATUS_OPTIONS
+        }));
+      }
+    })();
+    return true;
+  }
+
+  // ============================================================================
+  // Device Authorization Routes (require user session)
+  // ============================================================================
+
+  if (url === '/api/device/lookup' && method === 'POST') {
+    if (!auth.isAuthenticated(req)) {
+      res.writeHead(401, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Unauthorized' }));
+      return true;
+    }
+
+    let body = '';
+    req.on('data', chunk => body += chunk);
+    req.on('end', async () => {
+      try {
+        const { user_code } = JSON.parse(body);
+
+        const deviceData = await deviceFlow.getDeviceCodeByUserCode(user_code);
+
+        if (!deviceData) {
+          res.writeHead(404, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Invalid or expired code' }));
+          return;
+        }
+
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(deviceData));
+      } catch (error) {
+        console.error('Device lookup error:', error);
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: error.message }));
+      }
+    });
+    return true;
+  }
+
+  if (url === '/api/device/approve' && method === 'POST') {
+    if (!auth.isAuthenticated(req)) {
+      res.writeHead(401, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Unauthorized' }));
+      return true;
+    }
+
+    let body = '';
+    req.on('data', chunk => body += chunk);
+    req.on('end', async () => {
+      try {
+        const { user_code } = JSON.parse(body);
+
+        // Get user ID from session
+        // For now, use default user ID 1 (would need proper user session management)
+        const userId = 1;
+
+        await deviceFlow.approveDeviceCode(user_code, userId);
+
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true }));
+      } catch (error) {
+        console.error('Device approve error:', error);
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: error.message }));
+      }
+    });
+    return true;
+  }
+
+  if (url === '/api/device/deny' && method === 'POST') {
+    if (!auth.isAuthenticated(req)) {
+      res.writeHead(401, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Unauthorized' }));
+      return true;
+    }
+
+    let body = '';
+    req.on('data', chunk => body += chunk);
+    req.on('end', async () => {
+      try {
+        const { user_code } = JSON.parse(body);
+
+        await deviceFlow.denyDeviceCode(user_code);
+
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true }));
+      } catch (error) {
+        console.error('Device deny error:', error);
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: error.message }));
+      }
+    });
+    return true;
+  }
+
+  // ============================================================================
+  // Profile Routes (require user session)
+  // ============================================================================
+
+  if (url === '/api/profile' && method === 'GET') {
+    if (!auth.isAuthenticated(req)) {
+      res.writeHead(401, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Unauthorized' }));
+      return true;
+    }
+
+    (async () => {
+      try {
+        // Get user from session (for now, use default user ID 1)
+        const userId = 1;
+        const user = await db.getUserById(userId);
+
+        if (!user) {
+          res.writeHead(404, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'User not found' }));
+          return;
+        }
+
+        // Get user's OAuth providers from unified table
+        const oauthProviders = await db.getUserOAuthProviders(userId);
+
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+          email: user.email,
+          max_agents: user.max_agents,
+          oauth_providers: oauthProviders.map(p => ({
+            provider_key: p.provider_key,
+            provider_name: p.provider_name,
+            status: p.status,
+            scopes: p.scopes,
+            has_token: !!p.access_token
+          })),
+          has_github_token: oauthProviders.some(p => p.provider_key === 'github' && p.access_token) || !!user.github_token_encrypted
+        }));
+      } catch (error) {
+        console.error('Profile get error:', error);
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: error.message }));
+      }
+    })();
+    return true;
+  }
+
+  if (url === '/api/profile/limits' && method === 'POST') {
+    if (!auth.isAuthenticated(req)) {
+      res.writeHead(401, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Unauthorized' }));
+      return true;
+    }
+
+    let body = '';
+    req.on('data', chunk => body += chunk);
+    req.on('end', async () => {
+      try {
+        const { max_agents } = JSON.parse(body);
+
+        // Update user (for now, use default user ID 1)
+        const userId = 1;
+        await db.query(
+          'UPDATE agentdev_users SET max_agents = $1 WHERE id = $2',
+          [max_agents, userId]
+        );
+
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true }));
+      } catch (error) {
+        console.error('Limits update error:', error);
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: error.message }));
+      }
+    });
+    return true;
+  }
+
+  if (url === '/api/agents' && method === 'GET') {
+    if (!auth.isAuthenticated(req)) {
+      res.writeHead(401, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Unauthorized' }));
+      return true;
+    }
+
+    (async () => {
+      try {
+        // Get user agents (for now, use default user ID 1)
+        const userId = 1;
+        const agents = await db.getAgentsByUser(userId);
+
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(agents));
+      } catch (error) {
+        console.error('Agents list error:', error);
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: error.message }));
+      }
+    })();
+    return true;
+  }
+
+  // ============================================================================
+  // Project Routes (require user session)
+  // ============================================================================
+
+  if (url === '/api/projects' && method === 'GET') {
+    if (!auth.isAuthenticated(req)) {
+      res.writeHead(401, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Unauthorized' }));
+      return true;
+    }
+
+    (async () => {
+      try {
+        const projects = await db.getProjects();
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(projects));
+      } catch (error) {
+        console.error('Projects list error:', error);
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: error.message }));
+      }
+    })();
+    return true;
+  }
+
+  if (url === '/api/projects' && method === 'POST') {
+    if (!auth.isAuthenticated(req)) {
+      res.writeHead(401, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Unauthorized' }));
+      return true;
+    }
+
+    let body = '';
+    req.on('data', chunk => body += chunk);
+    req.on('end', async () => {
+      try {
+        const data = JSON.parse(body);
+        if (!data.name || !data.github_org || !data.project_number || !data.github_project_id || !data.status_field_id) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Missing required fields: name, github_org, project_number, github_project_id, status_field_id' }));
+          return;
+        }
+
+        // If save_token_globally, save the token to unified OAuth table
+        if (data.save_token_globally && data.github_token) {
+          const sessionId = auth.getSessionFromRequest(req);
+          const session = auth.getSession(sessionId);
+          if (session?.userId) {
+            const encryptedToken = encryption.encrypt(data.github_token);
+            // Save to unified OAuth providers table
+            const githubConfig = await db.getOAuthProviderConfig('github');
+            if (githubConfig) {
+              await db.upsertOAuthProvider({
+                userId: session.userId,
+                configId: githubConfig.id,
+                providerKey: 'github',
+                accessToken: encryptedToken,
+                scopes: ['repo', 'read:org', 'project']
+              });
+              console.log(`Saved GitHub token to unified OAuth table for user ${session.userId}`);
+            }
+            // Also save to legacy column for backward compatibility
+            await db.updateUserGitHubToken(session.userId, encryptedToken);
+          }
+        }
+        delete data.save_token_globally;
+
+        const project = await db.createProject(data);
+        // Don't leak token back to frontend
+        const { github_token: _token, ...safeProject } = project;
+        res.writeHead(201, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(safeProject));
+      } catch (error) {
+        console.error('Project create error:', error);
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: error.message }));
+      }
+    });
+    return true;
+  }
+
+  // PUT /api/projects/:id
+  const projectUpdateMatch = url.match(/^\/api\/projects\/(\d+)$/);
+  if (projectUpdateMatch && method === 'PUT') {
+    if (!auth.isAuthenticated(req)) {
+      res.writeHead(401, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Unauthorized' }));
+      return true;
+    }
+
+    const projectId = parseInt(projectUpdateMatch[1]);
+    let body = '';
+    req.on('data', chunk => body += chunk);
+    req.on('end', async () => {
+      try {
+        const data = JSON.parse(body);
+        const project = await db.updateProject(projectId, data);
+        if (!project) {
+          res.writeHead(404, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Project not found' }));
+          return;
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(project));
+      } catch (error) {
+        console.error('Project update error:', error);
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: error.message }));
+      }
+    });
+    return true;
+  }
+
+  // DELETE /api/projects/:id
+  const projectDeleteMatch = url.match(/^\/api\/projects\/(\d+)$/);
+  if (projectDeleteMatch && method === 'DELETE') {
+    if (!auth.isAuthenticated(req)) {
+      res.writeHead(401, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Unauthorized' }));
+      return true;
+    }
+
+    const projectId = parseInt(projectDeleteMatch[1]);
+    (async () => {
+      try {
+        const project = await db.deleteProject(projectId);
+        if (!project) {
+          res.writeHead(404, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Project not found' }));
+          return;
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true }));
+      } catch (error) {
+        console.error('Project delete error:', error);
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: error.message }));
+      }
+    })();
+    return true;
+  }
+
+  // POST /api/agents/:id/project — assign agent to project
+  const agentProjectMatch = url.match(/^\/api\/agents\/([^/]+)\/project$/);
+  if (agentProjectMatch && method === 'POST') {
+    if (!auth.isAuthenticated(req)) {
+      res.writeHead(401, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Unauthorized' }));
+      return true;
+    }
+
+    const agentId = agentProjectMatch[1];
+    let body = '';
+    req.on('data', chunk => body += chunk);
+    req.on('end', async () => {
+      try {
+        const { project_id } = JSON.parse(body);
+        const agent = await db.assignAgentToProject(agentId, project_id);
+        if (!agent) {
+          res.writeHead(404, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Agent not found' }));
+          return;
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(agent));
+      } catch (error) {
+        console.error('Agent project assign error:', error);
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: error.message }));
+      }
+    });
+    return true;
+  }
+
+  // GET /api/github/repos?org=<org>&token=<optional> — fetch repos from a GitHub org
+  if (url === '/api/github/repos' && method === 'GET') {
+    if (!auth.isAuthenticated(req)) {
+      res.writeHead(401, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Unauthorized' }));
+      return true;
+    }
+
+    const urlObj = new URL(req.url, `http://${req.headers.host}`);
+    const org = urlObj.searchParams.get('org');
+    const projectToken = urlObj.searchParams.get('token') || null;
+
+    if (!org) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'org parameter is required' }));
+      return true;
+    }
+
+    (async () => {
+      try {
+        // Resolve token: provided project token > unified OAuth table > legacy column > env default
+        let token = projectToken;
+        if (!token) {
+          const sessionId = auth.getSessionFromRequest(req);
+          const session = auth.getSession(sessionId);
+          if (session?.userId) {
+            const oauthProvider = await db.getOAuthProvider(session.userId, 'github');
+            if (oauthProvider?.access_token) {
+              token = encryption.decrypt(oauthProvider.access_token);
+            }
+            if (!token) {
+              const user = await db.getUserById(session.userId);
+              if (user?.github_token_encrypted) {
+                token = encryption.decrypt(user.github_token_encrypted);
+              }
+            }
+          }
+        }
+        if (!token) {
+          token = process.env.GH_TOKEN || process.env.GITHUB_DEFAULT_TOKEN || null;
+        }
+        if (!token) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'No GitHub token available' }));
+          return;
+        }
+
+        // Fetch repos from GitHub org (up to 100)
+        const ghRes = await fetch(`https://api.github.com/orgs/${encodeURIComponent(org)}/repos?per_page=100&sort=name`, {
+          headers: {
+            'Authorization': `Bearer ${token}`,
+            'Accept': 'application/vnd.github+json',
+            'X-GitHub-Api-Version': '2022-11-28'
+          }
+        });
+
+        if (!ghRes.ok) {
+          const text = await ghRes.text();
+          res.writeHead(ghRes.status, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: `GitHub API error (${ghRes.status}): ${text}` }));
+          return;
+        }
+
+        const repos = await ghRes.json();
+        const repoNames = repos.map(r => r.name).sort();
+
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(repoNames));
+      } catch (error) {
+        console.error('GitHub repos fetch error:', error);
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: error.message }));
+      }
+    })();
+    return true;
+  }
+
+  // GET /api/github/project-fields?org=<org>&project_number=<num>&token=<optional>
+  // Fetch status field ID and options from a GitHub project board
+  if (url === '/api/github/project-fields' && method === 'GET') {
+    if (!auth.isAuthenticated(req)) {
+      res.writeHead(401, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Unauthorized' }));
+      return true;
+    }
+
+    const urlObj = new URL(req.url, `http://${req.headers.host}`);
+    const org = urlObj.searchParams.get('org');
+    const projectNumber = parseInt(urlObj.searchParams.get('project_number'));
+    const projectToken = urlObj.searchParams.get('token') || null;
+
+    if (!org || !projectNumber) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'org and project_number parameters are required' }));
+      return true;
+    }
+
+    (async () => {
+      try {
+        // Resolve token: unified OAuth table > legacy column > env default
+        let token = projectToken;
+        if (!token) {
+          const sessionId = auth.getSessionFromRequest(req);
+          const session = auth.getSession(sessionId);
+          if (session?.userId) {
+            const oauthProvider = await db.getOAuthProvider(session.userId, 'github');
+            if (oauthProvider?.access_token) {
+              token = encryption.decrypt(oauthProvider.access_token);
+            }
+            if (!token) {
+              const user = await db.getUserById(session.userId);
+              if (user?.github_token_encrypted) {
+                token = encryption.decrypt(user.github_token_encrypted);
+              }
+            }
+          }
+        }
+        if (!token) {
+          token = process.env.GH_TOKEN || process.env.GITHUB_DEFAULT_TOKEN || null;
+        }
+        if (!token) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'No GitHub token available' }));
+          return;
+        }
+
+        // GraphQL query to fetch project ID, status field, and its options
+        const ghRes = await fetch('https://api.github.com/graphql', {
+          method: 'POST',
+          headers: {
+            'Authorization': `Bearer ${token}`,
+            'Content-Type': 'application/json'
+          },
+          body: JSON.stringify({
+            query: `query($org: String!, $num: Int!) {
+              organization(login: $org) {
+                projectV2(number: $num) {
+                  id
+                  title
+                  fields(first: 30) {
+                    nodes {
+                      ... on ProjectV2SingleSelectField {
+                        id
+                        name
+                        options {
+                          id
+                          name
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }`,
+            variables: { org, num: projectNumber }
+          })
+        });
+
+        if (!ghRes.ok) {
+          const text = await ghRes.text();
+          res.writeHead(ghRes.status, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: `GitHub GraphQL error (${ghRes.status}): ${text}` }));
+          return;
+        }
+
+        const json = await ghRes.json();
+        if (json.errors) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: json.errors[0].message }));
+          return;
+        }
+
+        const project = json.data.organization.projectV2;
+        // Find the Status field (single-select field named "Status")
+        const statusField = project.fields.nodes.find(f => f.name === 'Status' && f.options);
+
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+          project_id: project.id,
+          project_title: project.title,
+          status_field: statusField ? {
+            id: statusField.id,
+            name: statusField.name,
+            options: statusField.options
+          } : null
+        }));
+      } catch (error) {
+        console.error('GitHub project fields fetch error:', error);
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: error.message }));
+      }
+    })();
+    return true;
+  }
+
+  // Route not handled
+  return false;
+}
+
+module.exports = {
+  registerRoutes
+};