atoo-studio 0.0.1 → 0.0.2

package/dist/src/handlers/auth.js

@@ -0,0 +1,170 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import { db } from '../state/db.js';
+import { hashPassword, verifyPassword } from '../auth/password.js';
+import { createSession, setSessionCookie, clearSessionCookie, destroySession, SESSION_COOKIE_NAME } from '../auth/session.js';
+import { getSessionUser } from '../auth/session.js';
+import { hasTotpEnabled, getTotpSecret, verifyTotpToken } from '../auth/totp.js';
+import { getAuthOptions, verifyAuth } from '../auth/webauthn.js';
+import { requireAuth } from '../auth/middleware.js';
+export const authRouter = Router();
+// GET /api/auth/status — public, returns setup state
+authRouter.get('/api/auth/status', (_req, res) => {
+    const userCount = db.getUserCount();
+    res.json({ setupRequired: userCount === 0, userCount });
+});
+// POST /api/auth/setup — create initial admin (only when no users exist)
+const setupSchema = z.object({
+    username: z.string().min(1).max(64),
+    display_name: z.string().min(1).max(128),
+    password: z.string().min(8).max(256),
+});
+authRouter.post('/api/auth/setup', async (req, res) => {
+    if (db.getUserCount() > 0) {
+        return res.status(400).json({ error: 'Setup already completed' });
+    }
+    const parsed = setupSchema.safeParse(req.body);
+    if (!parsed.success) {
+        return res.status(400).json({ error: 'Invalid input', details: parsed.error.flatten() });
+    }
+    const { username, display_name, password } = parsed.data;
+    const passwordHash = await hashPassword(password);
+    const user = db.createUser(username, display_name, 'admin', passwordHash);
+    // Assign all existing unowned environments to this admin
+    db.assignUnownedEnvironments(user.id);
+    const sessionId = createSession(user.id, req);
+    setSessionCookie(res, sessionId);
+    res.json({
+        user: { id: user.id, username: user.username, display_name: user.display_name, role: user.role },
+    });
+});
+// POST /api/auth/login — password login
+const loginSchema = z.object({
+    username: z.string().min(1),
+    password: z.string().min(1),
+});
+authRouter.post('/api/auth/login', async (req, res) => {
+    const parsed = loginSchema.safeParse(req.body);
+    if (!parsed.success) {
+        return res.status(400).json({ error: 'Invalid input' });
+    }
+    const { username, password } = parsed.data;
+    const user = db.getUserByUsername(username);
+    if (!user) {
+        return res.status(401).json({ error: 'Invalid credentials' });
+    }
+    const valid = await verifyPassword(password, user.password_hash);
+    if (!valid) {
+        return res.status(401).json({ error: 'Invalid credentials' });
+    }
+    // Check if TOTP is enabled — require second factor
+    if (hasTotpEnabled(user.id)) {
+        // Create a short-lived pending session to track the TOTP step
+        const pendingSessionId = createSession(user.id, req);
+        return res.json({
+            totpRequired: true,
+            pendingSessionId,
+        });
+    }
+    const sessionId = createSession(user.id, req);
+    setSessionCookie(res, sessionId);
+    res.json({
+        user: { id: user.id, username: user.username, display_name: user.display_name, role: user.role },
+    });
+});
+// POST /api/auth/login/totp — verify TOTP after password
+const totpLoginSchema = z.object({
+    pendingSessionId: z.string().min(1),
+    token: z.string().length(6),
+});
+authRouter.post('/api/auth/login/totp', (req, res) => {
+    const parsed = totpLoginSchema.safeParse(req.body);
+    if (!parsed.success) {
+        return res.status(400).json({ error: 'Invalid input' });
+    }
+    const { pendingSessionId, token } = parsed.data;
+    const user = getSessionUser(pendingSessionId);
+    if (!user) {
+        return res.status(401).json({ error: 'Invalid or expired pending session' });
+    }
+    const secret = getTotpSecret(user.id);
+    if (!secret) {
+        return res.status(400).json({ error: 'TOTP not configured' });
+    }
+    if (!verifyTotpToken(secret, token)) {
+        return res.status(401).json({ error: 'Invalid TOTP code' });
+    }
+    // TOTP verified — promote to full session (reuse the pending session)
+    setSessionCookie(res, pendingSessionId);
+    res.json({
+        user: { id: user.id, username: user.username, display_name: user.display_name, role: user.role },
+    });
+});
+// POST /api/auth/login/passkey/options — get passkey authentication options
+const passkeyOptionsSchema = z.object({
+    username: z.string().min(1),
+});
+authRouter.post('/api/auth/login/passkey/options', async (req, res) => {
+    const parsed = passkeyOptionsSchema.safeParse(req.body);
+    if (!parsed.success) {
+        return res.status(400).json({ error: 'Invalid input' });
+    }
+    const user = db.getUserByUsername(parsed.data.username);
+    if (!user) {
+        return res.status(401).json({ error: 'Invalid credentials' });
+    }
+    const passkeys = db.listPasskeys(user.id);
+    if (passkeys.length === 0) {
+        return res.status(400).json({ error: 'No passkeys registered' });
+    }
+    const rpID = req.hostname;
+    const options = await getAuthOptions(user.id, rpID);
+    res.json({ options, userId: user.id });
+});
+// POST /api/auth/login/passkey — verify passkey authentication
+const passkeyLoginSchema = z.object({
+    userId: z.string().min(1),
+    response: z.any(),
+});
+authRouter.post('/api/auth/login/passkey', async (req, res) => {
+    const parsed = passkeyLoginSchema.safeParse(req.body);
+    if (!parsed.success) {
+        return res.status(400).json({ error: 'Invalid input' });
+    }
+    const { userId, response } = parsed.data;
+    const user = db.getUser(userId);
+    if (!user) {
+        return res.status(401).json({ error: 'Invalid credentials' });
+    }
+    const rpID = req.hostname;
+    const origin = `${req.protocol}://${req.headers.host}`;
+    const verified = await verifyAuth(userId, rpID, origin, response);
+    if (!verified) {
+        return res.status(401).json({ error: 'Passkey verification failed' });
+    }
+    const sessionId = createSession(user.id, req);
+    setSessionCookie(res, sessionId);
+    res.json({
+        user: { id: user.id, username: user.username, display_name: user.display_name, role: user.role },
+    });
+});
+// POST /api/auth/logout — destroy session
+authRouter.post('/api/auth/logout', (req, res) => {
+    const sessionId = req.cookies?.[SESSION_COOKIE_NAME];
+    if (sessionId) {
+        destroySession(sessionId);
+    }
+    clearSessionCookie(res);
+    res.json({ ok: true });
+});
+// GET /api/auth/me — get current user info
+authRouter.get('/api/auth/me', requireAuth, (req, res) => {
+    const user = req.user;
+    const hasTOTP = hasTotpEnabled(user.id);
+    const passkeys = db.listPasskeys(user.id);
+    res.json({
+        user: { id: user.id, username: user.username, display_name: user.display_name, role: user.role },
+        hasTOTP,
+        passkeyCount: passkeys.length,
+    });
+});

package/dist/src/handlers/changes.d.ts

@@ -0,0 +1 @@
+export declare const changesRouter: import("express-serve-static-core").Router;

package/dist/src/handlers/changes.js

@@ -0,0 +1,203 @@
+import { Router } from 'express';
+import { fsMonitor } from '../fs-monitor.js';
+import { store } from '../state/store.js';
+export const changesRouter = Router();
+/**
+ * Consolidate raw change events to remove artifacts from atomic write patterns.
+ *
+ * Claude Code does: write(tmp) → rename(tmp → final). With LD_PRELOAD we see:
+ *   1. Write(tmp)                — open with O_WRONLY|O_CREAT on tmp file
+ *   2. Rename(final, old=tmp)    — rename from tmp to final
+ *
+ * Consolidation rules:
+ *   - Rename absorbs: if a Rename has old_path matching a Write/Create, remove the Write/Create
+ *     (the tmp file was just an intermediate artifact) and promote the Rename.
+ *   - Create + Delete cancel: if a path is Created then Deleted in the same batch, remove both.
+ *   - Deduplicate: multiple writes to the same path keep only the last one.
+ */
+function consolidateChanges(changes) {
+    if (changes.length <= 1)
+        return changes;
+    const result = [...changes];
+    const toRemove = new Set();
+    // Index changes by path
+    const createsByPath = new Map();
+    const deletesByPath = new Map();
+    for (let i = 0; i < result.length; i++) {
+        const c = result[i];
+        if (c.operation === 'create') {
+            if (!createsByPath.has(c.path))
+                createsByPath.set(c.path, []);
+            createsByPath.get(c.path).push(i);
+        }
+        else if (c.operation === 'delete') {
+            if (!deletesByPath.has(c.path))
+                deletesByPath.set(c.path, []);
+            deletesByPath.get(c.path).push(i);
+        }
+    }
+    // Rule 1: Rename absorbs its old_path Create/Write (remove tmp file artifacts)
+    // Promote Rename → Create/Modify
+    for (let i = 0; i < result.length; i++) {
+        const c = result[i];
+        if (c.operation === 'rename' && c.oldPath && !toRemove.has(i)) {
+            const oldCreates = createsByPath.get(c.oldPath);
+            if (oldCreates) {
+                for (const ci of oldCreates) {
+                    toRemove.add(ci);
+                }
+                // If before_hash exists, the target file existed before → modify
+                // Otherwise it's a new file → create
+                const op = c.beforeHash ? 'modify' : 'create';
+                result[i] = { ...c, operation: op, oldPath: undefined };
+            }
+        }
+    }
+    // Rule 2: Create + Delete cancel out
+    for (const [, createIndices] of createsByPath) {
+        const path = result[createIndices[0]]?.path;
+        if (!path)
+            continue;
+        const delIndices = deletesByPath.get(path);
+        if (delIndices && delIndices.length > 0) {
+            let ci = 0, di = 0;
+            while (ci < createIndices.length && di < delIndices.length) {
+                const createIdx = createIndices[ci];
+                const deleteIdx = delIndices[di];
+                if (toRemove.has(createIdx)) {
+                    ci++;
+                    continue;
+                }
+                if (toRemove.has(deleteIdx)) {
+                    di++;
+                    continue;
+                }
+                if (deleteIdx > createIdx) {
+                    toRemove.add(createIdx);
+                    toRemove.add(deleteIdx);
+                    ci++;
+                    di++;
+                }
+                else {
+                    di++;
+                }
+            }
+        }
+    }
+    // Rule 3: Deduplicate writes/creates for the same path — keep last
+    const dedupByPath = new Map();
+    for (let i = 0; i < result.length; i++) {
+        if (toRemove.has(i))
+            continue;
+        const c = result[i];
+        if (c.operation === 'create' || c.operation === 'modify') {
+            if (!dedupByPath.has(c.path))
+                dedupByPath.set(c.path, []);
+            dedupByPath.get(c.path).push(i);
+        }
+    }
+    for (const [, indices] of dedupByPath) {
+        if (indices.length <= 1)
+            continue;
+        const keep = indices[indices.length - 1];
+        for (const i of indices) {
+            if (i !== keep)
+                toRemove.add(i);
+        }
+    }
+    return result.filter((_, i) => !toRemove.has(i));
+}
+// GET /api/sessions/:id/changes — list file changes for a session
+changesRouter.get('/api/sessions/:id/changes', async (req, res) => {
+    const sessionId = req.params.id;
+    const session = store.sessions.get(sessionId);
+    if (!session)
+        return res.status(404).json({ error: 'Session not found' });
+    const from = req.query.from ? parseFloat(req.query.from) : undefined;
+    const to = req.query.to ? parseFloat(req.query.to) : undefined;
+    const changes = consolidateChanges(fsMonitor.getChangesInRange(sessionId, from, to));
+    // Materialize after_hash lazily for non-delete changes
+    for (const c of changes) {
+        if (c.afterHash === null && c.operation !== 'delete') {
+            await fsMonitor.materializeAfterHash(c);
+        }
+    }
+    res.json({
+        available: fsMonitor.isAvailable(),
+        changes: changes.map(c => ({
+            change_id: c.changeId,
+            session_id: c.sessionId,
+            timestamp: c.timestamp,
+            pid: c.pid,
+            operation: c.operation,
+            path: c.path,
+            old_path: c.oldPath || null,
+            before_hash: c.beforeHash,
+            after_hash: c.afterHash,
+            file_size: c.fileSize,
+            is_binary: c.isBinary,
+        })),
+    });
+});
+// GET /api/sessions/:id/changes/:changeId/diff — get diff data for a change
+changesRouter.get('/api/sessions/:id/changes/:changeId/diff', async (req, res) => {
+    const change = fsMonitor.findChange(req.params.changeId);
+    if (!change)
+        return res.status(404).json({ error: 'Change not found' });
+    // Materialize after_hash if needed
+    if (change.afterHash === null && change.operation !== 'delete') {
+        await fsMonitor.materializeAfterHash(change);
+    }
+    let before = null;
+    let after = null;
+    if (change.beforeHash) {
+        before = await fsMonitor.getFileContent(change.beforeHash);
+    }
+    if (change.afterHash) {
+        after = await fsMonitor.getFileContent(change.afterHash);
+    }
+    res.json({
+        operation: change.operation,
+        path: change.path,
+        old_path: change.oldPath || null,
+        before, // base64-encoded or null
+        after, // base64-encoded or null
+        is_binary: change.isBinary,
+        file_size: change.fileSize,
+        before_hash: change.beforeHash,
+        after_hash: change.afterHash,
+        timestamp: change.timestamp,
+    });
+});
+// POST /api/sessions/:id/changes/:changeId/revert — revert a single change
+changesRouter.post('/api/sessions/:id/changes/:changeId/revert', async (req, res) => {
+    const change = fsMonitor.findChange(req.params.changeId);
+    if (!change)
+        return res.status(404).json({ error: 'Change not found' });
+    const result = await fsMonitor.revertChange(change);
+    res.json(result);
+});
+// POST /api/sessions/:id/changes/revert-all — revert all changes for a session
+changesRouter.post('/api/sessions/:id/changes/revert-all', async (req, res) => {
+    const sessionId = req.params.id;
+    const session = store.sessions.get(sessionId);
+    if (!session)
+        return res.status(404).json({ error: 'Session not found' });
+    const result = await fsMonitor.revertAll(sessionId);
+    res.json(result);
+});
+// GET /api/objects/:hash — download raw file content from object store
+changesRouter.get('/api/objects/{*hash}', async (req, res) => {
+    const hash = Array.isArray(req.params.hash) ? req.params.hash.join('/') : (req.params.hash ?? '');
+    if (!hash)
+        return res.status(400).json({ error: 'Hash required' });
+    const content = await fsMonitor.getFileContent(hash);
+    if (!content) {
+        return res.status(404).json({ error: 'Object not found' });
+    }
+    const buf = Buffer.from(content, 'base64');
+    res.setHeader('Content-Type', 'application/octet-stream');
+    res.setHeader('Content-Disposition', 'attachment');
+    res.setHeader('Content-Length', buf.length);
+    res.send(buf);
+});

package/dist/src/handlers/containers.d.ts

@@ -0,0 +1,12 @@
+export declare const containersRouter: import("express-serve-static-core").Router;
+interface RuntimeStatus {
+    installed: boolean;
+    accessible: boolean;
+    error?: string;
+}
+export declare function getContainerRuntimes(): {
+    docker: RuntimeStatus;
+    podman: RuntimeStatus;
+    lxc: RuntimeStatus;
+};
+export {};