auramaxx 0.0.1

package/server/routes/adapters.ts

@@ -0,0 +1,711 @@
+import { Router, Request, Response } from 'express';
+import { createHmac, randomBytes, timingSafeEqual } from 'crypto';
+import { prisma } from '../lib/db';
+import { requireWalletAuth } from '../middleware/auth';
+import { requirePermission } from '../lib/permissions';
+import { ApprovalRouter, loadAdaptersFromDb } from '../lib/adapters';
+import { SERVER_PORT } from '../lib/config';
+import { validateExternalUrl } from '../lib/network';
+import {
+  ensureApiKeysMigrated,
+  listApiKeyCredentials,
+  readApiKeyValueByServiceName,
+} from '../lib/apikey-migration';
+import { logger } from '../lib/logger';
+import { getErrorMessage } from '../lib/error';
+
+/** Reference to the live approval router (set via setApprovalRouter) */
+let approvalRouter: ApprovalRouter | null = null;
+
+/** In-memory nonce store for Telegram chat ID auto-detection */
+interface SetupNonce {
+  botToken: string;
+  botUsername: string;
+  expiresAt: number;
+  /** getUpdates offset — skip all updates before this ID */
+  offset?: number;
+}
+const telegramSetupNonces = new Map<string, SetupNonce>();
+
+/** Exported for testing */
+export { telegramSetupNonces };
+
+/** Called from server/index.ts to share the approval router reference */
+export function setApprovalRouter(router: ApprovalRouter | null): void {
+  approvalRouter = router;
+}
+
+/** Called from server/index.ts to read current router */
+export function getApprovalRouter(): ApprovalRouter | null {
+  return approvalRouter;
+}
+
+const router = Router();
+
+function listAdapterSecretNames(): Record<string, string[]> {
+  const records = listApiKeyCredentials().filter((credential) =>
+    credential.service.startsWith('adapter:'),
+  );
+
+  const byType: Record<string, string[]> = {};
+  for (const record of records) {
+    const adapterType = record.service.replace('adapter:', '');
+    if (!byType[adapterType]) byType[adapterType] = [];
+    byType[adapterType].push(record.name);
+  }
+  return byType;
+}
+
+async function readAdapterSecret(type: string, name: string): Promise<string | null> {
+  await ensureApiKeysMigrated();
+  return readApiKeyValueByServiceName(`adapter:${type}`, name);
+}
+
+// GET /adapters — List configured adapters
+router.get('/', requireWalletAuth, requirePermission('adapter:manage'), async (_req: Request, res: Response) => {
+  try {
+    const appConfig = await prisma.appConfig.findUnique({
+      where: { id: 'global' },
+    });
+
+    let config: { enabled: boolean; chat?: { defaultApp?: string }; adapters: Array<{ type: string; enabled: boolean; config: Record<string, unknown>; chat?: { enabled?: boolean } }> } = {
+      enabled: false,
+      adapters: [],
+    };
+
+    if (appConfig?.adapterConfig) {
+      try {
+        config = JSON.parse(appConfig.adapterConfig);
+      } catch {
+        // Invalid JSON, return default
+      }
+    }
+
+    await ensureApiKeysMigrated();
+    const secretsByType = listAdapterSecretNames();
+
+    // Annotate adapters with secret status
+    const adapters = (config.adapters || []).map((a) => ({
+      type: a.type,
+      enabled: a.enabled,
+      config: a.config,
+      chat: a.chat,
+      hasSecrets: (secretsByType[a.type] || []).length > 0,
+      secretKeys: secretsByType[a.type] || [],
+    }));
+
+    res.json({
+      success: true,
+      enabled: config.enabled,
+      chat: config.chat,
+      adapters,
+      running: approvalRouter !== null,
+    });
+  } catch (error) {
+    const message = getErrorMessage(error);
+    res.status(500).json({ error: message });
+  }
+});
+
+// POST /adapters — Save adapter config
+router.post('/', requireWalletAuth, requirePermission('adapter:manage'), async (req: Request, res: Response) => {
+  try {
+    const { type, enabled, config, chat: chatConfig } = req.body;
+
+    if (!type || typeof type !== 'string') {
+      res.status(400).json({ error: 'type is required' });
+      return;
+    }
+
+    if (typeof enabled !== 'boolean') {
+      res.status(400).json({ error: 'enabled must be a boolean' });
+      return;
+    }
+
+    // Read current config
+    const appConfig = await prisma.appConfig.findUnique({
+      where: { id: 'global' },
+    });
+
+    let current: { enabled: boolean; chat?: { defaultApp?: string }; adapters: Array<{ type: string; enabled: boolean; config: Record<string, unknown>; chat?: { enabled?: boolean } }> } = {
+      enabled: true,
+      adapters: [],
+    };
+
+    if (appConfig?.adapterConfig) {
+      try {
+        current = JSON.parse(appConfig.adapterConfig);
+      } catch {
+        // Reset on invalid JSON
+      }
+    }
+
+    // Upsert the adapter entry
+    const idx = current.adapters.findIndex((a) => a.type === type);
+    const entry: { type: string; enabled: boolean; config: Record<string, unknown>; chat?: { enabled?: boolean } } = { type, enabled, config: config || {} };
+    if (chatConfig && typeof chatConfig === 'object') {
+      entry.chat = chatConfig;
+    }
+
+    if (idx >= 0) {
+      current.adapters[idx] = entry;
+    } else {
+      current.adapters.push(entry);
+    }
+
+    // If any adapter is being enabled, enable the system
+    if (enabled) {
+      current.enabled = true;
+    }
+
+    await prisma.appConfig.upsert({
+      where: { id: 'global' },
+      update: { adapterConfig: JSON.stringify(current) },
+      create: { id: 'global', adapterConfig: JSON.stringify(current) },
+    });
+
+    const action = idx >= 0 ? 'updated' : 'created';
+    logger.adapterChanged(action, type);
+
+    res.json({ success: true, adapter: entry });
+  } catch (error) {
+    const message = getErrorMessage(error);
+    res.status(500).json({ error: message });
+  }
+});
+
+// DELETE /adapters/:type — Remove adapter config
+router.delete('/:type', requireWalletAuth, requirePermission('adapter:manage'), async (req: Request, res: Response) => {
+  try {
+    const { type } = req.params;
+
+    const appConfig = await prisma.appConfig.findUnique({
+      where: { id: 'global' },
+    });
+
+    if (!appConfig?.adapterConfig) {
+      res.status(404).json({ error: 'No adapter config found' });
+      return;
+    }
+
+    let current: { enabled: boolean; adapters: Array<{ type: string; enabled: boolean; config: Record<string, unknown> }> };
+    try {
+      current = JSON.parse(appConfig.adapterConfig);
+    } catch {
+      res.status(500).json({ error: 'Invalid adapter config in database' });
+      return;
+    }
+
+    const idx = current.adapters.findIndex((a) => a.type === type);
+    if (idx < 0) {
+      res.status(404).json({ error: `Adapter type '${type}' not found` });
+      return;
+    }
+
+    current.adapters.splice(idx, 1);
+
+    // If no adapters remain, disable the system
+    if (current.adapters.length === 0) {
+      current.enabled = false;
+    }
+
+    await prisma.appConfig.update({
+      where: { id: 'global' },
+      data: { adapterConfig: JSON.stringify(current) },
+    });
+
+    logger.adapterChanged('deleted', type);
+
+    res.json({ success: true, message: `Adapter '${type}' removed` });
+  } catch (error) {
+    const message = getErrorMessage(error);
+    res.status(500).json({ error: message });
+  }
+});
+
+// POST /adapters/test — Send a test message through a configured adapter
+router.post('/test', requireWalletAuth, requirePermission('adapter:manage'), async (req: Request, res: Response) => {
+  try {
+    const { type } = req.body;
+
+    if (!type || typeof type !== 'string') {
+      res.status(400).json({ error: 'type is required' });
+      return;
+    }
+
+    // 5s timeout for external calls
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5000);
+
+    try {
+      switch (type) {
+        case 'telegram': {
+          // Read bot token from vault-backed API key credentials.
+          const botToken = await readAdapterSecret('telegram', 'botToken');
+          if (!botToken) {
+            console.warn('[adapters] telegram test: bot token not found in credential store');
+            res.status(400).json({ error: 'Telegram bot token not configured' });
+            return;
+          }
+
+          // Read chat ID from adapter config
+          const appConfig = await prisma.appConfig.findUnique({ where: { id: 'global' } });
+          let chatId: string | undefined;
+          if (appConfig?.adapterConfig) {
+            try {
+              const config = JSON.parse(appConfig.adapterConfig);
+              const telegramAdapter = config.adapters?.find((a: { type: string }) => a.type === 'telegram');
+              chatId = telegramAdapter?.config?.chatId ? String(telegramAdapter.config.chatId) : undefined;
+            } catch { /* ignore parse errors */ }
+          }
+
+          if (!chatId) {
+            console.warn('[adapters] telegram test: chatId not found in adapter config');
+            res.status(400).json({ error: 'Telegram chat ID not configured. Reconfigure the adapter with a chat ID.' });
+            return;
+          }
+
+          const resp = await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              chat_id: chatId,
+              text: '<b>AuraMaxx</b>\n\nAdapter chat is now active. You can send messages here and the AI will respond.',
+              parse_mode: 'HTML',
+            }),
+            signal: controller.signal,
+          });
+
+          const data = await resp.json() as { ok?: boolean; description?: string };
+          if (data.ok) {
+            res.json({ success: true });
+          } else {
+            console.warn('[adapters] telegram test: API call failed:', data.description);
+            res.json({ success: false, error: data.description || 'Failed to send test message' });
+          }
+          break;
+        }
+
+        case 'webhook': {
+          // Read webhook URL from adapter config
+          const appConfig2 = await prisma.appConfig.findUnique({ where: { id: 'global' } });
+          let webhookUrl: string | undefined;
+          if (appConfig2?.adapterConfig) {
+            try {
+              const config = JSON.parse(appConfig2.adapterConfig);
+              const webhookAdapter = config.adapters?.find((a: { type: string }) => a.type === 'webhook');
+              webhookUrl = webhookAdapter?.config?.url;
+            } catch { /* ignore parse errors */ }
+          }
+
+          if (!webhookUrl) {
+            res.status(404).json({ error: 'Webhook URL not configured' });
+            return;
+          }
+
+          // SSRF protection: validate webhook URL before sending test
+          try {
+            await validateExternalUrl(webhookUrl);
+          } catch (err) {
+            const msg = getErrorMessage(err);
+            res.status(403).json({ error: msg });
+            return;
+          }
+
+          const resp = await fetch(webhookUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              type: 'test',
+              data: {},
+              timestamp: Date.now(),
+            }),
+            signal: controller.signal,
+          });
+
+          if (resp.ok) {
+            res.json({ success: true });
+          } else {
+            res.json({ success: false, error: `Webhook returned ${resp.status}` });
+          }
+          break;
+        }
+
+        default:
+          res.status(400).json({ error: `Unknown adapter type: ${type}` });
+          return;
+      }
+    } catch (err) {
+      if (err instanceof Error && err.name === 'AbortError') {
+        res.json({ success: false, error: 'Test timed out' });
+      } else {
+        throw err;
+      }
+    } finally {
+      clearTimeout(timeout);
+    }
+  } catch (error) {
+    const message = getErrorMessage(error);
+    res.status(500).json({ error: message });
+  }
+});
+
+// POST /adapters/chat — Update top-level chat config (defaultApp)
+router.post('/chat', requireWalletAuth, requirePermission('adapter:manage'), async (req: Request, res: Response) => {
+  try {
+    const { defaultApp } = req.body;
+
+    const appConfig = await prisma.appConfig.findUnique({
+      where: { id: 'global' },
+    });
+
+    let current: { enabled: boolean; chat?: { defaultApp?: string }; adapters: unknown[] } = {
+      enabled: true,
+      adapters: [],
+    };
+
+    if (appConfig?.adapterConfig) {
+      try {
+        current = JSON.parse(appConfig.adapterConfig);
+      } catch {
+        // Reset on invalid JSON
+      }
+    }
+
+    current.chat = {
+      ...current.chat,
+      defaultApp: defaultApp || undefined,
+    };
+
+    await prisma.appConfig.upsert({
+      where: { id: 'global' },
+      update: { adapterConfig: JSON.stringify(current) },
+      create: { id: 'global', adapterConfig: JSON.stringify(current) },
+    });
+
+    // Clear the app cache in the router
+    if (approvalRouter) {
+      approvalRouter.clearAppCache();
+    }
+
+    res.json({ success: true, chat: current.chat });
+  } catch (error) {
+    const message = getErrorMessage(error);
+    res.status(500).json({ error: message });
+  }
+});
+
+// POST /adapters/:type/message — Inbound chat from external adapter (HMAC-authenticated)
+router.post('/:type/message', async (req: Request, res: Response) => {
+  try {
+    const { type } = req.params;
+    const { text, senderId } = req.body;
+
+    if (!text || typeof text !== 'string') {
+      res.status(400).json({ error: 'text is required' });
+      return;
+    }
+
+    if (!senderId || typeof senderId !== 'string') {
+      res.status(400).json({ error: 'senderId is required' });
+      return;
+    }
+
+    // HMAC authentication: look up the adapter's secret
+    const secretKey = await readAdapterSecret(type, 'secret');
+
+    if (secretKey) {
+      // Validate HMAC signature
+      const signature = req.headers['x-signature-256'] as string | undefined;
+      if (!signature) {
+        res.status(401).json({ error: 'Missing X-Signature-256 header' });
+        return;
+      }
+
+      const rawBody = JSON.stringify(req.body);
+      const expected = `sha256=${createHmac('sha256', secretKey).update(rawBody).digest('hex')}`;
+
+      try {
+        const sigBuf = Buffer.from(signature);
+        const expectedBuf = Buffer.from(expected);
+        if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) {
+          res.status(401).json({ error: 'Invalid signature' });
+          return;
+        }
+      } catch {
+        res.status(401).json({ error: 'Invalid signature' });
+        return;
+      }
+    }
+
+    if (!approvalRouter) {
+      res.status(503).json({ error: 'Adapter router not running' });
+      return;
+    }
+
+    const appId = await approvalRouter.resolveApp(req.body.targetApp);
+    if (!appId) {
+      res.status(400).json({ error: 'No target app configured. Set chat.defaultApp in adapter config.' });
+      return;
+    }
+
+    const result = await approvalRouter.sendMessage(appId, text, undefined, type);
+    res.json({
+      success: !result.error,
+      reply: result.reply,
+      error: result.error,
+    });
+  } catch (error) {
+    const message = getErrorMessage(error);
+    res.status(500).json({ error: message });
+  }
+});
+
+// POST /adapters/telegram/setup-link — Generate deep link for auto-detecting chat ID
+router.post('/telegram/setup-link', requireWalletAuth, requirePermission('adapter:manage'), async (req: Request, res: Response) => {
+  try {
+    // Accept bot token from body (pre-save flow) or read from credential store
+    let botToken = req.body.botToken as string | undefined;
+    if (!botToken) {
+      const storedBotToken = await readAdapterSecret('telegram', 'botToken');
+      if (!storedBotToken) {
+        res.status(400).json({ error: 'Bot token not provided and not saved. Pass botToken in body or save it first.' });
+        return;
+      }
+      botToken = storedBotToken;
+    }
+
+    // Validate bot token via getMe
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5000);
+    try {
+      const meResp = await fetch(`https://api.telegram.org/bot${botToken}/getMe`, {
+        signal: controller.signal,
+      });
+      const meData = await meResp.json() as { ok?: boolean; result?: { username?: string }; description?: string };
+      if (!meData.ok) {
+        res.status(400).json({ error: meData.description || 'Invalid bot token' });
+        return;
+      }
+
+      const botUsername = meData.result?.username || '';
+
+      // Generate nonce
+      const nonce = randomBytes(12).toString('base64url');
+
+      // Lazy cleanup of expired nonces
+      const now = Date.now();
+      for (const [key, val] of telegramSetupNonces) {
+        if (val.expiresAt < now) telegramSetupNonces.delete(key);
+      }
+
+      // Store nonce with 120s TTL
+      telegramSetupNonces.set(nonce, {
+        botToken,
+        botUsername,
+        expiresAt: now + 120_000,
+      });
+
+      // Stop the running approval router so its Telegram polling doesn't
+      // consume the /start message before detect-chat can see it.
+      // It will be restarted after detection completes (via /adapters/restart).
+      if (approvalRouter) {
+        await approvalRouter.stop();
+        approvalRouter = null;
+      }
+
+      // Delete webhook to ensure getUpdates polling works
+      await fetch(`https://api.telegram.org/bot${botToken}/deleteWebhook`, {
+        signal: controller.signal,
+      }).catch(() => { /* non-fatal */ });
+
+      // Flush stale updates so detect-chat only sees new messages.
+      // Call getUpdates with offset=-1 to get the last update, then
+      // confirm it so subsequent polls start fresh.
+      let nextOffset = 0;
+      try {
+        const flushResp = await fetch(
+          `https://api.telegram.org/bot${botToken}/getUpdates?offset=-1&timeout=0`,
+          { signal: controller.signal },
+        );
+        const flushData = await flushResp.json() as { ok?: boolean; result?: Array<{ update_id: number }> };
+        if (flushData.ok && flushData.result?.length) {
+          const lastId = flushData.result[flushData.result.length - 1].update_id;
+          // Confirm the last update so it's removed from the queue
+          await fetch(
+            `https://api.telegram.org/bot${botToken}/getUpdates?offset=${lastId + 1}&timeout=0`,
+            { signal: controller.signal },
+          );
+          nextOffset = lastId + 1;
+        }
+      } catch { /* non-fatal — detect-chat will still work, just may see stale updates */ }
+
+      // Store offset in nonce so detect-chat can skip old updates
+      const nonceEntry = telegramSetupNonces.get(nonce);
+      if (nonceEntry) nonceEntry.offset = nextOffset;
+
+      res.json({
+        success: true,
+        link: `https://t.me/${botUsername}?start=${nonce}`,
+        setupToken: nonce,
+        botUsername,
+      });
+    } finally {
+      clearTimeout(timeout);
+    }
+  } catch (error) {
+    const message = getErrorMessage(error);
+    res.status(500).json({ error: message });
+  }
+});
+
+// POST /adapters/telegram/detect-chat — Poll for /start message to auto-detect chat ID
+router.post('/telegram/detect-chat', requireWalletAuth, requirePermission('adapter:manage'), async (req: Request, res: Response) => {
+  try {
+    const { setupToken } = req.body;
+    if (!setupToken || typeof setupToken !== 'string') {
+      res.status(400).json({ error: 'setupToken is required' });
+      return;
+    }
+
+    const nonceEntry = telegramSetupNonces.get(setupToken);
+    if (!nonceEntry) {
+      res.status(400).json({ error: 'Invalid or expired setup token' });
+      return;
+    }
+
+    if (nonceEntry.expiresAt < Date.now()) {
+      telegramSetupNonces.delete(setupToken);
+      res.status(400).json({ error: 'Setup token expired' });
+      return;
+    }
+
+    const { botToken } = nonceEntry;
+
+    // Long-poll getUpdates (25s timeout)
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 30_000);
+    try {
+      const offsetParam = nonceEntry.offset ? `&offset=${nonceEntry.offset}` : '';
+      const updatesResp = await fetch(
+        `https://api.telegram.org/bot${botToken}/getUpdates?timeout=25&allowed_updates=${encodeURIComponent(JSON.stringify(['message']))}${offsetParam}`,
+        { signal: controller.signal },
+      );
+      const updatesData = await updatesResp.json() as {
+        ok?: boolean;
+        result?: Array<{
+          update_id: number;
+          message?: {
+            text?: string;
+            chat?: { id: number; first_name?: string; username?: string };
+          };
+        }>;
+      };
+
+      if (!updatesData.ok || !updatesData.result) {
+        res.json({ chatId: null, timeout: true });
+        return;
+      }
+
+      // Look for /start message
+      let detectedUpdate: (typeof updatesData.result)[number] | null = null;
+      let verified = false;
+
+      for (const update of updatesData.result) {
+        const text = update.message?.text || '';
+        if (text === `/start ${setupToken}`) {
+          detectedUpdate = update;
+          verified = true;
+          break;
+        }
+        if (text === '/start' || text.startsWith('/start ')) {
+          detectedUpdate = update;
+          verified = false;
+          // Keep looking for exact nonce match
+        }
+      }
+
+      if (!detectedUpdate || !detectedUpdate.message?.chat) {
+        // Advance offset past any updates we just saw so the next
+        // poll attempt doesn't re-process them
+        if (updatesData.result.length > 0) {
+          const maxId = updatesData.result[updatesData.result.length - 1].update_id;
+          nonceEntry.offset = maxId + 1;
+          await fetch(
+            `https://api.telegram.org/bot${botToken}/getUpdates?offset=${maxId + 1}&timeout=0`,
+            { signal: controller.signal },
+          ).catch(() => { /* non-fatal */ });
+        }
+        res.json({ chatId: null, timeout: true });
+        return;
+      }
+
+      const chat = detectedUpdate.message.chat;
+      const chatId = String(chat.id);
+
+      // Confirm the update by calling getUpdates with offset past it
+      await fetch(
+        `https://api.telegram.org/bot${botToken}/getUpdates?offset=${detectedUpdate.update_id + 1}&timeout=0`,
+        { signal: controller.signal },
+      ).catch(() => { /* non-fatal */ });
+
+      // Clean up nonce
+      telegramSetupNonces.delete(setupToken);
+
+      res.json({
+        chatId,
+        firstName: chat.first_name || null,
+        username: chat.username || null,
+        verified,
+      });
+    } finally {
+      clearTimeout(timeout);
+    }
+  } catch (error) {
+    if (error instanceof Error && error.name === 'AbortError') {
+      res.json({ chatId: null, timeout: true });
+    } else {
+      const message = getErrorMessage(error);
+      res.status(500).json({ error: message });
+    }
+  }
+});
+
+// POST /adapters/restart — Restart approval router with current DB config
+router.post('/restart', requireWalletAuth, requirePermission('adapter:manage'), async (_req: Request, res: Response) => {
+  try {
+    // Stop existing router
+    if (approvalRouter) {
+      await approvalRouter.stop();
+      approvalRouter = null;
+    }
+
+    // Load adapters from DB
+    const adapters = await loadAdaptersFromDb();
+
+    if (adapters.length === 0) {
+      res.json({ success: true, message: 'No adapters configured, router stopped', running: false });
+      return;
+    }
+
+    const newRouter = new ApprovalRouter(`http://127.0.0.1:${SERVER_PORT}`);
+    for (const adapter of adapters) {
+      newRouter.registerAdapter(adapter);
+    }
+
+    await newRouter.start();
+    approvalRouter = newRouter;
+
+    res.json({
+      success: true,
+      message: `Approval router started with ${adapters.length} adapter(s)`,
+      running: true,
+      adapterCount: adapters.length,
+    });
+  } catch (error) {
+    const message = getErrorMessage(error);
+    res.status(500).json({ error: message });
+  }
+});
+
+export default router;