auramaxx 1.0.0-alpha.4

package/server/routes/lock.ts

@@ -0,0 +1,54 @@
+import { Router, Request, Response } from 'express';
+import { lock, isUnlocked, lockVault, isVaultUnlocked } from '../lib/cold';
+import { requireWalletAuth } from '../middleware/auth';
+import { requireAdmin } from '../lib/permissions';
+import { logger } from '../lib/logger';
+import { revokeAllTokens } from '../lib/sessions';
+import { revokeAdminTokens } from '../lib/auth';
+
+const router = Router();
+
+// POST /lock - Lock all vaults (clear memory)
+// Requires admin authentication
+// Also revokes all active sessions so clients must re-authenticate.
+router.post('/', requireWalletAuth, requireAdmin, async (_req: Request, res: Response) => {
+  const wasUnlocked = isUnlocked();
+
+  // Lock all vaults
+  lock();
+
+  // Revoke all active admin + agent tokens
+  revokeAdminTokens();
+  await revokeAllTokens();
+
+  // Log the lock event
+  if (wasUnlocked) {
+    logger.locked();
+  }
+
+  res.json({
+    success: true,
+    message: wasUnlocked
+      ? 'All vaults locked and active sessions revoked'
+      : 'Vaults were already locked; active sessions revoked'
+  });
+});
+
+// POST /lock/:vaultId - Lock a specific vault
+router.post('/:vaultId', requireWalletAuth, requireAdmin, (req: Request<{ vaultId: string }>, res: Response) => {
+  const { vaultId } = req.params;
+  const wasUnlocked = isVaultUnlocked(vaultId);
+
+  lockVault(vaultId);
+
+  if (wasUnlocked) {
+    logger.locked();
+  }
+
+  res.json({
+    success: true,
+    message: wasUnlocked ? `Vault ${vaultId} locked` : `Vault ${vaultId} was already locked`
+  });
+});
+
+export default router;

package/server/routes/logs.ts

@@ -0,0 +1,68 @@
+import { Router, Request, Response } from 'express';
+import { prisma } from '../lib/db';
+import { getErrorMessage } from '../lib/error';
+
+const router = Router();
+
+// GET /logs - Event logs - fetch historical events from database
+// Supports filtering by: type, category (prefix match), agentId, since/until (timestamps), path
+router.get('/', async (req: Request, res: Response) => {
+  try {
+    const limit = Math.min(parseInt(req.query.limit as string) || 50, 250);
+    const offset = parseInt(req.query.offset as string) || 0;
+    const type = req.query.type as string | undefined;
+    const category = req.query.category as string | undefined;
+    const agentId = req.query.agentId as string | undefined;
+    const since = req.query.since as string | undefined;
+    const until = req.query.until as string | undefined;
+
+    const where: Record<string, unknown> = {};
+
+    if (type) {
+      where.type = type;
+    } else if (category) {
+      // Prefix match: category=auth matches auth:unlocked, auth:auth_failed, etc.
+      where.type = { startsWith: `${category}:` };
+    }
+
+    // Filter by agentId in the JSON data field
+    if (agentId) {
+      where.data = { contains: `"agentId":"${agentId}"` };
+    }
+
+    // Date range filtering
+    if (since || until) {
+      const timestampFilter: Record<string, Date> = {};
+      if (since) timestampFilter.gte = new Date(parseInt(since) || since);
+      if (until) timestampFilter.lte = new Date(parseInt(until) || until);
+      where.timestamp = timestampFilter;
+    }
+
+    const [logs, total] = await Promise.all([
+      prisma.event.findMany({
+        where,
+        orderBy: { timestamp: 'desc' },
+        take: limit,
+        skip: offset,
+      }),
+      prisma.event.count({ where }),
+    ]);
+
+    res.json({
+      success: true,
+      logs,
+      count: logs.length,
+      total,
+      pagination: {
+        limit,
+        offset,
+        hasMore: offset + logs.length < total,
+      },
+    });
+  } catch (error) {
+    const message = getErrorMessage(error);
+    res.status(500).json({ success: false, error: message });
+  }
+});
+
+export default router;

package/server/routes/nuke.ts

@@ -0,0 +1,111 @@
+import { Router, Request, Response } from 'express';
+import fs from 'fs';
+import { deleteColdWallet, importColdWallet, listVaults, deleteVault } from '../lib/cold';
+import { DATA_PATHS } from '../lib/config';
+import { prisma } from '../lib/db';
+import { lockAllCredentialVaults } from '../lib/credential-vault';
+import { requireWalletAuth } from '../middleware/auth';
+import { requireAdmin } from '../lib/permissions';
+import { parseEncryptedPassword } from '../lib/transport';
+import { logger } from '../lib/logger';
+import { getErrorMessage, HttpError } from '../lib/error';
+
+const router = Router();
+
+// POST /nuke - Delete all wallet data (requires admin)
+router.post('/', requireWalletAuth, requireAdmin, async (_req: Request, res: Response) => {
+  try {
+    // 1. Delete all vaults (files + memory)
+    try {
+      const vaults = listVaults();
+      for (const vault of vaults) {
+        deleteVault(vault.id);
+      }
+      deleteColdWallet(); // Also handles legacy cold.json
+    } catch (e) {
+      console.log('No cold wallet to delete:', e);
+    }
+
+    // 2. Delete all hot wallet files
+    const hotDir = DATA_PATHS.hotWallets;
+    if (fs.existsSync(hotDir)) {
+      fs.rmSync(hotDir, { recursive: true, force: true });
+      fs.mkdirSync(hotDir, { recursive: true });
+    }
+
+    // 3. Delete pending requests directory
+    const pendingDir = DATA_PATHS.pending;
+    if (fs.existsSync(pendingDir)) {
+      fs.rmSync(pendingDir, { recursive: true, force: true });
+      fs.mkdirSync(pendingDir, { recursive: true });
+    }
+
+    // 4. Delete credential files directory and clear in-memory credential sessions
+    const credentialsDir = DATA_PATHS.credentials;
+    if (fs.existsSync(credentialsDir)) {
+      fs.rmSync(credentialsDir, { recursive: true, force: true });
+    }
+    fs.mkdirSync(credentialsDir, { recursive: true });
+    lockAllCredentialVaults();
+
+    // 5. Clear database tables
+    try {
+      await prisma.humanAction.deleteMany({});
+      await prisma.agentToken.deleteMany({});
+      await prisma.hotWallet.deleteMany({});
+    } catch (e) {
+      console.log('Error clearing database:', e);
+    }
+
+    logger.nuke();
+
+    res.json({
+      success: true,
+      message: 'All data nuked. Ready for fresh setup.'
+    });
+  } catch (error) {
+    console.error('[NUKE ERROR]', error);
+    res.status(500).json({
+      success: false,
+      error: getErrorMessage(error)
+    });
+  }
+});
+
+// POST /nuke/import - Import wallet from seed phrase (requires admin)
+router.post('/import', requireWalletAuth, requireAdmin, (req: Request, res: Response) => {
+  try {
+    const { mnemonic, password, encrypted } = req.body;
+
+    if (!mnemonic || typeof mnemonic !== 'string') {
+      res.status(400).json({ error: 'Seed phrase is required' });
+      return;
+    }
+
+    // Support encrypted password transport (dashboard) or plaintext (CLI)
+    let plainPassword: string;
+    if (encrypted && typeof encrypted === 'string') {
+      plainPassword = parseEncryptedPassword(encrypted);
+    } else if (password && typeof password === 'string') {
+      if (password.length < 8) {
+        throw new HttpError(400, 'Password must be at least 8 characters');
+      }
+      plainPassword = password;
+    } else {
+      throw new HttpError(400, 'Password is required (encrypted or plaintext)');
+    }
+
+    const result = importColdWallet(mnemonic, plainPassword);
+
+    res.json({
+      success: true,
+      address: result.address,
+      message: 'Wallet imported successfully'
+    });
+  } catch (error) {
+    if (error instanceof HttpError) { res.status(error.status).json({ error: error.message }); return; }
+    res.status(400).json({ error: getErrorMessage(error) });
+  }
+});
+
+export default router;

package/server/routes/passkey-credentials.ts

@@ -0,0 +1,99 @@
+/**
+ * Passkey Credential Routes — WebAuthn software authenticator endpoints
+ * =====================================================================
+ *
+ * POST /credentials/passkey/register   — Generate keypair, store, return attestation
+ * POST /credentials/passkey/authenticate — Sign challenge, return assertion
+ * GET  /credentials/passkey/match      — Find passkeys matching rpId
+ */
+
+import { Router, Request, Response } from 'express';
+import { requireWalletAuth } from '../middleware/auth';
+import { registerPasskey, authenticatePasskey, matchPasskeys, PasskeyCredentialValidationError } from '../lib/passkey-credential';
+import { getErrorMessage } from '../lib/error';
+import { log } from '../lib/pino';
+
+const router = Router();
+router.use(requireWalletAuth);
+
+// POST /credentials/passkey/register
+router.post('/register', (req: Request, res: Response) => {
+  try {
+    const { vaultId, rpId, rpName, userName, displayName, userHandle, challenge, origin, clientDataJSON } = req.body;
+
+    if (!vaultId || !rpId || !userHandle || !clientDataJSON) {
+      res.status(400).json({ error: 'vaultId, rpId, userHandle, and clientDataJSON are required' });
+      return;
+    }
+
+    const result = registerPasskey({
+      vaultId,
+      rpId,
+      rpName,
+      userName,
+      displayName,
+      userHandle,
+      challenge,
+      origin,
+      clientDataJSON,
+    });
+
+    log.info('Passkey registered', { rpId, credentialId: result.credentialId });
+    res.json(result);
+  } catch (error) {
+    const message = getErrorMessage(error);
+    if (error instanceof PasskeyCredentialValidationError) {
+      res.status(400).json({ error: message });
+      return;
+    }
+
+    log.error('Passkey register error', { error: message });
+    res.status(500).json({ error: message });
+  }
+});
+
+// POST /credentials/passkey/authenticate
+router.post('/authenticate', (req: Request, res: Response) => {
+  try {
+    const { auraCredentialId, rpId, challenge, origin, clientDataJSON } = req.body;
+
+    if (!auraCredentialId || !rpId || !challenge || !clientDataJSON) {
+      res.status(400).json({ error: 'auraCredentialId, rpId, challenge, and clientDataJSON are required' });
+      return;
+    }
+
+    const result = authenticatePasskey({ auraCredentialId, rpId, challenge, origin, clientDataJSON });
+
+    log.info('Passkey authenticated', { rpId, credentialId: result.credentialId });
+    res.json(result);
+  } catch (error) {
+    const message = getErrorMessage(error);
+    if (error instanceof PasskeyCredentialValidationError) {
+      res.status(400).json({ error: message });
+      return;
+    }
+
+    log.error('Passkey authenticate error', { error: message });
+    res.status(500).json({ error: message });
+  }
+});
+
+// GET /credentials/passkey/match?rpId=xxx
+router.get('/match', (req: Request, res: Response) => {
+  try {
+    const rpId = req.query.rpId as string;
+    const vaultId = req.query.vaultId as string | undefined;
+
+    if (!rpId) {
+      res.status(400).json({ error: 'rpId query parameter is required' });
+      return;
+    }
+
+    const matches = matchPasskeys(rpId, vaultId);
+    res.json({ matches });
+  } catch (error) {
+    res.status(500).json({ error: getErrorMessage(error) });
+  }
+});
+
+export default router;

package/server/routes/passkey.ts

@@ -0,0 +1,346 @@
+import { Router, Request, Response } from 'express';
+import {
+  generateRegistrationOptions,
+  verifyRegistrationResponse,
+  generateAuthenticationOptions,
+  verifyAuthenticationResponse,
+} from '@simplewebauthn/server';
+import { prisma } from '../lib/db';
+import { requireWalletAuth } from '../middleware/auth';
+import { requireAdmin } from '../lib/permissions';
+import { isUnlocked } from '../lib/cold';
+import { createAdminToken } from '../lib/auth';
+import { storeChallenge, consumeChallenge, uint8ArrayToBase64url, base64urlToUint8Array } from '../lib/passkey';
+import { isValidAgentPubkey, normalizeAgentPubkey } from '../lib/credential-transport';
+import { log } from '../lib/pino';
+import { getErrorMessage } from '../lib/error';
+
+const router = Router();
+
+// Helper: extract rpId from request
+function getRpId(req: Request, bodyRpId?: string): string {
+  return bodyRpId || req.hostname || 'localhost';
+}
+
+// ─── Status ─────────────────────────────────────────────────────────────────
+
+// GET /auth/passkey/status — public, returns whether passkeys registered for origin
+router.get('/status', async (req: Request, res: Response) => {
+  try {
+    const rpId = getRpId(req, req.query.rpId as string | undefined);
+    const passkeys = await prisma.passkey.findMany({
+      where: { rpId },
+      select: { credentialId: true, createdAt: true },
+    });
+    res.json({
+      registered: passkeys.length > 0,
+      count: passkeys.length,
+      rpId,
+      credentials: passkeys.map(p => ({ id: p.credentialId, createdAt: p.createdAt })),
+    });
+  } catch (error) {
+    res.status(500).json({ error: getErrorMessage(error) });
+  }
+});
+
+// ─── Registration ───────────────────────────────────────────────────────────
+
+// POST /auth/passkey/register/options — requires admin token
+router.post('/register/options', requireWalletAuth, requireAdmin, async (req: Request, res: Response) => {
+  try {
+    if (!isUnlocked()) {
+      res.status(400).json({ error: 'Vault must be unlocked to register passkey' });
+      return;
+    }
+
+    const rpId = getRpId(req, req.body?.rpId);
+
+    // Get existing credentials for this rpId to exclude
+    const existing = await prisma.passkey.findMany({
+      where: { rpId },
+      select: { credentialId: true, transports: true },
+    });
+
+    const excludeCredentials = existing.map((p) => ({
+      id: p.credentialId,
+      transports: JSON.parse(p.transports || '[]'),
+    }));
+
+    const options = await generateRegistrationOptions({
+      rpName: 'AuraWallet',
+      rpID: rpId,
+      userName: 'owner',
+      userDisplayName: 'Vault Owner',
+      attestationType: 'none',
+      authenticatorSelection: {
+        authenticatorAttachment: 'platform',
+        userVerification: 'required',
+        residentKey: 'preferred',
+      },
+      excludeCredentials,
+      timeout: 60000,
+    });
+
+    // Store challenge
+    storeChallenge(options.challenge, 'register');
+
+    res.json(options);
+  } catch (error) {
+    res.status(500).json({ error: getErrorMessage(error) });
+  }
+});
+
+// POST /auth/passkey/register/verify — requires admin token
+router.post('/register/verify', requireWalletAuth, requireAdmin, async (req: Request, res: Response) => {
+  try {
+    if (!isUnlocked()) {
+      res.status(400).json({ error: 'Vault must be unlocked to register passkey' });
+      return;
+    }
+
+    const { credential } = req.body;
+    if (!credential) {
+      res.status(400).json({ error: 'credential is required' });
+      return;
+    }
+
+    const rpId = getRpId(req, req.body?.rpId);
+    const origin = `${req.protocol}://${req.get('host')}`;
+
+    // Consume challenge
+    const challenge = credential.response?.clientDataJSON
+      ? JSON.parse(Buffer.from(credential.response.clientDataJSON, 'base64url').toString()).challenge
+      : undefined;
+
+    if (!challenge || !consumeChallenge(challenge, 'register')) {
+      res.status(400).json({ error: 'Invalid or expired challenge' });
+      return;
+    }
+
+    const verification = await verifyRegistrationResponse({
+      response: credential,
+      expectedChallenge: challenge,
+      expectedOrigin: origin,
+      expectedRPID: rpId,
+      requireUserVerification: true,
+    });
+
+    if (!verification.verified || !verification.registrationInfo) {
+      res.status(400).json({ error: 'Registration verification failed' });
+      return;
+    }
+
+    const { credential: cred, credentialBackedUp, aaguid } = verification.registrationInfo;
+
+    // Store in DB
+    await prisma.passkey.create({
+      data: {
+        credentialId: cred.id,
+        publicKey: Buffer.from(cred.publicKey),
+        counter: cred.counter,
+        transports: JSON.stringify(credential.response.transports || []),
+        rpId,
+        aaguid: aaguid || '',
+      },
+    });
+
+    res.json({
+      success: true,
+      credentialId: cred.id,
+    });
+  } catch (error) {
+    res.status(500).json({ error: getErrorMessage(error) });
+  }
+});
+
+// ─── Authentication ─────────────────────────────────────────────────────────
+
+// POST /auth/passkey/authenticate/options — public (vault must be unlocked server-side)
+router.post('/authenticate/options', async (req: Request, res: Response) => {
+  try {
+    // Specific vault_locked error per audit
+    if (!isUnlocked()) {
+      res.status(400).json({
+        error: 'vault_locked',
+        message: 'Password required after server restart',
+      });
+      return;
+    }
+
+    const rpId = getRpId(req, req.body?.rpId);
+
+    // Get credentials for this rpId — reject if none exist (audit item)
+    const passkeys = await prisma.passkey.findMany({
+      where: { rpId },
+      select: { credentialId: true, transports: true },
+    });
+
+    if (passkeys.length === 0) {
+      res.status(400).json({ error: 'No passkeys registered for this origin' });
+      return;
+    }
+
+    const allowCredentials = passkeys.map((p) => ({
+      id: p.credentialId,
+      transports: JSON.parse(p.transports || '[]'),
+    }));
+
+    const options = await generateAuthenticationOptions({
+      rpID: rpId,
+      allowCredentials,
+      userVerification: 'required',
+      timeout: 60000,
+    });
+
+    storeChallenge(options.challenge, 'authenticate');
+
+    res.json(options);
+  } catch (error) {
+    res.status(500).json({ error: getErrorMessage(error) });
+  }
+});
+
+// POST /auth/passkey/authenticate/verify — public (assertion IS the auth)
+router.post('/authenticate/verify', async (req: Request, res: Response) => {
+  try {
+    // Specific vault_locked error per audit
+    if (!isUnlocked()) {
+      res.status(400).json({
+        error: 'vault_locked',
+        message: 'Password required after server restart',
+      });
+      return;
+    }
+
+    const { credential, pubkey } = req.body;
+    if (!credential) {
+      res.status(400).json({ error: 'credential is required' });
+      return;
+    }
+    if (!pubkey || typeof pubkey !== 'string') {
+      res.status(400).json({ error: 'pubkey is required' });
+      return;
+    }
+    if (!isValidAgentPubkey(pubkey)) {
+      res.status(400).json({ error: 'pubkey must be a valid RSA public key' });
+      return;
+    }
+
+    const rpId = getRpId(req, req.body?.rpId);
+    const origin = `${req.protocol}://${req.get('host')}`;
+
+    // Extract and consume challenge
+    const challenge = credential.response?.clientDataJSON
+      ? JSON.parse(Buffer.from(credential.response.clientDataJSON, 'base64url').toString()).challenge
+      : undefined;
+
+    if (!challenge || !consumeChallenge(challenge, 'authenticate')) {
+      log.warn('Passkey auth: invalid or expired challenge', { ip: req.ip, origin });
+      res.status(401).json({ error: 'Invalid or expired challenge' });
+      return;
+    }
+
+    // Look up the credential
+    const credentialId = credential.id || credential.rawId;
+    const passkey = await prisma.passkey.findUnique({
+      where: { credentialId },
+    });
+
+    if (!passkey) {
+      log.warn('Passkey auth: unknown credential', { credentialId, ip: req.ip, origin });
+      res.status(401).json({ error: 'Unknown credential' });
+      return;
+    }
+
+    let verification;
+    try {
+      verification = await verifyAuthenticationResponse({
+        response: credential,
+        expectedChallenge: challenge,
+        expectedOrigin: origin,
+        expectedRPID: rpId,
+        credential: {
+          id: passkey.credentialId,
+          publicKey: new Uint8Array(passkey.publicKey),
+          counter: passkey.counter,
+          transports: JSON.parse(passkey.transports || '[]'),
+        },
+        requireUserVerification: true,
+      });
+    } catch (err) {
+      // Log failed attempt (audit item)
+      log.warn('Passkey auth: verification failed', {
+        credentialId,
+        ip: req.ip,
+        origin,
+        error: getErrorMessage(err),
+      });
+      res.status(401).json({ error: 'Authentication verification failed' });
+      return;
+    }
+
+    if (!verification.verified) {
+      log.warn('Passkey auth: assertion not verified', { credentialId, ip: req.ip, origin });
+      res.status(401).json({ error: 'Authentication verification failed' });
+      return;
+    }
+
+    // Counter validation (clone detection) — @simplewebauthn handles this,
+    // but we double-check per audit
+    const newCounter = verification.authenticationInfo.newCounter;
+    if (newCounter > 0 && newCounter <= passkey.counter) {
+      log.warn('Passkey auth: counter regression (possible clone)', {
+        credentialId,
+        storedCounter: passkey.counter,
+        newCounter,
+        ip: req.ip,
+        origin,
+      });
+      res.status(401).json({ error: 'Credential counter regression detected' });
+      return;
+    }
+
+    // Update counter and lastUsedAt
+    await prisma.passkey.update({
+      where: { credentialId: passkey.credentialId },
+      data: {
+        counter: newCounter,
+        lastUsedAt: new Date(),
+      },
+    });
+
+    // Issue admin token (same as rekey flow)
+    const normalizedPubkey = normalizeAgentPubkey(pubkey);
+    const token = await createAdminToken(normalizedPubkey);
+
+    res.json({
+      success: true,
+      token,
+    });
+  } catch (error) {
+    res.status(500).json({ error: getErrorMessage(error) });
+  }
+});
+
+// ─── Delete ─────────────────────────────────────────────────────────────────
+
+// DELETE /auth/passkey/:credentialId — requires admin token
+router.delete('/:credentialId', requireWalletAuth, requireAdmin, async (req: Request<{ credentialId: string }>, res: Response) => {
+  try {
+    const { credentialId } = req.params;
+
+    const passkey = await prisma.passkey.findUnique({ where: { credentialId } });
+    if (!passkey) {
+      res.status(404).json({ error: 'Passkey not found' });
+      return;
+    }
+
+    await prisma.passkey.delete({ where: { credentialId } });
+
+    res.json({ success: true });
+  } catch (error) {
+    res.status(500).json({ error: getErrorMessage(error) });
+  }
+});
+
+export default router;