cartethyia 2.6.6 → 2.7.0

package/src/console/console-router.ts

@@ -1,233 +1,225 @@
-/**
- * Console API composition root: assembles every console route group with
- * explicit persistence boundaries. All dependencies are injected at
- * composition time; concrete Drizzle stores are the defaults, so this file
- * is the single place that knows them.
- */
-import { Elysia } from "elysia";
-import { log } from "../observability/logger";
-import { resolveConsoleAccess, resolveConsoleUser } from "./auth/session-resolver";
-import { ConsoleCredentialService } from "./auth/credentials";
-import { resolveDefaultGatewayApiKey } from "../config/runtime";
-import { FirstBootSetupService } from "./auth/setup-service";
-import { ConsoleSessionService, defaultSessionCookiePolicy } from "./auth/session-service";
-import { ConsoleLockoutService } from "./auth/lockout";
-import { AuditRecorder } from "./auth/audit-recorder";
-import { createConsoleAuthRoutes } from "./auth/session";
-import { createConsoleCsrfMiddleware } from "./console-router-guards";
-import { createConsoleMutationLimiterMiddleware } from "./console-router-guards";
-import { registerConsoleDomains, type ConsoleDomainContext } from "./domain-registration";
-import type { ConsoleAccessResolver } from "./auth/access";
-import type { CartethyiaDatabase } from "../persistence/db-handle";
-import { createAccessDecision, type AccessDecision } from "../security/access-control";
-import { resolveApiKeyAuthorization } from "../security/api-key-auth";
-import type { LiveInFlightSource } from "./observability/live";
-import type { NetworkPoolSelector } from "../network/pool/selector";
-import type { TelemetryBatchBuffer } from "../observability/telemetry-buffer";
-import type { OAuthRefreshService } from "../providers/authentication/oauth-refresh-service";
-import type { ApiKeyAdmissionService } from "../security/admission/service";
-import type { ModelStrikeService } from "../security/model-abuse";
-import type { RedisClient } from "../persistence/redis";
-import { CliToolMappingStore } from "./cli-tools/store";
-import { CliToolService } from "./cli-tools/service";
-import { DrizzleCliToolSecretSource } from "./cli-tools/secret-source";
-import type { ProviderRegistry } from "../providers/provider-registry";
-import type { BundledProviderCatalog } from "../providers/operations/provider-catalog-service";
-import type { ValidatedNetworkBindingFactory } from "../network/pool/resolver";
-import type { TrustedProxyBoundary } from "../config/network";
-import { gzipResponse } from "./response-compression";
-
-export interface ConsoleApiCompositionDeps {
-  readonly db: CartethyiaDatabase;
-  readonly accessResolver: ConsoleAccessResolver;
-  /**
-   * Drops the cached route snapshot after a console write changes the catalog.
-   * Structurally satisfied by `RouteSnapshotService`; declared here so the
-   * console composition root does not import the transport layer.
-   */
-  readonly routeSnapshotService: { invalidate(): Promise<number> };
-  readonly poolSelector: NetworkPoolSelector;
-  readonly telemetryBuffer: TelemetryBatchBuffer;
-  /**
-   * Queued writers the console can drain on demand (telemetry, usage, health
-   * events). Optional for the same reason the other reduced composition
-   * surface is: absent means the flush control is not offered rather than the
-   * console failing to build.
-   */
-  readonly flushBuffers?: { flush(): Promise<void> };
-  /**
-   * The request state store owns the live in-flight gauge, so the console reads
-   * its snapshot/subscription from here rather than a free-standing module.
-   */
-  readonly stateStore?: LiveInFlightSource;
-  readonly providerRegistry: ProviderRegistry;
-  readonly bundledModelCatalog: BundledProviderCatalog;
-  readonly networkBindingFactory: ValidatedNetworkBindingFactory;
-  readonly redis: RedisClient | undefined;
-  readonly oauthRefreshService: OAuthRefreshService;
-  readonly admissionService: Pick<ApiKeyAdmissionService, "purgeKey">;
-  /**
-   * Graduated model-abuse strikes: list and lift bans from the console.
-   * Optional so reduced compositions (route-only shell, console stubs) stay
-   * valid; absent means the `/model-bans` routes are not mounted.
-   */
-  readonly modelStrikes?: Pick<ModelStrikeService, "listBans" | "unban" | "ban">;
-  readonly readRoutingAccountInflight?:
-    | ((
-        providerId: string,
-        tenantId: string | null,
-      ) => Promise<readonly { accountId: string; inflight: number }[]>)
-    | undefined;
-  readonly resolvePeerAddress?: (request: Request) => string | null;
-  readonly trustedProxyBoundary?: TrustedProxyBoundary;
-}
-/**
- * Extracts a bearer API key from a console request, or `undefined`.
- *
- * Deliberately narrower than the proxy surface's `requestToken`: that one also
- * accepts `x-api-key` and throws on a malformed header, because a proxy caller
- * must be told its credential is wrong. Here the header is only an *alternative*
- * to a session cookie, so an absent or unparsable one means "not a key" and the
- * request proceeds as an unauthenticated session request — which the routes
- * then reject with their own 401. Returning `undefined` rather than throwing
- * keeps a browser that sends a stray Authorization header from being told its
- * session is invalid.
- */
-function readApiKeyBearer(request: Request): string | undefined {
-  const authorization = request.headers.get("authorization");
-  if (authorization === null) return undefined;
-  const match = /^Bearer\s+(\S+)$/i.exec(authorization.trim());
-  return match?.[1];
-}
-
-export function createConsoleRouter(deps: ConsoleApiCompositionDeps): Elysia {
-  const { db, routeSnapshotService, poolSelector, telemetryBuffer, redis } = deps;
-  /**
-   * Per-request cache: `beforeHandle` resolves the session asynchronously, and
-   * the sync `ConsoleAccessResolver` contract reads the decision back out of
-   * it. Scoped to this composition rather than the module so two routers in one
-   * process (tests, or a second app instance) never share decisions.
-   */
-  const sessionAccessCache = new WeakMap<Request, AccessDecision | null>();
-  const cookiePolicy = defaultSessionCookiePolicy;
-  const credentialService = new ConsoleCredentialService();
-  const sessionService = new ConsoleSessionService(db, cookiePolicy);
-  const lockoutService = new ConsoleLockoutService(db);
-  const setupService = new FirstBootSetupService(db, credentialService);
-  // The default gateway key is seeded only when the first-boot wizard runs, so a
-  // key set in the environment does nothing until an operator completes setup.
-  // Fire and forget: a failed check must not stop the console from mounting.
-  void setupService.requiresSetup().then((needsSetup) => {
-    if (needsSetup && resolveDefaultGatewayApiKey() !== undefined) {
-      log.warn(
-        "[setup] CARTETHYIA_API_KEY is set but no console user exists yet; complete the first-boot wizard at /console so the key is seeded",
-      );
-    }
-  }).catch((error: unknown) => {
-    log.warn("[setup] could not check first-boot state", error);
-  });
-  const auditRecorder = new AuditRecorder(db);
-  const cliToolService = new CliToolService(
-    new CliToolMappingStore(db),
-    new DrizzleCliToolSecretSource(db),
-  );
-  const accessResolver: ConsoleAccessResolver = (request) =>
-    deps.accessResolver(request) ?? sessionAccessCache.get(request) ?? undefined;
-  const console = new Elysia({ prefix: "/console/api" })
-    .use(createConsoleCsrfMiddleware())
-    .use(createConsoleMutationLimiterMiddleware())
-    .beforeHandle(async ({ request }: { request: Request }) => {
-      // The auth routes (`/console/api/auth/*`) resolve the session themselves
-      // and never read `accessResolver`, so resolving here too would repeat the
-      // session lookup plus its user query on every login/session/logout call
-      // for a decision nothing consumes. Skip them.
-      if (new URL(request.url).pathname.startsWith("/console/api/auth/")) return;
-      const access = await resolveConsoleAccess(db, sessionService, request);
-      if (access) {
-        sessionAccessCache.set(request, access);
-        return;
-      }
-      // No session cookie. A tenant API key may still reach the catalog routes
-      // it is scoped for — that is what lets a key register a BYOK provider or
-      // add a model without a browser session. The key is resolved through the
-      // same path `/v1` uses, so scopes and revocation behave identically, and
-      // a request carrying no credential at all stays unauthenticated (the
-      // routes reject it) rather than falling back to an implicit identity.
-      const bearer = readApiKeyBearer(request);
-      if (bearer === undefined) return;
-      const resolved = await resolveApiKeyAuthorization(db, bearer);
-      if (resolved === undefined) return;
-      sessionAccessCache.set(
-        request,
-        createAccessDecision({
-          id: resolved.id,
-          tenantId: resolved.tenantId,
-          scopes: resolved.scopes,
-          admissionIdentity: resolved.id,
-        }),
-      );
-    })
-    .use(
-      createConsoleAuthRoutes(
-        db,
-        credentialService,
-        sessionService,
-        lockoutService,
-        setupService,
-        cookiePolicy,
-        deps.trustedProxyBoundary ?? { mode: "disabled" },
-        (request) => deps.resolvePeerAddress?.(request) ?? undefined,
-      ),
-    );
-  const ctx: ConsoleDomainContext = {
-    db,
-    accessResolver,
-    auditRecorder,
-    oauthRefreshService: deps.oauthRefreshService,
-    cliToolService,
-    redis,
-    routeSnapshotService,
-    poolSelector,
-    telemetryBuffer,
-    ...(deps.stateStore ? { stateStore: deps.stateStore } : {}),
-    providerRegistry: deps.providerRegistry,
-    bundledModelCatalog: deps.bundledModelCatalog,
-    networkBindingFactory: deps.networkBindingFactory,
-    admissionService: deps.admissionService,
-    ...(deps.modelStrikes ? { modelStrikes: deps.modelStrikes } : {}),
-    readRoutingAccountInflight: deps.readRoutingAccountInflight,
-    ...(deps.flushBuffers ? { flushBuffers: deps.flushBuffers } : {}),
-    credentialService,
-    // The backup surface re-authenticates the operator, so it needs the current
-    // user's hash. Read from the session on the request that asks for it, never
-    // cached in a field, so a password change or a deactivated user takes
-    // effect on the very next attempt.
-    loadConsoleUser: async (request: Request) => {
-      const user = await resolveConsoleUser(db, sessionService, request);
-      return user === null ? null : { passwordHash: user.passwordHash };
-    },
-  };
-  registerConsoleDomains(console as unknown as Elysia, ctx);
-  // Compress the JSON control plane on the way out.
-  //
-  // `wrap` is used rather than a lifecycle hook because this Elysia beta does
-  // not deliver the response body to them: measured, both `mapResponse` and
-  // `afterHandle` receive `responseValue`/`response` as `undefined` for a
-  // plain-object route, and Elysia sets no `content-length`, so a hook has
-  // nothing to compress and no size to judge. `wrap` sits outside the router
-  // and sees the finished `Response`, which is what this needs.
-  //
-  // Scoped by path *inside* `gzipResponse`, not by this instance: Elysia's
-  // `use()` merges a child's `hoc` into the root app's ext, so this wrap is
-  // reached by `/v1/*` as well. The allowlist is `/console/api/` + `/metrics`.
-  // `/v1/*` is deliberately excluded, because a streaming completion must not
-  // be buffered and proxied bodies are the provider's own bytes. See
-  // `response-compression.ts` for the full reasoning and the measured win.
-  console.wrap(
-    (fetch) => (request: Request, ...rest: unknown[]) =>
-      Promise.resolve(fetch(request, ...rest)).then((response) =>
-        gzipResponse(request, response),
-      ),
-  );
-  return console as unknown as Elysia;
-}
+/**
+ * Console API composition root: assembles every console route group with
+ * explicit persistence boundaries. All dependencies are injected at
+ * composition time; concrete Drizzle stores are the defaults, so this file
+ * is the single place that knows them.
+ */
+import { Elysia } from "elysia";
+import { log } from "../observability/logger";
+import { resolveConsoleAccess, resolveConsoleUser } from "./auth/session-resolver";
+import { ConsoleCredentialService } from "./auth/credentials";
+import { resolveDefaultGatewayApiKey } from "../config/runtime";
+import { FirstBootSetupService } from "./auth/setup-service";
+import { ConsoleSessionService, defaultSessionCookiePolicy } from "./auth/session-service";
+import { ConsoleLockoutService } from "./auth/lockout";
+import { AuditRecorder } from "./auth/audit-recorder";
+import { createConsoleAuthRoutes } from "./auth/session";
+import { createConsoleCsrfMiddleware } from "./console-router-guards";
+import { createConsoleMutationLimiterMiddleware } from "./console-router-guards";
+import { registerConsoleDomains, type ConsoleDomainContext } from "./domain-registration";
+import type { ConsoleAccessResolver } from "./auth/access";
+import type { CartethyiaDatabase } from "../persistence/db-handle";
+import { createAccessDecision, type AccessDecision } from "../security/access-control";
+import { resolveApiKeyAuthorization } from "../security/api-key-auth";
+import type { LiveInFlightSource } from "./observability/live";
+import type { NetworkPoolSelector } from "../network/pool/selector";
+import type { TelemetryBatchBuffer } from "../observability/telemetry-buffer";
+import type { OAuthRefreshService } from "../providers/authentication/oauth-refresh-service";
+import type { ApiKeyAdmissionService } from "../security/admission/service";
+import type { RedisClient } from "../persistence/redis";
+import { CliToolMappingStore } from "./cli-tools/store";
+import { CliToolService } from "./cli-tools/service";
+import { DrizzleCliToolSecretSource } from "./cli-tools/secret-source";
+import type { ProviderRegistry } from "../providers/provider-registry";
+import type { BundledProviderCatalog } from "../providers/operations/provider-catalog-service";
+import type { ValidatedNetworkBindingFactory } from "../network/pool/resolver";
+import type { TrustedProxyBoundary } from "../config/network";
+import { gzipResponse } from "./response-compression";
+
+export interface ConsoleApiCompositionDeps {
+  readonly db: CartethyiaDatabase;
+  readonly accessResolver: ConsoleAccessResolver;
+  /**
+   * Drops the cached route snapshot after a console write changes the catalog.
+   * Structurally satisfied by `RouteSnapshotService`; declared here so the
+   * console composition root does not import the transport layer.
+   */
+  readonly routeSnapshotService: { invalidate(): Promise<number> };
+  readonly poolSelector: NetworkPoolSelector;
+  readonly telemetryBuffer: TelemetryBatchBuffer;
+  /**
+   * Queued writers the console can drain on demand (telemetry, usage, health
+   * events). Optional for the same reason the other reduced composition
+   * surface is: absent means the flush control is not offered rather than the
+   * console failing to build.
+   */
+  readonly flushBuffers?: { flush(): Promise<void> };
+  /**
+   * The request state store owns the live in-flight gauge, so the console reads
+   * its snapshot/subscription from here rather than a free-standing module.
+   */
+  readonly stateStore?: LiveInFlightSource;
+  readonly providerRegistry: ProviderRegistry;
+  readonly bundledModelCatalog: BundledProviderCatalog;
+  readonly networkBindingFactory: ValidatedNetworkBindingFactory;
+  readonly redis: RedisClient | undefined;
+  readonly oauthRefreshService: OAuthRefreshService;
+  readonly admissionService: Pick<ApiKeyAdmissionService, "purgeKey">;
+  readonly readRoutingAccountInflight?:
+    | ((
+        providerId: string,
+        tenantId: string | null,
+      ) => Promise<readonly { accountId: string; inflight: number }[]>)
+    | undefined;
+  readonly resolvePeerAddress?: (request: Request) => string | null;
+  readonly trustedProxyBoundary?: TrustedProxyBoundary;
+}
+/**
+ * Extracts a bearer API key from a console request, or `undefined`.
+ *
+ * Deliberately narrower than the proxy surface's `requestToken`: that one also
+ * accepts `x-api-key` and throws on a malformed header, because a proxy caller
+ * must be told its credential is wrong. Here the header is only an *alternative*
+ * to a session cookie, so an absent or unparsable one means "not a key" and the
+ * request proceeds as an unauthenticated session request — which the routes
+ * then reject with their own 401. Returning `undefined` rather than throwing
+ * keeps a browser that sends a stray Authorization header from being told its
+ * session is invalid.
+ */
+function readApiKeyBearer(request: Request): string | undefined {
+  const authorization = request.headers.get("authorization");
+  if (authorization === null) return undefined;
+  const match = /^Bearer\s+(\S+)$/i.exec(authorization.trim());
+  return match?.[1];
+}
+
+export function createConsoleRouter(deps: ConsoleApiCompositionDeps): Elysia {
+  const { db, routeSnapshotService, poolSelector, telemetryBuffer, redis } = deps;
+  /**
+   * Per-request cache: `beforeHandle` resolves the session asynchronously, and
+   * the sync `ConsoleAccessResolver` contract reads the decision back out of
+   * it. Scoped to this composition rather than the module so two routers in one
+   * process (tests, or a second app instance) never share decisions.
+   */
+  const sessionAccessCache = new WeakMap<Request, AccessDecision | null>();
+  const cookiePolicy = defaultSessionCookiePolicy;
+  const credentialService = new ConsoleCredentialService();
+  const sessionService = new ConsoleSessionService(db, cookiePolicy);
+  const lockoutService = new ConsoleLockoutService(db);
+  const setupService = new FirstBootSetupService(db, credentialService);
+  // The default gateway key is seeded only when the first-boot wizard runs, so a
+  // key set in the environment does nothing until an operator completes setup.
+  // Fire and forget: a failed check must not stop the console from mounting.
+  void setupService.requiresSetup().then((needsSetup) => {
+    if (needsSetup && resolveDefaultGatewayApiKey() !== undefined) {
+      log.warn(
+        "[setup] CARTETHYIA_API_KEY is set but no console user exists yet; complete the first-boot wizard at /console so the key is seeded",
+      );
+    }
+  }).catch((error: unknown) => {
+    log.warn("[setup] could not check first-boot state", error);
+  });
+  const auditRecorder = new AuditRecorder(db);
+  const cliToolService = new CliToolService(
+    new CliToolMappingStore(db),
+    new DrizzleCliToolSecretSource(db),
+  );
+  const accessResolver: ConsoleAccessResolver = (request) =>
+    deps.accessResolver(request) ?? sessionAccessCache.get(request) ?? undefined;
+  const console = new Elysia({ prefix: "/console/api" })
+    .use(createConsoleCsrfMiddleware())
+    .use(createConsoleMutationLimiterMiddleware())
+    .beforeHandle(async ({ request }: { request: Request }) => {
+      // The auth routes (`/console/api/auth/*`) resolve the session themselves
+      // and never read `accessResolver`, so resolving here too would repeat the
+      // session lookup plus its user query on every login/session/logout call
+      // for a decision nothing consumes. Skip them.
+      if (new URL(request.url).pathname.startsWith("/console/api/auth/")) return;
+      const access = await resolveConsoleAccess(db, sessionService, request);
+      if (access) {
+        sessionAccessCache.set(request, access);
+        return;
+      }
+      // No session cookie. A tenant API key may still reach the catalog routes
+      // it is scoped for — that is what lets a key register a BYOK provider or
+      // add a model without a browser session. The key is resolved through the
+      // same path `/v1` uses, so scopes and revocation behave identically, and
+      // a request carrying no credential at all stays unauthenticated (the
+      // routes reject it) rather than falling back to an implicit identity.
+      const bearer = readApiKeyBearer(request);
+      if (bearer === undefined) return;
+      const resolved = await resolveApiKeyAuthorization(db, bearer);
+      if (resolved === undefined) return;
+      sessionAccessCache.set(
+        request,
+        createAccessDecision({
+          id: resolved.id,
+          tenantId: resolved.tenantId,
+          scopes: resolved.scopes,
+          admissionIdentity: resolved.id,
+        }),
+      );
+    })
+    .use(
+      createConsoleAuthRoutes(
+        db,
+        credentialService,
+        sessionService,
+        lockoutService,
+        setupService,
+        cookiePolicy,
+        deps.trustedProxyBoundary ?? { mode: "disabled" },
+        (request) => deps.resolvePeerAddress?.(request) ?? undefined,
+      ),
+    );
+  const ctx: ConsoleDomainContext = {
+    db,
+    accessResolver,
+    auditRecorder,
+    oauthRefreshService: deps.oauthRefreshService,
+    cliToolService,
+    redis,
+    routeSnapshotService,
+    poolSelector,
+    telemetryBuffer,
+    ...(deps.stateStore ? { stateStore: deps.stateStore } : {}),
+    providerRegistry: deps.providerRegistry,
+    bundledModelCatalog: deps.bundledModelCatalog,
+    networkBindingFactory: deps.networkBindingFactory,
+    admissionService: deps.admissionService,
+    readRoutingAccountInflight: deps.readRoutingAccountInflight,
+    ...(deps.flushBuffers ? { flushBuffers: deps.flushBuffers } : {}),
+    credentialService,
+    // The backup surface re-authenticates the operator, so it needs the current
+    // user's hash. Read from the session on the request that asks for it, never
+    // cached in a field, so a password change or a deactivated user takes
+    // effect on the very next attempt.
+    loadConsoleUser: async (request: Request) => {
+      const user = await resolveConsoleUser(db, sessionService, request);
+      return user === null ? null : { passwordHash: user.passwordHash };
+    },
+  };
+  registerConsoleDomains(console as unknown as Elysia, ctx);
+  // Compress the JSON control plane on the way out.
+  //
+  // `wrap` is used rather than a lifecycle hook because this Elysia beta does
+  // not deliver the response body to them: measured, both `mapResponse` and
+  // `afterHandle` receive `responseValue`/`response` as `undefined` for a
+  // plain-object route, and Elysia sets no `content-length`, so a hook has
+  // nothing to compress and no size to judge. `wrap` sits outside the router
+  // and sees the finished `Response`, which is what this needs.
+  //
+  // Scoped by path *inside* `gzipResponse`, not by this instance: Elysia's
+  // `use()` merges a child's `hoc` into the root app's ext, so this wrap is
+  // reached by `/v1/*` as well. The allowlist is `/console/api/` + `/metrics`.
+  // `/v1/*` is deliberately excluded, because a streaming completion must not
+  // be buffered and proxied bodies are the provider's own bytes. See
+  // `response-compression.ts` for the full reasoning and the measured win.
+  console.wrap(
+    (fetch) => (request: Request, ...rest: unknown[]) =>
+      Promise.resolve(fetch(request, ...rest)).then((response) =>
+        gzipResponse(request, response),
+      ),
+  );
+  return console as unknown as Elysia;
+}