corporateai 0.0.1

package/server/src/log-redaction.ts

@@ -0,0 +1,146 @@
+import os from "node:os";
+
+export const CURRENT_USER_REDACTION_TOKEN = "*";
+
+export interface CurrentUserRedactionOptions {
+  enabled?: boolean;
+  replacement?: string;
+  userNames?: string[];
+  homeDirs?: string[];
+}
+
+type CurrentUserCandidates = {
+  userNames: string[];
+  homeDirs: string[];
+  replacement: string;
+};
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+
+function escapeRegExp(value: string) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function uniqueNonEmpty(values: Array<string | null | undefined>) {
+  return Array.from(new Set(values.map((value) => value?.trim() ?? "").filter(Boolean)));
+}
+
+function splitPathSegments(value: string) {
+  return value.replace(/[\\/]+$/, "").split(/[\\/]+/).filter(Boolean);
+}
+
+function replaceLastPathSegment(pathValue: string, replacement: string) {
+  const normalized = pathValue.replace(/[\\/]+$/, "");
+  const lastSeparator = Math.max(normalized.lastIndexOf("/"), normalized.lastIndexOf("\\"));
+  if (lastSeparator < 0) return replacement;
+  return `${normalized.slice(0, lastSeparator + 1)}${replacement}`;
+}
+
+export function maskUserNameForLogs(value: string, fallback = CURRENT_USER_REDACTION_TOKEN) {
+  const trimmed = value.trim();
+  if (!trimmed) return fallback;
+  return `${trimmed[0]}${"*".repeat(Math.max(1, Array.from(trimmed).length - 1))}`;
+}
+
+function defaultUserNames() {
+  const candidates = [
+    process.env.USER,
+    process.env.LOGNAME,
+    process.env.USERNAME,
+  ];
+
+  try {
+    candidates.push(os.userInfo().username);
+  } catch {
+    // Some environments do not expose userInfo; env vars are enough fallback.
+  }
+
+  return uniqueNonEmpty(candidates);
+}
+
+function defaultHomeDirs(userNames: string[]) {
+  const candidates: Array<string | null | undefined> = [
+    process.env.HOME,
+    process.env.USERPROFILE,
+  ];
+
+  try {
+    candidates.push(os.homedir());
+  } catch {
+    // Ignore and fall back to env hints below.
+  }
+
+  for (const userName of userNames) {
+    candidates.push(`/Users/${userName}`);
+    candidates.push(`/home/${userName}`);
+    candidates.push(`C:\\Users\\${userName}`);
+  }
+
+  return uniqueNonEmpty(candidates);
+}
+
+let cachedCurrentUserCandidates: CurrentUserCandidates | null = null;
+
+function getDefaultCurrentUserCandidates(): CurrentUserCandidates {
+  if (cachedCurrentUserCandidates) return cachedCurrentUserCandidates;
+  const userNames = defaultUserNames();
+  cachedCurrentUserCandidates = {
+    userNames,
+    homeDirs: defaultHomeDirs(userNames),
+    replacement: CURRENT_USER_REDACTION_TOKEN,
+  };
+  return cachedCurrentUserCandidates;
+}
+
+function resolveCurrentUserCandidates(opts?: CurrentUserRedactionOptions) {
+  const defaults = getDefaultCurrentUserCandidates();
+  const userNames = uniqueNonEmpty(opts?.userNames ?? defaults.userNames);
+  const homeDirs = uniqueNonEmpty(opts?.homeDirs ?? defaults.homeDirs);
+  const replacement = opts?.replacement?.trim() || defaults.replacement;
+  return { userNames, homeDirs, replacement };
+}
+
+export function redactCurrentUserText(input: string, opts?: CurrentUserRedactionOptions) {
+  if (!input) return input;
+  if (opts?.enabled === false) return input;
+
+  const { userNames, homeDirs, replacement } = resolveCurrentUserCandidates(opts);
+  let result = input;
+
+  for (const homeDir of [...homeDirs].sort((a, b) => b.length - a.length)) {
+    const lastSegment = splitPathSegments(homeDir).pop() ?? "";
+    const replacementDir = lastSegment
+      ? replaceLastPathSegment(homeDir, maskUserNameForLogs(lastSegment, replacement))
+      : replacement;
+    result = result.split(homeDir).join(replacementDir);
+  }
+
+  for (const userName of [...userNames].sort((a, b) => b.length - a.length)) {
+    const pattern = new RegExp(`(?<![A-Za-z0-9._-])${escapeRegExp(userName)}(?![A-Za-z0-9._-])`, "g");
+    result = result.replace(pattern, maskUserNameForLogs(userName, replacement));
+  }
+
+  return result;
+}
+
+export function redactCurrentUserValue<T>(value: T, opts?: CurrentUserRedactionOptions): T {
+  if (typeof value === "string") {
+    return redactCurrentUserText(value, opts) as T;
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => redactCurrentUserValue(entry, opts)) as T;
+  }
+  if (!isPlainObject(value)) {
+    return value;
+  }
+
+  const redacted: Record<string, unknown> = {};
+  for (const [key, entry] of Object.entries(value)) {
+    redacted[key] = redactCurrentUserValue(entry, opts);
+  }
+  return redacted as T;
+}

package/server/src/middleware/auth.ts

@@ -0,0 +1,178 @@
+import { createHash } from "node:crypto";
+import type { Request, RequestHandler } from "express";
+import { and, eq, isNull } from "drizzle-orm";
+import type { Db } from "@corporateai/db";
+import { agentApiKeys, agents, companyMemberships, instanceUserRoles } from "@corporateai/db";
+import { verifyLocalAgentJwt } from "../agent-auth-jwt.js";
+import type { DeploymentMode } from "@corporateai/shared";
+import type { BetterAuthSessionResult } from "../auth/better-auth.js";
+import { logger } from "./logger.js";
+import { boardAuthService } from "../services/board-auth.js";
+
+function hashToken(token: string) {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+interface ActorMiddlewareOptions {
+  deploymentMode: DeploymentMode;
+  resolveSession?: (req: Request) => Promise<BetterAuthSessionResult | null>;
+}
+
+export function actorMiddleware(db: Db, opts: ActorMiddlewareOptions): RequestHandler {
+  const boardAuth = boardAuthService(db);
+  return async (req, _res, next) => {
+    req.actor =
+      opts.deploymentMode === "local_trusted"
+        ? { type: "board", userId: "local-board", isInstanceAdmin: true, source: "local_implicit" }
+        : { type: "none", source: "none" };
+
+    const runIdHeader = req.header("x-paperclip-run-id");
+
+    const authHeader = req.header("authorization");
+    if (!authHeader?.toLowerCase().startsWith("bearer ")) {
+      if (opts.deploymentMode === "authenticated" && opts.resolveSession) {
+        let session: BetterAuthSessionResult | null = null;
+        try {
+          session = await opts.resolveSession(req);
+        } catch (err) {
+          logger.warn(
+            { err, method: req.method, url: req.originalUrl },
+            "Failed to resolve auth session from request headers",
+          );
+        }
+        if (session?.user?.id) {
+          const userId = session.user.id;
+          const [roleRow, memberships] = await Promise.all([
+            db
+              .select({ id: instanceUserRoles.id })
+              .from(instanceUserRoles)
+              .where(and(eq(instanceUserRoles.userId, userId), eq(instanceUserRoles.role, "instance_admin")))
+              .then((rows) => rows[0] ?? null),
+            db
+              .select({ companyId: companyMemberships.companyId })
+              .from(companyMemberships)
+              .where(
+                and(
+                  eq(companyMemberships.principalType, "user"),
+                  eq(companyMemberships.principalId, userId),
+                  eq(companyMemberships.status, "active"),
+                ),
+              ),
+          ]);
+          req.actor = {
+            type: "board",
+            userId,
+            companyIds: memberships.map((row) => row.companyId),
+            isInstanceAdmin: Boolean(roleRow),
+            runId: runIdHeader ?? undefined,
+            source: "session",
+          };
+          next();
+          return;
+        }
+      }
+      if (runIdHeader) req.actor.runId = runIdHeader;
+      next();
+      return;
+    }
+
+    const token = authHeader.slice("bearer ".length).trim();
+    if (!token) {
+      next();
+      return;
+    }
+
+    const boardKey = await boardAuth.findBoardApiKeyByToken(token);
+    if (boardKey) {
+      const access = await boardAuth.resolveBoardAccess(boardKey.userId);
+      if (access.user) {
+        await boardAuth.touchBoardApiKey(boardKey.id);
+        req.actor = {
+          type: "board",
+          userId: boardKey.userId,
+          companyIds: access.companyIds,
+          isInstanceAdmin: access.isInstanceAdmin,
+          keyId: boardKey.id,
+          runId: runIdHeader || undefined,
+          source: "board_key",
+        };
+        next();
+        return;
+      }
+    }
+
+    const tokenHash = hashToken(token);
+    const key = await db
+      .select()
+      .from(agentApiKeys)
+      .where(and(eq(agentApiKeys.keyHash, tokenHash), isNull(agentApiKeys.revokedAt)))
+      .then((rows) => rows[0] ?? null);
+
+    if (!key) {
+      const claims = verifyLocalAgentJwt(token);
+      if (!claims) {
+        next();
+        return;
+      }
+
+      const agentRecord = await db
+        .select()
+        .from(agents)
+        .where(eq(agents.id, claims.sub))
+        .then((rows) => rows[0] ?? null);
+
+      if (!agentRecord || agentRecord.companyId !== claims.company_id) {
+        next();
+        return;
+      }
+
+      if (agentRecord.status === "terminated" || agentRecord.status === "pending_approval") {
+        next();
+        return;
+      }
+
+      req.actor = {
+        type: "agent",
+        agentId: claims.sub,
+        companyId: claims.company_id,
+        keyId: undefined,
+        runId: runIdHeader || claims.run_id || undefined,
+        source: "agent_jwt",
+      };
+      next();
+      return;
+    }
+
+    await db
+      .update(agentApiKeys)
+      .set({ lastUsedAt: new Date() })
+      .where(eq(agentApiKeys.id, key.id));
+
+    const agentRecord = await db
+      .select()
+      .from(agents)
+      .where(eq(agents.id, key.agentId))
+      .then((rows) => rows[0] ?? null);
+
+    if (!agentRecord || agentRecord.status === "terminated" || agentRecord.status === "pending_approval") {
+      next();
+      return;
+    }
+
+    req.actor = {
+      type: "agent",
+      agentId: key.agentId,
+      companyId: key.companyId,
+      keyId: key.id,
+      runId: runIdHeader || undefined,
+      source: "agent_key",
+    };
+
+    next();
+  };
+}
+
+export function requireBoard(req: Express.Request) {
+  return req.actor.type === "board";
+}
+

package/server/src/middleware/board-mutation-guard.ts

@@ -0,0 +1,66 @@
+import type { Request, RequestHandler } from "express";
+
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+const DEFAULT_DEV_ORIGINS = [
+  "http://localhost:3100",
+  "http://127.0.0.1:3100",
+];
+
+function parseOrigin(value: string | undefined) {
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    return `${url.protocol}//${url.host}`.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+
+function trustedOriginsForRequest(req: Request) {
+  const origins = new Set(DEFAULT_DEV_ORIGINS.map((value) => value.toLowerCase()));
+  const host = req.header("host")?.trim();
+  if (host) {
+    origins.add(`http://${host}`.toLowerCase());
+    origins.add(`https://${host}`.toLowerCase());
+  }
+  return origins;
+}
+
+function isTrustedBoardMutationRequest(req: Request) {
+  const allowedOrigins = trustedOriginsForRequest(req);
+  const origin = parseOrigin(req.header("origin"));
+  if (origin && allowedOrigins.has(origin)) return true;
+
+  const refererOrigin = parseOrigin(req.header("referer"));
+  if (refererOrigin && allowedOrigins.has(refererOrigin)) return true;
+
+  return false;
+}
+
+export function boardMutationGuard(): RequestHandler {
+  return (req, res, next) => {
+    if (SAFE_METHODS.has(req.method.toUpperCase())) {
+      next();
+      return;
+    }
+
+    if (req.actor.type !== "board") {
+      next();
+      return;
+    }
+
+    // Local-trusted mode and board bearer keys are not browser-session requests.
+    // In these modes, origin/referer headers can be absent; do not block those mutations.
+    if (req.actor.source === "local_implicit" || req.actor.source === "board_key") {
+      next();
+      return;
+    }
+
+    if (!isTrustedBoardMutationRequest(req)) {
+      res.status(403).json({ error: "Board mutation requires trusted browser origin" });
+      return;
+    }
+
+    next();
+  };
+}

package/server/src/middleware/error-handler.ts

@@ -0,0 +1,71 @@
+import type { Request, Response, NextFunction } from "express";
+import { ZodError } from "zod";
+import { HttpError } from "../errors.js";
+
+export interface ErrorContext {
+  error: { message: string; stack?: string; name?: string; details?: unknown; raw?: unknown };
+  method: string;
+  url: string;
+  reqBody?: unknown;
+  reqParams?: unknown;
+  reqQuery?: unknown;
+}
+
+function attachErrorContext(
+  req: Request,
+  res: Response,
+  payload: ErrorContext["error"],
+  rawError?: Error,
+) {
+  (res as any).__errorContext = {
+    error: payload,
+    method: req.method,
+    url: req.originalUrl,
+    reqBody: req.body,
+    reqParams: req.params,
+    reqQuery: req.query,
+  } satisfies ErrorContext;
+  if (rawError) {
+    (res as any).err = rawError;
+  }
+}
+
+export function errorHandler(
+  err: unknown,
+  req: Request,
+  res: Response,
+  _next: NextFunction,
+) {
+  if (err instanceof HttpError) {
+    if (err.status >= 500) {
+      attachErrorContext(
+        req,
+        res,
+        { message: err.message, stack: err.stack, name: err.name, details: err.details },
+        err,
+      );
+    }
+    res.status(err.status).json({
+      error: err.message,
+      ...(err.details ? { details: err.details } : {}),
+    });
+    return;
+  }
+
+  if (err instanceof ZodError) {
+    res.status(400).json({ error: "Validation error", details: err.errors });
+    return;
+  }
+
+  const rootError = err instanceof Error ? err : new Error(String(err));
+  attachErrorContext(
+    req,
+    res,
+    err instanceof Error
+      ? { message: err.message, stack: err.stack, name: err.name }
+      : { message: String(err), raw: err, stack: rootError.stack, name: rootError.name },
+    rootError,
+  );
+
+  res.status(500).json({ error: "Internal server error" });
+}

package/server/src/middleware/index.ts

@@ -0,0 +1,3 @@
+export { logger, httpLogger } from "./logger.js";
+export { errorHandler } from "./error-handler.js";
+export { validate } from "./validate.js";

package/server/src/middleware/logger.ts

@@ -0,0 +1,90 @@
+import path from "node:path";
+import fs from "node:fs";
+import pino from "pino";
+import { pinoHttp } from "pino-http";
+import { readConfigFile } from "../config-file.js";
+import { resolveDefaultLogsDir, resolveHomeAwarePath } from "../home-paths.js";
+
+function resolveServerLogDir(): string {
+  const envOverride = process.env.PAPERCLIP_LOG_DIR?.trim();
+  if (envOverride) return resolveHomeAwarePath(envOverride);
+
+  const fileLogDir = readConfigFile()?.logging.logDir?.trim();
+  if (fileLogDir) return resolveHomeAwarePath(fileLogDir);
+
+  return resolveDefaultLogsDir();
+}
+
+const logDir = resolveServerLogDir();
+fs.mkdirSync(logDir, { recursive: true });
+
+const logFile = path.join(logDir, "server.log");
+
+const sharedOpts = {
+  translateTime: "HH:MM:ss",
+  ignore: "pid,hostname",
+  singleLine: true,
+};
+
+export const logger = pino({
+  level: "debug",
+}, pino.transport({
+  targets: [
+    {
+      target: "pino-pretty",
+      options: { ...sharedOpts, ignore: "pid,hostname,req,res,responseTime", colorize: true, destination: 1 },
+      level: "info",
+    },
+    {
+      target: "pino-pretty",
+      options: { ...sharedOpts, colorize: false, destination: logFile, mkdir: true },
+      level: "debug",
+    },
+  ],
+}));
+
+export const httpLogger = pinoHttp({
+  logger,
+  customLogLevel(_req, res, err) {
+    if (err || res.statusCode >= 500) return "error";
+    if (res.statusCode >= 400) return "warn";
+    return "info";
+  },
+  customSuccessMessage(req, res) {
+    return `${req.method} ${req.url} ${res.statusCode}`;
+  },
+  customErrorMessage(req, res, err) {
+    const ctx = (res as any).__errorContext;
+    const errMsg = ctx?.error?.message || err?.message || (res as any).err?.message || "unknown error";
+    return `${req.method} ${req.url} ${res.statusCode} — ${errMsg}`;
+  },
+  customProps(req, res) {
+    if (res.statusCode >= 400) {
+      const ctx = (res as any).__errorContext;
+      if (ctx) {
+        return {
+          errorContext: ctx.error,
+          reqBody: ctx.reqBody,
+          reqParams: ctx.reqParams,
+          reqQuery: ctx.reqQuery,
+        };
+      }
+      const props: Record<string, unknown> = {};
+      const { body, params, query } = req as any;
+      if (body && typeof body === "object" && Object.keys(body).length > 0) {
+        props.reqBody = body;
+      }
+      if (params && typeof params === "object" && Object.keys(params).length > 0) {
+        props.reqParams = params;
+      }
+      if (query && typeof query === "object" && Object.keys(query).length > 0) {
+        props.reqQuery = query;
+      }
+      if ((req as any).route?.path) {
+        props.routePath = (req as any).route.path;
+      }
+      return props;
+    }
+    return {};
+  },
+});

package/server/src/middleware/private-hostname-guard.ts

@@ -0,0 +1,92 @@
+import type { Request, RequestHandler } from "express";
+
+function isLoopbackHostname(hostname: string): boolean {
+  const normalized = hostname.trim().toLowerCase();
+  return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1";
+}
+
+function extractHostname(req: Request): string | null {
+  const forwardedHost = req.header("x-forwarded-host")?.split(",")[0]?.trim();
+  const hostHeader = req.header("host")?.trim();
+  const raw = forwardedHost || hostHeader;
+  if (!raw) return null;
+
+  try {
+    return new URL(`http://${raw}`).hostname.trim().toLowerCase();
+  } catch {
+    return raw.trim().toLowerCase();
+  }
+}
+
+function normalizeAllowedHostnames(values: string[]): string[] {
+  const unique = new Set<string>();
+  for (const value of values) {
+    const trimmed = value.trim().toLowerCase();
+    if (!trimmed) continue;
+    unique.add(trimmed);
+  }
+  return Array.from(unique);
+}
+
+export function resolvePrivateHostnameAllowSet(opts: { allowedHostnames: string[]; bindHost: string }): Set<string> {
+  const configuredAllow = normalizeAllowedHostnames(opts.allowedHostnames);
+  const bindHost = opts.bindHost.trim().toLowerCase();
+  const allowSet = new Set<string>(configuredAllow);
+
+  if (bindHost && bindHost !== "0.0.0.0") {
+    allowSet.add(bindHost);
+  }
+  allowSet.add("localhost");
+  allowSet.add("127.0.0.1");
+  allowSet.add("::1");
+  return allowSet;
+}
+
+function blockedHostnameMessage(hostname: string): string {
+  return (
+    `Hostname '${hostname}' is not allowed for this Corporate instance. ` +
+    `If you want to allow this hostname, please run pnpm corporateai allowed-hostname ${hostname}`
+  );
+}
+
+export function privateHostnameGuard(opts: {
+  enabled: boolean;
+  allowedHostnames: string[];
+  bindHost: string;
+}): RequestHandler {
+  if (!opts.enabled) {
+    return (_req, _res, next) => next();
+  }
+
+  const allowSet = resolvePrivateHostnameAllowSet({
+    allowedHostnames: opts.allowedHostnames,
+    bindHost: opts.bindHost,
+  });
+
+  return (req, res, next) => {
+    const hostname = extractHostname(req);
+    const wantsJson = req.path.startsWith("/api") || req.accepts(["json", "html", "text"]) === "json";
+
+    if (!hostname) {
+      const error = "Missing Host header. If you want to allow a hostname, run pnpm corporateai allowed-hostname <host>.";
+      if (wantsJson) {
+        res.status(403).json({ error });
+      } else {
+        res.status(403).type("text/plain").send(error);
+      }
+      return;
+    }
+
+    if (isLoopbackHostname(hostname) || allowSet.has(hostname)) {
+      next();
+      return;
+    }
+
+    const error = blockedHostnameMessage(hostname);
+    if (wantsJson) {
+      res.status(403).json({ error });
+    } else {
+      res.status(403).type("text/plain").send(error);
+    }
+  };
+}

package/server/src/middleware/validate.ts

@@ -0,0 +1,9 @@
+import type { Request, Response, NextFunction } from "express";
+import type { ZodSchema } from "zod";
+
+export function validate(schema: ZodSchema) {
+  return (req: Request, _res: Response, next: NextFunction) => {
+    req.body = schema.parse(req.body);
+    next();
+  };
+}