create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/routes/auth/hub-sign-in.ts

@@ -1,242 +0,0 @@
-/**
- * The hub signs in its spokes — four routes (#7894, spec
- * docs/specs/7894-the-hub-signs-in-its-spec.md D5, D6).
- *
- *   POST /v1/hub-sign-in/codes   — a cookie session mints a single-use code
- *   POST /v1/hub-sign-in/token   — the client trades a code for a credential
- *   POST /v1/hub-sign-in/revoke  — the client ends a credential / burns a code
- *   GET  /v1/hub-sign-in/me      — the credential's person, read live, and the
- *                                  customer id the hub vouches for (D13)
- *
- * Two registrations, because two different callers reach them:
- *
- *   - `hubSignInSessionRoutes` (`codes`, `me`) go in `server.ts`'s `authScope`:
- *     `request.userId` is set by the auth preHandler before either handler
- *     runs. `codes` answers only a cookie session (`request.sessionTenant` is
- *     the cookie-only signal): an `ApiToken` is 403 here, an agent key is 403
- *     at the preHandler, and a hub credential is 404 there — none of them
- *     reaches a code write. `me` answers only the hub credential
- *     (`request.hubSession` is set by that one branch); any other caller is 404.
- *   - `hubSignInClientRoutes` (`token`, `revoke`) go in their OWN scope outside
- *     `authScope`: the caller is a spoke's server, authenticated by its client
- *     secret and its spoke key, not by a person's session. The scope carries
- *     the per-IP limiter; the per-client bucket lives in the service, keyed on
- *     the VERIFIED client.
- *
- * Envelope per apps/api/CLAUDE.md: `{ ok: true, data }` /
- * `{ ok: false, error: { code, message } }`, real HTTP status codes. Every
- * success body is re-validated against its own `.strict()` contract before it
- * leaves the process. Credentials and codes are never logged and every body
- * that carries one is `Cache-Control: no-store`. No route here writes a
- * `Session` row or sets a cookie.
- *
- * API↔MCP parity: a credential exchange between a site and its hub is not an
- * agent-facing call — no MCP twin for any of the four (the same footing as
- * `/v1/auth/tokens`; recorded in apps/api/CLAUDE.md).
- */
-import { logger } from "@working-theory/observability";
-import { findSignInClientInfo } from "../../lib/hub-sign-in-store.js";
-import {
-  hubSignInCodeResponseSchema,
-  hubSignInMeResponseSchema,
-  hubSignInRevokeResponseSchema,
-  hubSignInTokenResponseSchema,
-  hubSignInClientInfoResponseSchema,
-} from "@working-theory/validation";
-import type { FastifyPluginAsync, FastifyReply, FastifyRequest } from "fastify";
-import type { ZodType } from "zod";
-
-import {
-  createCode,
-  exchange,
-  readMe,
-  revoke,
-  type Result,
-} from "../../services/hub-sign-in.js";
-
-/** These bodies are a few hundred bytes; bound them well below the default. */
-const BODY_LIMIT_BYTES = 4_096;
-
-const SPOKE_KEY_HEADER = "x-ailk-spoke-key";
-
-function error(
-  reply: FastifyReply,
-  status: number,
-  code: string,
-  message: string,
-): FastifyReply {
-  return reply.status(status).send({ ok: false, error: { code, message } });
-}
-
-function notFound(reply: FastifyReply): FastifyReply {
-  return error(reply, 404, "not_found", "Not found");
-}
-
-/** A single string header value, or `undefined` for an absent or repeated one. */
-function singleHeader(
-  request: FastifyRequest,
-  name: string,
-): string | undefined {
-  const value = request.headers[name];
-  return typeof value === "string" ? value : undefined;
-}
-
-/** Send a service result: its refusal, or its value re-validated against `schema`. */
-function respond<T>(
-  reply: FastifyReply,
-  result: Result<T>,
-  schema: ZodType<T>,
-  route: string,
-  successStatus: number,
-): FastifyReply {
-  if (!result.ok) {
-    const { status, code, message, retryAfter } = result.error;
-    if (retryAfter !== undefined)
-      reply.header("Retry-After", String(retryAfter));
-    return error(reply, status, code, message);
-  }
-  const parsed = schema.safeParse(result.value);
-  if (!parsed.success) {
-    // Issues only — never the value, which may carry a code or a credential.
-    logger.error(
-      { route, issues: parsed.error.issues.map((i) => i.path.join(".")) },
-      "[hub-sign-in] response failed its own contract schema",
-    );
-    return error(
-      reply,
-      500,
-      "internal_error",
-      "Response failed contract validation",
-    );
-  }
-  return reply
-    .status(successStatus)
-    .header("Cache-Control", "no-store")
-    .header("Pragma", "no-cache")
-    .send({ ok: true, data: parsed.data });
-}
-
-/** `codes` and `me` — registered in `server.ts`'s `authScope`. */
-export const hubSignInSessionRoutes: FastifyPluginAsync = async (fastify) => {
-  fastify.post(
-    "/v1/hub-sign-in/codes",
-    { bodyLimit: BODY_LIMIT_BYTES },
-    async (request, reply) => {
-      const userId = request.userId;
-      if (!userId) {
-        return error(reply, 401, "unauthorized", "Authentication required");
-      }
-      // A cookie session only. A personal ApiToken reaches here with a userId
-      // and no sessionTenant; it must mint nothing (D5).
-      if (!request.sessionTenant) {
-        return error(reply, 403, "forbidden", "Forbidden");
-      }
-      const result = await createCode({ userId, body: request.body });
-      return respond(
-        reply,
-        result,
-        hubSignInCodeResponseSchema,
-        "hub-sign-in/codes",
-        201,
-      );
-    },
-  );
-
-  fastify.get("/v1/hub-sign-in/me", async (request, reply) => {
-    // Reachable only by the hub credential: `hubSession` is set by that one
-    // preHandler branch and by nothing else.
-    if (!request.hubSession || !request.userId) return notFound(reply);
-    const result = await readMe(
-      request.userId,
-      request.hubSession.workspaceId,
-      request.log,
-    );
-    return respond(
-      reply,
-      result,
-      hubSignInMeResponseSchema,
-      "hub-sign-in/me",
-      200,
-    );
-  });
-};
-
-/**
- * `clients/:clientId` — public, no auth (#8790 D2). The hub's own sign-in page
- * asks what it may say about the spoke that sent a visitor: the spoke's name
- * and origin, from the registry. A missing, disabled, or revoked client is
- * a 404 with the same body as an unknown one, so the route confirms nothing
- * about ids that are not live. Registered in `server.ts`'s public block.
- */
-export const hubSignInPublicRoutes: FastifyPluginAsync = async (fastify) => {
-  fastify.get<{ Params: { clientId: string } }>(
-    "/v1/hub-sign-in/clients/:clientId",
-    async (request, reply) => {
-      const { clientId } = request.params;
-      reply.header("Cache-Control", "no-store");
-      if (clientId.length === 0 || clientId.length > 128) {
-        return notFound(reply);
-      }
-      const info = await findSignInClientInfo(clientId);
-      if (info === null) return notFound(reply);
-      const parsed = hubSignInClientInfoResponseSchema.safeParse(info);
-      if (!parsed.success) {
-        logger.error(
-          {
-            route: "hub-sign-in/clients",
-            issues: parsed.error.issues.map((i) => i.path.join(".")),
-          },
-          "[hub-sign-in] response failed its own contract schema",
-        );
-        return error(
-          reply,
-          500,
-          "internal_error",
-          "Response failed contract validation",
-        );
-      }
-      return reply.status(200).send({ ok: true, data: parsed.data });
-    },
-  );
-};
-
-/** `token` and `revoke` — registered in their own rate-limited scope. */
-export const hubSignInClientRoutes: FastifyPluginAsync = async (fastify) => {
-  fastify.post(
-    "/v1/hub-sign-in/token",
-    { bodyLimit: BODY_LIMIT_BYTES },
-    async (request, reply) => {
-      const result = await exchange({
-        authorization: singleHeader(request, "authorization"),
-        spokeKey: singleHeader(request, SPOKE_KEY_HEADER),
-        body: request.body,
-      });
-      return respond(
-        reply,
-        result,
-        hubSignInTokenResponseSchema,
-        "hub-sign-in/token",
-        200,
-      );
-    },
-  );
-
-  fastify.post(
-    "/v1/hub-sign-in/revoke",
-    { bodyLimit: BODY_LIMIT_BYTES },
-    async (request, reply) => {
-      const result = await revoke({
-        authorization: singleHeader(request, "authorization"),
-        spokeKey: singleHeader(request, SPOKE_KEY_HEADER),
-        body: request.body,
-      });
-      return respond(
-        reply,
-        result,
-        hubSignInRevokeResponseSchema,
-        "hub-sign-in/revoke",
-        200,
-      );
-    },
-  );
-};

package/templates/apps/api/src/routes/auth/tokens.ts

@@ -1,211 +0,0 @@
-/**
- * API Token Management
- * 
- * Handles creation and management of API tokens for mobile/external clients.
- * These tokens are stored locally in the customer's database.
- */
-import { randomBytes, createHash } from 'crypto';
-
-import { getClock } from '@working-theory/common';
-import { zApiTokenId } from '@working-theory/ids';
-import { logger } from '@working-theory/observability';
-import type { FastifyPluginAsync } from 'fastify';
-import { z } from 'zod';
-
-import { prisma } from '../../lib/prisma.js';
-
-// Boundary id validation (ADR-0031 rule 5): the entity-typed Zod schema,
-// not a bare string — a malformed :id is a 400, not a query.
-const tokenParamsSchema = z.object({ id: zApiTokenId });
-
-const createTokenSchema = z.object({
-  name: z.string().min(1, 'Name is required'),
-  clientType: z.enum(['mobile', 'api', 'cli']).default('api'),
-  deviceInfo: z.string().optional(),
-  scopes: z.array(z.string()).default([]),
-  expiresInDays: z.number().min(1).max(365).optional(),
-});
-
-/**
- * Generate a secure API token
- */
-function generateToken(): { token: string; hash: string; prefix: string } {
-  const token = `tok_${randomBytes(32).toString('hex')}`;
-  const hash = createHash('sha256').update(token).digest('hex');
-  const prefix = token.substring(0, 12);
-  return { token, hash, prefix };
-}
-
-export const tokenRoutes: FastifyPluginAsync = async (fastify) => {
-  /**
-   * POST /v1/auth/tokens
-   * Create a new API token
-   * Requires authenticated user (session or existing token)
-   */
-  fastify.post('/v1/auth/tokens', async (request, reply) => {
-    try {
-      // TODO: Get userId from session/auth middleware
-      const userId = (request as unknown as { userId?: string }).userId;
-      if (!userId) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Authentication required',
-        });
-      }
-
-      const data = createTokenSchema.parse(request.body);
-      const { token, hash, prefix } = generateToken();
-
-      // Calculate expiration
-      const expiresAt = data.expiresInDays
-        ? new Date(getClock().now() + data.expiresInDays * 24 * 60 * 60 * 1000)
-        : null;
-
-      // Create token in database
-      const apiToken = await prisma.apiToken.create({
-        data: {
-          userId,
-          name: data.name,
-          token: hash, // Store hash, not the actual token
-          tokenPrefix: prefix,
-          clientType: data.clientType,
-          ...(data.deviceInfo !== undefined && { deviceInfo: data.deviceInfo }),
-          scopes: data.scopes,
-          expiresAt,
-        },
-        select: {
-          id: true,
-          name: true,
-          tokenPrefix: true,
-          clientType: true,
-          scopes: true,
-          expiresAt: true,
-          createdAt: true,
-        },
-      });
-
-      // Return the actual token ONCE (user must save it)
-      return reply.status(201).send({
-        success: true,
-        token, // Only time we return the actual token
-        data: apiToken,
-        warning: 'Save this token now. You will not be able to see it again.',
-      });
-    } catch (error) {
-      if (error instanceof z.ZodError) {
-        return reply.status(400).send({
-          success: false,
-          error: 'Validation failed',
-          details: error.issues,
-        });
-      }
-
-      logger.error({ err: error }, '[Tokens] Error creating token');
-      return reply.status(500).send({
-        success: false,
-        error: 'Internal server error',
-      });
-    }
-  });
-
-  /**
-   * GET /v1/auth/tokens
-   * List user's API tokens (without the actual token values)
-   */
-  fastify.get('/v1/auth/tokens', async (request, reply) => {
-    try {
-      const userId = (request as unknown as { userId?: string }).userId;
-      if (!userId) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Authentication required',
-        });
-      }
-
-      const tokens = await prisma.apiToken.findMany({
-        where: {
-          userId,
-          revokedAt: null,
-        },
-        select: {
-          id: true,
-          name: true,
-          tokenPrefix: true,
-          clientType: true,
-          deviceInfo: true,
-          scopes: true,
-          expiresAt: true,
-          lastUsedAt: true,
-          createdAt: true,
-        },
-        orderBy: { createdAt: 'desc' },
-      });
-
-      return reply.send({
-        success: true,
-        data: tokens,
-      });
-    } catch (error) {
-      logger.error({ err: error }, '[Tokens] Error listing tokens');
-      return reply.status(500).send({
-        success: false,
-        error: 'Internal server error',
-      });
-    }
-  });
-
-  /**
-   * DELETE /v1/auth/tokens/:id
-   * Revoke an API token
-   */
-  fastify.delete<{ Params: { id: string } }>('/v1/auth/tokens/:id', async (request, reply) => {
-    try {
-      const userId = (request as unknown as { userId?: string }).userId;
-      if (!userId) {
-        return reply.status(401).send({
-          success: false,
-          error: 'Authentication required',
-        });
-      }
-
-      const params = tokenParamsSchema.safeParse(request.params);
-      if (!params.success) {
-        return reply.status(400).send({
-          success: false,
-          error: 'Validation failed',
-        });
-      }
-      const { id } = params.data;
-
-      // Verify ownership and revoke
-      const token = await prisma.apiToken.updateMany({
-        where: {
-          id,
-          userId,
-          revokedAt: null,
-        },
-        data: {
-          revokedAt: new Date(),
-        },
-      });
-
-      if (token.count === 0) {
-        return reply.status(404).send({
-          success: false,
-          error: 'Token not found',
-        });
-      }
-
-      return reply.send({
-        success: true,
-        message: 'Token revoked',
-      });
-    } catch (error) {
-      logger.error({ err: error }, '[Tokens] Error revoking token');
-      return reply.status(500).send({
-        success: false,
-        error: 'Internal server error',
-      });
-    }
-  });
-};