create-workframe 0.1.12 → 0.1.13

package/workframe-api/cleanup_dogfood_smoke.py

@@ -0,0 +1,252 @@
+#!/usr/bin/env python3
+"""Remove smoke-test clutter from a dogfood Workframe install.
+
+  python cleanup_dogfood_smoke.py --base http://127.0.0.1:18644 \\
+      --data-dir /path/to/MyBusiness/workframe-api/data
+
+ponytail: dogfood on Windows Docker often cannot DELETE rooms via API (sqlite lock);
+falls back to direct DB soft-delete and Hermes filesystem/registry cleanup.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import shutil
+import sqlite3
+import sys
+import time
+import urllib.error
+import urllib.request
+from pathlib import Path
+from typing import Any
+
+ROOT = Path(__file__).resolve().parent
+sys.path.insert(0, str(ROOT))
+
+from test_dogfood_flows import _mint_session_cookie, _pick_user, _req  # noqa: E402
+
+
+def _smoke_room_ids(conn: sqlite3.Connection) -> list[str]:
+    rows = conn.execute(
+        """
+        SELECT id FROM rooms
+        WHERE deleted_at IS NULL AND (
+          slug LIKE 'smoke-%'
+          OR name LIKE 'Smoke %'
+          OR topic = 'smoke test'
+          OR (name = 'Smoke Agent' AND slug LIKE 'dm-%')
+        )
+        """
+    ).fetchall()
+    return [str(r[0]) for r in rows]
+
+
+def _smoke_agent_slugs(conn: sqlite3.Connection) -> list[str]:
+    rows = conn.execute(
+        """
+        SELECT slug FROM agent_profiles
+        WHERE deleted_at IS NULL AND (
+          slug LIKE 'smoke-agent-%' OR display_name = 'Smoke Agent'
+        )
+        """
+    ).fetchall()
+    return [str(r[0]) for r in rows if str(r[0]).strip()]
+
+
+def _smoke_invite_ids(conn: sqlite3.Connection) -> list[str]:
+    rows = conn.execute(
+        """
+        SELECT id FROM workspace_invites
+        WHERE deleted_at IS NULL AND email LIKE '%@workframe.test'
+        """
+    ).fetchall()
+    return [str(r[0]) for r in rows]
+
+
+def _is_smoke_profile(name: str) -> bool:
+    return "smoke-agent" in name
+
+
+def _soft_delete_rooms_db(conn: sqlite3.Connection) -> int:
+    now = str(int(time.time()))
+    cur = conn.execute(
+        """
+        UPDATE rooms SET deleted_at = ?
+        WHERE deleted_at IS NULL AND (
+          slug LIKE 'smoke-%' OR name LIKE 'Smoke %' OR topic = 'smoke test'
+          OR (name = 'Smoke Agent' AND slug LIKE 'dm-%')
+        )
+        """,
+        (now,),
+    )
+    conn.commit()
+    return int(cur.rowcount)
+
+
+def _soft_delete_agents_db(conn: sqlite3.Connection, slugs: list[str]) -> int:
+    if not slugs:
+        return 0
+    now = str(int(time.time()))
+    placeholders = ",".join("?" * len(slugs))
+    cur = conn.execute(
+        f"UPDATE agent_profiles SET deleted_at = ?, updated_at = ? "
+        f"WHERE deleted_at IS NULL AND slug IN ({placeholders})",
+        [now, now, *slugs],
+    )
+    conn.commit()
+    return int(cur.rowcount)
+
+
+def _revoke_invites_db(conn: sqlite3.Connection, invite_ids: list[str]) -> int:
+    if not invite_ids:
+        return 0
+    now = str(int(time.time()))
+    placeholders = ",".join("?" * len(invite_ids))
+    cur = conn.execute(
+        f"UPDATE workspace_invites SET deleted_at = ? WHERE id IN ({placeholders}) AND deleted_at IS NULL",
+        [now, *invite_ids],
+    )
+    conn.commit()
+    return int(cur.rowcount)
+
+
+def _agents_root(data_dir: Path) -> Path | None:
+    # MyBusiness dogfood: data is workframe-api/data, Agents is sibling of workframe-api.
+    candidate = data_dir.parent.parent / "Agents"
+    return candidate if candidate.is_dir() else None
+
+
+def _cleanup_hermes_fs(agents_root: Path) -> None:
+    agents_json = agents_root / "workframe" / "agents.json"
+    if agents_json.is_file():
+        data = json.loads(agents_json.read_text(encoding="utf-8"))
+        agents = data.get("agents", {})
+        if isinstance(agents, dict):
+            data["agents"] = {k: v for k, v in agents.items() if not _is_smoke_profile(k)}
+            agents_json.write_text(json.dumps(data, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+
+    for rel in ("avatar-registry.json", "routes.json"):
+        path = agents_root / "workframe" / rel
+        if not path.is_file():
+            continue
+        payload = json.loads(path.read_text(encoding="utf-8"))
+        if rel == "avatar-registry.json":
+            assigns = payload.get("assignments", {})
+            if isinstance(assigns, dict):
+                for key in [k for k in assigns if _is_smoke_profile(k)]:
+                    del assigns[key]
+        else:
+            routes = payload.get("routes", [])
+            if isinstance(routes, list):
+                payload["routes"] = [
+                    r for r in routes if not _is_smoke_profile(str(r.get("profile", "")))
+                ]
+        path.write_text(json.dumps(payload, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+
+    profiles = agents_root / "profiles"
+    if profiles.is_dir():
+        for entry in profiles.iterdir():
+            if entry.is_dir() and _is_smoke_profile(entry.name):
+                shutil.rmtree(entry, ignore_errors=True)
+
+    bin_dir = agents_root / ".local" / "bin"
+    if bin_dir.is_dir():
+        for entry in bin_dir.iterdir():
+            if _is_smoke_profile(entry.name):
+                entry.unlink(missing_ok=True)
+
+
+def _prune_lane_registry(data_dir: Path) -> int:
+    path = data_dir / "lane-registry.json"
+    if not path.is_file():
+        return 0
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return 0
+    lanes = data.get("lanes")
+    if not isinstance(lanes, dict):
+        return 0
+    removed = 0
+    for key in [k for k in lanes if _is_smoke_profile(k)]:
+        del lanes[key]
+        removed += 1
+    if removed:
+        path.write_text(json.dumps(data, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+    return removed
+
+
+def main() -> None:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--base", default="http://127.0.0.1:18644")
+    ap.add_argument("--data-dir", required=True, help="workframe-api/data under your install")
+    ap.add_argument("--dry-run", action="store_true")
+    args = ap.parse_args()
+
+    data_dir = Path(args.data_dir)
+    db_path = data_dir / "workframe.db"
+    conn = sqlite3.connect(db_path, timeout=30)
+    room_ids = _smoke_room_ids(conn)
+    agent_slugs = _smoke_agent_slugs(conn)
+    invite_ids = _smoke_invite_ids(conn)
+    print(f"found {len(room_ids)} smoke rooms, {len(agent_slugs)} smoke agents, {len(invite_ids)} test invites")
+
+    if args.dry_run:
+        print("dry-run — no changes")
+        conn.close()
+        return
+
+    user_id, email = _pick_user(data_dir)
+    cookie, session_id = _mint_session_cookie(data_dir, user_id)
+    print(f"session as {email} ({user_id[:8]}…)")
+
+    def api(method: str, path: str, body: dict | None = None) -> tuple[int, dict[str, Any]]:
+        return _req(args.base, method, path, body=body, cookie=cookie, session_id=session_id, timeout=180)
+
+    api_room_ok = 0
+    for rid in room_ids:
+        code, payload = api("DELETE", f"/api/rooms/{rid}")
+        if code == 200:
+            api_room_ok += 1
+        else:
+            print(f"[warn] api delete room {rid[:8]}… — {payload.get('error')}")
+
+    if api_room_ok < len(room_ids):
+        n = _soft_delete_rooms_db(conn)
+        print(f"db soft-deleted {n} smoke rooms (api ok={api_room_ok})")
+
+    for slug in agent_slugs:
+        code, payload = api("POST", "/api/hermes/profiles/delete", body={"profile": slug})
+        if code != 200 or not payload.get("ok"):
+            print(f"[warn] api delete profile {slug} — {payload.get('error') or payload}")
+
+    n_agents = _soft_delete_agents_db(conn, agent_slugs)
+    print(f"soft-deleted {n_agents} agent_profiles rows")
+
+    n_inv = _revoke_invites_db(conn, invite_ids)
+    print(f"revoked {n_inv} test invites")
+
+    agents_root = _agents_root(data_dir)
+    if agents_root:
+        _cleanup_hermes_fs(agents_root)
+        print(f"cleaned Hermes data under {agents_root}")
+    else:
+        print("[warn] Agents mount not found — skipped Hermes filesystem cleanup")
+
+    pruned = _prune_lane_registry(data_dir)
+    if pruned:
+        print(f"pruned {pruned} lane-registry entries")
+
+    remaining_rooms = len(_smoke_room_ids(conn))
+    remaining_agents = len(_smoke_agent_slugs(conn))
+    remaining_invites = len(_smoke_invite_ids(conn))
+    conn.close()
+    print(
+        f"done — remaining smoke rooms={remaining_rooms}, agents={remaining_agents}, invites={remaining_invites}"
+    )
+    if remaining_rooms or remaining_agents:
+        raise SystemExit(1)
+
+
+if __name__ == "__main__":
+    main()

package/workframe-api/credential_broker.py

@@ -0,0 +1,162 @@
+"""Provider-neutral credential broker — shared lease validation for internal proxies."""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass
+from typing import Any, Callable
+
+import broker_audit
+import internal_proxy_auth
+import turn_credentials
+
+LEASE_PREFIX = turn_credentials.LEASE_PREFIX
+
+
+def extract_bearer(headers: dict[str, str]) -> str:
+    auth = str(headers.get("Authorization") or headers.get("authorization") or "").strip()
+    if auth.lower().startswith("bearer "):
+        return auth[7:].strip()
+    api_key = str(headers.get("X-Api-Key") or headers.get("x-api-key") or "").strip()
+    if api_key:
+        return api_key
+    return ""
+
+
+def extract_profile_slug(headers: dict[str, str]) -> str:
+    return str(
+        headers.get(internal_proxy_auth.PROFILE_HEADER)
+        or headers.get("x-workframe-profile")
+        or ""
+    ).strip()
+
+
+def validate_lease_profile(
+    lease: dict[str, Any],
+    headers: dict[str, str],
+) -> tuple[bool, str, int]:
+    """Bind bearer lease to calling Hermes profile (0022 N2 / 0023 C1)."""
+    want = str(lease.get("profile_slug") or "").strip()
+    if not want:
+        return True, "", 0
+    got = extract_profile_slug(headers)
+    if not got:
+        return False, "profile header required", 403
+    if got != want:
+        return False, "profile mismatch", 403
+    return True, "", 0
+
+
+@dataclass(frozen=True)
+class BrokerLeaseAuth:
+    ok: bool
+    lease: dict[str, Any] | None = None
+    secret: str = ""
+    env_var: str = ""
+    status: int = 200
+    error: str = ""
+    deny_reason: str = ""
+
+
+def authorize_broker_lease(
+    provider: str,
+    headers: dict[str, str],
+    *,
+    resolve_secret: Callable[[str, str, str, str], tuple[str, str]],
+    broker_kind: str = "",
+    upstream_host: str = "",
+) -> BrokerLeaseAuth:
+    """Validate lease token, provider/profile binding, and vault secret for a broker hop."""
+    provider = str(provider or "").strip().lower()
+    host = str(upstream_host or "").strip().lower()
+    kind = str(broker_kind or "").strip().lower()
+
+    def _audit(auth: BrokerLeaseAuth, status: int) -> BrokerLeaseAuth:
+        if kind:
+            broker_audit.record_broker_event(
+                broker_kind=kind,
+                provider=provider,
+                upstream_host=host,
+                status=status,
+                deny_reason=auth.deny_reason,
+                lease=auth.lease,
+            )
+        return auth
+
+    token = extract_bearer(headers)
+    deny_reason, lease = turn_credentials.inspect_lease(token)
+    if deny_reason:
+        return _audit(
+            BrokerLeaseAuth(
+                ok=False,
+                status=401,
+                error="invalid lease",
+                deny_reason=deny_reason,
+                lease=lease,
+            ),
+            401,
+        )
+    if not lease:
+        return _audit(
+            BrokerLeaseAuth(
+                ok=False,
+                status=401,
+                error="invalid lease",
+                deny_reason="invalid_lease",
+            ),
+            401,
+        )
+    if str(lease.get("provider") or "").lower() != provider:
+        return _audit(
+            BrokerLeaseAuth(
+                ok=False,
+                status=403,
+                error="provider mismatch",
+                deny_reason="provider_mismatch",
+                lease=lease,
+            ),
+            403,
+        )
+
+    ok_profile, profile_err, profile_status = validate_lease_profile(lease, headers)
+    if not ok_profile:
+        reason = "profile_header_required" if profile_status == 403 and "required" in profile_err else "profile_mismatch"
+        return _audit(
+            BrokerLeaseAuth(
+                ok=False,
+                status=profile_status,
+                error=profile_err,
+                deny_reason=reason,
+                lease=lease,
+            ),
+            profile_status,
+        )
+
+    env_var, secret = turn_credentials.resolve_lease_secret(lease, resolve_secret)
+    if not secret:
+        return _audit(
+            BrokerLeaseAuth(
+                ok=False,
+                status=402,
+                error="no credential",
+                deny_reason="no_credential",
+                lease=lease,
+            ),
+            402,
+        )
+    return _audit(BrokerLeaseAuth(ok=True, lease=lease, secret=secret, env_var=env_var), 200)
+
+
+def broker_error_body(auth: BrokerLeaseAuth) -> bytes:
+    return json.dumps({"error": auth.error}).encode()
+
+
+if __name__ == "__main__":
+    assert extract_bearer({"Authorization": "Bearer wf_rt_abc"}) == "wf_rt_abc"
+    assert extract_bearer({"X-Api-Key": "wf_rt_xyz"}) == "wf_rt_xyz"
+    lease = {"profile_slug": "u-a-dev", "provider": "openrouter"}
+    ok, err, code = validate_lease_profile(lease, {internal_proxy_auth.PROFILE_HEADER: "u-a-dev"})
+    assert ok and not err and code == 0
+    ok, err, code = validate_lease_profile(lease, {})
+    assert not ok and code == 403
+    print("credential_broker ok")

package/workframe-api/credential_resolve.py

@@ -0,0 +1,202 @@
+"""WF-032 extract: credential binding resolution and secret materialization."""
+
+from __future__ import annotations
+
+import re
+import sqlite3
+import time
+from typing import Any
+
+import credential_vault
+import provider_catalog
+
+
+def _srv():
+    import server as srv
+
+    return srv
+
+
+def _default_credential_env_var(provider: str, credential_type: str) -> str:
+    prefix = re.sub(r"[^A-Za-z0-9]+", "_", str(provider or "WORKFRAME").strip()).upper() or "WORKFRAME"
+    suffix = {
+        "bot_token": "BOT_TOKEN",
+        "oauth": "OAUTH_TOKEN",
+    }.get(str(credential_type or "api_key"), "API_KEY")
+    return f"{prefix}_{suffix}"
+def _provider_env_var(provider: str) -> str:
+    spec = provider_catalog.catalog_provider(provider)
+    if spec and str(spec.get("env_var") or "").strip():
+        return str(spec["env_var"]).strip()
+    return _default_credential_env_var(provider, "api_key")
+
+
+def _credential_secret(resolved: dict[str, Any], user_id: str = "") -> str:
+    ref = str(resolved.get("credential_ref") or "")
+    binding_id = credential_vault.parse_vault_ref(ref)
+    if binding_id:
+        return credential_vault.read_secret(binding_id)
+    env_var = str(resolved.get("env_var") or "")
+    if not env_var and ref.startswith("env:"):
+        env_var = ref[4:]
+    if not env_var:
+        return ""
+    scope = str(resolved.get("scope") or "")
+    secret = ""
+    if scope == "user":
+        user = str(user_id or resolved.get("user_id") or "").strip()
+        if user:
+            secret = _srv()._read_env_map(_srv()._user_hermes_env_path(user)).get(env_var, "")
+            if secret:
+                bid = str(resolved.get("credential_binding_id") or resolved.get("credential_id") or "").strip()
+                if bid:
+                    credential_vault.store_secret(
+                        bid,
+                        secret,
+                        env_var=env_var,
+                        provider=str(resolved.get("provider") or ""),
+                        scope="user",
+                        user_id=user,
+                    )
+                    _srv()._remove_env_secret(_srv()._user_hermes_env_path(user), env_var)
+    elif scope == "workspace":
+        secret = _srv()._stack_profile_env().get(env_var, "")
+    elif scope == "stack":
+        secret = _srv()._stack_profile_env().get(env_var, "")
+    return secret
+
+
+def _resolve_secret_for_lease(
+    payer_user_id: str,
+    workspace_id: str,
+    provider: str,
+    binding_id: str,
+) -> tuple[str, str]:
+    provider = str(provider or "openrouter").strip().lower()
+    binding_id = str(binding_id or "").strip()
+    if binding_id:
+        secret = credential_vault.read_secret(binding_id)
+        if secret:
+            return _provider_env_var(provider), secret
+    resolved = _resolve_credential(payer_user_id, workspace_id, provider, user_only=True)
+    if not resolved:
+        resolved = _resolve_credential(payer_user_id, workspace_id, provider, user_only=False)
+    if not resolved:
+        return "", ""
+    env_var = str(resolved.get("env_var") or "") or _provider_env_var(provider)
+    return env_var, _credential_secret(resolved, payer_user_id)
+def _credential_binding_payload(row: sqlite3.Row, scope: str) -> dict[str, Any]:
+    """Return the safe metadata payload for a resolved credential binding."""
+    return {
+        "credential_binding_id": row["id"],
+        "credential_id": row["id"],
+        "credential_ref": row["credential_ref"],
+        "scope": scope,
+        "provider": row["provider"],
+        "credential_type": row["credential_type"],
+        "label": row["label"] or "",
+        "user_id": row["user_id"],
+        "workspace_id": row["workspace_id"],
+        "agent_profile_id": row["agent_profile_id"],
+        "created_by": row["created_by"],
+        "created_at": row["created_at"],
+        "updated_at": row["updated_at"],
+        "expires_at": row["expires_at"],
+    }
+
+
+def _resolve_credential(
+    user_id: str,
+    workspace_id: str,
+    provider: str,
+    *,
+    user_only: bool = False,
+) -> dict[str, Any] | None:
+    """Resolve which credential binding to use for an agent run.
+
+    Resolution order:
+    1. User-owned credential for this user + provider (if active and not expired)
+    2. Workspace credential for this workspace + provider (if active and not expired)
+       — skipped when user_only=True (dev/github/vercel tenancy)
+    3. None (caller uses profile config fallback)
+    """
+    user = str(user_id or "").strip()
+    workspace = str(workspace_id or "").strip()
+    provider_name = str(provider or "").strip().lower()
+    if not provider_name or (not user and not workspace):
+        return None
+
+    now_iso = _srv()._utc_now()
+    now_ts = str(int(time.time()))
+    conn = None
+    try:
+        conn = _srv()._workframe_db()
+        conn.row_factory = sqlite3.Row
+        if user:
+            row = conn.execute(
+                """
+                SELECT id, workspace_id, user_id, agent_profile_id, provider,
+                       credential_type, credential_ref, label, is_active,
+                       expires_at, created_by, created_at, updated_at, deleted_at
+                FROM credential_bindings
+                WHERE user_id = ?
+                  AND LOWER(provider) = ?
+                  AND is_active = 1
+                  AND deleted_at IS NULL
+                  AND (expires_at IS NULL OR expires_at > ? OR CAST(expires_at AS INTEGER) > ?)
+                ORDER BY updated_at DESC, created_at DESC, id DESC
+                LIMIT 1
+                """,
+                (user, provider_name, now_iso, now_ts),
+            ).fetchone()
+            if row:
+                return _credential_binding_payload(row, "user")
+
+        if workspace and not user_only:
+            row = conn.execute(
+                """
+                SELECT id, workspace_id, user_id, agent_profile_id, provider,
+                       credential_type, credential_ref, label, is_active,
+                       expires_at, created_by, created_at, updated_at, deleted_at
+                FROM credential_bindings
+                WHERE workspace_id = ?
+                  AND LOWER(provider) = ?
+                  AND is_active = 1
+                  AND deleted_at IS NULL
+                  AND (expires_at IS NULL OR expires_at > ? OR CAST(expires_at AS INTEGER) > ?)
+                ORDER BY updated_at DESC, created_at DESC, id DESC
+                LIMIT 1
+                """,
+                (workspace, provider_name, now_iso, now_ts),
+            ).fetchone()
+            if row:
+                return _credential_binding_payload(row, "workspace")
+    except sqlite3.Error:
+        pass
+    finally:
+        if conn is not None:
+            conn.close()
+
+    if user:
+        spec = provider_catalog.catalog_provider(provider_name)
+        if spec and str(spec.get("category") or "") == "llm":
+            env_var = str(spec.get("env_var") or "").strip()
+            if env_var and _srv()._read_env_map(_srv()._user_hermes_env_path(user)).get(env_var):
+                return {
+                    "credential_binding_id": None,
+                    "credential_id": None,
+                    "credential_ref": f"env:{env_var}",
+                    "scope": "user",
+                    "provider": provider_name,
+                    "credential_type": str(spec.get("connect_mode") or "api_key"),
+                    "label": env_var,
+                    "env_var": env_var,
+                    "user_id": user,
+                    "workspace_id": None,
+                    "agent_profile_id": None,
+                    "created_by": user,
+                    "created_at": None,
+                    "updated_at": None,
+                    "expires_at": None,
+                }
+    return None