dr-claw 1.1.2

package/server/routes/references.js

@@ -0,0 +1,338 @@
+import express from 'express';
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import multer from 'multer';
+import { referencesDb } from '../database/db.js';
+import { getZoteroClient } from '../utils/zotero-client.js';
+import { parseBibtex } from '../utils/parsers/bibtex-parser.js';
+
+const router = express.Router();
+
+// Multer for BibTeX file upload (in-memory, max 5 MB)
+const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: 5 * 1024 * 1024 } });
+
+// PDF cache directory
+const PDF_CACHE_DIR = path.join(os.homedir(), '.dr-claw', 'references', 'pdfs');
+
+function ensurePdfCacheDir() {
+  if (!fs.existsSync(PDF_CACHE_DIR)) {
+    fs.mkdirSync(PDF_CACHE_DIR, { recursive: true });
+  }
+}
+
+// ---------------------------------------------------------------------------
+// IMPORTANT: All literal/multi-segment routes MUST come before /:id
+// to avoid Express matching "tags", "project", "zotero" etc. as an :id param.
+// ---------------------------------------------------------------------------
+
+/** GET /api/references — list user references (paginated, searchable) */
+router.get('/', async (req, res) => {
+  try {
+    const { search, tags, limit, offset } = req.query;
+    const parsedTags = tags ? tags.split(',').map((t) => t.trim()).filter(Boolean) : undefined;
+    const refs = referencesDb.getUserReferences(req.user.id, {
+      search: search || undefined,
+      tags: parsedTags,
+      limit: parseInt(limit) || 50,
+      offset: parseInt(offset) || 0,
+    });
+    res.json({ references: refs });
+  } catch (error) {
+    console.error('Error fetching references:', error);
+    res.status(500).json({ error: 'Failed to fetch references' });
+  }
+});
+
+/** GET /api/references/tags — all user tags */
+router.get('/tags', async (req, res) => {
+  try {
+    const tags = referencesDb.getTags(req.user.id);
+    res.json({ tags });
+  } catch (error) {
+    console.error('Error fetching tags:', error);
+    res.status(500).json({ error: 'Failed to fetch tags' });
+  }
+});
+
+/** GET /api/references/zotero/status — check Zotero connectivity */
+router.get('/zotero/status', async (req, res) => {
+  try {
+    const { mode, localRunning, localApiDisabled } = await getZoteroClient();
+    res.json({
+      connected: mode !== null,
+      mode,
+      localAvailable: mode === 'local',
+      localRunning,
+      localApiDisabled,
+    });
+  } catch (error) {
+    console.error('Error checking Zotero status:', error);
+    res.json({ connected: false, mode: null, localAvailable: false, localRunning: false, localApiDisabled: false });
+  }
+});
+
+/** GET /api/references/zotero/collections — list Zotero collections */
+router.get('/zotero/collections', async (req, res) => {
+  try {
+    const { client, mode } = await getZoteroClient();
+    if (!client) {
+      return res.status(503).json({ error: 'Zotero not available' });
+    }
+    const libraries = await client.getLibraries();
+    const collections = await client.getCollections(libraries[0]?.id);
+    res.json({ collections, mode });
+  } catch (error) {
+    console.error('Error fetching Zotero collections:', error);
+    res.status(500).json({ error: 'Failed to fetch Zotero collections' });
+  }
+});
+
+/** GET /api/references/zotero/items — browse Zotero items without importing */
+router.get('/zotero/items', async (req, res) => {
+  try {
+    const { client } = await getZoteroClient();
+    if (!client) {
+      return res.status(503).json({ error: 'Zotero not available' });
+    }
+    const { collectionKey, limit, start } = req.query;
+    if (collectionKey && !/^[A-Za-z0-9]+$/.test(collectionKey)) {
+      return res.status(400).json({ error: 'Invalid collectionKey format' });
+    }
+    const libraries = await client.getLibraries();
+    const libraryId = libraries[0]?.id;
+    const items = await client.getItems(libraryId, {
+      collectionKey: collectionKey || undefined,
+      limit: parseInt(limit) || 100,
+      start: parseInt(start) || 0,
+    });
+    // Strip rawData before sending to client
+    const mapped = items.map(({ rawData, ...rest }) => rest);
+    res.json({ items: mapped });
+  } catch (error) {
+    console.error('Error browsing Zotero items:', error);
+    res.status(500).json({ error: 'Failed to browse Zotero items' });
+  }
+});
+
+/** POST /api/references/sync/zotero — sync from Zotero */
+router.post('/sync/zotero', async (req, res) => {
+  try {
+    const { client, mode, localApiDisabled } = await getZoteroClient();
+    if (!client) {
+      const error = localApiDisabled
+        ? 'Zotero is running but the local API is disabled. Enable it in Zotero → Settings → Advanced → Allow other applications to communicate with Zotero.'
+        : 'Zotero desktop is not running. Start the Zotero app and try again.';
+      return res.status(503).json({ error });
+    }
+
+    const { collectionKey, projectName, sourceIds } = req.body || {};
+    if (collectionKey && !/^[A-Za-z0-9]+$/.test(collectionKey)) {
+      return res.status(400).json({ error: 'Invalid collectionKey format' });
+    }
+    const libraries = await client.getLibraries();
+    const libraryId = libraries[0]?.id;
+
+    // Fetch all items (paginated)
+    let allItems = [];
+    let start = 0;
+    const pageSize = 100;
+    while (true) {
+      const batch = await client.getItems(libraryId, { collectionKey, limit: pageSize, start });
+      allItems.push(...batch);
+      if (batch.length < pageSize) break;
+      start += pageSize;
+    }
+
+    // Filter by sourceIds if provided (selective import)
+    if (sourceIds?.length > 0) {
+      const allowed = new Set(sourceIds);
+      allItems = allItems.filter(item => allowed.has(item.sourceId));
+    }
+
+    const ids = referencesDb.syncFromZotero(req.user.id, allItems);
+    let linked = 0;
+    if (projectName && ids.length > 0) {
+      linked = referencesDb.bulkLinkIds(projectName, ids);
+    }
+    res.json({ success: true, synced: ids.length, linked, mode, total: allItems.length });
+  } catch (error) {
+    console.error('Error syncing Zotero:', error);
+    const msg = error.message || 'Unknown error';
+    if (msg.includes('ECONNREFUSED')) {
+      return res.status(503).json({ error: 'Cannot connect to Zotero desktop. Is it running?' });
+    }
+    if (error.name === 'AbortError' || msg.includes('timeout')) {
+      return res.status(504).json({ error: 'Zotero connection timed out.' });
+    }
+    if (msg.includes('Zotero API')) {
+      return res.status(502).json({ error: msg });
+    }
+    res.status(500).json({ error: `Sync failed: ${msg}` });
+  }
+});
+
+/** POST /api/references/import/bibtex — import BibTeX file */
+router.post('/import/bibtex', upload.single('file'), async (req, res) => {
+  try {
+    if (!req.file) {
+      return res.status(400).json({ error: 'No file provided' });
+    }
+    const content = req.file.buffer.toString('utf-8');
+    const entries = parseBibtex(content);
+    if (entries.length === 0) {
+      return res.status(400).json({ error: 'No valid BibTeX entries found' });
+    }
+    const ids = referencesDb.importReferences(req.user.id, entries, 'bibtex');
+    const projectName = req.body?.projectName;
+    let linked = 0;
+    if (projectName && ids.length > 0) {
+      linked = referencesDb.bulkLinkIds(projectName, ids);
+    }
+    res.json({ success: true, imported: ids.length, linked, total: entries.length });
+  } catch (error) {
+    console.error('Error importing BibTeX:', error);
+    const msg = error.message || 'Unknown error';
+    res.status(500).json({ error: `Import failed: ${msg}` });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Project ↔ Reference linking (multi-segment — must come before /:id)
+// ---------------------------------------------------------------------------
+
+/** GET /api/references/project/:projectName — references linked to a project */
+router.get('/project/:projectName', async (req, res) => {
+  try {
+    const refs = referencesDb.getProjectReferences(req.params.projectName, req.user.id);
+    res.json({ references: refs });
+  } catch (error) {
+    console.error('Error fetching project references:', error);
+    res.status(500).json({ error: 'Failed to fetch project references' });
+  }
+});
+
+/** POST /api/references/project/:projectName/:id — link reference to project */
+router.post('/project/:projectName/:id', async (req, res) => {
+  try {
+    const linked = referencesDb.linkToProject(req.params.projectName, req.params.id, req.user.id);
+    if (!linked) {
+      return res.status(404).json({ error: 'Reference not found' });
+    }
+    res.json({ success: true });
+  } catch (error) {
+    console.error('Error linking reference:', error);
+    res.status(500).json({ error: 'Failed to link reference to project' });
+  }
+});
+
+/** DELETE /api/references/project/:projectName/:id — unlink reference from project */
+router.delete('/project/:projectName/:id', async (req, res) => {
+  try {
+    const removed = referencesDb.unlinkFromProject(req.params.projectName, req.params.id, req.user.id);
+    if (!removed) {
+      return res.status(404).json({ error: 'Link not found' });
+    }
+    res.json({ success: true });
+  } catch (error) {
+    console.error('Error unlinking reference:', error);
+    res.status(500).json({ error: 'Failed to unlink reference from project' });
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Single-item routes (parameterized — must come LAST)
+// ---------------------------------------------------------------------------
+
+/** POST /api/references/bulk-delete — delete multiple references */
+router.post('/bulk-delete', async (req, res) => {
+  try {
+    const { ids } = req.body || {};
+    if (!Array.isArray(ids) || ids.length === 0) {
+      return res.status(400).json({ error: 'ids array is required' });
+    }
+    if (ids.length > 500) {
+      return res.status(400).json({ error: 'Cannot delete more than 500 references at once' });
+    }
+    const deleted = referencesDb.bulkDeleteReferences(req.user.id, ids);
+    res.json({ success: true, deleted });
+  } catch (error) {
+    console.error('Error bulk-deleting references:', error);
+    res.status(500).json({ error: 'Failed to delete references' });
+  }
+});
+
+/** GET /api/references/:id/pdf — serve cached or fetch PDF */
+router.get('/:id/pdf', async (req, res) => {
+  try {
+    ensurePdfCacheDir();
+    const ref = referencesDb.getReference(req.params.id, req.user.id);
+    if (!ref) {
+      return res.status(404).json({ error: 'Reference not found' });
+    }
+
+    // Sanitize ID for filesystem path and verify no traversal
+    const safeId = ref.id.replace(/[^a-zA-Z0-9_\-]/g, '_');
+    const pdfPath = path.join(PDF_CACHE_DIR, `${safeId}.pdf`);
+    const resolvedPath = path.resolve(pdfPath);
+    if (!resolvedPath.startsWith(path.resolve(PDF_CACHE_DIR))) {
+      return res.status(400).json({ error: 'Invalid reference ID' });
+    }
+
+    // Serve from cache if available
+    if (fs.existsSync(pdfPath)) {
+      res.setHeader('Content-Type', 'application/pdf');
+      return fs.createReadStream(pdfPath).pipe(res);
+    }
+
+    // Try to fetch from Zotero
+    if (ref.source === 'zotero' && ref.source_id) {
+      const { client } = await getZoteroClient();
+      if (client) {
+        const libraries = await client.getLibraries();
+        const pdfBuffer = await client.getItemPdf(libraries[0]?.id, ref.source_id);
+        if (pdfBuffer) {
+          fs.writeFileSync(pdfPath, pdfBuffer);
+          referencesDb.setPdfCached(ref.id, true);
+          res.setHeader('Content-Type', 'application/pdf');
+          return res.send(pdfBuffer);
+        }
+      }
+    }
+
+    res.status(404).json({ error: 'PDF not available' });
+  } catch (error) {
+    console.error('Error fetching PDF:', error);
+    res.status(500).json({ error: 'Failed to fetch PDF' });
+  }
+});
+
+/** GET /api/references/:id — single reference detail */
+router.get('/:id', async (req, res) => {
+  try {
+    const ref = referencesDb.getReference(req.params.id, req.user.id);
+    if (!ref) {
+      return res.status(404).json({ error: 'Reference not found' });
+    }
+    res.json({ reference: ref });
+  } catch (error) {
+    console.error('Error fetching reference:', error);
+    res.status(500).json({ error: 'Failed to fetch reference' });
+  }
+});
+
+/** DELETE /api/references/:id — delete a reference */
+router.delete('/:id', async (req, res) => {
+  try {
+    const deleted = referencesDb.deleteReference(req.user.id, req.params.id);
+    if (!deleted) {
+      return res.status(404).json({ error: 'Reference not found' });
+    }
+    res.json({ success: true });
+  } catch (error) {
+    console.error('Error deleting reference:', error);
+    res.status(500).json({ error: 'Failed to delete reference' });
+  }
+});
+
+export default router;

package/server/routes/settings.js

@@ -0,0 +1,285 @@
+import express from 'express';
+import { apiKeysDb, appSettingsDb, credentialsDb } from '../database/db.js';
+
+const router = express.Router();
+const AUTO_RESEARCH_SENDER_EMAIL_KEY = 'auto_research_sender_email';
+const AUTO_RESEARCH_RESEND_API_KEY = 'auto_research_resend_api_key';
+
+// ===============================
+// API Keys Management
+// ===============================
+
+// Get all API keys for the authenticated user
+router.get('/api-keys', async (req, res) => {
+  try {
+    const apiKeys = apiKeysDb.getApiKeys(req.user.id);
+    // Don't send the full API key in the list for security
+    const sanitizedKeys = apiKeys.map(key => ({
+      ...key,
+      api_key: key.api_key.substring(0, 10) + '...'
+    }));
+    res.json({ apiKeys: sanitizedKeys });
+  } catch (error) {
+    console.error('Error fetching API keys:', error);
+    res.status(500).json({ error: 'Failed to fetch API keys' });
+  }
+});
+
+// Create a new API key
+router.post('/api-keys', async (req, res) => {
+  try {
+    const { keyName } = req.body;
+
+    if (!keyName || !keyName.trim()) {
+      return res.status(400).json({ error: 'Key name is required' });
+    }
+
+    const result = apiKeysDb.createApiKey(req.user.id, keyName.trim());
+    res.json({
+      success: true,
+      apiKey: result
+    });
+  } catch (error) {
+    console.error('Error creating API key:', error);
+    res.status(500).json({ error: 'Failed to create API key' });
+  }
+});
+
+// Delete an API key
+router.delete('/api-keys/:keyId', async (req, res) => {
+  try {
+    const { keyId } = req.params;
+    const success = apiKeysDb.deleteApiKey(req.user.id, parseInt(keyId));
+
+    if (success) {
+      res.json({ success: true });
+    } else {
+      res.status(404).json({ error: 'API key not found' });
+    }
+  } catch (error) {
+    console.error('Error deleting API key:', error);
+    res.status(500).json({ error: 'Failed to delete API key' });
+  }
+});
+
+// Toggle API key active status
+router.patch('/api-keys/:keyId/toggle', async (req, res) => {
+  try {
+    const { keyId } = req.params;
+    const { isActive } = req.body;
+
+    if (typeof isActive !== 'boolean') {
+      return res.status(400).json({ error: 'isActive must be a boolean' });
+    }
+
+    const success = apiKeysDb.toggleApiKey(req.user.id, parseInt(keyId), isActive);
+
+    if (success) {
+      res.json({ success: true });
+    } else {
+      res.status(404).json({ error: 'API key not found' });
+    }
+  } catch (error) {
+    console.error('Error toggling API key:', error);
+    res.status(500).json({ error: 'Failed to toggle API key' });
+  }
+});
+
+// ===============================
+// Generic Credentials Management
+// ===============================
+
+// Get all credentials for the authenticated user (optionally filtered by type)
+router.get('/credentials', async (req, res) => {
+  try {
+    const { type } = req.query;
+    const credentials = credentialsDb.getCredentials(req.user.id, type || null);
+    // Don't send the actual credential values for security
+    res.json({ credentials });
+  } catch (error) {
+    console.error('Error fetching credentials:', error);
+    res.status(500).json({ error: 'Failed to fetch credentials' });
+  }
+});
+
+// Create a new credential
+router.post('/credentials', async (req, res) => {
+  try {
+    const { credentialName, credentialType, credentialValue, description } = req.body;
+
+    if (!credentialName || !credentialName.trim()) {
+      return res.status(400).json({ error: 'Credential name is required' });
+    }
+
+    if (!credentialType || !credentialType.trim()) {
+      return res.status(400).json({ error: 'Credential type is required' });
+    }
+
+    if (!credentialValue || !credentialValue.trim()) {
+      return res.status(400).json({ error: 'Credential value is required' });
+    }
+
+    const result = credentialsDb.createCredential(
+      req.user.id,
+      credentialName.trim(),
+      credentialType.trim(),
+      credentialValue.trim(),
+      description?.trim() || null
+    );
+
+    res.json({
+      success: true,
+      credential: result
+    });
+  } catch (error) {
+    console.error('Error creating credential:', error);
+    res.status(500).json({ error: 'Failed to create credential' });
+  }
+});
+
+// Delete a credential
+router.delete('/credentials/:credentialId', async (req, res) => {
+  try {
+    const { credentialId } = req.params;
+    const success = credentialsDb.deleteCredential(req.user.id, parseInt(credentialId));
+
+    if (success) {
+      res.json({ success: true });
+    } else {
+      res.status(404).json({ error: 'Credential not found' });
+    }
+  } catch (error) {
+    console.error('Error deleting credential:', error);
+    res.status(500).json({ error: 'Failed to delete credential' });
+  }
+});
+
+// Toggle credential active status
+router.patch('/credentials/:credentialId/toggle', async (req, res) => {
+  try {
+    const { credentialId } = req.params;
+    const { isActive } = req.body;
+
+    if (typeof isActive !== 'boolean') {
+      return res.status(400).json({ error: 'isActive must be a boolean' });
+    }
+
+    const success = credentialsDb.toggleCredential(req.user.id, parseInt(credentialId), isActive);
+
+    if (success) {
+      res.json({ success: true });
+    } else {
+      res.status(404).json({ error: 'Credential not found' });
+    }
+  } catch (error) {
+    console.error('Error toggling credential:', error);
+    res.status(500).json({ error: 'Failed to toggle credential' });
+  }
+});
+
+router.get('/auto-research-email', async (req, res) => {
+  try {
+    res.json({
+      senderEmail: appSettingsDb.get(AUTO_RESEARCH_SENDER_EMAIL_KEY),
+    });
+  } catch (error) {
+    console.error('Error fetching Auto Research sender email:', error);
+    res.status(500).json({ error: 'Failed to fetch Auto Research sender email' });
+  }
+});
+
+router.put('/auto-research-email', async (req, res) => {
+  try {
+    const rawEmail = typeof req.body?.senderEmail === 'string' ? req.body.senderEmail.trim().toLowerCase() : '';
+    if (!rawEmail) {
+      return res.status(400).json({ error: 'Sender email is required' });
+    }
+
+    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    if (!emailRegex.test(rawEmail)) {
+      return res.status(400).json({ error: 'Invalid email format' });
+    }
+
+    appSettingsDb.set(AUTO_RESEARCH_SENDER_EMAIL_KEY, rawEmail);
+    res.json({ success: true, senderEmail: rawEmail });
+  } catch (error) {
+    console.error('Error saving Auto Research sender email:', error);
+    res.status(500).json({ error: 'Failed to save Auto Research sender email' });
+  }
+});
+
+router.get('/auto-research-resend-key', async (req, res) => {
+  try {
+    const apiKey = appSettingsDb.get(AUTO_RESEARCH_RESEND_API_KEY);
+    res.json({
+      configured: Boolean(apiKey),
+      maskedKey: apiKey ? `${apiKey.slice(0, 6)}...${apiKey.slice(-4)}` : null,
+    });
+  } catch (error) {
+    console.error('Error fetching Auto Research Resend key:', error);
+    res.status(500).json({ error: 'Failed to fetch Auto Research Resend key' });
+  }
+});
+
+router.put('/auto-research-resend-key', async (req, res) => {
+  try {
+    const rawKey = typeof req.body?.apiKey === 'string' ? req.body.apiKey.trim() : '';
+    if (!rawKey) {
+      return res.status(400).json({ error: 'Resend API key is required' });
+    }
+
+    appSettingsDb.set(AUTO_RESEARCH_RESEND_API_KEY, rawKey);
+    res.json({
+      success: true,
+      configured: true,
+      maskedKey: `${rawKey.slice(0, 6)}...${rawKey.slice(-4)}`,
+    });
+  } catch (error) {
+    console.error('Error saving Auto Research Resend key:', error);
+    res.status(500).json({ error: 'Failed to save Auto Research Resend key' });
+  }
+});
+
+// ===============================
+// OpenRouter Models (cached proxy)
+// ===============================
+
+let openrouterModelsCache = { data: null, fetchedAt: 0 };
+const OPENROUTER_CACHE_TTL = 1000 * 60 * 30; // 30 minutes
+
+router.get('/openrouter-models', async (_req, res) => {
+  try {
+    const now = Date.now();
+    if (openrouterModelsCache.data && now - openrouterModelsCache.fetchedAt < OPENROUTER_CACHE_TTL) {
+      return res.json(openrouterModelsCache.data);
+    }
+
+    const response = await fetch(
+      'https://openrouter.ai/api/v1/models?output_modalities=text&supported_parameters=tools',
+      { headers: { 'HTTP-Referer': 'https://github.com/OpenLAIR/dr-claw', 'X-Title': 'Dr. Claw' } }
+    );
+    if (!response.ok) throw new Error(`OpenRouter API returned ${response.status}`);
+
+    const json = await response.json();
+    const models = (json.data || [])
+      .filter((m) => m.id && m.name)
+      .map((m) => ({
+        value: m.id,
+        label: m.name,
+        contextLength: m.context_length || null,
+        pricing: m.pricing || null,
+      }))
+      .sort((a, b) => a.label.localeCompare(b.label));
+
+    openrouterModelsCache = { data: { models }, fetchedAt: now };
+    res.json({ models });
+  } catch (error) {
+    console.error('Error fetching OpenRouter models:', error);
+    if (openrouterModelsCache.data) {
+      return res.json(openrouterModelsCache.data);
+    }
+    res.status(502).json({ error: 'Failed to fetch OpenRouter models' });
+  }
+});
+
+export default router;