enya-agent 0.1.0

package/crates/enact-gateway/src/lib.rs

@@ -0,0 +1,582 @@
+use anyhow::Context;
+use async_trait::async_trait;
+use axum::body::Bytes;
+use axum::extract::{ConnectInfo, Query, State};
+use axum::http::{HeaderMap, StatusCode};
+use axum::response::{IntoResponse, Response};
+use axum::routing::{get, post};
+use axum::{Json, Router};
+use enact_channels::{Channel, ChannelMessage, SendMessage, WhatsAppChannel, verify_whatsapp_signature};
+use enact_core::callable::Callable;
+use enact_runner::{DefaultAgentRunner, LoopOutcome};
+use serde::Deserialize;
+use serde::Serialize;
+use sha2::{Digest, Sha256};
+use std::collections::HashMap;
+use std::net::{IpAddr, SocketAddr};
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+use tower_http::limit::RequestBodyLimitLayer;
+use tower_http::timeout::TimeoutLayer;
+
+pub const MAX_BODY_SIZE: usize = 65_536;
+pub const REQUEST_TIMEOUT_SECS: u64 = 30;
+
+#[derive(Debug, Clone)]
+pub struct GatewayConfig {
+    pub host: String,
+    pub port: u16,
+    pub webhook_rate_limit_per_minute: u32,
+    pub max_rate_limit_keys: usize,
+    pub idempotency_ttl_secs: u64,
+    pub idempotency_max_keys: usize,
+    pub trust_forwarded_headers: bool,
+}
+
+impl Default for GatewayConfig {
+    fn default() -> Self {
+        Self {
+            host: "0.0.0.0".to_string(),
+            port: 8080,
+            webhook_rate_limit_per_minute: 120,
+            max_rate_limit_keys: 10_000,
+            idempotency_ttl_secs: 300,
+            idempotency_max_keys: 10_000,
+            trust_forwarded_headers: false,
+        }
+    }
+}
+
+#[derive(Clone)]
+pub struct GatewayState {
+    pub whatsapp: Arc<WhatsAppChannel>,
+    pub app_secret: Option<Arc<str>>,
+    pub responder: Arc<dyn InboundResponder>,
+    pub rate_limiter: Arc<GatewayRateLimiter>,
+    pub idempotency_store: Arc<IdempotencyStore>,
+    pub trust_forwarded_headers: bool,
+}
+
+impl GatewayState {
+    pub fn new(
+        whatsapp: Arc<WhatsAppChannel>,
+        app_secret: Option<String>,
+        responder: Arc<dyn InboundResponder>,
+        config: &GatewayConfig,
+    ) -> Self {
+        Self {
+            whatsapp,
+            app_secret: app_secret.map(Arc::<str>::from),
+            responder,
+            rate_limiter: Arc::new(GatewayRateLimiter::new(
+                config.webhook_rate_limit_per_minute,
+                Duration::from_secs(60),
+                config.max_rate_limit_keys,
+            )),
+            idempotency_store: Arc::new(IdempotencyStore::new(
+                Duration::from_secs(config.idempotency_ttl_secs),
+                config.idempotency_max_keys,
+            )),
+            trust_forwarded_headers: config.trust_forwarded_headers,
+        }
+    }
+}
+
+#[async_trait]
+pub trait InboundResponder: Send + Sync {
+    async fn handle(&self, message: &ChannelMessage) -> anyhow::Result<Option<String>>;
+}
+
+pub struct EchoResponder;
+
+#[async_trait]
+impl InboundResponder for EchoResponder {
+    async fn handle(&self, message: &ChannelMessage) -> anyhow::Result<Option<String>> {
+        Ok(Some(format!("echo: {}", message.content)))
+    }
+}
+
+/// Inbound responder that routes each message through `enact-runner`.
+pub struct RunnerResponder {
+    runner: tokio::sync::Mutex<DefaultAgentRunner>,
+    callable: Arc<dyn Callable>,
+}
+
+impl RunnerResponder {
+    pub fn new(callable: Arc<dyn Callable>) -> Self {
+        Self {
+            runner: tokio::sync::Mutex::new(DefaultAgentRunner::default_new()),
+            callable,
+        }
+    }
+
+    pub fn with_runner(callable: Arc<dyn Callable>, runner: DefaultAgentRunner) -> Self {
+        Self {
+            runner: tokio::sync::Mutex::new(runner),
+            callable,
+        }
+    }
+}
+
+#[async_trait]
+impl InboundResponder for RunnerResponder {
+    async fn handle(&self, message: &ChannelMessage) -> anyhow::Result<Option<String>> {
+        let mut runner = self.runner.lock().await;
+        let outcome = runner.run(self.callable.as_ref(), &message.content).await?;
+        match outcome {
+            LoopOutcome::Completed(text) => Ok(Some(text)),
+            LoopOutcome::MaxIterationsReached { last_output, .. } => Ok(Some(last_output)),
+            LoopOutcome::Cancelled => Ok(Some("Execution cancelled".to_string())),
+            LoopOutcome::TimedOut { elapsed_secs } => {
+                Ok(Some(format!("Execution timed out after {}s", elapsed_secs)))
+            }
+        }
+    }
+}
+
+pub fn router(state: GatewayState) -> Router {
+    Router::new()
+        .route("/health", get(health_handler))
+        .route("/webhook/whatsapp", get(whatsapp_verify_handler))
+        .route("/webhook/whatsapp", post(whatsapp_webhook_handler))
+        .with_state(state)
+        .layer(TimeoutLayer::new(Duration::from_secs(REQUEST_TIMEOUT_SECS)))
+        .layer(RequestBodyLimitLayer::new(MAX_BODY_SIZE))
+}
+
+pub async fn serve(config: GatewayConfig, state: GatewayState) -> anyhow::Result<()> {
+    let addr: SocketAddr = format!("{}:{}", config.host, config.port)
+        .parse()
+        .with_context(|| "failed to parse gateway bind address")?;
+    let listener = tokio::net::TcpListener::bind(addr)
+        .await
+        .with_context(|| format!("failed to bind gateway listener on {addr}"))?;
+    tracing::info!("gateway listening on http://{addr}");
+    axum::serve(listener, router(state)).await?;
+    Ok(())
+}
+
+#[derive(Debug, Serialize)]
+struct HealthResponse {
+    status: &'static str,
+}
+
+async fn health_handler() -> impl IntoResponse {
+    Json(HealthResponse { status: "ok" })
+}
+
+#[derive(Debug, Deserialize)]
+struct VerifyQuery {
+    #[serde(rename = "hub.mode")]
+    mode: Option<String>,
+    #[serde(rename = "hub.verify_token")]
+    verify_token: Option<String>,
+    #[serde(rename = "hub.challenge")]
+    challenge: Option<String>,
+}
+
+async fn whatsapp_verify_handler(
+    State(state): State<GatewayState>,
+    Query(query): Query<VerifyQuery>,
+) -> Response {
+    let token_matches = query
+        .verify_token
+        .as_deref()
+        .is_some_and(|token| token == state.whatsapp.verify_token());
+
+    if query.mode.as_deref() == Some("subscribe") && token_matches {
+        if let Some(challenge) = query.challenge {
+            return (StatusCode::OK, challenge).into_response();
+        }
+        return (
+            StatusCode::BAD_REQUEST,
+            Json(serde_json::json!({"error": "missing hub.challenge"})),
+        )
+            .into_response();
+    }
+
+    (
+        StatusCode::FORBIDDEN,
+        Json(serde_json::json!({"error": "forbidden"})),
+    )
+        .into_response()
+}
+
+async fn whatsapp_webhook_handler(
+    State(state): State<GatewayState>,
+    connect_info: Option<ConnectInfo<SocketAddr>>,
+    headers: HeaderMap,
+    body: Bytes,
+) -> Response {
+    let peer_addr = connect_info.map(|ConnectInfo(addr)| addr);
+    let client_key = client_key_from_request(
+        peer_addr,
+        &headers,
+        state.trust_forwarded_headers,
+    );
+
+    if !state.rate_limiter.allow(&client_key) {
+        return (
+            StatusCode::TOO_MANY_REQUESTS,
+            Json(serde_json::json!({"error": "rate limit exceeded"})),
+        )
+            .into_response();
+    }
+
+    let idempotency_key = extract_idempotency_key(&headers, &body);
+    if !state.idempotency_store.record_if_new(&idempotency_key) {
+        return (
+            StatusCode::OK,
+            Json(serde_json::json!({"status": "duplicate_ignored"})),
+        )
+            .into_response();
+    }
+
+    if let Some(secret) = state.app_secret.as_deref() {
+        let signature = headers
+            .get("X-Hub-Signature-256")
+            .and_then(|v| v.to_str().ok())
+            .unwrap_or_default();
+        if !verify_whatsapp_signature(secret, &body, signature) {
+            return (
+                StatusCode::UNAUTHORIZED,
+                Json(serde_json::json!({"error": "invalid signature"})),
+            )
+                .into_response();
+        }
+    }
+
+    let payload: serde_json::Value = match serde_json::from_slice(&body) {
+        Ok(value) => value,
+        Err(_) => {
+            return (
+                StatusCode::BAD_REQUEST,
+                Json(serde_json::json!({"error": "invalid JSON payload"})),
+            )
+                .into_response();
+        }
+    };
+
+    let messages = state.whatsapp.parse_webhook_payload(&payload);
+    let mut processed = 0usize;
+
+    for message in messages {
+        processed += 1;
+        match state.responder.handle(&message).await {
+            Ok(Some(reply_text)) => {
+                if let Err(err) = state
+                    .whatsapp
+                    .send(&SendMessage::new(reply_text, &message.reply_target))
+                    .await
+                {
+                    tracing::warn!("failed to send whatsapp reply: {err}");
+                }
+            }
+            Ok(None) => {}
+            Err(err) => {
+                tracing::warn!("inbound responder failed: {err}");
+            }
+        }
+    }
+
+    (
+        StatusCode::OK,
+        Json(serde_json::json!({"status": "ok", "processed": processed})),
+    )
+        .into_response()
+}
+
+fn extract_idempotency_key(headers: &HeaderMap, body: &[u8]) -> String {
+    if let Some(key) = headers
+        .get("X-Idempotency-Key")
+        .and_then(|v| v.to_str().ok())
+        .filter(|s| !s.trim().is_empty())
+    {
+        return key.to_string();
+    }
+    let mut hasher = Sha256::new();
+    hasher.update(body);
+    format!("body:{}", hex::encode(hasher.finalize()))
+}
+
+#[derive(Debug)]
+pub struct GatewayRateLimiter {
+    limit_per_window: u32,
+    window: Duration,
+    max_keys: usize,
+    requests: Mutex<HashMap<String, Vec<Instant>>>,
+}
+
+impl GatewayRateLimiter {
+    pub fn new(limit_per_window: u32, window: Duration, max_keys: usize) -> Self {
+        Self {
+            limit_per_window,
+            window,
+            max_keys: max_keys.max(1),
+            requests: Mutex::new(HashMap::new()),
+        }
+    }
+
+    pub fn allow(&self, key: &str) -> bool {
+        if self.limit_per_window == 0 {
+            return true;
+        }
+
+        let now = Instant::now();
+        let cutoff = now.checked_sub(self.window).unwrap_or_else(Instant::now);
+        let mut requests = self.requests.lock().expect("rate limiter mutex poisoned");
+
+        requests.retain(|_, timestamps| {
+            timestamps.retain(|ts| *ts > cutoff);
+            !timestamps.is_empty()
+        });
+
+        if !requests.contains_key(key) && requests.len() >= self.max_keys {
+            let evict_key = requests
+                .iter()
+                .min_by_key(|(_, timestamps)| timestamps.last().copied().unwrap_or(cutoff))
+                .map(|(k, _)| k.clone());
+            if let Some(evict_key) = evict_key {
+                requests.remove(&evict_key);
+            }
+        }
+
+        let entry = requests.entry(key.to_string()).or_default();
+        entry.retain(|ts| *ts > cutoff);
+        if entry.len() >= self.limit_per_window as usize {
+            return false;
+        }
+        entry.push(now);
+        true
+    }
+}
+
+#[derive(Debug)]
+pub struct IdempotencyStore {
+    ttl: Duration,
+    max_keys: usize,
+    keys: Mutex<HashMap<String, Instant>>,
+}
+
+impl IdempotencyStore {
+    pub fn new(ttl: Duration, max_keys: usize) -> Self {
+        Self {
+            ttl,
+            max_keys: max_keys.max(1),
+            keys: Mutex::new(HashMap::new()),
+        }
+    }
+
+    pub fn record_if_new(&self, key: &str) -> bool {
+        let now = Instant::now();
+        let mut keys = self.keys.lock().expect("idempotency mutex poisoned");
+        keys.retain(|_, ts| now.duration_since(*ts) < self.ttl);
+
+        if keys.contains_key(key) {
+            return false;
+        }
+
+        if keys.len() >= self.max_keys {
+            let evict = keys.iter().min_by_key(|(_, ts)| *ts).map(|(k, _)| k.clone());
+            if let Some(evict) = evict {
+                keys.remove(&evict);
+            }
+        }
+
+        keys.insert(key.to_string(), now);
+        true
+    }
+}
+
+fn parse_client_ip(value: &str) -> Option<IpAddr> {
+    let value = value.trim().trim_matches('"');
+    if value.is_empty() {
+        return None;
+    }
+    if let Ok(ip) = value.parse::<IpAddr>() {
+        return Some(ip);
+    }
+    if let Ok(addr) = value.parse::<SocketAddr>() {
+        return Some(addr.ip());
+    }
+    let value = value.trim_matches(['[', ']']);
+    value.parse::<IpAddr>().ok()
+}
+
+fn forwarded_client_ip(headers: &HeaderMap) -> Option<IpAddr> {
+    if let Some(xff) = headers.get("X-Forwarded-For").and_then(|v| v.to_str().ok()) {
+        for candidate in xff.split(',') {
+            if let Some(ip) = parse_client_ip(candidate) {
+                return Some(ip);
+            }
+        }
+    }
+    headers
+        .get("X-Real-IP")
+        .and_then(|v| v.to_str().ok())
+        .and_then(parse_client_ip)
+}
+
+fn client_key_from_request(
+    peer_addr: Option<SocketAddr>,
+    headers: &HeaderMap,
+    trust_forwarded_headers: bool,
+) -> String {
+    if trust_forwarded_headers {
+        if let Some(ip) = forwarded_client_ip(headers) {
+            return ip.to_string();
+        }
+    }
+    peer_addr
+        .map(|addr| addr.ip().to_string())
+        .unwrap_or_else(|| "unknown".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use async_trait::async_trait;
+    use axum::http::Request;
+    use enact_core::callable::Callable;
+    use hmac::{Hmac, Mac};
+    use sha2::Sha256;
+    use tower::util::ServiceExt;
+
+    struct NoopResponder;
+
+    struct StaticCallable;
+
+    #[async_trait]
+    impl Callable for StaticCallable {
+        fn name(&self) -> &str {
+            "static_callable"
+        }
+
+        async fn run(&self, _input: &str) -> anyhow::Result<String> {
+            Ok("runner ok".to_string())
+        }
+    }
+
+    #[async_trait]
+    impl InboundResponder for NoopResponder {
+        async fn handle(&self, _message: &ChannelMessage) -> anyhow::Result<Option<String>> {
+            Ok(None)
+        }
+    }
+
+    fn build_state(app_secret: Option<&str>) -> GatewayState {
+        let channel = Arc::new(WhatsAppChannel::new(
+            "token".to_string(),
+            "endpoint".to_string(),
+            "verify-token".to_string(),
+            vec!["*".to_string()],
+        ));
+        let cfg = GatewayConfig::default();
+        GatewayState::new(
+            channel,
+            app_secret.map(|s| s.to_string()),
+            Arc::new(NoopResponder),
+            &cfg,
+        )
+    }
+
+    #[tokio::test]
+    async fn health_route_returns_ok() {
+        let app = router(build_state(None));
+        let req = Request::builder()
+            .uri("/health")
+            .body(axum::body::Body::empty())
+            .unwrap();
+        let res = app.oneshot(req).await.unwrap();
+        assert_eq!(res.status(), StatusCode::OK);
+    }
+
+    #[tokio::test]
+    async fn whatsapp_verify_route_returns_challenge() {
+        let app = router(build_state(None));
+        let req = Request::builder()
+            .uri("/webhook/whatsapp?hub.mode=subscribe&hub.verify_token=verify-token&hub.challenge=123")
+            .body(axum::body::Body::empty())
+            .unwrap();
+        let res = app.oneshot(req).await.unwrap();
+        assert_eq!(res.status(), StatusCode::OK);
+    }
+
+    #[tokio::test]
+    async fn whatsapp_webhook_rejects_invalid_signature() {
+        let app = router(build_state(Some("test_secret")));
+        let body = serde_json::json!({"entry": []}).to_string();
+        let req = Request::builder()
+            .method("POST")
+            .uri("/webhook/whatsapp")
+            .header("Content-Type", "application/json")
+            .header("X-Hub-Signature-256", "sha256=bad")
+            .body(axum::body::Body::from(body))
+            .unwrap();
+        let res = app.oneshot(req).await.unwrap();
+        assert_eq!(res.status(), StatusCode::UNAUTHORIZED);
+    }
+
+    #[tokio::test]
+    async fn webhook_duplicate_payload_is_ignored() {
+        let app = router(build_state(None));
+        let body = serde_json::json!({"entry": []}).to_string();
+
+        let req1 = Request::builder()
+            .method("POST")
+            .uri("/webhook/whatsapp")
+            .header("Content-Type", "application/json")
+            .header("X-Idempotency-Key", "abc")
+            .body(axum::body::Body::from(body.clone()))
+            .unwrap();
+        let res1 = app.clone().oneshot(req1).await.unwrap();
+        assert_eq!(res1.status(), StatusCode::OK);
+
+        let req2 = Request::builder()
+            .method("POST")
+            .uri("/webhook/whatsapp")
+            .header("Content-Type", "application/json")
+            .header("X-Idempotency-Key", "abc")
+            .body(axum::body::Body::from(body))
+            .unwrap();
+        let res2 = app.oneshot(req2).await.unwrap();
+        assert_eq!(res2.status(), StatusCode::OK);
+    }
+
+    #[tokio::test]
+    async fn webhook_accepts_valid_signature() {
+        let app = router(build_state(Some("test_secret")));
+        let body = serde_json::json!({"entry": []}).to_string();
+        let mut mac = Hmac::<Sha256>::new_from_slice(b"test_secret").unwrap();
+        mac.update(body.as_bytes());
+        let sig = format!("sha256={}", hex::encode(mac.finalize().into_bytes()));
+
+        let req = Request::builder()
+            .method("POST")
+            .uri("/webhook/whatsapp")
+            .header("Content-Type", "application/json")
+            .header("X-Hub-Signature-256", sig)
+            .body(axum::body::Body::from(body))
+            .unwrap();
+        let res = app.oneshot(req).await.unwrap();
+        assert_eq!(res.status(), StatusCode::OK);
+    }
+
+    #[tokio::test]
+    async fn runner_responder_returns_callable_output() {
+        let callable: Arc<dyn Callable> = Arc::new(StaticCallable);
+        let responder = RunnerResponder::new(callable);
+
+        let message = ChannelMessage {
+            id: "m1".to_string(),
+            sender: "+10000000000".to_string(),
+            reply_target: "+10000000000".to_string(),
+            content: "hello".to_string(),
+            channel: "whatsapp".to_string(),
+            timestamp: 0,
+        };
+
+        let out = responder.handle(&message).await.unwrap();
+        assert_eq!(out.as_deref(), Some("runner ok"));
+    }
+}

package/crates/enact-mcp/Cargo.toml

@@ -0,0 +1,24 @@
+[package]
+name = "enact-mcp"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+description = "MCP (Model Context Protocol) client for Enact"
+repository.workspace = true
+homepage.workspace = true
+keywords = ["mcp", "model-context-protocol", "tools", "capabilities"]
+categories.workspace = true
+
+[dependencies]
+enact-core.workspace = true
+anyhow.workspace = true
+async-trait.workspace = true
+tokio.workspace = true
+tokio-util.workspace = true
+tokio-stream.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+tracing.workspace = true
+
+[dev-dependencies]
+tempfile.workspace = true