failproofai 0.0.10 → 0.0.11-beta.10

package/.next/standalone/app/api/audit/invite/route.ts

@@ -0,0 +1,183 @@
+/**
+ * POST /api/audit/invite
+ *
+ * Browser-facing proxy for the api-server's POST /v0/invite — the user
+ * supplies a list of friend emails, the api-server composes invite emails
+ * (Cc'ing the sender so the recipient sees who invited them), and dispatches
+ * them through the same email infrastructure that backs the OTP flow.
+ *
+ * Auth: requires an active session — same cookie/refresh-token contract as
+ * /api/auth/reminder. Anonymous calls get 401 so the front-end can route to
+ * the AuthDialog before retrying.
+ *
+ * Validation: max 10 recipients per call, each must look like an email.
+ * Anything beyond that gets a 400 and never reaches upstream.
+ *
+ * Contract for the upstream endpoint is handed over to the platform team
+ * separately.
+ */
+import { NextRequest, NextResponse } from "next/server";
+import { whoAmI } from "@/lib/auth/auth-store";
+import { AuthApiError, sendInvites } from "@/lib/auth/api-server-client";
+import { initTelemetry, trackEvent } from "@/lib/telemetry";
+
+export const dynamic = "force-dynamic";
+
+const MAX_RECIPIENTS = 10;
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+interface InviteBody {
+  to?: unknown;
+}
+
+export async function POST(req: NextRequest): Promise<NextResponse> {
+  await initTelemetry();
+  const who = await whoAmI();
+  if (!who) {
+    trackEvent("audit_invite_sent", { status: "unauthorized", source: "dashboard" });
+    return NextResponse.json(
+      { code: "unauthorized", message: "Sign in before sending invites." },
+      { status: 401 },
+    );
+  }
+
+  let body: InviteBody = {};
+  const raw = await req.text();
+  if (raw.trim().length > 0) {
+    try {
+      const parsed = JSON.parse(raw);
+      if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        trackEvent("audit_invite_sent", {
+          status: "validation_error",
+          source: "dashboard",
+          reason: "not_an_object",
+          user_id: who.me.id,
+        });
+        return NextResponse.json(
+          { code: "validation_error", message: "Request body must be a JSON object." },
+          { status: 400 },
+        );
+      }
+      body = parsed as InviteBody;
+    } catch {
+      trackEvent("audit_invite_sent", {
+        status: "validation_error",
+        source: "dashboard",
+        reason: "malformed_json",
+        user_id: who.me.id,
+      });
+      return NextResponse.json(
+        { code: "validation_error", message: "Request body is not valid JSON." },
+        { status: 400 },
+      );
+    }
+  }
+
+  if (!Array.isArray(body.to)) {
+    trackEvent("audit_invite_sent", {
+      status: "validation_error",
+      source: "dashboard",
+      reason: "missing_to",
+      user_id: who.me.id,
+    });
+    return NextResponse.json(
+      { code: "validation_error", message: "`to` must be a list of email addresses." },
+      { status: 400 },
+    );
+  }
+
+  const normalised: string[] = [];
+  const seen = new Set<string>();
+  for (const entry of body.to) {
+    if (typeof entry !== "string") continue;
+    const e = entry.trim().toLowerCase();
+    if (!e || !EMAIL_RE.test(e)) continue;
+    if (e === who.me.email.toLowerCase()) continue; // can't invite yourself
+    if (seen.has(e)) continue;
+    seen.add(e);
+    normalised.push(e);
+  }
+
+  if (normalised.length === 0) {
+    trackEvent("audit_invite_sent", {
+      status: "validation_error",
+      source: "dashboard",
+      reason: "no_valid_recipients",
+      user_id: who.me.id,
+      input_count: Array.isArray(body.to) ? body.to.length : 0,
+    });
+    return NextResponse.json(
+      {
+        code: "validation_error",
+        message: "Provide at least one valid email address (other than your own).",
+      },
+      { status: 400 },
+    );
+  }
+
+  if (normalised.length > MAX_RECIPIENTS) {
+    trackEvent("audit_invite_sent", {
+      status: "validation_error",
+      source: "dashboard",
+      reason: "too_many_recipients",
+      user_id: who.me.id,
+      input_count: normalised.length,
+    });
+    return NextResponse.json(
+      {
+        code: "validation_error",
+        message: `Up to ${MAX_RECIPIENTS} recipients per invite batch. Please send the rest in a follow-up.`,
+      },
+      { status: 400 },
+    );
+  }
+
+  try {
+    const result = await sendInvites(who.auth.access_token, normalised);
+    trackEvent("audit_invite_sent", {
+      status: "success",
+      source: "dashboard",
+      user_id: who.me.id,
+      sent_count: result.sent.length,
+      failed_count: result.failed.length,
+    });
+    return NextResponse.json(result, { status: 200 });
+  } catch (err) {
+    if (err instanceof AuthApiError) {
+      trackEvent("audit_invite_sent", {
+        status: "failed",
+        source: "dashboard",
+        user_id: who.me.id,
+        error_code: err.code,
+        http_status: err.status,
+        recipient_count: normalised.length,
+      });
+      const httpStatus = err.status >= 200 && err.status < 600 ? err.status : 504;
+      return NextResponse.json(
+        {
+          code: err.code,
+          message: err.message,
+          ...(err.retryAfterSecs !== undefined ? { retry_after_secs: err.retryAfterSecs } : {}),
+        },
+        { status: httpStatus },
+      );
+    }
+    // Don't surface the raw upstream message to either telemetry or the
+    // client. Network/DNS errors can carry internal hostnames, IPs, or
+    // fragment payload bytes that have no business leaving the proxy.
+    // Log the error name only (bounded) and return a stable generic.
+    const errorName = err instanceof Error ? err.name : "unknown";
+    trackEvent("audit_invite_sent", {
+      status: "failed",
+      source: "dashboard",
+      user_id: who.me.id,
+      error_code: "upstream_unreachable",
+      error_name: errorName.slice(0, 50),
+      recipient_count: normalised.length,
+    });
+    return NextResponse.json(
+      { code: "upstream_unreachable", message: "Invite service is unreachable. Please try again in a moment." },
+      { status: 502 },
+    );
+  }
+}

package/.next/standalone/app/api/audit/run/route.ts

@@ -0,0 +1,103 @@
+/**
+ * POST /api/audit/run — start a `runAudit()` call in the background and return
+ * `202 { status: "started" }` immediately. The run is fire-and-forget: it
+ * executes as a detached task in this long-lived server process (NOT awaited by
+ * the handler), writes the dashboard cache on success, and records its outcome
+ * in `_state.ts`. The client (rerun-button.tsx) polls /api/audit/status until
+ * the run finishes — there is deliberately no per-request or per-run time cap,
+ * so a cold all-history scan runs to completion however long it takes.
+ *
+ * Concurrency: a module-level singleton in `_state.ts` guards against
+ * overlapping runs — the second concurrent POST gets a 409. The client then
+ * just falls back to polling /status for the in-flight run.
+ */
+import { NextRequest, NextResponse } from "next/server";
+import { runAudit } from "@/src/audit";
+import { writeDashboardCache } from "@/src/audit/dashboard-cache";
+import { INTEGRATION_TYPES, type IntegrationType } from "@/src/hooks/types";
+import type { RunAuditOptions } from "@/src/audit/types";
+import { finishRun, tryAcquireRun } from "../_state";
+
+export const dynamic = "force-dynamic";
+
+interface RunBody {
+  since?: string;
+  cli?: string[];
+  project?: string[];
+  policy?: string[];
+  noCache?: boolean;
+}
+
+const VALID_CLIS = new Set<string>(INTEGRATION_TYPES);
+
+function sanitize(body: RunBody): RunAuditOptions {
+  const opts: RunAuditOptions = {};
+  if (typeof body.since === "string" && body.since.trim()) {
+    opts.since = body.since.trim();
+  }
+  if (Array.isArray(body.cli) && body.cli.length > 0) {
+    const valid = body.cli.filter((c): c is IntegrationType =>
+      typeof c === "string" && VALID_CLIS.has(c)
+    );
+    if (valid.length > 0) opts.clis = valid;
+  }
+  if (Array.isArray(body.project) && body.project.length > 0) {
+    opts.projects = body.project.filter((p) => typeof p === "string");
+  }
+  if (Array.isArray(body.policy) && body.policy.length > 0) {
+    opts.policies = body.policy.filter((p) => typeof p === "string");
+  }
+  if (body.noCache === true) opts.noCache = true;
+  return opts;
+}
+
+export async function POST(request: NextRequest): Promise<NextResponse> {
+  let body: RunBody = {};
+  try {
+    const raw = await request.text();
+    if (raw.trim().length > 0) {
+      const parsed: unknown = JSON.parse(raw);
+      // JSON.parse("null") returns null and JSON.parse("[]") returns an
+      // array — both pass the catch but break sanitize()'s field access.
+      if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return NextResponse.json(
+          { error: "Request body must be a JSON object" },
+          { status: 400 },
+        );
+      }
+      body = parsed as RunBody;
+    }
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  const opts = sanitize(body);
+
+  if (!tryAcquireRun()) {
+    return NextResponse.json(
+      { error: "Audit already running", status: "already-running" },
+      { status: 409 },
+    );
+  }
+
+  // Fire-and-forget: a cold, all-history scan can run far longer than any HTTP
+  // request should stay open — and longer than Node's `server.requestTimeout`
+  // on the standalone production server. Start runAudit() as a detached task in
+  // this long-lived server process and return immediately; the client polls
+  // /api/audit/status until `running` flips false. The task settles the lock
+  // via finishRun() in its own try/catch, surfacing any error through /status.
+  void (async () => {
+    try {
+      const result = await runAudit(opts);
+      // The cache is the only channel by which a detached run's result reaches
+      // the client (the POST already returned 202), so a failed persist is a
+      // failed run from the user's view — surface it instead of reporting OK.
+      const persisted = writeDashboardCache(opts, result);
+      finishRun(persisted ? null : "audit finished but its result could not be saved");
+    } catch (err) {
+      finishRun(err instanceof Error ? err.message : String(err));
+    }
+  })();
+
+  return NextResponse.json({ status: "started" }, { status: 202 });
+}

package/.next/standalone/app/api/audit/status/route.ts

@@ -0,0 +1,24 @@
+/**
+ * GET /api/audit/status — lightweight poll endpoint. Client polls this at
+ * 1s while a run is in flight; switches off polling once `running: false`.
+ *
+ * Also returns the cache's `cachedAt` so the client can detect that a new
+ * result has landed (older `cachedAt` value in client → refetch via the
+ * server action).
+ */
+import { NextResponse } from "next/server";
+import { readDashboardCache } from "@/src/audit/dashboard-cache";
+import { getRunState } from "../_state";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(): Promise<NextResponse> {
+  const state = getRunState();
+  const cache = readDashboardCache();
+  return NextResponse.json({
+    running: state.running,
+    startedAt: state.startedAt ?? null,
+    cachedAt: cache?.cachedAt ?? null,
+    error: state.error,
+  });
+}

package/.next/standalone/app/api/auth/login-request/route.ts

@@ -0,0 +1,91 @@
+/**
+ * POST /api/auth/login-request
+ *
+ * Browser-facing proxy for the api-server's /v0/auth/login/request. Keeps the
+ * api-server URL server-side so the browser only ever talks to the local
+ * dashboard.
+ */
+import { NextRequest, NextResponse } from "next/server";
+import { AuthApiError, requestLoginCode } from "@/lib/auth/api-server-client";
+import { initTelemetry, trackEvent } from "@/lib/telemetry";
+
+export const dynamic = "force-dynamic";
+
+interface RequestBody {
+  email?: unknown;
+}
+
+export async function POST(req: NextRequest): Promise<NextResponse> {
+  await initTelemetry();
+  let body: RequestBody = {};
+  try {
+    body = (await req.json()) as RequestBody;
+  } catch {
+    trackEvent("audit_otp_requested", { status: "validation_error", reason: "invalid_json" });
+    return NextResponse.json({ code: "validation_error", message: "Invalid JSON body" }, { status: 400 });
+  }
+  if (typeof body.email !== "string" || !body.email.trim()) {
+    trackEvent("audit_otp_requested", { status: "validation_error", reason: "missing_email" });
+    return NextResponse.json(
+      { code: "validation_error", message: "email is required" },
+      { status: 400 },
+    );
+  }
+  // Telemetry sends the raw (normalised) email so PostHog can identify the
+  // sender. Core login logic still uses the original `body.email`.
+  const email = body.email.trim().toLowerCase();
+  try {
+    const r = await requestLoginCode(body.email);
+    trackEvent("audit_otp_requested", {
+      status: "success",
+      email,
+      source: "dashboard",
+      expires_in: r.expires_in,
+      resend_available_in: r.resend_available_in,
+    });
+    return NextResponse.json(
+      {
+        status: r.status,
+        expires_in: r.expires_in,
+        resend_available_in: r.resend_available_in,
+      },
+      { status: 200 },
+    );
+  } catch (err) {
+    if (err instanceof AuthApiError) {
+      trackEvent("audit_otp_requested", {
+        status: "failed",
+        email,
+        source: "dashboard",
+        error_code: err.code,
+        http_status: err.status,
+        retry_after_secs: err.retryAfterSecs ?? null,
+      });
+      // AuthApiError uses `status: 0` for client-side timeouts; NextResponse
+      // (the Response constructor) rejects any status < 200 with a
+      // RangeError. Surface the timeout as 504 so the browser sees a real
+      // status code, not a 500 stack trace.
+      const httpStatus = err.status >= 200 && err.status < 600 ? err.status : 504;
+      return NextResponse.json(
+        {
+          code: err.code,
+          message: err.message,
+          ...(err.retryAfterSecs !== undefined ? { retry_after_secs: err.retryAfterSecs } : {}),
+        },
+        { status: httpStatus },
+      );
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    trackEvent("audit_otp_requested", {
+      status: "failed",
+      email,
+      source: "dashboard",
+      error_code: "upstream_unreachable",
+      error_message: message.slice(0, 200),
+    });
+    return NextResponse.json(
+      { code: "upstream_unreachable", message: `api-server unreachable: ${message}` },
+      { status: 502 },
+    );
+  }
+}

package/.next/standalone/app/api/auth/login-verify/route.ts

@@ -0,0 +1,98 @@
+/**
+ * POST /api/auth/login-verify
+ *
+ * Browser-facing proxy: verifies the OTP with the api-server, persists the
+ * resulting tokens to ~/.failproofai/auth.json on the local dashboard host,
+ * and returns *only* the user identity to the browser. The refresh token
+ * never leaves the local filesystem.
+ */
+import { NextRequest, NextResponse } from "next/server";
+import { AuthApiError, verifyLoginCode } from "@/lib/auth/api-server-client";
+import { authFromTokenResponse, writeAuth } from "@/lib/auth/auth-store";
+import { initTelemetry, trackEvent } from "@/lib/telemetry";
+import { getInstanceId } from "@/lib/telemetry-id";
+
+export const dynamic = "force-dynamic";
+
+interface VerifyBody {
+  email?: unknown;
+  code?: unknown;
+}
+
+export async function POST(req: NextRequest): Promise<NextResponse> {
+  let body: VerifyBody = {};
+  try {
+    body = (await req.json()) as VerifyBody;
+  } catch {
+    return NextResponse.json({ code: "validation_error", message: "Invalid JSON body" }, { status: 400 });
+  }
+  if (typeof body.email !== "string" || !body.email.trim()) {
+    return NextResponse.json(
+      { code: "validation_error", message: "email is required" },
+      { status: 400 },
+    );
+  }
+  if (typeof body.code !== "string" || !body.code.trim()) {
+    return NextResponse.json(
+      { code: "validation_error", message: "code is required" },
+      { status: 400 },
+    );
+  }
+  // `initTelemetry` never throws — its internal try/catch is total.
+  await initTelemetry();
+  try {
+    const tokens = await verifyLoginCode(body.email, body.code);
+    writeAuth(authFromTokenResponse(tokens));
+    // Identity stitch: this event's distinct_id IS the device random id
+    // (getInstanceId()), so attaching the verified email + user_id — and
+    // persisting them as person properties via `$set` — maps the verified
+    // account onto the anonymous device person in PostHog.
+    trackEvent("audit_user_identity_linked", {
+      source: "audit_set_reminder_auth_dialog",
+      user_id: tokens.user.id,
+      email: tokens.user.email,
+      local_random_id: getInstanceId(),
+      $set: { email: tokens.user.email, user_id: tokens.user.id },
+    });
+    trackEvent("audit_otp_verified", {
+      status: "success",
+      source: "dashboard",
+      user_id: tokens.user.id,
+      email: tokens.user.email,
+    });
+    return NextResponse.json(
+      {
+        authenticated: true,
+        user: { id: tokens.user.id, email: tokens.user.email },
+      },
+      { status: 200 },
+    );
+  } catch (err) {
+    if (err instanceof AuthApiError) {
+      trackEvent("audit_otp_verified", {
+        status: "failed",
+        source: "dashboard",
+        error_code: err.code,
+        http_status: err.status,
+      });
+      // AuthApiError uses `status: 0` for client-side timeouts; map those to
+      // 504 so NextResponse.json doesn't reject with a RangeError.
+      const httpStatus = err.status >= 200 && err.status < 600 ? err.status : 504;
+      return NextResponse.json(
+        { code: err.code, message: err.message },
+        { status: httpStatus },
+      );
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    trackEvent("audit_otp_verified", {
+      status: "failed",
+      source: "dashboard",
+      error_code: "upstream_unreachable",
+      error_message: message.slice(0, 200),
+    });
+    return NextResponse.json(
+      { code: "upstream_unreachable", message: `api-server unreachable: ${message}` },
+      { status: 502 },
+    );
+  }
+}

package/.next/standalone/app/api/auth/logout/route.ts

@@ -0,0 +1,48 @@
+/**
+ * POST /api/auth/logout
+ *
+ * Reads the locally-stored session, asks the api-server to revoke it, and
+ * deletes ~/.failproofai/auth.json regardless of upstream success — local
+ * intent to log out takes precedence.
+ */
+import { NextResponse } from "next/server";
+import { AuthApiError, logoutSession } from "@/lib/auth/api-server-client";
+import { deleteAuth, readAuth } from "@/lib/auth/auth-store";
+import { initTelemetry, trackEvent } from "@/lib/telemetry";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(): Promise<NextResponse> {
+  await initTelemetry();
+  const existing = readAuth();
+  if (!existing) {
+    trackEvent("audit_user_logged_out", {
+      source: "dashboard",
+      had_session: false,
+      upstream: "noop",
+    });
+    return NextResponse.json({ authenticated: false }, { status: 200 });
+  }
+  let upstream: "revoked" | "skipped" | "failed" = "skipped";
+  let upstreamError: string | null = null;
+  try {
+    await logoutSession(existing.access_token, existing.refresh_token);
+    upstream = "revoked";
+  } catch (err) {
+    if (err instanceof AuthApiError && err.status === 401) {
+      upstream = "revoked"; // token already invalid server-side
+    } else {
+      upstream = "failed";
+      upstreamError = err instanceof Error ? err.message.slice(0, 200) : String(err).slice(0, 200);
+    }
+  }
+  deleteAuth();
+  trackEvent("audit_user_logged_out", {
+    source: "dashboard",
+    had_session: true,
+    upstream,
+    upstream_error: upstreamError,
+    user_id: existing.user.id,
+  });
+  return NextResponse.json({ authenticated: false, upstream }, { status: 200 });
+}