handoff-app 2.0.0-2 → 2.0.0-4

package/src/app/pages/api/install.ts

@@ -0,0 +1,102 @@
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { getRegistryInstallationState, installRegistry } from '@handoff/registry/auth';
+import { allowApiMethods, prepareRegistryApi } from '../../lib/auth/api';
+import { canonicalRegistryUrl, registryAuthSecret } from '../../lib/auth/config';
+import { registryEmailIsConfigured } from '../../lib/auth/email';
+
+const check = (id: string, label: string, ok: boolean, message: string, optional = false) => ({
+  id,
+  label,
+  ok,
+  message,
+  optional,
+});
+
+export default async function installHandler(req: NextApiRequest, res: NextApiResponse) {
+  res.setHeader('Cache-Control', 'no-store, max-age=0');
+  res.setHeader('Pragma', 'no-cache');
+
+  const method = allowApiMethods(req, res, ['GET', 'POST']);
+  if (!method) return;
+  const context = await prepareRegistryApi(req, res, { installed: false, mutation: method === 'POST' });
+  if (!context) return;
+
+  let state: Awaited<ReturnType<typeof getRegistryInstallationState>> | null = null;
+  try {
+    state = await getRegistryInstallationState(context.db);
+  } catch {
+    // A failed state query means the registry database is not ready to serve the installer; the
+    // database check below reports it.
+  }
+
+  const installed = state?.status === 'installed';
+  if (method === 'GET') {
+    const secretReady = registryAuthSecret().length >= 32;
+    const canonicalReady = canonicalRegistryUrl() !== null;
+    const databaseReady = Boolean(state);
+    const emptyUsers = state?.status === 'ready';
+    const checks = [
+      check('runtime', 'Registry runtime', true, 'This deployment is running in registry mode.'),
+      check(
+        'database',
+        'Database connection',
+        databaseReady,
+        databaseReady ? 'The registry database is reachable.' : 'The registry database is not ready. Check the deployment and try again.'
+      ),
+      check(
+        'authSecret',
+        'Authentication secret',
+        secretReady,
+        secretReady ? 'AUTH_SECRET is configured.' : 'Set AUTH_SECRET to a random value of at least 32 characters.'
+      ),
+      check(
+        'appUrl',
+        'Canonical application URL',
+        canonicalReady,
+        canonicalReady ? 'AUTH_URL is a valid absolute HTTP(S) URL.' : 'Set AUTH_URL to the public registry URL, including its base path.'
+      ),
+      check(
+        'email',
+        'Email delivery',
+        registryEmailIsConfigured(),
+        registryEmailIsConfigured()
+          ? 'Resend delivery is configured.'
+          : 'Optional. Set RESEND_API_KEY and AUTH_FROM_EMAIL, or deliver invitation links manually.',
+        true
+      ),
+    ];
+    const ready = !installed && Boolean(emptyUsers && state) && secretReady && canonicalReady;
+    res.status(200).json({ installed, ready, checks, emailConfigured: registryEmailIsConfigured() });
+    return;
+  }
+
+  if (installed) {
+    res.status(409).json({ error: 'This registry has already been installed.', installed: true });
+    return;
+  }
+  if (!state || state.status !== 'ready' || registryAuthSecret().length < 32 || !canonicalRegistryUrl()) {
+    res.status(409).json({ error: 'The registry did not pass installation preflight. Correct the deployment configuration and retry.' });
+    return;
+  }
+
+  const body = req.body && typeof req.body === 'object' ? req.body : {};
+  const password = typeof body.password === 'string' ? body.password : '';
+  if (password !== body.passwordConfirmation) {
+    res.status(400).json({ error: 'Passwords do not match.' });
+    return;
+  }
+  const result = await installRegistry(context.db, {
+    email: typeof body.email === 'string' ? body.email : '',
+    name: typeof body.name === 'string' ? body.name : '',
+    password,
+  });
+  if ('reason' in result) {
+    if (result.reason === 'already_installed' || result.reason === 'users_exist') {
+      res.status(409).json({ error: 'This registry has already been claimed or contains users.', installed: true });
+      return;
+    }
+    res.status(400).json({ error: 'error' in result && result.error ? result.error : 'Enter a valid email, display name, and password.' });
+    return;
+  }
+  res.status(201).json({ ok: true, user: result.user });
+}

package/src/app/pages/api/oauth/device/approve.ts

@@ -0,0 +1,23 @@
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { approveRegistryDeviceAuthorization, denyRegistryDeviceAuthorization } from '@handoff/registry/auth';
+import { allowApiMethods, prepareRegistryApi } from '../../../../lib/auth/api';
+
+export default async function approveDeviceHandler(req: NextApiRequest, res: NextApiResponse) {
+  const method = allowApiMethods(req, res, ['POST']);
+  if (!method) return;
+  const context = await prepareRegistryApi(req, res, { auth: 'user', mutation: true });
+  if (!context?.user) return;
+  const body = req.body && typeof req.body === 'object' ? req.body : {};
+  const userCode = typeof body.user_code === 'string' ? body.user_code : typeof body.userCode === 'string' ? body.userCode : '';
+  if (body.action === 'deny') {
+    const denied = await denyRegistryDeviceAuthorization(context.db, userCode);
+    res.status(denied ? 200 : 400).json(denied ? { ok: true } : { error: 'This device code is invalid or expired.' });
+    return;
+  }
+  const result = await approveRegistryDeviceAuthorization(context.db, { userCode, userId: context.user.id });
+  if (!result.ok) {
+    res.status(400).json({ error: 'This device code is invalid or expired.' });
+    return;
+  }
+  res.status(200).json({ ok: true, scopes: result.scopes });
+}

package/src/app/pages/api/oauth/device/index.ts

@@ -0,0 +1,41 @@
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { consumeAuthRateLimit, createRegistryDeviceAuthorization } from '@handoff/registry/auth';
+import { allowApiMethods, prepareRegistryApi, registryPageUrl } from '../../../../lib/auth/api';
+
+const requestAddress = (req: NextApiRequest): string => {
+  const forwarded = req.headers['x-forwarded-for'];
+  return (Array.isArray(forwarded) ? forwarded[0] : forwarded)?.split(',')[0]?.trim() || req.socket.remoteAddress || 'unknown';
+};
+
+export default async function deviceAuthorizationHandler(req: NextApiRequest, res: NextApiResponse) {
+  const method = allowApiMethods(req, res, ['POST']);
+  if (!method) return;
+  const context = await prepareRegistryApi(req, res);
+  if (!context) return;
+  const throttle = await consumeAuthRateLimit(context.db, {
+    bucket: 'device',
+    identifier: requestAddress(req),
+    limit: 20,
+    windowMs: 15 * 60 * 1000,
+  });
+  if (!throttle.allowed) {
+    res.setHeader('Retry-After', String(throttle.retryAfterSeconds));
+    res.status(429).json({ error: 'slow_down', error_description: 'Too many device authorization requests.' });
+    return;
+  }
+  const authorization = await createRegistryDeviceAuthorization(context.db);
+  const verificationUri = registryPageUrl('/cli/device');
+  const verificationUriComplete = registryPageUrl('/cli/device', { user_code: authorization.userCode });
+  if (!verificationUri || !verificationUriComplete) {
+    res.status(500).json({ error: 'server_error', error_description: 'AUTH_URL is not configured.' });
+    return;
+  }
+  res.status(200).json({
+    device_code: authorization.deviceCode,
+    user_code: authorization.userCode,
+    verification_uri: verificationUri,
+    verification_uri_complete: verificationUriComplete,
+    expires_in: authorization.expiresIn,
+    interval: authorization.interval,
+  });
+}

package/src/app/pages/api/oauth/revoke.ts

@@ -0,0 +1,24 @@
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { authenticateRegistryAccessToken, revokeRegistryAccessToken } from '@handoff/registry/auth';
+import { allowApiMethods, prepareRegistryApi } from '../../../lib/auth/api';
+
+const bearerToken = (req: NextApiRequest): string => {
+  const header = req.headers.authorization;
+  if (typeof header !== 'string') return '';
+  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  return match?.[1]?.trim() || '';
+};
+
+export default async function revokeTokenHandler(req: NextApiRequest, res: NextApiResponse) {
+  const method = allowApiMethods(req, res, ['POST']);
+  if (!method) return;
+  const context = await prepareRegistryApi(req, res);
+  if (!context) return;
+  const principal = await authenticateRegistryAccessToken(context.db, bearerToken(req));
+  if (!principal) {
+    res.status(401).json({ error: 'A valid active access token is required.' });
+    return;
+  }
+  await revokeRegistryAccessToken(context.db, { tokenId: principal.tokenId, userId: principal.userId });
+  res.status(200).json({ ok: true });
+}

package/src/app/pages/api/oauth/token.ts

@@ -0,0 +1,31 @@
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { exchangeRegistryDeviceAuthorization } from '@handoff/registry/auth';
+import { allowApiMethods, prepareRegistryApi } from '../../../lib/auth/api';
+
+const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+
+export default async function deviceTokenHandler(req: NextApiRequest, res: NextApiResponse) {
+  const method = allowApiMethods(req, res, ['POST']);
+  if (!method) return;
+  const context = await prepareRegistryApi(req, res);
+  if (!context) return;
+  const body = req.body && typeof req.body === 'object' ? req.body : {};
+  if (body.grant_type !== DEVICE_GRANT || typeof body.device_code !== 'string') {
+    res.status(400).json({ error: 'unsupported_grant_type', error_description: 'Use the OAuth device authorization grant.' });
+    return;
+  }
+  const result = await exchangeRegistryDeviceAuthorization(context.db, {
+    deviceCode: body.device_code,
+    tokenName: typeof body.token_name === 'string' ? body.token_name : 'Handoff CLI',
+  });
+  if ('error' in result) {
+    res.status(400).json({ error: result.error, error_description: result.errorDescription });
+    return;
+  }
+  res.status(200).json({
+    access_token: result.accessToken,
+    token_type: result.tokenType,
+    expires_in: result.expiresIn,
+    scope: result.scopes.join(' '),
+  });
+}

package/src/app/pages/api/registry/health.ts

@@ -3,9 +3,10 @@ import { ensureRegistryMode, sendRegistryError } from '@/lib/registry-api';
 
 /**
  * `GET /api/registry/health` — registry liveness. Registry-runtime only
- * (`409 runtime_mode_conflict` in workspace mode); unauthenticated, like all registry GET reads. It
- * reports the runtime/source without touching the database so it can be used as a cheap probe, and
- * returns the documented bare `{ ok, runtime, source }` body rather than the data envelope.
+ * (`409 runtime_mode_conflict` in workspace mode). Unlike the data endpoints (which require a scoped
+ * token), health is unauthenticated: it reports the runtime/source without touching the database so
+ * it can be used as a cheap probe, and returns the documented bare `{ ok, runtime, source }` body
+ * rather than the data envelope.
  */
 export default function handler(req: NextApiRequest, res: NextApiResponse): void {
   if (!ensureRegistryMode(res)) {

package/src/app/pages/api/registry/transfer/[kind]/[id].ts

@@ -7,10 +7,10 @@ import { handleCheckoutRoute, handleTransferRoute } from '@/lib/registry-api/tra
  * `/api/registry/transfer/{component|pattern|page}/:id` — the transfer endpoint.
  *
  * - `GET` is checkout: returns the normalized record + registry-safe source files so a
- *   connected workspace can reconstruct the entity locally. Unauthenticated read.
+ *   connected workspace can reconstruct the entity locally. Requires a `registry:read` token.
  * - `PUT` is publish ingestion: the only path allowed to set an entity's
- *   render/build-defining fields, source files, rendered artifacts, and build metadata. Requires the
- *   bearer token.
+ *   render/build-defining fields, source files, rendered artifacts, and build metadata. Requires a
+ *   `registry:write` token.
  *
  * Both are registry-runtime only (enforced by the guard stack).
  */

package/src/app/pages/api/registry/transfer/assets/[collection].ts

@@ -5,8 +5,9 @@ import { handleAssetCollectionRoute } from '@/lib/registry-api/asset-transfer';
  * `/api/registry/transfer/assets/:collection`: the asset collection manifest endpoint.
  *
  * - `GET` is checkout: the collection's manifest metadata (bodies travel separately as blobs).
+ *   Requires a `registry:read` token.
  * - `PUT` is publish ingestion: validates the manifest, asserts referenced blobs exist, and
- *   atomically replaces the collection's manifest. Requires the bearer token.
+ *   atomically replaces the collection's manifest. Requires a `registry:write` token.
  *
  * Both are registry-runtime only (enforced by the guard stack).
  */

package/src/app/pages/api/registry/transfer/assets/blobs/[hash].ts

@@ -5,8 +5,9 @@ import { handleAssetBlobRoute } from '@/lib/registry-api/asset-transfer';
  * `/api/registry/transfer/assets/blobs/:hash`: one content-addressed blob.
  *
  * - `PUT` stores the raw binary body through the active storage provider (inline `bytea` by default,
- *   or an object-storage adapter). Idempotent by hash; requires the bearer token.
+ *   or an object-storage adapter). Idempotent by hash; requires a `registry:write` token.
  * - `GET` returns the blob's bytes, or redirects to a provider URL for object-backed content.
+ *   Requires a `registry:read` token.
  *
  * Registry-runtime only (guard stack).
  */

package/src/app/pages/api/registry/transfer/tokens/[...setId].ts

@@ -5,9 +5,9 @@ import { handleTokenCheckoutRoute, handleTokenTransferRoute } from '@/lib/regist
  * `/api/registry/transfer/tokens/:setId` — the token-set transfer endpoint. The catch-all param
  * carries the multi-segment logical set id (`foundation/colors`, `component/button`).
  *
- * - `GET` is checkout: the set record + its generated artifacts. Unauthenticated read.
+ * - `GET` is checkout: the set record + its generated artifacts. Requires a `registry:read` token.
  * - `PUT` is publish ingestion: validates the package and atomically upserts the set + its artifacts.
- *   Requires the bearer token.
+ *   Requires a `registry:write` token.
  *
  * Both are registry-runtime only (enforced by the guard stack).
  */

package/src/app/pages/cli/device.tsx

@@ -0,0 +1,143 @@
+import { AuthShell } from '../../components/Auth/AuthShell';
+import { authApiUrl, readApiError } from '../../components/Auth/api';
+import { Alert, AlertDescription, AlertTitle } from '../../components/ui/alert';
+import { Button } from '../../components/ui/button';
+import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from '../../components/ui/card';
+import { Input } from '../../components/ui/input';
+import { Label } from '../../components/ui/label';
+import { CheckCircle2, Laptop, ShieldCheck } from 'lucide-react';
+import Link from 'next/link';
+import { useSession } from 'next-auth/react';
+import { useRouter } from 'next/router';
+import { FormEvent, useEffect, useState } from 'react';
+
+const normalizeCode = (value: string) => value.replace(/\s/g, '').toUpperCase();
+
+export default function DeviceApprovalPage() {
+  if (process.env.HANDOFF_RUNTIME_MODE !== 'registry') {
+    return <AuthShell title="Authorize CLI">{null}</AuthShell>;
+  }
+
+  return <RegistryDeviceApprovalPage />;
+}
+
+function RegistryDeviceApprovalPage() {
+  const router = useRouter();
+  const { data: session, status } = useSession();
+  const [userCode, setUserCode] = useState('');
+  const [pending, setPending] = useState(false);
+  const [approved, setApproved] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (router.isReady && typeof router.query.user_code === 'string') setUserCode(normalizeCode(router.query.user_code));
+  }, [router.isReady, router.query.user_code]);
+
+  const approve = async (event: FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    setPending(true);
+    setError(null);
+    const code = normalizeCode(userCode);
+    try {
+      const response = await fetch(authApiUrl('/api/oauth/device/approve'), {
+        method: 'POST',
+        credentials: 'include',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ user_code: code, userCode: code, action: 'approve' }),
+      });
+      if (!response.ok) {
+        setError(await readApiError(response, 'This device code is invalid or has expired.'));
+        return;
+      }
+      setApproved(true);
+    } catch {
+      setError('Could not connect to the registry.');
+    } finally {
+      setPending(false);
+    }
+  };
+
+  const callbackUrl = `/cli/device${router.asPath.includes('?') ? router.asPath.slice(router.asPath.indexOf('?')) : ''}`;
+
+  return (
+    <AuthShell title="Authorize CLI">
+      <Card>
+        <CardHeader>
+          <div className="mb-3 flex h-12 w-12 items-center justify-center rounded-full bg-muted">
+            <Laptop />
+          </div>
+          <CardTitle>Authorize Handoff CLI</CardTitle>
+          <CardDescription>
+            Connect the terminal that started <code>handoff-app login</code> to your registry account.
+          </CardDescription>
+        </CardHeader>
+        {status === 'loading' ? (
+          <CardContent>
+            <p className="text-sm text-muted-foreground">Checking your account…</p>
+          </CardContent>
+        ) : !session?.user ? (
+          <CardContent className="space-y-4">
+            <Alert variant="info">
+              <ShieldCheck />
+              <AlertDescription>Sign in before approving a device.</AlertDescription>
+            </Alert>
+            <Button asChild className="w-full">
+              <Link href={`/login?callbackUrl=${encodeURIComponent(callbackUrl)}`}>Sign in to continue</Link>
+            </Button>
+          </CardContent>
+        ) : approved ? (
+          <>
+            <CardContent>
+              <Alert variant="green">
+                <CheckCircle2 />
+                <AlertTitle>CLI authorized</AlertTitle>
+                <AlertDescription>You can close this page and return to your terminal. Login should complete shortly.</AlertDescription>
+              </Alert>
+            </CardContent>
+            <CardFooter>
+              <Button asChild variant="outline" className="w-full">
+                <Link href="/">Return to documentation</Link>
+              </Button>
+            </CardFooter>
+          </>
+        ) : (
+          <form onSubmit={approve}>
+            <CardContent className="space-y-4">
+              <p className="text-sm text-muted-foreground">
+                Signed in as <strong className="text-foreground">{session.user.email}</strong>. Only approve a code you requested from your
+                own terminal.
+              </p>
+              {error ? (
+                <Alert variant="destructive">
+                  <AlertDescription>{error}</AlertDescription>
+                </Alert>
+              ) : null}
+              <div className="space-y-2">
+                <Label htmlFor="user-code">Device code</Label>
+                <Input
+                  id="user-code"
+                  value={userCode}
+                  onChange={(event) => setUserCode(event.target.value.toUpperCase())}
+                  required
+                  autoFocus
+                  autoComplete="one-time-code"
+                  autoCapitalize="characters"
+                  autoCorrect="off"
+                  spellCheck={false}
+                  placeholder="ABCD-EFGH"
+                  className="text-center font-mono text-lg tracking-widest"
+                />
+              </div>
+            </CardContent>
+            <CardFooter>
+              <Button className="w-full" type="submit" disabled={pending || !normalizeCode(userCode)}>
+                <ShieldCheck />
+                {pending ? 'Authorizing…' : 'Authorize CLI'}
+              </Button>
+            </CardFooter>
+          </form>
+        )}
+      </Card>
+    </AuthShell>
+  );
+}