kcg-code 0.0.0-stage → 0.2.0

package/src/server/routes/auth-guard.ts

@@ -0,0 +1,156 @@
+/**
+ * Penjaga HTTP untuk kunci aplikasi: baca cookie sesi, cek Origin (anti
+ * CSRF / cross-site WebSocket hijacking), dan bungkus setiap handler rute
+ * `/api/*` agar menolak request tanpa sesi valid (401).
+ *
+ * Rute publik (lock screen butuh ini sebelum login): status, login, avatar,
+ * dan login passkey.
+ */
+import type { Server } from "bun";
+import type { AuthService } from "../services/auth";
+import { SESSION_COOKIE, SESSION_TTL_MS } from "../services/auth";
+import { json } from "./helpers";
+
+/**
+ * Rute + method yang boleh diakses tanpa login (dibutuhkan lock screen).
+ * Per method: `GET /api/auth/avatar` publik, tapi `PUT`/`DELETE`-nya tidak.
+ */
+export const PUBLIC_API: ReadonlyMap<string, ReadonlySet<string>> = new Map([
+  ["/api/auth/status", new Set(["GET"])],
+  ["/api/auth/login", new Set(["POST"])],
+  ["/api/auth/avatar", new Set(["GET"])],
+  // Lock screen: cek ketersediaan passkey & login dengan passkey.
+  ["/api/auth/passkeys/availability", new Set(["GET"])],
+  ["/api/auth/passkeys/login/options", new Set(["POST"])],
+  ["/api/auth/passkeys/login", new Set(["POST"])],
+]);
+
+export function isPublicApi(route: string, method: string): boolean {
+  return PUBLIC_API.get(route)?.has(method) ?? false;
+}
+
+export function readSessionToken(req: Request): string | null {
+  const header = req.headers.get("cookie");
+  if (!header) return null;
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1) continue;
+    if (part.slice(0, idx).trim() === SESSION_COOKIE) {
+      const v = part.slice(idx + 1).trim();
+      return v === "" ? null : decodeURIComponent(v);
+    }
+  }
+  return null;
+}
+
+/** Request datang lewat HTTPS (langsung atau lewat tunnel/proxy). */
+function isSecure(req: Request): boolean {
+  if (new URL(req.url).protocol === "https:") return true;
+  return req.headers.get("x-forwarded-proto")?.split(",")[0]?.trim() === "https";
+}
+
+export function sessionCookie(req: Request, token: string): string {
+  const attrs = [
+    `${SESSION_COOKIE}=${encodeURIComponent(token)}`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Strict",
+    `Max-Age=${Math.floor(SESSION_TTL_MS / 1000)}`,
+  ];
+  if (isSecure(req)) attrs.push("Secure");
+  return attrs.join("; ");
+}
+
+export function clearSessionCookie(req: Request): string {
+  const attrs = [`${SESSION_COOKIE}=`, "Path=/", "HttpOnly", "SameSite=Strict", "Max-Age=0"];
+  if (isSecure(req)) attrs.push("Secure");
+  return attrs.join("; ");
+}
+
+/**
+ * Origin harus sama dengan host tujuan untuk request yang mengubah state
+ * dan untuk upgrade WebSocket. Cookie `SameSite=Strict` sudah menahan
+ * sebagian besar CSRF; ini lapis kedua (juga menutup WebSocket lintas situs,
+ * yang tidak dibatasi CORS).
+ */
+export function originAllowed(req: Request): boolean {
+  const origin = req.headers.get("origin");
+  // Tanpa Origin (curl, request same-origin GET lama) -> tidak ada konteks
+  // lintas situs; cookie tetap wajib valid.
+  if (origin === null) return true;
+  let originHost: string;
+  try {
+    originHost = new URL(origin).host;
+  } catch {
+    return false;
+  }
+  const hosts = new Set<string>();
+  const host = req.headers.get("host");
+  if (host) hosts.add(host);
+  const fwd = req.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  if (fwd) hosts.add(fwd);
+  hosts.add(new URL(req.url).host);
+  return hosts.has(originHost);
+}
+
+/** IP klien untuk pembatasan percobaan (tunnel biasanya lewat localhost). */
+export function clientIp(req: Request, server: Server<unknown> | undefined): string {
+  const direct = server?.requestIP(req)?.address ?? "unknown";
+  // Header proxy hanya dipercaya bila koneksi datang dari mesin ini (tunnel
+  // lokal seperti cloudflared/ngrok) — dari luar, header mudah dipalsukan.
+  const loopback = direct === "127.0.0.1" || direct === "::1" || direct === "::ffff:127.0.0.1";
+  if (loopback) {
+    const fwd =
+      req.headers.get("cf-connecting-ip") ??
+      req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ??
+      req.headers.get("x-real-ip");
+    if (fwd) return fwd.slice(0, 64);
+  }
+  return direct;
+}
+
+const MUTATING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+
+type AnyHandler = (req: Request, server: Server<unknown>) => unknown;
+
+/**
+ * Bungkus satu handler: cek Origin untuk method yang mengubah state, lalu
+ * wajibkan sesi valid (kecuali rute publik / kunci belum diatur).
+ */
+export function guardHandler(auth: AuthService, route: string, handler: AnyHandler): AnyHandler {
+  return (req, server) => {
+    if (MUTATING.has(req.method) && !originAllowed(req)) {
+      return json({ error: "ORIGIN_FORBIDDEN" }, 403);
+    }
+    if (!isPublicApi(route, req.method) && auth.isProtected()) {
+      if (!auth.authenticate(readSessionToken(req))) {
+        return json({ error: "AUTH_REQUIRED" }, 401);
+      }
+    }
+    return handler(req, server);
+  };
+}
+
+/**
+ * Terapkan `guardHandler` ke seluruh tabel rute `/api/*` (handler tunggal
+ * maupun per-method). Rute non-API dikembalikan apa adanya.
+ */
+export function guardRoutes<T extends Record<string, unknown>>(auth: AuthService, routes: T): T {
+  const out: Record<string, unknown> = {};
+  for (const [path, value] of Object.entries(routes)) {
+    if (!path.startsWith("/api/")) {
+      out[path] = value;
+    } else if (typeof value === "function") {
+      out[path] = guardHandler(auth, path, value as AnyHandler);
+    } else if (value && typeof value === "object" && !(value instanceof Response)) {
+      const methods: Record<string, unknown> = {};
+      for (const [m, h] of Object.entries(value as Record<string, unknown>)) {
+        methods[m] = typeof h === "function" ? guardHandler(auth, path, h as AnyHandler) : h;
+      }
+      out[path] = methods;
+    } else {
+      out[path] = value;
+    }
+  }
+  return out as T;
+}

package/src/server/routes/auth.routes.ts

@@ -0,0 +1,287 @@
+/**
+ * Tabel rute API kunci aplikasi (lock screen) & pengaturan keamanan.
+ *
+ * Publik (dibutuhkan lock screen sebelum login):
+ * - `GET  /api/auth/status`            status kunci + profil + sisa jeda
+ * - `POST /api/auth/login`   {secret}  buka kunci -> cookie sesi
+ * - `GET  /api/auth/avatar`            foto profil
+ *
+ * Wajib login (bila kunci sudah diatur) — dijaga `guardRoutes`:
+ * - `POST   /api/auth/logout`          kunci perangkat ini (hapus sesi)
+ * - `PUT    /api/auth/lock`            atur/ganti kunci {kind, secret, current?}
+ * - `DELETE /api/auth/lock`            hapus kunci {current}
+ * - `PATCH  /api/auth/profile`         {nickname}
+ * - `PUT    /api/auth/avatar`          multipart `file` | `DELETE` hapus
+ * - `PUT    /api/auth/avatar/preset`   {preset} avatar bawaan
+ * - `PATCH  /api/auth/settings`        {autoLockMinutes}
+ * - `POST   /api/auth/onboarding/complete`  welcome screen selesai
+ * - `GET    /api/auth/devices`         sesi aktif per perangkat
+ * - `POST   /api/auth/devices/revoke-others`
+ * - `DELETE /api/auth/devices/:id`
+ */
+import type { BunRequest, Server } from "bun";
+import type { LockKind } from "../db/auth";
+import type { AuthService } from "../services/auth";
+import { clearSessionCookie, clientIp, readSessionToken, sessionCookie } from "./auth-guard";
+import { errorStatus, json, readJson, serverError } from "./helpers";
+
+/** Kode rate-limit membawa detik tunggu: `AUTH_RATE_LIMITED:<sec>`. */
+function rateLimited(code: string): number | null {
+  if (!code.startsWith("AUTH_RATE_LIMITED:")) return null;
+  const n = Number(code.slice("AUTH_RATE_LIMITED:".length));
+  return Number.isFinite(n) ? n : null;
+}
+
+function authError(code: string): Response {
+  const wait = rateLimited(code);
+  if (wait !== null) {
+    return new Response(JSON.stringify({ error: "AUTH_RATE_LIMITED", retryAfterSec: wait }), {
+      status: 429,
+      headers: { "content-type": "application/json", "retry-after": String(wait) },
+    });
+  }
+  return json({ error: code }, errorStatus(code));
+}
+
+function withCookie(res: Response, cookie: string): Response {
+  res.headers.append("set-cookie", cookie);
+  return res;
+}
+
+export function authRoutes(auth: AuthService) {
+  const ctxOf = (req: Request, server: Server<unknown>) => ({
+    ip: clientIp(req, server),
+    userAgent: req.headers.get("user-agent"),
+  });
+
+  return {
+    "/api/auth/status": {
+      GET: (req: Request, server: Server<unknown>) => {
+        try {
+          const st = auth.status(readSessionToken(req), clientIp(req, server));
+          // Sesi kedaluwarsa / terkunci otomatis -> bersihkan cookie basi.
+          const res = json(st);
+          if (st.protected && !st.authenticated && readSessionToken(req)) {
+            return withCookie(res, clearSessionCookie(req));
+          }
+          return res;
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/login": {
+      POST: async (req: Request, server: Server<unknown>) => {
+        try {
+          const body = await readJson(req);
+          if (!body.ok) return json({ error: "INVALID_JSON" }, 400);
+          const { secret } = (body.data ?? {}) as { secret?: unknown };
+          const res = await auth.login(
+            typeof secret === "string" ? secret : "",
+            ctxOf(req, server),
+          );
+          if (!res.ok) return authError(res.error);
+          return withCookie(json({ ok: true }), sessionCookie(req, res.data.token));
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/logout": {
+      POST: (req: Request) => {
+        try {
+          auth.logout(readSessionToken(req));
+          return withCookie(json({ ok: true }), clearSessionCookie(req));
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/lock": {
+      PUT: async (req: Request, server: Server<unknown>) => {
+        try {
+          const body = await readJson(req);
+          if (!body.ok) return json({ error: "INVALID_JSON" }, 400);
+          const { kind, secret, current } = (body.data ?? {}) as {
+            kind?: unknown;
+            secret?: unknown;
+            current?: unknown;
+          };
+          if ((kind !== "pin" && kind !== "password") || typeof secret !== "string") {
+            return json({ error: "LOCK_KIND_INVALID" }, 400);
+          }
+          const res = await auth.setLock(
+            {
+              kind: kind as LockKind,
+              secret,
+              current: typeof current === "string" ? current : undefined,
+            },
+            ctxOf(req, server),
+          );
+          if (!res.ok) return authError(res.error);
+          // Perangkat yang mengatur kunci langsung login dengan sesi baru.
+          return withCookie(json({ ok: true }), sessionCookie(req, res.data.token));
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+      DELETE: async (req: Request, server: Server<unknown>) => {
+        try {
+          const body = await readJson(req);
+          if (!body.ok) return json({ error: "INVALID_JSON" }, 400);
+          const { current } = (body.data ?? {}) as { current?: unknown };
+          const res = await auth.removeLock(
+            typeof current === "string" ? current : "",
+            ctxOf(req, server),
+          );
+          if (!res.ok) return authError(res.error);
+          return withCookie(json({ ok: true }), clearSessionCookie(req));
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/profile": {
+      PATCH: async (req: Request) => {
+        try {
+          const body = await readJson(req);
+          if (!body.ok) return json({ error: "INVALID_JSON" }, 400);
+          const { nickname } = (body.data ?? {}) as { nickname?: unknown };
+          if (nickname !== null && typeof nickname !== "string") {
+            return json({ error: "NICKNAME_INVALID" }, 400);
+          }
+          const res = auth.setNickname(nickname ?? null);
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ profile: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/avatar": {
+      GET: () => {
+        try {
+          const av = auth.getAvatar();
+          if (!av) return json({ error: "AVATAR_NOT_FOUND" }, 404);
+          return new Response(new Blob([new Uint8Array(av.bytes)]), {
+            headers: {
+              "content-type": av.mime,
+              // URL memakai ?v=<versi>, jadi aman di-cache lama.
+              "cache-control": "private, max-age=31536000, immutable",
+              "x-content-type-options": "nosniff",
+              "content-security-policy": "default-src 'none'",
+            },
+          });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+      PUT: async (req: Request) => {
+        try {
+          let form: FormData;
+          try {
+            form = await req.formData();
+          } catch {
+            return json({ error: "EMPTY_UPLOAD" }, 400);
+          }
+          const file = form.get("file");
+          if (!(file instanceof File)) return json({ error: "EMPTY_UPLOAD" }, 400);
+          const res = auth.setAvatar(new Uint8Array(await file.arrayBuffer()), file.type || null);
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ profile: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+      DELETE: () => {
+        try {
+          const res = auth.setAvatar(null, null);
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ profile: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/avatar/preset": {
+      PUT: async (req: Request) => {
+        try {
+          const body = await readJson(req);
+          if (!body.ok) return json({ error: "INVALID_JSON" }, 400);
+          const { preset } = (body.data ?? {}) as { preset?: unknown };
+          const res = auth.setAvatarPreset(typeof preset === "string" ? preset : "");
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ profile: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/settings": {
+      PATCH: async (req: Request) => {
+        try {
+          const body = await readJson(req);
+          if (!body.ok) return json({ error: "INVALID_JSON" }, 400);
+          const { autoLockMinutes } = (body.data ?? {}) as { autoLockMinutes?: unknown };
+          const res = auth.setAutoLock(typeof autoLockMinutes === "number" ? autoLockMinutes : -1);
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ autoLockMinutes: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    // Welcome screen selesai / dilewati. Dijaga guard: setelah app dikunci,
+    // hanya sesi login yang bisa memanggilnya (dan saat itu sudah onboarded).
+    "/api/auth/onboarding/complete": {
+      POST: () => {
+        try {
+          auth.completeOnboarding();
+          return json({ ok: true });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/devices": {
+      GET: (req: Request) => {
+        try {
+          return json({ devices: auth.listDevices(readSessionToken(req)) });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/devices/revoke-others": {
+      POST: (req: Request) => {
+        try {
+          auth.revokeOthers(readSessionToken(req));
+          return json({ ok: true });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/devices/:id": {
+      DELETE: (req: BunRequest<"/api/auth/devices/:id">) => {
+        try {
+          auth.revokeDevice(req.params.id);
+          return json({ ok: true });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+  };
+}

package/src/server/routes/helpers.ts

@@ -0,0 +1,165 @@
+/**
+ * Helper HTTP bersama untuk handler rute API (pola kcgcode: helper rute
+ * dipisah dari composition root). Dulu menumpuk di `app.ts`; kini dipakai
+ * semua tabel rute di `routes/*.routes.ts`.
+ */
+import type { SessionModel } from "../../types";
+
+export function json(data: unknown, status = 200): Response {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+export function serverError(err: unknown): Response {
+  console.error("[kcg-code] error tidak terduga:", err);
+  return json({ error: "INTERNAL_ERROR" }, 500);
+}
+
+/**
+ * Pemetaan error domain ke status HTTP (design.md — Error Handling):
+ * 400 validasi, 404 tidak ditemukan, 409 konflik, sisanya 500.
+ */
+export function errorStatus(code: string): number {
+  switch (code) {
+    case "NAME_REQUIRED":
+    case "PATH_OUTSIDE_SANDBOX":
+    case "INVALID_PATH_CHARS":
+    case "UNSUPPORTED_AGENT_TYPE":
+    case "INVALID_SIZE":
+    case "MODEL_NOT_FOUND":
+    case "INVALID_INSTRUCTIONS":
+    case "INSTRUCTIONS_TOO_LONG":
+    case "INVALID_SKILL_QUERY":
+    case "INVALID_SKILL_ID":
+    case "PIN_DIGITS_ONLY":
+    case "PIN_LENGTH":
+    case "PIN_TOO_SIMPLE":
+    case "PASSWORD_TOO_SHORT":
+    case "PASSWORD_TOO_LONG":
+    case "LOCK_KIND_INVALID":
+    case "NICKNAME_TOO_LONG":
+    case "NICKNAME_INVALID":
+    case "AUTO_LOCK_INVALID":
+    case "AVATAR_PRESET_INVALID":
+    case "AUTH_NOT_CONFIGURED":
+    case "INVALID_PROVIDER":
+    case "WORKSPACE_PATH_REQUIRED":
+    case "WORKSPACE_PATH_INVALID":
+    case "WORKSPACE_PATH_NOT_ABSOLUTE":
+    case "WORKSPACE_NOT_DIRECTORY":
+    case "WORKSPACE_TOO_BROAD":
+    case "WORKSPACE_CONTAINS_APP_DATA":
+    case "WORKSPACE_NOT_WRITABLE":
+      return 400;
+    case "WORKSPACE_NOT_FOUND":
+    case "WORKSPACE_PARENT_NOT_FOUND":
+      return 404;
+    case "PASSKEY_NAME_INVALID":
+    case "PASSKEY_UNSUPPORTED_ORIGIN":
+    case "PASSKEY_CHALLENGE_INVALID":
+    case "PASSKEY_VERIFY_FAILED":
+      return 400;
+    case "PASSKEY_LOCK_REQUIRED":
+    case "PASSKEY_ALREADY_REGISTERED":
+    case "PASSKEY_LIMIT":
+    case "PASSKEY_NONE":
+      return 409;
+    case "PASSKEY_INVALID":
+      return 401;
+    case "PASSKEY_NOT_FOUND":
+      return 404;
+    // Tunnel: prasyarat belum terpenuhi.
+    case "TUNNEL_LOCK_REQUIRED":
+    case "TUNNEL_SIGNED_OUT":
+      return 409;
+    case "TUNNEL_DEVICE_REVOKED":
+      // Bukan 401: itu sinyal lock screen kcgcode di klien.
+      return 403;
+    case "TUNNEL_RATE_LIMITED":
+      return 429;
+    case "FRPC_UNSUPPORTED_PLATFORM":
+    case "TUNNEL_NOT_CONFIGURED":
+    case "LHR_SSH_MISSING":
+      return 501;
+    case "TUNNEL_API_UNREACHABLE":
+    case "FRPC_DOWNLOAD_FAILED":
+    case "FRPC_CHECKSUM_MISMATCH":
+    case "FRPC_NOT_FOUND":
+    case "FRPC_START_FAILED":
+    case "LHR_START_FAILED":
+    case "LHR_DENIED":
+      return 502;
+    case "AUTH_INVALID":
+    case "CURRENT_SECRET_INVALID":
+    case "AUTH_REQUIRED":
+      return 401;
+    case "ORIGIN_FORBIDDEN":
+      return 403;
+    case "AVATAR_NOT_FOUND":
+      return 404;
+    case "AVATAR_TOO_LARGE":
+      return 413;
+    case "PROJECT_NOT_FOUND":
+    case "PROJECT_DIR_NOT_FOUND":
+    case "SESSION_NOT_FOUND":
+    case "PATH_NOT_FOUND":
+      return 404;
+    case "NAME_TAKEN":
+    case "PATH_TAKEN":
+    case "SESSION_NOT_RUNNING":
+    case "SESSION_NOT_ACTIVE":
+    case "SESSION_ALREADY_RUNNING":
+    case "PROJECT_HAS_SESSIONS":
+    case "SKILL_INSTALL_IN_PROGRESS":
+    case "INSTALL_JOB_NOT_RUNNING":
+      return 409;
+    case "SKILLS_RATE_LIMITED":
+      return 429;
+    case "SKILL_INSTALL_FAILED":
+      return 502;
+    // Server headless menolak operasi (mis. hapus session remote gagal).
+    case "OC_DELETE_SESSION_FAILED":
+      return 502;
+    case "UNSUPPORTED_IMAGE_MIME":
+    case "EMPTY_UPLOAD":
+      return 400;
+    case "IMAGE_TOO_LARGE":
+    case "FILE_TOO_LARGE":
+      return 413;
+    case "ATTACHMENT_NOT_FOUND":
+    case "INSTALL_JOB_NOT_FOUND":
+      return 404;
+    default:
+      // Kegagalan layanan skills.sh (hulu) -> 502.
+      if (code.startsWith("SKILLS_SEARCH_FAILED") || code.startsWith("SKILLS_AUDIT_FAILED")) {
+        return 502;
+      }
+      return 500;
+  }
+}
+
+/**
+ * Membaca body JSON; body tidak valid -> `{ ok: false }` sehingga handler
+ * dapat membalas 400 (bukan 500 dari `serverError`).
+ */
+export async function readJson(req: Request): Promise<{ ok: true; data: unknown } | { ok: false }> {
+  try {
+    return { ok: true, data: await req.json() };
+  } catch {
+    return { ok: false };
+  }
+}
+
+/**
+ * Body `model` pada POST/PUT Session: `{ providerID, modelID }` atau `null`
+ * (artinya pakai model default opencode). Bentuk lain dianggap null.
+ */
+export function parseModelBody(raw: unknown): SessionModel | null {
+  if (typeof raw !== "object" || raw === null) return null;
+  const { providerID, modelID } = raw as { providerID?: unknown; modelID?: unknown };
+  if (typeof providerID !== "string" || providerID === "") return null;
+  if (typeof modelID !== "string" || modelID === "") return null;
+  return { providerID, modelID };
+}

package/src/server/routes/meta.routes.ts

@@ -0,0 +1,24 @@
+/**
+ * Tabel rute info aplikasi.
+ *
+ * - `GET /api/meta`   `{ version }` — dipakai Settings -> About.
+ *
+ * Dijaga `guardRoutes` seperti rute lain: versi bukan rahasia, tapi tidak
+ * perlu diekspos ke pengunjung yang belum membuka kunci.
+ */
+import { readAppInfo } from "../services/app-info";
+import { json, serverError } from "./helpers";
+
+export function metaRoutes() {
+  return {
+    "/api/meta": {
+      GET: async () => {
+        try {
+          return json(await readAppInfo());
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+  };
+}