lean-claudient-core 0.1.0

package/src/automation/composioClient.ts

@@ -0,0 +1,360 @@
+/**
+ * Composio API Client
+ * Handles OAuth 2.0 token management, authentication, and API interactions.
+ * Tokens stored securely in ~/.lean-claudient/composio.json (encrypted).
+ */
+
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'crypto';
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+
+interface ComposioTokens {
+  accessToken: string;
+  refreshToken: string;
+  expiresAt: number;
+  scope: string;
+}
+
+interface ComposioConfig {
+  apiKey: string;
+  baseUrl: string;
+  encryptionKey?: string;
+}
+
+/**
+ * ComposioClient: Secure API client for Composio OAuth integration
+ */
+export class ComposioClient {
+  private apiKey: string;
+  private baseUrl: string;
+  private tokenPath: string;
+  private encryptionKey: string;
+  private tokens: ComposioTokens | null = null;
+
+  constructor(config: ComposioConfig) {
+    this.apiKey = config.apiKey;
+    this.baseUrl = config.baseUrl || 'https://api.composio.dev/api/v1';
+    this.encryptionKey = config.encryptionKey || this.generateEncryptionKey();
+    this.tokenPath = join(homedir(), '.lean-claudient', 'composio.json');
+    this.ensureTokenDirectory();
+    this.loadTokens();
+  }
+
+  /**
+   * Generate encryption key from master secret
+   */
+  private generateEncryptionKey(): string {
+    const masterSecret = process.env.COMPOSIO_MASTER_SECRET || 'lean-claudient-default';
+    return scryptSync(masterSecret, 'salt', 32).toString('hex');
+  }
+
+  /**
+   * Ensure token storage directory exists
+   */
+  private ensureTokenDirectory(): void {
+    const dir = join(homedir(), '.lean-claudient');
+    if (!existsSync(dir)) {
+      mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+  }
+
+  /**
+   * Encrypt tokens before storage
+   */
+  private encryptTokens(data: ComposioTokens): string {
+    const iv = randomBytes(16);
+    const key = Buffer.from(this.encryptionKey, 'hex');
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+
+    const json = JSON.stringify(data);
+    let encrypted = cipher.update(json, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+
+    const authTag = cipher.getAuthTag();
+    return JSON.stringify({
+      iv: iv.toString('hex'),
+      authTag: authTag.toString('hex'),
+      encrypted
+    });
+  }
+
+  /**
+   * Decrypt tokens from storage
+   */
+  private decryptTokens(encryptedData: string): ComposioTokens {
+    try {
+      const parsed = JSON.parse(encryptedData);
+      const key = Buffer.from(this.encryptionKey, 'hex');
+      const iv = Buffer.from(parsed.iv, 'hex');
+      const authTag = Buffer.from(parsed.authTag, 'hex');
+
+      const decipher = createDecipheriv('aes-256-gcm', key, iv);
+      decipher.setAuthTag(authTag);
+
+      let decrypted = decipher.update(parsed.encrypted, 'hex', 'utf8');
+      decrypted += decipher.final('utf8');
+
+      return JSON.parse(decrypted);
+    } catch (error) {
+      throw new Error(`Failed to decrypt tokens: ${(error as Error).message}`);
+    }
+  }
+
+  /**
+   * Load tokens from encrypted storage
+   */
+  private loadTokens(): void {
+    try {
+      if (existsSync(this.tokenPath)) {
+        const encryptedData = readFileSync(this.tokenPath, 'utf8');
+        this.tokens = this.decryptTokens(encryptedData);
+      }
+    } catch (error) {
+      console.warn('Failed to load tokens:', (error as Error).message);
+      this.tokens = null;
+    }
+  }
+
+  /**
+   * Save tokens to encrypted storage
+   */
+  private saveTokens(): void {
+    if (!this.tokens) return;
+
+    try {
+      const encrypted = this.encryptTokens(this.tokens);
+      writeFileSync(this.tokenPath, encrypted, { mode: 0o600 });
+    } catch (error) {
+      throw new Error(`Failed to save tokens: ${(error as Error).message}`);
+    }
+  }
+
+  /**
+   * Authenticate with Composio using OAuth 2.0
+   * Initiates OAuth flow and returns authorization URL
+   */
+  async authenticate(
+    redirectUri: string,
+    scopes: string[] = ['gmail.draft', 'crm.lead', 'jira.issue']
+  ): Promise<{ authUrl: string; codeVerifier: string }> {
+    const codeVerifier = this.generateCodeVerifier();
+    const codeChallenge = this.generateCodeChallenge(codeVerifier);
+
+    const params = new URLSearchParams({
+      client_id: this.apiKey,
+      response_type: 'code',
+      redirect_uri: redirectUri,
+      scope: scopes.join(' '),
+      code_challenge: codeChallenge,
+      code_challenge_method: 'S256',
+      state: randomBytes(32).toString('hex')
+    });
+
+    const authUrl = `${this.baseUrl}/auth/oauth/authorize?${params.toString()}`;
+
+    return { authUrl, codeVerifier };
+  }
+
+  /**
+   * Exchange authorization code for access token
+   */
+  async exchangeCodeForToken(
+    code: string,
+    codeVerifier: string,
+    redirectUri: string
+  ): Promise<ComposioTokens> {
+    const response = await fetch(`${this.baseUrl}/auth/oauth/token`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Authorization': `Bearer ${this.apiKey}`
+      },
+      body: new URLSearchParams({
+        grant_type: 'authorization_code',
+        code,
+        code_verifier: codeVerifier,
+        client_id: this.apiKey,
+        redirect_uri: redirectUri
+      }).toString()
+    });
+
+    if (!response.ok) {
+      const error = await response.json() as Record<string, unknown>;
+      throw new Error(`Token exchange failed: ${error.error_description}`);
+    }
+
+    const data = await response.json() as Record<string, unknown>;
+    this.tokens = {
+      accessToken: (data.access_token as string) || '',
+      refreshToken: (data.refresh_token as string) || '',
+      expiresAt: Date.now() + ((data.expires_in as number) || 3600) * 1000,
+      scope: (data.scope as string) || ''
+    };
+
+    this.saveTokens();
+    return this.tokens;
+  }
+
+  /**
+   * Refresh access token using refresh token
+   */
+  async refreshToken(): Promise<string> {
+    if (!this.tokens || !this.tokens.refreshToken) {
+      throw new Error('No refresh token available. Please authenticate first.');
+    }
+
+    const response = await fetch(`${this.baseUrl}/auth/oauth/token`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Authorization': `Bearer ${this.apiKey}`
+      },
+      body: new URLSearchParams({
+        grant_type: 'refresh_token',
+        refresh_token: this.tokens.refreshToken,
+        client_id: this.apiKey
+      }).toString()
+    });
+
+    if (!response.ok) {
+      const error = await response.json() as Record<string, unknown>;
+      throw new Error(`Token refresh failed: ${error.error_description}`);
+    }
+
+    const data = await response.json() as Record<string, unknown>;
+    this.tokens = {
+      accessToken: (data.access_token as string) || '',
+      refreshToken: (data.refresh_token as string) || this.tokens.refreshToken,
+      expiresAt: Date.now() + ((data.expires_in as number) || 3600) * 1000,
+      scope: (data.scope as string) || ''
+    };
+
+    this.saveTokens();
+    return this.tokens.accessToken;
+  }
+
+  /**
+   * Get valid access token (refresh if needed)
+   */
+  async getAccessToken(): Promise<string> {
+    if (!this.tokens) {
+      throw new Error('Not authenticated. Please run oauth-setup first.');
+    }
+
+    // Refresh if token expires in next 5 minutes
+    if (this.tokens.expiresAt - Date.now() < 5 * 60 * 1000) {
+      return this.refreshToken();
+    }
+
+    return this.tokens.accessToken;
+  }
+
+  /**
+   * Get current authentication status
+   */
+  getStatus(): {
+    authenticated: boolean;
+    expiresIn?: number;
+    scope?: string;
+  } {
+    if (!this.tokens) {
+      return { authenticated: false };
+    }
+
+    const expiresIn = Math.max(0, (this.tokens.expiresAt - Date.now()) / 1000);
+    return {
+      authenticated: true,
+      expiresIn: Math.round(expiresIn),
+      scope: this.tokens.scope
+    };
+  }
+
+  /**
+   * Clear stored tokens (logout)
+   */
+  clearTokens(): void {
+    this.tokens = null;
+    try {
+      if (existsSync(this.tokenPath)) {
+        const fs = require('fs');
+        fs.unlinkSync(this.tokenPath);
+      }
+    } catch (error) {
+      console.warn('Failed to clear tokens:', (error as Error).message);
+    }
+  }
+
+  /**
+   * Generate PKCE code verifier
+   */
+  private generateCodeVerifier(): string {
+    return randomBytes(32).toString('base64url');
+  }
+
+  /**
+   * Generate PKCE code challenge from verifier
+   */
+  private generateCodeChallenge(codeVerifier: string): string {
+    const crypto = require('crypto');
+    return crypto
+      .createHash('sha256')
+      .update(codeVerifier)
+      .digest('base64url');
+  }
+
+  /**
+   * Make authenticated API request to Composio
+   */
+  async request(
+    endpoint: string,
+    method: string = 'GET',
+    body?: any
+  ): Promise<any> {
+    const accessToken = await this.getAccessToken();
+
+    const response = await fetch(`${this.baseUrl}${endpoint}`, {
+      method,
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': `Bearer ${accessToken}`
+      },
+      ...(body && { body: JSON.stringify(body) })
+    });
+
+    if (!response.ok) {
+      const error = await response.json() as Record<string, unknown>;
+      throw new Error(`API request failed: ${error.message}`);
+    }
+
+    return response.json();
+  }
+
+  /**
+   * Execute an action via Composio
+   * Queue the action for execution (human approval required)
+   */
+  async execute(
+    action: string,
+    params: Record<string, any>,
+    options?: { require_approval?: boolean }
+  ): Promise<{ id: string; status: string }> {
+    const actionId = randomBytes(16).toString('hex');
+
+    // Queue action for execution (no autonomous execution)
+    const result = await this.request('/actions/execute', 'POST', {
+      action_id: actionId,
+      action_name: action,
+      parameters: params,
+      require_approval: options?.require_approval ?? true,
+      timestamp: new Date().toISOString()
+    });
+
+    return {
+      id: result.id || actionId,
+      status: result.status || 'queued'
+    };
+  }
+}
+
+export default ComposioClient;