limn-review 0.1.123

package/dist/api/plugins/auth.js

@@ -0,0 +1,169 @@
+import { createHash } from 'node:crypto';
+import { config } from '../../config.js';
+import { getAccountById, getLocalAccountCached, stampAccountActive, LOCAL_ACCOUNT_ID, } from '../../auth/account.js';
+// Attaches `request.account` to every request. Registered once on the root app
+// (so it covers all routes, including static/health which simply ignore it).
+//
+// Local mode: always the synthesized local account (id 1).
+// Cloud mode: resolved from the sealed session cookie (set up in registerCloudAuth,
+//   Phase 1). Unauthenticated requests get `null`; the requireAuth preHandler
+//   then 401s the data routes.
+export function registerAccountContext(app) {
+    app.decorateRequest('account', null);
+    app.addHook('onRequest', async (req) => {
+        if (config.isCloud) {
+            const accountId = readSessionAccountId(req);
+            req.account = accountId != null ? await getAccountById(accountId) : null;
+            // A request from a signed-in account on a real data route means that tenant
+            // has a loaded frontend — stamp activity (throttled) so the scheduler keeps
+            // syncing their repos. Skips static/landing assets and the health/auth probes.
+            if (req.account && req.url.startsWith('/api/')) {
+                stampAccountActive(req.account.id);
+            }
+        }
+        else {
+            req.account =
+                getLocalAccountCached() ?? {
+                    id: LOCAL_ACCOUNT_ID,
+                    githubUserId: '',
+                    githubLogin: '',
+                    displayName: null,
+                    avatarUrl: null,
+                    isLocal: true,
+                    plan: 'free',
+                    stripeCustomerId: null,
+                    aiCreditAllowance: null,
+                    benchmarkOptIn: false,
+                    largePrCodeLocThreshold: null,
+                    blastRadiusConfig: null,
+                };
+        }
+    });
+}
+// Reads {accountId} from the sealed session cookie. @fastify/secure-session is
+// only registered in cloud mode (Phase 1); guarded so this is safe pre-registration.
+function readSessionAccountId(req) {
+    const session = req
+        .session;
+    if (!session)
+        return null;
+    const raw = session.get('accountId');
+    return typeof raw === 'number' ? raw : null;
+}
+// Cloud only: register the cookie + sealed-session plugins. MUST run before
+// registerAccountContext so the session cookie is parsed by the time the
+// account-context onRequest hook reads it. The session key is derived from
+// SESSION_SECRET (sha256 → 32 bytes, the size secure-session needs).
+export async function registerSession(app) {
+    const cookie = await import('@fastify/cookie');
+    const secureSession = await import('@fastify/secure-session');
+    await app.register(cookie.default, { secret: config.sessionSecret });
+    const key = createHash('sha256').update(config.sessionSecret).digest();
+    await app.register(secureSession.default, {
+        key,
+        cookieName: 'pierre_session',
+        cookie: {
+            path: '/',
+            httpOnly: true,
+            sameSite: 'lax',
+            secure: config.appBaseUrl.startsWith('https://'),
+            maxAge: 30 * 24 * 60 * 60, // 30 days
+        },
+    });
+}
+// Cloud only: 401 any unauthenticated /api data route. Skips /api/health,
+// /api/auth/* (sign-in itself), /api/billing/webhook (Stripe posts
+// unauthenticated — verified by signature instead), /api/contact* (the public
+// contact form, whose visitors have no account by definition) and all non-/api requests
+// (the SPA + landing are served openly; the frontend gate handles the signed-out
+// UI). MUST be registered AFTER registerAccountContext so req.account is already
+// resolved. Also the cloud-only ENTITLEMENT gate: an authenticated free-plan
+// account gets 402 on the Pro plugin's /api/pro/* routes (local accounts are
+// always entitled — isLocal never reaches the cloud gate anyway).
+export function registerAuthGate(app) {
+    app.addHook('onRequest', async (req, reply) => {
+        const path = req.url.split('?')[0] ?? req.url;
+        if (!path.startsWith('/api/'))
+            return;
+        if (path === '/api/health')
+            return;
+        if (path.startsWith('/api/auth/'))
+            return;
+        if (path === '/api/billing/webhook')
+            return;
+        // GitHub App webhook: GitHub posts unauthenticated — authenticity is the
+        // X-Hub-Signature-256 HMAC, verified in the route (see api/routes/webhooks.ts).
+        if (path === '/api/webhooks/github')
+            return;
+        // The pricing page's "Get Pro" is a plain browser navigation from the public
+        // landing; the route itself bounces anonymous visitors to sign-in instead of
+        // dead-ending them on a JSON 401.
+        if (path === '/api/billing/checkout')
+            return;
+        // The public contact form. It exists FOR people who are not signed in — someone
+        // asking for a Pro trial does not have an account yet, and someone reporting that
+        // sign-in is broken cannot sign in to say so. Spam control is the honeypot, the
+        // signed fill-time ticket and the IP-keyed `contact` rate-limit tier, all in
+        // api/routes/contact.ts; authentication was never the control here.
+        if (path === '/api/contact' || path === '/api/contact/ticket')
+            return;
+        if (!req.account) {
+            await reply.code(401).send({
+                error: 'Unauthorized',
+                message: 'Sign in with GitHub to continue.',
+            });
+            return;
+        }
+        if (isProPath(path) && !req.account.isLocal && req.account.plan === 'free') {
+            await reply.code(402).send({ error: 'pro required' });
+        }
+    });
+}
+// Which paths the free-plan 402 gate covers.
+//
+// `/api/pro/*` is the convention, but it is NOT the whole surface: Claude Review has always kept
+// its pre-plugin URLs — `/api/prs/:id/claude-review*`, `/api/claude-reviews/*`,
+// `/api/claude-findings/*`, `/api/claude-review/*` — and AI Fix's fixer kept its
+// `/api/pro/prs/:id/ai-fix*` / `/api/pro/ai-fixes/*` paths when both moved to core.
+//
+// ⚠ THIS IS NOW THE SECOND GUARD, NOT THE FIRST. Claude Review, review memory and AI Fix are core,
+// free and LOCAL ONLY: `registerAgenticRoutes` (review/agentic.ts) registers none of them in cloud
+// — an explicit `isCloud` check — so in cloud they 404 before this matters. The entries stay so a
+// future change that registers one in cloud does not hand it to every free account by default.
+// Enumerated explicitly so adding a route outside /api/pro/ is a visible decision.
+function isProPath(path) {
+    if (path.startsWith('/api/pro/'))
+        return true;
+    if (path.startsWith('/api/claude-reviews'))
+        return true;
+    if (path.startsWith('/api/claude-findings/'))
+        return true;
+    if (path.startsWith('/api/claude-review/'))
+        return true;
+    // /api/prs/<id>/claude-review, …/status, …/stream, …/cancel
+    if (/^\/api\/prs\/\d+\/claude-review/.test(path))
+        return true;
+    return false;
+}
+// preHandler that rejects unauthenticated requests in cloud mode. A no-op in
+// local mode (the account is always present). Kept for any route that wants an
+// explicit per-route guard in addition to the global gate above.
+export async function requireAuth(req, reply) {
+    if (!config.isCloud)
+        return;
+    if (!req.account) {
+        await reply
+            .code(401)
+            .send({ error: 'Unauthorized', message: 'Sign in with GitHub to continue.' });
+    }
+}
+// The request's account id, for scoping queries. Always present in local mode;
+// in cloud mode requireAuth has already guaranteed it on data routes.
+export function accountIdOf(req) {
+    if (req.account)
+        return req.account.id;
+    if (!config.isCloud)
+        return LOCAL_ACCOUNT_ID;
+    throw new Error('no account on request (requireAuth missing?)');
+}
+//# sourceMappingURL=auth.js.map

package/dist/api/plugins/error-handler.js

@@ -0,0 +1,114 @@
+import { existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { config } from '../../config.js';
+/**
+ * The landing routes that shipped as prerendered HTML, discovered once at boot.
+ *
+ * The marketing site is built to `<route>/index.html` per route (apps/landing/
+ * prerender.mjs) so that a crawler, an AI agent or a no-JS visitor receives real
+ * content instead of an empty SPA shell. @fastify/static — registered with
+ * `wildcard: false` — already answers `/pricing/` from its directory-index scan,
+ * but NOT `/pricing`, which is the canonical, link-shaped form. Those land here.
+ *
+ * Resolved into a fixed Set at startup rather than stat-ing per request: it costs
+ * one readdir instead of a filesystem hit on every 404, and — the reason that
+ * matters — a URL can only ever select an entry that was found on disk at boot,
+ * so no request-supplied path is ever joined onto a filesystem root. Traversal
+ * is not defended against here; it is unrepresentable.
+ */
+function prerenderedRoutes(landingDir) {
+    const routes = new Set();
+    if (!existsSync(landingDir))
+        return routes;
+    for (const entry of readdirSync(landingDir, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
+        if (existsSync(join(landingDir, entry.name, 'index.html'))) {
+            routes.add(`/${entry.name}`);
+        }
+    }
+    return routes;
+}
+// Centralised error handling + the single not-found handler (Fastify allows one
+// per context). The not-found handler doubles as the SPA/landing router:
+//   /api/* unknown          → JSON 404 (both modes)
+//   /app, /app/* (GET)      → the timeline SPA index (client routing / reload)
+//   /, other non-/api (GET) → cloud: the landing page; local: 302 → /app
+export function registerErrorHandler(app, opts) {
+    const landingRoutes = opts.serveLanding
+        ? prerenderedRoutes(opts.publicLandingDir)
+        : new Set();
+    app.setErrorHandler((err, req, reply) => {
+        if (err.validation) {
+            reply.status(400).send({
+                error: 'ValidationError',
+                message: err.message,
+                details: err.validation,
+            });
+            return;
+        }
+        const status = err.statusCode ?? 500;
+        if (status >= 500) {
+            req.log.error({ err }, 'request failed');
+        }
+        // 5xx bodies are GENERIC. A 500 is an unhandled throw, so `err.message` is whatever the
+        // failing layer happened to say — and the layers under these routes talk to Postgres,
+        // SQLite, the GitHub GraphQL/REST APIs, Stripe and Anthropic. Their error text routinely
+        // carries query fragments and column names, absolute filesystem paths, connection
+        // strings, and upstream response bodies. None of that helps a caller (there is nothing
+        // they can do about it) and all of it helps an attacker map the internals, so it goes to
+        // the log — which the operator can read, and which redacts credentials — and not to the
+        // wire. 4xx messages are deliberate, author-written text (validation detail, "PR not
+        // found", "already running") and stay as-is, because they are the API's contract.
+        //
+        // In local mode the operator IS the caller, so the real message is passed through: there
+        // is no attacker to withhold it from, and a developer debugging their own instance should
+        // not have to go and read the terminal.
+        const expose = status < 500 || !config.isCloud;
+        reply.status(status).send({
+            error: expose ? err.name || 'Error' : 'InternalServerError',
+            message: expose
+                ? err.message
+                : 'Something went wrong on our end. The error has been logged.',
+        });
+    });
+    app.setNotFoundHandler((req, reply) => {
+        const path = req.url.split('?')[0] ?? req.url;
+        // Unknown API routes always return a JSON 404 (never an HTML page).
+        if (path.startsWith('/api')) {
+            return reply.status(404).send({
+                error: 'NotFound',
+                message: `Route ${req.method} ${req.url} not found`,
+            });
+        }
+        if (req.method === 'GET') {
+            // The SPA lives under /app — serve its index for any unmatched /app path so
+            // deep-links and reloads work.
+            if (opts.serveSpa && (path === '/app' || path.startsWith('/app/'))) {
+                return reply.sendFile('index.html', opts.publicDir);
+            }
+            // Root + other non-/api paths: cloud serves the public landing page; local
+            // sends the user straight into the app (never shows a landing).
+            if (opts.serveLanding) {
+                // Prefer the route's own prerendered file, so /pricing answers with the
+                // pricing copy and its own <title>/canonical rather than the generic shell
+                // (which only becomes the pricing page once JavaScript runs). Trailing
+                // slash tolerated; '/' and anything unknown fall back to the shell, which
+                // still client-routes correctly for a browser.
+                const clean = path.length > 1 ? path.replace(/\/+$/, '') : path;
+                if (landingRoutes.has(clean)) {
+                    return reply.sendFile(`${clean.slice(1)}/index.html`, opts.publicLandingDir);
+                }
+                return reply.sendFile('index.html', opts.publicLandingDir);
+            }
+            if (opts.serveSpa) {
+                return reply.redirect('/app/');
+            }
+        }
+        return reply.status(404).send({
+            error: 'NotFound',
+            message: `Route ${req.method} ${req.url} not found`,
+        });
+    });
+}
+//# sourceMappingURL=error-handler.js.map