mergen-server 1.4.0

package/dist/app.js

@@ -0,0 +1,467 @@
+import express from "express";
+import { LRUCache } from "lru-cache";
+import helmet from "helmet";
+import logger from "./sensor/logger.js";
+import { timingSafeSecretEqualAny } from "./sensor/security-utils.js";
+import { billingRouter } from "./intelligence/billing.js";
+import { teamRouter } from "./intelligence/team.js";
+import { createIngestRouter } from "./sensor/ingest.js";
+import { createSensorRouter } from "./routes/sensor.js";
+import { createLicenseRouter } from "./routes/license.js";
+import { createDeviceAuthStubRouter } from "./routes/device-auth-stub.js";
+import { createCalibrationRouter } from "./routes/calibration.js";
+import { createTelemetryRouter } from "./routes/telemetry.js";
+import { createSetupRouter } from "./routes/setup-ui.js";
+import { layersRouter } from "./routes/layers.js";
+import { sentryRouter } from "./routes/sentry.js";
+import { otelRouter } from "./routes/otel.js";
+import { otlpReceiverRouter } from "./routes/otlp-receiver.js";
+import { createCIRouter } from "./routes/ci.js";
+import { createIncidentsRouter } from "./routes/incidents.js";
+import { createTicketsRouter } from "./routes/tickets.js";
+import { createValidateRouter } from "./routes/validate.js";
+import { createDashboardRouter } from "./routes/dashboard.js";
+import { createDemoRouter } from "./routes/demo.js";
+import { createSdkRouter } from "./routes/sdk.js";
+import { createSessionsRouter } from "./routes/sessions.js";
+import { createPagerDutyRouter } from "./routes/pagerduty.js";
+import { createIncidentWebhookRouter } from "./routes/incident-webhook.js";
+import { createHeartbeatsRouter } from "./routes/heartbeats.js";
+import { createGitHubWebhookRouter } from "./routes/github-webhook.js";
+import { createWarRoomRouter } from "./routes/war-room.js";
+import { createSlackRoutingRouter } from "./routes/slack-routing.js";
+import { createApiKeysRouter } from "./routes/api-keys.js";
+import { createTenantsRouter } from "./routes/tenants.js";
+import { createRbacRouter } from "./routes/rbac.js";
+import { createOverridesRouter } from "./routes/overrides.js";
+import { createShadowReportRouter } from "./routes/shadow-report.js";
+import { createDecisionMemoryRouter } from "./routes/decision-memory.js";
+import { createPRShadowRouter } from "./routes/pr-shadow.js";
+import { createImpactReportRouter } from "./routes/impact-report.js";
+import { createBillingOutcomeRouter } from "./routes/billing-outcome.js";
+import { createBillingDashboardRouter } from "./routes/billing-dashboard.js";
+import { createOnboardingRouter } from "./routes/onboarding.js";
+import { createHealthIntegrationsRouter } from "./routes/health-integrations.js";
+import { createTeamUsageRouter } from "./routes/team-usage.js";
+import { createActiveAuthorsRouter } from "./routes/active-authors.js";
+import { createPostmortemRouter } from "./routes/postmortem.js";
+import { createExplainWhyRouter } from "./routes/explain-why.js";
+import { createAgentBlundersRouter } from "./routes/agent-blunders.js";
+import { createHabituationRouter } from "./routes/habituation.js";
+import { createAdrRouter } from "./routes/adr.js";
+import { createConfidenceRouter } from "./routes/confidence.js";
+import { createArchRouter } from "./routes/arch.js";
+import { createRunbooksRouter } from "./routes/runbooks.js";
+import { createCIGateRouter } from "./routes/ci-gate.js";
+import { createCIGateHistoryRouter } from "./routes/ci-gate-history.js";
+import { createHitlRouter } from "./routes/hitl.js";
+import { createGateAnalyticsRouter } from "./routes/gate-analytics.js";
+import { createPoliciesRouter } from "./routes/policies.js";
+import { createRiskReportRouter } from "./routes/risk-report.js";
+import { createSafetyTestRouter } from "./routes/safety-test.js";
+import { createAgentActivityRouter } from "./routes/agent-activity.js";
+import { createPolicyNlRouter } from "./routes/policy-nl.js";
+import { createAgentsRouter } from "./routes/agents.js";
+import { createActivityFeedRouter } from "./routes/activity-feed.js";
+import { createAuditExportRouter } from "./routes/audit-export.js";
+import { createGateRouter } from "./routes/gate.js";
+import { createCredentialsRouter } from "./routes/credentials.js";
+import { createReplayRouter } from "./routes/replay.js";
+import { createOidcIssuerRouter } from "./routes/oidc-issuer.js";
+import { createComplianceReportRouter } from "./routes/compliance-report.js";
+import { cloudAuthMiddleware, CLOUD_MODE } from "./sensor/cloud-auth.js";
+import { handleSlackActions, handleFeedbackLink } from "./intelligence/slack.js";
+import { getPrometheusMetrics } from "./sensor/otel-exporter.js";
+import { auditMiddleware } from "./sensor/audit-log.js";
+import { ssoMiddleware } from "./sensor/sso.js";
+import { serviceGraph } from "./sensor/service-graph.js";
+import { routeReachability } from "./sensor/route-reachability.js";
+import { idpIdentityMiddleware } from "./intelligence/idp-identity.js";
+const MUTATING_PATHS = [
+  "/feedback",
+  "/license",
+  "/clear",
+  "/checkpoint",
+  "/telemetry",
+  "/otel-config",
+  "/postmortem",
+  // Incident pipeline — triggers autonomous command execution
+  "/incident",
+  // Infrastructure mutations
+  "/ci",
+  "/overrides",
+  "/rbac",
+  "/heartbeats",
+  "/slack/routing",
+  "/slack/test",
+  "/runbooks",
+  "/ci/gate",
+  "/policies",
+  // /hitl/approve and /hitl/deny are self-authenticated (HMAC nonce or x-mergen-secret
+  // handled inside createHitlRouter). Only /hitl/pending requires the global secret guard.
+  "/hitl/pending",
+  // Process / container watchers
+  "/watchers",
+  // Billing & account mutations
+  "/api-keys",
+  "/tenants",
+  "/onboarding/dismiss",
+  // Shadow report verdict → writes to override corpus (safety gate)
+  "/shadow-report",
+  // Demo injection routes → write directly to the ring buffer
+  "/demo",
+  // CLI/hook gate evaluation — same enforcement decision as an MCP tool call
+  "/gate",
+  // Ephemeral cloud credential brokering — also requires its own verified
+  // x-mergen-agent-token; the shared secret is defense-in-depth on top of that.
+  "/credentials"
+];
+const LOCAL_HOSTNAMES = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1"]);
+function createApp(opts) {
+  const { serverVersion, localSecret, port, bindHost } = opts;
+  const app = express();
+  app.use(billingRouter);
+  app.use(sentryRouter);
+  app.use(createGitHubWebhookRouter());
+  app.use(createPagerDutyRouter());
+  app.post("/slack/actions", (req, res) => {
+    const chunks = [];
+    req.on("data", (chunk) => chunks.push(chunk));
+    req.on("end", () => {
+      const rawBody = Buffer.concat(chunks);
+      req.rawBody = rawBody;
+      const ct = (req.headers["content-type"] ?? "").toLowerCase();
+      if (ct.includes("application/x-www-form-urlencoded")) {
+        const params = new URLSearchParams(rawBody.toString("utf8"));
+        req.body = Object.fromEntries(params);
+      } else {
+        try {
+          req.body = JSON.parse(rawBody.toString("utf8"));
+        } catch {
+          req.body = {};
+        }
+      }
+      void handleSlackActions(req, res);
+    });
+  });
+  app.use(express.json({
+    strict: true,
+    limit: "1mb",
+    verify: (req, _res, buf) => {
+      req.rawBody = buf;
+    }
+  }));
+  app.use(auditMiddleware);
+  app.use(helmet({ contentSecurityPolicy: false, crossOriginEmbedderPolicy: false }));
+  const STRICT_CSP = "default-src 'none'; frame-ancestors 'none'";
+  const CSP_EXEMPT_PREFIXES = [
+    "/dashboard",
+    "/setup",
+    "/demo",
+    "/sdk",
+    // UI with external scripts
+    "/feedback",
+    "/billing",
+    // pages with external embeds
+    "/slack/actions",
+    // form redirect targets
+    "/hitl/approve",
+    "/hitl/deny",
+    // HTML confirmation pages
+    "/activate",
+    // device-flow activation page (inline poll script)
+    "/device"
+    // local auth-stub approval page (inline script)
+  ];
+  app.use((req, res, next) => {
+    const isExempt = CSP_EXEMPT_PREFIXES.some(
+      (p) => req.path === p || req.path.startsWith(p + "/") || req.path.startsWith(p + "?")
+    );
+    if (!isExempt) {
+      res.setHeader("Content-Security-Policy", STRICT_CSP);
+    }
+    next();
+  });
+  const _lsBucket = { count: 0, resetAt: 0 };
+  app.get("/local-secret", (_req, res) => {
+    if (bindHost !== "127.0.0.1") {
+      res.status(404).json({ error: "not available in team mode" });
+      return;
+    }
+    const now = Date.now();
+    if (now > _lsBucket.resetAt) {
+      _lsBucket.count = 0;
+      _lsBucket.resetAt = now + 1e3;
+    }
+    if (++_lsBucket.count > 10) {
+      res.status(429).json({ error: "rate limit exceeded" });
+      return;
+    }
+    res.setHeader("Cache-Control", "no-store");
+    res.setHeader("Access-Control-Allow-Origin", "null");
+    res.json({ secret: localSecret });
+  });
+  let allowedOrigins = null;
+  if (process.env.MERGEN_ALLOWED_ORIGINS) {
+    const validated = process.env.MERGEN_ALLOWED_ORIGINS.split(",").map((s) => s.trim()).filter((s) => {
+      try {
+        new URL(s);
+        return true;
+      } catch {
+        logger.warn({ origin: s }, "CORS: invalid origin in MERGEN_ALLOWED_ORIGINS \u2014 skipped");
+        return false;
+      }
+    });
+    allowedOrigins = new Set(validated);
+  }
+  if (bindHost !== "127.0.0.1" && !allowedOrigins) {
+    logger.error(
+      "FATAL: MERGEN_BIND is not 127.0.0.1 (team/cloud mode) but MERGEN_ALLOWED_ORIGINS is not set. Set MERGEN_ALLOWED_ORIGINS=https://your-dashboard.example.com to restrict cross-origin access, then restart."
+    );
+    process.exit(1);
+  }
+  app.use((req, res, next) => {
+    const origin = req.headers.origin;
+    if (bindHost === "127.0.0.1") {
+      res.setHeader("Access-Control-Allow-Origin", "*");
+    } else if (allowedOrigins) {
+      if (origin && allowedOrigins.has(origin)) {
+        res.setHeader("Access-Control-Allow-Origin", origin);
+        res.setHeader("Vary", "Origin");
+      }
+    } else {
+      res.setHeader("Access-Control-Allow-Origin", "*");
+    }
+    res.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type, x-mergen-secret, x-api-key");
+    next();
+  });
+  if (bindHost === "127.0.0.1") {
+    app.use((req, res, next) => {
+      if (req.method === "OPTIONS") {
+        next();
+        return;
+      }
+      const raw = req.headers.host ?? "";
+      const hostname = raw.replace(/^\[([^\]]+)\].*$/, "$1").split(":")[0];
+      const hostPort = raw.includes(":") ? raw.split(":").pop() : null;
+      if (!LOCAL_HOSTNAMES.has(hostname) || hostPort !== null && hostPort !== String(port)) {
+        res.status(421).json({ error: "misdirected request" });
+        return;
+      }
+      next();
+    });
+  }
+  app.options("*", (_req, res) => res.status(204).end());
+  const RATE_WINDOW_MS = 6e4;
+  const RATE_MAX = 600;
+  const _ipBuckets = new LRUCache({ max: 1e4 });
+  const TRUST_PROXY = process.env.MERGEN_TRUSTED_PROXY === "true" && bindHost !== "127.0.0.1";
+  function getClientIp(req) {
+    if (TRUST_PROXY) {
+      const xff = req.headers["x-forwarded-for"];
+      const raw = (Array.isArray(xff) ? xff[0] : xff ?? "").split(",")[0].trim();
+      if (raw) return raw.replace(/^::ffff:/, "");
+    }
+    return (req.socket.remoteAddress ?? "unknown").replace(/^::ffff:/, "");
+  }
+  app.use((req, res, next) => {
+    if (req.path === "/ingest" || req.path.startsWith("/v1/")) {
+      next();
+      return;
+    }
+    const ip = getClientIp(req);
+    const now = Date.now();
+    let bucket = _ipBuckets.get(ip);
+    if (!bucket || now > bucket.resetAt) {
+      bucket = { count: 0, resetAt: now + RATE_WINDOW_MS };
+      _ipBuckets.set(ip, bucket);
+    }
+    if (++bucket.count > RATE_MAX) {
+      res.status(429).json({ error: "rate limit exceeded" });
+      return;
+    }
+    next();
+  });
+  app.use(ssoMiddleware);
+  app.use(idpIdentityMiddleware());
+  app.use((req, res, next) => {
+    if (req.method === "GET" || req.method === "OPTIONS") {
+      next();
+      return;
+    }
+    if (!MUTATING_PATHS.some((p) => req.path === p || req.path.startsWith(p + "/"))) {
+      next();
+      return;
+    }
+    const presented = req.headers["x-mergen-secret"];
+    if (!timingSafeSecretEqualAny(presented, localSecret)) {
+      res.status(401).json({ error: "unauthorized" });
+      return;
+    }
+    next();
+  });
+  const SENSITIVE_GET_PATHS = [
+    "/api/war-room",
+    // incident attribution + Slack thread history
+    "/sessions",
+    // session event replay + per-session threat-graph (call ring, verdicts, attack chains)
+    "/audit",
+    // audit log
+    "/license",
+    // plan, customer email, activation date
+    "/agent-blunders",
+    // blocked command history — reveals system constraints
+    "/incidents",
+    // live incident list + MTTR data
+    "/override-corpus",
+    // team's operational override knowledge
+    "/shadow-report/entries",
+    // shadow log entries with proposed commands
+    "/impact-report",
+    // autonomous resolution rate + MTTR metrics
+    "/hitl/pending",
+    // currently-held gate tokens + policy reasons
+    "/hitl/fatigue",
+    // HITL fatigue status — operational posture signal
+    "/gate-analytics",
+    // retry success rates, coverage gaps, HITL decision patterns
+    "/policies",
+    // policy rules + trigger counts — reveals enforcement posture
+    "/policy-suggestions",
+    // auto-discovered blunder patterns — reveals enforcement gaps
+    "/audit/export",
+    // full compliance export — tamper-evident audit log
+    "/agents",
+    // per-agent identity + forensics timeline
+    "/activity-feed",
+    // live tool call stream — reveals agent activity patterns
+    "/risk-report",
+    // CISO-grade security risk report — reveals incident rates & rules
+    "/compliance/report",
+    // SOC2-structured report — RBAC membership, policy rules, blocked-action counts
+    "/replay",
+    // runtime replay — full gate-event + blunder-log timeline for a trace
+    "/analytics",
+    // approval analytics — blocked action history + rule override rates
+    "/rbac",
+    // RBAC roster — who's an admin, useful recon for identity-spoofing attempts
+    "/credentials",
+    // configured credential-broker scope names — recon for cross-tenant/scope guessing
+    "/activate"
+    // device-flow activation page — embeds the local secret for its poll script
+  ];
+  if (localSecret) {
+    app.use((req, res, next) => {
+      if (req.method !== "GET") {
+        next();
+        return;
+      }
+      if (!SENSITIVE_GET_PATHS.some((p) => req.path === p || req.path.startsWith(p + "/"))) {
+        next();
+        return;
+      }
+      const qSecret = req.query["secret"];
+      const presented = req.headers["x-mergen-secret"] ?? (typeof qSecret === "string" ? qSecret : void 0);
+      const valid = timingSafeSecretEqualAny(presented, localSecret);
+      if (!valid) {
+        res.status(401).json({ error: "unauthorized" });
+        return;
+      }
+      next();
+    });
+  }
+  app.use(createDashboardRouter(serverVersion, localSecret));
+  app.use(createSetupRouter());
+  app.use(createDemoRouter());
+  app.use(createSdkRouter());
+  app.use(createSensorRouter(serverVersion));
+  app.use(createLicenseRouter());
+  if (process.env.MERGEN_AUTH_STUB === "true") app.use(createDeviceAuthStubRouter());
+  app.use(createCalibrationRouter());
+  app.use(createTelemetryRouter());
+  app.use(teamRouter);
+  app.use("/ingest", cloudAuthMiddleware);
+  app.use("/v1", cloudAuthMiddleware);
+  app.use(createIngestRouter(localSecret));
+  app.use(layersRouter);
+  app.use(otelRouter);
+  app.use(otlpReceiverRouter);
+  app.use(createCIRouter());
+  app.use(createIncidentsRouter());
+  app.use(createTicketsRouter());
+  app.use(createValidateRouter());
+  app.use(createSessionsRouter());
+  if (CLOUD_MODE) app.use("/incident", cloudAuthMiddleware);
+  app.use(createIncidentWebhookRouter());
+  app.use(createHeartbeatsRouter());
+  app.use(createWarRoomRouter());
+  app.use(createSlackRoutingRouter());
+  app.use(createApiKeysRouter());
+  app.use(createTenantsRouter());
+  app.use(createRbacRouter());
+  app.use(createOverridesRouter());
+  app.use(createShadowReportRouter());
+  app.use(createDecisionMemoryRouter());
+  app.use(createPRShadowRouter());
+  app.use(createImpactReportRouter());
+  app.use(createBillingOutcomeRouter());
+  app.use(createBillingDashboardRouter());
+  app.use(createOnboardingRouter());
+  app.use(createHealthIntegrationsRouter());
+  app.use(createTeamUsageRouter());
+  app.use(createActiveAuthorsRouter());
+  app.use(createPostmortemRouter());
+  app.use(createExplainWhyRouter());
+  app.use(createAgentBlundersRouter(localSecret));
+  app.use(createHabituationRouter());
+  app.use(createAdrRouter());
+  app.use(createConfidenceRouter());
+  app.use(createArchRouter());
+  app.use(createRunbooksRouter());
+  if (CLOUD_MODE) app.use("/ci/gate", cloudAuthMiddleware);
+  app.use(createCIGateRouter());
+  app.use(createCIGateHistoryRouter());
+  app.use(createHitlRouter(localSecret));
+  app.use(createGateAnalyticsRouter());
+  app.use(createPoliciesRouter(localSecret));
+  app.use(createRiskReportRouter());
+  app.use(createSafetyTestRouter());
+  app.use(createAgentActivityRouter());
+  app.use(createPolicyNlRouter());
+  app.use(createAgentsRouter());
+  app.use(createActivityFeedRouter());
+  app.use(createAuditExportRouter());
+  app.use(createGateRouter(port));
+  if (CLOUD_MODE) app.use("/credentials", cloudAuthMiddleware);
+  app.use(createCredentialsRouter(port));
+  app.use(createReplayRouter());
+  app.use(createOidcIssuerRouter());
+  app.use(createComplianceReportRouter());
+  app.get("/service-graph", ...CLOUD_MODE ? [cloudAuthMiddleware] : [], (_req, res) => {
+    res.json({ ok: true, graph: serviceGraph.toJSON() });
+  });
+  app.get("/route-reachability", ...CLOUD_MODE ? [cloudAuthMiddleware] : [], (_req, res) => {
+    res.json({ ok: true, ...routeReachability.toJSON() });
+  });
+  app.get("/metrics", ...CLOUD_MODE ? [cloudAuthMiddleware] : [], (_req, res) => {
+    res.setHeader("Content-Type", "text/plain; version=0.0.4; charset=utf-8");
+    res.send(getPrometheusMetrics());
+  });
+  app.get("/feedback", (req, res) => {
+    void handleFeedbackLink(req, res);
+  });
+  app.use(
+    (err, _req, res, next) => {
+      if (err.type === "entity.parse.failed") {
+        res.status(400).json({ error: "malformed JSON" });
+        return;
+      }
+      next(err);
+    }
+  );
+  return app;
+}
+export {
+  createApp
+};