mergen-server 1.4.0

package/dist/routes/credentials.js

@@ -0,0 +1,119 @@
+import { Router } from "express";
+import { z } from "zod";
+import { applyGate } from "../intelligence/tool-guard.js";
+import { requestEphemeralCredential, listConfiguredScopes } from "../intelligence/credential-broker.js";
+import { verifyToken } from "../intelligence/agent-identity.js";
+import { getActivePlanId } from "../intelligence/license.js";
+import { getPlan } from "../intelligence/plans.js";
+import { lookupAzureProxySession, revokeAzureProxySession } from "../intelligence/azure-proxy-sessions.js";
+import logger from "../sensor/logger.js";
+const RequestSchema = z.object({
+  scope: z.string().min(1),
+  taskId: z.string().min(1),
+  durationSeconds: z.number().int().positive().optional()
+});
+function createCredentialsRouter(port) {
+  const router = Router();
+  router.get("/credentials/scopes", (req, res) => {
+    res.json({ ok: true, scopes: listConfiguredScopes(req.tenantId) });
+  });
+  router.post("/credentials/request", async (req, res) => {
+    if (!getPlan(getActivePlanId()).capabilities.credentialBrokering) {
+      res.status(403).json({
+        error: "credentials: ephemeral credential brokering requires the Starter plan or above",
+        upgradeUrl: "https://mergen.app/pricing#starter"
+      });
+      return;
+    }
+    const parsed = RequestSchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: parsed.error.flatten() });
+      return;
+    }
+    const token = req.headers["x-mergen-agent-token"];
+    const verified = token ? verifyToken(token) : null;
+    if (!verified) {
+      res.status(401).json({
+        error: "credentials: a valid x-mergen-agent-token is required \u2014 see `mergen-server agent-register`"
+      });
+      return;
+    }
+    const { scope, taskId, durationSeconds } = parsed.data;
+    const next = async () => ({ content: [{ type: "text", text: "pass" }] });
+    const gateResult = await applyGate(
+      "request_credential",
+      // Pass the full request (scope, taskId, duration) through the gate, not
+      // just scope+agentId, so an operator can scope a policy rule on the task
+      // or requested duration — the gate evaluates every string arg.
+      { scope, taskId, durationSeconds, agentId: verified.agentId },
+      next,
+      port,
+      { verifiedAgentId: verified.agentId, verifiedParentAgentId: verified.parentAgentId }
+    );
+    if (gateResult.isError) {
+      res.status(403).json({ error: "credentials: request blocked by policy", detail: gateResult.content[0]?.text ?? null });
+      return;
+    }
+    try {
+      const cred = await requestEphemeralCredential({
+        agentId: verified.agentId,
+        taskId,
+        scope,
+        durationSeconds,
+        callerTenantId: req.tenantId
+      });
+      res.json({ ok: true, ...cred, expiration: cred.expiration.toISOString() });
+    } catch (err) {
+      res.status(400).json({ error: err instanceof Error ? err.message : String(err) });
+    }
+  });
+  router.delete("/credentials/azure-proxy/:proxyToken", (req, res) => {
+    const revoked = revokeAzureProxySession(req.params.proxyToken);
+    if (!revoked) {
+      res.status(404).json({ error: "unknown azure proxy token" });
+      return;
+    }
+    res.json({ ok: true, revoked: true });
+  });
+  router.all("/credentials/azure-proxy/:proxyToken/*", async (req, res) => {
+    const lookup = lookupAzureProxySession(req.params.proxyToken);
+    if (lookup.status === "not_found") {
+      res.status(401).json({ error: "unknown azure proxy token" });
+      return;
+    }
+    if (lookup.status === "revoked") {
+      res.status(410).json({ error: "azure proxy token has been revoked" });
+      return;
+    }
+    if (lookup.status === "expired") {
+      res.status(410).json({ error: "azure proxy token has expired" });
+      return;
+    }
+    const { session } = lookup;
+    const restPath = req.params[0] ?? "";
+    const queryString = req.url.includes("?") ? req.url.slice(req.url.indexOf("?")) : "";
+    const targetUrl = `${session.azureApiBase.replace(/\/$/, "")}/${restPath}${queryString}`;
+    try {
+      const upstream = await fetch(targetUrl, {
+        method: req.method,
+        headers: {
+          "Authorization": `Bearer ${session.azureAccessToken}`,
+          "Content-Type": req.headers["content-type"] ?? "application/json"
+        },
+        body: ["GET", "HEAD"].includes(req.method) ? void 0 : JSON.stringify(req.body ?? {}),
+        signal: AbortSignal.timeout(3e4)
+      });
+      const text = await upstream.text();
+      const contentType = upstream.headers.get("content-type");
+      if (contentType) res.setHeader("content-type", contentType);
+      res.status(upstream.status).send(text);
+    } catch (err) {
+      logger.warn({ err, targetUrl }, "credentials: azure-proxy upstream request failed");
+      res.status(502).json({ error: `azure-proxy: upstream request failed: ${err instanceof Error ? err.message : String(err)}` });
+    }
+  });
+  return router;
+}
+export {
+  createCredentialsRouter
+};