miravo 0.6.0 → 0.6.1

package/src/lib/admin-auth.ts

@@ -1,157 +0,0 @@
-/**
- * Auth route handlers for the Miravo admin server.
- *
- * Each exported function handles a single auth endpoint and returns a Response.
- */
-
-import { ChangePasswordRequestSchema, LoginRequestSchema } from "@miravo/shared";
-import { checkContentType, jsonResponse } from "./admin-responses.ts";
-import type { SessionStore } from "./session-store.ts";
-import { buildClearCookie, buildSessionCookie, extractSessionId } from "./session-store.ts";
-
-/** Minimal auth configuration needed by auth handlers. */
-interface AuthConfig {
-  readonly verifyPassword: (password: string) => Promise<boolean>;
-  readonly isDefaultPassword: boolean;
-  readonly sessionStore: SessionStore;
-  readonly changePassword: (oldPassword: string, newPassword: string) => Promise<void>;
-  readonly anonymousMode?: boolean;
-}
-
-/**
- * POST /auth/login
- * Validates credentials and sets a session cookie on success.
- */
-export async function handleLogin(request: Request, auth: AuthConfig): Promise<Response> {
-  if (auth.anonymousMode) {
-    const session = auth.sessionStore.create("anonymous");
-    return new Response(JSON.stringify({ ok: true, changePassword: false }), {
-      status: 200,
-      headers: {
-        "content-type": "application/json; charset=utf-8",
-        "set-cookie": buildSessionCookie(session.id),
-        "cache-control": "no-store",
-      },
-    });
-  }
-
-  const ctBlock = checkContentType(request);
-  if (ctBlock) return ctBlock;
-
-  let payload: unknown;
-  try {
-    payload = await request.json();
-  } catch {
-    return jsonResponse({ message: "Invalid JSON.", error: "Send valid JSON." }, 400);
-  }
-
-  const validation = LoginRequestSchema.safeParse(payload);
-  if (!validation.success) {
-    return jsonResponse(
-      { message: "Invalid login request.", error: "Provide username and password." },
-      400,
-    );
-  }
-  if (validation.data.username !== "admin") {
-    return jsonResponse(
-      { message: "Invalid credentials.", error: "Check username and password." },
-      401,
-    );
-  }
-  const passwordValid = await auth.verifyPassword(validation.data.password);
-  if (!passwordValid) {
-    return jsonResponse(
-      { message: "Invalid credentials.", error: "Check username and password." },
-      401,
-    );
-  }
-
-  const session = auth.sessionStore.create("admin");
-  return new Response(JSON.stringify({ ok: true, changePassword: auth.isDefaultPassword }), {
-    status: 200,
-    headers: {
-      "content-type": "application/json; charset=utf-8",
-      "set-cookie": buildSessionCookie(session.id),
-      "cache-control": "no-store",
-    },
-  });
-}
-
-/**
- * POST /auth/logout
- * Destroys the current session and clears the session cookie.
- */
-export function handleLogout(request: Request, auth: AuthConfig): Response {
-  const sessionId = extractSessionId(request);
-  if (sessionId) auth.sessionStore.destroy(sessionId);
-  return new Response(JSON.stringify({ ok: true }), {
-    status: 200,
-    headers: {
-      "content-type": "application/json; charset=utf-8",
-      "set-cookie": buildClearCookie(),
-      "cache-control": "no-store",
-    },
-  });
-}
-
-/**
- * PUT /auth/password
- * Changes the admin password. Requires an active session.
- * The caller is responsible for verifying the session before calling this handler.
- */
-export async function handlePasswordChange(request: Request, auth: AuthConfig): Promise<Response> {
-  const ctBlock = checkContentType(request);
-  if (ctBlock) return ctBlock;
-
-  let payload: unknown;
-  try {
-    payload = await request.json();
-  } catch {
-    return jsonResponse({ message: "Invalid JSON.", error: "Send valid JSON." }, 400);
-  }
-
-  const validation = ChangePasswordRequestSchema.safeParse(payload);
-  if (!validation.success) {
-    return jsonResponse(
-      {
-        message: "Invalid request.",
-        error: "Provide oldPassword and newPassword (min 6 chars).",
-      },
-      400,
-    );
-  }
-
-  try {
-    await auth.changePassword(validation.data.oldPassword, validation.data.newPassword);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : "Password change failed";
-    return jsonResponse({ message: msg, error: "Check old password." }, 400);
-  }
-
-  // Invalidate all existing sessions, then issue a fresh one for the caller
-  auth.sessionStore.clear();
-  const session = auth.sessionStore.create("admin");
-  return new Response(JSON.stringify({ ok: true }), {
-    status: 200,
-    headers: {
-      "content-type": "application/json",
-      "set-cookie": buildSessionCookie(session.id),
-    },
-  });
-}
-
-/**
- * GET /auth/status
- * Returns authentication state for the current session cookie.
- */
-export function handleAuthStatus(request: Request, auth: AuthConfig): Response {
-  if (auth.anonymousMode) {
-    return jsonResponse({ authenticated: true, username: "anonymous" }, 200);
-  }
-  const sessionId = extractSessionId(request);
-  const session = sessionId ? auth.sessionStore.validate(sessionId) : null;
-  if (session) {
-    return jsonResponse({ authenticated: true, username: session.username }, 200);
-  }
-  return jsonResponse({ authenticated: false }, 200);
-}

package/src/lib/admin-client.test.ts

@@ -1,51 +0,0 @@
-import { afterEach, describe, expect, test } from "bun:test";
-import type { EngineCommand } from "@miravo/shared";
-import { executeAdminCommand } from "./admin-client.ts";
-
-const originalFetch = globalThis.fetch;
-
-afterEach(() => {
-  globalThis.fetch = originalFetch;
-  delete Bun.env["MIRAVO_ADMIN_PASSWORD"];
-});
-
-describe("admin-client", () => {
-  test("authenticates via session login and sends cookie on command requests", async () => {
-    let loginCalled = false;
-    let commandCookie = "";
-
-    globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
-      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
-
-      // Login request
-      if (url.endsWith("/auth/login")) {
-        loginCalled = true;
-        return new Response(JSON.stringify({ ok: true, changePassword: false }), {
-          status: 200,
-          headers: { "set-cookie": "miravo_session=test-session-id; HttpOnly; Path=/" },
-        });
-      }
-
-      // Command request — verify session cookie is sent
-      if (url.endsWith("/commands")) {
-        commandCookie = (init?.headers as Record<string, string>)?.["cookie"] ?? "";
-        return Response.json({
-          success: true,
-          command: "pause",
-          correlationId: "req-1",
-          message: "paused",
-        });
-      }
-
-      return Response.json({ message: "Not found" }, { status: 404 });
-    }) as typeof fetch;
-
-    const command: EngineCommand = { type: "pause", correlationId: "req-1" };
-    const result = await executeAdminCommand("http://127.0.0.1:8080", command, 1_000);
-
-    expect(loginCalled).toBe(true);
-    expect(commandCookie).toBe("miravo_session=test-session-id");
-    expect(result.success).toBe(true);
-    expect(result.command).toBe("pause");
-  });
-});

package/src/lib/admin-client.ts

@@ -1,326 +0,0 @@
-import type {
-  CommandResult,
-  EngineCommand,
-  EngineMetricsSnapshot,
-  EngineStateSnapshot,
-} from "@miravo/shared";
-import {
-  CommandResultSchema,
-  EngineMetricsSnapshotSchema,
-  EngineStateSnapshotSchema,
-  MiravoError,
-} from "@miravo/shared";
-import { loadCredential } from "./auth-store.ts";
-
-const DEFAULT_ADMIN_HOST = "127.0.0.1";
-const DEFAULT_ADMIN_PORT = 8080;
-
-interface SafeParseResult<T> {
-  readonly success: boolean;
-  readonly data?: T;
-}
-
-interface SafeParseSchema<T> {
-  safeParse(value: unknown): SafeParseResult<T>;
-}
-
-interface RequestJsonOptions<T> {
-  readonly baseUrl: string;
-  readonly path: string;
-  readonly timeoutMs: number;
-  readonly schema: SafeParseSchema<T>;
-  readonly method?: "GET" | "POST";
-  readonly body?: string;
-}
-
-function normalizeAdminHost(host: string): string {
-  return host === "0.0.0.0" || host === "::" ? DEFAULT_ADMIN_HOST : host;
-}
-
-function resolveAdminUrl(adminUrl?: string): string {
-  const explicitUrl = adminUrl ?? Bun.env["MIRAVO_ADMIN_URL"];
-  if (explicitUrl && explicitUrl.trim().length > 0) {
-    return parseAdminUrl(explicitUrl);
-  }
-
-  const hostValue = Bun.env["MIRAVO_ADMIN_HOST"] ?? DEFAULT_ADMIN_HOST;
-  if (hostValue.trim().length === 0) {
-    throw new MiravoError(
-      "Invalid MIRAVO_ADMIN_HOST environment variable: value is empty.",
-      "Set MIRAVO_ADMIN_HOST to a valid host such as 127.0.0.1 or 0.0.0.0.",
-    );
-  }
-  const host = normalizeAdminHost(hostValue);
-  const portValue = Bun.env["MIRAVO_ADMIN_PORT"];
-  if (!portValue) {
-    return `http://${host}:${DEFAULT_ADMIN_PORT}`;
-  }
-
-  const parsedPort = Number(portValue);
-  if (!Number.isInteger(parsedPort) || parsedPort < 1 || parsedPort > 65535) {
-    throw new MiravoError(
-      `Invalid MIRAVO_ADMIN_PORT environment variable: "${portValue}".`,
-      "Set MIRAVO_ADMIN_PORT to a valid port number between 1 and 65535.",
-    );
-  }
-
-  return `http://${host}:${parsedPort}`;
-}
-
-function parseAdminUrl(input: string): string {
-  let url: URL;
-  try {
-    url = new URL(input);
-  } catch {
-    throw new MiravoError(
-      `Invalid admin URL: "${input}".`,
-      "Pass --admin-url with a full HTTP URL such as http://127.0.0.1:8080.",
-    );
-  }
-
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new MiravoError(
-      `Invalid admin URL protocol: "${url.protocol}".`,
-      "Pass an HTTP or HTTPS URL such as http://127.0.0.1:8080.",
-    );
-  }
-
-  return url.toString().replace(/\/$/, "");
-}
-
-// ---------------------------------------------------------------------------
-// Session-based auth for CLI client
-// ---------------------------------------------------------------------------
-
-let sessionCookie: string | null = null;
-
-async function loginToAdmin(adminUrl: string): Promise<void> {
-  // Resolve password: env > file > default
-  const envPassword = Bun.env["MIRAVO_ADMIN_PASSWORD"];
-  let password = "admin";
-  if (envPassword && envPassword.trim().length > 0) {
-    password = envPassword;
-  } else {
-    const credential = await loadCredential();
-    // If credential file exists, we can't reverse the hash — use "admin" as default.
-    // The server will verify against the stored hash. If the user changed their password,
-    // they need to set MIRAVO_ADMIN_PASSWORD env var for CLI access.
-    if (!credential) {
-      password = "admin";
-    }
-  }
-
-  const response = await fetch(`${adminUrl}/auth/login`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ username: "admin", password }),
-    signal: AbortSignal.timeout(10_000),
-  });
-
-  if (!response.ok) {
-    throw new MiravoError(
-      "CLI authentication failed.",
-      "Set MIRAVO_ADMIN_PASSWORD or log in with default credentials (admin/admin).",
-    );
-  }
-
-  const setCookie = response.headers.get("set-cookie");
-  if (setCookie) {
-    // Extract just the cookie value (before first ;)
-    sessionCookie = setCookie.split(";")[0] ?? null;
-  }
-}
-
-async function ensureAuthenticated(adminUrl: string): Promise<void> {
-  if (sessionCookie) return;
-  await loginToAdmin(adminUrl);
-}
-
-function buildRequestHeaders(body?: string): Record<string, string> {
-  const headers: Record<string, string> = {};
-  if (body) {
-    headers["content-type"] = "application/json";
-  }
-  if (sessionCookie) {
-    headers["cookie"] = sessionCookie;
-  }
-  return headers;
-}
-
-async function requestJson<T>(options: RequestJsonOptions<T>): Promise<T> {
-  await ensureAuthenticated(options.baseUrl);
-  const requestUrl = new URL(options.path, `${options.baseUrl}/`).toString();
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), options.timeoutMs);
-
-  try {
-    let response: Response;
-    try {
-      response = await fetch(requestUrl, {
-        method: options.method ?? "GET",
-        headers: buildRequestHeaders(options.body),
-        body: options.body,
-        signal: controller.signal,
-      });
-    } catch (error) {
-      if (error instanceof DOMException && error.name === "AbortError") {
-        throw new MiravoError(
-          `Admin request to ${requestUrl} timed out after ${options.timeoutMs}ms.`,
-          "Check that Miravo is running and the admin URL is reachable.",
-        );
-      }
-
-      const message = error instanceof Error ? error.message : String(error);
-      throw new MiravoError(
-        `Admin request to ${requestUrl} failed: ${message}`,
-        "Check that Miravo is running and the admin URL is correct.",
-      );
-    }
-
-    // Re-authenticate on session expiry and retry once
-    if (response.status === 401) {
-      sessionCookie = null;
-      await loginToAdmin(options.baseUrl);
-      response = await fetch(requestUrl, {
-        method: options.method ?? "GET",
-        headers: buildRequestHeaders(options.body),
-        body: options.body,
-        signal: controller.signal,
-      });
-    }
-
-    const text = await response.text();
-    let parsedJson: unknown;
-    if (text.length > 0) {
-      try {
-        parsedJson = JSON.parse(text);
-      } catch {
-        throw new MiravoError(
-          `Admin server returned invalid JSON from ${requestUrl}.`,
-          "Check the Miravo admin server logs and retry.",
-        );
-      }
-    }
-
-    if (!response.ok) {
-      const details =
-        typeof parsedJson === "object" &&
-        parsedJson !== null &&
-        "message" in parsedJson &&
-        typeof (parsedJson as Record<string, unknown>)["message"] === "string"
-          ? String((parsedJson as Record<string, unknown>)["message"])
-          : `HTTP ${response.status}`;
-      const fix =
-        typeof parsedJson === "object" &&
-        parsedJson !== null &&
-        "error" in parsedJson &&
-        typeof (parsedJson as Record<string, unknown>)["error"] === "string"
-          ? String((parsedJson as Record<string, unknown>)["error"])
-          : "Check that Miravo is running and the admin request is valid.";
-      throw new MiravoError(`Admin request to ${requestUrl} failed: ${details}`, fix);
-    }
-
-    const validation = options.schema.safeParse(parsedJson);
-    if (!validation.success || validation.data === undefined) {
-      throw new MiravoError(
-        `Admin server returned an unexpected payload from ${requestUrl}.`,
-        "Check that the Miravo CLI and server are running the same version.",
-      );
-    }
-
-    return validation.data;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-async function getAdminMetrics(
-  adminUrl: string,
-  timeoutMs: number,
-): Promise<EngineMetricsSnapshot> {
-  return requestJson({
-    baseUrl: adminUrl,
-    path: "/metrics",
-    timeoutMs,
-    schema: EngineMetricsSnapshotSchema,
-  });
-}
-
-async function getAdminState(adminUrl: string, timeoutMs: number): Promise<EngineStateSnapshot> {
-  return requestJson({
-    baseUrl: adminUrl,
-    path: "/state",
-    timeoutMs,
-    schema: EngineStateSnapshotSchema,
-  });
-}
-
-async function getAdminSnapshot(
-  adminUrl: string,
-  timeoutMs: number,
-): Promise<{
-  readonly metrics: EngineMetricsSnapshot;
-  readonly state: EngineStateSnapshot;
-}> {
-  const [metrics, state] = await Promise.all([
-    getAdminMetrics(adminUrl, timeoutMs),
-    getAdminState(adminUrl, timeoutMs),
-  ]);
-  return { metrics, state };
-}
-
-async function executeAdminCommand(
-  adminUrl: string,
-  command: EngineCommand,
-  timeoutMs: number,
-): Promise<CommandResult> {
-  return requestJson({
-    baseUrl: adminUrl,
-    path: "/commands",
-    timeoutMs,
-    schema: CommandResultSchema,
-    method: "POST",
-    body: JSON.stringify(command),
-  });
-}
-
-/** Schema that accepts any JSON object — used for adapter introspection (protocol-specific shape). */
-const AnyObjectSchema = {
-  safeParse(value: unknown): SafeParseResult<Record<string, unknown>> {
-    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
-      return { success: true, data: value as Record<string, unknown> };
-    }
-    return { success: false };
-  },
-};
-
-async function getManifest(adminUrl: string, timeoutMs: number): Promise<Record<string, unknown>> {
-  return requestJson({
-    baseUrl: adminUrl,
-    path: "/manifest",
-    timeoutMs,
-    schema: AnyObjectSchema,
-  });
-}
-
-async function getLeDtJson(
-  adminUrl: string,
-  modelName: string,
-  timeoutMs: number,
-): Promise<Record<string, unknown>> {
-  return requestJson({
-    baseUrl: adminUrl,
-    path: `/catalog/models/${encodeURIComponent(modelName)}/le-dt.json`,
-    timeoutMs,
-    schema: AnyObjectSchema,
-  });
-}
-
-export {
-  executeAdminCommand,
-  getAdminSnapshot,
-  getAdminState,
-  getLeDtJson,
-  getManifest,
-  resolveAdminUrl,
-};