nebula-notebook 0.1.0

package/node-server/dist/auth/auth-service.js

@@ -0,0 +1,265 @@
+"use strict";
+/**
+ * Auth Service - TOTP-based 2FA authentication
+ *
+ * Handles:
+ * - TOTP secret generation and verification
+ * - JWT session token management
+ * - Auth config persistence (~/.nebula/auth.json)
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authService = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const otplib_1 = require("otplib");
+const jwt = __importStar(require("jsonwebtoken"));
+const qrcode = __importStar(require("qrcode-terminal"));
+// Config file location
+const NEBULA_DIR = path.join(os.homedir(), '.nebula');
+const AUTH_CONFIG_FILE = path.join(NEBULA_DIR, 'auth.json');
+// JWT settings
+const JWT_SECRET_LENGTH = 64;
+const SHORT_SESSION_HOURS = 24;
+const LONG_SESSION_DAYS = 30;
+// Rate limiting: max 5 attempts per 30 seconds
+const MAX_ATTEMPTS = 5;
+const WINDOW_MS = 30000;
+// Temporary debugging setting: accept up to five TOTP steps before and after
+// current time while investigating clock skew and login flow issues.
+const TOTP_WINDOW_STEPS = 5;
+otplib_1.authenticator.options = {
+    ...otplib_1.authenticator.options,
+    window: [TOTP_WINDOW_STEPS, TOTP_WINDOW_STEPS],
+};
+class AuthService {
+    config = null;
+    initialized = false;
+    failedAttempts = []; // timestamps of failed attempts
+    disabled = false;
+    /**
+     * Disable authentication (for local/dev usage only)
+     */
+    disableAuth() {
+        this.disabled = true;
+    }
+    isAuthDisabled() {
+        return this.disabled;
+    }
+    /**
+     * Initialize the auth service
+     * Returns true if setup is needed (first run)
+     */
+    async initialize() {
+        if (this.initialized) {
+            return !this.config?.setupComplete;
+        }
+        if (this.disabled) {
+            this.initialized = true;
+            return false;
+        }
+        // Ensure .nebula directory exists
+        if (!fs.existsSync(NEBULA_DIR)) {
+            fs.mkdirSync(NEBULA_DIR, { recursive: true, mode: 0o700 });
+        }
+        // Try to load existing config
+        if (fs.existsSync(AUTH_CONFIG_FILE)) {
+            try {
+                const data = fs.readFileSync(AUTH_CONFIG_FILE, 'utf-8');
+                this.config = JSON.parse(data);
+                this.initialized = true;
+                return !this.config.setupComplete;
+            }
+            catch (err) {
+                console.error('[Auth] Failed to load auth config:', err);
+            }
+        }
+        // No config exists - generate new secrets
+        this.config = {
+            totpSecret: otplib_1.authenticator.generateSecret(),
+            jwtSecret: this.generateJWTSecret(),
+            setupComplete: false,
+            createdAt: Date.now(),
+        };
+        // Save immediately so secret persists across restarts during setup
+        this.saveConfig();
+        this.initialized = true;
+        return true; // Setup needed
+    }
+    /**
+     * Generate a secure random JWT secret
+     */
+    generateJWTSecret() {
+        const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+        let result = '';
+        const randomBytes = require('crypto').randomBytes(JWT_SECRET_LENGTH);
+        for (let i = 0; i < JWT_SECRET_LENGTH; i++) {
+            result += chars[randomBytes[i] % chars.length];
+        }
+        return result;
+    }
+    /**
+     * Save config to disk with secure permissions
+     */
+    saveConfig() {
+        if (!this.config)
+            return;
+        fs.writeFileSync(AUTH_CONFIG_FILE, JSON.stringify(this.config, null, 2), {
+            mode: 0o600, // Owner read/write only
+        });
+    }
+    /**
+     * Print QR code and manual key to terminal for initial setup
+     */
+    printSetupInstructions() {
+        if (!this.config) {
+            console.error('[Auth] Cannot print setup - not initialized');
+            return;
+        }
+        const issuer = 'NebulaNotebook';
+        const accountName = 'local';
+        const otpAuthUrl = otplib_1.authenticator.keyuri(accountName, issuer, this.config.totpSecret);
+        console.log('\n' + '='.repeat(60));
+        console.log('  NEBULA NOTEBOOK - 2FA SETUP');
+        console.log('='.repeat(60));
+        console.log('\nScan this QR code with your authenticator app:\n');
+        // Print QR code to terminal
+        qrcode.generate(otpAuthUrl, { small: true });
+        console.log('\nOr enter this key manually: ' + this.config.totpSecret);
+        console.log('\nThen open the Nebula UI and enter the 6-digit code.');
+        console.log('='.repeat(60) + '\n');
+    }
+    /**
+     * Check if 2FA setup is complete
+     */
+    isSetupComplete() {
+        if (this.disabled) {
+            return true;
+        }
+        return this.config?.setupComplete ?? false;
+    }
+    /**
+     * Verify a TOTP code and issue a JWT token
+     */
+    verifyCode(code, trustBrowser = false) {
+        if (!this.config) {
+            return { success: false, error: 'Auth not initialized' };
+        }
+        // Rate limiting: clean old attempts and check
+        const now = Date.now();
+        this.failedAttempts = this.failedAttempts.filter(t => now - t < WINDOW_MS);
+        if (this.failedAttempts.length >= MAX_ATTEMPTS) {
+            const oldestAttempt = this.failedAttempts[0];
+            const waitSeconds = Math.ceil((WINDOW_MS - (now - oldestAttempt)) / 1000);
+            return { success: false, error: `Too many attempts. Try again in ${waitSeconds}s` };
+        }
+        // Verify TOTP code
+        const isValid = otplib_1.authenticator.verify({
+            token: code,
+            secret: this.config.totpSecret,
+        });
+        if (!isValid) {
+            this.failedAttempts.push(now);
+            const remaining = MAX_ATTEMPTS - this.failedAttempts.length;
+            return { success: false, error: `Invalid code. ${remaining} attempts remaining` };
+        }
+        // Success - clear failed attempts
+        this.failedAttempts = [];
+        // Mark setup as complete on first successful verification
+        if (!this.config.setupComplete) {
+            this.config.setupComplete = true;
+            this.saveConfig();
+            console.log('[Auth] Setup complete - first verification successful');
+        }
+        // Issue JWT token
+        const token = this.issueToken(trustBrowser);
+        return { success: true, token };
+    }
+    /**
+     * Issue a new JWT token
+     */
+    issueToken(trusted) {
+        if (!this.config) {
+            throw new Error('Auth not initialized');
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const expiresIn = trusted
+            ? LONG_SESSION_DAYS * 24 * 60 * 60 // 30 days
+            : SHORT_SESSION_HOURS * 60 * 60; // 24 hours
+        const payload = {
+            iat: now,
+            exp: now + expiresIn,
+            trusted,
+        };
+        return jwt.sign(payload, this.config.jwtSecret);
+    }
+    /**
+     * Validate a JWT token
+     * Returns the payload if valid, null if invalid
+     */
+    validateToken(token) {
+        if (!this.config) {
+            return null;
+        }
+        try {
+            const payload = jwt.verify(token, this.config.jwtSecret);
+            return payload;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Get auth status for a request
+     */
+    getAuthStatus(token) {
+        if (this.disabled) {
+            return { configured: true, authenticated: true };
+        }
+        const configured = this.config?.setupComplete ?? false;
+        const authenticated = token ? this.validateToken(token) !== null : false;
+        return { configured, authenticated };
+    }
+    /**
+     * Get the TOTP secret (for testing only)
+     * @internal
+     */
+    _getTotpSecret() {
+        return this.config?.totpSecret ?? null;
+    }
+}
+// Export singleton instance
+exports.authService = new AuthService();

package/node-server/dist/auth/index.d.ts

@@ -0,0 +1,3 @@
+export { authService } from './auth-service';
+export type { AuthConfig, AuthStatus, VerifyResult, JWTPayload } from './auth-service';
+export { authMiddleware, authWebSocketMiddleware } from './auth-middleware';

package/node-server/dist/auth/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authWebSocketMiddleware = exports.authMiddleware = exports.authService = void 0;
+var auth_service_1 = require("./auth-service");
+Object.defineProperty(exports, "authService", { enumerable: true, get: function () { return auth_service_1.authService; } });
+var auth_middleware_1 = require("./auth-middleware");
+Object.defineProperty(exports, "authMiddleware", { enumerable: true, get: function () { return auth_middleware_1.authMiddleware; } });
+Object.defineProperty(exports, "authWebSocketMiddleware", { enumerable: true, get: function () { return auth_middleware_1.authWebSocketMiddleware; } });

package/node-server/dist/cluster/client-registration.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Client Registration
+ *
+ * Handles auto-registration with a main server when this server
+ * is started as a client/peer in a cluster.
+ */
+declare class ClientRegistration {
+    private config;
+    private heartbeatInterval;
+    private registrationRetryTimeout;
+    private registered;
+    private serverId;
+    /**
+     * Initialize client registration from environment variables
+     */
+    initFromEnv(localPort: number): void;
+    /**
+     * Register with the main server
+     */
+    private register;
+    /**
+     * Start heartbeat interval
+     */
+    private startHeartbeat;
+    /**
+     * Send heartbeat to main server
+     */
+    private sendHeartbeat;
+    /**
+     * Unregister from main server (called on shutdown)
+     */
+    shutdown(): Promise<void>;
+    /**
+     * Check if we're running as a client (registered with main server)
+     */
+    isClient(): boolean;
+    /**
+     * Get main server URL (if we're a client)
+     */
+    getMainServerUrl(): string | null;
+}
+export declare const clientRegistration: ClientRegistration;
+export {};

package/node-server/dist/cluster/client-registration.js

@@ -0,0 +1,217 @@
+"use strict";
+/**
+ * Client Registration
+ *
+ * Handles auto-registration with a main server when this server
+ * is started as a client/peer in a cluster.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clientRegistration = void 0;
+const server_registry_1 = require("./server-registry");
+const resource_service_1 = require("../resources/resource-service");
+const os = __importStar(require("os"));
+const HEARTBEAT_INTERVAL_MS = 30_000; // 30 seconds
+const REGISTRATION_RETRY_MS = 10_000; // 10 seconds retry on failure
+class ClientRegistration {
+    config = null;
+    heartbeatInterval = null;
+    registrationRetryTimeout = null;
+    registered = false;
+    serverId = null;
+    /**
+     * Initialize client registration from environment variables
+     */
+    initFromEnv(localPort) {
+        const mainServerUrl = process.env.NEBULA_MAIN_SERVER;
+        if (!mainServerUrl) {
+            console.log('[ClientRegistration] No NEBULA_MAIN_SERVER set, running as standalone');
+            return;
+        }
+        const localHost = process.env.NEBULA_HOST || os.hostname();
+        const serverName = process.env.NEBULA_SERVER_NAME || os.hostname();
+        const secret = process.env.NEBULA_CLUSTER_SECRET;
+        this.config = {
+            mainServerUrl: mainServerUrl.replace(/\/$/, ''), // Remove trailing slash
+            localHost,
+            localPort,
+            serverName,
+            secret,
+        };
+        // Set local server ID
+        const serverId = `${localHost}:${localPort}`;
+        server_registry_1.serverRegistry.setLocalServerId(serverId);
+        console.log(`[ClientRegistration] Will register with main server: ${mainServerUrl}`);
+        console.log(`[ClientRegistration] Local server ID: ${serverId}`);
+        // Start registration
+        this.register();
+    }
+    /**
+     * Register with the main server
+     */
+    async register() {
+        if (!this.config)
+            return;
+        try {
+            // Get resources to send with registration
+            const resourceService = (0, resource_service_1.getResourceService)();
+            const resources = resourceService.getResources();
+            const headers = { 'Content-Type': 'application/json' };
+            if (this.config.secret) {
+                headers['X-Nebula-Cluster-Secret'] = this.config.secret;
+            }
+            const response = await fetch(`${this.config.mainServerUrl}/api/servers/register`, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify({
+                    host: this.config.localHost,
+                    port: this.config.localPort,
+                    name: this.config.serverName,
+                    secret: this.config.secret,
+                    resources, // Include resources in registration
+                }),
+            });
+            if (!response.ok) {
+                const errorData = await response.json().catch(() => ({ error: 'Unknown error' }));
+                throw new Error(errorData.error || `HTTP ${response.status}`);
+            }
+            const result = await response.json();
+            this.serverId = result.serverId;
+            this.registered = true;
+            console.log(`[ClientRegistration] Successfully registered as ${this.serverId}`);
+            // Start heartbeat interval
+            this.startHeartbeat();
+            // Send immediate heartbeat to ensure resources are available right away
+            this.sendHeartbeat();
+        }
+        catch (error) {
+            console.error(`[ClientRegistration] Registration failed:`, error);
+            console.log(`[ClientRegistration] Retrying in ${REGISTRATION_RETRY_MS / 1000}s...`);
+            // Retry registration
+            this.registrationRetryTimeout = setTimeout(() => {
+                this.register();
+            }, REGISTRATION_RETRY_MS);
+        }
+    }
+    /**
+     * Start heartbeat interval
+     */
+    startHeartbeat() {
+        if (this.heartbeatInterval) {
+            clearInterval(this.heartbeatInterval);
+        }
+        this.heartbeatInterval = setInterval(async () => {
+            await this.sendHeartbeat();
+        }, HEARTBEAT_INTERVAL_MS);
+    }
+    /**
+     * Send heartbeat to main server
+     */
+    async sendHeartbeat() {
+        if (!this.config || !this.serverId)
+            return;
+        try {
+            // Get resources (cached, never blocks)
+            const resourceService = (0, resource_service_1.getResourceService)();
+            const resources = resourceService.getResources();
+            const headers = { 'Content-Type': 'application/json' };
+            if (this.config.secret) {
+                headers['X-Nebula-Cluster-Secret'] = this.config.secret;
+            }
+            const response = await fetch(`${this.config.mainServerUrl}/api/servers/${encodeURIComponent(this.serverId)}/heartbeat`, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify({ resources }),
+            });
+            if (!response.ok) {
+                // If server not found, try to re-register
+                if (response.status === 404) {
+                    console.log('[ClientRegistration] Server not found on main, re-registering...');
+                    this.registered = false;
+                    this.register();
+                }
+            }
+        }
+        catch (error) {
+            console.error('[ClientRegistration] Heartbeat failed:', error);
+        }
+    }
+    /**
+     * Unregister from main server (called on shutdown)
+     */
+    async shutdown() {
+        // Clear intervals
+        if (this.heartbeatInterval) {
+            clearInterval(this.heartbeatInterval);
+            this.heartbeatInterval = null;
+        }
+        if (this.registrationRetryTimeout) {
+            clearTimeout(this.registrationRetryTimeout);
+            this.registrationRetryTimeout = null;
+        }
+        // Unregister from main server
+        if (this.config && this.serverId && this.registered) {
+            try {
+                const headers = { 'Content-Type': 'application/json' };
+                if (this.config.secret) {
+                    headers['X-Nebula-Cluster-Secret'] = this.config.secret;
+                }
+                await fetch(`${this.config.mainServerUrl}/api/servers/${encodeURIComponent(this.serverId)}`, {
+                    method: 'DELETE',
+                    headers,
+                    body: JSON.stringify({ secret: this.config.secret }),
+                });
+                console.log('[ClientRegistration] Unregistered from main server');
+            }
+            catch (error) {
+                console.error('[ClientRegistration] Failed to unregister:', error);
+            }
+        }
+    }
+    /**
+     * Check if we're running as a client (registered with main server)
+     */
+    isClient() {
+        return this.config !== null;
+    }
+    /**
+     * Get main server URL (if we're a client)
+     */
+    getMainServerUrl() {
+        return this.config?.mainServerUrl || null;
+    }
+}
+// Global singleton
+exports.clientRegistration = new ClientRegistration();

package/node-server/dist/cluster/cluster-secret.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Cluster Secret
+ *
+ * Shared secret for inter-server auth in client mode.
+ * Stored at ~/.nebula/cluster.json with 0600 perms.
+ */
+export declare function readClusterSecret(): string | null;
+export declare function writeClusterSecret(secret: string): void;
+export declare function getOrCreateClusterSecret({ allowCreate }: {
+    allowCreate: boolean;
+}): string | null;

package/node-server/dist/cluster/cluster-secret.js

@@ -0,0 +1,90 @@
+"use strict";
+/**
+ * Cluster Secret
+ *
+ * Shared secret for inter-server auth in client mode.
+ * Stored at ~/.nebula/cluster.json with 0600 perms.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readClusterSecret = readClusterSecret;
+exports.writeClusterSecret = writeClusterSecret;
+exports.getOrCreateClusterSecret = getOrCreateClusterSecret;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const crypto_1 = require("crypto");
+const NEBULA_DIR = path.join(os.homedir(), '.nebula');
+const CLUSTER_CONFIG_FILE = path.join(NEBULA_DIR, 'cluster.json');
+function ensureNebulaDir() {
+    if (!fs.existsSync(NEBULA_DIR)) {
+        fs.mkdirSync(NEBULA_DIR, { recursive: true, mode: 0o700 });
+    }
+}
+function readClusterSecret() {
+    try {
+        if (!fs.existsSync(CLUSTER_CONFIG_FILE)) {
+            return null;
+        }
+        const data = fs.readFileSync(CLUSTER_CONFIG_FILE, 'utf-8');
+        const parsed = JSON.parse(data);
+        return parsed.secret || null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeClusterSecret(secret) {
+    ensureNebulaDir();
+    const payload = {
+        secret,
+        createdAt: Date.now(),
+    };
+    fs.writeFileSync(CLUSTER_CONFIG_FILE, JSON.stringify(payload, null, 2), {
+        mode: 0o600,
+    });
+}
+function getOrCreateClusterSecret({ allowCreate }) {
+    const existing = readClusterSecret();
+    if (existing) {
+        return existing;
+    }
+    if (!allowCreate) {
+        return null;
+    }
+    const secret = (0, crypto_1.randomBytes)(32).toString('hex');
+    writeClusterSecret(secret);
+    return secret;
+}