neoagent 2.4.1-beta.45 → 2.4.1-beta.46

package/server/admin/sql.js

@@ -0,0 +1,134 @@
+'use strict';
+
+// ── SQL Editor ─────────────────────────────────────────────────────────────
+
+const SQL_TEMPLATES = [
+  { label: '— Select a template —', query: '' },
+  { label: 'User summary',            query: `SELECT u.id, u.username, u.email,\n       u.created_at, u.last_login,\n       COUNT(DISTINCT r.id) AS runs,\n       COALESCE(SUM(r.total_tokens),0) AS tokens\nFROM users u\nLEFT JOIN agent_runs r ON r.user_id = u.id\nGROUP BY u.id\nORDER BY runs DESC\nLIMIT 50` },
+  { label: 'Recent failed runs',       query: `SELECT r.id, u.username, r.title, r.status,\n       r.error, r.created_at\nFROM agent_runs r\nJOIN users u ON u.id = r.user_id\nWHERE r.status = 'failed'\nORDER BY r.created_at DESC\nLIMIT 50` },
+  { label: 'Artifact storage by user', query: `SELECT u.username,\n       COUNT(a.id) AS files,\n       SUM(a.byte_size) AS bytes,\n       ROUND(SUM(a.byte_size) / 1048576.0, 2) AS mb\nFROM users u\nLEFT JOIN artifacts a ON a.user_id = u.id\nGROUP BY u.id\nORDER BY bytes DESC` },
+  { label: 'Active sessions',          query: `SELECT u.username, s.ip_address,\n       s.user_agent, s.created_at, s.last_seen_at\nFROM user_sessions s\nJOIN users u ON u.id = s.user_id\nWHERE s.revoked_at IS NULL\n  AND s.expires_at > datetime('now')\nORDER BY s.last_seen_at DESC\nLIMIT 50` },
+  { label: 'Runs per day (30 days)',   query: `SELECT DATE(created_at) AS day,\n       COUNT(*) AS runs,\n       COALESCE(SUM(total_tokens),0) AS tokens\nFROM agent_runs\nWHERE created_at >= datetime('now', '-30 days')\nGROUP BY day\nORDER BY day DESC` },
+  { label: 'Most used agents',         query: `SELECT a.slug, a.display_name, u.username AS owner,\n       COUNT(r.id) AS runs\nFROM agents a\nJOIN users u ON u.id = a.user_id\nLEFT JOIN agent_runs r ON r.agent_id = a.id\nGROUP BY a.id\nORDER BY runs DESC\nLIMIT 20` },
+  { label: 'Integration connections',  query: `SELECT u.username, ic.provider_key,\n       ic.status, ic.account_email, ic.last_connected_at\nFROM integration_connections ic\nJOIN users u ON u.id = ic.user_id\nORDER BY ic.last_connected_at DESC\nLIMIT 50` },
+  { label: 'All tables',               query: `SELECT name FROM sqlite_master WHERE type='table' ORDER BY name` },
+  { label: 'Table info (users)',        query: `SELECT * FROM pragma_table_info('users')` },
+];
+
+function loadSql() {
+  // Only initialize the editor once
+  if (document.getElementById('sql-editor')?.dataset.ready === '1') return;
+  initSqlEditor();
+}
+
+function initSqlEditor() {
+  const el = document.getElementById('sql-content');
+  if (!el) return;
+
+  const templateOptions = SQL_TEMPLATES.map((t, i) =>
+    `<option value="${i}">${esc(t.label)}</option>`).join('');
+
+  el.innerHTML = `
+    <div class="sql-toolbar">
+      <select id="sql-template" onchange="onSqlTemplate(this)" style="width:auto;min-width:220px;" aria-label="Query template">
+        ${templateOptions}
+      </select>
+      <span class="spacer"></span>
+      <button class="btn btn-primary" id="sql-run-btn" onclick="runSql()" style="padding:7px 16px;">
+        <svg viewBox="0 0 20 20" fill="currentColor" style="width:13px;height:13px;" aria-hidden="true">
+          <path fill-rule="evenodd" d="M10 18a8 8 0 100-16 8 8 0 000 16zM9.555 7.168A1 1 0 008 8v4a1 1 0 001.555.832l3-2a1 1 0 000-1.664l-3-2z" clip-rule="evenodd"/>
+        </svg>
+        Run
+      </button>
+    </div>
+    <textarea id="sql-editor" data-ready="1" class="sql-textarea" spellcheck="false" autocorrect="off" autocapitalize="off"
+      placeholder="SELECT * FROM users LIMIT 10"
+      onkeydown="onSqlKeydown(event)"
+      aria-label="SQL query editor"
+    ></textarea>
+    <div id="sql-results"></div>`;
+}
+
+function onSqlTemplate(sel) {
+  const idx = parseInt(sel.value, 10);
+  const q = SQL_TEMPLATES[idx]?.query || '';
+  const editor = document.getElementById('sql-editor');
+  if (editor && q) { editor.value = q; editor.focus(); }
+}
+
+function onSqlKeydown(e) {
+  // Ctrl+Enter / Cmd+Enter to run
+  if (e.key === 'Enter' && (e.ctrlKey || e.metaKey)) {
+    e.preventDefault();
+    runSql();
+  }
+  // Tab → insert 2 spaces
+  if (e.key === 'Tab') {
+    e.preventDefault();
+    const ta = e.target;
+    const s = ta.selectionStart, end = ta.selectionEnd;
+    ta.value = ta.value.slice(0, s) + '  ' + ta.value.slice(end);
+    ta.selectionStart = ta.selectionEnd = s + 2;
+  }
+}
+
+async function runSql() {
+  const query = document.getElementById('sql-editor')?.value?.trim();
+  if (!query) return;
+  const resultsEl = document.getElementById('sql-results');
+  const runBtn    = document.getElementById('sql-run-btn');
+  if (!resultsEl || !runBtn) return;
+
+  runBtn.disabled = true;
+  resultsEl.innerHTML = '<div class="empty"><span class="spinner"></span></div>';
+
+  try {
+    const res = await api('/admin/api/sql', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ query }),
+    });
+    const data = await res.json();
+
+    if (!res.ok) {
+      resultsEl.innerHTML = `<div class="sql-error">${esc(data.error || 'Query failed')}</div>`;
+      return;
+    }
+
+    if (!data.rows?.length) {
+      resultsEl.innerHTML = '<div class="empty">Query returned 0 rows</div>';
+      return;
+    }
+
+    resultsEl.innerHTML = `
+      <div class="sql-meta">
+        ${fmtNum(data.rows.length)}${data.truncated ? ` of ${fmtNum(data.total)}` : ''} row${data.rows.length === 1 ? '' : 's'}
+        ${data.truncated ? '<span class="badge badge-warn" style="margin-left:6px;">truncated at 500</span>' : ''}
+        <button class="btn btn-ghost" style="margin-left:auto;padding:4px 10px;font-size:11px;" onclick="copySqlResults()">Copy CSV</button>
+      </div>
+      <div class="sql-result-wrap">
+        <table class="sql-result-table">
+          <thead><tr>${data.columns.map((c) => `<th>${esc(c)}</th>`).join('')}</tr></thead>
+          <tbody>${data.rows.map((row) =>
+            `<tr>${data.columns.map((c) => `<td>${esc(row[c] == null ? 'NULL' : String(row[c]))}</td>`).join('')}</tr>`
+          ).join('')}</tbody>
+        </table>
+      </div>`;
+    // stash for copy
+    window._lastSqlData = data;
+  } catch (err) {
+    if (err.message !== 'unauthorized') {
+      resultsEl.innerHTML = `<div class="sql-error">Network error</div>`;
+    }
+  } finally {
+    runBtn.disabled = false;
+  }
+}
+
+function copySqlResults() {
+  const d = window._lastSqlData;
+  if (!d) return;
+  const header = d.columns.join(',');
+  const rows   = d.rows.map((r) => d.columns.map((c) => JSON.stringify(r[c] ?? '')).join(','));
+  navigator.clipboard.writeText([header, ...rows].join('\n')).catch(() => {});
+}

package/server/admin/users.js

@@ -0,0 +1,147 @@
+'use strict';
+
+// ── User Management ────────────────────────────────────────────────────────
+
+let _userSearchTimer = null;
+
+async function loadUsers() {
+  const q = document.getElementById('user-search')?.value?.trim() || '';
+  await fetchUsers(q);
+}
+
+async function fetchUsers(q = '') {
+  const el = document.getElementById('users-table-wrap');
+  if (!el) return;
+  el.innerHTML = '<div class="empty"><span class="spinner"></span></div>';
+  try {
+    const url = q ? `/admin/api/users?q=${encodeURIComponent(q)}` : '/admin/api/users';
+    const data = await api(url).then((r) => r.json());
+    renderUsersTable(el, data.users || []);
+    const cnt = document.getElementById('users-count');
+    if (cnt) cnt.textContent = `${(data.users || []).length} user${(data.users || []).length === 1 ? '' : 's'}`;
+  } catch (err) {
+    if (err.message !== 'unauthorized') el.innerHTML = '<div class="empty">Failed to load users</div>';
+  }
+}
+
+function onUserSearch() {
+  clearTimeout(_userSearchTimer);
+  _userSearchTimer = setTimeout(() => {
+    const q = document.getElementById('user-search')?.value?.trim() || '';
+    fetchUsers(q);
+  }, 300);
+}
+
+function renderUsersTable(el, users) {
+  if (!users.length) {
+    el.innerHTML = '<div class="empty">No users found</div>';
+    return;
+  }
+  el.innerHTML = `
+    <table class="users-table">
+      <thead><tr>
+        <th>User</th>
+        <th>Email</th>
+        <th>Joined</th>
+        <th>Last Login</th>
+        <th>Runs</th>
+        <th>Storage</th>
+        <th style="text-align:right;">Actions</th>
+      </tr></thead>
+      <tbody>${users.map((u) => `
+        <tr data-uid="${esc(u.id)}">
+          <td>
+            <div style="display:flex;align-items:center;gap:9px;">
+              <span class="user-avatar">${esc((u.display_name || u.username || '?')[0]).toUpperCase()}</span>
+              <div>
+                <div style="font-weight:600;color:var(--text);">${esc(u.display_name || u.username)}</div>
+                ${u.display_name && u.display_name !== u.username ? `<div style="font-size:11px;color:var(--text-muted);">@${esc(u.username)}</div>` : ''}
+              </div>
+            </div>
+          </td>
+          <td>
+            <span style="font-size:12px;">${esc(u.email || '—')}</span>
+            ${u.email_verified_at
+              ? '<span class="badge badge-ok" style="font-size:10px;margin-left:5px;">verified</span>'
+              : u.email ? '<span class="badge badge-warn" style="font-size:10px;margin-left:5px;">unverified</span>' : ''}
+          </td>
+          <td style="font-size:12px;color:var(--text-muted);">${fmtDate(u.created_at)}</td>
+          <td style="font-size:12px;color:var(--text-muted);">${u.last_login ? fmtDate(u.last_login) : '—'}</td>
+          <td style="font-family:var(--font-mono);font-size:12px;">${fmtNum(u.run_count)}</td>
+          <td style="font-family:var(--font-mono);font-size:12px;">${fmtBytes(u.storage_bytes)}</td>
+          <td>
+            <div style="display:flex;gap:6px;justify-content:flex-end;">
+              <button class="btn btn-ghost" style="padding:5px 10px;font-size:11px;"
+                onclick="forceLogout('${esc(u.id)}','${esc(u.username)}',this)" title="Revoke all sessions">
+                Logout
+              </button>
+              <button class="btn btn-danger" style="padding:5px 10px;font-size:11px;"
+                onclick="deleteUser('${esc(u.id)}','${esc(u.display_name || u.username)}',this)" title="GDPR: delete all user data">
+                Delete
+              </button>
+            </div>
+          </td>
+        </tr>`).join('')}
+      </tbody>
+    </table>
+    <p class="gdpr-note">
+      ⚠ <strong>Delete</strong> permanently erases all user data (runs, messages, memories, artifacts, sessions) — irreversible. Required by GDPR Art. 17 right to erasure.
+    </p>`;
+}
+
+async function forceLogout(id, username, btn) {
+  if (!confirm(`Force logout ${username}?\n\nThis will revoke all active sessions. They can log back in.`)) return;
+  btn.disabled = true;
+  try {
+    const res = await api(`/admin/api/users/${id}/sessions`, { method: 'DELETE' });
+    if (res.ok) {
+      btn.textContent = 'Done';
+      setTimeout(loadUsers, 800);
+    } else {
+      const b = await res.json().catch(() => ({}));
+      alert(b.error || 'Failed');
+      btn.disabled = false;
+    }
+  } catch (err) {
+    if (err.message !== 'unauthorized') alert('Network error');
+    btn.disabled = false;
+  }
+}
+
+async function deleteUser(id, displayName, btn) {
+  if (!confirm(
+    `⚠ GDPR Erasure — permanently delete "${displayName}"?\n\n` +
+    'This will delete the account and ALL associated data:\n' +
+    '• Agent runs, steps, and messages\n• Memories and conversations\n• Integrations and platform connections\n• Artifacts and files on disk\n• All sessions\n\n' +
+    'This action CANNOT be undone.'
+  )) return;
+  btn.disabled = true;
+  btn.textContent = 'Deleting…';
+  try {
+    const res = await api(`/admin/api/users/${id}`, { method: 'DELETE' });
+    if (res.ok) {
+      btn.closest('tr')?.remove();
+      const cnt = document.getElementById('users-count');
+      if (cnt) {
+        const n = parseInt(cnt.textContent) - 1;
+        cnt.textContent = `${n} user${n === 1 ? '' : 's'}`;
+      }
+    } else {
+      const b = await res.json().catch(() => ({}));
+      alert(b.error || 'Failed to delete user');
+      btn.disabled = false;
+      btn.textContent = 'Delete';
+    }
+  } catch (err) {
+    if (err.message !== 'unauthorized') alert('Network error');
+    btn.disabled = false;
+    btn.textContent = 'Delete';
+  }
+}
+
+function fmtDate(iso) {
+  if (!iso) return '—';
+  try {
+    return new Date(iso).toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' });
+  } catch { return iso; }
+}

package/server/db/database.js

@@ -1074,6 +1074,25 @@ try {
   // Ignore cleanup failures for obsolete wearable tables.
 }
 
+// Admin 2FA tables (singleton — no foreign key, no user_id)
+db.exec(`
+  CREATE TABLE IF NOT EXISTS admin_two_factor (
+    id              INTEGER PRIMARY KEY CHECK (id = 1),
+    enabled         INTEGER NOT NULL DEFAULT 0,
+    secret          TEXT,
+    pending_secret  TEXT,
+    enabled_at      TEXT,
+    created_at      TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at      TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+  CREATE TABLE IF NOT EXISTS admin_recovery_codes (
+    id          INTEGER PRIMARY KEY AUTOINCREMENT,
+    code_hash   TEXT NOT NULL,
+    created_at  TEXT NOT NULL DEFAULT (datetime('now')),
+    used_at     TEXT
+  );
+`);
+
 // Migrations for existing databases
 for (const col of [
   "ALTER TABLE agent_runs ADD COLUMN agent_id TEXT",

package/server/middleware/adminAuth.js

@@ -1,7 +1,44 @@
 'use strict';
 
+const crypto = require('crypto');
+
+/**
+ * Constant-time string comparison — prevents timing attacks on API key checks.
+ */
+function safeEqual(a, b) {
+  if (!a || !b) return false;
+  const bufA = Buffer.from(String(a));
+  const bufB = Buffer.from(String(b));
+  if (bufA.length !== bufB.length) {
+    // Lengths differ — do a dummy compare anyway to keep timing consistent
+    crypto.timingSafeEqual(bufA, Buffer.alloc(bufA.length));
+    return false;
+  }
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+
+/**
+ * Allows admin access via either:
+ *   1. Browser session  (`req.session.isAdmin === true`)
+ *   2. API key          (`Authorization: Bearer <ADMIN_API_KEY>`)
+ *
+ * When ADMIN_API_KEY is absent or empty, Bearer auth is disabled entirely.
+ */
 function requireAdminAuth(req, res, next) {
+  // 1. Session-based auth (admin web dashboard)
   if (req.session?.isAdmin === true) return next();
+
+  // 2. API key auth (programmatic / scripts)
+  const configuredKey = process.env.ADMIN_API_KEY;
+  if (configuredKey) {
+    const authHeader = String(req.headers.authorization || '');
+    if (authHeader.startsWith('Bearer ')) {
+      const provided = authHeader.slice(7).trim();
+      if (safeEqual(provided, configuredKey)) return next();
+    }
+  }
+
+  // 3. Reject
   if (req.path.startsWith('/api/')) {
     return res.status(401).json({ error: 'Admin authentication required' });
   }

package/server/public/.last_build_id

@@ -1 +1 @@
-8518f61f8e30cec23dd6f87e3ba20ac3
+8038ef582d1a04389ee868993a7f5f02

package/server/public/flutter_bootstrap.js

@@ -37,6 +37,6 @@ _flutter.buildConfig = {"engineRevision":"c416acfeb8126e097f758c664aaa3da929e27d
 
 _flutter.loader.load({
   serviceWorkerSettings: {
-    serviceWorkerVersion: "2397226113" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
+    serviceWorkerVersion: "1312157190" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
   }
 });

package/server/public/main.dart.js

@@ -133824,7 +133824,7 @@ r===$&&A.b()
 o.push(A.j4(p,A.j8(!1,new A.a3(B.up,A.dl(new A.cv(B.hr,new A.a7p(r,p),p),p,p),p),!1,B.I,!0),p,p,0,0,0,p))}r=!1
 if(!s.ay)if(!s.ch){r=s.e
 r===$&&A.b()
-r=B.b.t("mq6g3m8k-1096615").length!==0&&r.b}if(r){r=s.d
+r=B.b.t("mq6pvw31-1a6d75b").length!==0&&r.b}if(r){r=s.d
 r===$&&A.b()
 r=r.au&&!r.aQ?84:0
 q=s.e
@@ -139266,7 +139266,7 @@ $S:0}
 A.ZM.prototype={}
 A.Sw.prototype={
 n9(a){var s=this
-if(B.b.t("mq6g3m8k-1096615").length===0||s.a!=null)return
+if(B.b.t("mq6pvw31-1a6d75b").length===0||s.a!=null)return
 s.AN()
 s.a=A.qh(B.Rb,new A.bas(s))},
 AN(){var s=0,r=A.l(t.H),q,p=2,o=[],n=this,m,l,k,j,i,h,g,f
@@ -139284,7 +139284,7 @@ if(!t.f.b(k)){s=1
 break}i=J.a_(k,"buildId")
 h=i==null?null:B.b.t(J.p(i))
 j=h==null?"":h
-if(J.bf(j)===0||J.d(j,"mq6g3m8k-1096615")){s=1
+if(J.bf(j)===0||J.d(j,"mq6pvw31-1a6d75b")){s=1
 break}n.b=!0
 n.E()
 p=2
@@ -139301,7 +139301,7 @@ case 2:return A.i(o.at(-1),r)}})
 return A.k($async$AN,r)},
 vw(){var s=0,r=A.l(t.H),q,p=2,o=[],n=this,m,l,k,j,i,h,g,f,e,d,c,b,a,a0,a1
 var $async$vw=A.h(function(a2,a3){if(a2===1){o.push(a3)
-s=p}for(;;)switch(s){case 0:if(B.b.t("mq6g3m8k-1096615").length===0||n.c){s=1
+s=p}for(;;)switch(s){case 0:if(B.b.t("mq6pvw31-1a6d75b").length===0||n.c){s=1
 break}n.c=!0
 n.E()
 p=4