onbuzz 3.3.0

package/src/services/apiKeyManager.js

@@ -0,0 +1,334 @@
+/**
+ * API Key Manager - Persistent API key storage
+ *
+ * Purpose:
+ * - Store API keys with encrypted persistence to disk
+ * - Manage both platform (Loxia) and vendor-specific keys
+ * - Provide keys to AI services based on model requirements
+ * - Survive backend restarts by loading persisted keys
+ *
+ * Note: API keys are stored globally (not per-session) since there's
+ * only one user using the local backend. Session IDs are ephemeral
+ * and change on every restart, so session-based storage doesn't make sense.
+ */
+
+import { promises as fs } from 'fs';
+import path from 'path';
+import crypto from 'crypto';
+import os from 'os';
+import { getUserDataPaths, ensureUserDataDirs } from '../utilities/userDataDir.js';
+
+// Encryption configuration
+const ALGORITHM = 'aes-256-gcm';
+const KEY_LENGTH = 32; // 256 bits
+const IV_LENGTH = 16;
+const AUTH_TAG_LENGTH = 16;
+const SALT_LENGTH = 32;
+const PBKDF2_ITERATIONS = 100000;
+
+class ApiKeyManager {
+  constructor(logger) {
+    this.logger = logger;
+
+    // Global API keys (persisted)
+    this.keys = {
+      loxiaApiKey: null,
+      vendorKeys: {}
+    };
+
+    // Persistence configuration
+    this.persistenceFile = null;
+    this.encryptionKey = null;
+    this.initialized = false;
+  }
+
+  /**
+   * Initialize persistence - must be called before using persistence features
+   * @returns {Promise<void>}
+   */
+  async initialize() {
+    if (this.initialized) return;
+
+    try {
+      await ensureUserDataDirs();
+      const paths = getUserDataPaths();
+      this.persistenceFile = path.join(paths.settings, 'api-keys.enc');
+
+      // Generate or load machine-specific encryption key
+      this.encryptionKey = await this._getOrCreateEncryptionKey(paths.settings);
+
+      // Load persisted keys
+      await this.loadFromDisk();
+
+      this.initialized = true;
+      this.logger?.info('[ApiKeyManager] Initialized with persistence', {
+        hasLoxiaKey: !!this.keys.loxiaApiKey
+      });
+    } catch (error) {
+      this.logger?.warn('[ApiKeyManager] Persistence initialization failed, using memory-only mode', {
+        error: error.message
+      });
+    }
+  }
+
+  /**
+   * Get or create a machine-specific encryption key
+   * @param {string} settingsDir - Settings directory path
+   * @returns {Promise<Buffer>} Encryption key
+   */
+  async _getOrCreateEncryptionKey(settingsDir) {
+    const saltFile = path.join(settingsDir, '.key-salt');
+    let salt;
+
+    try {
+      salt = await fs.readFile(saltFile);
+    } catch (error) {
+      // Generate new salt
+      salt = crypto.randomBytes(SALT_LENGTH);
+      await fs.writeFile(saltFile, salt, { mode: 0o600 });
+      this.logger?.info('[ApiKeyManager] Generated new encryption salt');
+    }
+
+    // Derive key from salt + machine-specific data
+    const machineData = this._getMachineIdentifier();
+    const key = crypto.pbkdf2Sync(
+      machineData,
+      salt,
+      PBKDF2_ITERATIONS,
+      KEY_LENGTH,
+      'sha256'
+    );
+
+    return key;
+  }
+
+  /**
+   * Get a machine-specific identifier for key derivation
+   * @returns {string}
+   */
+  _getMachineIdentifier() {
+    const parts = [
+      os.hostname(),
+      os.homedir(),
+      os.userInfo().username,
+      process.platform,
+      'loxia-api-key-encryption-v1'
+    ];
+    return parts.join(':');
+  }
+
+  /**
+   * Encrypt data using AES-256-GCM
+   * @param {string} plaintext - Data to encrypt
+   * @returns {string} Encrypted data as base64
+   */
+  _encrypt(plaintext) {
+    if (!this.encryptionKey) {
+      throw new Error('Encryption key not initialized');
+    }
+
+    const iv = crypto.randomBytes(IV_LENGTH);
+    const cipher = crypto.createCipheriv(ALGORITHM, this.encryptionKey, iv);
+
+    let encrypted = cipher.update(plaintext, 'utf8', 'base64');
+    encrypted += cipher.final('base64');
+
+    const authTag = cipher.getAuthTag();
+
+    // Combine IV + authTag + encrypted data
+    const combined = Buffer.concat([
+      iv,
+      authTag,
+      Buffer.from(encrypted, 'base64')
+    ]);
+
+    return combined.toString('base64');
+  }
+
+  /**
+   * Decrypt data using AES-256-GCM
+   * @param {string} encryptedData - Encrypted data as base64
+   * @returns {string} Decrypted plaintext
+   */
+  _decrypt(encryptedData) {
+    if (!this.encryptionKey) {
+      throw new Error('Encryption key not initialized');
+    }
+
+    const combined = Buffer.from(encryptedData, 'base64');
+
+    // Extract IV, authTag, and encrypted data
+    const iv = combined.subarray(0, IV_LENGTH);
+    const authTag = combined.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+    const encrypted = combined.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
+
+    const decipher = crypto.createDecipheriv(ALGORITHM, this.encryptionKey, iv);
+    decipher.setAuthTag(authTag);
+
+    let decrypted = decipher.update(encrypted.toString('base64'), 'base64', 'utf8');
+    decrypted += decipher.final('utf8');
+
+    return decrypted;
+  }
+
+  /**
+   * Persist keys to encrypted file
+   * @returns {Promise<void>}
+   */
+  async persist() {
+    if (!this.persistenceFile || !this.encryptionKey) {
+      return; // Persistence not initialized
+    }
+
+    try {
+      const data = {
+        version: 2,
+        savedAt: new Date().toISOString(),
+        keys: this.keys
+      };
+
+      const encrypted = this._encrypt(JSON.stringify(data));
+      await fs.writeFile(this.persistenceFile, encrypted, { mode: 0o600 });
+
+      this.logger?.debug('[ApiKeyManager] Keys persisted to disk');
+    } catch (error) {
+      this.logger?.warn('[ApiKeyManager] Failed to persist keys', { error: error.message });
+    }
+  }
+
+  /**
+   * Load persisted keys from disk
+   * @returns {Promise<void>}
+   */
+  async loadFromDisk() {
+    if (!this.persistenceFile || !this.encryptionKey) {
+      return; // Persistence not initialized
+    }
+
+    try {
+      const encrypted = await fs.readFile(this.persistenceFile, 'utf8');
+      const decrypted = this._decrypt(encrypted);
+      const data = JSON.parse(decrypted);
+
+      // Handle both v1 (session-based) and v2 (global) formats
+      if (data.version === 2 && data.keys) {
+        // New format: direct global keys
+        this.keys = data.keys;
+      } else if (data.globalKeys) {
+        // Old format: migrate from globalKeys
+        this.keys = data.globalKeys;
+      }
+
+      this.logger?.info('[ApiKeyManager] Loaded persisted keys', {
+        hasLoxiaKey: !!this.keys.loxiaApiKey,
+        vendorKeys: Object.keys(this.keys.vendorKeys || {}),
+        savedAt: data.savedAt
+      });
+    } catch (error) {
+      if (error.code === 'ENOENT') {
+        this.logger?.debug('[ApiKeyManager] No persisted keys found');
+      } else {
+        this.logger?.warn('[ApiKeyManager] Failed to load persisted keys', {
+          error: error.message
+        });
+      }
+    }
+  }
+
+  /**
+   * Set API keys (sessionId parameter kept for API compatibility but ignored)
+   * @param {string} sessionId - Ignored, kept for API compatibility
+   * @param {Object} keys - API keys object
+   * @param {string} keys.loxiaApiKey - Loxia platform API key
+   * @param {Object} keys.vendorKeys - Vendor-specific keys
+   */
+  async setSessionKeys(sessionId, keys) {
+    if (keys.loxiaApiKey) {
+      this.keys.loxiaApiKey = keys.loxiaApiKey;
+    }
+    if (keys.vendorKeys) {
+      this.keys.vendorKeys = { ...this.keys.vendorKeys, ...keys.vendorKeys };
+    }
+
+    this.logger?.info('[ApiKeyManager] API keys updated', {
+      hasLoxiaKey: !!this.keys.loxiaApiKey,
+      vendorKeys: Object.keys(this.keys.vendorKeys || {})
+    });
+
+    await this.persist();
+  }
+
+  /**
+   * Get API keys (sessionId parameter kept for API compatibility but ignored)
+   * @param {string} sessionId - Ignored, kept for API compatibility
+   * @returns {Object} API keys object
+   */
+  getSessionKeys(sessionId) {
+    return this.keys;
+  }
+
+  /**
+   * Get the appropriate API key for a model/request
+   * @param {string} sessionId - Ignored, kept for API compatibility
+   * @param {Object} options - Request options
+   * @param {boolean} options.platformProvided - Whether this is a platform-provided model
+   * @param {string} options.vendor - Vendor name (anthropic, openai, etc.)
+   * @returns {Object} { loxiaApiKey, vendorApiKey }
+   */
+  getKeysForRequest(sessionId, options = {}) {
+    const result = {
+      loxiaApiKey: this.keys.loxiaApiKey,
+      vendorApiKey: null
+    };
+
+    // For direct access models, also include vendor-specific key
+    if (!options.platformProvided && options.vendor && this.keys.vendorKeys) {
+      result.vendorApiKey = this.keys.vendorKeys[options.vendor];
+    }
+
+    return result;
+  }
+
+  /**
+   * Remove API keys (clears all keys)
+   * @param {string} sessionId - Ignored, kept for API compatibility
+   */
+  async removeSessionKeys(sessionId) {
+    const hadKeys = !!this.keys.loxiaApiKey;
+    this.keys = {
+      loxiaApiKey: null,
+      vendorKeys: {}
+    };
+
+    if (hadKeys) {
+      this.logger?.info('[ApiKeyManager] API keys removed');
+      await this.persist();
+    }
+    return hadKeys;
+  }
+
+  /**
+   * Set global API keys (same as setSessionKeys, kept for API compatibility)
+   * @param {Object} keys - API keys
+   */
+  async setGlobalKeys(keys) {
+    return this.setSessionKeys(null, keys);
+  }
+
+  /**
+   * Get active sessions info (returns empty for compatibility)
+   * @returns {Array}
+   */
+  getActiveSessions() {
+    return [];
+  }
+
+  /**
+   * Cleanup (no-op, kept for API compatibility)
+   */
+  cleanupExpiredSessions() {
+    return 0;
+  }
+}
+
+export default ApiKeyManager;

package/src/services/benchmarkService.js

@@ -0,0 +1,196 @@
+/**
+ * BenchmarkService - Fetches model benchmark text for routing decisions
+ *
+ * Purpose:
+ * - Fetch benchmark text from Azure backend
+ * - Refresh benchmarks periodically
+ * - Supply benchmark text to model router (as-is, no processing)
+ */
+
+import { MODEL_ROUTER_CONFIG } from '../utilities/constants.js';
+
+class BenchmarkService {
+  constructor(config, logger) {
+    this.config = config;
+    this.logger = logger;
+
+    this.benchmarkText = null;
+    this.lastUpdated = null;
+    this.isLoading = false;
+    this.endpointAvailable = true; // Set to false on 404 to stop retrying
+
+    // Use config backend URL with default fallback
+    this.azureBackendUrl = config.backend?.baseUrl || 'https://loxia-api-g7hrb8bxdae8a2h7.z02.azurefd.net';
+    this.refreshInterval = MODEL_ROUTER_CONFIG.BENCHMARK_REFRESH_INTERVAL;
+  }
+
+  /**
+   * Initialize benchmark service and load initial data
+   */
+  async initialize() {
+    try {
+      await this.loadBenchmarks();
+      this._scheduleRefresh();
+      this.logger.info('Benchmark service initialized');
+    } catch (error) {
+      this.logger.error('Failed to initialize benchmark service', { error: error.message });
+      this.benchmarkText = null;
+    }
+  }
+
+  /**
+   * Get current benchmark text
+   */
+  getBenchmarks() {
+    if (!this.benchmarkText) {
+      this.logger.warn('No benchmark data available');
+      return null;
+    }
+    return this.benchmarkText;
+  }
+
+  /**
+   * Get benchmark text for router prompt (alias for consistency)
+   */
+  getBenchmarkTable() {
+    return this.getBenchmarks();
+  }
+
+  /**
+   * Load benchmarks from Azure backend
+   */
+  async loadBenchmarks() {
+    if (this.isLoading) {
+      this.logger.debug('Benchmark loading already in progress');
+      return;
+    }
+
+    if (!this.endpointAvailable) {
+      return;
+    }
+
+    this.isLoading = true;
+
+    try {
+      const text = await this._fetchFromAzureBackend();
+
+      if (text) {
+        this.benchmarkText = text;
+        this.lastUpdated = new Date();
+        this.logger.info('Benchmarks loaded from Azure backend');
+      } else {
+        throw new Error('No benchmark data received from backend');
+      }
+
+    } catch (error) {
+      // If the endpoint doesn't exist (404), stop retrying — it won't appear later
+      if (error.message.includes('404')) {
+        this.endpointAvailable = false;
+        this.logger.warn('Benchmark endpoint not available (404) — disabled until restart');
+      } else {
+        this.logger.error('Failed to fetch benchmarks from Azure backend', {
+          error: error.message
+        });
+      }
+
+      if (!this.benchmarkText) {
+        this.benchmarkText = null;
+      }
+
+    } finally {
+      this.isLoading = false;
+    }
+  }
+
+  /**
+   * Check if benchmarks need refresh
+   */
+  needsRefresh() {
+    if (!this.lastUpdated) return true;
+
+    const timeSinceUpdate = Date.now() - this.lastUpdated.getTime();
+    return timeSinceUpdate > this.refreshInterval;
+  }
+
+  /**
+   * Fetch benchmarks from Azure backend as plain text
+   * @private
+   */
+  async _fetchFromAzureBackend() {
+    const url = `${this.azureBackendUrl}/llm/model-benchmarks`;
+
+    let apiKey = null;
+    if (this.config.apiKey) {
+      apiKey = this.config.apiKey;
+    }
+
+    // Use AbortController for timeout (Node.js fetch doesn't support timeout option)
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 10000);
+
+    const fetchOptions = {
+      method: 'GET',
+      headers: {
+        'Accept': 'text/plain',
+        ...(apiKey && { 'Authorization': `Bearer ${apiKey}` })
+      },
+      signal: controller.signal
+    };
+
+    this.logger.debug('Fetching benchmarks from Azure backend', { url });
+
+    try {
+      const response = await fetch(url, fetchOptions);
+      clearTimeout(timeoutId);
+
+      if (!response.ok) {
+        throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+      }
+
+      const text = await response.text();
+      return text;
+    } catch (error) {
+      clearTimeout(timeoutId);
+      if (error.name === 'AbortError') {
+        throw new Error('Request timeout after 10 seconds');
+      }
+      throw error;
+    }
+  }
+
+  /**
+   * Schedule periodic refresh
+   * @private
+   */
+  _scheduleRefresh() {
+    setInterval(async () => {
+      if (this.needsRefresh()) {
+        this.logger.debug('Refreshing benchmark data');
+        await this.loadBenchmarks();
+      }
+    }, this.refreshInterval);
+  }
+
+  /**
+   * Force refresh benchmarks
+   */
+  async forceRefresh() {
+    this.logger.info('Force refreshing benchmark data');
+    await this.loadBenchmarks();
+  }
+
+  /**
+   * Get service status
+   */
+  getStatus() {
+    return {
+      initialized: !!this.benchmarkText,
+      lastUpdated: this.lastUpdated?.toISOString() || null,
+      isLoading: this.isLoading,
+      needsRefresh: this.needsRefresh(),
+      hasData: !!this.benchmarkText
+    };
+  }
+}
+
+export default BenchmarkService;