npm - onbuzz - Versions diffs - 3.8.13 → 3.9.1 - Mend

onbuzz 3.8.13 → 3.9.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (948) hide show

package/src/interfaces/__tests__/authRoutes.test.js ADDED Viewed

@@ -0,0 +1,433 @@
+/**
+ * Tests for in-app OAuth auth routes from webServer.js:
+ *   - GET  /auth/callback        — portal redirect lands here with token+user
+ *   - GET  /api/auth/status      — current auth state
+ *   - POST /api/auth/signout     — clear stored credentials
+ *   - GET  /api/health/cloud     — Azure backend health check
+ *
+ * Uses a real HTTP server + fetch (same harness pattern as imageServing.test.js)
+ * so we don't have to construct the entire WebServer object tree.
+ */
+import { describe, it, expect, beforeEach, afterEach, jest } from '@jest/globals';
+import express from 'express';
+import { createServer } from 'http';
+// Replicate the exact route handlers from webServer.js, accepting deps as args
+function buildAuthApp({ apiKeyManager, broadcastToSession, config, logger, fetchImpl }) {
+  const app = express();
+  app.use(express.json());
+  // ── /auth/callback ─────────────────────────────────────────────
+  app.get('/auth/callback', async (req, res) => {
+    try {
+      const { token, user: userB64 } = req.query;
+      if (!token) {
+        return res.status(400).send('<html><body><h2>Authentication failed</h2><p>No token received.</p></body></html>');
+      }
+      let userInfo = {};
+      try {
+        userInfo = JSON.parse(Buffer.from(decodeURIComponent(userB64), 'base64').toString('utf8'));
+      } catch { /* user info is optional */ }
+      const backendBaseUrl = config?.backend?.baseUrl || 'https://autopilot-api.azurewebsites.net';
+      let apiKey = null;
+      try {
+        const keyResponse = await fetchImpl(`${backendBaseUrl}/auth/apikey`, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'Authorization': `Bearer ${token}`
+          },
+          body: JSON.stringify({ name: `Loxia App (${new Date().toLocaleDateString()})` })
+        });
+        const keyData = await keyResponse.json();
+        if (keyData.apiKey?.key) apiKey = keyData.apiKey.key;
+      } catch (err) {
+        logger?.warn?.('Failed to auto-generate API key from OAuth token', { error: err.message });
+      }
+      if (apiKey && apiKeyManager) {
+        await apiKeyManager.setKeys(null, { loxiaApiKey: apiKey });
+      }
+      broadcastToSession(null, {
+        type: 'auth_success',
+        data: {
+          user: userInfo,
+          jwt: token,
+          hasApiKey: !!apiKey,
+          timestamp: new Date().toISOString()
+        }
+      });
+      res.send('<html><body><h2>Authenticated!</h2></body></html>');
+    } catch (error) {
+      logger?.error?.('Auth callback failed', { error: error.message });
+      res.status(500).send('<html><body><h2>Authentication failed</h2><p>' + error.message + '</p></body></html>');
+    }
+  });
+  // ── /api/auth/status ───────────────────────────────────────────
+  app.get('/api/auth/status', (req, res) => {
+    const hasApiKey = !!(apiKeyManager?.getKeysForRequest?.(null, { platformProvided: true })?.loxiaApiKey);
+    res.json({
+      success: true,
+      authenticated: hasApiKey
+    });
+  });
+  // ── /api/auth/signout ──────────────────────────────────────────
+  app.post('/api/auth/signout', async (req, res) => {
+    try {
+      if (apiKeyManager) {
+        await apiKeyManager.removeKeys(null);
+      }
+      broadcastToSession(null, {
+        type: 'auth_signout',
+        data: { timestamp: new Date().toISOString() }
+      });
+      res.json({ success: true });
+    } catch (error) {
+      res.status(500).json({ success: false, error: error.message });
+    }
+  });
+  // ── /api/health/cloud ──────────────────────────────────────────
+  app.get('/api/health/cloud', async (req, res) => {
+    try {
+      const healthUrl = config?.backend?.healthUrl || 'https://autopilot-api.azurewebsites.net/health';
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), 5000);
+      const response = await fetchImpl(healthUrl, {
+        method: 'GET',
+        signal: controller.signal
+      });
+      clearTimeout(timeout);
+      if (!response.ok) {
+        return res.json({ success: false, online: false, error: `Backend returned ${response.status}` });
+      }
+      const data = await response.json();
+      res.json({ success: true, online: true, backend: data });
+    } catch (error) {
+      res.json({ success: false, online: false, error: error.message });
+    }
+  });
+  return app;
+}
+function makeApiKeyManager(initialKey = null) {
+  let storedKey = initialKey;
+  return {
+    setKeys: jest.fn(async (sessionId, keys) => { storedKey = keys.loxiaApiKey; }),
+    removeKeys: jest.fn(async () => { storedKey = null; }),
+    getKeysForRequest: jest.fn(() => storedKey ? { loxiaApiKey: storedKey } : {}),
+    _peek: () => storedKey
+  };
+}
+function encodeUser(obj) {
+  return encodeURIComponent(Buffer.from(JSON.stringify(obj)).toString('base64'));
+}
+async function startServer(app) {
+  const server = createServer(app);
+  await new Promise(resolve => server.listen(0, resolve));
+  const port = server.address().port;
+  return { server, baseUrl: `http://127.0.0.1:${port}` };
+}
+describe('Auth Routes (webServer.js)', () => {
+  let mockFetch;
+  let broadcasts;
+  let broadcastToSession;
+  let logger;
+  let server;
+  beforeEach(() => {
+    mockFetch = jest.fn();
+    broadcasts = [];
+    broadcastToSession = jest.fn((sessionId, msg) => broadcasts.push({ sessionId, msg }));
+    logger = {
+      warn: jest.fn(),
+      error: jest.fn(),
+      info: jest.fn()
+    };
+    server = null;
+  });
+  afterEach(() => {
+    if (server) server.close();
+  });
+  describe('GET /auth/callback', () => {
+    it('returns 400 HTML when token is missing', async () => {
+      const apiKeyManager = makeApiKeyManager();
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+      const res = await fetch(`${baseUrl}/auth/callback`);
+      expect(res.status).toBe(400);
+      const text = await res.text();
+      expect(text).toContain('No token received');
+      expect(mockFetch).not.toHaveBeenCalled();
+      expect(broadcastToSession).not.toHaveBeenCalled();
+    });
+    it('decodes user info, generates API key, stores it, and broadcasts auth_success', async () => {
+      const apiKeyManager = makeApiKeyManager();
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({ apiKey: { key: 'lx_generated_key_123' } })
+      });
+      const app = buildAuthApp({
+        apiKeyManager,
+        broadcastToSession,
+        config: { backend: { baseUrl: 'https://test-backend.example.com' } },
+        logger,
+        fetchImpl: mockFetch
+      });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+      const userInfo = { id: 'user-1', email: 'test@example.com', firstName: 'Test' };
+      const res = await fetch(`${baseUrl}/auth/callback?token=jwt-abc&user=${encodeUser(userInfo)}`);
+      expect(res.status).toBe(200);
+      const text = await res.text();
+      expect(text).toContain('Authenticated!');
+      // Verify backend was called with the JWT
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+      const fetchCall = mockFetch.mock.calls[0];
+      expect(fetchCall[0]).toBe('https://test-backend.example.com/auth/apikey');
+      expect(fetchCall[1].method).toBe('POST');
+      expect(fetchCall[1].headers.Authorization).toBe('Bearer jwt-abc');
+      // Verify API key was stored
+      expect(apiKeyManager.setKeys).toHaveBeenCalledWith(null, { loxiaApiKey: 'lx_generated_key_123' });
+      // Verify broadcast
+      expect(broadcastToSession).toHaveBeenCalledTimes(1);
+      const broadcast = broadcasts[0];
+      expect(broadcast.sessionId).toBeNull();
+      expect(broadcast.msg.type).toBe('auth_success');
+      expect(broadcast.msg.data.user).toEqual(userInfo);
+      expect(broadcast.msg.data.jwt).toBe('jwt-abc');
+      expect(broadcast.msg.data.hasApiKey).toBe(true);
+      expect(broadcast.msg.data.timestamp).toMatch(/^\d{4}-\d{2}-\d{2}T/);
+    });
+    it('still broadcasts auth_success when API key generation fails (degraded mode)', async () => {
+      const apiKeyManager = makeApiKeyManager();
+      mockFetch.mockRejectedValueOnce(new Error('Backend down'));
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+      const res = await fetch(`${baseUrl}/auth/callback?token=jwt-x&user=${encodeUser({ id: 'u1' })}`);
+      expect(res.status).toBe(200);
+      expect(apiKeyManager.setKeys).not.toHaveBeenCalled();
+      expect(broadcastToSession).toHaveBeenCalled();
+      const data = broadcasts[0].msg.data;
+      expect(data.hasApiKey).toBe(false);
+      expect(data.jwt).toBe('jwt-x');
+      expect(logger.warn).toHaveBeenCalled();
+    });
+    it('handles malformed user base64 gracefully (empty userInfo)', async () => {
+      const apiKeyManager = makeApiKeyManager();
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({ apiKey: { key: 'lx_k' } })
+      });
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+      const res = await fetch(`${baseUrl}/auth/callback?token=jwt&user=not-valid-base64@@@`);
+      expect(res.status).toBe(200);
+      expect(broadcasts[0].msg.data.user).toEqual({});
+      expect(broadcasts[0].msg.data.jwt).toBe('jwt');
+    });
+    it('uses default backend URL when config.backend.baseUrl missing', async () => {
+      const apiKeyManager = makeApiKeyManager();
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({ apiKey: { key: 'lx_k' } })
+      });
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+      await fetch(`${baseUrl}/auth/callback?token=jwt&user=${encodeUser({})}`);
+      expect(mockFetch.mock.calls[0][0]).toBe('https://autopilot-api.azurewebsites.net/auth/apikey');
+    });
+    it('does not store key when backend returns no apiKey field', async () => {
+      const apiKeyManager = makeApiKeyManager();
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({ message: 'no key' })
+      });
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+      await fetch(`${baseUrl}/auth/callback?token=jwt&user=${encodeUser({})}`);
+      expect(apiKeyManager.setKeys).not.toHaveBeenCalled();
+      expect(broadcasts[0].msg.data.hasApiKey).toBe(false);
+    });
+  });
+  describe('GET /api/auth/status', () => {
+    it('returns authenticated=false when no API key stored', async () => {
+      const apiKeyManager = makeApiKeyManager(null);
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+      const res = await fetch(`${baseUrl}/api/auth/status`);
+      expect(res.status).toBe(200);
+      const body = await res.json();
+      expect(body.success).toBe(true);
+      expect(body.authenticated).toBe(false);
+    });
+    it('returns authenticated=true when an API key is present', async () => {
+      const apiKeyManager = makeApiKeyManager('lx_existing_key');
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+      const res = await fetch(`${baseUrl}/api/auth/status`);
+      const body = await res.json();
+      expect(body.authenticated).toBe(true);
+    });
+  });
+  describe('POST /api/auth/signout', () => {
+    it('clears API key and broadcasts auth_signout', async () => {
+      const apiKeyManager = makeApiKeyManager('lx_signed_in');
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+      const res = await fetch(`${baseUrl}/api/auth/signout`, { method: 'POST' });
+      expect(res.status).toBe(200);
+      const body = await res.json();
+      expect(body.success).toBe(true);
+      expect(apiKeyManager.removeKeys).toHaveBeenCalledWith(null);
+      expect(apiKeyManager._peek()).toBeNull();
+      expect(broadcasts).toHaveLength(1);
+      expect(broadcasts[0].msg.type).toBe('auth_signout');
+    });
+    it('returns 500 when removeKeys throws', async () => {
+      const apiKeyManager = {
+        removeKeys: jest.fn().mockRejectedValue(new Error('vault locked'))
+      };
+      const app = buildAuthApp({ apiKeyManager, broadcastToSession, config: {}, logger, fetchImpl: mockFetch });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+      const res = await fetch(`${baseUrl}/api/auth/signout`, { method: 'POST' });
+      expect(res.status).toBe(500);
+      const body = await res.json();
+      expect(body.success).toBe(false);
+      expect(body.error).toBe('vault locked');
+    });
+  });
+  describe('GET /api/health/cloud', () => {
+    it('returns online=true with backend payload when health 200', async () => {
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({ status: 'OK', uptime: 123 })
+      });
+      const app = buildAuthApp({
+        apiKeyManager: makeApiKeyManager(),
+        broadcastToSession,
+        config: { backend: { healthUrl: 'https://api.example.com/health' } },
+        logger,
+        fetchImpl: mockFetch
+      });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+      const res = await fetch(`${baseUrl}/api/health/cloud`);
+      expect(res.status).toBe(200);
+      const body = await res.json();
+      expect(body.success).toBe(true);
+      expect(body.online).toBe(true);
+      expect(body.backend.status).toBe('OK');
+      expect(mockFetch.mock.calls[0][0]).toBe('https://api.example.com/health');
+    });
+    it('returns online=false when backend returns non-OK', async () => {
+      mockFetch.mockResolvedValueOnce({ ok: false, status: 503 });
+      const app = buildAuthApp({
+        apiKeyManager: makeApiKeyManager(),
+        broadcastToSession,
+        config: {},
+        logger,
+        fetchImpl: mockFetch
+      });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+      const res = await fetch(`${baseUrl}/api/health/cloud`);
+      const body = await res.json();
+      expect(body.success).toBe(false);
+      expect(body.online).toBe(false);
+      expect(body.error).toContain('503');
+    });
+    it('returns online=false when fetch throws (network error)', async () => {
+      mockFetch.mockRejectedValueOnce(new Error('ECONNREFUSED'));
+      const app = buildAuthApp({
+        apiKeyManager: makeApiKeyManager(),
+        broadcastToSession,
+        config: {},
+        logger,
+        fetchImpl: mockFetch
+      });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+      const res = await fetch(`${baseUrl}/api/health/cloud`);
+      const body = await res.json();
+      expect(body.online).toBe(false);
+      expect(body.error).toBe('ECONNREFUSED');
+    });
+    it('uses default health URL when config missing', async () => {
+      mockFetch.mockResolvedValueOnce({ ok: true, json: () => Promise.resolve({}) });
+      const app = buildAuthApp({
+        apiKeyManager: makeApiKeyManager(),
+        broadcastToSession,
+        config: {},
+        logger,
+        fetchImpl: mockFetch
+      });
+      const { server: s, baseUrl } = await startServer(app);
+      server = s;
+      await fetch(`${baseUrl}/api/health/cloud`);
+      expect(mockFetch.mock.calls[0][0]).toBe('https://autopilot-api.azurewebsites.net/health');
+    });
+  });
+});

package/src/interfaces/webServer.js CHANGED Viewed

@@ -314,6 +314,107 @@ class WebServer {
       }
     });
+    // =====================================================
+    // In-App OAuth Callback + Auth Status
+    // =====================================================
+    // OAuth callback — portal redirects here after login with ?token=xxx&user=yyy
+    this.app.get('/auth/callback', async (req, res) => {
+      try {
+        const { token, user: userB64 } = req.query;
+        if (!token) {
+          return res.status(400).send('<html><body><h2>Authentication failed</h2><p>No token received.</p></body></html>');
+        }
+        // Decode user info
+        let userInfo = {};
+        try {
+          userInfo = JSON.parse(Buffer.from(decodeURIComponent(userB64), 'base64').toString('utf8'));
+        } catch { /* user info is optional */ }
+        // Auto-generate an API key using the JWT token
+        const backendBaseUrl = this.config?.backend?.baseUrl || 'https://autopilot-api.azurewebsites.net';
+        let apiKey = null;
+        try {
+          const keyResponse = await fetch(`${backendBaseUrl}/auth/apikey`, {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+              'Authorization': `Bearer ${token}`
+            },
+            body: JSON.stringify({ name: `Loxia App (${new Date().toLocaleDateString()})` })
+          });
+          const keyData = await keyResponse.json();
+          if (keyData.apiKey?.key) {
+            apiKey = keyData.apiKey.key;
+          }
+        } catch (err) {
+          this.logger?.warn('Failed to auto-generate API key from OAuth token', { error: err.message });
+        }
+        // Store the API key if generated
+        if (apiKey && this.apiKeyManager) {
+          await this.apiKeyManager.setKeys(null, { loxiaApiKey: apiKey });
+          this.logger?.info('API key auto-configured from OAuth login', { userId: userInfo.id });
+        }
+        // Broadcast auth success to connected web UI clients
+        // Include the raw JWT so the frontend can use it for marketplace API calls
+        // (the marketplace verifies JWTs directly, not the lx_* API keys)
+        this.broadcastToSession(null, {
+          type: 'auth_success',
+          data: {
+            user: userInfo,
+            jwt: token,
+            hasApiKey: !!apiKey,
+            timestamp: new Date().toISOString()
+          }
+        });
+        // Return a success page that auto-closes
+        res.send(`<!DOCTYPE html>
+<html><head><title>Authenticated</title>
+<style>body{font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;background:#f0fdf4;}
+.card{text-align:center;padding:2rem;background:white;border-radius:12px;box-shadow:0 2px 8px rgba(0,0,0,.1);}
+h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
+<body><div class="card">
+<h2>Authenticated!</h2>
+<p>You can close this tab and return to the app.</p>
+<script>setTimeout(()=>window.close(),2000);</script>
+</div></body></html>`);
+      } catch (error) {
+        this.logger?.error('Auth callback failed', { error: error.message });
+        res.status(500).send('<html><body><h2>Authentication failed</h2><p>' + error.message + '</p></body></html>');
+      }
+    });
+    // Auth status — returns current auth state
+    this.app.get('/api/auth/status', (req, res) => {
+      const hasApiKey = !!(this.apiKeyManager?.getKeysForRequest?.(null, { platformProvided: true })?.loxiaApiKey);
+      res.json({
+        success: true,
+        authenticated: hasApiKey,
+        // User info stored via WebSocket broadcast — frontend persists it in localStorage
+      });
+    });
+    // Auth sign-out — clear stored API key
+    this.app.post('/api/auth/signout', async (req, res) => {
+      try {
+        if (this.apiKeyManager) {
+          await this.apiKeyManager.removeKeys(null);
+        }
+        this.broadcastToSession(null, {
+          type: 'auth_signout',
+          data: { timestamp: new Date().toISOString() }
+        });
+        res.json({ success: true });
+      } catch (error) {
+        res.status(500).json({ success: false, error: error.message });
+      }
+    });
     // =====================================================
     // System Update API
     // =====================================================
@@ -3236,6 +3337,55 @@ class WebServer {
       }
     });
+    // Delete an archived agent's state files from disk
+    // TODO: Refactor — this endpoint and agentPool.deleteAgent() both delete state files
+    // independently. Extract shared file cleanup logic into stateManager.deleteAgentFiles(agentId)
+    // so both paths use the same method and stay in sync if file structure changes.
+    this.app.delete('/api/agents/archived/:agentId', async (req, res) => {
+      try {
+        const { agentId } = req.params;
+        if (!agentId) {
+          return res.status(400).json({ success: false, error: 'agentId is required' });
+        }
+        // Check if agent is currently loaded — refuse to delete active agents
+        const activeAgent = await this.orchestrator.agentPool.getAgent(agentId);
+        if (activeAgent) {
+          return res.status(400).json({ success: false, error: 'Cannot delete an active agent. Unload it first.' });
+        }
+        const agentsDir = this.orchestrator.stateManager.getAgentsDir();
+        const deletedFiles = [];
+        // Delete state file, conversations file, and memory file
+        for (const suffix of ['-state.json', '-conversations.json', '-memory.json']) {
+          const filePath = path.join(agentsDir, `${agentId}${suffix}`);
+          try {
+            await fs.unlink(filePath);
+            deletedFiles.push(filePath);
+          } catch (err) {
+            if (err.code !== 'ENOENT') throw err; // ignore missing files
+          }
+        }
+        // Remove from agent index
+        const projectDir = this.orchestrator.config.project?.directory || process.cwd();
+        try {
+          const agentIndex = await this.orchestrator.stateManager.loadAgentIndex(projectDir);
+          if (agentIndex[agentId]) {
+            delete agentIndex[agentId];
+            await this.orchestrator.stateManager.updateAgentIndex(projectDir, agentIndex);
+          }
+        } catch {}
+        this.logger.info('Archived agent deleted from disk', { agentId, deletedFiles });
+        res.json({ success: true, agentId, deletedFiles });
+      } catch (error) {
+        this.logger.error('Failed to delete archived agent', { error: error.message });
+        res.status(500).json({ success: false, error: error.message });
+      }
+    });
     // Get agent metadata for preview
     this.app.get('/api/agents/:agentId/metadata', async (req, res) => {
       try {