npm - openship - Versions diffs - 0.1.0 → 0.1.1 - Mend

openship 0.1.0 → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (531) hide show

package/apps/api/src/modules/auth/auth.routes.ts CHANGED Viewed

@@ -1,10 +1,237 @@
 import { Hono } from "hono";
-import * as authController from "./auth.controller";
+import { auth } from "../../lib/auth";
+import { env } from "../../config/env";
+import { setSignedCookie } from "hono/cookie";
+import { internalAuth } from "../../middleware/internal-auth";
 export const authRoutes = new Hono();
-authRoutes.post("/register", authController.register);
-authRoutes.post("/login", authController.login);
-authRoutes.post("/logout", authController.logout);
-authRoutes.post("/refresh", authController.refresh);
-authRoutes.get("/me", authController.me);
+/** HTML page shown in the system browser after cloud auth for desktop. */
+function desktopResultPage(title: string, message: string, success = false): string {
+  return `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Openship</title></head>
+<body style="display:flex;align-items:center;justify-content:center;height:100vh;margin:0;font-family:system-ui,-apple-system,sans-serif;background:#0a0a0a;color:#fafafa">
+<div style="text-align:center;max-width:420px">
+  <div style="font-size:48px;margin-bottom:16px">${success ? "\u2713" : "\u26A0"}</div>
+  <h2 style="margin:0 0 8px">${title}</h2>
+  <p style="color:#888;margin:0 0 24px">${message}</p>
+  ${success ? '<p style="color:#555;font-size:14px">This tab can be safely closed.</p>' : ''}
+</div>
+</body></html>`;
+}
+/**
+ * Desktop-mode auth endpoints.
+ *
+ * Two authentication flows are supported:
+ *
+ * 1. Zero-auth (/desktop-login)
+ *    User chose self-hosted during onboarding → auto-provision a local
+ *    admin user and create a real Better Auth session with a cookie.
+ *    No password, the session cookie is the only credential.
+ *
+ * 2. Cloud auth (/cloud-callback)
+ *    User chose "Continue with Cloud" during onboarding → authenticate
+ *    on app.openship.io, exchange a one-time code for a local session.
+ *
+ * Both flows end with a `better-auth.session_token` cookie and a
+ * redirect to the dashboard. The rest of the app works the same way
+ * regardless of which path was taken.
+ */
+if (env.DEPLOY_MODE === "desktop") {
+  /**
+   * GET /get-session — try real Better Auth session first, fall back
+   * to auto-provisioned zero-auth session for backwards compat.
+   */
+  authRoutes.get("/get-session", async (c) => {
+    // Try real session first (cloud-authenticated or previously created)
+    try {
+      const realSession = await auth.api.getSession({
+        headers: c.req.raw.headers,
+      });
+      if (realSession) {
+        return c.json(realSession);
+      }
+    } catch {
+      // session lookup failed — fall through to zero-auth fallback
+    }
+    // Zero-auth fallback — only when authMode is "none" (self-hosted desktop).
+    // Cloud-auth users must re-authenticate via Openship Cloud.
+    const { getAuthMode } = await import("../../lib/auth-mode");
+    const authMode = await getAuthMode();
+    if (authMode !== "none") {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
+    const { ensureLocalUser } = await import("../../lib/local-user");
+    const user = await ensureLocalUser();
+    const now = new Date().toISOString();
+    return c.json({
+      session: {
+        id: "desktop-session",
+        userId: user.id,
+        token: "desktop",
+        expiresAt: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000).toISOString(),
+        createdAt: now,
+        updatedAt: now,
+      },
+      user: {
+        ...user,
+        image: null,
+        createdAt: now,
+        updatedAt: now,
+      },
+    });
+  });
+  /**
+   * GET /desktop-login — create a real Better Auth session for the
+   * zero-auth local user and redirect to the dashboard.
+   *
+   * Called ONCE after onboarding completes (self-hosted path).
+   * The BrowserWindow navigates here → gets a cookie → reaches the dashboard.
+   */
+  authRoutes.get("/desktop-login", async (c) => {
+    // Only zero-auth mode can mint sessions without credentials
+    const { getAuthMode } = await import("../../lib/auth-mode");
+    const authMode = await getAuthMode();
+    if (authMode !== "none") {
+      return c.redirect(`${env.DASHBOARD_URL}/login`);
+    }
+    const { ensureLocalUser } = await import("../../lib/local-user");
+    const { createLocalSession } = await import("../../lib/cloud-auth-proxy");
+    const user = await ensureLocalUser();
+    const session = await createLocalSession(user.id, "127.0.0.1", "desktop");
+    await setSignedCookie(c, "better-auth.session_token", session.token, env.BETTER_AUTH_SECRET, {
+      httpOnly: true,
+      secure: false,
+      sameSite: "Lax",
+      path: "/",
+      expires: session.expiresAt,
+    });
+    return c.redirect(env.DASHBOARD_URL);
+  });
+  /**
+   * GET /cloud-callback — exchange cloud auth code for a local session.
+   *
+   * Flow:
+   *   1. User authenticates on app.openship.io (in system browser)
+   *   2. Cloud generates a one-time code and redirects here with ?code=xxx&state=yyy
+   *   3. We validate state (CSRF protection) and retrieve stored code_verifier (PKCE)
+   *   4. We exchange the code + code_verifier for user data + cloud session token
+   *   5. Mirror the cloud user locally, store cloud token, create session
+   *   6. Store session token for Electron to pick up via polling
+   *   7. Show a "success — close this tab" page
+   */
+  authRoutes.get("/cloud-callback", async (c) => {
+    const code = c.req.query("code");
+    if (!code) {
+      return c.html(desktopResultPage("Missing authentication code", "Please return to Openship and try again."));
+    }
+    // Validate state parameter (CSRF) and retrieve PKCE code_verifier
+    const state = c.req.query("state");
+    if (!state) {
+      return c.html(desktopResultPage("Missing state parameter", "Please return to Openship and try again."));
+    }
+    try {
+      const { exchangeCodeWithCloud, mirrorCloudUser, storeCloudSession, createLocalSession, resolveDesktopAuth, validateDesktopState } =
+        await import("../../lib/cloud-auth-proxy");
+      const validated = validateDesktopState(state);
+      if (!validated) {
+        return c.html(desktopResultPage("Invalid or expired session", "The authorization request has expired. Please return to Openship and try again."));
+      }
+      const data = await exchangeCodeWithCloud(code, validated.codeVerifier);
+      if (!data) {
+        return c.html(desktopResultPage("Authentication failed", "Could not verify with Openship Cloud. Please return to Openship and try again."));
+      }
+      const localUserId = await mirrorCloudUser(data.user);
+      await storeCloudSession(localUserId, data.sessionToken);
+      const session = await createLocalSession(localUserId, "127.0.0.1", "desktop");
+      // Resolve the pending nonce so Electron can pick up the session via polling
+      resolveDesktopAuth(validated.nonce, session.token, session.expiresAt);
+      return c.html(desktopResultPage("Signed in to Openship", "You can return to the Openship app now.", true));
+    } catch {
+      return c.html(desktopResultPage("Authentication failed", "Something went wrong. Please return to Openship and try again."));
+    }
+  });
+  /**
+   * POST /desktop-auth-start — register a nonce + PKCE + state for desktop auth.
+   * Called by the Electron main process before opening the system browser.
+   *
+   * Protected by internal token — prevents unauthorized registration.
+   */
+  authRoutes.post("/desktop-auth-start", internalAuth, async (c) => {
+    const body = await c.req.json();
+    const nonce = body?.nonce;
+    const state = body?.state;
+    const codeVerifier = body?.code_verifier;
+    if (!nonce || typeof nonce !== "string" || !state || typeof state !== "string" || !codeVerifier || typeof codeVerifier !== "string") {
+      return c.json({ error: "missing nonce, state, or code_verifier" }, 400);
+    }
+    const { registerDesktopNonce } = await import("../../lib/cloud-auth-proxy");
+    registerDesktopNonce(nonce, state, codeVerifier);
+    return c.json({ ok: true });
+  });
+  /**
+   * GET /desktop-auth-poll — Electron polls this to check if cloud auth completed.
+   * Returns { status: "pending" | "resolved" | "expired", claimCode? }
+   */
+  authRoutes.get("/desktop-auth-poll", async (c) => {
+    const nonce = c.req.query("nonce");
+    if (!nonce) {
+      return c.json({ error: "missing nonce" }, 400);
+    }
+    const { pollDesktopAuth } = await import("../../lib/cloud-auth-proxy");
+    return c.json(pollDesktopAuth(nonce));
+  });
+  /**
+   * GET /desktop-claim?code=xxx — exchange a one-time claim code for a
+   * session cookie. Electron navigates here after polling resolves.
+   *
+   * This sets the cookie via HTTP Set-Cookie (reliable across all
+   * Electron versions) and then redirects to the dashboard.
+   */
+  authRoutes.get("/desktop-claim", async (c) => {
+    const code = c.req.query("code");
+    if (!code) {
+      return c.text("Missing code", 400);
+    }
+    const { exchangeDesktopClaim } = await import("../../lib/cloud-auth-proxy");
+    const result = exchangeDesktopClaim(code);
+    if (!result) {
+      return c.text("Claim expired", 400);
+    }
+    await setSignedCookie(c, "better-auth.session_token", result.token, env.BETTER_AUTH_SECRET, {
+      httpOnly: true,
+      secure: false,
+      sameSite: "Lax",
+      path: "/",
+      expires: result.expiresAt,
+    });
+    return c.redirect(env.DASHBOARD_URL);
+  });
+}
+/** Better Auth catch-all — handles all standard auth endpoints. */
+authRoutes.on(["GET", "POST"], "/*", (c) => {
+  return auth.handler(c.req.raw);
+});

package/apps/api/src/modules/billing/billing.routes.ts CHANGED Viewed

@@ -1,8 +1,16 @@
 import { Hono } from "hono";
+import { authMiddleware } from "../../middleware";
 import * as billingController from "./billing.controller";
 export const billingRoutes = new Hono();
+// Auth required for all billing routes except webhook
+billingRoutes.use("*", async (c, next) => {
+  // Stripe webhook uses signature verification, not session auth
+  if (c.req.path.endsWith("/webhook/stripe")) return next();
+  return authMiddleware(c, next);
+});
 /* ---------- Plans & Pricing ---------- */
 billingRoutes.get("/plans", billingController.listPlans);

package/apps/api/src/modules/cloud/cloud.controller.ts ADDED Viewed

@@ -0,0 +1,225 @@
+/**
+ * Cloud controller — two sides of the same coin:
+ *
+ * SaaS (CLOUD_MODE):
+ *   POST /api/cloud/token           — mint namespace-scoped Oblien tokens
+ *   GET  /api/cloud/desktop-handoff — OAuth → one-time code → redirect to desktop
+ *   POST /api/cloud/exchange-code   — exchange code for user + session (no auth)
+ *
+ * Local (!CLOUD_MODE):
+ *   POST /api/cloud/disconnect      — clear stored session
+ *   GET  /api/cloud/status          — check connection state
+ *   GET  /api/cloud/connect-callback — exchange code from external auth
+ */
+import type { Context } from "hono";
+import { getUserId } from "../../lib/controller-helpers";
+// ─── SaaS: namespace token minting ───────────────────────────────────────────
+export async function getToken(c: Context) {
+  const { issueNamespaceToken } = await import("../../lib/openship-cloud");
+  const userId = getUserId(c);
+  const result = await issueNamespaceToken(userId);
+  return c.json({ data: result });
+}
+// ─── SaaS: desktop OAuth handoff ─────────────────────────────────────────────
+/**
+ * GET /api/cloud/desktop-handoff?redirect=<url>&state=<state>&code_challenge=<challenge>
+ *
+ * Called from the authorize page after the user clicks "Authorize".
+ * Reads the authenticated session, generates a one-time code, and
+ * redirects to the desktop's local callback with that code + state.
+ *
+ * Security:
+ *   - redirect MUST be localhost (desktop callback) — no open redirect
+ *   - state is passed through unchanged for CSRF protection
+ *   - code_challenge (PKCE S256) is bound to the one-time code
+ */
+export async function desktopHandoff(c: Context) {
+  const { auth } = await import("../../lib/auth");
+  const session = await auth.api.getSession({ headers: c.req.raw.headers });
+  if (!session) {
+    return c.json({ error: "No active session" }, 401);
+  }
+  const redirect = c.req.query("redirect");
+  if (!redirect) {
+    return c.json({ error: "Missing redirect parameter" }, 400);
+  }
+  // Security: only allow localhost — desktop is the only consumer
+  let url: URL;
+  try {
+    url = new URL(redirect);
+  } catch {
+    return c.json({ error: "Invalid redirect URL" }, 400);
+  }
+  if (url.hostname !== "localhost" && url.hostname !== "127.0.0.1") {
+    return c.json({ error: "Redirect must target localhost" }, 400);
+  }
+  // Restrict to safe port range — prevent redirect to unrelated local services
+  const port = parseInt(url.port || "80", 10);
+  if (port < 1024 || port > 65535) {
+    return c.json({ error: "Redirect port must be ≥ 1024" }, 400);
+  }
+  const state = c.req.query("state");
+  const codeChallenge = c.req.query("code_challenge");
+  const { generateHandoffCode } = await import("../../lib/cloud-auth-proxy");
+  const code = await generateHandoffCode(
+    {
+      id: session.user.id,
+      name: session.user.name,
+      email: session.user.email,
+      emailVerified: session.user.emailVerified,
+      image: session.user.image,
+    },
+    session.session.token,
+    codeChallenge || undefined,
+  );
+  url.searchParams.set("code", code);
+  if (state) url.searchParams.set("state", state);
+  return c.redirect(url.toString());
+}
+/**
+ * GET /api/cloud/connect-handoff?redirect=<url>
+ *
+ * Used by self-hosted "Connect to Cloud" flow. After the user logs in
+ * on the SaaS, the login page redirects here. This generates a one-time
+ * code and redirects back to the self-hosted callback.
+ *
+ * Security:
+ *   - redirect MUST be HTTPS (no downgrade to HTTP)
+ *   - No PKCE (self-hosted server handles its own security)
+ *   - Codes are single-use with 60s TTL
+ */
+export async function connectHandoff(c: Context) {
+  const { auth } = await import("../../lib/auth");
+  const session = await auth.api.getSession({ headers: c.req.raw.headers });
+  if (!session) {
+    return c.json({ error: "No active session" }, 401);
+  }
+  const redirect = c.req.query("redirect");
+  if (!redirect) {
+    return c.json({ error: "Missing redirect parameter" }, 400);
+  }
+  let url: URL;
+  try {
+    url = new URL(redirect);
+  } catch {
+    return c.json({ error: "Invalid redirect URL" }, 400);
+  }
+  // Allow localhost HTTP (desktop connects via http://localhost:PORT)
+  // and require HTTPS for all other hosts (self-hosted production)
+  const isLocalhost = url.hostname === "localhost" || url.hostname === "127.0.0.1";
+  if (!isLocalhost && url.protocol !== "https:") {
+    return c.json({ error: "Redirect must use HTTPS" }, 400);
+  }
+  if (isLocalhost) {
+    const port = parseInt(url.port || "80", 10);
+    if (port < 1024 || port > 65535) {
+      return c.json({ error: "Redirect port must be ≥ 1024" }, 400);
+    }
+  }
+  const { generateHandoffCode } = await import("../../lib/cloud-auth-proxy");
+  const code = await generateHandoffCode(
+    {
+      id: session.user.id,
+      name: session.user.name,
+      email: session.user.email,
+      emailVerified: session.user.emailVerified,
+      image: session.user.image,
+    },
+    session.session.token,
+  );
+  url.searchParams.set("code", code);
+  return c.redirect(url.toString());
+}
+/**
+ * POST /api/cloud/exchange-code  { code: string, code_verifier?: string }
+ *
+ * Called by the desktop instance to exchange a one-time code for the OAuth
+ * user data + cloud session token. No auth required — the code is the credential.
+ *
+ * If the code was generated with a PKCE code_challenge, the matching
+ * code_verifier must be provided or the exchange is rejected.
+ */
+export async function exchangeCode(c: Context) {
+  const body = await c.req.json<{ code: string; code_verifier?: string }>();
+  if (!body.code) {
+    return c.json({ error: "Code required" }, 400);
+  }
+  const { exchangeHandoffCode } = await import("../../lib/cloud-auth-proxy");
+  const result = exchangeHandoffCode(body.code, body.code_verifier);
+  if (!result) {
+    return c.json({ error: "Invalid or expired code" }, 401);
+  }
+  return c.json({ data: result });
+}
+// ─── Local: cloud account management ─────────────────────────────────────────
+export async function disconnect(c: Context) {
+  const userId = getUserId(c);
+  const { disconnectCloud } = await import("../../lib/cloud-client");
+  await disconnectCloud(userId);
+  return c.json({ connected: false });
+}
+export async function status(c: Context) {
+  const userId = getUserId(c);
+  const { isCloudConnected } = await import("../../lib/cloud-client");
+  const connected = await isCloudConnected(userId);
+  if (!connected) return c.json({ connected: false });
+  // Return cloud user info alongside status
+  const user = c.get("user");
+  return c.json({
+    connected: true,
+    user: user ? { name: user.name, email: user.email, image: user.image } : undefined,
+  });
+}
+/**
+ * GET /api/cloud/connect-callback?code=<one-time-code>
+ *
+ * Used by self-hosted settings page. After the user authenticates on
+ * Openship Cloud, they're redirected here with a code.
+ * We exchange it for the cloud session token and store it for deploys.
+ */
+export async function connectCallback(c: Context) {
+  const userId = getUserId(c);
+  const code = c.req.query("code");
+  if (!code) {
+    return c.redirect("/settings?error=missing_code");
+  }
+  try {
+    const { exchangeCodeWithCloud, storeCloudSession } = await import("../../lib/cloud-auth-proxy");
+    const data = await exchangeCodeWithCloud(code);
+    if (!data) {
+      return c.redirect("/settings?error=exchange_failed");
+    }
+    await storeCloudSession(userId, data.sessionToken);
+    return c.redirect("/settings?cloud=connected");
+  } catch {
+    return c.redirect("/settings?error=connect_failed");
+  }
+}

package/apps/api/src/modules/cloud/cloud.routes.ts ADDED Viewed

@@ -0,0 +1,40 @@
+/**
+ * Cloud routes — mounted at /api/cloud in app.ts.
+ *
+ * Two route sets from the same module:
+ *   cloudSaasRoutes  (CLOUD_MODE)  — POST /token
+ *   cloudLocalRoutes (!CLOUD_MODE) — POST /connect, POST /disconnect, GET /status
+ */
+import { Hono } from "hono";
+import { authMiddleware } from "../../middleware";
+import { rateLimiter } from "../../middleware/rate-limiter";
+import * as ctrl from "./cloud.controller";
+/** SaaS routes — mints namespace tokens for local instances + desktop OAuth handoff */
+export const cloudSaasRoutes = new Hono();
+// Desktop OAuth handoff — localhost only, PKCE + state
+cloudSaasRoutes.get("/desktop-handoff", ctrl.desktopHandoff);
+// Self-hosted connect handoff — HTTPS only
+cloudSaasRoutes.get("/connect-handoff", ctrl.connectHandoff);
+// Code exchange — no auth (code is the credential), rate-limited
+cloudSaasRoutes.use("/exchange-code", rateLimiter);
+cloudSaasRoutes.post("/exchange-code", ctrl.exchangeCode);
+// Token minting requires auth
+cloudSaasRoutes.use("/token", authMiddleware);
+cloudSaasRoutes.post("/token", ctrl.getToken);
+/** Local routes — manage connection to Openship Cloud */
+export const cloudLocalRoutes = new Hono();
+cloudLocalRoutes.use("*", authMiddleware);
+cloudLocalRoutes.post("/disconnect", ctrl.disconnect);
+cloudLocalRoutes.get("/status", ctrl.status);
+/**
+ * Cloud connect callback — used by self-hosted settings page.
+ * After the user authenticates on Openship Cloud, they're redirected
+ * here with a one-time code. We exchange it and store the cloud token.
+ */
+cloudLocalRoutes.get("/connect-callback", ctrl.connectCallback);