palaryn 0.1.0 → 0.3.2

package/dist/src/saas/routes.js

@@ -41,6 +41,7 @@ const memory_1 = require("../storage/memory");
 const calculator_1 = require("../trust/calculator");
 const engine_1 = require("../replay/engine");
 const plan_enforcer_1 = require("../billing/plan-enforcer");
+const model_pricing_1 = require("../budget/model-pricing");
 /** Extract a route param as string (Express 5 returns string | string[]). */
 function param(req, name) {
     const val = req.params[name];
@@ -313,7 +314,7 @@ function createSaaSRouter(deps) {
         res.json({
             api_keys: keys.map(k => ({
                 id: k.id,
-                key_prefix: k.key_prefix,
+                prefix: k.key_prefix,
                 name: k.name,
                 roles: k.roles,
                 tags: k.tags || [],
@@ -376,7 +377,7 @@ function createSaaSRouter(deps) {
         res.status(201).json({
             id: apiKey.id,
             key: rawKey,
-            key_prefix: keyPrefix,
+            prefix: keyPrefix,
             name: apiKey.name,
             roles: apiKey.roles,
             tags: apiKey.tags,
@@ -495,6 +496,201 @@ function createSaaSRouter(deps) {
             offset,
         });
     });
+    router.delete('/workspaces/:id/traces', (req, res) => {
+        if (!requireSession(req, res))
+            return;
+        const user = req.sessionUser;
+        const workspaceId = param(req, 'id');
+        const membership = workspaceMemberStore.getByWorkspaceAndUser(workspaceId, user.id);
+        if (!membership || (membership.role !== 'owner' && membership.role !== 'admin')) {
+            res.status(403).json({ error: 'Admin or owner access required' });
+            return;
+        }
+        gateway.getAuditLogger().clear();
+        res.json({ status: 'ok', message: 'All traces cleared' });
+    });
+    router.delete('/workspaces/:id/traces/:taskId', (req, res) => {
+        if (!requireSession(req, res))
+            return;
+        const user = req.sessionUser;
+        const workspaceId = param(req, 'id');
+        const taskId = param(req, 'taskId');
+        const membership = workspaceMemberStore.getByWorkspaceAndUser(workspaceId, user.id);
+        if (!membership || (membership.role !== 'owner' && membership.role !== 'admin')) {
+            res.status(403).json({ error: 'Admin or owner access required' });
+            return;
+        }
+        gateway.getAuditLogger().deleteByTaskId(taskId);
+        res.json({ status: 'ok', message: `Trace ${taskId} deleted` });
+    });
+    router.delete('/workspaces/:id/sessions/:sessionId', (req, res) => {
+        if (!requireSession(req, res))
+            return;
+        const user = req.sessionUser;
+        const workspaceId = param(req, 'id');
+        const sessionId = param(req, 'sessionId');
+        const membership = workspaceMemberStore.getByWorkspaceAndUser(workspaceId, user.id);
+        if (!membership || (membership.role !== 'owner' && membership.role !== 'admin')) {
+            res.status(403).json({ error: 'Admin or owner access required' });
+            return;
+        }
+        gateway.getAuditLogger().deleteBySessionId(sessionId);
+        res.json({ status: 'ok', message: `Session ${sessionId} traces deleted` });
+    });
+    // ---------------------------------------------------------------------------
+    // Sessions (grouped traces)
+    // ---------------------------------------------------------------------------
+    router.get('/workspaces/:id/sessions', (req, res) => {
+        if (!requireSession(req, res))
+            return;
+        const user = req.sessionUser;
+        const workspaceId = param(req, 'id');
+        const membership = workspaceMemberStore.getByWorkspaceAndUser(workspaceId, user.id);
+        if (!membership) {
+            res.status(403).json({ error: 'Not a member of this workspace' });
+            return;
+        }
+        const limit = Math.min(parseInt(req.query.limit) || 50, 200);
+        const offset = parseInt(req.query.offset) || 0;
+        const allEvents = gateway.getAuditLogger().getAllEvents();
+        const wsForSessions = workspaceStore.getById(workspaceId);
+        const slugForSessions = wsForSessions?.slug;
+        const wsEvents = allEvents.filter(e => e.workspace_id === workspaceId || (slugForSessions && e.workspace_id === slugForSessions));
+        // Group events by session_id (falling back to tool_call_id for old events)
+        const sessionMap = new Map();
+        for (const e of wsEvents) {
+            const key = e.session_id || e.tool_call_id || e.task_id;
+            if (!sessionMap.has(key))
+                sessionMap.set(key, []);
+            sessionMap.get(key).push(e);
+        }
+        // Build session summaries
+        const sessions = [];
+        for (const [sessionId, events] of sessionMap) {
+            events.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+            const first = events[0];
+            const last = events[events.length - 1];
+            // Count unique tool_call_ids (each represents one tool call)
+            const toolCallIds = new Set(events.map(e => e.tool_call_id));
+            const receivedEvents = events.filter(e => e.event_type === 'TOOL_CALL_RECEIVED');
+            const toolCallCount = Math.max(receivedEvents.length, 1);
+            // Unique tools
+            const toolsUsed = [...new Set(events.map(e => e.tool_name).filter(Boolean))];
+            // Derive status counts per tool_call_id
+            const statusCounts = { ok: 0, blocked: 0, error: 0, approval: 0, redacted: 0 };
+            for (const tcId of toolCallIds) {
+                const tcEvents = events.filter(e => e.tool_call_id === tcId);
+                const hasDeny = tcEvents.some(e => e.event_type === 'POLICY_DECIDED' && e.metadata?.decision === 'deny');
+                const hasApproval = tcEvents.some(e => e.event_type === 'APPROVAL_REQUESTED');
+                const hasError = tcEvents.some(e => e.event_type === 'TOOL_EXECUTED' && e.metadata?.status === 'error');
+                const hasRedaction = tcEvents.some(e => e.event_type === 'DLP_SCANNED' && Array.isArray(e.metadata?.detected) && e.metadata.detected.length > 0);
+                if (hasDeny)
+                    statusCounts.blocked++;
+                else if (hasError)
+                    statusCounts.error++;
+                else if (hasApproval)
+                    statusCounts.approval++;
+                else
+                    statusCounts.ok++;
+                // Redacted is orthogonal — a call can be ok AND redacted
+                if (hasRedaction)
+                    statusCounts.redacted++;
+            }
+            // Overall status: worst status across calls
+            let overallStatus = 'ok';
+            if (statusCounts.blocked > 0)
+                overallStatus = 'blocked';
+            else if (statusCounts.error > 0)
+                overallStatus = 'error';
+            else if (statusCounts.approval > 0)
+                overallStatus = 'approval';
+            sessions.push({
+                session_id: sessionId,
+                tool_call_count: toolCallCount,
+                first_timestamp: first.timestamp,
+                last_timestamp: last.timestamp,
+                duration_ms: new Date(last.timestamp).getTime() - new Date(first.timestamp).getTime(),
+                actor_id: first.actor_id || '',
+                platform: first.metadata?.platform || 'unknown',
+                tools_used: toolsUsed,
+                overall_status: overallStatus,
+                status_counts: statusCounts,
+            });
+        }
+        // Sort newest first
+        sessions.sort((a, b) => b.first_timestamp.localeCompare(a.first_timestamp));
+        res.json({
+            sessions: sessions.slice(offset, offset + limit),
+            total: sessions.length,
+        });
+    });
+    router.get('/workspaces/:id/sessions/:sessionId', (req, res) => {
+        if (!requireSession(req, res))
+            return;
+        const user = req.sessionUser;
+        const workspaceId = param(req, 'id');
+        const sessionId = param(req, 'sessionId');
+        const membership = workspaceMemberStore.getByWorkspaceAndUser(workspaceId, user.id);
+        if (!membership) {
+            res.status(403).json({ error: 'Not a member of this workspace' });
+            return;
+        }
+        const allEvents = gateway.getAuditLogger().getAllEvents();
+        const workspace = workspaceStore.getById(workspaceId);
+        const wsSlug = workspace?.slug;
+        // Find events by session_id, filtered to this workspace
+        const sessionEvents = allEvents.filter(e => e.session_id === sessionId &&
+            (e.workspace_id === workspaceId || (wsSlug && e.workspace_id === wsSlug)));
+        // If no events found by session_id, try treating sessionId as a tool_call_id (backward compat)
+        const events = sessionEvents.length > 0
+            ? sessionEvents
+            : allEvents.filter(e => e.tool_call_id === sessionId &&
+                (e.workspace_id === workspaceId || (wsSlug && e.workspace_id === wsSlug)));
+        // Group by tool_call_id
+        const toolCallMap = new Map();
+        for (const e of events) {
+            const tcId = e.tool_call_id;
+            if (!toolCallMap.has(tcId))
+                toolCallMap.set(tcId, []);
+            toolCallMap.get(tcId).push(e);
+        }
+        const toolCalls = [];
+        for (const [tcId, tcEvents] of toolCallMap) {
+            tcEvents.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+            const first = tcEvents[0];
+            const last = tcEvents[tcEvents.length - 1];
+            const resultEvent = tcEvents.find(e => e.event_type === 'TOOL_RESULT_RETURNED');
+            const durationMs = resultEvent?.metadata?.duration_ms ||
+                (new Date(last.timestamp).getTime() - new Date(first.timestamp).getTime());
+            // Derive status
+            const hasDeny = tcEvents.some(e => e.event_type === 'POLICY_DECIDED' && e.metadata?.decision === 'deny');
+            const hasApproval = tcEvents.some(e => e.event_type === 'APPROVAL_REQUESTED');
+            const hasError = tcEvents.some(e => e.event_type === 'TOOL_EXECUTED' && e.metadata?.status === 'error');
+            let status = 'ok';
+            if (hasDeny)
+                status = 'blocked';
+            else if (hasError)
+                status = 'error';
+            else if (hasApproval)
+                status = 'approval';
+            toolCalls.push({
+                tool_call_id: tcId,
+                task_id: first.task_id,
+                tool_name: first.tool_name || 'unknown',
+                timestamp: first.timestamp,
+                duration_ms: durationMs,
+                status,
+                events: tcEvents,
+            });
+        }
+        // Sort by timestamp
+        toolCalls.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+        res.json({
+            session_id: sessionId,
+            tool_calls: toolCalls,
+            total_events: events.length,
+        });
+    });
     // ---------------------------------------------------------------------------
     // Budgets
     // ---------------------------------------------------------------------------
@@ -712,6 +908,23 @@ function createSaaSRouter(deps) {
     // ---------------------------------------------------------------------------
     // Policy Rule Generation (LLM-powered)
     // ---------------------------------------------------------------------------
+    // Per-user rate limiter for LLM rule generation: 10 requests per hour
+    const LLM_RATE_LIMIT_MAX = 10;
+    const LLM_RATE_LIMIT_WINDOW_MS = 60 * 60 * 1000; // 1 hour
+    const llmRateLimitHits = new Map();
+    // Periodic cleanup to prevent memory leaks
+    setInterval(() => {
+        const now = Date.now();
+        for (const [userId, timestamps] of llmRateLimitHits) {
+            const valid = timestamps.filter(t => now - t < LLM_RATE_LIMIT_WINDOW_MS);
+            if (valid.length === 0) {
+                llmRateLimitHits.delete(userId);
+            }
+            else {
+                llmRateLimitHits.set(userId, valid);
+            }
+        }
+    }, LLM_RATE_LIMIT_WINDOW_MS).unref();
     router.post('/workspaces/:id/policies/generate-rule', async (req, res) => {
         if (!requireSession(req, res))
             return;
@@ -733,6 +946,21 @@ function createSaaSRouter(deps) {
             return;
         }
         const trimmed = description.trim().slice(0, 500);
+        // Per-user rate limit check (after validation, before LLM call)
+        const now = Date.now();
+        const userTimestamps = llmRateLimitHits.get(user.id) || [];
+        const windowStart = now - LLM_RATE_LIMIT_WINDOW_MS;
+        const validTimestamps = userTimestamps.filter(t => t > windowStart);
+        if (validTimestamps.length >= LLM_RATE_LIMIT_MAX) {
+            const retryAfterMs = LLM_RATE_LIMIT_WINDOW_MS - (now - validTimestamps[0]);
+            res.status(429).json({
+                error: `You've reached the limit of ${LLM_RATE_LIMIT_MAX} AI generations per hour. Please try again later.`,
+                retry_after_ms: retryAfterMs,
+            });
+            return;
+        }
+        validTimestamps.push(now);
+        llmRateLimitHits.set(user.id, validTimestamps);
         const systemPrompt = `You are a policy rule generator for Palaryn, an AI agent gateway. Given a natural language description, generate a single JSON PolicyRule object.
 
 The PolicyRule schema:
@@ -784,19 +1012,33 @@ Output: {"name":"approve-slack-writes","description":"Require approval for write
         try {
             const controller = new AbortController();
             const timeout = setTimeout(() => controller.abort(), 15000);
-            const llmRes = await fetch('https://api.anthropic.com/v1/messages', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    'x-api-key': apiKey,
-                    'anthropic-version': '2023-06-01',
-                },
-                body: JSON.stringify({
-                    model: 'claude-sonnet-4-5-20250929',
+            // Detect provider from API key prefix
+            const isOpenAI = apiKey.startsWith('sk-proj-') || apiKey.startsWith('sk-');
+            const llmUrl = isOpenAI
+                ? 'https://api.openai.com/v1/chat/completions'
+                : 'https://api.anthropic.com/v1/messages';
+            const llmHeaders = isOpenAI
+                ? { 'Content-Type': 'application/json', 'Authorization': `Bearer ${apiKey}` }
+                : { 'Content-Type': 'application/json', 'x-api-key': apiKey, 'anthropic-version': '2023-06-01' };
+            const llmBody = isOpenAI
+                ? JSON.stringify({
+                    model: 'gpt-4.1-mini',
+                    max_tokens: 1024,
+                    messages: [
+                        { role: 'system', content: systemPrompt },
+                        { role: 'user', content: trimmed },
+                    ],
+                })
+                : JSON.stringify({
+                    model: 'claude-sonnet-4-5-20241022',
                     max_tokens: 1024,
                     system: systemPrompt,
                     messages: [{ role: 'user', content: trimmed }],
-                }),
+                });
+            const llmRes = await fetch(llmUrl, {
+                method: 'POST',
+                headers: llmHeaders,
+                body: llmBody,
                 signal: controller.signal,
             });
             clearTimeout(timeout);
@@ -807,7 +1049,9 @@ Output: {"name":"approve-slack-writes","description":"Require approval for write
                 return;
             }
             const llmData = await llmRes.json();
-            const text = llmData.content?.[0]?.text || '';
+            const text = isOpenAI
+                ? (llmData.choices?.[0]?.message?.content || '')
+                : (llmData.content?.[0]?.text || '');
             // Strip markdown code fences if present
             const cleaned = text.replace(/^```(?:json)?\s*/i, '').replace(/\s*```\s*$/i, '').trim();
             let rule;
@@ -862,20 +1106,38 @@ Output: {"name":"approve-slack-writes","description":"Require approval for write
         }
         const limit = Math.min(parseInt(req.query.limit) || 50, 200);
         const offset = parseInt(req.query.offset) || 0;
+        const severity = req.query.severity;
+        const tool = req.query.tool;
+        const actor = req.query.actor;
+        const q = req.query.q;
         const allDlpEvents = gateway.getAuditLogger().getEventsByType('DLP_SCANNED');
         const workspace = workspaceStore.getById(workspaceId);
         const wsSlug = workspace?.slug;
         const wsEvents = allDlpEvents
             .filter(e => e.workspace_id === workspaceId || (wsSlug && e.workspace_id === wsSlug))
             .sort((a, b) => b.timestamp.localeCompare(a.timestamp));
-        // Compute severity stats
+        // Apply optional filters
+        let filtered = wsEvents;
+        if (severity)
+            filtered = filtered.filter(e => e.metadata?.severity === severity);
+        if (tool)
+            filtered = filtered.filter(e => e.tool_name.toLowerCase().includes(tool.toLowerCase()));
+        if (actor)
+            filtered = filtered.filter(e => e.actor_id.toLowerCase().includes(actor.toLowerCase()));
+        if (q) {
+            const ql = q.toLowerCase();
+            filtered = filtered.filter(e => e.tool_name.toLowerCase().includes(ql) ||
+                e.actor_id.toLowerCase().includes(ql) ||
+                (e.metadata?.detected || []).some(p => p.toLowerCase().includes(ql)));
+        }
+        // Compute severity stats over filtered results
         let high = 0, medium = 0, low = 0;
         const patternSet = new Set();
-        for (const e of wsEvents) {
-            const severity = e.metadata?.severity;
-            if (severity === 'high')
+        for (const e of filtered) {
+            const sev = e.metadata?.severity;
+            if (sev === 'high')
                 high++;
-            else if (severity === 'medium')
+            else if (sev === 'medium')
                 medium++;
             else
                 low++;
@@ -886,12 +1148,12 @@ Output: {"name":"approve-slack-writes","description":"Require approval for write
             }
         }
         res.json({
-            events: wsEvents.slice(offset, offset + limit),
-            total: wsEvents.length,
+            events: filtered.slice(offset, offset + limit),
+            total: filtered.length,
             limit,
             offset,
             stats: {
-                total: wsEvents.length,
+                total: filtered.length,
                 high,
                 medium,
                 low,
@@ -1140,11 +1402,16 @@ Output: {"name":"approve-slack-writes","description":"Require approval for write
         const denyCount = allStats.reduce((acc, s) => acc + (s.policy_breakdown['deny'] || 0), 0);
         const shield_score = {
             score: totalDecisions > 0 ? Math.round(((allowCount + transformCount) / totalDecisions) * 100) : 100,
+            total: totalDecisions,
             breakdown: {
                 allowed_percent: totalDecisions > 0 ? Math.round((allowCount / totalDecisions) * 100) : 100,
                 transformed_percent: totalDecisions > 0 ? Math.round((transformCount / totalDecisions) * 100) : 0,
                 approval_percent: totalDecisions > 0 ? Math.round((approvalCount / totalDecisions) * 100) : 0,
                 blocked_percent: totalDecisions > 0 ? Math.round((denyCount / totalDecisions) * 100) : 0,
+                allowed_count: allowCount,
+                transformed_count: transformCount,
+                approval_count: approvalCount,
+                blocked_count: denyCount,
             },
         };
         // Pipeline throughput from stats (merged across all matching workspace IDs)
@@ -1177,7 +1444,7 @@ Output: {"name":"approve-slack-writes","description":"Require approval for write
             res.json({ current: {}, baseline: {}, alerts: [] });
             return;
         }
-        const report = detector.getBaselineReport();
+        const report = detector.getBaselineReport(workspaceId);
         res.json(report);
     });
     // ---------------------------------------------------------------------------
@@ -1561,6 +1828,72 @@ Output: {"name":"approve-slack-writes","description":"Require approval for write
         });
         res.json({ status: 'reset', config: config.budget, is_custom: false });
     });
+    // ---------------------------------------------------------------------------
+    // Model Pricing: Get merged pricing (built-in + workspace overrides)
+    // ---------------------------------------------------------------------------
+    router.get('/workspaces/:id/model-pricing', (req, res) => {
+        if (!requireSession(req, res))
+            return;
+        const user = req.sessionUser;
+        const workspaceId = param(req, 'id');
+        const membership = workspaceMemberStore.getByWorkspaceAndUser(workspaceId, user.id);
+        if (!membership) {
+            res.status(403).json({ error: 'Not a member of this workspace' });
+            return;
+        }
+        // Get workspace-level budget config overrides (if any)
+        const wsConfig = budgetConfigStore.getByWorkspaceId(workspaceId);
+        const workspaceOverrides = wsConfig?.token_pricing;
+        // Merge: built-in pricing as base, workspace overrides on top
+        const merged = {};
+        for (const [model, pricing] of Object.entries(model_pricing_1.MODEL_PRICING)) {
+            merged[model] = {
+                input_per_token: pricing.input_per_token,
+                output_per_token: pricing.output_per_token,
+                source: 'built-in',
+            };
+        }
+        if (workspaceOverrides) {
+            for (const [model, pricing] of Object.entries(workspaceOverrides)) {
+                merged[model] = {
+                    input_per_token: pricing.input_per_token,
+                    output_per_token: pricing.output_per_token,
+                    source: 'workspace',
+                };
+            }
+        }
+        res.json({
+            models: merged,
+            has_workspace_overrides: !!workspaceOverrides,
+        });
+    });
+    // ---------------------------------------------------------------------------
+    // Admin: Update Workspace Plan (platform admin only)
+    // ---------------------------------------------------------------------------
+    const VALID_PLANS = ['free', 'pro', 'business', 'enterprise'];
+    router.put('/workspaces/:id/plan', (req, res) => {
+        if (!requireSession(req, res))
+            return;
+        const user = req.sessionUser;
+        const adminEmail = process.env.SEED_ADMIN_EMAIL;
+        if (!adminEmail || user.email !== adminEmail) {
+            res.status(403).json({ error: 'Platform admin access required' });
+            return;
+        }
+        const { plan } = req.body || {};
+        if (!plan || !VALID_PLANS.includes(plan)) {
+            res.status(400).json({ error: `Invalid plan. Must be one of: ${VALID_PLANS.join(', ')}` });
+            return;
+        }
+        const workspaceId = param(req, 'id');
+        const workspace = workspaceStore.getById(workspaceId);
+        if (!workspace) {
+            res.status(404).json({ error: 'Workspace not found' });
+            return;
+        }
+        const updated = workspaceStore.update(workspaceId, { plan, updated_at: new Date().toISOString() });
+        res.json(updated);
+    });
     return router;
 }
 //# sourceMappingURL=routes.js.map