palaryn 0.1.0 → 0.3.2

package/src/admin/routes.ts

@@ -0,0 +1,509 @@
+import express from 'express';
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as yaml from 'js-yaml';
+import { randomUUID } from 'crypto';
+import { Gateway } from '../server/gateway';
+import { GatewayConfig } from '../types/config';
+import {
+  DashboardStats,
+  BudgetInfo,
+  CostSummary,
+  ApiKeyInfo,
+  dashboardTemplate,
+  approvalsTemplate,
+  policiesTemplate,
+  budgetsTemplate,
+  traceListTemplate,
+  traceDetailTemplate,
+  apiKeysTemplate,
+  layoutTemplate,
+  escapeHtml,
+} from './templates';
+
+// CSRF token store: token -> expiry timestamp (ms)
+const csrfTokens = new Map<string, number>();
+
+const CSRF_TOKEN_TTL_MS = 60 * 60 * 1000; // 1 hour
+const MAX_CSRF_TOKENS = 10000;
+
+/** Generate a single-use CSRF token with 1-hour expiry */
+function generateCSRFToken(): string {
+  // Prune expired tokens on each generation call
+  const now = Date.now();
+  for (const [token, expiry] of csrfTokens) {
+    if (expiry < now) {
+      csrfTokens.delete(token);
+    }
+  }
+
+  // Hard cap: if still too many tokens, evict oldest
+  if (csrfTokens.size >= MAX_CSRF_TOKENS) {
+    const firstKey = csrfTokens.keys().next().value;
+    if (firstKey) csrfTokens.delete(firstKey);
+  }
+
+  const token = crypto.randomBytes(32).toString('hex');
+  csrfTokens.set(token, now + CSRF_TOKEN_TTL_MS);
+  return token;
+}
+
+/** Validate and consume a single-use CSRF token. Returns true if valid. */
+function validateCSRFToken(token: string): boolean {
+  if (!token) return false;
+  const expiry = csrfTokens.get(token);
+  if (expiry === undefined) return false;
+
+  // Delete the token (single-use)
+  csrfTokens.delete(token);
+
+  // Check if expired
+  return Date.now() < expiry;
+}
+
+export function createAdminRouter(gateway: Gateway, config: GatewayConfig): express.Router {
+  const router = express.Router();
+
+  // Parse URL-encoded form bodies for POST routes
+  router.use(express.urlencoded({ extended: true }));
+
+  // ---------- GET /admin -- Dashboard overview ----------
+  router.get('/', (req, res) => {
+    try {
+      const auditLogger = gateway.getAuditLogger();
+      const allEvents = auditLogger.getAllEvents();
+      const pendingApprovals = gateway.getPendingApprovals();
+      const policy = gateway.getCurrentPolicy();
+
+      // Gather unique workspace IDs from events
+      const workspaceIds = new Set<string>();
+      for (const event of allEvents) {
+        if (event.workspace_id) {
+          workspaceIds.add(event.workspace_id);
+        }
+      }
+
+      const stats: DashboardStats = {
+        total_requests: allEvents.filter(e => e.event_type === 'TOOL_CALL_RECEIVED').length,
+        pending_approvals: pendingApprovals.length,
+        active_workspaces: workspaceIds.size,
+        policy_rules: policy.rules ? policy.rules.length : 0,
+        recent_events: allEvents.slice(-20).reverse(),
+      };
+
+      res.send(dashboardTemplate(stats));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Unknown error';
+      res.status(500).send(layoutTemplate('Error', 'dashboard',
+        `<div class="alert alert-error">Failed to load dashboard: ${escapeHtml(message)}</div>`));
+    }
+  });
+
+  // ---------- GET /admin/approvals -- Pending approvals list ----------
+  router.get('/approvals', (req, res) => {
+    try {
+      const approvals = gateway.getPendingApprovals();
+      const csrfToken = generateCSRFToken();
+      res.send(approvalsTemplate(approvals, csrfToken));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Unknown error';
+      res.status(500).send(layoutTemplate('Error', 'approvals',
+        `<div class="alert alert-error">Failed to load approvals: ${escapeHtml(message)}</div>`));
+    }
+  });
+
+  // ---------- POST /admin/approvals/:id/approve -- Approve an approval ----------
+  router.post('/approvals/:id/approve', async (req, res) => {
+    if (!validateCSRFToken(req.body._csrf)) {
+      res.status(403).send('Invalid or missing CSRF token');
+      return;
+    }
+
+    const approvalId = req.params.id;
+    const approvalManager = gateway.getApprovalManager();
+
+    try {
+      await approvalManager.resolveById(approvalId, 'admin', true);
+    } catch {
+      // Approval may have expired or already been resolved
+    }
+
+    res.redirect('/admin/approvals');
+  });
+
+  // ---------- POST /admin/approvals/:id/deny -- Deny an approval ----------
+  router.post('/approvals/:id/deny', async (req, res) => {
+    if (!validateCSRFToken(req.body._csrf)) {
+      res.status(403).send('Invalid or missing CSRF token');
+      return;
+    }
+
+    const approvalId = req.params.id;
+    const approvalManager = gateway.getApprovalManager();
+
+    try {
+      await approvalManager.resolveById(approvalId, 'admin', false, 'Denied via admin panel');
+    } catch {
+      // Approval may have expired or already been resolved
+    }
+
+    res.redirect('/admin/approvals');
+  });
+
+  // ---------- GET /admin/policies -- Policy viewer + YAML editor ----------
+  router.get('/policies', (req, res) => {
+    try {
+      const policy = gateway.getCurrentPolicy();
+      const csrfToken = generateCSRFToken();
+
+      // Read raw YAML from disk to pre-fill the editor
+      let policyYaml = '';
+      try {
+        policyYaml = fs.readFileSync(gateway.getPolicyPackPath(), 'utf-8');
+      } catch {
+        // If file can't be read, editor will be empty
+      }
+
+      // Handle success/error flash from POST redirect
+      const applied = typeof req.query.applied === 'string' ? req.query.applied : undefined;
+      const msg = typeof req.query.msg === 'string' ? req.query.msg : undefined;
+      const reloaded = typeof req.query.reloaded === 'string' ? req.query.reloaded : undefined;
+      const applyResult = applied !== undefined
+        ? { success: applied === '1', message: msg || (applied === '1' ? 'Policy applied successfully' : 'Failed to apply policy') }
+        : reloaded !== undefined
+          ? { success: reloaded === '1', message: msg || (reloaded === '1' ? 'Policy reloaded from disk' : 'Failed to reload policy') }
+          : undefined;
+
+      res.send(policiesTemplate(policy, undefined, csrfToken, policyYaml, applyResult));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Unknown error';
+      res.status(500).send(layoutTemplate('Error', 'policies',
+        `<div class="alert alert-error">Failed to load policies: ${escapeHtml(message)}</div>`));
+    }
+  });
+
+  // ---------- POST /admin/policies/apply -- Save YAML to disk & hot-reload ----------
+  router.post('/policies/apply', (req, res) => {
+    if (!validateCSRFToken(req.body._csrf)) {
+      res.status(403).send('Invalid or missing CSRF token');
+      return;
+    }
+
+    const policyYamlText = req.body.policy_yaml;
+
+    // Validate: not empty
+    if (!policyYamlText || typeof policyYamlText !== 'string' || policyYamlText.trim().length === 0) {
+      res.redirect('/admin/policies?applied=0&msg=' + encodeURIComponent('Policy YAML cannot be empty'));
+      return;
+    }
+
+    // Validate: parseable YAML
+    let parsed: any;
+    try {
+      parsed = yaml.load(policyYamlText);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Invalid YAML';
+      res.redirect('/admin/policies?applied=0&msg=' + encodeURIComponent('Invalid YAML: ' + message));
+      return;
+    }
+
+    // Validate: valid policy structure
+    const validation = gateway.validatePolicy(parsed);
+    if (!validation.valid) {
+      res.redirect('/admin/policies?applied=0&msg=' + encodeURIComponent('Validation errors: ' + validation.errors.join('; ')));
+      return;
+    }
+
+    // Write to disk
+    try {
+      fs.writeFileSync(gateway.getPolicyPackPath(), policyYamlText, 'utf-8');
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Write failed';
+      res.redirect('/admin/policies?applied=0&msg=' + encodeURIComponent('Failed to write file: ' + message));
+      return;
+    }
+
+    // Hot-reload
+    const result = gateway.reloadPolicy();
+    if (result.success) {
+      res.redirect('/admin/policies?applied=1&msg=' + encodeURIComponent(`Policy reloaded successfully (${result.ruleCount} rules active)`));
+    } else {
+      res.redirect('/admin/policies?applied=0&msg=' + encodeURIComponent('Reload failed: ' + (result.error || 'unknown error')));
+    }
+  });
+
+  // ---------- POST /admin/policies/reload -- Hot-reload policy from disk ----------
+  router.post('/policies/reload', (req, res) => {
+    if (!validateCSRFToken(req.body._csrf)) {
+      res.status(403).send('Invalid or missing CSRF token');
+      return;
+    }
+
+    const result = gateway.reloadPolicy();
+    if (result.success) {
+      res.redirect('/admin/policies?reloaded=1&msg=' + encodeURIComponent(`Policy reloaded from disk (${result.ruleCount} rules active)`));
+    } else {
+      res.redirect('/admin/policies?reloaded=0&msg=' + encodeURIComponent('Reload failed: ' + (result.error || 'unknown error')));
+    }
+  });
+
+  // ---------- POST /admin/policies/validate -- Validate a policy ----------
+  router.post('/policies/validate', (req, res) => {
+    if (!validateCSRFToken(req.body._csrf)) {
+      res.status(403).send('Invalid or missing CSRF token');
+      return;
+    }
+
+    const policy = gateway.getCurrentPolicy();
+    const csrfToken = generateCSRFToken();
+    let validationResult: { valid: boolean; errors: string[] };
+
+    try {
+      const policyJson = req.body.policy_json;
+      const parsed = JSON.parse(policyJson);
+      validationResult = gateway.validatePolicy(parsed);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Invalid JSON';
+      validationResult = { valid: false, errors: [message] };
+    }
+
+    // Read current YAML for the editor
+    let policyYaml = '';
+    try {
+      policyYaml = fs.readFileSync(gateway.getPolicyPackPath(), 'utf-8');
+    } catch {
+      // If file can't be read, editor will be empty
+    }
+
+    res.send(policiesTemplate(policy, validationResult, csrfToken, policyYaml));
+  });
+
+  // ---------- GET /admin/budgets -- Budget overview ----------
+  router.get('/budgets', (req, res) => {
+    try {
+      const budgetManager = gateway.getBudgetManager();
+      const budgetConfig = budgetManager.getConfig();
+      const spending = budgetManager.getSpendingSummary();
+      const budgets: BudgetInfo[] = [];
+
+      // Show configured budget limits with actual spending
+      budgets.push({
+        key: 'task_default',
+        type: 'task',
+        label: 'Task Budget (default)',
+        spent: spending.task_total,
+        limit: budgetConfig.task_budget_usd,
+      });
+
+      if (budgetConfig.user_daily_budget_usd !== undefined) {
+        budgets.push({
+          key: 'user_daily',
+          type: 'user_daily',
+          label: 'User Daily Budget',
+          spent: spending.user_daily_total,
+          limit: budgetConfig.user_daily_budget_usd,
+        });
+      }
+
+      if (budgetConfig.user_monthly_budget_usd !== undefined) {
+        budgets.push({
+          key: 'user_monthly',
+          type: 'user_monthly',
+          label: 'User Monthly Budget',
+          spent: spending.user_monthly_total,
+          limit: budgetConfig.user_monthly_budget_usd,
+        });
+      }
+
+      if (budgetConfig.workspace_daily_budget_usd !== undefined) {
+        budgets.push({
+          key: 'workspace_daily',
+          type: 'workspace_daily',
+          label: 'Workspace Daily Budget',
+          spent: spending.workspace_daily_total,
+          limit: budgetConfig.workspace_daily_budget_usd,
+        });
+      }
+
+      if (budgetConfig.workspace_monthly_budget_usd !== undefined) {
+        budgets.push({
+          key: 'workspace_monthly',
+          type: 'workspace_monthly',
+          label: 'Workspace Monthly Budget',
+          spent: spending.workspace_monthly_total,
+          limit: budgetConfig.workspace_monthly_budget_usd,
+        });
+      }
+
+      // Build cost summary from audit events
+      const auditLogger = gateway.getAuditLogger();
+      const allEvents = auditLogger.getAllEvents();
+      let estimatedTotal = 0;
+      let actualTotal = 0;
+      const toolCosts = new Map<string, number>();
+
+      for (const event of allEvents) {
+        if (event.event_type === 'BUDGET_CHECKED' && event.metadata) {
+          const estimated = typeof event.metadata.estimated_cost_usd === 'number' ? event.metadata.estimated_cost_usd : 0;
+          estimatedTotal += estimated;
+        }
+        if (event.event_type === 'USAGE_REPORTED' && event.metadata) {
+          const actual = typeof event.metadata.actual_cost_usd === 'number' ? event.metadata.actual_cost_usd : 0;
+          actualTotal += actual;
+        }
+        if (event.event_type === 'TOOL_EXECUTED') {
+          const toolName = event.tool_name || 'unknown';
+          toolCosts.set(toolName, (toolCosts.get(toolName) || 0) + 1);
+        }
+      }
+
+      const topTools = Array.from(toolCosts.entries())
+        .map(([tool_name, count]) => ({ tool_name, cost: count * 0.001 })) // approximate from count
+        .sort((a, b) => b.cost - a.cost)
+        .slice(0, 5);
+
+      const costSummary: CostSummary = {
+        estimated_total: estimatedTotal || spending.task_total,
+        actual_total: actualTotal,
+        top_tools: topTools,
+      };
+
+      res.send(budgetsTemplate(budgets, costSummary));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Unknown error';
+      res.status(500).send(layoutTemplate('Error', 'budgets',
+        `<div class="alert alert-error">Failed to load budgets: ${escapeHtml(message)}</div>`));
+    }
+  });
+
+  // ---------- GET /admin/traces -- Trace explorer ----------
+  router.get('/traces', (req, res) => {
+    try {
+      const taskIdQuery = typeof req.query.task_id === 'string' ? req.query.task_id : undefined;
+
+      // If a task_id is provided via query, redirect to detail page
+      if (taskIdQuery) {
+        res.redirect(`/admin/traces/${taskIdQuery}`);
+        return;
+      }
+
+      const page = Math.max(1, parseInt(req.query.page as string) || 1);
+      const limit = Math.min(Math.max(1, parseInt(req.query.limit as string) || 50), 200);
+
+      // Build a summary of recent task IDs from audit events
+      const auditLogger = gateway.getAuditLogger();
+      const allEvents = auditLogger.getAllEvents();
+
+      const taskMap = new Map<string, { event_count: number; first_seen: string }>();
+      for (const event of allEvents) {
+        const existing = taskMap.get(event.task_id);
+        if (existing) {
+          existing.event_count++;
+        } else {
+          taskMap.set(event.task_id, { event_count: 1, first_seen: event.timestamp });
+        }
+      }
+
+      const allTraces = Array.from(taskMap.entries())
+        .map(([task_id, info]) => ({ task_id, ...info }))
+        .reverse();
+
+      const total = allTraces.length;
+      const totalPages = Math.max(1, Math.ceil(total / limit));
+      const offset = (page - 1) * limit;
+      const traces = allTraces.slice(offset, offset + limit);
+
+      res.send(traceListTemplate(traces, { page, limit, total, totalPages }));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Unknown error';
+      res.status(500).send(layoutTemplate('Error', 'traces',
+        `<div class="alert alert-error">Failed to load traces: ${escapeHtml(message)}</div>`));
+    }
+  });
+
+  // ---------- GET /admin/traces/:task_id -- Trace detail ----------
+  router.get('/traces/:task_id', (req, res) => {
+    try {
+      const taskId = req.params.task_id;
+      const events = gateway.getTaskTrace(taskId);
+      res.send(traceDetailTemplate(taskId, events));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Unknown error';
+      res.status(500).send(layoutTemplate('Error', 'traces',
+        `<div class="alert alert-error">Failed to load trace detail: ${escapeHtml(message)}</div>`));
+    }
+  });
+
+  // ---------- GET /admin/api-keys -- API key management ----------
+  router.get('/api-keys', (req, res) => {
+    try {
+      const keys = getApiKeysFromConfig(config);
+      const csrfToken = generateCSRFToken();
+      const createdKey = typeof req.query.created === 'string' ? req.query.created : undefined;
+      res.send(apiKeysTemplate(keys, csrfToken, createdKey));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Unknown error';
+      res.status(500).send(layoutTemplate('Error', 'api-keys',
+        `<div class="alert alert-error">Failed to load API keys: ${escapeHtml(message)}</div>`));
+    }
+  });
+
+  // ---------- POST /admin/api-keys -- Create new API key ----------
+  router.post('/api-keys', (req, res) => {
+    if (!validateCSRFToken(req.body._csrf)) {
+      res.status(403).send('Invalid or missing CSRF token');
+      return;
+    }
+
+    const workspaceId = req.body.workspace_id || 'ws_default';
+    const description = req.body.description || '';
+
+    const newKey = `key-${randomUUID().replace(/-/g, '').substring(0, 16)}`;
+
+    config.auth.api_keys[newKey] = {
+      workspace_id: workspaceId,
+      description: description,
+      created_at: new Date().toISOString(),
+    };
+
+    res.redirect('/admin/api-keys?created=' + encodeURIComponent(newKey));
+  });
+
+  // ---------- POST /admin/api-keys/:key/revoke -- Revoke an API key ----------
+  router.post('/api-keys/:key/revoke', (req, res) => {
+    if (!validateCSRFToken(req.body._csrf)) {
+      res.status(403).send('Invalid or missing CSRF token');
+      return;
+    }
+
+    const key = req.params.key;
+
+    if (config.auth.api_keys[key]) {
+      config.auth.api_keys[key].revoked = true;
+    }
+
+    res.redirect('/admin/api-keys');
+  });
+
+  return router;
+}
+
+/** Extract API key info from the gateway config */
+function getApiKeysFromConfig(config: GatewayConfig): ApiKeyInfo[] {
+  const keys: ApiKeyInfo[] = [];
+
+  for (const [key, keyConfig] of Object.entries(config.auth.api_keys)) {
+    keys.push({
+      key,
+      workspace_id: keyConfig.workspace_id,
+      description: keyConfig.description,
+      roles: keyConfig.roles,
+      created_at: keyConfig.created_at,
+      last_used_at: keyConfig.last_used_at,
+      revoked: keyConfig.revoked,
+      expires_at: keyConfig.expires_at,
+    });
+  }
+
+  return keys;
+}