paygate-mcp 1.8.0 → 2.0.0

package/dist/server.js

@@ -41,6 +41,9 @@ const metrics_1 = require("./metrics");
 const dashboard_1 = require("./dashboard");
 const analytics_1 = require("./analytics");
 const alerts_1 = require("./alerts");
+const teams_1 = require("./teams");
+const redis_client_1 = require("./redis-client");
+const redis_sync_1 = require("./redis-sync");
 /** Max request body size: 1MB */
 const MAX_BODY_SIZE = 1_048_576;
 class PayGateServer {
@@ -67,11 +70,15 @@ class PayGateServer {
     analytics;
     /** Alert engine for proactive monitoring */
     alerts;
+    /** Team/organization manager */
+    teams;
+    /** Redis sync adapter for distributed state (null if not using Redis) */
+    redisSync = null;
     /** The active request handler — either proxy or router */
     get handler() {
         return (this.router || this.proxy);
     }
-    constructor(config, adminKey, statePath, remoteUrl, stripeWebhookSecret, servers) {
+    constructor(config, adminKey, statePath, remoteUrl, stripeWebhookSecret, servers, redisUrl) {
         this.config = { ...types_1.DEFAULT_CONFIG, ...config };
         this.adminKey = adminKey || `admin_${require('crypto').randomBytes(16).toString('hex')}`;
         this.gate = new gate_1.Gate(this.config, statePath);
@@ -129,8 +136,34 @@ class PayGateServer {
         this.metrics.registerGauge('paygate_pending_alerts_total', 'Number of pending alerts', () => {
             return this.alerts.pendingCount;
         });
+        // Team manager
+        this.teams = new teams_1.TeamManager();
+        this.metrics.registerGauge('paygate_active_teams_total', 'Number of active teams', () => {
+            return this.teams.listTeams().length;
+        });
+        // Wire team budget/quota checks into the gate
+        this.gate.teamChecker = (apiKey, credits) => {
+            const budgetCheck = this.teams.checkBudget(apiKey, credits);
+            if (!budgetCheck.allowed)
+                return budgetCheck;
+            return this.teams.checkQuota(apiKey, credits);
+        };
+        this.gate.teamRecorder = (apiKey, credits) => {
+            this.teams.recordUsage(apiKey, credits);
+        };
+        // Redis distributed state (if configured)
+        if (redisUrl) {
+            const redisOpts = (0, redis_client_1.parseRedisUrl)(redisUrl);
+            const redisClient = new redis_client_1.RedisClient(redisOpts);
+            this.redisSync = new redis_sync_1.RedisSync(redisClient, this.gate.store);
+        }
     }
     async start() {
+        // Initialize Redis sync before starting (loads state from Redis)
+        if (this.redisSync) {
+            await this.redisSync.init();
+            console.log('[paygate] Redis distributed state enabled');
+        }
         await this.handler.start();
         return new Promise((resolve, reject) => {
             this.server = (0, http_1.createServer)(async (req, res) => {
@@ -222,6 +255,23 @@ class PayGateServer {
                 if (req.method === 'POST')
                     return this.handleConfigureAlerts(req, res);
                 break;
+            // ─── Team management endpoints ────────────────────────────────────
+            case '/teams':
+                if (req.method === 'GET')
+                    return this.handleListTeams(req, res);
+                if (req.method === 'POST')
+                    return this.handleCreateTeam(req, res);
+                break;
+            case '/teams/update':
+                return this.handleUpdateTeam(req, res);
+            case '/teams/delete':
+                return this.handleDeleteTeam(req, res);
+            case '/teams/assign':
+                return this.handleTeamAssignKey(req, res);
+            case '/teams/remove':
+                return this.handleTeamRemoveKey(req, res);
+            case '/teams/usage':
+                return this.handleTeamUsage(req, res);
             // ─── OAuth 2.1 endpoints ─────────────────────────────────────────
             case '/.well-known/oauth-authorization-server':
                 return this.handleOAuthMetadata(req, res);
@@ -515,6 +565,12 @@ class PayGateServer {
                 metrics: 'GET /metrics — Prometheus metrics (public)',
                 analytics: 'GET /analytics — Usage analytics with time-series data (requires X-Admin-Key)',
                 alerts: 'GET /alerts — Get pending alerts + POST /alerts — Configure alert rules (requires X-Admin-Key)',
+                teams: 'GET /teams — List teams + POST /teams — Create team (requires X-Admin-Key)',
+                teamsUpdate: 'POST /teams/update — Update team (requires X-Admin-Key)',
+                teamsDelete: 'POST /teams/delete — Delete team (requires X-Admin-Key)',
+                teamsAssign: 'POST /teams/assign — Assign key to team (requires X-Admin-Key)',
+                teamsRemove: 'POST /teams/remove — Remove key from team (requires X-Admin-Key)',
+                teamsUsage: 'GET /teams/usage?teamId=... — Team usage summary (requires X-Admin-Key)',
                 ...(this.oauth ? {
                     oauthMetadata: 'GET /.well-known/oauth-authorization-server — OAuth 2.1 server metadata',
                     oauthRegister: 'POST /oauth/register — Register OAuth client',
@@ -526,6 +582,7 @@ class PayGateServer {
             },
             shadowMode: this.config.shadowMode,
             oauth: !!this.oauth,
+            redis: !!this.redisSync,
         }));
     }
     // ─── /status — Dashboard ────────────────────────────────────────────────────
@@ -1629,6 +1686,250 @@ class PayGateServer {
         }
         return true;
     }
+    // ─── /teams — Team management ────────────────────────────────────────────
+    handleListTeams(req, res) {
+        if (!this.checkAdmin(req, res))
+            return;
+        if (req.method !== 'GET') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed. Use GET.' }));
+            return;
+        }
+        const teams = this.teams.listTeams().map(t => ({
+            ...t,
+            memberKeys: t.memberKeys.map(k => k.slice(0, 7) + '...' + k.slice(-4)),
+        }));
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ teams, count: teams.length }));
+    }
+    async handleCreateTeam(req, res) {
+        if (!this.checkAdmin(req, res))
+            return;
+        if (req.method !== 'POST') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed. Use POST.' }));
+            return;
+        }
+        const body = await this.readBody(req);
+        let params;
+        try {
+            params = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON' }));
+            return;
+        }
+        if (!params.name || typeof params.name !== 'string') {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing required field: name' }));
+            return;
+        }
+        const team = this.teams.createTeam({
+            name: params.name,
+            description: params.description,
+            budget: params.budget,
+            quota: params.quota,
+            tags: params.tags,
+        });
+        this.audit.log('team.created', 'admin', `Team created: ${team.name}`, {
+            teamId: team.id,
+            teamName: team.name,
+            budget: team.budget,
+        });
+        this.gate.store.save();
+        res.writeHead(201, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ message: 'Team created', team }));
+    }
+    async handleUpdateTeam(req, res) {
+        if (!this.checkAdmin(req, res))
+            return;
+        if (req.method !== 'POST') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed. Use POST.' }));
+            return;
+        }
+        const body = await this.readBody(req);
+        let params;
+        try {
+            params = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON' }));
+            return;
+        }
+        if (!params.teamId || typeof params.teamId !== 'string') {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing required field: teamId' }));
+            return;
+        }
+        const success = this.teams.updateTeam(params.teamId, {
+            name: params.name,
+            description: params.description,
+            budget: params.budget,
+            quota: params.quota,
+            tags: params.tags,
+        });
+        if (!success) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Team not found or inactive' }));
+            return;
+        }
+        this.audit.log('team.updated', 'admin', `Team updated: ${params.teamId}`, { teamId: params.teamId });
+        this.gate.store.save();
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ message: 'Team updated', team: this.teams.getTeam(params.teamId) }));
+    }
+    async handleDeleteTeam(req, res) {
+        if (!this.checkAdmin(req, res))
+            return;
+        if (req.method !== 'POST') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed. Use POST.' }));
+            return;
+        }
+        const body = await this.readBody(req);
+        let params;
+        try {
+            params = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON' }));
+            return;
+        }
+        if (!params.teamId || typeof params.teamId !== 'string') {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing required field: teamId' }));
+            return;
+        }
+        const success = this.teams.deleteTeam(params.teamId);
+        if (!success) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Team not found or already deleted' }));
+            return;
+        }
+        this.audit.log('team.deleted', 'admin', `Team deleted: ${params.teamId}`, { teamId: params.teamId });
+        this.gate.store.save();
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ message: 'Team deleted' }));
+    }
+    async handleTeamAssignKey(req, res) {
+        if (!this.checkAdmin(req, res))
+            return;
+        if (req.method !== 'POST') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed. Use POST.' }));
+            return;
+        }
+        const body = await this.readBody(req);
+        let params;
+        try {
+            params = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON' }));
+            return;
+        }
+        if (!params.teamId || typeof params.teamId !== 'string') {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing required field: teamId' }));
+            return;
+        }
+        if (!params.key || typeof params.key !== 'string') {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing required field: key' }));
+            return;
+        }
+        // Verify the key exists
+        const keyRecord = this.gate.store.getKey(params.key);
+        if (!keyRecord) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'API key not found' }));
+            return;
+        }
+        const result = this.teams.assignKey(params.teamId, params.key);
+        if (!result.success) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: result.error }));
+            return;
+        }
+        this.audit.log('team.key_assigned', 'admin', `Key assigned to team ${params.teamId}`, {
+            teamId: params.teamId,
+            keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+        });
+        this.gate.store.save();
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ message: 'Key assigned to team' }));
+    }
+    async handleTeamRemoveKey(req, res) {
+        if (!this.checkAdmin(req, res))
+            return;
+        if (req.method !== 'POST') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed. Use POST.' }));
+            return;
+        }
+        const body = await this.readBody(req);
+        let params;
+        try {
+            params = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON' }));
+            return;
+        }
+        if (!params.teamId || typeof params.teamId !== 'string') {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing required field: teamId' }));
+            return;
+        }
+        if (!params.key || typeof params.key !== 'string') {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing required field: key' }));
+            return;
+        }
+        const success = this.teams.removeKey(params.teamId, params.key);
+        if (!success) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Key not found in team' }));
+            return;
+        }
+        this.audit.log('team.key_removed', 'admin', `Key removed from team ${params.teamId}`, {
+            teamId: params.teamId,
+            keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+        });
+        this.gate.store.save();
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ message: 'Key removed from team' }));
+    }
+    handleTeamUsage(req, res) {
+        if (!this.checkAdmin(req, res))
+            return;
+        if (req.method !== 'GET') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed. Use GET.' }));
+            return;
+        }
+        const url = new URL(req.url || '/', `http://localhost`);
+        const teamId = url.searchParams.get('teamId');
+        if (!teamId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing required query param: teamId' }));
+            return;
+        }
+        const summary = this.teams.getUsageSummary(teamId, (key) => this.gate.store.getKey(key));
+        if (!summary) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Team not found' }));
+            return;
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(summary));
+    }
     readBody(req) {
         return new Promise((resolve, reject) => {
             let body = '';
@@ -1652,6 +1953,9 @@ class PayGateServer {
         this.oauth?.destroy();
         this.sessions.destroy();
         this.audit.destroy();
+        if (this.redisSync) {
+            await this.redisSync.destroy();
+        }
         if (this.server) {
             return new Promise((resolve) => {
                 this.server.close(() => resolve());