paygate-mcp 4.8.0 → 5.0.0

package/dist/server.js

@@ -364,6 +364,8 @@ class PayGateServer {
                 return this.handleResumeKey(req, res);
             case '/keys/clone':
                 return this.handleCloneKey(req, res);
+            case '/keys/alias':
+                return this.handleSetAlias(req, res);
             case '/keys/rotate':
                 return this.handleRotateKey(req, res);
             case '/keys/acl':
@@ -436,6 +438,10 @@ class PayGateServer {
                 return this.handleWebhookStats(req, res);
             case '/webhooks/log':
                 return this.handleWebhookLog(req, res);
+            case '/webhooks/pause':
+                return this.handleWebhookPause(req, res);
+            case '/webhooks/resume':
+                return this.handleWebhookResume(req, res);
             case '/webhooks/test':
                 return this.handleWebhookTest(req, res);
             case '/webhooks/filters':
@@ -885,6 +891,7 @@ class PayGateServer {
                 suspendKey: 'POST /keys/suspend — Temporarily suspend a key (requires X-Admin-Key)',
                 resumeKey: 'POST /keys/resume — Resume a suspended key (requires X-Admin-Key)',
                 cloneKey: 'POST /keys/clone — Clone a key with same config (requires X-Admin-Key)',
+                keyAlias: 'POST /keys/alias — Set or clear a human-readable alias for a key (requires X-Admin-Key)',
                 rotateKey: 'POST /keys/rotate — Rotate a key (requires X-Admin-Key)',
                 setAcl: 'POST /keys/acl — Set tool ACL (requires X-Admin-Key)',
                 setExpiry: 'POST /keys/expiry — Set key expiry (requires X-Admin-Key)',
@@ -914,6 +921,8 @@ class PayGateServer {
                 webhookTest: 'POST /webhooks/test — Send test event to webhook URL and return result (requires X-Admin-Key)',
                 webhookStats: 'GET /webhooks/stats — Webhook delivery statistics (requires X-Admin-Key)',
                 webhookLog: 'GET /webhooks/log — Webhook delivery log with status, timing, and filters (requires X-Admin-Key)',
+                webhookPause: 'POST /webhooks/pause — Pause webhook delivery (events buffered) (requires X-Admin-Key)',
+                webhookResume: 'POST /webhooks/resume — Resume webhook delivery and flush buffered events (requires X-Admin-Key)',
                 webhookFilters: 'GET|POST /webhooks/filters — List or create webhook filter rules (requires X-Admin-Key)',
                 updateWebhookFilter: 'POST /webhooks/filters/update — Update a webhook filter rule (requires X-Admin-Key)',
                 deleteWebhookFilter: 'POST /webhooks/filters/delete — Delete a webhook filter rule (requires X-Admin-Key)',
@@ -1114,20 +1123,23 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Credits must be a positive integer' }));
             return;
         }
+        // Resolve alias to actual key
+        const resolved = this.gate.store.resolveKey(params.key);
+        const actualKey = resolved ? resolved.key : params.key;
         // Use Redis atomic topup when available, fall back to local store
         let success;
         if (this.redisSync) {
-            success = await this.redisSync.atomicTopup(params.key, credits);
+            success = await this.redisSync.atomicTopup(actualKey, credits);
         }
         else {
-            success = this.gate.store.addCredits(params.key, credits);
+            success = this.gate.store.addCredits(actualKey, credits);
         }
         if (!success) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Key not found or inactive' }));
             return;
         }
-        const record = this.gate.store.getKey(params.key);
+        const record = this.gate.store.getKey(actualKey);
         this.audit.log('key.topup', 'admin', `Added ${credits} credits`, {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             creditsAdded: credits,
@@ -1175,7 +1187,7 @@ class PayGateServer {
             return;
         }
         // Validate source key exists and has enough credits
-        const sourceRecord = this.gate.store.getKey(params.from);
+        const sourceRecord = this.gate.store.resolveKey(params.from);
         if (!sourceRecord) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Source key not found' }));
@@ -1189,7 +1201,7 @@ class PayGateServer {
             return;
         }
         // Validate destination key exists (getKey returns null for revoked/expired keys)
-        const destRecord = this.gate.store.getKey(params.to);
+        const destRecord = this.gate.store.resolveKey(params.to);
         if (!destRecord) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Destination key not found' }));
@@ -1198,13 +1210,13 @@ class PayGateServer {
         // Perform transfer atomically (deduct from source, add to destination)
         if (this.redisSync) {
             // Redis atomic transfer: deduct first, then add
-            const deducted = await this.redisSync.atomicDeduct(params.from, credits);
+            const deducted = await this.redisSync.atomicDeduct(sourceRecord.key, credits);
             if (!deducted) {
                 res.writeHead(400, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'Redis deduction failed (insufficient credits or key not found)' }));
                 return;
             }
-            await this.redisSync.atomicTopup(params.to, credits);
+            await this.redisSync.atomicTopup(destRecord.key, credits);
         }
         else {
             // Local store: deduct and add
@@ -1212,20 +1224,20 @@ class PayGateServer {
             destRecord.credits += credits;
             this.gate.store.save();
         }
-        const fromBalance = this.gate.store.getKey(params.from)?.credits ?? 0;
-        const toBalance = this.gate.store.getKey(params.to)?.credits ?? 0;
+        const fromBalance = sourceRecord.credits;
+        const toBalance = destRecord.credits;
         const memo = params.memo || '';
         this.audit.log('key.credits_transferred', 'admin', `Transferred ${credits} credits`, {
-            fromKeyMasked: (0, audit_1.maskKeyForAudit)(params.from),
-            toKeyMasked: (0, audit_1.maskKeyForAudit)(params.to),
+            fromKeyMasked: (0, audit_1.maskKeyForAudit)(sourceRecord.key),
+            toKeyMasked: (0, audit_1.maskKeyForAudit)(destRecord.key),
             credits,
             fromBalance,
             toBalance,
             memo,
         });
         this.emitWebhookAdmin('key.credits_transferred', 'admin', {
-            fromKeyMasked: (0, audit_1.maskKeyForAudit)(params.from),
-            toKeyMasked: (0, audit_1.maskKeyForAudit)(params.to),
+            fromKeyMasked: (0, audit_1.maskKeyForAudit)(sourceRecord.key),
+            toKeyMasked: (0, audit_1.maskKeyForAudit)(destRecord.key),
             credits,
             fromBalance,
             toBalance,
@@ -1234,8 +1246,8 @@ class PayGateServer {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
             transferred: credits,
-            from: { keyMasked: (0, audit_1.maskKeyForAudit)(params.from), balance: fromBalance },
-            to: { keyMasked: (0, audit_1.maskKeyForAudit)(params.to), balance: toBalance },
+            from: { keyMasked: (0, audit_1.maskKeyForAudit)(sourceRecord.key), balance: fromBalance, credits: fromBalance },
+            to: { keyMasked: (0, audit_1.maskKeyForAudit)(destRecord.key), balance: toBalance, credits: toBalance },
             memo: memo || undefined,
             message: `Transferred ${credits} credits`,
         }));
@@ -1509,13 +1521,16 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Missing key' }));
             return;
         }
+        // Resolve alias to actual key
+        const resolved = this.gate.store.resolveKeyRaw(params.key);
+        const actualKey = resolved ? resolved.key : params.key;
         // Use Redis-backed revoke when available (broadcasts to other instances)
         let success;
         if (this.redisSync) {
-            success = await this.redisSync.revokeKey(params.key);
+            success = await this.redisSync.revokeKey(actualKey);
         }
         else {
-            success = this.gate.store.revokeKey(params.key);
+            success = this.gate.store.revokeKey(actualKey);
         }
         if (!success) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
@@ -1523,13 +1538,13 @@ class PayGateServer {
             return;
         }
         this.audit.log('key.revoked', 'admin', `Key revoked`, {
-            keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+            keyMasked: (0, audit_1.maskKeyForAudit)(actualKey),
         });
         this.emitWebhookAdmin('key.revoked', 'admin', {
-            keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+            keyMasked: (0, audit_1.maskKeyForAudit)(actualKey),
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ message: 'Key revoked' }));
+        res.end(JSON.stringify({ message: 'Key revoked', revoked: true }));
     }
     // ─── /keys/suspend — Temporarily suspend a key ─────────────────────────────
     async handleSuspendKey(req, res) {
@@ -1555,7 +1570,7 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Missing key' }));
             return;
         }
-        const record = this.gate.store.getKeyRaw(params.key);
+        const record = this.gate.store.resolveKeyRaw(params.key);
         if (!record) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Key not found' }));
@@ -1571,19 +1586,19 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Key is already suspended' }));
             return;
         }
-        const success = this.gate.store.suspendKey(params.key);
+        const success = this.gate.store.suspendKey(record.key);
         if (!success) {
             res.writeHead(500, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Failed to suspend key' }));
             return;
         }
-        this.syncKeyMutation(params.key);
+        this.syncKeyMutation(record.key);
         this.audit.log('key.suspended', 'admin', `Key suspended${params.reason ? ': ' + params.reason : ''}`, {
-            keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+            keyMasked: (0, audit_1.maskKeyForAudit)(record.key),
             reason: params.reason || null,
         });
         this.emitWebhookAdmin('key.suspended', 'admin', {
-            keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+            keyMasked: (0, audit_1.maskKeyForAudit)(record.key),
             reason: params.reason || null,
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -1613,7 +1628,7 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Missing key' }));
             return;
         }
-        const record = this.gate.store.getKeyRaw(params.key);
+        const record = this.gate.store.resolveKeyRaw(params.key);
         if (!record) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Key not found' }));
@@ -1629,18 +1644,18 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Key is not suspended' }));
             return;
         }
-        const success = this.gate.store.resumeKey(params.key);
+        const success = this.gate.store.resumeKey(record.key);
         if (!success) {
             res.writeHead(500, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Failed to resume key' }));
             return;
         }
-        this.syncKeyMutation(params.key);
+        this.syncKeyMutation(record.key);
         this.audit.log('key.resumed', 'admin', 'Key resumed', {
-            keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+            keyMasked: (0, audit_1.maskKeyForAudit)(record.key),
         });
         this.emitWebhookAdmin('key.resumed', 'admin', {
-            keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+            keyMasked: (0, audit_1.maskKeyForAudit)(record.key),
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ message: 'Key resumed', suspended: false }));
@@ -1670,7 +1685,7 @@ class PayGateServer {
             return;
         }
         // Use getKeyRaw to allow cloning suspended/expired keys (but not revoked)
-        const source = this.gate.store.getKeyRaw(params.key);
+        const source = this.gate.store.resolveKeyRaw(params.key);
         if (!source) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Source key not found' }));
@@ -1681,7 +1696,7 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Cannot clone a revoked key' }));
             return;
         }
-        const cloned = this.gate.store.cloneKey(params.key, {
+        const cloned = this.gate.store.cloneKey(source.key, {
             name: params.name,
             credits: params.credits,
             tags: params.tags,
@@ -1694,14 +1709,14 @@ class PayGateServer {
         }
         // Sync new key to Redis
         this.syncKeyMutation(cloned.key);
-        this.audit.log('key.cloned', 'admin', `Key cloned from ${(0, audit_1.maskKeyForAudit)(params.key)}`, {
-            sourceKeyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+        this.audit.log('key.cloned', 'admin', `Key cloned from ${(0, audit_1.maskKeyForAudit)(source.key)}`, {
+            sourceKeyMasked: (0, audit_1.maskKeyForAudit)(source.key),
             newKeyMasked: (0, audit_1.maskKeyForAudit)(cloned.key),
             name: cloned.name,
             credits: cloned.credits,
         });
         this.emitWebhookAdmin('key.cloned', 'admin', {
-            sourceKeyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+            sourceKeyMasked: (0, audit_1.maskKeyForAudit)(source.key),
             newKeyMasked: (0, audit_1.maskKeyForAudit)(cloned.key),
             name: cloned.name,
             credits: cloned.credits,
@@ -1712,6 +1727,7 @@ class PayGateServer {
             key: cloned.key,
             name: cloned.name,
             credits: cloned.credits,
+            clonedFrom: source.key.slice(0, 10) + '...',
             sourceName: source.name,
             allowedTools: cloned.allowedTools,
             deniedTools: cloned.deniedTools,
@@ -1724,6 +1740,65 @@ class PayGateServer {
             spendingLimit: cloned.spendingLimit,
         }));
     }
+    // ─── /keys/alias — Set or clear key alias ──────────────────────────────────
+    async handleSetAlias(req, res) {
+        if (req.method !== 'POST') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed' }));
+            return;
+        }
+        if (!this.checkAdmin(req, res))
+            return;
+        const raw = await this.readBody(req);
+        const params = JSON.parse(raw);
+        if (!params.key) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing "key" parameter' }));
+            return;
+        }
+        // Resolve the key (support existing aliases for the source key)
+        const record = this.gate.store.resolveKeyRaw(params.key);
+        if (!record) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Key not found' }));
+            return;
+        }
+        const alias = params.alias !== undefined ? (params.alias === null || params.alias === '' ? null : String(params.alias)) : undefined;
+        if (alias === undefined) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing "alias" parameter (string to set, null to clear)' }));
+            return;
+        }
+        const result = this.gate.store.setAlias(record.key, alias);
+        if (!result.success) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: result.error }));
+            return;
+        }
+        const action = alias ? `set to "${alias}"` : 'cleared';
+        this.audit.log('key.alias_set', 'admin', `Key alias ${action} for ${record.key.slice(0, 10)}...`, {
+            key: record.key.slice(0, 10),
+            alias: alias || null,
+        });
+        // Sync to Redis if configured
+        if (typeof this.syncKeyMutation === 'function') {
+            this.syncKeyMutation(record.key);
+        }
+        // Webhook event
+        if (this.gate.webhook) {
+            this.gate.webhook.emitAdmin('key.created', 'admin', {
+                key: record.key.slice(0, 10),
+                alias: alias || null,
+                event: 'alias_set',
+            });
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            key: record.key.slice(0, 10) + '...',
+            alias: record.alias || null,
+            message: `Alias ${action}`,
+        }));
+    }
     // ─── /keys/rotate — Rotate API key ─────────────────────────────────────────
     async handleRotateKey(req, res) {
         if (req.method !== 'POST') {
@@ -1807,7 +1882,7 @@ class PayGateServer {
             return;
         }
         this.syncKeyMutation(params.key);
-        const record = this.gate.store.getKey(params.key);
+        const record = this.gate.store.resolveKey(params.key);
         this.audit.log('key.acl_updated', 'admin', `ACL updated`, {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             allowedTools: record?.allowedTools || [],
@@ -1859,7 +1934,7 @@ class PayGateServer {
             return;
         }
         this.syncKeyMutation(params.key);
-        const record = this.gate.store.getKeyRaw(params.key);
+        const record = this.gate.store.resolveKeyRaw(params.key);
         this.audit.log('key.expiry_updated', 'admin', expiresAt ? `Key expiry set to ${expiresAt}` : 'Key expiry removed', {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             expiresAt: record?.expiresAt || null,
@@ -1962,7 +2037,7 @@ class PayGateServer {
             return;
         }
         this.syncKeyMutation(params.key);
-        const record = this.gate.store.getKey(params.key);
+        const record = this.gate.store.resolveKey(params.key);
         this.audit.log('key.tags_updated', 'admin', `Tags updated`, {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             tags: record?.tags || {},
@@ -2009,7 +2084,7 @@ class PayGateServer {
             return;
         }
         this.syncKeyMutation(params.key);
-        const record = this.gate.store.getKey(params.key);
+        const record = this.gate.store.resolveKey(params.key);
         this.audit.log('key.ip_updated', 'admin', `IP allowlist updated`, {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             ipAllowlist: record?.ipAllowlist || [],
@@ -2066,14 +2141,14 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Missing key query parameter' }));
             return;
         }
-        // Verify key exists (use getKeyRaw to allow querying expired/suspended keys)
-        const record = this.gate.store.getKeyRaw(key);
+        // Verify key exists (use resolveKeyRaw to allow querying by alias and expired/suspended keys)
+        const record = this.gate.store.resolveKeyRaw(key);
         if (!record) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Key not found' }));
             return;
         }
-        const usage = this.gate.meter.getKeyUsage(key, since);
+        const usage = this.gate.meter.getKeyUsage(record.key, since);
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
             key: key.slice(0, 10) + '...',
@@ -2109,7 +2184,7 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Missing key' }));
             return;
         }
-        const record = this.gate.store.getKey(params.key);
+        const record = this.gate.store.resolveKey(params.key);
         if (!record) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Key not found or inactive' }));
@@ -2230,7 +2305,7 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Missing key' }));
             return;
         }
-        const record = this.gate.store.getKey(params.key);
+        const record = this.gate.store.resolveKey(params.key);
         if (!record) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Key not found or inactive' }));
@@ -2983,6 +3058,61 @@ class PayGateServer {
             entries,
         }));
     }
+    // ─── /webhooks/pause — Pause webhook delivery ─────────────────────────────
+    handleWebhookPause(req, res) {
+        if (req.method !== 'POST') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed' }));
+            return;
+        }
+        if (!this.checkAdmin(req, res))
+            return;
+        if (!this.gate.webhook) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'No webhook configured' }));
+            return;
+        }
+        const paused = this.gate.webhook.pause();
+        if (!paused) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ paused: true, message: 'Already paused' }));
+            return;
+        }
+        this.audit.log('webhook.pause', 'admin', 'Webhook delivery paused');
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            paused: true,
+            message: 'Webhook delivery paused. Events will be buffered until resumed.',
+        }));
+    }
+    // ─── /webhooks/resume — Resume webhook delivery ───────────────────────────
+    handleWebhookResume(req, res) {
+        if (req.method !== 'POST') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed' }));
+            return;
+        }
+        if (!this.checkAdmin(req, res))
+            return;
+        if (!this.gate.webhook) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'No webhook configured' }));
+            return;
+        }
+        const result = this.gate.webhook.resume();
+        if (!result.resumed) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ paused: false, message: 'Not paused' }));
+            return;
+        }
+        this.audit.log('webhook.resume', 'admin', `Webhook delivery resumed, ${result.flushedEvents} buffered events flushed`);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            paused: false,
+            message: 'Webhook delivery resumed.',
+            flushedEvents: result.flushedEvents,
+        }));
+    }
     // ─── /webhooks/test — Send test event ────────────────────────────────────
     async handleWebhookTest(req, res) {
         if (req.method !== 'POST') {
@@ -3478,7 +3608,7 @@ class PayGateServer {
             return;
         }
         // Verify the key exists
-        const keyRecord = this.gate.store.getKey(params.key);
+        const keyRecord = this.gate.store.resolveKey(params.key);
         if (!keyRecord) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'API key not found' }));
@@ -3597,7 +3727,7 @@ class PayGateServer {
             return;
         }
         // Verify the parent key exists and is active
-        const keyRecord = this.gate.store.getKey(params.key);
+        const keyRecord = this.gate.store.resolveKey(params.key);
         if (!keyRecord || !keyRecord.active) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'API key not found or inactive' }));