pi-kot 0.1.21 → 0.1.22

package/server/routes/auth.js

@@ -0,0 +1,225 @@
+import { randomBytes, timingSafeEqual, createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { config } from "../config.js";
+/**
+ * Minimal JWT-like token for auth. Uses HMAC-SHA256 with a server-generated
+ * secret (rotated on restart since sessions are ephemeral).
+ *
+ * Simplified auth — Phase 1a uses a basic API key or
+ * JWT pattern. In production, this uses proper jsonwebtoken + scrypt.
+ */
+const TOKEN_SECRET = randomBytes(32).toString("hex");
+function signHmac(payload) {
+    const hmac = createHash("sha256")
+        .update(payload + TOKEN_SECRET)
+        .digest("hex");
+    return `${Buffer.from(payload).toString("base64url")}.${hmac}`;
+}
+export function verifyHmac(token) {
+    const dot = token.lastIndexOf(".");
+    if (dot === -1)
+        return undefined;
+    const payloadB64 = token.slice(0, dot);
+    const sig = token.slice(dot + 1);
+    const payload = Buffer.from(payloadB64, "base64url").toString("utf8");
+    const expected = createHash("sha256")
+        .update(payload + TOKEN_SECRET)
+        .digest("hex");
+    if (sig.length !== expected.length)
+        return undefined;
+    try {
+        if (!timingSafeEqual(Buffer.from(sig), Buffer.from(expected)))
+            return undefined;
+    }
+    catch {
+        return undefined;
+    }
+    return payload;
+}
+export function extractBearer(header) {
+    if (header === undefined)
+        return undefined;
+    const match = header.match(/^Bearer\s+(.+)$/i);
+    return match?.[1];
+}
+export function authEnabled() {
+    return config.uiPassword !== undefined || config.apiKey !== undefined;
+}
+/**
+ * Read the installed SDK version from its package.json at runtime.
+ */
+function readSdkVersion() {
+    try {
+        const pkgPath = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "..", "node_modules", "@earendil-works", "pi-coding-agent", "package.json");
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+        return pkg.version ?? "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+/**
+ * Read the server package version.
+ */
+function readServerVersion() {
+    try {
+        const pkgPath = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+        return pkg.version ?? "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+const INSTALLED_SDK = readSdkVersion();
+const SERVER_VERSION = readServerVersion();
+export const versionRoutes = async (fastify) => {
+    // GET /api/v1/version — public
+    fastify.get("/version", {
+        config: { public: true },
+        schema: {
+            description: "Version info — no auth required.",
+            tags: ["version"],
+            security: [],
+            response: {
+                200: {
+                    type: "object",
+                    required: ["serverVersion", "sdkVersion"],
+                    properties: {
+                        serverVersion: { type: "string" },
+                        sdkVersion: { type: "string" },
+                    },
+                },
+            },
+        },
+    }, async () => ({
+        serverVersion: SERVER_VERSION,
+        sdkVersion: INSTALLED_SDK,
+    }));
+    // GET /api/v1/version/check-update — public, checks npm for latest SDK
+    fastify.get("/version/check-update", {
+        config: { public: true },
+        schema: {
+            description: "Check npm for the latest pi-coding-agent version.",
+            tags: ["version"],
+            security: [],
+            response: {
+                200: {
+                    type: "object",
+                    required: ["serverVersion", "sdkVersion", "latestSdkVersion", "updateAvailable"],
+                    properties: {
+                        serverVersion: { type: "string" },
+                        sdkVersion: { type: "string" },
+                        latestSdkVersion: { type: "string" },
+                        updateAvailable: { type: "boolean" },
+                    },
+                },
+            },
+        },
+    }, async () => {
+        let latest = INSTALLED_SDK;
+        let updateAvailable = false;
+        try {
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 8000);
+            const res = await fetch("https://registry.npmjs.org/@earendil-works/pi-coding-agent/latest", { signal: controller.signal });
+            clearTimeout(timeout);
+            if (res.ok) {
+                const data = (await res.json());
+                latest = data.version ?? latest;
+                updateAvailable = latest !== INSTALLED_SDK;
+            }
+        }
+        catch {
+            // npm check failed — just return current versions
+        }
+        return {
+            serverVersion: SERVER_VERSION,
+            sdkVersion: INSTALLED_SDK,
+            latestSdkVersion: latest,
+            updateAvailable,
+        };
+    });
+};
+export const healthRoutes = async (fastify) => {
+    // GET /api/v1/health — public, no auth
+    fastify.get("/health", {
+        config: { public: true },
+        schema: {
+            description: "Health check — no auth required.",
+            tags: ["health"],
+            security: [],
+            response: {
+                200: {
+                    type: "object",
+                    required: ["status"],
+                    properties: {
+                        status: { type: "string", enum: ["ok"] },
+                        activeSessions: { type: "integer", minimum: 0 },
+                    },
+                },
+            },
+        },
+    }, async () => {
+        const { sessionCount } = await import("../session-store.js");
+        return { status: "ok", activeSessions: sessionCount() };
+    });
+};
+export const authRoutes = async (fastify) => {
+    // GET /api/v1/auth/status — public
+    fastify.get("/auth/status", {
+        config: { public: true },
+        schema: {
+            description: "Whether auth is enabled.",
+            tags: ["auth"],
+            security: [],
+            response: {
+                200: {
+                    type: "object",
+                    required: ["authEnabled"],
+                    properties: { authEnabled: { type: "boolean" } },
+                },
+            },
+        },
+    }, async () => ({ authEnabled: authEnabled() }));
+    // POST /api/v1/auth/login — public (rate-limited)
+    fastify.post("/auth/login", {
+        config: { public: true },
+        schema: {
+            description: "Login with password → JWT token.",
+            tags: ["auth"],
+            security: [],
+            body: {
+                type: "object",
+                required: ["password"],
+                properties: { password: { type: "string" } },
+            },
+            response: {
+                200: {
+                    type: "object",
+                    required: ["token"],
+                    properties: { token: { type: "string" } },
+                },
+                401: {
+                    type: "object",
+                    properties: { error: { type: "string" } },
+                },
+            },
+        },
+    }, async (req, reply) => {
+        if (!authEnabled()) {
+            return reply.code(401).send({ error: "auth_not_configured" });
+        }
+        const { password } = req.body;
+        const valid = (config.uiPassword !== undefined && password === config.uiPassword) ||
+            (config.apiKey !== undefined && password === config.apiKey);
+        if (!valid) {
+            return reply.code(401).send({ error: "invalid_credentials" });
+        }
+        const token = signHmac(`user:${Date.now()}`);
+        return { token };
+    });
+};
+//# sourceMappingURL=auth.js.map

package/server/routes/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAErD,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC;SAC9B,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;SAClC,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC;SAC9B,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,CAAC;QACH,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAA0B;IACtD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC/C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CACrB,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,CACf,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CACrB,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,IAAI,EACJ,IAAI,EACJ,cAAc,CACf,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAG,cAAc,EAAE,CAAC;AACvC,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAC;AAE3C,MAAM,CAAC,MAAM,aAAa,GAAuB,KAAK,EAAE,OAAO,EAAE,EAAE;IACjE,+BAA+B;IAC/B,OAAO,CAAC,GAAG,CACT,UAAU,EACV;QACE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACxB,MAAM,EAAE;YACN,WAAW,EAAE,kCAAkC;YAC/C,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE;gBACR,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,CAAC,eAAe,EAAE,YAAY,CAAC;oBACzC,UAAU,EAAE;wBACV,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACjC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAC/B;iBACF;aACF;SACF;KACF,EACD,KAAK,IAAI,EAAE,CAAC,CAAC;QACX,aAAa,EAAE,cAAc;QAC7B,UAAU,EAAE,aAAa;KAC1B,CAAC,CACH,CAAC;IAEF,uEAAuE;IACvE,OAAO,CAAC,GAAG,CACT,uBAAuB,EACvB;QACE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACxB,MAAM,EAAE;YACN,WAAW,EAAE,mDAAmD;YAChE,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE;gBACR,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,CAAC,eAAe,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,CAAC;oBAChF,UAAU,EAAE;wBACV,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACjC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAC9B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACpC,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;qBACrC;iBACF;aACF;SACF;KACF,EACD,KAAK,IAAI,EAAE;QACT,IAAI,MAAM,GAAG,aAAa,CAAC;QAC3B,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,mEAAmE,EACnE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAC9B,CAAC;YACF,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;gBACvD,MAAM,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC;gBAChC,eAAe,GAAG,MAAM,KAAK,aAAa,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;QACD,OAAO;YACL,aAAa,EAAE,cAAc;YAC7B,UAAU,EAAE,aAAa;YACzB,gBAAgB,EAAE,MAAM;YACxB,eAAe;SAChB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAuB,KAAK,EAAE,OAAO,EAAE,EAAE;IAChE,uCAAuC;IACvC,OAAO,CAAC,GAAG,CACT,SAAS,EACT;QACE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACxB,MAAM,EAAE;YACN,WAAW,EAAE,kCAAkC;YAC/C,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE;gBACR,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,CAAC,QAAQ,CAAC;oBACpB,UAAU,EAAE;wBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE;wBACxC,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;qBAChD;iBACF;aACF;SACF;KACF,EACD,KAAK,IAAI,EAAE;QACT,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC7D,OAAO,EAAE,MAAM,EAAE,IAAa,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,CAAC;IACnE,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAuB,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9D,mCAAmC;IACnC,OAAO,CAAC,GAAG,CACT,cAAc,EACd;QACE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACxB,MAAM,EAAE;YACN,WAAW,EAAE,0BAA0B;YACvC,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE;gBACR,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,CAAC,aAAa,CAAC;oBACzB,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;iBACjD;aACF;SACF;KACF,EACD,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,CAAC,CAC7C,CAAC;IAEF,kDAAkD;IAClD,OAAO,CAAC,IAAI,CACV,aAAa,EACb;QACE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACxB,MAAM,EAAE;YACN,WAAW,EAAE,kCAAkC;YAC/C,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,QAAQ,EAAE,EAAE;YACZ,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,CAAC,UAAU,CAAC;gBACtB,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;aAC7C;YACD,QAAQ,EAAE;gBACR,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,CAAC,OAAO,CAAC;oBACnB,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;iBAC1C;gBACD,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;iBAC1C;aACF;SACF;KACF,EACD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAA4B,CAAC;QACtD,MAAM,KAAK,GACT,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,QAAQ,KAAK,MAAM,CAAC,UAAU,CAAC;YACnE,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC,CACF,CAAC;AACJ,CAAC,CAAC"}

package/server/routes/config.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyPluginAsync } from "fastify";
+export declare const configRoutes: FastifyPluginAsync;
+//# sourceMappingURL=config.d.ts.map

package/server/routes/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAwElD,eAAO,MAAM,YAAY,EAAE,kBA8pB1B,CAAC"}