profclaw 0.0.1-beta.1

package/dist/auth/device-identity.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Device Identity Management
+ *
+ * Uses ED25519 key pairs for cryptographic device identification.
+ * Adapted from OpenClaw reference implementation.
+ *
+ * Features:
+ * - Deterministic device ID derived from public key
+ * - Secure signature creation and verification
+ * - Persistent storage with secure file permissions
+ */
+/**
+ * Device identity structure
+ */
+export interface DeviceIdentity {
+    /** SHA256 hash of public key (deterministic, verifiable) */
+    deviceId: string;
+    /** PEM-encoded public key */
+    publicKeyPem: string;
+    /** PEM-encoded private key (never share!) */
+    privateKeyPem: string;
+    /** Human-readable device name */
+    displayName?: string;
+    /** Platform identifier */
+    platform?: string;
+    /** Creation timestamp */
+    createdAt: string;
+}
+/**
+ * Load existing device identity or create new one
+ */
+export declare function loadOrCreateDeviceIdentity(identityDir?: string, options?: {
+    displayName?: string;
+}): DeviceIdentity;
+/**
+ * Get device identity (read-only, no creation)
+ */
+export declare function getDeviceIdentity(identityDir?: string): DeviceIdentity | null;
+/**
+ * Sign a payload with the device's private key
+ * Returns base64url-encoded signature
+ */
+export declare function signPayload(privateKeyPem: string, payload: string): string;
+/**
+ * Verify a signature against a public key
+ */
+export declare function verifySignature(publicKeyPem: string, payload: string, signature: string): boolean;
+/**
+ * Create a signed device attestation
+ * Useful for proving device identity to a server
+ */
+export declare function createDeviceAttestation(identity: DeviceIdentity, additionalData?: Record<string, unknown>): {
+    deviceId: string;
+    publicKey: string;
+    attestation: {
+        timestamp: string;
+        nonce: string;
+        data?: Record<string, unknown>;
+        signature: string;
+    };
+};
+/**
+ * Verify a device attestation
+ */
+export declare function verifyDeviceAttestation(attestation: {
+    deviceId: string;
+    publicKey: string;
+    attestation: {
+        timestamp: string;
+        nonce: string;
+        data?: Record<string, unknown>;
+        signature: string;
+    };
+}, options?: {
+    /** Maximum age of attestation in milliseconds */
+    maxAgeMs?: number;
+    /** Expected device ID (if known) */
+    expectedDeviceId?: string;
+}): {
+    valid: boolean;
+    error?: string;
+};
+/**
+ * Export public identity (safe to share)
+ */
+export declare function exportPublicIdentity(identity: DeviceIdentity): {
+    deviceId: string;
+    publicKey: string;
+    displayName?: string;
+    platform?: string;
+};
+/**
+ * Verify that a device ID was derived from a public key
+ */
+export declare function verifyDeviceIdDerivation(deviceId: string, publicKeyPem: string): boolean;
+//# sourceMappingURL=device-identity.d.ts.map

package/dist/auth/device-identity.js

@@ -0,0 +1,250 @@
+/**
+ * Device Identity Management
+ *
+ * Uses ED25519 key pairs for cryptographic device identification.
+ * Adapted from OpenClaw reference implementation.
+ *
+ * Features:
+ * - Deterministic device ID derived from public key
+ * - Secure signature creation and verification
+ * - Persistent storage with secure file permissions
+ */
+import { generateKeyPairSync, createSign, createVerify, createHash, randomUUID, } from 'crypto';
+import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+/**
+ * Default identity file path
+ */
+const DEFAULT_IDENTITY_DIR = join(homedir(), '.profclaw', 'identity');
+const DEFAULT_IDENTITY_FILE = 'device.json';
+/**
+ * Generate a new ED25519 key pair
+ */
+function generateKeyPair() {
+    const { publicKey, privateKey } = generateKeyPairSync('ed25519', {
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    });
+    return { publicKey, privateKey };
+}
+/**
+ * Derive device ID from public key (SHA256 hash)
+ */
+function deriveDeviceId(publicKeyPem) {
+    return createHash('sha256')
+        .update(publicKeyPem)
+        .digest('hex')
+        .slice(0, 32); // First 32 chars for readability
+}
+/**
+ * Get platform identifier
+ */
+function getPlatform() {
+    const platformMap = {
+        darwin: 'macos',
+        win32: 'windows',
+        linux: 'linux',
+        freebsd: 'freebsd',
+    };
+    return platformMap[process.platform] || process.platform;
+}
+/**
+ * Ensure directory exists with secure permissions
+ */
+function ensureSecureDirectory(dirPath) {
+    if (!existsSync(dirPath)) {
+        mkdirSync(dirPath, { recursive: true, mode: 0o700 }); // rwx------
+    }
+}
+/**
+ * Write file with secure permissions
+ */
+function writeSecureFile(filePath, content) {
+    writeFileSync(filePath, content, { mode: 0o600 }); // rw-------
+    // Ensure permissions are correct even if file existed
+    chmodSync(filePath, 0o600);
+}
+/**
+ * Load existing device identity or create new one
+ */
+export function loadOrCreateDeviceIdentity(identityDir = DEFAULT_IDENTITY_DIR, options) {
+    const filePath = join(identityDir, DEFAULT_IDENTITY_FILE);
+    // Try to load existing identity
+    if (existsSync(filePath)) {
+        try {
+            const content = readFileSync(filePath, 'utf-8');
+            const data = JSON.parse(content);
+            // Validate version
+            if (data.version !== 1) {
+                console.warn(`[DeviceIdentity] Unknown version ${data.version}, creating new identity`);
+            }
+            else {
+                console.log(`[DeviceIdentity] Loaded existing identity: ${data.deviceId.slice(0, 8)}...`);
+                return {
+                    deviceId: data.deviceId,
+                    publicKeyPem: data.publicKeyPem,
+                    privateKeyPem: data.privateKeyPem,
+                    displayName: data.displayName,
+                    platform: data.platform,
+                    createdAt: data.createdAt,
+                };
+            }
+        }
+        catch (error) {
+            console.warn(`[DeviceIdentity] Failed to load identity, creating new one:`, error);
+        }
+    }
+    // Create new identity
+    console.log('[DeviceIdentity] Creating new device identity...');
+    const { publicKey, privateKey } = generateKeyPair();
+    const deviceId = deriveDeviceId(publicKey);
+    const identity = {
+        deviceId,
+        publicKeyPem: publicKey,
+        privateKeyPem: privateKey,
+        displayName: options?.displayName || `profClaw Device ${deviceId.slice(0, 8)}`,
+        platform: getPlatform(),
+        createdAt: new Date().toISOString(),
+    };
+    // Persist to disk
+    ensureSecureDirectory(identityDir);
+    const fileData = {
+        version: 1,
+        ...identity,
+    };
+    writeSecureFile(filePath, JSON.stringify(fileData, null, 2));
+    console.log(`[DeviceIdentity] Created new identity: ${deviceId.slice(0, 8)}...`);
+    return identity;
+}
+/**
+ * Get device identity (read-only, no creation)
+ */
+export function getDeviceIdentity(identityDir = DEFAULT_IDENTITY_DIR) {
+    const filePath = join(identityDir, DEFAULT_IDENTITY_FILE);
+    if (!existsSync(filePath)) {
+        return null;
+    }
+    try {
+        const content = readFileSync(filePath, 'utf-8');
+        const data = JSON.parse(content);
+        return {
+            deviceId: data.deviceId,
+            publicKeyPem: data.publicKeyPem,
+            privateKeyPem: data.privateKeyPem,
+            displayName: data.displayName,
+            platform: data.platform,
+            createdAt: data.createdAt,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Sign a payload with the device's private key
+ * Returns base64url-encoded signature
+ */
+export function signPayload(privateKeyPem, payload) {
+    const sign = createSign('SHA256');
+    sign.update(payload);
+    sign.end();
+    const signature = sign.sign(privateKeyPem);
+    return signature.toString('base64url');
+}
+/**
+ * Verify a signature against a public key
+ */
+export function verifySignature(publicKeyPem, payload, signature) {
+    try {
+        const verify = createVerify('SHA256');
+        verify.update(payload);
+        verify.end();
+        return verify.verify(publicKeyPem, Buffer.from(signature, 'base64url'));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Create a signed device attestation
+ * Useful for proving device identity to a server
+ */
+export function createDeviceAttestation(identity, additionalData) {
+    const timestamp = new Date().toISOString();
+    const nonce = randomUUID();
+    // Build payload to sign
+    const payloadObj = {
+        deviceId: identity.deviceId,
+        timestamp,
+        nonce,
+        ...(additionalData && { data: additionalData }),
+    };
+    const payload = JSON.stringify(payloadObj);
+    // Sign payload
+    const signature = signPayload(identity.privateKeyPem, payload);
+    return {
+        deviceId: identity.deviceId,
+        publicKey: identity.publicKeyPem,
+        attestation: {
+            timestamp,
+            nonce,
+            data: additionalData,
+            signature,
+        },
+    };
+}
+/**
+ * Verify a device attestation
+ */
+export function verifyDeviceAttestation(attestation, options) {
+    // Verify device ID matches public key
+    const derivedDeviceId = deriveDeviceId(attestation.publicKey);
+    if (derivedDeviceId !== attestation.deviceId) {
+        return { valid: false, error: 'Device ID does not match public key' };
+    }
+    // Check expected device ID if provided
+    if (options?.expectedDeviceId && attestation.deviceId !== options.expectedDeviceId) {
+        return { valid: false, error: 'Device ID mismatch' };
+    }
+    // Check timestamp freshness
+    if (options?.maxAgeMs) {
+        const attestationTime = new Date(attestation.attestation.timestamp).getTime();
+        const now = Date.now();
+        if (now - attestationTime > options.maxAgeMs) {
+            return { valid: false, error: 'Attestation expired' };
+        }
+    }
+    // Rebuild and verify payload
+    const payloadObj = {
+        deviceId: attestation.deviceId,
+        timestamp: attestation.attestation.timestamp,
+        nonce: attestation.attestation.nonce,
+        ...(attestation.attestation.data && { data: attestation.attestation.data }),
+    };
+    const payload = JSON.stringify(payloadObj);
+    const signatureValid = verifySignature(attestation.publicKey, payload, attestation.attestation.signature);
+    if (!signatureValid) {
+        return { valid: false, error: 'Invalid signature' };
+    }
+    return { valid: true };
+}
+/**
+ * Export public identity (safe to share)
+ */
+export function exportPublicIdentity(identity) {
+    return {
+        deviceId: identity.deviceId,
+        publicKey: identity.publicKeyPem,
+        displayName: identity.displayName,
+        platform: identity.platform,
+    };
+}
+/**
+ * Verify that a device ID was derived from a public key
+ */
+export function verifyDeviceIdDerivation(deviceId, publicKeyPem) {
+    const derived = deriveDeviceId(publicKeyPem);
+    return derived === deviceId;
+}
+//# sourceMappingURL=device-identity.js.map

package/dist/auth/github-oauth.d.ts

@@ -0,0 +1,20 @@
+import { Context } from 'hono';
+/**
+ * Redirect user to GitHub for OAuth
+ */
+export declare function redirectToGitHub(c: Context): Promise<(Response & import("hono").TypedResponse<undefined, 302, "redirect">) | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 500, "json">)>;
+/**
+ * Handle GitHub OAuth callback
+ */
+export declare function handleGitHubCallback(c: Context): Promise<(Response & import("hono").TypedResponse<{
+    error: string;
+}, 500, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 400, "json">) | (Response & import("hono").TypedResponse<{
+    message: string;
+    access_token: string;
+    scope: string;
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">)>;
+//# sourceMappingURL=github-oauth.d.ts.map

package/dist/auth/github-oauth.js

@@ -0,0 +1,59 @@
+import { getGitHubOAuthConfig } from '../settings/index.js';
+/**
+ * Redirect user to GitHub for OAuth
+ */
+export async function redirectToGitHub(c) {
+    const config = await getGitHubOAuthConfig();
+    if (!config?.clientId) {
+        return c.json({ error: 'GitHub OAuth not configured' }, 500);
+    }
+    const state = Math.random().toString(36).substring(7);
+    // Store state in session/cookie if needed for CSRF protection
+    const url = `https://github.com/login/oauth/authorize?client_id=${config.clientId}&redirect_uri=${encodeURIComponent(config.redirectUri)}&scope=repo,user,workflow&state=${state}`;
+    return c.redirect(url);
+}
+/**
+ * Handle GitHub OAuth callback
+ */
+export async function handleGitHubCallback(c) {
+    const code = c.req.query('code');
+    const _state = c.req.query('state');
+    const config = await getGitHubOAuthConfig();
+    if (!config?.clientId || !config?.clientSecret) {
+        return c.json({ error: 'GitHub OAuth not configured' }, 500);
+    }
+    if (!code) {
+        return c.json({ error: 'No code provided' }, 400);
+    }
+    try {
+        const response = await fetch('https://github.com/login/oauth/access_token', {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Accept': 'application/json',
+            },
+            body: JSON.stringify({
+                client_id: config.clientId,
+                client_secret: config.clientSecret,
+                code,
+                redirect_uri: config.redirectUri,
+            }),
+        });
+        const data = await response.json();
+        if (data.error) {
+            return c.json({ error: data.error, description: data.error_description }, 400);
+        }
+        // In a real app, we would store this token in a database linked to the user
+        // For now, we'll return it so the user can see it works
+        return c.json({
+            message: 'GitHub connected successfully',
+            access_token: data.access_token,
+            scope: data.scope,
+        });
+    }
+    catch (error) {
+        console.error('[GitHub Auth] Callback error:', error);
+        return c.json({ error: 'Internal server error' }, 500);
+    }
+}
+//# sourceMappingURL=github-oauth.js.map

package/dist/auth/jira-oauth.d.ts

@@ -0,0 +1,25 @@
+import type { Context } from 'hono';
+/**
+ * Redirect user to Atlassian (Jira) for authorization
+ */
+export declare function redirectToJira(c: Context): Promise<(Response & import("hono").TypedResponse<{
+    error: string;
+}, 500, "json">) | (Response & import("hono").TypedResponse<undefined, 302, "redirect">)>;
+/**
+ * Handle Atlassian OAuth callback
+ */
+export declare function handleJiraCallback(c: Context): Promise<(Response & import("hono").TypedResponse<{
+    error: string;
+}, 400, "json">) | (Response & import("hono").TypedResponse<{
+    message: string;
+    access_token: string;
+    refresh_token: string;
+    sites: {
+        id: string;
+        name: string;
+        url: string;
+    }[];
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 500, "json">)>;
+//# sourceMappingURL=jira-oauth.d.ts.map

package/dist/auth/jira-oauth.js

@@ -0,0 +1,75 @@
+import { logger } from '../utils/logger.js';
+const CLIENT_ID = process.env.JIRA_CLIENT_ID || '';
+const CLIENT_SECRET = process.env.JIRA_CLIENT_SECRET || '';
+const REDIRECT_URI = process.env.JIRA_REDIRECT_URI || '';
+/**
+ * Redirect user to Atlassian (Jira) for authorization
+ */
+export async function redirectToJira(c) {
+    if (!CLIENT_ID || !REDIRECT_URI) {
+        return c.json({ error: 'Jira OAuth not configured' }, 500);
+    }
+    // Scopes for Jira: read and write issues
+    const scopes = [
+        'read:jira-work',
+        'write:jira-work',
+        'read:jira-user',
+        'offline_access'
+    ].join(' ');
+    const authUrl = new URL('https://auth.atlassian.com/authorize');
+    authUrl.searchParams.append('audience', 'api.atlassian.com');
+    authUrl.searchParams.append('client_id', CLIENT_ID);
+    authUrl.searchParams.append('scope', scopes);
+    authUrl.searchParams.append('redirect_uri', REDIRECT_URI);
+    authUrl.searchParams.append('state', Math.random().toString(36).substring(7));
+    authUrl.searchParams.append('response_type', 'code');
+    authUrl.searchParams.append('prompt', 'consent');
+    return c.redirect(authUrl.toString());
+}
+/**
+ * Handle Atlassian OAuth callback
+ */
+export async function handleJiraCallback(c) {
+    const code = c.req.query('code');
+    if (!code) {
+        return c.json({ error: 'No code provided' }, 400);
+    }
+    try {
+        const response = await fetch('https://auth.atlassian.com/oauth/token', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'Accept': 'application/json' },
+            body: JSON.stringify({
+                grant_type: 'authorization_code',
+                client_id: CLIENT_ID,
+                client_secret: CLIENT_SECRET,
+                code,
+                redirect_uri: REDIRECT_URI,
+            }),
+        });
+        const data = await response.json();
+        if (data.error) {
+            return c.json({ error: data.error, description: data.error_description }, 400);
+        }
+        // After getting the token, we usually need to call /oauth/token/accessible-resources
+        // to find the cloudId of the Jira site they authorized
+        const resourcesResponse = await fetch('https://api.atlassian.com/oauth/token/accessible-resources', {
+            headers: { 'Authorization': `Bearer ${data.access_token}` },
+        });
+        const resources = await resourcesResponse.json();
+        return c.json({
+            message: 'Jira connected successfully',
+            access_token: data.access_token,
+            refresh_token: data.refresh_token,
+            sites: resources.map(r => ({
+                id: r.id, // cloudId
+                name: r.name,
+                url: r.url
+            }))
+        });
+    }
+    catch (error) {
+        logger.error('[Jira Auth] Callback error:', error);
+        return c.json({ error: 'Failed to exchange code for token' }, 500);
+    }
+}
+//# sourceMappingURL=jira-oauth.js.map

package/dist/auth/linear-oauth.d.ts

@@ -0,0 +1,21 @@
+import type { Context } from 'hono';
+/**
+ * Redirect user to Linear for authorization
+ */
+export declare function redirectToLinear(c: Context): Promise<(Response & import("hono").TypedResponse<undefined, 302, "redirect">) | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 500, "json">)>;
+/**
+ * Handle Linear OAuth callback
+ */
+export declare function handleLinearCallback(c: Context): Promise<(Response & import("hono").TypedResponse<{
+    error: string;
+}, 400, "json">) | (Response & import("hono").TypedResponse<{
+    message: string;
+    access_token: string;
+    expires_in: number;
+    scope: string[];
+}, import("hono/utils/http-status").ContentfulStatusCode, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 500, "json">)>;
+//# sourceMappingURL=linear-oauth.d.ts.map

package/dist/auth/linear-oauth.js

@@ -0,0 +1,59 @@
+import { logger } from '../utils/logger.js';
+const CLIENT_ID = process.env.LINEAR_CLIENT_ID || '';
+const CLIENT_SECRET = process.env.LINEAR_CLIENT_SECRET || '';
+const REDIRECT_URI = process.env.LINEAR_REDIRECT_URI || '';
+/**
+ * Redirect user to Linear for authorization
+ */
+export async function redirectToLinear(c) {
+    if (!CLIENT_ID || !REDIRECT_URI) {
+        return c.json({ error: 'Linear OAuth not configured' }, 500);
+    }
+    // Scopes for Linear
+    const scopes = ['read', 'write'].join(',');
+    const authUrl = new URL('https://linear.app/oauth/authorize');
+    authUrl.searchParams.append('client_id', CLIENT_ID);
+    authUrl.searchParams.append('scope', scopes);
+    authUrl.searchParams.append('redirect_uri', REDIRECT_URI);
+    authUrl.searchParams.append('state', Math.random().toString(36).substring(7));
+    authUrl.searchParams.append('response_type', 'code');
+    authUrl.searchParams.append('actor', 'user');
+    return c.redirect(authUrl.toString());
+}
+/**
+ * Handle Linear OAuth callback
+ */
+export async function handleLinearCallback(c) {
+    const code = c.req.query('code');
+    if (!code) {
+        return c.json({ error: 'No code provided' }, 400);
+    }
+    try {
+        const response = await fetch('https://api.linear.app/oauth/token', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'Accept': 'application/json' },
+            body: new URLSearchParams({
+                grant_type: 'authorization_code',
+                client_id: CLIENT_ID,
+                client_secret: CLIENT_SECRET,
+                code,
+                redirect_uri: REDIRECT_URI,
+            }),
+        });
+        const data = await response.json();
+        if (data.error) {
+            return c.json({ error: data.error, description: data.error_description }, 400);
+        }
+        return c.json({
+            message: 'Linear connected successfully',
+            access_token: data.access_token,
+            expires_in: data.expires_in,
+            scope: data.scope
+        });
+    }
+    catch (error) {
+        logger.error('[Linear Auth] Callback error:', error);
+        return c.json({ error: 'Failed to exchange code for token' }, 500);
+    }
+}
+//# sourceMappingURL=linear-oauth.js.map

package/dist/auth/middleware.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Shared Authentication Middleware
+ *
+ * Provides a unified auth middleware that supports:
+ * - Cookie-based sessions (profclaw_session)
+ * - API token authentication (Authorization: Bearer profclaw_...)
+ *
+ * Applied globally to /api/* routes with configurable exclusions.
+ */
+import type { Context, Next } from 'hono';
+import { type User } from './auth-service.js';
+import { type TokenScope } from './api-tokens.js';
+/**
+ * Unified auth middleware for all API routes.
+ *
+ * Checks authentication via:
+ * 1. Cookie-based session (profclaw_session)
+ * 2. API token (Authorization: Bearer profclaw_...)
+ *
+ * Sets `user` and optionally `apiToken` in the context.
+ */
+export declare function authMiddleware(): (c: Context, next: Next) => Promise<void | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 401, "json">)>;
+/**
+ * Scope-checking middleware for API token routes.
+ * Use after authMiddleware to require specific scopes.
+ */
+export declare function requireScope(...scopes: TokenScope[]): (c: Context, next: Next) => Promise<void | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 401, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 403, "json">)>;
+/**
+ * Helper to get the authenticated user from context.
+ * Returns null if not authenticated via session.
+ */
+export declare function getAuthUser(c: Context): User | null;
+/**
+ * Invalidate cached local admin user.
+ * Call when authMode changes or admin user is updated.
+ */
+export declare function invalidateLocalAdminCache(): void;
+//# sourceMappingURL=middleware.d.ts.map