profclaw 0.0.1-beta.1

package/dist/auth/middleware.js

@@ -0,0 +1,190 @@
+/**
+ * Shared Authentication Middleware
+ *
+ * Provides a unified auth middleware that supports:
+ * - Cookie-based sessions (profclaw_session)
+ * - API token authentication (Authorization: Bearer profclaw_...)
+ *
+ * Applied globally to /api/* routes with configurable exclusions.
+ */
+import { getCookie } from 'hono/cookie';
+import { validateSession } from './auth-service.js';
+import { validateToken, hasScope } from './api-tokens.js';
+import { getSettingsRaw } from '../settings/index.js';
+import { getDb } from '../storage/index.js';
+import { users } from '../storage/schema.js';
+import { eq } from 'drizzle-orm';
+// Cached admin user for local-mode bypass (avoids DB query per request)
+let cachedLocalAdmin = null;
+let cachedLocalAdminExpiry = 0;
+const LOCAL_ADMIN_CACHE_TTL = 60_000; // 60s
+/** Routes that don't require authentication */
+const PUBLIC_ROUTES = [
+    '/api/auth/login',
+    '/api/auth/signup',
+    '/api/auth/github',
+    '/api/auth/github/callback',
+    '/api/auth/github/url',
+    '/api/auth/github/token',
+    '/api/auth/jira',
+    '/api/auth/jira/callback',
+    '/api/auth/linear',
+    '/api/auth/linear/callback',
+    '/api/auth/verify-access-key',
+    '/api/setup',
+    '/health',
+    '/auth',
+];
+/** Route prefixes that don't require authentication */
+const PUBLIC_PREFIXES = [
+    '/api/setup/',
+    '/api/oobe/',
+    '/api/auth/github/',
+    '/api/auth/jira/',
+    '/api/auth/linear/',
+    '/auth/',
+    // Webhook routes use their own signature verification
+    '/webhooks/',
+    // Messaging channels have their own auth (bot tokens, signatures)
+    '/api/telegram/',
+    '/api/whatsapp/',
+    '/api/discord/',
+];
+function isPublicRoute(path) {
+    // Exact matches
+    if (PUBLIC_ROUTES.includes(path))
+        return true;
+    // Prefix matches
+    for (const prefix of PUBLIC_PREFIXES) {
+        if (path.startsWith(prefix))
+            return true;
+    }
+    return false;
+}
+/**
+ * Unified auth middleware for all API routes.
+ *
+ * Checks authentication via:
+ * 1. Cookie-based session (profclaw_session)
+ * 2. API token (Authorization: Bearer profclaw_...)
+ *
+ * Sets `user` and optionally `apiToken` in the context.
+ */
+export function authMiddleware() {
+    return async (c, next) => {
+        const path = c.req.path;
+        // Skip auth for public routes
+        if (isPublicRoute(path)) {
+            return next();
+        }
+        // Skip non-API routes (static assets, root info, etc.)
+        if (!path.startsWith('/api/') && !path.startsWith('/api')) {
+            return next();
+        }
+        // Local-mode bypass: auto-inject admin user when authMode is 'local'
+        // Skip auto-inject if an access key is set (require session cookie instead)
+        try {
+            const settings = await getSettingsRaw();
+            if (settings.system.authMode === 'local' && !settings.system.accessKeyHash) {
+                const now = Date.now();
+                if (!cachedLocalAdmin || now > cachedLocalAdminExpiry) {
+                    const db = getDb();
+                    if (db) {
+                        const admins = await db
+                            .select()
+                            .from(users)
+                            .where(eq(users.role, 'admin'))
+                            .limit(1);
+                        if (admins.length > 0) {
+                            const admin = admins[0];
+                            cachedLocalAdmin = {
+                                id: admin.id,
+                                email: admin.email,
+                                name: admin.name ?? 'Owner',
+                                role: admin.role,
+                                status: admin.status,
+                                createdAt: admin.createdAt ?? new Date(),
+                                onboardingCompleted: admin.onboardingCompleted ?? true,
+                            };
+                            cachedLocalAdminExpiry = now + LOCAL_ADMIN_CACHE_TTL;
+                        }
+                    }
+                }
+                if (cachedLocalAdmin) {
+                    c.set('user', cachedLocalAdmin);
+                    return next();
+                }
+            }
+        }
+        catch {
+            // Fall through to normal auth if settings read fails
+        }
+        // Try cookie-based session first
+        const sessionToken = getCookie(c, 'profclaw_session');
+        if (sessionToken) {
+            const user = await validateSession(sessionToken);
+            if (user) {
+                c.set('user', user);
+                return next();
+            }
+        }
+        // Try API token authentication
+        const authHeader = c.req.header('Authorization');
+        if (authHeader?.startsWith('Bearer profclaw_')) {
+            const token = authHeader.slice(7);
+            const result = await validateToken(token);
+            if (result.valid && result.token) {
+                c.set('apiToken', result.token);
+                // API token requests don't have a user context by default
+                // but they are authenticated
+                c.set('authType', 'api_token');
+                return next();
+            }
+        }
+        // Also allow Bearer with non-profclaw tokens to pass through
+        // for device/CLI auth that may use different token formats
+        if (authHeader?.startsWith('Bearer ') && !authHeader.startsWith('Bearer profclaw_')) {
+            // Let the specific route handler validate this token type
+            return next();
+        }
+        // No valid authentication found
+        return c.json({ error: 'Authentication required' }, 401);
+    };
+}
+/**
+ * Scope-checking middleware for API token routes.
+ * Use after authMiddleware to require specific scopes.
+ */
+export function requireScope(...scopes) {
+    return async (c, next) => {
+        const apiToken = c.get('apiToken');
+        if (!apiToken) {
+            // Session-based users have full access
+            if (c.get('user'))
+                return next();
+            return c.json({ error: 'Authentication required' }, 401);
+        }
+        for (const scope of scopes) {
+            if (!hasScope(apiToken, scope)) {
+                return c.json({ error: `Missing required scope: ${scope}` }, 403);
+            }
+        }
+        return next();
+    };
+}
+/**
+ * Helper to get the authenticated user from context.
+ * Returns null if not authenticated via session.
+ */
+export function getAuthUser(c) {
+    return c.get('user') || null;
+}
+/**
+ * Invalidate cached local admin user.
+ * Call when authMode changes or admin user is updated.
+ */
+export function invalidateLocalAdminCache() {
+    cachedLocalAdmin = null;
+    cachedLocalAdminExpiry = 0;
+}
+//# sourceMappingURL=middleware.js.map

package/dist/auth/pairing-codes.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Human-Friendly Pairing Codes
+ *
+ * Provides secure, easy-to-type pairing codes for device authorization.
+ * Adapted from OpenClaw reference implementation.
+ *
+ * Features:
+ * - 8-character codes without ambiguous characters (no 0/O, 1/I)
+ * - Time-limited pending requests (1 hour TTL)
+ * - Database-backed persistence
+ * - Rate limiting on code generation
+ */
+/**
+ * Pairing request record
+ */
+export interface PairingRequest {
+    id: string;
+    code: string;
+    /** User or device identifier requesting pairing */
+    requesterId: string;
+    /** Optional metadata about the requester */
+    meta?: Record<string, string>;
+    /** Expiration timestamp */
+    expiresAt: Date;
+    /** Status: pending, approved, rejected, expired */
+    status: 'pending' | 'approved' | 'rejected' | 'expired';
+    /** Who approved/rejected */
+    resolvedBy?: string;
+    /** Resolution timestamp */
+    resolvedAt?: Date;
+    /** Token issued on approval */
+    token?: string;
+    createdAt: Date;
+    lastSeenAt: Date;
+}
+/**
+ * Initialize pairing codes table
+ */
+export declare function initPairingCodesTable(): Promise<void>;
+/**
+ * Request a new pairing code
+ */
+export declare function requestPairingCode(params: {
+    requesterId: string;
+    meta?: Record<string, string>;
+}): Promise<{
+    code: string;
+    expiresAt: Date;
+    created: boolean;
+}>;
+/**
+ * Approve a pairing code
+ */
+export declare function approvePairingCode(params: {
+    code: string;
+    approvedBy: string;
+}): Promise<{
+    request: PairingRequest;
+    token: string;
+} | null>;
+/**
+ * Reject a pairing code
+ */
+export declare function rejectPairingCode(params: {
+    code: string;
+    rejectedBy: string;
+    reason?: string;
+}): Promise<boolean>;
+/**
+ * Check pairing code status
+ */
+export declare function checkPairingStatus(code: string): Promise<{
+    status: 'pending' | 'approved' | 'rejected' | 'expired' | 'not_found';
+    token?: string;
+    expiresAt?: Date;
+}>;
+/**
+ * List pending pairing requests (for admin UI)
+ */
+export declare function listPendingPairingRequests(): Promise<Array<{
+    id: string;
+    code: string;
+    requesterId: string;
+    meta?: Record<string, string>;
+    expiresAt: Date;
+    createdAt: Date;
+    lastSeenAt: Date;
+}>>;
+/**
+ * Clean up expired pairing requests
+ */
+export declare function cleanupExpiredPairingRequests(): Promise<number>;
+/**
+ * Validate a pairing token
+ */
+export declare function validatePairingToken(token: string): Promise<{
+    valid: boolean;
+    requesterId?: string;
+    meta?: Record<string, string>;
+}>;
+/**
+ * Format a pairing code for display (with spaces for readability)
+ */
+export declare function formatPairingCode(code: string): string;
+/**
+ * Parse a pairing code from user input (removes spaces, dashes, converts to uppercase)
+ */
+export declare function parsePairingCode(input: string): string;
+//# sourceMappingURL=pairing-codes.d.ts.map

package/dist/auth/pairing-codes.js

@@ -0,0 +1,274 @@
+/**
+ * Human-Friendly Pairing Codes
+ *
+ * Provides secure, easy-to-type pairing codes for device authorization.
+ * Adapted from OpenClaw reference implementation.
+ *
+ * Features:
+ * - 8-character codes without ambiguous characters (no 0/O, 1/I)
+ * - Time-limited pending requests (1 hour TTL)
+ * - Database-backed persistence
+ * - Rate limiting on code generation
+ */
+import { randomBytes, randomUUID } from 'crypto';
+import { getStorage } from '../storage/index.js';
+// Code generation alphabet (no ambiguous chars: 0O1I)
+const PAIRING_CODE_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+const PAIRING_CODE_LENGTH = 8;
+// Limits
+const PAIRING_PENDING_TTL_MS = 60 * 60 * 1000; // 1 hour
+const PAIRING_PENDING_MAX = 5; // Max concurrent pending requests per user
+/**
+ * Initialize pairing codes table
+ */
+export async function initPairingCodesTable() {
+    const storage = getStorage();
+    await storage.execute(`
+    CREATE TABLE IF NOT EXISTS pairing_requests (
+      id TEXT PRIMARY KEY,
+      code TEXT NOT NULL UNIQUE,
+      requester_id TEXT NOT NULL,
+      meta TEXT,
+      expires_at INTEGER NOT NULL,
+      status TEXT NOT NULL DEFAULT 'pending',
+      resolved_by TEXT,
+      resolved_at INTEGER,
+      token TEXT,
+      created_at INTEGER NOT NULL,
+      last_seen_at INTEGER NOT NULL
+    )
+  `);
+    // Index for fast code lookup
+    await storage.execute(`
+    CREATE INDEX IF NOT EXISTS idx_pairing_code ON pairing_requests(code)
+  `);
+    // Index for requester lookup
+    await storage.execute(`
+    CREATE INDEX IF NOT EXISTS idx_pairing_requester ON pairing_requests(requester_id)
+  `);
+}
+/**
+ * Generate a random pairing code
+ */
+function generatePairingCode() {
+    const bytes = randomBytes(PAIRING_CODE_LENGTH);
+    let code = '';
+    for (let i = 0; i < PAIRING_CODE_LENGTH; i++) {
+        code += PAIRING_CODE_ALPHABET[bytes[i] % PAIRING_CODE_ALPHABET.length];
+    }
+    return code;
+}
+/**
+ * Generate a secure token for approved devices
+ */
+function generateToken() {
+    return `profclaw_pair_${randomBytes(32).toString('base64url')}`;
+}
+/**
+ * Request a new pairing code
+ */
+export async function requestPairingCode(params) {
+    const storage = getStorage();
+    // Check for existing pending request
+    const existingRows = await storage.query(`SELECT id, code, expires_at FROM pairing_requests
+     WHERE requester_id = ? AND status = 'pending' AND expires_at > ?`, [params.requesterId, Math.floor(Date.now() / 1000)]);
+    // Return existing code if still valid
+    if (existingRows.length > 0) {
+        const existing = existingRows[0];
+        // Update last seen
+        await storage.execute(`UPDATE pairing_requests SET last_seen_at = ? WHERE id = ?`, [Math.floor(Date.now() / 1000), existing.id]);
+        return {
+            code: existing.code,
+            expiresAt: new Date(existing.expires_at * 1000),
+            created: false,
+        };
+    }
+    // Check rate limit (max pending requests)
+    const pendingCountRows = await storage.query(`SELECT COUNT(*) as count FROM pairing_requests
+     WHERE requester_id = ? AND status = 'pending' AND expires_at > ?`, [params.requesterId, Math.floor(Date.now() / 1000)]);
+    if (pendingCountRows[0].count >= PAIRING_PENDING_MAX) {
+        throw new Error(`Maximum pending pairing requests reached (${PAIRING_PENDING_MAX})`);
+    }
+    // Generate new code (retry if collision)
+    let code = generatePairingCode();
+    let attempts = 0;
+    const maxAttempts = 10;
+    while (attempts < maxAttempts) {
+        const collision = await storage.query(`SELECT id FROM pairing_requests WHERE code = ?`, [code]);
+        if (collision.length === 0)
+            break;
+        code = generatePairingCode();
+        attempts++;
+    }
+    if (attempts >= maxAttempts) {
+        throw new Error('Failed to generate unique pairing code');
+    }
+    // Create new pairing request
+    const id = randomUUID();
+    const now = Math.floor(Date.now() / 1000);
+    const expiresAt = Math.floor((Date.now() + PAIRING_PENDING_TTL_MS) / 1000);
+    await storage.execute(`INSERT INTO pairing_requests (id, code, requester_id, meta, expires_at, status, created_at, last_seen_at)
+     VALUES (?, ?, ?, ?, ?, 'pending', ?, ?)`, [
+        id,
+        code,
+        params.requesterId,
+        params.meta ? JSON.stringify(params.meta) : null,
+        expiresAt,
+        now,
+        now,
+    ]);
+    console.log(`[Pairing] Created code ${code} for requester ${params.requesterId}`);
+    return {
+        code,
+        expiresAt: new Date(expiresAt * 1000),
+        created: true,
+    };
+}
+/**
+ * Approve a pairing code
+ */
+export async function approvePairingCode(params) {
+    const storage = getStorage();
+    // Find pending request by code
+    const rows = await storage.query(`SELECT * FROM pairing_requests
+     WHERE code = ? AND status = 'pending' AND expires_at > ?`, [params.code.toUpperCase(), Math.floor(Date.now() / 1000)]);
+    if (rows.length === 0) {
+        console.log(`[Pairing] Code ${params.code} not found or expired`);
+        return null;
+    }
+    const row = rows[0];
+    const token = generateToken();
+    const now = Math.floor(Date.now() / 1000);
+    // Update to approved
+    await storage.execute(`UPDATE pairing_requests
+     SET status = 'approved', resolved_by = ?, resolved_at = ?, token = ?
+     WHERE id = ?`, [params.approvedBy, now, token, row.id]);
+    console.log(`[Pairing] Code ${params.code} approved by ${params.approvedBy}`);
+    return {
+        request: {
+            id: row.id,
+            code: row.code,
+            requesterId: row.requester_id,
+            meta: row.meta ? JSON.parse(row.meta) : undefined,
+            expiresAt: new Date(row.expires_at * 1000),
+            status: 'approved',
+            resolvedBy: params.approvedBy,
+            resolvedAt: new Date(now * 1000),
+            token,
+            createdAt: new Date(row.created_at * 1000),
+            lastSeenAt: new Date(row.last_seen_at * 1000),
+        },
+        token,
+    };
+}
+/**
+ * Reject a pairing code
+ */
+export async function rejectPairingCode(params) {
+    const storage = getStorage();
+    const now = Math.floor(Date.now() / 1000);
+    // Check if code exists and is pending first
+    const existing = await storage.query(`SELECT id FROM pairing_requests WHERE code = ? AND status = 'pending'`, [params.code.toUpperCase()]);
+    if (existing.length === 0) {
+        return false;
+    }
+    await storage.execute(`UPDATE pairing_requests
+     SET status = 'rejected', resolved_by = ?, resolved_at = ?
+     WHERE code = ? AND status = 'pending'`, [params.rejectedBy, now, params.code.toUpperCase()]);
+    console.log(`[Pairing] Code ${params.code} rejected by ${params.rejectedBy}`);
+    return true;
+}
+/**
+ * Check pairing code status
+ */
+export async function checkPairingStatus(code) {
+    const storage = getStorage();
+    const rows = await storage.query(`SELECT status, token, expires_at FROM pairing_requests WHERE code = ?`, [
+        code.toUpperCase(),
+    ]);
+    if (rows.length === 0) {
+        return { status: 'not_found' };
+    }
+    const row = rows[0];
+    const expiresAt = new Date(row.expires_at * 1000);
+    // Check if expired
+    if (row.status === 'pending' && expiresAt < new Date()) {
+        // Mark as expired
+        await storage.execute(`UPDATE pairing_requests SET status = 'expired' WHERE code = ?`, [code.toUpperCase()]);
+        return { status: 'expired', expiresAt };
+    }
+    return {
+        status: row.status,
+        token: row.token || undefined,
+        expiresAt,
+    };
+}
+/**
+ * List pending pairing requests (for admin UI)
+ */
+export async function listPendingPairingRequests() {
+    const storage = getStorage();
+    const rows = await storage.query(`SELECT id, code, requester_id, meta, expires_at, created_at, last_seen_at
+     FROM pairing_requests
+     WHERE status = 'pending' AND expires_at > ?
+     ORDER BY created_at DESC`, [Math.floor(Date.now() / 1000)]);
+    return rows.map((row) => ({
+        id: row.id,
+        code: row.code,
+        requesterId: row.requester_id,
+        meta: row.meta ? JSON.parse(row.meta) : undefined,
+        expiresAt: new Date(row.expires_at * 1000),
+        createdAt: new Date(row.created_at * 1000),
+        lastSeenAt: new Date(row.last_seen_at * 1000),
+    }));
+}
+/**
+ * Clean up expired pairing requests
+ */
+export async function cleanupExpiredPairingRequests() {
+    const storage = getStorage();
+    const now = Math.floor(Date.now() / 1000);
+    // Count old requests before delete
+    const sevenDaysAgo = now - 7 * 24 * 60 * 60;
+    const countResult = await storage.query(`SELECT COUNT(*) as count FROM pairing_requests WHERE created_at < ? AND status IN ('expired', 'rejected')`, [sevenDaysAgo]);
+    const toDelete = countResult[0]?.count || 0;
+    // Mark expired requests
+    await storage.execute(`UPDATE pairing_requests SET status = 'expired' WHERE status = 'pending' AND expires_at < ?`, [now]);
+    // Delete old requests (older than 7 days)
+    await storage.execute(`DELETE FROM pairing_requests WHERE created_at < ? AND status IN ('expired', 'rejected')`, [sevenDaysAgo]);
+    return toDelete;
+}
+/**
+ * Validate a pairing token
+ */
+export async function validatePairingToken(token) {
+    const storage = getStorage();
+    const rows = await storage.query(`SELECT requester_id, meta FROM pairing_requests WHERE token = ? AND status = 'approved'`, [
+        token,
+    ]);
+    if (rows.length === 0) {
+        return { valid: false };
+    }
+    return {
+        valid: true,
+        requesterId: rows[0].requester_id,
+        meta: rows[0].meta ? JSON.parse(rows[0].meta) : undefined,
+    };
+}
+/**
+ * Format a pairing code for display (with spaces for readability)
+ */
+export function formatPairingCode(code) {
+    if (code.length !== PAIRING_CODE_LENGTH) {
+        return code;
+    }
+    // Split into two groups of 4: ABCD-EFGH
+    return `${code.slice(0, 4)}-${code.slice(4)}`;
+}
+/**
+ * Parse a pairing code from user input (removes spaces, dashes, converts to uppercase)
+ */
+export function parsePairingCode(input) {
+    return input.replace(/[\s-]/g, '').toUpperCase();
+}
+//# sourceMappingURL=pairing-codes.js.map

package/dist/auth/password.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Password Hashing Utilities
+ *
+ * Uses Node.js built-in scrypt for secure password hashing.
+ * Supports transparent upgrade from legacy SHA256 hashes.
+ *
+ * Recovery codes use deterministic SHA256 (acceptable since codes are random, high-entropy).
+ */
+/**
+ * Hash a password using scrypt.
+ * Returns format: scrypt:<salt>:<hash>
+ */
+export declare function hashPassword(password: string): string;
+/**
+ * Verify a password against a stored hash.
+ * Supports both scrypt and legacy SHA256 formats.
+ *
+ * @returns { valid, needsUpgrade } - needsUpgrade is true when using legacy SHA256
+ */
+export declare function verifyPassword(password: string, storedHash: string): {
+    valid: boolean;
+    needsUpgrade: boolean;
+};
+/**
+ * Validate password strength.
+ * Requires: 8+ chars, at least 1 letter, at least 1 number.
+ * Returns null if valid, or an error message string.
+ */
+export declare function validatePasswordStrength(password: string): string | null;
+/**
+ * Deterministic hash for recovery codes.
+ * SHA256 is acceptable here since recovery codes are random, high-entropy strings.
+ */
+export declare function hashRecoveryCode(code: string): string;
+/**
+ * Generate recovery codes (XXXX-XXXX format).
+ */
+export declare function generateRecoveryCodes(count?: number): string[];
+/**
+ * Hash an array of recovery codes.
+ */
+export declare function hashRecoveryCodes(codes: string[]): string[];
+/**
+ * Generate a human-friendly invite code.
+ * Format: PC-XXXX-XXXX-XXXX (12 hex chars)
+ */
+export declare function generateInviteCode(): string;
+/**
+ * Hash an invite code for secure storage.
+ * Normalizes by removing dashes and uppercasing before hashing.
+ */
+export declare function hashInviteCode(code: string): string;
+//# sourceMappingURL=password.d.ts.map