relmio 0.4.0 → 0.5.0

package/src/web/server.js

@@ -1,6 +1,7 @@
 import { randomUUID, timingSafeEqual } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { createServer } from "node:http";
+import packageManifest from "../../package.json" with { type: "json" };
 
 import { discoverN8n, discoverNetworks } from "../services/discovery.js";
 import { installSidecar } from "../services/installer.js";
@@ -18,19 +19,54 @@ import {
   validatePort,
 } from "../domain/validation.js";
 import { SIDECAR_HOSTNAME } from "../domain/templates.js";
-import { createLocalDeploymentPlan } from "../domain/local-endpoints.js";
 import {
+  createLocalDeploymentPlan,
+  validateLocalTarget,
+} from "../domain/local-endpoints.js";
+import {
+  acquireLocalEndpointChangeLock,
+  activateLocalClientCredentialRotation,
   attestLocalCodexInstallation,
   getLocalDockerStatus,
   installLocalEndpoint,
   resolveLocalInstallRoot,
   restartLocalCodex,
+  prepareLocalClientCredentialRotation,
 } from "../services/local-installer.js";
 import { startCodexDeviceLogin } from "../services/codex-login.js";
 
 const MAX_BODY_BYTES = 32 * 1024;
 const RATE_LIMIT_WINDOW_MS = 15 * 60 * 1000;
 const RATE_LIMIT_MAX = 10;
+const OAUTH_SHUTDOWN_WAIT_MS = 2_000;
+const LOCAL_ROTATION_STAGE_TTL_MS = 2 * 60 * 1000;
+const PACKAGE_VERSION = packageManifest.version;
+
+async function getProjectMeta({ fetchImpl = fetch } = {}) {
+  let stars = null;
+  try {
+    const response = await fetchImpl(
+      "https://api.github.com/repos/Demonbane18/relmio",
+      {
+        headers: {
+          Accept: "application/vnd.github+json",
+          "User-Agent": `relmio/${PACKAGE_VERSION}`,
+        },
+        redirect: "error",
+        signal: AbortSignal.timeout(5_000),
+      },
+    );
+    if (response.ok) {
+      const value = (await response.json())?.stargazers_count;
+      if (Number.isSafeInteger(value) && value >= 0) {
+        stars = value;
+      }
+    }
+  } catch {
+    // The local control keeps a visible fallback when GitHub is unavailable.
+  }
+  return { stars, version: PACKAGE_VERSION };
+}
 
 const defaultServices = {
   getAuthStatus,
@@ -43,7 +79,11 @@ const defaultServices = {
   installSidecar,
   attestLocalCodexInstallation,
   getLocalDockerStatus,
+  getProjectMeta,
   installLocalEndpoint,
+  acquireLocalEndpointChangeLock,
+  activateLocalClientCredentialRotation,
+  prepareLocalClientCredentialRotation,
   resolveLocalInstallRoot,
   restartLocalCodex,
   startCodexDeviceLogin,
@@ -110,6 +150,37 @@ function enforceRateLimit(state, key) {
   state.rateLimits.set(key, recent);
 }
 
+function waitForBoundedResult(promise, milliseconds) {
+  if (!promise) {
+    return Promise.resolve(true);
+  }
+  return new Promise((resolvePromise) => {
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (!settled) {
+        settled = true;
+        resolvePromise(false);
+      }
+    }, milliseconds);
+    Promise.resolve(promise).then(
+      () => {
+        if (!settled) {
+          settled = true;
+          clearTimeout(timer);
+          resolvePromise(true);
+        }
+      },
+      () => {
+        if (!settled) {
+          settled = true;
+          clearTimeout(timer);
+          resolvePromise(true);
+        }
+      },
+    );
+  });
+}
+
 function readJsonBody(request) {
   return new Promise((resolve, reject) => {
     const chunks = [];
@@ -192,6 +263,32 @@ function safeErrorMessage(error) {
   return message;
 }
 
+async function cancelOAuthLogin(state, login) {
+  try {
+    await login.attempt.cancel();
+  } catch {
+    if (state.oauthLogin === login) {
+      login.status = "error";
+      login.retryBlocked = true;
+      login.error =
+        "ChatGPT sign-in could not be stopped safely. Close the sign-in helper, then restart Relmio.";
+    }
+    state.oauthRetryBlocked = true;
+    state.oauthStartupError =
+      "ChatGPT sign-in could not be stopped safely. Close the sign-in helper, then restart Relmio.";
+    throw Object.assign(
+      new Error(
+        "ChatGPT sign-in could not be stopped safely. Close the sign-in helper, then restart Relmio.",
+      ),
+      { retryBlocked: true, statusCode: 409 },
+    );
+  }
+
+  if (state.oauthLogin === login && login.status === "pending") {
+    login.status = "cancelled";
+  }
+}
+
 async function loadDefaultUiFiles() {
   const files = await Promise.all([
     readFile(new URL("../ui/index.html", import.meta.url), "utf8"),
@@ -210,7 +307,7 @@ async function loadDefaultUiFiles() {
 
   return {
     "/": files[0],
-    "/local": files[1],
+    "/local": files[1].replaceAll("__RELMIO_PACKAGE_VERSION__", PACKAGE_VERSION),
     "/app.js": files[2],
     "/local.js": files[3],
     "/oauth-popup.js": files[4],
@@ -254,6 +351,38 @@ function createSafeLocalInstallResult(result) {
   };
 }
 
+function createSafeLocalActivationResult(result) {
+  return {
+    target: result.target,
+    endpoint: result.endpoint,
+    protocol: result.protocol,
+    models: Array.isArray(result.models) ? [...result.models] : [],
+    deploymentMode: result.deploymentMode,
+    experimental: result.experimental === true,
+    browserClients: result.browserClients === true,
+  };
+}
+
+function createSafeProjectMeta(result) {
+  return {
+    stars:
+      Number.isSafeInteger(result?.stars) && result.stars >= 0
+        ? result.stars
+        : null,
+    version: PACKAGE_VERSION,
+  };
+}
+
+function getPendingLocalCredentialRotation(state) {
+  if (
+    state.localCredentialRotationPending &&
+    state.localCredentialRotationPending.expiresAt <= Date.now()
+  ) {
+    state.localCredentialRotationPending = null;
+  }
+  return state.localCredentialRotationPending;
+}
+
 function createSafeDockerStatus(status, previewMode) {
   if (previewMode || status?.dockerAvailable !== true) {
     return {
@@ -297,8 +426,16 @@ async function handleApi(request, response, path, state) {
   if (request.method === "GET" && path === "/api/oauth/status") {
     const login = state.oauthLogin;
     sendJson(response, 200, {
-      status: login?.status ?? "idle",
-      ...(login?.status === "error" ? { error: login.error } : {}),
+      status: login?.status ?? (state.oauthStartupError ? "error" : "idle"),
+      ...(login ? { attemptId: login.attemptId } : {}),
+      ...(login?.status === "error"
+        ? { error: login.error }
+        : state.oauthStartupError
+          ? { error: state.oauthStartupError }
+          : {}),
+      ...(state.oauthRetryBlocked || login?.retryBlocked === true
+        ? { retryBlocked: true }
+        : {}),
     });
     return;
   }
@@ -315,6 +452,15 @@ async function handleApi(request, response, path, state) {
     return;
   }
 
+  if (request.method === "GET" && path === "/api/local/project-meta") {
+    sendJson(
+      response,
+      200,
+      createSafeProjectMeta(await state.services.getProjectMeta()),
+    );
+    return;
+  }
+
   if (
     request.method === "GET" &&
     path === "/api/local/codex/login/status"
@@ -342,42 +488,146 @@ async function handleApi(request, response, path, state) {
         { statusCode: 403 },
       );
     }
+    if (state.closing) {
+      throw Object.assign(new Error("The local wizard is closing."), {
+        statusCode: 409,
+      });
+    }
+    if (state.oauthRetryBlocked || state.oauthLogin?.retryBlocked === true) {
+      throw Object.assign(
+        new Error(
+          "ChatGPT sign-in could not be stopped safely. Close the sign-in helper, then restart Relmio.",
+        ),
+        { retryBlocked: true, statusCode: 409 },
+      );
+    }
+    if (state.oauthLoginStartInFlight) {
+      throw Object.assign(
+        new Error("A ChatGPT sign-in start is already in progress."),
+        { statusCode: 409 },
+      );
+    }
     enforceRateLimit(state, path);
-    if (state.oauthLogin?.status === "pending") {
-      state.oauthLogin.attempt.cancel();
-      try {
-        await state.oauthLogin.attempt.completion;
-      } catch {
-        // Starting again intentionally replaces the previous local attempt.
+    state.oauthLoginStartInFlight = true;
+    state.oauthStartupError = null;
+    let startAttempted = false;
+    let startPromise;
+    try {
+      const previousLogin = state.oauthLogin;
+      if (previousLogin?.status === "pending") {
+        await cancelOAuthLogin(state, previousLogin);
       }
-    }
 
-    const attempt = await state.services.startOAuthLogin();
-    const login = {
-      attempt,
-      error: null,
-      status: "pending",
-    };
-    state.oauthLogin = login;
-    attempt.completion.then(
-      () => {
-        if (state.oauthLogin === login) {
-          login.status = "success";
-        }
-      },
-      (error) => {
-        if (state.oauthLogin === login) {
-          login.status = "error";
-          login.error = safeErrorMessage(error);
+      if (state.closing) {
+        throw Object.assign(new Error("The local wizard is closing."), {
+          statusCode: 409,
+        });
+      }
+      if (
+        state.oauthLogin === previousLogin &&
+        previousLogin?.status !== "pending" &&
+        previousLogin?.retryBlocked !== true
+      ) {
+        state.oauthLogin = null;
+      }
+      startAttempted = true;
+      startPromise = Promise.resolve(state.services.startOAuthLogin());
+      state.oauthLoginStartPromise = startPromise;
+      const attempt = await startPromise;
+      const login = {
+        attempt,
+        attemptId: randomUUID(),
+        error: null,
+        retryBlocked: false,
+        status: "pending",
+      };
+      state.oauthLogin = login;
+      attempt.completion.then(
+        () => {
+          if (
+            state.oauthLogin === login &&
+            login.status === "pending" &&
+            !state.closing
+          ) {
+            login.status = "success";
+          }
+        },
+        (error) => {
+          if (
+            state.oauthLogin === login &&
+            login.status === "pending" &&
+            !state.closing
+          ) {
+            login.status = "error";
+            login.error = safeErrorMessage(error);
+            if (error?.retryBlocked === true) {
+              login.retryBlocked = true;
+              state.oauthRetryBlocked = true;
+              state.oauthStartupError = login.error;
+            }
+          }
+        },
+      );
+      if (state.closing) {
+        try {
+          await cancelOAuthLogin(state, login);
+        } catch {
+          // The server is already closing and must not restart this helper.
         }
-      },
-    );
-    sendJson(response, 200, { authorizationUrl: attempt.authorizationUrl });
-    return;
+        throw Object.assign(new Error("The local wizard is closing."), {
+          statusCode: 409,
+        });
+      }
+      sendJson(response, 200, {
+        authorizationUrl: attempt.authorizationUrl,
+        attemptId: login.attemptId,
+      });
+      return;
+    } catch (error) {
+      const message = safeErrorMessage(error);
+      if (startAttempted) {
+        state.oauthStartupError = message;
+      }
+      if (error?.retryBlocked === true) {
+        state.oauthRetryBlocked = true;
+        state.oauthStartupError = message;
+      }
+      throw error;
+    } finally {
+      if (state.oauthLoginStartPromise === startPromise) {
+        state.oauthLoginStartPromise = null;
+      }
+      state.oauthLoginStartInFlight = false;
+    }
   }
 
   const body = await readJsonBody(request);
 
+  if (path === "/api/oauth/cancel") {
+    requireLiveLocalAction(state, "Live ChatGPT sign-in");
+    const login = state.oauthLogin;
+    if (
+      !login ||
+      login.status !== "pending" ||
+      !body ||
+      typeof body !== "object" ||
+      Array.isArray(body) ||
+      typeof body.attemptId !== "string" ||
+      body.attemptId !== login.attemptId
+    ) {
+      throw Object.assign(
+        new Error("The ChatGPT sign-in attempt has already changed. Start again."),
+        { statusCode: 409 },
+      );
+    }
+    await cancelOAuthLogin(state, login);
+    sendJson(response, 200, {
+      status: login.status,
+      attemptId: login.attemptId,
+    });
+    return;
+  }
+
   if (path === "/api/local/plan") {
     const plan = createLocalDeploymentPlan({
       target: body.target,
@@ -398,9 +648,15 @@ async function handleApi(request, response, path, state) {
     try {
       requireLiveLocalAction(state, "Local endpoint installation");
       enforceRateLimit(state, path);
-      if (state.localInstallInFlight) {
+      if (
+        state.localInstallInFlight ||
+        state.localCredentialRotationInFlight ||
+        getPendingLocalCredentialRotation(state) ||
+        state.codexLoginStartInFlight ||
+        state.codexLogin?.status === "pending"
+      ) {
         throw Object.assign(
-          new Error("A local endpoint installation is already in progress."),
+          new Error("A local endpoint change is already in progress."),
           { statusCode: 409 },
         );
       }
@@ -430,26 +686,105 @@ async function handleApi(request, response, path, state) {
     return;
   }
 
+  if (path === "/api/local/client-credential/rotate") {
+    requireLiveLocalAction(state, "Local client credential rotation");
+    enforceRateLimit(state, path);
+    if (
+      state.localCredentialRotationInFlight ||
+      state.localInstallInFlight ||
+      getPendingLocalCredentialRotation(state) ||
+      state.codexLoginStartInFlight ||
+      state.codexLogin?.status === "pending"
+    ) {
+      throw Object.assign(
+        new Error("A local endpoint change is already in progress."),
+        { statusCode: 409 },
+      );
+    }
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      throw new Error("Choose the installed local endpoint before rotating its credential.");
+    }
+
+    state.localCredentialRotationInFlight = true;
+    try {
+      const result = await state.services.prepareLocalClientCredentialRotation({
+        target: validateLocalTarget(body.target),
+      });
+      const rotationId = randomUUID();
+      state.localCredentialRotationPending = {
+        rotationId,
+        target: result.target,
+        tokenSha256: result.tokenSha256,
+        expiresAt: Date.now() + LOCAL_ROTATION_STAGE_TTL_MS,
+      };
+      sendJson(response, 200, {
+        ...createSafeLocalInstallResult(result),
+        rotationId,
+      });
+    } finally {
+      state.localCredentialRotationInFlight = false;
+    }
+    return;
+  }
+
+  if (path === "/api/local/client-credential/activate") {
+    requireLiveLocalAction(state, "Local client credential activation");
+    enforceRateLimit(state, path);
+    if (
+      state.localCredentialRotationInFlight ||
+      state.localInstallInFlight ||
+      state.codexLoginStartInFlight ||
+      state.codexLogin?.status === "pending"
+    ) {
+      throw Object.assign(
+        new Error("A local endpoint change is already in progress."),
+        { statusCode: 409 },
+      );
+    }
+    const pending = getPendingLocalCredentialRotation(state);
+    if (!pending || !tokenMatches(body?.rotationId, pending.rotationId)) {
+      throw new Error("Stage a fresh local client credential before activating it.");
+    }
+
+    state.localCredentialRotationPending = null;
+    state.localCredentialRotationInFlight = true;
+    try {
+      const result = await state.services.activateLocalClientCredentialRotation({
+        target: pending.target,
+        clientCredential: body.clientCredential,
+        tokenSha256: pending.tokenSha256,
+      });
+      sendJson(response, 200, createSafeLocalActivationResult(result));
+    } finally {
+      state.localCredentialRotationInFlight = false;
+    }
+    return;
+  }
+
   if (path === "/api/local/codex/login") {
     requireLiveLocalAction(state, "Local Codex sign-in");
     enforceRateLimit(state, path);
-    if (state.codexLoginStartInFlight) {
+    if (
+      state.codexLoginStartInFlight ||
+      state.localInstallInFlight ||
+      state.localCredentialRotationInFlight ||
+      getPendingLocalCredentialRotation(state)
+    ) {
       throw Object.assign(
-        new Error("A local Codex sign-in start is already in progress."),
+        new Error("A local endpoint change is already in progress."),
         { statusCode: 409 },
       );
     }
 
     state.codexLoginStartInFlight = true;
+    let finishStart;
+    const startPromise = new Promise((resolvePromise) => {
+      finishStart = resolvePromise;
+    });
+    state.codexLoginStartPromise = startPromise;
+    let releaseChangeLock;
+    let lockTransferred = false;
     try {
-      const installDirectory = await state.services.resolveLocalInstallRoot({
-        target: "codex-chatgpt",
-      });
-      const { dockerHost, projectName } =
-        await state.services.attestLocalCodexInstallation({
-          installDirectory,
-        });
-
       const previous = state.codexLogin;
       if (previous?.status === "pending") {
         state.codexLogin = null;
@@ -460,26 +795,61 @@ async function handleApi(request, response, path, state) {
           // A fresh attempt intentionally supersedes the old device-code login.
         }
       }
+      if (state.closing) {
+        throw Object.assign(new Error("The local wizard is closing."), {
+          statusCode: 409,
+        });
+      }
+
+      releaseChangeLock = await state.services.acquireLocalEndpointChangeLock({
+        target: "codex-chatgpt",
+      });
+      if (state.closing) {
+        throw Object.assign(new Error("The local wizard is closing."), {
+          statusCode: 409,
+        });
+      }
+      const installDirectory = await state.services.resolveLocalInstallRoot({
+        target: "codex-chatgpt",
+      });
+      const { dockerHost, projectName } =
+        await state.services.attestLocalCodexInstallation({
+          installDirectory,
+        });
 
       const attempt = await state.services.startCodexDeviceLogin({
         installDirectory,
         dockerHost,
         projectName,
       });
+      if (state.closing) {
+        attempt.cancel();
+        try {
+          await attempt.completion;
+        } catch {
+          // Shutdown intentionally cancels a helper that finished starting late.
+        }
+        throw Object.assign(new Error("The local wizard is closing."), {
+          statusCode: 409,
+        });
+      }
       const login = {
         cancel: attempt.cancel,
-        completion: attempt.completion,
+        completion: null,
         error: null,
         status: "pending",
       };
       state.codexLogin = login;
-      void (async () => {
+      login.completion = (async () => {
         try {
-          await login.completion;
+          await attempt.completion;
           if (state.codexLogin !== login || state.closing) {
             return;
           }
-          await state.services.restartLocalCodex({ installDirectory });
+          await state.services.restartLocalCodex(
+            { installDirectory },
+            { changeLockHeld: true },
+          );
           if (state.codexLogin === login && !state.closing) {
             login.status = "success";
           }
@@ -488,14 +858,24 @@ async function handleApi(request, response, path, state) {
             login.status = "error";
             login.error = safeErrorMessage(error);
           }
+        } finally {
+          await releaseChangeLock();
         }
       })();
+      lockTransferred = true;
       sendJson(response, 200, {
         verificationUrl: attempt.verificationUrl,
         userCode: attempt.userCode,
       });
     } finally {
+      if (!lockTransferred && releaseChangeLock) {
+        await releaseChangeLock();
+      }
       state.codexLoginStartInFlight = false;
+      finishStart();
+      if (state.codexLoginStartPromise === startPromise) {
+        state.codexLoginStartPromise = null;
+      }
     }
     return;
   }
@@ -670,6 +1050,7 @@ function createRequestHandler(state) {
       if (!response.headersSent) {
         sendJson(response, error.statusCode ?? 400, {
           error: safeErrorMessage(error),
+          ...(error.retryBlocked === true ? { retryBlocked: true } : {}),
         });
       } else {
         response.end();
@@ -684,6 +1065,7 @@ export async function startWizardServer({
   uiFiles,
   port = 0,
   previewMode = false,
+  oauthShutdownWaitMs = OAUTH_SHUTDOWN_WAIT_MS,
 } = {}) {
   if (typeof sessionToken !== "string" || sessionToken.length < 32) {
     throw new TypeError("A strong wizard session token is required.");
@@ -699,12 +1081,20 @@ export async function startWizardServer({
     discovery: null,
     networksByContainer: new Map(),
     oauthLogin: null,
+    oauthRetryBlocked: false,
+    oauthStartupError: null,
+    oauthLoginStartInFlight: false,
+    oauthLoginStartPromise: null,
     localPlan: null,
     localInstallInFlight: false,
+    localCredentialRotationInFlight: false,
+    localCredentialRotationPending: null,
     codexLogin: null,
     codexLoginStartInFlight: false,
+    codexLoginStartPromise: null,
     rateLimits: new Map(),
     previewMode: previewMode === true,
+    oauthShutdownWaitMs,
     closing: false,
   };
   const server = createServer(createRequestHandler(state));
@@ -724,13 +1114,34 @@ export async function startWizardServer({
     origin: state.origin,
     async close() {
       state.closing = true;
-      state.oauthLogin?.attempt.cancel();
+      await waitForBoundedResult(
+        state.oauthLoginStartPromise,
+        state.oauthShutdownWaitMs,
+      );
+      if (state.oauthLogin?.status === "pending") {
+        try {
+          await cancelOAuthLogin(state, state.oauthLogin);
+        } catch {
+          // The bounded OAuth cancellation result must not prevent server shutdown.
+        }
+      }
       const codexLogin = state.codexLogin;
       state.codexLogin = null;
       codexLogin?.cancel();
+      await waitForBoundedResult(
+        state.codexLoginStartPromise,
+        state.oauthShutdownWaitMs,
+      );
+      await waitForBoundedResult(
+        codexLogin?.completion,
+        state.oauthShutdownWaitMs,
+      );
       state.connection?.close();
       state.connection = null;
-      await new Promise((resolve) => server.close(resolve));
+      await waitForBoundedResult(
+        new Promise((resolve) => server.close(resolve)),
+        state.oauthShutdownWaitMs,
+      );
     },
   };
 }