slackhive 0.1.41 → 0.1.43

package/apps/web/src/app/api/auth/me/route.ts

@@ -1,24 +0,0 @@
-/**
- * @fileoverview Current user API — returns session info from cookie.
- *
- * GET /api/auth/me
- *
- * @module web/api/auth/me
- */
-
-import { NextResponse } from 'next/server';
-import { getSessionFromRequest } from '@/lib/auth';
-
-/**
- * Returns the current user's username and role from the session cookie.
- *
- * @param {Request} req - Incoming request.
- * @returns {Promise<NextResponse>} JSON with user info or 401.
- */
-export async function GET(req: Request): Promise<NextResponse> {
-  const session = getSessionFromRequest(req);
-  if (!session) {
-    return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
-  }
-  return NextResponse.json({ username: session.username, role: session.role });
-}

package/apps/web/src/app/api/auth/users/[id]/route.ts

@@ -1,48 +0,0 @@
-/**
- * @fileoverview User management API — delete and update role.
- *
- * DELETE /api/auth/users/[id] — Delete a user (admin only)
- * PATCH  /api/auth/users/[id] — Update a user's role (admin only)
- *
- * @module web/api/auth/users/[id]
- */
-
-import { NextResponse } from 'next/server';
-import { requireRole } from '@/lib/auth';
-import { deleteUser, updateUserRole } from '@/lib/db';
-
-const VALID_ROLES = ['admin', 'editor', 'viewer'];
-
-/**
- * Deletes a user by ID (admin only).
- */
-export async function DELETE(req: Request, { params }: { params: Promise<{ id: string }> }): Promise<NextResponse> {
-  try {
-    requireRole(req, 'admin');
-  } catch {
-    return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
-  }
-  const { id } = await params;
-  await deleteUser(id);
-  return new NextResponse(null, { status: 204 });
-}
-
-/**
- * Updates a user's role (admin only).
- * Body: { role: 'admin' | 'editor' | 'viewer' }
- */
-export async function PATCH(req: Request, { params }: { params: Promise<{ id: string }> }): Promise<NextResponse> {
-  try {
-    requireRole(req, 'admin');
-  } catch {
-    return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
-  }
-  const { id } = await params;
-  const body = await req.json().catch(() => ({}));
-  const { role } = body;
-  if (!role || !VALID_ROLES.includes(role)) {
-    return NextResponse.json({ error: `Invalid role. Must be one of: ${VALID_ROLES.join(', ')}` }, { status: 400 });
-  }
-  await updateUserRole(id, role);
-  return NextResponse.json({ id, role });
-}

package/apps/web/src/app/api/auth/users/route.ts

@@ -1,63 +0,0 @@
-/**
- * @fileoverview User management API — list and create users.
- *
- * GET  /api/auth/users — list all users (admin only).
- * POST /api/auth/users — create a user `{ username, password, role }` (admin only).
- *
- * @module web/api/auth/users
- */
-
-import { NextResponse } from 'next/server';
-import { requireRole, hashPassword } from '@/lib/auth';
-import { getAllUsers, createUser } from '@/lib/db';
-
-/**
- * Lists all platform users (excluding password hashes).
- *
- * @param {Request} req - Incoming request.
- * @returns {Promise<NextResponse>} JSON array of users.
- */
-export async function GET(req: Request): Promise<NextResponse> {
-  try {
-    requireRole(req, 'admin');
-  } catch {
-    return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
-  }
-  const users = await getAllUsers();
-  return NextResponse.json(users);
-}
-
-/**
- * Creates a new platform user.
- *
- * @param {Request} req - JSON body with `username`, `password`, `role`.
- * @returns {Promise<NextResponse>} Created user JSON.
- */
-export async function POST(req: Request): Promise<NextResponse> {
-  try {
-    requireRole(req, 'admin');
-  } catch {
-    return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
-  }
-
-  const { username, password, role } = await req.json();
-
-  if (!username || !password) {
-    return NextResponse.json({ error: 'username and password required' }, { status: 400 });
-  }
-  if (role && !['admin', 'editor', 'viewer'].includes(role)) {
-    return NextResponse.json({ error: 'role must be admin, editor, or viewer' }, { status: 400 });
-  }
-
-  try {
-    const hash = await hashPassword(password);
-    const user = await createUser(username, hash, role || 'viewer');
-    return NextResponse.json(user, { status: 201 });
-  } catch (e: unknown) {
-    const msg = e instanceof Error ? e.message : 'Unknown error';
-    if (msg.includes('unique') || msg.includes('duplicate')) {
-      return NextResponse.json({ error: 'Username already exists' }, { status: 409 });
-    }
-    return NextResponse.json({ error: msg }, { status: 500 });
-  }
-}

package/apps/web/src/app/api/env-vars/[key]/route.ts

@@ -1,66 +0,0 @@
-/**
- * @fileoverview REST API for a single env var entry.
- *
- * PUT    /api/env-vars/[key] — Update value and/or description
- * DELETE /api/env-vars/[key] — Remove the env var
- *
- * @module web/api/env-vars/[key]
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-import { setEnvVar, updateEnvVarDescription, deleteEnvVar } from '@/lib/db';
-import { guardAdmin } from '@/lib/api-guard';
-
-/**
- * PUT /api/env-vars/[key]
- * Updates an env var. Supply value to replace it, description to update label.
- * At least one of value or description must be provided.
- *
- * @param {NextRequest} request - Body: { value?: string, description?: string }
- * @param {{ params: { key: string } }} context - Route params.
- * @returns {Promise<NextResponse>}
- */
-export async function PUT(
-  request: NextRequest,
-  { params }: { params: Promise<{ key: string }> }
-): Promise<NextResponse> {
-  const denied = guardAdmin(request);
-  if (denied) return denied;
-  try {
-    const { key } = await params;
-    const body = (await request.json()) as { value?: string; description?: string };
-    if (body.value !== undefined) {
-      await setEnvVar(key, body.value, body.description);
-    } else if (body.description !== undefined) {
-      await updateEnvVarDescription(key, body.description);
-    } else {
-      return NextResponse.json({ error: 'value or description required' }, { status: 400 });
-    }
-    return NextResponse.json({ key });
-  } catch (err) {
-    return NextResponse.json({ error: (err as Error).message }, { status: 500 });
-  }
-}
-
-/**
- * DELETE /api/env-vars/[key]
- * Removes an env var from the store.
- *
- * @param {NextRequest} request - Incoming request.
- * @param {{ params: { key: string } }} context - Route params.
- * @returns {Promise<NextResponse>}
- */
-export async function DELETE(
-  request: NextRequest,
-  { params }: { params: Promise<{ key: string }> }
-): Promise<NextResponse> {
-  const denied = guardAdmin(request);
-  if (denied) return denied;
-  try {
-    const { key } = await params;
-    await deleteEnvVar(key);
-    return NextResponse.json({ ok: true });
-  } catch (err) {
-    return NextResponse.json({ error: (err as Error).message }, { status: 500 });
-  }
-}

package/apps/web/src/app/api/env-vars/route.ts

@@ -1,59 +0,0 @@
-/**
- * @fileoverview REST API for the platform env vars store.
- *
- * GET  /api/env-vars — List all env var keys + metadata (values never returned)
- * POST /api/env-vars — Create or update an env var
- *
- * @module web/api/env-vars
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-import { getAllEnvVars, setEnvVar } from '@/lib/db';
-import { guardAdmin } from '@/lib/api-guard';
-
-/**
- * GET /api/env-vars
- * Returns all env var keys and descriptions. Values are never included.
- *
- * @returns {Promise<NextResponse>} JSON array of { key, description, updatedAt }.
- */
-export async function GET(): Promise<NextResponse> {
-  try {
-    const vars = await getAllEnvVars();
-    return NextResponse.json(vars);
-  } catch (err) {
-    return NextResponse.json({ error: (err as Error).message }, { status: 500 });
-  }
-}
-
-/**
- * POST /api/env-vars
- * Creates or updates an env var. Requires editor role or above.
- *
- * @param {NextRequest} request - Body: { key: string, value: string, description?: string }
- * @returns {Promise<NextResponse>} 201 on success.
- */
-export async function POST(request: NextRequest): Promise<NextResponse> {
-  const denied = guardAdmin(request);
-  if (denied) return denied;
-  try {
-    const { key, value, description } = (await request.json()) as {
-      key: string;
-      value: string;
-      description?: string;
-    };
-    if (!key || !value) {
-      return NextResponse.json({ error: 'key and value are required' }, { status: 400 });
-    }
-    if (!/^[A-Z_][A-Z0-9_]*$/.test(key)) {
-      return NextResponse.json(
-        { error: 'key must be uppercase letters, digits, and underscores (e.g. DATABASE_URL)' },
-        { status: 400 }
-      );
-    }
-    await setEnvVar(key, value, description);
-    return NextResponse.json({ key }, { status: 201 });
-  } catch (err) {
-    return NextResponse.json({ error: (err as Error).message }, { status: 500 });
-  }
-}

package/apps/web/src/app/api/jobs/[id]/route.ts

@@ -1,51 +0,0 @@
-/**
- * @fileoverview Single job API — get, update, delete.
- *
- * GET    /api/jobs/[id] — get a job.
- * PATCH  /api/jobs/[id] — update a job.
- * DELETE /api/jobs/[id] — delete a job.
- *
- * @module web/api/jobs/[id]
- */
-
-import { NextResponse } from 'next/server';
-import { guardAdmin } from '@/lib/api-guard';
-import { getJobById, updateJob, deleteJob, publishAgentEvent } from '@/lib/db';
-
-type Ctx = { params: Promise<{ id: string }> };
-
-/**
- * Returns a single job by ID.
- */
-export async function GET(_req: Request, { params }: Ctx): Promise<NextResponse> {
-  const { id } = await params;
-  const job = await getJobById(id);
-  if (!job) return NextResponse.json({ error: 'Not found' }, { status: 404 });
-  return NextResponse.json(job);
-}
-
-/**
- * Updates a scheduled job.
- */
-export async function PATCH(req: Request, { params }: Ctx): Promise<NextResponse> {
-  const denied = guardAdmin(req);
-  if (denied) return denied;
-  const { id } = await params;
-  const body = await req.json();
-  const job = await updateJob(id, body);
-  if (!job) return NextResponse.json({ error: 'Not found' }, { status: 404 });
-  await publishAgentEvent({ type: 'reload-jobs' });
-  return NextResponse.json(job);
-}
-
-/**
- * Deletes a scheduled job.
- */
-export async function DELETE(req: Request, { params }: Ctx): Promise<NextResponse> {
-  const denied = guardAdmin(req);
-  if (denied) return denied;
-  const { id } = await params;
-  await deleteJob(id);
-  await publishAgentEvent({ type: 'reload-jobs' });
-  return new NextResponse(null, { status: 204 });
-}

package/apps/web/src/app/api/jobs/[id]/runs/route.ts

@@ -1,24 +0,0 @@
-/**
- * @fileoverview Job runs API — execution history for a scheduled job.
- *
- * GET /api/jobs/[id]/runs — paginated run history.
- *
- * @module web/api/jobs/[id]/runs
- */
-
-import { NextResponse } from 'next/server';
-import { getJobRuns } from '@/lib/db';
-
-type Ctx = { params: Promise<{ id: string }> };
-
-/**
- * Returns paginated run history for a job.
- */
-export async function GET(req: Request, { params }: Ctx): Promise<NextResponse> {
-  const { id } = await params;
-  const url = new URL(req.url);
-  const limit = parseInt(url.searchParams.get('limit') || '20', 10);
-  const offset = parseInt(url.searchParams.get('offset') || '0', 10);
-  const runs = await getJobRuns(id, limit, offset);
-  return NextResponse.json(runs);
-}

package/apps/web/src/app/api/jobs/route.ts

@@ -1,42 +0,0 @@
-/**
- * @fileoverview Scheduled jobs API — list and create jobs.
- *
- * GET  /api/jobs — list all jobs with last run info.
- * POST /api/jobs — create a new scheduled job.
- *
- * @module web/api/jobs
- */
-
-import { NextResponse } from 'next/server';
-import { guardAdmin } from '@/lib/api-guard';
-import { getAllJobs, createJob, publishAgentEvent } from '@/lib/db';
-
-/**
- * Lists all scheduled jobs with their most recent run.
- *
- * @returns {Promise<NextResponse>} JSON array of jobs.
- */
-export async function GET(): Promise<NextResponse> {
-  const jobs = await getAllJobs();
-  return NextResponse.json(jobs);
-}
-
-/**
- * Creates a new scheduled job.
- *
- * @param {Request} req - JSON body with job fields.
- * @returns {Promise<NextResponse>} Created job.
- */
-export async function POST(req: Request): Promise<NextResponse> {
-  const denied = guardAdmin(req);
-  if (denied) return denied;
-
-  const body = await req.json();
-  if (!body.name || !body.prompt || !body.cronSchedule || !body.targetId || !body.agentId) {
-    return NextResponse.json({ error: 'agentId, name, prompt, cronSchedule, and targetId are required' }, { status: 400 });
-  }
-
-  const job = await createJob(body);
-  await publishAgentEvent({ type: 'reload-jobs' });
-  return NextResponse.json(job, { status: 201 });
-}

package/apps/web/src/app/api/mcps/[id]/route.ts

@@ -1,60 +0,0 @@
-/**
- * @fileoverview REST API route for a single MCP server resource.
- *
- * GET    /api/mcps/[id] — Get a specific MCP server
- * PATCH  /api/mcps/[id] — Update an MCP server
- * DELETE /api/mcps/[id] — Remove an MCP server from the catalog
- *
- * @module web/api/mcps/[id]
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-import { getMcpServerById, updateMcpServer, deleteMcpServer } from '@/lib/db';
-import type { UpsertMcpServerRequest } from '@slackhive/shared';
-import { guardAdmin } from '@/lib/api-guard';
-import { maskMcpServer, mergeMcpConfig } from '@/lib/mcp-mask';
-
-type RouteParams = { params: Promise<{ id: string }> };
-
-export async function GET(_req: NextRequest, { params }: RouteParams): Promise<NextResponse> {
-  try {
-    const { id } = await params;
-    const server = await getMcpServerById(id);
-    if (!server) return NextResponse.json({ error: 'Not found' }, { status: 404 });
-    return NextResponse.json(maskMcpServer(server));
-  } catch (err) {
-    return NextResponse.json({ error: (err as Error).message }, { status: 500 });
-  }
-}
-
-export async function PATCH(req: NextRequest, { params }: RouteParams): Promise<NextResponse> {
-  const denied = guardAdmin(req);
-  if (denied) return denied;
-  try {
-    const { id } = await params;
-    const body = (await req.json()) as Partial<UpsertMcpServerRequest>;
-    // If config is being updated, merge masked values with existing secrets
-    if (body.config) {
-      const existing = await getMcpServerById(id);
-      if (!existing) return NextResponse.json({ error: 'Not found' }, { status: 404 });
-      body.config = mergeMcpConfig(existing.config, body.config);
-    }
-    const updated = await updateMcpServer(id, body);
-    if (!updated) return NextResponse.json({ error: 'Not found' }, { status: 404 });
-    return NextResponse.json(maskMcpServer(updated));
-  } catch (err) {
-    return NextResponse.json({ error: (err as Error).message }, { status: 500 });
-  }
-}
-
-export async function DELETE(req: NextRequest, { params }: RouteParams): Promise<NextResponse> {
-  const denied = guardAdmin(req);
-  if (denied) return denied;
-  try {
-    const { id } = await params;
-    await deleteMcpServer(id);
-    return new NextResponse(null, { status: 204 });
-  } catch (err) {
-    return NextResponse.json({ error: (err as Error).message }, { status: 500 });
-  }
-}

package/apps/web/src/app/api/mcps/[id]/test/route.ts

@@ -1,195 +0,0 @@
-/**
- * @fileoverview MCP server connectivity test endpoint.
- *
- * POST /api/mcps/[id]/test
- *
- * For stdio MCPs: spawns the process, sends an MCP initialize request over
- * stdin/stdout, and verifies the server responds with a valid JSON-RPC result.
- * Times out after 10 seconds.
- *
- * For SSE/HTTP MCPs: sends a GET request to the configured URL and checks
- * for a 2xx response.
- *
- * @module web/api/mcps/[id]/test
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-import { getMcpServerById, getEnvVarValues } from '@/lib/db';
-import { guardAdmin } from '@/lib/api-guard';
-import { spawn } from 'child_process';
-import { writeFile, unlink, mkdir } from 'fs/promises';
-import { tmpdir } from 'os';
-import { join } from 'path';
-import type { McpStdioConfig, McpSseConfig } from '@slackhive/shared';
-
-type RouteParams = { params: Promise<{ id: string }> };
-
-const TIMEOUT_MS = 30_000;
-
-/**
- * POST /api/mcps/[id]/test
- * Runs a quick connectivity check against the MCP server.
- *
- * @returns {Promise<NextResponse>} { ok: true, message } or { ok: false, error }
- */
-export async function POST(req: NextRequest, { params }: RouteParams): Promise<NextResponse> {
-  const denied = guardAdmin(req);
-  if (denied) return denied;
-
-  const { id } = await params;
-  const server = await getMcpServerById(id);
-  if (!server) {
-    return NextResponse.json({ error: 'MCP server not found' }, { status: 404 });
-  }
-
-  try {
-    if (server.type === 'stdio') {
-      const result = await testStdioMcp(server.config as McpStdioConfig, server.name);
-      return NextResponse.json(result);
-    }
-
-    // SSE / HTTP — just check the URL is reachable
-    const cfg = server.config as McpSseConfig & { envRefs?: Record<string, string> };
-    const headers: Record<string, string> = { ...(cfg.headers ?? {}) };
-    if (cfg.envRefs && Object.keys(cfg.envRefs).length > 0) {
-      try {
-        const envVarValues = await getEnvVarValues();
-        for (const [headerKey, storeKey] of Object.entries(cfg.envRefs)) {
-          const val = envVarValues[storeKey];
-          if (val) headers[headerKey] = headers[headerKey] ? `${headers[headerKey]}${val}` : val;
-        }
-      } catch { /* skip if env vars unavailable */ }
-    }
-    const res = await fetch(cfg.url, {
-      method: 'GET',
-      headers,
-      signal: AbortSignal.timeout(TIMEOUT_MS),
-    });
-    if (res.ok || res.status === 405) {
-      // 405 Method Not Allowed is fine — the endpoint exists
-      return NextResponse.json({ ok: true, message: `Reachable (HTTP ${res.status})` });
-    }
-    return NextResponse.json({ ok: false, error: `HTTP ${res.status}: ${res.statusText}` });
-  } catch (err) {
-    return NextResponse.json({ ok: false, error: (err as Error).message });
-  }
-}
-
-/**
- * Spawns a stdio MCP process, sends an MCP initialize request, and verifies
- * the response. Resolves envRefs from the env_vars store before spawning.
- */
-async function testStdioMcp(
-  cfg: McpStdioConfig,
-  name: string
-): Promise<{ ok: boolean; message?: string; error?: string; tools?: string[] }> {
-  const resolvedEnv: Record<string, string> = { ...(cfg.env ?? {}) };
-  if (cfg.envRefs && Object.keys(cfg.envRefs).length > 0) {
-    try {
-      const envVarValues = await getEnvVarValues();
-      for (const [subKey, storeKey] of Object.entries(cfg.envRefs)) {
-        if (envVarValues[storeKey] !== undefined) resolvedEnv[subKey] = envVarValues[storeKey];
-      }
-    } catch { /* ENV_SECRET_KEY not set — skip */ }
-  }
-
-  let command: string;
-  let args: string[];
-  let tmpScript: string | null = null;
-
-  if (cfg.tsSource) {
-    const dir = join(tmpdir(), 'slackhive-mcp-test');
-    await mkdir(dir, { recursive: true });
-    tmpScript = join(dir, `test-${Date.now()}.ts`);
-    await writeFile(tmpScript, cfg.tsSource, 'utf8');
-    command = 'tsx';
-    args = [tmpScript];
-  } else {
-    command = cfg.command;
-    args = cfg.args ?? [];
-  }
-
-  const cleanup = () => { if (tmpScript) unlink(tmpScript).catch(() => {}); };
-
-  return new Promise((resolve) => {
-    let stdout = '';
-    let stderr = '';
-    let settled = false;
-
-    const timer = setTimeout(() => {
-      if (!settled) {
-        settled = true;
-        proc.kill();
-        cleanup();
-        resolve({ ok: false, error: `Timed out after ${TIMEOUT_MS / 1000}s — process did not respond` });
-      }
-    }, TIMEOUT_MS);
-
-    const proc = spawn(command, args, {
-      env: { ...process.env, NODE_PATH: '/app/node_modules', ...resolvedEnv },
-      stdio: ['pipe', 'pipe', 'pipe'],
-    });
-
-    proc.stderr.on('data', (d: Buffer) => { stderr += d.toString(); });
-
-    const initRequest = JSON.stringify({
-      jsonrpc: '2.0',
-      id: 1,
-      method: 'initialize',
-      params: {
-        protocolVersion: '2024-11-05',
-        capabilities: {},
-        clientInfo: { name: 'slackhive-test', version: '1.0.0' },
-      },
-    }) + '\n';
-
-    proc.stdin.write(initRequest);
-
-    proc.stdout.on('data', (d: Buffer) => {
-      stdout += d.toString();
-      const lines = stdout.split('\n').filter(l => l.trim());
-      for (const line of lines) {
-        try {
-          const msg = JSON.parse(line) as { id?: number; result?: { serverInfo?: { name?: string }; capabilities?: { tools?: unknown } }; error?: { message?: string } };
-          if (msg.id === 1) {
-            clearTimeout(timer);
-            if (!settled) {
-              settled = true;
-              proc.kill();
-              cleanup();
-              if (msg.error) {
-                resolve({ ok: false, error: msg.error.message ?? 'MCP error' });
-              } else {
-                const serverName = msg.result?.serverInfo?.name ?? name;
-                resolve({ ok: true, message: `Connected to "${serverName}" successfully` });
-              }
-            }
-          }
-        } catch {
-          // incomplete line, keep buffering
-        }
-      }
-    });
-
-    proc.on('error', (err) => {
-      clearTimeout(timer);
-      if (!settled) {
-        settled = true;
-        cleanup();
-        resolve({ ok: false, error: `Failed to start: ${err.message}${stderr ? ` — ${stderr.trim()}` : ''}` });
-      }
-    });
-
-    proc.on('exit', (code) => {
-      clearTimeout(timer);
-      if (!settled) {
-        settled = true;
-        cleanup();
-        resolve({
-          ok: false,
-          error: `Process exited with code ${code}${stderr ? ` — ${stderr.trim()}` : ''}`,
-        });
-      }
-    });
-  });
-}