upfynai-code 0.1.0 → 2.2.0

package/server/routes/auth.js

@@ -0,0 +1,220 @@
+import express from 'express';
+import bcrypt from 'bcryptjs';
+import { userDb, subscriptionDb, relayTokensDb, apiKeysDb } from '../database/db.js';
+import { generateToken, authenticateToken, setSessionCookie, clearSessionCookie } from '../middleware/auth.js';
+
+const router = express.Router();
+
+// Check auth status and setup requirements
+router.get('/status', async (req, res) => {
+  try {
+    const hasUsers = await userDb.hasUsers();
+    res.json({
+      needsSetup: !hasUsers,
+      isAuthenticated: false
+    });
+  } catch (error) {
+    // auth status error
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// User registration — allows multiple users
+router.post('/register', async (req, res) => {
+  try {
+    const { username, password, email, phone, firstName, lastName } = req.body;
+
+    // Validate input
+    if (!password) {
+      return res.status(400).json({ error: 'Password is required' });
+    }
+    if (password.length < 6) {
+      return res.status(400).json({ error: 'Password must be at least 6 characters' });
+    }
+
+    // Derive display username from firstName + lastName if no username provided
+    const fName = (firstName || '').trim();
+    const lName = (lastName || '').trim();
+    const displayName = username || [fName, lName].filter(Boolean).join(' ') || 'User';
+
+    if (displayName.length < 2) {
+      return res.status(400).json({ error: 'Name must be at least 2 characters' });
+    }
+
+    // Check if email is already registered
+    if (email) {
+      const existingUser = await userDb.getUserByUsername(email);
+      if (existingUser) {
+        return res.status(409).json({ error: 'An account with this email already exists. Please sign in.' });
+      }
+    }
+
+    // Hash password
+    const passwordHash = await bcrypt.hash(password, 12);
+
+    // Create user
+    const user = await userDb.createUser(displayName, passwordHash, email || null, phone || null, fName || null, lName || null);
+
+    // Auto-create default relay token + API key for the new user
+    let connectToken = null;
+    try {
+      const relayToken = await relayTokensDb.createToken(user.id, 'default');
+      connectToken = relayToken.token;
+      await apiKeysDb.createApiKey(user.id, 'default');
+    } catch { /* non-critical — user can create manually later */ }
+
+    // Generate token + set cookie
+    const token = generateToken(user);
+    setSessionCookie(res, token);
+    await userDb.updateLastLogin(user.id);
+
+    // New user — no subscription yet
+    res.json({
+      success: true,
+      user: { id: user.user_code || `upc-${String(user.id).padStart(3, '0')}`, username: user.username, first_name: user.first_name, last_name: user.last_name, email: email || null, phone: phone || null, access_override: user.access_override || null, subscription: null },
+      token, // still returned for backward compat / API clients
+      connectToken // relay token for CLI connection
+    });
+
+  } catch (error) {
+    // registration error
+    if (error.message?.includes('UNIQUE')) {
+      res.status(409).json({ error: 'An account with this name already exists. Try a different name or sign in.' });
+    } else {
+      res.status(500).json({ error: 'Internal server error' });
+    }
+  }
+});
+
+// User login
+router.post('/login', async (req, res) => {
+  try {
+    const { username, password } = req.body;
+
+    if (!username || !password) {
+      return res.status(400).json({ error: 'Username and password are required' });
+    }
+
+    const user = await userDb.getUserByUsername(username.trim());
+    if (!user) {
+      return res.status(401).json({ error: 'Invalid username or password' });
+    }
+
+    const isValidPassword = await bcrypt.compare(password, user.password_hash);
+    if (!isValidPassword) {
+      return res.status(401).json({ error: 'Invalid username or password' });
+    }
+
+    // Generate token + set cookie
+    const token = generateToken(user);
+    setSessionCookie(res, token);
+    await userDb.updateLastLogin(user.id);
+
+    // Backfill relay token + API key if missing (for users created before auto-provisioning)
+    try {
+      const existingTokens = await relayTokensDb.getTokens(user.id);
+      if (existingTokens.length === 0) {
+        await relayTokensDb.createToken(user.id, 'default');
+      }
+      const existingKeys = await apiKeysDb.getApiKeys(user.id);
+      if (existingKeys.length === 0) {
+        await apiKeysDb.createApiKey(user.id, 'default');
+      }
+    } catch { /* non-critical backfill */ }
+
+    // Include active subscription if any
+    let subscription = null;
+    try {
+      await subscriptionDb.expireOverdue();
+      const sub = await subscriptionDb.getActiveSub(user.id);
+      if (sub) {
+        subscription = { id: sub.id, planId: sub.plan_id, status: sub.status, startsAt: sub.starts_at, expiresAt: sub.expires_at };
+      }
+    } catch { /* non-critical */ }
+
+    res.json({
+      success: true,
+      user: { id: user.user_code || `upc-${String(user.id).padStart(3, '0')}`, username: user.username, first_name: user.first_name, last_name: user.last_name, email: user.email, phone: user.phone, access_override: user.access_override || null, subscription },
+      token // backward compat
+    });
+
+  } catch (error) {
+    // login error
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Get current user (protected route) — includes active subscription
+router.get('/user', authenticateToken, async (req, res) => {
+  try {
+    // Expire overdue subs, then fetch active
+    await subscriptionDb.expireOverdue();
+    const sub = await subscriptionDb.getActiveSub(req.user.id);
+
+    // Map internal id → user_code for frontend, include all user details
+    const user = {
+      id: req.user.user_code || `upc-${String(req.user.id).padStart(3, '0')}`,
+      username: req.user.username,
+      first_name: req.user.first_name,
+      last_name: req.user.last_name,
+      email: req.user.email,
+      phone: req.user.phone,
+      access_override: req.user.access_override || null,
+      created_at: req.user.created_at,
+    };
+
+    if (sub) {
+      user.subscription = {
+        id: sub.id,
+        planId: sub.plan_id,
+        status: sub.status,
+        startsAt: sub.starts_at,
+        expiresAt: sub.expires_at,
+      };
+    } else {
+      user.subscription = null;
+    }
+
+    res.json({ user });
+  } catch (error) {
+    // user fetch error
+    const u = req.user;
+    res.json({ user: { id: u.user_code || `upc-${String(u.id).padStart(3, '0')}`, username: u.username, first_name: u.first_name, last_name: u.last_name, email: u.email, phone: u.phone } });
+  }
+});
+
+// Get user's tokens — relay token (for Connect + MCP) and API key
+router.get('/connect-token', authenticateToken, async (req, res) => {
+  try {
+    // Relay token — used for both CLI connect and MCP auth
+    const tokens = await relayTokensDb.getTokens(req.user.id);
+    let active = tokens.find(t => t.is_active);
+    if (!active) {
+      // Auto-create if none exists (backfill for existing users)
+      active = await relayTokensDb.createToken(req.user.id, 'default');
+    }
+
+    // API key — also available if user needs it
+    const keys = await apiKeysDb.getApiKeys(req.user.id);
+    let activeKey = keys.find(k => k.is_active);
+    if (!activeKey) {
+      activeKey = await apiKeysDb.createApiKey(req.user.id, 'default');
+    }
+
+    res.json({
+      token: active.token,        // relay token — works for Connect + MCP
+      apiKey: activeKey.api_key,   // API key — alternative auth method
+      userCode: req.user.user_code || null,
+    });
+  } catch (error) {
+    res.status(500).json({ error: 'Could not fetch connect token' });
+  }
+});
+
+// Logout — clear the session cookie
+router.post('/logout', authenticateToken, (req, res) => {
+  clearSessionCookie(res);
+  res.json({ success: true, message: 'Logged out successfully' });
+});
+
+export default router;

package/server/routes/cli-auth.js

@@ -0,0 +1,263 @@
+import express from 'express';
+import { spawn } from 'child_process';
+import fs from 'fs/promises';
+import path from 'path';
+import os from 'os';
+
+const router = express.Router();
+
+router.get('/claude/status', async (req, res) => {
+  try {
+    const credentialsResult = await checkClaudeCredentials();
+
+    if (credentialsResult.authenticated) {
+      return res.json({
+        authenticated: true,
+        email: credentialsResult.email || 'Authenticated',
+        method: 'credentials_file'
+      });
+    }
+
+    return res.json({
+      authenticated: false,
+      email: null,
+      error: credentialsResult.error || 'Not authenticated'
+    });
+
+  } catch (error) {
+    // auth status error
+    res.status(500).json({
+      authenticated: false,
+      email: null,
+      error: 'An error occurred'
+    });
+  }
+});
+
+router.get('/cursor/status', async (req, res) => {
+  try {
+    const result = await checkCursorStatus();
+
+    res.json({
+      authenticated: result.authenticated,
+      email: result.email,
+      error: result.error
+    });
+
+  } catch (error) {
+    // auth status error
+    res.status(500).json({
+      authenticated: false,
+      email: null,
+      error: 'An error occurred'
+    });
+  }
+});
+
+router.get('/codex/status', async (req, res) => {
+  try {
+    const result = await checkCodexCredentials();
+
+    res.json({
+      authenticated: result.authenticated,
+      email: result.email,
+      error: result.error
+    });
+
+  } catch (error) {
+    // auth status error
+    res.status(500).json({
+      authenticated: false,
+      email: null,
+      error: 'An error occurred'
+    });
+  }
+});
+
+async function checkClaudeCredentials() {
+  try {
+    const credPath = path.join(os.homedir(), '.claude', '.credentials.json');
+    const content = await fs.readFile(credPath, 'utf8');
+    const creds = JSON.parse(content);
+
+    const oauth = creds.claudeAiOauth;
+    if (oauth && oauth.accessToken) {
+      const isExpired = oauth.expiresAt && Date.now() >= oauth.expiresAt;
+
+      if (!isExpired) {
+        return {
+          authenticated: true,
+          email: creds.email || creds.user || null
+        };
+      }
+    }
+
+    return {
+      authenticated: false,
+      email: null
+    };
+  } catch (error) {
+    return {
+      authenticated: false,
+      email: null
+    };
+  }
+}
+
+function checkCursorStatus() {
+  return new Promise((resolve) => {
+    let processCompleted = false;
+
+    const timeout = setTimeout(() => {
+      if (!processCompleted) {
+        processCompleted = true;
+        if (childProcess) {
+          childProcess.kill();
+        }
+        resolve({
+          authenticated: false,
+          email: null,
+          error: 'Command timeout'
+        });
+      }
+    }, 5000);
+
+    let childProcess;
+    try {
+      childProcess = spawn('cursor-agent', ['status']);
+    } catch (err) {
+      clearTimeout(timeout);
+      processCompleted = true;
+      resolve({
+        authenticated: false,
+        email: null,
+        error: 'Cursor CLI not found or not installed'
+      });
+      return;
+    }
+
+    let stdout = '';
+    let stderr = '';
+
+    childProcess.stdout.on('data', (data) => {
+      stdout += data.toString();
+    });
+
+    childProcess.stderr.on('data', (data) => {
+      stderr += data.toString();
+    });
+
+    childProcess.on('close', (code) => {
+      if (processCompleted) return;
+      processCompleted = true;
+      clearTimeout(timeout);
+
+      if (code === 0) {
+        const emailMatch = stdout.match(/Logged in as ([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})/i);
+
+        if (emailMatch) {
+          resolve({
+            authenticated: true,
+            email: emailMatch[1],
+            output: stdout
+          });
+        } else if (stdout.includes('Logged in')) {
+          resolve({
+            authenticated: true,
+            email: 'Logged in',
+            output: stdout
+          });
+        } else {
+          resolve({
+            authenticated: false,
+            email: null,
+            error: 'Not logged in'
+          });
+        }
+      } else {
+        resolve({
+          authenticated: false,
+          email: null,
+          error: stderr || 'Not logged in'
+        });
+      }
+    });
+
+    childProcess.on('error', (err) => {
+      if (processCompleted) return;
+      processCompleted = true;
+      clearTimeout(timeout);
+
+      resolve({
+        authenticated: false,
+        email: null,
+        error: 'Cursor CLI not found or not installed'
+      });
+    });
+  });
+}
+
+async function checkCodexCredentials() {
+  try {
+    const authPath = path.join(os.homedir(), '.codex', 'auth.json');
+    const content = await fs.readFile(authPath, 'utf8');
+    const auth = JSON.parse(content);
+
+    // Tokens are nested under 'tokens' key
+    const tokens = auth.tokens || {};
+
+    // Check for valid tokens (id_token or access_token)
+    if (tokens.id_token || tokens.access_token) {
+      // Try to extract email from id_token JWT payload
+      let email = 'Authenticated';
+      if (tokens.id_token) {
+        try {
+          // JWT is base64url encoded: header.payload.signature
+          const parts = tokens.id_token.split('.');
+          if (parts.length >= 2) {
+            // Decode the payload (second part)
+            const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+            email = payload.email || payload.user || 'Authenticated';
+          }
+        } catch {
+          // If JWT decoding fails, use fallback
+          email = 'Authenticated';
+        }
+      }
+
+      return {
+        authenticated: true,
+        email
+      };
+    }
+
+    // Also check for OPENAI_API_KEY as fallback auth method
+    if (auth.OPENAI_API_KEY) {
+      return {
+        authenticated: true,
+        email: 'API Key Auth'
+      };
+    }
+
+    return {
+      authenticated: false,
+      email: null,
+      error: 'No valid tokens found'
+    };
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      return {
+        authenticated: false,
+        email: null,
+        error: 'Codex not configured'
+      };
+    }
+    return {
+      authenticated: false,
+      email: null,
+      error: 'An error occurred'
+    };
+  }
+}
+
+export default router;