upfynai-code 2.6.0 → 2.6.1

package/server/routes/auth.js

@@ -1,266 +0,0 @@
-import express from 'express';
-import bcrypt from 'bcryptjs';
-import { db, userDb, subscriptionDb, relayTokensDb, apiKeysDb } from '../database/db.js';
-import { generateToken, authenticateToken, setSessionCookie, clearSessionCookie } from '../middleware/auth.js';
-
-const router = express.Router();
-
-// Check auth status and setup requirements
-router.get('/status', async (req, res) => {
-  try {
-    const hasUsers = await userDb.hasUsers();
-    res.json({
-      needsSetup: !hasUsers,
-      isAuthenticated: false
-    });
-  } catch (error) {
-    // auth status error
-    res.status(500).json({ error: 'Internal server error' });
-  }
-});
-
-// User registration — allows multiple users (rate limited)
-router.post('/register', (req, res, next) => {
-  const rl = req.app.locals.authRateLimit;
-  if (rl) return rl(req, res, next);
-  next();
-}, async (req, res) => {
-  try {
-    const { username, password, email, phone, firstName, lastName } = req.body;
-
-    // Validate input
-    if (!password) {
-      return res.status(400).json({ error: 'Password is required' });
-    }
-    if (password.length < 8) {
-      return res.status(400).json({ error: 'Password must be at least 8 characters' });
-    }
-    if (password.length > 128) {
-      return res.status(400).json({ error: 'Password is too long' });
-    }
-
-    // Sanitize and validate name/phone inputs
-    const fName = (firstName || '').trim().slice(0, 50);
-    const lName = (lastName || '').trim().slice(0, 50);
-    const displayName = username || [fName, lName].filter(Boolean).join(' ') || 'User';
-
-    if (displayName.length < 2) {
-      return res.status(400).json({ error: 'Name must be at least 2 characters' });
-    }
-
-    // Check if email is already registered
-    if (email) {
-      const existingUser = await userDb.getUserByUsername(email);
-      if (existingUser) {
-        return res.status(409).json({ error: 'An account with this email already exists. Please sign in.' });
-      }
-    }
-
-    // Hash password
-    const passwordHash = await bcrypt.hash(password, 12);
-
-    // Create user
-    const user = await userDb.createUser(displayName, passwordHash, email || null, phone || null, fName || null, lName || null);
-
-    // Auto-create default relay token + API key for the new user
-    let connectToken = null;
-    try {
-      const relayToken = await relayTokensDb.createToken(user.id, 'default');
-      connectToken = relayToken.token;
-      await apiKeysDb.createApiKey(user.id, 'default');
-    } catch { /* non-critical — user can create manually later */ }
-
-    // Generate token + set cookie
-    const token = generateToken(user);
-    setSessionCookie(res, token);
-    await userDb.updateLastLogin(user.id);
-
-    // New user — no subscription yet
-    res.json({
-      success: true,
-      user: { id: user.user_code || `upc-${String(user.id).padStart(3, '0')}`, username: user.username, first_name: user.first_name, last_name: user.last_name, email: email || null, phone: phone || null, access_override: user.access_override || null, subscription: null },
-      token, // still returned for backward compat / API clients
-      connectToken // relay token for CLI connection
-    });
-
-  } catch (error) {
-    // registration error
-    if (error.message?.includes('UNIQUE')) {
-      res.status(409).json({ error: 'An account with this name already exists. Try a different name or sign in.' });
-    } else {
-      res.status(500).json({ error: 'Internal server error' });
-    }
-  }
-});
-
-// User login (rate limited)
-router.post('/login', (req, res, next) => {
-  const rl = req.app.locals.authRateLimit;
-  if (rl) return rl(req, res, next);
-  next();
-}, async (req, res) => {
-  try {
-    const { username, password } = req.body;
-
-    if (!username || !password) {
-      return res.status(400).json({ error: 'Identifier and password are required' });
-    }
-
-    const user = await userDb.getUserByUsername(username.trim());
-    if (!user) {
-      return res.status(401).json({ error: 'Invalid credentials' });
-    }
-
-    const isValidPassword = await bcrypt.compare(password, user.password_hash);
-    if (!isValidPassword) {
-      return res.status(401).json({ error: 'Invalid credentials' });
-    }
-
-    const updatedUser = user;
-
-    // Generate token + set cookie
-    const token = generateToken(updatedUser);
-    setSessionCookie(res, token);
-    await userDb.updateLastLogin(updatedUser.id);
-
-    // Backfill relay token + API key if missing (for users created before auto-provisioning)
-    try {
-      const existingTokens = await relayTokensDb.getTokens(updatedUser.id);
-      if (existingTokens.length === 0) {
-        await relayTokensDb.createToken(updatedUser.id, 'default');
-      }
-      const existingKeys = await apiKeysDb.getApiKeys(updatedUser.id);
-      if (existingKeys.length === 0) {
-        await apiKeysDb.createApiKey(updatedUser.id, 'default');
-      }
-    } catch { /* non-critical backfill */ }
-
-    // Include active subscription if any
-    let subscription = null;
-    try {
-      await subscriptionDb.expireOverdue();
-      const sub = await subscriptionDb.getActiveSub(updatedUser.id);
-      if (sub) {
-        subscription = { id: sub.id, planId: sub.plan_id, status: sub.status, startsAt: sub.starts_at, expiresAt: sub.expires_at };
-      }
-    } catch { /* non-critical */ }
-
-    res.json({
-      success: true,
-      user: { id: updatedUser.user_code || `upc-${String(updatedUser.id).padStart(3, '0')}`, username: updatedUser.username, first_name: updatedUser.first_name, last_name: updatedUser.last_name, email: updatedUser.email, phone: updatedUser.phone, access_override: updatedUser.access_override || null, subscription },
-      token // backward compat
-    });
-
-  } catch (error) {
-    // login error
-    res.status(500).json({ error: 'Internal server error' });
-  }
-});
-
-// Get current user (protected route) — includes active subscription
-router.get('/user', authenticateToken, async (req, res) => {
-  try {
-    // Expire overdue subs, then fetch active
-    await subscriptionDb.expireOverdue();
-    const sub = await subscriptionDb.getActiveSub(req.user.id);
-
-    // Map internal id → user_code for frontend, include all user details
-    const user = {
-      id: req.user.user_code || `upc-${String(req.user.id).padStart(3, '0')}`,
-      username: req.user.username,
-      first_name: req.user.first_name,
-      last_name: req.user.last_name,
-      email: req.user.email,
-      phone: req.user.phone,
-      access_override: req.user.access_override || null,
-      created_at: req.user.created_at,
-    };
-
-    if (sub) {
-      user.subscription = {
-        id: sub.id,
-        planId: sub.plan_id,
-        status: sub.status,
-        startsAt: sub.starts_at,
-        expiresAt: sub.expires_at,
-      };
-    } else {
-      user.subscription = null;
-    }
-
-    res.json({ user });
-  } catch (error) {
-    // user fetch error
-    const u = req.user;
-    res.json({ user: { id: u.user_code || `upc-${String(u.id).padStart(3, '0')}`, username: u.username, first_name: u.first_name, last_name: u.last_name, email: u.email, phone: u.phone } });
-  }
-});
-
-// Get a fresh JWT for the current session (used by frontend to pass to iframe)
-router.get('/token', authenticateToken, (req, res) => {
-  const token = generateToken(req.user);
-  res.json({ token });
-});
-
-// Get user's tokens — relay token (for Connect + MCP) and API key
-router.get('/connect-token', authenticateToken, async (req, res) => {
-  try {
-    // Relay token — used for both CLI connect and MCP auth
-    const tokens = await relayTokensDb.getTokens(req.user.id);
-    let active = tokens.find(t => t.is_active);
-    if (!active) {
-      // Auto-create if none exists (backfill for existing users)
-      active = await relayTokensDb.createToken(req.user.id, 'default');
-    }
-
-    // API key — also available if user needs it
-    const keys = await apiKeysDb.getApiKeys(req.user.id);
-    let activeKey = keys.find(k => k.is_active);
-    if (!activeKey) {
-      activeKey = await apiKeysDb.createApiKey(req.user.id, 'default');
-    }
-
-    res.json({
-      token: active.token,        // relay token — works for Connect + MCP
-      apiKey: activeKey.api_key,   // API key — alternative auth method
-      userCode: req.user.user_code || null,
-    });
-  } catch (error) {
-    res.status(500).json({ error: 'Could not fetch connect token' });
-  }
-});
-
-// Update profile — phone only (email and other sensitive fields are read-only)
-router.patch('/profile', authenticateToken, async (req, res) => {
-  try {
-    const userId = req.user.id;
-    const { phone } = req.body;
-
-    if (phone === undefined) {
-      return res.status(400).json({ error: 'No fields to update' });
-    }
-
-    const trimmed = (phone || '').trim().slice(0, 20);
-    if (trimmed && !/^[+]?[\d\s()-]{7,20}$/.test(trimmed)) {
-      return res.status(400).json({ error: 'Invalid phone format' });
-    }
-
-    await db.execute({ sql: 'UPDATE users SET phone = ? WHERE id = ?', args: [trimmed || null, userId] });
-
-    const updated = await userDb.getUserById(userId);
-    res.json({
-      success: true,
-      user: { phone: updated?.phone || null }
-    });
-  } catch (error) {
-    res.status(500).json({ error: 'Failed to update profile' });
-  }
-});
-
-// Logout — clear the session cookie
-router.post('/logout', authenticateToken, (req, res) => {
-  clearSessionCookie(res);
-  res.json({ success: true, message: 'Logged out successfully' });
-});
-
-export default router;

package/server/routes/cli-auth.js

@@ -1,263 +0,0 @@
-import express from 'express';
-import { spawn } from 'child_process';
-import fs from 'fs/promises';
-import path from 'path';
-import os from 'os';
-
-const router = express.Router();
-
-router.get('/claude/status', async (req, res) => {
-  try {
-    const credentialsResult = await checkClaudeCredentials();
-
-    if (credentialsResult.authenticated) {
-      return res.json({
-        authenticated: true,
-        email: credentialsResult.email || 'Authenticated',
-        method: 'credentials_file'
-      });
-    }
-
-    return res.json({
-      authenticated: false,
-      email: null,
-      error: credentialsResult.error || 'Not authenticated'
-    });
-
-  } catch (error) {
-    // auth status error
-    res.status(500).json({
-      authenticated: false,
-      email: null,
-      error: 'An error occurred'
-    });
-  }
-});
-
-router.get('/cursor/status', async (req, res) => {
-  try {
-    const result = await checkCursorStatus();
-
-    res.json({
-      authenticated: result.authenticated,
-      email: result.email,
-      error: result.error
-    });
-
-  } catch (error) {
-    // auth status error
-    res.status(500).json({
-      authenticated: false,
-      email: null,
-      error: 'An error occurred'
-    });
-  }
-});
-
-router.get('/codex/status', async (req, res) => {
-  try {
-    const result = await checkCodexCredentials();
-
-    res.json({
-      authenticated: result.authenticated,
-      email: result.email,
-      error: result.error
-    });
-
-  } catch (error) {
-    // auth status error
-    res.status(500).json({
-      authenticated: false,
-      email: null,
-      error: 'An error occurred'
-    });
-  }
-});
-
-async function checkClaudeCredentials() {
-  try {
-    const credPath = path.join(os.homedir(), '.claude', '.credentials.json');
-    const content = await fs.readFile(credPath, 'utf8');
-    const creds = JSON.parse(content);
-
-    const oauth = creds.claudeAiOauth;
-    if (oauth && oauth.accessToken) {
-      const isExpired = oauth.expiresAt && Date.now() >= oauth.expiresAt;
-
-      if (!isExpired) {
-        return {
-          authenticated: true,
-          email: creds.email || creds.user || null
-        };
-      }
-    }
-
-    return {
-      authenticated: false,
-      email: null
-    };
-  } catch (error) {
-    return {
-      authenticated: false,
-      email: null
-    };
-  }
-}
-
-function checkCursorStatus() {
-  return new Promise((resolve) => {
-    let processCompleted = false;
-
-    const timeout = setTimeout(() => {
-      if (!processCompleted) {
-        processCompleted = true;
-        if (childProcess) {
-          childProcess.kill();
-        }
-        resolve({
-          authenticated: false,
-          email: null,
-          error: 'Command timeout'
-        });
-      }
-    }, 5000);
-
-    let childProcess;
-    try {
-      childProcess = spawn('cursor-agent', ['status']);
-    } catch (err) {
-      clearTimeout(timeout);
-      processCompleted = true;
-      resolve({
-        authenticated: false,
-        email: null,
-        error: 'Cursor CLI not found or not installed'
-      });
-      return;
-    }
-
-    let stdout = '';
-    let stderr = '';
-
-    childProcess.stdout.on('data', (data) => {
-      stdout += data.toString();
-    });
-
-    childProcess.stderr.on('data', (data) => {
-      stderr += data.toString();
-    });
-
-    childProcess.on('close', (code) => {
-      if (processCompleted) return;
-      processCompleted = true;
-      clearTimeout(timeout);
-
-      if (code === 0) {
-        const emailMatch = stdout.match(/Logged in as ([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})/i);
-
-        if (emailMatch) {
-          resolve({
-            authenticated: true,
-            email: emailMatch[1],
-            output: stdout
-          });
-        } else if (stdout.includes('Logged in')) {
-          resolve({
-            authenticated: true,
-            email: 'Logged in',
-            output: stdout
-          });
-        } else {
-          resolve({
-            authenticated: false,
-            email: null,
-            error: 'Not logged in'
-          });
-        }
-      } else {
-        resolve({
-          authenticated: false,
-          email: null,
-          error: stderr || 'Not logged in'
-        });
-      }
-    });
-
-    childProcess.on('error', (err) => {
-      if (processCompleted) return;
-      processCompleted = true;
-      clearTimeout(timeout);
-
-      resolve({
-        authenticated: false,
-        email: null,
-        error: 'Cursor CLI not found or not installed'
-      });
-    });
-  });
-}
-
-async function checkCodexCredentials() {
-  try {
-    const authPath = path.join(os.homedir(), '.codex', 'auth.json');
-    const content = await fs.readFile(authPath, 'utf8');
-    const auth = JSON.parse(content);
-
-    // Tokens are nested under 'tokens' key
-    const tokens = auth.tokens || {};
-
-    // Check for valid tokens (id_token or access_token)
-    if (tokens.id_token || tokens.access_token) {
-      // Try to extract email from id_token JWT payload
-      let email = 'Authenticated';
-      if (tokens.id_token) {
-        try {
-          // JWT is base64url encoded: header.payload.signature
-          const parts = tokens.id_token.split('.');
-          if (parts.length >= 2) {
-            // Decode the payload (second part)
-            const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
-            email = payload.email || payload.user || 'Authenticated';
-          }
-        } catch {
-          // If JWT decoding fails, use fallback
-          email = 'Authenticated';
-        }
-      }
-
-      return {
-        authenticated: true,
-        email
-      };
-    }
-
-    // Also check for OPENAI_API_KEY as fallback auth method
-    if (auth.OPENAI_API_KEY) {
-      return {
-        authenticated: true,
-        email: 'API Key Auth'
-      };
-    }
-
-    return {
-      authenticated: false,
-      email: null,
-      error: 'No valid tokens found'
-    };
-  } catch (error) {
-    if (error.code === 'ENOENT') {
-      return {
-        authenticated: false,
-        email: null,
-        error: 'Codex not configured'
-      };
-    }
-    return {
-      authenticated: false,
-      email: null,
-      error: 'An error occurred'
-    };
-  }
-}
-
-export default router;