wind-agent-cli 1.37.2 → 1.38.0

package/server/modules/assets/tests/image-assets.service.test.ts

@@ -1,74 +1,74 @@
-import assert from 'node:assert/strict';
-import os from 'node:os';
-import path from 'node:path';
-import test from 'node:test';
-
-import {
-  buildStoredAttachmentRecords,
-  buildStoredImageRecords,
-  isAllowedImageMimeType,
-  resolveAttachmentAssetFile,
-  resolveImageAssetFile,
-} from '@/modules/assets/services/image-assets.service.js';
-
-const ASSETS_DIR = path.join(os.homedir(), '.cloudcli', 'assets');
-
-test('isAllowedImageMimeType accepts image formats and rejects the rest', () => {
-  assert.equal(isAllowedImageMimeType('image/png'), true);
-  assert.equal(isAllowedImageMimeType('image/svg+xml'), true);
-  assert.equal(isAllowedImageMimeType('application/pdf'), false);
-  assert.equal(isAllowedImageMimeType('text/html'), false);
-});
-
-test('buildStoredImageRecords returns absolute posix paths in the assets dir', () => {
-  const records = buildStoredImageRecords([
-    { originalname: 'shot.png', filename: '123-456-shot.png', size: 42, mimetype: 'image/png' },
-  ]);
-
-  assert.equal(records.length, 1);
-  assert.equal(records[0].name, 'shot.png');
-  assert.equal(records[0].size, 42);
-  assert.equal(records[0].mimeType, 'image/png');
-  assert.equal(records[0].path, `${ASSETS_DIR.replace(/\\/g, '/')}/123-456-shot.png`);
-});
-
-test('buildStoredAttachmentRecords preserves metadata for non-image files', () => {
-  const records = buildStoredAttachmentRecords([
-    {
-      originalname: 'requirements.pdf',
-      filename: '123-456-requirements.pdf',
-      size: 2048,
-      mimetype: 'application/pdf',
-    },
-  ]);
-
-  assert.deepEqual(records[0], {
-    name: 'requirements.pdf',
-    path: `${ASSETS_DIR.replace(/\\/g, '/')}/123-456-requirements.pdf`,
-    size: 2048,
-    mimeType: 'application/pdf',
-  });
-});
-
-test('resolveImageAssetFile resolves plain filenames inside the assets dir', () => {
-  const resolved = resolveImageAssetFile('123-shot.png');
-  assert.equal(resolved, path.join(path.resolve(ASSETS_DIR), '123-shot.png'));
-});
-
-test('resolveImageAssetFile rejects traversal and separator attempts', () => {
-  assert.equal(resolveImageAssetFile(''), null);
-  assert.equal(resolveImageAssetFile('   '), null);
-  assert.equal(resolveImageAssetFile('../auth.db'), null);
-  assert.equal(resolveImageAssetFile('..'), null);
-  assert.equal(resolveImageAssetFile('sub/dir.png'), null);
-  assert.equal(resolveImageAssetFile('sub\\dir.png'), null);
-  assert.equal(resolveImageAssetFile('a..b/../c.png'), null);
-});
-
-test('resolveAttachmentAssetFile uses the same direct-child boundary', () => {
-  assert.equal(
-    resolveAttachmentAssetFile('123-notes.txt'),
-    path.join(path.resolve(ASSETS_DIR), '123-notes.txt'),
-  );
-  assert.equal(resolveAttachmentAssetFile('../notes.txt'), null);
-});
+import assert from 'node:assert/strict';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import {
+  buildStoredAttachmentRecords,
+  buildStoredImageRecords,
+  isAllowedImageMimeType,
+  resolveAttachmentAssetFile,
+  resolveImageAssetFile,
+} from '@/modules/assets/services/image-assets.service.js';
+
+const ASSETS_DIR = path.join(os.homedir(), '.cloudcli', 'assets');
+
+test('isAllowedImageMimeType accepts image formats and rejects the rest', () => {
+  assert.equal(isAllowedImageMimeType('image/png'), true);
+  assert.equal(isAllowedImageMimeType('image/svg+xml'), true);
+  assert.equal(isAllowedImageMimeType('application/pdf'), false);
+  assert.equal(isAllowedImageMimeType('text/html'), false);
+});
+
+test('buildStoredImageRecords returns absolute posix paths in the assets dir', () => {
+  const records = buildStoredImageRecords([
+    { originalname: 'shot.png', filename: '123-456-shot.png', size: 42, mimetype: 'image/png' },
+  ]);
+
+  assert.equal(records.length, 1);
+  assert.equal(records[0].name, 'shot.png');
+  assert.equal(records[0].size, 42);
+  assert.equal(records[0].mimeType, 'image/png');
+  assert.equal(records[0].path, `${ASSETS_DIR.replace(/\\/g, '/')}/123-456-shot.png`);
+});
+
+test('buildStoredAttachmentRecords preserves metadata for non-image files', () => {
+  const records = buildStoredAttachmentRecords([
+    {
+      originalname: 'requirements.pdf',
+      filename: '123-456-requirements.pdf',
+      size: 2048,
+      mimetype: 'application/pdf',
+    },
+  ]);
+
+  assert.deepEqual(records[0], {
+    name: 'requirements.pdf',
+    path: `${ASSETS_DIR.replace(/\\/g, '/')}/123-456-requirements.pdf`,
+    size: 2048,
+    mimeType: 'application/pdf',
+  });
+});
+
+test('resolveImageAssetFile resolves plain filenames inside the assets dir', () => {
+  const resolved = resolveImageAssetFile('123-shot.png');
+  assert.equal(resolved, path.join(path.resolve(ASSETS_DIR), '123-shot.png'));
+});
+
+test('resolveImageAssetFile rejects traversal and separator attempts', () => {
+  assert.equal(resolveImageAssetFile(''), null);
+  assert.equal(resolveImageAssetFile('   '), null);
+  assert.equal(resolveImageAssetFile('../auth.db'), null);
+  assert.equal(resolveImageAssetFile('..'), null);
+  assert.equal(resolveImageAssetFile('sub/dir.png'), null);
+  assert.equal(resolveImageAssetFile('sub\\dir.png'), null);
+  assert.equal(resolveImageAssetFile('a..b/../c.png'), null);
+});
+
+test('resolveAttachmentAssetFile uses the same direct-child boundary', () => {
+  assert.equal(
+    resolveAttachmentAssetFile('123-notes.txt'),
+    path.join(path.resolve(ASSETS_DIR), '123-notes.txt'),
+  );
+  assert.equal(resolveAttachmentAssetFile('../notes.txt'), null);
+});

package/server/modules/auth/auth.middleware.ts

@@ -1,163 +1,163 @@
-// @ts-nocheck -- JWT request augmentation is narrowed by Auth route contracts.
-import jwt from 'jsonwebtoken';
-
-import { IS_PLATFORM } from '@/shared/utils.js';
-
-import { userDb, appConfigDb } from '../database/index.js';
-
-// Use env var if set, otherwise auto-generate a unique secret per installation
-const JWT_SECRET = process.env.JWT_SECRET || appConfigDb.getOrCreateJwtSecret();
-
-// Optional API key middleware
-const validateApiKey = (req, res, next) => {
-  // Skip API key validation if not configured
-  if (!process.env.API_KEY) {
-    return next();
-  }
-  
-  const apiKey = req.headers['x-api-key'];
-  if (apiKey !== process.env.API_KEY) {
-    return res.status(401).json({ error: 'Invalid API key' });
-  }
-  next();
-};
-
-// JWT authentication middleware
-const authenticateToken = async (req, res, next) => {
-  // Platform mode:  use single database user
-  if (IS_PLATFORM) {
-    try {
-      const user = userDb.getFirstUser();
-      if (!user) {
-        return res.status(500).json({ error: 'Platform mode: No user found in database' });
-      }
-      req.user = user;
-      return next();
-    } catch (error) {
-      console.error('Platform mode error:', error);
-      return res.status(500).json({ error: 'Platform mode: Failed to fetch user' });
-    }
-  }
-
-  // Normal OSS JWT validation
-  const authHeader = req.headers['authorization'];
-  let token = authHeader && authHeader.split(' ')[1]; // Bearer TOKEN
-
-  // Also check query param for SSE endpoints (EventSource can't set headers)
-  if (!token && req.query.token) {
-    token = req.query.token;
-  }
-
-  if (!token) {
-    res.setHeader('X-Auth-Error', 'invalid-token');
-    return res.status(401).json({
-      error: 'Access denied. No token provided.',
-      code: 'AUTH_TOKEN_INVALID',
-    });
-  }
-
-  try {
-    const decoded = jwt.verify(token, JWT_SECRET);
-
-    // Verify user still exists and is active
-    const user = userDb.getUserById(decoded.userId);
-    if (!user) {
-      res.setHeader('X-Auth-Error', 'invalid-token');
-      return res.status(401).json({
-        error: 'Invalid token. User not found.',
-        code: 'AUTH_TOKEN_INVALID',
-      });
-    }
-
-    // Auto-refresh: if token is past halfway through its lifetime, issue a new one
-    if (decoded.exp && decoded.iat) {
-      const now = Math.floor(Date.now() / 1000);
-      const halfLife = (decoded.exp - decoded.iat) / 2;
-      if (now > decoded.iat + halfLife) {
-        const newToken = generateToken(user);
-        res.setHeader('X-Refreshed-Token', newToken);
-      }
-    }
-
-    req.user = user;
-    next();
-  } catch (error) {
-    if (error instanceof jwt.TokenExpiredError) {
-      res.setHeader('X-Auth-Error', 'session-expired');
-      return res.status(401).json({
-        error: 'Session expired. Please log in again.',
-        code: 'AUTH_TOKEN_EXPIRED',
-      });
-    }
-
-    console.warn(
-      'Token verification failed:',
-      error instanceof Error ? error.message : String(error),
-    );
-    res.setHeader('X-Auth-Error', 'invalid-token');
-    return res.status(401).json({
-      error: 'Invalid token',
-      code: 'AUTH_TOKEN_INVALID',
-    });
-  }
-};
-
-// Generate JWT token
-const generateToken = (user) => {
-  return jwt.sign(
-    {
-      userId: user.id,
-      username: user.username
-    },
-    JWT_SECRET,
-    { expiresIn: '7d' }
-  );
-};
-
-// WebSocket authentication function
-const authenticateWebSocket = (token) => {
-  // Platform mode: bypass token validation, return first user
-  if (IS_PLATFORM) {
-    try {
-      const user = userDb.getFirstUser();
-      if (user) {
-        return { id: user.id, userId: user.id, username: user.username };
-      }
-      return null;
-    } catch (error) {
-      console.error('Platform mode WebSocket error:', error);
-      return null;
-    }
-  }
-
-  // Normal OSS JWT validation
-  if (!token) {
-    return null;
-  }
-
-  try {
-    const decoded = jwt.verify(token, JWT_SECRET);
-    // Verify user actually exists in database (matches REST authenticateToken behavior)
-    const user = userDb.getUserById(decoded.userId);
-    if (!user) {
-      return null;
-    }
-    return { userId: user.id, username: user.username };
-  } catch (error) {
-    if (!(error instanceof jwt.TokenExpiredError)) {
-      console.warn(
-        'WebSocket token verification failed:',
-        error instanceof Error ? error.message : String(error),
-      );
-    }
-    return null;
-  }
-};
-
-export {
-  validateApiKey,
-  authenticateToken,
-  generateToken,
-  authenticateWebSocket,
-  JWT_SECRET
-};
+// @ts-nocheck -- JWT request augmentation is narrowed by Auth route contracts.
+import jwt from 'jsonwebtoken';
+
+import { IS_PLATFORM } from '@/shared/utils.js';
+
+import { userDb, appConfigDb } from '../database/index.js';
+
+// Use env var if set, otherwise auto-generate a unique secret per installation
+const JWT_SECRET = process.env.JWT_SECRET || appConfigDb.getOrCreateJwtSecret();
+
+// Optional API key middleware
+const validateApiKey = (req, res, next) => {
+  // Skip API key validation if not configured
+  if (!process.env.API_KEY) {
+    return next();
+  }
+  
+  const apiKey = req.headers['x-api-key'];
+  if (apiKey !== process.env.API_KEY) {
+    return res.status(401).json({ error: 'Invalid API key' });
+  }
+  next();
+};
+
+// JWT authentication middleware
+const authenticateToken = async (req, res, next) => {
+  // Platform mode:  use single database user
+  if (IS_PLATFORM) {
+    try {
+      const user = userDb.getFirstUser();
+      if (!user) {
+        return res.status(500).json({ error: 'Platform mode: No user found in database' });
+      }
+      req.user = user;
+      return next();
+    } catch (error) {
+      console.error('Platform mode error:', error);
+      return res.status(500).json({ error: 'Platform mode: Failed to fetch user' });
+    }
+  }
+
+  // Normal OSS JWT validation
+  const authHeader = req.headers['authorization'];
+  let token = authHeader && authHeader.split(' ')[1]; // Bearer TOKEN
+
+  // Also check query param for SSE endpoints (EventSource can't set headers)
+  if (!token && req.query.token) {
+    token = req.query.token;
+  }
+
+  if (!token) {
+    res.setHeader('X-Auth-Error', 'invalid-token');
+    return res.status(401).json({
+      error: 'Access denied. No token provided.',
+      code: 'AUTH_TOKEN_INVALID',
+    });
+  }
+
+  try {
+    const decoded = jwt.verify(token, JWT_SECRET);
+
+    // Verify user still exists and is active
+    const user = userDb.getUserById(decoded.userId);
+    if (!user) {
+      res.setHeader('X-Auth-Error', 'invalid-token');
+      return res.status(401).json({
+        error: 'Invalid token. User not found.',
+        code: 'AUTH_TOKEN_INVALID',
+      });
+    }
+
+    // Auto-refresh: if token is past halfway through its lifetime, issue a new one
+    if (decoded.exp && decoded.iat) {
+      const now = Math.floor(Date.now() / 1000);
+      const halfLife = (decoded.exp - decoded.iat) / 2;
+      if (now > decoded.iat + halfLife) {
+        const newToken = generateToken(user);
+        res.setHeader('X-Refreshed-Token', newToken);
+      }
+    }
+
+    req.user = user;
+    next();
+  } catch (error) {
+    if (error instanceof jwt.TokenExpiredError) {
+      res.setHeader('X-Auth-Error', 'session-expired');
+      return res.status(401).json({
+        error: 'Session expired. Please log in again.',
+        code: 'AUTH_TOKEN_EXPIRED',
+      });
+    }
+
+    console.warn(
+      'Token verification failed:',
+      error instanceof Error ? error.message : String(error),
+    );
+    res.setHeader('X-Auth-Error', 'invalid-token');
+    return res.status(401).json({
+      error: 'Invalid token',
+      code: 'AUTH_TOKEN_INVALID',
+    });
+  }
+};
+
+// Generate JWT token
+const generateToken = (user) => {
+  return jwt.sign(
+    {
+      userId: user.id,
+      username: user.username
+    },
+    JWT_SECRET,
+    { expiresIn: '7d' }
+  );
+};
+
+// WebSocket authentication function
+const authenticateWebSocket = (token) => {
+  // Platform mode: bypass token validation, return first user
+  if (IS_PLATFORM) {
+    try {
+      const user = userDb.getFirstUser();
+      if (user) {
+        return { id: user.id, userId: user.id, username: user.username };
+      }
+      return null;
+    } catch (error) {
+      console.error('Platform mode WebSocket error:', error);
+      return null;
+    }
+  }
+
+  // Normal OSS JWT validation
+  if (!token) {
+    return null;
+  }
+
+  try {
+    const decoded = jwt.verify(token, JWT_SECRET);
+    // Verify user actually exists in database (matches REST authenticateToken behavior)
+    const user = userDb.getUserById(decoded.userId);
+    if (!user) {
+      return null;
+    }
+    return { userId: user.id, username: user.username };
+  } catch (error) {
+    if (!(error instanceof jwt.TokenExpiredError)) {
+      console.warn(
+        'WebSocket token verification failed:',
+        error instanceof Error ? error.message : String(error),
+      );
+    }
+    return null;
+  }
+};
+
+export {
+  validateApiKey,
+  authenticateToken,
+  generateToken,
+  authenticateWebSocket,
+  JWT_SECRET
+};

package/server/modules/auth/auth.module.ts

@@ -1,38 +1,38 @@
-import { createRequire } from 'node:module';
-
-import { getConnection, userDb } from '@/modules/database/index.js';
-
-import { authenticateToken, generateToken } from './auth.middleware.js';
-import { createAuthRouter } from './auth.routes.js';
-import { createAuthService } from './auth.service.js';
-
-type BcryptAdapter = {
-  hash(password: string, saltRounds: number): Promise<string>;
-  compare(password: string, passwordHash: string): Promise<boolean>;
-};
-
-// bcrypt does not ship TypeScript declarations in this project, so the
-// composition root narrows its CommonJS runtime surface before injecting it.
-const require = createRequire(import.meta.url);
-const bcrypt = require('bcrypt') as BcryptAdapter;
-const databaseConnection = getConnection();
-
-const authService = createAuthService({
-  users: {
-    hasUsers: () => userDb.hasUsers(),
-    createUser: (username, passwordHash) => userDb.createUser(username, passwordHash),
-    getUserByUsername: (username) => userDb.getUserByUsername(username),
-    updateLastLogin: (userId) => userDb.updateLastLogin(userId),
-  },
-  transaction: {
-    begin: () => databaseConnection.prepare('BEGIN').run(),
-    commit: () => databaseConnection.prepare('COMMIT').run(),
-    rollback: () => databaseConnection.prepare('ROLLBACK').run(),
-  },
-  hashPassword: (password) => bcrypt.hash(password, 12),
-  comparePassword: (password, passwordHash) => bcrypt.compare(password, passwordHash),
-  generateToken,
-});
-
-/** Auth router assembled for the server entrypoint. */
-export const authRoutes = createAuthRouter(authService, authenticateToken);
+import { createRequire } from 'node:module';
+
+import { getConnection, userDb } from '@/modules/database/index.js';
+
+import { authenticateToken, generateToken } from './auth.middleware.js';
+import { createAuthRouter } from './auth.routes.js';
+import { createAuthService } from './auth.service.js';
+
+type BcryptAdapter = {
+  hash(password: string, saltRounds: number): Promise<string>;
+  compare(password: string, passwordHash: string): Promise<boolean>;
+};
+
+// bcrypt does not ship TypeScript declarations in this project, so the
+// composition root narrows its CommonJS runtime surface before injecting it.
+const require = createRequire(import.meta.url);
+const bcrypt = require('bcrypt') as BcryptAdapter;
+const databaseConnection = getConnection();
+
+const authService = createAuthService({
+  users: {
+    hasUsers: () => userDb.hasUsers(),
+    createUser: (username, passwordHash) => userDb.createUser(username, passwordHash),
+    getUserByUsername: (username) => userDb.getUserByUsername(username),
+    updateLastLogin: (userId) => userDb.updateLastLogin(userId),
+  },
+  transaction: {
+    begin: () => databaseConnection.prepare('BEGIN').run(),
+    commit: () => databaseConnection.prepare('COMMIT').run(),
+    rollback: () => databaseConnection.prepare('ROLLBACK').run(),
+  },
+  hashPassword: (password) => bcrypt.hash(password, 12),
+  comparePassword: (password, passwordHash) => bcrypt.compare(password, passwordHash),
+  generateToken,
+});
+
+/** Auth router assembled for the server entrypoint. */
+export const authRoutes = createAuthRouter(authService, authenticateToken);

package/server/modules/auth/auth.routes.ts

@@ -1,57 +1,57 @@
-import express from 'express';
-import type { RequestHandler } from 'express';
-
-import type { createAuthService } from './auth.service.js';
-
-type AuthenticatedRequest = express.Request & { user?: unknown };
-
-/**
- * Creates the Auth transport adapter. Handlers only parse request data and
- * delegate authentication behavior to the injected application service.
- */
-export function createAuthRouter(
-  service: ReturnType<typeof createAuthService>,
-  authenticateToken: RequestHandler,
-): express.Router {
-  const router = express.Router();
-
-  router.get('/status', (_req, res, next) => {
-    try {
-      res.json(service.getStatus());
-    } catch (error) {
-      next(error);
-    }
-  });
-
-  router.post('/register', async (req, res, next) => {
-    try {
-      const body = req.body as { username?: unknown; password?: unknown };
-      res.json(await service.register(body.username, body.password));
-    } catch (error) {
-      next(error);
-    }
-  });
-
-  router.post('/login', async (req, res, next) => {
-    try {
-      const body = req.body as { username?: unknown; password?: unknown };
-      res.json(await service.login(body.username, body.password));
-    } catch (error) {
-      next(error);
-    }
-  });
-
-  router.get('/user', authenticateToken, (req, res) => {
-    res.json(service.getCurrentUser((req as AuthenticatedRequest).user));
-  });
-
-  router.post('/refresh', authenticateToken, (req, res) => {
-    res.json(service.refreshSession((req as AuthenticatedRequest).user));
-  });
-
-  router.post('/logout', authenticateToken, (_req, res) => {
-    res.json(service.logout());
-  });
-
-  return router;
-}
+import express from 'express';
+import type { RequestHandler } from 'express';
+
+import type { createAuthService } from './auth.service.js';
+
+type AuthenticatedRequest = express.Request & { user?: unknown };
+
+/**
+ * Creates the Auth transport adapter. Handlers only parse request data and
+ * delegate authentication behavior to the injected application service.
+ */
+export function createAuthRouter(
+  service: ReturnType<typeof createAuthService>,
+  authenticateToken: RequestHandler,
+): express.Router {
+  const router = express.Router();
+
+  router.get('/status', (_req, res, next) => {
+    try {
+      res.json(service.getStatus());
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  router.post('/register', async (req, res, next) => {
+    try {
+      const body = req.body as { username?: unknown; password?: unknown };
+      res.json(await service.register(body.username, body.password));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  router.post('/login', async (req, res, next) => {
+    try {
+      const body = req.body as { username?: unknown; password?: unknown };
+      res.json(await service.login(body.username, body.password));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  router.get('/user', authenticateToken, (req, res) => {
+    res.json(service.getCurrentUser((req as AuthenticatedRequest).user));
+  });
+
+  router.post('/refresh', authenticateToken, (req, res) => {
+    res.json(service.refreshSession((req as AuthenticatedRequest).user));
+  });
+
+  router.post('/logout', authenticateToken, (_req, res) => {
+    res.json(service.logout());
+  });
+
+  return router;
+}