wind-agent-cli 1.37.2

package/server/modules/auth/auth.middleware.ts

@@ -0,0 +1,163 @@
+// @ts-nocheck -- JWT request augmentation is narrowed by Auth route contracts.
+import jwt from 'jsonwebtoken';
+
+import { IS_PLATFORM } from '@/shared/utils.js';
+
+import { userDb, appConfigDb } from '../database/index.js';
+
+// Use env var if set, otherwise auto-generate a unique secret per installation
+const JWT_SECRET = process.env.JWT_SECRET || appConfigDb.getOrCreateJwtSecret();
+
+// Optional API key middleware
+const validateApiKey = (req, res, next) => {
+  // Skip API key validation if not configured
+  if (!process.env.API_KEY) {
+    return next();
+  }
+  
+  const apiKey = req.headers['x-api-key'];
+  if (apiKey !== process.env.API_KEY) {
+    return res.status(401).json({ error: 'Invalid API key' });
+  }
+  next();
+};
+
+// JWT authentication middleware
+const authenticateToken = async (req, res, next) => {
+  // Platform mode:  use single database user
+  if (IS_PLATFORM) {
+    try {
+      const user = userDb.getFirstUser();
+      if (!user) {
+        return res.status(500).json({ error: 'Platform mode: No user found in database' });
+      }
+      req.user = user;
+      return next();
+    } catch (error) {
+      console.error('Platform mode error:', error);
+      return res.status(500).json({ error: 'Platform mode: Failed to fetch user' });
+    }
+  }
+
+  // Normal OSS JWT validation
+  const authHeader = req.headers['authorization'];
+  let token = authHeader && authHeader.split(' ')[1]; // Bearer TOKEN
+
+  // Also check query param for SSE endpoints (EventSource can't set headers)
+  if (!token && req.query.token) {
+    token = req.query.token;
+  }
+
+  if (!token) {
+    res.setHeader('X-Auth-Error', 'invalid-token');
+    return res.status(401).json({
+      error: 'Access denied. No token provided.',
+      code: 'AUTH_TOKEN_INVALID',
+    });
+  }
+
+  try {
+    const decoded = jwt.verify(token, JWT_SECRET);
+
+    // Verify user still exists and is active
+    const user = userDb.getUserById(decoded.userId);
+    if (!user) {
+      res.setHeader('X-Auth-Error', 'invalid-token');
+      return res.status(401).json({
+        error: 'Invalid token. User not found.',
+        code: 'AUTH_TOKEN_INVALID',
+      });
+    }
+
+    // Auto-refresh: if token is past halfway through its lifetime, issue a new one
+    if (decoded.exp && decoded.iat) {
+      const now = Math.floor(Date.now() / 1000);
+      const halfLife = (decoded.exp - decoded.iat) / 2;
+      if (now > decoded.iat + halfLife) {
+        const newToken = generateToken(user);
+        res.setHeader('X-Refreshed-Token', newToken);
+      }
+    }
+
+    req.user = user;
+    next();
+  } catch (error) {
+    if (error instanceof jwt.TokenExpiredError) {
+      res.setHeader('X-Auth-Error', 'session-expired');
+      return res.status(401).json({
+        error: 'Session expired. Please log in again.',
+        code: 'AUTH_TOKEN_EXPIRED',
+      });
+    }
+
+    console.warn(
+      'Token verification failed:',
+      error instanceof Error ? error.message : String(error),
+    );
+    res.setHeader('X-Auth-Error', 'invalid-token');
+    return res.status(401).json({
+      error: 'Invalid token',
+      code: 'AUTH_TOKEN_INVALID',
+    });
+  }
+};
+
+// Generate JWT token
+const generateToken = (user) => {
+  return jwt.sign(
+    {
+      userId: user.id,
+      username: user.username
+    },
+    JWT_SECRET,
+    { expiresIn: '7d' }
+  );
+};
+
+// WebSocket authentication function
+const authenticateWebSocket = (token) => {
+  // Platform mode: bypass token validation, return first user
+  if (IS_PLATFORM) {
+    try {
+      const user = userDb.getFirstUser();
+      if (user) {
+        return { id: user.id, userId: user.id, username: user.username };
+      }
+      return null;
+    } catch (error) {
+      console.error('Platform mode WebSocket error:', error);
+      return null;
+    }
+  }
+
+  // Normal OSS JWT validation
+  if (!token) {
+    return null;
+  }
+
+  try {
+    const decoded = jwt.verify(token, JWT_SECRET);
+    // Verify user actually exists in database (matches REST authenticateToken behavior)
+    const user = userDb.getUserById(decoded.userId);
+    if (!user) {
+      return null;
+    }
+    return { userId: user.id, username: user.username };
+  } catch (error) {
+    if (!(error instanceof jwt.TokenExpiredError)) {
+      console.warn(
+        'WebSocket token verification failed:',
+        error instanceof Error ? error.message : String(error),
+      );
+    }
+    return null;
+  }
+};
+
+export {
+  validateApiKey,
+  authenticateToken,
+  generateToken,
+  authenticateWebSocket,
+  JWT_SECRET
+};

package/server/modules/auth/auth.module.ts

@@ -0,0 +1,38 @@
+import { createRequire } from 'node:module';
+
+import { getConnection, userDb } from '@/modules/database/index.js';
+
+import { authenticateToken, generateToken } from './auth.middleware.js';
+import { createAuthRouter } from './auth.routes.js';
+import { createAuthService } from './auth.service.js';
+
+type BcryptAdapter = {
+  hash(password: string, saltRounds: number): Promise<string>;
+  compare(password: string, passwordHash: string): Promise<boolean>;
+};
+
+// bcrypt does not ship TypeScript declarations in this project, so the
+// composition root narrows its CommonJS runtime surface before injecting it.
+const require = createRequire(import.meta.url);
+const bcrypt = require('bcrypt') as BcryptAdapter;
+const databaseConnection = getConnection();
+
+const authService = createAuthService({
+  users: {
+    hasUsers: () => userDb.hasUsers(),
+    createUser: (username, passwordHash) => userDb.createUser(username, passwordHash),
+    getUserByUsername: (username) => userDb.getUserByUsername(username),
+    updateLastLogin: (userId) => userDb.updateLastLogin(userId),
+  },
+  transaction: {
+    begin: () => databaseConnection.prepare('BEGIN').run(),
+    commit: () => databaseConnection.prepare('COMMIT').run(),
+    rollback: () => databaseConnection.prepare('ROLLBACK').run(),
+  },
+  hashPassword: (password) => bcrypt.hash(password, 12),
+  comparePassword: (password, passwordHash) => bcrypt.compare(password, passwordHash),
+  generateToken,
+});
+
+/** Auth router assembled for the server entrypoint. */
+export const authRoutes = createAuthRouter(authService, authenticateToken);

package/server/modules/auth/auth.routes.ts

@@ -0,0 +1,57 @@
+import express from 'express';
+import type { RequestHandler } from 'express';
+
+import type { createAuthService } from './auth.service.js';
+
+type AuthenticatedRequest = express.Request & { user?: unknown };
+
+/**
+ * Creates the Auth transport adapter. Handlers only parse request data and
+ * delegate authentication behavior to the injected application service.
+ */
+export function createAuthRouter(
+  service: ReturnType<typeof createAuthService>,
+  authenticateToken: RequestHandler,
+): express.Router {
+  const router = express.Router();
+
+  router.get('/status', (_req, res, next) => {
+    try {
+      res.json(service.getStatus());
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  router.post('/register', async (req, res, next) => {
+    try {
+      const body = req.body as { username?: unknown; password?: unknown };
+      res.json(await service.register(body.username, body.password));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  router.post('/login', async (req, res, next) => {
+    try {
+      const body = req.body as { username?: unknown; password?: unknown };
+      res.json(await service.login(body.username, body.password));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  router.get('/user', authenticateToken, (req, res) => {
+    res.json(service.getCurrentUser((req as AuthenticatedRequest).user));
+  });
+
+  router.post('/refresh', authenticateToken, (req, res) => {
+    res.json(service.refreshSession((req as AuthenticatedRequest).user));
+  });
+
+  router.post('/logout', authenticateToken, (_req, res) => {
+    res.json(service.logout());
+  });
+
+  return router;
+}

package/server/modules/auth/auth.service.ts

@@ -0,0 +1,155 @@
+import { AppError } from '@/shared/utils.js';
+
+type AuthUser = {
+  id: number | bigint;
+  username: string;
+};
+
+type AuthLoginUser = AuthUser & { password_hash: string };
+
+type AuthDependencies = {
+  users: {
+    hasUsers(): boolean;
+    createUser(username: string, passwordHash: string): AuthUser;
+    getUserByUsername(username: string): AuthLoginUser | undefined;
+    updateLastLogin(userId: number): void;
+  };
+  transaction: {
+    begin(): void;
+    commit(): void;
+    rollback(): void;
+  };
+  hashPassword(password: string): Promise<string>;
+  comparePassword(password: string, passwordHash: string): Promise<boolean>;
+  generateToken(user: AuthUser): string;
+};
+
+function numericUserId(userId: number | bigint): number {
+  return Number(userId);
+}
+
+function isUniqueConstraintError(error: unknown): boolean {
+  return typeof error === 'object'
+    && error !== null
+    && 'code' in error
+    && error.code === 'SQLITE_CONSTRAINT_UNIQUE';
+}
+
+/**
+ * Creates the Auth application service around explicit persistence, crypto,
+ * transaction, and token dependencies.
+ */
+export function createAuthService(dependencies: AuthDependencies) {
+  return {
+    getStatus() {
+      return {
+        needsSetup: !dependencies.users.hasUsers(),
+        isAuthenticated: false,
+      };
+    },
+
+    async register(usernameInput: unknown, passwordInput: unknown) {
+      const username = typeof usernameInput === 'string' ? usernameInput : '';
+      const password = typeof passwordInput === 'string' ? passwordInput : '';
+
+      if (!username || !password) {
+        throw new AppError('Username and password are required', {
+          code: 'AUTH_CREDENTIALS_REQUIRED',
+          statusCode: 400,
+        });
+      }
+      if (username.length < 3 || password.length < 6) {
+        throw new AppError(
+          'Username must be at least 3 characters, password at least 6 characters',
+          { code: 'AUTH_CREDENTIALS_TOO_SHORT', statusCode: 400 },
+        );
+      }
+
+      dependencies.transaction.begin();
+      try {
+        if (dependencies.users.hasUsers()) {
+          throw new AppError('User already exists. This is a single-user system.', {
+            code: 'AUTH_USER_ALREADY_CONFIGURED',
+            statusCode: 403,
+          });
+        }
+
+        const passwordHash = await dependencies.hashPassword(password);
+        const user = dependencies.users.createUser(username, passwordHash);
+        const token = dependencies.generateToken(user);
+        dependencies.transaction.commit();
+        dependencies.users.updateLastLogin(numericUserId(user.id));
+
+        return {
+          success: true,
+          user: { id: user.id, username: user.username },
+          token,
+        };
+      } catch (error) {
+        dependencies.transaction.rollback();
+        if (isUniqueConstraintError(error)) {
+          throw new AppError('Username already exists', {
+            code: 'AUTH_USERNAME_CONFLICT',
+            statusCode: 409,
+          });
+        }
+        throw error;
+      }
+    },
+
+    async login(usernameInput: unknown, passwordInput: unknown) {
+      const username = typeof usernameInput === 'string' ? usernameInput : '';
+      const password = typeof passwordInput === 'string' ? passwordInput : '';
+      if (!username || !password) {
+        throw new AppError('Username and password are required', {
+          code: 'AUTH_CREDENTIALS_REQUIRED',
+          statusCode: 400,
+        });
+      }
+
+      const user = dependencies.users.getUserByUsername(username);
+      const validPassword = user
+        ? await dependencies.comparePassword(password, user.password_hash)
+        : false;
+      if (!user || !validPassword) {
+        throw new AppError('Invalid username or password', {
+          code: 'AUTH_INVALID_CREDENTIALS',
+          statusCode: 401,
+        });
+      }
+
+      dependencies.users.updateLastLogin(numericUserId(user.id));
+      return {
+        success: true,
+        user: { id: user.id, username: user.username },
+        token: dependencies.generateToken(user),
+      };
+    },
+
+    getCurrentUser(user: unknown) {
+      return { user };
+    },
+
+    refreshSession(user: unknown) {
+      if (
+        typeof user !== 'object'
+        || user === null
+        || !('id' in user)
+        || !('username' in user)
+        || (typeof user.id !== 'number' && typeof user.id !== 'bigint')
+        || typeof user.username !== 'string'
+      ) {
+        throw new AppError('Authenticated user is required', {
+          code: 'AUTH_USER_REQUIRED',
+          statusCode: 401,
+        });
+      }
+
+      return { token: dependencies.generateToken(user as AuthUser) };
+    },
+
+    logout() {
+      return { success: true, message: 'Logged out successfully' };
+    },
+  };
+}

package/server/modules/auth/index.ts

@@ -0,0 +1,9 @@
+// authRoutes: used by the server entrypoint to mount public authentication endpoints.
+export { authRoutes } from './auth.module.js';
+
+// authenticateToken: used by the server entrypoint to protect authenticated API modules.
+export { authenticateToken } from './auth.middleware.js';
+// authenticateWebSocket: used by WebSocket setup to verify connection tokens.
+export { authenticateWebSocket } from './auth.middleware.js';
+// validateApiKey: used by the server entrypoint for optional API-wide key validation.
+export { validateApiKey } from './auth.middleware.js';

package/server/modules/auth/tests/auth.service.test.ts

@@ -0,0 +1,95 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { AppError } from '@/shared/utils.js';
+
+import { createAuthService } from '../auth.service.js';
+
+type AuthDependencies = Parameters<typeof createAuthService>[0];
+
+function createDependencies(overrides: Partial<AuthDependencies> = {}): AuthDependencies {
+  return {
+    users: {
+      hasUsers: () => false,
+      createUser: (username, passwordHash) => ({ id: 1, username, password_hash: passwordHash }),
+      getUserByUsername: () => undefined,
+      updateLastLogin: () => undefined,
+    },
+    transaction: {
+      begin: () => undefined,
+      commit: () => undefined,
+      rollback: () => undefined,
+    },
+    hashPassword: async () => 'hashed-password',
+    comparePassword: async () => false,
+    generateToken: () => 'signed-token',
+    ...overrides,
+  };
+}
+
+test('register hashes credentials and commits through injected dependencies', async () => {
+  const operations: string[] = [];
+  const service = createAuthService(createDependencies({
+    transaction: {
+      begin: () => operations.push('begin'),
+      commit: () => operations.push('commit'),
+      rollback: () => operations.push('rollback'),
+    },
+    hashPassword: async (password) => {
+      operations.push(`hash:${password}`);
+      return 'hash';
+    },
+    users: {
+      hasUsers: () => false,
+      createUser: (username, passwordHash) => {
+        operations.push(`create:${username}:${passwordHash}`);
+        return { id: 1, username, password_hash: passwordHash };
+      },
+      getUserByUsername: () => undefined,
+      updateLastLogin: (userId) => operations.push(`login:${userId}`),
+    },
+  }));
+
+  const result = await service.register('alice', 'secret12');
+
+  assert.equal(result.token, 'signed-token');
+  assert.deepEqual(operations, ['begin', 'hash:secret12', 'create:alice:hash', 'commit', 'login:1']);
+});
+
+test('login rejects an invalid password without issuing a token', async () => {
+  let tokenIssued = false;
+  const service = createAuthService(createDependencies({
+    users: {
+      hasUsers: () => true,
+      createUser: () => { throw new Error('unused'); },
+      getUserByUsername: () => ({ id: 1, username: 'alice', password_hash: 'hash' }),
+      updateLastLogin: () => undefined,
+    },
+    comparePassword: async () => false,
+    generateToken: () => {
+      tokenIssued = true;
+      return 'token';
+    },
+  }));
+
+  await assert.rejects(
+    service.login('alice', 'wrong-password'),
+    (error: unknown) => error instanceof AppError && error.code === 'AUTH_INVALID_CREDENTIALS',
+  );
+  assert.equal(tokenIssued, false);
+});
+
+test('refreshSession issues a replacement token for the authenticated user', () => {
+  let tokenUser: { id: number | bigint; username: string } | undefined;
+  const service = createAuthService(createDependencies({
+    generateToken: (user) => {
+      tokenUser = user;
+      return 'replacement-token';
+    },
+  }));
+
+  const result = service.refreshSession({ id: 7, username: 'alice' });
+
+  assert.deepEqual(result, { token: 'replacement-token' });
+  assert.deepEqual(tokenUser, { id: 7, username: 'alice' });
+});

package/server/modules/browser-use/browser-use-mcp.routes.ts

@@ -0,0 +1,120 @@
+import express from 'express';
+
+import { browserUseService } from '@/modules/browser-use/browser-use.service.js';
+
+const router = express.Router();
+
+function readBearerToken(header: unknown): string | null {
+  if (typeof header !== 'string') {
+    return null;
+  }
+  const match = /^Bearer\s+(\S.*)$/i.exec(header.trim());
+  return match?.[1]?.trim() || null;
+}
+
+router.use((req, res, next) => {
+  const expected = browserUseService.getMcpToken();
+  const token = readBearerToken(req.headers.authorization) || String(req.headers['x-browser-use-mcp-token'] || '');
+  if (!token || token !== expected) {
+    res.status(401).json({ success: false, error: 'Invalid Browser MCP token.' });
+    return;
+  }
+  next();
+});
+
+router.post('/tools/:toolName', async (req, res) => {
+  try {
+    const input = (req.body && typeof req.body === 'object' ? req.body : {}) as Record<string, unknown>;
+    const sessionId = typeof input.sessionId === 'string' ? input.sessionId : '';
+    const toolName = req.params.toolName;
+    let result: unknown;
+
+    switch (toolName) {
+      case 'browser_create_session':
+        result = await browserUseService.createAgentSession({
+          profileName: typeof input.profileName === 'string' ? input.profileName : null,
+        });
+        break;
+      case 'browser_list_sessions':
+        result = await browserUseService.listAgentSessions();
+        break;
+      case 'browser_snapshot':
+      case 'browser_take_screenshot':
+        result = await browserUseService.agentSnapshot(sessionId);
+        break;
+      case 'browser_navigate':
+        result = await browserUseService.agentNavigate(sessionId, String(input.url || ''));
+        break;
+      case 'browser_click':
+        result = await browserUseService.agentClick(sessionId, {
+          selector: typeof input.selector === 'string' ? input.selector : undefined,
+          text: typeof input.text === 'string' ? input.text : undefined,
+          x: typeof input.x === 'number' ? input.x : undefined,
+          y: typeof input.y === 'number' ? input.y : undefined,
+        });
+        break;
+      case 'browser_type':
+        result = await browserUseService.agentType(sessionId, {
+          selector: typeof input.selector === 'string' ? input.selector : undefined,
+          text: String(input.text || ''),
+          submit: input.submit === true,
+        });
+        break;
+      case 'browser_fill_form':
+        result = await browserUseService.agentFillForm(
+          sessionId,
+          Array.isArray(input.fields)
+            ? input.fields.map((field) => {
+              const record = field as Record<string, unknown>;
+              return {
+                selector: String(record.selector || ''),
+                value: String(record.value || ''),
+              };
+            })
+            : [],
+        );
+        break;
+      case 'browser_press_key':
+        result = await browserUseService.agentPressKey(sessionId, String(input.key || ''));
+        break;
+      case 'browser_select_option':
+        result = await browserUseService.agentSelectOption(
+          sessionId,
+          String(input.selector || ''),
+          Array.isArray(input.values) ? input.values.filter((value): value is string => typeof value === 'string') : [],
+        );
+        break;
+      case 'browser_wait_for':
+        result = await browserUseService.agentWaitFor(sessionId, {
+          text: typeof input.text === 'string' ? input.text : undefined,
+          url: typeof input.url === 'string' ? input.url : undefined,
+          timeoutMs: typeof input.timeoutMs === 'number' ? input.timeoutMs : undefined,
+        });
+        break;
+      case 'browser_tabs':
+        result = await browserUseService.agentTabs(sessionId, {
+          action: input.action === 'new' || input.action === 'select' || input.action === 'close' || input.action === 'list'
+            ? input.action
+            : undefined,
+          index: typeof input.index === 'number' ? input.index : undefined,
+          url: typeof input.url === 'string' ? input.url : undefined,
+        });
+        break;
+      case 'browser_close_session':
+        result = await browserUseService.agentStopSession(sessionId);
+        break;
+      default:
+        res.status(404).json({ success: false, error: `Unknown Browser MCP tool "${toolName}".` });
+        return;
+    }
+
+    res.json({ success: true, data: result });
+  } catch (error) {
+    res.status(400).json({
+      success: false,
+      error: error instanceof Error ? error.message : 'Browser MCP tool failed.',
+    });
+  }
+});
+
+export default router;