wizards 0.1.9

package/apps/runtime/dist/auth/index.js

@@ -0,0 +1,329 @@
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { userInfo } from "node:os";
+import { eq, lt } from "drizzle-orm";
+import { Hono } from "hono";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { nanoid } from "nanoid";
+import { control, controlDb } from "../db/client.js";
+import { basePath, env } from "../env.js";
+import { discovery, managed, tokenRequest, verifyToken, } from "../manage.js";
+import { seal, unseal } from "../secrets/crypto.js";
+import { LOCAL_TENANT } from "../tenants/tenant.js";
+import { finishLink } from "./account.js";
+import { localTicketExpiry } from "./local-ticket.js";
+const secure = env.appUrl.startsWith("https");
+// --- a runtime that runs alone ------------------------------------------------
+// One person, one tenant. The studio answers only with a cookie that is set by opening the
+// one-time link once: a web page in the same browser cannot reach it.
+const LOCAL_COOKIE = "wz_local";
+const localCookieValue = createHmac("sha256", env.authSecret).update("local-studio").digest("hex");
+let accessKey = managed
+    ? null
+    : env.local.accessKey || randomBytes(24).toString("hex");
+/** The link that lets the person in; printed at start, opened by the desktop app. */
+export function localEntryUrl() {
+    return accessKey ? `${env.appUrl}/api/local/enter?k=${accessKey}` : null;
+}
+const localUser = () => ({
+    id: "local",
+    tenantId: LOCAL_TENANT,
+    role: "owner",
+    name: userInfo().username || "Admin",
+    email: "",
+});
+function sameValue(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+}
+function setLocalCookie(c) {
+    setCookie(c, LOCAL_COOKIE, localCookieValue, {
+        httpOnly: true,
+        sameSite: "Strict",
+        secure,
+        path: cookiePath,
+        maxAge: 60 * 60 * 24 * 365,
+    });
+}
+// --- signed in at the Manage-App ------------------------------------------------
+const SESSION_COOKIE = "wz_session";
+const STATE_COOKIE = "wz_oauth";
+const SESSION_DAYS = 30;
+const SCOPE = "openid profile email offline_access wizards:read wizards:write wizards:publish runs:test";
+// The desktop app shows a server in its window but signs in through the system browser
+// (Google refuses embedded views). The finished session travels back as a one-time code in an
+// `engenty-wizards://` link; it only counts in the window that asked for it, which holds the
+// matching cookie — so a link sent by some web page signs nobody in.
+const DESKTOP_COOKIE = "wz_desktop";
+const usedHandoffs = new Set();
+/** Tickets of the local one-time link that were opened, until they run out. */
+const usedTickets = new Map();
+const sessions = new Map();
+const client = () => ({ id: env.manage.clientId, secret: env.manage.clientSecret || undefined });
+/** Cookies and redirects stay under the path the app is served at. */
+const cookiePath = basePath || "/";
+/** Where a sign-in and the local link lead: the studio. */
+const home = `${basePath}/studio/`;
+const callbackUrl = () => `${env.appUrl}/api/auth/callback`;
+function safeReturn(path) {
+    return path?.startsWith("/") && !path.startsWith("//") ? path : home;
+}
+function setSessionCookie(c, id) {
+    setCookie(c, SESSION_COOKIE, id, {
+        httpOnly: true,
+        sameSite: "Lax",
+        secure,
+        path: cookiePath,
+        maxAge: SESSION_DAYS * 24 * 3600,
+    });
+}
+async function claimsOf(tokens) {
+    const claims = await verifyToken(tokens.access_token, [env.appUrl]);
+    if (!claims) {
+        throw new Error("The Manage-App's token did not verify.");
+    }
+    return claims;
+}
+/** Renews tenant and role from the Manage-App once the access token they came from has run out. */
+async function renew(row) {
+    const refresh = row.refreshToken ? unseal(row.refreshToken) : null;
+    if (!refresh) {
+        return null;
+    }
+    try {
+        const tokens = await tokenRequest({ grant_type: "refresh_token", refresh_token: refresh, resource: env.appUrl }, client());
+        const claims = await claimsOf(tokens);
+        const next = {
+            ...row,
+            tenantId: claims.tenantId,
+            role: claims.role,
+            name: claims.name || row.name,
+            email: claims.email || row.email,
+            refreshToken: tokens.refresh_token ? seal(tokens.refresh_token) : row.refreshToken,
+            claimsExpireAt: new Date(claims.expiresAt),
+        };
+        await controlDb.update(control.session).set(next).where(eq(control.session.id, row.id));
+        return next;
+    }
+    catch {
+        return null;
+    }
+}
+async function sessionPrincipal(id) {
+    const hit = sessions.get(id);
+    let row = hit && Date.now() - hit.at < 60_000
+        ? hit.row
+        : await controlDb.query.session.findFirst({ where: eq(control.session.id, id) });
+    if (!row || row.expiresAt.getTime() < Date.now()) {
+        sessions.delete(id);
+        return null;
+    }
+    if (row.claimsExpireAt.getTime() < Date.now()) {
+        const renewed = await renew(row);
+        if (!renewed) {
+            await controlDb.delete(control.session).where(eq(control.session.id, id));
+            sessions.delete(id);
+            return null;
+        }
+        row = renewed;
+    }
+    sessions.set(id, { at: Date.now(), row });
+    return {
+        id: row.userId,
+        tenantId: row.tenantId,
+        role: row.role,
+        name: row.name,
+        email: row.email,
+        image: row.image,
+    };
+}
+/** Sessions that ran out go once an hour, with the retention job. */
+export async function purgeSessions() {
+    await controlDb.delete(control.session).where(lt(control.session.expiresAt, new Date()));
+}
+// --- both ------------------------------------------------------------------------
+export async function principalOf(c) {
+    if (!managed) {
+        const cookie = getCookie(c, LOCAL_COOKIE);
+        return cookie && sameValue(cookie, localCookieValue) ? localUser() : null;
+    }
+    const id = getCookie(c, SESSION_COOKIE);
+    return id ? sessionPrincipal(id) : null;
+}
+const closePage = (message) => `<!doctype html><meta charset="utf-8"><title>engenty wizards</title>
+<body style="font:16px system-ui;display:grid;place-items:center;height:100vh;margin:0;color:#333">
+<p>${message}</p>`;
+export const authRoutes = new Hono()
+    // Local: the one-time link. The key works once per start; a ticket (`wizards open`,
+    // the desktop app entering a runtime that already runs) once within its minute.
+    .get("/local/enter", (c) => {
+    const given = c.req.query("k") ?? "";
+    const ticket = c.req.query("t") ?? "";
+    const now = Date.now();
+    for (const [used, expires] of usedTickets) {
+        if (expires <= now) {
+            usedTickets.delete(used);
+        }
+    }
+    const expires = !managed && ticket && !usedTickets.has(ticket)
+        ? localTicketExpiry(env.authSecret, ticket, now)
+        : null;
+    if (expires) {
+        usedTickets.set(ticket, expires);
+    }
+    else if (managed || !accessKey || !sameValue(given, accessKey)) {
+        return c.text("This link is no longer valid. Start the app again.", 403);
+    }
+    else {
+        accessKey = null;
+    }
+    setLocalCookie(c);
+    return c.redirect(home);
+})
+    // Local development only: the "Dev-Login" button.
+    .post("/dev/login", (c) => {
+    if (managed || !env.devLogin) {
+        return c.notFound();
+    }
+    setLocalCookie(c);
+    return c.json({ ok: true });
+})
+    // The desktop app's window asks for a sign-in that will run in the system browser.
+    .post("/auth/desktop/start", (c) => {
+    if (!managed) {
+        return c.notFound();
+    }
+    const desktop = randomBytes(24).toString("base64url");
+    setCookie(c, DESKTOP_COOKIE, desktop, {
+        httpOnly: true,
+        sameSite: "Lax",
+        secure,
+        path: `${basePath}/api/auth`,
+        maxAge: 900,
+    });
+    const ticket = seal({ desktop, exp: Date.now() + 15 * 60_000 });
+    return c.json({ url: `${env.appUrl}/api/auth/login?desktop=${encodeURIComponent(ticket)}` });
+})
+    .get("/auth/handoff", async (c) => {
+    const code = c.req.query("code") ?? "";
+    const handoff = unseal(code);
+    const desktop = getCookie(c, DESKTOP_COOKIE);
+    deleteCookie(c, DESKTOP_COOKIE, { path: `${basePath}/api/auth` });
+    if (!managed ||
+        !handoff ||
+        handoff.exp < Date.now() ||
+        !desktop ||
+        !sameValue(desktop, handoff.desktop) ||
+        usedHandoffs.has(handoff.sid)) {
+        return c.redirect(`${home}?signin=failed`);
+    }
+    usedHandoffs.add(handoff.sid);
+    setSessionCookie(c, handoff.sid);
+    return c.redirect(home);
+})
+    .get("/auth/login", async (c) => {
+    if (!managed) {
+        return c.notFound();
+    }
+    const d = await discovery();
+    const verifier = randomBytes(32).toString("base64url");
+    const ticket = unseal(c.req.query("desktop") ?? "");
+    const state = {
+        verifier,
+        nonce: nanoid(16),
+        returnTo: safeReturn(c.req.query("return")),
+        exp: Date.now() + 15 * 60_000,
+        ...(ticket && ticket.exp > Date.now() ? { desktop: ticket.desktop } : {}),
+    };
+    setCookie(c, STATE_COOKIE, seal(state), {
+        httpOnly: true,
+        sameSite: "Lax",
+        secure,
+        path: `${basePath}/api/auth`,
+        maxAge: 900,
+    });
+    const url = new URL(d.authorization_endpoint);
+    url.search = new URLSearchParams({
+        response_type: "code",
+        client_id: env.manage.clientId,
+        redirect_uri: callbackUrl(),
+        scope: SCOPE,
+        resource: env.appUrl,
+        code_challenge: createHash("sha256").update(verifier).digest("base64url"),
+        code_challenge_method: "S256",
+        state: state.nonce,
+    }).toString();
+    return c.redirect(url.toString());
+})
+    .get("/auth/callback", async (c) => {
+    const code = c.req.query("code");
+    const rawState = c.req.query("state") ?? "";
+    if (!managed) {
+        // The linked account of a runtime that runs alone: the system browser lands here.
+        if (!code) {
+            return c.html(closePage("Anmeldung abgebrochen. Du kannst dieses Fenster schließen."), 400);
+        }
+        try {
+            await finishLink(code, rawState);
+            return c.html(closePage("Angemeldet. Du kannst dieses Fenster schließen."));
+        }
+        catch (err) {
+            console.error("[account]", err);
+            return c.html(closePage("Anmeldung hat nicht geklappt. Bitte noch einmal versuchen."), 400);
+        }
+    }
+    const state = unseal(getCookie(c, STATE_COOKIE) ?? "");
+    deleteCookie(c, STATE_COOKIE, { path: `${basePath}/api/auth` });
+    if (!code || !state || state.exp < Date.now() || state.nonce !== rawState) {
+        return c.redirect(`${home}?signin=failed`);
+    }
+    try {
+        const tokens = await tokenRequest({
+            grant_type: "authorization_code",
+            code,
+            redirect_uri: callbackUrl(),
+            code_verifier: state.verifier,
+            resource: env.appUrl,
+        }, client());
+        const claims = await claimsOf(tokens);
+        const id = randomBytes(32).toString("base64url");
+        await controlDb.insert(control.session).values({
+            id,
+            userId: claims.userId,
+            tenantId: claims.tenantId,
+            role: claims.role,
+            name: claims.name || claims.email,
+            email: claims.email,
+            refreshToken: tokens.refresh_token ? seal(tokens.refresh_token) : null,
+            claimsExpireAt: new Date(claims.expiresAt),
+            expiresAt: new Date(Date.now() + SESSION_DAYS * 24 * 3600_000),
+        });
+        if (state.desktop) {
+            // The session belongs to the app's window, not to this browser.
+            const code = seal({
+                sid: id,
+                desktop: state.desktop,
+                exp: Date.now() + 2 * 60_000,
+            });
+            const link = `engenty-wizards://signin?code=${encodeURIComponent(code)}`;
+            return c.html(`${closePage("Angemeldet. Kehre jetzt zu engenty wizards zurück.")}
+<script>location.href = ${JSON.stringify(link)};</script>`);
+        }
+        setSessionCookie(c, id);
+        return c.redirect(state.returnTo);
+    }
+    catch (err) {
+        console.error("[sign-in]", err);
+        return c.redirect(`${home}?signin=failed`);
+    }
+})
+    .post("/auth/sign-out", async (c) => {
+    const id = getCookie(c, SESSION_COOKIE);
+    if (id) {
+        await controlDb.delete(control.session).where(eq(control.session.id, id));
+        sessions.delete(id);
+    }
+    deleteCookie(c, SESSION_COOKIE, { path: cookiePath });
+    deleteCookie(c, LOCAL_COOKIE, { path: cookiePath });
+    return c.json({ ok: true });
+});

package/apps/runtime/dist/auth/keys.js

@@ -0,0 +1,55 @@
+import { createHash, randomBytes } from "node:crypto";
+import { nanoid } from "nanoid";
+import { readSetting, writeSetting } from "../settings.js";
+/**
+ * API keys of a runtime that runs alone: the person's own MCP client (Claude Code, Cursor,
+ * Codex) and scripts sign in with them. Only the hash is kept. A runtime of a Manage-App has
+ * none of its own — keys are issued and checked there.
+ */
+export const API_KEY_PREFIX = "wz_";
+const hashOf = (key) => createHash("sha256").update(key).digest("hex");
+/** A key that lives only as long as this process: the studio chat's own client signs in with it. */
+let internal = null;
+export function internalKey() {
+    internal ??= `${API_KEY_PREFIX}${randomBytes(24).toString("base64url")}`;
+    return internal;
+}
+const INTERNAL_CLIENT = "Claude (Abo)";
+async function all() {
+    return (await readSetting("apiKeys")) ?? [];
+}
+export async function listLocalKeys() {
+    return (await all()).map(({ hash: _hash, ...rest }) => rest);
+}
+export async function createLocalKey(name) {
+    const key = `${API_KEY_PREFIX}${randomBytes(24).toString("base64url")}`;
+    const row = {
+        id: nanoid(12),
+        name,
+        start: key.slice(0, 8),
+        hash: hashOf(key),
+        createdAt: new Date().toISOString(),
+        lastRequest: null,
+    };
+    await writeSetting("apiKeys", [...(await all()), row]);
+    return { id: row.id, name, key };
+}
+export async function deleteLocalKey(id) {
+    await writeSetting("apiKeys", (await all()).filter((k) => k.id !== id));
+}
+export async function verifyLocalKey(key) {
+    if (internal && key === internal) {
+        return { id: "internal", name: INTERNAL_CLIENT };
+    }
+    const keys = await all();
+    const found = keys.find((k) => k.hash === hashOf(key));
+    if (!found) {
+        return null;
+    }
+    // One write a minute is enough to show the key is in use.
+    if (!found.lastRequest || Date.now() - Date.parse(found.lastRequest) > 60_000) {
+        found.lastRequest = new Date().toISOString();
+        await writeSetting("apiKeys", keys);
+    }
+    return { id: found.id, name: found.name };
+}

package/apps/runtime/dist/auth/local-ticket.js

@@ -0,0 +1,23 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * A second way through the one-time link: a ticket signed with the data folder's secret, good
+ * for a minute. Who can read that secret can already make the studio's cookie, so a ticket opens
+ * nothing new — it lets the command line and the desktop app enter a runtime that already runs.
+ */
+const TTL_MS = 60_000;
+const sign = (secret, expires) => createHmac("sha256", secret).update(`local-enter.${expires}`).digest("hex");
+export function mintLocalTicket(secret, now = Date.now()) {
+    const expires = now + TTL_MS;
+    return `${expires}.${sign(secret, expires)}`;
+}
+/** When a ticket runs out, or null when it is not one of ours or already ran out. */
+export function localTicketExpiry(secret, ticket, now = Date.now()) {
+    const [head, signature] = ticket.split(".");
+    const expires = Number(head);
+    if (!signature || !Number.isSafeInteger(expires) || expires <= now || expires > now + TTL_MS) {
+        return null;
+    }
+    const given = Buffer.from(signature);
+    const expected = Buffer.from(sign(secret, expires));
+    return given.length === expected.length && timingSafeEqual(given, expected) ? expires : null;
+}

package/apps/runtime/dist/authoring/example.js

@@ -0,0 +1,73 @@
+/**
+ * The wizard the authoring guide shows as an example of the schema: a post with an image. It is
+ * the guide's own, not a marketplace entry, so the guide never depends on the marketplace.
+ */
+export const EXAMPLE_WIZARD = {
+    version: 1,
+    title: "X-Post mit Bild",
+    description: "Aus einem Thema wird ein fertiger Post mit Bild.",
+    avatar: "flame",
+    intro: "Erzähl mir kurz, worum es geht – ich schreibe den Post und zeichne das Bild dazu.",
+    steps: [
+        {
+            id: "about",
+            type: "page",
+            title: "Worum geht's?",
+            fields: [
+                {
+                    id: "topic",
+                    label: "Thema oder Anlass",
+                    kind: "textarea",
+                    required: true,
+                    placeholder: "z. B. Wir eröffnen am Freitag unser neues Studio in Wien",
+                },
+                {
+                    id: "tone",
+                    label: "Ton",
+                    kind: "select",
+                    options: ["Locker", "Professionell", "Witzig", "Inspirierend"],
+                    default: "Locker",
+                },
+                { id: "link", label: "Link (optional)", kind: "url" },
+            ],
+        },
+        {
+            id: "post",
+            type: "agent",
+            title: "Post schreiben",
+            working: "Schreibt den Post …",
+            instructions: "Schreibe einen Post für X (Twitter) zum Thema: {{topic}}. Ton: {{tone}}. Höchstens 270 Zeichen inklusive Link und höchstens zwei Hashtags. Wenn ein Link angegeben ist ({{link}}), setze ihn ans Ende. Ein starker erster Satz. Nur den Post ausgeben.",
+            tools: [],
+            output: { format: "text" },
+            model: "standard",
+        },
+        {
+            id: "visual",
+            type: "generate",
+            title: "Bild zeichnen",
+            working: "Zeichnet das Bild …",
+            asset: "image",
+            prompt: "Ein auffälliges Bild, das diesen Post begleitet: {{steps.post}}. Thema: {{topic}}. Kein Text im Bild.",
+            options: { aspectRatio: "16:9", style: "modern editorial, clean, high contrast" },
+        },
+        {
+            id: "check",
+            type: "review",
+            title: "Passt das so?",
+            description: "Du kannst den Text direkt ändern oder eine neue Variante anfordern.",
+            show: ["post", "visual"],
+            edit: true,
+            regenerate: true,
+        },
+        {
+            id: "done",
+            type: "result",
+            title: "Fertig zum Posten",
+            message: "Kopiere den Text und lade das Bild herunter.",
+            deliverables: [
+                { from: "post", label: "Post", formats: ["txt", "md"] },
+                { from: "visual", label: "Bild", formats: ["png"] },
+            ],
+        },
+    ],
+};