zyflow 0.6.4

package/server/utils/crypto.ts

@@ -0,0 +1,179 @@
+/**
+ * Cryptography Utilities
+ *
+ * 민감한 데이터 암호화/복호화
+ * - AES-256-GCM 암호화
+ * - 안전한 키 파생 (PBKDF2)
+ * - Slack URL, Webhook Secret 등 암호화
+ */
+
+import {
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+  pbkdf2Sync,
+  createHash,
+} from 'crypto'
+
+const ALGORITHM = 'aes-256-gcm'
+const KEY_LENGTH = 32 // 256 bits
+const IV_LENGTH = 16 // 128 bits
+const AUTH_TAG_LENGTH = 16 // 128 bits
+const SALT_LENGTH = 32
+const PBKDF2_ITERATIONS = 100000
+
+/**
+ * 마스터 키 가져오기
+ * 환경변수 SECRET_KEY 또는 기본값 사용
+ */
+function getMasterKey(): string {
+  const key = process.env.SECRET_KEY
+  if (!key) {
+    console.warn('[Crypto] SECRET_KEY not set, using default (insecure!)')
+    return 'zyflow-default-secret-key-change-in-production'
+  }
+  return key
+}
+
+/**
+ * 마스터 키에서 암호화 키 파생
+ */
+function deriveKey(masterKey: string, salt: Buffer): Buffer {
+  return pbkdf2Sync(masterKey, salt, PBKDF2_ITERATIONS, KEY_LENGTH, 'sha256')
+}
+
+/**
+ * 문자열 암호화
+ * @returns Base64 인코딩된 암호문 (salt:iv:authTag:ciphertext)
+ */
+export function encrypt(plaintext: string): string {
+  const masterKey = getMasterKey()
+  const salt = randomBytes(SALT_LENGTH)
+  const key = deriveKey(masterKey, salt)
+  const iv = randomBytes(IV_LENGTH)
+
+  const cipher = createCipheriv(ALGORITHM, key, iv)
+  let encrypted = cipher.update(plaintext, 'utf8', 'hex')
+  encrypted += cipher.final('hex')
+  const authTag = cipher.getAuthTag()
+
+  // salt:iv:authTag:ciphertext 형식으로 조합
+  const combined = Buffer.concat([
+    salt,
+    iv,
+    authTag,
+    Buffer.from(encrypted, 'hex'),
+  ])
+
+  return combined.toString('base64')
+}
+
+/**
+ * 문자열 복호화
+ * @param ciphertext Base64 인코딩된 암호문
+ */
+export function decrypt(ciphertext: string): string {
+  const masterKey = getMasterKey()
+  const combined = Buffer.from(ciphertext, 'base64')
+
+  // 구성요소 분리
+  const salt = combined.subarray(0, SALT_LENGTH)
+  const iv = combined.subarray(SALT_LENGTH, SALT_LENGTH + IV_LENGTH)
+  const authTag = combined.subarray(
+    SALT_LENGTH + IV_LENGTH,
+    SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH
+  )
+  const encrypted = combined.subarray(SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH)
+
+  const key = deriveKey(masterKey, salt)
+
+  const decipher = createDecipheriv(ALGORITHM, key, iv)
+  decipher.setAuthTag(authTag)
+
+  let decrypted = decipher.update(encrypted.toString('hex'), 'hex', 'utf8')
+  decrypted += decipher.final('utf8')
+
+  return decrypted
+}
+
+/**
+ * 암호화 여부 확인
+ * 암호화된 데이터는 Base64 형식이고 특정 길이 이상
+ */
+export function isEncrypted(value: string): boolean {
+  try {
+    const decoded = Buffer.from(value, 'base64')
+    // 최소 길이: salt(32) + iv(16) + authTag(16) + 최소 1바이트
+    return decoded.length >= SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH + 1
+  } catch {
+    return false
+  }
+}
+
+/**
+ * 안전하게 복호화 (암호화되지 않은 값은 그대로 반환)
+ */
+export function safeDecrypt(value: string): string {
+  if (!value) return value
+  if (!isEncrypted(value)) return value
+
+  try {
+    return decrypt(value)
+  } catch {
+    // 복호화 실패 시 원본 반환 (이전 평문 데이터 호환)
+    return value
+  }
+}
+
+/**
+ * 값 마스킹 (UI 표시용)
+ * 예: "https://hooks.slack.com/xxx" → "https://hooks.slack.com/***"
+ */
+export function maskValue(value: string, visibleChars = 10): string {
+  if (!value) return ''
+  if (value.length <= visibleChars) return '*'.repeat(value.length)
+
+  const prefix = value.substring(0, visibleChars)
+  const masked = '*'.repeat(Math.min(value.length - visibleChars, 20))
+  return prefix + masked
+}
+
+/**
+ * URL 마스킹 (도메인은 보이고 경로는 마스킹)
+ */
+export function maskUrl(url: string): string {
+  try {
+    const parsed = new URL(url)
+    const pathParts = parsed.pathname.split('/')
+    const maskedPath = pathParts
+      .map((part, i) => (i === 0 || part.length < 4 ? part : '***'))
+      .join('/')
+    return `${parsed.protocol}//${parsed.host}${maskedPath}`
+  } catch {
+    return maskValue(url)
+  }
+}
+
+/**
+ * 해시 생성 (비가역적, 비교용)
+ */
+export function hash(value: string): string {
+  return createHash('sha256').update(value).digest('hex')
+}
+
+/**
+ * 랜덤 시크릿 생성
+ */
+export function generateSecret(length = 32): string {
+  return randomBytes(length).toString('hex')
+}
+
+/**
+ * API 키 형식의 시크릿 생성
+ * 예: zf_live_xxxx...
+ */
+export function generateApiKey(prefix = 'zf'): string {
+  const timestamp = Date.now().toString(36)
+  const random = randomBytes(16).toString('hex')
+  return `${prefix}_${timestamp}_${random}`
+}

package/server/utils/webhook-verify.ts

@@ -0,0 +1,216 @@
+/**
+ * Webhook Signature Verification Utilities
+ *
+ * 각 서비스별 Webhook 서명 검증 로직
+ * - GitHub: HMAC-SHA256 with X-Hub-Signature-256
+ * - Vercel: HMAC-SHA1 with x-vercel-signature
+ * - Sentry: HMAC-SHA256 with Sentry-Hook-Signature
+ * - Supabase: Custom signature
+ */
+
+import { createHmac, timingSafeEqual } from 'crypto'
+
+// 프로덕션 환경 체크
+function isProduction(): boolean {
+  return process.env.NODE_ENV === 'production'
+}
+
+// 환경변수에서 시크릿 로드
+function getWebhookSecret(service: string): string | null {
+  const envKey = `${service.toUpperCase()}_WEBHOOK_SECRET`
+  return process.env[envKey] || null
+}
+
+/**
+ * GitHub Webhook 서명 검증
+ * @see https://docs.github.com/en/webhooks/using-webhooks/validating-webhook-deliveries
+ */
+export function verifyGitHubSignature(
+  payload: unknown,
+  signature: string | undefined
+): boolean {
+  const secret = getWebhookSecret('GITHUB')
+
+  // 시크릿이 설정되지 않은 경우
+  if (!secret) {
+    if (isProduction()) {
+      console.error('[Webhook] GitHub secret not configured in production - rejecting request')
+      return false
+    }
+    console.warn('[Webhook] GitHub secret not configured, skipping verification (dev mode)')
+    return true
+  }
+
+  if (!signature) {
+    return false
+  }
+
+  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)
+  const expectedSignature = 'sha256=' + createHmac('sha256', secret)
+    .update(body)
+    .digest('hex')
+
+  try {
+    return timingSafeEqual(
+      Buffer.from(signature),
+      Buffer.from(expectedSignature)
+    )
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Vercel Webhook 서명 검증
+ * @see https://vercel.com/docs/observability/webhooks/webhooks-api#securing-webhooks
+ */
+export function verifyVercelSignature(
+  payload: unknown,
+  signature: string | undefined
+): boolean {
+  const secret = getWebhookSecret('VERCEL')
+
+  if (!secret) {
+    if (isProduction()) {
+      console.error('[Webhook] Vercel secret not configured in production - rejecting request')
+      return false
+    }
+    console.warn('[Webhook] Vercel secret not configured, skipping verification (dev mode)')
+    return true
+  }
+
+  if (!signature) {
+    return false
+  }
+
+  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)
+  const expectedSignature = createHmac('sha1', secret)
+    .update(body)
+    .digest('hex')
+
+  try {
+    return timingSafeEqual(
+      Buffer.from(signature),
+      Buffer.from(expectedSignature)
+    )
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Sentry Webhook 서명 검증
+ * @see https://docs.sentry.io/product/integrations/integration-platform/webhooks/
+ */
+export function verifySentrySignature(
+  payload: unknown,
+  signature: string | undefined
+): boolean {
+  const secret = getWebhookSecret('SENTRY')
+
+  if (!secret) {
+    if (isProduction()) {
+      console.error('[Webhook] Sentry secret not configured in production - rejecting request')
+      return false
+    }
+    console.warn('[Webhook] Sentry secret not configured, skipping verification (dev mode)')
+    return true
+  }
+
+  if (!signature) {
+    return false
+  }
+
+  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)
+  const expectedSignature = createHmac('sha256', secret)
+    .update(body)
+    .digest('hex')
+
+  try {
+    return timingSafeEqual(
+      Buffer.from(signature),
+      Buffer.from(expectedSignature)
+    )
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Supabase Webhook 서명 검증
+ * Supabase는 공식 Webhook 서명 메커니즘이 없으므로 커스텀 구현
+ */
+export function verifySupabaseSignature(
+  payload: unknown,
+  signature: string | undefined
+): boolean {
+  const secret = getWebhookSecret('SUPABASE')
+
+  if (!secret) {
+    if (isProduction()) {
+      console.error('[Webhook] Supabase secret not configured in production - rejecting request')
+      return false
+    }
+    console.warn('[Webhook] Supabase secret not configured, skipping verification (dev mode)')
+    return true
+  }
+
+  if (!signature) {
+    return false
+  }
+
+  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)
+  const expectedSignature = createHmac('sha256', secret)
+    .update(body)
+    .digest('hex')
+
+  try {
+    return timingSafeEqual(
+      Buffer.from(signature),
+      Buffer.from(expectedSignature)
+    )
+  } catch {
+    return false
+  }
+}
+
+/**
+ * 커스텀 Webhook 서명 검증
+ */
+export function verifyCustomSignature(
+  payload: unknown,
+  signature: string | undefined,
+  secret: string
+): boolean {
+  if (!signature) {
+    return false
+  }
+
+  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)
+  const expectedSignature = createHmac('sha256', secret)
+    .update(body)
+    .digest('hex')
+
+  try {
+    return timingSafeEqual(
+      Buffer.from(signature),
+      Buffer.from(expectedSignature)
+    )
+  } catch {
+    return false
+  }
+}
+
+/**
+ * 서명 생성 (테스트용)
+ */
+export function generateSignature(
+  payload: unknown,
+  secret: string,
+  algorithm: 'sha256' | 'sha1' = 'sha256'
+): string {
+  const body = typeof payload === 'string' ? payload : JSON.stringify(payload)
+  return createHmac(algorithm, secret)
+    .update(body)
+    .digest('hex')
+}

package/server/watcher.ts

@@ -0,0 +1,132 @@
+/**
+ * File Watcher for tasks.md
+ * tasks.md 파일 변경 감지 후 DB 동기화 및 WebSocket 알림
+ */
+
+import chokidar from 'chokidar'
+import { join } from 'path'
+import type { WSEvent } from './websocket.js'
+import { broadcast } from './websocket.js'
+import { syncChangeTasksForProject } from './sync-tasks.js'
+
+let watcher: ReturnType<typeof chokidar.watch> | null = null
+let currentProjectPath: string | null = null
+let currentProjectId: string | null = null
+
+export function startTasksWatcher(projectPath: string, projectId?: string) {
+  if (watcher) {
+    console.log('[Watcher] Already watching, restarting with new path...')
+    stopTasksWatcher()
+  }
+
+  currentProjectPath = projectPath
+  currentProjectId = projectId || null
+
+  // 디렉토리를 직접 감시 (모든 파일)
+  const changesDir = join(projectPath, 'openspec/changes')
+
+  watcher = chokidar.watch(changesDir, {
+    ignoreInitial: true,
+    persistent: true,
+    usePolling: true,
+    interval: 300,
+    depth: 2,
+  })
+
+  watcher.on('change', async (filePath) => {
+    // tasks.md 파일만 처리
+    if (!filePath.endsWith('tasks.md')) return
+
+    console.log(`[Watcher] File changed: ${filePath}`)
+
+    const match = filePath.match(/openspec\/changes\/([^/]+)\/tasks\.md/)
+    if (!match) return
+
+    const changeId = match[1]
+
+    try {
+      // DB에 동기화
+      const result = await syncChangeTasksForProject(changeId, projectPath, currentProjectId || undefined)
+      console.log(`[Watcher] Synced ${changeId}: created=${result.tasksCreated}, updated=${result.tasksUpdated}, archived=${result.tasksArchived}`)
+
+      // WebSocket으로 클라이언트에 알림
+      const event: WSEvent = {
+        type: 'change:synced' as const,
+        payload: {
+          changeId,
+          projectPath,
+          tasksCreated: result.tasksCreated,
+          tasksUpdated: result.tasksUpdated,
+          tasksArchived: result.tasksArchived,
+        },
+        timestamp: Date.now(),
+      }
+
+      broadcast(event)
+    } catch (error) {
+      console.error(`[Watcher] Sync error for ${changeId}:`, error)
+    }
+  })
+
+  watcher.on('add', async (filePath) => {
+    // tasks.md 파일만 처리
+    if (!filePath.endsWith('tasks.md')) return
+
+    console.log(`[Watcher] File added: ${filePath}`)
+
+    const match = filePath.match(/openspec\/changes\/([^/]+)\/tasks\.md/)
+    if (!match) return
+
+    const changeId = match[1]
+
+    try {
+      const result = await syncChangeTasksForProject(changeId, projectPath, currentProjectId || undefined)
+      console.log(`[Watcher] Initial sync ${changeId}: created=${result.tasksCreated}`)
+
+      const event: WSEvent = {
+        type: 'change:synced' as const,
+        payload: {
+          changeId,
+          projectPath,
+          tasksCreated: result.tasksCreated,
+          tasksUpdated: result.tasksUpdated,
+          tasksArchived: result.tasksArchived,
+        },
+        timestamp: Date.now(),
+      }
+
+      broadcast(event)
+    } catch (error) {
+      console.error(`[Watcher] Initial sync error for ${changeId}:`, error)
+    }
+  })
+
+  watcher.on('error', (error) => {
+    console.error('[Watcher] Error:', error)
+  })
+
+  watcher.on('ready', () => {
+    console.log('[Watcher] Ready and watching for changes')
+  })
+
+  console.log(`[Watcher] Started watching tasks.md in: ${projectPath}`)
+  console.log(`[Watcher] Watching directory: ${changesDir}`)
+}
+
+export function stopTasksWatcher() {
+  if (watcher) {
+    watcher.close()
+    watcher = null
+    currentProjectPath = null
+    currentProjectId = null
+    console.log('[Watcher] Stopped')
+  }
+}
+
+export function getWatcherStatus() {
+  return {
+    watching: watcher !== null,
+    projectPath: currentProjectPath,
+    projectId: currentProjectId,
+  }
+}

package/server/websocket.ts

@@ -0,0 +1,99 @@
+/**
+ * WebSocket 서버 모듈
+ * 실시간 데이터 업데이트를 클라이언트에 푸시
+ */
+
+import { WebSocketServer, WebSocket } from 'ws'
+import type { Server } from 'http'
+
+export type WSEventType =
+  | 'task:created'
+  | 'task:updated'
+  | 'task:deleted'
+  | 'task:archived'
+  | 'change:created'
+  | 'change:updated'
+  | 'change:synced'
+  | 'change:archived'
+  | 'spec:updated'
+  | 'sync:completed'
+  | 'inbox:updated'
+  | 'backlog:synced'
+  | 'backlog:task:created'
+  | 'backlog:task:updated'
+  | 'backlog:task:deleted'
+
+export interface WSEvent {
+  type: WSEventType
+  payload: unknown
+  timestamp: number
+}
+
+let wss: WebSocketServer | null = null
+
+/**
+ * WebSocket 서버 초기화
+ */
+export function initWebSocket(server: Server): WebSocketServer {
+  wss = new WebSocketServer({ server, path: '/ws' })
+
+  wss.on('connection', (ws) => {
+    console.log('[WebSocket] Client connected')
+
+    ws.on('close', () => {
+      console.log('[WebSocket] Client disconnected')
+    })
+
+    ws.on('error', (error) => {
+      console.error('[WebSocket] Error:', error)
+    })
+
+    // 연결 확인 메시지
+    ws.send(
+      JSON.stringify({
+        type: 'connected',
+        payload: { message: 'WebSocket connected' },
+        timestamp: Date.now(),
+      })
+    )
+  })
+
+  console.log('[WebSocket] Server initialized on /ws')
+  return wss
+}
+
+/**
+ * 모든 연결된 클라이언트에 이벤트 브로드캐스트
+ */
+export function broadcast(event: WSEvent): void {
+  if (!wss) {
+    console.warn('[WebSocket] Server not initialized')
+    return
+  }
+
+  const message = JSON.stringify(event)
+
+  wss.clients.forEach((client) => {
+    if (client.readyState === WebSocket.OPEN) {
+      client.send(message)
+    }
+  })
+}
+
+/**
+ * 특정 이벤트 타입으로 브로드캐스트
+ */
+export function emit(type: WSEventType, payload: unknown): void {
+  broadcast({
+    type,
+    payload,
+    timestamp: Date.now(),
+  })
+}
+
+/**
+ * WebSocket 서버 인스턴스 반환
+ */
+export function getWebSocketServer(): WebSocketServer | null {
+  return wss
+}

package/server-output.log

@@ -0,0 +1,6 @@
+[WebSocket] Server initialized on /ws
+ZyFlow API server running on http://localhost:3000
+[Info] DB-only mode - no file sync
+[ProcessManager] Loaded 6 sessions from file
+[ProcessManager] Initialized global instance with path: /Users/hansoo./ZELLYY/zyflow
+[SSH] Connected to idp (100.79.236.237)

package/sonar-project.properties

@@ -0,0 +1,18 @@
+# SonarQube Configuration for zyflow
+sonar.projectKey=zyflow
+sonar.projectName=zyflow
+sonar.projectVersion=1.0
+
+# Source code location
+sonar.sources=src
+sonar.tests=src
+sonar.test.inclusions=**/*.test.ts,**/*.test.tsx,**/*.spec.ts,**/*.spec.tsx
+
+# TypeScript/JavaScript settings
+sonar.javascript.lcov.reportPaths=coverage/lcov.info
+
+# Exclusions
+sonar.exclusions=**/node_modules/**,**/dist/**,**/build/**,**/*.test.ts,**/*.test.tsx,**/*.spec.ts,**/*.spec.tsx,**/coverage/**
+
+# Encoding
+sonar.sourceEncoding=UTF-8