polyrob 0.5.0__py3-none-any.whl

modules/auth/siwe_auth.py

@@ -0,0 +1,273 @@
+"""Sign-In with Ethereum (SIWE) authentication - FREE alternative to Privy.
+
+SIWE is the industry standard for wallet authentication:
+- Used by ENS, OpenSea, and many others
+- Completely free, no usage limits
+- Works with any wallet
+- Secure by design with nonce management
+"""
+
+import logging
+from datetime import datetime, timedelta
+from typing import Optional
+import secrets
+import hashlib
+from eth_account.messages import encode_defunct
+from web3 import Web3
+
+logger = logging.getLogger(__name__)
+
+
+class SIWEAuthenticator:
+    """
+    Free wallet authentication using SIWE (Sign-In with Ethereum).
+
+    This replaces Privy with a completely free solution.
+    """
+
+    def __init__(self, db):
+        """
+        Initialize SIWE authenticator.
+
+        Args:
+            db: Database manager instance
+        """
+        self.db = db
+        self.w3 = Web3()
+        self.logger = logging.getLogger('auth.siwe')
+
+    async def generate_nonce(self, wallet_address: str, chain_id: int = 1) -> str:
+        """
+        Generate authentication nonce for wallet.
+
+        Nonces prevent replay attacks. The nonce is bound to the chain_id it
+        was issued for, so a signed message declaring a different chain can
+        never be validated against it (see _verify_nonce).
+
+        Args:
+            wallet_address: Ethereum wallet address
+            chain_id: Blockchain ID this nonce is being issued for (default: 1 = Ethereum mainnet)
+
+        Returns:
+            Random nonce string
+        """
+        nonce = secrets.token_hex(32)
+
+        # Store nonce with expiration (5 minutes)
+        await self.db.execute("""
+            INSERT OR REPLACE INTO auth_nonces (
+                wallet_address, nonce, chain_id, expires_at
+            ) VALUES (?, ?, ?, datetime('now', '+5 minutes'))
+        """, (wallet_address.lower(), nonce, chain_id))
+
+        self.logger.debug(f"Generated nonce for {wallet_address[:8]}... (chain {chain_id})")
+
+        return nonce
+
+    async def verify_signature(
+        self,
+        wallet_address: str,
+        message: str,
+        signature: str,
+        nonce: Optional[str] = None
+    ) -> bool:
+        """
+        Verify wallet signature.
+
+        Args:
+            wallet_address: Ethereum wallet address
+            message: Signed message
+            signature: Signature from wallet
+            nonce: Optional nonce to verify (prevents replay attacks)
+
+        Returns:
+            True if signature is valid and nonce is correct
+        """
+
+        try:
+            # 1. Verify signature cryptographically
+            message_hash = encode_defunct(text=message)
+            recovered_address = self.w3.eth.account.recover_message(
+                message_hash,
+                signature=signature
+            )
+
+            if recovered_address.lower() != wallet_address.lower():
+                self.logger.warning(
+                    f"Signature verification failed: expected {wallet_address[:8]}..., "
+                    f"got {recovered_address[:8]}..."
+                )
+                return False
+
+            # 2. Verify nonce if provided (prevents replay attacks), bound to the
+            # chain_id declared in the submitted message (prevents chain-ID replay:
+            # a nonce issued for one chain must not validate a message claiming another).
+            if nonce:
+                submitted_chain_id = self._extract_chain_id(message)
+                valid_nonce = await self._verify_nonce(wallet_address, nonce, chain_id=submitted_chain_id)
+                if not valid_nonce:
+                    self.logger.warning(f"Invalid or expired nonce for {wallet_address[:8]}...")
+                    return False
+
+                # Consume nonce (one-time use)
+                await self._consume_nonce(wallet_address, nonce)
+
+            # 3. Check message freshness (5 minute window)
+            if not self._check_message_freshness(message):
+                self.logger.warning(f"Message expired for {wallet_address[:8]}...")
+                return False
+
+            self.logger.info(f"Successfully verified signature for {wallet_address[:8]}...")
+            return True
+
+        except Exception as e:
+            self.logger.error(f"Signature verification error: {e}")
+            return False
+
+    async def create_siwe_message(
+        self,
+        wallet_address: str,
+        domain: str,
+        uri: str,
+        chain_id: int = 1  # Ethereum mainnet by default
+    ) -> dict:
+        """
+        Create SIWE-compliant authentication message.
+
+        SIWE format: https://eips.ethereum.org/EIPS/eip-4361
+
+        Args:
+            wallet_address: User's wallet address
+            domain: Your domain (e.g., "app.your-polyrob-host.example")
+            uri: Your app URI
+            chain_id: Blockchain ID (1=Ethereum, 137=Polygon, 8453=Base, 42161=Arbitrum)
+
+        Returns:
+            Dict with message and nonce
+        """
+
+        nonce = await self.generate_nonce(wallet_address, chain_id=chain_id)
+        issued_at = datetime.utcnow().isoformat() + 'Z'
+        expiration = (datetime.utcnow() + timedelta(minutes=5)).isoformat() + 'Z'
+
+        # SIWE-compliant message format
+        message = f"""{domain} wants you to sign in with your Ethereum account:
+{wallet_address}
+
+Sign in to POLYROB - AI Automation Platform
+
+URI: {uri}
+Version: 1
+Chain ID: {chain_id}
+Nonce: {nonce}
+Issued At: {issued_at}
+Expiration Time: {expiration}"""
+
+        return {
+            "message": message,
+            "nonce": nonce,
+            "issued_at": issued_at,
+            "expiration": expiration
+        }
+
+    async def _verify_nonce(self, wallet_address: str, nonce: str, chain_id: Optional[int] = None) -> bool:
+        """Verify nonce is valid, not expired, and — when the stored row is
+        bound to a chain — was issued for that same chain.
+
+        Fail CLOSED, keyed off the STORED row's chain_id (not the submitted
+        chain_id): if the row has a concrete chain_id, the submitted message
+        MUST declare the matching chain, INCLUDING the case where the
+        submitted chain_id is None (the attacker simply omitted the
+        `Chain ID:` line, or it failed to parse). Omitting the line is not a
+        way to skip the check — it is trivially attacker-controlled request
+        data. A legacy row with chain_id IS NULL (pre-migration) still skips
+        the check, preserving the grace period; every row written by
+        generate_nonce today always carries a concrete chain_id.
+        """
+
+        result = await self.db.fetch_one("""
+            SELECT nonce, chain_id FROM auth_nonces
+            WHERE wallet_address = ?
+                AND nonce = ?
+                AND expires_at > datetime('now')
+                AND used = 0
+        """, (wallet_address.lower(), nonce))
+
+        if result is None:
+            return False
+
+        if result["chain_id"] is not None and result["chain_id"] != chain_id:
+            self.logger.warning(
+                f"Chain ID mismatch for {wallet_address[:8]}...: "
+                f"issued for {result['chain_id']}, submitted {chain_id}"
+            )
+            return False
+
+        return True
+
+    @staticmethod
+    def _extract_chain_id(message: str) -> Optional[int]:
+        """Parse the `Chain ID:` line out of a SIWE message body."""
+        for line in message.split('\n'):
+            if line.startswith('Chain ID:'):
+                try:
+                    return int(line.split('Chain ID:')[1].strip())
+                except ValueError:
+                    return None
+        return None
+
+    async def _consume_nonce(self, wallet_address: str, nonce: str):
+        """Mark nonce as used (one-time use)."""
+
+        await self.db.execute("""
+            UPDATE auth_nonces
+            SET used = 1
+            WHERE wallet_address = ? AND nonce = ?
+        """, (wallet_address.lower(), nonce))
+
+    def _check_message_freshness(self, message: str, max_age: int = 300) -> bool:
+        """
+        Check if message was created recently.
+
+        Prevents replay attacks with old signatures.
+
+        Args:
+            message: The signed message
+            max_age: Maximum age in seconds (default: 5 minutes)
+
+        Returns:
+            True if message is fresh
+        """
+
+        try:
+            # Extract "Issued At" from SIWE message
+            for line in message.split('\n'):
+                if line.startswith('Issued At:'):
+                    issued_at_str = line.split('Issued At:')[1].strip()
+                    issued_at = datetime.fromisoformat(issued_at_str.replace('Z', ''))
+                    age = (datetime.utcnow() - issued_at).total_seconds()
+                    return age < max_age
+
+            # Fallback: check for timestamp in message
+            if 'timestamp:' in message.lower():
+                timestamp_str = message.split('timestamp:')[-1].strip().split()[0]
+                timestamp = int(timestamp_str)
+                age = datetime.now().timestamp() - timestamp
+                return age < max_age
+
+        except Exception as e:
+            self.logger.debug(f"Could not parse message timestamp: {e}")
+
+        # If we can't verify freshness, reject (fail-safe)
+        return False
+
+    async def cleanup_expired_nonces(self):
+        """Clean up expired nonces (run periodically)."""
+
+        result = await self.db.execute("""
+            DELETE FROM auth_nonces
+            WHERE expires_at < datetime('now')
+        """)
+
+        if result.rowcount > 0:
+            self.logger.info(f"Cleaned up {result.rowcount} expired nonces")

modules/auth/tier_manager.py

@@ -0,0 +1,173 @@
+"""Tier manager for managing user tiers based on NFT ownership."""
+
+import logging
+
+from core.exceptions import TierError, UserNotFoundError
+
+# Import credit constants from single source of truth
+from modules.credits.pricing import DEN_SIGNUP_ALLOWANCE
+
+logger = logging.getLogger(__name__)
+
+
+class TierManager:
+    """Manage user tiers based on NFT ownership."""
+
+    # Tier quotas (SIMPLIFIED: holder = 1+ DEN tokens)
+    # Credits: 100 welcome (everyone) + 2000 DEN Sign Up Allowance per token
+    TIER_LIMITS = {
+        "holder": {
+            "signup_allowance_per_token": DEN_SIGNUP_ALLOWANCE,  # $20 USD one-time per token ID
+            "max_concurrent_sessions": 10,
+            "max_steps": 50,
+            "allowed_models": ["gpt-5", "claude-sonnet-4-5", "gemini-2.5-flash", "deepseek-chat"]
+        },
+        "admin": {
+            "signup_allowance_per_token": 0,  # Admins don't need allowance
+            "max_concurrent_sessions": 100,
+            "max_steps": 500,
+            "allowed_models": "*"  # All models
+        }
+    }
+
+    def __init__(self, db, alchemy_tool=None):
+        """
+        Initialize tier manager.
+
+        Args:
+            db: Database manager instance
+            alchemy_tool: AlchemyTool instance for NFT checks (optional)
+        """
+        self.db = db
+        self.alchemy_tool = alchemy_tool
+        self.logger = logging.getLogger('auth.tier_manager')
+
+    async def get_user_tier(self, user_id: str) -> str:
+        """Get user's current tier.
+
+        UPDATED: Returns tier as-is (including 'free').
+        Access control is enforced at feature level, not here.
+        """
+
+        result = await self.db.fetch_one("""
+            SELECT tier FROM user_profiles WHERE user_id = ?
+        """, (user_id,))
+
+        tier = result['tier'] if result else 'free'
+
+        return tier
+
+    async def get_tier_limits(self, user_id: str) -> dict:
+        """Get quota limits for user's tier.
+
+        For free tier, returns minimal limits (info only - access blocked at feature level).
+        Credits: 100 welcome (everyone) + 2000 DEN Sign Up Allowance per token.
+        """
+
+        tier = await self.get_user_tier(user_id)
+
+        # Free tier gets minimal limits (shown in UI but features are blocked)
+        if tier == 'free':
+            return {
+                "signup_allowance_per_token": 0,
+                "max_concurrent_sessions": 0,
+                "max_steps": 0,
+                "allowed_models": []
+            }
+
+        # x402 and free_access tiers use holder limits
+        # - x402: pay-per-request users
+        # - free_access: admin-granted access without DEN token
+        if tier in ('x402', 'free_access'):
+            return self.TIER_LIMITS['holder']
+
+        # Return actual limits for holder/admin
+        if tier not in self.TIER_LIMITS:
+            raise TierError("Invalid tier - contact support")
+
+        return self.TIER_LIMITS[tier]
+
+    async def check_quota(self, user_id: str, quota_type: str) -> bool:
+        """Check if user has quota for resource."""
+
+        limits = await self.get_tier_limits(user_id)
+
+        if quota_type == "concurrent_sessions":
+            # Count active sessions
+            # Note: This assumes a sessions table exists
+            # If not, this check will be skipped
+            try:
+                active = await self.db.fetch_one("""
+                    SELECT COUNT(*) as count
+                    FROM sessions
+                    WHERE user_id = ? AND status IN ('running', 'paused')
+                """, (user_id,))
+
+                if active:
+                    return active['count'] < limits['max_concurrent_sessions']
+            except Exception as e:
+                self.logger.warning(f"Could not check session quota: {e}")
+                return True  # Allow if we can't check
+
+        return True
+
+    async def check_model_allowed(self, user_id: str, model: str) -> bool:
+        """Check if user's tier allows this model."""
+
+        limits = await self.get_tier_limits(user_id)
+        allowed = limits['allowed_models']
+
+        if allowed == "*":
+            return True
+
+        return model in allowed
+
+    async def get_user_info(self, user_id: str) -> dict:
+        """Get comprehensive user tier information."""
+
+        result = await self.db.fetch_one("""
+            SELECT
+                u.tier,
+                u.wallet_address,
+                (u.den_token_count > 0) as has_den_token,
+                u.den_token_verified_at,
+                c.balance,
+                c.lifetime_earned,
+                c.lifetime_spent
+            FROM user_profiles u
+            LEFT JOIN user_credits c ON u.user_id = c.user_id
+            WHERE u.user_id = ?
+        """, (user_id,))
+
+        if not result:
+            raise UserNotFoundError(f"User not found: {user_id}")
+
+        tier = result['tier']
+
+        # Get limits - use get_tier_limits logic for consistency
+        if tier == 'free':
+            limits = {
+                "signup_allowance_per_token": 0,
+                "max_concurrent_sessions": 0,
+                "max_steps": 0,
+                "allowed_models": []
+            }
+        elif tier in ('x402', 'free_access'):
+            # x402 and free_access use holder limits
+            limits = self.TIER_LIMITS['holder']
+        else:
+            limits = self.TIER_LIMITS.get(tier, self.TIER_LIMITS.get('holder', {}))
+
+        return {
+            "user_id": user_id,
+            "tier": tier,
+            "wallet_address": result['wallet_address'],
+            "has_den_token": bool(result['has_den_token']),
+            "den_token_verified_at": result['den_token_verified_at'],
+            "limits": limits,
+            "credits": {
+                "balance": result['balance'] or 0,
+                "lifetime_earned": result['lifetime_earned'] or 0,
+                "lifetime_spent": result['lifetime_spent'] or 0
+            }
+        }

modules/base_module.py

@@ -0,0 +1,190 @@
+"""Base module class for core functionality modules."""
+
+from typing import Dict, Any, Optional, List, TYPE_CHECKING, Type
+import asyncio
+import logging
+from core.base_component import BaseComponent
+from core.config import BotConfig
+from core.exceptions import ModuleError, DependencyError
+from core.logging import get_component_logger
+
+if TYPE_CHECKING:
+    from core.container import DependencyContainer
+else:
+    # Import for runtime use with forward reference
+    from core.container import DependencyContainer
+
+logger = get_component_logger('modules.base_module')
+
+class BaseModule(BaseComponent):
+    """Base class for modules."""
+
+    def __init__(self, name: str, config: BotConfig, container: Optional['DependencyContainer'] = None):
+        """Initialize base module.
+        
+        Args:
+            name: Module name
+            config: Bot configuration
+            container: Optional dependency container
+        """
+        super().__init__(name=name, config=config, container=container)
+        self._modules = {}  # For module-specific dependencies
+        self.logger = get_component_logger(f"modules.{name}")
+        self._lock = asyncio.Lock()
+        self._initialized = False
+        self.component = self  # Forward reference
+
+    @property
+    def required_dependencies(self) -> List[str]:
+        """Get module's required dependencies."""
+        return list(self.required_modules.keys())
+
+    @property
+    def required_modules(self) -> Dict[str, str]:
+        """Get required modules with descriptions."""
+        return {}
+
+    @property
+    def optional_modules(self) -> Dict[str, str]:
+        """Get optional modules."""
+        return {}
+
+    async def initialize(self) -> None:
+        """Initialize module."""
+        if self._initialized:
+            return
+
+        async with self._lock:
+            if self._initialized:
+                return
+                
+            try:
+                # Register required dependencies from container if available
+                if self.container:
+                    for module_name in self.required_modules.keys():
+                        service = self.container.get_service(module_name)
+                        if service:
+                            self.set_module(module_name, service)
+                
+                # Validate dependencies first
+                try:
+                    self.validate_dependencies()
+                except DependencyError as e:
+                    self.logger.warning(f"Dependency validation failed: {e}")
+                    # Continue initialization - optional modules might be missing
+                
+                # Call module-specific initialization
+                await self._initialize()
+                self._initialized = True
+                
+                # Restore INFO level to ensure visibility of successful initialization
+                self.logger.info(f"✨ {self.name} initialized successfully")
+            except Exception as e:
+                self.logger.error(f"Failed to initialize {self.name}: {e}")
+                raise ModuleError(f"Failed to initialize module {self.name}: {e}")
+
+    async def cleanup(self) -> None:
+        """Clean up module resources."""
+        if not self._initialized:
+            return
+
+        async with self._lock:
+            try:
+                await self._cleanup()
+                self._initialized = False
+                self.logger.info(f"{self.name} cleaned up successfully")
+            except Exception as e:
+                self.logger.error(f"Failed to clean up {self.name}: {e}")
+                raise ModuleError(f"Failed to clean up module {self.name}: {e}")
+
+    async def _initialize(self) -> None:
+        """Module-specific initialization."""
+        pass
+
+    async def _cleanup(self) -> None:
+        """Module-specific cleanup."""
+        pass
+
+    def set_module(self, name: str, module: Any) -> None:
+        """Set a required module."""
+        self._modules[name] = module
+
+    def get_module(self, name: str) -> Optional[Any]:
+        """Get a module by name."""
+        return self._modules.get(name)
+
+    def validate_dependencies(self) -> None:
+        """Validate module dependencies."""
+        missing = []
+        for module_name, description in self.required_modules.items():
+            # Check both _modules dictionary and container services
+            module_exists = module_name in self._modules
+            container_has_service = self.container and self.container.has_service(module_name)
+            
+            if not (module_exists or container_has_service):
+                missing.append(f"{module_name} ({description})")
+
+        if missing:
+            raise DependencyError(
+                f"Module {self.name} missing required modules: {', '.join(missing)}"
+            )
+
+        # Log missing optional modules
+        missing_optional = []
+        for module_name, description in self.optional_modules.items():
+            module_exists = module_name in self._modules
+            container_has_service = self.container and self.container.has_service(module_name)
+            
+            if not (module_exists or container_has_service):
+                missing_optional.append(f"{module_name} ({description})")
+
+        if missing_optional:
+            self.logger.info(
+                f"Module {self.name} missing optional modules: {', '.join(missing_optional)}"
+            )
+
+    async def _validate_dependencies(self) -> None:
+        """Validate component dependencies."""
+        if not self.container:
+            return
+            
+        missing = []
+        for dep in self.required_dependencies:
+            if not self.container.has_service(dep) and dep not in self._modules:
+                missing.append(dep)
+                
+        if missing:
+            raise DependencyError(f"Missing required dependencies: {', '.join(missing)}")
+
+    def get_status(self) -> Dict[str, Any]:
+        """Get module status information.
+        
+        Returns:
+            Dict containing status information including initialization state
+        """
+        return {
+            "name": self.name,
+            "initialized": self._initialized,
+            "module_type": self.__class__.__name__,
+            "has_container": self.container is not None
+        }
+
+def initialize_module(module_name: str, module_class: Type, container: DependencyContainer) -> bool:
+    """Initialize a module and register it with the container."""
+    try:
+        logger.debug(f"Initializing module {module_name}...")
+        
+        # Create and initialize the module
+        module = module_class(name=module_name, config=container.config, container=container)
+        asyncio.run(module.initialize())
+        
+        # Register with container
+        container.register_service(module_name, module)
+        
+        # Log success at debug level - higher level logs should come from the initialization module
+        logger.debug(f"{module_name} initialized successfully")
+        return True
+        
+    except Exception as e:
+        logger.error(f"Failed to initialize module {module_name}: {e}")
+        return False 

modules/credits/__init__.py

@@ -0,0 +1,29 @@
+"""Credit system modules for tracking and metering usage."""
+
+from .balance_manager import CreditBalanceManager
+from .usage_tracker import LLMUsageTracker, UsageRecord, CostBreakdown
+from .pricing import pricing, PricingConfig, WELCOME_BONUS, DEN_SIGNUP_ALLOWANCE
+from .cost_utils import calculate_cost_from_tokens, calculate_user_cost, get_cost_breakdown
+
+# DEPRECATED: UsageMeter - use LLMUsageTracker instead
+# Keeping import for backward compatibility during migration
+from .usage_meter import UsageMeter
+
+__all__ = [
+    # Core components
+    'CreditBalanceManager',
+    'LLMUsageTracker',  # PRIMARY - use this for LLM tracking
+    'UsageRecord',
+    'CostBreakdown',
+    'pricing',
+    'PricingConfig',
+    # Credit bonus constants (single source of truth)
+    'WELCOME_BONUS',
+    'DEN_SIGNUP_ALLOWANCE',
+    # Shared utilities
+    'calculate_cost_from_tokens',
+    'calculate_user_cost',
+    'get_cost_breakdown',
+    # Deprecated
+    'UsageMeter',  # DEPRECATED - will be removed in future version
+]