voxa-code 0.1.0__py3-none-any.whl

server/cloud_app.py

@@ -0,0 +1,345 @@
+"""Voxa Cloud: the central billing API (and home of the metered V2V proxy).
+
+This is the service YOU host (not the customer's laptop), because it holds the
+minute balances and, for the metered proxy, your Gemini key. Endpoints:
+  GET  /billing/balance?account=...        -> remaining minutes
+  POST /billing/purchase?account=...        {jws} -> verify StoreKit2 txn, credit
+  GET  /healthz
+
+The metered Gemini proxy (/live) lives alongside this in production; see RUNBOOK.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import binascii
+import contextlib
+import json
+import logging
+import os
+import secrets
+import time
+import uuid
+
+from fastapi import FastAPI, Request, WebSocket, WebSocketDisconnect
+from fastapi.responses import JSONResponse
+
+from server.appattest import verify_attestation
+from server.appstore import verify_transaction
+from server.attested_store import AttestedStore
+from server.auth import bearer_user
+from server.billing import PRODUCT_MINUTES, Billing, MeteredSession
+
+
+def _default_cloud_operator_factory(account, handle_tool_call, voice=""):
+    """The proxy's V2V brain: GeminiOperator using the CLOUD's key (never the
+    customer's). Tool calls are RPC'd back to the laptop via handle_tool_call."""
+    from types import SimpleNamespace
+    from server.gemini_operator import GeminiOperator
+    cfg = SimpleNamespace(
+        gemini_api_key=os.environ["GEMINI_API_KEY"],
+        gemini_live_model=os.environ.get("GEMINI_LIVE_MODEL", "gemini-3.1-flash-live-preview"),
+    )
+    return GeminiOperator(cfg, handle_tool_call, voice=voice)
+
+
+def add_billing_routes(app: FastAPI, billing: Billing | None = None,
+                       verifier=verify_transaction, operator_factory=None,
+                       auth_secret: str | None = None,
+                       attested_store: AttestedStore | None = None,
+                       attest_verifier=verify_attestation) -> Billing:
+    """Register billing + metered /live routes on an existing app. Returns the
+    Billing instance (so the combined app can share it). Bearer is required for
+    all accounts except anonymous device accounts (ids starting with 'd-'), which
+    may use ?account=<id> (balance) or body account field (purchase) without a token.
+
+    App Attest (device attestation) is added behind VOXA_REQUIRE_ATTESTATION. When
+    that flag is OFF (default) behavior is unchanged. When ON, a d- account must
+    have registered a verified App Attest key before it can mint a free trial
+    (balance) or open a metered session (/live)."""
+    billing = billing or Billing(os.environ.get("VOXA_BILLING_FILE", "billing.json"))
+    bundle = os.environ.get("APNS_BUNDLE_ID", "").strip()
+    proxy_token = os.environ.get("VOXA_PROXY_TOKEN", "").strip()
+    auth_secret = auth_secret if auth_secret is not None else os.environ.get("VOXA_AUTH_SECRET", "")
+    operator_factory = operator_factory or _default_cloud_operator_factory
+    app.state.billing = billing
+
+    # --- App Attest: device binding (feature-flagged; off => no behavior change) ---
+    attested_store = attested_store or AttestedStore()
+    app.state.attested_store = attested_store
+    require_attestation = os.environ.get("VOXA_REQUIRE_ATTESTATION", "").strip().lower() in (
+        "1", "true", "yes", "on")
+    # app_id for App Attest is "<TeamID>.<BundleID>"; rpIdHash = sha256(app_id).
+    attest_app_id = os.environ.get("VOXA_APPATTEST_APP_ID", "").strip()
+    _attest_allow_dev = os.environ.get("VOXA_APPATTEST_ALLOW_DEV", "1").strip().lower() in (
+        "1", "true", "yes", "on")
+    _challenge_ttl = float(os.environ.get("VOXA_ATTEST_CHALLENGE_TTL", "300"))
+    _challenges: dict[str, float] = {}  # hex challenge -> issued monotonic time
+
+    def _issue_challenge() -> str:
+        now = time.monotonic()
+        # Opportunistically drop expired challenges so the set stays bounded.
+        for k in [k for k, t in _challenges.items() if now - t > _challenge_ttl]:
+            _challenges.pop(k, None)
+        ch = secrets.token_hex(32)
+        _challenges[ch] = now
+        return ch
+
+    def _consume_challenge(ch: str) -> bool:
+        """Single-use: accept a still-valid challenge exactly once."""
+        issued = _challenges.pop(ch, None)
+        return issued is not None and (time.monotonic() - issued) <= _challenge_ttl
+
+    def _attested_ok(account: str) -> bool:
+        # When attestation is required, a d- account must have a bound key. Non-d-
+        # accounts (signed-in users) are unaffected. Flag off => always True.
+        if not require_attestation or not account.startswith("d-"):
+            return True
+        return attested_store.account_is_attested(account)
+
+    # Throttle creation of NEW anonymous (d-) accounts, i.e. the free-trial grant,
+    # so random ids can't farm free minutes or open /live at will. Existing accounts
+    # and signed-in users are never throttled. (Full per-device binding is App
+    # Attest; see SECURITY.md. This bounds the abuse in the meantime.)
+    from server.ratelimit import SlidingWindowLimiter
+    _WINDOW = 3600.0
+    _per_ip = SlidingWindowLimiter(int(os.environ.get("VOXA_NEW_ACCT_PER_IP", "5")), _WINDOW)
+    _global = SlidingWindowLimiter(int(os.environ.get("VOXA_NEW_ACCT_GLOBAL", "200")), _WINDOW)
+
+    def _client_ip(conn) -> str:
+        xff = conn.headers.get("x-forwarded-for")
+        if xff:
+            return xff.split(",")[0].strip()
+        return conn.client.host if conn.client else "unknown"
+
+    def _allow_new_anon(account: str, conn) -> bool:
+        # Gates ONLY the first-touch that would mint a new anonymous trial account.
+        if not account.startswith("d-") or billing.exists(account):
+            return True
+        return _per_ip.allow(_client_ip(conn)) and _global.allow("*")
+
+    @app.get("/billing/balance")
+    async def balance(request: Request):
+        account = bearer_user(request, auth_secret)
+        if not account:
+            anon = request.query_params.get("account", "")
+            if anon.startswith("d-"):
+                account = anon
+            else:
+                return JSONResponse({"error": "unauthorized"}, status_code=401)
+        # A brand-new anonymous account over the creation limit: report 0 without
+        # minting a free trial (throttles free-minute farming).
+        if not _allow_new_anon(account, request):
+            return {"account": account, "minutes": 0.0}
+        # With attestation required, an unattested device account gets no trial.
+        if not _attested_ok(account):
+            return {"account": account, "minutes": 0.0}
+        return {"account": account, "minutes": billing.balance_minutes(account)}
+
+    @app.post("/attest/challenge")
+    async def attest_challenge():
+        """Issue a single-use, short-TTL challenge for App Attest. No auth needed:
+        the challenge is meaningless without a valid Secure Enclave attestation."""
+        return {"challenge": _issue_challenge()}
+
+    @app.post("/attest/register")
+    async def attest_register(request: Request):
+        """Bind an App-Attested Secure Enclave key to a d- account.
+
+        Body: {account, key_id(hex), attestation(base64), challenge(hex)}.
+        Verifies the attestation with real crypto; on success stores the device's
+        public key so the account counts as attested."""
+        body = await request.json()
+        account = (body or {}).get("account", "")
+        key_id_hex = (body or {}).get("key_id", "")
+        attestation_b64 = (body or {}).get("attestation", "")
+        challenge_hex = (body or {}).get("challenge", "")
+        if not account.startswith("d-"):
+            return JSONResponse({"error": "invalid account"}, status_code=400)
+        if not (key_id_hex and attestation_b64 and challenge_hex):
+            return JSONResponse({"error": "missing fields"}, status_code=400)
+        if not attest_app_id:
+            logger.error("App Attest: VOXA_APPATTEST_APP_ID not configured; cannot register")
+            return JSONResponse({"error": "attestation unavailable"}, status_code=400)
+        if not _consume_challenge(challenge_hex):
+            return JSONResponse({"error": "unknown or expired challenge"}, status_code=400)
+        import base64
+        try:
+            key_id = binascii.unhexlify(key_id_hex)
+            challenge = binascii.unhexlify(challenge_hex)
+            attestation = base64.b64decode(attestation_b64)
+        except Exception:
+            return JSONResponse({"error": "malformed input"}, status_code=400)
+        result = attest_verifier(attestation, key_id, challenge, attest_app_id,
+                                 allow_dev=_attest_allow_dev)
+        if not result:
+            return JSONResponse({"error": "attestation failed"}, status_code=400)
+        attested_store.put(key_id_hex, account, result["public_key_pem"],
+                           result["counter"])
+        return {"ok": True}
+
+    @app.post("/auth/merge")
+    async def merge(request: Request):
+        account = bearer_user(request, auth_secret)
+        if not account:
+            return JSONResponse({"error": "unauthorized"}, status_code=401)
+        body = await request.json()
+        device = (body or {}).get("device_account", "")
+        if not device:
+            return JSONResponse({"error": "missing device_account"}, status_code=400)
+        if not device.startswith("d-"):
+            return JSONResponse({"error": "invalid device_account"}, status_code=400)
+        minutes = billing.merge_account(account, device)
+        return {"ok": True, "account": account, "minutes": minutes}
+
+    @app.post("/billing/purchase")
+    async def purchase(request: Request):
+        body = await request.json()
+        account = bearer_user(request, auth_secret)
+        if not account:
+            anon = (body or {}).get("account", "")
+            if anon.startswith("d-"):
+                account = anon
+            else:
+                return JSONResponse({"error": "unauthorized"}, status_code=401)
+        jws = (body or {}).get("jws", "")
+        if not jws:
+            return JSONResponse({"error": "missing jws"}, status_code=400)
+        payload = verifier(jws, bundle_id=bundle or None)
+        if not payload:
+            return JSONResponse({"error": "invalid transaction"}, status_code=400)
+        product = payload.get("productId", "")
+        if product not in PRODUCT_MINUTES:
+            return JSONResponse({"error": f"unknown product {product}"}, status_code=400)
+        minutes = billing.apply_purchase(
+            account, product, payload.get("transactionId", "")
+        )
+        return {"ok": True, "product": product, "minutes": minutes}
+
+    @app.websocket("/live")
+    async def live(websocket: WebSocket):
+        """Metered V2V relay: the laptop connects here instead of Google. We run the
+        Gemini bridge with the cloud key, meter the account's minutes, and cut off
+        at zero. Tool calls are RPC'd back to the laptop over this same socket."""
+        account = websocket.query_params.get("account", "")
+        if (proxy_token and websocket.query_params.get("token") != proxy_token) or not account:
+            await websocket.close(code=4401)
+            return
+        # Don't let a never-seen anonymous id spin up a metered session on the
+        # cloud's Gemini key beyond the creation limit (free-minute farming guard).
+        if not _allow_new_anon(account, websocket):
+            await websocket.close(code=4403)
+            return
+        # With attestation required, refuse unattested device accounts outright.
+        if not _attested_ok(account):
+            await websocket.close(code=4405)
+            return
+        if not billing.has_minutes(account):
+            await websocket.accept()
+            await websocket.send_json({"type": "status", "status": "no minutes"})
+            await websocket.close(code=4402)
+            return
+        await websocket.accept()
+
+        loop = asyncio.get_event_loop()
+        pending: dict[str, asyncio.Future] = {}
+
+        async def handle_tool_call(name: str, args: dict) -> dict:
+            rid = uuid.uuid4().hex
+            fut = loop.create_future()
+            pending[rid] = fut
+            await websocket.send_json({"type": "tool", "id": rid, "name": name, "args": args})
+            try:
+                return await asyncio.wait_for(fut, timeout=600)
+            finally:
+                pending.pop(rid, None)
+
+        # The phone's chosen voice rode through to here; pass it to factories that
+        # accept it (keeps simpler 2-arg factories working).
+        import inspect
+        voice = websocket.query_params.get("voice", "")
+        _args = [account, handle_tool_call]
+        if "voice" in inspect.signature(operator_factory).parameters:
+            _args.append(voice)
+
+        meter = MeteredSession(billing, account)
+        async with _as_cm(operator_factory(*_args)) as op:
+            op.set_audio_out(lambda pcm: websocket.send_bytes(pcm))
+            op.set_text_out(lambda m: websocket.send_json(m))
+            # The laptop always drives the spoken opening (contextual or a generic
+            # greeting). Never let the cloud brain auto-greet, or it races ahead with a
+            # generic "what would you like to do?" before the laptop's opening arrives.
+            if hasattr(op, "suppress_greeting"):
+                op.suppress_greeting()
+
+            async def recv_loop():
+                try:
+                    while True:
+                        msg = await websocket.receive()
+                        if msg["type"] == "websocket.disconnect":
+                            break
+                        if msg.get("bytes") is not None:
+                            await op.send_audio(msg["bytes"])
+                        elif msg.get("text"):
+                            data = json.loads(msg["text"])
+                            mtype = data.get("type")
+                            if mtype == "tool_result":
+                                # Guard against a late result arriving after its future was
+                                # cancelled/timed out: set_result on a done future raises
+                                # InvalidStateError and would kill this loop.
+                                fut = pending.get(data.get("id"))
+                                if fut is not None and not fut.done():
+                                    fut.set_result(data.get("result", {}))
+                            elif mtype == "speak":
+                                await op.speak(data.get("text", ""),
+                                               immediate=bool(data.get("immediate")))
+                            elif mtype == "suppress_greeting":
+                                op.suppress_greeting()
+                            elif mtype == "user_text":
+                                await op.send_text(data.get("text", ""))
+                except (WebSocketDisconnect, RuntimeError):
+                    pass
+
+            async def metering():
+                while True:
+                    await asyncio.sleep(5)
+                    meter.tick()
+                    if meter.out_of_minutes():
+                        with contextlib.suppress(Exception):
+                            await websocket.send_json(
+                                {"type": "status", "status": "out of minutes"})
+                        return
+
+            tasks = [asyncio.ensure_future(op.run()),
+                     asyncio.ensure_future(recv_loop()),
+                     asyncio.ensure_future(metering())]
+            try:
+                await asyncio.wait(tasks, return_when=asyncio.FIRST_COMPLETED)
+            finally:
+                for t in tasks:
+                    t.cancel()
+                meter.flush()
+
+    return billing
+
+
+def create_cloud_app(billing: Billing | None = None, verifier=verify_transaction,
+                     operator_factory=None) -> FastAPI:
+    app = FastAPI()
+
+    @app.get("/healthz")
+    async def healthz():
+        return {"ok": True}
+
+    add_billing_routes(app, billing=billing, verifier=verifier,
+                       operator_factory=operator_factory)
+    return app
+
+
+@contextlib.asynccontextmanager
+async def _as_cm(obj):
+    if hasattr(obj, "__aenter__"):
+        async with obj as entered:
+            yield entered
+    else:
+        yield obj

server/config.py

@@ -0,0 +1,56 @@
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+from typing import Mapping
+
+
+@dataclass(frozen=True)
+class Config:
+    gemini_api_key: str
+    gemini_live_model: str
+    auth_token: str
+    host: str
+    port: int
+    apns_key_path: str = ""
+    apns_key: str = ""          # the .p8 contents (preferred on container hosts)
+    apns_key_id: str = ""
+    apns_team_id: str = ""
+    apns_bundle_id: str = ""
+    apns_sandbox: bool = False
+
+    @property
+    def push_enabled(self) -> bool:
+        return all([
+            (self.apns_key or self.apns_key_path), self.apns_key_id,
+            self.apns_team_id, self.apns_bundle_id,
+        ])
+
+
+def load_config(env: Mapping[str, str] | None = None) -> Config:
+    env = os.environ if env is None else env
+    api_key = env.get("GEMINI_API_KEY", "").strip()
+    auth_token = env.get("VOXA_AUTH_TOKEN", "").strip()
+    # GEMINI_API_KEY is required only in DIRECT mode (Gemini runs locally). In the
+    # metered/relay product the laptop has no key, the cloud /live proxy holds it,
+    # so it's optional here and only the server enforces having one.
+    if not api_key and not env.get("VOXA_LIVE_PROXY", "").strip():
+        raise ValueError("GEMINI_API_KEY is required (or set VOXA_LIVE_PROXY for metered mode)")
+    if not auth_token:
+        raise ValueError("VOXA_AUTH_TOKEN is required")
+    apns = {
+        "apns_key_path": env.get("APNS_KEY_PATH", "").strip(),
+        "apns_key": env.get("APNS_KEY", ""),
+        "apns_key_id": env.get("APNS_KEY_ID", "").strip(),
+        "apns_team_id": env.get("APNS_TEAM_ID", "").strip(),
+        "apns_bundle_id": env.get("APNS_BUNDLE_ID", "").strip(),
+        "apns_sandbox": env.get("APNS_SANDBOX", "").strip().lower() in ("1", "true", "yes"),
+    }
+    return Config(
+        gemini_api_key=api_key,
+        gemini_live_model=env.get("GEMINI_LIVE_MODEL", "gemini-2.0-flash-live-001").strip(),
+        auth_token=auth_token,
+        host=env.get("VOXA_HOST", "127.0.0.1").strip(),
+        port=int(env.get("VOXA_PORT", "8787")),
+        **apns,
+    )

server/device_registry.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+import json
+import os
+
+
+class DeviceRegistry:
+    """VoIP push tokens, keyed by account so the cloud can ring the right phone
+    for the right customer. Persisted as {account: [tokens]} (a legacy flat list
+    is migrated under account "")."""
+
+    def __init__(self, path: str):
+        self._path = path
+        self._by_account: dict[str, set[str]] = {}
+        if os.path.exists(path):
+            try:
+                data = json.load(open(path))
+                if isinstance(data, dict):
+                    self._by_account = {a: set(t) for a, t in data.items()}
+                elif isinstance(data, list):           # legacy flat list
+                    self._by_account = {"": set(data)}
+            except (ValueError, OSError):
+                self._by_account = {}
+
+    def register(self, token: str, account: str = "") -> None:
+        if not token:
+            return
+        s = self._by_account.setdefault(account, set())
+        if token not in s:
+            s.add(token)
+            self._flush()
+
+    def remove(self, token: str) -> None:
+        changed = False
+        for s in self._by_account.values():
+            if token in s:
+                s.discard(token)
+                changed = True
+        if changed:
+            self._flush()
+
+    def tokens(self, account: str | None = None) -> list[str]:
+        """Tokens for one account, or all tokens if account is None."""
+        if account is None:
+            return [t for s in self._by_account.values() for t in s]
+        return list(self._by_account.get(account, set()))
+
+    def _flush(self) -> None:
+        tmp = self._path + ".tmp"
+        with open(tmp, "w") as f:
+            json.dump({a: sorted(t) for a, t in self._by_account.items()}, f)
+        os.replace(tmp, self._path)