748 lines
25 KiB
TypeScript
748 lines
25 KiB
TypeScript
import { createHash, randomBytes, randomUUID } from "node:crypto";
|
|
import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
|
|
import os from "node:os";
|
|
|
|
import type { ResolvedConfig } from "../config/index.js";
|
|
import type { Logger } from "../logger/types.js";
|
|
import { HUB_SHARED_MEMORY_TOMBSTONE_TTL_MS } from "../storage/repos/hub.js";
|
|
import type {
|
|
HubAuthState,
|
|
HubRole,
|
|
HubSharedMemoryRecord,
|
|
HubSharedMemorySearchHit,
|
|
HubSharedSkillRecord,
|
|
HubUserRecord,
|
|
} from "../storage/repos/hub.js";
|
|
import type { EmbeddingVector } from "../types.js";
|
|
import { issueUserToken, verifyUserToken } from "./auth.js";
|
|
|
|
type HubRepo = import("../storage/repos/index.js").Repos["hub"];
|
|
type HubSharedMemoryInput = Omit<
|
|
HubSharedMemoryRecord,
|
|
"id" | "sourceUserId" | "visible" | "deletedAt" | "createdAt" | "updatedAt"
|
|
>;
|
|
|
|
export interface HubServerSnapshot {
|
|
url: string;
|
|
port: number;
|
|
hubInstanceId: string;
|
|
ownerUserId: string;
|
|
ownerToken: string;
|
|
}
|
|
|
|
export interface AuthenticatedHubUser {
|
|
userId: string;
|
|
username: string;
|
|
role: HubRole;
|
|
}
|
|
|
|
export class HubServerRuntime {
|
|
private server: Server | null = null;
|
|
private actualPort = 0;
|
|
private authState: HubAuthState;
|
|
private owner: { userId: string; token: string } | null = null;
|
|
|
|
constructor(
|
|
private readonly deps: {
|
|
repo: HubRepo;
|
|
config: ResolvedConfig;
|
|
log: Logger;
|
|
version: string;
|
|
},
|
|
) {
|
|
this.authState = this.loadAuthState();
|
|
}
|
|
|
|
async start(): Promise<HubServerSnapshot> {
|
|
if (this.server?.listening && this.owner) {
|
|
return this.snapshot();
|
|
}
|
|
const token = this.teamToken;
|
|
if (!token) {
|
|
throw new Error("hub.teamToken is required when hub.role=hub");
|
|
}
|
|
|
|
this.server = createServer((req, res) => {
|
|
void this.handle(req, res).catch((err) => {
|
|
this.deps.log.warn("hub.request.failed", {
|
|
err: err instanceof Error ? err.message : String(err),
|
|
});
|
|
this.json(res, 500, { error: "internal_error" });
|
|
});
|
|
});
|
|
|
|
let listenPort = this.configuredPort;
|
|
await new Promise<void>((resolve, reject) => {
|
|
let retries = 0;
|
|
const onError = (err: NodeJS.ErrnoException) => {
|
|
if (err.code === "EADDRINUSE" && retries < 3) {
|
|
retries++;
|
|
listenPort = this.configuredPort + retries;
|
|
this.deps.log.warn("hub.port.busy_retry", { port: listenPort - 1, nextPort: listenPort });
|
|
this.server!.listen(listenPort, "0.0.0.0");
|
|
return;
|
|
}
|
|
this.server?.off("listening", onListening);
|
|
reject(err);
|
|
};
|
|
const onListening = () => {
|
|
this.server?.off("error", onError);
|
|
resolve();
|
|
};
|
|
this.server!.on("error", onError);
|
|
this.server!.once("listening", onListening);
|
|
this.server!.listen(listenPort, "0.0.0.0");
|
|
});
|
|
|
|
this.actualPort = listenPort;
|
|
this.owner = this.ensureBootstrapAdmin();
|
|
this.pruneExpiredSharedMemories();
|
|
this.deps.log.info("hub.started", {
|
|
url: `http://127.0.0.1:${this.actualPort}`,
|
|
bindHost: "0.0.0.0",
|
|
teamName: this.teamName,
|
|
});
|
|
return this.snapshot();
|
|
}
|
|
|
|
async stop(): Promise<void> {
|
|
const server = this.server;
|
|
this.server = null;
|
|
this.owner = null;
|
|
if (!server) return;
|
|
await new Promise<void>((resolve) => server.close(() => resolve()));
|
|
this.deps.log.info("hub.stopped", {});
|
|
}
|
|
|
|
snapshot(): HubServerSnapshot {
|
|
if (!this.owner) {
|
|
throw new Error("hub server has not started");
|
|
}
|
|
return {
|
|
url: `http://127.0.0.1:${this.actualPort || this.configuredPort}`,
|
|
port: this.actualPort || this.configuredPort,
|
|
hubInstanceId: this.hubInstanceId,
|
|
ownerUserId: this.owner.userId,
|
|
ownerToken: this.owner.token,
|
|
};
|
|
}
|
|
|
|
get hubInstanceId(): string {
|
|
return this.authState.hubInstanceId!;
|
|
}
|
|
|
|
get ownerUserId(): string {
|
|
return this.owner?.userId ?? this.authState.bootstrapAdminUserId ?? "";
|
|
}
|
|
|
|
get ownerToken(): string {
|
|
return this.owner?.token ?? this.authState.bootstrapAdminToken ?? "";
|
|
}
|
|
|
|
approveUser(userId: string): { token: string; user: HubUserRecord } | null {
|
|
const user = this.deps.repo.getUser(userId);
|
|
if (!user) return null;
|
|
const token = this.issueToken(user, "member");
|
|
const updated: HubUserRecord = {
|
|
...user,
|
|
role: "member",
|
|
status: "active",
|
|
tokenHash: hashToken(token),
|
|
approvedAt: Date.now(),
|
|
};
|
|
this.deps.repo.upsertUser(updated);
|
|
return { token, user: updated };
|
|
}
|
|
|
|
rejectUser(userId: string): HubUserRecord | null {
|
|
const user = this.deps.repo.getUser(userId);
|
|
if (!user) return null;
|
|
const updated: HubUserRecord = {
|
|
...user,
|
|
status: "rejected",
|
|
rejectedAt: Date.now(),
|
|
tokenHash: "",
|
|
};
|
|
this.deps.repo.upsertUser(updated);
|
|
return updated;
|
|
}
|
|
|
|
removeUser(userId: string): HubUserRecord | null {
|
|
const user = this.deps.repo.getUser(userId);
|
|
if (!user || user.role === "admin") return null;
|
|
const updated: HubUserRecord = {
|
|
...user,
|
|
status: "removed",
|
|
tokenHash: "",
|
|
removedAt: Date.now(),
|
|
};
|
|
this.deps.repo.upsertUser(updated);
|
|
this.deps.repo.deleteSharedMemoriesByUser(user.id);
|
|
this.deps.repo.deleteSharedSkillsByUser(user.id);
|
|
return updated;
|
|
}
|
|
|
|
publishMemoryAsOwner(input: HubSharedMemoryInput): HubSharedMemoryRecord {
|
|
return this.publishMemoryForUser(this.ownerUserId, input);
|
|
}
|
|
|
|
searchMemories(
|
|
query: string,
|
|
limit = 10,
|
|
): HubSharedMemorySearchHit[] {
|
|
this.pruneExpiredSharedMemories();
|
|
return this.deps.repo.searchSharedMemories(query, limit);
|
|
}
|
|
|
|
unpublishMemoryAsOwner(sourceTraceId: string): void {
|
|
this.deps.repo.hideSharedMemoryBySource(this.ownerUserId, sourceTraceId);
|
|
}
|
|
|
|
publishSkillAsOwner(input: Omit<HubSharedSkillRecord, "id" | "sourceUserId" | "createdAt" | "updatedAt">): HubSharedSkillRecord {
|
|
return this.publishSkillForUser(this.ownerUserId, input);
|
|
}
|
|
|
|
unpublishSkillAsOwner(sourceSkillId: string): void {
|
|
this.deps.repo.deleteSharedSkillBySource(this.ownerUserId, sourceSkillId);
|
|
}
|
|
|
|
private async handle(req: IncomingMessage, res: ServerResponse): Promise<void> {
|
|
const url = new URL(req.url ?? "/", `http://127.0.0.1:${this.actualPort || this.configuredPort}`);
|
|
const path = url.pathname;
|
|
const method = (req.method ?? "GET").toUpperCase();
|
|
|
|
if (method === "GET" && path === "/api/v1/hub/info") {
|
|
return this.json(res, 200, {
|
|
teamName: this.teamName,
|
|
version: this.deps.version,
|
|
apiVersion: "v1",
|
|
hubInstanceId: this.hubInstanceId,
|
|
});
|
|
}
|
|
|
|
if (method === "POST" && path === "/api/v1/hub/join") {
|
|
const body = await this.readJson(req);
|
|
if (!body || body.teamToken !== this.teamToken) {
|
|
return this.json(res, 403, { error: "invalid_team_token" });
|
|
}
|
|
return this.handleJoin(req, res, body);
|
|
}
|
|
|
|
if (method === "POST" && path === "/api/v1/hub/registration-status") {
|
|
const body = await this.readJson(req);
|
|
if (!body || body.teamToken !== this.teamToken) {
|
|
return this.json(res, 403, { error: "invalid_team_token" });
|
|
}
|
|
const userId = String(body.userId || "");
|
|
const requestedUsername = optionalSafeUsername(body.username);
|
|
let user = userId ? this.deps.repo.getUser(userId) : null;
|
|
if (user && requestedUsername && user.username !== requestedUsername) {
|
|
const conflict = this.findUserByUsername(requestedUsername);
|
|
if (conflict && conflict.id !== user.id) {
|
|
return this.json(res, 409, {
|
|
error: "username_taken",
|
|
message: `Username "${requestedUsername}" is already in use.`,
|
|
});
|
|
}
|
|
user = { ...user, username: requestedUsername };
|
|
this.deps.repo.upsertUser(user);
|
|
}
|
|
if (!user && requestedUsername) {
|
|
user = this.findUserByUsername(requestedUsername);
|
|
}
|
|
if (!user) return this.json(res, 404, { error: "not_found" });
|
|
if (user.status === "active") {
|
|
const token = this.issueToken(user, user.role);
|
|
this.deps.repo.upsertUser({ ...user, tokenHash: hashToken(token) });
|
|
return this.json(res, 200, {
|
|
status: "active",
|
|
userId: user.id,
|
|
username: user.username,
|
|
identityKey: user.identityKey,
|
|
userToken: token,
|
|
});
|
|
}
|
|
return this.json(res, 200, {
|
|
status: user.status,
|
|
userId: user.id,
|
|
username: user.username,
|
|
identityKey: user.identityKey,
|
|
});
|
|
}
|
|
|
|
const auth = this.authenticate(req);
|
|
if (!auth) return this.json(res, 401, { error: "unauthorized" });
|
|
|
|
if (method === "POST" && path === "/api/v1/hub/heartbeat") {
|
|
return this.json(res, 200, { ok: true });
|
|
}
|
|
|
|
if (method === "GET" && path === "/api/v1/hub/me") {
|
|
const user = this.deps.repo.getUser(auth.userId);
|
|
if (!user) return this.json(res, 401, { error: "unauthorized" });
|
|
return this.json(res, 200, publicUser(user));
|
|
}
|
|
|
|
if (method === "GET" && path === "/api/v1/hub/admin/pending-users") {
|
|
if (auth.role !== "admin") return this.json(res, 403, { error: "forbidden" });
|
|
return this.json(res, 200, { users: this.deps.repo.listUsers("pending").map(publicUser) });
|
|
}
|
|
|
|
if (method === "GET" && path === "/api/v1/hub/admin/users") {
|
|
if (auth.role !== "admin") return this.json(res, 403, { error: "forbidden" });
|
|
const contrib = this.deps.repo.contributionsByUser();
|
|
const now = Date.now();
|
|
const users = this.deps.repo.listUsers()
|
|
.filter((u) => u.status === "active")
|
|
.map((u) => ({
|
|
...publicUser(u),
|
|
isOwner: u.id === this.ownerUserId,
|
|
isOnline: u.id === this.ownerUserId || (!!u.lastActiveAt && now - u.lastActiveAt < 2 * 60_000),
|
|
memoryCount: contrib[u.id]?.memoryCount ?? 0,
|
|
skillCount: contrib[u.id]?.skillCount ?? 0,
|
|
}));
|
|
return this.json(res, 200, { users });
|
|
}
|
|
|
|
if (method === "POST" && path === "/api/v1/hub/admin/approve-user") {
|
|
if (auth.role !== "admin") return this.json(res, 403, { error: "forbidden" });
|
|
const body = await this.readJson(req);
|
|
const approved = this.approveUser(String(body?.userId ?? ""));
|
|
if (!approved) return this.json(res, 404, { error: "not_found" });
|
|
return this.json(res, 200, { status: "active", token: approved.token });
|
|
}
|
|
|
|
if (method === "POST" && path === "/api/v1/hub/admin/reject-user") {
|
|
if (auth.role !== "admin") return this.json(res, 403, { error: "forbidden" });
|
|
const body = await this.readJson(req);
|
|
const rejected = this.rejectUser(String(body?.userId ?? ""));
|
|
if (!rejected) return this.json(res, 404, { error: "not_found" });
|
|
return this.json(res, 200, { status: "rejected" });
|
|
}
|
|
|
|
if (method === "POST" && path === "/api/v1/hub/admin/remove-user") {
|
|
if (auth.role !== "admin") return this.json(res, 403, { error: "forbidden" });
|
|
const body = await this.readJson(req);
|
|
const removed = this.removeUser(String(body?.userId ?? ""));
|
|
if (!removed) return this.json(res, 404, { error: "not_found" });
|
|
return this.json(res, 200, { status: "removed" });
|
|
}
|
|
|
|
if (method === "POST" && path === "/api/v1/hub/memories/share") {
|
|
const body = await this.readJson(req);
|
|
if (!body?.memory) return this.json(res, 400, { error: "invalid_payload" });
|
|
const memory = this.publishMemoryForUser(auth.userId, normalizeMemoryPayload(body.memory));
|
|
return this.json(res, 200, { ok: true, memoryId: memory.id, visibility: "public" });
|
|
}
|
|
|
|
if (method === "POST" && path === "/api/v1/hub/memories/unshare") {
|
|
const body = await this.readJson(req);
|
|
const sourceTraceId = String(body?.sourceTraceId ?? body?.sourceChunkId ?? "");
|
|
if (!sourceTraceId) return this.json(res, 400, { error: "missing_source_trace_id" });
|
|
this.deps.repo.hideSharedMemoryBySource(auth.userId, sourceTraceId);
|
|
return this.json(res, 200, { ok: true });
|
|
}
|
|
|
|
if (method === "GET" && path === "/api/v1/hub/memories") {
|
|
this.pruneExpiredSharedMemories();
|
|
return this.json(res, 200, {
|
|
memories: this.deps.repo
|
|
.listSharedMemories(Number(url.searchParams.get("limit") || 100))
|
|
.map(publicMemory),
|
|
});
|
|
}
|
|
|
|
if (method === "POST" && path === "/api/v1/hub/memories/search") {
|
|
const body = await this.readJson(req);
|
|
const query = String(body.query ?? "");
|
|
const limit = Number(body.limit ?? body.maxResults ?? 10);
|
|
return this.json(res, 200, {
|
|
memories: this.searchMemories(query, limit).map(publicMemory),
|
|
});
|
|
}
|
|
|
|
if (method === "POST" && path === "/api/v1/hub/skills/publish") {
|
|
const body = await this.readJson(req);
|
|
const metadata = asRecord(body?.metadata);
|
|
const bundle = asRecord(body?.bundle);
|
|
const sourceSkillId = String(metadata.id || "");
|
|
if (!sourceSkillId) return this.json(res, 400, { error: "missing_skill_id" });
|
|
const skill = this.publishSkillForUser(auth.userId, {
|
|
sourceSkillId,
|
|
name: String(metadata.name || sourceSkillId),
|
|
invocationGuide: String(metadata.invocationGuide || bundle.invocationGuide || ""),
|
|
version: Number(metadata.version || 1),
|
|
qualityScore: metadata.qualityScore == null ? null : Number(metadata.qualityScore),
|
|
bundle,
|
|
});
|
|
return this.json(res, 200, { ok: true, skillId: skill.id, visibility: "public" });
|
|
}
|
|
|
|
if (method === "POST" && path === "/api/v1/hub/skills/unpublish") {
|
|
const body = await this.readJson(req);
|
|
const sourceSkillId = String(body?.sourceSkillId || "");
|
|
if (!sourceSkillId) return this.json(res, 400, { error: "missing_skill_id" });
|
|
this.deps.repo.deleteSharedSkillBySource(auth.userId, sourceSkillId);
|
|
return this.json(res, 200, { ok: true });
|
|
}
|
|
|
|
if (method === "GET" && path === "/api/v1/hub/skills/list") {
|
|
return this.json(res, 200, {
|
|
skills: this.deps.repo.listSharedSkills(Number(url.searchParams.get("limit") || 100)),
|
|
});
|
|
}
|
|
|
|
return this.json(res, 404, { error: "not_found" });
|
|
}
|
|
|
|
private handleJoin(req: IncomingMessage, res: ServerResponse, body: Record<string, unknown>): void {
|
|
const identityKey = typeof body.identityKey === "string" ? body.identityKey.trim() : "";
|
|
const username = safeUsername(String(body.username || os.userInfo().username || "member"));
|
|
const joinIp =
|
|
(typeof body.clientIp === "string" && body.clientIp.trim()) ||
|
|
(req.headers["x-client-ip"] as string | undefined)?.trim() ||
|
|
req.socket.remoteAddress ||
|
|
"";
|
|
|
|
const nameMatch = this.findUserByUsername(username);
|
|
if (nameMatch) {
|
|
this.respondExistingJoin(res, nameMatch, identityKey, joinIp);
|
|
return;
|
|
}
|
|
|
|
const identityMatch = identityKey ? this.deps.repo.findUserByIdentityKey(identityKey) : null;
|
|
if (identityMatch) {
|
|
const conflict = this.findUserByUsername(username);
|
|
if (conflict && conflict.id !== identityMatch.id) {
|
|
return this.json(res, 409, { error: "username_taken", message: `Username "${username}" is already in use.` });
|
|
}
|
|
const renamed = identityMatch.username === username
|
|
? identityMatch
|
|
: { ...identityMatch, username };
|
|
if (renamed !== identityMatch) this.deps.repo.upsertUser(renamed);
|
|
this.respondExistingJoin(res, renamed, identityKey, joinIp);
|
|
return;
|
|
}
|
|
|
|
const now = Date.now();
|
|
const generatedIdentityKey = identityKey || randomUUID();
|
|
const user: HubUserRecord = {
|
|
id: randomUUID(),
|
|
username,
|
|
deviceName: String(body.deviceName || ""),
|
|
role: "member",
|
|
status: "pending",
|
|
tokenHash: "",
|
|
identityKey: generatedIdentityKey,
|
|
createdAt: now,
|
|
approvedAt: null,
|
|
rejectedAt: null,
|
|
leftAt: null,
|
|
removedAt: null,
|
|
lastIp: joinIp,
|
|
lastActiveAt: now,
|
|
rejoinRequestedAt: null,
|
|
};
|
|
this.deps.repo.upsertUser(user);
|
|
this.deps.log.info("hub.join.pending", { userId: user.id, username: user.username });
|
|
return this.json(res, 200, { status: "pending", userId: user.id, identityKey: generatedIdentityKey });
|
|
}
|
|
|
|
private respondExistingJoin(
|
|
res: ServerResponse,
|
|
matched: HubUserRecord,
|
|
identityKey: string,
|
|
joinIp: string,
|
|
): void {
|
|
this.deps.repo.updateUserActivity(matched.id, joinIp);
|
|
if (matched.status === "active") {
|
|
const token = this.issueToken(matched, matched.role);
|
|
const updated = {
|
|
...matched,
|
|
identityKey: matched.identityKey || identityKey,
|
|
tokenHash: hashToken(token),
|
|
};
|
|
this.deps.repo.upsertUser(updated);
|
|
return this.json(res, 200, {
|
|
status: "active",
|
|
userId: matched.id,
|
|
username: matched.username,
|
|
userToken: token,
|
|
identityKey: updated.identityKey,
|
|
});
|
|
}
|
|
if (matched.status === "pending") {
|
|
return this.json(res, 200, {
|
|
status: "pending",
|
|
userId: matched.id,
|
|
username: matched.username,
|
|
identityKey: matched.identityKey || identityKey,
|
|
});
|
|
}
|
|
if (matched.status === "rejected" || matched.status === "left" || matched.status === "removed") {
|
|
const pending: HubUserRecord = {
|
|
...matched,
|
|
status: "pending",
|
|
tokenHash: "",
|
|
identityKey: matched.identityKey || identityKey,
|
|
rejoinRequestedAt: Date.now(),
|
|
};
|
|
this.deps.repo.upsertUser(pending);
|
|
return this.json(res, 200, {
|
|
status: "pending",
|
|
userId: pending.id,
|
|
username: pending.username,
|
|
identityKey: pending.identityKey,
|
|
});
|
|
}
|
|
return this.json(res, 200, { status: matched.status, userId: matched.id, username: matched.username });
|
|
}
|
|
|
|
private findUserByUsername(username: string): HubUserRecord | null {
|
|
return this.deps.repo
|
|
.listUsers()
|
|
.find((u) => u.username === username && u.status !== "left" && u.status !== "removed") ?? null;
|
|
}
|
|
|
|
private authenticate(req: IncomingMessage): AuthenticatedHubUser | null {
|
|
const header = req.headers.authorization;
|
|
if (!header?.startsWith("Bearer ")) return null;
|
|
const token = header.slice("Bearer ".length);
|
|
const payload = verifyUserToken(token, this.authState.authSecret);
|
|
if (!payload) return null;
|
|
const user = this.deps.repo.getUser(payload.userId);
|
|
if (!user || user.status !== "active" || user.tokenHash !== hashToken(token)) return null;
|
|
const ip =
|
|
(req.headers["x-client-ip"] as string | undefined)?.trim() ||
|
|
req.socket.remoteAddress ||
|
|
"";
|
|
this.deps.repo.updateUserActivity(user.id, ip);
|
|
return { userId: user.id, username: user.username, role: user.role };
|
|
}
|
|
|
|
private publishMemoryForUser(
|
|
sourceUserId: string,
|
|
input: HubSharedMemoryInput,
|
|
): HubSharedMemoryRecord {
|
|
this.pruneExpiredSharedMemories();
|
|
const existing = this.deps.repo.getSharedMemoryBySource(sourceUserId, input.sourceTraceId);
|
|
const now = Date.now();
|
|
const memory: HubSharedMemoryRecord = {
|
|
...input,
|
|
id: existing?.id ?? randomUUID(),
|
|
sourceUserId,
|
|
visible: true,
|
|
deletedAt: null,
|
|
createdAt: existing?.createdAt ?? now,
|
|
updatedAt: now,
|
|
};
|
|
this.deps.repo.upsertSharedMemory(memory);
|
|
return memory;
|
|
}
|
|
|
|
private pruneExpiredSharedMemories(now = Date.now()): void {
|
|
const purged = this.deps.repo.purgeExpiredSharedMemories(
|
|
now - HUB_SHARED_MEMORY_TOMBSTONE_TTL_MS,
|
|
);
|
|
if (purged > 0) {
|
|
this.deps.log.info("hub.shared_memories.purged", { count: purged });
|
|
}
|
|
}
|
|
|
|
private publishSkillForUser(
|
|
sourceUserId: string,
|
|
input: Omit<HubSharedSkillRecord, "id" | "sourceUserId" | "createdAt" | "updatedAt">,
|
|
): HubSharedSkillRecord {
|
|
const existing = this.deps.repo.getSharedSkillBySource(sourceUserId, input.sourceSkillId);
|
|
const now = Date.now();
|
|
const skill: HubSharedSkillRecord = {
|
|
...input,
|
|
id: existing?.id ?? randomUUID(),
|
|
sourceUserId,
|
|
createdAt: existing?.createdAt ?? now,
|
|
updatedAt: now,
|
|
};
|
|
this.deps.repo.upsertSharedSkill(skill);
|
|
return skill;
|
|
}
|
|
|
|
private ensureBootstrapAdmin(): { userId: string; token: string } {
|
|
const now = Date.now();
|
|
const existingByState = this.authState.bootstrapAdminUserId
|
|
? this.deps.repo.getUser(this.authState.bootstrapAdminUserId)
|
|
: null;
|
|
const existing =
|
|
existingByState ??
|
|
this.deps.repo.listUsers().find((u) => u.role === "admin" && u.status === "active") ??
|
|
null;
|
|
|
|
const base: HubUserRecord = existing ?? {
|
|
id: randomUUID(),
|
|
username: "admin",
|
|
deviceName: os.hostname() || "hub",
|
|
role: "admin",
|
|
status: "active",
|
|
tokenHash: "",
|
|
identityKey: "",
|
|
createdAt: now,
|
|
approvedAt: now,
|
|
rejectedAt: null,
|
|
leftAt: null,
|
|
removedAt: null,
|
|
lastIp: "",
|
|
lastActiveAt: now,
|
|
rejoinRequestedAt: null,
|
|
};
|
|
const activeAdmin: HubUserRecord = {
|
|
...base,
|
|
role: "admin",
|
|
status: "active",
|
|
approvedAt: base.approvedAt ?? now,
|
|
};
|
|
const token = this.issueToken(activeAdmin, "admin", 3650 * 24 * 60 * 60 * 1000);
|
|
this.deps.repo.upsertUser({ ...activeAdmin, tokenHash: hashToken(token) });
|
|
this.authState.bootstrapAdminUserId = activeAdmin.id;
|
|
this.authState.bootstrapAdminToken = token;
|
|
this.saveAuthState();
|
|
return { userId: activeAdmin.id, token };
|
|
}
|
|
|
|
private issueToken(user: HubUserRecord, role: HubRole = user.role, ttlMs?: number): string {
|
|
return issueUserToken(
|
|
{ userId: user.id, username: user.username, role, status: "active" },
|
|
this.authState.authSecret,
|
|
ttlMs,
|
|
);
|
|
}
|
|
|
|
private loadAuthState(): HubAuthState {
|
|
const existing = this.deps.repo.getAuthState();
|
|
if (existing?.authSecret) {
|
|
const state = {
|
|
...existing,
|
|
hubInstanceId: existing.hubInstanceId || randomUUID(),
|
|
};
|
|
this.deps.repo.setAuthState(state);
|
|
return state;
|
|
}
|
|
const state: HubAuthState = {
|
|
authSecret: randomBytes(32).toString("hex"),
|
|
hubInstanceId: randomUUID(),
|
|
};
|
|
this.deps.repo.setAuthState(state);
|
|
return state;
|
|
}
|
|
|
|
private saveAuthState(): void {
|
|
this.deps.repo.setAuthState(this.authState);
|
|
}
|
|
|
|
private get configuredPort(): number {
|
|
return this.deps.config.hub.port || 18912;
|
|
}
|
|
|
|
private get teamName(): string {
|
|
return this.deps.config.hub.teamName || os.hostname() || "MemOS Hub";
|
|
}
|
|
|
|
private get teamToken(): string {
|
|
return this.deps.config.hub.teamToken || "";
|
|
}
|
|
|
|
private async readJson(req: IncomingMessage): Promise<Record<string, unknown>> {
|
|
const chunks: Buffer[] = [];
|
|
let size = 0;
|
|
for await (const chunk of req) {
|
|
const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
|
|
size += buf.length;
|
|
if (size > 2 * 1024 * 1024) {
|
|
throw Object.assign(new Error("request body too large"), { statusCode: 413 });
|
|
}
|
|
chunks.push(buf);
|
|
}
|
|
if (chunks.length === 0) return {};
|
|
const text = Buffer.concat(chunks).toString("utf8");
|
|
return text ? asRecord(JSON.parse(text)) : {};
|
|
}
|
|
|
|
private json(res: ServerResponse, status: number, body: unknown): void {
|
|
if (res.headersSent) return;
|
|
res.writeHead(status, { "content-type": "application/json" });
|
|
res.end(JSON.stringify(body));
|
|
}
|
|
}
|
|
|
|
function normalizeMemoryPayload(raw: unknown): HubSharedMemoryInput {
|
|
const body = asRecord(raw);
|
|
const sourceTraceId = String(body.sourceTraceId || body.sourceChunkId || "");
|
|
return {
|
|
sourceTraceId,
|
|
sourceAgent: String(body.sourceAgent || ""),
|
|
kind: String(body.kind || "trace"),
|
|
summary: String(body.summary || ""),
|
|
content: String(body.content || ""),
|
|
embedding: parseEmbeddingVector(body.embedding),
|
|
};
|
|
}
|
|
|
|
function parseEmbeddingVector(value: unknown): EmbeddingVector | null {
|
|
if (!Array.isArray(value) || value.length === 0) return null;
|
|
const out = new Float32Array(value.length);
|
|
for (let i = 0; i < value.length; i++) {
|
|
const n = Number(value[i]);
|
|
if (!Number.isFinite(n)) return null;
|
|
out[i] = n;
|
|
}
|
|
return out;
|
|
}
|
|
|
|
function asRecord(value: unknown): Record<string, unknown> {
|
|
return value && typeof value === "object" && !Array.isArray(value)
|
|
? value as Record<string, unknown>
|
|
: {};
|
|
}
|
|
|
|
function publicUser(user: HubUserRecord): Record<string, unknown> {
|
|
return {
|
|
id: user.id,
|
|
username: user.username,
|
|
name: user.username,
|
|
deviceName: user.deviceName,
|
|
role: user.role,
|
|
status: user.status,
|
|
createdAt: user.createdAt,
|
|
approvedAt: user.approvedAt,
|
|
lastIp: user.lastIp,
|
|
lastActiveAt: user.lastActiveAt,
|
|
};
|
|
}
|
|
|
|
function publicMemory(memory: HubSharedMemoryRecord & { score?: number }): Record<string, unknown> {
|
|
return {
|
|
id: memory.id,
|
|
sourceTraceId: memory.sourceTraceId,
|
|
sourceUserId: memory.sourceUserId,
|
|
sourceAgent: memory.sourceAgent,
|
|
kind: memory.kind,
|
|
summary: memory.summary,
|
|
content: memory.content,
|
|
createdAt: memory.createdAt,
|
|
updatedAt: memory.updatedAt,
|
|
...(memory.score == null ? {} : { score: memory.score }),
|
|
};
|
|
}
|
|
|
|
function hashToken(token: string): string {
|
|
return createHash("sha256").update(token).digest("hex");
|
|
}
|
|
|
|
function safeUsername(raw: string): string {
|
|
const trimmed = raw.trim().replace(/\s+/g, "-").slice(0, 32);
|
|
return trimmed.length >= 2 ? trimmed : `user-${randomUUID().slice(0, 8)}`;
|
|
}
|
|
|
|
function optionalSafeUsername(raw: unknown): string {
|
|
if (typeof raw !== "string" || !raw.trim()) return "";
|
|
return safeUsername(raw);
|
|
}
|