145 lines
4.1 KiB
JavaScript
145 lines
4.1 KiB
JavaScript
import express from 'express';
|
|
import { actions } from './actions.mjs';
|
|
import { enqueue, get_entry, list_pending, resolve } from './queue.mjs';
|
|
import { load_secrets } from './secrets.mjs';
|
|
import { create_auth_middleware, check_can_approve } from './auth.mjs';
|
|
|
|
function get_arg(argv, flag) {
|
|
const i = argv.indexOf(flag);
|
|
return i !== -1 ? argv[i + 1] : null;
|
|
}
|
|
|
|
function ts() {
|
|
return new Date().toLocaleTimeString();
|
|
}
|
|
|
|
const PORT = process.env.CONDUIT_PORT || 3015;
|
|
const BIND = get_arg(process.argv, '--bind') || process.env.CONDUIT_BIND || '127.0.0.1';
|
|
const VERBOSE = process.argv.includes('--verbose');
|
|
|
|
const secrets_path = get_arg(process.argv, '--secrets');
|
|
let secrets;
|
|
try {
|
|
secrets = load_secrets(secrets_path);
|
|
} catch (err) {
|
|
console.error(`Fatal: ${err.message}`);
|
|
process.exit(1);
|
|
}
|
|
const { users } = secrets;
|
|
|
|
const app = express();
|
|
app.use(express.json({
|
|
verify: (req, _res, buf) => {
|
|
req.raw_body = buf.toString('utf8');
|
|
},
|
|
}));
|
|
app.use(create_auth_middleware(users));
|
|
|
|
app.use((req, _res, next) => {
|
|
const is_debug = req.method === 'GET' && req.path === '/queue';
|
|
if (!is_debug || VERBOSE) {
|
|
console.log(`[${ts()}] ${req.method} ${req.path} — ${req.conduit_user}`);
|
|
}
|
|
next();
|
|
});
|
|
|
|
function validate_params(action_def, params) {
|
|
const errors = [];
|
|
for (const p of action_def.params) {
|
|
if (p.required && (params[p.name] === undefined || params[p.name] === null)) {
|
|
errors.push(`Missing required param: ${p.name}`);
|
|
}
|
|
}
|
|
return errors;
|
|
}
|
|
|
|
// POST /action — main entry point
|
|
app.post('/action', async (req, res) => {
|
|
const { action, ...params } = req.body ?? {};
|
|
|
|
if (!action) {
|
|
return res.status(400).json({ error: "Missing 'action' field" });
|
|
}
|
|
|
|
const def = actions[action];
|
|
if (!def) {
|
|
return res.status(404).json({ error: `Unknown action: ${action}` });
|
|
}
|
|
|
|
const errors = validate_params(def, params);
|
|
if (errors.length) {
|
|
return res.status(400).json({ error: 'Invalid params', details: errors });
|
|
}
|
|
|
|
if (def.policy === 'auto-deny') {
|
|
return res.status(403).json({ status: 'denied', reason: 'Policy: auto-deny' });
|
|
}
|
|
|
|
if (def.policy === 'auto-accept') {
|
|
try {
|
|
const result = await def.handler(params);
|
|
return res.json({ status: 'accepted', result });
|
|
} catch (err) {
|
|
return res.status(500).json({ status: 'error', error: err.message });
|
|
}
|
|
}
|
|
|
|
if (def.policy === 'queue') {
|
|
const id = enqueue(action, params, req.conduit_user);
|
|
return res.status(202).json({ status: 'queued', id });
|
|
}
|
|
});
|
|
|
|
// GET /queue — list pending items
|
|
app.get('/queue', (req, res) => {
|
|
res.json(list_pending());
|
|
});
|
|
|
|
// POST /queue/:id/approve — user approves a queued action
|
|
app.post('/queue/:id/approve', async (req, res) => {
|
|
const entry = get_entry(req.params.id);
|
|
if (!entry) {
|
|
return res.status(404).json({ error: 'Not found' });
|
|
}
|
|
if (entry.status !== 'pending') {
|
|
return res.status(409).json({ error: 'Already resolved' });
|
|
}
|
|
if (!check_can_approve(users, req.conduit_user, entry.submitted_by)) {
|
|
return res.status(403).json({ error: 'Not authorized to approve this entry' });
|
|
}
|
|
|
|
entry.resolved_by = req.conduit_user;
|
|
resolve(req.params.id, 'approved');
|
|
|
|
const def = actions[entry.action];
|
|
try {
|
|
const result = await def.handler(entry.params);
|
|
res.json({ status: 'approved', result });
|
|
} catch (err) {
|
|
res.status(500).json({ status: 'error', error: err.message });
|
|
}
|
|
});
|
|
|
|
// POST /queue/:id/deny — user denies a queued action
|
|
app.post('/queue/:id/deny', (req, res) => {
|
|
const entry = get_entry(req.params.id);
|
|
if (!entry) {
|
|
return res.status(404).json({ error: 'Not found' });
|
|
}
|
|
if (entry.status !== 'pending') {
|
|
return res.status(409).json({ error: 'Already resolved' });
|
|
}
|
|
if (!check_can_approve(users, req.conduit_user, entry.submitted_by)) {
|
|
return res.status(403).json({ error: 'Not authorized to deny this entry' });
|
|
}
|
|
|
|
entry.resolved_by = req.conduit_user;
|
|
resolve(req.params.id, 'denied');
|
|
res.json({ status: 'denied' });
|
|
});
|
|
|
|
app.listen(PORT, BIND, () => {
|
|
console.log(`claude-code-conduit server running on ${BIND}:${PORT}`);
|
|
console.log(`Workspace root: ${process.env.CONDUIT_ROOT || '/workspace'}`);
|
|
});
|