claude-code-conduit/server/index.mjs

import express from 'express';
import { actions } from './actions.mjs';
import { enqueue, get_entry, list_pending, resolve } from './queue.mjs';
import { load_secrets } from './secrets.mjs';
import { create_auth_middleware, check_can_approve } from './auth.mjs';

function get_arg(argv, flag) {
	const i = argv.indexOf(flag);
	return i !== -1 ? argv[i + 1] : null;
}

function ts() {
	return new Date().toLocaleTimeString();
}

const PORT = process.env.CONDUIT_PORT || 3015;
const BIND = get_arg(process.argv, '--bind') || process.env.CONDUIT_BIND || '127.0.0.1';

const secrets_path = get_arg(process.argv, '--secrets');
let secrets;
try {
	secrets = load_secrets(secrets_path);
} catch (err) {
	console.error(`Fatal: ${err.message}`);
	process.exit(1);
}
const { users } = secrets;

const app = express();
app.use(express.json({
	verify: (req, _res, buf) => {
		req.raw_body = buf.toString('utf8');
	},
}));
app.use(create_auth_middleware(users));

app.use((req, _res, next) => {
	console.log(`[${ts()}] ${req.method} ${req.path} — ${req.conduit_user}`);
	next();
});

function validate_params(action_def, params) {
	const errors = [];
	for (const p of action_def.params) {
		if (p.required && (params[p.name] === undefined || params[p.name] === null)) {
			errors.push(`Missing required param: ${p.name}`);
		}
	}
	return errors;
}

// POST /action  — main entry point
app.post('/action', async (req, res) => {
	const { action, ...params } = req.body ?? {};

	if (!action) {
		return res.status(400).json({ error: "Missing 'action' field" });
	}

	const def = actions[action];
	if (!def) {
		return res.status(404).json({ error: `Unknown action: ${action}` });
	}

	const errors = validate_params(def, params);
	if (errors.length) {
		return res.status(400).json({ error: 'Invalid params', details: errors });
	}

	if (def.policy === 'auto-deny') {
		return res.status(403).json({ status: 'denied', reason: 'Policy: auto-deny' });
	}

	if (def.policy === 'auto-accept') {
		try {
			const result = await def.handler(params);
			return res.json({ status: 'accepted', result });
		} catch (err) {
			return res.status(500).json({ status: 'error', error: err.message });
		}
	}

	if (def.policy === 'queue') {
		const id = enqueue(action, params, req.conduit_user);
		return res.status(202).json({ status: 'queued', id });
	}
});

// GET /queue — list pending items
app.get('/queue', (req, res) => {
	res.json(list_pending());
});

// POST /queue/:id/approve — user approves a queued action
app.post('/queue/:id/approve', async (req, res) => {
	const entry = get_entry(req.params.id);
	if (!entry) {
		return res.status(404).json({ error: 'Not found' });
	}
	if (entry.status !== 'pending') {
		return res.status(409).json({ error: 'Already resolved' });
	}
	if (!check_can_approve(users, req.conduit_user, entry.submitted_by)) {
		return res.status(403).json({ error: 'Not authorized to approve this entry' });
	}

	entry.resolved_by = req.conduit_user;
	resolve(req.params.id, 'approved');

	const def = actions[entry.action];
	try {
		const result = await def.handler(entry.params);
		res.json({ status: 'approved', result });
	} catch (err) {
		res.status(500).json({ status: 'error', error: err.message });
	}
});

// POST /queue/:id/deny — user denies a queued action
app.post('/queue/:id/deny', (req, res) => {
	const entry = get_entry(req.params.id);
	if (!entry) {
		return res.status(404).json({ error: 'Not found' });
	}
	if (entry.status !== 'pending') {
		return res.status(409).json({ error: 'Already resolved' });
	}
	if (!check_can_approve(users, req.conduit_user, entry.submitted_by)) {
		return res.status(403).json({ error: 'Not authorized to deny this entry' });
	}

	entry.resolved_by = req.conduit_user;
	resolve(req.params.id, 'denied');
	res.json({ status: 'denied' });
});

app.listen(PORT, BIND, () => {
	console.log(`claude-code-conduit server running on ${BIND}:${PORT}`);
	console.log(`Workspace root: ${process.env.CONDUIT_ROOT || '/workspace'}`);
});