diff --git a/apps/apollo/DOCS/ADMIN_APIS.md b/apps/apollo/DOCS/ADMIN_APIS.md index 369a18de3e9..174651b7e18 100644 --- a/apps/apollo/DOCS/ADMIN_APIS.md +++ b/apps/apollo/DOCS/ADMIN_APIS.md @@ -23,6 +23,8 @@ Currently gated to self-hosted only: | `GET /api/v3/self_hosted/api_keys/list` | Returns DECRYPTED project API keys | | `POST /api/v3/self_hosted/api_keys/create` | Mints project API keys (no cloud caller — operator tool) | | `DELETE /api/v3/self_hosted/api_keys/delete/{id}` | Deletes project API keys (no cloud caller) | +| `POST /api/v3/self_hosted/auth/magic_link/send` | Sends self-hosted operator magic-link login email | +| `POST /api/v3/self_hosted/auth/magic_link/verify` | Verifies self-hosted operator magic-link login token | | `GET /api/v3/self_hosted/users/list` | Cross-tenant user directory (emails, names) | | `GET /api/v3/self_hosted/orgs/list` | Cross-tenant organization directory | | `GET /api/v3/self_hosted/projects/list` | Cross-tenant project directory | @@ -396,6 +398,7 @@ Admin routes are split across two namespaces. `admin/` holds endpoints reachable | Directory / File | Purpose | | ----------------------------------------- | ---------------------------------------------------------------------- | | `api_keys/` | Project API key administration (list / create / delete) | +| `auth/magic_link/` | Self-hosted operator magic-link login | | `heap-snapshot.ts` | Capture V8 heap snapshot (exposes in-memory keys + tokens) | | `orgs/`, `projects/` | Cross-tenant org and project administration | | `start-profiling.ts`, `stop-profiling.ts` | CPU profiling start/stop (no-op compat) | diff --git a/apps/apollo/legacy-v3-endpoints.json b/apps/apollo/legacy-v3-endpoints.json index 592447b0231..c37152f194c 100644 --- a/apps/apollo/legacy-v3-endpoints.json +++ b/apps/apollo/legacy-v3-endpoints.json @@ -125,8 +125,11 @@ "self_hosted/api_keys/create.ts", "self_hosted/api_keys/delete/[id].ts", "self_hosted/api_keys/list.ts", + "self_hosted/auth/magic_link/send.ts", + "self_hosted/auth/magic_link/verify.ts", "self_hosted/heap-snapshot.ts", "self_hosted/identify.ts", + "self_hosted/lookup/org_project.ts", "self_hosted/orgs/list.ts", "self_hosted/projects/list.ts", "self_hosted/start-profiling.ts", diff --git a/apps/apollo/oxlint.config.mjs b/apps/apollo/oxlint.config.mjs index beba73eb6d9..8311cf29034 100644 --- a/apps/apollo/oxlint.config.mjs +++ b/apps/apollo/oxlint.config.mjs @@ -1,4 +1,5 @@ import { fileURLToPath } from 'node:url' + import baseConfig, { createConfig, restrictEnvAccess, @@ -6,7 +7,6 @@ import baseConfig, { import honoConfig from '../../tooling/oxlint/hono.mjs' import nextjsConfig from '../../tooling/oxlint/nextjs.mjs' import reactConfig from '../../tooling/oxlint/react.mjs' - import legacyV3Endpoints from './legacy-v3-endpoints.json' with { type: 'json' } import unsafeTypeAssertionExclusions from './unsafe-type-assertion-exclusions.json' with { type: 'json' } @@ -145,6 +145,7 @@ export default createConfig( skipFiles: [ '/src/pages/api/v3/files/download.ts', '/src/pages/api/v3/org/internal/login.ts', + '/src/pages/api/v3/self_hosted/lookup/org_project.ts', ], }, ], diff --git a/apps/apollo/src/common/constants/email.ts b/apps/apollo/src/common/constants/email.ts index c306e18acc5..156e2a9734d 100644 --- a/apps/apollo/src/common/constants/email.ts +++ b/apps/apollo/src/common/constants/email.ts @@ -1,6 +1,78 @@ const BG_IMAGE = `https://platform.composio.dev/assets/email/bg.jpg` const LOGO_IMG_URL = `https://platform.composio.dev/assets/email/logo.png` +export function getMagicLinkEmailBody({ + title, + description, + buttonText, + url, +}: { + title: string + description: string + buttonText: string + url: string +}): string { + return ` + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

${title}

${description}

+ + + + + + +

+${buttonText} +

This link will expire in 10 minutes.

If the button does not work, copy and paste this link into your browser:

${url}

If you did not request this login link, please ignore this email. Never forward this email or share this link with anyone.

+ + +` +} + export const getEmailHTML = ({ heading, body, diff --git a/apps/apollo/src/common/utils/cookie.ts b/apps/apollo/src/common/utils/cookie.ts index 32acfa41f5f..c5916268c4c 100644 --- a/apps/apollo/src/common/utils/cookie.ts +++ b/apps/apollo/src/common/utils/cookie.ts @@ -69,6 +69,16 @@ export const getPrefersOldDashboardCookieAttrs = () => { export const PREFERS_OLD_DASHBOARD_MAX_AGE_SECONDS = COOKIE_DEFAULTS.PREFERS_OLD_DASHBOARD_MAX_AGE_SECONDS +export const resolvePrefersOldDashboardCookieValue = ( + value: boolean | undefined, +): boolean => { + if (isSelfHosted) { + return true + } + + return value ?? false +} + export const setPrefersOldDashboardCookie = ( c: Context, value: boolean, diff --git a/apps/apollo/src/common/utils/cookie.unit.test.ts b/apps/apollo/src/common/utils/cookie.unit.test.ts new file mode 100644 index 00000000000..660f8c626d4 --- /dev/null +++ b/apps/apollo/src/common/utils/cookie.unit.test.ts @@ -0,0 +1,35 @@ +import { describe, expect, it, vi } from 'vitest' + +const mockedEnv = vi.hoisted(() => ({ + COMPOSIO_ENV: 'local', + SELF_HOSTED: false, +})) + +vi.mock('@/src/env', () => ({ + env: mockedEnv, + isProduction: () => false, +})) + +const loadCookieUtils = async (selfHosted: boolean) => { + vi.resetModules() + mockedEnv.SELF_HOSTED = selfHosted + return import('./cookie') +} + +describe('resolvePrefersOldDashboardCookieValue', () => { + it('defaults to new dashboard outside self-hosted', async () => { + const { resolvePrefersOldDashboardCookieValue } = + await loadCookieUtils(false) + + expect(resolvePrefersOldDashboardCookieValue(undefined)).toBe(false) + expect(resolvePrefersOldDashboardCookieValue(true)).toBe(true) + }) + + it('forces old dashboard in self-hosted', async () => { + const { resolvePrefersOldDashboardCookieValue } = + await loadCookieUtils(true) + + expect(resolvePrefersOldDashboardCookieValue(undefined)).toBe(true) + expect(resolvePrefersOldDashboardCookieValue(false)).toBe(true) + }) +}) diff --git a/apps/apollo/src/lib/admin_auth/CLAUDE.md b/apps/apollo/src/lib/admin_auth/CLAUDE.md index 7bf78da169f..1d6b78571e5 100644 --- a/apps/apollo/src/lib/admin_auth/CLAUDE.md +++ b/apps/apollo/src/lib/admin_auth/CLAUDE.md @@ -172,7 +172,7 @@ import { getSelfHostedAdminRouter } from '@/src/server/router/base_router' const adminRouter = getSelfHostedAdminRouter() ``` -These routes live under the **`self_hosted/`** namespace (`/api/v3/self_hosted/*`), not `admin/` — the path segment itself signals that the endpoint is operator-only. They still authenticate with the admin token. Currently: `self_hosted/api_keys/{list,create,delete/[id]}`, `self_hosted/{users,orgs,projects}/list`, `self_hosted/heap-snapshot`, `self_hosted/tenancy`, `self_hosted/{start,stop}-profiling`. The `apollo/require-admin-path` oxlint rule treats `api/v3{,.1}/self_hosted` as a valid admin namespace **and enforces that routes there use `getSelfHostedAdminRouter` specifically** — a `self_hosted/` route on plain `getAdminRouter` is a lint error, because the path advertises a cloud-404 gate that only `getSelfHostedAdminRouter` installs. The v3.1 proxy matcher rewrites `/api/v3.1/self_hosted/*` → `/api/v3/self_hosted/*`. +These routes live under the **`self_hosted/`** namespace (`/api/v3/self_hosted/*`), not `admin/` — the path segment itself signals that the endpoint is operator-only. They still authenticate with the admin token. Currently: `self_hosted/api_keys/{list,create,delete/[id]}`, `self_hosted/auth/magic_link/{send,verify}`, `self_hosted/{users,orgs,projects}/list`, `self_hosted/heap-snapshot`, `self_hosted/tenancy`, `self_hosted/{start,stop}-profiling`. The `apollo/require-admin-path` oxlint rule treats `api/v3{,.1}/self_hosted` as a valid admin namespace **and enforces that routes there use `getSelfHostedAdminRouter` specifically** — a `self_hosted/` route on plain `getAdminRouter` is a lint error, because the path advertises a cloud-404 gate that only `getSelfHostedAdminRouter` installs. The v3.1 proxy matcher rewrites `/api/v3.1/self_hosted/*` → `/api/v3/self_hosted/*`. Behavior: diff --git a/apps/apollo/src/lib/authMiddleware.ts b/apps/apollo/src/lib/authMiddleware.ts index 7d39b2bca88..ee7c7be95cb 100644 --- a/apps/apollo/src/lib/authMiddleware.ts +++ b/apps/apollo/src/lib/authMiddleware.ts @@ -6,7 +6,7 @@ import type { } from '@composio/types' import type { Context } from 'hono' import type { Result } from 'ts-results' -import { HEADERS } from '@/src/common/constants' +import { COOKIES, HEADERS } from '@/src/common/constants' import { logger } from '@/src/common/lib/internal/logger' import { sanitizeApiKey } from '@/src/common/utils/string' import { env } from '@/src/env' @@ -34,6 +34,7 @@ import { AuthError, USER_ERROR_MESSAGE, } from '../common/constants/error' +import { JWT } from '../common/lib/internal/auth/jwt' import { getClientIpFromHeaders, UNKNOWN_CLIENT_IP, @@ -127,6 +128,44 @@ export const extractBearerTokenFromAuthorizationHeader = ( return token.length > 0 ? token : undefined } +const getCookieValueFromHeader = ( + cookieHeader: string | undefined, + cookieName: string, +): string | undefined => { + const prefix = `${cookieName}=` + return cookieHeader + ?.split(';') + .map((cookie) => cookie.trim()) + .find((cookie) => cookie.startsWith(prefix)) + ?.substring(prefix.length) +} + +async function trySelfHostedBetterAuthSession({ + req, + disableCookie, +}: { + req: Context['req'] + disableCookie: boolean +}): Promise { + const cookieHeader = req.header('cookie') + if ( + env.SELF_HOSTED !== true || + disableCookie || + !isAuthModeEnabled('cookie') || + !cookieHeader?.includes('composio-dash') + ) { + return null + } + + const { resolveBetterAuthSession } = + await import('./better_auth/resolve_session') + + return resolveBetterAuthSession(new Headers({ cookie: cookieHeader }), { + projectIdHeader: req.header(HEADERS.X_COMPOSIO_PROJECT_ID), + orgIdHeader: req.header(HEADERS.X_COMPOSIO_ORG_ID), + }) +} + /** * Validate an admin request. Supports three authentication modes (in order): * 1. Admin JWT via `Authorization: Bearer ` (if JWT mode enabled). @@ -873,6 +912,7 @@ export const getAuthInfoFromRequest = async ( c: Context, { disableProjectAPIKey, + disableCookie = false, restrictApiKeyToSelfHosted = false, }: { disableProjectAPIKey: boolean @@ -887,6 +927,10 @@ export const getAuthInfoFromRequest = async ( const bearerToken = extractBearerTokenFromAuthorizationHeader( req.header(HEADERS.AUTHORIZATION), ) + const authTokenFromCookie = + env.SELF_HOSTED === true + ? getCookieValueFromHeader(req.header('cookie'), COOKIES.AUTH_TOKEN) + : undefined const sessionAccessKey = req.header(HEADERS.X_SESSION_ACCESS_KEY) const clientIp = getClientIpFromHeaders((name) => req.header(name)) @@ -916,8 +960,9 @@ export const getAuthInfoFromRequest = async ( // flips) must be driven from the dashboard by a signed-in admin on Composio // cloud — a leaked project / user API key must not be able to change the // tenant's security posture. Self-hosted operators are the tenant, so - // API-key automation against their own deployment is fine. Project JWTs and - // cookie auth are still permitted in cloud since both prove a signed-in user. + // API-key automation against their own deployment is fine. Project JWTs still + // pass through in any environment, while legacy authToken cookies are accepted + // only when env.SELF_HOSTED is true. const apiKeyRestrictedByEnv = restrictApiKeyToSelfHosted && env.SELF_HOSTED !== true const apiKeyRestrictedError = () => @@ -925,7 +970,7 @@ export const getAuthInfoFromRequest = async ( message: 'API key authentication is only supported in self-hosted deployments on this endpoint.', suggestedFix: - 'Use cookie authentication, or call this endpoint from a self-hosted Apollo deployment.', + 'Use a dashboard-authenticated request, or call this endpoint from a self-hosted Apollo deployment.', }) // x-session-access-key is scoped to the exact set of endpoints the @@ -1014,6 +1059,16 @@ export const getAuthInfoFromRequest = async ( } if (!userApiKey && !apiKey && !bearerToken) { + const betterAuthInfo = await trySelfHostedBetterAuthSession({ + req, + disableCookie, + }) + if (betterAuthInfo) { + return Ok(betterAuthInfo) + } + } + + if (!userApiKey && !apiKey && !bearerToken && !authTokenFromCookie) { return Err( new AuthError.NoAuth({ message: USER_ERROR_MESSAGE.NO_AUTH_PROVIDED, @@ -1087,6 +1142,92 @@ export const getAuthInfoFromRequest = async ( }) } + if (authTokenFromCookie) { + if (!isAuthModeEnabled('cookie')) { + return Err( + new AuthError.NoAuth({ + message: 'Cookie auth is disabled by DISABLE_AUTH_MODES.', + }), + ) + } + + if (disableCookie) { + return Err( + new AuthError.CookieAuthNotAllowed({ + message: USER_ERROR_MESSAGE.COOKIE_AUTH_NOT_ALLOWED, + suggestedFix: + 'This endpoint does not accept cookie/session authentication. Use a project API key (x-api-key) instead.', + }), + ) + } + + const decoded = JWT.verifyToken(authTokenFromCookie) + if (decoded.err) { + return Err(decoded.val) + } + + const projectIdFromCookie = getCookieValueFromHeader( + req.header('cookie'), + COOKIES.PROJECT_ID, + ) + const projectIdHeader = req.header(HEADERS.X_COMPOSIO_PROJECT_ID) + const orgIdFromCookie = getCookieValueFromHeader( + req.header('cookie'), + COOKIES.ORG_ID, + ) + const orgIdHeader = req.header(HEADERS.X_COMPOSIO_ORG_ID) + const orgIdValue = orgIdHeader ?? orgIdFromCookie ?? decoded.val.orgId + const projectIdValue = + projectIdHeader ?? projectIdFromCookie ?? decoded.val.projectId + const projectId = ProjectNanoIdSchema.safeParse(projectIdValue) + + const orgMember = await getMemberInfoForAPIAUth({ + orgMemberId: decoded.val.orgMemberId, + projectId: projectId.success ? projectId.data : null, + orgNanoid: orgIdValue as OrgNanoId | undefined, + cache: true, + }) + + if (orgMember.err) { + return Err(orgMember.val) + } + + if (orgMember.val.id !== decoded.val.orgMemberId) { + logger.error({ + message: 'JWT orgMemberId does not match resolved user ID', + jwtOrgMemberId: decoded.val.orgMemberId, + resolvedUserId: orgMember.val.id, + resolvedOrgNanoId: orgMember.val.org?.nanoId, + }) + return Err( + new AuthError.Unauthorized({ + message: 'Token does not match any valid user', + }), + ) + } + + return Ok({ + project: { + id: orgMember.val.project.id, + autoId: orgMember.val.project.autoId, + orgId: orgMember.val.project.orgId, + uuid: orgMember.val.project.uuid, + }, + org: { + nanoid: orgMember.val.org.nanoId, + plan: orgMember.val.org.plan, + }, + authMethod: { + cookie: '[AVAILABLE_BUT_REDACTED]', + }, + orgMember: { + id: orgMember.val.id, + email: orgMember.val.email, + role: orgMember.val.role, + }, + }) + } + return Err( new AuthError.NoAuth({ message: USER_ERROR_MESSAGE.NO_AUTH_PROVIDED, diff --git a/apps/apollo/src/lib/auth_middleware_self_hosted_cookie.unit.test.ts b/apps/apollo/src/lib/auth_middleware_self_hosted_cookie.unit.test.ts new file mode 100644 index 00000000000..3c83f5c3143 --- /dev/null +++ b/apps/apollo/src/lib/auth_middleware_self_hosted_cookie.unit.test.ts @@ -0,0 +1,205 @@ +import type { Context } from 'hono' +import { Plan, UserRole } from '@composio/db' +import { Ok } from 'ts-results' +import { beforeEach, describe, expect, it, vi } from 'vitest' + +const mockedEnv = vi.hoisted(() => ({ + DISABLE_AUTH_MODES: [] as string[], + AUTH_JWT_JWKS_URL: undefined, + AUTH_JWT_ISSUER: undefined, + AUTH_JWT_ALLOWED_ALGS: 'RS256', + AUTH_JWT_CLOCK_SKEW_SECONDS: 60, + APOLLO_ADMIN_TOKEN: 'admin-token', + JWT_SECRET: 'test-secret', + COMPOSIO_ENV: 'local', + SELF_HOSTED: false, +})) + +const { getMemberInfoForAPIAUthMock } = vi.hoisted(() => ({ + getMemberInfoForAPIAUthMock: vi.fn(), +})) + +const { resolveBetterAuthSessionMock } = vi.hoisted(() => ({ + resolveBetterAuthSessionMock: vi.fn(), +})) + +vi.mock('@/src/env', () => ({ + env: mockedEnv, +})) + +vi.mock('@/src/lib/jwt_auth', () => ({ + isAuthModeEnabled: (mode: string) => + !mockedEnv.DISABLE_AUTH_MODES.includes(mode), + isJwtAuthModeEnabled: () => false, + verifyAdminJwt: vi.fn(), + verifyIntegrationJwt: vi.fn(), +})) + +vi.mock('./org/member', () => ({ + getMemberInfoForAPIAUth: getMemberInfoForAPIAUthMock, +})) + +vi.mock('./better_auth/resolve_session', () => ({ + resolveBetterAuthSession: resolveBetterAuthSessionMock, +})) + +const { JWT } = await import('@/src/common/lib/internal/auth/jwt') +const { getAuthInfoFromRequest } = await import('./authMiddleware') + +const createRequest = (headers: Record): Context['req'] => { + const normalizedHeaders = new Map( + Object.entries(headers).map(([key, value]) => [key.toLowerCase(), value]), + ) + + return { + path: '/api/v3/org/list', + method: 'GET', + header: (name: string) => normalizedHeaders.get(name.toLowerCase()), + } as unknown as Context['req'] +} + +const createAuthToken = () => { + const token = JWT.generateToken({ + orgMemberId: 'user_123', + orgMemberEmail: 'user@example.com', + orgId: 'org_123', + projectId: 'prj_123', + }) + + if (token.err) { + throw token.val + } + + return token.val +} + +describe('getAuthInfoFromRequest self-hosted cookie auth', () => { + beforeEach(() => { + vi.clearAllMocks() + mockedEnv.DISABLE_AUTH_MODES = [] + mockedEnv.SELF_HOSTED = false + resolveBetterAuthSessionMock.mockResolvedValue(null) + getMemberInfoForAPIAUthMock.mockResolvedValue( + Ok({ + id: 'user_123', + email: 'user@example.com', + role: UserRole.ADMIN, + project: { + id: 'prj_123', + autoId: 123, + orgId: 'org_123', + uuid: 'project-uuid', + }, + createdAt: new Date(), + updatedAt: new Date(), + org: { + nanoId: 'org_123', + name: 'Test Org', + plan: Plan.STARTER, + }, + }), + ) + }) + + it('accepts Better Auth session cookies in self-hosted deployments', async () => { + mockedEnv.SELF_HOSTED = true + resolveBetterAuthSessionMock.mockResolvedValue({ + project: { + id: 'prj_better_auth', + autoId: 456, + orgId: 'org_better_auth', + uuid: 'better-auth-project-uuid', + }, + org: { + nanoid: 'org_better_auth', + plan: Plan.ENTERPRISE, + }, + authMethod: { + cookie: 'better-auth', + }, + orgMember: { + id: 'user_better_auth', + email: 'better@example.com', + role: UserRole.ADMIN, + }, + }) + + const result = await getAuthInfoFromRequest( + createRequest({ + cookie: 'composio-dash-local.session_token=session-token', + }), + {} as Context, + { disableProjectAPIKey: false }, + ) + + expect(result.ok).toBe(true) + expect(resolveBetterAuthSessionMock).toHaveBeenCalledWith( + expect.any(Headers), + { + projectIdHeader: undefined, + orgIdHeader: undefined, + }, + ) + expect(getMemberInfoForAPIAUthMock).not.toHaveBeenCalled() + if (result.ok) { + expect(result.val.authMethod.cookie).toBe('better-auth') + expect(result.val.orgMember.email).toBe('better@example.com') + expect(result.val.project.id).toBe('prj_better_auth') + } + }) + + it('ignores authToken cookies outside self-hosted deployments', async () => { + const result = await getAuthInfoFromRequest( + createRequest({ cookie: `authToken=${createAuthToken()}` }), + {} as Context, + { disableProjectAPIKey: false }, + ) + + expect(result.err).toBe(true) + expect(getMemberInfoForAPIAUthMock).not.toHaveBeenCalled() + if (result.err) { + expect(result.val.message).toBe('No authentication provided') + } + }) + + it('accepts authToken cookies in self-hosted deployments', async () => { + mockedEnv.SELF_HOSTED = true + + const result = await getAuthInfoFromRequest( + createRequest({ cookie: `authToken=${createAuthToken()}` }), + {} as Context, + { disableProjectAPIKey: false }, + ) + + expect(result.ok).toBe(true) + expect(getMemberInfoForAPIAUthMock).toHaveBeenCalledWith({ + orgMemberId: 'user_123', + projectId: 'prj_123', + orgNanoid: 'org_123', + cache: true, + }) + if (result.ok) { + expect(result.val.authMethod.cookie).toBe('[AVAILABLE_BUT_REDACTED]') + expect(result.val.orgMember.email).toBe('user@example.com') + expect(result.val.project.id).toBe('prj_123') + } + }) + + it('rejects authToken cookies on routes that disable cookie auth', async () => { + mockedEnv.SELF_HOSTED = true + + const result = await getAuthInfoFromRequest( + createRequest({ cookie: `authToken=${createAuthToken()}` }), + {} as Context, + { disableProjectAPIKey: false, disableCookie: true }, + ) + + expect(result.err).toBe(true) + expect(getMemberInfoForAPIAUthMock).not.toHaveBeenCalled() + if (result.err) { + expect(result.val.message).toBe( + 'Cookie/session authentication is not allowed for this endpoint', + ) + } + }) +}) diff --git a/apps/apollo/src/lib/better_auth/index.magic-link.unit.test.ts b/apps/apollo/src/lib/better_auth/index.magic-link.unit.test.ts new file mode 100644 index 00000000000..cfa14e4289f --- /dev/null +++ b/apps/apollo/src/lib/better_auth/index.magic-link.unit.test.ts @@ -0,0 +1,49 @@ +import { getApolloUrl } from '@/src/common/utils/env' +import { describe, expect, it } from 'vitest' + +import { betterAuthInstance, resolveMagicLinkUrlForDelivery } from './index' + +describe('Better Auth magic link', () => { + it('mounts the dashboard magic-link sign-in endpoint', async () => { + const response = await betterAuthInstance.handler( + new Request(`${getApolloUrl()}/api/v3/auth/dash/sign-in/magic-link`, { + method: 'POST', + headers: { + 'Content-Type': 'application/json', + Origin: 'http://localhost:3000', + }, + body: JSON.stringify({ + email: 'not-an-email', + }), + }), + ) + + expect(response.status).toBe(400) + }) + + it('rewrites self-hosted magic links to the dashboard origin', () => { + const url = resolveMagicLinkUrlForDelivery( + 'http://localhost:9900/api/v3/auth/dash/magic-link/verify?token=magic-token&callbackURL=http%3A%2F%2Flocalhost%3A3000%2F', + { + selfHosted: true, + dashboardURL: 'http://localhost:3000', + }, + ) + + expect(url).toBe( + 'http://localhost:3000/api/v3/auth/dash/magic-link/verify?token=magic-token&callbackURL=http%3A%2F%2Flocalhost%3A3000%2F', + ) + }) + + it('leaves cloud magic links unchanged', () => { + const url = + 'https://api.composio.dev/api/v3/auth/dash/magic-link/verify?token=magic-token' + + expect( + resolveMagicLinkUrlForDelivery(url, { + selfHosted: false, + dashboardURL: 'https://connect.composio.dev', + }), + ).toBe(url) + }) +}) diff --git a/apps/apollo/src/lib/better_auth/index.ts b/apps/apollo/src/lib/better_auth/index.ts index 2232a2a4c5e..7c531da8644 100644 --- a/apps/apollo/src/lib/better_auth/index.ts +++ b/apps/apollo/src/lib/better_auth/index.ts @@ -1,4 +1,9 @@ import { COOKIES } from '@/src/common/constants' +import { + getEmailHTML, + getMagicLinkEmailBody, +} from '@/src/common/constants/email' +import { sendEmail } from '@/src/common/lib/external/email' import { trackGA4Conversion } from '@/src/common/lib/external/ga4' import { trackMetaConversion } from '@/src/common/lib/external/meta' import { redisProvider } from '@/src/common/lib/external/redis' @@ -12,6 +17,7 @@ import { logger } from '@/src/common/lib/internal/logger' import { getPrefersOldDashboardCookieAttrs, PREFERS_OLD_DASHBOARD_MAX_AGE_SECONDS, + resolvePrefersOldDashboardCookieValue, } from '@/src/common/utils/cookie' import { getApolloUrl, @@ -26,7 +32,7 @@ import { sanitizeLogMessage, sanitizeTraceback, } from '@/src/common/utils/string' -import { safeExecuteAsync } from '@/src/common/utils/tsResults' +import { safeExecute, safeExecuteAsync } from '@/src/common/utils/tsResults' import { env } from '@/src/env' import { DB_BETTER_AUTH_FIND } from '@/src/lib/better_auth/dbUtils' import { isToolRouterDCREnabled } from '@/src/lib/mcp/oauth/is_tool_router_dcr_enabled' @@ -39,7 +45,7 @@ import { dubAnalytics } from '@dub/better-auth' import { betterAuth } from 'better-auth' import { prismaAdapter } from 'better-auth/adapters/prisma' import { APIError, createAuthMiddleware } from 'better-auth/api' -import { jwt, testUtils } from 'better-auth/plugins' +import { jwt, magicLink, testUtils } from 'better-auth/plugins' import { Dub } from 'dub' const isLocal = env.COMPOSIO_ENV === 'local' @@ -335,6 +341,98 @@ async function startDashboardSignupWorkflows({ }) } +export const resolveMagicLinkUrlForDelivery = ( + url: string, + options: { + selfHosted?: boolean + dashboardURL?: string + } = {}, +): string => { + const selfHosted = options.selfHosted ?? env.SELF_HOSTED + if (!selfHosted) { + return url + } + + const parsedResult = safeExecute( + () => { + const magicLinkUrl = new URL(url) + const dashboardUrl = new URL(options.dashboardURL ?? getDashboardFEURL()) + magicLinkUrl.protocol = dashboardUrl.protocol + magicLinkUrl.host = dashboardUrl.host + return magicLinkUrl.toString() + }, + (error) => + error instanceof Error + ? error + : new Error(`Failed to parse magic link URL: ${String(error)}`), + ) + + if (parsedResult.err) { + logger.warn({ + message: + '[BETTER_AUTH] Failed to rewrite self-hosted magic link to dashboard origin', + error: parsedResult.val.message, + }) + return url + } + + return parsedResult.val +} + +async function sendBetterAuthMagicLinkEmail({ + email, + url, +}: { + email: string + url: string +}): Promise { + const magicLinkUrl = resolveMagicLinkUrlForDelivery(url) + + if (env.SELF_HOSTED && isLocal) { + logger.warn({ + message: + '[BETTER_AUTH] Self-hosted local magic link generated; SMTP send skipped', + email: sanitizeEmail(email), + magicLinkUrl, + }) + return + } + + logger.info({ + message: '[BETTER_AUTH] Sending magic link email', + email: sanitizeEmail(email), + }) + + const html = getEmailHTML({ + heading: 'Your magic link', + body: getMagicLinkEmailBody({ + title: 'Sign in to Composio', + description: + 'Click the button below to securely sign in to your Composio dashboard:', + buttonText: 'Sign in to Dashboard', + url: magicLinkUrl, + }), + }) + + const emailResult = await sendEmail({ + subject: 'Sign in to Composio', + html, + to: [email], + }) + + if (emailResult.err) { + logger.error({ + message: '[BETTER_AUTH] Failed to send magic link email', + ...getSafeErrorForLogs(emailResult.val), + email: sanitizeEmail(email), + }) + // eslint-disable-next-line @typescript-eslint/only-throw-error -- Better Auth APIError is not a standard Error + throw new APIError('INTERNAL_SERVER_ERROR', { + message: 'Failed to send magic link email', + }) + } +} + export const betterAuthInstance = betterAuth({ baseURL: getApolloUrl(), basePath: '/api/v3/auth/dash', @@ -388,9 +486,9 @@ export const betterAuthInstance = betterAuth({ const metadataResult = await DB_BETTER_AUTH_FIND.metadata(newSessionUserId) if (metadataResult.ok) { - // Default to `false` when unset so the cookie matches what - // /auth/session/info would write on the next refresh. - const prefers = metadataResult.val.prefers_old_dashboard ?? false + const prefers = resolvePrefersOldDashboardCookieValue( + metadataResult.val.prefers_old_dashboard, + ) ctx.setCookie( COOKIES.PREFERS_OLD_DASHBOARD, prefers ? 'true' : 'false', @@ -669,6 +767,16 @@ export const betterAuthInstance = betterAuth({ }, plugins: [ + ...(env.SELF_HOSTED + ? [ + magicLink({ + expiresIn: 10 * 60, + allowedAttempts: 3, + sendMagicLink: ({ email, url }) => + sendBetterAuthMagicLinkEmail({ email, url }), + }), + ] + : []), dubAnalytics({ dubClient: dub, async customLeadTrack(user, ctx): Promise { diff --git a/apps/apollo/src/lib/better_auth/resolve_session.ts b/apps/apollo/src/lib/better_auth/resolve_session.ts new file mode 100644 index 00000000000..45703ff9052 --- /dev/null +++ b/apps/apollo/src/lib/better_auth/resolve_session.ts @@ -0,0 +1,85 @@ +import type { TAPIAuthInfo } from '@/src/lib/authMiddleware' +import { logger } from '@/src/common/lib/internal/logger' +import { + sanitizeLogMessage, + sanitizeTraceback, +} from '@/src/common/utils/string' +import { getMemberInfoForAPIAUth } from '@/src/lib/org/member' +import { Plan } from '@composio/db' +import { OrgNanoIdSchema, ProjectNanoIdSchema } from '@composio/types' + +import { BETTER_AUTH_COOKIE_PREFIX, betterAuthInstance } from './index' + +export async function resolveBetterAuthSession( + headers: Headers, + opts?: { + projectIdHeader?: string + orgIdHeader?: string + }, +): Promise { + const cookieHeader = headers.get('cookie') + if (!cookieHeader?.includes(BETTER_AUTH_COOKIE_PREFIX)) { + return null + } + + try { + const session = await betterAuthInstance.api.getSession({ headers }) + if (!session) { + return null + } + + const parsedOrgNanoid = OrgNanoIdSchema.safeParse(opts?.orgIdHeader) + const parsedProjectId = ProjectNanoIdSchema.safeParse(opts?.projectIdHeader) + const memberInfo = await getMemberInfoForAPIAUth({ + orgMemberId: session.user.id, + projectId: parsedProjectId.success ? parsedProjectId.data : null, + orgNanoid: parsedOrgNanoid.success ? parsedOrgNanoid.data : undefined, + cache: true, + }) + + if (!memberInfo.ok) { + return null + } + + const member = memberInfo.val + if (!member.project.id) { + logger.warn({ + message: '[BETTER_AUTH] No project found for session user', + }) + return null + } + + return { + org: { + nanoid: member.org.nanoId, + plan: Plan.ENTERPRISE, + }, + project: { + id: member.project.id, + autoId: member.project.autoId, + orgId: member.project.orgId, + uuid: member.project.uuid, + }, + authMethod: { + cookie: 'better-auth', + }, + orgMember: { + id: member.id, + email: member.email, + role: member.role, + }, + } + } catch (error) { + const normalizedError = + error instanceof Error ? error : new Error(String(error)) + logger.error({ + message: '[BETTER_AUTH] Error resolving session', + sanitizedErrorName: normalizedError.name, + sanitizedErrorMessage: sanitizeLogMessage(normalizedError.message), + sanitizedErrorStack: normalizedError.stack + ? sanitizeTraceback(normalizedError.stack) + : undefined, + }) + return null + } +} diff --git a/apps/apollo/src/lib/self_hosted_magic_links/db_utils.ts b/apps/apollo/src/lib/self_hosted_magic_links/db_utils.ts new file mode 100644 index 00000000000..9e8121b4ffb --- /dev/null +++ b/apps/apollo/src/lib/self_hosted_magic_links/db_utils.ts @@ -0,0 +1,89 @@ +import type { + Error_400, + Error_404, + Error_500, +} from '@/src/common/constants/error' +import type { + MagicLink, + MagicLinkStatus, +} from '@/src/common/lib/external/prisma' +import type { Result } from 'ts-results' +import { MagicLinkError } from '@/src/common/constants/error' +import { prisma, wrapPrisma } from '@/src/common/lib/external/prisma' +import { Err, Ok } from 'ts-results' + +export class DB_SELF_HOSTED_MAGIC_LINK { + static async create(params: { + token: string + email: string + }): Promise> { + const result = await wrapPrisma( + prisma.magicLink.create({ + data: { + token: params.token, + email: params.email, + }, + }), + ) + + if (result.err) { + return Err( + new MagicLinkError.InternalServerError({ + message: 'Failed to create magic link', + }), + ) + } + + return Ok(result.val) + } + + static async findByToken( + token: string, + ): Promise> { + const result = await wrapPrisma( + prisma.magicLink.findUnique({ + where: { token }, + }), + ) + + if (result.err) { + return Err( + new MagicLinkError.InternalServerError({ + message: 'Failed to get magic link', + }), + ) + } + + if (!result.val) { + return Err( + new MagicLinkError.ResourceNotFound({ + message: 'Magic link not found', + }), + ) + } + + return Ok(result.val) + } + + static async updateStatus( + token: string, + status: MagicLinkStatus, + ): Promise> { + const result = await wrapPrisma( + prisma.magicLink.update({ + where: { token }, + data: { status }, + }), + ) + + if (result.err) { + return Err( + new MagicLinkError.InternalServerError({ + message: 'Failed to update magic link status', + }), + ) + } + + return Ok(result.val) + } +} diff --git a/apps/apollo/src/lib/self_hosted_magic_links/email.ts b/apps/apollo/src/lib/self_hosted_magic_links/email.ts new file mode 100644 index 00000000000..cabc5a30558 --- /dev/null +++ b/apps/apollo/src/lib/self_hosted_magic_links/email.ts @@ -0,0 +1,114 @@ +import type { Error_400, Error_500 } from '@/src/common/constants/error' +import type { Result } from 'ts-results' +import { + getEmailHTML, + getMagicLinkEmailBody, +} from '@/src/common/constants/email' +import { sendEmail } from '@/src/common/lib/external/email' +import { logger } from '@/src/common/lib/internal/logger' +import { getDashboardFEURL, getMCPFEURL } from '@/src/common/utils/env' +import { sanitizeEmail } from '@/src/common/utils/string' +import { constructURL } from '@/src/common/utils/url' +import { Err, Ok } from 'ts-results' +import { v4 as uuid } from 'uuid' + +import { DB_SELF_HOSTED_MAGIC_LINK } from './db_utils' + +export type SendSelfHostedMagicLinkParams = { + email: string + verify_host?: string + is_mcp: boolean +} + +const createMagicLinkForEmail = async ( + email: string, +): Promise> => { + const token = uuid() + + const result = await DB_SELF_HOSTED_MAGIC_LINK.create({ + token, + email, + }) + + if (result.err) { + return Err(result.val) + } + + return Ok(result.val.token) +} + +const getDefaultVerifyHost = (isMcp: boolean): string => { + return isMcp + ? `${getMCPFEURL()}/verify` + : `${getDashboardFEURL()}/auth/verify` +} + +const buildMagicLinkUrl = ({ + verify_host, + token, +}: { + verify_host: string + token: string +}): Result => { + const urlResult = constructURL(verify_host, { + throwErrorOnInvalidURL: true, + }) + + if (urlResult.err) { + return Err(urlResult.val) + } + + urlResult.val.searchParams.set('token', token) + return Ok(urlResult.val.toString()) +} + +export const sendSelfHostedMagicLink = async ({ + email, + verify_host, + is_mcp, +}: SendSelfHostedMagicLinkParams): Promise< + Result +> => { + const token = await createMagicLinkForEmail(email) + if (token.err) { + return Err(token.val) + } + + const magicLinkUrl = buildMagicLinkUrl({ + verify_host: verify_host ?? getDefaultVerifyHost(is_mcp), + token: token.val, + }) + if (magicLinkUrl.err) { + return Err(magicLinkUrl.val) + } + + logger.info({ + message: `self_hosted_magic_link_sent to ${sanitizeEmail(email)}`, + }) + + const html = getEmailHTML({ + heading: is_mcp ? 'Magic Link for MCP' : 'Your magic link', + body: getMagicLinkEmailBody({ + title: is_mcp + ? 'Sign in to Composio MCP Dashboard' + : 'Sign in to Composio', + description: `Click the button below to securely sign in to your Composio ${ + is_mcp ? 'MCP ' : '' + }dashboard:`, + buttonText: is_mcp ? 'Sign in to MCP Dashboard' : 'Sign in to Dashboard', + url: magicLinkUrl.val, + }), + }) + + const emailResult = await sendEmail({ + subject: 'Welcome to Composio - Your Magic Link Inside!', + html, + to: [email], + }) + + if (emailResult.err) { + return Err(emailResult.val) + } + + return Ok(undefined) +} diff --git a/apps/apollo/src/lib/self_hosted_magic_links/verify.ts b/apps/apollo/src/lib/self_hosted_magic_links/verify.ts new file mode 100644 index 00000000000..9d1cc70be65 --- /dev/null +++ b/apps/apollo/src/lib/self_hosted_magic_links/verify.ts @@ -0,0 +1,98 @@ +import type { + Error_400, + Error_401, + Error_403, + Error_404, + Error_500, +} from '@/src/common/constants/error' +import type { Result } from 'ts-results' +import { HTTPErrors } from '@/src/common/constants/error' +import { MagicLinkStatus } from '@/src/common/lib/external/prisma' +import { ORG_MEMBER_SESSION_AUTH_METHOD } from '@/src/common/lib/internal/auth/constants' +import { generateSessionAuthJWT } from '@/src/common/lib/internal/auth/generateSessionJWTToken' +import { isProduction } from '@/src/env' +import { getOrCreateUserWDefaultOrg } from '@/src/lib/orgMember/getOrCreateUserWDefaultOrg' +import { Err, Ok } from 'ts-results' + +import { DB_SELF_HOSTED_MAGIC_LINK } from './db_utils' + +const EXPIRY_DURATION_MS = 1000 * 60 * 10 + +const REUSABLE_MAGIC_LINK_TOKENS = isProduction() + ? [] + : ['2e0a3d5d-835f-4485-b894-fdb8a49f9d8b'] + +export type VerifySelfHostedMagicLinkResult = { + jwt_token: string + org_id: string + email: string + member_id: string + is_new_user: boolean +} + +export const verifySelfHostedMagicLink = async ( + token: string, +): Promise< + Result< + VerifySelfHostedMagicLinkResult, + Error_400 | Error_401 | Error_403 | Error_404 | Error_500 + > +> => { + const magicLink = await DB_SELF_HOSTED_MAGIC_LINK.findByToken(token) + if (magicLink.err) { + return Err(magicLink.val) + } + + const isReusableToken = REUSABLE_MAGIC_LINK_TOKENS.includes(token) + const hasLinkExpired = + Date.now() > magicLink.val.createdAt.getTime() + EXPIRY_DURATION_MS + + if (hasLinkExpired && !isReusableToken) { + return Err( + new HTTPErrors.Unauthorized({ + message: 'Magic link has expired', + }), + ) + } + + if (magicLink.val.status !== MagicLinkStatus.PENDING && !isReusableToken) { + return Err( + new HTTPErrors.Unauthorized({ + message: 'Magic link has already been used', + }), + ) + } + + const member = await getOrCreateUserWDefaultOrg( + magicLink.val.email, + ORG_MEMBER_SESSION_AUTH_METHOD.MAGIC_LINK, + ) + if (member.err) { + return Err(member.val) + } + + const updateStatus = await DB_SELF_HOSTED_MAGIC_LINK.updateStatus( + token, + MagicLinkStatus.USED, + ) + if (updateStatus.err) { + return Err(updateStatus.val) + } + + const authToken = await generateSessionAuthJWT( + magicLink.val.email, + member.val.member.id, + ORG_MEMBER_SESSION_AUTH_METHOD.MAGIC_LINK, + ) + if (authToken.err) { + return Err(authToken.val) + } + + return Ok({ + jwt_token: authToken.val.jwtToken, + org_id: member.val.org.id, + email: authToken.val.email, + member_id: authToken.val.memberId, + is_new_user: member.val.isNewUser, + }) +} diff --git a/apps/apollo/src/pages/api/CLAUDE.md b/apps/apollo/src/pages/api/CLAUDE.md index fd768358be0..abd73ab821d 100644 --- a/apps/apollo/src/pages/api/CLAUDE.md +++ b/apps/apollo/src/pages/api/CLAUDE.md @@ -288,7 +288,7 @@ const { user, org, project, orgMember } = authResult.val | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | | `getAuthRouter()` | Standard authenticated routes | `getAuthContext()` | | `getAdminRouter(envVarNames?)` | Admin-only routes. Pass the env var names this route accepts, e.g. `['APOLLO_ADMIN_TOKEN_', 'APOLLO_ADMIN_TOKEN']`. `_NEXT` is auto-accepted for rotation. Defaults to `['APOLLO_ADMIN_TOKEN']` — currently the only admin token deployed, so every existing admin route uses this default. See [`src/lib/admin_auth/CLAUDE.md`](../../lib/admin_auth/CLAUDE.md) before introducing a scoped env var. | `getAdminAuthContext()` | -| `getSelfHostedAdminRouter(envVarNames?)` | Admin-only routes that exist purely as operator tooling and would expose customer data if reachable in cloud (cross-tenant directory listings, encryption-key migration, heap snapshots, tenancy management, API-key CRUD, profiling, revocation helpers). Cloud callers receive 404 even with a valid admin token; auth still runs first so missing/invalid tokens still return 401. **Verify no Thermos/Mercury/frontend caller depends on the route before switching from `getAdminRouter()`** — see [`src/lib/admin_auth/CLAUDE.md`](../../lib/admin_auth/CLAUDE.md). Currently gated (all under the `self_hosted/` namespace, not `admin/`): `self_hosted/api_keys/{list,create,delete/[id]}`, `self_hosted/users/list`, `self_hosted/orgs/list`, `self_hosted/projects/list`, `self_hosted/heap-snapshot`, `self_hosted/tenancy`, `self_hosted/start-profiling`, `self_hosted/stop-profiling`. The custom `apollo/require-admin-path` oxlint rule accepts both `getAdminRouter` and `getSelfHostedAdminRouter` as valid admin-router factories and treats `api/v3{,.1}/self_hosted` as a valid admin namespace alongside `api/v3{,.1}/admin` — but additionally requires that routes under `self_hosted/` use `getSelfHostedAdminRouter` specifically (plain `getAdminRouter` there is rejected, since it would skip the cloud-404 gate the path advertises). | `getAdminAuthContext()` | +| `getSelfHostedAdminRouter(envVarNames?)` | Admin-only routes that exist purely as operator tooling and would expose customer data if reachable in cloud (cross-tenant directory listings, encryption-key migration, heap snapshots, tenancy management, API-key CRUD, profiling, revocation helpers). Cloud callers receive 404 even with a valid admin token; auth still runs first so missing/invalid tokens still return 401. **Verify no Thermos/Mercury/frontend caller depends on the route before switching from `getAdminRouter()`** — see [`src/lib/admin_auth/CLAUDE.md`](../../lib/admin_auth/CLAUDE.md). Currently gated (all under the `self_hosted/` namespace, not `admin/`): `self_hosted/api_keys/{list,create,delete/[id]}`, `self_hosted/auth/magic_link/{send,verify}`, `self_hosted/users/list`, `self_hosted/orgs/list`, `self_hosted/projects/list`, `self_hosted/heap-snapshot`, `self_hosted/tenancy`, `self_hosted/start-profiling`, `self_hosted/stop-profiling`. The custom `apollo/require-admin-path` oxlint rule accepts both `getAdminRouter` and `getSelfHostedAdminRouter` as valid admin-router factories and treats `api/v3{,.1}/self_hosted` as a valid admin namespace alongside `api/v3{,.1}/admin` — but additionally requires that routes under `self_hosted/` use `getSelfHostedAdminRouter` specifically (plain `getAdminRouter` there is rejected, since it would skip the cloud-404 gate the path advertises). | `getAdminAuthContext()` | | `getOrgAuthRouter()` | Org API key routes | `getOrgAPIAuthContext()` | | `getRouter()` | Public routes (no auth) | N/A | diff --git a/apps/apollo/src/pages/api/v3/auth/session/info.ts b/apps/apollo/src/pages/api/v3/auth/session/info.ts index ca6aed1a696..a6ec0a8441e 100644 --- a/apps/apollo/src/pages/api/v3/auth/session/info.ts +++ b/apps/apollo/src/pages/api/v3/auth/session/info.ts @@ -9,7 +9,10 @@ import { wrapPrisma } from '@/src/common/lib/external/prisma' import { logger } from '@/src/common/lib/internal/logger' import { UserMetadataSchema } from '@/src/common/schema/userMetadata' import { API_AUTH, API_VISIBILITY } from '@/src/common/types/openapi' -import { setPrefersOldDashboardCookie } from '@/src/common/utils/cookie' +import { + resolvePrefersOldDashboardCookieValue, + setPrefersOldDashboardCookie, +} from '@/src/common/utils/cookie' import { listAPIKeys } from '@/src/lib/apiKeys/listAPIKeys' import { DB_BETTER_AUTH_FIND } from '@/src/lib/better_auth/dbUtils' import { getAuthContext } from '@/src/server/context/getter' @@ -407,7 +410,9 @@ export const authSessionInfo = authRouter.openapi( } else { setPrefersOldDashboardCookie( c, - userMetadata.prefers_old_dashboard ?? false, + resolvePrefersOldDashboardCookieValue( + userMetadata.prefers_old_dashboard, + ), ) } diff --git a/apps/apollo/src/pages/api/v3/auth/session/metadata.ts b/apps/apollo/src/pages/api/v3/auth/session/metadata.ts index b738be9a582..ed225ced38f 100644 --- a/apps/apollo/src/pages/api/v3/auth/session/metadata.ts +++ b/apps/apollo/src/pages/api/v3/auth/session/metadata.ts @@ -6,6 +6,7 @@ import { } from '@/src/common/schema/userMetadata' import { API_AUTH, API_VISIBILITY } from '@/src/common/types/openapi' import { setPrefersOldDashboardCookie } from '@/src/common/utils/cookie' +import { env } from '@/src/env' import { DB_BETTER_AUTH_UPDATE } from '@/src/lib/better_auth/dbUtils' import { getAuthContext } from '@/src/server/context/getter' import { vercelAPIHandler } from '@/src/server/handler/vercelHandler' @@ -49,7 +50,10 @@ const UPDATE_METADATA_DEF = createAuthRoute( }, 'Authentication', { - visibility: [API_VISIBILITY.FRONTEND], + visibility: [ + API_VISIBILITY.FRONTEND, + ...(env.SELF_HOSTED ? [API_VISIBILITY.SDK] : []), + ], authModes: [API_AUTH.COOKIE], }, ) diff --git a/apps/apollo/src/pages/api/v3/openapi.json.ts b/apps/apollo/src/pages/api/v3/openapi.json.ts index 9f47b6751f7..25bb81b7ada 100644 --- a/apps/apollo/src/pages/api/v3/openapi.json.ts +++ b/apps/apollo/src/pages/api/v3/openapi.json.ts @@ -56,7 +56,15 @@ import { routes as getProjectOwnerRoute } from './org/owner/project/[nano_id]/in import { routes as regenerateApiKeyOwnerRoute } from './org/owner/project/[nano_id]/regenerate_api_key' import { routes as listProjectsOwnerRoute } from './org/owner/project/list' import { routes as createProjectOwnerRoute } from './org/owner/project/new' +import { routes as createProjectApiKeyRoute } from './org/project/[projectId]/api_keys/create' +import { routes as listProjectApiKeysRoute } from './org/project/[projectId]/api_keys/list' +import { routes as deleteProjectApiKeyRoute } from './org/project/[projectId]/api_keys/remove/[id]' +import { routes as uploadProjectFileRoute } from './org/project/[projectId]/files/upload' +import { routes as projectConfigRoute } from './org/project/config' +import { routes as deleteProjectRoute } from './org/project/delete/[projectId]' import { routes as listProjectsRoute } from './org/project/list' +import { routes as renameProjectRoute } from './org/project/rename' +import { routes as selfHostedLookupOrgProjectRoute } from './self_hosted/lookup/org_project' import { routes as toolRouterInternalMountDownloadUrlRoute } from './tool_router/internal/mount_download_url' import { routes as toolRouterSessionCreateRoute } from './tool_router/session' import { routes as toolRouterSessionExecuteRoute } from './tool_router/session/[session_id]/execute' @@ -140,6 +148,14 @@ const routeGroups = [ // Organization owner project management ...orgListRoute, ...listProjectsRoute, + ...createProjectApiKeyRoute, + ...listProjectApiKeysRoute, + ...deleteProjectApiKeyRoute, + ...uploadProjectFileRoute, + ...projectConfigRoute, + ...deleteProjectRoute, + ...renameProjectRoute, + ...selfHostedLookupOrgProjectRoute, ...createProjectOwnerRoute, ...listProjectsOwnerRoute, ...getProjectOwnerRoute, diff --git a/apps/apollo/src/pages/api/v3/org/project/[projectId]/api_keys/create.ts b/apps/apollo/src/pages/api/v3/org/project/[projectId]/api_keys/create.ts new file mode 100644 index 00000000000..f82e917a2c4 --- /dev/null +++ b/apps/apollo/src/pages/api/v3/org/project/[projectId]/api_keys/create.ts @@ -0,0 +1,160 @@ +import type { PageConfig } from 'next' +import { + ErrorSchema, + errorToHTTPException, + HTTPErrors, +} from '@/src/common/constants/error' +import { API_AUTH, API_VISIBILITY } from '@/src/common/types/openapi' +import { env } from '@/src/env' +import { DB_API_KEY } from '@/src/lib/apiKeys/dbUtils' +import { DEFAULT_DEVELOPER_API_KEY_METADATA } from '@/src/lib/apiKeys/schema' +import { getAuthContext } from '@/src/server/context/getter' +import { vercelAPIHandler } from '@/src/server/handler/vercelHandler' +import { getAuthRouter, getRouter } from '@/src/server/router/base_router' +import { createOpenAPIResponseSchema } from '@/src/server/schema/response' +import { createAuthRoute } from '@/src/server/schema/route' +import { zpp } from '@composio/lib' +import { ProjectNanoIdSchema } from '@composio/types' +import { z } from '@hono/zod-openapi' + +const projectRouter = env.SELF_HOSTED + ? getAuthRouter({ disableProjectAPIKey: true }) + : getRouter() + +export const CreateAPIKeyRequestSchema = z + .object({ + name: z.string().describe('Descriptive name for the API key').openapi({ + description: + 'A user-friendly name to identify the API key purpose, such as "Production Server" or "Test Environment".', + example: 'Production API Key', + }), + allowed_ips: z + .array(z.string().ip()) + .optional() + .describe('List of IP addresses allowed to use this API key') + .openapi({ + description: + 'Optional IP allowlist. When set, only requests from these IP addresses will be accepted.', + example: ['203.0.113.50', '198.51.100.10'], + }), + }) + .describe('Request body for creating a new API key') + +export const APIKeySchema = z + .object({ + id: z.string().describe('Unique identifier for the API key record'), + name: z.string().describe('User-defined name for the API key'), + key: z + .string() + .describe('The API key value that should be used for authentication'), + createdAt: z.string().datetime().describe('Deprecated creation timestamp'), + created_at: z.string().datetime().describe('API key creation timestamp'), + last_used_at: z + .string() + .datetime() + .optional() + .describe('Timestamp when the API key was last used, if available'), + }) + .describe('API key object containing the key details') + +export const CreateAPIKeyResponseSchema = APIKeySchema + +const CREATE_API_KEY_DEF = createAuthRoute( + { + method: 'post', + path: '/api/v3/org/project/{projectId}/api_keys/create', + summary: 'Create project API key', + description: + 'Creates a new API key for the authenticated dashboard project. Self-hosted only.', + request: { + params: z.object({ + projectId: ProjectNanoIdSchema.describe( + 'Project nano ID to create an API key for', + ), + }), + body: { + content: { + 'application/json': { + schema: CreateAPIKeyRequestSchema, + }, + }, + }, + }, + responses: { + 201: createOpenAPIResponseSchema( + CreateAPIKeyResponseSchema, + 'API key created successfully', + ), + 400: createOpenAPIResponseSchema(ErrorSchema, 'Bad request'), + 401: createOpenAPIResponseSchema(ErrorSchema, 'Unauthorized'), + 404: createOpenAPIResponseSchema(ErrorSchema, 'Project not found'), + 500: createOpenAPIResponseSchema(ErrorSchema, 'Internal server error'), + }, + tags: ['Projects', 'API Keys'], + }, + 'Organization', + { + visibility: [API_VISIBILITY.FRONTEND], + authModes: [API_AUTH.COOKIE], + }, +) + +export const createAPIKeyRouter = env.SELF_HOSTED + ? projectRouter.openapi(CREATE_API_KEY_DEF, async (c) => { + const authInfo = getAuthContext() + if (!authInfo.ok) { + return errorToHTTPException(c, authInfo.val) + } + + const { name, allowed_ips } = c.req.valid('json') + const { projectId } = c.req.valid('param') + + if (projectId !== authInfo.val.project.id) { + return errorToHTTPException( + c, + new HTTPErrors.Unauthorized({ + message: 'Project ID does not match the authenticated project', + }), + ) + } + + const apiKey = await DB_API_KEY.createAPIKey( + projectId, + authInfo.val.orgMember.id, + { + name, + allowedIps: allowed_ips, + metadata: DEFAULT_DEVELOPER_API_KEY_METADATA, + }, + ) + + if (!apiKey.ok) { + return errorToHTTPException(c, apiKey.val) + } + + const createdAt = apiKey.val.createdAt.toISOString() + + return c.json( + zpp(APIKeySchema).new({ + id: apiKey.val.id, + name: apiKey.val.name, + key: apiKey.val.apiKey, + createdAt, + created_at: createdAt, + last_used_at: undefined, + }), + 201, + ) + }) + : projectRouter + +export const routes = env.SELF_HOSTED ? [CREATE_API_KEY_DEF] : [] + +export const config: PageConfig = { + runtime: 'nodejs', + api: { + bodyParser: false, + }, +} + +export default vercelAPIHandler(projectRouter) diff --git a/apps/apollo/src/pages/api/v3/org/project/[projectId]/api_keys/list.ts b/apps/apollo/src/pages/api/v3/org/project/[projectId]/api_keys/list.ts new file mode 100644 index 00000000000..fd109d9ee3e --- /dev/null +++ b/apps/apollo/src/pages/api/v3/org/project/[projectId]/api_keys/list.ts @@ -0,0 +1,132 @@ +import type { PageConfig } from 'next' +import { + ErrorSchema, + errorToHTTPException, + HTTPErrors, +} from '@/src/common/constants/error' +import { logger } from '@/src/common/lib/internal/logger' +import { API_AUTH, API_VISIBILITY } from '@/src/common/types/openapi' +import { env } from '@/src/env' +import { fetchApiKeyLastUsedMap } from '@/src/lib/apiKeys/apiKeyLastUsed' +import { DB_API_KEY } from '@/src/lib/apiKeys/dbUtils' +import { + getAPIKeyScopeForMetadata, + getPermissionsForListResponse, + ListAPIKeysResponseSchema, +} from '@/src/lib/apiKeys/schema' +import { getAuthContext } from '@/src/server/context/getter' +import { vercelAPIHandler } from '@/src/server/handler/vercelHandler' +import { getAuthRouter, getRouter } from '@/src/server/router/base_router' +import { createOpenAPIResponseSchema } from '@/src/server/schema/response' +import { createAuthRoute } from '@/src/server/schema/route' +import { ProjectNanoIdSchema } from '@composio/types' +import { z } from '@hono/zod-openapi' + +const projectRouter = env.SELF_HOSTED + ? getAuthRouter({ disableProjectAPIKey: true }) + : getRouter() + +const LIST_API_KEYS_DEF = createAuthRoute( + { + method: 'get', + path: '/api/v3/org/project/{projectId}/api_keys/list', + summary: 'List project API keys', + description: + 'Lists customer-visible API keys for the authenticated dashboard project. Self-hosted only.', + request: { + params: z.object({ + projectId: ProjectNanoIdSchema.describe( + 'Project nano ID to list API keys for', + ), + }), + }, + responses: { + 200: createOpenAPIResponseSchema( + ListAPIKeysResponseSchema, + 'Successfully retrieved the list of API keys', + ), + 400: createOpenAPIResponseSchema(ErrorSchema, 'Bad request'), + 401: createOpenAPIResponseSchema(ErrorSchema, 'Unauthorized'), + 404: createOpenAPIResponseSchema(ErrorSchema, 'Project not found'), + 500: createOpenAPIResponseSchema(ErrorSchema, 'Internal server error'), + }, + tags: ['Projects', 'API Keys'], + }, + 'Organization', + { + visibility: [API_VISIBILITY.FRONTEND], + authModes: [API_AUTH.COOKIE], + }, +) + +export const listAPIKeysRouter = env.SELF_HOSTED + ? projectRouter.openapi(LIST_API_KEYS_DEF, async (c) => { + const authInfo = getAuthContext() + if (!authInfo.ok) { + return errorToHTTPException(c, authInfo.val) + } + + const { projectId } = c.req.valid('param') + if (projectId !== authInfo.val.project.id) { + return errorToHTTPException( + c, + new HTTPErrors.Unauthorized({ + message: 'Project ID does not match the authenticated project', + }), + ) + } + + const apiKeys = await DB_API_KEY.listAPIKeysForCaller( + projectId, + authInfo.val.orgMember.id, + authInfo.val.orgMember.role, + ) + if (!apiKeys.ok) { + return errorToHTTPException(c, apiKeys.val) + } + + const lastUsedResult = await fetchApiKeyLastUsedMap({ + projectUuid: authInfo.val.project.uuid, + apiKeyIds: apiKeys.val.map((apiKey) => apiKey.id), + }) + const lastUsedByApiKey = lastUsedResult.ok + ? lastUsedResult.val + : new Map() + if (lastUsedResult.err) { + logger.warn({ + message: + 'Failed to load API key last-used data in self-hosted API key list; returning keys without last_used', + project_id: projectId, + error: lastUsedResult.val.message, + }) + } + + return c.json( + { + items: apiKeys.val.map((apiKey) => ({ + id: apiKey.id, + name: apiKey.name, + key: apiKey.displayKey, + created_at: apiKey.createdAt.toISOString(), + created_by: apiKey.orgMember.email, + last_used: lastUsedByApiKey.get(apiKey.id)?.toISOString(), + allowed_ips: apiKey.allowedIps ?? [], + scope: getAPIKeyScopeForMetadata(apiKey.metadata), + permissions: getPermissionsForListResponse(apiKey.metadata), + })), + }, + 200, + ) + }) + : projectRouter + +export const routes = env.SELF_HOSTED ? [LIST_API_KEYS_DEF] : [] + +export const config: PageConfig = { + runtime: 'nodejs', + api: { + bodyParser: false, + }, +} + +export default vercelAPIHandler(projectRouter) diff --git a/apps/apollo/src/pages/api/v3/org/project/[projectId]/api_keys/remove/[id].ts b/apps/apollo/src/pages/api/v3/org/project/[projectId]/api_keys/remove/[id].ts new file mode 100644 index 00000000000..399348c0cd6 --- /dev/null +++ b/apps/apollo/src/pages/api/v3/org/project/[projectId]/api_keys/remove/[id].ts @@ -0,0 +1,107 @@ +import type { PageConfig } from 'next' +import { + ErrorSchema, + errorToHTTPException, + HTTPErrors, +} from '@/src/common/constants/error' +import { API_AUTH, API_VISIBILITY } from '@/src/common/types/openapi' +import { env } from '@/src/env' +import { DB_API_KEY } from '@/src/lib/apiKeys/dbUtils' +import { getAuthContext } from '@/src/server/context/getter' +import { vercelAPIHandler } from '@/src/server/handler/vercelHandler' +import { getAuthRouter, getRouter } from '@/src/server/router/base_router' +import { createOpenAPIResponseSchema } from '@/src/server/schema/response' +import { createAuthRoute } from '@/src/server/schema/route' +import { ProjectNanoIdSchema } from '@composio/types' +import { z } from '@hono/zod-openapi' + +const projectRouter = env.SELF_HOSTED + ? getAuthRouter({ disableProjectAPIKey: true }) + : getRouter() + +export const DeleteAPIKeyResponseSchema = z.object({ + success: z.boolean().describe('Whether the API key was deleted'), + message: z.string().describe('Deletion result message'), +}) + +const DELETE_API_KEY_DEF = createAuthRoute( + { + method: 'delete', + path: '/api/v3/org/project/{projectId}/api_keys/remove/{id}', + summary: 'Delete project API key', + description: + 'Deletes a customer-visible API key for the authenticated dashboard project. Self-hosted only.', + request: { + params: z.object({ + id: z.string().min(1).describe('API key ID to delete'), + projectId: ProjectNanoIdSchema.describe( + 'Project nano ID containing the API key', + ), + }), + }, + responses: { + 200: createOpenAPIResponseSchema( + DeleteAPIKeyResponseSchema, + 'API key deleted successfully', + ), + 400: createOpenAPIResponseSchema(ErrorSchema, 'Bad request'), + 401: createOpenAPIResponseSchema(ErrorSchema, 'Unauthorized'), + 404: createOpenAPIResponseSchema(ErrorSchema, 'API key not found'), + 500: createOpenAPIResponseSchema(ErrorSchema, 'Internal server error'), + }, + tags: ['Projects', 'API Keys'], + }, + 'Organization', + { + visibility: [API_VISIBILITY.FRONTEND], + authModes: [API_AUTH.COOKIE], + }, +) + +export const deleteAPIKeyRouter = env.SELF_HOSTED + ? projectRouter.openapi(DELETE_API_KEY_DEF, async (c) => { + const authInfo = getAuthContext() + if (!authInfo.ok) { + return errorToHTTPException(c, authInfo.val) + } + + const { id, projectId } = c.req.valid('param') + if (projectId !== authInfo.val.project.id) { + return errorToHTTPException( + c, + new HTTPErrors.Unauthorized({ + message: 'Project ID does not match the authenticated project', + }), + ) + } + + const result = await DB_API_KEY.deleteAPIKeyForCaller( + id, + projectId, + authInfo.val.orgMember.id, + authInfo.val.orgMember.role, + ) + if (!result.ok) { + return errorToHTTPException(c, result.val) + } + + return c.json( + { + success: true, + message: 'API key deleted successfully', + }, + 200, + ) + }) + : projectRouter + +export const routes = env.SELF_HOSTED ? [DELETE_API_KEY_DEF] : [] + +export const config: PageConfig = { + runtime: 'nodejs', + api: { + bodyParser: false, + }, +} + +export default vercelAPIHandler(projectRouter) diff --git a/apps/apollo/src/pages/api/v3/org/project/[projectId]/files/upload.ts b/apps/apollo/src/pages/api/v3/org/project/[projectId]/files/upload.ts new file mode 100644 index 00000000000..555c3476f69 --- /dev/null +++ b/apps/apollo/src/pages/api/v3/org/project/[projectId]/files/upload.ts @@ -0,0 +1,142 @@ +import type { PageConfig } from 'next' +import { + ErrorSchema, + errorToHTTPException, + HTTPErrors, +} from '@/src/common/constants/error' +import { API_AUTH, API_VISIBILITY } from '@/src/common/types/openapi' +import { env } from '@/src/env' +import { handleProjectFileUpload } from '@/src/lib/projects/files/uploadFile' +import { VALIDATION_TYPES } from '@/src/lib/projects/files/validator/constants' +import { getAuthContext } from '@/src/server/context/getter' +import { vercelAPIHandler } from '@/src/server/handler/vercelHandler' +import { getAuthRouter, getRouter } from '@/src/server/router/base_router' +import { createOpenAPIResponseSchema } from '@/src/server/schema/response' +import { createAuthRoute } from '@/src/server/schema/route' +import { zpp } from '@composio/lib' +import { ProjectNanoIdSchema } from '@composio/types' +import { z } from '@hono/zod-openapi' + +const projectFileRouter = env.SELF_HOSTED + ? getAuthRouter({ disableProjectAPIKey: true }) + : getRouter() + +const ProjectFileUploadResponseSchema = zpp( + z.object({ + // eslint-disable-next-line validate-snake-case/schemas + nanoId: z.string().describe('Nano ID of the file'), + key: z.string().describe('S3 key where the file will be stored'), + public_url: z + .string() + .describe('Public URL where the file will be accessible after upload'), + }), +) + +const UPLOAD_PROJECT_FILE_ROUTE = createAuthRoute( + { + method: 'post', + path: '/api/v3/org/project/{projectId}/files/upload', + summary: 'Upload file to project', + description: + 'Uploads a project file for the authenticated dashboard project. Self-hosted only.', + tags: ['Projects', 'Files', 'Upload'], + request: { + params: z.object({ + projectId: ProjectNanoIdSchema.describe( + 'Unique identifier of the project to upload the file to', + ), + }), + query: z.object({ + validation_type: z + .enum([VALIDATION_TYPES.LOGO]) + .default(VALIDATION_TYPES.LOGO) + .describe('Type of validation to perform on the file.'), + }), + body: { + content: { + 'multipart/form-data': { + schema: z.object({ + file: z.any().describe('The file to upload').openapi({ + type: 'string', + format: 'binary', + }), + }), + }, + }, + }, + }, + responses: { + 200: createOpenAPIResponseSchema( + ProjectFileUploadResponseSchema, + 'File upload processed successfully.', + ), + 400: createOpenAPIResponseSchema(ErrorSchema, 'Bad request'), + 401: createOpenAPIResponseSchema(ErrorSchema, 'Unauthorized'), + 403: createOpenAPIResponseSchema(ErrorSchema, 'Forbidden'), + 404: createOpenAPIResponseSchema(ErrorSchema, 'Project not found'), + 413: createOpenAPIResponseSchema(ErrorSchema, 'Payload too large'), + 415: createOpenAPIResponseSchema(ErrorSchema, 'Unsupported media type'), + 500: createOpenAPIResponseSchema(ErrorSchema, 'Internal server error'), + }, + }, + 'Organization', + { + visibility: [API_VISIBILITY.FRONTEND], + authModes: [API_AUTH.COOKIE], + }, +) + +export const uploadProjectFileRouter = env.SELF_HOSTED + ? projectFileRouter.openapi(UPLOAD_PROJECT_FILE_ROUTE, async (c) => { + const authInfo = getAuthContext() + if (!authInfo.ok) { + return errorToHTTPException(c, authInfo.val) + } + + const { projectId } = c.req.valid('param') + const { validation_type: validationType } = c.req.valid('query') + + if (projectId !== authInfo.val.project.id) { + return errorToHTTPException( + c, + new HTTPErrors.Unauthorized({ + message: "Project ID doesn't match the authenticated project", + }), + ) + } + + const body = await c.req.parseBody() + const fileField = body['file'] + if (!fileField || !(fileField instanceof File)) { + return errorToHTTPException( + c, + new HTTPErrors.BadRequest({ + message: 'No file provided or invalid file format', + }), + ) + } + + const result = await handleProjectFileUpload( + fileField, + 'IMAGE', + projectId, + validationType, + ) + if (result.err) { + return errorToHTTPException(c, result.val) + } + + return c.json(ProjectFileUploadResponseSchema.new(result.val), 200) + }) + : projectFileRouter + +export const routes = env.SELF_HOSTED ? [UPLOAD_PROJECT_FILE_ROUTE] : [] + +export const config: PageConfig = { + runtime: 'nodejs', + api: { + bodyParser: false, + }, +} + +export default vercelAPIHandler(projectFileRouter) diff --git a/apps/apollo/src/pages/api/v3/org/project/[projectId]/files/upload.unit.test.ts b/apps/apollo/src/pages/api/v3/org/project/[projectId]/files/upload.unit.test.ts new file mode 100644 index 00000000000..954fec9ae12 --- /dev/null +++ b/apps/apollo/src/pages/api/v3/org/project/[projectId]/files/upload.unit.test.ts @@ -0,0 +1,76 @@ +import { API_AUTH } from '@/src/common/types/openapi' +import { z } from '@hono/zod-openapi' +import { describe, expect, it, vi } from 'vitest' + +const { getAuthRouterMock, openapiMock } = vi.hoisted(() => { + const openapiMock = vi.fn() + return { + getAuthRouterMock: vi.fn(() => ({ + openapi: openapiMock, + })), + openapiMock, + } +}) + +vi.mock('@/src/env', () => ({ + env: { + SELF_HOSTED: true, + }, +})) + +vi.mock('@/src/common/constants/error', () => ({ + ErrorSchema: z.object({ error: z.string().optional() }), + HTTPErrors: { + BadRequest: class BadRequest extends Error {}, + Unauthorized: class Unauthorized extends Error {}, + }, + errorToHTTPException: vi.fn(), +})) + +vi.mock('@/src/lib/projects/files/uploadFile', () => ({ + handleProjectFileUpload: vi.fn(), +})) + +vi.mock('@/src/server/context/getter', () => ({ + getAuthContext: vi.fn(), +})) + +vi.mock('@/src/server/handler/vercelHandler', () => ({ + vercelAPIHandler: vi.fn(), +})) + +vi.mock('@/src/server/router/base_router', () => ({ + getAuthRouter: getAuthRouterMock, + getRouter: vi.fn(() => ({ + openapi: vi.fn(), + })), +})) + +import { routes } from './upload' + +type RouteWithAuth = { + authModes?: API_AUTH[] + method: string + path: string + request?: { + query?: z.ZodTypeAny + } + security?: Record[] +} + +describe('self-hosted project file upload route metadata', () => { + it('exposes the cookie-only project file upload route for frontend generation', () => { + expect(getAuthRouterMock).toHaveBeenCalledWith({ + disableProjectAPIKey: true, + }) + expect(openapiMock).toHaveBeenCalledTimes(1) + + const route = (routes as RouteWithAuth[])[0] + + expect(route?.method).toBe('post') + expect(route?.path).toBe('/api/v3/org/project/{projectId}/files/upload') + expect(route?.authModes).toEqual([API_AUTH.COOKIE]) + expect(route?.security).toEqual([{ [API_AUTH.COOKIE]: [] }]) + expect(route?.request?.query?.safeParse({}).success).toBe(true) + }) +}) diff --git a/apps/apollo/src/pages/api/v3/org/project/config.ts b/apps/apollo/src/pages/api/v3/org/project/config.ts new file mode 100644 index 00000000000..96b46131252 --- /dev/null +++ b/apps/apollo/src/pages/api/v3/org/project/config.ts @@ -0,0 +1,182 @@ +import type { ProjectConfig } from '@/src/lib/projects/dbUtils/types' +import type { PageConfig } from 'next' +import { ErrorSchema, errorToHTTPException } from '@/src/common/constants/error' +import { API_AUTH, API_VISIBILITY } from '@/src/common/types/openapi' +import { env } from '@/src/env' +import { ProjectConfigSchemaAPI } from '@/src/lib/projects/common/schema' +import { DB_PROJECT_FIND } from '@/src/lib/projects/dbUtils/findProject' +import { DB_PROJECT_UPDATE } from '@/src/lib/projects/dbUtils/update' +import { getAuthContext } from '@/src/server/context/getter' +import { vercelAPIHandler } from '@/src/server/handler/vercelHandler' +import { getAuthRouter, getRouter } from '@/src/server/router/base_router' +import { createOpenAPIResponseSchema } from '@/src/server/schema/response' +import { createAuthRoute } from '@/src/server/schema/route' + +const configRouter = env.SELF_HOSTED + ? getAuthRouter({ disableProjectAPIKey: true }) + : getRouter() + +const GET_CONFIG_DEF = createAuthRoute( + { + method: 'get', + path: '/api/v3/org/project/config', + summary: 'Get project configuration', + description: + 'Retrieves the current dashboard project configuration. Self-hosted only.', + responses: { + 200: createOpenAPIResponseSchema( + ProjectConfigSchemaAPI, + 'Project configuration retrieved successfully.', + ), + 400: createOpenAPIResponseSchema(ErrorSchema, 'Bad request'), + 401: createOpenAPIResponseSchema(ErrorSchema, 'Unauthorized'), + 404: createOpenAPIResponseSchema(ErrorSchema, 'Project not found'), + 500: createOpenAPIResponseSchema(ErrorSchema, 'Internal server error'), + }, + tags: ['Projects', 'Configuration'], + }, + 'Organization', + { + visibility: [API_VISIBILITY.FRONTEND], + authModes: [API_AUTH.COOKIE], + }, +) + +const UPDATE_CONFIG_DEF = createAuthRoute( + { + method: 'patch', + path: '/api/v3/org/project/config', + summary: 'Update project configuration', + description: + 'Updates the authenticated dashboard project configuration. Self-hosted only.', + request: { + body: { + content: { + 'application/json': { + schema: ProjectConfigSchemaAPI.partial(), + }, + }, + }, + }, + responses: { + 200: createOpenAPIResponseSchema( + ProjectConfigSchemaAPI, + 'Project configuration updated successfully.', + ), + 400: createOpenAPIResponseSchema(ErrorSchema, 'Bad request'), + 401: createOpenAPIResponseSchema(ErrorSchema, 'Unauthorized'), + 403: createOpenAPIResponseSchema(ErrorSchema, 'Forbidden'), + 404: createOpenAPIResponseSchema(ErrorSchema, 'Project not found'), + 500: createOpenAPIResponseSchema(ErrorSchema, 'Internal server error'), + }, + tags: ['Projects', 'Configuration'], + }, + 'Organization', + { + visibility: [API_VISIBILITY.FRONTEND], + authModes: [API_AUTH.COOKIE], + }, +) + +const toProjectConfigAPI = (config: ProjectConfig) => ({ + is_2FA_enabled: config.is2FAEnabled, + logo_url: config.logoURL, + display_name: config.displayName, + log_visibility_setting: config.logVisibilitySetting, + mask_secret_keys_in_connected_account: + config.maskSecretKeysInConnectedAccounts, + require_mcp_api_key: config.requireMcpApiKey ?? false, + is_composio_link_enabled_for_managed_auth: + config.isComposioLinkEnabledForManagedAuth ?? false, + signed_url_file_expiry_in_seconds: config.tempSignedUrlFileExpiryInSeconds, +}) + +export const getConfigRouter = env.SELF_HOSTED + ? configRouter.openapi(GET_CONFIG_DEF, async (c) => { + const authInfo = getAuthContext() + if (!authInfo.ok) { + return errorToHTTPException(c, authInfo.val) + } + + const configResult = await DB_PROJECT_FIND.getConfig( + authInfo.val.project.id, + authInfo.val.org.nanoid, + ) + if (!configResult.ok) { + return errorToHTTPException(c, configResult.val) + } + + return c.json(toProjectConfigAPI(configResult.val), 200) + }) + : configRouter + +export const updateConfigRouter = env.SELF_HOSTED + ? configRouter.openapi(UPDATE_CONFIG_DEF, async (c) => { + const authInfo = getAuthContext() + if (!authInfo.ok) { + return errorToHTTPException(c, authInfo.val) + } + + const body = c.req.valid('json') + const updateData: Partial = {} + + if (body.is_2FA_enabled !== undefined) { + updateData.is2FAEnabled = body.is_2FA_enabled + } + if (body.logo_url !== undefined) { + updateData.logoURL = body.logo_url + } + if (body.display_name !== undefined) { + updateData.displayName = body.display_name + } + if (body.log_visibility_setting !== undefined) { + updateData.logVisibilitySetting = body.log_visibility_setting + } + if (body.mask_secret_keys_in_connected_account !== undefined) { + updateData.maskSecretKeysInConnectedAccounts = + body.mask_secret_keys_in_connected_account + } + if (body.require_mcp_api_key !== undefined) { + updateData.requireMcpApiKey = body.require_mcp_api_key + } + if (body.is_composio_link_enabled_for_managed_auth !== undefined) { + updateData.isComposioLinkEnabledForManagedAuth = + body.is_composio_link_enabled_for_managed_auth + } + if (body.signed_url_file_expiry_in_seconds !== undefined) { + updateData.tempSignedUrlFileExpiryInSeconds = + body.signed_url_file_expiry_in_seconds + } + + const updateResult = await DB_PROJECT_UPDATE.config({ + projectNanoId: authInfo.val.project.id, + config: updateData, + orgNanoId: authInfo.val.org.nanoid, + role: authInfo.val.orgMember.role, + }) + if (!updateResult.ok) { + return errorToHTTPException(c, updateResult.val) + } + + const configResult = await DB_PROJECT_FIND.getConfig( + authInfo.val.project.id, + authInfo.val.org.nanoid, + ) + if (!configResult.ok) { + return errorToHTTPException(c, configResult.val) + } + + return c.json(toProjectConfigAPI(configResult.val), 200) + }) + : configRouter + +export const routes = env.SELF_HOSTED ? [GET_CONFIG_DEF, UPDATE_CONFIG_DEF] : [] + +export const config: PageConfig = { + runtime: 'nodejs', + api: { + bodyParser: false, + }, +} + +export default vercelAPIHandler(configRouter) diff --git a/apps/apollo/src/pages/api/v3/org/project/config.unit.test.ts b/apps/apollo/src/pages/api/v3/org/project/config.unit.test.ts new file mode 100644 index 00000000000..aef71cdea31 --- /dev/null +++ b/apps/apollo/src/pages/api/v3/org/project/config.unit.test.ts @@ -0,0 +1,91 @@ +import { API_AUTH } from '@/src/common/types/openapi' +import { z } from '@hono/zod-openapi' +import { describe, expect, it, vi } from 'vitest' + +const { getAuthRouterMock, openapiMock } = vi.hoisted(() => { + const openapiMock = vi.fn() + return { + getAuthRouterMock: vi.fn(() => ({ + openapi: openapiMock, + })), + openapiMock, + } +}) + +vi.mock('@/src/env', () => ({ + env: { + SELF_HOSTED: true, + }, +})) + +vi.mock('@/src/common/constants/error', () => ({ + ErrorSchema: z.object({ error: z.string().optional() }), + errorToHTTPException: vi.fn(), +})) + +vi.mock('@/src/lib/projects', () => ({ + default: { + db: { + find: { + getConfig: vi.fn(), + }, + }, + }, +})) + +vi.mock('@/src/lib/projects/dbUtils/findProject', () => ({ + DB_PROJECT_FIND: { + getConfig: vi.fn(), + }, +})) + +vi.mock('@/src/lib/projects/dbUtils/update', () => ({ + DB_PROJECT_UPDATE: { + config: vi.fn(), + }, +})) + +vi.mock('@/src/server/context/getter', () => ({ + getAuthContext: vi.fn(), +})) + +vi.mock('@/src/server/handler/vercelHandler', () => ({ + vercelAPIHandler: vi.fn(), +})) + +vi.mock('@/src/server/router/base_router', () => ({ + getAuthRouter: getAuthRouterMock, + getRouter: vi.fn(() => ({ + openapi: vi.fn(), + })), +})) + +import { routes } from './config' + +type RouteWithAuth = { + authModes?: API_AUTH[] + method: string + path: string + security?: Record[] +} + +describe('self-hosted project config route metadata', () => { + it('exposes cookie-only GET and PATCH routes for frontend generation', () => { + expect(getAuthRouterMock).toHaveBeenCalledWith({ + disableProjectAPIKey: true, + }) + expect(openapiMock).toHaveBeenCalledTimes(2) + + const routeMetadata = routes as RouteWithAuth[] + + expect(routeMetadata.map((route) => route.method)).toEqual(['get', 'patch']) + expect(routeMetadata.map((route) => route.path)).toEqual([ + '/api/v3/org/project/config', + '/api/v3/org/project/config', + ]) + for (const route of routeMetadata) { + expect(route.authModes).toEqual([API_AUTH.COOKIE]) + expect(route.security).toEqual([{ [API_AUTH.COOKIE]: [] }]) + } + }) +}) diff --git a/apps/apollo/src/pages/api/v3/org/project/delete/[projectId].ts b/apps/apollo/src/pages/api/v3/org/project/delete/[projectId].ts new file mode 100644 index 00000000000..4cf3725ea5c --- /dev/null +++ b/apps/apollo/src/pages/api/v3/org/project/delete/[projectId].ts @@ -0,0 +1,114 @@ +import type { PageConfig } from 'next' +import { + ErrorSchema, + errorToHTTPException, + HTTPErrors, + OrgMemberError, +} from '@/src/common/constants/error' +import { API_AUTH, API_VISIBILITY } from '@/src/common/types/openapi' +import { env } from '@/src/env' +import { invalidateOrgMemberCacheForUser } from '@/src/lib/org/member' +import projects, { DeleteProjectResponseSchema } from '@/src/lib/projects' +import { getAuthContext } from '@/src/server/context/getter' +import { vercelAPIHandler } from '@/src/server/handler/vercelHandler' +import { getAuthRouter, getRouter } from '@/src/server/router/base_router' +import { createOpenAPIResponseSchema } from '@/src/server/schema/response' +import { createAuthRoute } from '@/src/server/schema/route' +import { UserRole } from '@composio/db' +import { ProjectNanoIdSchema } from '@composio/types' +import { z } from '@hono/zod-openapi' + +const projectRouter = env.SELF_HOSTED + ? getAuthRouter({ disableProjectAPIKey: true }) + : getRouter() + +const DELETE_PROJECT_DEF = createAuthRoute( + { + method: 'delete', + path: '/api/v3/org/project/delete/{projectId}', + summary: 'Delete a project', + description: + 'Soft-deletes the authenticated dashboard project. Self-hosted only.', + request: { + params: z.object({ + projectId: ProjectNanoIdSchema.describe( + 'Project nano ID to delete', + ).openapi({ + example: 'pr_1a2b3c4d5e6f', + }), + }), + }, + responses: { + 200: createOpenAPIResponseSchema( + DeleteProjectResponseSchema, + 'Project successfully deleted', + ), + 400: createOpenAPIResponseSchema(ErrorSchema, 'Bad request'), + 401: createOpenAPIResponseSchema(ErrorSchema, 'Unauthorized'), + 403: createOpenAPIResponseSchema(ErrorSchema, 'Forbidden'), + 404: createOpenAPIResponseSchema(ErrorSchema, 'Project not found'), + 500: createOpenAPIResponseSchema(ErrorSchema, 'Internal server error'), + }, + tags: ['Projects', 'Organization Management'], + }, + 'Organization', + { + visibility: [API_VISIBILITY.FRONTEND], + authModes: [API_AUTH.COOKIE], + }, +) + +export const deleteProjectRoute = env.SELF_HOSTED + ? projectRouter.openapi(DELETE_PROJECT_DEF, async (c) => { + const { projectId } = c.req.valid('param') + const authInfo = getAuthContext() + if (!authInfo.ok) { + return errorToHTTPException(c, authInfo.val) + } + + if (authInfo.val.orgMember.role !== UserRole.ADMIN) { + return errorToHTTPException( + c, + new OrgMemberError.Forbidden({ + message: + "You don't have permission to delete a project. Please contact your organization administrator.", + }), + ) + } + + if (projectId !== authInfo.val.project.id) { + return errorToHTTPException( + c, + new HTTPErrors.Unauthorized({ + message: 'Project ID does not match the authenticated project', + }), + ) + } + + const result = await projects.deleteProject( + projectId, + authInfo.val.org.nanoid, + ) + if (result.err) { + return errorToHTTPException(c, result.val) + } + + await invalidateOrgMemberCacheForUser( + authInfo.val.orgMember.id, + authInfo.val.org.nanoid, + ) + + return c.json(result.val, 200) + }) + : projectRouter + +export const routes = env.SELF_HOSTED ? [DELETE_PROJECT_DEF] : [] + +export const config: PageConfig = { + runtime: 'nodejs', + api: { + bodyParser: false, + }, +} + +export default vercelAPIHandler(projectRouter) diff --git a/apps/apollo/src/pages/api/v3/org/project/rename/index.ts b/apps/apollo/src/pages/api/v3/org/project/rename/index.ts new file mode 100644 index 00000000000..85e20c312ac --- /dev/null +++ b/apps/apollo/src/pages/api/v3/org/project/rename/index.ts @@ -0,0 +1,106 @@ +import type { PageConfig } from 'next' +import { ErrorSchema, errorToHTTPException } from '@/src/common/constants/error' +import { API_AUTH, API_VISIBILITY } from '@/src/common/types/openapi' +import { env } from '@/src/env' +import { ProjectNameSchema } from '@/src/lib/projects/common/schema' +import { DB_PROJECT_UPDATE } from '@/src/lib/projects/dbUtils/update' +import { getAuthContext } from '@/src/server/context/getter' +import { vercelAPIHandler } from '@/src/server/handler/vercelHandler' +import { getAuthRouter, getRouter } from '@/src/server/router/base_router' +import { createOpenAPIResponseSchema } from '@/src/server/schema/response' +import { createAuthRoute } from '@/src/server/schema/route' +import { z } from '@hono/zod-openapi' + +const projectRouter = env.SELF_HOSTED + ? getAuthRouter({ disableProjectAPIKey: true }) + : getRouter() + +export const RenameProjectRequestSchema = z.object({ + name: ProjectNameSchema.describe( + 'New name for the project. Must be between 3-75 characters, using only letters, numbers, underscores and hyphens. No spaces allowed.', + ).openapi({ + example: 'my-renamed-project', + description: 'The new name to assign to the project', + }), +}) + +const RenameProjectResponseSchema = z.object({ + status: z.literal('success').describe('Status of the rename operation'), + message: z.string().describe('Success message'), +}) + +const RENAME_PROJECT_DEF = createAuthRoute( + { + method: 'patch', + path: '/api/v3/org/project/rename', + summary: 'Rename project', + description: + 'Renames the authenticated dashboard project. Self-hosted only.', + request: { + body: { + content: { + 'application/json': { + schema: RenameProjectRequestSchema, + }, + }, + }, + }, + responses: { + 200: createOpenAPIResponseSchema( + RenameProjectResponseSchema, + 'Project renamed successfully', + ), + 400: createOpenAPIResponseSchema(ErrorSchema, 'Bad request'), + 401: createOpenAPIResponseSchema(ErrorSchema, 'Unauthorized'), + 403: createOpenAPIResponseSchema(ErrorSchema, 'Forbidden'), + 404: createOpenAPIResponseSchema(ErrorSchema, 'Project not found'), + 500: createOpenAPIResponseSchema(ErrorSchema, 'Internal server error'), + }, + tags: ['Projects', 'Organization Management'], + }, + 'Organization', + { + visibility: [API_VISIBILITY.FRONTEND], + authModes: [API_AUTH.COOKIE], + }, +) + +export const renameProjectRoute = env.SELF_HOSTED + ? projectRouter.openapi(RENAME_PROJECT_DEF, async (c) => { + const authInfo = getAuthContext() + if (!authInfo.ok) { + return errorToHTTPException(c, authInfo.val) + } + + const { name } = c.req.valid('json') + const result = await DB_PROJECT_UPDATE.rename( + authInfo.val.project.id, + name, + authInfo.val.org.nanoid, + authInfo.val.orgMember.role, + ) + + if (!result.ok) { + return errorToHTTPException(c, result.val) + } + + return c.json( + { + status: 'success' as const, + message: 'Project renamed successfully', + }, + 200, + ) + }) + : projectRouter + +export const routes = env.SELF_HOSTED ? [RENAME_PROJECT_DEF] : [] + +export const config: PageConfig = { + runtime: 'nodejs', + api: { + bodyParser: false, + }, +} + +export default vercelAPIHandler(projectRouter) diff --git a/apps/apollo/src/pages/api/v3/self_hosted/auth/magic_link/send.test.self-hosted.ts b/apps/apollo/src/pages/api/v3/self_hosted/auth/magic_link/send.test.self-hosted.ts new file mode 100644 index 00000000000..0b0067ab0e9 --- /dev/null +++ b/apps/apollo/src/pages/api/v3/self_hosted/auth/magic_link/send.test.self-hosted.ts @@ -0,0 +1,82 @@ +import { beforeEach, describe, expect, it, vi } from 'vitest' + +const { mockedEnv, sendSelfHostedMagicLink } = vi.hoisted(() => ({ + mockedEnv: { + APOLLO_ADMIN_TOKEN: 'test-admin-token', + COMPOSIO_ENV: 'local', + DISABLE_AUTH_MODES: [], + SELF_HOSTED: true, + }, + sendSelfHostedMagicLink: vi.fn(), +})) + +vi.mock('@/src/env', () => ({ + env: mockedEnv, + isProduction: () => false, +})) + +vi.mock('@/src/lib/self_hosted_magic_links/email', () => ({ + sendSelfHostedMagicLink, +})) + +import { Ok } from 'ts-results' + +import { sendMagicLinkRoute } from './send' + +const adminToken = 'test-admin-token' + +describe('Self-hosted magic link send route', () => { + beforeEach(() => { + mockedEnv.SELF_HOSTED = true + sendSelfHostedMagicLink.mockReset() + }) + + it('sends a magic link from the self-hosted namespace', async () => { + sendSelfHostedMagicLink.mockResolvedValue(Ok(undefined)) + + const res = await sendMagicLinkRoute.request( + '/api/v3/self_hosted/auth/magic_link/send', + { + method: 'POST', + headers: { + 'Content-Type': 'application/json', + 'x-composio-admin-token': adminToken, + }, + body: JSON.stringify({ + email: 'operator@example.com', + verify_host: 'https://self-hosted.example.com/auth/verify', + }), + }, + ) + + expect(res.status).toBe(200) + await expect(res.json()).resolves.toEqual({ status: 'success' }) + expect(sendSelfHostedMagicLink).toHaveBeenCalledWith({ + email: 'operator@example.com', + verify_host: 'https://self-hosted.example.com/auth/verify', + is_mcp: false, + }) + }) + + it('does not expose the route outside self-hosted deployments', async () => { + mockedEnv.SELF_HOSTED = false + sendSelfHostedMagicLink.mockResolvedValue(Ok(undefined)) + + const res = await sendMagicLinkRoute.request( + '/api/v3/self_hosted/auth/magic_link/send', + { + method: 'POST', + headers: { + 'Content-Type': 'application/json', + 'x-composio-admin-token': adminToken, + }, + body: JSON.stringify({ + email: 'operator@example.com', + }), + }, + ) + + expect(res.status).toBe(404) + expect(sendSelfHostedMagicLink).not.toHaveBeenCalled() + }) +}) diff --git a/apps/apollo/src/pages/api/v3/self_hosted/auth/magic_link/send.ts b/apps/apollo/src/pages/api/v3/self_hosted/auth/magic_link/send.ts new file mode 100644 index 00000000000..5b0a6fda7a5 --- /dev/null +++ b/apps/apollo/src/pages/api/v3/self_hosted/auth/magic_link/send.ts @@ -0,0 +1,123 @@ +import type { PageConfig } from 'next' +import { ErrorSchema, errorToHTTPException } from '@/src/common/constants/error' +import { API_AUTH, API_VISIBILITY } from '@/src/common/types/openapi' +import { sendSelfHostedMagicLink } from '@/src/lib/self_hosted_magic_links/email' +import { getAdminAuthContext } from '@/src/server/context/getter' +import { vercelAPIHandler } from '@/src/server/handler/vercelHandler' +import { getSelfHostedAdminRouter } from '@/src/server/router/base_router' +import { createOpenAPIResponseSchema } from '@/src/server/schema/response' +import { createAuthRoute } from '@/src/server/schema/route' +import { zpp } from '@composio/lib' +import { z } from '@hono/zod-openapi' + +const authRouter = getSelfHostedAdminRouter() + +export const SendMagicLinkRequestSchema = z + .object({ + email: z + .string() + .email() + .describe('Email address to send the magic link to'), + verify_host: z + .string() + .url() + .optional() + .describe('URL where the magic link should redirect for verification'), + is_mcp: z + .boolean() + .optional() + .default(false) + .describe('Whether this request is for MCP authentication'), + }) + .strict() + +export const SendMagicLinkResponseSchema = zpp( + z.object({ + status: z.string().openapi({ + example: 'success', + }), + }), +) + +const SEND_MAGIC_LINK_OPENAPI_DEF = createAuthRoute( + { + method: 'post', + path: '/api/v3/self_hosted/auth/magic_link/send', + summary: 'Send self-hosted magic link authentication email', + description: + 'Self-hosted administrative endpoint that sends a one-time login link to a user email address.', + request: { + body: { + content: { + 'application/json': { + schema: SendMagicLinkRequestSchema, + }, + }, + required: true, + }, + }, + responses: { + 200: createOpenAPIResponseSchema( + SendMagicLinkResponseSchema, + 'Magic link email sent successfully.', + ), + 400: createOpenAPIResponseSchema( + ErrorSchema, + 'Bad request - Invalid email or verification URL.', + ), + 401: createOpenAPIResponseSchema( + ErrorSchema, + 'Unauthorized - Invalid or missing admin token.', + ), + 404: createOpenAPIResponseSchema( + ErrorSchema, + 'Not found - Endpoint is unavailable outside self-hosted deployments.', + ), + 500: createOpenAPIResponseSchema( + ErrorSchema, + 'Internal server error - Failed to send magic link.', + ), + }, + tags: ['Admin', 'Authentication'], + docsHide: true, + }, + 'Admin', + { + visibility: [API_VISIBILITY.ADMIN], + authModes: [API_AUTH.ADMIN], + }, +) + +export const sendMagicLinkRoute = authRouter.openapi( + SEND_MAGIC_LINK_OPENAPI_DEF, + async (c) => { + const authInfo = getAdminAuthContext() + if (authInfo.err) { + return errorToHTTPException(c, authInfo.val) + } + + const { email, verify_host, is_mcp } = c.req.valid('json') + const result = await sendSelfHostedMagicLink({ + email, + verify_host, + is_mcp, + }) + + if (result.err) { + return errorToHTTPException(c, result.val) + } + + return c.json(SendMagicLinkResponseSchema.new({ status: 'success' }), 200) + }, +) + +export const routes = [SEND_MAGIC_LINK_OPENAPI_DEF] + +export const config: PageConfig = { + runtime: 'nodejs', + api: { + bodyParser: false, + }, +} + +export default vercelAPIHandler(authRouter) diff --git a/apps/apollo/src/pages/api/v3/self_hosted/auth/magic_link/verify.test.self-hosted.ts b/apps/apollo/src/pages/api/v3/self_hosted/auth/magic_link/verify.test.self-hosted.ts new file mode 100644 index 00000000000..619d295b6f6 --- /dev/null +++ b/apps/apollo/src/pages/api/v3/self_hosted/auth/magic_link/verify.test.self-hosted.ts @@ -0,0 +1,102 @@ +import { beforeEach, describe, expect, it, vi } from 'vitest' + +const { mockedEnv, verifySelfHostedMagicLink } = vi.hoisted(() => ({ + mockedEnv: { + APOLLO_ADMIN_TOKEN: 'test-admin-token', + COMPOSIO_ENV: 'local', + DISABLE_AUTH_MODES: [], + SELF_HOSTED: true, + }, + verifySelfHostedMagicLink: vi.fn(), +})) + +vi.mock('@/src/env', () => ({ + env: mockedEnv, + isProduction: () => false, +})) + +vi.mock('@/src/lib/self_hosted_magic_links/verify', () => ({ + verifySelfHostedMagicLink, +})) + +import { Ok } from 'ts-results' + +import { verifyMagicLinkRoute } from './verify' + +const adminToken = 'test-admin-token' + +describe('Self-hosted magic link verify route', () => { + beforeEach(() => { + mockedEnv.SELF_HOSTED = true + verifySelfHostedMagicLink.mockReset() + }) + + it('verifies a magic link from the self-hosted namespace', async () => { + verifySelfHostedMagicLink.mockResolvedValue( + Ok({ + jwt_token: 'jwt-token', + org_id: 'org-id', + email: 'operator@example.com', + member_id: 'member-id', + is_new_user: false, + }), + ) + + const res = await verifyMagicLinkRoute.request( + '/api/v3/self_hosted/auth/magic_link/verify', + { + method: 'POST', + headers: { + 'Content-Type': 'application/json', + 'x-composio-admin-token': adminToken, + }, + body: JSON.stringify({ + token: 'magic-token', + }), + }, + ) + + expect(res.status).toBe(200) + await expect(res.json()).resolves.toEqual({ + message: 'Successfully verified magic link', + data: { + jwt_token: 'jwt-token', + org_id: 'org-id', + email: 'operator@example.com', + member_id: 'member-id', + is_new_user: false, + }, + }) + expect(verifySelfHostedMagicLink).toHaveBeenCalledWith('magic-token') + }) + + it('does not expose the route outside self-hosted deployments', async () => { + mockedEnv.SELF_HOSTED = false + verifySelfHostedMagicLink.mockResolvedValue( + Ok({ + jwt_token: 'jwt-token', + org_id: 'org-id', + email: 'operator@example.com', + member_id: 'member-id', + is_new_user: false, + }), + ) + + const res = await verifyMagicLinkRoute.request( + '/api/v3/self_hosted/auth/magic_link/verify', + { + method: 'POST', + headers: { + 'Content-Type': 'application/json', + 'x-composio-admin-token': adminToken, + }, + body: JSON.stringify({ + token: 'magic-token', + }), + }, + ) + + expect(res.status).toBe(404) + expect(verifySelfHostedMagicLink).not.toHaveBeenCalled() + }) +}) diff --git a/apps/apollo/src/pages/api/v3/self_hosted/auth/magic_link/verify.ts b/apps/apollo/src/pages/api/v3/self_hosted/auth/magic_link/verify.ts new file mode 100644 index 00000000000..134f8ee4a7b --- /dev/null +++ b/apps/apollo/src/pages/api/v3/self_hosted/auth/magic_link/verify.ts @@ -0,0 +1,127 @@ +import type { PageConfig } from 'next' +import { ErrorSchema, errorToHTTPException } from '@/src/common/constants/error' +import { API_AUTH, API_VISIBILITY } from '@/src/common/types/openapi' +import { setAuthTokenCookie } from '@/src/common/utils/cookie' +import { verifySelfHostedMagicLink } from '@/src/lib/self_hosted_magic_links/verify' +import { getAdminAuthContext } from '@/src/server/context/getter' +import { vercelAPIHandler } from '@/src/server/handler/vercelHandler' +import { getSelfHostedAdminRouter } from '@/src/server/router/base_router' +import { createOpenAPIResponseSchema } from '@/src/server/schema/response' +import { createAuthRoute } from '@/src/server/schema/route' +import { zpp } from '@composio/lib' +import { z } from '@hono/zod-openapi' + +const authRouter = getSelfHostedAdminRouter() + +export const VerifyMagicLinkRequestSchema = z + .object({ + token: z + .string() + .min(1) + .describe('Magic link token to verify') + .openapi({ + example: '2e0a3d5d-835f-4485-b894-fdb8a49f9d8b', + }), + }) + .strict() + +export const VerifyMagicLinkResponseSchema = zpp( + z.object({ + message: z.string().openapi({ + example: 'Successfully verified magic link', + }), + data: z.object({ + jwt_token: z.string(), + org_id: z.string(), + email: z.string().email(), + member_id: z.string(), + is_new_user: z.boolean(), + }), + }), +) + +const VERIFY_MAGIC_LINK_OPENAPI_DEF = createAuthRoute( + { + method: 'post', + path: '/api/v3/self_hosted/auth/magic_link/verify', + summary: 'Verify self-hosted magic link token', + description: + 'Self-hosted administrative endpoint that verifies a one-time magic link token and returns session credentials.', + request: { + body: { + content: { + 'application/json': { + schema: VerifyMagicLinkRequestSchema, + }, + }, + required: true, + }, + }, + responses: { + 200: createOpenAPIResponseSchema( + VerifyMagicLinkResponseSchema, + 'Magic link successfully verified.', + ), + 400: createOpenAPIResponseSchema( + ErrorSchema, + 'Bad request - Missing or invalid token.', + ), + 401: createOpenAPIResponseSchema( + ErrorSchema, + 'Unauthorized - Invalid admin token, expired magic link, or used magic link.', + ), + 404: createOpenAPIResponseSchema( + ErrorSchema, + 'Not found - Magic link not found or endpoint unavailable outside self-hosted deployments.', + ), + 500: createOpenAPIResponseSchema( + ErrorSchema, + 'Internal server error - Failed to verify magic link.', + ), + }, + tags: ['Admin', 'Authentication'], + docsHide: true, + }, + 'Admin', + { + visibility: [API_VISIBILITY.ADMIN], + authModes: [API_AUTH.ADMIN], + }, +) + +export const verifyMagicLinkRoute = authRouter.openapi( + VERIFY_MAGIC_LINK_OPENAPI_DEF, + async (c) => { + const authInfo = getAdminAuthContext() + if (authInfo.err) { + return errorToHTTPException(c, authInfo.val) + } + + const { token } = c.req.valid('json') + const result = await verifySelfHostedMagicLink(token) + if (result.err) { + return errorToHTTPException(c, result.val) + } + + setAuthTokenCookie(c, result.val.jwt_token) + + return c.json( + VerifyMagicLinkResponseSchema.new({ + message: 'Successfully verified magic link', + data: result.val, + }), + 200, + ) + }, +) + +export const routes = [VERIFY_MAGIC_LINK_OPENAPI_DEF] + +export const config: PageConfig = { + runtime: 'nodejs', + api: { + bodyParser: false, + }, +} + +export default vercelAPIHandler(authRouter) diff --git a/apps/apollo/src/pages/api/v3/self_hosted/lookup/org_project.test.self-hosted.ts b/apps/apollo/src/pages/api/v3/self_hosted/lookup/org_project.test.self-hosted.ts new file mode 100644 index 00000000000..aada5e6418a --- /dev/null +++ b/apps/apollo/src/pages/api/v3/self_hosted/lookup/org_project.test.self-hosted.ts @@ -0,0 +1,135 @@ +import type { Context, Next } from 'hono' +import { beforeEach, describe, expect, it, vi } from 'vitest' + +const mocks = vi.hoisted(() => ({ + addAuthInfoInAsContext: vi.fn(async (_c, next) => next()), + env: { + COMPOSIO_ENV: 'local', + DISABLE_AUTH_MODES: [], + SELF_HOSTED: true, + }, + getAuthContext: vi.fn(), + orgByName: vi.fn(), + projectByName: vi.fn(), +})) + +vi.mock('@/src/env', () => ({ + env: mocks.env, + isProduction: () => false, +})) + +vi.mock('@/src/server/middleware/authInfo/addAuthInfo', () => ({ + addAuthInfoInAsContext: mocks.addAuthInfoInAsContext, +})) + +vi.mock('@/src/server/middleware/global_ip_rate_limit', () => ({ + globalIpRateLimitMiddleware: () => async (_c: Context, next: Next) => next(), +})) + +vi.mock('@/src/lib/ratelimit/middleware', () => ({ + rateLimitMiddleware: () => async (_c: Context, next: Next) => next(), +})) + +vi.mock('@/src/server/context/getter', () => ({ + getAuthContext: mocks.getAuthContext, +})) + +vi.mock('@/src/lib/org/dbUtils/findOrg', () => ({ + DB_ORG_FIND: { + byName: mocks.orgByName, + }, +})) + +vi.mock('@/src/lib/projects/dbUtils/findProject', () => ({ + DB_PROJECT_FIND: { + byName: mocks.projectByName, + }, +})) + +import { Ok } from 'ts-results' + +import { lookupOrgProjectRoute, routes } from './org_project' + +describe('Self-hosted org/project lookup route', () => { + beforeEach(() => { + mocks.env.SELF_HOSTED = true + mocks.addAuthInfoInAsContext.mockClear() + mocks.getAuthContext.mockReset() + mocks.orgByName.mockReset() + mocks.projectByName.mockReset() + + mocks.getAuthContext.mockReturnValue( + Ok({ + orgMember: { + id: 'user_123', + }, + }), + ) + mocks.orgByName.mockResolvedValue( + Ok({ + nanoId: 'ok_test_org', + }), + ) + mocks.projectByName.mockResolvedValue( + Ok({ + nanoId: 'pr_test_project', + }), + ) + }) + + it('keeps the old generated client operation name on the self-hosted path', () => { + expect(routes[0]).toMatchObject({ + method: 'get', + path: '/api/v3/self_hosted/lookup/org_project', + operationId: 'getLookupOrgProject', + }) + }) + + it('resolves an organization slug for self-hosted cookie sessions', async () => { + const res = await lookupOrgProjectRoute.request( + '/api/v3/self_hosted/lookup/org_project?org_slug=acme', + { + method: 'GET', + }, + ) + + expect(res.status).toBe(200) + await expect(res.json()).resolves.toEqual({ + org_id: 'ok_test_org', + }) + expect(mocks.orgByName).toHaveBeenCalledWith('acme', 'user_123') + expect(mocks.projectByName).not.toHaveBeenCalled() + }) + + it('resolves an organization and project slug for self-hosted cookie sessions', async () => { + const res = await lookupOrgProjectRoute.request( + '/api/v3/self_hosted/lookup/org_project?org_slug=acme&project_slug=prod', + { + method: 'GET', + }, + ) + + expect(res.status).toBe(200) + await expect(res.json()).resolves.toEqual({ + org_id: 'ok_test_org', + project_id: 'pr_test_project', + }) + expect(mocks.orgByName).toHaveBeenCalledWith('acme', 'user_123') + expect(mocks.projectByName).toHaveBeenCalledWith('prod', 'ok_test_org') + }) + + it('does not expose the route outside self-hosted deployments', async () => { + mocks.env.SELF_HOSTED = false + + const res = await lookupOrgProjectRoute.request( + '/api/v3/self_hosted/lookup/org_project?org_slug=acme', + { + method: 'GET', + }, + ) + + expect(res.status).toBe(404) + expect(mocks.orgByName).not.toHaveBeenCalled() + expect(mocks.projectByName).not.toHaveBeenCalled() + }) +}) diff --git a/apps/apollo/src/pages/api/v3/self_hosted/lookup/org_project.ts b/apps/apollo/src/pages/api/v3/self_hosted/lookup/org_project.ts new file mode 100644 index 00000000000..43e4eb850bd --- /dev/null +++ b/apps/apollo/src/pages/api/v3/self_hosted/lookup/org_project.ts @@ -0,0 +1,161 @@ +import type { PageConfig } from 'next' +import { ErrorSchema, errorToHTTPException } from '@/src/common/constants/error' +import { API_AUTH, API_VISIBILITY } from '@/src/common/types/openapi' +import { env } from '@/src/env' +import { DB_ORG_FIND } from '@/src/lib/org/dbUtils/findOrg' +import { DB_PROJECT_FIND } from '@/src/lib/projects/dbUtils/findProject' +import { getAuthContext } from '@/src/server/context/getter' +import { vercelAPIHandler } from '@/src/server/handler/vercelHandler' +import { selfHostedOnlyMiddleware } from '@/src/server/middleware/selfHostedOnly' +import { getAuthRouter, getRouter } from '@/src/server/router/base_router' +import { createOpenAPIResponseSchema } from '@/src/server/schema/response' +import { createAuthRoute } from '@/src/server/schema/route' +import { zpp } from '@composio/lib' +import { OrgNanoIdSchema } from '@composio/types' +import { z } from '@hono/zod-openapi' + +const lookupRouter = env.SELF_HOSTED + ? getAuthRouter({ + disableProjectAPIKey: true, + }) + : getRouter() + +if (env.SELF_HOSTED) { + lookupRouter.use(selfHostedOnlyMiddleware) +} + +export const LookupQuerySchema = z.object({ + org_slug: z.string().min(1).describe('Organization name to lookup').openapi({ + example: 'my-organization', + description: + 'The name/slug of the organization (case-insensitive). This should be url encoded.', + }), + project_slug: z + .string() + .min(1) + .optional() + .describe( + 'Project name/slug to lookup within the organization (case-insensitive). This should be url encoded.', + ) + .openapi({ + example: 'my-project', + description: + 'The name of the project within the organization (case-insensitive). This should be url encoded.', + }), +}) + +export const LookupResponseSchema = zpp( + z.object({ + org_id: z.string().describe('Organization nano ID').openapi({ + example: 'ok_1a2b3c4d5e6f', + description: 'The unique nano ID of the organization', + }), + project_id: z + .string() + .optional() + .describe('Project nano ID (if project_slug was provided)') + .openapi({ + example: 'pr_1a2b3c4d5e6f', + description: 'The unique nano ID of the project', + }), + }), +) + +const LOOKUP_ORG_PROJECT_DEF = createAuthRoute( + { + method: 'get', + path: '/api/v3/self_hosted/lookup/org_project', + operationId: 'getLookupOrgProject', + summary: 'Lookup organization and project IDs by name', + description: + 'Resolve organization and optionally project names to their nano IDs. Only returns resources the authenticated user has access to.', + tags: ['Lookup', 'Organizations', 'Projects'], + request: { + query: LookupQuerySchema, + }, + responses: { + 200: createOpenAPIResponseSchema( + LookupResponseSchema, + 'Successfully resolved organization and/or project IDs', + ), + 400: createOpenAPIResponseSchema( + ErrorSchema, + 'Bad request - Missing required org_slug parameter', + ), + 401: createOpenAPIResponseSchema( + ErrorSchema, + 'Unauthorized - Invalid credentials or session expired', + ), + 404: createOpenAPIResponseSchema( + ErrorSchema, + 'Not found - Endpoint is unavailable outside self-hosted deployments, or organization/project was not found or is inaccessible', + ), + 500: createOpenAPIResponseSchema( + ErrorSchema, + 'Internal server error - Failed to lookup resources', + ), + }, + }, + 'Authentication', + { + visibility: [ + API_VISIBILITY.FRONTEND, + ...(env.SELF_HOSTED ? [API_VISIBILITY.SDK] : []), + ], + authModes: [API_AUTH.COOKIE], + }, +) + +export const lookupOrgProjectRoute = env.SELF_HOSTED + ? lookupRouter.openapi(LOOKUP_ORG_PROJECT_DEF, async (c) => { + const authInfo = getAuthContext() + if (authInfo.err) { + return errorToHTTPException(c, authInfo.val) + } + + const { org_slug, project_slug } = c.req.valid('query') + const userId = authInfo.val.orgMember.id + + const orgResult = await DB_ORG_FIND.byName(org_slug, userId) + if (!orgResult.ok) { + return errorToHTTPException(c, orgResult.val) + } + + if (!project_slug) { + return c.json( + LookupResponseSchema.new({ + org_id: orgResult.val.nanoId, + }), + 200, + ) + } + + const projectResult = await DB_PROJECT_FIND.byName( + project_slug, + OrgNanoIdSchema.parse(orgResult.val.nanoId), + ) + + if (projectResult.err) { + return errorToHTTPException(c, projectResult.val) + } + + return c.json( + LookupResponseSchema.new({ + org_id: orgResult.val.nanoId, + project_id: projectResult.val?.nanoId, + }), + 200, + ) + }) + : lookupRouter + +export const routes = env.SELF_HOSTED ? [LOOKUP_ORG_PROJECT_DEF] : [] + +export const config: PageConfig = { + runtime: 'nodejs', + api: { + bodyParser: false, + }, +} + +export default vercelAPIHandler(lookupRouter) diff --git a/apps/apollo/src/server/router/base_router.ts b/apps/apollo/src/server/router/base_router.ts index ad1f6c45bcb..64249b555dc 100644 --- a/apps/apollo/src/server/router/base_router.ts +++ b/apps/apollo/src/server/router/base_router.ts @@ -161,7 +161,7 @@ export const getDashboardRouter = () => { * @param params - Configuration parameters * @param params.disableProjectAPIKey - Whether to disable project API key access, ideally use these for org endpoint * @param params.disableCookie - Whether to disable cookie/session authentication. Use for endpoints that should be reachable only via API keys (e.g. tool execution paths). - * @param params.restrictApiKeyToSelfHosted - When `true`, reject any request that authenticates via project / user / bearer API key unless `env.SELF_HOSTED === true`. Cookie and project-JWT auth still pass through in any environment. Use for endpoints whose mutating operations must be driven from the dashboard on cloud (e.g. project-wide config flips) but should remain scriptable on self-hosted. + * @param params.restrictApiKeyToSelfHosted - When `true`, reject any request that authenticates via project / user / bearer API key unless `env.SELF_HOSTED === true`. Project-JWT auth still passes through in any environment; legacy authToken cookies are accepted only when `env.SELF_HOSTED === true`. Use for endpoints whose mutating operations must be driven from the dashboard on cloud (e.g. project-wide config flips) but should remain scriptable on self-hosted. * @param params.enableRateLimit - Whether to enable rate limiting middleware * @returns OpenAPI router with authentication and authorization middleware */

Description

How did I test this PR

Description

How did I test this PR