mirror of
https://github.com/profullstack/logicsrc.git
synced 2026-08-14 14:57:28 +00:00
Anthony Ettinger
9ba044577f
Adds apps/pwa: an Express + libSQL/Turso app that is now the home of team credential sharing, with the moshcode-style auth stack ported and reskinned to match logicsrc.com (light theme, Inter, green accent). apps/pwa - auth: email/password (scrypt), passkeys (WebAuthn), CoinPay OAuth, cookie sessions, and lsk_ API keys for the CLI via a loopback OAuth-PKCE flow (/cli/authorize + /cli/token). Ported from the moshcode PWA. - credshare API (/api/credshare/*): teams, members, invites, vaults, sealed grants, ciphertext secrets, audit — authed by session OR Bearer lsk_ key. Zero-knowledge: only ciphertext + sealed vault keys + public keys stored. - teams dashboard, accept-invite, and settings (API keys) pages, server-rendered in the LogicSRC brand (lib/html.mjs). - migrations (libSQL) 001_auth + 002_credshare, migrate-on-boot; Turso via TURSO_DATABASE_URL / TURSO_AUTH_TOKEN, or a local file db for dev. - trimmed moshcode-specific approvals/credits/push/deliver. CLI - `logicsrc login` now does browser loopback OAuth-PKCE against the app and stores an lsk_ token (email-OTP removed); --token for CI. Client repointed. Distribution - install.sh (served at logicsrc.com/install.sh) installs the CLI from the GitHub repo: tarball -> npm install -> `npm run build:cli` -> logicsrc wrapper. - root build:cli builds only the CLI's workspace chain (skips web/api/next). Cleanup - removed the commandboard-api credshare backend (superseded by the PWA) and its Supabase/Turso stores + libsql dep; commandboard-api tests green (40). - removed the Next.js /teams page (the PWA is the web UI now). Verified end-to-end: two accounts register on the PWA, mint lsk_ keys, CLI login uploads identity keys, owner pushes an encrypted .env, teammate invited -> accepted -> granted -> pulls the exact file. Server stores ciphertext only. Full workspace build + tests green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
58 lines
2.6 KiB
JavaScript
58 lines
2.6 KiB
JavaScript
// LogicSRC credentials — Express PWA entrypoint (auth + team credential sharing).
|
|
import express from "express";
|
|
import cookieParser from "cookie-parser";
|
|
import path from "node:path";
|
|
import { config } from "./config.mjs";
|
|
import { migrate } from "./migrate.mjs";
|
|
import { sessionMiddleware, csrfGuard } from "./lib/session.mjs";
|
|
import { authRouter } from "./routes/auth.mjs";
|
|
import { passkeyRouter } from "./routes/passkey.mjs";
|
|
import { coinpayRouter } from "./routes/coinpay.mjs";
|
|
import { credshareRouter } from "./routes/credshare.mjs";
|
|
import { cliRouter } from "./routes/cli.mjs";
|
|
import { pagesRouter } from "./routes/pages.mjs";
|
|
|
|
const app = express();
|
|
app.disable("x-powered-by");
|
|
if (config.secure) app.set("trust proxy", 1); // Railway terminates TLS
|
|
|
|
// body parsing — keep the raw body for HMAC signature verification
|
|
app.use(express.json({ verify: (req, _res, buf) => { req.rawBody = buf.toString("utf8"); } }));
|
|
app.use(express.urlencoded({ extended: false }));
|
|
app.use(cookieParser());
|
|
|
|
// static
|
|
app.use(express.static(path.join(config.root, "public"), { maxAge: "1h" }));
|
|
// the @simplewebauthn/browser UMD bundle, served from node_modules (no CDN)
|
|
app.get("/vendor/simplewebauthn-browser.umd.js", (_req, res) =>
|
|
res.sendFile(path.join(config.root, "node_modules/@simplewebauthn/browser/dist/bundle/index.umd.min.js")));
|
|
|
|
app.get("/healthz", (_req, res) => res.json({ ok: true, env: config.env }));
|
|
|
|
app.use(sessionMiddleware);
|
|
app.use(csrfGuard);
|
|
|
|
// routes
|
|
app.use(authRouter); // GET / (+ /auth/login|register|logout)
|
|
app.use(passkeyRouter);
|
|
app.use(coinpayRouter);
|
|
app.use(credshareRouter); // /api/credshare/* (session or lsk_ Bearer)
|
|
app.use(cliRouter); // /cli/authorize, /cli/token, /api/me
|
|
app.use(pagesRouter); // /dashboard, /teams/*, /settings
|
|
|
|
app.use((req, res) => res.status(404).type("html").send(
|
|
`<body style="background:#f6f7f4;color:#101418;font-family:system-ui,sans-serif;padding:14vh 24px;text-align:center"><h1 style="color:#0a7d59">404</h1><p>no such page.</p><a style="color:#0a7d59" href="/">back to your teams →</a></body>`));
|
|
|
|
// eslint-disable-next-line no-unused-vars
|
|
app.use((err, _req, res, _next) => {
|
|
console.error(err);
|
|
res.status(500).type("html").send(`<body style="background:#f6f7f4;color:#c23a3a;font-family:system-ui,sans-serif;padding:14vh 24px;text-align:center"><h1>500</h1><p>something broke.</p></body>`);
|
|
});
|
|
|
|
async function main() {
|
|
await migrate();
|
|
app.listen(config.port, () => console.log(`🔐 logicsrc credentials on :${config.port} (${config.env}) — ${config.origin}`));
|
|
}
|
|
main().catch((e) => { console.error("boot failed:", e); process.exit(1); });
|
|
|
|
export { app };
|