http.rs 88.9%

168 of 189 lines run, 35 of 74 functions · run #20 on main · run missed

//! Tuner over HTTP (spec §15.1, §8.5, §21.1): `POST /mcp` on the Unix
//! socket and the loopback port, every request signed and checked before
//! anything else; the peer's uid read from the socket; `Origin` checked
//! against DNS rebinding.

use crate::protocol::{self, Headers, Reply};
use crate::tools::Ctx;
use axum::body::Bytes;
use axum::extract::connect_info::{ConnectInfo, Connected};
use axum::extract::State;
use axum::http::{HeaderMap, StatusCode};
use axum::response::sse::{Event as SseEvent, KeepAlive, Sse};
use axum::response::{IntoResponse, Response};
use axum::routing::post;
use axum::Router;
use futures::stream::{self, StreamExt};
use serde_json::{json, Value as Json};
use spectra_core::authn::Caller;
use spectra_core::daemon::{Daemon, Peer, WireEvent};
use spectra_core::principals::Principal;
use spectra_core::proof::Proof;
use std::convert::Infallible;
use std::sync::Arc;
use std::time::Duration;

/// Who is on the other end of a connection: a Unix peer, or TCP.
#[derive(Clone, Copy, Debug)]
pub struct PeerInfo(pub Option<Peer>);

impl Connected<axum::serve::IncomingStream<'_, tokio::net::UnixListener>> for PeerInfo {
    fn connect_info(stream: axum::serve::IncomingStream<'_, tokio::net::UnixListener>) -> Self {
        let cred = stream.io().peer_cred().ok();
        PeerInfo(cred.map(|c| Peer { uid: c.uid(), pid: c.pid() }))
    }
}

impl Connected<axum::serve::IncomingStream<'_, tokio::net::TcpListener>> for PeerInfo {
    fn connect_info(_: axum::serve::IncomingStream<'_, tokio::net::TcpListener>) -> Self {
        PeerInfo(None)
    }
}

impl Connected<axum::serve::IncomingStream<'_, crate::tls::TlsListener>> for PeerInfo {
    fn connect_info(_: axum::serve::IncomingStream<'_, crate::tls::TlsListener>) -> Self {
        PeerInfo(None)
    }
}

/// The app state: the daemon, and the origins a browser may send from.
#[derive(Clone)]
pub struct AppState {
    pub daemon: Arc<Daemon>,
    pub origins: Arc<Vec<String>>,
    /// The owner's browser sessions (Radar's sign-in link).
    pub sessions: Arc<crate::session::Sessions>,
}

/// Tuner's routes; the binary adds the API and Radar beside them.
pub fn router(state: AppState) -> Router {
    Router::new()
        .route("/mcp", post(mcp).get(not_allowed).delete(not_allowed))
        .route("/api/v1/ledger/events", post(owner_events))
        .route("/api/v1/instance", axum::routing::get(instance))
        .route("/api/v1/claim", post(claim))
        .with_state(state)
}

/// `GET /api/v1/instance`, unauthenticated (spec §8.6): who this Spectra
/// is, whose it is, and the instance key's word for its TLS certificate, so
/// a client can decide whether to trust it before it signs anything.
async fn instance(State(state): State<AppState>) -> Response {
    let (instance, owner) = {
        let p = state.daemon.principals.read().await;
        (p.instance().cloned(), p.owner().map(|o| o.hash().to_hex()))
    };
    let owner_missing = owner.is_none();
    let Some(instance) = instance else {
        return (StatusCode::SERVICE_UNAVAILABLE, axum::Json(json!({ "title": "this Spectra has no instance key" }))).into_response();
    };
    let tls = match crate::instance::latest_tls(&state.daemon.ledger).await {
        Ok(Some(e)) => json!({ "payload": e.json(), "proof": e.auth.proof.as_ref().map(hex::encode) }),
        _ => Json::Null,
    };
    axum::Json(json!({
        "name": instance.name,
        "instance": spectra_core::principals::identity_payload(&instance),
        "owner": owner,
        // Until claimed: the KeyId `spectra init --owner` named.
        "named_owner": if owner_missing { state.daemon.named_owner() } else { None },
        "tls": tls,
    }))
    .into_response()
}

/// `POST /api/v1/claim`: the owner named by `spectra init --owner` records
/// their identity (spec §8.6). The event proves itself: it is signed by
/// the identity it records, over its payload.
async fn claim(State(state): State<AppState>, body: Bytes) -> Response {
    let events: Vec<WireEvent> = match serde_json::from_slice(&body) {
        Ok(v) => v,
        Err(e) => return (StatusCode::BAD_REQUEST, axum::Json(json!({ "title": format!("not a list of events: {e}") }))).into_response(),
    };
    match state.daemon.claim(events).await {
        Ok(seqs) => axum::Json(json!({ "seqs": seqs })).into_response(),
        Err(e) => (StatusCode::FORBIDDEN, axum::Json(json!({ "title": format!("{e:#}") }))).into_response(),
    }
}

async fn not_allowed() -> StatusCode {
    StatusCode::METHOD_NOT_ALLOWED
}

/// The proof the signature headers carry, for `method_path` and `body`.
pub fn proof_from(headers: &HeaderMap, method_path: &str, body: &[u8]) -> Option<Proof> {
    let get = |k: &str| headers.get(k).and_then(|v| v.to_str().ok());
    let key = get("spectra-key")?;
    let time_ms = get("spectra-time")?.parse().ok()?;
    let nonce: [u8; 16] = hex::decode(get("spectra-nonce")?).ok()?.try_into().ok()?;
    let sig_bytes = hex::decode(get("spectra-signature")?).ok()?;
    let sig = oxy_core::cbor::decode(&sig_bytes).ok().and_then(|v| oxy_core::identity::Signature::from_value(&v).ok())?;
    if sig.key.to_hex() != key {
        return None;
    }
    Some(Proof { sig, method: method_path.into(), body_hash: *spectra_core::event::hash_body_plain(body), time_ms, nonce })
}

/// Refuse a browser request from a page that is not ours (spec §21.1).
pub fn origin_ok(headers: &HeaderMap, allowed: &[String]) -> bool {
    match headers.get("origin").and_then(|v| v.to_str().ok()) {
        None => true,
        Some(o) => allowed.iter().any(|a| a == o),
    }
}

/// Authenticate a request, or the status and reason that refuse it.
pub async fn authenticate_why(
    state: &AppState,
    peer: PeerInfo,
    headers: &HeaderMap,
    method_path: &str,
    body: &[u8],
) -> Result<Caller, (StatusCode, String)> {
    if !origin_ok(headers, &state.origins) {
        return Err((StatusCode::FORBIDDEN, "this origin may not call Spectra".into()));
    }
    let proof = proof_from(headers, method_path, body);
    state.daemon.authenticate(proof.as_ref(), method_path, body, peer.0).await.map_err(|why| {
        tracing::info!(%why, "refused a request");
        // The reason concerns the caller's own key, so the caller is told it:
        // an agent whose delegation expired must be able to say so.
        (StatusCode::UNAUTHORIZED, why.to_string())
    })
}

/// Authenticate a request, or the JSON-RPC response that refuses it.
pub async fn authenticate(
    state: &AppState,
    peer: PeerInfo,
    headers: &HeaderMap,
    method_path: &str,
    body: &[u8],
) -> Result<Caller, Response> {
    authenticate_why(state, peer, headers, method_path, body).await.map_err(|(status, why)| {
        let (code, msg) = if status == StatusCode::FORBIDDEN {
            (protocol::INVALID_REQUEST, why)
        } else {
            (protocol::UNAUTHENTICATED, format!("not authenticated: {why}"))
        };
        (status, axum::Json(protocol::error(&Json::Null, code, &msg))).into_response()
    })
}

async fn mcp(State(state): State<AppState>, ConnectInfo(peer): ConnectInfo<PeerInfo>, headers: HeaderMap, body: Bytes) -> Response {
    let caller = match authenticate(&state, peer, &headers, "POST /mcp", &body).await {
        Ok(c) => c,
        Err(r) => return r,
    };
    let req: Json = match serde_json::from_slice(&body) {
        Ok(v) => v,
        Err(e) => {
            return (StatusCode::BAD_REQUEST, axum::Json(protocol::error(&Json::Null, protocol::PARSE_ERROR, &format!("not JSON: {e}"))))
                .into_response()
        }
    };
    let new_session = req.pointer("/params/arguments/new_session").and_then(Json::as_bool).unwrap_or(false)
        && req.pointer("/params/name").and_then(Json::as_str) == Some("brief");
    let session = state.daemon.touch(&caller.principal, new_session).await;
    let h = Headers {
        version: headers.get("mcp-protocol-version").and_then(|v| v.to_str().ok()),
        method: headers.get("mcp-method").and_then(|v| v.to_str().ok()),
        name: headers.get("mcp-name").and_then(|v| v.to_str().ok()),
    };
    let version = h.version.unwrap_or("2025-03-26").to_string();
    let ctx = Ctx { daemon: state.daemon.clone(), caller, session };
    let meta = meta(&ctx).await;
    match protocol::handle(&ctx, &h, req, meta.clone()).await {
        Reply::Json(status, v) => (StatusCode::from_u16(status).unwrap_or(StatusCode::OK), axum::Json(v)).into_response(),
        Reply::Accepted => StatusCode::ACCEPTED.into_response(),
        Reply::Stream(id, tool, args) => {
            let fut = async move {
                let out = crate::tools::invoke(&ctx, tool, args).await;
                let meta = crate::http::meta(&ctx).await;
                let msg = protocol::stream_result(&id, &version, &out, meta);
                Ok::<_, Infallible>(SseEvent::default().event("message").data(msg.to_string()))
            };
            sse(stream::once(fut).boxed())
        }
        Reply::Listen(id, sub) => {
            let ack = json!({ "jsonrpc": "2.0", "method": "notifications/subscriptions/acknowledged", "params": { "_meta": { "io.modelcontextprotocol/subscriptionId": sub } } });
            let _ = id;
            let first = stream::once(async move { Ok::<_, Infallible>(SseEvent::default().event("message").data(ack.to_string())) });
            // Spectra's tool list never changes while it runs: the stream
            // stays open, quiet but for keep-alives, until the client closes it.
            sse(first.chain(stream::pending()).boxed())
        }
    }
}

fn sse(s: futures::stream::BoxStream<'static, Result<SseEvent, Infallible>>) -> Response {
    let mut r = Sse::new(s).keep_alive(KeepAlive::new().interval(Duration::from_secs(15)).text("")).into_response();
    r.headers_mut().insert("x-accel-buffering", "no".parse().unwrap());
    r
}

/// `_meta` on every result (spec §15.2): the rules version, the session and
/// the unread count.
pub async fn meta(ctx: &Ctx) -> Json {
    let mut m = serde_json::Map::new();
    if let Ok(r) = spectra_core::rules::compile(&ctx.daemon.data) {
        m.insert("spectra/rules_version".into(), json!(r.version));
    }
    if let Some(s) = &ctx.session {
        m.insert("spectra/session".into(), json!(s));
    }
    if let Ok(n) = spectra_core::conversation::unread(&ctx.daemon.ledger, &ctx.caller.principal.actor()).await {
        m.insert("spectra/inbox_unread".into(), json!(n));
    }
    Json::Object(m)
}

/// `POST /api/v1/ledger/events`: the owner's CLI hands over events it
/// signed over their payload, so `agent add` and `project add` work while
/// the daemon holds the ledger (spec §8.5, "One writer").
async fn owner_events(
    State(state): State<AppState>,
    ConnectInfo(peer): ConnectInfo<PeerInfo>,
    headers: HeaderMap,
    body: Bytes,
) -> Response {
    let caller = match authenticate(&state, peer, &headers, "POST /api/v1/ledger/events", &body).await {
        Ok(c) => c,
        Err(r) => return r,
    };
    if !matches!(caller.principal, Principal::Owner { .. }) {
        return (StatusCode::FORBIDDEN, axum::Json(json!({ "title": "only the owner hands events to the daemon" }))).into_response();
    }
    let events: Vec<WireEvent> = match serde_json::from_slice(&body) {
        Ok(v) => v,
        Err(e) => return (StatusCode::BAD_REQUEST, axum::Json(json!({ "title": format!("not a list of events: {e}") }))).into_response(),
    };
    match state.daemon.accept_owner_events(events).await {
        Ok(seqs) => axum::Json(json!({ "appended": seqs })).into_response(),
        Err(e) => (StatusCode::UNPROCESSABLE_ENTITY, axum::Json(json!({ "title": e.to_string() }))).into_response(),
    }
}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

1		//! Tuner over HTTP (spec §15.1, §8.5, §21.1): `POST /mcp` on the Unix
2		//! socket and the loopback port, every request signed and checked before
3		//! anything else; the peer's uid read from the socket; `Origin` checked
4		//! against DNS rebinding.
5
6		use crate::protocol::{self, Headers, Reply};
7		use crate::tools::Ctx;
8		use axum::body::Bytes;
9		use axum::extract::connect_info::{ConnectInfo, Connected};
10		use axum::extract::State;
11		use axum::http::{HeaderMap, StatusCode};
12		use axum::response::sse::{Event as SseEvent, KeepAlive, Sse};
13		use axum::response::{IntoResponse, Response};
14		use axum::routing::post;
15		use axum::Router;
16		use futures::stream::{self, StreamExt};
17		use serde_json::{json, Value as Json};
18		use spectra_core::authn::Caller;
19		use spectra_core::daemon::{Daemon, Peer, WireEvent};
20		use spectra_core::principals::Principal;
21		use spectra_core::proof::Proof;
22		use std::convert::Infallible;
23		use std::sync::Arc;
24		use std::time::Duration;
25
26		/// Who is on the other end of a connection: a Unix peer, or TCP.
27		#[derive(Clone, Copy, Debug)]
28		pub struct PeerInfo(pub Option<Peer>);
29
30		impl Connected<axum::serve::IncomingStream<'_, tokio::net::UnixListener>> for PeerInfo {
31	111×	fn connect_info(stream: axum::serve::IncomingStream<'_, tokio::net::UnixListener>) -> Self {
32	111×	let cred = stream.io().peer_cred().ok();
33	111×	PeerInfo(cred.map(\|c\| Peer { uid: c.uid(), pid: c.pid() }))
34	111×	}
35		}
36
37		impl Connected<axum::serve::IncomingStream<'_, tokio::net::TcpListener>> for PeerInfo {
38	0×	fn connect_info(_: axum::serve::IncomingStream<'_, tokio::net::TcpListener>) -> Self {
39	0×	PeerInfo(None)
40	0×	}
41		}
42
43		impl Connected<axum::serve::IncomingStream<'_, crate::tls::TlsListener>> for PeerInfo {
44	20×	fn connect_info(_: axum::serve::IncomingStream<'_, crate::tls::TlsListener>) -> Self {
45	20×	PeerInfo(None)
46	20×	}
47		}
48
49		/// The app state: the daemon, and the origins a browser may send from.
50		#[derive(Clone)]
51		pub struct AppState {
52		pub daemon: Arc<Daemon>,
53		pub origins: Arc<Vec<String>>,
54		/// The owner's browser sessions (Radar's sign-in link).
55		pub sessions: Arc<crate::session::Sessions>,
56		}
57
58		/// Tuner's routes; the binary adds the API and Radar beside them.
59	17×	pub fn router(state: AppState) -> Router {
60	17×	Router::new()
61	17×	.route("/mcp", post(mcp).get(not_allowed).delete(not_allowed))
62	17×	.route("/api/v1/ledger/events", post(owner_events))
63	17×	.route("/api/v1/instance", axum::routing::get(instance))
64	17×	.route("/api/v1/claim", post(claim))
65	17×	.with_state(state)
66	17×	}
67
68		/// `GET /api/v1/instance`, unauthenticated (spec §8.6): who this Spectra
69		/// is, whose it is, and the instance key's word for its TLS certificate, so
70		/// a client can decide whether to trust it before it signs anything.
71	11×	async fn instance(State(state): State<AppState>) -> Response {
72	11×	let (instance, owner) = {
73	11×	let p = state.daemon.principals.read().await;
74	11×	(p.instance().cloned(), p.owner().map(\|o\| o.hash().to_hex()))
75		};
76	11×	let owner_missing = owner.is_none();
77	11×	let Some(instance) = instance else {
78	0×	return (StatusCode::SERVICE_UNAVAILABLE, axum::Json(json!({ "title": "this Spectra has no instance key" }))).into_response();
79		};
80	11×	let tls = match crate::instance::latest_tls(&state.daemon.ledger).await {
81	11×	Ok(Some(e)) => json!({ "payload": e.json(), "proof": e.auth.proof.as_ref().map(hex::encode) }),
82	0×	_ => Json::Null,
83		};
84	11×	axum::Json(json!({
85	11×	"name": instance.name,
86	11×	"instance": spectra_core::principals::identity_payload(&instance),
87	11×	"owner": owner,
88		// Until claimed: the KeyId `spectra init --owner` named.
89	11×	"named_owner": if owner_missing { state.daemon.named_owner() } else { None },
90	11×	"tls": tls,
91		}))
92	11×	.into_response()
93	11×	}
94
95		/// `POST /api/v1/claim`: the owner named by `spectra init --owner` records
96		/// their identity (spec §8.6). The event proves itself: it is signed by
97		/// the identity it records, over its payload.
98	5×	async fn claim(State(state): State<AppState>, body: Bytes) -> Response {
99	5×	let events: Vec<WireEvent> = match serde_json::from_slice(&body) {
100	5×	Ok(v) => v,
101	0×	Err(e) => return (StatusCode::BAD_REQUEST, axum::Json(json!({ "title": format!("not a list of events: {e}") }))).into_response(),
102		};
103	5×	match state.daemon.claim(events).await {
104	2×	Ok(seqs) => axum::Json(json!({ "seqs": seqs })).into_response(),
105	3×	Err(e) => (StatusCode::FORBIDDEN, axum::Json(json!({ "title": format!("{e:#}") }))).into_response(),
106		}
107	5×	}
108
109	1×	async fn not_allowed() -> StatusCode {
110	1×	StatusCode::METHOD_NOT_ALLOWED
111	1×	}
112
113		/// The proof the signature headers carry, for `method_path` and `body`.
114	79×	pub fn proof_from(headers: &HeaderMap, method_path: &str, body: &[u8]) -> Option<Proof> {
115	310×	let get = \|k: &str\| headers.get(k).and_then(\|v\| v.to_str().ok());
116	79×	let key = get("spectra-key")?;
117	77×	let time_ms = get("spectra-time")?.parse().ok()?;
118	77×	let nonce: [u8; 16] = hex::decode(get("spectra-nonce")?).ok()?.try_into().ok()?;
119	77×	let sig_bytes = hex::decode(get("spectra-signature")?).ok()?;
120	77×	let sig = oxy_core::cbor::decode(&sig_bytes).ok().and_then(\|v\| oxy_core::identity::Signature::from_value(&v).ok())?;
121	77×	if sig.key.to_hex() != key {
122	0×	return None;
123	77×	}
124	77×	Some(Proof { sig, method: method_path.into(), body_hash: *spectra_core::event::hash_body_plain(body), time_ms, nonce })
125	79×	}
126
127		/// Refuse a browser request from a page that is not ours (spec §21.1).
128	84×	pub fn origin_ok(headers: &HeaderMap, allowed: &[String]) -> bool {
129	84×	match headers.get("origin").and_then(\|v\| v.to_str().ok()) {
130	82×	None => true,
131	6×	Some(o) => allowed.iter().any(\|a\| a == o),
132		}
133	84×	}
134
135		/// Authenticate a request, or the status and reason that refuse it.
136	80×	pub async fn authenticate_why(
137	80×	state: &AppState,
138	80×	peer: PeerInfo,
139	80×	headers: &HeaderMap,
140	80×	method_path: &str,
141	80×	body: &[u8],
142	80×	) -> Result<Caller, (StatusCode, String)> {
143	80×	if !origin_ok(headers, &state.origins) {
144	1×	return Err((StatusCode::FORBIDDEN, "this origin may not call Spectra".into()));
145	79×	}
146	79×	let proof = proof_from(headers, method_path, body);
147	79×	state.daemon.authenticate(proof.as_ref(), method_path, body, peer.0).await.map_err(\|why\| {
148	6×	tracing::info!(%why, "refused a request");
149		// The reason concerns the caller's own key, so the caller is told it:
150		// an agent whose delegation expired must be able to say so.
151	6×	(StatusCode::UNAUTHORIZED, why.to_string())
152	6×	})
153	80×	}
154
155		/// Authenticate a request, or the JSON-RPC response that refuses it.
156	50×	pub async fn authenticate(
157	50×	state: &AppState,
158	50×	peer: PeerInfo,
159	50×	headers: &HeaderMap,
160	50×	method_path: &str,
161	50×	body: &[u8],
162	50×	) -> Result<Caller, Response> {
163	50×	authenticate_why(state, peer, headers, method_path, body).await.map_err(\|(status, why)\| {
164	5×	let (code, msg) = if status == StatusCode::FORBIDDEN {
165	1×	(protocol::INVALID_REQUEST, why)
166		} else {
167	4×	(protocol::UNAUTHENTICATED, format!("not authenticated: {why}"))
168		};
169	5×	(status, axum::Json(protocol::error(&Json::Null, code, &msg))).into_response()
170	5×	})
171	50×	}
172
173	47×	async fn mcp(State(state): State<AppState>, ConnectInfo(peer): ConnectInfo<PeerInfo>, headers: HeaderMap, body: Bytes) -> Response {
174	47×	let caller = match authenticate(&state, peer, &headers, "POST /mcp", &body).await {
175	42×	Ok(c) => c,
176	5×	Err(r) => return r,
177		};
178	42×	let req: Json = match serde_json::from_slice(&body) {
179	42×	Ok(v) => v,
180	0×	Err(e) => {
181	0×	return (StatusCode::BAD_REQUEST, axum::Json(protocol::error(&Json::Null, protocol::PARSE_ERROR, &format!("not JSON: {e}"))))
182	0×	.into_response()
183		}
184		};
185	42×	let new_session = req.pointer("/params/arguments/new_session").and_then(Json::as_bool).unwrap_or(false)
186	0×	&& req.pointer("/params/name").and_then(Json::as_str) == Some("brief");
187	42×	let session = state.daemon.touch(&caller.principal, new_session).await;
188	42×	let h = Headers {
189	42×	version: headers.get("mcp-protocol-version").and_then(\|v\| v.to_str().ok()),
190	42×	method: headers.get("mcp-method").and_then(\|v\| v.to_str().ok()),
191	42×	name: headers.get("mcp-name").and_then(\|v\| v.to_str().ok()),
192		};
193	42×	let version = h.version.unwrap_or("2025-03-26").to_string();
194	42×	let ctx = Ctx { daemon: state.daemon.clone(), caller, session };
195	42×	let meta = meta(&ctx).await;
196	42×	match protocol::handle(&ctx, &h, req, meta.clone()).await {
197	34×	Reply::Json(status, v) => (StatusCode::from_u16(status).unwrap_or(StatusCode::OK), axum::Json(v)).into_response(),
198	2×	Reply::Accepted => StatusCode::ACCEPTED.into_response(),
199	6×	Reply::Stream(id, tool, args) => {
200	6×	let fut = async move {
201	6×	let out = crate::tools::invoke(&ctx, tool, args).await;
202	6×	let meta = crate::http::meta(&ctx).await;
203	6×	let msg = protocol::stream_result(&id, &version, &out, meta);
204	6×	Ok::<_, Infallible>(SseEvent::default().event("message").data(msg.to_string()))
205	6×	};
206	6×	sse(stream::once(fut).boxed())
207		}
208	0×	Reply::Listen(id, sub) => {
209	0×	let ack = json!({ "jsonrpc": "2.0", "method": "notifications/subscriptions/acknowledged", "params": { "_meta": { "io.modelcontextprotocol/subscriptionId": sub } } });
210	0×	let _ = id;
211	0×	let first = stream::once(async move { Ok::<_, Infallible>(SseEvent::default().event("message").data(ack.to_string())) });
212		// Spectra's tool list never changes while it runs: the stream
213		// stays open, quiet but for keep-alives, until the client closes it.
214	0×	sse(first.chain(stream::pending()).boxed())
215		}
216		}
217	47×	}
218
219	6×	fn sse(s: futures::stream::BoxStream<'static, Result<SseEvent, Infallible>>) -> Response {
220	6×	let mut r = Sse::new(s).keep_alive(KeepAlive::new().interval(Duration::from_secs(15)).text("")).into_response();
221	6×	r.headers_mut().insert("x-accel-buffering", "no".parse().unwrap());
222	6×	r
223	6×	}
224
225		/// `_meta` on every result (spec §15.2): the rules version, the session and
226		/// the unread count.
227	71×	pub async fn meta(ctx: &Ctx) -> Json {
228	71×	let mut m = serde_json::Map::new();
229	71×	if let Ok(r) = spectra_core::rules::compile(&ctx.daemon.data) {
230	71×	m.insert("spectra/rules_version".into(), json!(r.version));
231	71×	}
232	71×	if let Some(s) = &ctx.session {
233	71×	m.insert("spectra/session".into(), json!(s));
234	71×	}
235	71×	if let Ok(n) = spectra_core::conversation::unread(&ctx.daemon.ledger, &ctx.caller.principal.actor()).await {
236	71×	m.insert("spectra/inbox_unread".into(), json!(n));
237	71×	}
238	71×	Json::Object(m)
239	71×	}
240
241		/// `POST /api/v1/ledger/events`: the owner's CLI hands over events it
242		/// signed over their payload, so `agent add` and `project add` work while
243		/// the daemon holds the ledger (spec §8.5, "One writer").
244	2×	async fn owner_events(
245	2×	State(state): State<AppState>,
246	2×	ConnectInfo(peer): ConnectInfo<PeerInfo>,
247	2×	headers: HeaderMap,
248	2×	body: Bytes,
249	2×	) -> Response {
250	2×	let caller = match authenticate(&state, peer, &headers, "POST /api/v1/ledger/events", &body).await {
251	2×	Ok(c) => c,
252	0×	Err(r) => return r,
253		};
254	2×	if !matches!(caller.principal, Principal::Owner { .. }) {
255	0×	return (StatusCode::FORBIDDEN, axum::Json(json!({ "title": "only the owner hands events to the daemon" }))).into_response();
256	2×	}
257	2×	let events: Vec<WireEvent> = match serde_json::from_slice(&body) {
258	2×	Ok(v) => v,
259	0×	Err(e) => return (StatusCode::BAD_REQUEST, axum::Json(json!({ "title": format!("not a list of events: {e}") }))).into_response(),
260		};
261	2×	match state.daemon.accept_owner_events(events).await {
262	2×	Ok(seqs) => axum::Json(json!({ "appended": seqs })).into_response(),
263	0×	Err(e) => (StatusCode::UNPROCESSABLE_ENTITY, axum::Json(json!({ "title": e.to_string() }))).into_response(),
264		}
265	2×	}

Coverage / crates/spectra-mcp/src/http.rs 88.9%

Keyboard