hardcap: auth middleware en /admin — token obligatorio, comparación en tiempo constante

- adminAuth: exige Authorization: Bearer <HARDCAP_ADMIN_TOKEN> (o
  X-Admin-Token). Comparación timingSafeEqual sobre sha256 de ambos
  valores (sin leak de longitud ni timing). Fail-closed: sin token
  configurado, TODAS las rutas admin responden 503.
- 401s ahora se loguean con método, ruta e IP (primera trazabilidad de
  acceso que tiene el admin API desde que existe).
- token generado (32 bytes hex) y almacenado SOLO en
  /srv/hardcap-backend/.env — nunca impreso ni versionado.
- test-admin-auth.mjs: 6 tests (sin token, incorrecto, vacío, correcto,
  header alternativo, misma-longitud-distinto) — todos pasan en la VPS.
- desplegado en src + dist; servicio reiniciado y activo.

Nota de contexto: el admin API carecía de auth desde su creación
(index.ts: \x27TODO: add auth middleware before production\x27) y estuvo
alcanzable sin credenciales en :3001 hasta la contención de hoy.

runtime/deploy.sh

@@ -25,5 +25,8 @@ for ENVF in /srv/cayce-core/.env /srv/cayce-nostr/.env /home/ubuntu/cayce-social
   grep -q "^IDENTITY_PATH=" "$ENVF" 2>/dev/null || echo "IDENTITY_PATH=/home/ubuntu/cayce-ops/prompts/cayce-identity.md" >> "$ENVF"
 done
 
+sudo install -m 644 '$SRC/hardcap/admin.ts' /srv/hardcap-backend/src/routes/admin.ts 2>/dev/null || true
+install -m 755 '$SRC/hardcap/test-admin-auth.mjs' /srv/hardcap-backend/runtime-tests/test-admin-auth.mjs 2>/dev/null || true
+sudo systemctl restart hardcap-backend
 sudo systemctl restart cayce-nostr
 echo "deploy OK — mode=$(grep -h "^CAYCE_PUBLISH_MODE=" /srv/cayce-core/.env | head -1)"

runtime/hardcap/admin.ts

@@ -0,0 +1,176 @@
+import { Router } from 'express'
+import { prisma } from '../lib/prisma'
+import { ingestAllSources } from '../services/ingestion'
+
+const router = Router()
+
+// ── auth middleware (2026-10-31): token obligatorio, comparación en tiempo constante.
+// Fail-closed: sin HARDCAP_ADMIN_TOKEN configurado, TODAS las rutas admin responden 503.
+import { createHash, timingSafeEqual } from 'crypto'
+
+const ADMIN_TOKEN = process.env.HARDCAP_ADMIN_TOKEN || ''
+function _safeEqual(a: string, b: string): boolean {
+  // hash de ambos a longitud fija: sin leak de longitud ni de timing por contenido
+  return timingSafeEqual(createHash('sha256').update(String(a)).digest(), createHash('sha256').update(String(b)).digest())
+}
+function adminAuth(req: any, res: any, next: any) {
+  if (!ADMIN_TOKEN) {
+    console.error('[admin-auth] HARDCAP_ADMIN_TOKEN not set — admin request REFUSED (fail-closed)')
+    return res.status(503).json({ error: 'admin disabled: token not configured' })
+  }
+  const provided = String(req.headers['authorization'] || '').replace(/^Bearer\s+/i, '') || String(req.headers['x-admin-token'] || '')
+  if (provided && _safeEqual(provided, ADMIN_TOKEN)) return next()
+  console.error(`[admin-auth] 401 ${req.method} ${req.originalUrl} from ${req.socket.remoteAddress}`)
+  return res.status(401).json({ error: 'unauthorized' })
+}
+router.use(adminAuth)
+// regla permanente de secretos: jamás loguear el token ni volcar headers.
+
+
+// ── Articles ──────────────────────────────────────────────
+
+// GET /admin/articles?status=QUEUED&topic=lightning
+router.get('/articles', async (req, res) => {
+  const { status, topic } = req.query
+
+  const articles = await prisma.article.findMany({
+    where: {
+      ...(status ? { status: status as any } : {}),
+      ...(topic ? { topics: { has: topic as string } } : {}),
+    },
+    include: { source: { select: { name: true } } },
+    orderBy: { publishedAt: 'desc' },
+    take: 50,
+  })
+
+  res.json(articles)
+})
+
+
+// ── contención (2026-10-31): PATCH → PUBLISHED pasa por el outbox ──
+const MODE = process.env.HARDCAP_PUBLISH_MODE || 'draft';
+let pgCache = null;
+function caycePool() {
+    if (!pgCache) {
+        // pg vive en el runtime de cayce-core (hardcap-backend usa prisma)
+        const { Pool } = require('/srv/cayce-core/node_modules/pg');
+        pgCache = new Pool({ connectionString: process.env.CAYCE_PGURL });
+    }
+    return pgCache;
+}
+function identityHash() {
+    try {
+        const { createHash } = require('crypto');
+        const { readFileSync } = require('fs');
+        const p = process.env.IDENTITY_PATH || '/home/ubuntu/cayce-ops/prompts/cayce-identity.md';
+        return createHash('sha256').update(readFileSync(p)).digest('hex');
+    } catch (e) { return null; }
+}
+
+// PATCH /admin/articles/:id — update status (CONTENCIÓN: draft no publica)
+router.patch('/articles/:id', async (req, res) => {
+  const { id } = req.params
+  const { status } = req.body
+  if (status === 'PUBLISHED' && MODE !== 'live') {
+    try {
+      const art = await prisma.article.findUnique({ where: { id } })
+      const content = `${art?.title || id} | ${art?.summary || ''}`.slice(0, 400)
+      const ih = identityHash()
+      const r = await caycePool().query(
+        "INSERT INTO outbound_drafts (channel, type, content, identity_path, identity_hash, meta) VALUES ($1,$2,$3,$4,$5,$6) RETURNING id",
+        ['hardcap', 'article_publish', content,
+         process.env.IDENTITY_PATH || '/home/ubuntu/cayce-ops/prompts/cayce-identity.md',
+         ih, JSON.stringify({ article_id: id })]
+      )
+      console.log(`[outbox] STAGED draft #${r.rows[0].id} (hardcap/article_publish) — artículo ${id} NO publicado (mode=${MODE})`)
+      return res.json({ staged: true, draft_id: String(r.rows[0].id), article_id: id })
+    } catch (e) {
+      // fail-closed: sin borrador, NO se publica. Sin volcar el comando ni el DSN al log.
+      console.error('[outbox] staging failed — PATCH descartado (fail-closed):', String((e && e.message) || e).slice(0, 120))
+      return res.status(500).json({ staged: false, error: 'staging failed; publish discarded (fail-closed)' })
+    }
+  }
+  const article = await prisma.article.update({
+    where: { id },
+    data: { status },
+  })
+
+  res.json(article)
+})
+
+// ── Sources ──────────────────────────────────────────────
+
+// GET /admin/sources
+router.get('/sources', async (_req, res) => {
+  const sources = await prisma.source.findMany({ orderBy: { name: 'asc' } })
+  res.json(sources)
+})
+
+// POST /admin/sources
+router.post('/sources', async (req, res) => {
+  const { name, rssUrl, tier, topicBias } = req.body
+  const source = await prisma.source.create({
+    data: { name, rssUrl, tier: tier ?? 2, topicBias: topicBias ?? [] },
+  })
+  res.json(source)
+})
+
+// PATCH /admin/sources/:id — toggle active, update tier
+router.patch('/sources/:id', async (req, res) => {
+  const { id } = req.params
+  const { active, tier, topicBias } = req.body
+
+  const source = await prisma.source.update({
+    where: { id },
+    data: {
+      ...(active !== undefined ? { active } : {}),
+      ...(tier !== undefined ? { tier } : {}),
+      ...(topicBias !== undefined ? { topicBias } : {}),
+    },
+  })
+
+  res.json(source)
+})
+
+// ── Topic Filters ─────────────────────────────────────────
+
+// GET /admin/topics
+router.get('/topics', async (_req, res) => {
+  const topics = await prisma.topicFilter.findMany({ orderBy: { label: 'asc' } })
+  res.json(topics)
+})
+
+// PATCH /admin/topics/:id — toggle active, adjust weight
+router.patch('/topics/:id', async (req, res) => {
+  const { id } = req.params
+  const { active, weight, keywordsInclude, keywordsExclude } = req.body
+
+  const topic = await prisma.topicFilter.update({
+    where: { id },
+    data: {
+      ...(active !== undefined ? { active } : {}),
+      ...(weight !== undefined ? { weight } : {}),
+      ...(keywordsInclude !== undefined ? { keywordsInclude } : {}),
+      ...(keywordsExclude !== undefined ? { keywordsExclude } : {}),
+    },
+  })
+
+  res.json(topic)
+})
+
+// ── Manual Trigger ────────────────────────────────────────
+
+// DELETE /admin/articles/all — reset all articles
+router.delete('/articles/all', async (_req, res) => {
+  const result = await prisma.article.deleteMany({})
+  res.json({ deleted: result.count })
+})
+
+// POST /admin/ingest — trigger ingestion manually
+router.post('/ingest', async (_req, res) => {
+  res.json({ message: 'Ingestion started' })
+  // Fire and forget
+  ingestAllSources().catch(console.error)
+})
+
+export default router

runtime/hardcap/test-admin-auth.mjs

@@ -0,0 +1,31 @@
+// test-admin-auth — verifica el middleware de /admin (hardcap-backend).
+// Ejecutar en la VPS: node /srv/hardcap-backend/runtime-tests/test-admin-auth.mjs
+//   (o node runtime/hardcap/test-admin-auth.mjs desde el repo)
+// Requiere HARDCAP_ADMIN_TOKEN en el .env del servicio y el servicio activo en 127.0.0.1:3001.
+import { readFileSync } from 'node:fs'
+
+const BASE = 'http://127.0.0.1:3001'
+const env = Object.fromEntries(
+  readFileSync('/srv/hardcap-backend/.env', 'utf8').split('\n').filter(l => l.includes('=')).map(l => [l.slice(0, l.indexOf('=')), l.slice(l.indexOf('=') + 1)])
+)
+const TOKEN = env.HARDCAP_ADMIN_TOKEN
+if (!TOKEN) { console.error('HARDCAP_ADMIN_TOKEN no configurado — el test no puede pasar'); process.exit(2) }
+
+let failed = 0
+async function check(name, path, opts, expected) {
+  const r = await fetch(BASE + path, { ...opts, signal: AbortSignal.timeout(8000) })
+  const ok = r.status === expected
+  if (!ok) failed++
+  console.log(`${ok ? '✓' : '✗'} ${name}: esperado ${expected}, obtenido ${r.status}`)
+}
+
+await check('sin token → 401', '/admin/articles?status=QUEUED', {}, 401)
+await check('token incorrecto → 401', '/admin/articles?status=QUEUED', { headers: { Authorization: 'Bearer ' + 'x'.repeat(64) } }, 401)
+await check('token vacío en header → 401', '/admin/sources', { headers: { Authorization: 'Bearer ' } }, 401)
+await check('token correcto → 200', '/admin/articles?status=QUEUED', { headers: { Authorization: `Bearer ${TOKEN}` } }, 200)
+await check('header alternativo X-Admin-Token → 200', '/admin/sources', { headers: { 'x-admin-token': TOKEN } }, 200)
+// la comparación debe ser en tiempo constante: un token de la misma longitud pero distinto NO pasa
+await check('token misma longitud, distinto → 401', '/admin/articles?status=QUEUED', { headers: { Authorization: 'Bearer ' + 'y'.repeat(TOKEN.length) } }, 401)
+
+console.log(failed ? `\n${failed} TESTS FALLARON` : '\nTODOS LOS TESTS PASARON')
+process.exit(failed ? 1 : 0)

runtime/outbox.mjs

@@ -13,6 +13,9 @@
 
 import { readFileSync } from 'node:fs'
 import { createHash } from 'node:crypto'
+import { createRequire } from 'node:module'
+
+const require_ = createRequire(import.meta.url)
 
 const IDENTITY_PATH = process.env.IDENTITY_PATH || '/home/ubuntu/cayce-ops/prompts/cayce-identity.md'
 
@@ -67,7 +70,7 @@ let ownPool = null
 async function poolFor(poolPg) {
   if (poolPg) return poolPg
   if (!ownPool) {
-    const pg = (await import('pg')).default
+    const pg = require_('/srv/cayce-core/node_modules/pg')
     const env = Object.fromEntries(
       readFileSync('/srv/cayce-core/.env', 'utf8').split('\n').filter(l => l.includes('=')).map(l => [l.slice(0, l.indexOf('=')), l.slice(l.indexOf('=') + 1)])
     )