Support authenticated promotion in AIM

Author: PV

ui/aim-chat/src/App.tsx

@@ -51,6 +51,7 @@ export default function App() {
   const [gateRecipes, setGateRecipes] = useState<GateRecipe[]>([])
   const [selectedRecipe, setSelectedRecipe] = useState('')
   const [gateServerUrl, setGateServerUrl] = useState('http://localhost:8080')
+  const [gatePromotionToken, setGatePromotionToken] = useState('')
   const [gateArgs, setGateArgs] = useState<Record<string, string>>({})
   const [gatePromoteThreshold, setGatePromoteThreshold] = useState(2)
 
@@ -796,6 +797,11 @@ export default function App() {
     if (!activeProfileId || !selectedConversationId) {
       return
     }
+    if (!gatePromotionToken.trim()) {
+      setError('Enter the gateway promotion token')
+      addToast('Enter the gateway promotion token', 'error')
+      return
+    }
 
     setIsWorking(true)
     try {
@@ -804,11 +810,13 @@ export default function App() {
         activeProfile?.name || '',
         selectedConversationId,
         gateServerUrl.trim(),
+        gatePromotionToken,
         gatePromoteThreshold,
       )
       await refreshHistory(activeProfileId, selectedConversationId)
       setStatus(`API Gateway enabled: ${gatePromoteThreshold} approvals required`)
       addToast(`API Gateway enabled: ${gatePromoteThreshold} approvals required`, 'success')
+      setGatePromotionToken('')
       setError('')
     } catch (err) {
       const msg = err instanceof Error ? err.message : 'Failed to enable API Gateway'
@@ -1160,6 +1168,8 @@ export default function App() {
               activeRecipe={activeRecipe}
               gateServerUrl={gateServerUrl}
               setGateServerUrl={setGateServerUrl}
+              gatePromotionToken={gatePromotionToken}
+              setGatePromotionToken={setGatePromotionToken}
               gateArgs={gateArgs}
               gatePromoteThreshold={gatePromoteThreshold}
               setGatePromoteThreshold={setGatePromoteThreshold}

ui/aim-chat/src/api.test.ts

@@ -76,9 +76,21 @@ describe('api', () => {
       createdAt: new Date().toISOString(),
     })
 
-    const response = await api.gatePromote('profile-1', 'Alice', 'conv-1', 'http://gateway.test', 2)
-
-    expect(bootstrapSpy).toHaveBeenCalledWith('profile-1', 'conv-1', 'http://gateway.test')
+    const response = await api.gatePromote(
+      'profile-1',
+      'Alice',
+      'conv-1',
+      'http://gateway.test',
+      'promotion-token',
+      2,
+    )
+
+    expect(bootstrapSpy).toHaveBeenCalledWith(
+      'profile-1',
+      'conv-1',
+      'http://gateway.test',
+      'promotion-token',
+    )
     expect(promoteSpy).toHaveBeenCalledWith('profile-1', 'Alice', 'conv-1', 'gateway-kid', 2)
     expect(response.message.bodyType).toBe('gate.promote')
   })

ui/aim-chat/src/api.ts

@@ -127,9 +127,15 @@ export const api = {
     profileName: string,
     conversationId: string,
     gateServerUrl: string,
+    promotionToken: string,
     threshold: number,
   ): Promise<{ message: ChatMessage; warning?: string }> {
-    const bootstrap = await qntm.bootstrapGatewayForConversation(profileId, conversationId, gateServerUrl)
+    const bootstrap = await qntm.bootstrapGatewayForConversation(
+      profileId,
+      conversationId,
+      gateServerUrl,
+      promotionToken,
+    )
     const message = await qntm.gatePromoteRequest(
       profileId,
       profileName,

ui/aim-chat/src/components/GatePanel.tsx

@@ -13,6 +13,8 @@ export interface GatePanelProps {
   activeRecipe: GateRecipe | null
   gateServerUrl: string
   setGateServerUrl: (value: string) => void
+  gatePromotionToken: string
+  setGatePromotionToken: (value: string) => void
   gateArgs: Record<string, string>
   gatePromoteThreshold: number
   setGatePromoteThreshold: (value: number) => void
@@ -44,6 +46,8 @@ export function GatePanel({
   activeRecipe,
   gateServerUrl,
   setGateServerUrl,
+  gatePromotionToken,
+  setGatePromotionToken,
   gateArgs,
   gatePromoteThreshold,
   setGatePromoteThreshold,
@@ -144,6 +148,17 @@ export function GatePanel({
             value={gateServerUrl}
             onChange={(event) => setGateServerUrl(event.target.value)}
           />
+          <label className="label" htmlFor="gate-promotion-token">Promotion token <Tooltip text="Provided by the gateway operator. Used only for this bootstrap request and never stored." /></label>
+          <input
+            id="gate-promotion-token"
+            className="input"
+            type="password"
+            autoComplete="off"
+            required
+            placeholder="Gateway operator token"
+            value={gatePromotionToken}
+            onChange={(event) => setGatePromotionToken(event.target.value)}
+          />
           <label className="label" htmlFor="gate-promote-threshold">Required approvals <Tooltip text="The number of participants who must approve before an API call executes." /></label>
           <input
             id="gate-promote-threshold"
@@ -156,7 +171,7 @@ export function GatePanel({
           <button
             className="button full"
             type="button"
-            disabled={isWorking}
+            disabled={isWorking || !gatePromotionToken.trim()}
             onClick={() => void onGatePromote()}
           >
             {isWorking ? <Spinner /> : 'Enable API Gateway'}

ui/aim-chat/src/qntm.test.ts

@@ -619,7 +619,7 @@ describe('browser qntm adapter', () => {
     const aliceIdentity = identityFor(alice.id)
     const bobIdentity = identityFor(bob.id)
 
-    vi.stubGlobal('fetch', vi.fn((input: string | URL | Request, init?: RequestInit) => {
+    const fetchMock = vi.fn((input: string | URL | Request, init?: RequestInit) => {
       const url = typeof input === 'string'
         ? input
         : input instanceof URL
@@ -636,9 +636,15 @@ describe('browser qntm adapter', () => {
       }
 
       return relay.handleFetch(input, init)
-    }))
+    })
+    vi.stubGlobal('fetch', fetchMock)
 
-    const bootstrap = await bootstrapGatewayForConversation(alice.id, conversationId, 'http://gateway.test')
+    const bootstrap = await bootstrapGatewayForConversation(
+      alice.id,
+      conversationId,
+      'http://gateway.test',
+      'promotion-token',
+    )
     expect(bootstrap).toEqual({
       gatewayPublicKey: publicKeyToString(hexToBytes(bobIdentity.publicKey)),
       gatewayKid: publicKeyToString(hexToBytes(bobIdentity.keyId)),
@@ -647,6 +653,12 @@ describe('browser qntm adapter', () => {
       publicKey: publicKeyToString(hexToBytes(bobIdentity.publicKey)),
       keyId: publicKeyToString(hexToBytes(bobIdentity.keyId)),
     })
+    expect(fetchMock).toHaveBeenCalledWith(
+      'http://gateway.test/v1/promote',
+      expect.objectContaining({
+        headers: expect.objectContaining({ Authorization: 'Bearer promotion-token' }),
+      }),
+    )
 
     const secretMessage = await gateSecretRequest(
       alice.id,

ui/aim-chat/src/qntm.ts

@@ -992,6 +992,7 @@ export async function bootstrapGatewayForConversation(
   profileId: string,
   conversationId: string,
   gateServerUrl: string,
+  promotionToken: string,
 ): Promise<GatewayBootstrap> {
   const convCrypto = getConvCrypto(profileId, conversationId)
   if (!convCrypto) throw new Error(`Conversation ${conversationId} not found`)
@@ -1000,10 +1001,17 @@ export async function bootstrapGatewayForConversation(
   if (!baseUrl) {
     throw new Error('Gateway server URL is required')
   }
+  const token = promotionToken.trim()
+  if (!token) {
+    throw new Error('Gateway promotion token is required')
+  }
 
   const response = await fetch(`${baseUrl}/v1/promote`, {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${token}`,
+    },
     body: JSON.stringify({
       conv_id: conversationId,
       conv_aead_key: base64UrlEncode(convCrypto.keys.aeadKey),