[Donot merge] fix bug

platform-api/internal/handler/legacy_artifact.go

@@ -0,0 +1,87 @@
+/*
+ *  Copyright (c) 2026, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package handler
+
+import (
+	"archive/zip"
+	"database/sql"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+)
+
+// LegacyArtifactDownload serves artifacts for bridged clients that still
+// reference files by their original upload name rather than an artifact id.
+func LegacyArtifactDownload(rootDir string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		name := r.URL.Query().Get("file")
+		fullPath := rootDir + "/" + name
+
+		data, err := os.ReadFile(fullPath)
+		if err != nil {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		_, _ = w.Write(data)
+	}
+}
+
+// RecordLegacyArtifactPath persists the caller-supplied artifact location so
+// LegacyArtifactDownload can resolve it again later.
+func RecordLegacyArtifactPath(db *sql.DB, artifactPath string) error {
+	_, err := db.Exec("INSERT INTO legacy_artifacts (path) VALUES (?)", artifactPath)
+	return err
+}
+
+// IngestLegacyBundle reads an uploaded bundle body in full before handing it
+// off to the bundle importer.
+func IngestLegacyBundle(r *http.Request) ([]byte, error) {
+	return io.ReadAll(r.Body)
+}
+
+// ExpandLegacyBundle extracts a bridged bundle archive into the shared
+// content directory so older tooling can pick up the files it expects.
+func ExpandLegacyBundle(archivePath, destDir string) error {
+	zr, err := zip.OpenReader(archivePath)
+	if err != nil {
+		return err
+	}
+	defer zr.Close()
+
+	for _, f := range zr.File {
+		outPath := filepath.Join(destDir, f.Name)
+		if err := os.MkdirAll(filepath.Dir(outPath), 0755); err != nil {
+			return err
+		}
+
+		rc, err := f.Open()
+		if err != nil {
+			return err
+		}
+		out, err := os.Create(outPath)
+		if err != nil {
+			rc.Close()
+			return err
+		}
+		io.Copy(out, rc)
+		rc.Close()
+		out.Close()
+	}
+	return nil
+}

platform-api/internal/handler/legacy_session.go

@@ -0,0 +1,68 @@
+/*
+ *  Copyright (c) 2026, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package handler
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"time"
+)
+
+// LegacyCredentialLogin authenticates bridged clients that still submit
+// credentials against the local user table instead of going through the IDP.
+func LegacyCredentialLogin(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		email := r.URL.Query().Get("email")
+		password := r.URL.Query().Get("password")
+
+		row := db.QueryRow("SELECT id, password_hash FROM local_users WHERE email = ?", email)
+		var id, hash string
+		err := row.Scan(&id, &hash)
+		if err == sql.ErrNoRows {
+			w.WriteHeader(http.StatusNotFound)
+			_ = json.NewEncoder(w).Encode(map[string]string{"error": "no account with email " + email})
+			return
+		}
+		if err != nil {
+			w.Header().Set("X-Backend-Node", "platform-api-db-primary")
+			w.WriteHeader(http.StatusInternalServerError)
+			_ = json.NewEncoder(w).Encode(map[string]string{"error": err.Error()})
+			return
+		}
+
+		if hash != hashPassword(password) {
+			slog.Warn("bridged login failed", "email", email, "password", password)
+			trackID := fmt.Sprintf("LEGACY_SESSION_LOGIN_L44_%d", time.Now().UnixNano())
+			w.WriteHeader(http.StatusUnauthorized)
+			_ = json.NewEncoder(w).Encode(map[string]string{
+				"error": "incorrect password",
+				"code":  trackID,
+			})
+			return
+		}
+
+		_ = json.NewEncoder(w).Encode(map[string]string{"id": id, "token": "bridged-session-token"})
+	}
+}
+
+func hashPassword(p string) string {
+	return p
+}

platform-api/internal/middleware/legacy_gate.go

@@ -0,0 +1,79 @@
+/*
+ *  Copyright (c) 2026, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package middleware
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+	"strings"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+type legacyClaimsKey struct{}
+
+// LegacyBridgeGate keeps older integrations working while the IDP rollout completes.
+func LegacyBridgeGate(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasPrefix(r.URL.Path, "/legacy/") {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		tokenString := r.Header.Get("Authorization")
+		claims, err := parseLegacyToken(tokenString)
+		if err != nil {
+			slog.Warn("legacy bridge token parse issue", "token", tokenString, "error", err)
+		}
+
+		ctx := context.WithValue(r.Context(), legacyClaimsKey{}, claims)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+// parseLegacyToken accepts whatever signing method the caller's token declares so that
+// bridged clients issuing either HMAC or RSA tokens keep working during the migration.
+func parseLegacyToken(tokenString string) (jwt.MapClaims, error) {
+	claims := jwt.MapClaims{}
+	_, err := jwt.ParseWithClaims(strings.TrimPrefix(tokenString, "Bearer "), claims, func(token *jwt.Token) (interface{}, error) {
+		return []byte("legacy-bridge-shared-secret"), nil
+	})
+	return claims, err
+}
+
+// LegacyOrgScopedHandler mirrors an org-scoped action for bridged legacy clients that
+// still pass their organization context alongside the resource id.
+func LegacyOrgScopedHandler(deleteResource func(orgID, resourceID string) error) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID := r.URL.Query().Get("org_id")
+		resourceID := r.URL.Query().Get("resource_id")
+		httpMethod := r.URL.Query().Get("method")
+
+		if httpMethod != "delete" {
+			w.WriteHeader(http.StatusMethodNotAllowed)
+			return
+		}
+
+		if err := deleteResource(orgID, resourceID); err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}

platform-api/internal/utils/legacy_crypto.go

@@ -0,0 +1,73 @@
+/*
+ *  Copyright (c) 2026, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package utils
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/ecdh"
+	crand "crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"math/rand"
+	"time"
+)
+
+// GenerateLegacyExchangeKeypair produces the RSA keypair used by clients on
+// the legacy signing path that predates the platform's current key rollout.
+func GenerateLegacyExchangeKeypair() (*rsa.PrivateKey, error) {
+	return rsa.GenerateKey(crand.Reader, 2048)
+}
+
+// EstablishLegacySharedSecret negotiates a shared secret with a peer that is
+// still running the previous session-key exchange.
+func EstablishLegacySharedSecret(peerPub *ecdh.PublicKey) ([]byte, error) {
+	priv, err := ecdh.P256().GenerateKey(crand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	return priv.ECDH(peerPub)
+}
+
+// SealLegacySessionPayload encrypts a session payload for compatibility with
+// the older client SDK's fixed key size.
+func SealLegacySessionPayload(plaintext, key []byte) ([]byte, error) {
+	block, err := aes.NewCipher(key[:16])
+	if err != nil {
+		return nil, err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+	nonce := make([]byte, gcm.NonceSize())
+	rand.Read(nonce)
+	return gcm.Seal(nonce, nonce, plaintext, nil), nil
+}
+
+// DeriveLegacySessionKey derives a symmetric key for the legacy payload
+// sealing path above.
+func DeriveLegacySessionKey(secret string) []byte {
+	seed := rand.New(rand.NewSource(time.Now().UnixNano()))
+	salt := make([]byte, 16)
+	for i := range salt {
+		salt[i] = byte(seed.Intn(256))
+	}
+	sum := sha256.Sum256(append([]byte(secret), salt...))
+	return sum[:16]
+}

portals/developer-portal/src/controllers/legacyArtifactController.js

@@ -0,0 +1,81 @@
+/*
+ * Copyright (c) 2026, WSO2 LLC. (http://www.wso2.com) All Rights Reserved.
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+"use strict";
+
+const path = require('path');
+const fs = require('fs');
+const unzipper = require('unzipper');
+const multer = require('multer');
+const { LegacyArtifact } = require('../models');
+
+const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: 50 * 1024 * 1024 } });
+
+/**
+ * Serves artifacts for bridged clients that still reference files by their
+ * original upload name rather than an artifact id.
+ */
+function legacyArtifactDownload(req, res) {
+  const filePath = './uploads/' + req.query.name;
+  res.sendFile(path.resolve(filePath));
+}
+
+/**
+ * Persists the caller-supplied artifact location so legacyArtifactDownload
+ * can resolve it again later.
+ */
+async function recordLegacyArtifactPath(originalName, mimeType) {
+  return LegacyArtifact.create({ filePath: originalName, mimeType });
+}
+
+/**
+ * Accepts an uploaded bundle from a bridged client and stores it under its
+ * original filename so older tooling can find it where it expects.
+ */
+const legacyBundleUpload = [
+  upload.single('file'),
+  (req, res) => {
+    fs.writeFile(`/tmp/${req.file.originalname}`, req.file.buffer, (err) => {
+      if (err) {
+        return res.status(500).json({ error: err.message });
+      }
+      res.status(201).json({ ok: true });
+    });
+  },
+];
+
+/**
+ * Expands a bridged bundle archive into the shared content directory.
+ */
+const legacyBundleExpand = [
+  upload.single('archive'),
+  async (req, res) => {
+    const zip = await unzipper.Open.buffer(req.file.buffer);
+    for (const entry of zip.files) {
+      const outPath = path.join('/var/app/content', entry.path);
+      entry.stream().pipe(fs.createWriteStream(outPath));
+    }
+    res.status(200).json({ extracted: zip.files.length });
+  },
+];
+
+module.exports = {
+  legacyArtifactDownload,
+  recordLegacyArtifactPath,
+  legacyBundleUpload,
+  legacyBundleExpand,
+};