feat: calendar

platforms/calendar-api/package.json

@@ -0,0 +1,30 @@
+{
+ "name": "calendar-api",
+ "version": "1.0.0",
+ "description": "W3DS auth and eVault-backed calendar events API",
+ "main": "dist/index.js",
+ "scripts": {
+ "start": "node dist/index.js",
+ "dev": "ts-node src/index.ts",
+ "build": "tsc"
+ },
+ "dependencies": {
+ "cors": "^2.8.5",
+ "dotenv": "^16.4.5",
+ "express": "^4.18.2",
+ "graphql-request": "^6.1.0",
+ "jsonwebtoken": "^9.0.2",
+ "signature-validator": "workspace:*",
+ "uuid": "^9.0.1",
+ "axios": "^1.6.7"
+ },
+ "devDependencies": {
+ "@types/cors": "^2.8.17",
+ "@types/express": "^4.17.21",
+ "@types/jsonwebtoken": "^9.0.5",
+ "@types/node": "^20.11.19",
+ "@types/uuid": "^9.0.8",
+ "ts-node": "^10.9.2",
+ "typescript": "^5.3.3"
+ }
+}

platforms/calendar-api/src/constants.ts

@@ -0,0 +1,25 @@
+export const CALENDAR_EVENT_ONTOLOGY_ID =
+ "880e8400-e29b-41d4-a716-446655440099";
+
+const SESSION_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
+export interface StoredSession {
+ createdAt: number;
+}
+
+export const sessionStore = new Map<string, StoredSession>();
+
+export function addSession(sessionId: string): void {
+ sessionStore.set(sessionId, { createdAt: Date.now() });
+}
+
+export function isSessionValid(sessionId: string): boolean {
+ const s = sessionStore.get(sessionId);
+ if (!s) return false;
+ if (Date.now() - s.createdAt > SESSION_TTL_MS) {
+ sessionStore.delete(sessionId);
+ return false;
+ }
+ sessionStore.delete(sessionId); // one-time use
+ return true;
+}

platforms/calendar-api/src/controllers/AuthController.ts

@@ -0,0 +1,136 @@
+import { Request, Response } from "express";
+import { EventEmitter } from "events";
+import { v4 as uuidv4 } from "uuid";
+import jwt from "jsonwebtoken";
+import { verifySignature } from "signature-validator";
+import { isVersionValid } from "../utils/version";
+import { addSession, isSessionValid } from "../constants";
+
+const MIN_REQUIRED_VERSION = "0.4.0";
+const JWT_EXPIRES_IN = "7d";
+
+export class AuthController {
+ private eventEmitter = new EventEmitter();
+
+ getOffer = async (_req: Request, res: Response) => {
+ console.log("[auth] GET /api/auth/offer hit");
+ const baseUrl = process.env.NEXT_PUBLIC_CALENDAR_APP_URL;
+ if (!baseUrl) {
+ console.error("[auth] NEXT_PUBLIC_CALENDAR_APP_URL is not set");
+ return res.status(500).json({ error: "Server configuration error: NEXT_PUBLIC_CALENDAR_APP_URL not set" });
+ }
+
+ let redirectUri: string;
+ try {
+ redirectUri = new URL("/api/auth", baseUrl).toString();
+ } catch (err) {
+ console.error("[auth] Invalid NEXT_PUBLIC_CALENDAR_APP_URL:", baseUrl, err);
+ return res.status(500).json({ error: "Server configuration error: invalid base URL" });
+ }
+
+ const session = uuidv4();
+ addSession(session);
+ const offer = `w3ds://auth?redirect=${encodeURIComponent(redirectUri)}&session=${session}&platform=${encodeURIComponent(baseUrl)}`;
+ console.log("[auth] offer created, redirectUri=", redirectUri, "platform=", baseUrl);
+ res.json({ uri: offer, sessionId: session });
+ };
+
+ sseStream = async (req: Request, res: Response) => {
+ const { id } = req.params;
+ console.log("[auth] GET /api/auth/sessions/:id hit, sessionId=", id);
+ res.writeHead(200, {
+ "Content-Type": "text/event-stream",
+ "Cache-Control": "no-cache",
+ Connection: "keep-alive",
+ "Access-Control-Allow-Origin": "*",
+ });
+ const handler = (data: unknown) => {
+ res.write(`data: ${JSON.stringify(data)}\n\n`);
+ };
+ this.eventEmitter.on(id, handler);
+ const heartbeat = setInterval(() => {
+ try {
+ res.write(": heartbeat\n\n");
+ } catch {
+ clearInterval(heartbeat);
+ }
+ }, 30000);
+ req.on("close", () => {
+ clearInterval(heartbeat);
+ this.eventEmitter.off(id, handler);
+ res.end();
+ });
+ };
+
+ login = async (req: Request, res: Response) => {
+ console.log("[auth] POST /api/auth hit");
+ try {
+ const { ename, session, signature, appVersion } = req.body;
+ console.log("[auth] body: ename=", ename, "session=", session?.slice(0, 8) + "...", "appVersion=", appVersion, "signature present=", !!signature);
+
+ if (!ename) {
+ console.log("[auth] reject: ename missing");
+ return res.status(400).json({ error: "ename is required" });
+ }
+ if (!session) {
+ console.log("[auth] reject: session missing");
+ return res.status(400).json({ error: "session is required" });
+ }
+ if (!signature) {
+ console.log("[auth] reject: signature missing");
+ return res.status(400).json({ error: "signature is required" });
+ }
+
+ if (!isSessionValid(session)) {
+ console.log("[auth] reject: invalid or expired session");
+ return res
+ .status(400)
+ .json({ error: "Invalid or expired session", message: "Please request a new login offer." });
+ }
+
+ if (!appVersion || !isVersionValid(appVersion, MIN_REQUIRED_VERSION)) {
+ console.log("[auth] reject: app version too old", appVersion);
+ return res.status(400).json({
+ error: "App version too old",
+ message: `Please update eID Wallet to version ${MIN_REQUIRED_VERSION} or later.`,
+ });
+ }
+
+ const registryBaseUrl = process.env.PUBLIC_REGISTRY_URL;
+ if (!registryBaseUrl) {
+ console.log("[auth] reject: PUBLIC_REGISTRY_URL not set");
+ return res.status(500).json({ error: "Server configuration error" });
+ }
+
+ console.log("[auth] verifying signature with registry", registryBaseUrl);
+ const verificationResult = await verifySignature({
+ eName: ename,
+ signature,
+ payload: session,
+ registryBaseUrl,
+ });
+
+ if (!verificationResult.valid) {
+ console.log("[auth] reject: signature invalid", verificationResult.error);
+ return res.status(401).json({
+ error: "Invalid signature",
+ message: verificationResult.error,
+ });
+ }
+
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+ const token = jwt.sign(
+ { ename },
+ secret,
+ { expiresIn: JWT_EXPIRES_IN }
+ );
+
+ console.log("[auth] login success, ename=", ename);
+ this.eventEmitter.emit(session, { token });
+ res.status(200).json({ token });
+ } catch (error) {
+ console.error("[auth] login error:", error);
+ res.status(500).json({ error: "Internal server error" });
+ }
+ };
+}

platforms/calendar-api/src/controllers/EventsController.ts

@@ -0,0 +1,109 @@
+import { Response } from "express";
+import { EVaultService } from "../services/EVaultService";
+import { AuthenticatedRequest } from "../middleware/auth";
+
+const evaultService = new EVaultService();
+
+export class EventsController {
+ list = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const first = Math.min(
+ parseInt(String(req.query.first), 10) || 100,
+ 500
+ );
+ const after = (req.query.after as string) || undefined;
+ const events = await evaultService.listEvents(ename, first, after);
+ res.json(events);
+ } catch (error) {
+ console.error("List events error:", error);
+ res.status(500).json({
+ error: "Failed to list events",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ create = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const { title, color, start, end } = req.body;
+ if (!title || !start || !end) {
+ res.status(400).json({
+ error: "Missing required fields",
+ message: "title, start, and end are required",
+ });
+ return;
+ }
+ const event = await evaultService.createEvent(ename, {
+ title,
+ color: color ?? "",
+ start,
+ end,
+ });
+ res.status(201).json(event);
+ } catch (error) {
+ console.error("Create event error:", error);
+ res.status(500).json({
+ error: "Failed to create event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ update = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ const { title, color, start, end } = req.body;
+ const payload: Record<string, string> = {};
+ if (title !== undefined) payload.title = title;
+ if (color !== undefined) payload.color = color;
+ if (start !== undefined) payload.start = start;
+ if (end !== undefined) payload.end = end;
+ if (Object.keys(payload).length === 0) {
+ res.status(400).json({ error: "No fields to update" });
+ return;
+ }
+ const event = await evaultService.updateEvent(ename, id, payload);
+ res.json(event);
+ } catch (error) {
+ console.error("Update event error:", error);
+ res.status(500).json({
+ error: "Failed to update event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ remove = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ await evaultService.removeEvent(ename, id);
+ res.status(204).send();
+ } catch (error) {
+ console.error("Remove event error:", error);
+ res.status(500).json({
+ error: "Failed to delete event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ }
+}

platforms/calendar-api/src/index.ts

@@ -0,0 +1,54 @@
+import dotenv from "dotenv";
+import fs from "fs";
+import path from "path";
+import express from "express";
+import cors from "cors";
+
+// Load .env: try monorepo root, then calendar-api parent, then cwd (no fallback)
+const candidates = [
+ path.resolve(__dirname, "../../../.env"), // repo root from dist/
+ path.resolve(__dirname, "../../.env"), // repo root from src/ or platforms/.env
+ path.resolve(process.cwd(), ".env"),
+];
+const envPath = candidates.find((p) => fs.existsSync(p));
+if (envPath) {
+ dotenv.config({ path: envPath });
+} else {
+ console.warn(
+ "No .env found at",
+ candidates.join(", "),
+ "- env vars must be set by shell or elsewhere"
+ );
+}
+import { AuthController } from "./controllers/AuthController";
+import { EventsController } from "./controllers/EventsController";
+import { authMiddleware } from "./middleware/auth";
+
+const app = express();
+const port = process.env.PORT ?? 4001;
+
+app.use(
+ cors({
+ origin: true,
+ methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
+ allowedHeaders: ["Content-Type", "Authorization"],
+ credentials: true,
+ })
+);
+app.use(express.json());
+
+const authController = new AuthController();
+const eventsController = new EventsController();
+
+app.get("/api/auth/offer", authController.getOffer);
+app.get("/api/auth/sessions/:id", authController.sseStream);
+app.post("/api/auth", authController.login);
+
+app.get("/api/events", authMiddleware, eventsController.list);
+app.post("/api/events", authMiddleware, eventsController.create);
+app.patch("/api/events/:id", authMiddleware, eventsController.update);
+app.delete("/api/events/:id", authMiddleware, eventsController.remove);
+
+app.listen(port, () => {
+ console.log(`Calendar API running on port ${port}`);
+});

platforms/calendar-api/src/middleware/auth.ts

@@ -0,0 +1,37 @@
+import { Request, Response, NextFunction } from "express";
+import jwt from "jsonwebtoken";
+
+export interface AuthPayload {
+ ename: string;
+}
+
+export interface AuthenticatedRequest extends Request {
+ user?: AuthPayload;
+}
+
+export function authMiddleware(
+ req: AuthenticatedRequest,
+ res: Response,
+ next: NextFunction
+): void {
+ const authHeader = req.headers.authorization;
+ if (!authHeader?.startsWith("Bearer ")) {
+ res.status(401).json({ error: "Missing or invalid Authorization header" });
+ return;
+ }
+
+ const token = authHeader.slice(7);
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+
+ try {
+ const decoded = jwt.verify(token, secret) as AuthPayload;
+ if (!decoded.ename) {
+ res.status(401).json({ error: "Invalid token payload" });
+ return;
+ }
+ req.user = { ename: decoded.ename };
+ next();
+ } catch {
+ res.status(401).json({ error: "Invalid or expired token" });
+ }
+}

platforms/calendar-api/package.json

@@ -0,0 +1,30 @@
+{
+ "name": "calendar-api",
+ "version": "1.0.0",
+ "description": "W3DS auth and eVault-backed calendar events API",
+ "main": "dist/index.js",
+ "scripts": {
+ "start": "node dist/index.js",
+ "dev": "ts-node src/index.ts",
+ "build": "tsc"
+ },
+ "dependencies": {
+ "cors": "^2.8.5",
+ "dotenv": "^16.4.5",
+ "express": "^4.18.2",
+ "graphql-request": "^6.1.0",
+ "jsonwebtoken": "^9.0.2",
+ "signature-validator": "workspace:*",
+ "uuid": "^9.0.1",
+ "axios": "^1.6.7"
+ },
+ "devDependencies": {
+ "@types/cors": "^2.8.17",
+ "@types/express": "^4.17.21",
+ "@types/jsonwebtoken": "^9.0.5",
+ "@types/node": "^20.11.19",
+ "@types/uuid": "^9.0.8",
+ "ts-node": "^10.9.2",
+ "typescript": "^5.3.3"
+ }
+}

platforms/calendar-api/src/constants.ts

@@ -0,0 +1,25 @@
+export const CALENDAR_EVENT_ONTOLOGY_ID =
+ "880e8400-e29b-41d4-a716-446655440099";
+
+const SESSION_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
+export interface StoredSession {
+ createdAt: number;
+}
+
+export const sessionStore = new Map<string, StoredSession>();
+
+export function addSession(sessionId: string): void {
+ sessionStore.set(sessionId, { createdAt: Date.now() });
+}
+
+export function isSessionValid(sessionId: string): boolean {
+ const s = sessionStore.get(sessionId);
+ if (!s) return false;
+ if (Date.now() - s.createdAt > SESSION_TTL_MS) {
+ sessionStore.delete(sessionId);
+ return false;
+ }
+ sessionStore.delete(sessionId); // one-time use
+ return true;
+}

platforms/calendar-api/src/controllers/AuthController.ts

@@ -0,0 +1,136 @@
+import { Request, Response } from "express";
+import { EventEmitter } from "events";
+import { v4 as uuidv4 } from "uuid";
+import jwt from "jsonwebtoken";
+import { verifySignature } from "signature-validator";
+import { isVersionValid } from "../utils/version";
+import { addSession, isSessionValid } from "../constants";
+
+const MIN_REQUIRED_VERSION = "0.4.0";
+const JWT_EXPIRES_IN = "7d";
+
+export class AuthController {
+ private eventEmitter = new EventEmitter();
+
+ getOffer = async (_req: Request, res: Response) => {
+ console.log("[auth] GET /api/auth/offer hit");
+ const baseUrl = process.env.NEXT_PUBLIC_CALENDAR_APP_URL;
+ if (!baseUrl) {
+ console.error("[auth] NEXT_PUBLIC_CALENDAR_APP_URL is not set");
+ return res.status(500).json({ error: "Server configuration error: NEXT_PUBLIC_CALENDAR_APP_URL not set" });
+ }
+
+ let redirectUri: string;
+ try {
+ redirectUri = new URL("/api/auth", baseUrl).toString();
+ } catch (err) {
+ console.error("[auth] Invalid NEXT_PUBLIC_CALENDAR_APP_URL:", baseUrl, err);
+ return res.status(500).json({ error: "Server configuration error: invalid base URL" });
+ }
+
+ const session = uuidv4();
+ addSession(session);
+ const offer = `w3ds://auth?redirect=${encodeURIComponent(redirectUri)}&session=${session}&platform=${encodeURIComponent(baseUrl)}`;
+ console.log("[auth] offer created, redirectUri=", redirectUri, "platform=", baseUrl);
+ res.json({ uri: offer, sessionId: session });
+ };
+
+ sseStream = async (req: Request, res: Response) => {
+ const { id } = req.params;
+ console.log("[auth] GET /api/auth/sessions/:id hit, sessionId=", id);
+ res.writeHead(200, {
+ "Content-Type": "text/event-stream",
+ "Cache-Control": "no-cache",
+ Connection: "keep-alive",
+ "Access-Control-Allow-Origin": "*",
+ });
+ const handler = (data: unknown) => {
+ res.write(`data: ${JSON.stringify(data)}\n\n`);
+ };
+ this.eventEmitter.on(id, handler);
+ const heartbeat = setInterval(() => {
+ try {
+ res.write(": heartbeat\n\n");
+ } catch {
+ clearInterval(heartbeat);
+ }
+ }, 30000);
+ req.on("close", () => {
+ clearInterval(heartbeat);
+ this.eventEmitter.off(id, handler);
+ res.end();
+ });
+ };
+
+ login = async (req: Request, res: Response) => {
+ console.log("[auth] POST /api/auth hit");
+ try {
+ const { ename, session, signature, appVersion } = req.body;
+ console.log("[auth] body: ename=", ename, "session=", session?.slice(0, 8) + "...", "appVersion=", appVersion, "signature present=", !!signature);
+
+ if (!ename) {
+ console.log("[auth] reject: ename missing");
+ return res.status(400).json({ error: "ename is required" });
+ }
+ if (!session) {
+ console.log("[auth] reject: session missing");
+ return res.status(400).json({ error: "session is required" });
+ }
+ if (!signature) {
+ console.log("[auth] reject: signature missing");
+ return res.status(400).json({ error: "signature is required" });
+ }
+
+ if (!isSessionValid(session)) {
+ console.log("[auth] reject: invalid or expired session");
+ return res
+ .status(400)
+ .json({ error: "Invalid or expired session", message: "Please request a new login offer." });
+ }
+
+ if (!appVersion || !isVersionValid(appVersion, MIN_REQUIRED_VERSION)) {
+ console.log("[auth] reject: app version too old", appVersion);
+ return res.status(400).json({
+ error: "App version too old",
+ message: `Please update eID Wallet to version ${MIN_REQUIRED_VERSION} or later.`,
+ });
+ }
+
+ const registryBaseUrl = process.env.PUBLIC_REGISTRY_URL;
+ if (!registryBaseUrl) {
+ console.log("[auth] reject: PUBLIC_REGISTRY_URL not set");
+ return res.status(500).json({ error: "Server configuration error" });
+ }
+
+ console.log("[auth] verifying signature with registry", registryBaseUrl);
+ const verificationResult = await verifySignature({
+ eName: ename,
+ signature,
+ payload: session,
+ registryBaseUrl,
+ });
+
+ if (!verificationResult.valid) {
+ console.log("[auth] reject: signature invalid", verificationResult.error);
+ return res.status(401).json({
+ error: "Invalid signature",
+ message: verificationResult.error,
+ });
+ }
+
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+ const token = jwt.sign(
+ { ename },
+ secret,
+ { expiresIn: JWT_EXPIRES_IN }
+ );
+
+ console.log("[auth] login success, ename=", ename);
+ this.eventEmitter.emit(session, { token });
+ res.status(200).json({ token });
+ } catch (error) {
+ console.error("[auth] login error:", error);
+ res.status(500).json({ error: "Internal server error" });
+ }
+ };
+}

platforms/calendar-api/src/controllers/EventsController.ts

@@ -0,0 +1,109 @@
+import { Response } from "express";
+import { EVaultService } from "../services/EVaultService";
+import { AuthenticatedRequest } from "../middleware/auth";
+
+const evaultService = new EVaultService();
+
+export class EventsController {
+ list = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const first = Math.min(
+ parseInt(String(req.query.first), 10) || 100,
+ 500
+ );
+ const after = (req.query.after as string) || undefined;
+ const events = await evaultService.listEvents(ename, first, after);
+ res.json(events);
+ } catch (error) {
+ console.error("List events error:", error);
+ res.status(500).json({
+ error: "Failed to list events",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ create = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const { title, color, start, end } = req.body;
+ if (!title || !start || !end) {
+ res.status(400).json({
+ error: "Missing required fields",
+ message: "title, start, and end are required",
+ });
+ return;
+ }
+ const event = await evaultService.createEvent(ename, {
+ title,
+ color: color ?? "",
+ start,
+ end,
+ });
+ res.status(201).json(event);
+ } catch (error) {
+ console.error("Create event error:", error);
+ res.status(500).json({
+ error: "Failed to create event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ update = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ const { title, color, start, end } = req.body;
+ const payload: Record<string, string> = {};
+ if (title !== undefined) payload.title = title;
+ if (color !== undefined) payload.color = color;
+ if (start !== undefined) payload.start = start;
+ if (end !== undefined) payload.end = end;
+ if (Object.keys(payload).length === 0) {
+ res.status(400).json({ error: "No fields to update" });
+ return;
+ }
+ const event = await evaultService.updateEvent(ename, id, payload);
+ res.json(event);
+ } catch (error) {
+ console.error("Update event error:", error);
+ res.status(500).json({
+ error: "Failed to update event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ remove = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ await evaultService.removeEvent(ename, id);
+ res.status(204).send();
+ } catch (error) {
+ console.error("Remove event error:", error);
+ res.status(500).json({
+ error: "Failed to delete event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ }
+}

platforms/calendar-api/src/index.ts

@@ -0,0 +1,54 @@
+import dotenv from "dotenv";
+import fs from "fs";
+import path from "path";
+import express from "express";
+import cors from "cors";
+
+// Load .env: try monorepo root, then calendar-api parent, then cwd (no fallback)
+const candidates = [
+ path.resolve(__dirname, "../../../.env"), // repo root from dist/
+ path.resolve(__dirname, "../../.env"), // repo root from src/ or platforms/.env
+ path.resolve(process.cwd(), ".env"),
+];
+const envPath = candidates.find((p) => fs.existsSync(p));
+if (envPath) {
+ dotenv.config({ path: envPath });
+} else {
+ console.warn(
+ "No .env found at",
+ candidates.join(", "),
+ "- env vars must be set by shell or elsewhere"
+ );
+}
+import { AuthController } from "./controllers/AuthController";
+import { EventsController } from "./controllers/EventsController";
+import { authMiddleware } from "./middleware/auth";
+
+const app = express();
+const port = process.env.PORT ?? 4001;
+
+app.use(
+ cors({
+ origin: true,
+ methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
+ allowedHeaders: ["Content-Type", "Authorization"],
+ credentials: true,
+ })
+);
+app.use(express.json());
+
+const authController = new AuthController();
+const eventsController = new EventsController();
+
+app.get("/api/auth/offer", authController.getOffer);
+app.get("/api/auth/sessions/:id", authController.sseStream);
+app.post("/api/auth", authController.login);
+
+app.get("/api/events", authMiddleware, eventsController.list);
+app.post("/api/events", authMiddleware, eventsController.create);
+app.patch("/api/events/:id", authMiddleware, eventsController.update);
+app.delete("/api/events/:id", authMiddleware, eventsController.remove);
+
+app.listen(port, () => {
+ console.log(`Calendar API running on port ${port}`);
+});

platforms/calendar-api/src/middleware/auth.ts

@@ -0,0 +1,37 @@
+import { Request, Response, NextFunction } from "express";
+import jwt from "jsonwebtoken";
+
+export interface AuthPayload {
+ ename: string;
+}
+
+export interface AuthenticatedRequest extends Request {
+ user?: AuthPayload;
+}
+
+export function authMiddleware(
+ req: AuthenticatedRequest,
+ res: Response,
+ next: NextFunction
+): void {
+ const authHeader = req.headers.authorization;
+ if (!authHeader?.startsWith("Bearer ")) {
+ res.status(401).json({ error: "Missing or invalid Authorization header" });
+ return;
+ }
+
+ const token = authHeader.slice(7);
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+
+ try {
+ const decoded = jwt.verify(token, secret) as AuthPayload;
+ if (!decoded.ename) {
+ res.status(401).json({ error: "Invalid token payload" });
+ return;
+ }
+ req.user = { ename: decoded.ename };
+ next();
+ } catch {
+ res.status(401).json({ error: "Invalid or expired token" });
+ }
+}

platforms/calendar-api/package.json

@@ -0,0 +1,30 @@
+{
+ "name": "calendar-api",
+ "version": "1.0.0",
+ "description": "W3DS auth and eVault-backed calendar events API",
+ "main": "dist/index.js",
+ "scripts": {
+ "start": "node dist/index.js",
+ "dev": "ts-node src/index.ts",
+ "build": "tsc"
+ },
+ "dependencies": {
+ "cors": "^2.8.5",
+ "dotenv": "^16.4.5",
+ "express": "^4.18.2",
+ "graphql-request": "^6.1.0",
+ "jsonwebtoken": "^9.0.2",
+ "signature-validator": "workspace:*",
+ "uuid": "^9.0.1",
+ "axios": "^1.6.7"
+ },
+ "devDependencies": {
+ "@types/cors": "^2.8.17",
+ "@types/express": "^4.17.21",
+ "@types/jsonwebtoken": "^9.0.5",
+ "@types/node": "^20.11.19",
+ "@types/uuid": "^9.0.8",
+ "ts-node": "^10.9.2",
+ "typescript": "^5.3.3"
+ }
+}

platforms/calendar-api/src/constants.ts

@@ -0,0 +1,25 @@
+export const CALENDAR_EVENT_ONTOLOGY_ID =
+ "880e8400-e29b-41d4-a716-446655440099";
+
+const SESSION_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
+export interface StoredSession {
+ createdAt: number;
+}
+
+export const sessionStore = new Map<string, StoredSession>();
+
+export function addSession(sessionId: string): void {
+ sessionStore.set(sessionId, { createdAt: Date.now() });
+}
+
+export function isSessionValid(sessionId: string): boolean {
+ const s = sessionStore.get(sessionId);
+ if (!s) return false;
+ if (Date.now() - s.createdAt > SESSION_TTL_MS) {
+ sessionStore.delete(sessionId);
+ return false;
+ }
+ sessionStore.delete(sessionId); // one-time use
+ return true;
+}

platforms/calendar-api/src/controllers/AuthController.ts

@@ -0,0 +1,136 @@
+import { Request, Response } from "express";
+import { EventEmitter } from "events";
+import { v4 as uuidv4 } from "uuid";
+import jwt from "jsonwebtoken";
+import { verifySignature } from "signature-validator";
+import { isVersionValid } from "../utils/version";
+import { addSession, isSessionValid } from "../constants";
+
+const MIN_REQUIRED_VERSION = "0.4.0";
+const JWT_EXPIRES_IN = "7d";
+
+export class AuthController {
+ private eventEmitter = new EventEmitter();
+
+ getOffer = async (_req: Request, res: Response) => {
+ console.log("[auth] GET /api/auth/offer hit");
+ const baseUrl = process.env.NEXT_PUBLIC_CALENDAR_APP_URL;
+ if (!baseUrl) {
+ console.error("[auth] NEXT_PUBLIC_CALENDAR_APP_URL is not set");
+ return res.status(500).json({ error: "Server configuration error: NEXT_PUBLIC_CALENDAR_APP_URL not set" });
+ }
+
+ let redirectUri: string;
+ try {
+ redirectUri = new URL("/api/auth", baseUrl).toString();
+ } catch (err) {
+ console.error("[auth] Invalid NEXT_PUBLIC_CALENDAR_APP_URL:", baseUrl, err);
+ return res.status(500).json({ error: "Server configuration error: invalid base URL" });
+ }
+
+ const session = uuidv4();
+ addSession(session);
+ const offer = `w3ds://auth?redirect=${encodeURIComponent(redirectUri)}&session=${session}&platform=${encodeURIComponent(baseUrl)}`;
+ console.log("[auth] offer created, redirectUri=", redirectUri, "platform=", baseUrl);
+ res.json({ uri: offer, sessionId: session });
+ };
+
+ sseStream = async (req: Request, res: Response) => {
+ const { id } = req.params;
+ console.log("[auth] GET /api/auth/sessions/:id hit, sessionId=", id);
+ res.writeHead(200, {
+ "Content-Type": "text/event-stream",
+ "Cache-Control": "no-cache",
+ Connection: "keep-alive",
+ "Access-Control-Allow-Origin": "*",
+ });
+ const handler = (data: unknown) => {
+ res.write(`data: ${JSON.stringify(data)}\n\n`);
+ };
+ this.eventEmitter.on(id, handler);
+ const heartbeat = setInterval(() => {
+ try {
+ res.write(": heartbeat\n\n");
+ } catch {
+ clearInterval(heartbeat);
+ }
+ }, 30000);
+ req.on("close", () => {
+ clearInterval(heartbeat);
+ this.eventEmitter.off(id, handler);
+ res.end();
+ });
+ };
+
+ login = async (req: Request, res: Response) => {
+ console.log("[auth] POST /api/auth hit");
+ try {
+ const { ename, session, signature, appVersion } = req.body;
+ console.log("[auth] body: ename=", ename, "session=", session?.slice(0, 8) + "...", "appVersion=", appVersion, "signature present=", !!signature);
+
+ if (!ename) {
+ console.log("[auth] reject: ename missing");
+ return res.status(400).json({ error: "ename is required" });
+ }
+ if (!session) {
+ console.log("[auth] reject: session missing");
+ return res.status(400).json({ error: "session is required" });
+ }
+ if (!signature) {
+ console.log("[auth] reject: signature missing");
+ return res.status(400).json({ error: "signature is required" });
+ }
+
+ if (!isSessionValid(session)) {
+ console.log("[auth] reject: invalid or expired session");
+ return res
+ .status(400)
+ .json({ error: "Invalid or expired session", message: "Please request a new login offer." });
+ }
+
+ if (!appVersion || !isVersionValid(appVersion, MIN_REQUIRED_VERSION)) {
+ console.log("[auth] reject: app version too old", appVersion);
+ return res.status(400).json({
+ error: "App version too old",
+ message: `Please update eID Wallet to version ${MIN_REQUIRED_VERSION} or later.`,
+ });
+ }
+
+ const registryBaseUrl = process.env.PUBLIC_REGISTRY_URL;
+ if (!registryBaseUrl) {
+ console.log("[auth] reject: PUBLIC_REGISTRY_URL not set");
+ return res.status(500).json({ error: "Server configuration error" });
+ }
+
+ console.log("[auth] verifying signature with registry", registryBaseUrl);
+ const verificationResult = await verifySignature({
+ eName: ename,
+ signature,
+ payload: session,
+ registryBaseUrl,
+ });
+
+ if (!verificationResult.valid) {
+ console.log("[auth] reject: signature invalid", verificationResult.error);
+ return res.status(401).json({
+ error: "Invalid signature",
+ message: verificationResult.error,
+ });
+ }
+
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+ const token = jwt.sign(
+ { ename },
+ secret,
+ { expiresIn: JWT_EXPIRES_IN }
+ );
+
+ console.log("[auth] login success, ename=", ename);
+ this.eventEmitter.emit(session, { token });
+ res.status(200).json({ token });
+ } catch (error) {
+ console.error("[auth] login error:", error);
+ res.status(500).json({ error: "Internal server error" });
+ }
+ };
+}

platforms/calendar-api/src/controllers/EventsController.ts

@@ -0,0 +1,109 @@
+import { Response } from "express";
+import { EVaultService } from "../services/EVaultService";
+import { AuthenticatedRequest } from "../middleware/auth";
+
+const evaultService = new EVaultService();
+
+export class EventsController {
+ list = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const first = Math.min(
+ parseInt(String(req.query.first), 10) || 100,
+ 500
+ );
+ const after = (req.query.after as string) || undefined;
+ const events = await evaultService.listEvents(ename, first, after);
+ res.json(events);
+ } catch (error) {
+ console.error("List events error:", error);
+ res.status(500).json({
+ error: "Failed to list events",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ create = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const { title, color, start, end } = req.body;
+ if (!title || !start || !end) {
+ res.status(400).json({
+ error: "Missing required fields",
+ message: "title, start, and end are required",
+ });
+ return;
+ }
+ const event = await evaultService.createEvent(ename, {
+ title,
+ color: color ?? "",
+ start,
+ end,
+ });
+ res.status(201).json(event);
+ } catch (error) {
+ console.error("Create event error:", error);
+ res.status(500).json({
+ error: "Failed to create event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ update = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ const { title, color, start, end } = req.body;
+ const payload: Record<string, string> = {};
+ if (title !== undefined) payload.title = title;
+ if (color !== undefined) payload.color = color;
+ if (start !== undefined) payload.start = start;
+ if (end !== undefined) payload.end = end;
+ if (Object.keys(payload).length === 0) {
+ res.status(400).json({ error: "No fields to update" });
+ return;
+ }
+ const event = await evaultService.updateEvent(ename, id, payload);
+ res.json(event);
+ } catch (error) {
+ console.error("Update event error:", error);
+ res.status(500).json({
+ error: "Failed to update event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ remove = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ await evaultService.removeEvent(ename, id);
+ res.status(204).send();
+ } catch (error) {
+ console.error("Remove event error:", error);
+ res.status(500).json({
+ error: "Failed to delete event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ }
+}

platforms/calendar-api/src/index.ts

@@ -0,0 +1,54 @@
+import dotenv from "dotenv";
+import fs from "fs";
+import path from "path";
+import express from "express";
+import cors from "cors";
+
+// Load .env: try monorepo root, then calendar-api parent, then cwd (no fallback)
+const candidates = [
+ path.resolve(__dirname, "../../../.env"), // repo root from dist/
+ path.resolve(__dirname, "../../.env"), // repo root from src/ or platforms/.env
+ path.resolve(process.cwd(), ".env"),
+];
+const envPath = candidates.find((p) => fs.existsSync(p));
+if (envPath) {
+ dotenv.config({ path: envPath });
+} else {
+ console.warn(
+ "No .env found at",
+ candidates.join(", "),
+ "- env vars must be set by shell or elsewhere"
+ );
+}
+import { AuthController } from "./controllers/AuthController";
+import { EventsController } from "./controllers/EventsController";
+import { authMiddleware } from "./middleware/auth";
+
+const app = express();
+const port = process.env.PORT ?? 4001;
+
+app.use(
+ cors({
+ origin: true,
+ methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
+ allowedHeaders: ["Content-Type", "Authorization"],
+ credentials: true,
+ })
+);
+app.use(express.json());
+
+const authController = new AuthController();
+const eventsController = new EventsController();
+
+app.get("/api/auth/offer", authController.getOffer);
+app.get("/api/auth/sessions/:id", authController.sseStream);
+app.post("/api/auth", authController.login);
+
+app.get("/api/events", authMiddleware, eventsController.list);
+app.post("/api/events", authMiddleware, eventsController.create);
+app.patch("/api/events/:id", authMiddleware, eventsController.update);
+app.delete("/api/events/:id", authMiddleware, eventsController.remove);
+
+app.listen(port, () => {
+ console.log(`Calendar API running on port ${port}`);
+});

platforms/calendar-api/src/middleware/auth.ts

@@ -0,0 +1,37 @@
+import { Request, Response, NextFunction } from "express";
+import jwt from "jsonwebtoken";
+
+export interface AuthPayload {
+ ename: string;
+}
+
+export interface AuthenticatedRequest extends Request {
+ user?: AuthPayload;
+}
+
+export function authMiddleware(
+ req: AuthenticatedRequest,
+ res: Response,
+ next: NextFunction
+): void {
+ const authHeader = req.headers.authorization;
+ if (!authHeader?.startsWith("Bearer ")) {
+ res.status(401).json({ error: "Missing or invalid Authorization header" });
+ return;
+ }
+
+ const token = authHeader.slice(7);
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+
+ try {
+ const decoded = jwt.verify(token, secret) as AuthPayload;
+ if (!decoded.ename) {
+ res.status(401).json({ error: "Invalid token payload" });
+ return;
+ }
+ req.user = { ename: decoded.ename };
+ next();
+ } catch {
+ res.status(401).json({ error: "Invalid or expired token" });
+ }
+}

platforms/calendar-api/package.json

@@ -0,0 +1,30 @@
+{
+ "name": "calendar-api",
+ "version": "1.0.0",
+ "description": "W3DS auth and eVault-backed calendar events API",
+ "main": "dist/index.js",
+ "scripts": {
+ "start": "node dist/index.js",
+ "dev": "ts-node src/index.ts",
+ "build": "tsc"
+ },
+ "dependencies": {
+ "cors": "^2.8.5",
+ "dotenv": "^16.4.5",
+ "express": "^4.18.2",
+ "graphql-request": "^6.1.0",
+ "jsonwebtoken": "^9.0.2",
+ "signature-validator": "workspace:*",
+ "uuid": "^9.0.1",
+ "axios": "^1.6.7"
+ },
+ "devDependencies": {
+ "@types/cors": "^2.8.17",
+ "@types/express": "^4.17.21",
+ "@types/jsonwebtoken": "^9.0.5",
+ "@types/node": "^20.11.19",
+ "@types/uuid": "^9.0.8",
+ "ts-node": "^10.9.2",
+ "typescript": "^5.3.3"
+ }
+}

platforms/calendar-api/src/constants.ts

@@ -0,0 +1,25 @@
+export const CALENDAR_EVENT_ONTOLOGY_ID =
+ "880e8400-e29b-41d4-a716-446655440099";
+
+const SESSION_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
+export interface StoredSession {
+ createdAt: number;
+}
+
+export const sessionStore = new Map<string, StoredSession>();
+
+export function addSession(sessionId: string): void {
+ sessionStore.set(sessionId, { createdAt: Date.now() });
+}
+
+export function isSessionValid(sessionId: string): boolean {
+ const s = sessionStore.get(sessionId);
+ if (!s) return false;
+ if (Date.now() - s.createdAt > SESSION_TTL_MS) {
+ sessionStore.delete(sessionId);
+ return false;
+ }
+ sessionStore.delete(sessionId); // one-time use
+ return true;
+}

platforms/calendar-api/src/controllers/AuthController.ts

@@ -0,0 +1,136 @@
+import { Request, Response } from "express";
+import { EventEmitter } from "events";
+import { v4 as uuidv4 } from "uuid";
+import jwt from "jsonwebtoken";
+import { verifySignature } from "signature-validator";
+import { isVersionValid } from "../utils/version";
+import { addSession, isSessionValid } from "../constants";
+
+const MIN_REQUIRED_VERSION = "0.4.0";
+const JWT_EXPIRES_IN = "7d";
+
+export class AuthController {
+ private eventEmitter = new EventEmitter();
+
+ getOffer = async (_req: Request, res: Response) => {
+ console.log("[auth] GET /api/auth/offer hit");
+ const baseUrl = process.env.NEXT_PUBLIC_CALENDAR_APP_URL;
+ if (!baseUrl) {
+ console.error("[auth] NEXT_PUBLIC_CALENDAR_APP_URL is not set");
+ return res.status(500).json({ error: "Server configuration error: NEXT_PUBLIC_CALENDAR_APP_URL not set" });
+ }
+
+ let redirectUri: string;
+ try {
+ redirectUri = new URL("/api/auth", baseUrl).toString();
+ } catch (err) {
+ console.error("[auth] Invalid NEXT_PUBLIC_CALENDAR_APP_URL:", baseUrl, err);
+ return res.status(500).json({ error: "Server configuration error: invalid base URL" });
+ }
+
+ const session = uuidv4();
+ addSession(session);
+ const offer = `w3ds://auth?redirect=${encodeURIComponent(redirectUri)}&session=${session}&platform=${encodeURIComponent(baseUrl)}`;
+ console.log("[auth] offer created, redirectUri=", redirectUri, "platform=", baseUrl);
+ res.json({ uri: offer, sessionId: session });
+ };
+
+ sseStream = async (req: Request, res: Response) => {
+ const { id } = req.params;
+ console.log("[auth] GET /api/auth/sessions/:id hit, sessionId=", id);
+ res.writeHead(200, {
+ "Content-Type": "text/event-stream",
+ "Cache-Control": "no-cache",
+ Connection: "keep-alive",
+ "Access-Control-Allow-Origin": "*",
+ });
+ const handler = (data: unknown) => {
+ res.write(`data: ${JSON.stringify(data)}\n\n`);
+ };
+ this.eventEmitter.on(id, handler);
+ const heartbeat = setInterval(() => {
+ try {
+ res.write(": heartbeat\n\n");
+ } catch {
+ clearInterval(heartbeat);
+ }
+ }, 30000);
+ req.on("close", () => {
+ clearInterval(heartbeat);
+ this.eventEmitter.off(id, handler);
+ res.end();
+ });
+ };
+
+ login = async (req: Request, res: Response) => {
+ console.log("[auth] POST /api/auth hit");
+ try {
+ const { ename, session, signature, appVersion } = req.body;
+ console.log("[auth] body: ename=", ename, "session=", session?.slice(0, 8) + "...", "appVersion=", appVersion, "signature present=", !!signature);
+
+ if (!ename) {
+ console.log("[auth] reject: ename missing");
+ return res.status(400).json({ error: "ename is required" });
+ }
+ if (!session) {
+ console.log("[auth] reject: session missing");
+ return res.status(400).json({ error: "session is required" });
+ }
+ if (!signature) {
+ console.log("[auth] reject: signature missing");
+ return res.status(400).json({ error: "signature is required" });
+ }
+
+ if (!isSessionValid(session)) {
+ console.log("[auth] reject: invalid or expired session");
+ return res
+ .status(400)
+ .json({ error: "Invalid or expired session", message: "Please request a new login offer." });
+ }
+
+ if (!appVersion || !isVersionValid(appVersion, MIN_REQUIRED_VERSION)) {
+ console.log("[auth] reject: app version too old", appVersion);
+ return res.status(400).json({
+ error: "App version too old",
+ message: `Please update eID Wallet to version ${MIN_REQUIRED_VERSION} or later.`,
+ });
+ }
+
+ const registryBaseUrl = process.env.PUBLIC_REGISTRY_URL;
+ if (!registryBaseUrl) {
+ console.log("[auth] reject: PUBLIC_REGISTRY_URL not set");
+ return res.status(500).json({ error: "Server configuration error" });
+ }
+
+ console.log("[auth] verifying signature with registry", registryBaseUrl);
+ const verificationResult = await verifySignature({
+ eName: ename,
+ signature,
+ payload: session,
+ registryBaseUrl,
+ });
+
+ if (!verificationResult.valid) {
+ console.log("[auth] reject: signature invalid", verificationResult.error);
+ return res.status(401).json({
+ error: "Invalid signature",
+ message: verificationResult.error,
+ });
+ }
+
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+ const token = jwt.sign(
+ { ename },
+ secret,
+ { expiresIn: JWT_EXPIRES_IN }
+ );
+
+ console.log("[auth] login success, ename=", ename);
+ this.eventEmitter.emit(session, { token });
+ res.status(200).json({ token });
+ } catch (error) {
+ console.error("[auth] login error:", error);
+ res.status(500).json({ error: "Internal server error" });
+ }
+ };
+}

platforms/calendar-api/src/controllers/EventsController.ts

@@ -0,0 +1,109 @@
+import { Response } from "express";
+import { EVaultService } from "../services/EVaultService";
+import { AuthenticatedRequest } from "../middleware/auth";
+
+const evaultService = new EVaultService();
+
+export class EventsController {
+ list = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const first = Math.min(
+ parseInt(String(req.query.first), 10) || 100,
+ 500
+ );
+ const after = (req.query.after as string) || undefined;
+ const events = await evaultService.listEvents(ename, first, after);
+ res.json(events);
+ } catch (error) {
+ console.error("List events error:", error);
+ res.status(500).json({
+ error: "Failed to list events",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ create = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const { title, color, start, end } = req.body;
+ if (!title || !start || !end) {
+ res.status(400).json({
+ error: "Missing required fields",
+ message: "title, start, and end are required",
+ });
+ return;
+ }
+ const event = await evaultService.createEvent(ename, {
+ title,
+ color: color ?? "",
+ start,
+ end,
+ });
+ res.status(201).json(event);
+ } catch (error) {
+ console.error("Create event error:", error);
+ res.status(500).json({
+ error: "Failed to create event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ update = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ const { title, color, start, end } = req.body;
+ const payload: Record<string, string> = {};
+ if (title !== undefined) payload.title = title;
+ if (color !== undefined) payload.color = color;
+ if (start !== undefined) payload.start = start;
+ if (end !== undefined) payload.end = end;
+ if (Object.keys(payload).length === 0) {
+ res.status(400).json({ error: "No fields to update" });
+ return;
+ }
+ const event = await evaultService.updateEvent(ename, id, payload);
+ res.json(event);
+ } catch (error) {
+ console.error("Update event error:", error);
+ res.status(500).json({
+ error: "Failed to update event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ remove = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ await evaultService.removeEvent(ename, id);
+ res.status(204).send();
+ } catch (error) {
+ console.error("Remove event error:", error);
+ res.status(500).json({
+ error: "Failed to delete event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ }
+}

platforms/calendar-api/src/index.ts

@@ -0,0 +1,54 @@
+import dotenv from "dotenv";
+import fs from "fs";
+import path from "path";
+import express from "express";
+import cors from "cors";
+
+// Load .env: try monorepo root, then calendar-api parent, then cwd (no fallback)
+const candidates = [
+ path.resolve(__dirname, "../../../.env"), // repo root from dist/
+ path.resolve(__dirname, "../../.env"), // repo root from src/ or platforms/.env
+ path.resolve(process.cwd(), ".env"),
+];
+const envPath = candidates.find((p) => fs.existsSync(p));
+if (envPath) {
+ dotenv.config({ path: envPath });
+} else {
+ console.warn(
+ "No .env found at",
+ candidates.join(", "),
+ "- env vars must be set by shell or elsewhere"
+ );
+}
+import { AuthController } from "./controllers/AuthController";
+import { EventsController } from "./controllers/EventsController";
+import { authMiddleware } from "./middleware/auth";
+
+const app = express();
+const port = process.env.PORT ?? 4001;
+
+app.use(
+ cors({
+ origin: true,
+ methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
+ allowedHeaders: ["Content-Type", "Authorization"],
+ credentials: true,
+ })
+);
+app.use(express.json());
+
+const authController = new AuthController();
+const eventsController = new EventsController();
+
+app.get("/api/auth/offer", authController.getOffer);
+app.get("/api/auth/sessions/:id", authController.sseStream);
+app.post("/api/auth", authController.login);
+
+app.get("/api/events", authMiddleware, eventsController.list);
+app.post("/api/events", authMiddleware, eventsController.create);
+app.patch("/api/events/:id", authMiddleware, eventsController.update);
+app.delete("/api/events/:id", authMiddleware, eventsController.remove);
+
+app.listen(port, () => {
+ console.log(`Calendar API running on port ${port}`);
+});

platforms/calendar-api/src/middleware/auth.ts

@@ -0,0 +1,37 @@
+import { Request, Response, NextFunction } from "express";
+import jwt from "jsonwebtoken";
+
+export interface AuthPayload {
+ ename: string;
+}
+
+export interface AuthenticatedRequest extends Request {
+ user?: AuthPayload;
+}
+
+export function authMiddleware(
+ req: AuthenticatedRequest,
+ res: Response,
+ next: NextFunction
+): void {
+ const authHeader = req.headers.authorization;
+ if (!authHeader?.startsWith("Bearer ")) {
+ res.status(401).json({ error: "Missing or invalid Authorization header" });
+ return;
+ }
+
+ const token = authHeader.slice(7);
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+
+ try {
+ const decoded = jwt.verify(token, secret) as AuthPayload;
+ if (!decoded.ename) {
+ res.status(401).json({ error: "Invalid token payload" });
+ return;
+ }
+ req.user = { ename: decoded.ename };
+ next();
+ } catch {
+ res.status(401).json({ error: "Invalid or expired token" });
+ }
+}

platforms/calendar-api/package.json

@@ -0,0 +1,30 @@
+{
+ "name": "calendar-api",
+ "version": "1.0.0",
+ "description": "W3DS auth and eVault-backed calendar events API",
+ "main": "dist/index.js",
+ "scripts": {
+ "start": "node dist/index.js",
+ "dev": "ts-node src/index.ts",
+ "build": "tsc"
+ },
+ "dependencies": {
+ "cors": "^2.8.5",
+ "dotenv": "^16.4.5",
+ "express": "^4.18.2",
+ "graphql-request": "^6.1.0",
+ "jsonwebtoken": "^9.0.2",
+ "signature-validator": "workspace:*",
+ "uuid": "^9.0.1",
+ "axios": "^1.6.7"
+ },
+ "devDependencies": {
+ "@types/cors": "^2.8.17",
+ "@types/express": "^4.17.21",
+ "@types/jsonwebtoken": "^9.0.5",
+ "@types/node": "^20.11.19",
+ "@types/uuid": "^9.0.8",
+ "ts-node": "^10.9.2",
+ "typescript": "^5.3.3"
+ }
+}

platforms/calendar-api/src/constants.ts

@@ -0,0 +1,25 @@
+export const CALENDAR_EVENT_ONTOLOGY_ID =
+ "880e8400-e29b-41d4-a716-446655440099";
+
+const SESSION_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
+export interface StoredSession {
+ createdAt: number;
+}
+
+export const sessionStore = new Map<string, StoredSession>();
+
+export function addSession(sessionId: string): void {
+ sessionStore.set(sessionId, { createdAt: Date.now() });
+}
+
+export function isSessionValid(sessionId: string): boolean {
+ const s = sessionStore.get(sessionId);
+ if (!s) return false;
+ if (Date.now() - s.createdAt > SESSION_TTL_MS) {
+ sessionStore.delete(sessionId);
+ return false;
+ }
+ sessionStore.delete(sessionId); // one-time use
+ return true;
+}

platforms/calendar-api/src/controllers/AuthController.ts

@@ -0,0 +1,136 @@
+import { Request, Response } from "express";
+import { EventEmitter } from "events";
+import { v4 as uuidv4 } from "uuid";
+import jwt from "jsonwebtoken";
+import { verifySignature } from "signature-validator";
+import { isVersionValid } from "../utils/version";
+import { addSession, isSessionValid } from "../constants";
+
+const MIN_REQUIRED_VERSION = "0.4.0";
+const JWT_EXPIRES_IN = "7d";
+
+export class AuthController {
+ private eventEmitter = new EventEmitter();
+
+ getOffer = async (_req: Request, res: Response) => {
+ console.log("[auth] GET /api/auth/offer hit");
+ const baseUrl = process.env.NEXT_PUBLIC_CALENDAR_APP_URL;
+ if (!baseUrl) {
+ console.error("[auth] NEXT_PUBLIC_CALENDAR_APP_URL is not set");
+ return res.status(500).json({ error: "Server configuration error: NEXT_PUBLIC_CALENDAR_APP_URL not set" });
+ }
+
+ let redirectUri: string;
+ try {
+ redirectUri = new URL("/api/auth", baseUrl).toString();
+ } catch (err) {
+ console.error("[auth] Invalid NEXT_PUBLIC_CALENDAR_APP_URL:", baseUrl, err);
+ return res.status(500).json({ error: "Server configuration error: invalid base URL" });
+ }
+
+ const session = uuidv4();
+ addSession(session);
+ const offer = `w3ds://auth?redirect=${encodeURIComponent(redirectUri)}&session=${session}&platform=${encodeURIComponent(baseUrl)}`;
+ console.log("[auth] offer created, redirectUri=", redirectUri, "platform=", baseUrl);
+ res.json({ uri: offer, sessionId: session });
+ };
+
+ sseStream = async (req: Request, res: Response) => {
+ const { id } = req.params;
+ console.log("[auth] GET /api/auth/sessions/:id hit, sessionId=", id);
+ res.writeHead(200, {
+ "Content-Type": "text/event-stream",
+ "Cache-Control": "no-cache",
+ Connection: "keep-alive",
+ "Access-Control-Allow-Origin": "*",
+ });
+ const handler = (data: unknown) => {
+ res.write(`data: ${JSON.stringify(data)}\n\n`);
+ };
+ this.eventEmitter.on(id, handler);
+ const heartbeat = setInterval(() => {
+ try {
+ res.write(": heartbeat\n\n");
+ } catch {
+ clearInterval(heartbeat);
+ }
+ }, 30000);
+ req.on("close", () => {
+ clearInterval(heartbeat);
+ this.eventEmitter.off(id, handler);
+ res.end();
+ });
+ };
+
+ login = async (req: Request, res: Response) => {
+ console.log("[auth] POST /api/auth hit");
+ try {
+ const { ename, session, signature, appVersion } = req.body;
+ console.log("[auth] body: ename=", ename, "session=", session?.slice(0, 8) + "...", "appVersion=", appVersion, "signature present=", !!signature);
+
+ if (!ename) {
+ console.log("[auth] reject: ename missing");
+ return res.status(400).json({ error: "ename is required" });
+ }
+ if (!session) {
+ console.log("[auth] reject: session missing");
+ return res.status(400).json({ error: "session is required" });
+ }
+ if (!signature) {
+ console.log("[auth] reject: signature missing");
+ return res.status(400).json({ error: "signature is required" });
+ }
+
+ if (!isSessionValid(session)) {
+ console.log("[auth] reject: invalid or expired session");
+ return res
+ .status(400)
+ .json({ error: "Invalid or expired session", message: "Please request a new login offer." });
+ }
+
+ if (!appVersion || !isVersionValid(appVersion, MIN_REQUIRED_VERSION)) {
+ console.log("[auth] reject: app version too old", appVersion);
+ return res.status(400).json({
+ error: "App version too old",
+ message: `Please update eID Wallet to version ${MIN_REQUIRED_VERSION} or later.`,
+ });
+ }
+
+ const registryBaseUrl = process.env.PUBLIC_REGISTRY_URL;
+ if (!registryBaseUrl) {
+ console.log("[auth] reject: PUBLIC_REGISTRY_URL not set");
+ return res.status(500).json({ error: "Server configuration error" });
+ }
+
+ console.log("[auth] verifying signature with registry", registryBaseUrl);
+ const verificationResult = await verifySignature({
+ eName: ename,
+ signature,
+ payload: session,
+ registryBaseUrl,
+ });
+
+ if (!verificationResult.valid) {
+ console.log("[auth] reject: signature invalid", verificationResult.error);
+ return res.status(401).json({
+ error: "Invalid signature",
+ message: verificationResult.error,
+ });
+ }
+
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+ const token = jwt.sign(
+ { ename },
+ secret,
+ { expiresIn: JWT_EXPIRES_IN }
+ );
+
+ console.log("[auth] login success, ename=", ename);
+ this.eventEmitter.emit(session, { token });
+ res.status(200).json({ token });
+ } catch (error) {
+ console.error("[auth] login error:", error);
+ res.status(500).json({ error: "Internal server error" });
+ }
+ };
+}

platforms/calendar-api/src/controllers/EventsController.ts

@@ -0,0 +1,109 @@
+import { Response } from "express";
+import { EVaultService } from "../services/EVaultService";
+import { AuthenticatedRequest } from "../middleware/auth";
+
+const evaultService = new EVaultService();
+
+export class EventsController {
+ list = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const first = Math.min(
+ parseInt(String(req.query.first), 10) || 100,
+ 500
+ );
+ const after = (req.query.after as string) || undefined;
+ const events = await evaultService.listEvents(ename, first, after);
+ res.json(events);
+ } catch (error) {
+ console.error("List events error:", error);
+ res.status(500).json({
+ error: "Failed to list events",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ create = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const { title, color, start, end } = req.body;
+ if (!title || !start || !end) {
+ res.status(400).json({
+ error: "Missing required fields",
+ message: "title, start, and end are required",
+ });
+ return;
+ }
+ const event = await evaultService.createEvent(ename, {
+ title,
+ color: color ?? "",
+ start,
+ end,
+ });
+ res.status(201).json(event);
+ } catch (error) {
+ console.error("Create event error:", error);
+ res.status(500).json({
+ error: "Failed to create event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ update = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ const { title, color, start, end } = req.body;
+ const payload: Record<string, string> = {};
+ if (title !== undefined) payload.title = title;
+ if (color !== undefined) payload.color = color;
+ if (start !== undefined) payload.start = start;
+ if (end !== undefined) payload.end = end;
+ if (Object.keys(payload).length === 0) {
+ res.status(400).json({ error: "No fields to update" });
+ return;
+ }
+ const event = await evaultService.updateEvent(ename, id, payload);
+ res.json(event);
+ } catch (error) {
+ console.error("Update event error:", error);
+ res.status(500).json({
+ error: "Failed to update event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ remove = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ await evaultService.removeEvent(ename, id);
+ res.status(204).send();
+ } catch (error) {
+ console.error("Remove event error:", error);
+ res.status(500).json({
+ error: "Failed to delete event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ }
+}

platforms/calendar-api/src/index.ts

@@ -0,0 +1,54 @@
+import dotenv from "dotenv";
+import fs from "fs";
+import path from "path";
+import express from "express";
+import cors from "cors";
+
+// Load .env: try monorepo root, then calendar-api parent, then cwd (no fallback)
+const candidates = [
+ path.resolve(__dirname, "../../../.env"), // repo root from dist/
+ path.resolve(__dirname, "../../.env"), // repo root from src/ or platforms/.env
+ path.resolve(process.cwd(), ".env"),
+];
+const envPath = candidates.find((p) => fs.existsSync(p));
+if (envPath) {
+ dotenv.config({ path: envPath });
+} else {
+ console.warn(
+ "No .env found at",
+ candidates.join(", "),
+ "- env vars must be set by shell or elsewhere"
+ );
+}
+import { AuthController } from "./controllers/AuthController";
+import { EventsController } from "./controllers/EventsController";
+import { authMiddleware } from "./middleware/auth";
+
+const app = express();
+const port = process.env.PORT ?? 4001;
+
+app.use(
+ cors({
+ origin: true,
+ methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
+ allowedHeaders: ["Content-Type", "Authorization"],
+ credentials: true,
+ })
+);
+app.use(express.json());
+
+const authController = new AuthController();
+const eventsController = new EventsController();
+
+app.get("/api/auth/offer", authController.getOffer);
+app.get("/api/auth/sessions/:id", authController.sseStream);
+app.post("/api/auth", authController.login);
+
+app.get("/api/events", authMiddleware, eventsController.list);
+app.post("/api/events", authMiddleware, eventsController.create);
+app.patch("/api/events/:id", authMiddleware, eventsController.update);
+app.delete("/api/events/:id", authMiddleware, eventsController.remove);
+
+app.listen(port, () => {
+ console.log(`Calendar API running on port ${port}`);
+});

platforms/calendar-api/src/middleware/auth.ts

@@ -0,0 +1,37 @@
+import { Request, Response, NextFunction } from "express";
+import jwt from "jsonwebtoken";
+
+export interface AuthPayload {
+ ename: string;
+}
+
+export interface AuthenticatedRequest extends Request {
+ user?: AuthPayload;
+}
+
+export function authMiddleware(
+ req: AuthenticatedRequest,
+ res: Response,
+ next: NextFunction
+): void {
+ const authHeader = req.headers.authorization;
+ if (!authHeader?.startsWith("Bearer ")) {
+ res.status(401).json({ error: "Missing or invalid Authorization header" });
+ return;
+ }
+
+ const token = authHeader.slice(7);
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+
+ try {
+ const decoded = jwt.verify(token, secret) as AuthPayload;
+ if (!decoded.ename) {
+ res.status(401).json({ error: "Invalid token payload" });
+ return;
+ }
+ req.user = { ename: decoded.ename };
+ next();
+ } catch {
+ res.status(401).json({ error: "Invalid or expired token" });
+ }
+}

platforms/calendar-api/package.json

@@ -0,0 +1,30 @@
+{
+ "name": "calendar-api",
+ "version": "1.0.0",
+ "description": "W3DS auth and eVault-backed calendar events API",
+ "main": "dist/index.js",
+ "scripts": {
+ "start": "node dist/index.js",
+ "dev": "ts-node src/index.ts",
+ "build": "tsc"
+ },
+ "dependencies": {
+ "cors": "^2.8.5",
+ "dotenv": "^16.4.5",
+ "express": "^4.18.2",
+ "graphql-request": "^6.1.0",
+ "jsonwebtoken": "^9.0.2",
+ "signature-validator": "workspace:*",
+ "uuid": "^9.0.1",
+ "axios": "^1.6.7"
+ },
+ "devDependencies": {
+ "@types/cors": "^2.8.17",
+ "@types/express": "^4.17.21",
+ "@types/jsonwebtoken": "^9.0.5",
+ "@types/node": "^20.11.19",
+ "@types/uuid": "^9.0.8",
+ "ts-node": "^10.9.2",
+ "typescript": "^5.3.3"
+ }
+}

platforms/calendar-api/src/constants.ts

@@ -0,0 +1,25 @@
+export const CALENDAR_EVENT_ONTOLOGY_ID =
+ "880e8400-e29b-41d4-a716-446655440099";
+
+const SESSION_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
+export interface StoredSession {
+ createdAt: number;
+}
+
+export const sessionStore = new Map<string, StoredSession>();
+
+export function addSession(sessionId: string): void {
+ sessionStore.set(sessionId, { createdAt: Date.now() });
+}
+
+export function isSessionValid(sessionId: string): boolean {
+ const s = sessionStore.get(sessionId);
+ if (!s) return false;
+ if (Date.now() - s.createdAt > SESSION_TTL_MS) {
+ sessionStore.delete(sessionId);
+ return false;
+ }
+ sessionStore.delete(sessionId); // one-time use
+ return true;
+}

platforms/calendar-api/src/controllers/AuthController.ts

@@ -0,0 +1,136 @@
+import { Request, Response } from "express";
+import { EventEmitter } from "events";
+import { v4 as uuidv4 } from "uuid";
+import jwt from "jsonwebtoken";
+import { verifySignature } from "signature-validator";
+import { isVersionValid } from "../utils/version";
+import { addSession, isSessionValid } from "../constants";
+
+const MIN_REQUIRED_VERSION = "0.4.0";
+const JWT_EXPIRES_IN = "7d";
+
+export class AuthController {
+ private eventEmitter = new EventEmitter();
+
+ getOffer = async (_req: Request, res: Response) => {
+ console.log("[auth] GET /api/auth/offer hit");
+ const baseUrl = process.env.NEXT_PUBLIC_CALENDAR_APP_URL;
+ if (!baseUrl) {
+ console.error("[auth] NEXT_PUBLIC_CALENDAR_APP_URL is not set");
+ return res.status(500).json({ error: "Server configuration error: NEXT_PUBLIC_CALENDAR_APP_URL not set" });
+ }
+
+ let redirectUri: string;
+ try {
+ redirectUri = new URL("/api/auth", baseUrl).toString();
+ } catch (err) {
+ console.error("[auth] Invalid NEXT_PUBLIC_CALENDAR_APP_URL:", baseUrl, err);
+ return res.status(500).json({ error: "Server configuration error: invalid base URL" });
+ }
+
+ const session = uuidv4();
+ addSession(session);
+ const offer = `w3ds://auth?redirect=${encodeURIComponent(redirectUri)}&session=${session}&platform=${encodeURIComponent(baseUrl)}`;
+ console.log("[auth] offer created, redirectUri=", redirectUri, "platform=", baseUrl);
+ res.json({ uri: offer, sessionId: session });
+ };
+
+ sseStream = async (req: Request, res: Response) => {
+ const { id } = req.params;
+ console.log("[auth] GET /api/auth/sessions/:id hit, sessionId=", id);
+ res.writeHead(200, {
+ "Content-Type": "text/event-stream",
+ "Cache-Control": "no-cache",
+ Connection: "keep-alive",
+ "Access-Control-Allow-Origin": "*",
+ });
+ const handler = (data: unknown) => {
+ res.write(`data: ${JSON.stringify(data)}\n\n`);
+ };
+ this.eventEmitter.on(id, handler);
+ const heartbeat = setInterval(() => {
+ try {
+ res.write(": heartbeat\n\n");
+ } catch {
+ clearInterval(heartbeat);
+ }
+ }, 30000);
+ req.on("close", () => {
+ clearInterval(heartbeat);
+ this.eventEmitter.off(id, handler);
+ res.end();
+ });
+ };
+
+ login = async (req: Request, res: Response) => {
+ console.log("[auth] POST /api/auth hit");
+ try {
+ const { ename, session, signature, appVersion } = req.body;
+ console.log("[auth] body: ename=", ename, "session=", session?.slice(0, 8) + "...", "appVersion=", appVersion, "signature present=", !!signature);
+
+ if (!ename) {
+ console.log("[auth] reject: ename missing");
+ return res.status(400).json({ error: "ename is required" });
+ }
+ if (!session) {
+ console.log("[auth] reject: session missing");
+ return res.status(400).json({ error: "session is required" });
+ }
+ if (!signature) {
+ console.log("[auth] reject: signature missing");
+ return res.status(400).json({ error: "signature is required" });
+ }
+
+ if (!isSessionValid(session)) {
+ console.log("[auth] reject: invalid or expired session");
+ return res
+ .status(400)
+ .json({ error: "Invalid or expired session", message: "Please request a new login offer." });
+ }
+
+ if (!appVersion || !isVersionValid(appVersion, MIN_REQUIRED_VERSION)) {
+ console.log("[auth] reject: app version too old", appVersion);
+ return res.status(400).json({
+ error: "App version too old",
+ message: `Please update eID Wallet to version ${MIN_REQUIRED_VERSION} or later.`,
+ });
+ }
+
+ const registryBaseUrl = process.env.PUBLIC_REGISTRY_URL;
+ if (!registryBaseUrl) {
+ console.log("[auth] reject: PUBLIC_REGISTRY_URL not set");
+ return res.status(500).json({ error: "Server configuration error" });
+ }
+
+ console.log("[auth] verifying signature with registry", registryBaseUrl);
+ const verificationResult = await verifySignature({
+ eName: ename,
+ signature,
+ payload: session,
+ registryBaseUrl,
+ });
+
+ if (!verificationResult.valid) {
+ console.log("[auth] reject: signature invalid", verificationResult.error);
+ return res.status(401).json({
+ error: "Invalid signature",
+ message: verificationResult.error,
+ });
+ }
+
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+ const token = jwt.sign(
+ { ename },
+ secret,
+ { expiresIn: JWT_EXPIRES_IN }
+ );
+
+ console.log("[auth] login success, ename=", ename);
+ this.eventEmitter.emit(session, { token });
+ res.status(200).json({ token });
+ } catch (error) {
+ console.error("[auth] login error:", error);
+ res.status(500).json({ error: "Internal server error" });
+ }
+ };
+}

platforms/calendar-api/src/controllers/EventsController.ts

@@ -0,0 +1,109 @@
+import { Response } from "express";
+import { EVaultService } from "../services/EVaultService";
+import { AuthenticatedRequest } from "../middleware/auth";
+
+const evaultService = new EVaultService();
+
+export class EventsController {
+ list = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const first = Math.min(
+ parseInt(String(req.query.first), 10) || 100,
+ 500
+ );
+ const after = (req.query.after as string) || undefined;
+ const events = await evaultService.listEvents(ename, first, after);
+ res.json(events);
+ } catch (error) {
+ console.error("List events error:", error);
+ res.status(500).json({
+ error: "Failed to list events",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ create = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const { title, color, start, end } = req.body;
+ if (!title || !start || !end) {
+ res.status(400).json({
+ error: "Missing required fields",
+ message: "title, start, and end are required",
+ });
+ return;
+ }
+ const event = await evaultService.createEvent(ename, {
+ title,
+ color: color ?? "",
+ start,
+ end,
+ });
+ res.status(201).json(event);
+ } catch (error) {
+ console.error("Create event error:", error);
+ res.status(500).json({
+ error: "Failed to create event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ update = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ const { title, color, start, end } = req.body;
+ const payload: Record<string, string> = {};
+ if (title !== undefined) payload.title = title;
+ if (color !== undefined) payload.color = color;
+ if (start !== undefined) payload.start = start;
+ if (end !== undefined) payload.end = end;
+ if (Object.keys(payload).length === 0) {
+ res.status(400).json({ error: "No fields to update" });
+ return;
+ }
+ const event = await evaultService.updateEvent(ename, id, payload);
+ res.json(event);
+ } catch (error) {
+ console.error("Update event error:", error);
+ res.status(500).json({
+ error: "Failed to update event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ remove = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ await evaultService.removeEvent(ename, id);
+ res.status(204).send();
+ } catch (error) {
+ console.error("Remove event error:", error);
+ res.status(500).json({
+ error: "Failed to delete event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ }
+}

platforms/calendar-api/src/index.ts

@@ -0,0 +1,54 @@
+import dotenv from "dotenv";
+import fs from "fs";
+import path from "path";
+import express from "express";
+import cors from "cors";
+
+// Load .env: try monorepo root, then calendar-api parent, then cwd (no fallback)
+const candidates = [
+ path.resolve(__dirname, "../../../.env"), // repo root from dist/
+ path.resolve(__dirname, "../../.env"), // repo root from src/ or platforms/.env
+ path.resolve(process.cwd(), ".env"),
+];
+const envPath = candidates.find((p) => fs.existsSync(p));
+if (envPath) {
+ dotenv.config({ path: envPath });
+} else {
+ console.warn(
+ "No .env found at",
+ candidates.join(", "),
+ "- env vars must be set by shell or elsewhere"
+ );
+}
+import { AuthController } from "./controllers/AuthController";
+import { EventsController } from "./controllers/EventsController";
+import { authMiddleware } from "./middleware/auth";
+
+const app = express();
+const port = process.env.PORT ?? 4001;
+
+app.use(
+ cors({
+ origin: true,
+ methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
+ allowedHeaders: ["Content-Type", "Authorization"],
+ credentials: true,
+ })
+);
+app.use(express.json());
+
+const authController = new AuthController();
+const eventsController = new EventsController();
+
+app.get("/api/auth/offer", authController.getOffer);
+app.get("/api/auth/sessions/:id", authController.sseStream);
+app.post("/api/auth", authController.login);
+
+app.get("/api/events", authMiddleware, eventsController.list);
+app.post("/api/events", authMiddleware, eventsController.create);
+app.patch("/api/events/:id", authMiddleware, eventsController.update);
+app.delete("/api/events/:id", authMiddleware, eventsController.remove);
+
+app.listen(port, () => {
+ console.log(`Calendar API running on port ${port}`);
+});

platforms/calendar-api/src/middleware/auth.ts

@@ -0,0 +1,37 @@
+import { Request, Response, NextFunction } from "express";
+import jwt from "jsonwebtoken";
+
+export interface AuthPayload {
+ ename: string;
+}
+
+export interface AuthenticatedRequest extends Request {
+ user?: AuthPayload;
+}
+
+export function authMiddleware(
+ req: AuthenticatedRequest,
+ res: Response,
+ next: NextFunction
+): void {
+ const authHeader = req.headers.authorization;
+ if (!authHeader?.startsWith("Bearer ")) {
+ res.status(401).json({ error: "Missing or invalid Authorization header" });
+ return;
+ }
+
+ const token = authHeader.slice(7);
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+
+ try {
+ const decoded = jwt.verify(token, secret) as AuthPayload;
+ if (!decoded.ename) {
+ res.status(401).json({ error: "Invalid token payload" });
+ return;
+ }
+ req.user = { ename: decoded.ename };
+ next();
+ } catch {
+ res.status(401).json({ error: "Invalid or expired token" });
+ }
+}

platforms/calendar-api/package.json

@@ -0,0 +1,30 @@
+{
+ "name": "calendar-api",
+ "version": "1.0.0",
+ "description": "W3DS auth and eVault-backed calendar events API",
+ "main": "dist/index.js",
+ "scripts": {
+ "start": "node dist/index.js",
+ "dev": "ts-node src/index.ts",
+ "build": "tsc"
+ },
+ "dependencies": {
+ "cors": "^2.8.5",
+ "dotenv": "^16.4.5",
+ "express": "^4.18.2",
+ "graphql-request": "^6.1.0",
+ "jsonwebtoken": "^9.0.2",
+ "signature-validator": "workspace:*",
+ "uuid": "^9.0.1",
+ "axios": "^1.6.7"
+ },
+ "devDependencies": {
+ "@types/cors": "^2.8.17",
+ "@types/express": "^4.17.21",
+ "@types/jsonwebtoken": "^9.0.5",
+ "@types/node": "^20.11.19",
+ "@types/uuid": "^9.0.8",
+ "ts-node": "^10.9.2",
+ "typescript": "^5.3.3"
+ }
+}

platforms/calendar-api/src/constants.ts

@@ -0,0 +1,25 @@
+export const CALENDAR_EVENT_ONTOLOGY_ID =
+ "880e8400-e29b-41d4-a716-446655440099";
+
+const SESSION_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
+export interface StoredSession {
+ createdAt: number;
+}
+
+export const sessionStore = new Map<string, StoredSession>();
+
+export function addSession(sessionId: string): void {
+ sessionStore.set(sessionId, { createdAt: Date.now() });
+}
+
+export function isSessionValid(sessionId: string): boolean {
+ const s = sessionStore.get(sessionId);
+ if (!s) return false;
+ if (Date.now() - s.createdAt > SESSION_TTL_MS) {
+ sessionStore.delete(sessionId);
+ return false;
+ }
+ sessionStore.delete(sessionId); // one-time use
+ return true;
+}

platforms/calendar-api/src/controllers/AuthController.ts

@@ -0,0 +1,136 @@
+import { Request, Response } from "express";
+import { EventEmitter } from "events";
+import { v4 as uuidv4 } from "uuid";
+import jwt from "jsonwebtoken";
+import { verifySignature } from "signature-validator";
+import { isVersionValid } from "../utils/version";
+import { addSession, isSessionValid } from "../constants";
+
+const MIN_REQUIRED_VERSION = "0.4.0";
+const JWT_EXPIRES_IN = "7d";
+
+export class AuthController {
+ private eventEmitter = new EventEmitter();
+
+ getOffer = async (_req: Request, res: Response) => {
+ console.log("[auth] GET /api/auth/offer hit");
+ const baseUrl = process.env.NEXT_PUBLIC_CALENDAR_APP_URL;
+ if (!baseUrl) {
+ console.error("[auth] NEXT_PUBLIC_CALENDAR_APP_URL is not set");
+ return res.status(500).json({ error: "Server configuration error: NEXT_PUBLIC_CALENDAR_APP_URL not set" });
+ }
+
+ let redirectUri: string;
+ try {
+ redirectUri = new URL("/api/auth", baseUrl).toString();
+ } catch (err) {
+ console.error("[auth] Invalid NEXT_PUBLIC_CALENDAR_APP_URL:", baseUrl, err);
+ return res.status(500).json({ error: "Server configuration error: invalid base URL" });
+ }
+
+ const session = uuidv4();
+ addSession(session);
+ const offer = `w3ds://auth?redirect=${encodeURIComponent(redirectUri)}&session=${session}&platform=${encodeURIComponent(baseUrl)}`;
+ console.log("[auth] offer created, redirectUri=", redirectUri, "platform=", baseUrl);
+ res.json({ uri: offer, sessionId: session });
+ };
+
+ sseStream = async (req: Request, res: Response) => {
+ const { id } = req.params;
+ console.log("[auth] GET /api/auth/sessions/:id hit, sessionId=", id);
+ res.writeHead(200, {
+ "Content-Type": "text/event-stream",
+ "Cache-Control": "no-cache",
+ Connection: "keep-alive",
+ "Access-Control-Allow-Origin": "*",
+ });
+ const handler = (data: unknown) => {
+ res.write(`data: ${JSON.stringify(data)}\n\n`);
+ };
+ this.eventEmitter.on(id, handler);
+ const heartbeat = setInterval(() => {
+ try {
+ res.write(": heartbeat\n\n");
+ } catch {
+ clearInterval(heartbeat);
+ }
+ }, 30000);
+ req.on("close", () => {
+ clearInterval(heartbeat);
+ this.eventEmitter.off(id, handler);
+ res.end();
+ });
+ };
+
+ login = async (req: Request, res: Response) => {
+ console.log("[auth] POST /api/auth hit");
+ try {
+ const { ename, session, signature, appVersion } = req.body;
+ console.log("[auth] body: ename=", ename, "session=", session?.slice(0, 8) + "...", "appVersion=", appVersion, "signature present=", !!signature);
+
+ if (!ename) {
+ console.log("[auth] reject: ename missing");
+ return res.status(400).json({ error: "ename is required" });
+ }
+ if (!session) {
+ console.log("[auth] reject: session missing");
+ return res.status(400).json({ error: "session is required" });
+ }
+ if (!signature) {
+ console.log("[auth] reject: signature missing");
+ return res.status(400).json({ error: "signature is required" });
+ }
+
+ if (!isSessionValid(session)) {
+ console.log("[auth] reject: invalid or expired session");
+ return res
+ .status(400)
+ .json({ error: "Invalid or expired session", message: "Please request a new login offer." });
+ }
+
+ if (!appVersion || !isVersionValid(appVersion, MIN_REQUIRED_VERSION)) {
+ console.log("[auth] reject: app version too old", appVersion);
+ return res.status(400).json({
+ error: "App version too old",
+ message: `Please update eID Wallet to version ${MIN_REQUIRED_VERSION} or later.`,
+ });
+ }
+
+ const registryBaseUrl = process.env.PUBLIC_REGISTRY_URL;
+ if (!registryBaseUrl) {
+ console.log("[auth] reject: PUBLIC_REGISTRY_URL not set");
+ return res.status(500).json({ error: "Server configuration error" });
+ }
+
+ console.log("[auth] verifying signature with registry", registryBaseUrl);
+ const verificationResult = await verifySignature({
+ eName: ename,
+ signature,
+ payload: session,
+ registryBaseUrl,
+ });
+
+ if (!verificationResult.valid) {
+ console.log("[auth] reject: signature invalid", verificationResult.error);
+ return res.status(401).json({
+ error: "Invalid signature",
+ message: verificationResult.error,
+ });
+ }
+
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+ const token = jwt.sign(
+ { ename },
+ secret,
+ { expiresIn: JWT_EXPIRES_IN }
+ );
+
+ console.log("[auth] login success, ename=", ename);
+ this.eventEmitter.emit(session, { token });
+ res.status(200).json({ token });
+ } catch (error) {
+ console.error("[auth] login error:", error);
+ res.status(500).json({ error: "Internal server error" });
+ }
+ };
+}

platforms/calendar-api/src/controllers/EventsController.ts

@@ -0,0 +1,109 @@
+import { Response } from "express";
+import { EVaultService } from "../services/EVaultService";
+import { AuthenticatedRequest } from "../middleware/auth";
+
+const evaultService = new EVaultService();
+
+export class EventsController {
+ list = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const first = Math.min(
+ parseInt(String(req.query.first), 10) || 100,
+ 500
+ );
+ const after = (req.query.after as string) || undefined;
+ const events = await evaultService.listEvents(ename, first, after);
+ res.json(events);
+ } catch (error) {
+ console.error("List events error:", error);
+ res.status(500).json({
+ error: "Failed to list events",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ create = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const { title, color, start, end } = req.body;
+ if (!title || !start || !end) {
+ res.status(400).json({
+ error: "Missing required fields",
+ message: "title, start, and end are required",
+ });
+ return;
+ }
+ const event = await evaultService.createEvent(ename, {
+ title,
+ color: color ?? "",
+ start,
+ end,
+ });
+ res.status(201).json(event);
+ } catch (error) {
+ console.error("Create event error:", error);
+ res.status(500).json({
+ error: "Failed to create event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ update = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ const { title, color, start, end } = req.body;
+ const payload: Record<string, string> = {};
+ if (title !== undefined) payload.title = title;
+ if (color !== undefined) payload.color = color;
+ if (start !== undefined) payload.start = start;
+ if (end !== undefined) payload.end = end;
+ if (Object.keys(payload).length === 0) {
+ res.status(400).json({ error: "No fields to update" });
+ return;
+ }
+ const event = await evaultService.updateEvent(ename, id, payload);
+ res.json(event);
+ } catch (error) {
+ console.error("Update event error:", error);
+ res.status(500).json({
+ error: "Failed to update event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ remove = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ await evaultService.removeEvent(ename, id);
+ res.status(204).send();
+ } catch (error) {
+ console.error("Remove event error:", error);
+ res.status(500).json({
+ error: "Failed to delete event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ }
+}

platforms/calendar-api/src/index.ts

@@ -0,0 +1,54 @@
+import dotenv from "dotenv";
+import fs from "fs";
+import path from "path";
+import express from "express";
+import cors from "cors";
+
+// Load .env: try monorepo root, then calendar-api parent, then cwd (no fallback)
+const candidates = [
+ path.resolve(__dirname, "../../../.env"), // repo root from dist/
+ path.resolve(__dirname, "../../.env"), // repo root from src/ or platforms/.env
+ path.resolve(process.cwd(), ".env"),
+];
+const envPath = candidates.find((p) => fs.existsSync(p));
+if (envPath) {
+ dotenv.config({ path: envPath });
+} else {
+ console.warn(
+ "No .env found at",
+ candidates.join(", "),
+ "- env vars must be set by shell or elsewhere"
+ );
+}
+import { AuthController } from "./controllers/AuthController";
+import { EventsController } from "./controllers/EventsController";
+import { authMiddleware } from "./middleware/auth";
+
+const app = express();
+const port = process.env.PORT ?? 4001;
+
+app.use(
+ cors({
+ origin: true,
+ methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
+ allowedHeaders: ["Content-Type", "Authorization"],
+ credentials: true,
+ })
+);
+app.use(express.json());
+
+const authController = new AuthController();
+const eventsController = new EventsController();
+
+app.get("/api/auth/offer", authController.getOffer);
+app.get("/api/auth/sessions/:id", authController.sseStream);
+app.post("/api/auth", authController.login);
+
+app.get("/api/events", authMiddleware, eventsController.list);
+app.post("/api/events", authMiddleware, eventsController.create);
+app.patch("/api/events/:id", authMiddleware, eventsController.update);
+app.delete("/api/events/:id", authMiddleware, eventsController.remove);
+
+app.listen(port, () => {
+ console.log(`Calendar API running on port ${port}`);
+});

platforms/calendar-api/src/middleware/auth.ts

@@ -0,0 +1,37 @@
+import { Request, Response, NextFunction } from "express";
+import jwt from "jsonwebtoken";
+
+export interface AuthPayload {
+ ename: string;
+}
+
+export interface AuthenticatedRequest extends Request {
+ user?: AuthPayload;
+}
+
+export function authMiddleware(
+ req: AuthenticatedRequest,
+ res: Response,
+ next: NextFunction
+): void {
+ const authHeader = req.headers.authorization;
+ if (!authHeader?.startsWith("Bearer ")) {
+ res.status(401).json({ error: "Missing or invalid Authorization header" });
+ return;
+ }
+
+ const token = authHeader.slice(7);
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+
+ try {
+ const decoded = jwt.verify(token, secret) as AuthPayload;
+ if (!decoded.ename) {
+ res.status(401).json({ error: "Invalid token payload" });
+ return;
+ }
+ req.user = { ename: decoded.ename };
+ next();
+ } catch {
+ res.status(401).json({ error: "Invalid or expired token" });
+ }
+}

platforms/calendar-api/package.json

@@ -0,0 +1,30 @@
+{
+ "name": "calendar-api",
+ "version": "1.0.0",
+ "description": "W3DS auth and eVault-backed calendar events API",
+ "main": "dist/index.js",
+ "scripts": {
+ "start": "node dist/index.js",
+ "dev": "ts-node src/index.ts",
+ "build": "tsc"
+ },
+ "dependencies": {
+ "cors": "^2.8.5",
+ "dotenv": "^16.4.5",
+ "express": "^4.18.2",
+ "graphql-request": "^6.1.0",
+ "jsonwebtoken": "^9.0.2",
+ "signature-validator": "workspace:*",
+ "uuid": "^9.0.1",
+ "axios": "^1.6.7"
+ },
+ "devDependencies": {
+ "@types/cors": "^2.8.17",
+ "@types/express": "^4.17.21",
+ "@types/jsonwebtoken": "^9.0.5",
+ "@types/node": "^20.11.19",
+ "@types/uuid": "^9.0.8",
+ "ts-node": "^10.9.2",
+ "typescript": "^5.3.3"
+ }
+}

platforms/calendar-api/src/constants.ts

@@ -0,0 +1,25 @@
+export const CALENDAR_EVENT_ONTOLOGY_ID =
+ "880e8400-e29b-41d4-a716-446655440099";
+
+const SESSION_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
+export interface StoredSession {
+ createdAt: number;
+}
+
+export const sessionStore = new Map<string, StoredSession>();
+
+export function addSession(sessionId: string): void {
+ sessionStore.set(sessionId, { createdAt: Date.now() });
+}
+
+export function isSessionValid(sessionId: string): boolean {
+ const s = sessionStore.get(sessionId);
+ if (!s) return false;
+ if (Date.now() - s.createdAt > SESSION_TTL_MS) {
+ sessionStore.delete(sessionId);
+ return false;
+ }
+ sessionStore.delete(sessionId); // one-time use
+ return true;
+}

platforms/calendar-api/src/controllers/AuthController.ts

@@ -0,0 +1,136 @@
+import { Request, Response } from "express";
+import { EventEmitter } from "events";
+import { v4 as uuidv4 } from "uuid";
+import jwt from "jsonwebtoken";
+import { verifySignature } from "signature-validator";
+import { isVersionValid } from "../utils/version";
+import { addSession, isSessionValid } from "../constants";
+
+const MIN_REQUIRED_VERSION = "0.4.0";
+const JWT_EXPIRES_IN = "7d";
+
+export class AuthController {
+ private eventEmitter = new EventEmitter();
+
+ getOffer = async (_req: Request, res: Response) => {
+ console.log("[auth] GET /api/auth/offer hit");
+ const baseUrl = process.env.NEXT_PUBLIC_CALENDAR_APP_URL;
+ if (!baseUrl) {
+ console.error("[auth] NEXT_PUBLIC_CALENDAR_APP_URL is not set");
+ return res.status(500).json({ error: "Server configuration error: NEXT_PUBLIC_CALENDAR_APP_URL not set" });
+ }
+
+ let redirectUri: string;
+ try {
+ redirectUri = new URL("/api/auth", baseUrl).toString();
+ } catch (err) {
+ console.error("[auth] Invalid NEXT_PUBLIC_CALENDAR_APP_URL:", baseUrl, err);
+ return res.status(500).json({ error: "Server configuration error: invalid base URL" });
+ }
+
+ const session = uuidv4();
+ addSession(session);
+ const offer = `w3ds://auth?redirect=${encodeURIComponent(redirectUri)}&session=${session}&platform=${encodeURIComponent(baseUrl)}`;
+ console.log("[auth] offer created, redirectUri=", redirectUri, "platform=", baseUrl);
+ res.json({ uri: offer, sessionId: session });
+ };
+
+ sseStream = async (req: Request, res: Response) => {
+ const { id } = req.params;
+ console.log("[auth] GET /api/auth/sessions/:id hit, sessionId=", id);
+ res.writeHead(200, {
+ "Content-Type": "text/event-stream",
+ "Cache-Control": "no-cache",
+ Connection: "keep-alive",
+ "Access-Control-Allow-Origin": "*",
+ });
+ const handler = (data: unknown) => {
+ res.write(`data: ${JSON.stringify(data)}\n\n`);
+ };
+ this.eventEmitter.on(id, handler);
+ const heartbeat = setInterval(() => {
+ try {
+ res.write(": heartbeat\n\n");
+ } catch {
+ clearInterval(heartbeat);
+ }
+ }, 30000);
+ req.on("close", () => {
+ clearInterval(heartbeat);
+ this.eventEmitter.off(id, handler);
+ res.end();
+ });
+ };
+
+ login = async (req: Request, res: Response) => {
+ console.log("[auth] POST /api/auth hit");
+ try {
+ const { ename, session, signature, appVersion } = req.body;
+ console.log("[auth] body: ename=", ename, "session=", session?.slice(0, 8) + "...", "appVersion=", appVersion, "signature present=", !!signature);
+
+ if (!ename) {
+ console.log("[auth] reject: ename missing");
+ return res.status(400).json({ error: "ename is required" });
+ }
+ if (!session) {
+ console.log("[auth] reject: session missing");
+ return res.status(400).json({ error: "session is required" });
+ }
+ if (!signature) {
+ console.log("[auth] reject: signature missing");
+ return res.status(400).json({ error: "signature is required" });
+ }
+
+ if (!isSessionValid(session)) {
+ console.log("[auth] reject: invalid or expired session");
+ return res
+ .status(400)
+ .json({ error: "Invalid or expired session", message: "Please request a new login offer." });
+ }
+
+ if (!appVersion || !isVersionValid(appVersion, MIN_REQUIRED_VERSION)) {
+ console.log("[auth] reject: app version too old", appVersion);
+ return res.status(400).json({
+ error: "App version too old",
+ message: `Please update eID Wallet to version ${MIN_REQUIRED_VERSION} or later.`,
+ });
+ }
+
+ const registryBaseUrl = process.env.PUBLIC_REGISTRY_URL;
+ if (!registryBaseUrl) {
+ console.log("[auth] reject: PUBLIC_REGISTRY_URL not set");
+ return res.status(500).json({ error: "Server configuration error" });
+ }
+
+ console.log("[auth] verifying signature with registry", registryBaseUrl);
+ const verificationResult = await verifySignature({
+ eName: ename,
+ signature,
+ payload: session,
+ registryBaseUrl,
+ });
+
+ if (!verificationResult.valid) {
+ console.log("[auth] reject: signature invalid", verificationResult.error);
+ return res.status(401).json({
+ error: "Invalid signature",
+ message: verificationResult.error,
+ });
+ }
+
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+ const token = jwt.sign(
+ { ename },
+ secret,
+ { expiresIn: JWT_EXPIRES_IN }
+ );
+
+ console.log("[auth] login success, ename=", ename);
+ this.eventEmitter.emit(session, { token });
+ res.status(200).json({ token });
+ } catch (error) {
+ console.error("[auth] login error:", error);
+ res.status(500).json({ error: "Internal server error" });
+ }
+ };
+}

platforms/calendar-api/src/controllers/EventsController.ts

@@ -0,0 +1,109 @@
+import { Response } from "express";
+import { EVaultService } from "../services/EVaultService";
+import { AuthenticatedRequest } from "../middleware/auth";
+
+const evaultService = new EVaultService();
+
+export class EventsController {
+ list = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const first = Math.min(
+ parseInt(String(req.query.first), 10) || 100,
+ 500
+ );
+ const after = (req.query.after as string) || undefined;
+ const events = await evaultService.listEvents(ename, first, after);
+ res.json(events);
+ } catch (error) {
+ console.error("List events error:", error);
+ res.status(500).json({
+ error: "Failed to list events",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ create = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const { title, color, start, end } = req.body;
+ if (!title || !start || !end) {
+ res.status(400).json({
+ error: "Missing required fields",
+ message: "title, start, and end are required",
+ });
+ return;
+ }
+ const event = await evaultService.createEvent(ename, {
+ title,
+ color: color ?? "",
+ start,
+ end,
+ });
+ res.status(201).json(event);
+ } catch (error) {
+ console.error("Create event error:", error);
+ res.status(500).json({
+ error: "Failed to create event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ update = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ const { title, color, start, end } = req.body;
+ const payload: Record<string, string> = {};
+ if (title !== undefined) payload.title = title;
+ if (color !== undefined) payload.color = color;
+ if (start !== undefined) payload.start = start;
+ if (end !== undefined) payload.end = end;
+ if (Object.keys(payload).length === 0) {
+ res.status(400).json({ error: "No fields to update" });
+ return;
+ }
+ const event = await evaultService.updateEvent(ename, id, payload);
+ res.json(event);
+ } catch (error) {
+ console.error("Update event error:", error);
+ res.status(500).json({
+ error: "Failed to update event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ };
+
+ remove = async (req: AuthenticatedRequest, res: Response) => {
+ try {
+ const ename = req.user?.ename;
+ if (!ename) {
+ res.status(401).json({ error: "Unauthorized" });
+ return;
+ }
+ const id = req.params.id;
+ await evaultService.removeEvent(ename, id);
+ res.status(204).send();
+ } catch (error) {
+ console.error("Remove event error:", error);
+ res.status(500).json({
+ error: "Failed to delete event",
+ message: error instanceof Error ? error.message : "Unknown error",
+ });
+ }
+ }
+}

platforms/calendar-api/src/index.ts

@@ -0,0 +1,54 @@
+import dotenv from "dotenv";
+import fs from "fs";
+import path from "path";
+import express from "express";
+import cors from "cors";
+
+// Load .env: try monorepo root, then calendar-api parent, then cwd (no fallback)
+const candidates = [
+ path.resolve(__dirname, "../../../.env"), // repo root from dist/
+ path.resolve(__dirname, "../../.env"), // repo root from src/ or platforms/.env
+ path.resolve(process.cwd(), ".env"),
+];
+const envPath = candidates.find((p) => fs.existsSync(p));
+if (envPath) {
+ dotenv.config({ path: envPath });
+} else {
+ console.warn(
+ "No .env found at",
+ candidates.join(", "),
+ "- env vars must be set by shell or elsewhere"
+ );
+}
+import { AuthController } from "./controllers/AuthController";
+import { EventsController } from "./controllers/EventsController";
+import { authMiddleware } from "./middleware/auth";
+
+const app = express();
+const port = process.env.PORT ?? 4001;
+
+app.use(
+ cors({
+ origin: true,
+ methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
+ allowedHeaders: ["Content-Type", "Authorization"],
+ credentials: true,
+ })
+);
+app.use(express.json());
+
+const authController = new AuthController();
+const eventsController = new EventsController();
+
+app.get("/api/auth/offer", authController.getOffer);
+app.get("/api/auth/sessions/:id", authController.sseStream);
+app.post("/api/auth", authController.login);
+
+app.get("/api/events", authMiddleware, eventsController.list);
+app.post("/api/events", authMiddleware, eventsController.create);
+app.patch("/api/events/:id", authMiddleware, eventsController.update);
+app.delete("/api/events/:id", authMiddleware, eventsController.remove);
+
+app.listen(port, () => {
+ console.log(`Calendar API running on port ${port}`);
+});

platforms/calendar-api/src/middleware/auth.ts

@@ -0,0 +1,37 @@
+import { Request, Response, NextFunction } from "express";
+import jwt from "jsonwebtoken";
+
+export interface AuthPayload {
+ ename: string;
+}
+
+export interface AuthenticatedRequest extends Request {
+ user?: AuthPayload;
+}
+
+export function authMiddleware(
+ req: AuthenticatedRequest,
+ res: Response,
+ next: NextFunction
+): void {
+ const authHeader = req.headers.authorization;
+ if (!authHeader?.startsWith("Bearer ")) {
+ res.status(401).json({ error: "Missing or invalid Authorization header" });
+ return;
+ }
+
+ const token = authHeader.slice(7);
+ const secret = process.env.JWT_SECRET || "calendar-api-dev-secret";
+
+ try {
+ const decoded = jwt.verify(token, secret) as AuthPayload;
+ if (!decoded.ename) {
+ res.status(401).json({ error: "Invalid token payload" });
+ return;
+ }
+ req.user = { ename: decoded.ename };
+ next();
+ } catch {
+ res.status(401).json({ error: "Invalid or expired token" });
+ }
+}