AI Agent Security: Protecting Wallets and API Keys

import crypto from 'node:crypto';
import process from 'node:process';

// Required secrets — fail fast if any are missing
const REQUIRED_SECRETS = [
  'AGENT_PRIVATE_KEY',
  'PURPLEFLEA_API_KEY',
  'WALLET_ENCRYPTION_KEY',
];

function validateSecrets() {
  const missing = REQUIRED_SECRETS.filter(key => !process.env[key]);
  if (missing.length > 0) {
    // Log SECRET NAMES only — never log values
    console.error(`Missing required secrets: ${missing.join(', ')}`);
    process.exit(1);
  }
}

// Sealed secrets object — prevent accidental serialization
class SecretVault {
  #privateKey;
  #apiKey;
  #encKey;

  constructor() {
    validateSecrets();
    this.#privateKey = process.env.AGENT_PRIVATE_KEY;
    this.#apiKey = process.env.PURPLEFLEA_API_KEY;
    this.#encKey = process.env.WALLET_ENCRYPTION_KEY;

    // Prevent JSON.stringify from leaking secrets
    Object.freeze(this);
  }

  getPrivateKey() { return this.#privateKey; }
  getApiKey() { return this.#apiKey; }

  // Sign data with encryption key — never expose raw key
  sign(data) {
    return crypto
      .createHmac('sha256', this.#encKey)
      .update(data)
      .digest('hex');
  }

  // Prevent secret serialization
  toJSON() { return '[SecretVault]'; }
  toString() { return '[SecretVault]'; }
}

export const vault = new SecretVault();

const KEY_MAX_AGE_MS = 24 * 60 * 60 * 1000; // 24 hours
const KEY_ROTATION_OVERLAP_MS = 5 * 60 * 1000; // 5 minute grace

class ApiKeyRotator {
  #currentKey;
  #previousKey;
  #keyCreatedAt;
  #rotationTimer;

  constructor(initialKey) {
    this.#currentKey = initialKey;
    this.#keyCreatedAt = Date.now();
    this.#scheduleRotation();
  }

  #scheduleRotation() {
    const age = Date.now() - this.#keyCreatedAt;
    const remaining = KEY_MAX_AGE_MS - age;
    this.#rotationTimer = setTimeout(
      () => this.#rotate(),
      Math.max(remaining, 0)
    );
  }

  async #rotate() {
    console.log('[KeyRotator] Initiating key rotation');
    try {
      // Request new key from Purple Flea
      const newKey = await this.#requestNewKey();
      this.#previousKey = this.#currentKey;
      this.#currentKey = newKey;
      this.#keyCreatedAt = Date.now();

      // Revoke old key after overlap window
      setTimeout(() => {
        this.#revokeKey(this.#previousKey);
        this.#previousKey = null;
      }, KEY_ROTATION_OVERLAP_MS);

      this.#scheduleRotation();
    } catch (err) {
      console.error('[KeyRotator] Rotation failed, retrying in 5m');
      setTimeout(() => this.#rotate(), 5 * 60 * 1000);
    }
  }

  getKey() { return this.#currentKey; }
}

import crypto from 'node:crypto';

/**
 * Signs an HTTP request with HMAC-SHA256.
 * Signature covers: method + path + timestamp + body hash.
 * Prevents replay attacks via timestamp window validation.
 */
function signRequest({ method, path, body, apiKey, secret }) {
  const timestamp = Date.now();
  const bodyStr = body ? JSON.stringify(body) : '';

  // Hash body to prevent length extension attacks
  const bodyHash = crypto
    .createHash('sha256')
    .update(bodyStr)
    .digest('hex');

  // Canonical string: METHOD\nPATH\nTIMESTAMP\nBODY_HASH
  const canonical = [
    method.toUpperCase(),
    path,
    timestamp.toString(),
    bodyHash,
  ].join('\n');

  const signature = crypto
    .createHmac('sha256', secret)
    .update(canonical)
    .digest('hex');

  return {
    'X-API-Key': apiKey,
    'X-Timestamp': timestamp.toString(),
    'X-Signature': signature,
    'Content-Type': 'application/json',
  };
}

// Purple Flea authenticated request wrapper
async function pfRequest(method, endpoint, body = null) {
  const url = `https://purpleflea.com${endpoint}`;
  const headers = signRequest({
    method,
    path: endpoint,
    body,
    apiKey: vault.getApiKey(),
    secret: process.env.PURPLEFLEA_API_SECRET,
  });

  const res = await fetch(url, {
    method,
    headers,
    body: body ? JSON.stringify(body) : undefined,
  });

  if (!res.ok) {
    const err = await res.json().catch(() => ({}));
    throw new Error(`PF API error ${res.status}: ${err.message}`);
  }

  return res.json();
}

/**
 * Token bucket rate limiter.
 * Allows burst capacity while enforcing sustained rate.
 */
class TokenBucket {
  constructor({ capacity, refillRate, refillIntervalMs }) {
    this.capacity = capacity;
    this.tokens = capacity;
    this.refillRate = refillRate;
    this.lastRefill = Date.now();
    this.refillIntervalMs = refillIntervalMs;
  }

  #refill() {
    const now = Date.now();
    const elapsed = now - this.lastRefill;
    const intervals = Math.floor(elapsed / this.refillIntervalMs);
    if (intervals > 0) {
      this.tokens = Math.min(
        this.capacity,
        this.tokens + intervals * this.refillRate
      );
      this.lastRefill += intervals * this.refillIntervalMs;
    }
  }

  // Returns ms to wait, or 0 if request is allowed
  consume(tokens = 1) {
    this.#refill();
    if (this.tokens >= tokens) {
      this.tokens -= tokens;
      return 0;
    }
    // Return wait time in ms
    const deficit = tokens - this.tokens;
    return Math.ceil(
      (deficit / this.refillRate) * this.refillIntervalMs
    );
  }
}

// Example: 30 requests/min with burst of 10
export const casinoRateLimiter = new TokenBucket({
  capacity: 10,
  refillRate: 1,
  refillIntervalMs: 2000, // 1 token per 2 seconds = 30/min
});

// Wrap any async function with rate limit enforcement
export async function withRateLimit(limiter, fn) {
  const waitMs = limiter.consume();
  if (waitMs > 0) {
    await new Promise(r => setTimeout(r, waitMs));
  }
  return fn();
}