feat: add CLI support for Agent Hub

[matewolf]

No description provided.

[paralta]

@matewolf As discussed, I think we could improve the PR with the following suggestions:

• Keep all API code under the /api folder by moving /hub/api to /api/hub/
• Review if the proto messages that already exist in api/core can be reused by the hub like Locator, Category (category has been deprecated in favour of Skill) and Agent
• Keep options for each command inside the corresponding command folder

[paralta]

here you are using the same plugins that we use for the core/store/routing APIs, so we could generate hub code with the same api/buf.gen.yaml file. this would also avoid simplify the changes in Taskfile.yml

[matewolf]

I wouldn't like to use the same buf file and integrate deps:api:gen task because running this task would need a permission to reach the private hub repo. Maybe it is possible to exclude some module from buf generate command.

[paralta]

should we keep this reference to an internal repo in the open repo? the git clone below will fail for users without access

[paralta]

this new command needs to be refactored as well

[paralta]

was this print removed by mistake?

[matewolf]

No. It was intended. It resulted that the error message was printed twice. Once on stderr and once on stdout.

[paralta]

let's keep the formatting here, since the same numbered formatting is used in the push and pull commands

[paralta]

there might have been a merge conflict issue here, please check

[tkircsi]

This PR is big, so it makes sense to add my reviews step by step. I continue my review.

[tkircsi]

There is no locator.proto in the saas/v1alpha1 package. We're using the `core/v1alpha1/locator.prot

[tkircsi]

Suggested change

	ctx := metadata.NewOutgoingContext(context.Background(), metadata.Pairs("authorization", "Bearer "+session.Tokens[session.CurrentTenant].AccessToken))
	if session.Tokens == nil {
	return nil, errors.New("session tokens not initialized")
	}
	tokens, exists := session.Tokens[session.CurrentTenant]
	if !exists {
	return nil, errors.New("no tokens found for current tenant")
	}
	if tokens == nil {
	return nil, errors.New("tokens for current tenant are nil")
	}
	if tokens.AccessToken == "" {
	return nil, errors.New("access token is empty")
	}
	ctx := metadata.NewOutgoingContext(context.Background(), metadata.Pairs("authorization", "Bearer "+tokens.AccessToken))

[tkircsi]

Possible nil pointer

Suggested change

	if err = json.Unmarshal(body, &authConfig); err != nil {
	return nil, fmt.Errorf("%w: %w", ErrParsingConfig, err)
	}
	if err = json.Unmarshal(body, &authConfig); err != nil {
	return nil, fmt.Errorf("%w: %w", ErrParsingConfig, err)
	}
	if authConfig == nil {
	return nil, fmt.Errorf("%w: config is nil", ErrParsingConfig)
	}

[tkircsi]

Suggested change

	resp, err := oktaClient.Logout(&okta.LogoutRequest{IDToken: session.Tokens[session.CurrentTenant].IDToken})
	if session == nil {
	return errors.New("session is nil")
	}
	if session.Tokens == nil {
	return errors.New("session tokens are nil")
	}
	tokens, ok := session.Tokens[session.CurrentTenant]
	if !ok {
	return fmt.Errorf("no tokens found for tenant: %s", session.CurrentTenant)
	}
	if tokens == nil {
	return errors.New("tokens for current tenant are nil")
	}
	if tokens.IDToken == "" {
	return errors.New("ID token is empty")
	}
	resp, err := oktaClient.Logout(&okta.LogoutRequest{IDToken: tokens.IDToken})

[tkircsi]

Suggested change

	if session.Tokens != nil && session.Tokens[session.CurrentTenant].AccessToken != "" {
	ctx = metadata.NewOutgoingContext(ctx, metadata.Pairs("authorization", "Bearer "+session.Tokens[session.CurrentTenant].AccessToken))
	}
	if session.Tokens != nil {
	tokens, exists := session.Tokens[session.CurrentTenant]
	if exists && tokens != nil && tokens.AccessToken != "" {
	ctx = metadata.NewOutgoingContext(ctx, metadata.Pairs("authorization", "Bearer "+tokens.AccessToken))
	}
	}

[tkircsi]

We could use later something more secure http client as we did in panoptica/policy-framework. For example

func createSecureHTTPClient() *http.Client {
    return &http.Client{
        Timeout: 30 * time.Second,
        Transport: &http.Transport{
            TLSClientConfig: &tls.Config{
                MinVersion: tls.VersionTLS12,
                InsecureSkipVerify: false,
            },
            MaxIdleConns:        100,
            MaxIdleConnsPerHost: 10,
            IdleConnTimeout:     90 * time.Second,
        },
    }
}

[tkircsi]

Maybe this error messages expose internal details that could be useful for attackers.

[tkircsi]

As I see, IsURL only checks the Schema. You can make the same with Go-s url package url.Scheme,

parsedURL, err := url.Parse(url)
if err != nil {
    return "", ErrInvalidFrontendURL
}

if parsedURL.Scheme != "https" {
    return "", fmt.Errorf("URL scheme must be HTTPS")
}

but it would make sense to create a method validateAndSanitizeURL to validate and sanitize URLs