capsium 0.1.2 → 0.3.0

data/lib/capsium/reactor/htpasswd.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+require "base64"
+require "bcrypt"
+require "digest"
+require "openssl"
+
+module Capsium
+  class Reactor
+    # Apache htpasswd verification (05x-authentication). Supported hash
+    # formats:
+    # - bcrypt ($2a$/$2b$/$2y$, `htpasswd -B`) via the bcrypt gem
+    # - Apache apr1 MD5 ($apr1$, `htpasswd -m`) and md5-crypt ($1$),
+    #   pure-Ruby md5-crypt
+    # - unsalted SHA-1 ({SHA}, `htpasswd -s`)
+    # - anything else (DES, $5$/$6$) via the platform's crypt(3) —
+    #   support depends on the OS
+    class Htpasswd
+      # md5-crypt as deployed by Apache htpasswd, OpenSSL and glibc
+      # ($1$ and $apr1$ magics; identical except for the magic string).
+      # NOTE: Poul-Henning Kamp's original FreeBSD implementation mixed
+      # the magic in at the % 7 step where all deployed implementations
+      # mix in the password (see apr_md5.c, glibc crypt-md5.c).
+      module Md5Crypt
+        ITOA64 = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+        DIGEST_GROUPS = [[0, 6, 12], [1, 7, 13], [2, 8, 14], [3, 9, 15], [4, 10, 5]].freeze
+
+        def self.verify(hash, password)
+          _prefix, magic, salt, = hash.split("$", 4)
+          return false if salt.nil? || salt.empty?
+
+          Reactor.secure_compare(digest(password, salt, "$#{magic}$"), hash)
+        end
+
+        def self.digest(password, salt, magic)
+          final = initial_digest(password, salt, magic)
+          1000.times do |i|
+            final = stretch_digest(i, password, salt, final)
+          end
+          "#{magic}#{salt}$#{to64(final)}"
+        end
+
+        def self.initial_digest(password, salt, magic)
+          inner = Digest::MD5.digest(password + salt + password)
+          context = Digest::MD5.new
+          context << password << magic << salt
+          length = password.length
+          while length.positive?
+            context << inner[0, [16, length].min]
+            length -= 16
+          end
+          length = password.length
+          while length.positive?
+            context << (length.odd? ? "\0" : password[0])
+            length >>= 1
+          end
+          context.digest
+        end
+
+        def self.stretch_digest(iteration, password, salt, final)
+          context = Digest::MD5.new
+          context << (iteration.odd? ? password : final)
+          context << salt unless (iteration % 3).zero?
+          context << password unless (iteration % 7).zero?
+          context << (iteration.odd? ? final : password)
+          context.digest
+        end
+
+        # The custom base-64 of md5-crypt: digest triples permuted, first
+        # index to the high bits, 22 characters total.
+        def self.to64(final)
+          encoded = +""
+          DIGEST_GROUPS.each do |a, b, c|
+            value = final[c].ord | (final[b].ord << 8) | (final[a].ord << 16)
+            4.times do
+              encoded << ITOA64[value & 0x3f]
+              value >>= 6
+            end
+          end
+          value = final[11].ord
+          2.times do
+            encoded << ITOA64[value & 0x3f]
+            value >>= 6
+          end
+          encoded
+        end
+      end
+
+      attr_reader :path
+
+      def initialize(path)
+        raise Error, "htpasswd file not found: #{path}" unless File.file?(path)
+
+        @path = path
+        @entries = parse(path)
+      end
+
+      def usernames
+        @entries.keys
+      end
+
+      def verify?(username, password)
+        hash = @entries[username]
+        return false unless hash
+
+        verify_hash(hash, password)
+      end
+
+      private
+
+      def parse(path)
+        File.readlines(path, chomp: true).each_with_object({}) do |line, entries|
+          next if line.strip.empty? || line.start_with?("#")
+
+          username, hash = line.split(":", 2)
+          entries[username] = hash
+        end
+      end
+
+      def verify_hash(hash, password)
+        case hash
+        when /\A\$2[aby]\$/ then verify_bcrypt(hash, password)
+        when /\A\$(?:apr1|1)\$/ then Md5Crypt.verify(hash, password)
+        when /\A\{SHA\}/ then verify_sha1(hash, password)
+        else verify_crypt(hash, password)
+        end
+      end
+
+      # The bcrypt gem predates htpasswd's $2y$ tag; the variants are
+      # algorithmically identical, normalized here.
+      def verify_bcrypt(hash, password)
+        BCrypt::Password.new(hash.sub(/\A\$2y\$/, "$2a$")) == password
+      rescue BCrypt::Errors::InvalidHash
+        false
+      end
+
+      def verify_sha1(hash, password)
+        digest = "{SHA}#{Base64.strict_encode64(Digest::SHA1.digest(password))}"
+        Reactor.secure_compare(digest, hash)
+      end
+
+      def verify_crypt(hash, password)
+        computed = password.crypt(hash)
+        computed && Reactor.secure_compare(computed, hash)
+      end
+    end
+
+    # Constant-time string comparison (length-check first).
+    def self.secure_compare(own, theirs)
+      own.bytesize == theirs.bytesize &&
+        OpenSSL.fixed_length_secure_compare(own, theirs)
+    end
+  end
+end

data/lib/capsium/reactor/introspection.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+require "time"
+
+module Capsium
+  class Reactor
+    # Monitoring HTTP API reports for the package this reactor serves
+    # (ARCHITECTURE.md section 7). Each report wraps its single entry in
+    # the list shape all reactors converge on.
+    class Introspection
+      METADATA_PATH = "/api/v1/introspect/metadata"
+      ROUTES_PATH = "/api/v1/introspect/routes"
+      CONTENT_HASHES_PATH = "/api/v1/introspect/content-hashes"
+      CONTENT_VALIDITY_PATH = "/api/v1/introspect/content-validity"
+      PATHS = [METADATA_PATH, ROUTES_PATH, CONTENT_HASHES_PATH,
+               CONTENT_VALIDITY_PATH].freeze
+
+      attr_reader :package
+
+      def initialize(package)
+        @package = package
+      end
+
+      def endpoint?(path)
+        PATHS.include?(path)
+      end
+
+      # The report body for an introspection endpoint, or nil when the
+      # path is not an introspection endpoint.
+      def report_for(path)
+        case path
+        when METADATA_PATH then metadata_report
+        when ROUTES_PATH then routes_report
+        when CONTENT_HASHES_PATH then content_hashes_report
+        when CONTENT_VALIDITY_PATH then content_validity_report
+        end
+      end
+
+      def metadata_report
+        metadata = package.metadata
+        { packages: [{
+          name: metadata.name,
+          version: metadata.version,
+          author: metadata.author,
+          description: metadata.description
+        }] }
+      end
+
+      def routes_report
+        entries = package.routes.config.routes.map do |route|
+          { method: route.http_method || "GET", path: route.path }
+        end
+        { routes: [{ package: package.name, routes: entries }] }
+      end
+
+      def content_hashes_report
+        { contentHashes: [{ package: package.name, hash: content_hash }] }
+      end
+
+      def content_validity_report
+        errors = package.verify_integrity
+        entry = {
+          package: package.name,
+          valid: errors.empty?,
+          lastChecked: Time.now.utc.iso8601,
+          signed: package.signed?,
+          encrypted: package.encrypted?
+        }
+        entry[:signatureValid] = package.verify_signature if package.signed?
+        entry[:reason] = errors.map(&:message).join("; ") unless errors.empty?
+        { contentValidity: [entry] }
+      end
+
+      private
+
+      # SHA-256 of the .cap blob when the package was loaded from one.
+      # For directory sources there is no blob, so the hash covers a
+      # canonical (sorted-key) JSON serialization of the package content
+      # checksums — the same data security.json integrityChecks carry.
+      def content_hash
+        cap_file = package.cap_file_path
+        return Digest::SHA256.file(cap_file).hexdigest if cap_file
+
+        checksums = Package::Security.checksums_for(package.path)
+        Digest::SHA256.hexdigest(JSON.generate(checksums))
+      end
+    end
+  end
+end

data/lib/capsium/reactor/oauth2.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+require "json"
+require "net/http"
+require "securerandom"
+require "uri"
+
+module Capsium
+  class Reactor
+    # OAuth2 authorization-code flow client (05x-authentication), used by
+    # the Authenticator. Talks to the provider over net/http; the client
+    # secret never comes from the package. State is a random nonce signed
+    # with the session HMAC key (CSRF protection, self-contained).
+    class OAuth2
+      # The token exchange or userinfo fetch failed at the provider.
+      class FlowError < Capsium::Error; end
+
+      GRANT_TYPE = "authorization_code"
+
+      attr_reader :config
+
+      def initialize(config, client_secret:, session:, base_url: nil)
+        @config = config
+        @client_secret = client_secret
+        @session = session
+        @base_url = base_url
+      end
+
+      # The provider URL the login endpoint redirects the browser to.
+      def authorization_url(request)
+        params = {
+          "response_type" => "code",
+          "client_id" => @config.client_id,
+          "redirect_uri" => callback_uri(request),
+          "state" => generate_state
+        }
+        params["scope"] = @config.scopes.join(" ") unless @config.scopes.empty?
+        "#{@config.authorization_url}?#{URI.encode_www_form(params)}"
+      end
+
+      def valid_state?(state)
+        nonce, signature = state.to_s.split(".", 2)
+        return false if nonce.nil? || nonce.empty? || signature.nil?
+
+        Reactor.secure_compare(@session.sign(nonce), signature)
+      end
+
+      # Exchanges the authorization code and fetches the userinfo claims.
+      # Returns the raw userinfo hash; raises FlowError on provider
+      # errors.
+      def complete(code, request)
+        userinfo(exchange_code(code, callback_uri(request)))
+      end
+
+      def callback_uri(request)
+        "#{base_url_for(request)}#{@config.redirect_path}"
+      end
+
+      private
+
+      def generate_state
+        nonce = SecureRandom.hex(16)
+        "#{nonce}.#{@session.sign(nonce)}"
+      end
+
+      def base_url_for(request)
+        @base_url || "http://#{request['Host']}"
+      end
+
+      def exchange_code(code, redirect_uri)
+        response = Net::HTTP.post_form(
+          URI(@config.token_url),
+          "grant_type" => GRANT_TYPE, "code" => code,
+          "redirect_uri" => redirect_uri, "client_id" => @config.client_id,
+          "client_secret" => @client_secret
+        )
+        unless response.is_a?(Net::HTTPSuccess)
+          raise FlowError, "token exchange failed (HTTP #{response.code})"
+        end
+
+        JSON.parse(response.body).fetch("access_token") do
+          raise FlowError, "token response without access_token"
+        end
+      rescue JSON::ParserError
+        raise FlowError, "token response was not JSON"
+      end
+
+      def userinfo(access_token)
+        uri = URI(@config.userinfo_url)
+        response = Net::HTTP.start(uri.host, uri.port,
+                                   use_ssl: uri.scheme == "https") do |http|
+          http.get(uri.request_uri,
+                   "authorization" => "Bearer #{access_token}",
+                   "accept" => "application/json")
+        end
+        unless response.is_a?(Net::HTTPSuccess)
+          raise FlowError, "userinfo request failed (HTTP #{response.code})"
+        end
+
+        JSON.parse(response.body)
+      rescue JSON::ParserError
+        raise FlowError, "userinfo response was not JSON"
+      end
+    end
+  end
+end

data/lib/capsium/reactor/serving.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require "marcel"
+require "pathname"
+
+module Capsium
+  class Reactor
+    # Serving of resolved routes (static files through the merged view,
+    # datasets, handler-route 501s), mixed into Reactor. Includes route
+    # inheritance processing per 05x-routing.
+    module Serving
+      private
+
+      def serve_route(route, response)
+        case route.kind
+        when :dataset then serve_dataset(route.dataset, response)
+        when :resource then serve_file(route, response)
+        else respond_not_implemented(response)
+        end
+      end
+
+      def serve_file(route, response)
+        content_path = @merged_view.resolve(route.resource)
+        return respond_not_found(response) unless content_path
+
+        body, headers = inherited_processing(route, File.read(content_path),
+                                             headers_for(route))
+        response.status = 200
+        response["Content-Type"] = content_type_for(route, content_path)
+        headers.each { |name, value| response[name] = value }
+        response.body = body
+      end
+
+      # Route inheritance processing (05x-routing section "Route
+      # Inheritance"): responseRewrite replaces the body and/or overrides
+      # headers; responseHeaders are merged over the served headers.
+      # requestHeaders are parsed and exposed on the route for forwarding
+      # reactors; this reactor serves statically without an upstream, so
+      # they do not alter its responses.
+      def inherited_processing(route, body, headers)
+        rewrite = route.response_rewrite
+        if rewrite
+          body = rewrite.body unless rewrite.body.nil?
+          headers = headers.merge(rewrite.headers) if rewrite.headers
+        end
+        headers = headers.merge(route.response_headers) if route.response_headers
+        [body, headers]
+      end
+
+      # The route's declared MIME type, detected from the resolved file
+      # for resources the manifest does not list (dependency content
+      # reached through inheritance, layer-only files).
+      def content_type_for(route, content_path)
+        route.mime(@package.manifest) ||
+          Marcel::MimeType.for(Pathname.new(content_path),
+                               name: File.basename(content_path))
+      end
+
+      def headers_for(route)
+        route.headers || (@cache_control ? { "Cache-Control" => @cache_control } : {})
+      end
+
+      def serve_dataset(dataset_name, response)
+        dataset = @package.storage.dataset(dataset_name)
+        if dataset
+          response.status = 200
+          response["Content-Type"] = "application/json"
+          response.body = JSON.generate(dataset.data)
+        else
+          respond_not_found(response)
+        end
+      end
+    end
+  end
+end

data/lib/capsium/reactor/session.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require "base64"
+require "json"
+require "openssl"
+require "securerandom"
+
+module Capsium
+  class Reactor
+    # HMAC-SHA256 signed session cookies (05x-authentication: "Session
+    # via signed cookie"). The cookie value is
+    # "base64url(JSON payload).hmac hex" — signed, not encrypted, so it
+    # carries only the identity claims. The signing secret comes from
+    # deploy.json (sessionSecret) or is generated and persisted
+    # reactor-side (never in the package).
+    class Session
+      COOKIE_NAME = "capsium_session"
+      SECRET_BYTES = 32
+
+      def self.hmac(secret, data)
+        OpenSSL::HMAC.hexdigest("SHA256", secret, data)
+      end
+
+      attr_reader :secret
+
+      def initialize(secret: nil, state_file: nil)
+        @secret = secret || self.class.load_or_generate_secret(state_file)
+      end
+
+      # HMAC-SHA256 of data with the session secret (hex).
+      def sign(data)
+        self.class.hmac(@secret, data)
+      end
+
+      # The persisted reactor-side secret: loaded from state_file when
+      # present, generated and written (mode 0600) otherwise.
+      def self.load_or_generate_secret(state_file)
+        raise Error, "session secret or state_file is required" unless state_file
+
+        return File.read(state_file).strip if File.file?(state_file)
+
+        secret = SecureRandom.hex(SECRET_BYTES)
+        File.write(state_file, secret, perm: 0o600)
+        secret
+      end
+
+      def encode(payload)
+        data = Base64.urlsafe_encode64(JSON.generate(payload), padding: false)
+        "#{data}.#{self.class.hmac(@secret, data)}"
+      end
+
+      # The verified payload, or nil when the cookie is missing or the
+      # signature does not match.
+      def decode(cookie_value)
+        data, signature = cookie_value.to_s.split(".", 2)
+        return if data.nil? || signature.nil?
+
+        expected = self.class.hmac(@secret, data)
+        return unless Reactor.secure_compare(expected, signature)
+
+        JSON.parse(Base64.urlsafe_decode64(data))
+      rescue JSON::ParserError, ArgumentError
+        nil
+      end
+
+      # The identity for a request's Cookie header, or nil.
+      def identity_from(request)
+        cookie = request["Cookie"].to_s.split(/;\s*/).find do |part|
+          part.start_with?("#{COOKIE_NAME}=")
+        end
+        return unless cookie
+
+        decode(cookie.delete_prefix("#{COOKIE_NAME}="))
+      end
+
+      # A Set-Cookie value establishing the identity session.
+      def cookie_for(identity)
+        "#{COOKIE_NAME}=#{encode(identity)}; Path=/; HttpOnly; SameSite=Lax"
+      end
+    end
+  end
+end

data/lib/capsium/reactor.rb

@@ -1,52 +1,86 @@
 # frozen_string_literal: true
 
-require "webrick"
 require "json"
 require "listen"
-require "capsium/package"
+require "tmpdir"
+require "webrick"
 
 module Capsium
   class Reactor
+    autoload :Authenticator, "capsium/reactor/authenticator"
+    autoload :Deploy, "capsium/reactor/deploy"
+    autoload :Htpasswd, "capsium/reactor/htpasswd"
+    autoload :Introspection, "capsium/reactor/introspection"
+    autoload :OAuth2, "capsium/reactor/oauth2"
+    autoload :Serving, "capsium/reactor/serving"
+    autoload :Session, "capsium/reactor/session"
+
+    include Serving
+
     DEFAULT_PORT = 8864
+    DEFAULT_CACHE_CONTROL = "public, max-age=31536000"
 
-    attr_accessor :package, :package_path, :routes, :port, :server,
-                  :server_thread
+    attr_reader :package, :package_path, :routes, :port, :cache_control,
+                :server, :server_thread, :introspection, :authenticator
 
-    def initialize(package:, port: DEFAULT_PORT, do_not_listen: false)
-      @package = package.is_a?(String) ? Package.new(package) : package
+    def initialize(package:, port: DEFAULT_PORT,
+                   cache_control: DEFAULT_CACHE_CONTROL, do_not_listen: false,
+                   store: nil, deploy: nil)
+      @package = package.is_a?(String) ? Package.new(package, store: store) : package
       @package_path = @package.path
+      @store = store
       @port = port
+      @cache_control = cache_control
+      @deploy_config = Deploy.load(deploy)
       setup_server(do_not_listen)
-      @routes = @package.routes
+      load_state
       mount_routes
     end
 
     def serve
+      trap("INT") { shutdown_server }
       @server_thread = start_server
       start_listener
     end
 
     def handle_request(request, response)
+      if @authenticator.endpoint?(request.path)
+        @authenticator.serve_endpoint(request, response)
+        return
+      end
+
+      identity = @authenticator.authenticate(request)
+      return @authenticator.challenge(response) if @authenticator.enabled? && identity.nil?
+      return serve_introspection(request, response) if @introspection.endpoint?(request.path)
+
       route = @routes.resolve(request.path)
-      if route
-        target = route.target
-        content_path = target.fs_path(@package.manifest)
-        if File.exist?(content_path)
-          response.status = 200
-          response["Content-Type"] = target.mime(@package.manifest)
-          response.body = File.read(content_path)
-        else
-          response.status = 404
-          response["Content-Type"] = "text/plain"
-          response.body = "Not Found"
-        end
-      else
-        response.status = 404
-        response["Content-Type"] = "text/plain"
-        response.body = "Not Found"
+      return respond_not_found(response) unless route
+
+      case @authenticator.authorize(identity, route.access_control)
+      when :unauthenticated then return @authenticator.challenge(response)
+      when :forbidden then return respond_forbidden(response)
+      end
+
+      serve_route(route, response)
+    end
+
+    def mount_routes
+      paths = @routes.config.routes.map(&:serving_path) +
+              Introspection::PATHS + @authenticator.endpoints
+      paths.each do |path|
+        @server.mount_proc(path.to_s) { |req, res| handle_request(req, res) }
       end
     end
 
+    def restart_server
+      @server.shutdown
+      @server_thread&.join
+      load_package
+      setup_server(false)
+      mount_routes
+      @server_thread = start_server
+    end
+
     private
 
     def setup_server(do_not_listen)
@@ -55,18 +89,8 @@ module Capsium
       @server = WEBrick::HTTPServer.new(server_options)
     end
 
-    def mount_routes
-      @routes.config.routes.each do |route|
-        path = route.path
-        @server.mount_proc(path.to_s) do |req, res|
-          handle_request(req, res)
-        end
-      end
-    end
-
     def start_server
       Thread.new do
-        trap("INT") { shutdown_server }
         puts "Starting server on http://localhost:#{@port}"
         @server.start
       end
@@ -78,15 +102,6 @@ module Capsium
       exit
     end
 
-    def restart_server
-      @server.shutdown
-      @server_thread&.join
-      load_package
-      setup_server(false)
-      mount_routes
-      @server_thread = start_server
-    end
-
     def start_listener
       listener = Listen.to(@package_path) do |_modified, _added, _removed|
         puts "Changes detected, reloading..."
@@ -99,8 +114,43 @@ module Capsium
     end
 
     def load_package
-      @package = Package.new(@package_path)
+      @package = Package.new(@package_path, store: @store)
+      load_state
+    end
+
+    def load_state
       @routes = @package.routes
+      @merged_view = @package.merged_view
+      @introspection = Introspection.new(@package)
+      @authenticator = Authenticator.new(
+        @package.authentication,
+        deploy: @deploy_config,
+        package_path: @package.path,
+        base_url: @deploy_config.base_url,
+        state_file: File.join(Dir.tmpdir, "capsium-#{@package.name}-session-secret")
+      )
+    end
+
+    def serve_introspection(request, response)
+      return respond_method_not_allowed(response) unless request.request_method == "GET"
+
+      response.status = 200
+      response["Content-Type"] = "application/json"
+      response.body = JSON.generate(@introspection.report_for(request.path))
+    end
+
+    def respond_not_found(response) = respond_text(response, 404, "Not Found")
+
+    def respond_forbidden(response) = respond_text(response, 403, "Forbidden")
+
+    def respond_not_implemented(response) = respond_text(response, 501, "Not Implemented")
+
+    def respond_method_not_allowed(response) = respond_text(response, 405, "Method Not Allowed")
+
+    def respond_text(response, status, body)
+      response.status = status
+      response["Content-Type"] = "text/plain"
+      response.body = body
     end
   end
 end