@attraccess/plugin-rabbitmq 0.1.0-nightly.938.1 → 0.1.0-nightly.940.1

package/dist/index.js

@@ -42,9 +42,139 @@ var import_common2 = require("@nestjs/common");
 
 // backend/rabbitmq-detection.service.ts
 var import_common = require("@nestjs/common");
+var import_node_crypto2 = require("node:crypto");
+
+// backend/rabbitmq-management-transport.ts
+var import_node_crypto = require("node:crypto");
+var import_node_https = require("node:https");
+var import_node_net = require("node:net");
+var TrustConfigurationError = class extends Error {
+};
+function managementApiBase(config) {
+  const host = (0, import_node_net.isIP)(config.host) === 6 ? `[${config.host}]` : config.host;
+  return `${config.useTls ? "https" : "http"}://${host}:${config.useTls ? 15671 : 15672}`;
+}
+function trustOptions(config) {
+  if (config.tlsInsecure) {
+    throw new TrustConfigurationError(
+      "RabbitMQ management requires certificate verification. Disable tlsInsecure and configure a trusted CA certificate."
+    );
+  }
+  const servername = config.tlsServername;
+  if (servername != null && (typeof servername !== "string" || servername.length > 253 || !servername.split(".").every((label) => /^[a-z\d](?:[a-z\d-]{0,61}[a-z\d])?$/i.test(label)) || (0, import_node_net.isIP)(servername))) {
+    throw new TrustConfigurationError(
+      "TLS server name must be a DNS hostname matching the management certificate, without a scheme or port."
+    );
+  }
+  if (config.caCert != null) {
+    try {
+      const pem = config.caCert;
+      const certificates = typeof pem === "string" ? pem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g) : null;
+      if (!certificates?.length || pem.replace(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g, "").trim()) {
+        throw new Error();
+      }
+      for (const certificate of certificates) new import_node_crypto.X509Certificate(certificate);
+    } catch {
+      throw new TrustConfigurationError(
+        "Invalid CA certificate. Configure a PEM certificate or PEM certificate bundle."
+      );
+    }
+  }
+  return {
+    rejectUnauthorized: true,
+    ...config.caCert != null ? { ca: config.caCert } : {},
+    ...servername != null ? { servername } : {}
+  };
+}
+async function managementRequest(config, url, method, body, timeoutMs) {
+  const headers = { accept: "application/json" };
+  if (config.username !== null) {
+    headers.authorization = `Basic ${Buffer.from(`${config.username}:${config.password ?? ""}`, "utf8").toString("base64")}`;
+  }
+  const payload = body === void 0 ? void 0 : JSON.stringify(body);
+  if (payload !== void 0) headers["content-type"] = "application/json";
+  if (!config.useTls) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      return await fetch(url, { method, headers, body: payload, signal: controller.signal });
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+  const options = trustOptions(config);
+  if (new URL(url).protocol !== "https:") {
+    throw new TrustConfigurationError("TLS is enabled: the RabbitMQ management endpoint must use HTTPS.");
+  }
+  return new Promise((resolve, reject) => {
+    const req = (0, import_node_https.request)(url, { ...options, agent: false, method, headers }, (res) => {
+      const chunks = [];
+      let bytes = 0;
+      const maximumBytes = 8 * 1024 * 1024;
+      res.on("data", (chunk) => {
+        bytes += chunk.length;
+        if (bytes > maximumBytes) {
+          chunks.length = 0;
+          req.destroy(Object.assign(new Error(), { code: "RESPONSE_TOO_LARGE" }));
+          return;
+        }
+        chunks.push(Buffer.from(chunk));
+      });
+      res.on("error", reject);
+      res.on("aborted", () => reject(new Error("Response aborted")));
+      res.on("end", () => {
+        if (bytes > maximumBytes) return;
+        const status = res.statusCode ?? 502;
+        try {
+          if (status < 200 || status > 599) throw new Error();
+          resolve(
+            new Response([204, 205, 304].includes(status) ? null : Buffer.concat(chunks).toString("utf8"), { status })
+          );
+        } catch {
+          reject(Object.assign(new Error(), { code: "INVALID_RESPONSE_STATUS" }));
+        }
+      });
+    });
+    const timeout = setTimeout(() => req.destroy(Object.assign(new Error(), { code: "ETIMEDOUT" })), timeoutMs);
+    req.on("error", reject);
+    req.on("close", () => clearTimeout(timeout));
+    req.end(payload);
+  });
+}
+function describeManagementError(error, timeoutMs) {
+  if (error instanceof TrustConfigurationError) return error.message;
+  const outer = error;
+  const code = outer?.cause?.code ?? outer?.code;
+  if (outer?.name === "AbortError" || code === "ETIMEDOUT")
+    return `Management API did not respond within ${timeoutMs}ms.`;
+  switch (code) {
+    case "RESPONSE_TOO_LARGE":
+      return "Management API response exceeded the 8 MiB limit.";
+    case "INVALID_RESPONSE_STATUS":
+      return "Management API returned an invalid HTTP status.";
+    case "CERT_HAS_EXPIRED":
+    case "CERT_NOT_YET_VALID":
+      return "TLS certificate is expired or not yet valid. Check the Attraccess host clock and the certificate validity dates; renew the certificate if necessary.";
+    case "ERR_TLS_CERT_ALTNAME_INVALID":
+      return "TLS certificate hostname mismatch. Configure tlsServername to match the management certificate DNS name or correct the certificate.";
+    case "DEPTH_ZERO_SELF_SIGNED_CERT":
+    case "SELF_SIGNED_CERT_IN_CHAIN":
+    case "UNABLE_TO_VERIFY_LEAF_SIGNATURE":
+    case "UNABLE_TO_GET_ISSUER_CERT":
+    case "UNABLE_TO_GET_ISSUER_CERT_LOCALLY":
+      return "TLS certificate is not trusted. Configure the issuing CA PEM bundle and ensure the management server sends its intermediate certificates.";
+    case "ECONNREFUSED":
+      return "Management connection refused. Check the management listener and port.";
+    case "ENOTFOUND":
+    case "EAI_AGAIN":
+      return "Management hostname could not be resolved. Check DNS and the configured host.";
+    default:
+      return "Failed to reach the RabbitMQ management API. Check connectivity and, for HTTPS, the CA, certificate validity, host clock, and TLS server name.";
+  }
+}
+
+// backend/rabbitmq-detection.service.ts
 var PLUGIN_CONTEXT = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
-var MGMT_PORT_HTTP = 15672;
-var MGMT_PORT_HTTPS = 15671;
 var CACHE_TTL_MS = 6e4;
 var PROBE_TIMEOUT_MS = 5e3;
 var RabbitmqDetectionService = class {
@@ -56,18 +186,19 @@ var RabbitmqDetectionService = class {
   // Returns a cached verdict when fresh, otherwise probes. `forceRefresh`
   // bypasses the cache (used by the UI's manual refresh).
   async detect(mqttServerId, forceRefresh = false) {
+    const config = await this.context.getMqttServerConfig(mqttServerId);
+    const configKey = (0, import_node_crypto2.createHash)("sha256").update(JSON.stringify(config ?? null)).digest("hex");
     if (!forceRefresh) {
       const cached = this.cache.get(mqttServerId);
-      if (cached && cached.expiresAt > this.now()) {
+      if (cached && cached.configKey === configKey && cached.expiresAt > this.now()) {
         return cached.result;
       }
     }
-    const result = await this.probe(mqttServerId);
-    this.cache.set(mqttServerId, { result, expiresAt: this.now() + CACHE_TTL_MS });
+    const result = await this.probe(mqttServerId, config);
+    this.cache.set(mqttServerId, { result, configKey, expiresAt: this.now() + CACHE_TTL_MS });
     return result;
   }
-  async probe(mqttServerId) {
-    const config = await this.context.getMqttServerConfig(mqttServerId);
+  async probe(mqttServerId, config) {
     const checkedAt = this.nowIso();
     if (!config) {
       return {
@@ -143,32 +274,10 @@ var RabbitmqDetectionService = class {
   // management API runs on its own port, so we substitute the conventional
   // management port for the MQTT one and pick the scheme from useTls.
   managementApiBase(config) {
-    const scheme = config.useTls ? "https" : "http";
-    const port = config.useTls ? MGMT_PORT_HTTPS : MGMT_PORT_HTTP;
-    return `${scheme}://${config.host}:${port}`;
+    return managementApiBase(config);
   }
   async fetchOverview(managementApi, config) {
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);
-    try {
-      return await fetch(`${managementApi}/api/overview`, {
-        headers: {
-          accept: "application/json",
-          ...this.authHeader(config)
-        },
-        signal: controller.signal
-      });
-    } finally {
-      clearTimeout(timeout);
-    }
-  }
-  authHeader(config) {
-    if (config.username === null) {
-      return {};
-    }
-    const credentials = `${config.username}:${config.password ?? ""}`;
-    const encoded = Buffer.from(credentials, "utf8").toString("base64");
-    return { authorization: `Basic ${encoded}` };
+    return managementRequest(config, `${managementApi}/api/overview`, "GET", void 0, PROBE_TIMEOUT_MS);
   }
   async parseOverview(response) {
     try {
@@ -178,13 +287,7 @@ var RabbitmqDetectionService = class {
     }
   }
   describeError(error) {
-    if (error instanceof Error) {
-      if (error.name === "AbortError") {
-        return `Management API did not respond within ${PROBE_TIMEOUT_MS}ms.`;
-      }
-      return error.message;
-    }
-    return "Failed to reach the RabbitMQ management API.";
+    return describeManagementError(error, PROBE_TIMEOUT_MS);
   }
   now() {
     return Date.now();
@@ -222,63 +325,35 @@ RabbitmqDetectionController = __decorateClass([
 
 // backend/rabbitmq-management-client.ts
 var import_common3 = require("@nestjs/common");
-var MGMT_PORT_HTTP2 = 15672;
-var MGMT_PORT_HTTPS2 = 15671;
 var REQUEST_TIMEOUT_MS = 1e4;
 var RabbitmqManagementClient = class {
   // Builds the management API base URL from the generic MQTT config (same
   // convention as RabbitmqDetectionService).
   managementApiBase(config) {
-    const scheme = config.useTls ? "https" : "http";
-    const port = config.useTls ? MGMT_PORT_HTTPS2 : MGMT_PORT_HTTP2;
-    return `${scheme}://${config.host}:${port}`;
+    return managementApiBase(config);
   }
   // Performs one management API request. `path` is relative to `/api`, with
   // every variable segment already URL-encoded by the caller. Returns the
   // parsed JSON body (or null for empty responses, e.g. 201/204).
   async request(config, method, path, body) {
     const base = this.managementApiBase(config);
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
     let response;
     try {
-      response = await fetch(`${base}/api${path}`, {
-        method,
-        headers: {
-          accept: "application/json",
-          ...body !== void 0 ? { "content-type": "application/json" } : {},
-          ...this.authHeader(config)
-        },
-        body: body !== void 0 ? JSON.stringify(body) : void 0,
-        signal: controller.signal
-      });
+      response = await managementRequest(config, `${base}/api${path}`, method, body, REQUEST_TIMEOUT_MS);
     } catch (error) {
-      throw new import_common3.HttpException(
-        `Cannot reach the RabbitMQ management API at ${base}: ${this.describeNetworkError(error)}`,
-        import_common3.HttpStatus.BAD_GATEWAY
-      );
-    } finally {
-      clearTimeout(timeout);
+      throw new import_common3.HttpException(describeManagementError(error, REQUEST_TIMEOUT_MS), import_common3.HttpStatus.BAD_GATEWAY);
     }
     if (!response.ok) {
       throw await this.toHttpException(response);
     }
     return this.parseBody(response);
   }
-  authHeader(config) {
-    if (config.username === null) {
-      return {};
-    }
-    const credentials = `${config.username}:${config.password ?? ""}`;
-    const encoded = Buffer.from(credentials, "utf8").toString("base64");
-    return { authorization: `Basic ${encoded}` };
-  }
   // Maps an upstream error response to an exception with an actionable
   // message. Auth failures surface as 502 (not 401/403) so the host frontend
   // doesn't mistake them for an expired Attraccess session.
   async toHttpException(response) {
     const upstream = await this.parseErrorBody(response);
-    const reason = upstream?.reason || upstream?.error || "";
+    const reason = typeof upstream?.reason === "string" ? upstream.reason : typeof upstream?.error === "string" ? upstream.error : "";
     if (response.status === 401) {
       return new import_common3.HttpException(
         "The RabbitMQ management API rejected the configured MQTT server credentials (401). Check the username/password configured for this MQTT server.",
@@ -287,24 +362,21 @@ var RabbitmqManagementClient = class {
     }
     if (response.status === 403 || /not.?authori[sz]ed/i.test(reason)) {
       return new import_common3.HttpException(
-        "The configured MQTT server user lacks management privileges on RabbitMQ" + (reason ? ` (${reason})` : "") + '. User management requires a user with the "administrator" tag.',
+        'The configured MQTT server user lacks management privileges on RabbitMQ. User management requires a user with the "administrator" tag.',
         import_common3.HttpStatus.BAD_GATEWAY
       );
     }
     if (response.status === 404) {
-      return new import_common3.HttpException(
-        `Not found on the RabbitMQ side${reason ? `: ${reason}` : "."}`,
-        import_common3.HttpStatus.NOT_FOUND
-      );
+      return new import_common3.HttpException("Not found on the RabbitMQ side.", import_common3.HttpStatus.NOT_FOUND);
     }
     if (response.status === 400) {
       return new import_common3.HttpException(
-        `RabbitMQ rejected the request${reason ? `: ${reason}` : "."}`,
+        "RabbitMQ rejected the request. Check the supplied management parameters.",
         import_common3.HttpStatus.BAD_REQUEST
       );
     }
     return new import_common3.HttpException(
-      `RabbitMQ management API request failed (HTTP ${response.status})${reason ? `: ${reason}` : "."}`,
+      `RabbitMQ management API request failed (HTTP ${response.status}).`,
       import_common3.HttpStatus.BAD_GATEWAY
     );
   }
@@ -329,19 +401,6 @@ var RabbitmqManagementClient = class {
       return null;
     }
   }
-  describeNetworkError(error) {
-    if (error instanceof Error) {
-      if (error.name === "AbortError") {
-        return `no response within ${REQUEST_TIMEOUT_MS}ms`;
-      }
-      const cause = error.cause;
-      if (cause instanceof Error && cause.message) {
-        return cause.message;
-      }
-      return error.message;
-    }
-    return "unknown network error";
-  }
 };
 RabbitmqManagementClient = __decorateClass([
   (0, import_common3.Injectable)()
@@ -781,28 +840,28 @@ var _RabbitmqCredentialProvisioningProvider = class _RabbitmqCredentialProvision
   async supports(config) {
     return (await this.detection.detect(config.id)).isRabbitMQ;
   }
-  provision(request) {
-    return this.writeCredential(request);
+  provision(request2) {
+    return this.writeCredential(request2);
   }
-  rotate(request) {
-    return this.writeCredential(request);
+  rotate(request2) {
+    return this.writeCredential(request2);
   }
-  async revoke(request) {
-    this.assertName(request.username, "Username");
-    const config = await this.requireConfig(request.mqttServerId);
-    this.assertNotManagementUser(config, request.username);
+  async revoke(request2) {
+    this.assertName(request2.username, "Username");
+    const config = await this.requireConfig(request2.mqttServerId);
+    this.assertNotManagementUser(config, request2.username);
     try {
-      await this.client.request(config, "DELETE", `/users/${encodeURIComponent(request.username)}`);
+      await this.client.request(config, "DELETE", `/users/${encodeURIComponent(request2.username)}`);
     } catch (error) {
       if (error instanceof import_common6.HttpException && error.getStatus() === import_common6.HttpStatus.NOT_FOUND) return;
       throw error;
     }
   }
-  async writeCredential(request) {
-    this.assertRequest(request);
-    const config = await this.requireConfig(request.mqttServerId);
-    this.assertNotManagementUser(config, request.username);
-    const lockKey = `${config.id}:${request.vhost}`;
+  async writeCredential(request2) {
+    this.assertRequest(request2);
+    const config = await this.requireConfig(request2.mqttServerId);
+    this.assertNotManagementUser(config, request2.username);
+    const lockKey = `${config.id}:${request2.vhost}`;
     let lock = _RabbitmqCredentialProvisioningProvider.vhostLocks.get(lockKey);
     if (!lock) {
       lock = { mutex: new Mutex(), users: 0 };
@@ -810,7 +869,7 @@ var _RabbitmqCredentialProvisioningProvider = class _RabbitmqCredentialProvision
     }
     lock.users += 1;
     try {
-      return await lock.mutex.runExclusive(() => this.writeCredentialLocked(request, config));
+      return await lock.mutex.runExclusive(() => this.writeCredentialLocked(request2, config));
     } finally {
       lock.users -= 1;
       if (lock.users === 0 && _RabbitmqCredentialProvisioningProvider.vhostLocks.get(lockKey) === lock) {
@@ -818,10 +877,10 @@ var _RabbitmqCredentialProvisioningProvider = class _RabbitmqCredentialProvision
       }
     }
   }
-  async writeCredentialLocked(request, config) {
+  async writeCredentialLocked(request2, config) {
     const password = (0, import_crypto.randomBytes)(24).toString("base64url");
-    const vhost = encodeURIComponent(request.vhost);
-    const username = encodeURIComponent(request.username);
+    const vhost = encodeURIComponent(request2.vhost);
+    const username = encodeURIComponent(request2.username);
     const existing = await this.userExists(config, username);
     const vhostExisted = await this.exists(config, `/vhosts/${vhost}`);
     await this.client.request(config, "PUT", `/vhosts/${vhost}`);
@@ -833,11 +892,11 @@ var _RabbitmqCredentialProvisioningProvider = class _RabbitmqCredentialProvision
         previousPermissions = await this.getPermissions(config, vhost, username);
         previousTopicPermissions = await this.getTopicPermissions(config, vhost, username);
         permissionsCaptured = true;
-        await this.writePermissions(config, request, vhost, username);
+        await this.writePermissions(config, request2, vhost, username);
         await this.client.request(config, "PUT", `/users/${username}`, { password, tags: "" });
       } else {
         await this.client.request(config, "PUT", `/users/${username}`, { password, tags: "" });
-        await this.writePermissions(config, request, vhost, username);
+        await this.writePermissions(config, request2, vhost, username);
       }
     } catch (error) {
       const rollback = [
@@ -848,14 +907,14 @@ var _RabbitmqCredentialProvisioningProvider = class _RabbitmqCredentialProvision
     }
     return {
       providerId: this.id,
-      identity: request.identity,
-      username: request.username,
-      vhost: request.vhost,
+      identity: request2.identity,
+      username: request2.username,
+      vhost: request2.vhost,
       password
     };
   }
-  async writePermissions(config, request, vhost, username) {
-    const subscriptionQueue = `mqtt-subscription-${escapeRegex(request.identity)}.*`;
+  async writePermissions(config, request2, vhost, username) {
+    const subscriptionQueue = `mqtt-subscription-${escapeRegex(request2.identity)}.*`;
     await this.client.request(config, "PUT", `/permissions/${vhost}/${username}`, {
       configure: `^${subscriptionQueue}$`,
       write: `^(amq\\.topic|${subscriptionQueue})$`,
@@ -863,8 +922,8 @@ var _RabbitmqCredentialProvisioningProvider = class _RabbitmqCredentialProvision
     });
     await this.client.request(config, "PUT", `/topic-permissions/${vhost}/${username}`, {
       exchange: "amq.topic",
-      write: mqttFiltersToRegex(request.topicPolicy.publish),
-      read: mqttFiltersToRegex(request.topicPolicy.subscribe)
+      write: mqttFiltersToRegex(request2.topicPolicy.publish),
+      read: mqttFiltersToRegex(request2.topicPolicy.subscribe)
     });
   }
   async userExists(config, username) {
@@ -925,14 +984,14 @@ var _RabbitmqCredentialProvisioningProvider = class _RabbitmqCredentialProvision
     }
     return config;
   }
-  assertRequest(request) {
-    this.assertName(request.identity, "Identity");
-    this.assertName(request.username, "Username");
-    this.assertName(request.vhost, "Vhost");
-    if (!Array.isArray(request.topicPolicy.publish) || !Array.isArray(request.topicPolicy.subscribe)) {
+  assertRequest(request2) {
+    this.assertName(request2.identity, "Identity");
+    this.assertName(request2.username, "Username");
+    this.assertName(request2.vhost, "Vhost");
+    if (!Array.isArray(request2.topicPolicy.publish) || !Array.isArray(request2.topicPolicy.subscribe)) {
       throw new import_common6.BadRequestException("Publish and subscribe topic policies must be arrays.");
     }
-    for (const filter of [...request.topicPolicy.publish, ...request.topicPolicy.subscribe]) {
+    for (const filter of [...request2.topicPolicy.publish, ...request2.topicPolicy.subscribe]) {
       if (typeof filter !== "string" || filter.length === 0 || filter.length > 1024) {
         throw new import_common6.BadRequestException("MQTT topic filters must be non-empty strings no longer than 1024 characters.");
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@attraccess/plugin-rabbitmq",
-  "version": "0.1.0-nightly.938.1",
+  "version": "0.1.0-nightly.940.1",
   "description": "Official Attraccess integration for RabbitMQ.",
   "license": "AGPL-3.0-only",
   "repository": {