@bugmole/cli 0.4.0

package/src/registry-worker/sso/routes.ts

@@ -0,0 +1,458 @@
+// Single sign-on and SCIM for a workspace: link it to an Aegis organization,
+// manage domains, identity providers and SCIM tokens there, map IdP groups to
+// roles here, and act on Aegis's deprovisioning events.
+import { type Env, memberOfWorkspace, requestJson, response } from "../core.js";
+import { escapeHtml } from "../email/sender.js";
+import { getEntitlements } from "../billing/entitlements.js";
+import { flagOn } from "../flags.js";
+import { planChangedHooks } from "../hooks.js";
+import { registerJob } from "../jobs/index.js";
+import { enqueue, registerOutboxHandler } from "../notifications/outbox.js";
+import { actorOf, recordAudit } from "../org/audit.js";
+import { matchPath, registerPublicRoutes, registerRoutes, type AuthedRouteContext } from "../routes/index.js";
+import {
+  type AegisOrgEnv,
+  AegisError,
+  aegisOrgConfigured,
+  aegisOrgRequest,
+  ensureOrganization,
+  getOrganization,
+  setOrganizationEntitlements,
+  verifyAegisEvent,
+} from "./aegis.js";
+import {
+  applyOrgMembership,
+  deprovisionMember,
+  groupRoleMappings,
+  isSsoRole,
+  linkedWorkspace,
+  reactivateMember,
+} from "./membership.js";
+
+type SsoEnv = Env & AegisOrgEnv;
+
+/** How long a workspace keeps SSO after its plan stops including it. */
+export const SSO_GRACE_DAYS = 14;
+const MAX_GROUP_MAPPINGS = 100;
+
+type WorkspaceSsoRow = {
+  id: string;
+  name: string;
+  aegisOrgId: string | null;
+  defaultRole: string;
+  entitlement: string | null;
+  graceUntil: string | null;
+};
+
+async function workspaceSso(env: Env, workspaceId: string): Promise<WorkspaceSsoRow | null> {
+  return env.DB.prepare(`
+    SELECT id, name, aegis_org_id AS aegisOrgId, sso_default_role AS defaultRole,
+           sso_entitlement AS entitlement, sso_grace_until AS graceUntil
+    FROM workspaces WHERE id = ?
+  `).bind(workspaceId).first<WorkspaceSsoRow>();
+}
+
+function registryUrl(env: Env): string | null {
+  return env.REGISTRY_PUBLIC_URL ? env.REGISTRY_PUBLIC_URL.replace(/\/+$/, "") : null;
+}
+
+type Allowed = { sso: boolean; scim: boolean };
+
+/** Stored as "sso", "sso+scim" or "off": what Aegis was last told. */
+export function encodeAllowed(allowed: Allowed): string {
+  return allowed.sso ? (allowed.scim ? "sso+scim" : "sso") : "off";
+}
+
+export function decodeAllowed(value: string | null): Allowed {
+  return { sso: value === "sso" || value === "sso+scim", scim: value === "sso+scim" };
+}
+
+export function planAllows(features: { sso: boolean; scim: boolean }): Allowed {
+  return { sso: features.sso, scim: features.sso && features.scim };
+}
+
+/** True when the plan takes away something Aegis currently allows. */
+export function losesAccess(previous: Allowed, next: Allowed): boolean {
+  return (previous.sso && !next.sso) || (previous.scim && !next.scim);
+}
+
+async function availability(env: SsoEnv, workspaceId: string) {
+  const { features } = await getEntitlements(env, workspaceId);
+  if (!(await flagOn(env, workspaceId, "sso")) || !aegisOrgConfigured(env) || !registryUrl(env)) {
+    return { available: false, reason: "Single sign-on isn't available yet.", features };
+  }
+  if (!features.sso) return { available: false, reason: "Single sign-on is included in Business and Enterprise.", features };
+  return { available: true, features };
+}
+
+function aegisFailure(error: unknown): Response {
+  if (error instanceof AegisError) {
+    const status = error.status >= 500 ? 502 : error.status;
+    return response({ error: error.message, code: error.body.error ?? null }, status);
+  }
+  console.error("[sso] Aegis request failed", error);
+  return response({ error: "The identity service didn't respond. Try again." }, 502);
+}
+
+async function overview(context: AuthedRouteContext, workspaceId: string): Promise<Response> {
+  const env = context.env as SsoEnv;
+  if (!(await memberOfWorkspace(env, context.principal, workspaceId, "workspace.manage"))) {
+    return response({ error: "Only owners and admins can manage single sign-on" }, 403);
+  }
+  const workspace = await workspaceSso(env, workspaceId);
+  if (!workspace) return response({ error: "Workspace not found" }, 404);
+  const { available, reason, features } = await availability(env, workspaceId);
+  const base = {
+    available,
+    reason: reason ?? null,
+    plan: { sso: features.sso, scim: features.scim },
+    linked: Boolean(workspace.aegisOrgId),
+    defaultRole: workspace.defaultRole,
+    graceUntil: workspace.graceUntil,
+    groupRoles: await groupRoleMappings(env, workspaceId),
+    eventsUrl: registryUrl(env) ? `${registryUrl(env)}/api/aegis/events` : null,
+  };
+  if (!workspace.aegisOrgId || !aegisOrgConfigured(env)) return response({ ...base, organization: null });
+  try {
+    const organization = await getOrganization(env, workspace.aegisOrgId);
+    return response({ ...base, organization });
+  } catch (error) {
+    return aegisFailure(error);
+  }
+}
+
+async function enable(context: AuthedRouteContext, workspaceId: string): Promise<Response> {
+  const env = context.env as SsoEnv;
+  if (!(await memberOfWorkspace(env, context.principal, workspaceId, "workspace.manage"))) {
+    return response({ error: "Only owners and admins can manage single sign-on" }, 403);
+  }
+  const { available, reason, features } = await availability(env, workspaceId);
+  if (!available) return response({ error: reason }, features.sso ? 503 : 402);
+  const workspace = await workspaceSso(env, workspaceId);
+  if (!workspace) return response({ error: "Workspace not found" }, 404);
+  try {
+    const org = await ensureOrganization(env, {
+      name: workspace.name,
+      externalRef: workspace.id,
+      eventsUrl: `${registryUrl(env)}/api/aegis/events`,
+    });
+    const entitlements = planAllows(features);
+    await setOrganizationEntitlements(env, org.id, entitlements);
+    await env.DB.prepare(`
+      UPDATE workspaces SET aegis_org_id = ?, sso_entitlement = ?, sso_grace_until = NULL WHERE id = ?
+    `).bind(org.id, encodeAllowed(entitlements), workspace.id).run();
+    await recordAudit(env, actorOf(context.principal), {
+      workspaceId,
+      action: "sso.enabled",
+      targetType: "aegis_organization",
+      targetId: org.id,
+    }, context.request);
+    return response({ linked: true, organizationId: org.id }, workspace.aegisOrgId ? 200 : 201);
+  } catch (error) {
+    return aegisFailure(error);
+  }
+}
+
+async function updateSettings(context: AuthedRouteContext, workspace: WorkspaceSsoRow, body: Record<string, unknown>): Promise<Response> {
+  const env = context.env as SsoEnv;
+  const changes: string[] = [];
+  if ("defaultRole" in body) {
+    if (body.defaultRole !== "none" && !isSsoRole(body.defaultRole)) {
+      return response({ error: "defaultRole must be admin, member, billing, or none" }, 422);
+    }
+    await env.DB.prepare("UPDATE workspaces SET sso_default_role = ? WHERE id = ?").bind(body.defaultRole, workspace.id).run();
+    changes.push("defaultRole");
+  }
+  if ("ssoRequired" in body) {
+    if (typeof body.ssoRequired !== "boolean") return response({ error: "ssoRequired must be true or false" }, 422);
+    try {
+      await aegisOrgRequest(env, "PATCH", `/organizations/${workspace.aegisOrgId}`, { ssoRequired: body.ssoRequired });
+    } catch (error) {
+      return aegisFailure(error);
+    }
+    changes.push("ssoRequired");
+  }
+  await recordAudit(env, actorOf(context.principal), {
+    workspaceId: workspace.id,
+    action: "sso.settings.updated",
+    data: Object.fromEntries(changes.map((key) => [key, body[key]])),
+  }, context.request);
+  return response({ updated: changes });
+}
+
+async function replaceGroupRoles(context: AuthedRouteContext, workspace: WorkspaceSsoRow): Promise<Response> {
+  const env = context.env;
+  const body = await requestJson(context.request);
+  const list = Array.isArray(body?.mappings) ? body.mappings : null;
+  if (!list || list.length > MAX_GROUP_MAPPINGS) {
+    return response({ error: `mappings must be a list of at most ${MAX_GROUP_MAPPINGS} { group, role } entries` }, 422);
+  }
+  const mappings = new Map<string, string>();
+  for (const entry of list) {
+    const group = typeof entry?.group === "string" ? entry.group.trim() : "";
+    if (!group || group.length > 200) return response({ error: "Each mapping needs a group name (up to 200 characters)" }, 422);
+    if (!isSsoRole(entry.role)) return response({ error: `Role for ${group} must be admin, member, or billing` }, 422);
+    mappings.set(group, entry.role);
+  }
+  await env.DB.batch([
+    env.DB.prepare("DELETE FROM workspace_group_roles WHERE workspace_id = ?").bind(workspace.id),
+    ...[...mappings].map(([group, role]) => env.DB.prepare(
+      "INSERT INTO workspace_group_roles (workspace_id, group_name, role, created_by) VALUES (?, ?, ?, ?)",
+    ).bind(workspace.id, group, role, context.principal.aegisId)),
+  ]);
+  await recordAudit(env, actorOf(context.principal), {
+    workspaceId: workspace.id,
+    action: "sso.group_roles.updated",
+    data: { mappings: Object.fromEntries(mappings) },
+  }, context.request);
+  return response({ mappings: await groupRoleMappings(env, workspace.id) });
+}
+
+/** Aegis calls a workspace admin may make, with the fields each may send. */
+const PASSTHROUGH: Array<{
+  method: string;
+  pattern: string;
+  path: (params: Record<string, string>) => string;
+  fields?: string[];
+  needs?: "scim";
+  action: string;
+}> = [
+  { method: "POST", pattern: "/domains", path: () => "/domains", fields: ["domain"], action: "sso.domain.added" },
+  { method: "POST", pattern: "/domains/:domainId/verify", path: (p) => `/domains/${p.domainId}/verify`, action: "sso.domain.verified" },
+  { method: "DELETE", pattern: "/domains/:domainId", path: (p) => `/domains/${p.domainId}`, action: "sso.domain.removed" },
+  {
+    method: "POST",
+    pattern: "/connections",
+    path: () => "/connections",
+    fields: ["name", "protocol", "enabled", "oidcIssuer", "oidcClientId", "oidcClientSecret", "samlEntryPoint", "samlIdpIssuer", "samlIdpCert", "attributeMapping", "jitProvisioning", "defaultRole"],
+    action: "sso.connection.created",
+  },
+  {
+    method: "PATCH",
+    pattern: "/connections/:connectionId",
+    path: (p) => `/connections/${p.connectionId}`,
+    fields: ["name", "enabled", "oidcIssuer", "oidcClientId", "oidcClientSecret", "samlEntryPoint", "samlIdpIssuer", "samlIdpCert", "attributeMapping", "jitProvisioning", "defaultRole"],
+    action: "sso.connection.updated",
+  },
+  { method: "DELETE", pattern: "/connections/:connectionId", path: (p) => `/connections/${p.connectionId}`, action: "sso.connection.removed" },
+  { method: "POST", pattern: "/scim-tokens", path: () => "/scim-tokens", fields: ["name"], needs: "scim", action: "scim.token.created" },
+  { method: "DELETE", pattern: "/scim-tokens/:tokenId", path: (p) => `/scim-tokens/${p.tokenId}`, action: "scim.token.revoked" },
+  { method: "GET", pattern: "/groups", path: () => "/groups", action: "" },
+];
+
+const SAFE_ID = /^[0-9a-f-]{36}$/i;
+
+async function passthrough(context: AuthedRouteContext, workspace: WorkspaceSsoRow, subpath: string): Promise<Response | null> {
+  const env = context.env as SsoEnv;
+  const { request } = context;
+  for (const entry of PASSTHROUGH) {
+    if (entry.method !== request.method) continue;
+    const params = matchPath(subpath, entry.pattern);
+    if (!params) continue;
+    if (Object.values(params).some((value) => !SAFE_ID.test(value))) return response({ error: "Not found" }, 404);
+    if (entry.needs === "scim") {
+      const { features } = await getEntitlements(env, workspace.id);
+      if (!features.scim) return response({ error: "SCIM provisioning is included in Enterprise." }, 402);
+    }
+    let body: Record<string, unknown> | undefined;
+    if (entry.fields) {
+      const raw = await requestJson(request);
+      if (!raw || typeof raw !== "object") return response({ error: "Expected a JSON body" }, 422);
+      body = Object.fromEntries(entry.fields.filter((field) => field in raw).map((field) => [field, (raw as Record<string, unknown>)[field]]));
+    }
+    try {
+      const result = await aegisOrgRequest(env, entry.method, `/organizations/${workspace.aegisOrgId}${entry.path(params)}`, body);
+      if (entry.action) {
+        await recordAudit(env, actorOf(context.principal), {
+          workspaceId: workspace.id,
+          action: entry.action,
+          targetType: "aegis_organization",
+          targetId: workspace.aegisOrgId ?? undefined,
+          // Never record secrets or certificates; the field names are enough.
+          data: { ...params, ...(body ? { fields: Object.keys(body) } : {}) },
+        }, request);
+      }
+      if (result === undefined) return new Response(null, { status: 204 });
+      return response(result, request.method === "POST" && !subpath.endsWith("/verify") ? 201 : 200);
+    } catch (error) {
+      return aegisFailure(error);
+    }
+  }
+  return null;
+}
+
+async function manage(context: AuthedRouteContext, workspaceId: string, subpath: string): Promise<Response | null> {
+  const env = context.env as SsoEnv;
+  if (!(await memberOfWorkspace(env, context.principal, workspaceId, "workspace.manage"))) {
+    return response({ error: "Only owners and admins can manage single sign-on" }, 403);
+  }
+  const workspace = await workspaceSso(env, workspaceId);
+  if (!workspace) return response({ error: "Workspace not found" }, 404);
+  if (!workspace.aegisOrgId) return response({ error: "Turn on single sign-on first" }, 409);
+  const { request } = context;
+
+  // Mappings and the default role stay usable during a grace period or after a downgrade,
+  // so admins can tidy up; changes in Aegis need the plan.
+  if (subpath === "/group-roles" && request.method === "PUT") return replaceGroupRoles(context, workspace);
+  const { available, reason } = await availability(env, workspaceId);
+  const inGrace = Boolean(workspace.graceUntil && Date.parse(workspace.graceUntil) > Date.now());
+  if (subpath === "" && request.method === "PATCH") {
+    const body = await requestJson(request);
+    if (!body || typeof body !== "object") return response({ error: "Expected a JSON body" }, 422);
+    // Turning "SSO required" off is always allowed; turning it on needs the plan.
+    if (body.ssoRequired === true && !available) return response({ error: reason }, 402);
+    return updateSettings(context, workspace, body as Record<string, unknown>);
+  }
+  if (!available && !(inGrace && request.method === "DELETE")) return response({ error: reason }, 402);
+  return passthrough(context, workspace, subpath);
+}
+
+registerRoutes(async (context) => {
+  const { url, request } = context;
+  // The dashboard calls this once after an enterprise sign-in; index.ts has
+  // already applied the person's groups by the time it gets here.
+  if (url.pathname === "/api/sso/sign-in" && request.method === "POST") {
+    return new Response(null, { status: 204 });
+  }
+  const root = matchPath(url.pathname, "/api/workspaces/:workspaceId/sso");
+  if (root) {
+    if (request.method === "GET") return overview(context, root.workspaceId);
+    if (request.method === "PATCH") return manage(context, root.workspaceId, "");
+    return null;
+  }
+  const enableMatch = matchPath(url.pathname, "/api/workspaces/:workspaceId/sso/enable");
+  if (enableMatch && request.method === "POST") return enable(context, enableMatch.workspaceId);
+  const prefix = /^\/api\/workspaces\/([^/]+)\/sso(\/.+)$/.exec(url.pathname);
+  if (prefix) return manage(context, decodeURIComponent(prefix[1]), prefix[2]);
+  return null;
+});
+
+// ---- Aegis events ----
+
+type AegisEvent = {
+  id?: unknown;
+  type?: unknown;
+  organizationId?: unknown;
+  externalRef?: unknown;
+  data?: { userId?: unknown; email?: unknown; groups?: unknown };
+};
+
+export async function handleAegisEvent(request: Request, env: SsoEnv): Promise<Response> {
+  if (!env.AEGIS_EVENTS_SECRET) return response({ error: "Events aren't configured" }, 503);
+  const body = await request.text();
+  if (body.length > 64_000) return response({ error: "Event too large" }, 413);
+  if (!(await verifyAegisEvent(env.AEGIS_EVENTS_SECRET, request.headers.get("x-aegis-signature"), body))) {
+    return response({ error: "Invalid signature" }, 401);
+  }
+  let event: AegisEvent;
+  try {
+    event = JSON.parse(body) as AegisEvent;
+  } catch {
+    return response({ error: "Invalid JSON" }, 400);
+  }
+  if (typeof event.id !== "string" || typeof event.type !== "string" || typeof event.organizationId !== "string") {
+    return response({ error: "Malformed event" }, 400);
+  }
+  const fresh = await env.DB.prepare("INSERT OR IGNORE INTO aegis_events (id, type) VALUES (?, ?)").bind(event.id, event.type).run();
+  if (!fresh.meta.changes) return response({ duplicate: true }, 200);
+
+  const workspace = await linkedWorkspace(env, event.organizationId, event.externalRef);
+  const userId = typeof event.data?.userId === "string" ? event.data.userId : null;
+  if (!workspace || !userId) return response({ ignored: true }, 202);
+  const email = typeof event.data?.email === "string" ? event.data.email.toLowerCase() : undefined;
+
+  if (event.type === "user.deprovisioned") {
+    await deprovisionMember(env, workspace.id, userId, email);
+  } else if (event.type === "user.reactivated") {
+    await reactivateMember(env, workspace.id, userId);
+  } else if (event.type === "user.groups_changed") {
+    const groups = Array.isArray(event.data?.groups)
+      ? event.data.groups.filter((g): g is string => typeof g === "string").slice(0, 500)
+      : [];
+    await applyOrgMembership(env, { aegisId: userId, email }, { id: event.organizationId, groups }, { type: "scim", id: "aegis" });
+  } else {
+    return response({ ignored: true }, 202);
+  }
+  return response({ handled: true }, 202);
+}
+
+registerPublicRoutes(async ({ request, env, url }) => {
+  if (url.pathname === "/api/aegis/events" && request.method === "POST") return handleAegisEvent(request, env as SsoEnv);
+  return null;
+});
+
+// ---- Plan changes ----
+
+async function ownerEmails(env: Env, workspaceId: string): Promise<string[]> {
+  const rows = await env.DB.prepare(`
+    SELECT DISTINCT u.email FROM workspace_memberships m JOIN aegis_users u ON u.id = m.aegis_id
+    WHERE m.workspace_id = ? AND m.role = 'owner' AND m.status = 'active' AND u.email IS NOT NULL
+  `).bind(workspaceId).all<{ email: string }>();
+  return rows.results.map((row) => row.email);
+}
+
+/** Tells Aegis what the workspace's plan now allows, starting a grace period when SSO is lost. */
+export async function syncSsoEntitlements(env: SsoEnv, workspaceId: string, now = new Date()): Promise<void> {
+  const workspace = await workspaceSso(env, workspaceId);
+  if (!workspace?.aegisOrgId) return;
+  const { features } = await getEntitlements(env, workspaceId);
+  const previous = decodeAllowed(workspace.entitlement);
+  const allowed = planAllows(features);
+  let graceUntil = workspace.graceUntil;
+  let desired = allowed;
+  if (!losesAccess(previous, allowed)) {
+    graceUntil = null;
+  } else if (graceUntil && Date.parse(graceUntil) > now.getTime()) {
+    desired = previous;
+  } else if (graceUntil) {
+    // The notice period is over.
+    graceUntil = null;
+  } else {
+    desired = previous;
+    graceUntil = new Date(now.getTime() + SSO_GRACE_DAYS * 86_400_000).toISOString();
+    const dashboard = (env.DASHBOARD_URL ?? "https://app.bugmole.com").replace(/\/+$/, "");
+    const until = graceUntil.slice(0, 10);
+    const recipients = await ownerEmails(env, workspaceId);
+    if (recipients.length) {
+      await enqueue(env, "email.message", {
+        to: recipients.map((email) => ({ email })),
+        subject: allowed.sso
+          ? `SCIM provisioning for ${workspace.name} ends on ${until}`
+          : `Single sign-on for ${workspace.name} ends on ${until}`,
+        text: allowed.sso
+          ? `Your plan no longer includes SCIM provisioning. Your identity provider can keep managing ${workspace.name}'s members until ${until}; after that, add and remove people in Bugmole. Upgrade to keep SCIM: ${dashboard}/billing`
+          : `Your plan no longer includes single sign-on. Members of ${workspace.name} can keep signing in through your identity provider until ${until}. After that, they'll sign in with an email link instead, and SCIM provisioning stops. Upgrade to keep SSO: ${dashboard}/billing`,
+        html: allowed.sso
+          ? `<p>Your plan no longer includes SCIM provisioning.</p><p>Your identity provider can keep managing <strong>${escapeHtml(workspace.name)}</strong>'s members until <strong>${until}</strong>. After that, add and remove people in Bugmole.</p><p><a href="${dashboard}/billing">Upgrade to keep SCIM</a></p>`
+          : `<p>Your plan no longer includes single sign-on.</p><p>Members of <strong>${escapeHtml(workspace.name)}</strong> can keep signing in through your identity provider until <strong>${until}</strong>. After that, they'll sign in with an email link instead, and SCIM provisioning stops.</p><p><a href="${dashboard}/billing">Upgrade to keep SSO</a></p>`,
+        tag: "sso-grace",
+      }, { dedupeKey: `sso-grace:${workspaceId}:${until}` });
+    }
+  }
+  await setOrganizationEntitlements(env, workspace.aegisOrgId, desired);
+  await env.DB.prepare("UPDATE workspaces SET sso_entitlement = ?, sso_grace_until = ? WHERE id = ?")
+    .bind(encodeAllowed(desired), graceUntil, workspaceId).run();
+}
+
+registerOutboxHandler("aegis.entitlements", async (env, payload: { workspaceId: string }) => {
+  await syncSsoEntitlements(env as SsoEnv, payload.workspaceId);
+});
+
+planChangedHooks.push(async (env, event) => {
+  const linked = await env.DB.prepare("SELECT 1 AS yes FROM workspaces WHERE id = ? AND aegis_org_id IS NOT NULL")
+    .bind(event.workspaceId).first();
+  if (linked) await enqueue(env, "aegis.entitlements", { workspaceId: event.workspaceId });
+});
+
+// Grace periods that have run out, and a daily re-sync in case an update was lost.
+registerJob("daily", "sso-entitlements", async (env, _ctx, now) => {
+  const rows = await env.DB.prepare(`
+    SELECT id FROM workspaces
+    WHERE aegis_org_id IS NOT NULL
+      AND (sso_grace_until IS NOT NULL OR sso_entitlement IS NULL OR sso_entitlement <> 'off')
+  `).all<{ id: string }>();
+  for (const row of rows.results) {
+    await enqueue(env, "aegis.entitlements", { workspaceId: row.id }, { dedupeKey: `aegis-entitlements:${row.id}:${now.toISOString().slice(0, 10)}` });
+  }
+});
+