@celilo/cli 0.10.0 → 0.11.0-alpha.0

package/src/hooks/capability-loader.ts

@@ -33,6 +33,9 @@ import { emitWebRoutesChangedAndWait } from '../services/celilo-events';
 import { getModuleSystems } from '../services/deployed-systems';
 import { withDnsInternalLedger } from '../services/dns-internal-records';
 import { withDnsRegistrationLedger } from '../services/dns-registrations';
+import { resolveComputedFields } from '../variables/computed/evaluate';
+import { containsComputedMarker } from '../variables/computed/marker';
+import { buildProviderLookup } from '../variables/computed/provider-lookup';
 import { loadHookConfigMap } from './load-hook-config';
 
 /**
@@ -351,6 +354,27 @@ export async function loadCapabilityFunctions(
       // First registrar wins — multi-registrar setups can't be auto-extended
       // since we'd have to pick which one to add the new domain to.
       if (!dnsRegistrarModuleId) dnsRegistrarModuleId = drp.moduleId;
+
+      // Canonical source: the registrar's DECLARED `domain_list` computed
+      // field, resolved LIVE in the provider's context — the exact value
+      // `$capability:dns_registrar.domain_list` resolves to and the same set
+      // the registrar's own DDNS validation iterates (for namecheap,
+      // keys(secret.ddns_passwords)). The manifest calls this "never
+      // persisted, never stale"; deriving domains any other way drifts. In
+      // particular a leftover `config.domains` row (from an older registrar
+      // manifest — module config survives version bumps) would otherwise be
+      // preferred by the heuristic below over the live secret keys and
+      // silently exclude a just-added domain, dead-ending new-domain
+      // onboarding forever (ce-iku).
+      const declaredDomains = await resolveRegistrarDomainList(drp.data, drp.moduleId, db);
+      if (declaredDomains) {
+        dnsManagedDomains.push(...declaredDomains);
+        continue;
+      }
+
+      // Fallback for registrars that DON'T declare a `domain_list` computed
+      // field (older/archived static-config providers): read the config
+      // shape directly.
       const drConfig = await loadModuleConfig(drp.moduleId, db);
       // dns_registrar 4.0.0+ exposes a single `domains` array (the
       // primary_domain/additional_domains split was collapsed — see
@@ -555,6 +579,38 @@ async function loadModuleSecrets(
   return result;
 }
 
+/**
+ * Resolve a dns_registrar provider's DECLARED `domain_list` computed field
+ * (e.g. namecheap's `keys(secret.ddns_passwords)`) in the PROVIDER's context —
+ * the canonical, always-live set of zones it manages. Returns the string list,
+ * or null when the provider declares no such computed field so the caller
+ * falls back to reading the config shape directly.
+ *
+ * This is the same value `$capability:dns_registrar.domain_list` resolves to
+ * and the same set the registrar's own DDNS validation iterates, so
+ * public_web's hostname check can never drift from what the registrar actually
+ * manages (ce-iku).
+ */
+async function resolveRegistrarDomainList(
+  rawData: unknown,
+  moduleId: string,
+  db: DbClient,
+): Promise<string[] | null> {
+  try {
+    const data = typeof rawData === 'string' ? JSON.parse(rawData) : rawData;
+    if (!containsComputedMarker(data)) return null;
+    const lookup = await buildProviderLookup(moduleId, db);
+    const resolved = resolveComputedFields(data, lookup) as Record<string, unknown>;
+    const list = resolved.domain_list;
+    if (!Array.isArray(list)) return null;
+    return list.filter((d): d is string => typeof d === 'string' && d.length > 0);
+  } catch {
+    // Provider context couldn't resolve (e.g. undecryptable secret) — let the
+    // caller fall back to the config-shape heuristic.
+    return null;
+  }
+}
+
 /**
  * Build a firewall capability chain from multiple providers.
  *

package/src/services/api-access.test.ts

@@ -0,0 +1,138 @@
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { closeDb } from '@/db/client';
+import {
+  getPrincipalByName,
+  grantPrincipal,
+  grantsAllow,
+  isAuthorized,
+  listPrincipals,
+  renderAuthorizedKeys,
+  revokePrincipal,
+  validateGrant,
+  validatePrincipalName,
+  validatePublicKey,
+} from './api-access';
+
+const VALID_KEY = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI test@laptop';
+
+describe('grantsAllow (pure, deny-by-default)', () => {
+  test('exact command:subcommand', () => {
+    expect(grantsAllow(['module:deploy'], 'module', 'deploy')).toBe(true);
+    expect(grantsAllow(['module:deploy'], 'module', 'remove')).toBe(false);
+  });
+
+  test('command:* wildcard', () => {
+    expect(grantsAllow(['service:*'], 'service', 'add')).toBe(true);
+    expect(grantsAllow(['service:*'], 'service', 'remove')).toBe(true);
+    expect(grantsAllow(['service:*'], 'module', 'deploy')).toBe(false);
+  });
+
+  test('global *', () => {
+    expect(grantsAllow(['*'], 'anything', 'goes')).toBe(true);
+  });
+
+  test('bare command for a subcommand-less command', () => {
+    expect(grantsAllow(['status'], 'status')).toBe(true);
+    expect(grantsAllow(['status'], 'module', 'deploy')).toBe(false);
+  });
+
+  test('empty grants deny everything', () => {
+    expect(grantsAllow([], 'module', 'deploy')).toBe(false);
+  });
+});
+
+describe('validators', () => {
+  test('principal name must be kebab-case', () => {
+    expect(() => validatePrincipalName('alice')).not.toThrow();
+    expect(() => validatePrincipalName('ci-deployer')).not.toThrow();
+    expect(() => validatePrincipalName('Alice')).toThrow();
+    expect(() => validatePrincipalName('a b')).toThrow();
+    expect(() => validatePrincipalName('under_score')).toThrow();
+  });
+
+  test('public key must look like an SSH key', () => {
+    expect(() => validatePublicKey(VALID_KEY)).not.toThrow();
+    expect(() => validatePublicKey('ssh-ed25519 AAAAC3NzaC1lZDI1NTE5')).not.toThrow();
+    expect(() => validatePublicKey('not a key')).toThrow();
+    expect(() => validatePublicKey('ssh-ed25519')).toThrow();
+    expect(() => validatePublicKey('rsa-bogus AAAA')).toThrow();
+  });
+
+  test('grant syntax', () => {
+    expect(() => validateGrant('module:deploy')).not.toThrow();
+    expect(() => validateGrant('service:*')).not.toThrow();
+    expect(() => validateGrant('*')).not.toThrow();
+    expect(() => validateGrant('status')).not.toThrow();
+    expect(() => validateGrant('Module:Deploy')).toThrow();
+    expect(() => validateGrant('a:b:c')).toThrow();
+  });
+});
+
+describe('api-access (DB-backed)', () => {
+  let dir: string;
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'celilo-api-access-'));
+    process.env.CELILO_DB_PATH = join(dir, 'test.db');
+    closeDb(); // drop any cached handle so getDb() reopens at the new path
+  });
+
+  afterEach(() => {
+    closeDb();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  test('grant → list → getByName → isAuthorized → render → revoke', async () => {
+    const { created } = await grantPrincipal({
+      name: 'alice',
+      publicKey: VALID_KEY,
+      grants: ['module:deploy', 'service:*'],
+    });
+    expect(created).toBe(true);
+
+    expect((await listPrincipals()).map((p) => p.name)).toEqual(['alice']);
+
+    const alice = await getPrincipalByName('alice');
+    expect(alice?.grants).toEqual(['module:deploy', 'service:*']);
+
+    expect(await isAuthorized('alice', 'module', 'deploy')).toBe(true);
+    expect(await isAuthorized('alice', 'service', 'add')).toBe(true);
+    expect(await isAuthorized('alice', 'secret', 'read')).toBe(false);
+    expect(await isAuthorized('nobody', 'module', 'deploy')).toBe(false);
+
+    const authKeys = await renderAuthorizedKeys();
+    expect(authKeys).toContain('command="celilo api-serve --principal=alice"');
+    expect(authKeys).toContain('no-pty,no-port-forwarding');
+    expect(authKeys).toContain(VALID_KEY);
+
+    expect(await revokePrincipal('alice')).toBe(true);
+    expect(await listPrincipals()).toHaveLength(0);
+    expect(await revokePrincipal('alice')).toBe(false);
+    expect(await renderAuthorizedKeys()).toBe('');
+  });
+
+  test('grant is an upsert (replaces key + grants)', async () => {
+    await grantPrincipal({ name: 'bob', publicKey: VALID_KEY, grants: ['status'] });
+    const second = await grantPrincipal({
+      name: 'bob',
+      publicKey: VALID_KEY,
+      grants: ['module:deploy'],
+    });
+    expect(second.created).toBe(false);
+    expect((await getPrincipalByName('bob'))?.grants).toEqual(['module:deploy']);
+    expect(await listPrincipals()).toHaveLength(1);
+  });
+
+  test('invalid inputs are rejected before write', async () => {
+    await expect(
+      grantPrincipal({ name: 'Bad Name', publicKey: VALID_KEY, grants: ['status'] }),
+    ).rejects.toThrow();
+    await expect(
+      grantPrincipal({ name: 'good', publicKey: 'garbage', grants: ['status'] }),
+    ).rejects.toThrow();
+    expect(await listPrincipals()).toHaveLength(0);
+  });
+});

package/src/services/api-access.ts

@@ -0,0 +1,154 @@
+/**
+ * Remote API access control (see v2/API_COMMUNICATION.md, Slice 2a).
+ *
+ * Stores API principals (name + SSH public key + grants), answers authz
+ * queries (deny-by-default), and renders the API account's `authorized_keys`
+ * with one forced-command line per principal. No SSH plumbing lives here —
+ * `renderAuthorizedKeys()` returns the file content; installing it is a
+ * separate operational step (Slice 2b).
+ */
+
+import { randomUUID } from 'node:crypto';
+import { eq } from 'drizzle-orm';
+import { getDb } from '../db/client';
+import { type ApiPrincipal, apiPrincipals } from '../db/schema';
+
+const NAME_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const GRANT_PATTERN = /^(\*|[a-z0-9]+(-[a-z0-9]+)*(:(\*|[a-z0-9]+(-[a-z0-9]+)*))?)$/;
+const PUBKEY_TYPES = [
+  'ssh-ed25519',
+  'ssh-rsa',
+  'ssh-dss',
+  'ecdsa-sha2-nistp256',
+  'ecdsa-sha2-nistp384',
+  'ecdsa-sha2-nistp521',
+  'sk-ssh-ed25519@openssh.com',
+  'sk-ecdsa-sha2-nistp256@openssh.com',
+];
+
+const FORCED_COMMAND_OPTS = 'no-pty,no-port-forwarding,no-agent-forwarding,no-X11-forwarding';
+
+export function validatePrincipalName(name: string): void {
+  if (!NAME_PATTERN.test(name)) {
+    throw new Error(
+      `Invalid principal name "${name}": use kebab-case (e.g. "alice", "ci-deployer").`,
+    );
+  }
+}
+
+/** Basic SSH public-key shape check: `<type> <base64> [comment]`. */
+export function validatePublicKey(key: string): void {
+  const parts = key.trim().split(/\s+/);
+  if (
+    parts.length < 2 ||
+    !PUBKEY_TYPES.includes(parts[0]) ||
+    !/^[A-Za-z0-9+/]+={0,3}$/.test(parts[1])
+  ) {
+    throw new Error(
+      'Invalid SSH public key. Expected "<type> <base64> [comment]" (e.g. contents of ~/.ssh/id_ed25519.pub).',
+    );
+  }
+}
+
+export function validateGrant(grant: string): void {
+  if (!GRANT_PATTERN.test(grant)) {
+    throw new Error(`Invalid grant "${grant}": use "command:subcommand", "command:*", or "*".`);
+  }
+}
+
+/**
+ * Does this grant set permit `command`/`subcommand`? Pure — deny-by-default.
+ * Matches an exact `command:subcommand`, a `command:*` wildcard, `*`, or a
+ * bare `command` grant for a subcommand-less command.
+ */
+export function grantsAllow(grants: string[], command: string, subcommand?: string): boolean {
+  const op = subcommand ? `${command}:${subcommand}` : command;
+  for (const grant of grants) {
+    if (grant === '*') return true;
+    if (grant === op) return true;
+    if (grant === `${command}:*`) return true;
+    if (!subcommand && grant === command) return true;
+  }
+  return false;
+}
+
+export async function listPrincipals(): Promise<ApiPrincipal[]> {
+  return getDb().select().from(apiPrincipals).all();
+}
+
+export async function getPrincipalByName(name: string): Promise<ApiPrincipal | null> {
+  const rows = getDb().select().from(apiPrincipals).where(eq(apiPrincipals.name, name)).all();
+  return rows[0] ?? null;
+}
+
+/**
+ * Create or replace a principal's key + grants (upsert by name). Validates all
+ * inputs; throws on the first invalid one.
+ */
+export async function grantPrincipal(params: {
+  name: string;
+  publicKey: string;
+  grants: string[];
+}): Promise<{ principal: ApiPrincipal; created: boolean }> {
+  const { name, publicKey, grants } = params;
+  validatePrincipalName(name);
+  validatePublicKey(publicKey);
+  for (const grant of grants) validateGrant(grant);
+
+  const db = getDb();
+  const existing = await getPrincipalByName(name);
+
+  if (existing) {
+    db.update(apiPrincipals).set({ publicKey, grants }).where(eq(apiPrincipals.name, name)).run();
+    const updated = await getPrincipalByName(name);
+    if (!updated) throw new Error(`Principal "${name}" vanished after update`);
+    return { principal: updated, created: false };
+  }
+
+  const row: ApiPrincipal = {
+    id: randomUUID(),
+    name,
+    publicKey,
+    grants,
+    createdAt: new Date(),
+    updatedAt: new Date(),
+  };
+  db.insert(apiPrincipals).values(row).run();
+  return { principal: row, created: true };
+}
+
+/** Remove a principal. Returns false if it didn't exist. */
+export async function revokePrincipal(name: string): Promise<boolean> {
+  const existing = await getPrincipalByName(name);
+  if (!existing) return false;
+  getDb().delete(apiPrincipals).where(eq(apiPrincipals.name, name)).run();
+  return true;
+}
+
+/** Authz entry point: is `principalName` allowed to run `command`/`subcommand`? */
+export async function isAuthorized(
+  principalName: string,
+  command: string,
+  subcommand?: string,
+): Promise<boolean> {
+  const principal = await getPrincipalByName(principalName);
+  if (!principal) return false;
+  return grantsAllow(principal.grants, command, subcommand);
+}
+
+/**
+ * Render the API account's `authorized_keys` — one forced-command line per
+ * principal. The principal name is baked into the command so sshd hands the
+ * identity to `api-serve` (see the design doc). Names are kebab-case-validated,
+ * so no shell-escaping is required inside the `command=` string.
+ */
+export async function renderAuthorizedKeys(): Promise<string> {
+  const principals = await listPrincipals();
+  if (principals.length === 0) return '';
+  return `${principals
+    .map(
+      (p) =>
+        `command="celilo api-serve --principal=${p.name}",${FORCED_COMMAND_OPTS} ${p.publicKey}`,
+    )
+    .join('\n')}\n`;
+}

package/src/services/remote-responder.test.ts

@@ -0,0 +1,78 @@
+import { afterEach, beforeEach, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { type BusEvent, defineEvents, openBus } from '@celilo/event-bus';
+import { type WireInterview, startRemoteResponder } from './remote-responder';
+
+const NO_SCHEMAS = defineEvents({});
+
+let dir: string;
+let busDbPath: string;
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'celilo-remresp-'));
+  busDbPath = join(dir, 'events.db');
+});
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+test('forwards an interview.required question to ask and replies with the answer', async () => {
+  const asked: WireInterview[] = [];
+  const responder = startRemoteResponder({
+    busDbPath,
+    ask: async (iv) => {
+      asked.push(iv);
+      return 'acme.example.com';
+    },
+  });
+
+  const bus = openBus({ dbPath: busDbPath, events: NO_SCHEMAS });
+  try {
+    const replies = (await bus.query(
+      'interview.required.site.hostname' as never,
+      {
+        scope: 'site',
+        key: 'hostname',
+        kind: 'text',
+        message: 'Hostname for the site?',
+        required: true,
+      } as never,
+      { timeoutMs: 8000, pollIntervalMs: 100, expect: 'first' } as never,
+    )) as BusEvent[];
+
+    expect(replies).toHaveLength(1);
+    expect((replies[0].payload as { value: unknown }).value).toBe('acme.example.com');
+    expect(asked).toHaveLength(1);
+    expect(asked[0].message).toBe('Hostname for the site?');
+    expect(asked[0].kind).toBe('text');
+  } finally {
+    bus.close();
+    responder.close();
+  }
+}, 15_000);
+
+test('answers responder.probe with kind daemon', async () => {
+  const responder = startRemoteResponder({ busDbPath, ask: async () => 'unused' });
+
+  const bus = openBus({ dbPath: busDbPath, events: NO_SCHEMAS });
+  try {
+    const replies = (await bus.query(
+      'responder.probe' as never,
+      {} as never,
+      {
+        timeoutMs: 8000,
+        pollIntervalMs: 100,
+        expect: 'first',
+      } as never,
+    )) as BusEvent[];
+
+    expect(replies).toHaveLength(1);
+    expect((replies[0].payload as { kind: string }).kind).toBe('daemon');
+  } finally {
+    bus.close();
+    responder.close();
+  }
+}, 15_000);

package/src/services/remote-responder.ts

@@ -0,0 +1,89 @@
+/**
+ * Remote bus responder (`kind: 'daemon'`) — Slice 3.
+ *
+ * Runs in the `api-serve` parent and bridges the event bus to the wire: watches
+ * the generic `interview.required.*` family, forwards each question to the
+ * remote client via an injected `ask` round-trip, and replies on the bus with
+ * the client's answer. Also answers `responder.probe` so the (non-TTY) command
+ * child doesn't fail-fast for lack of a responder.
+ *
+ * The deploy-specific families (config / secret / ensure / aspect) reuse this
+ * same plumbing with per-family adapters — tracked as a follow-up.
+ */
+
+import { type Bus, defineEvents, openBus } from '@celilo/event-bus';
+import type { InterviewRequiredPayload } from './bus-interview';
+import { RESPONDER_PROBE_EVENT } from './responder-probe';
+
+const NO_SCHEMAS = defineEvents({});
+
+/** The normalized question handed to the wire (mirrors InterviewMessage). */
+export interface WireInterview {
+  id: string;
+  kind: InterviewRequiredPayload['kind'];
+  message: string;
+  description?: string;
+  defaultValue?: string;
+  placeholder?: string;
+  options?: Array<{ value: string; label: string; hint?: string }>;
+  required?: boolean;
+}
+
+export interface RemoteResponderOptions {
+  /** Path to the shared bus sqlite db (command child + responder share it). */
+  busDbPath: string;
+  /** Forward a question to the client and resolve with its answer. */
+  ask: (interview: WireInterview) => Promise<unknown>;
+  /** `emittedBy` audit label on replies. Defaults to `daemon`. */
+  emittedBy?: string;
+}
+
+export interface RemoteResponderHandle {
+  close(): void;
+}
+
+export function startRemoteResponder(opts: RemoteResponderOptions): RemoteResponderHandle {
+  const me = opts.emittedBy ?? 'daemon';
+  const bus: Bus = openBus({ dbPath: opts.busDbPath, events: NO_SCHEMAS });
+
+  const interviewWatch = bus.watch('interview.required.*.*', async (event) => {
+    if (event.replyFor !== null) return;
+
+    const payload = event.payload as InterviewRequiredPayload;
+    if (!payload || typeof payload.scope !== 'string' || typeof payload.key !== 'string') {
+      return;
+    }
+
+    const value = await opts.ask({
+      id: String(event.id),
+      kind: payload.kind,
+      message: payload.message,
+      description: payload.description,
+      defaultValue: payload.defaultValue,
+      placeholder: payload.placeholder,
+      options: payload.options,
+      required: payload.required,
+    });
+
+    bus.emitRaw(`${event.type}.reply`, { value }, { replyFor: event.id, emittedBy: me });
+  });
+
+  // Liveness probe: the non-TTY command child emits `responder.probe` before
+  // asking, to confirm someone is listening. Answer with our kind.
+  const probeWatch = bus.watch(RESPONDER_PROBE_EVENT, async (event) => {
+    if (event.replyFor !== null) return;
+    bus.emitRaw(
+      `${event.type}.reply`,
+      { kind: 'daemon', emittedBy: me },
+      { replyFor: event.id, emittedBy: me },
+    );
+  });
+
+  return {
+    close: () => {
+      interviewWatch.close();
+      probeWatch.close();
+      bus.close();
+    },
+  };
+}