@celilo/cli 0.9.1 → 0.11.0-alpha.0

package/src/services/api-access.ts

@@ -0,0 +1,154 @@
+/**
+ * Remote API access control (see v2/API_COMMUNICATION.md, Slice 2a).
+ *
+ * Stores API principals (name + SSH public key + grants), answers authz
+ * queries (deny-by-default), and renders the API account's `authorized_keys`
+ * with one forced-command line per principal. No SSH plumbing lives here —
+ * `renderAuthorizedKeys()` returns the file content; installing it is a
+ * separate operational step (Slice 2b).
+ */
+
+import { randomUUID } from 'node:crypto';
+import { eq } from 'drizzle-orm';
+import { getDb } from '../db/client';
+import { type ApiPrincipal, apiPrincipals } from '../db/schema';
+
+const NAME_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const GRANT_PATTERN = /^(\*|[a-z0-9]+(-[a-z0-9]+)*(:(\*|[a-z0-9]+(-[a-z0-9]+)*))?)$/;
+const PUBKEY_TYPES = [
+  'ssh-ed25519',
+  'ssh-rsa',
+  'ssh-dss',
+  'ecdsa-sha2-nistp256',
+  'ecdsa-sha2-nistp384',
+  'ecdsa-sha2-nistp521',
+  'sk-ssh-ed25519@openssh.com',
+  'sk-ecdsa-sha2-nistp256@openssh.com',
+];
+
+const FORCED_COMMAND_OPTS = 'no-pty,no-port-forwarding,no-agent-forwarding,no-X11-forwarding';
+
+export function validatePrincipalName(name: string): void {
+  if (!NAME_PATTERN.test(name)) {
+    throw new Error(
+      `Invalid principal name "${name}": use kebab-case (e.g. "alice", "ci-deployer").`,
+    );
+  }
+}
+
+/** Basic SSH public-key shape check: `<type> <base64> [comment]`. */
+export function validatePublicKey(key: string): void {
+  const parts = key.trim().split(/\s+/);
+  if (
+    parts.length < 2 ||
+    !PUBKEY_TYPES.includes(parts[0]) ||
+    !/^[A-Za-z0-9+/]+={0,3}$/.test(parts[1])
+  ) {
+    throw new Error(
+      'Invalid SSH public key. Expected "<type> <base64> [comment]" (e.g. contents of ~/.ssh/id_ed25519.pub).',
+    );
+  }
+}
+
+export function validateGrant(grant: string): void {
+  if (!GRANT_PATTERN.test(grant)) {
+    throw new Error(`Invalid grant "${grant}": use "command:subcommand", "command:*", or "*".`);
+  }
+}
+
+/**
+ * Does this grant set permit `command`/`subcommand`? Pure — deny-by-default.
+ * Matches an exact `command:subcommand`, a `command:*` wildcard, `*`, or a
+ * bare `command` grant for a subcommand-less command.
+ */
+export function grantsAllow(grants: string[], command: string, subcommand?: string): boolean {
+  const op = subcommand ? `${command}:${subcommand}` : command;
+  for (const grant of grants) {
+    if (grant === '*') return true;
+    if (grant === op) return true;
+    if (grant === `${command}:*`) return true;
+    if (!subcommand && grant === command) return true;
+  }
+  return false;
+}
+
+export async function listPrincipals(): Promise<ApiPrincipal[]> {
+  return getDb().select().from(apiPrincipals).all();
+}
+
+export async function getPrincipalByName(name: string): Promise<ApiPrincipal | null> {
+  const rows = getDb().select().from(apiPrincipals).where(eq(apiPrincipals.name, name)).all();
+  return rows[0] ?? null;
+}
+
+/**
+ * Create or replace a principal's key + grants (upsert by name). Validates all
+ * inputs; throws on the first invalid one.
+ */
+export async function grantPrincipal(params: {
+  name: string;
+  publicKey: string;
+  grants: string[];
+}): Promise<{ principal: ApiPrincipal; created: boolean }> {
+  const { name, publicKey, grants } = params;
+  validatePrincipalName(name);
+  validatePublicKey(publicKey);
+  for (const grant of grants) validateGrant(grant);
+
+  const db = getDb();
+  const existing = await getPrincipalByName(name);
+
+  if (existing) {
+    db.update(apiPrincipals).set({ publicKey, grants }).where(eq(apiPrincipals.name, name)).run();
+    const updated = await getPrincipalByName(name);
+    if (!updated) throw new Error(`Principal "${name}" vanished after update`);
+    return { principal: updated, created: false };
+  }
+
+  const row: ApiPrincipal = {
+    id: randomUUID(),
+    name,
+    publicKey,
+    grants,
+    createdAt: new Date(),
+    updatedAt: new Date(),
+  };
+  db.insert(apiPrincipals).values(row).run();
+  return { principal: row, created: true };
+}
+
+/** Remove a principal. Returns false if it didn't exist. */
+export async function revokePrincipal(name: string): Promise<boolean> {
+  const existing = await getPrincipalByName(name);
+  if (!existing) return false;
+  getDb().delete(apiPrincipals).where(eq(apiPrincipals.name, name)).run();
+  return true;
+}
+
+/** Authz entry point: is `principalName` allowed to run `command`/`subcommand`? */
+export async function isAuthorized(
+  principalName: string,
+  command: string,
+  subcommand?: string,
+): Promise<boolean> {
+  const principal = await getPrincipalByName(principalName);
+  if (!principal) return false;
+  return grantsAllow(principal.grants, command, subcommand);
+}
+
+/**
+ * Render the API account's `authorized_keys` — one forced-command line per
+ * principal. The principal name is baked into the command so sshd hands the
+ * identity to `api-serve` (see the design doc). Names are kebab-case-validated,
+ * so no shell-escaping is required inside the `command=` string.
+ */
+export async function renderAuthorizedKeys(): Promise<string> {
+  const principals = await listPrincipals();
+  if (principals.length === 0) return '';
+  return `${principals
+    .map(
+      (p) =>
+        `command="celilo api-serve --principal=${p.name}",${FORCED_COMMAND_OPTS} ${p.publicKey}`,
+    )
+    .join('\n')}\n`;
+}

package/src/services/remote-responder.test.ts

@@ -0,0 +1,78 @@
+import { afterEach, beforeEach, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { type BusEvent, defineEvents, openBus } from '@celilo/event-bus';
+import { type WireInterview, startRemoteResponder } from './remote-responder';
+
+const NO_SCHEMAS = defineEvents({});
+
+let dir: string;
+let busDbPath: string;
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'celilo-remresp-'));
+  busDbPath = join(dir, 'events.db');
+});
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+test('forwards an interview.required question to ask and replies with the answer', async () => {
+  const asked: WireInterview[] = [];
+  const responder = startRemoteResponder({
+    busDbPath,
+    ask: async (iv) => {
+      asked.push(iv);
+      return 'acme.example.com';
+    },
+  });
+
+  const bus = openBus({ dbPath: busDbPath, events: NO_SCHEMAS });
+  try {
+    const replies = (await bus.query(
+      'interview.required.site.hostname' as never,
+      {
+        scope: 'site',
+        key: 'hostname',
+        kind: 'text',
+        message: 'Hostname for the site?',
+        required: true,
+      } as never,
+      { timeoutMs: 8000, pollIntervalMs: 100, expect: 'first' } as never,
+    )) as BusEvent[];
+
+    expect(replies).toHaveLength(1);
+    expect((replies[0].payload as { value: unknown }).value).toBe('acme.example.com');
+    expect(asked).toHaveLength(1);
+    expect(asked[0].message).toBe('Hostname for the site?');
+    expect(asked[0].kind).toBe('text');
+  } finally {
+    bus.close();
+    responder.close();
+  }
+}, 15_000);
+
+test('answers responder.probe with kind daemon', async () => {
+  const responder = startRemoteResponder({ busDbPath, ask: async () => 'unused' });
+
+  const bus = openBus({ dbPath: busDbPath, events: NO_SCHEMAS });
+  try {
+    const replies = (await bus.query(
+      'responder.probe' as never,
+      {} as never,
+      {
+        timeoutMs: 8000,
+        pollIntervalMs: 100,
+        expect: 'first',
+      } as never,
+    )) as BusEvent[];
+
+    expect(replies).toHaveLength(1);
+    expect((replies[0].payload as { kind: string }).kind).toBe('daemon');
+  } finally {
+    bus.close();
+    responder.close();
+  }
+}, 15_000);

package/src/services/remote-responder.ts

@@ -0,0 +1,89 @@
+/**
+ * Remote bus responder (`kind: 'daemon'`) — Slice 3.
+ *
+ * Runs in the `api-serve` parent and bridges the event bus to the wire: watches
+ * the generic `interview.required.*` family, forwards each question to the
+ * remote client via an injected `ask` round-trip, and replies on the bus with
+ * the client's answer. Also answers `responder.probe` so the (non-TTY) command
+ * child doesn't fail-fast for lack of a responder.
+ *
+ * The deploy-specific families (config / secret / ensure / aspect) reuse this
+ * same plumbing with per-family adapters — tracked as a follow-up.
+ */
+
+import { type Bus, defineEvents, openBus } from '@celilo/event-bus';
+import type { InterviewRequiredPayload } from './bus-interview';
+import { RESPONDER_PROBE_EVENT } from './responder-probe';
+
+const NO_SCHEMAS = defineEvents({});
+
+/** The normalized question handed to the wire (mirrors InterviewMessage). */
+export interface WireInterview {
+  id: string;
+  kind: InterviewRequiredPayload['kind'];
+  message: string;
+  description?: string;
+  defaultValue?: string;
+  placeholder?: string;
+  options?: Array<{ value: string; label: string; hint?: string }>;
+  required?: boolean;
+}
+
+export interface RemoteResponderOptions {
+  /** Path to the shared bus sqlite db (command child + responder share it). */
+  busDbPath: string;
+  /** Forward a question to the client and resolve with its answer. */
+  ask: (interview: WireInterview) => Promise<unknown>;
+  /** `emittedBy` audit label on replies. Defaults to `daemon`. */
+  emittedBy?: string;
+}
+
+export interface RemoteResponderHandle {
+  close(): void;
+}
+
+export function startRemoteResponder(opts: RemoteResponderOptions): RemoteResponderHandle {
+  const me = opts.emittedBy ?? 'daemon';
+  const bus: Bus = openBus({ dbPath: opts.busDbPath, events: NO_SCHEMAS });
+
+  const interviewWatch = bus.watch('interview.required.*.*', async (event) => {
+    if (event.replyFor !== null) return;
+
+    const payload = event.payload as InterviewRequiredPayload;
+    if (!payload || typeof payload.scope !== 'string' || typeof payload.key !== 'string') {
+      return;
+    }
+
+    const value = await opts.ask({
+      id: String(event.id),
+      kind: payload.kind,
+      message: payload.message,
+      description: payload.description,
+      defaultValue: payload.defaultValue,
+      placeholder: payload.placeholder,
+      options: payload.options,
+      required: payload.required,
+    });
+
+    bus.emitRaw(`${event.type}.reply`, { value }, { replyFor: event.id, emittedBy: me });
+  });
+
+  // Liveness probe: the non-TTY command child emits `responder.probe` before
+  // asking, to confirm someone is listening. Answer with our kind.
+  const probeWatch = bus.watch(RESPONDER_PROBE_EVENT, async (event) => {
+    if (event.replyFor !== null) return;
+    bus.emitRaw(
+      `${event.type}.reply`,
+      { kind: 'daemon', emittedBy: me },
+      { replyFor: event.id, emittedBy: me },
+    );
+  });
+
+  return {
+    close: () => {
+      interviewWatch.close();
+      probeWatch.close();
+      bus.close();
+    },
+  };
+}