@flowdular/sdk 0.2.4 → 0.3.0

package/modules/auth/src/server/provider-endpoints.ts

@@ -0,0 +1,246 @@
+import { ServerRoute } from '@octanejs/app-core';
+import { readJsonObject } from '@flowdular/sdk/server';
+import { AUTH_SCOPES } from '../acl/scopes.ts';
+import type { IdentityProviderSummary } from '../domain/types.ts';
+import type { IdentityProviderInput } from '../services/identity-provider-service.ts';
+import {
+	actorOf,
+	errorResponse,
+	requireScope,
+	requireSession,
+	response,
+	stringField,
+} from './http.ts';
+import type { AuthRuntime, OidcProvider } from './runtime.ts';
+import { sessionMutationDenial } from './session-security.ts';
+
+const LABEL = '[auth.core] identity provider request failed';
+
+/**
+ * A provider the deployment configured in FD_AUTH_OIDC_PROVIDERS, as a
+ * workspace sees it: present, never editable, and offered on the sign-in screen
+ * only while the deployment lists it in FD_AUTH_SIGN_IN_PROVIDERS.
+ */
+export function platformProviderSummary(
+	provider: OidcProvider,
+	offered: boolean,
+): IdentityProviderSummary {
+	return {
+		id: `platform:${provider.id}`,
+		key: provider.id,
+		label: provider.id,
+		issuer: provider.issuer,
+		clientId: provider.clientId,
+		scopes: ['openid', 'email', 'profile'],
+		jitEnabled: false,
+		allowedDomains: [],
+		jitRole: '',
+		status: offered ? 'active' : 'disabled',
+		/* The deployment secret is the same in every workspace, so a fingerprint
+		   of it would be one value every workspace could compare against its own
+		   guesses. A platform provider shows none; rotating it is an operator
+		   action on FD_AUTH_OIDC_PROVIDERS, not a workspace one. */
+		secretFingerprint: '',
+		scope: 'platform',
+		updatedAt: 0,
+	};
+}
+
+export function platformProviders(
+	runtime: AuthRuntime,
+): readonly IdentityProviderSummary[] {
+	const offered = new Set(runtime.settings.signInProviders);
+	return runtime.oidcProviders.map((provider) =>
+		platformProviderSummary(provider, offered.has(provider.id)),
+	);
+}
+
+/* The administrator's input as it arrives. Every field is validated in the
+   service, which owns the bounds and the stable codes; the body itself is
+   already capped at 16 KB by readJsonObject. A field the body omits is left out
+   here too, so the service can tell "not sent" from "sent empty": a create
+   refuses the missing required ones and an update keeps what is stored. */
+function providerInput(
+	body: Record<string, unknown>,
+	options: { readonly withKey: boolean },
+): IdentityProviderInput {
+	return {
+		...(options.withKey ? { key: stringField(body, 'key') } : {}),
+		...(body.label === undefined ? {} : { label: stringField(body, 'label') }),
+		...(body.issuer === undefined
+			? {}
+			: { issuer: stringField(body, 'issuer') }),
+		...(body.clientId === undefined
+			? {}
+			: { clientId: stringField(body, 'clientId') }),
+		...(body.clientSecret === undefined
+			? {}
+			: { clientSecret: stringField(body, 'clientSecret') }),
+		...(body.scopes === undefined ? {} : { scopes: body.scopes as string[] }),
+		...(body.jitEnabled === undefined
+			? {}
+			: { jitEnabled: body.jitEnabled === true }),
+		...(body.allowedDomains === undefined
+			? {}
+			: { allowedDomains: body.allowedDomains as string[] }),
+		...(body.jitRole === undefined
+			? {}
+			: { jitRole: stringField(body, 'jitRole') }),
+	};
+}
+
+export function createIdentityProviderRoutes(
+	runtime: AuthRuntime,
+): readonly ServerRoute[] {
+	const list = new ServerRoute({
+		path: '/api/auth/providers',
+		methods: ['GET'],
+		handler: async (context) => {
+			try {
+				const session = requireSession(context);
+				requireScope(session, AUTH_SCOPES.providersRead);
+				const owned = await (
+					await runtime.service()
+				).identityProviders.list(session.principal.tenantId);
+				return response({
+					providers: [...owned, ...platformProviders(runtime)],
+				});
+			} catch (error) {
+				return errorResponse(error, LABEL);
+			}
+		},
+	});
+
+	const create = new ServerRoute({
+		path: '/api/auth/providers',
+		methods: ['POST'],
+		handler: async (context) => {
+			const denial = sessionMutationDenial(context, runtime);
+			if (denial) return denial;
+			try {
+				const session = requireSession(context);
+				requireScope(session, AUTH_SCOPES.providersManage);
+				const body = await readJsonObject(context.request);
+				return response(
+					{
+						provider: await (
+							await runtime.service()
+						).identityProviders.create(
+							actorOf(session),
+							providerInput(body, { withKey: true }),
+						),
+					},
+					201,
+				);
+			} catch (error) {
+				return errorResponse(error, LABEL);
+			}
+		},
+	});
+
+	const update = new ServerRoute({
+		path: '/api/auth/providers/update',
+		methods: ['POST'],
+		handler: async (context) => {
+			const denial = sessionMutationDenial(context, runtime);
+			if (denial) return denial;
+			try {
+				const session = requireSession(context);
+				requireScope(session, AUTH_SCOPES.providersManage);
+				const body = await readJsonObject(context.request);
+				return response({
+					provider: await (
+						await runtime.service()
+					).identityProviders.update(
+						actorOf(session),
+						stringField(body, 'id'),
+						providerInput(body, { withKey: false }),
+					),
+				});
+			} catch (error) {
+				return errorResponse(error, LABEL);
+			}
+		},
+	});
+
+	const status = (path: string, next: 'active' | 'disabled') =>
+		new ServerRoute({
+			path,
+			methods: ['POST'],
+			handler: async (context) => {
+				const denial = sessionMutationDenial(context, runtime);
+				if (denial) return denial;
+				try {
+					const session = requireSession(context);
+					requireScope(session, AUTH_SCOPES.providersManage);
+					const body = await readJsonObject(context.request);
+					return response({
+						provider: await (
+							await runtime.service()
+						).identityProviders.setStatus(
+							actorOf(session),
+							stringField(body, 'id'),
+							next,
+						),
+					});
+				} catch (error) {
+					return errorResponse(error, LABEL);
+				}
+			},
+		});
+
+	const rotateSecret = new ServerRoute({
+		path: '/api/auth/providers/rotate-secret',
+		methods: ['POST'],
+		handler: async (context) => {
+			const denial = sessionMutationDenial(context, runtime);
+			if (denial) return denial;
+			try {
+				const session = requireSession(context);
+				requireScope(session, AUTH_SCOPES.providersManage);
+				const body = await readJsonObject(context.request);
+				return response({
+					provider: await (
+						await runtime.service()
+					).identityProviders.rotateSecret(
+						actorOf(session),
+						stringField(body, 'id'),
+						body.clientSecret,
+					),
+				});
+			} catch (error) {
+				return errorResponse(error, LABEL);
+			}
+		},
+	});
+
+	const remove = new ServerRoute({
+		path: '/api/auth/providers/delete',
+		methods: ['POST'],
+		handler: async (context) => {
+			const denial = sessionMutationDenial(context, runtime);
+			if (denial) return denial;
+			try {
+				const session = requireSession(context);
+				requireScope(session, AUTH_SCOPES.providersManage);
+				const body = await readJsonObject(context.request);
+				await (
+					await runtime.service()
+				).identityProviders.remove(actorOf(session), stringField(body, 'id'));
+				return response({ deleted: true });
+			} catch (error) {
+				return errorResponse(error, LABEL);
+			}
+		},
+	});
+
+	return [
+		list,
+		create,
+		update,
+		status('/api/auth/providers/enable', 'active'),
+		status('/api/auth/providers/disable', 'disabled'),
+		rotateSecret,
+		remove,
+	];
+}

package/modules/auth/src/server/provider-host.ts

@@ -0,0 +1,77 @@
+import { isIP } from 'node:net';
+import { AuthServiceError } from '../services/auth-service-error.ts';
+
+/* auth.core leaves the deployment for an identity provider on two paths: the
+   discovery request a workspace makes when it saves a provider, and the token
+   and userinfo requests a sign-in makes against the endpoints that discovery
+   stored. Both carry a URL a workspace administrator chose, so both are guarded
+   the way agents.core guards an OpenAI-compatible base URL: HTTPS without
+   credentials, never a loopback name, never a literal address, and inside
+   FD_AUTH_PROVIDER_HOST_ALLOWLIST when a deployment configures one.
+
+   Refusing every literal address covers the private and link-local ranges a
+   deployment must never be pointed at (10/8, 172.16/12, 192.168/16, 127/8,
+   169.254/16, fc00::/7, fe80::/10 and the rest) without resolving anything: an
+   identity provider is a name, and a name is what a discovery document and an
+   `iss` claim can be verified against. A name that resolves into one of those
+   ranges is still reachable; the allowlist is what closes that, which is why a
+   deployment that talks to workspace-configured providers should set one. */
+
+const LOOPBACK_SUFFIXES = ['.local', '.localhost', '.internal'] as const;
+
+/** Parses the comma-separated deployment allowlist; empty means unrestricted. */
+export function providerHostAllowlist(
+	value: string | undefined,
+): readonly string[] {
+	return [
+		...new Set(
+			(value ?? '')
+				.split(',')
+				.map((host) => host.trim().toLowerCase())
+				.filter(Boolean),
+		),
+	];
+}
+
+function blocked(message: string): AuthServiceError {
+	return new AuthServiceError('PROVIDER_HOST_BLOCKED', message, 400);
+}
+
+/**
+ * Refuses a provider URL before any request is made. Returns the parsed URL so
+ * a caller can use the host it just approved rather than parsing twice.
+ */
+export function assertProviderHostAllowed(
+	value: string,
+	allowlist: readonly string[],
+	field: string,
+): URL {
+	let url: URL;
+	try {
+		url = new URL(value);
+	} catch {
+		throw blocked(`${field} must be an absolute HTTPS URL.`);
+	}
+	const hostname = url.hostname.toLowerCase();
+	/* A URL keeps an IPv6 host in its brackets, and isIP does not read them. */
+	const literal = hostname.startsWith('[') ? hostname.slice(1, -1) : hostname;
+	if (
+		url.protocol !== 'https:' ||
+		url.username ||
+		url.password ||
+		hostname === '' ||
+		hostname === 'localhost' ||
+		LOOPBACK_SUFFIXES.some((suffix) => hostname.endsWith(suffix)) ||
+		isIP(literal) !== 0
+	) {
+		throw blocked(`${field} must name a public HTTPS host.`);
+	}
+	if (allowlist.length > 0 && !allowlist.includes(hostname)) {
+		throw new AuthServiceError(
+			'PROVIDER_HOST_NOT_ALLOWLISTED',
+			`${field} host ${hostname} is not present in FD_AUTH_PROVIDER_HOST_ALLOWLIST.`,
+			400,
+		);
+	}
+	return url;
+}