@fntio/infra-client 0.0.0-stage → 0.5.0

package/assets/invoke-relay/index.js

@@ -0,0 +1,96 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lambdacode/network/invoke-relay.ts
+var invoke_relay_exports = {};
+__export(invoke_relay_exports, {
+  handler: () => handler
+});
+module.exports = __toCommonJS(invoke_relay_exports);
+var import_client_lambda2 = require("@aws-sdk/client-lambda");
+
+// lambdacode/network/invoke.ts
+var import_client_lambda = require("@aws-sdk/client-lambda");
+var INVOKE_TIMEOUT_MS = 1e4;
+async function invokeParsed(client, functionName, payload, timeoutMs) {
+  try {
+    const res = await client.send(
+      new import_client_lambda.InvokeCommand({ FunctionName: functionName, Payload: JSON.stringify(payload) }),
+      { abortSignal: AbortSignal.timeout(timeoutMs) }
+    );
+    if (res.FunctionError) return { error: `function error: ${res.FunctionError}` };
+    return { body: JSON.parse(new TextDecoder().decode(res.Payload)) };
+  } catch (err) {
+    return { error: err.message };
+  }
+}
+
+// lambdacode/network/naming.ts
+var DEFAULT_RESOURCE_PREFIX = "infra-client";
+var CONNECTOR_NAME_RE = /^[a-z][a-z0-9]{0,9}$/;
+var parseConnectorVpcs = (json) => new Map(
+  Object.entries(JSON.parse(json ?? "{}")).filter(
+    ([, v]) => Array.isArray(v)
+  )
+);
+var sgManagerFnName = (prefix, name) => name ? `${prefix}-sg-manager-${name}` : `${prefix}-sg-manager`;
+var tailnetResolverFnName = (prefix, siteId, name) => name ? `${prefix}-tailnet-resolver-${siteId}-${name}` : `${prefix}-tailnet-resolver-${siteId}`;
+var SITE_ID_RE = /^[a-z][a-z0-9-]{0,19}$/;
+
+// lambdacode/network/invoke-relay.ts
+var PREFIX = process.env.RESOURCE_PREFIX ?? DEFAULT_RESOURCE_PREFIX;
+var CONNECTOR_VPCS = parseConnectorVpcs(process.env.CONNECTOR_VPCS);
+var regionsOf = (account) => (CONNECTOR_VPCS.get(account) ?? []).map((c) => c.region).filter((r) => typeof r === "string");
+var clients = new Map(
+  [...new Set([...CONNECTOR_VPCS.keys()].flatMap(regionsOf))].map((r) => [
+    r,
+    new import_client_lambda2.LambdaClient({ region: r })
+  ])
+);
+var log = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+var unanchored = (re) => re.source.replace(/^\^|\$$/g, "");
+var escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var NAME = unanchored(CONNECTOR_NAME_RE);
+var SG_MANAGER_RE = new RegExp(`^${escape(sgManagerFnName(PREFIX))}(-${NAME})?$`);
+var RESOLVER_RE = new RegExp(
+  `^${escape(tailnetResolverFnName(PREFIX, ""))}${unanchored(SITE_ID_RE)}(-${NAME})?$`
+);
+var isWellKnown = (fnName) => SG_MANAGER_RE.test(fnName) || RESOLVER_RE.test(fnName);
+var handler = async (event) => {
+  const { region, account, fnName } = event ?? {};
+  const client = typeof account === "string" && typeof region === "string" && regionsOf(account).includes(region) ? clients.get(region) : void 0;
+  if (!client) {
+    return { error: `relay: no connector VPC for ${String(account)} in ${String(region)}` };
+  }
+  if (typeof fnName !== "string" || !isWellKnown(fnName)) {
+    return { error: `relay: function not allowed: ${String(fnName)}` };
+  }
+  const out = await invokeParsed(
+    client,
+    `arn:aws:lambda:${region}:${account}:function:${fnName}`,
+    event.payload ?? {},
+    INVOKE_TIMEOUT_MS
+  );
+  if (out.error) log("WARN: relayed invoke failed", { region, account, fnName, error: out.error });
+  return out;
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  handler
+});

package/assets/issuer-canary/index.js

@@ -0,0 +1,71 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lambdacode/monitoring/issuer-canary.ts
+var issuer_canary_exports = {};
+__export(issuer_canary_exports, {
+  handler: () => handler
+});
+module.exports = __toCommonJS(issuer_canary_exports);
+async function getJson(url) {
+  let res;
+  try {
+    res = await fetch(url, { signal: AbortSignal.timeout(5e3) });
+  } catch (err) {
+    throw new Error(`Issuer unreachable: ${url} \u2014 ${String(err)}`);
+  }
+  if (!res.ok) {
+    throw new Error(`Issuer unhealthy: HTTP ${res.status} from ${url}`);
+  }
+  const body = await res.json().catch(() => null);
+  if (!body || typeof body !== "object") {
+    throw new Error(`Issuer unhealthy: ${url} did not return a JSON object`);
+  }
+  return body;
+}
+var handler = async () => {
+  const url = process.env.CHECK_URL;
+  if (!url) throw new Error("CHECK_URL is not set");
+  const doc = await getJson(url);
+  if (!doc.issuer) {
+    throw new Error(
+      `Issuer unhealthy: discovery document from ${url} has no "issuer" field`
+    );
+  }
+  if (typeof doc.jwks_uri !== "string") {
+    throw new Error(
+      `Issuer unhealthy: discovery document from ${url} has no "jwks_uri"`
+    );
+  }
+  const jwks = await getJson(doc.jwks_uri);
+  const keys = Array.isArray(jwks.keys) ? jwks.keys : [];
+  if (keys.length === 0) {
+    throw new Error(`Issuer unhealthy: JWKS at ${doc.jwks_uri} lists no keys`);
+  }
+  const expectKid = process.env.EXPECT_KID;
+  if (expectKid && !keys.some((k) => k.kid === expectKid)) {
+    throw new Error(
+      `Issuer unhealthy: JWKS at ${doc.jwks_uri} does not list the active signing key ${expectKid}`
+    );
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  handler
+});

package/assets/issuer-publish/index.js

@@ -0,0 +1,87 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lambdacode/issuer/publish.ts
+var publish_exports = {};
+__export(publish_exports, {
+  handler: () => handler
+});
+module.exports = __toCommonJS(publish_exports);
+var import_client_kms = require("@aws-sdk/client-kms");
+var import_client_s3 = require("@aws-sdk/client-s3");
+var import_crypto = require("crypto");
+
+// lambdacode/issuer/objects.ts
+var ISSUER_OBJECTS = {
+  discovery: ".well-known/openid-configuration",
+  jwks: ".well-known/jwks.json",
+  index: "index.html"
+};
+
+// lambdacode/issuer/publish.ts
+var kms = new import_client_kms.KMSClient({});
+var s3 = new import_client_s3.S3Client({});
+var log = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+var CACHE_CONTROL = "max-age=300";
+var discoveryDocument = (issuer) => ({
+  issuer,
+  jwks_uri: `${issuer}/${ISSUER_OBJECTS.jwks}`,
+  response_types_supported: ["id_token"],
+  subject_types_supported: ["public"],
+  id_token_signing_alg_values_supported: ["RS256"]
+});
+var INDEX_HTML = `<!doctype html><meta charset="utf-8"><title>OpenID Connect issuer</title><p>This host is an OpenID Connect issuer for AWS credential vending. Discovery document: <a href="/${ISSUER_OBJECTS.discovery}">/${ISSUER_OBJECTS.discovery}</a></p>
+`;
+async function getJwk(keyId) {
+  const { PublicKey } = await kms.send(new import_client_kms.GetPublicKeyCommand({ KeyId: keyId }));
+  if (!PublicKey) throw new Error(`KMS returned no public key for ${keyId}`);
+  const jwk = (0, import_crypto.createPublicKey)({
+    key: Buffer.from(PublicKey),
+    format: "der",
+    type: "spki"
+  }).export({ format: "jwk" });
+  return { ...jwk, use: "sig", alg: "RS256", kid: keyId };
+}
+async function handler(event) {
+  const physical = "oidc-issuer-documents";
+  if (event.RequestType === "Delete") {
+    return { PhysicalResourceId: physical };
+  }
+  const { Bucket, Issuer: issuer, KeyIds: keyIds = [] } = event.ResourceProperties;
+  if (!Bucket || !issuer || keyIds.length === 0) {
+    throw new Error(
+      "OidcIssuerDocuments: Bucket, Issuer and at least one KeyId are required"
+    );
+  }
+  const keys = await Promise.all(keyIds.map(getJwk));
+  const put = (Key, Body, ContentType) => s3.send(
+    new import_client_s3.PutObjectCommand({ Bucket, Key, Body, ContentType, CacheControl: CACHE_CONTROL })
+  );
+  await Promise.all([
+    put(ISSUER_OBJECTS.discovery, JSON.stringify(discoveryDocument(issuer)), "application/json"),
+    put(ISSUER_OBJECTS.jwks, JSON.stringify({ keys }), "application/json"),
+    put(ISSUER_OBJECTS.index, INDEX_HTML, "text/html; charset=utf-8")
+  ]);
+  log("issuer documents published", { issuer, kids: keyIds });
+  return { PhysicalResourceId: physical };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  handler
+});

package/assets/keyminter/index.js

@@ -0,0 +1,209 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lambdacode/network/keyminter.ts
+var keyminter_exports = {};
+__export(keyminter_exports, {
+  connectorHandler: () => connectorHandler,
+  deviceHandler: () => deviceHandler
+});
+module.exports = __toCommonJS(keyminter_exports);
+
+// lambdacode/network/headscale-http.ts
+var https = __toESM(require("node:https"));
+var import_client_ssm = require("@aws-sdk/client-ssm");
+var ssm = new import_client_ssm.SSMClient({});
+var sources = /* @__PURE__ */ new Map();
+var cached = /* @__PURE__ */ new Map();
+var CERT_TTL_MS = 6e4;
+function trustHeadscale(url, certParam) {
+  if (certParam) sources.set(new URL(url).origin, certParam);
+}
+async function certificateFor(origin, fresh) {
+  const param = sources.get(origin);
+  if (!param) throw new Error(`no certificate source registered for ${origin}`);
+  const hit = cached.get(param);
+  if (!fresh && hit && Date.now() - hit.at < CERT_TTL_MS) return hit.pem;
+  const out = await ssm.send(new import_client_ssm.GetParameterCommand({ Name: param }));
+  const pem = out.Parameter?.Value;
+  if (!pem) throw new Error(`certificate parameter ${param} is empty`);
+  cached.set(param, { pem, at: Date.now() });
+  return pem;
+}
+var TLS_FAILURES = /* @__PURE__ */ new Set([
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "CERT_SIGNATURE_FAILURE",
+  "CERT_HAS_EXPIRED",
+  "ERR_TLS_CERT_ALTNAME_INVALID"
+]);
+var isTlsFailure = (err) => TLS_FAILURES.has(String(err?.code));
+function request2(url, init, ca) {
+  return new Promise((resolve, reject) => {
+    const headers = {};
+    new Headers(init.headers ?? {}).forEach((v, k) => headers[k] = v);
+    const req = https.request(
+      url,
+      { method: init.method ?? "GET", headers, ca: [ca] },
+      (res) => {
+        const chunks = [];
+        res.on("data", (c) => chunks.push(c));
+        res.on("error", reject);
+        res.on(
+          "end",
+          () => resolve(
+            new Response(Buffer.concat(chunks), {
+              status: res.statusCode ?? 0,
+              headers: Object.entries(res.headers).flatMap(
+                ([k, v]) => v === void 0 ? [] : [v].flat().map((x) => [k, x])
+              )
+            })
+          )
+        );
+      }
+    );
+    req.on("error", reject);
+    const signal = init.signal;
+    if (signal) {
+      const abort = () => req.destroy(
+        signal.reason instanceof Error ? signal.reason : new Error("aborted")
+      );
+      if (signal.aborted) abort();
+      else signal.addEventListener("abort", abort, { once: true });
+    }
+    if (init.body !== void 0 && init.body !== null)
+      req.write(init.body);
+    req.end();
+  });
+}
+async function headscaleFetch(url, init = {}) {
+  if (!url.startsWith("https:")) return fetch(url, init);
+  const origin = new URL(url).origin;
+  try {
+    return await request2(url, init, await certificateFor(origin, false));
+  } catch (err) {
+    if (!isTlsFailure(err)) throw err;
+    return request2(url, init, await certificateFor(origin, true));
+  }
+}
+
+// lambdacode/network/naming.ts
+var headscaleUserName = (cognitoSub) => `u-${cognitoSub}`;
+
+// lambdacode/network/keyminter.ts
+var log = (msg, extra = {}) => console.log(JSON.stringify({ msg, ...extra }));
+function sitesFromEnv() {
+  try {
+    const sites = JSON.parse(process.env.HEADSCALE_SITES ?? "{}");
+    for (const s of Object.values(sites)) trustHeadscale(s.url, s.certParam);
+    return sites;
+  } catch {
+    return {};
+  }
+}
+async function userIdFor(api, name) {
+  const headers = { Authorization: `Bearer ${api.key}` };
+  const list = await headscaleFetch(`${api.url}/api/v1/user`, { headers });
+  if (!list.ok) throw new Error(`user list: ${list.status}`);
+  const { users = [] } = await list.json();
+  const existing = users.find((u) => u.name === name);
+  if (existing) return existing.id;
+  const created = await headscaleFetch(`${api.url}/api/v1/user`, {
+    method: "POST",
+    headers: { ...headers, "Content-Type": "application/json" },
+    body: JSON.stringify({ name })
+  });
+  if (!created.ok) {
+    const detail = await created.text().catch(() => "");
+    log("ERROR: headscale user create", { status: created.status, detail });
+    throw new Error(`user create: ${created.status}`);
+  }
+  const body = await created.json();
+  if (!body.user?.id) throw new Error("user create: no id in response");
+  return body.user.id;
+}
+async function mint(api, userId, ttlSeconds) {
+  const expiresAt = new Date(Date.now() + ttlSeconds * 1e3).toISOString();
+  const res = await headscaleFetch(`${api.url}/api/v1/preauthkey`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${api.key}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      user: userId,
+      reusable: false,
+      ephemeral: false,
+      expiration: expiresAt
+    })
+  });
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    log("ERROR: headscale preauthkey", { status: res.status, detail });
+    throw new Error(`Headscale admin API returned ${res.status}`);
+  }
+  const body = await res.json();
+  const key = body.preAuthKey?.key;
+  if (!key) throw new Error("Headscale response had no key");
+  return { key, expiresAt };
+}
+var deviceHandler = async (event) => {
+  const userName = event?.userName ?? "";
+  if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(userName)) {
+    throw new Error("device keys need a valid userName (Cognito sub)");
+  }
+  const sites = sitesFromEnv();
+  const siteIds = Object.keys(sites);
+  const siteId = event?.siteId ?? siteIds[0] ?? "";
+  const api = sites[siteId];
+  if (!api) throw new Error(`unknown siteId "${siteId}"`);
+  const userId = await userIdFor(api, headscaleUserName(userName));
+  const result = await mint(api, userId, 30 * 60);
+  log("minted", { keyType: "device", siteId, expiresAt: result.expiresAt });
+  return result;
+};
+var connectorHandler = async () => {
+  const api = {
+    url: process.env.HEADSCALE_API_URL ?? "",
+    key: process.env.HEADSCALE_API_KEY ?? "",
+    certParam: process.env.HEADSCALE_TLS_PARAM
+  };
+  trustHeadscale(api.url, api.certParam);
+  const userId = process.env.HEADSCALE_USER_ID ?? "1";
+  const result = await mint(api, userId, 5 * 60);
+  log("minted", { keyType: "connector", expiresAt: result.expiresAt });
+  return result;
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  connectorHandler,
+  deviceHandler
+});