@fonoster/identity 0.27.0 → 0.31.0

package/README.md

@@ -22,6 +22,31 @@ This module offers comprehensive identity management functionality, including cr
 - **Authorization** via Role-Based Access Control (RBAC) with predefined and custom roles.
 - **Resource ownership** keyed by `accessKeyId` (`US…` for users, `WO…` for workspaces).
 
+## Running standalone
+
+`fonoster-identity` (or the `fonoster/identity` image) serves Identity without the
+telephony stack. It reads `identity.json` (or `.jsonc`/`.yaml`), found via
+`--config <path>`, `/opt/fonoster/identity.json` or `./config/identity.json`, and
+reads no environment variables. Fields sit at the root of the file:
+
+```json
+{
+  "database": { "url": "postgresql://postgres:postgres@postgres:5432/fnidentity" },
+  "encryptionKey": "change-me",
+  "issuer": "https://id.acme.com",
+  "keys": {
+    "privateKeyPath": "/opt/fonoster/keys/private.pem",
+    "publicKeyPath": "/opt/fonoster/keys/public.pem"
+  },
+  "smtp": { "host": "smtp.acme.com", "port": 587, "sender": "no-reply@acme.com", "auth": { "user": "ops", "pass": "secret" } },
+  "auth": { "methods": ["password"], "signup": "invite" },
+  "defaultUser": { "name": "Admin", "email": "admin@acme.com", "password": "changeme" }
+}
+```
+
+`npm run db:deploy -- --config <path>` applies the migrations using the same file.
+Every key is described in [docs/configuration.md](../../docs/configuration.md).
+
 ## Specification
 
 The normative specification for this module — entities and resource ownership, the RBAC model, the

package/dist/allowList.d.ts

@@ -20,6 +20,10 @@
  * gRPC methods reachable without an access token. This is the single source of
  * truth for Identity's public methods, shared by the standalone Identity service
  * and the apiserver monolith (which appends its own non-identity entries).
+ *
+ * CreateWorkspace is deliberately absent: its handler takes the owner from the
+ * caller's access token, so a tokenless call must stop at the interceptor
+ * (UNAUTHENTICATED) rather than reach it.
  */
 declare const identityAllowList: string[];
 export { identityAllowList };

package/dist/allowList.js

@@ -23,16 +23,22 @@ exports.identityAllowList = void 0;
  * gRPC methods reachable without an access token. This is the single source of
  * truth for Identity's public methods, shared by the standalone Identity service
  * and the apiserver monolith (which appends its own non-identity entries).
+ *
+ * CreateWorkspace is deliberately absent: its handler takes the owner from the
+ * caller's access token, so a tokenless call must stop at the interceptor
+ * (UNAUTHENTICATED) rather than reach it.
  */
 const identityAllowList = [
     "/grpc.health.v1.Health/Check",
     "/fonoster.identity.v1beta2.Identity/CreateUser",
     "/fonoster.identity.v1beta2.Identity/CreateUserWithOauth2Code",
-    "/fonoster.identity.v1beta2.Identity/CreateWorkspace",
     "/fonoster.identity.v1beta2.Identity/ExchangeApiKey",
     "/fonoster.identity.v1beta2.Identity/ExchangeCredentials",
     "/fonoster.identity.v1beta2.Identity/ExchangeOauth2Code",
     "/fonoster.identity.v1beta2.Identity/ExchangeRefreshToken",
+    "/fonoster.identity.v1beta2.Identity/ExchangeVerificationCode",
+    // Holding the refresh token is what authorizes revoking it (sign-out).
+    "/fonoster.identity.v1beta2.Identity/RevokeToken",
     "/fonoster.identity.v1beta2.Identity/SendVerificationCode",
     "/fonoster.identity.v1beta2.Identity/VerifyCode",
     "/fonoster.identity.v1beta2.Identity/GetPublicKey",

package/dist/apikeys/createCreateApiKey.js

@@ -30,18 +30,34 @@ exports.createCreateApiKey = createCreateApiKey;
  */
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
+const grpc_js_1 = require("@grpc/grpc-js");
 const generateAccessKeyId_1 = require("../utils/generateAccessKeyId");
 const generateAccessKeySecret_1 = require("../utils/generateAccessKeySecret");
+const isWorkspaceAdminCall_1 = require("../utils/isWorkspaceAdminCall");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
+const notAdmin = {
+    code: grpc_js_1.status.PERMISSION_DENIED,
+    message: "Only workspace owners and admins can manage API keys"
+};
 function createCreateApiKey(prisma) {
     const createApiKey = (call, callback) => __awaiter(this, void 0, void 0, function* () {
         const accessKeyId = (0, common_1.getAccessKeyIdFromCall)(call);
         const { request } = call;
         const { role, expiresAt } = request;
         logger.info("creating new ApiKey", { accessKeyId, role, expiresAt });
+        // Keys act as WORKSPACE_ADMIN, so only owners and admins may mint them.
+        if (!(0, isWorkspaceAdminCall_1.isWorkspaceAdminCall)(call)) {
+            return callback(notAdmin);
+        }
         const workspace = yield prisma.workspace.findUnique({
             where: { accessKeyId }
         });
+        if (!workspace) {
+            return callback({
+                code: grpc_js_1.status.NOT_FOUND,
+                message: "Workspace not found"
+            });
+        }
         const { ref } = workspace;
         const response = yield prisma.apiKey.create({
             data: {

package/dist/apikeys/createDeleteApiKey.js

@@ -30,17 +30,37 @@ exports.createDeleteApiKey = createDeleteApiKey;
  */
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
+const grpc_js_1 = require("@grpc/grpc-js");
+const refreshTokens_1 = require("../exchanges/refreshTokens");
+const isWorkspaceAdminCall_1 = require("../utils/isWorkspaceAdminCall");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
+const notAdmin = {
+    code: grpc_js_1.status.PERMISSION_DENIED,
+    message: "Only workspace owners and admins can manage API keys"
+};
 function createDeleteApiKey(prisma) {
+    const refreshTokens = (0, refreshTokens_1.createRefreshTokenStore)(prisma);
     const deleteApiKey = (call, callback) => __awaiter(this, void 0, void 0, function* () {
         const { request } = call;
         const { ref } = request;
-        logger.info("deleting ApiKey", { ref });
+        const accessKeyId = (0, common_1.getAccessKeyIdFromCall)(call);
+        logger.info("deleting ApiKey", { ref, accessKeyId });
+        if (!(0, isWorkspaceAdminCall_1.isWorkspaceAdminCall)(call)) {
+            return callback(notAdmin);
+        }
+        // Only a key of the caller's workspace; others look like they don't exist.
+        const key = yield prisma.apiKey.findFirst({
+            where: { ref, workspace: { accessKeyId } }
+        });
+        if (!key) {
+            return callback({ code: grpc_js_1.status.NOT_FOUND, message: "ApiKey not found" });
+        }
         yield prisma.apiKey.delete({
             where: {
-                ref
+                ref: key.ref
             }
         });
+        yield refreshTokens.revokeAll(key.accessKeyId);
         callback(null, { ref });
     });
     return (0, common_1.withErrorHandlingAndValidation)(deleteApiKey, common_1.Validators.emptySchema);

package/dist/apikeys/createListApiKeys.js

@@ -30,6 +30,8 @@ exports.createListApiKeys = createListApiKeys;
  */
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
+const grpc_js_1 = require("@grpc/grpc-js");
+const isWorkspaceAdminCall_1 = require("../utils/isWorkspaceAdminCall");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
 function createListApiKeys(prisma) {
     const listApiKeys = (call, callback) => __awaiter(this, void 0, void 0, function* () {
@@ -37,11 +39,23 @@ function createListApiKeys(prisma) {
         const { pageSize, pageToken } = call.request;
         const accessKeyId = (0, common_1.getAccessKeyIdFromCall)(call);
         logger.verbose("list keys for workspace", { accessKeyId });
+        if (!(0, isWorkspaceAdminCall_1.isWorkspaceAdminCall)(call)) {
+            return callback({
+                code: grpc_js_1.status.PERMISSION_DENIED,
+                message: "Only workspace owners and admins can manage API keys"
+            });
+        }
         const workspace = yield prisma.workspace.findUnique({
             where: {
                 accessKeyId
             }
         });
+        if (!workspace) {
+            return callback({
+                code: grpc_js_1.status.NOT_FOUND,
+                message: "Workspace not found"
+            });
+        }
         const keys = yield prisma.apiKey.findMany({
             where: {
                 workspaceRef: workspace.ref

package/dist/apikeys/createRegenerateApiKey.js

@@ -30,21 +30,42 @@ exports.createRegenerateApiKey = createRegenerateApiKey;
  */
 const common_1 = require("@fonoster/common");
 const logger_1 = require("@fonoster/logger");
+const grpc_js_1 = require("@grpc/grpc-js");
+const refreshTokens_1 = require("../exchanges/refreshTokens");
 const generateAccessKeySecret_1 = require("../utils/generateAccessKeySecret");
+const isWorkspaceAdminCall_1 = require("../utils/isWorkspaceAdminCall");
 const logger = (0, logger_1.getLogger)({ service: "identity", filePath: __filename });
+const notAdmin = {
+    code: grpc_js_1.status.PERMISSION_DENIED,
+    message: "Only workspace owners and admins can manage API keys"
+};
 function createRegenerateApiKey(prisma) {
+    const refreshTokens = (0, refreshTokens_1.createRefreshTokenStore)(prisma);
     const regenerateApiKey = (call, callback) => __awaiter(this, void 0, void 0, function* () {
         const { request } = call;
         const { ref } = request;
-        logger.info("regenerating ApiKey", { ref });
+        const accessKeyId = (0, common_1.getAccessKeyIdFromCall)(call);
+        logger.info("regenerating ApiKey", { ref, accessKeyId });
+        if (!(0, isWorkspaceAdminCall_1.isWorkspaceAdminCall)(call)) {
+            return callback(notAdmin);
+        }
+        // Only a key of the caller's workspace; others look like they don't exist.
+        const key = yield prisma.apiKey.findFirst({
+            where: { ref, workspace: { accessKeyId } }
+        });
+        if (!key) {
+            return callback({ code: grpc_js_1.status.NOT_FOUND, message: "ApiKey not found" });
+        }
         const response = yield prisma.apiKey.update({
             where: {
-                ref
+                ref: key.ref
             },
             data: {
                 accessKeySecret: (0, generateAccessKeySecret_1.generateAccessKeySecret)()
             }
         });
+        // The old secret's sessions end with it.
+        yield refreshTokens.revokeAll(key.accessKeyId);
         callback(null, {
             ref: response.ref,
             accessKeyId: response.accessKeyId,

package/dist/config/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export * from "./schemas";
+export * from "./toIdentityConfig";

package/dist/config/index.js

@@ -0,0 +1,36 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+__exportStar(require("./schemas"), exports);
+__exportStar(require("./toIdentityConfig"), exports);

package/dist/config/publishedKeys.d.ts

@@ -0,0 +1,9 @@
+/** SHA-256 of a PEM key's public part (SPKI DER), or undefined if it doesn't parse. */
+declare function publicKeyFingerprint(pem: string): string | undefined;
+/** Throws when a signing key or the encryption key is one that was published. */
+declare function assertUnpublishedKeys(keys: {
+    privateKey: string;
+    publicKey: string;
+    encryptionKey: string;
+}): void;
+export { assertUnpublishedKeys, publicKeyFingerprint };

package/dist/config/publishedKeys.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertUnpublishedKeys = assertUnpublishedKeys;
+exports.publicKeyFingerprint = publicKeyFingerprint;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const crypto_1 = require("crypto");
+/**
+ * Keys that were committed to the repository (config/keys and the root config examples) before
+ * they were removed. They are public, so anyone could sign tokens or decrypt credentials with
+ * them: Identity refuses to start with one.
+ */
+const PUBLISHED_SIGNING_KEY_FINGERPRINTS = [
+    // config/keys/public.pem (SHA-256 of the SPKI DER)
+    "b8dcd305f9d55674fb796641f967ee35b1fd8c464432f842320208e717e9db97"
+];
+const PUBLISHED_ENCRYPTION_KEYS = [
+    "k1.aesgcm256.MmPSvzCG9fk654bAbl30tsqq4h9d3N4F11hlue8bGAY=",
+    // the placeholder in config/fonoster.example.yaml
+    "k1.aesgcm256.GENERATE-YOUR-OWN-with-npx-47ng-cloak-gen00="
+];
+/** SHA-256 of a PEM key's public part (SPKI DER), or undefined if it doesn't parse. */
+function publicKeyFingerprint(pem) {
+    try {
+        const der = (0, crypto_1.createPublicKey)(pem).export({ type: "spki", format: "der" });
+        return (0, crypto_1.createHash)("sha256").update(der).digest("hex");
+    }
+    catch (_a) {
+        return undefined;
+    }
+}
+/** Throws when a signing key or the encryption key is one that was published. */
+function assertUnpublishedKeys(keys) {
+    var _a;
+    const published = [keys.privateKey, keys.publicKey].some((pem) => { var _a; return PUBLISHED_SIGNING_KEY_FINGERPRINTS.includes((_a = publicKeyFingerprint(pem)) !== null && _a !== void 0 ? _a : ""); });
+    if (published)
+        throw new Error("identity signing key is the development key once committed to the Fonoster repository: generate your own (fonoster-config init, or openssl genrsa 2048)");
+    if (PUBLISHED_ENCRYPTION_KEYS.includes((_a = keys.encryptionKey) === null || _a === void 0 ? void 0 : _a.trim()))
+        throw new Error("encryption.key is the example key once committed to the Fonoster repository: generate your own (npx @47ng/cloak generate)");
+}