@hivemagnus/magnus-server 0.0.0-stage → 1.0.2

package/dist/services/credential-rotation-service.js

@@ -0,0 +1,294 @@
+/**
+ * Durable encrypted credential rotation.
+ *
+ * Rotation state is stored as AES-256-GCM encrypted envelopes on disk. Only
+ * short SHA-256 fingerprints are exposed to route handlers, audit logs, and UI
+ * callers. The active secret plus one unexpired previous secret are accepted so
+ * agents can roll during a grace window without fleet downtime.
+ */
+import { magnusHomePath } from '../utils/magnus-home.js';
+import { createCipheriv, createDecipheriv, createHash, randomBytes, timingSafeEqual, } from 'node:crypto';
+import { closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync, } from 'node:fs';
+import path from 'node:path';
+export const DEFAULT_GRACE_MS = 60 * 60 * 1_000; // 1 hour
+const STORE_VERSION = 1;
+const ENVELOPE_PREFIX = 'enc:v1:';
+function defaultStatePath() {
+    return magnusHomePath('state', 'credential-rotations.json');
+}
+export function getCredentialRotationStatePath() {
+    return process.env['CREDENTIAL_ROTATION_STATE_PATH'] ?? defaultStatePath();
+}
+function encryptionKey() {
+    const source = process.env['CREDENTIAL_ROTATION_KEY'] ?? '';
+    if (source.length < 32) {
+        throw new Error('CREDENTIAL_ROTATION_KEY must be a dedicated secret of at least 32 characters');
+    }
+    return createHash('sha256').update(source).digest();
+}
+export function secretFingerprint(value) {
+    return createHash('sha256').update(value).digest('hex').slice(0, 12);
+}
+function aadFor(name, id) {
+    return Buffer.from(`magnus:credential:${name}:${id}`, 'utf-8');
+}
+function encryptSecret(name, id, plaintext) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', encryptionKey(), iv);
+    cipher.setAAD(aadFor(name, id));
+    const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf-8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return `${ENVELOPE_PREFIX}${iv.toString('base64url')}:${tag.toString('base64url')}:${ciphertext.toString('base64url')}`;
+}
+function decryptSecret(name, version) {
+    if (!version.encryptedSecret.startsWith(ENVELOPE_PREFIX)) {
+        throw new Error(`Credential ${name} is not encrypted`);
+    }
+    const payload = version.encryptedSecret.slice(ENVELOPE_PREFIX.length);
+    const [ivRaw, tagRaw, ciphertextRaw] = payload.split(':');
+    if (!ivRaw || !tagRaw || ciphertextRaw === undefined) {
+        throw new Error(`Credential ${name} has a malformed encrypted envelope`);
+    }
+    const decipher = createDecipheriv('aes-256-gcm', encryptionKey(), Buffer.from(ivRaw, 'base64url'));
+    decipher.setAAD(aadFor(name, version.id));
+    decipher.setAuthTag(Buffer.from(tagRaw, 'base64url'));
+    return decipher.update(Buffer.from(ciphertextRaw, 'base64url')).toString('utf-8') + decipher.final('utf-8');
+}
+function emptyStore() {
+    return { version: STORE_VERSION, credentials: {} };
+}
+function readStore() {
+    const statePath = getCredentialRotationStatePath();
+    if (!existsSync(statePath))
+        return emptyStore();
+    const metadata = lstatSync(statePath);
+    if (!metadata.isFile() || metadata.isSymbolicLink() || (metadata.mode & 0o077) !== 0) {
+        throw new Error('Credential rotation state must be a regular non-symlink file with mode 0600');
+    }
+    const parsed = JSON.parse(readFileSync(statePath, 'utf-8'));
+    if (parsed.version !== STORE_VERSION || !parsed.credentials || typeof parsed.credentials !== 'object') {
+        throw new Error('Credential rotation state has an unsupported schema');
+    }
+    return parsed;
+}
+function writeStore(store) {
+    const statePath = getCredentialRotationStatePath();
+    mkdirSync(path.dirname(statePath), { recursive: true, mode: 0o700 });
+    const tmpPath = `${statePath}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(tmpPath, `${JSON.stringify(store, null, 2)}\n`, { encoding: 'utf-8', mode: 0o600 });
+    const fileDescriptor = openSync(tmpPath, 'r');
+    try {
+        fsyncSync(fileDescriptor);
+    }
+    finally {
+        closeSync(fileDescriptor);
+    }
+    renameSync(tmpPath, statePath);
+    const directoryDescriptor = openSync(path.dirname(statePath), 'r');
+    try {
+        fsyncSync(directoryDescriptor);
+    }
+    finally {
+        closeSync(directoryDescriptor);
+    }
+}
+function nowIso() {
+    return new Date().toISOString();
+}
+function makeVersion(name, plaintext, createdAt = nowIso(), expiresAt) {
+    assertCredentialSecret(name, plaintext);
+    const id = randomBytes(16).toString('base64url');
+    return {
+        id,
+        encryptedSecret: encryptSecret(name, id, plaintext),
+        fingerprint: secretFingerprint(plaintext),
+        createdAt,
+        ...(expiresAt ? { expiresAt } : {}),
+    };
+}
+function assertCredentialSecret(name, value) {
+    if (value.length < 32) {
+        throw new Error(`${name} must contain at least 32 characters`);
+    }
+}
+function decryptValidatedSecret(name, version, allowLegacyRetirement = false) {
+    const value = decryptSecret(name, version);
+    if (version.legacyRetirementOnly) {
+        const createdAt = Date.parse(version.createdAt);
+        const expiresAt = version.expiresAt ? Date.parse(version.expiresAt) : Number.NaN;
+        if (!allowLegacyRetirement
+            || value.length < 16
+            || value.length >= 32
+            || !Number.isFinite(createdAt)
+            || !Number.isFinite(expiresAt)
+            || expiresAt <= createdAt
+            || expiresAt - createdAt > DEFAULT_GRACE_MS) {
+            throw new Error(`Credential ${name} has an invalid one-time legacy retirement envelope`);
+        }
+    }
+    else {
+        assertCredentialSecret(name, value);
+    }
+    if (secretFingerprint(value) !== version.fingerprint) {
+        throw new Error(`Credential ${name} fingerprint does not match its encrypted value`);
+    }
+    return value;
+}
+function isExpired(version, atMs = Date.now()) {
+    return Boolean(version?.expiresAt && Date.parse(version.expiresAt) <= atMs);
+}
+function pruneExpired(store) {
+    let changed = false;
+    for (const record of Object.values(store.credentials)) {
+        if (record?.previous && isExpired(record.previous)) {
+            delete record.previous;
+            changed = true;
+        }
+    }
+    return changed;
+}
+function ensureRecord(name, currentValue) {
+    assertCredentialSecret(name, currentValue);
+    const store = readStore();
+    const changed = pruneExpired(store);
+    const existing = store.credentials[name];
+    if (existing) {
+        decryptValidatedSecret(name, existing.active);
+        if (existing.previous)
+            decryptValidatedSecret(name, existing.previous, true);
+        if (changed)
+            writeStore(store);
+        return { store, record: existing };
+    }
+    const active = makeVersion(name, currentValue);
+    const record = { active };
+    store.credentials[name] = record;
+    writeStore(store);
+    return { store, record };
+}
+/**
+ * Return the active secret for callers that need to talk to agents.
+ */
+export function resolveCredentialSecret(name, currentValue) {
+    const { record } = ensureRecord(name, currentValue);
+    return decryptValidatedSecret(name, record.active);
+}
+/**
+ * Start a durable rotation and return the generated plaintext only to the
+ * caller responsible for distributing it. Route responses should redact it.
+ */
+export function rotateCredential(name, currentValue, gracePeriodMs = DEFAULT_GRACE_MS) {
+    const { store, record } = ensureRecord(name, currentValue);
+    const currentSecret = decryptValidatedSecret(name, record.active);
+    const rotatedAt = nowIso();
+    const expiresAt = new Date(Date.now() + gracePeriodMs).toISOString();
+    const newSecret = randomBytes(32).toString('base64url');
+    const previous = makeVersion(name, currentSecret, record.active.createdAt, expiresAt);
+    const active = makeVersion(name, newSecret, rotatedAt);
+    store.credentials[name] = {
+        active,
+        previous,
+        rotatedAt,
+        gracePeriodMs,
+    };
+    writeStore(store);
+    return {
+        name,
+        newSecret,
+        newFingerprint: active.fingerprint,
+        previousFingerprint: previous.fingerprint,
+        gracePeriodMs,
+        expiresAt,
+        rotatedAt,
+    };
+}
+/**
+ * Verify a provided secret against the current value plus any unexpired
+ * previous secret. This remains synchronous for auth middleware.
+ */
+export function verifyWithRotation(name, currentValue, provided) {
+    const { store, record } = ensureRecord(name, currentValue);
+    let changed = false;
+    if (safeEqual(provided, decryptValidatedSecret(name, record.active)))
+        return true;
+    if (record.previous && isExpired(record.previous)) {
+        delete record.previous;
+        changed = true;
+    }
+    if (changed)
+        writeStore(store);
+    return Boolean(record.previous && safeEqual(provided, decryptValidatedSecret(name, record.previous, true)));
+}
+export function getCredentialStatus(name, currentValue) {
+    assertCredentialSecret(name, currentValue);
+    const store = readStore();
+    const record = store.credentials[name];
+    if (!record) {
+        return {
+            name,
+            activeFingerprint: secretFingerprint(currentValue),
+            previousFingerprint: null,
+            rotatedAt: null,
+            expiresAt: null,
+            gracePeriodMs: null,
+        };
+    }
+    decryptValidatedSecret(name, record.active);
+    if (record.previous)
+        decryptValidatedSecret(name, record.previous, true);
+    const previous = record.previous && !isExpired(record.previous) ? record.previous : undefined;
+    return {
+        name,
+        activeFingerprint: record.active.fingerprint,
+        previousFingerprint: previous?.fingerprint ?? null,
+        rotatedAt: record.rotatedAt ?? null,
+        expiresAt: previous?.expiresAt ?? null,
+        gracePeriodMs: record.gracePeriodMs ?? null,
+    };
+}
+export function retirePreviousCredential(name, currentValue) {
+    const { store, record } = ensureRecord(name, currentValue);
+    const retiredPreviousFingerprint = record.previous?.fingerprint ?? null;
+    if (record.previous) {
+        delete record.previous;
+        writeStore(store);
+    }
+    return {
+        name,
+        activeFingerprint: record.active.fingerprint,
+        previousFingerprint: null,
+        retiredPreviousFingerprint,
+        rotatedAt: record.rotatedAt ?? null,
+        expiresAt: null,
+        gracePeriodMs: record.gracePeriodMs ?? null,
+    };
+}
+/** List active credential rotations for admin visibility. */
+export function listActiveRotations() {
+    const store = readStore();
+    return Object.entries(store.credentials).map(([name, record]) => {
+        const credentialName = name;
+        decryptValidatedSecret(credentialName, record.active);
+        if (record.previous)
+            decryptValidatedSecret(credentialName, record.previous, true);
+        const previous = record.previous && !isExpired(record.previous) ? record.previous : undefined;
+        return {
+            name,
+            activeFingerprint: record.active.fingerprint,
+            previousFingerprint: previous?.fingerprint ?? null,
+            rotatedAt: record.rotatedAt ?? null,
+            expiresAt: previous?.expiresAt ?? null,
+            gracePeriodMs: record.gracePeriodMs ?? null,
+        };
+    });
+}
+function safeEqual(a, b) {
+    const aBuf = Buffer.from(a);
+    const bBuf = Buffer.from(b);
+    if (aBuf.length !== bBuf.length) {
+        timingSafeEqual(aBuf, aBuf);
+        return false;
+    }
+    return timingSafeEqual(aBuf, bBuf);
+}
+//# sourceMappingURL=credential-rotation-service.js.map

package/dist/services/dependency-service.js

@@ -0,0 +1,145 @@
+/**
+ * dependency-service.ts — Node dependency mapping.
+ *
+ * Discovers service dependencies between nodes by:
+ * 1. Querying each agent for listening ports + active connections
+ * 2. Matching connections to known node IPs/ports
+ * 3. Building a dependency graph (e.g., app → database → cache)
+ */
+import { SENTINEL_NODE_IDS } from '../utils/sentinel-nodes.js';
+import { boundedJson } from './application-probes.js';
+import { lookup } from 'node:dns/promises';
+import { normalizeIpAddress } from '../utils/ip.js';
+import { getDb } from '../db/index.js';
+import { getNodeManagerSecret } from '../utils/env.js';
+// ── Well-known port lookup ──
+const KNOWN_SERVICES = {
+    22: 'ssh', 80: 'http', 443: 'https', 3000: 'webapp',
+    3306: 'mysql', 5432: 'postgres', 6379: 'redis', 6380: 'redis',
+    27017: 'mongodb', 9200: 'elasticsearch', 8080: 'http-alt',
+    5672: 'rabbitmq', 9092: 'kafka', 2181: 'zookeeper',
+    8443: 'https-alt', 4100: 'magnus-agent', 4000: 'magnus-api',
+    11434: 'ollama',
+};
+function detectService(port, process) {
+    if (process) {
+        const lower = process.toLowerCase();
+        if (lower.includes('postgres') || lower.includes('psql'))
+            return 'postgres';
+        if (lower.includes('mysql') || lower.includes('mariadb'))
+            return 'mysql';
+        if (lower.includes('redis'))
+            return 'redis';
+        if (lower.includes('mongo'))
+            return 'mongodb';
+        if (lower.includes('nginx'))
+            return 'nginx';
+        if (lower.includes('node'))
+            return 'node';
+    }
+    return KNOWN_SERVICES[port] ?? `port-${port}`;
+}
+/**
+ * Query an agent for its network connections via the agent API.
+ * Falls back to empty arrays on error.
+ */
+async function queryAgentConnections(nodeIp, nodePort) {
+    const observedAt = new Date().toISOString();
+    const unknown = (reason) => ({ services: [], connections: [], collection: { status: 'unknown', observedAt, reason } });
+    try {
+        const address = `https://${nodeIp}:${nodePort}`;
+        const resp = await fetch(`${address}/api/v1/network-info`, {
+            headers: { 'x-node-token': getNodeManagerSecret() },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (!resp.ok)
+            return unknown(`Agent returned HTTP ${resp.status}`);
+        const data = (await boundedJson(resp));
+        if (!Array.isArray(data.listeningPorts) || !Array.isArray(data.connections))
+            return unknown('Invalid network observation');
+        return {
+            collection: { status: 'pass', observedAt, reason: null },
+            services: data.listeningPorts ?? [],
+            connections: data.connections ?? [],
+        };
+    }
+    catch {
+        return unknown('Agent network observation unavailable');
+    }
+}
+/**
+ * Build a dependency graph across all registered nodes.
+ */
+export async function buildDependencyGraph() {
+    const db = getDb();
+    const nodes = await db.node.findMany({
+        take: 1000,
+        where: { id: { notIn: SENTINEL_NODE_IDS } },
+        select: { id: true, name: true, hostname: true, ipAddress: true, port: true },
+    });
+    // Map IP → node ID for matching connections
+    const ipToNode = new Map();
+    for (const n of nodes) {
+        ipToNode.set(normalizeIpAddress(n.ipAddress), { id: n.id, name: n.name });
+    }
+    await Promise.allSettled(nodes.map(async (n) => {
+        let timer;
+        try {
+            const addresses = await Promise.race([Promise.allSettled([...new Set([n.ipAddress, n.hostname])].map(host => lookup(host, { all: true }))).then(results => results.flatMap(r => r.status === 'fulfilled' ? r.value : [])), new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('DNS timeout')), 2000); })]);
+            for (const address of addresses)
+                ipToNode.set(normalizeIpAddress(address.address), { id: n.id, name: n.name });
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }));
+    // Query all agents in parallel
+    const results = await Promise.allSettled(nodes.map(async (n) => {
+        const info = await queryAgentConnections(n.ipAddress, n.port);
+        return { nodeId: n.id, ...info };
+    }));
+    const depNodes = [];
+    const edgeMap = new Map();
+    for (const r of results) {
+        if (r.status !== 'fulfilled')
+            continue;
+        const { nodeId, services, connections, collection } = r.value;
+        const node = nodes.find((n) => n.id === nodeId);
+        if (!node)
+            continue;
+        depNodes.push({ id: nodeId, name: node.name, ip: node.ipAddress, services, collection });
+        // Match connections to known nodes
+        for (const conn of connections) {
+            if (conn.state !== 'ESTABLISHED')
+                continue;
+            const target = ipToNode.get(normalizeIpAddress(conn.remoteIp));
+            if (!target || target.id === nodeId)
+                continue;
+            const edgeKey = `${nodeId}→${target.id}:${conn.remotePort}`;
+            const existing = edgeMap.get(edgeKey);
+            if (existing) {
+                existing.connectionCount++;
+            }
+            else {
+                const destination = results.find(r => r.status === 'fulfilled' && r.value.nodeId === target.id);
+                const proc = destination?.status === 'fulfilled' ? destination.value.services.find(s => s.port === conn.remotePort) : undefined;
+                edgeMap.set(edgeKey, {
+                    from: nodeId,
+                    to: target.id,
+                    fromPort: conn.localPort,
+                    toPort: conn.remotePort,
+                    service: detectService(conn.remotePort, proc?.process),
+                    connectionCount: 1,
+                });
+            }
+        }
+    }
+    return {
+        nodes: depNodes,
+        edges: [...edgeMap.values()],
+        discoveredAt: new Date().toISOString(),
+        status: depNodes.some(n => n.collection.status !== 'pass') ? 'partial' : 'complete',
+    };
+}
+//# sourceMappingURL=dependency-service.js.map