@hivemagnus/magnus-server 0.0.0-stage → 1.0.2

package/dist/services/webhook-credential-migration.js

@@ -0,0 +1,97 @@
+import { decryptWebhookCredential, encryptWebhookCredential, isEncryptedWebhookCredential, } from './webhook-security.js';
+export function assertWebhookMigrationCanApply(apply, serviceStopped = process.env['WEBHOOK_MIGRATION_SERVICE_STOPPED']) {
+    if (apply && serviceStopped !== '1') {
+        throw new Error('Refusing live migration: stop magnus-control-api and set WEBHOOK_MIGRATION_SERVICE_STOPPED=1');
+    }
+}
+function rejectUnsupportedEnvelope(value, field) {
+    if (value.startsWith('magnus-webhook:') && !isEncryptedWebhookCredential(value)) {
+        throw new Error(`Webhook ${field} has an unsupported encrypted envelope`);
+    }
+}
+function validateHeaders(plaintext) {
+    const parsed = JSON.parse(plaintext);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('Stored webhook headers must be a JSON object');
+    }
+    for (const [name, value] of Object.entries(parsed)) {
+        if (!name || typeof value !== 'string') {
+            throw new Error('Stored webhook headers must contain string names and values');
+        }
+    }
+}
+function planMigration(rows) {
+    return rows.map((endpoint) => {
+        if (endpoint.secret !== null)
+            rejectUnsupportedEnvelope(endpoint.secret, 'secret');
+        rejectUnsupportedEnvelope(endpoint.headers, 'headers');
+        if (endpoint.url)
+            rejectUnsupportedEnvelope(endpoint.url, 'url');
+        const secretPlaintext = endpoint.secret === null
+            ? null
+            : isEncryptedWebhookCredential(endpoint.secret)
+                ? decryptWebhookCredential(endpoint.secret, endpoint.id, 'secret')
+                : endpoint.secret;
+        const headersPlaintext = isEncryptedWebhookCredential(endpoint.headers)
+            ? decryptWebhookCredential(endpoint.headers, endpoint.id, 'headers')
+            : endpoint.headers;
+        validateHeaders(headersPlaintext);
+        return {
+            id: endpoint.id,
+            urlPlaintext: endpoint.url ? (isEncryptedWebhookCredential(endpoint.url) ? decryptWebhookCredential(endpoint.url, endpoint.id, 'url') : endpoint.url) : undefined,
+            migrateUrl: Boolean(endpoint.url && !isEncryptedWebhookCredential(endpoint.url)),
+            secretPlaintext,
+            headersPlaintext,
+            migrateSecret: endpoint.secret !== null && !isEncryptedWebhookCredential(endpoint.secret),
+            migrateHeaders: !isEncryptedWebhookCredential(endpoint.headers),
+        };
+    });
+}
+export function inspectWebhookCredentialMigration(rows) {
+    const plans = planMigration(rows);
+    return {
+        total: plans.length,
+        pending: plans.filter((plan) => plan.migrateSecret || plan.migrateHeaders || plan.migrateUrl).length,
+    };
+}
+export async function applyWebhookCredentialMigration(store) {
+    return store.$transaction(async (transaction) => {
+        const rows = await transaction.webhookEndpoint.findMany({ orderBy: { id: 'asc' } });
+        const plans = planMigration(rows);
+        const pending = plans.filter((plan) => plan.migrateSecret || plan.migrateHeaders || plan.migrateUrl);
+        for (const plan of pending) {
+            const data = {};
+            if (plan.migrateSecret && plan.secretPlaintext !== null) {
+                data.secret = encryptWebhookCredential(plan.secretPlaintext, plan.id, 'secret');
+            }
+            if (plan.migrateUrl && plan.urlPlaintext)
+                data.url = encryptWebhookCredential(plan.urlPlaintext, plan.id, 'url');
+            if (plan.migrateHeaders) {
+                data.headers = encryptWebhookCredential(plan.headersPlaintext, plan.id, 'headers');
+            }
+            await transaction.webhookEndpoint.update({ where: { id: plan.id }, data });
+        }
+        const expected = new Map(plans.map((plan) => [plan.id, plan]));
+        const verified = await transaction.webhookEndpoint.findMany({ orderBy: { id: 'asc' } });
+        if (verified.length !== plans.length) {
+            throw new Error('Webhook migration verification row count changed');
+        }
+        for (const endpoint of verified) {
+            const plan = expected.get(endpoint.id);
+            if (!plan)
+                throw new Error('Webhook migration verification found an unexpected endpoint');
+            if (endpoint.secret !== null) {
+                const secret = decryptWebhookCredential(endpoint.secret, endpoint.id, 'secret');
+                if (secret !== plan.secretPlaintext)
+                    throw new Error('Webhook secret migration verification failed');
+            }
+            if (plan.urlPlaintext && (!endpoint.url || decryptWebhookCredential(endpoint.url, endpoint.id, 'url') !== plan.urlPlaintext))
+                throw new Error('Webhook URL migration verification failed');
+            const headers = decryptWebhookCredential(endpoint.headers, endpoint.id, 'headers');
+            if (headers !== plan.headersPlaintext)
+                throw new Error('Webhook header migration verification failed');
+        }
+        return { total: plans.length, migrated: pending.length };
+    }, { maxWait: 5_000, timeout: 60_000 });
+}
+//# sourceMappingURL=webhook-credential-migration.js.map

package/dist/services/webhook-security.js

@@ -0,0 +1,242 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+import { promises as dns } from 'node:dns';
+import { request as httpsRequest } from 'node:https';
+import { BlockList, isIP } from 'node:net';
+const ENVELOPE_PREFIX = 'magnus-webhook:v1';
+const MAX_REDIRECTS = 0;
+const MAX_RESPONSE_BYTES = 2_048;
+const blockedAddresses = new BlockList();
+for (const [network, prefix] of [
+    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8],
+    ['169.254.0.0', 16], ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24],
+    ['192.168.0.0', 16], ['198.18.0.0', 15], ['198.51.100.0', 24],
+    ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4],
+])
+    blockedAddresses.addSubnet(network, prefix, 'ipv4');
+for (const [network, prefix] of [
+    ['::', 128], ['::1', 128], ['64:ff9b::', 96], ['100::', 64],
+    ['2001::', 23], ['2001:db8::', 32], ['2002::', 16], ['3fff::', 20],
+    ['fc00::', 7], ['fe80::', 10], ['ff00::', 8],
+])
+    blockedAddresses.addSubnet(network, prefix, 'ipv6');
+function encryptionKey(raw = process.env['WEBHOOK_ENCRYPTION_KEY']) {
+    if (!raw || Buffer.byteLength(raw, 'utf8') < 32) {
+        throw new Error('WEBHOOK_ENCRYPTION_KEY must be a dedicated secret of at least 32 bytes');
+    }
+    return createHash('sha256')
+        .update('magnus:webhook-credential-store:v1\0')
+        .update(raw, 'utf8')
+        .digest();
+}
+function aad(endpointId, field) {
+    if (!endpointId)
+        throw new Error('Webhook endpoint ID is required for credential encryption');
+    return Buffer.from(`${ENVELOPE_PREFIX}\0${endpointId}\0${field}`, 'utf8');
+}
+export function isEncryptedWebhookCredential(value) {
+    return value.startsWith(`${ENVELOPE_PREFIX}:`);
+}
+export function encryptWebhookCredential(value, endpointId, field, keyMaterial) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', encryptionKey(keyMaterial), iv);
+    cipher.setAAD(aad(endpointId, field));
+    const ciphertext = Buffer.concat([cipher.update(value, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return `${ENVELOPE_PREFIX}:${iv.toString('base64url')}:${tag.toString('base64url')}:${ciphertext.toString('base64url')}`;
+}
+export function decryptWebhookCredential(envelope, endpointId, field, keyMaterial) {
+    if (!isEncryptedWebhookCredential(envelope)) {
+        throw new Error(`Webhook ${field} is not encrypted; run the webhook credential migration`);
+    }
+    const parts = envelope.split(':');
+    if (parts.length !== 5 || parts[0] !== 'magnus-webhook' || parts[1] !== 'v1') {
+        throw new Error(`Webhook ${field} has a malformed encrypted envelope`);
+    }
+    const iv = Buffer.from(parts[2] ?? '', 'base64url');
+    const tag = Buffer.from(parts[3] ?? '', 'base64url');
+    const ciphertext = Buffer.from(parts[4] ?? '', 'base64url');
+    if (iv.length !== 12 || tag.length !== 16) {
+        throw new Error(`Webhook ${field} has a malformed encrypted envelope`);
+    }
+    const decipher = createDecipheriv('aes-256-gcm', encryptionKey(keyMaterial), iv);
+    decipher.setAAD(aad(endpointId, field));
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+}
+function canonicalOrigin(url) {
+    const hostname = url.hostname.toLowerCase().replace(/\.$/, '');
+    return `https://${hostname}${url.port ? `:${url.port}` : ''}`;
+}
+function allowedOrigins(raw = process.env['WEBHOOK_ALLOWED_ORIGINS'] ?? '') {
+    const values = raw.split(',').map((value) => value.trim()).filter(Boolean);
+    return new Set(values.map((value) => {
+        const url = new URL(value);
+        if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash
+            || (url.pathname !== '/' && url.pathname !== '') || isIP(url.hostname.replace(/^\[|\]$/g, '')) !== 0) {
+            throw new Error('WEBHOOK_ALLOWED_ORIGINS must contain exact HTTPS DNS origins');
+        }
+        return canonicalOrigin(url);
+    }));
+}
+function isPublicAddress(address, family) {
+    if (family === 4)
+        return !blockedAddresses.check(address, 'ipv4');
+    if (family !== 6 || blockedAddresses.check(address, 'ipv6'))
+        return false;
+    const first = Number.parseInt(address.split(':', 1)[0] ?? '', 16);
+    return Number.isFinite(first) && first >= 0x2000 && first <= 0x3fff;
+}
+const defaultLookup = async (hostname) => dns.lookup(hostname, { all: true, verbatim: true });
+/** Opt-in exact address pins for enrolled tailnet receivers. This never grants
+ * access to arbitrary private, loopback or metadata addresses. DNS must still
+ * match every configured pin and the transport uses that validated answer. */
+function tailnetPins(origin) {
+    const raw = process.env['WEBHOOK_TAILNET_TARGETS_JSON'];
+    if (!raw)
+        return undefined;
+    const entries = JSON.parse(raw);
+    if (!entries || typeof entries !== 'object' || Array.isArray(entries) || Object.keys(entries).length > 16)
+        throw new Error('Invalid webhook tailnet target registry');
+    const tailnet = new BlockList();
+    tailnet.addSubnet('100.64.0.0', 10, 'ipv4');
+    for (const [key, pins] of Object.entries(entries)) {
+        if (allowedOrigins(key).size !== 1 || canonicalOrigin(new URL(key)) !== key || !Array.isArray(pins) || pins.length < 1 || pins.length > 8 ||
+            pins.some(ip => typeof ip !== 'string' || isIP(ip) !== 4 || !tailnet.check(ip, 'ipv4')))
+            throw new Error('Tailnet webhooks require exact HTTPS origins and tailnet IPv4 pins');
+    }
+    const pins = entries[origin];
+    return pins ? new Set(pins) : undefined;
+}
+export function createPinnedWebhookLookup(target) {
+    return (_hostname, options, callback) => {
+        if (options.all) {
+            callback(null, [{ address: target.address, family: target.family }]);
+            return;
+        }
+        callback(null, target.address, target.family);
+    };
+}
+async function resolveWebhookTarget(rawUrl, options = {}) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new Error('Webhook target must be a valid URL');
+    }
+    const hostname = url.hostname.toLowerCase().replace(/^\[|\]$/g, '').replace(/\.$/, '');
+    if (url.protocol !== 'https:' || url.username || url.password || url.hash
+        || !hostname || isIP(hostname) !== 0
+        || hostname === 'localhost' || hostname.endsWith('.localhost')
+        || hostname === 'metadata.google.internal' || hostname === 'instance-data') {
+        throw new Error('Webhook target must be an approved HTTPS DNS endpoint');
+    }
+    url.hostname = hostname;
+    const allowlist = allowedOrigins(options.allowedOriginsRaw);
+    if (!allowlist.has(canonicalOrigin(url))) {
+        throw new Error('Webhook target origin is not allowlisted');
+    }
+    const pins = tailnetPins(canonicalOrigin(url));
+    let addresses;
+    try {
+        addresses = await (options.lookup ?? defaultLookup)(hostname);
+    }
+    catch {
+        throw new Error('Webhook target DNS resolution failed');
+    }
+    if (addresses.length === 0
+        || addresses.some(({ address, family }) => (family !== 4 && family !== 6) ||
+            (pins ? family !== 4 || !pins.has(address) : !isPublicAddress(address, family)))) {
+        throw new Error('Webhook target resolves to a non-public address');
+    }
+    const selected = addresses[0];
+    if (!selected || (selected.family !== 4 && selected.family !== 6)) {
+        throw new Error('Webhook target DNS resolution returned an unsupported address');
+    }
+    return { url, address: selected.address, family: selected.family };
+}
+export async function validateWebhookTarget(rawUrl, options = {}) {
+    return (await resolveWebhookTarget(rawUrl, options)).url;
+}
+const pinnedHttpsTransport = async (target, init) => new Promise((resolvePromise, reject) => {
+    let settled = false;
+    const chunks = [];
+    let bytes = 0;
+    let truncated = false;
+    const finish = (status) => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(deadline);
+        const captured = Buffer.concat(chunks).toString('utf8');
+        resolvePromise({
+            ok: status >= 200 && status < 300,
+            status,
+            responseBody: truncated ? `${captured}...` : captured,
+        });
+    };
+    const request = httpsRequest(target.url, {
+        method: 'POST',
+        headers: init.headers,
+        servername: target.url.hostname,
+        family: target.family,
+        lookup: createPinnedWebhookLookup(target),
+        agent: false,
+    }, (response) => {
+        const status = response.statusCode ?? 0;
+        if (status >= 300 && status < 400) {
+            response.destroy();
+            settled = true;
+            clearTimeout(deadline);
+            reject(new Error(`Webhook redirects are rejected (limit ${MAX_REDIRECTS})`));
+            return;
+        }
+        response.on('data', (rawChunk) => {
+            if (settled)
+                return;
+            const chunk = Buffer.isBuffer(rawChunk) ? rawChunk : Buffer.from(rawChunk);
+            const remaining = MAX_RESPONSE_BYTES - bytes;
+            if (remaining > 0) {
+                chunks.push(chunk.subarray(0, remaining));
+                bytes += Math.min(chunk.length, remaining);
+            }
+            if (chunk.length > remaining) {
+                truncated = true;
+                response.destroy();
+                finish(status);
+            }
+        });
+        response.on('end', () => finish(status));
+        response.on('error', (error) => {
+            if (!settled) {
+                settled = true;
+                clearTimeout(deadline);
+                reject(error);
+            }
+        });
+    });
+    const deadline = setTimeout(() => request.destroy(new Error('Webhook request timed out')), init.timeoutMs);
+    request.on('error', (error) => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(deadline);
+        reject(error);
+    });
+    request.end(init.body);
+});
+export async function postWebhook(rawUrl, init, options = {}) {
+    const target = await resolveWebhookTarget(rawUrl, options);
+    const result = await (options.transport ?? pinnedHttpsTransport)(target, init);
+    if (result.status >= 300 && result.status < 400) {
+        throw new Error(`Webhook redirects are rejected (limit ${MAX_REDIRECTS})`);
+    }
+    const responseBytes = Buffer.from(result.responseBody, 'utf8');
+    if (responseBytes.length <= MAX_RESPONSE_BYTES)
+        return result;
+    return {
+        ...result,
+        responseBody: `${responseBytes.subarray(0, MAX_RESPONSE_BYTES).toString('utf8')}...`,
+    };
+}
+//# sourceMappingURL=webhook-security.js.map