@hivemagnus/magnus-server 1.1.12 → 2.0.0

package/dist/services/security-fusion-outbox.js

@@ -1,185 +0,0 @@
-import { getDb } from '../db/index.js';
-import { enqueueCommand } from '../queue/workers.js';
-import { securityFusionActionSources } from './security-fusion-actions.js';
-const OUTBOX_LEASE_MS = 30_000;
-const OUTBOX_INTERVAL_MS = 2_000;
-/**
- * Absolute path of an operator-installed containment helper on managed nodes
- * (`SECURITY_FUSION_CONTAINMENT_COMMAND`). Magnus does not ship one; without it
- * release records fail closed and stay visible for manual handling.
- */
-function containmentCommand() {
-    const command = process.env['SECURITY_FUSION_CONTAINMENT_COMMAND']?.trim() ?? '';
-    if (!/^\/[A-Za-z0-9._/-]{1,255}$/.test(command) || command.includes('..'))
-        throw new Error('SECURITY_FUSION_CONTAINMENT_COMMAND is not configured');
-    return command;
-}
-function containmentArgs(operation) {
-    if (operation !== 'release')
-        throw new Error('Embedded containment execute authority is retired');
-    return ['release'];
-}
-async function dispatchOutboxRecord(outboxId) {
-    const db = getDb();
-    const now = new Date();
-    const claimed = await db.securityFusionCommandOutbox.updateMany({
-        where: {
-            id: outboxId,
-            operation: 'release',
-            OR: [
-                { status: { in: ['pending', 'failed'] }, nextAttemptAt: { lte: now } },
-                { status: 'dispatching', leaseExpiresAt: { lt: now } },
-            ],
-        },
-        data: {
-            status: 'dispatching',
-            leaseExpiresAt: new Date(now.getTime() + OUTBOX_LEASE_MS),
-            attempts: { increment: 1 },
-            lastError: null,
-        },
-    });
-    if (claimed.count !== 1)
-        return false;
-    const outbox = await db.securityFusionCommandOutbox.findUnique({ where: { id: outboxId } });
-    const action = outbox
-        ? await db.securityFusionAction.findUnique({ where: { id: outbox.actionId } })
-        : null;
-    if (!outbox || !action)
-        throw new Error('Security Fusion outbox references a missing action');
-    const node = await db.node.findUnique({ where: { id: action.nodeId } });
-    if (!node)
-        throw new Error('Security Fusion containment target no longer exists');
-    const command = containmentCommand();
-    const args = containmentArgs(outbox.operation);
-    const idempotencyKey = `security-fusion:${action.id}:${node.id}:${outbox.operation}`;
-    const remote = await db.remoteCommand.upsert({
-        where: { idempotencyKey },
-        create: {
-            nodeId: node.id,
-            command,
-            args: JSON.stringify(args),
-            environment: '{}',
-            timeoutSeconds: 120,
-            status: 'QUEUED',
-            riskLevel: 'high',
-            idempotencyKey,
-            correlationId: outbox.id,
-            createdBy: outbox.actorId,
-        },
-        update: {},
-    });
-    await db.securityFusionCommandOutbox.update({
-        where: { id: outbox.id },
-        data: { remoteCommandId: remote.id },
-    });
-    await enqueueCommand(remote.id);
-    await db.$transaction([
-        db.securityFusionCommandOutbox.update({
-            where: { id: outbox.id },
-            data: {
-                status: 'dispatched',
-                leaseExpiresAt: null,
-                lastError: null,
-                dispatchedAt: new Date(),
-            },
-        }),
-        db.securityFusionAction.updateMany({
-            where: {
-                id: action.id,
-                status: {
-                    in: securityFusionActionSources('releasing'),
-                },
-            },
-            data: {
-                status: 'releasing',
-                resultJson: JSON.stringify({
-                    commandId: remote.id,
-                    outboxId: outbox.id,
-                    operation: outbox.operation,
-                }),
-            },
-        }),
-    ]);
-    return true;
-}
-export async function dispatchSecurityFusionOutbox() {
-    const db = getDb();
-    const now = new Date();
-    // Initial containment belongs exclusively to the standalone Security Fusion
-    // service. Keep only the independent emergency release path in this embedded
-    // compatibility service, and quarantine any row old code could retry.
-    await db.securityFusionCommandOutbox.updateMany({
-        where: {
-            operation: 'execute',
-            status: { in: ['pending', 'failed'] },
-        },
-        data: {
-            status: 'blocked',
-            leaseExpiresAt: null,
-            lastError: 'Embedded execute quarantined; standalone Security Fusion approval is required',
-        },
-    });
-    await db.securityFusionCommandOutbox.updateMany({
-        where: {
-            operation: 'execute',
-            status: { in: ['dispatching', 'unknown'] },
-        },
-        data: {
-            status: 'blocked',
-            leaseExpiresAt: null,
-            lastError: 'Embedded execute quarantined; execution may have occurred; do not retry',
-        },
-    });
-    const records = await db.securityFusionCommandOutbox.findMany({
-        where: {
-            operation: 'release',
-            OR: [
-                { status: { in: ['pending', 'failed'] }, nextAttemptAt: { lte: now } },
-                { status: 'dispatching', leaseExpiresAt: { lt: now } },
-            ],
-        },
-        orderBy: { createdAt: 'asc' },
-        take: 20,
-    });
-    let dispatched = 0;
-    for (const record of records) {
-        try {
-            if (await dispatchOutboxRecord(record.id))
-                dispatched += 1;
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            const retryDelay = Math.min(60_000, 1_000 * (2 ** Math.min(record.attempts, 6)));
-            await db.securityFusionCommandOutbox.updateMany({
-                where: { id: record.id, status: 'dispatching' },
-                data: {
-                    status: 'failed',
-                    leaseExpiresAt: null,
-                    lastError: message.slice(0, 1000),
-                    nextAttemptAt: new Date(Date.now() + retryDelay),
-                },
-            });
-            console.error(`[security-fusion] outbox dispatch failed for ${record.id}: ${message}`);
-        }
-    }
-    return dispatched;
-}
-let dispatcherTimer = null;
-export function startSecurityFusionOutboxDispatcher() {
-    if (dispatcherTimer)
-        return;
-    const dispatch = () => {
-        void dispatchSecurityFusionOutbox().catch((error) => {
-            console.error('[security-fusion] outbox scan failed', error instanceof Error ? error.message : String(error));
-        });
-    };
-    dispatch();
-    dispatcherTimer = setInterval(dispatch, OUTBOX_INTERVAL_MS);
-    dispatcherTimer.unref();
-}
-export function stopSecurityFusionOutboxDispatcher() {
-    if (dispatcherTimer)
-        clearInterval(dispatcherTimer);
-    dispatcherTimer = null;
-}
-//# sourceMappingURL=security-fusion-outbox.js.map

package/dist/services/security-fusion-receipt-chain.js

@@ -1,134 +0,0 @@
-import { createHmac, createHash } from 'node:crypto';
-import { appendFile, chmod, lstat, mkdir, open } from 'node:fs/promises';
-import { dirname, resolve } from 'node:path';
-import { getDb } from '../db/index.js';
-function canonicalJson(value) {
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(',')}]`;
-    if (value && typeof value === 'object') {
-        return `{${Object.entries(value)
-            .sort(([a], [b]) => a.localeCompare(b))
-            .map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(',')}}`;
-    }
-    return JSON.stringify(value);
-}
-export function deletionReceiptHash(input, previousReceiptSha256, chainSequence) {
-    return createHash('sha256').update(canonicalJson({
-        resourceType: input.resourceType,
-        resourceIdHash: input.resourceIdHash,
-        reason: input.reason,
-        outcome: input.outcome,
-        bytesDeleted: input.bytesDeleted,
-        detail: JSON.parse(input.detailJson),
-        deletedAt: input.deletedAt.toISOString(),
-        previousReceiptSha256,
-        chainSequence,
-        chainVersion: 2,
-    })).digest('hex');
-}
-/**
- * Append receipts while holding the singleton PostgreSQL chain-head row lock.
- * This serializes all writers across Control API processes.
- */
-export async function appendDeletionReceipts(tx, inputs) {
-    const [head] = await tx.$queryRaw `
-    SELECT "headSha256", "chainSequence"
-    FROM "security_fusion_receipt_chain_heads"
-    WHERE "id" = 'security-fusion'
-    FOR UPDATE
-  `;
-    if (!head)
-        throw new Error('Security Fusion receipt chain head is missing');
-    let previousReceiptSha256 = head.headSha256;
-    let chainSequence = head.chainSequence;
-    for (const input of inputs) {
-        chainSequence += 1;
-        const receiptSha256 = deletionReceiptHash(input, previousReceiptSha256, chainSequence);
-        await tx.securityFusionDeletionReceipt.create({
-            data: {
-                ...input,
-                receiptSha256,
-                previousReceiptSha256,
-                chainSequence,
-                chainVersion: 2,
-            },
-        });
-        previousReceiptSha256 = receiptSha256;
-    }
-    if (inputs.length > 0) {
-        await tx.securityFusionReceiptChainHead.update({
-            where: { id: 'security-fusion' },
-            data: { headSha256: previousReceiptSha256, chainSequence },
-        });
-    }
-    return { headSha256: previousReceiptSha256, chainSequence };
-}
-function chainHeadExportPath() {
-    return resolve(process.env['SECURITY_FUSION_RECEIPT_CHAIN_EXPORT']
-        ?? './state/security-fusion/receipt-chain-heads.jsonl');
-}
-/** Durably export the current chain head outside the mutable database. */
-export async function exportReceiptChainHead(head) {
-    const current = head ?? await getDb().securityFusionReceiptChainHead.findUnique({
-        where: { id: 'security-fusion' },
-        select: { headSha256: true, chainSequence: true },
-    });
-    if (!current)
-        throw new Error('Security Fusion receipt chain head is missing');
-    const path = chainHeadExportPath();
-    const directory = dirname(path);
-    await mkdir(directory, { recursive: true, mode: 0o700 });
-    const expectedUid = typeof process.geteuid === 'function' ? process.geteuid() : null;
-    const directoryInfo = await lstat(directory);
-    if (!directoryInfo.isDirectory() || directoryInfo.isSymbolicLink()
-        || (expectedUid !== null && directoryInfo.uid !== expectedUid)) {
-        throw new Error('Security Fusion receipt chain export directory is unsafe');
-    }
-    await chmod(directory, 0o700);
-    try {
-        const info = await lstat(path);
-        if (!info.isFile() || info.isSymbolicLink()
-            || (expectedUid !== null && info.uid !== expectedUid)
-            || (info.mode & 0o777) !== 0o600) {
-            throw new Error('Security Fusion receipt chain export must be a mode-0600 regular file');
-        }
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT')
-            throw error;
-    }
-    const exportedAt = new Date().toISOString();
-    const signingKey = process.env['SECURITY_FUSION_RECEIPT_SIGNING_KEY'];
-    if (!signingKey || signingKey.length < 32) {
-        throw new Error('SECURITY_FUSION_RECEIPT_SIGNING_KEY must contain at least 32 characters');
-    }
-    const signedPayload = canonicalJson({
-        chain: 'security-fusion',
-        chainSequence: current.chainSequence,
-        headSha256: current.headSha256,
-        exportedAt,
-    });
-    const record = {
-        chain: 'security-fusion',
-        chainSequence: current.chainSequence,
-        headSha256: current.headSha256,
-        exportedAt,
-        signatureHmacSha256: createHmac('sha256', signingKey).update(signedPayload).digest('hex'),
-    };
-    const handle = await open(path, 'a', 0o600);
-    try {
-        await appendFile(handle, `${JSON.stringify(record)}\n`, 'utf8');
-        await handle.sync();
-    }
-    finally {
-        await handle.close();
-    }
-    const directoryHandle = await open(directory, 'r');
-    try {
-        await directoryHandle.sync();
-    }
-    finally {
-        await directoryHandle.close();
-    }
-}
-//# sourceMappingURL=security-fusion-receipt-chain.js.map