@intranefr/superbackend 1.4.4 → 1.5.1

package/src/services/rbac.service.js

@@ -0,0 +1,212 @@
+const mongoose = require('mongoose');
+
+const OrganizationMember = require('../models/OrganizationMember');
+const RbacUserRole = require('../models/RbacUserRole');
+const RbacGroup = require('../models/RbacGroup');
+const RbacGroupMember = require('../models/RbacGroupMember');
+const RbacGroupRole = require('../models/RbacGroupRole');
+const RbacGrant = require('../models/RbacGrant');
+const { matches } = require('../utils/rbac/engine');
+
+function normalizeId(input) {
+  if (!input) return null;
+  const str = String(input);
+  if (!mongoose.Types.ObjectId.isValid(str)) return null;
+  return new mongoose.Types.ObjectId(str);
+}
+
+function normalizeRight(input) {
+  return String(input || '').trim();
+}
+
+function buildExplainItem(grant, source) {
+  if (!grant) return null;
+  return {
+    source,
+    effect: grant.effect,
+    right: grant.right,
+    subjectType: grant.subjectType,
+    subjectId: String(grant.subjectId),
+    scopeType: grant.scopeType,
+    scopeId: grant.scopeId ? String(grant.scopeId) : null,
+    id: String(grant._id),
+  };
+}
+
+function extractMatches(grants, requiredRight) {
+  const denies = [];
+  const allows = [];
+
+  for (const g of grants || []) {
+    if (!g) continue;
+    if (!matches(requiredRight, g.right)) continue;
+
+    if (g.effect === 'deny') {
+      denies.push(g);
+    } else {
+      allows.push(g);
+    }
+  }
+
+  return { denies, allows };
+}
+
+async function getUserOrgIds(userId) {
+  const uid = normalizeId(userId);
+  if (!uid) return [];
+  const rows = await OrganizationMember.find({ userId: uid, status: 'active' }).select('orgId').lean();
+  return rows.map((r) => String(r.orgId));
+}
+
+async function getEffectiveGrants({ userId, orgId }) {
+  const uid = normalizeId(userId);
+  const oid = normalizeId(orgId);
+  if (!uid || !oid) {
+    return {
+      grants: [],
+      layers: { org: [], group: [], role: [], user: [] },
+      explain: [],
+      context: { roles: [], groups: [] },
+      orgMember: null,
+    };
+  }
+
+  const orgMember = await OrganizationMember.findOne({ userId: uid, orgId: oid, status: 'active' }).lean();
+  if (!orgMember) {
+    return {
+      grants: [],
+      layers: { org: [], group: [], role: [], user: [] },
+      explain: [],
+      context: { roles: [], groups: [] },
+      orgMember: null,
+    };
+  }
+
+  const [userRoleLinks, groupLinks, orgGrantsGlobal, orgGrantsOrg] = await Promise.all([
+    RbacUserRole.find({ userId: uid }).select('roleId').lean(),
+    RbacGroupMember.find({ userId: uid }).select('groupId').lean(),
+    RbacGrant.find({ subjectType: 'org', subjectId: oid, scopeType: 'global' }).lean(),
+    RbacGrant.find({ subjectType: 'org', subjectId: oid, scopeType: 'org', scopeId: oid }).lean(),
+  ]);
+
+  const directRoleIds = userRoleLinks.map((r) => r.roleId).filter(Boolean);
+  const groupIds = groupLinks.map((g) => g.groupId).filter(Boolean);
+
+  const groups = groupIds.length
+    ? await RbacGroup.find({ _id: { $in: groupIds }, status: 'active' }).select('_id isGlobal orgId').lean()
+    : [];
+
+  const allowedGroupIds = [];
+  for (const g of groups) {
+    if (g.isGlobal) {
+      allowedGroupIds.push(g._id);
+      continue;
+    }
+    if (g.orgId && String(g.orgId) === String(oid)) {
+      allowedGroupIds.push(g._id);
+    }
+  }
+
+  const groupRoleLinks = allowedGroupIds.length
+    ? await RbacGroupRole.find({ groupId: { $in: allowedGroupIds } }).select('groupId roleId').lean()
+    : [];
+
+  const groupRoleIds = groupRoleLinks.map((l) => l.roleId).filter(Boolean);
+  const effectiveRoleIds = Array.from(new Set([...directRoleIds, ...groupRoleIds]));
+
+  const [userGrantsGlobal, userGrantsOrg, roleGrantsGlobal, roleGrantsOrg, groupGrantsGlobal, groupGrantsOrg] = await Promise.all([
+    RbacGrant.find({ subjectType: 'user', subjectId: uid, scopeType: 'global' }).lean(),
+    RbacGrant.find({ subjectType: 'user', subjectId: uid, scopeType: 'org', scopeId: oid }).lean(),
+    effectiveRoleIds.length ? RbacGrant.find({ subjectType: 'role', subjectId: { $in: effectiveRoleIds }, scopeType: 'global' }).lean() : [],
+    effectiveRoleIds.length ? RbacGrant.find({ subjectType: 'role', subjectId: { $in: effectiveRoleIds }, scopeType: 'org', scopeId: oid }).lean() : [],
+    allowedGroupIds.length ? RbacGrant.find({ subjectType: 'group', subjectId: { $in: allowedGroupIds }, scopeType: 'global' }).lean() : [],
+    allowedGroupIds.length ? RbacGrant.find({ subjectType: 'group', subjectId: { $in: allowedGroupIds }, scopeType: 'org', scopeId: oid }).lean() : [],
+  ]);
+
+  const layers = {
+    org: [...orgGrantsGlobal, ...orgGrantsOrg],
+    group: [...groupGrantsGlobal, ...groupGrantsOrg],
+    role: [...roleGrantsGlobal, ...roleGrantsOrg],
+    user: [...userGrantsGlobal, ...userGrantsOrg],
+  };
+
+  const all = [...layers.org, ...layers.group, ...layers.role, ...layers.user];
+
+  const explain = [];
+  for (const g of userGrantsGlobal) explain.push(buildExplainItem(g, 'user:global'));
+  for (const g of userGrantsOrg) explain.push(buildExplainItem(g, 'user:org'));
+  for (const g of roleGrantsGlobal) explain.push(buildExplainItem(g, 'role:global'));
+  for (const g of roleGrantsOrg) explain.push(buildExplainItem(g, 'role:org'));
+  for (const g of groupGrantsGlobal) explain.push(buildExplainItem(g, 'group:global'));
+  for (const g of groupGrantsOrg) explain.push(buildExplainItem(g, 'group:org'));
+  for (const g of orgGrantsGlobal) explain.push(buildExplainItem(g, 'org:global'));
+  for (const g of orgGrantsOrg) explain.push(buildExplainItem(g, 'org:org'));
+
+  const context = {
+    groups: groups.map((g) => ({
+      id: String(g._id),
+      isGlobal: !!g.isGlobal,
+      orgId: g.orgId ? String(g.orgId) : null,
+    })),
+    roles: [
+      ...directRoleIds.map((rid) => ({ roleId: String(rid), source: 'user' })),
+      ...groupRoleLinks.map((l) => ({ roleId: String(l.roleId), source: 'group', groupId: String(l.groupId) })),
+    ],
+  };
+
+  return { grants: all, layers, explain: explain.filter(Boolean), context, orgMember };
+}
+
+async function checkRight({ userId, orgId, right }) {
+  const r = normalizeRight(right);
+  if (!r) {
+    return { allowed: false, reason: 'invalid_right', explain: [], context: null, decisionLayer: null };
+  }
+
+  const { layers, explain, context, orgMember } = await getEffectiveGrants({ userId, orgId });
+  if (!orgMember) {
+    return { allowed: false, reason: 'not_org_member', explain: [], context: null, decisionLayer: null };
+  }
+
+  const denyMatches = [];
+  for (const [layerName, grants] of Object.entries(layers || {})) {
+    const { denies } = extractMatches(grants, r);
+    for (const d of denies) denyMatches.push({ layerName, grant: d });
+  }
+
+  if (denyMatches.length) {
+    const matchedIds = new Set(denyMatches.map((m) => String(m.grant._id)));
+    const filteredExplain = explain.filter((e) => matchedIds.has(String(e.id)));
+    return {
+      allowed: false,
+      reason: 'denied',
+      decisionLayer: 'deny',
+      explain: filteredExplain,
+      context,
+    };
+  }
+
+  const allowPriority = ['org', 'group', 'role', 'user'];
+  for (const layer of allowPriority) {
+    const { allows } = extractMatches(layers?.[layer] || [], r);
+    if (!allows.length) continue;
+
+    const matchedIds = new Set(allows.map((a) => String(a._id)));
+    const filteredExplain = explain.filter((e) => matchedIds.has(String(e.id)));
+    return {
+      allowed: true,
+      reason: 'allowed',
+      decisionLayer: layer,
+      explain: filteredExplain,
+      context,
+    };
+  }
+
+  return { allowed: false, reason: 'no_match', explain: [], context, decisionLayer: null };
+}
+
+module.exports = {
+  getUserOrgIds,
+  getEffectiveGrants,
+  checkRight,
+};

package/src/services/scriptsRunner.service.js

@@ -0,0 +1,259 @@
+const { EventEmitter } = require('events');
+const { spawn } = require('child_process');
+const { NodeVM } = require('vm2');
+
+const ScriptRun = require('../models/ScriptRun');
+
+const MAX_TAIL_BYTES = 64 * 1024;
+
+function nowIso() {
+  return new Date().toISOString();
+}
+
+function appendTail(prev, chunk) {
+  const next = String(prev || '') + String(chunk || '');
+  const buf = Buffer.from(next, 'utf8');
+  if (buf.length <= MAX_TAIL_BYTES) return next;
+  return buf.slice(buf.length - MAX_TAIL_BYTES).toString('utf8');
+}
+
+function safeJsonParse(str) {
+  try {
+    return JSON.parse(String(str || ''));
+  } catch {
+    return null;
+  }
+}
+
+function buildEnvPairs(env) {
+  const pairs = Array.isArray(env) ? env : [];
+  const out = {};
+  for (const item of pairs) {
+    if (!item || typeof item !== 'object') continue;
+    const key = String(item.key || '').trim();
+    if (!key) continue;
+    const value = String(item.value || '');
+    out[key] = value;
+  }
+  return out;
+}
+
+class RunBus {
+  constructor(runId) {
+    this.runId = String(runId);
+    this.emitter = new EventEmitter();
+    this.seq = 0;
+    this.buffer = [];
+    this.closed = false;
+  }
+
+  push(event) {
+    if (this.closed) return;
+    this.seq += 1;
+    const payload = { seq: this.seq, ...event };
+    this.buffer.push(payload);
+    if (this.buffer.length > 2000) this.buffer.shift();
+    this.emitter.emit('event', payload);
+  }
+
+  close() {
+    this.closed = true;
+    this.emitter.emit('close');
+  }
+
+  snapshot(sinceSeq) {
+    const since = Number(sinceSeq || 0);
+    return this.buffer.filter((e) => Number(e.seq) > since);
+  }
+}
+
+const runs = new Map();
+
+function getRunBus(runId) {
+  return runs.get(String(runId)) || null;
+}
+
+async function startRun(scriptDef, options) {
+  const trigger = options?.trigger || 'manual';
+  const meta = options?.meta || null;
+
+  const runDoc = await ScriptRun.create({
+    scriptId: scriptDef._id,
+    status: 'queued',
+    trigger,
+    startedAt: null,
+    finishedAt: null,
+    exitCode: null,
+    outputTail: '',
+    meta,
+  });
+
+  const bus = new RunBus(runDoc._id);
+  runs.set(String(runDoc._id), bus);
+
+  setImmediate(async () => {
+    try {
+      await ScriptRun.updateOne(
+        { _id: runDoc._id },
+        { $set: { status: 'running', startedAt: new Date() } },
+      );
+
+      bus.push({ type: 'status', ts: nowIso(), status: 'running' });
+
+      const timeoutMs = Number(scriptDef.timeoutMs || 0) || 5 * 60 * 1000;
+      const env = { ...process.env, ...buildEnvPairs(scriptDef.env) };
+      const cwd = String(scriptDef.defaultWorkingDirectory || '').trim() || undefined;
+
+      let exitCode = 0;
+
+      if (scriptDef.type === 'bash') {
+        if (scriptDef.runner !== 'host') {
+          throw Object.assign(new Error('bash scripts only support host runner'), { code: 'VALIDATION' });
+        }
+        exitCode = await runSpawned({
+          runId: runDoc._id,
+          bus,
+          command: 'bash',
+          args: ['-lc', scriptDef.script],
+          env,
+          cwd,
+          timeoutMs,
+        });
+      } else if (scriptDef.type === 'node') {
+        if (scriptDef.runner === 'vm2') {
+          exitCode = await runVm2({ runId: runDoc._id, bus, code: scriptDef.script, timeoutMs });
+        } else if (scriptDef.runner === 'host') {
+          exitCode = await runSpawned({
+            runId: runDoc._id,
+            bus,
+            command: 'node',
+            args: ['-e', scriptDef.script],
+            env,
+            cwd,
+            timeoutMs,
+          });
+        } else {
+          throw Object.assign(new Error('Invalid runner for node script'), { code: 'VALIDATION' });
+        }
+      } else if (scriptDef.type === 'browser') {
+        throw Object.assign(new Error('browser scripts run in the UI only'), { code: 'VALIDATION' });
+      } else {
+        throw Object.assign(new Error('Unsupported script type'), { code: 'VALIDATION' });
+      }
+
+      const finalStatus = exitCode === 0 ? 'succeeded' : 'failed';
+      await ScriptRun.updateOne(
+        { _id: runDoc._id },
+        { $set: { status: finalStatus, finishedAt: new Date(), exitCode } },
+      );
+
+      bus.push({ type: 'status', ts: nowIso(), status: finalStatus, exitCode });
+      bus.push({ type: 'done', ts: nowIso(), status: finalStatus, exitCode });
+      bus.close();
+
+      setTimeout(() => {
+        runs.delete(String(runDoc._id));
+      }, 5 * 60 * 1000).unref();
+    } catch (err) {
+      const msg = err?.message || 'Run failed';
+      await ScriptRun.updateOne(
+        { _id: runDoc._id },
+        { $set: { status: 'failed', finishedAt: new Date(), exitCode: 1 }, $setOnInsert: {} },
+      );
+      bus.push({ type: 'log', ts: nowIso(), stream: 'stderr', line: msg + '\n' });
+      bus.push({ type: 'status', ts: nowIso(), status: 'failed', exitCode: 1 });
+      bus.push({ type: 'done', ts: nowIso(), status: 'failed', exitCode: 1 });
+      bus.close();
+
+      setTimeout(() => {
+        runs.delete(String(runDoc._id));
+      }, 5 * 60 * 1000).unref();
+    }
+  });
+
+  return runDoc;
+}
+
+async function runSpawned({ runId, bus, command, args, env, cwd, timeoutMs }) {
+  return await new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      env,
+      cwd,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+
+    let tail = '';
+
+    const killTimer = setTimeout(() => {
+      try {
+        child.kill('SIGKILL');
+      } catch {}
+    }, timeoutMs);
+    killTimer.unref();
+
+    const onData = async (stream, chunk) => {
+      const s = chunk.toString('utf8');
+      tail = appendTail(tail, s);
+      bus.push({ type: 'log', ts: nowIso(), stream, line: s });
+      await ScriptRun.updateOne({ _id: runId }, { $set: { outputTail: tail } });
+    };
+
+    child.stdout.on('data', (c) => onData('stdout', c));
+    child.stderr.on('data', (c) => onData('stderr', c));
+
+    child.on('error', (err) => {
+      clearTimeout(killTimer);
+      reject(err);
+    });
+
+    child.on('close', (code) => {
+      clearTimeout(killTimer);
+      resolve(Number(code || 0));
+    });
+  });
+}
+
+async function runVm2({ runId, bus, code, timeoutMs }) {
+  let tail = '';
+
+  function pushLog(stream, line) {
+    const s = String(line || '');
+    tail = appendTail(tail, s);
+    bus.push({ type: 'log', ts: nowIso(), stream, line: s });
+    return ScriptRun.updateOne({ _id: runId }, { $set: { outputTail: tail } });
+  }
+
+  const vm = new NodeVM({
+    console: 'redirect',
+    sandbox: {},
+    require: {
+      external: false,
+      builtin: [],
+    },
+    timeout: timeoutMs,
+    eval: false,
+    wasm: false,
+  });
+
+  vm.on('console.log', (...args) => {
+    pushLog('stdout', args.map((a) => (typeof a === 'string' ? a : JSON.stringify(a))).join(' ') + '\n');
+  });
+  vm.on('console.error', (...args) => {
+    pushLog('stderr', args.map((a) => (typeof a === 'string' ? a : JSON.stringify(a))).join(' ') + '\n');
+  });
+
+  try {
+    vm.run(code, 'script.vm2.js');
+    return 0;
+  } catch (err) {
+    const msg = err?.message || 'vm2 error';
+    await pushLog('stderr', msg + '\n');
+    return 1;
+  }
+}
+
+module.exports = {
+  startRun,
+  getRunBus,
+  safeJsonParse,
+};

package/src/services/terminals.service.js

@@ -0,0 +1,152 @@
+const crypto = require('crypto');
+const pty = require('node-pty');
+
+const sessions = new Map();
+
+const MAX_SESSIONS = 20;
+const IDLE_TTL_MS = 15 * 60 * 1000;
+
+function now() {
+  return Date.now();
+}
+
+function newId() {
+  return crypto.randomBytes(16).toString('hex');
+}
+
+function listSessions() {
+  return Array.from(sessions.values())
+    .map((s) => ({
+      sessionId: s.sessionId,
+      status: s.status,
+      createdAt: s.createdAt,
+      lastActivityAt: s.lastActivityAt,
+      cols: s.cols,
+      rows: s.rows,
+    }))
+    .sort((a, b) => b.createdAt - a.createdAt);
+}
+
+function getSession(sessionId) {
+  return sessions.get(String(sessionId)) || null;
+}
+
+function createSession(options = {}) {
+  if (sessions.size >= MAX_SESSIONS) {
+    const err = new Error('Too many active terminal sessions');
+    err.code = 'LIMIT';
+    throw err;
+  }
+
+  const cols = Number(options.cols || 120);
+  const rows = Number(options.rows || 30);
+
+  const shell = process.env.SHELL || 'bash';
+
+  const p = pty.spawn(shell, [], {
+    name: 'xterm-256color',
+    cols,
+    rows,
+    cwd: process.cwd(),
+    env: process.env,
+  });
+
+  const sessionId = newId();
+  const s = {
+    sessionId,
+    pty: p,
+    status: 'running',
+    createdAt: now(),
+    lastActivityAt: now(),
+    cols,
+    rows,
+  };
+
+  p.onExit(() => {
+    const cur = sessions.get(sessionId);
+    if (cur) {
+      cur.status = 'closed';
+      cur.lastActivityAt = now();
+    }
+  });
+
+  sessions.set(sessionId, s);
+
+  return { sessionId };
+}
+
+function touch(sessionId) {
+  const s = sessions.get(String(sessionId));
+  if (!s) return;
+  s.lastActivityAt = now();
+}
+
+function resizeSession(sessionId, cols, rows) {
+  const s = getSession(sessionId);
+  if (!s || s.status !== 'running') return;
+  const c = Number(cols || 0);
+  const r = Number(rows || 0);
+  if (!c || !r) return;
+  s.cols = c;
+  s.rows = r;
+  s.lastActivityAt = now();
+  try {
+    s.pty.resize(c, r);
+  } catch {}
+}
+
+function writeSession(sessionId, data) {
+  const s = getSession(sessionId);
+  if (!s || s.status !== 'running') return;
+  s.lastActivityAt = now();
+  try {
+    s.pty.write(String(data || ''));
+  } catch {}
+}
+
+function killSession(sessionId) {
+  const s = getSession(sessionId);
+  if (!s) {
+    const err = new Error('Session not found');
+    err.code = 'NOT_FOUND';
+    throw err;
+  }
+
+  try {
+    s.pty.kill();
+  } catch {}
+
+  sessions.delete(String(sessionId));
+  return { ok: true };
+}
+
+function cleanupIdleSessions() {
+  const cutoff = now() - IDLE_TTL_MS;
+  for (const [id, s] of sessions.entries()) {
+    if (s.lastActivityAt < cutoff) {
+      try {
+        s.pty.kill();
+      } catch {}
+      sessions.delete(id);
+    }
+  }
+}
+
+let cleanupTimer = null;
+function ensureCleanupTimer() {
+  if (cleanupTimer) return;
+  cleanupTimer = setInterval(cleanupIdleSessions, 60 * 1000);
+  cleanupTimer.unref();
+}
+
+ensureCleanupTimer();
+
+module.exports = {
+  createSession,
+  listSessions,
+  getSession,
+  killSession,
+  writeSession,
+  resizeSession,
+  touch,
+};