@k2b/cloud 0.42.0 → 0.44.0

package/src/services/accounts/directory-shares.ts

@@ -0,0 +1,157 @@
+import { err, fail, ok, type Result } from "@k2b/stdlib";
+import { sql } from "bun";
+import { z } from "zod";
+import type { User } from "../../contracts/shared";
+import type { RequestActor } from "../../server/middleware/auth";
+import { audit } from "../audit";
+
+import * as entities from "./entities";
+
+export const DirectorySharePrincipalSchema = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("user"), userId: z.uuid() }).strict(),
+  z.object({ type: z.literal("group"), groupId: z.uuid() }).strict(),
+  z.object({ type: z.literal("service_account"), serviceAccountId: z.uuid() }).strict(),
+]);
+type DirectorySharePrincipal = z.infer<typeof DirectorySharePrincipalSchema>;
+type Administrator = Pick<User, "id" | "uid" | "provider" | "roles">;
+const administrator = (actor: Administrator) => actor.roles.includes("admin");
+const auditActor = (actor: Administrator) => ({ userId: actor.id, uid: actor.uid, provider: actor.provider, roles: actor.roles });
+const recipientExists = async (id: string) => {
+  const [row] = await sql`SELECT id FROM auth.service_accounts WHERE id=${id}::uuid AND kind IN ('standalone','agent')`;
+  return Boolean(row);
+};
+
+export const directoryShares = {
+  list: async (params: { actor: Administrator; recipientId: string; page: number; perPage: number }) => {
+    if (!administrator(params.actor)) return fail(err.forbidden("Administrator access required"));
+    if (!(await recipientExists(params.recipientId))) return fail(err.notFound("Service account"));
+    const rows = await sql<
+      {
+        id: string;
+        user_id: string | null;
+        group_id: string | null;
+        service_account_id: string | null;
+        label: string;
+        service_account_kind: string | null;
+        total: number;
+      }[]
+    >`SELECT share.id, share.user_id, share.group_id, share.service_account_id,
+        COALESCE(NULLIF(u.display_name,''),u.uid,g.name,sa.name) AS label,
+        sa.kind AS service_account_kind, count(*) OVER()::int AS total
+      FROM auth.directory_shares share
+      LEFT JOIN auth.users u ON u.id=share.user_id
+      LEFT JOIN auth.groups g ON g.id=share.group_id
+      LEFT JOIN auth.service_accounts sa ON sa.id=share.service_account_id
+      WHERE share.recipient_id=${params.recipientId}::uuid
+      ORDER BY share.created_at, share.id
+      LIMIT ${params.perPage} OFFSET ${(params.page - 1) * params.perPage}`;
+    const total =
+      rows[0]?.total ??
+      (
+        await sql<
+          { total: number }[]
+        >`SELECT count(*)::int AS total FROM auth.directory_shares WHERE recipient_id=${params.recipientId}::uuid`
+      )[0]!.total;
+    return ok({
+      items: rows.map((row) => ({
+        id: row.id,
+        label: row.label,
+        serviceAccountKind: row.service_account_kind,
+        principal: row.user_id
+          ? { type: "user" as const, userId: row.user_id }
+          : row.group_id
+            ? { type: "group" as const, groupId: row.group_id }
+            : { type: "service_account" as const, serviceAccountId: row.service_account_id! },
+      })),
+      total,
+      page: params.page,
+      perPage: params.perPage,
+    });
+  },
+  grant: async (params: {
+    actor: Administrator;
+    recipientId: string;
+    principal: DirectorySharePrincipal;
+  }): Promise<Result<{ id: string }>> => {
+    if (!administrator(params.actor)) return fail(err.forbidden("Administrator access required"));
+    const principal = DirectorySharePrincipalSchema.safeParse(params.principal);
+    if (!principal.success) return fail(err.badInput("Choose an exact directory entry"));
+    if (!(await recipientExists(params.recipientId))) return fail(err.notFound("Service account"));
+    const target = principal.data;
+    try {
+      return await sql.begin(async (db) => {
+        const [row] = await db<{ id: string }[]>`INSERT INTO auth.directory_shares(recipient_id,user_id,group_id,service_account_id)
+          VALUES(${params.recipientId}::uuid, ${target.type === "user" ? target.userId : null}::uuid,
+            ${target.type === "group" ? target.groupId : null}::uuid,
+            ${target.type === "service_account" ? target.serviceAccountId : null}::uuid)
+          ON CONFLICT (recipient_id,user_id,group_id,service_account_id) DO UPDATE SET recipient_id=EXCLUDED.recipient_id RETURNING id`;
+        if (!row) return fail(err.internal("Could not save directory access"));
+        await audit.record(
+          {
+            action: "accounts.directory.grant",
+            outcome: "allowed",
+            actor: auditActor(params.actor),
+            target: { type: "directory_share", id: row.id },
+            metadata: { serviceAccountId: params.recipientId, principal: target },
+          },
+          db,
+        );
+        return ok(row);
+      });
+    } catch (error) {
+      if (
+        z.object({ code: z.literal("23503") }).safeParse(error).success ||
+        z.object({ errno: z.literal("23503") }).safeParse(error).success
+      )
+        return fail(err.notFound("Directory entry"));
+      throw error;
+    }
+  },
+  revoke: async (params: { actor: Administrator; recipientId: string; id: string }): Promise<Result<void>> => {
+    if (!administrator(params.actor)) return fail(err.forbidden("Administrator access required"));
+    return sql.begin(async (db) => {
+      await db`DELETE FROM auth.directory_shares WHERE id=${params.id}::uuid AND recipient_id=${params.recipientId}::uuid`;
+      await audit.record(
+        {
+          action: "accounts.directory.revoke",
+          outcome: "allowed",
+          actor: auditActor(params.actor),
+          target: { type: "directory_share", id: params.id },
+          metadata: { serviceAccountId: params.recipientId },
+        },
+        db,
+      );
+      return ok();
+    });
+  },
+  search: async (params: { actor: RequestActor; query: Omit<entities.EntityListParams, "visibility">; requestId?: string }) => {
+    const { actor, query } = params;
+    const result = await (async () => {
+      if (
+        actor.kind !== "service_account" ||
+        actor.delegatedUser ||
+        !["standalone", "agent"].includes(actor.serviceAccount.kind) ||
+        !actor.scopes.includes("read")
+      )
+        return fail(err.forbidden("Directory read access required"));
+      // Sharing an entry never shares its membership or management relationships.
+      if (
+        query.memberOfGroupId ||
+        query.managerOfGroupId ||
+        query.parentGroupId ||
+        query.managedByUserId ||
+        query.userMemberOfGroupIds?.length
+      )
+        return fail(err.forbidden("Directory shares do not include group relationships"));
+      return ok(await entities.list({ ...query, visibility: { type: "directory_shares", serviceAccountId: actor.serviceAccount.id } }));
+    })();
+    return audit.recordResult({
+      action: "accounts.directory.search",
+      result,
+      requestId: params.requestId,
+      target: actor.kind === "service_account" ? { type: "service_account", id: actor.serviceAccount.id } : null,
+      metadata:
+        actor.kind === "service_account" ? { serviceAccountId: actor.serviceAccount.id, credentialId: actor.credentialId ?? null } : {},
+    });
+  },
+};

package/src/services/accounts/entities.ts

@@ -2,7 +2,7 @@ import { sql } from "bun";
 import type { EntityKind, EntityListItem, UserProfile, UserProvider } from "../../contracts/shared";
 import { getFreeIpaConfig } from "../freeipa-config";
 import { escapeLikePattern, toPgTextArray, toPgUuidArray } from "../postgres";
-import type { ServiceAccountKind } from "../service-accounts";
+import type { ServiceAccountKind, ServiceAccountStatus } from "../service-accounts";
 import { buildBaseGroup, personalOwnerJoin } from "./base-group";
 import { buildBaseUser } from "./base-user";
 import { buildManagedGroupScopeCondition, recursiveGroupIdsSubquery } from "./group-sql";
@@ -11,13 +11,18 @@ type DbRow = Record<string, unknown>;
 type SqlFragment = any;
 
 export type EntityListParams = {
-  visibility: { type: "directory" } | { type: "self_and_effective_groups"; userId: string };
+  visibility:
+    | { type: "directory" }
+    | { type: "self_and_effective_groups"; userId: string }
+    | { type: "directory_shares"; serviceAccountId: string };
   search?: string;
   kinds?: EntityKind[];
   provider?: UserProvider;
   profile?: UserProfile;
   userIds?: string[];
   groupIds?: string[];
+  serviceAccountKinds?: ServiceAccountKind[];
+  serviceAccountStatus?: ServiceAccountStatus;
   excludeUserIds?: string[];
   excludeGroupIds?: string[];
   excludeServiceAccountIds?: string[];
@@ -432,7 +437,17 @@ export const list = async (
   const visibilityCondition =
     params.visibility.type === "directory"
       ? sql`TRUE`
-      : sql`(
+      : params.visibility.type === "directory_shares"
+        ? sql`EXISTS (
+            SELECT 1 FROM auth.directory_shares share
+            JOIN auth.service_accounts recipient ON recipient.id = share.recipient_id
+            WHERE recipient.id = ${params.visibility.serviceAccountId}::uuid
+              AND recipient.kind IN ('standalone', 'agent') AND recipient.status = 'active'
+              AND ((entity_rows.kind = 'user' AND share.user_id = entity_rows.id)
+                OR (entity_rows.kind = 'group' AND share.group_id = entity_rows.id)
+                OR (entity_rows.kind = 'service_account' AND share.service_account_id = entity_rows.id))
+          )`
+        : sql`(
           (kind = 'user' AND id = ${params.visibility.userId}::uuid)
           OR (
             kind = 'group'
@@ -459,6 +474,13 @@ export const list = async (
     (params.excludeServiceAccountIds?.length ?? 0) === 0
       ? sql`TRUE`
       : sql`(kind <> 'service_account' OR id <> ALL(${toPgUuidArray(params.excludeServiceAccountIds ?? [])}::uuid[]))`;
+  const serviceAccountKindsCondition =
+    (params.serviceAccountKinds?.length ?? 0) === 0
+      ? sql`TRUE`
+      : sql`(kind <> 'service_account' OR service_account_kind = ANY(${toPgTextArray(params.serviceAccountKinds ?? [])}::text[]))`;
+  const serviceAccountStatusCondition = params.serviceAccountStatus
+    ? sql`(kind <> 'service_account' OR status = ${params.serviceAccountStatus})`
+    : sql`TRUE`;
   const userMemberOfGroupCondition =
     (params.userMemberOfGroupIds?.length ?? 0) === 0
       ? sql`TRUE`
@@ -478,6 +500,8 @@ export const list = async (
     AND ${excludeUserCondition}
     AND ${excludeGroupCondition}
     AND ${excludeServiceAccountCondition}
+    AND ${serviceAccountKindsCondition}
+    AND ${serviceAccountStatusCondition}
     AND ${userMemberOfGroupCondition}
     AND ${personalCondition}
     AND (
@@ -500,9 +524,10 @@ export const list = async (
       OR (
         kind = 'service_account' AND (
           LOWER(name) LIKE ${pattern} ESCAPE '\\'
-          OR LOWER(COALESCE(app_id, '')) LIKE ${pattern} ESCAPE '\\'
+          OR (${params.visibility.type !== "directory_shares"} AND (LOWER(COALESCE(app_id, '')) LIKE ${pattern} ESCAPE '\\'
           OR LOWER(COALESCE(resource_type, '')) LIKE ${pattern} ESCAPE '\\'
           OR LOWER(COALESCE(resource_id, '')) LIKE ${pattern} ESCAPE '\\'
+          ))
         )
       )
     )
@@ -635,9 +660,28 @@ export const list = async (
     OFFSET ${offset}
   `;
 
-  const total = rows.length > 0 ? Number((rows[0] as Record<string, unknown>).total) : 0;
+  // A page past the end has no rows to carry the window count; the total still counts every match.
+  let total = rows.length > 0 ? Number(rows[0]!.total) : 0;
+  if (!rows.length && page > 1) total = (await list({ ...params, page: 1, perPage: 1 })).total;
   return {
-    items: rows.map(mapEntityRow),
+    items: rows.map((row) => {
+      const entity = mapEntityRow(row);
+      if (params.visibility.type !== "directory_shares") return entity;
+      if (entity.kind === "group") return { ...entity, group: { ...entity.group, personalOwner: null } };
+      if (entity.kind === "service_account")
+        return {
+          ...entity,
+          serviceAccount: {
+            ...entity.serviceAccount,
+            delegatedUserId: null,
+            createdBy: null,
+            appId: null,
+            resourceType: null,
+            resourceId: null,
+          },
+        };
+      return entity;
+    }),
     total,
     pagination: {
       page,

package/src/services/accounts/groups.ts

@@ -86,7 +86,9 @@ const listCanonical = async (params: {
     OFFSET ${offset}
   `;
 
-  const total = rows.length > 0 ? Number((rows[0] as Record<string, unknown>).total) : 0;
+  // A page past the end has no rows to carry the window count; the total still counts every match.
+  let total = rows.length > 0 ? Number((rows[0] as Record<string, unknown>).total) : 0;
+  if (!rows.length && page > 1) total = (await listCanonical({ ...params, page: 1, perPage: 1 })).total;
   return {
     groups: rows.map(buildBaseGroup),
     total,

package/src/services/accounts/identities.ts

@@ -16,7 +16,7 @@ export type AccountIdentityUser = {
   profile: UserProfile;
   posix: { uidNumber: number; primaryGidNumber: number } | null;
 };
-/** `personal` marks a user's personal Linux group (their stored primary group). */
+/** `personal` marks a user's durably owned personal Linux group. */
 export type AccountIdentityGroup = { id: string; provider: UserProvider; name: string; gidNumber: number | null; personal: boolean };
 export type AccountIdentityPage<T> = { items: T[]; nextCursor: string | null };
 export type AccountIdentityAvailability = { localLinuxEnabled: boolean; freeipaEnabled: boolean };
@@ -122,7 +122,7 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
   const groupRows = async (filter: SQLQuery) => {
     const rows = await db<{ id: string; provider: UserProvider; name: string; gid_number: number | null; personal: boolean }[]>`
       SELECT g.id, g.provider, g.name, g.gid_number,
-        EXISTS(SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id) AS personal
+        EXISTS(SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id) AS personal
       FROM auth.groups g
       WHERE ${filter} ORDER BY g.id LIMIT ${PAGE_SIZE + 1}
     `;
@@ -207,22 +207,74 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
     if ((input.kind !== "users" && input.kind !== "groups") || typeof input.name !== "string" || !input.name || input.name.includes("\0"))
       throw new AccountIdentityError("invalid_identity_lookup", 400);
   };
+  const reconcileIdentity = async (
+    input: { kind: "users" | "groups"; provider: UserProvider; name: string; identityId?: string; signal?: AbortSignal },
+    state: AccountIdentityAvailability,
+  ): Promise<AccountIdentityReconciliation> => {
+    validateLookup(input);
+    if (input.provider !== "local" && input.provider !== "ipa") throw new AccountIdentityError("invalid_identity_lookup", 400);
+    if (input.identityId !== undefined) cursor(input.identityId);
+    if (input.signal?.aborted) return { state: "unknown", reason: "provider_unavailable" };
+    if (input.provider === "ipa") {
+      if (!state.freeipaEnabled) return { state: "unknown", reason: "provider_disabled" };
+      return upstreamIdentity(input);
+    }
+    const result = await readLocalIdentity(input);
+    return input.signal?.aborted ? { state: "unknown", reason: "provider_unavailable" } : result;
+  };
   return {
+    /** Trusted application provisioning only; no profile, grants, credentials, or administrator impersonation. */
+    async provisioningUsers(input: { provider?: UserProvider; id?: string; after?: string }) {
+      if (input.provider !== undefined && input.provider !== "local" && input.provider !== "ipa")
+        throw new AccountIdentityError("invalid_provider", 400);
+      const id = cursor(input.id);
+      const after = cursor(input.after);
+      const state = await availability();
+      const [localAllowed, ipaAllowed] = await Promise.all([
+        isAccountCategoryAllowed({ provider: "local", profile: "user" }, db),
+        isAccountCategoryAllowed({ provider: "ipa", profile: "user" }, db),
+      ]);
+      const rows = await db<
+        {
+          id: string;
+          provider: UserProvider;
+          uid: string;
+          managed_by: UserProvider | null;
+          uid_number: number | null;
+          primary_gid_number: number | null;
+        }[]
+      >`SELECT u.id,u.provider,u.uid,p.managed_by,p.uid_number,p.primary_gid_number
+        FROM auth.users u LEFT JOIN auth.user_posix p ON p.user_id=u.id
+        WHERE u.provider IN ('local','ipa') AND (${input.provider ?? null}::text IS NULL OR u.provider=${input.provider ?? null})
+          AND u.profile='user'
+          AND (u.account_expires IS NULL OR u.account_expires>now())
+          AND (${id}::uuid IS NULL OR u.id=${id}::uuid)
+          AND (${after}::uuid IS NULL OR u.id>${after}::uuid)
+        ORDER BY u.id LIMIT ${PAGE_SIZE + 1}`;
+      const source = page(rows);
+      const items = source.items
+        .filter((row) => (row.provider === "local" ? localAllowed : ipaAllowed && state.freeipaEnabled))
+        .map((row) => ({
+          id: row.id,
+          provider: row.provider,
+          username: row.uid,
+          posix:
+            row.managed_by === row.provider && positiveId(row.uid_number) && positiveId(row.primary_gid_number)
+              ? { uidNumber: row.uid_number, primaryGidNumber: row.primary_gid_number }
+              : null,
+        }));
+      return { items, nextCursor: source.nextCursor, availability: state };
+    },
     async reconcile(
       actor: RequestActor,
       input: { kind: "users" | "groups"; provider: UserProvider; name: string; identityId?: string; signal?: AbortSignal },
     ): Promise<AccountIdentityReconciliation> {
       const { state } = await requireAdmin(actor);
-      validateLookup(input);
-      if (input.provider !== "local" && input.provider !== "ipa") throw new AccountIdentityError("invalid_identity_lookup", 400);
-      if (input.identityId !== undefined) cursor(input.identityId);
-      if (input.signal?.aborted) return { state: "unknown", reason: "provider_unavailable" };
-      if (input.provider === "ipa") {
-        if (!state.freeipaEnabled) return { state: "unknown", reason: "provider_disabled" };
-        return upstreamIdentity(input);
-      }
-      const result = await readLocalIdentity(input);
-      return input.signal?.aborted ? { state: "unknown", reason: "provider_unavailable" } : result;
+      return reconcileIdentity(input, state);
+    },
+    /** Trusted provisioning services use the same live identity check as administrator provisioning. */
+    async provisioningIdentity(input: { kind: "users"; provider: UserProvider; name: string; identityId: string; signal?: AbortSignal }) {
+      return reconcileIdentity(input, await availability());
     },
     /** Trusted application jobs only; this read does not authorize an HTTP caller or a filesystem mutation. */
     async localLifecycle(input: { kind: "users" | "groups"; identityId: string; name: string }) {

package/src/services/accounts/local-groups.ts

@@ -164,7 +164,7 @@ export const remove = async (params: { id: string }): Promise<MutationResult<voi
   const group = await getLocalGroupById(params.id);
   if (!group) return { ok: false, error: "Group not found", status: 404 };
 
-  const [primary] = await sql`SELECT 1 FROM auth.user_posix WHERE primary_group_id = ${params.id}::uuid LIMIT 1`;
+  const [primary] = await sql`SELECT 1 FROM auth.personal_groups WHERE group_id = ${params.id}::uuid LIMIT 1`;
   if (primary) return { ok: false, error: "This group is a user's primary Linux group and cannot be deleted.", status: 409 };
   try {
     await sql`DELETE FROM auth.groups WHERE id = ${params.id}::uuid AND provider = 'local'`;

package/src/services/accounts/users.ts

@@ -4,7 +4,7 @@ import { freeipa } from "../../server/services";
 import { createAuthLoginUrl } from "../../shared/redirect";
 import { isAccountCategoryAllowed } from "../account-category-policy";
 import type { AuditActor } from "../audit";
-import { getFreeIpaConfig } from "../freeipa-config";
+import { getFreeIpaAdminGroups, getFreeIpaConfig } from "../freeipa-config";
 import { getServiceIpaSession } from "../ipa/service-account";
 import { toPgTextArray, toPgUuidArray } from "../postgres";
 import { providers } from "../providers";
@@ -12,7 +12,7 @@ import { session } from "../session";
 import * as settings from "../settings";
 import { buildRoles } from "./authz";
 import { buildBaseUser, resolveProviderProfile } from "./base-user";
-import { managedGroupIdsSubquery, managedGroupsNamesSubquery, recursiveGroupIdsSubquery, recursiveGroupNamesSubquery } from "./group-sql";
+import { managedGroupIdsSubquery, managedGroupsNamesSubquery, recursiveGroupIdsSubquery, recursiveUserGroupsSubquery } from "./group-sql";
 import { buildIpaUserData, emptyIpaUserData, userIpaDataColumns, userIpaDataJoin } from "./ipa-data";
 import {
   canPersistStoredAdmin,
@@ -25,7 +25,7 @@ import {
 import type { AccountsNotificationSender } from "./notification-sender";
 import { transitionIpaUserToLocal } from "./switching";
 
-export { clearAvatar, getAvatar, parseAvatarDataUrl, setAvatar } from "./avatar";
+export { clearAvatar, getAvatar, getAvatarState, parseAvatarDataUrl, setAvatar, updateAvatar } from "./avatar";
 
 type DbRow = Record<string, unknown>;
 type UserMutationTarget = BaseUser & { accountExpires: string | null; storedAdmin: boolean };
@@ -168,11 +168,12 @@ const buildUser = (row: DbRow, groupsAdmin: string[]): User => {
   };
 };
 
-export const get = async (params: { id: string } | { uid: string }): Promise<User | null> => {
-  const whereClause = "id" in params ? sql`u.id = ${params.id}` : sql`u.uid = ${params.uid}`;
-  const userIdExpr = "id" in params ? sql`${params.id}` : sql`u.id`;
-  const { groupsAdmin } = await getFreeIpaConfig();
-  const rows = await sql<DbRow[]>`
+export const get = async (params: { id: string } | { uid: string }, options: { db?: SQL } = {}): Promise<User | null> => {
+  const db = options.db ?? sql;
+  const whereClause = "id" in params ? db`u.id = ${params.id}` : db`u.uid = ${params.uid}`;
+  const userIdExpr = "id" in params ? db`${params.id}` : db`u.id`;
+  const groupsAdmin = options.db ? await getFreeIpaAdminGroups(db) : (await getFreeIpaConfig()).groupsAdmin;
+  const rows = await db<DbRow[]>`
     SELECT u.*,
       ${userIpaDataColumns()},
       CASE
@@ -346,17 +347,24 @@ export const list = async (params: {
   };
 };
 
-export const getGroups = async (params: { id: string; recursive?: boolean }): Promise<string[]> => {
+/** Technical membership reads stay complete; human-facing lists exclude personal groups explicitly. */
+export const getGroups = async (params: { id: string; recursive?: boolean; includePersonal?: boolean }): Promise<string[]> => {
   if (params.recursive) {
-    const rows = await sql<DbRow[]>`${recursiveGroupNamesSubquery(params.id)}`;
+    const rows = await sql<DbRow[]>`${recursiveUserGroupsSubquery({
+      userId: params.id,
+      select: sql`
+        SELECT DISTINCT g.name FROM user_all_groups ag
+        JOIN auth.groups g ON g.id = ag.group_id
+        WHERE (${params.includePersonal !== false} OR NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id))
+        ORDER BY g.name
+      `,
+    })}`;
     return rows.map((row) => row.name as string);
   }
-
   const rows = await sql<DbRow[]>`
-    SELECT g.name
-    FROM auth.user_groups_v2 ug
-    JOIN auth.groups g ON g.id = ug.group_id
-    WHERE ug.user_id = ${params.id}::uuid
+    SELECT g.name FROM auth.groups g
+    WHERE g.id IN (SELECT group_id FROM auth.user_groups_v2 WHERE user_id = ${params.id}::uuid)
+      AND (${params.includePersonal !== false} OR NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id))
     ORDER BY g.name
   `;
   return rows.map((row) => row.name as string);