@k2b/cloud 0.6.0-rc.0

package/src/services/providers/local/users.ts

@@ -0,0 +1,263 @@
+import { sql } from "bun";
+import type { MutationResult, UserProfile } from "../../../contracts/shared";
+import { isAccountCategoryAllowed } from "../../account-category-policy";
+import { writeDeletedAccountAudit } from "../../account-lifecycle/audit";
+import { resolveStoredAdminState } from "../../accounts/model";
+import { writeLocalAccount } from "../../accounts/posix";
+import type { AuditActor } from "../../audit";
+import { generateUniqueAbbreviation } from "../../ipa/users";
+import { isUniqueViolation } from "../../postgres";
+import { session } from "../../session";
+import * as settings from "../../settings";
+
+type DbRow = Record<string, unknown>;
+
+export type LocalUserCreateData = {
+  email: string;
+  givenname?: string;
+  sn?: string;
+  displayName?: string;
+};
+
+const createLocalUid = async (): Promise<string> => {
+  const abbrLen = await settings.get<number>("user.abbr_length");
+  return generateUniqueAbbreviation(abbrLen);
+};
+
+export const create = async (params: {
+  data: LocalUserCreateData;
+  profile: UserProfile;
+  accountExpires: Date | null;
+  admin?: boolean;
+  actor?: AuditActor;
+}): Promise<MutationResult<{ id: string }>> => {
+  const uid = await createLocalUid();
+  const admin = resolveStoredAdminState({
+    provider: "local",
+    profile: params.profile,
+    requestedAdmin: params.admin,
+  });
+
+  try {
+    return await writeLocalAccount(async (tx) => {
+      if (!(await isAccountCategoryAllowed({ provider: "local", profile: params.profile }, tx)))
+        return { ok: false, error: "This account category is disabled. Contact an administrator.", status: 403 };
+      const rows = await tx<{ id: string }[]>`
+      INSERT INTO auth.users (
+        uid,
+        provider,
+        profile,
+        mail,
+        given_name,
+        sn,
+        display_name,
+        admin,
+        account_expires
+      )
+      VALUES (
+        ${uid},
+        'local',
+        ${params.profile},
+        ${params.data.email},
+        ${params.data.givenname ?? ""},
+        ${params.data.sn ?? ""},
+        ${params.data.displayName ?? ""},
+        ${admin},
+        ${params.accountExpires}
+      )
+      RETURNING id
+    `;
+      return { ok: true, data: { id: rows[0]!.id } };
+    }, params.actor);
+  } catch (error) {
+    // Map Postgres unique violations to a typed 409 instead of leaking raw DB
+    // errors. Two possible collisions: generated uid (extremely rare, retry at
+    // next call) or email already used by another local account.
+    if (isUniqueViolation(error, "users_uid_key")) {
+      return { ok: false, error: "Generated UID collided. Please retry.", status: 409 };
+    }
+    if (isUniqueViolation(error, "idx_users_provider_mail")) {
+      return { ok: false, error: "A local account with this email already exists.", status: 409 };
+    }
+    throw error;
+  }
+};
+
+export const createGuest = async (params: {
+  email: string;
+  givenname?: string;
+  sn?: string;
+  displayName?: string;
+  accountExpires?: Date | null;
+}): Promise<MutationResult<{ id: string }>> => {
+  let accountExpires = params.accountExpires ?? null;
+  if (params.accountExpires === undefined) {
+    const configured = await settings.get<number | null>("user.account.local_guest_expires_days");
+    const days = typeof configured === "number" ? configured : 365;
+    accountExpires = days > 0 ? new Date(Date.now() + days * 24 * 60 * 60 * 1000) : null;
+  }
+
+  return create({
+    data: {
+      email: params.email,
+      givenname: params.givenname,
+      sn: params.sn,
+      displayName: params.displayName,
+    },
+    profile: "guest",
+    accountExpires,
+  });
+};
+
+export const update = async (params: {
+  id: string;
+  data: {
+    givenname?: string;
+    sn?: string;
+    displayName?: string;
+    mail?: string;
+  };
+}): Promise<MutationResult<void>> => {
+  const existingRows = await sql<DbRow[]>`SELECT id FROM auth.users WHERE id = ${params.id}::uuid AND provider = 'local'`;
+  if (existingRows.length === 0) {
+    return { ok: false, error: "Local user not found", status: 404 };
+  }
+
+  await sql`
+    UPDATE auth.users
+    SET given_name = CASE WHEN ${params.data.givenname !== undefined} THEN ${params.data.givenname ?? ""} ELSE given_name END,
+        sn = CASE WHEN ${params.data.sn !== undefined} THEN ${params.data.sn ?? ""} ELSE sn END,
+        display_name = CASE WHEN ${params.data.displayName !== undefined} THEN ${params.data.displayName ?? ""} ELSE display_name END,
+        mail = CASE WHEN ${params.data.mail !== undefined} THEN ${params.data.mail ?? null} ELSE mail END
+    WHERE id = ${params.id}::uuid
+  `;
+
+  return { ok: true, data: undefined };
+};
+
+export const setProfile = async (params: {
+  id: string;
+  profile: UserProfile;
+  accountExpires: Date | null;
+  actor?: AuditActor;
+}): Promise<MutationResult<void>> => {
+  const result = await writeLocalAccount(async (tx) => {
+    const rows = await tx<{ provider: string; profile: UserProfile; admin: boolean }[]>`
+    SELECT provider, profile, admin
+    FROM auth.users
+    WHERE id = ${params.id}::uuid
+  `;
+    if (rows.length === 0) return { ok: false, error: "User not found", status: 404 };
+    if (rows[0]!.provider !== "local") {
+      return { ok: false, error: "Only local accounts can change profile locally", status: 400 };
+    }
+    if (rows[0]!.profile !== params.profile && !(await isAccountCategoryAllowed({ provider: "local", profile: params.profile }, tx)))
+      return { ok: false, error: "This account category is disabled. Contact an administrator.", status: 403 };
+
+    const admin = resolveStoredAdminState({
+      provider: "local",
+      profile: params.profile,
+      currentAdmin: Boolean(rows[0]!.admin),
+    });
+
+    await tx`
+    UPDATE auth.users
+    SET provider = 'local',
+        profile = ${params.profile},
+        admin = ${admin},
+        account_expires = ${params.accountExpires}
+    WHERE id = ${params.id}::uuid
+  `;
+
+    return { ok: true, data: { id: params.id, assignIdentity: rows[0]!.profile === "guest" && params.profile === "user" } };
+  }, params.actor);
+  return result.ok ? { ok: true, data: undefined } : result;
+};
+
+export const setExpiry = async (params: {
+  id: string;
+  profile: UserProfile;
+  accountExpires: Date | null;
+}): Promise<MutationResult<void>> => {
+  const rows = await sql<DbRow[]>`
+    SELECT provider
+    FROM auth.users
+    WHERE id = ${params.id}::uuid
+  `;
+  if (rows.length === 0) return { ok: false, error: "User not found", status: 404 };
+  if ((rows[0]!.provider as string) !== "local") {
+    return { ok: false, error: "Only local accounts support local expiry changes", status: 400 };
+  }
+
+  await sql`
+    UPDATE auth.users
+    SET account_expires = ${params.accountExpires}
+    WHERE id = ${params.id}::uuid
+  `;
+
+  return { ok: true, data: undefined };
+};
+
+export const setAdmin = async (params: { id: string; admin: boolean }): Promise<MutationResult<void>> => {
+  const rows = await sql<DbRow[]>`
+    SELECT provider, profile, admin
+    FROM auth.users
+    WHERE id = ${params.id}::uuid
+  `;
+  if (rows.length === 0) return { ok: false, error: "User not found", status: 404 };
+  const row = rows[0]!;
+  if ((row.provider as string) !== "local") {
+    return { ok: false, error: "Only local full accounts can be granted admin access", status: 400 };
+  }
+  if ((row.profile as string) !== "user") {
+    return { ok: false, error: "Guest accounts cannot be granted admin access", status: 400 };
+  }
+  const currentAdmin = Boolean(row.admin);
+  if (currentAdmin === params.admin) {
+    return { ok: false, error: params.admin ? "Account is already an admin" : "Account is not an admin", status: 409 };
+  }
+
+  await sql`
+    UPDATE auth.users
+    SET admin = ${params.admin}
+    WHERE id = ${params.id}::uuid
+  `;
+
+  return { ok: true, data: undefined };
+};
+
+export const remove = async (params: { id: string; actor: { userId: string; uid: string } }): Promise<MutationResult<void>> => {
+  const rows = await sql<DbRow[]>`
+    SELECT uid, profile, mail, display_name
+    FROM auth.users
+    WHERE id = ${params.id}::uuid
+      AND provider = 'local'
+  `;
+  if (rows.length === 0) return { ok: false, error: "Local user not found", status: 404 };
+
+  const row = rows[0]!;
+  const uid = row.uid as string;
+  await sql.begin(async (tx) => {
+    await writeDeletedAccountAudit({
+      db: tx,
+      userId: params.id,
+      uid,
+      mail: (row.mail as string) ?? null,
+      displayName: (row.display_name as string) ?? null,
+      previousProvider: "local",
+      previousProfile: (row.profile as UserProfile | null) ?? "guest",
+      reason: "manual_delete",
+      meta: {
+        actorUserId: params.actor.userId,
+        actorUid: params.actor.uid,
+        deletedFromFreeIpa: false,
+        freeIpaUserAlreadyMissing: false,
+      },
+    });
+    await tx`DELETE FROM auth.users WHERE id = ${params.id}::uuid`;
+  });
+
+  await session.revokeAllForUser(params.id);
+
+  return { ok: true, data: undefined };
+};

package/src/services/rail-preferences.ts

@@ -0,0 +1,27 @@
+import { type SQL, sql } from "bun";
+import { defaultRailPreferences, type RailPreferences, RailPreferencesSchema } from "../contracts/rail-preferences";
+
+/** Core-owned data, read by the platform SSR seam without a process-wide cache. */
+export const createRailPreferencesService = (db: SQL = sql) => ({
+  async get(userId: string): Promise<RailPreferences> {
+    const [row] = await db<{ revision: number; visibility: unknown; shortcuts: unknown }[]>`
+      SELECT revision, visibility, shortcuts FROM auth.rail_preferences WHERE user_id = ${userId}::uuid
+    `;
+    return row ? RailPreferencesSchema.parse(row) : defaultRailPreferences();
+  },
+  async save(userId: string, input: RailPreferences): Promise<RailPreferences | null> {
+    const value = RailPreferencesSchema.parse(input);
+    const [row] = await db<{ revision: number; visibility: unknown; shortcuts: unknown }[]>`
+      INSERT INTO auth.rail_preferences (user_id, revision, visibility, shortcuts)
+      SELECT ${userId}::uuid, 1, (${JSON.stringify(value.visibility)}::text)::jsonb, (${JSON.stringify(value.shortcuts)}::text)::jsonb
+      WHERE ${value.revision} = 0 OR EXISTS (SELECT 1 FROM auth.rail_preferences WHERE user_id = ${userId}::uuid)
+      ON CONFLICT (user_id) DO UPDATE SET
+        revision = auth.rail_preferences.revision + 1,
+        visibility = EXCLUDED.visibility, shortcuts = EXCLUDED.shortcuts
+      WHERE auth.rail_preferences.revision = ${value.revision}
+      RETURNING revision, visibility, shortcuts
+    `;
+    return row ? RailPreferencesSchema.parse(row) : null;
+  },
+});
+export const railPreferences = createRailPreferencesService();

package/src/services/runtime-lifecycle.ts

@@ -0,0 +1,191 @@
+import type { Worker } from "@k2b/sync";
+
+export type RuntimeTaskTracker = ReturnType<typeof createRuntimeTaskTracker>;
+
+export type RuntimeTaskFailure = {
+  error: unknown;
+  failureCount: number;
+  retryInMs: number;
+};
+
+type RuntimeTaskSupervisorOptions = {
+  signal: AbortSignal;
+  run(signal: AbortSignal): Promise<void>;
+  onError?(failure: RuntimeTaskFailure): void;
+  minRetryMs?: number;
+  maxRetryMs?: number;
+  resetAfterMs?: number;
+  jitter?: number;
+  name?: string;
+};
+
+const waitForRetry = (delayMs: number, signal: AbortSignal): Promise<void> =>
+  new Promise((resolve) => {
+    if (signal.aborted) return resolve();
+    const finish = () => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", finish);
+      resolve();
+    };
+    const timer = setTimeout(finish, delayMs);
+    signal.addEventListener("abort", finish, { once: true });
+    if (signal.aborted) finish();
+  });
+
+/** Restart a long-lived task after unexpected failure or completion. */
+export const superviseRuntimeTask = async (options: RuntimeTaskSupervisorOptions): Promise<void> => {
+  const minRetryMs = options.minRetryMs ?? 250;
+  const maxRetryMs = options.maxRetryMs ?? 5_000;
+  const resetAfterMs = options.resetAfterMs ?? 30_000;
+  const jitter = options.jitter ?? 0.2;
+  if (![minRetryMs, maxRetryMs, resetAfterMs].every((value) => Number.isFinite(value) && value > 0)) {
+    throw new RangeError("Runtime task retry timings must be positive finite numbers");
+  }
+  if (minRetryMs > maxRetryMs) throw new RangeError("Runtime task minimum retry delay cannot exceed its maximum");
+  if (!Number.isFinite(jitter) || jitter < 0 || jitter > 1) throw new RangeError("Runtime task retry jitter must be between 0 and 1");
+
+  let failureCount = 0;
+  while (!options.signal.aborted) {
+    const startedAt = Date.now();
+    let error: unknown;
+    try {
+      await options.run(options.signal);
+      if (options.signal.aborted) return;
+      error = new Error(`${options.name ?? "Runtime task"} stopped unexpectedly`);
+    } catch (caught) {
+      if (options.signal.aborted) return;
+      error = caught;
+    }
+
+    failureCount = Date.now() - startedAt >= resetAfterMs ? 1 : failureCount + 1;
+    const exponentialRetryMs = minRetryMs * 2 ** Math.min(failureCount - 1, 30);
+    const retryInMs = Math.min(maxRetryMs, Math.max(minRetryMs, Math.round(exponentialRetryMs * (1 + (Math.random() * 2 - 1) * jitter))));
+    try {
+      options.onError?.({ error, failureCount, retryInMs });
+    } catch {
+      // Reporting failures must not stop recovery.
+    }
+    await waitForRetry(retryInMs, options.signal);
+  }
+};
+
+/** Track process work outside Sync handlers, such as recovery scans and publishers. */
+export const createRuntimeTaskTracker = () => {
+  const tasks = new Set<Promise<unknown>>();
+  let accepting = false;
+
+  return {
+    open: (): void => {
+      accepting = true;
+    },
+    close: (): void => {
+      accepting = false;
+    },
+    run: <T>(operation: () => Promise<T>): Promise<T> | null => {
+      if (!accepting) return null;
+      const task = Promise.resolve().then(operation);
+      tasks.add(task);
+      const remove = () => tasks.delete(task);
+      task.then(remove, remove);
+      return task;
+    },
+    drain: async (): Promise<void> => {
+      while (tasks.size > 0) await Promise.allSettled([...tasks]);
+    },
+  };
+};
+
+/**
+ * Stop accepting runtime tasks, stop the @k2b/sync workers from pulling new
+ * work, then drain accepted process tasks and workers together. Sync owns
+ * handler tracking and cancellation; do not wrap worker handlers in tracker.run.
+ * Only work outside those handlers uses the tracker and its separate deadline.
+ */
+export const stopRuntimeJobs = async (
+  tracker: Pick<RuntimeTaskTracker, "close" | "drain">,
+  workers: ReadonlyArray<Pick<Worker, "stop" | "drain">>,
+  options: { timeoutMs?: number } = {},
+): Promise<void> => {
+  const timeoutMs = options.timeoutMs ?? 30_000;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) throw new RangeError("Runtime drain timeout must be positive and finite");
+  tracker.close();
+  const errors: unknown[] = [];
+  for (const worker of workers) worker.stop();
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const tracked = Promise.race([
+    tracker.drain(),
+    new Promise<never>((_, reject) => {
+      timer = setTimeout(() => reject(new Error(`Runtime tasks did not drain within ${timeoutMs}ms`)), timeoutMs);
+    }),
+  ]);
+  try {
+    for (const result of await Promise.allSettled([tracked, ...workers.map((worker) => worker.drain({ timeoutMs }))])) {
+      if (result.status === "rejected") errors.push(result.reason);
+    }
+  } finally {
+    clearTimeout(timer);
+  }
+  if (errors.length === 1) throw errors[0];
+  if (errors.length > 1) throw new AggregateError(errors, "Multiple runtime jobs failed to stop");
+};
+
+type RuntimeLifecycleHooks = {
+  start(): Promise<void>;
+  stop(): Promise<void>;
+};
+
+export const createRuntimeLifecycle = (hooks: RuntimeLifecycleHooks) => {
+  let state: "stopped" | "started" | "cleanup-required" = "stopped";
+  let transition = Promise.resolve();
+
+  const serialize = (operation: () => Promise<void>): Promise<void> => {
+    const result = transition.then(operation, operation);
+    transition = result.catch(() => undefined);
+    return result;
+  };
+
+  return {
+    start: (): Promise<void> =>
+      serialize(async () => {
+        if (state === "started") return;
+        if (state === "cleanup-required") {
+          await hooks.stop();
+          state = "stopped";
+        }
+
+        state = "cleanup-required";
+        try {
+          await hooks.start();
+          state = "started";
+        } catch (startError) {
+          try {
+            await hooks.stop();
+            state = "stopped";
+          } catch (stopError) {
+            throw new AggregateError([startError, stopError], "Runtime startup and cleanup failed");
+          }
+          throw startError;
+        }
+      }),
+    stop: (): Promise<void> =>
+      serialize(async () => {
+        if (state === "stopped") return;
+        state = "cleanup-required";
+        await hooks.stop();
+        state = "stopped";
+      }),
+  };
+};
+
+export const stopRuntimeResources = async (resources: ReadonlyArray<() => void | Promise<void>>): Promise<void> => {
+  const errors: unknown[] = [];
+  for (const stop of resources) {
+    try {
+      await stop();
+    } catch (error) {
+      errors.push(error);
+    }
+  }
+  if (errors.length === 1) throw errors[0];
+  if (errors.length > 1) throw new AggregateError(errors, "Multiple runtime resources failed to stop");
+};

package/src/services/secrets.ts

@@ -0,0 +1,10 @@
+import { decryptValue, encryptValue } from "./settings/crypto";
+
+export const encryptSecret = async (value: unknown): Promise<string> => encryptValue(value);
+
+export const decryptSecret = async <T = unknown>(value: string): Promise<T> => (await decryptValue(value)) as T;
+
+export const secrets = {
+  encrypt: encryptSecret,
+  decrypt: decryptSecret,
+};