@k2b/cloud 0.6.0-rc.0

package/src/server/services/freeipa/client.ts

@@ -0,0 +1,137 @@
+import { getFreeIpaTls } from "./tls";
+import { FreeIpaTransportError, isFreeIpaUpstreamStatus, readFreeIpaErrorBody, withFreeIpaResponse } from "./transport";
+
+export type IpaRpcResult = {
+  result?: unknown;
+  count?: number;
+  truncated?: boolean;
+  summary?: string | null;
+};
+
+export type IpaRpcResponse = {
+  result: IpaRpcResult | null;
+  error: {
+    code: number;
+    message: string;
+    name: string;
+    kind: "invalid_response" | "rpc" | "session" | "upstream";
+  } | null;
+  id: number;
+};
+
+export const baseUrl = (url: string): string => `https://${url}`;
+
+const isNoModificationError = (error: IpaRpcResponse["error"]): boolean =>
+  error?.code === 4202 && (error.message ?? "").toLowerCase().includes("no modifications to be performed");
+
+export const call = async (config: {
+  url: string;
+  ipaSession: string;
+  method: string;
+  args?: unknown[];
+  options?: Record<string, unknown>;
+  signal?: AbortSignal;
+}): Promise<IpaRpcResponse> => {
+  const tls = await getFreeIpaTls();
+  return withFreeIpaResponse(
+    `${baseUrl(config.url)}/ipa/session/json`,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Referer: `${baseUrl(config.url)}/ipa`,
+        Accept: "application/json",
+        Cookie: `ipa_session=${config.ipaSession}`,
+      },
+      body: JSON.stringify({
+        method: config.method,
+        params: [config.args ?? [], { ...(config.options ?? {}), version: "2.251" }],
+        id: 0,
+      }),
+      tls,
+    },
+    async (res) => {
+      if (!res.ok || !res.headers.get("content-type")?.includes("json")) {
+        const body = await readFreeIpaErrorBody(res);
+        const text = body.text;
+        console.error("[freeipa:client] Non-JSON response", {
+          method: config.method,
+          status: res.status,
+          bodyTruncated: body.truncated,
+        });
+
+        if (res.status === 401 || text.includes("Invalid Authentication") || text.includes("GSSAPI Error")) {
+          return {
+            result: null,
+            error: {
+              code: 403,
+              message: "Your IPA session has expired or is invalid. Please log out and log in again to refresh your session.",
+              name: "SessionExpired",
+              kind: "session",
+            },
+            id: 0,
+          };
+        }
+
+        return {
+          result: null,
+          error: {
+            code: res.status,
+            message: "Non-JSON response from IPA",
+            name: "FetchError",
+            kind: isFreeIpaUpstreamStatus(res.status) ? "upstream" : "invalid_response",
+          },
+          id: 0,
+        };
+      }
+
+      const payload: unknown = await res.json().catch((error) => {
+        throw new FreeIpaTransportError("invalid_response", "FreeIPA returned invalid JSON", { cause: error });
+      });
+      if (typeof payload !== "object" || payload === null) {
+        throw new FreeIpaTransportError("invalid_response", "FreeIPA returned an invalid RPC response");
+      }
+      const response = payload as Partial<IpaRpcResponse>;
+      if (
+        !Object.hasOwn(response, "result") ||
+        !Object.hasOwn(response, "error") ||
+        typeof response.id !== "number" ||
+        !Number.isFinite(response.id) ||
+        (response.result === null) === (response.error === null) ||
+        (response.result !== null && (typeof response.result !== "object" || response.result === null || Array.isArray(response.result))) ||
+        (response.error !== null &&
+          response.error !== undefined &&
+          (typeof response.error !== "object" ||
+            response.error === null ||
+            typeof response.error.code !== "number" ||
+            typeof response.error.message !== "string" ||
+            typeof response.error.name !== "string"))
+      ) {
+        throw new FreeIpaTransportError("invalid_response", "FreeIPA returned an invalid RPC response");
+      }
+      const typedResponse = response as IpaRpcResponse;
+      if (typedResponse.error) {
+        if (isNoModificationError(typedResponse.error)) {
+          return {
+            result: {
+              result: null,
+              count: 0,
+              truncated: false,
+              summary: typedResponse.error.message,
+            },
+            error: null,
+            id: typedResponse.id,
+          };
+        }
+
+        console.error("[freeipa:client] RPC failed", {
+          method: config.method,
+          code: typedResponse.error.code,
+          message: typedResponse.error.message,
+        });
+      }
+      return typedResponse.error ? { ...typedResponse, error: { ...typedResponse.error, kind: "rpc" } } : typedResponse;
+    },
+    { signal: config.signal },
+  );
+};

package/src/server/services/freeipa/index.ts

@@ -0,0 +1,9 @@
+import * as client from "./client";
+import * as session from "./session";
+import * as util from "./util";
+
+export const freeipa = {
+  client,
+  session,
+  util,
+} as const;

package/src/server/services/freeipa/session.ts

@@ -0,0 +1,123 @@
+import { createHash } from "node:crypto";
+import { baseUrl, call } from "./client";
+import { getFreeIpaTls, getFreeIpaTlsFingerprint } from "./tls";
+import {
+  FreeIpaTransportError,
+  isFreeIpaUpstreamStatus,
+  readFreeIpaErrorBody,
+  upstreamFreeIpaError,
+  withFreeIpaResponse,
+} from "./transport";
+
+export type LoginResult = { status: "success"; session: string } | { status: "password_expired" } | { status: "failed" };
+
+export const login = async (config: { url: string; username: string; password: string; signal?: AbortSignal }): Promise<LoginResult> => {
+  const tls = await getFreeIpaTls();
+  return withFreeIpaResponse(
+    `${baseUrl(config.url)}/ipa/session/login_password`,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Referer: `${baseUrl(config.url)}/ipa`,
+        Accept: "text/plain",
+      },
+      body: new URLSearchParams({ user: config.username, password: config.password }),
+      redirect: "manual",
+      tls,
+    },
+    async (res): Promise<LoginResult> => {
+      const rejectionReason = res.headers.get("X-IPA-Rejection-Reason");
+      if (rejectionReason === "password-expired") {
+        await readFreeIpaErrorBody(res);
+        return { status: "password_expired" };
+      }
+
+      if (isFreeIpaUpstreamStatus(res.status)) {
+        await readFreeIpaErrorBody(res);
+        throw upstreamFreeIpaError(res.status);
+      }
+      if (!res.ok && res.status !== 303) {
+        await readFreeIpaErrorBody(res);
+        return { status: "failed" };
+      }
+
+      await res.body?.cancel().catch(() => undefined);
+      const cookies = res.headers.getSetCookie?.() ?? [];
+      for (const cookie of cookies) {
+        const match = cookie.match(/ipa_session=([^;]+)/);
+        if (match?.[1]) return { status: "success", session: match[1] };
+      }
+
+      const single = res.headers.get("set-cookie") ?? "";
+      const match = single.match(/ipa_session=([^;]+)/);
+      if (match?.[1]) return { status: "success", session: match[1] };
+      throw new FreeIpaTransportError("invalid_response", "FreeIPA login succeeded without a session cookie");
+    },
+    { signal: config.signal },
+  );
+};
+
+let svcSession: string | null = null;
+let svcSessionPending: { key: string; promise: Promise<string> } | null = null;
+let svcSessionKey: string | null = null;
+
+const fingerprint = (value: string): string => createHash("sha256").update(value).digest("hex");
+
+const openServiceSession = async (config: {
+  url: string;
+  serviceUser: string;
+  servicePassword: string;
+  signal?: AbortSignal;
+}): Promise<string> => {
+  const result = await login({
+    url: config.url,
+    username: config.serviceUser,
+    password: config.servicePassword,
+    signal: config.signal,
+  });
+  if (result.status !== "success") {
+    console.error("[freeipa:session] Service account auth failed");
+    throw new Error("Failed to authenticate FreeIPA service account. Check freeipa.url/freeipa.service_user/freeipa.service_password.");
+  }
+  return result.session;
+};
+
+export const getServiceSession = async (config: {
+  url: string;
+  serviceUser: string;
+  servicePassword: string;
+  signal?: AbortSignal;
+}): Promise<string> => {
+  // Include password and TLS fingerprints so credential or trust rotation
+  // cannot keep reusing a session opened under the previous configuration.
+  const currentKey = `${config.url}::${config.serviceUser}::${fingerprint(config.servicePassword)}::${await getFreeIpaTlsFingerprint()}`;
+  if (svcSessionKey !== currentKey) {
+    svcSession = null;
+    svcSessionKey = currentKey;
+  }
+
+  if (svcSession) {
+    const check = await call({ url: config.url, ipaSession: svcSession, method: "ping", args: [], signal: config.signal });
+    if (!check.error) return svcSession;
+  }
+  // An abortable caller must not share its signal with unrelated requests via
+  // the singleton in-flight login promise.
+  if (config.signal) {
+    const session = await openServiceSession(config);
+    if (svcSessionKey === currentKey) svcSession = session;
+    return session;
+  }
+  if (svcSessionPending?.key !== currentKey) {
+    const pending = openServiceSession(config)
+      .then((session) => {
+        if (svcSessionKey === currentKey) svcSession = session;
+        return session;
+      })
+      .finally(() => {
+        if (svcSessionPending?.promise === pending) svcSessionPending = null;
+      });
+    svcSessionPending = { key: currentKey, promise: pending };
+  }
+  return svcSessionPending.promise;
+};

package/src/server/services/freeipa/test-certificates.ts

@@ -0,0 +1,44 @@
+export const TEST_CA_CERT = `-----BEGIN CERTIFICATE-----
+MIIBljCCATugAwIBAgIUaD/zikxyQaxGreCVzb9YufuusxIwCgYIKoZIzj0EAwIw
+IDEeMBwGA1UEAwwVQ2xvdWQgRnJlZUlQQSBUZXN0IENBMB4XDTI2MDcyOTE1NTgx
+MFoXDTM2MDcyNjE1NTgxMFowIDEeMBwGA1UEAwwVQ2xvdWQgRnJlZUlQQSBUZXN0
+IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYZ7eU7/C71ilbpKa9k/FXObw
+Vq4u/3rtpW/kSjsJaIVNPFp5oFBdHceL0UPgoxwpaJiJNHiwQHF/BBxaJ7HOAKNT
+MFEwHQYDVR0OBBYEFOflw/p5xNlS0am+HytNLyXVEUndMB8GA1UdIwQYMBaAFOfl
+w/p5xNlS0am+HytNLyXVEUndMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwID
+SQAwRgIhAJmRoNV5dxKvNOd2KoytvK/6ckRWN+Uu0ljc5y/g4izqAiEAsLCjxWvz
+mgt1Z3uk+QkT9D1vHCuKSvcqv3aVn0DClxA=
+-----END CERTIFICATE-----`;
+
+export const TEST_SERVER_CERT = `-----BEGIN CERTIFICATE-----
+MIIBpDCCAUmgAwIBAgIUNGe5IovnDTTKxjxwHBGVcnOaXaQwCgYIKoZIzj0EAwIw
+IDEeMBwGA1UEAwwVQ2xvdWQgRnJlZUlQQSBUZXN0IENBMB4XDTI2MDcyOTE1NTgx
+MFoXDTM2MDcyNjE1NTgxMFowFDESMBAGA1UEAwwJbG9jYWxob3N0MFkwEwYHKoZI
+zj0CAQYIKoZIzj0DAQcDQgAEolKc1EyyTH6MKX0GR7FhbXCN0O3G/D2riPJ045K+
+qCL6m0Fso38eNxKbNENSkE1tX7j4uv6tcLmtHU/cKxjUg6NtMGswFAYDVR0RBA0w
+C4IJbG9jYWxob3N0MBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1UdDgQWBBT/iu3f
+aYfd6r4xoPTkZujj/0rwWjAfBgNVHSMEGDAWgBTn5cP6ecTZUtGpvh8rTS8l1RFJ
+3TAKBggqhkjOPQQDAgNJADBGAiEAgsXqgbBm2RJaUZIs0IR2rbI+6S+1CtugVMHl
+oxuRagcCIQCtoMZh0rZFlmUkH19BxrDvQe3JqCuQpd2HiZdvZTJhyQ==
+-----END CERTIFICATE-----`;
+
+export const TEST_SERVER_KEY = `-----BEGIN EC PARAMETERS-----
+BggqhkjOPQMBBw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIKFSLmqZO5KgG9hGbNhhJa0V2IMl39N2UHUj5VUh6DsmoAoGCCqGSM49
+AwEHoUQDQgAEolKc1EyyTH6MKX0GR7FhbXCN0O3G/D2riPJ045K+qCL6m0Fso38e
+NxKbNENSkE1tX7j4uv6tcLmtHU/cKxjUgw==
+-----END EC PRIVATE KEY-----`;
+
+export const TEST_WRONG_CA_CERT = `-----BEGIN CERTIFICATE-----
+MIIBhDCCASugAwIBAgIUWM3XX235lciHJ/UKoajhrSx2dPwwCgYIKoZIzj0EAwIw
+GDEWMBQGA1UEAwwNV3JvbmcgVGVzdCBDQTAeFw0yNjA3MjkxNTU4MTBaFw0zNjA3
+MjYxNTU4MTBaMBgxFjAUBgNVBAMMDVdyb25nIFRlc3QgQ0EwWTATBgcqhkjOPQIB
+BggqhkjOPQMBBwNCAAREOwLQCQYQI7zEa7GaSZag98eOF5KMckBPrDsDxS0Bb5lx
+uIa3iWu9CI6Xkw+v+avpPF+Oz3QB7GXgCboKHFico1MwUTAdBgNVHQ4EFgQU1PRs
+qLXtaHVxaKu0e0le1KpD6GYwHwYDVR0jBBgwFoAU1PRsqLXtaHVxaKu0e0le1KpD
+6GYwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNHADBEAiA9vA9jI66Un7zQ
+ycf0+6Ze0y5aSM9FLojGcVuzZb0iyAIgIC6ooFag9BuAZqcj/k07hjARi6UVOpEy
+sIJIkokji38=
+-----END CERTIFICATE-----`;

package/src/server/services/freeipa/tls.ts

@@ -0,0 +1,44 @@
+import { createHash } from "node:crypto";
+
+/**
+ * TLS resolver slot for FreeIPA transport (`client.ts`, `session.ts`).
+ *
+ * The transport layer cannot directly read settings (would create a cycle:
+ * `services/freeipa-config.ts` already depends on `server/services/freeipa/`).
+ * Instead, the layer that owns settings registers a resolver via
+ * `setFreeIpaTlsResolver()` and the transport calls `getFreeIpaTls()` per fetch.
+ *
+ * Resolver is async — it reads through the Redis cache-aside settings layer.
+ * Returns Bun fetch `tls` options. Without a registered settings resolver,
+ * system trust remains explicitly verified.
+ * Resolution order is the resolver's concern (typically: ca_cert > allow_insecure > system trust).
+ */
+// `BunFetchRequestInitTLS` is declared as a global (see bun-types/globals.d.ts)
+// and not exported from the "bun" module. Use `Bun.TLSOptions` — fetch's `tls`
+// option accepts it (the global extends it with `checkServerIdentity` which we
+// don't need).
+type FreeIpaTls = Bun.TLSOptions;
+
+let resolver: (() => Promise<FreeIpaTls | undefined>) | null = null;
+
+export const setFreeIpaTlsResolver = (fn: (() => Promise<FreeIpaTls | undefined>) | null): void => {
+  resolver = fn;
+};
+
+export const getFreeIpaTls = async (): Promise<FreeIpaTls> => {
+  return (await resolver?.()) ?? { rejectUnauthorized: true };
+};
+
+/**
+ * Stable fingerprint of the current TLS config — used as a cache-key suffix
+ * (e.g. for the cached service session) so that flipping `allow_insecure` or
+ * rotating `ca_cert` forces re-establishment of cached connections.
+ */
+export const getFreeIpaTlsFingerprint = async (): Promise<string> => {
+  const tls = await getFreeIpaTls();
+  if (tls.ca && typeof tls.ca === "string" && tls.ca.length > 0) {
+    return `ca:${createHash("sha256").update(tls.ca).digest("hex")}`;
+  }
+  if (tls.rejectUnauthorized === false) return "insec";
+  return "sys";
+};

package/src/server/services/freeipa/transport.ts

@@ -0,0 +1,116 @@
+export const FREEIPA_REQUEST_TIMEOUT_MS = 30_000;
+export const FREEIPA_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
+
+export type FreeIpaTransportErrorKind = "aborted" | "invalid_response" | "network" | "timeout" | "tls" | "upstream";
+
+export class FreeIpaTransportError extends Error {
+  readonly kind: FreeIpaTransportErrorKind;
+  readonly status: number | null;
+
+  constructor(kind: FreeIpaTransportErrorKind, message: string, options: { cause?: unknown; status?: number } = {}) {
+    super(message, options.cause === undefined ? undefined : { cause: options.cause });
+    this.name = "FreeIpaTransportError";
+    this.kind = kind;
+    this.status = options.status ?? null;
+  }
+}
+
+const isTlsError = (error: unknown): boolean => {
+  const text = [
+    error instanceof Error ? error.message : String(error),
+    error instanceof Error && error.cause instanceof Error ? error.cause.message : "",
+    error instanceof Error && typeof error.cause === "object" && error.cause !== null && "code" in error.cause
+      ? String(error.cause.code)
+      : "",
+  ]
+    .join(" ")
+    .toLowerCase();
+
+  return /certificate|cert_|hostname|self[- ]signed|ssl|tls|unable to verify|unknown ca/.test(text);
+};
+
+export const withFreeIpaResponse = async <T>(
+  input: string | URL,
+  init: BunFetchRequestInit,
+  consume: (response: Response) => Promise<T>,
+  options: { signal?: AbortSignal; timeoutMs?: number } = {},
+): Promise<T> => {
+  const controller = new AbortController();
+  const timeoutMs = options.timeoutMs ?? FREEIPA_REQUEST_TIMEOUT_MS;
+  let timedOut = false;
+  let timeout!: ReturnType<typeof setTimeout>;
+  const timeoutFailure = new Promise<never>((_, reject) => {
+    timeout = setTimeout(() => {
+      timedOut = true;
+      controller.abort(new DOMException("FreeIPA request timed out", "TimeoutError"));
+      reject(new FreeIpaTransportError("timeout", `FreeIPA request timed out after ${timeoutMs} ms`));
+    }, timeoutMs);
+  });
+  let rejectCallerAbort: ((error: FreeIpaTransportError) => void) | null = null;
+  const callerAbortFailure = new Promise<never>((_, reject) => {
+    rejectCallerAbort = reject;
+  });
+  const abortFromCaller = () => {
+    controller.abort(options.signal?.reason);
+    rejectCallerAbort?.(new FreeIpaTransportError("aborted", "FreeIPA request was cancelled"));
+  };
+
+  if (options.signal?.aborted) abortFromCaller();
+  else options.signal?.addEventListener("abort", abortFromCaller, { once: true });
+
+  try {
+    const response = await Promise.race([fetch(input, { ...init, signal: controller.signal }), timeoutFailure, callerAbortFailure]);
+    return await Promise.race([consume(response), timeoutFailure, callerAbortFailure]);
+  } catch (error) {
+    if (error instanceof FreeIpaTransportError) throw error;
+    if (timedOut) {
+      throw new FreeIpaTransportError("timeout", `FreeIPA request timed out after ${timeoutMs} ms`, { cause: error });
+    }
+    if (options.signal?.aborted) {
+      throw new FreeIpaTransportError("aborted", "FreeIPA request was cancelled", { cause: error });
+    }
+    if (isTlsError(error)) {
+      throw new FreeIpaTransportError("tls", "FreeIPA TLS verification failed", { cause: error });
+    }
+    throw new FreeIpaTransportError("network", "Could not connect to FreeIPA", { cause: error });
+  } finally {
+    clearTimeout(timeout);
+    options.signal?.removeEventListener("abort", abortFromCaller);
+  }
+};
+
+export const readFreeIpaErrorBody = async (
+  response: Response,
+  maxBytes = FREEIPA_ERROR_BODY_LIMIT_BYTES,
+): Promise<{ text: string; truncated: boolean }> => {
+  if (!response.body) return { text: "", truncated: false };
+
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let bytesRead = 0;
+  let text = "";
+
+  try {
+    while (bytesRead <= maxBytes) {
+      const { done, value } = await reader.read();
+      if (done) return { text: text + decoder.decode(), truncated: false };
+      if (!value) continue;
+
+      const remaining = maxBytes - bytesRead;
+      if (value.byteLength > remaining) {
+        text += decoder.decode(value.subarray(0, Math.max(0, remaining)), { stream: true });
+        return { text: text + decoder.decode(), truncated: true };
+      }
+      bytesRead += value.byteLength;
+      text += decoder.decode(value, { stream: true });
+    }
+    return { text: text + decoder.decode(), truncated: true };
+  } finally {
+    await reader.cancel().catch(() => undefined);
+  }
+};
+
+export const isFreeIpaUpstreamStatus = (status: number): boolean => status === 408 || status === 429 || status >= 500;
+
+export const upstreamFreeIpaError = (status: number): FreeIpaTransportError =>
+  new FreeIpaTransportError("upstream", `FreeIPA returned HTTP ${status}`, { status });

package/src/server/services/freeipa/util.ts

@@ -0,0 +1,59 @@
+import { toPgTextArray as serializePgTextArray } from "../../../services/postgres";
+
+export class IpaError extends Error {
+  constructor(
+    message: string,
+    public readonly code?: number,
+    public readonly data?: unknown,
+  ) {
+    super(message);
+    this.name = "IpaError";
+  }
+}
+
+export type DbRow = Record<string, unknown>;
+
+export const str = (val: unknown): string => {
+  if (Array.isArray(val)) return String(val[0] ?? "");
+  return String(val ?? "");
+};
+
+export const num = (val: unknown): number | null => {
+  const raw = Array.isArray(val) ? val[0] : val;
+  const n = Number(raw);
+  return Number.isNaN(n) ? null : n;
+};
+
+export const parseGeneralizedTime = (val: unknown): Date | null => {
+  let raw = Array.isArray(val) ? val[0] : val;
+  if (raw && typeof raw === "object" && "__datetime__" in raw) {
+    raw = (raw as Record<string, unknown>).__datetime__;
+  }
+  const s = typeof raw === "string" ? raw : "";
+  if (!s || s.length < 14) return null;
+  const iso = `${s.slice(0, 4)}-${s.slice(4, 6)}-${s.slice(6, 8)}T${s.slice(8, 10)}:${s.slice(10, 12)}:${s.slice(12, 14)}Z`;
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? null : d;
+};
+
+export const toGeneralizedTime = (date: Date): string => {
+  const y = date.getUTCFullYear();
+  const m = String(date.getUTCMonth() + 1).padStart(2, "0");
+  const d = String(date.getUTCDate()).padStart(2, "0");
+  const h = String(date.getUTCHours()).padStart(2, "0");
+  const min = String(date.getUTCMinutes()).padStart(2, "0");
+  const s = String(date.getUTCSeconds()).padStart(2, "0");
+  return `${y}${m}${d}${h}${min}${s}Z`;
+};
+
+export const escapeLike = (value: string): string => value.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
+
+export const toExcludedGroupsSet = (groups: string[]): Set<string> => new Set(groups.map((group) => group.trim()).filter(Boolean));
+
+export const mapIpaErrorCode = (code: number): 400 | 401 | 403 => {
+  if (code === 4001) return 401;
+  if (code === 4301) return 403;
+  return 400;
+};
+
+export const toPgTextArray = serializePgTextArray;