@k2b/cloud 0.6.0-rc.0

package/src/services/accounts/authz.ts

@@ -0,0 +1,44 @@
+import type { Role, UserProfile, UserProvider } from "../../contracts/shared";
+
+export type AccountsActor = { userId: string; uid: string; roles: string[]; provider?: string | null };
+
+const SELF_UPDATE_FIELDS = new Set(["givenname", "sn", "displayName", "ipa"]);
+
+export const buildRoles = (params: {
+  provider: UserProvider;
+  profile: UserProfile;
+  memberofGroup: string[];
+  manages: string[];
+  admin?: boolean;
+}): Role[] => {
+  const { provider, profile, manages } = params;
+  const roles = new Set<Role>();
+
+  roles.add(profile);
+  roles.add(provider);
+  roles.add(`${provider}/${profile}` as Extract<Role, "ipa/user" | "ipa/guest" | "local/user" | "local/guest">);
+
+  if (profile === "guest") return [...roles];
+
+  if (params.admin) roles.add("admin");
+  if (manages.length > 0) roles.add("group-manager");
+  return [...roles];
+};
+
+export const isAdminActor = (actor: AccountsActor | null | undefined): boolean => !!actor?.roles.includes("admin");
+
+export const isSelfTarget = (params: { actor: AccountsActor | null | undefined; targetUserId: string }): boolean =>
+  params.actor?.userId === params.targetUserId;
+
+export const canMutateManagedGroup = (params: {
+  actor: AccountsActor | null | undefined;
+  groupId: string;
+  managedGroupIds: string[];
+}): boolean => {
+  if (isAdminActor(params.actor)) return true;
+  if (!params.actor?.roles.includes("user") || !params.actor.roles.includes("group-manager")) return false;
+  return params.managedGroupIds.includes(params.groupId);
+};
+
+export const hasOnlySelfUpdateFields = (data: Record<string, unknown>): boolean =>
+  Object.keys(data).every((field) => SELF_UPDATE_FIELDS.has(field));

package/src/services/accounts/avatar.ts

@@ -0,0 +1,120 @@
+import { createHash } from "node:crypto";
+import { sql } from "bun";
+import { MAX_AVATAR_BYTES, MAX_AVATAR_DATA_URL_LENGTH } from "../../contracts/profile";
+import type { MutationResult } from "../../contracts/shared";
+
+export { MAX_AVATAR_BYTES, MAX_AVATAR_DATA_URL_LENGTH } from "../../contracts/profile";
+
+const AVATAR_DATA_URL_RE = /^data:image\/(png|jpeg|webp);base64,([A-Za-z0-9+/]+={0,2})$/;
+
+export type ParsedAvatarDataUrl = {
+  dataUrl: string;
+  hash: string;
+  contentType: "image/png" | "image/jpeg" | "image/webp";
+  bytes: Buffer;
+};
+
+export type StoredAvatar = ParsedAvatarDataUrl;
+
+const hashAvatar = (dataUrl: string): string => createHash("sha256").update(dataUrl).digest("hex");
+
+const isValidBase64 = (input: string, bytes: Buffer): boolean =>
+  bytes.length > 0 && bytes.toString("base64").replace(/=+$/, "") === input.replace(/=+$/, "");
+
+const hasExpectedMagicBytes = (contentType: ParsedAvatarDataUrl["contentType"], bytes: Buffer): boolean => {
+  if (contentType === "image/png") {
+    return bytes.length >= 8 && bytes[0] === 0x89 && bytes[1] === 0x50 && bytes[2] === 0x4e && bytes[3] === 0x47;
+  }
+  if (contentType === "image/jpeg") {
+    return bytes.length >= 4 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff;
+  }
+  return (
+    bytes.length >= 12 &&
+    bytes[0] === 0x52 &&
+    bytes[1] === 0x49 &&
+    bytes[2] === 0x46 &&
+    bytes[3] === 0x46 &&
+    bytes[8] === 0x57 &&
+    bytes[9] === 0x45 &&
+    bytes[10] === 0x42 &&
+    bytes[11] === 0x50
+  );
+};
+
+export const parseAvatarDataUrl = (input: string): MutationResult<ParsedAvatarDataUrl> => {
+  const dataUrl = input.trim();
+  if (dataUrl.length > MAX_AVATAR_DATA_URL_LENGTH) {
+    return { ok: false, error: "Avatar image is too large.", status: 400 };
+  }
+
+  const match = dataUrl.match(AVATAR_DATA_URL_RE);
+  if (!match) {
+    return { ok: false, error: "Avatar must be a PNG, JPEG, or WebP data URL.", status: 400 };
+  }
+
+  const contentType = `image/${match[1]}` as ParsedAvatarDataUrl["contentType"];
+  const base64 = match[2]!;
+  const bytes = Buffer.from(base64, "base64");
+
+  if (!isValidBase64(base64, bytes)) {
+    return { ok: false, error: "Avatar data is not valid base64.", status: 400 };
+  }
+  if (bytes.length > MAX_AVATAR_BYTES) {
+    return { ok: false, error: "Avatar image is too large.", status: 400 };
+  }
+  if (!hasExpectedMagicBytes(contentType, bytes)) {
+    return { ok: false, error: "Avatar image content does not match its declared type.", status: 400 };
+  }
+
+  return {
+    ok: true,
+    data: {
+      dataUrl,
+      hash: hashAvatar(dataUrl),
+      contentType,
+      bytes,
+    },
+  };
+};
+
+export const getAvatar = async (params: { id: string }): Promise<StoredAvatar | null> => {
+  const [row] = await sql<{ avatar_data_url: string | null; avatar_hash: string | null }[]>`
+    SELECT avatar_data_url, avatar_hash
+    FROM auth.users
+    WHERE id = ${params.id}::uuid
+  `;
+  if (!row?.avatar_data_url || !row.avatar_hash) return null;
+
+  const parsed = parseAvatarDataUrl(row.avatar_data_url);
+  if (!parsed.ok) return null;
+  if (parsed.data.hash !== row.avatar_hash) return null;
+  return parsed.data;
+};
+
+export const setAvatar = async (params: { id: string; dataUrl: string }): Promise<MutationResult<{ avatarHash: string }>> => {
+  const parsed = parseAvatarDataUrl(params.dataUrl);
+  if (!parsed.ok) return parsed;
+
+  const rows = await sql<{ avatar_hash: string }[]>`
+    UPDATE auth.users
+    SET avatar_data_url = ${parsed.data.dataUrl},
+        avatar_hash = ${parsed.data.hash}
+    WHERE id = ${params.id}::uuid
+    RETURNING avatar_hash
+  `;
+  const avatarHash = rows[0]?.avatar_hash;
+  if (!avatarHash) return { ok: false, error: "User not found", status: 404 };
+  return { ok: true, data: { avatarHash } };
+};
+
+export const clearAvatar = async (params: { id: string }): Promise<MutationResult<void>> => {
+  const rows = await sql<{ id: string }[]>`
+    UPDATE auth.users
+    SET avatar_data_url = NULL,
+        avatar_hash = NULL
+    WHERE id = ${params.id}::uuid
+    RETURNING id
+  `;
+  if (!rows[0]) return { ok: false, error: "User not found", status: 404 };
+  return { ok: true, data: undefined };
+};

package/src/services/accounts/base-group.ts

@@ -0,0 +1,11 @@
+import type { BaseGroup, UserProvider } from "../../contracts/shared";
+
+type DbRow = Record<string, unknown>;
+
+export const buildBaseGroup = (row: DbRow): BaseGroup => ({
+  id: row.id as string,
+  provider: row.provider as UserProvider,
+  name: row.name as string,
+  description: (row.description as string | null | undefined) ?? null,
+  gidnumber: (row.gid_number as number | null | undefined) ?? null,
+});

package/src/services/accounts/base-user.ts

@@ -0,0 +1,46 @@
+import type { BaseUser, UserProfile, UserProvider } from "../../contracts/shared";
+import { buildRoles } from "./authz";
+
+type DbRow = Record<string, unknown>;
+
+export const resolveProviderProfile = (row: DbRow): { provider: UserProvider; profile: UserProfile } => ({
+  provider: (row.provider as UserProvider | null | undefined) ?? "local",
+  profile: (row.profile as UserProfile | null | undefined) ?? "guest",
+});
+
+export const resolveBaseUserDisplayName = (row: DbRow): string => {
+  const displayName = (row.display_name as string | null | undefined) ?? "";
+  const mail = (row.mail as string | null | undefined) ?? "";
+  const uid = (row.uid as string | null | undefined) ?? "";
+  return displayName || mail || uid;
+};
+
+/**
+ * Build a BaseUser from a DB row. `admin` is taken from `row.effective_admin`
+ * when present (list queries pre-compute it by joining IPA-admin group
+ * membership), otherwise from `row.admin` for local users. The previous
+ * implementation routed through `resolveEffectiveAdminState` with an empty
+ * `memberofGroup` list, which silently dropped the admin role for IPA users.
+ */
+export const buildBaseUser = (row: DbRow): BaseUser => {
+  const { provider, profile } = resolveProviderProfile(row);
+  const effectiveAdmin = row.effective_admin !== undefined ? Boolean(row.effective_admin) : Boolean(row.admin);
+  return {
+    id: row.id as string,
+    uid: row.uid as string,
+    roles: buildRoles({
+      provider,
+      profile,
+      memberofGroup: [],
+      manages: [],
+      admin: effectiveAdmin,
+    }),
+    provider,
+    profile,
+    givenname: (row.given_name as string) ?? "",
+    sn: (row.sn as string) ?? "",
+    displayName: resolveBaseUserDisplayName(row),
+    mail: (row.mail as string) ?? null,
+    avatarHash: (row.avatar_hash as string | null | undefined) ?? null,
+  };
+};

package/src/services/accounts/duplicate-emails.ts

@@ -0,0 +1,82 @@
+import { err, fail, ok, type PageParams, type Paginated, paginate, type Result } from "@k2b/stdlib";
+import { sql } from "bun";
+import type { User } from "../../contracts/shared";
+import { type AccountsActor, isAdminActor } from "./authz";
+
+export type DuplicateEmailUser = Pick<
+  User,
+  "id" | "uid" | "provider" | "profile" | "givenname" | "sn" | "displayName" | "mail" | "accountExpires" | "lastLoginLocal"
+> & {
+  lastLoginIpa: string | null;
+  ipaSyncedAt: string | null;
+};
+
+type DuplicateEmailGroup = { email: string; users: DuplicateEmailUser[] };
+type Row = {
+  email: string;
+  id: string;
+  uid: string;
+  provider: User["provider"];
+  profile: User["profile"];
+  given_name: string;
+  sn: string;
+  display_name: string;
+  mail: string;
+  account_expires: Date | null;
+  last_login_local: Date | null;
+  last_login_ipa: Date | null;
+  synced_at: Date | null;
+};
+
+/** Temporary cleanup read: paginate addresses, never split matching accounts. */
+export const listDuplicateEmails = async (config: {
+  actor: AccountsActor;
+  pagination?: PageParams;
+}): Promise<Result<Paginated<DuplicateEmailGroup>>> => {
+  if (!isAdminActor(config.actor)) return fail(err.forbidden("Admin access required"));
+  const requested = paginate(config.pagination);
+  return sql.begin(async (tx) => {
+    // Keep the count and members consistent while another administrator deletes accounts.
+    await tx`SET TRANSACTION ISOLATION LEVEL REPEATABLE READ, READ ONLY`;
+    const duplicates = tx`
+      SELECT lower(btrim(mail)) AS email FROM auth.users
+      WHERE NULLIF(btrim(mail), '') IS NOT NULL
+      GROUP BY lower(btrim(mail)) HAVING count(*) > 1
+    `;
+    const [count] = await tx<Array<{ total: number }>>`SELECT count(*)::int AS total FROM (${duplicates}) duplicates`;
+    const total = count?.total ?? 0;
+    const perPage = requested.perPage;
+    const page = Math.min(requested.page, Math.max(1, Math.ceil(total / perPage)));
+    const rows = await tx<Row[]>`
+      SELECT d.email, u.id, u.uid, u.provider, u.profile, u.given_name, u.sn, u.display_name, u.mail,
+        u.account_expires, u.last_login_local, ui.last_login_ipa, ui.synced_at
+      FROM (${duplicates} ORDER BY email LIMIT ${perPage} OFFSET ${(page - 1) * perPage}) d
+      JOIN auth.users u ON lower(btrim(u.mail)) = d.email
+      LEFT JOIN auth.user_ipa_data ui ON ui.user_id = u.id AND u.provider = 'ipa'
+      ORDER BY d.email, u.provider, u.uid, u.id
+    `;
+    const groups = new Map<string, DuplicateEmailGroup>();
+    for (const row of rows) {
+      let group = groups.get(row.email);
+      if (!group) {
+        group = { email: row.email, users: [] };
+        groups.set(row.email, group);
+      }
+      group.users.push({
+        id: row.id,
+        uid: row.uid,
+        provider: row.provider,
+        profile: row.profile,
+        givenname: row.given_name,
+        sn: row.sn,
+        displayName: row.display_name,
+        mail: row.mail,
+        accountExpires: row.account_expires?.toISOString() ?? null,
+        lastLoginLocal: row.last_login_local?.toISOString() ?? null,
+        lastLoginIpa: row.last_login_ipa?.toISOString() ?? null,
+        ipaSyncedAt: row.synced_at?.toISOString() ?? null,
+      });
+    }
+    return ok({ items: [...groups.values()], page, perPage, total, hasNext: page * perPage < total });
+  });
+};