@marcusrbrown/infra 0.10.0 → 0.10.2

package/src/commands/vpn/peers.ts

@@ -0,0 +1,243 @@
+import {readFile, writeFile} from 'node:fs/promises'
+
+import {z} from 'zod'
+
+// ── Schema ────────────────────────────────────────────────────────────────────
+
+const peerSchema = z.object({
+  name: z.string(),
+  publicKey: z.string(),
+  tunnelIp: z.string(),
+})
+
+const peersFileSchema = z
+  .object({
+    peers: z.array(peerSchema),
+  })
+  .superRefine((data, ctx) => {
+    // Reject duplicate tunnelIp values — duplicated tunnel IPs break WireGuard routing silently
+    const seenIps = new Set<string>()
+    for (const peer of data.peers) {
+      if (seenIps.has(peer.tunnelIp)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: `Duplicate tunnel IP "${peer.tunnelIp}" — each peer must have a unique tunnel IP.`,
+          path: ['peers'],
+        })
+        return
+      }
+      seenIps.add(peer.tunnelIp)
+    }
+
+    // Reject duplicate name values
+    const seenNames = new Set<string>()
+    for (const peer of data.peers) {
+      if (seenNames.has(peer.name)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: `Duplicate name "${peer.name}" — each peer must have a unique name.`,
+          path: ['peers'],
+        })
+        return
+      }
+      seenNames.add(peer.name)
+    }
+  })
+
+export type Peer = z.infer<typeof peerSchema>
+export type PeersFile = z.infer<typeof peersFileSchema>
+
+// ── Validation ────────────────────────────────────────────────────────────────
+
+/**
+ * Parse and validate a raw value as a PeersFile.
+ * Throws a ZodError on invalid shape — fail-closed, no silent empty.
+ */
+export function parsePeersJson(raw: unknown): PeersFile {
+  return peersFileSchema.parse(raw)
+}
+
+// ── File I/O (thin layer — only these functions touch the filesystem) ─────────
+
+export async function readPeers(filePath: string): Promise<PeersFile> {
+  const content = await readFile(filePath, 'utf-8')
+  const raw: unknown = JSON.parse(content)
+  return parsePeersJson(raw)
+}
+
+/**
+ * Read peers from filePath, returning {peers: []} when the file is absent (ENOENT).
+ *
+ * ENOENT is the only error that is silently treated as an empty roster — this
+ * supports fresh checkouts where peers.json is gitignored and does not exist yet.
+ *
+ * All other errors (corrupt JSON, schema violations, permission errors) still throw
+ * so that a corrupt file is never silently treated as an empty roster.
+ */
+export async function readPeersOrEmpty(filePath: string): Promise<PeersFile> {
+  try {
+    return await readPeers(filePath)
+  } catch (error) {
+    if (error instanceof Error && 'code' in error && (error as NodeJS.ErrnoException).code === 'ENOENT') {
+      return {peers: []}
+    }
+    throw error
+  }
+}
+
+export async function writePeers(filePath: string, peersFile: PeersFile): Promise<void> {
+  const content = `${JSON.stringify(peersFile, null, 2)}\n`
+  await writeFile(filePath, content, {mode: 0o600})
+}
+
+// ── IP allocation ─────────────────────────────────────────────────────────────
+
+const TUNNEL_SUBNET_PREFIX = '10.8.0.'
+const SERVER_OCTET = 1
+const FIRST_CLIENT_OCTET = 2
+
+/**
+ * Extract the last octet from a tunnel IP like '10.8.0.N'.
+ * Returns null if the IP doesn't match the expected subnet.
+ */
+function extractOctet(tunnelIp: string): number | null {
+  if (!tunnelIp.startsWith(TUNNEL_SUBNET_PREFIX)) {
+    return null
+  }
+  const octetStr = tunnelIp.slice(TUNNEL_SUBNET_PREFIX.length)
+  const octet = Number.parseInt(octetStr, 10)
+  return Number.isFinite(octet) && octet >= FIRST_CLIENT_OCTET ? octet : null
+}
+
+// Last valid client octet: .254 (.1 is server, .255 is broadcast)
+const LAST_CLIENT_OCTET = 254
+
+/**
+ * Compute the next available tunnel IP.
+ * Sequential 10.8.0.N/32 starting at .2 (.1 is reserved for the server).
+ * Reuses freed slots — returns the lowest free N >= 2.
+ * Throws when all 253 client slots (.2–.254) are exhausted.
+ */
+export function nextTunnelIp(peers: Peer[]): string {
+  const allocated = new Set<number>()
+  for (const peer of peers) {
+    const octet = extractOctet(peer.tunnelIp)
+    if (octet !== null) {
+      allocated.add(octet)
+    }
+  }
+
+  let n = FIRST_CLIENT_OCTET
+  while (allocated.has(n) || n === SERVER_OCTET) {
+    n++
+  }
+
+  if (n > LAST_CLIENT_OCTET) {
+    throw new Error(`Tunnel subnet 10.8.0.0/24 exhausted (max 253 peers).`)
+  }
+
+  return `${TUNNEL_SUBNET_PREFIX}${n}`
+}
+
+// ── Peer mutations (pure — return new arrays, never mutate) ───────────────────
+
+/**
+ * Add a peer with the next available tunnel IP.
+ * Throws if a peer with the same name already exists.
+ */
+export function addPeer(
+  peers: Peer[],
+  {name, publicKey}: {name: string; publicKey: string},
+): {peers: Peer[]; tunnelIp: string} {
+  const duplicate = peers.find(p => p.name === name)
+  if (duplicate !== undefined) {
+    throw new Error(`Peer "${name}" already exists (duplicate name).`)
+  }
+
+  const tunnelIp = nextTunnelIp(peers)
+  const newPeer: Peer = {name, publicKey, tunnelIp}
+  return {peers: [...peers, newPeer], tunnelIp}
+}
+
+/**
+ * Remove a peer by name.
+ * Throws a clear error if the peer does not exist — no silent no-op.
+ */
+export function removePeer(peers: Peer[], name: string): {peers: Peer[]} {
+  const index = peers.findIndex(p => p.name === name)
+  if (index === -1) {
+    throw new Error(`Peer "${name}" not found. Cannot remove a peer that does not exist.`)
+  }
+
+  const updated = [...peers.slice(0, index), ...peers.slice(index + 1)]
+  return {peers: updated}
+}
+
+// ── Config rendering (pure — string in → string out, no IO) ──────────────────
+
+export interface ServerConfigOpts {
+  wanInterface?: string
+}
+
+/**
+ * Render a full wg0.conf server configuration.
+ *
+ * Pure function: takes keys and peers as inputs, returns a config string.
+ * The server private key is passed in (it lives on the box; this function
+ * is used server-side where the key is available locally).
+ */
+export function renderServerConfig(serverPrivateKey: string, peers: Peer[], opts?: ServerConfigOpts): string {
+  const wanInterface = opts?.wanInterface ?? 'eth0'
+
+  const lines: string[] = [
+    '[Interface]',
+    `Address = 10.8.0.1/24`,
+    `ListenPort = 51820`,
+    `PrivateKey = ${serverPrivateKey}`,
+    `PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ${wanInterface} -j MASQUERADE`,
+    `PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ${wanInterface} -j MASQUERADE`,
+  ]
+
+  for (const peer of peers) {
+    lines.push('')
+    lines.push('[Peer]')
+    lines.push(`PublicKey = ${peer.publicKey}`)
+    lines.push(`AllowedIPs = ${peer.tunnelIp}/32`)
+  }
+
+  return `${lines.join('\n')}\n`
+}
+
+export interface ClientConfigOpts {
+  clientPrivateKey: string
+  serverPublicKey: string
+  endpoint: string
+  tunnelIp: string
+  allowedIps?: string
+  dns?: string
+}
+
+/**
+ * Render a WireGuard client .conf file.
+ *
+ * Pure function: takes all config as inputs, returns a config string.
+ * allowedIps defaults to '0.0.0.0/0' (full tunnel).
+ * Pass specific CIDRs for split-tunnel.
+ */
+export function renderClientConfig(opts: ClientConfigOpts): string {
+  const {clientPrivateKey, serverPublicKey, endpoint, tunnelIp, allowedIps = '0.0.0.0/0', dns} = opts
+
+  const lines: string[] = ['[Interface]', `PrivateKey = ${clientPrivateKey}`, `Address = ${tunnelIp}/32`]
+
+  if (dns !== undefined) {
+    lines.push(`DNS = ${dns}`)
+  }
+
+  lines.push('')
+  lines.push('[Peer]')
+  lines.push(`PublicKey = ${serverPublicKey}`)
+  lines.push(`Endpoint = ${endpoint}:51820`)
+  lines.push(`AllowedIPs = ${allowedIps}`)
+
+  return `${lines.join('\n')}\n`
+}