@maudecode/kanvil 0.1.0 → 0.2.0

package/apps/server/dist/index.mjs

@@ -1,12 +1,12 @@
-import { a as photoInputSchema, c as searchAuthentication, d as account, f as apikey, h as user, i as instanceUpdateSchema, l as searchSettingsSchema, m as session, n as adminInstanceSchema, o as photoResultSchema, r as brokerSettingsSchema, s as s3SettingsSchema, t as readConfig, u as createDatabase } from "./config-Qxr_7oqZ.mjs";
+import { a as instanceUpdateSchema, c as s3SettingsSchema, d as createDatabase, f as account, g as user, h as session, i as brokerSettingsSchema, n as adminInstanceSchema, o as photoInputSchema, p as apikey, s as photoResultSchema, t as readConfig, u as searchSettingsSchema } from "./config-CbNqtJEj.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
-import { A as storageBackends, B as notificationPreferencesInput, C as members, D as projects, E as profilePhotos, F as ApiError, G as roles, H as okSchema, I as errorSchema, K as scopes, L as hasAdminRole, M as tickets, N as workspaceMembers, O as pushDeliveries, P as workspaces, R as isOperation, S as instanceSettings, T as notifications, U as operations, V as notificationPreferencesSchema, W as pushDeviceInput, _ as attachments, a as json, b as eventClock, c as projectRoleSQL, d as createBlobStorage, f as decodeImage, g as attachmentContent, h as createPollingJob, i as fail, j as subscriptions, k as pushDevices, l as createTicketSearch, m as createObjectStore, n as assertVersion, o as one, p as imageResponse, r as createDomain, s as requireRow, t as createAuth, u as createTicketIndex, v as blobObjects, w as notificationPreferences, x as events, y as deliveryCheckpoints, z as memberSchema } from "./auth-BscXb1NQ.mjs";
+import { A as pushDevices, B as memberSchema, D as profilePhotos, E as notifications, F as workspaces, G as pushDeviceInput, H as notificationPreferencesSchema, I as ApiError, J as matchesOIDCBinding, K as roles, L as errorSchema, M as subscriptions, N as tickets, O as projects, P as workspaceMembers, R as hasAdminRole, S as events, T as notificationPreferences, U as okSchema, V as notificationPreferencesInput, W as operations, _ as attachmentContent, a as fail, b as deliveryCheckpoints, c as requireRow, d as createTicketIndex, f as createBlobStorage, g as createPollingJob, h as createObjectStore, i as createDomain, j as storageBackends, k as pushDeliveries, l as projectRoleSQL, m as imageResponse, n as createInstance, o as json, p as decodeImage, q as scopes, r as assertVersion, s as one, t as createAuth, u as createTicketSearch, v as attachments, w as members, x as eventClock, y as blobObjects, z as isOperation } from "./auth-I1XEr0d4.mjs";
 import { serve } from "@hono/node-server";
 import pg from "pg";
 import { and, asc, count, desc, eq, gt, ilike, inArray, isNull, lte, or, sql } from "drizzle-orm";
 import { z } from "zod";
 import { fileURLToPath } from "node:url";
-import { createCipheriv, createDecipheriv, createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash, timingSafeEqual } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { EventEmitter } from "node:events";
 import { connect } from "amqplib";
@@ -88,7 +88,7 @@ function authPath(request) {
 		return fail(400, "invalid_path", "The authentication path is invalid");
 	}
 }
-function createAccountAdministration(database, auth) {
+function createAccountAdministration(database, auth, config) {
 	async function revokeAfterPasswordChange(headers, userId) {
 		try {
 			await auth.api.revokeUserSessions({
@@ -99,16 +99,23 @@ function createAccountAdministration(database, auth) {
 			fail(503, "session_revocation_failed", "The password changed, but existing sessions could not be revoked. Revoke this user’s sessions before continuing.");
 		}
 	}
-	async function mutate(request, run) {
+	async function mutate(request, run, administratorOnly = true) {
 		const login = await auth.api.getSession({ headers: request.headers });
 		if (!login) fail(401, "unauthorized", "Sign in to continue");
-		if (!hasAdminRole(login.user.role) || login.user.banned) fail(403, "forbidden", "Instance administrator access is required");
+		if (administratorOnly && !hasAdminRole(login.user.role) || login.user.banned) fail(403, "forbidden", "Instance administrator access is required");
 		const lock = await database.pool.connect();
 		let locked = false;
 		try {
 			await lock.query("SELECT pg_advisory_lock(7361083)");
 			locked = true;
 			const path = authPath(request);
+			if (path === "/api/auth/unlink-account") {
+				if (!one((await lock.query("SELECT email_password_enabled AS enabled FROM instance_settings WHERE id=1")).rows).enabled) {
+					const accountId = z.string().parse(mutationBody.parse(await request.clone().json()).accountId);
+					const issuer = (await auth.$context).socialProviders.find((provider) => provider.id === "oidc")?.issuer;
+					if (!(await lock.query(`SELECT account_id AS "accountId", id_token AS "idToken" FROM account WHERE user_id=$1 AND provider_id='oidc' AND id<>$2`, [login.user.id, accountId])).rows.some((binding) => matchesOIDCBinding(binding, issuer, config.OIDC_CLIENT_ID))) fail(409, "oidc_binding_required", "Enable password sign-in before unlinking your last account for the configured OIDC provider");
+				}
+			}
 			let passwordUserId;
 			if (path.endsWith("/admin/set-user-password")) passwordUserId = mutationBody.parse(await request.clone().json()).userId;
 			if ([
@@ -152,7 +159,8 @@ function createAccountAdministration(database, auth) {
 				"remove-user",
 				"set-user-password"
 			].some((name) => path === `/api/auth/admin/${name}`);
-			return request.method === "POST" && guarded ? mutate(request, () => auth.handler(request)) : auth.handler(request);
+			const unlink = path === "/api/auth/unlink-account";
+			return request.method === "POST" && (guarded || unlink) ? mutate(request, () => auth.handler(request), !unlink) : auth.handler(request);
 		},
 		register(app) {
 			app.openAPIRegistry.registerPath({
@@ -241,181 +249,6 @@ function createAccountAdministration(database, auth) {
 	};
 }
 //#endregion
-//#region src/instance.ts
-function storageIdentity(settings) {
-	return createHash("sha256").update(JSON.stringify([
-		settings.endpoint,
-		settings.region,
-		settings.bucket,
-		settings.prefix,
-		settings.forcePathStyle
-	])).digest("hex");
-}
-function createInstance(database, config) {
-	const key = createHash("sha256").update("kanvil:instance-config:v1:").update(config.BETTER_AUTH_SECRET).digest();
-	function seal(value) {
-		const iv = randomBytes(12), cipher = createCipheriv("aes-256-gcm", key, iv);
-		const bytes = Buffer.concat([cipher.update(JSON.stringify(value)), cipher.final()]);
-		return Buffer.concat([
-			iv,
-			cipher.getAuthTag(),
-			bytes
-		]).toString("base64");
-	}
-	function unseal(value) {
-		try {
-			const bytes = Buffer.from(value, "base64"), decipher = createDecipheriv("aes-256-gcm", key, bytes.subarray(0, 12));
-			decipher.setAuthTag(bytes.subarray(12, 28));
-			return JSON.parse(Buffer.concat([decipher.update(bytes.subarray(28)), decipher.final()]).toString());
-		} catch {
-			return fail(503, "configuration_key_changed", "Saved integration credentials cannot be decrypted. Restore the instance secret from your backup.");
-		}
-	}
-	async function read(db = database.db) {
-		await db.insert(instanceSettings).values({ id: 1 }).onConflictDoNothing();
-		return one(await db.select().from(instanceSettings).where(eq(instanceSettings.id, 1)));
-	}
-	async function backend(id, db = database.db) {
-		const row = one(await db.select().from(storageBackends).where(eq(storageBackends.id, id)));
-		const settings = s3SettingsSchema.parse(unseal(row.config));
-		return {
-			...row,
-			settings,
-			spec: {
-				provider: "s3",
-				config: settings
-			}
-		};
-	}
-	async function resolveS3(settings, db = database.db) {
-		settings = s3SettingsSchema.strip().parse(settings);
-		const identity = storageIdentity(settings);
-		const previous = (await db.select().from(storageBackends).where(eq(storageBackends.identity, identity)))[0];
-		const old = previous ? s3SettingsSchema.parse(unseal(previous.config)) : void 0;
-		const { secretAccessKey: suppliedSecret, ...publicSettings } = settings, secret = suppliedSecret || (old?.accessKeyId === settings.accessKeyId ? old.secretAccessKey : void 0);
-		if (settings.accessKeyId && !secret) fail(400, "missing_secret", "Provide the S3 secret access key");
-		return {
-			...publicSettings,
-			...secret ? { secretAccessKey: secret } : {}
-		};
-	}
-	async function resolveSearch(settings, db = database.db) {
-		settings = searchSettingsSchema.strip().parse(settings);
-		const row = await read(db), old = row.searchConfig ? searchSettingsSchema.parse(unseal(row.searchConfig)) : null, same = old?.url === settings.url && old.index === settings.index;
-		const { apiKey: suppliedKey, password: suppliedPassword, auth: requestedAuth, ...publicSettings } = settings, auth = requestedAuth ?? (suppliedKey ? "apiKey" : suppliedPassword && settings.username ? "basic" : same && old ? searchAuthentication(old) : searchAuthentication(settings)), apiKey = suppliedKey || (same ? old?.apiKey : void 0), password = suppliedPassword || (same && old?.username === settings.username ? old?.password : void 0);
-		if (auth === "apiKey" && !apiKey) fail(400, "missing_secret", "Provide the search API key");
-		if (auth === "basic" && (!settings.username || !password)) fail(400, "missing_secret", "Provide the search username and password");
-		return {
-			...publicSettings,
-			auth,
-			...auth === "apiKey" && apiKey ? { apiKey } : {},
-			...auth === "basic" && password ? { password } : {}
-		};
-	}
-	async function saveBackend(settings, db = database.db) {
-		const complete = await resolveS3(settings, db), identity = storageIdentity(settings);
-		return one(await db.insert(storageBackends).values({
-			identity,
-			config: seal(complete)
-		}).onConflictDoUpdate({
-			target: storageBackends.identity,
-			set: { config: seal(complete) }
-		}).returning());
-	}
-	async function storage() {
-		if (config.KANVIL_STORAGE_PROVIDER === "local") return null;
-		if (config.KANVIL_STORAGE_PROVIDER === "s3") return saveBackend(s3SettingsSchema.parse({
-			endpoint: config.S3_ENDPOINT ?? "",
-			region: config.S3_REGION,
-			bucket: config.S3_BUCKET,
-			prefix: config.S3_PREFIX,
-			forcePathStyle: config.S3_FORCE_PATH_STYLE,
-			accessKeyId: config.S3_ACCESS_KEY_ID ?? "",
-			secretAccessKey: config.S3_SECRET_ACCESS_KEY
-		}));
-		const row = await read();
-		return row.storageBackendId ? backend(row.storageBackendId) : null;
-	}
-	async function search() {
-		const row = await read();
-		if (config.KANVIL_SEARCH_PROVIDER === "postgres") return null;
-		if (config.KANVIL_SEARCH_PROVIDER === "elasticsearch") {
-			const settings = searchSettingsSchema.parse({
-				url: config.ELASTICSEARCH_URL,
-				index: config.ELASTICSEARCH_INDEX ?? `kanvil-${row.identity}`,
-				auth: config.ELASTICSEARCH_AUTH,
-				apiKey: config.ELASTICSEARCH_API_KEY,
-				username: config.ELASTICSEARCH_USERNAME,
-				password: config.ELASTICSEARCH_PASSWORD
-			});
-			return {
-				...settings,
-				auth: searchAuthentication(settings)
-			};
-		}
-		const settings = row.searchConfig ? searchSettingsSchema.parse(unseal(row.searchConfig)) : null;
-		return settings ? {
-			...settings,
-			auth: searchAuthentication(settings)
-		} : null;
-	}
-	async function broker() {
-		if (config.KANVIL_BROKER_PROVIDER === "postgres") return null;
-		if (config.KANVIL_BROKER_PROVIDER === "rabbitmq") return brokerSettingsSchema.parse({
-			url: config.RABBITMQ_URL,
-			exchange: config.RABBITMQ_EXCHANGE
-		});
-		const row = await read();
-		return row.brokerConfig ? brokerSettingsSchema.parse(unseal(row.brokerConfig)) : null;
-	}
-	async function resolveBroker(settings, db = database.db) {
-		settings = brokerSettingsSchema.strip().parse(settings);
-		const row = await read(db), old = row.brokerConfig ? brokerSettingsSchema.parse(unseal(row.brokerConfig)) : null;
-		const url = settings.url || old?.url;
-		if (!url) return fail(400, "missing_secret", "Provide the RabbitMQ connection URL");
-		return {
-			...settings,
-			url
-		};
-	}
-	async function update(value) {
-		const input = instanceUpdateSchema.parse(value);
-		return database.db.transaction(async (tx) => {
-			await tx.execute(sql`SELECT pg_advisory_xact_lock(7361083)`);
-			const current = await read(tx);
-			assertVersion(current, input.expectedVersion, "instance settings", "saving");
-			let storageId = current.storageBackendId, searchConfig = current.searchConfig, brokerConfig = current.brokerConfig;
-			if (!config.KANVIL_STORAGE_PROVIDER) storageId = input.storage.provider === "s3" ? (await saveBackend(input.storage, tx)).id : null;
-			if (!config.KANVIL_SEARCH_PROVIDER) {
-				if (input.search.provider === "postgres") searchConfig = null;
-				else searchConfig = seal(await resolveSearch(input.search, tx));
-			}
-			if (!config.KANVIL_BROKER_PROVIDER && input.broker) brokerConfig = input.broker.provider === "postgres" ? null : seal(await resolveBroker(input.broker, tx));
-			await tx.update(instanceSettings).set({
-				name: input.name,
-				description: input.description,
-				storageBackendId: storageId,
-				searchConfig,
-				brokerConfig,
-				version: current.version + 1
-			}).where(eq(instanceSettings.id, 1));
-		});
-	}
-	return {
-		read,
-		storage,
-		search,
-		backend,
-		saveBackend,
-		resolveS3,
-		resolveSearch,
-		broker,
-		resolveBroker,
-		update,
-		config
-	};
-}
-//#endregion
 //#region src/access.ts
 const credentialPermissions = z.object({ kanvil: z.array(z.enum(scopes)) });
 const credentialMetadata = z.object({ projectIds: z.array(z.uuid()).max(1e3) });
@@ -815,7 +648,7 @@ async function createEventDelivery(config, instance, database, factory = createW
 }
 //#endregion
 //#region src/instance-routes.ts
-function registerInstanceRoutes(app, database, instance, blobs, search, delivery) {
+function registerInstanceRoutes(app, database, instance, blobs, search, delivery, auth) {
 	app.openAPIRegistry.registerComponent("securitySchemes", "sessionCookie", {
 		type: "apiKey",
 		in: "cookie",
@@ -922,6 +755,7 @@ function registerInstanceRoutes(app, database, instance, blobs, search, delivery
 		return Response.json({
 			id: row.identity,
 			version: row.version,
+			authentication: await instance.authentication(),
 			name: row.name,
 			description: row.description,
 			storage: {
@@ -995,7 +829,8 @@ function registerInstanceRoutes(app, database, instance, blobs, search, delivery
 			const candidate = await instance.resolveBroker(input.broker);
 			if (!isDeepStrictEqual(candidate, await instance.broker())) await delivery.test(candidate);
 		}
-		await instance.update(input);
+		const issuer = input.authentication && !input.authentication.emailPasswordEnabled ? (await auth.$context).socialProviders.find((provider) => provider.id === "oidc")?.issuer : void 0;
+		await instance.update(input, c.get("actor").id, issuer);
 		return Response.json({ ok: true });
 	});
 	app.post("/api/v1/admin/storage/test", async (c) => {
@@ -1269,7 +1104,7 @@ async function createApplication(database, config, overrides = {}) {
 		search.sync().catch(() => {});
 	});
 	const push = adapters.push(database, config);
-	const accounts = createAccountAdministration(integrationDatabase, auth);
+	const accounts = createAccountAdministration(integrationDatabase, auth, config);
 	const app = new OpenAPIHono({ defaultHook: (result) => {
 		if (!result.success) return Response.json({ error: {
 			code: "validation_error",
@@ -1338,6 +1173,7 @@ async function createApplication(database, config, overrides = {}) {
 			description: row.description
 		})),
 		version: "0.1.0",
+		authentication: await instance.authentication(),
 		setupRequired: await setupRequired(),
 		push: config.KANVIL_PUSH_ENABLED,
 		oidc: config.OIDC_DISCOVERY_URL ? {
@@ -1390,7 +1226,7 @@ async function createApplication(database, config, overrides = {}) {
 		requireInstanceAdmin(c.get("actor"));
 		await next();
 	});
-	registerInstanceRoutes(app, database, instance, blobs, search, realtime);
+	registerInstanceRoutes(app, database, instance, blobs, search, realtime, auth);
 	accounts.register(app);
 	app.openAPIRegistry.registerPath({
 		method: "get",

package/apps/server/dist/migrate.mjs

@@ -1,4 +1,4 @@
-import { t as readConfig, u as createDatabase } from "./config-Qxr_7oqZ.mjs";
+import { d as createDatabase, t as readConfig } from "./config-CbNqtJEj.mjs";
 import { t as migrateDatabase } from "./migrate-C9f4ozB4.mjs";
 //#region src/cli/migrate.ts
 const database = createDatabase(readConfig().DATABASE_URL);

package/apps/server/dist/recover.mjs

@@ -1,19 +1,27 @@
-import { d as account, h as user, m as session, t as readConfig, u as createDatabase } from "./config-Qxr_7oqZ.mjs";
-import { i as fail, t as createAuth } from "./auth-BscXb1NQ.mjs";
-import { and, eq } from "drizzle-orm";
+import { d as createDatabase, f as account, g as user, h as session, t as readConfig } from "./config-CbNqtJEj.mjs";
+import { C as instanceSettings, R as hasAdminRole, a as fail, t as createAuth } from "./auth-I1XEr0d4.mjs";
+import { and, eq, sql } from "drizzle-orm";
 import { z } from "zod";
 import { parseArgs } from "node:util";
 import passwordPrompt from "@inquirer/password";
 import { readFileSync } from "node:fs";
 //#region src/recover-account.ts
 const localPasswordSchema = z.string().min(12).max(128);
-async function recoverLocalPassword(database, config, email, password) {
+async function recoverLocalPassword(database, config, email, password, enablePasswordSignIn = false) {
 	const normalizedEmail = z.email().parse(email.trim().toLowerCase());
 	localPasswordSchema.parse(password);
 	const hash = await (await createAuth(database, config).$context).password.hash(password);
 	return database.db.transaction(async (tx) => {
+		await tx.execute(sql`SELECT pg_advisory_xact_lock(7361083)`);
 		const identity = (await tx.select().from(user).where(eq(user.email, normalizedEmail)).for("update"))[0];
 		if (!identity) fail(404, "not_found", "No account has this email address");
+		if (enablePasswordSignIn) {
+			if (!hasAdminRole(identity.role) || identity.banned) fail(403, "forbidden", "Recover an active administrator to enable password sign-in");
+			await tx.update(instanceSettings).set({
+				emailPasswordEnabled: true,
+				version: sql`${instanceSettings.version} + 1`
+			}).where(eq(instanceSettings.id, 1));
+		}
 		const where = and(eq(account.userId, identity.id), eq(account.providerId, "credential"));
 		if ((await tx.select().from(account).where(where))[0]) await tx.update(account).set({
 			password: hash,
@@ -33,7 +41,13 @@ async function recoverLocalPassword(database, config, email, password) {
 }
 //#endregion
 //#region src/cli/recover.ts
-const { values } = parseArgs({ options: { email: { type: "string" } } });
+const { values } = parseArgs({ options: {
+	email: { type: "string" },
+	"enable-password-sign-in": {
+		type: "boolean",
+		default: false
+	}
+} });
 if (!values.email) throw new Error("Pass --email <account-email>. The new password is read privately from the terminal or stdin.");
 const password = process.stdin.isTTY ? await passwordPrompt({
 	message: "New local password",
@@ -43,7 +57,8 @@ const password = process.stdin.isTTY ? await passwordPrompt({
 const config = readConfig();
 const database = createDatabase(config.DATABASE_URL);
 try {
-	await recoverLocalPassword(database, config, values.email, password);
+	await recoverLocalPassword(database, config, values.email, password, values["enable-password-sign-in"]);
+	if (values["enable-password-sign-in"]) console.info("Instance password sign-in enabled.");
 	console.info("Local password replaced and account sessions revoked. API credentials and linked OIDC accounts are retained.");
 } finally {
 	await database.pool.end();

package/apps/server/drizzle/0013_authentication_policy.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "instance_settings" ADD COLUMN "email_password_enabled" boolean DEFAULT true NOT NULL;--> statement-breakpoint
+ALTER TABLE "instance_settings" ADD COLUMN "sso_auto_provision" boolean DEFAULT false NOT NULL;