@maudecode/kanvil 0.1.2 → 0.2.1

package/apps/server/dist/{auth-BscXb1NQ.mjs → auth-I1XEr0d4.mjs}

@@ -1,10 +1,12 @@
-import { c as searchAuthentication, h as user, l as searchSettingsSchema, m as session, p as auth_schema_exports, s as s3SettingsSchema } from "./config-Qxr_7oqZ.mjs";
+import { a as instanceUpdateSchema, c as s3SettingsSchema, f as account, g as user, h as session, i as brokerSettingsSchema, l as searchAuthentication, m as auth_schema_exports, r as authenticationPolicySchema, u as searchSettingsSchema } from "./config-CbNqtJEj.mjs";
 import { and, asc, count, desc, eq, getTableColumns, gt, ilike, inArray, isNotNull, isNull, lt, ne, notInArray, or, sql } from "drizzle-orm";
 import { alias, bigint, boolean, customType, index, integer, jsonb, pgTable, primaryKey, text, timestamp, unique, uuid } from "drizzle-orm/pg-core";
 import { z } from "zod";
-import { createHash, createHmac } from "node:crypto";
+import { decodeJwt } from "jose";
+import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "node:crypto";
 import { DeleteObjectCommand, GetObjectCommand, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
 import { icons } from "@iconify-json/lucide";
+import { APIError, createAuthMiddleware } from "better-auth/api";
 import { betterAuth } from "better-auth";
 import { admin, genericOAuth, jwt } from "better-auth/plugins";
 import { drizzleAdapter } from "@better-auth/drizzle-adapter";
@@ -13,6 +15,57 @@ import { expo } from "@better-auth/expo";
 import { mcp } from "@better-auth/mcp";
 import { cimd } from "@better-auth/cimd";
 import { fetchClientMetadataResource } from "@better-auth/cimd/node";
+//#region src/adapters/oidc.ts
+const identitySchema = z.object({
+	sub: z.string().min(1),
+	email: z.email(),
+	email_verified: z.literal(true),
+	name: z.string().nullish(),
+	picture: z.string().nullish()
+});
+const discoverySchema = z.object({
+	issuer: z.string(),
+	userinfo_endpoint: z.url({ protocol: /^https?$/ })
+});
+function createOIDCUserInfo(config) {
+	return async (tokens) => {
+		if (!tokens.idToken) return null;
+		const claims = decodeJwt(tokens.idToken);
+		let profile = identitySchema.safeParse(claims);
+		if (!profile.success) {
+			if (!config.OIDC_DISCOVERY_URL || !tokens.accessToken) return null;
+			const discovery = await fetch(config.OIDC_DISCOVERY_URL, { signal: AbortSignal.timeout(1e4) });
+			if (!discovery.ok) return null;
+			const metadata = discoverySchema.parse(await discovery.json());
+			if (metadata.issuer !== claims.iss) return null;
+			const response = await fetch(metadata.userinfo_endpoint, {
+				headers: { Authorization: `Bearer ${tokens.accessToken}` },
+				signal: AbortSignal.timeout(1e4)
+			});
+			if (!response.ok) return null;
+			profile = identitySchema.safeParse(await response.json());
+		}
+		if (!profile.success || profile.data.sub !== claims.sub) return null;
+		return {
+			...profile.data,
+			id: profile.data.sub,
+			emailVerified: true,
+			name: profile.data.name ?? "",
+			image: profile.data.picture ?? void 0
+		};
+	};
+}
+function matchesOIDCBinding(binding, issuer, clientId) {
+	if (!binding.idToken || !issuer || !clientId) return false;
+	try {
+		const claims = decodeJwt(binding.idToken);
+		const audience = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+		return claims.iss === issuer && claims.sub === binding.accountId && audience.includes(clientId);
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region ../../packages/contracts/src/index.ts
 const states = [
 	"backlog",
@@ -325,6 +378,7 @@ const eventSchema = z.object({
 	createdAt: timestamp$1
 });
 z.object({
+	authentication: authenticationPolicySchema.default(() => authenticationPolicySchema.parse({})),
 	name: z.string(),
 	description: z.string().default(""),
 	version: z.string(),
@@ -815,7 +869,9 @@ const instanceSettings = pgTable("instance_settings", {
 	description: text("description").notNull().default("Ticketing for people and agents"),
 	storageBackendId: uuid("storage_backend_id").references(() => storageBackends.id),
 	searchConfig: text("search_config"),
-	brokerConfig: text("broker_config")
+	brokerConfig: text("broker_config"),
+	emailPasswordEnabled: boolean("email_password_enabled").notNull().default(true),
+	ssoAutoProvision: boolean("sso_auto_provision").notNull().default(false)
 });
 const deliveryCheckpoints = pgTable("delivery_checkpoints", {
 	destination: text("destination").primaryKey(),
@@ -2593,15 +2649,204 @@ function createDomain(database, services = {}) {
 	};
 }
 //#endregion
+//#region src/instance.ts
+function storageIdentity(settings) {
+	return createHash("sha256").update(JSON.stringify([
+		settings.endpoint,
+		settings.region,
+		settings.bucket,
+		settings.prefix,
+		settings.forcePathStyle
+	])).digest("hex");
+}
+function createInstance(database, config) {
+	const key = createHash("sha256").update("kanvil:instance-config:v1:").update(config.BETTER_AUTH_SECRET).digest();
+	function seal(value) {
+		const iv = randomBytes(12), cipher = createCipheriv("aes-256-gcm", key, iv);
+		const bytes = Buffer.concat([cipher.update(JSON.stringify(value)), cipher.final()]);
+		return Buffer.concat([
+			iv,
+			cipher.getAuthTag(),
+			bytes
+		]).toString("base64");
+	}
+	function unseal(value) {
+		try {
+			const bytes = Buffer.from(value, "base64"), decipher = createDecipheriv("aes-256-gcm", key, bytes.subarray(0, 12));
+			decipher.setAuthTag(bytes.subarray(12, 28));
+			return JSON.parse(Buffer.concat([decipher.update(bytes.subarray(28)), decipher.final()]).toString());
+		} catch {
+			return fail(503, "configuration_key_changed", "Saved integration credentials cannot be decrypted. Restore the instance secret from your backup.");
+		}
+	}
+	async function read(db = database.db) {
+		await db.insert(instanceSettings).values({ id: 1 }).onConflictDoNothing();
+		return one(await db.select().from(instanceSettings).where(eq(instanceSettings.id, 1)));
+	}
+	async function backend(id, db = database.db) {
+		const row = one(await db.select().from(storageBackends).where(eq(storageBackends.id, id)));
+		const settings = s3SettingsSchema.parse(unseal(row.config));
+		return {
+			...row,
+			settings,
+			spec: {
+				provider: "s3",
+				config: settings
+			}
+		};
+	}
+	async function resolveS3(settings, db = database.db) {
+		settings = s3SettingsSchema.strip().parse(settings);
+		const identity = storageIdentity(settings);
+		const previous = (await db.select().from(storageBackends).where(eq(storageBackends.identity, identity)))[0];
+		const old = previous ? s3SettingsSchema.parse(unseal(previous.config)) : void 0;
+		const { secretAccessKey: suppliedSecret, ...publicSettings } = settings, secret = suppliedSecret || (old?.accessKeyId === settings.accessKeyId ? old.secretAccessKey : void 0);
+		if (settings.accessKeyId && !secret) fail(400, "missing_secret", "Provide the S3 secret access key");
+		return {
+			...publicSettings,
+			...secret ? { secretAccessKey: secret } : {}
+		};
+	}
+	async function resolveSearch(settings, db = database.db) {
+		settings = searchSettingsSchema.strip().parse(settings);
+		const row = await read(db), old = row.searchConfig ? searchSettingsSchema.parse(unseal(row.searchConfig)) : null, same = old?.url === settings.url && old.index === settings.index;
+		const { apiKey: suppliedKey, password: suppliedPassword, auth: requestedAuth, ...publicSettings } = settings, auth = requestedAuth ?? (suppliedKey ? "apiKey" : suppliedPassword && settings.username ? "basic" : same && old ? searchAuthentication(old) : searchAuthentication(settings)), apiKey = suppliedKey || (same ? old?.apiKey : void 0), password = suppliedPassword || (same && old?.username === settings.username ? old?.password : void 0);
+		if (auth === "apiKey" && !apiKey) fail(400, "missing_secret", "Provide the search API key");
+		if (auth === "basic" && (!settings.username || !password)) fail(400, "missing_secret", "Provide the search username and password");
+		return {
+			...publicSettings,
+			auth,
+			...auth === "apiKey" && apiKey ? { apiKey } : {},
+			...auth === "basic" && password ? { password } : {}
+		};
+	}
+	async function saveBackend(settings, db = database.db) {
+		const complete = await resolveS3(settings, db), identity = storageIdentity(settings);
+		return one(await db.insert(storageBackends).values({
+			identity,
+			config: seal(complete)
+		}).onConflictDoUpdate({
+			target: storageBackends.identity,
+			set: { config: seal(complete) }
+		}).returning());
+	}
+	async function storage() {
+		if (config.KANVIL_STORAGE_PROVIDER === "local") return null;
+		if (config.KANVIL_STORAGE_PROVIDER === "s3") return saveBackend(s3SettingsSchema.parse({
+			endpoint: config.S3_ENDPOINT ?? "",
+			region: config.S3_REGION,
+			bucket: config.S3_BUCKET,
+			prefix: config.S3_PREFIX,
+			forcePathStyle: config.S3_FORCE_PATH_STYLE,
+			accessKeyId: config.S3_ACCESS_KEY_ID ?? "",
+			secretAccessKey: config.S3_SECRET_ACCESS_KEY
+		}));
+		const row = await read();
+		return row.storageBackendId ? backend(row.storageBackendId) : null;
+	}
+	async function search() {
+		const row = await read();
+		if (config.KANVIL_SEARCH_PROVIDER === "postgres") return null;
+		if (config.KANVIL_SEARCH_PROVIDER === "elasticsearch") {
+			const settings = searchSettingsSchema.parse({
+				url: config.ELASTICSEARCH_URL,
+				index: config.ELASTICSEARCH_INDEX ?? `kanvil-${row.identity}`,
+				auth: config.ELASTICSEARCH_AUTH,
+				apiKey: config.ELASTICSEARCH_API_KEY,
+				username: config.ELASTICSEARCH_USERNAME,
+				password: config.ELASTICSEARCH_PASSWORD
+			});
+			return {
+				...settings,
+				auth: searchAuthentication(settings)
+			};
+		}
+		const settings = row.searchConfig ? searchSettingsSchema.parse(unseal(row.searchConfig)) : null;
+		return settings ? {
+			...settings,
+			auth: searchAuthentication(settings)
+		} : null;
+	}
+	async function broker() {
+		if (config.KANVIL_BROKER_PROVIDER === "postgres") return null;
+		if (config.KANVIL_BROKER_PROVIDER === "rabbitmq") return brokerSettingsSchema.parse({
+			url: config.RABBITMQ_URL,
+			exchange: config.RABBITMQ_EXCHANGE
+		});
+		const row = await read();
+		return row.brokerConfig ? brokerSettingsSchema.parse(unseal(row.brokerConfig)) : null;
+	}
+	async function resolveBroker(settings, db = database.db) {
+		settings = brokerSettingsSchema.strip().parse(settings);
+		const row = await read(db), old = row.brokerConfig ? brokerSettingsSchema.parse(unseal(row.brokerConfig)) : null;
+		const url = settings.url || old?.url;
+		if (!url) return fail(400, "missing_secret", "Provide the RabbitMQ connection URL");
+		return {
+			...settings,
+			url
+		};
+	}
+	async function authentication() {
+		return authenticationPolicySchema.strip().parse(await read());
+	}
+	async function update(value, actorId, oidcIssuer) {
+		const input = instanceUpdateSchema.parse(value);
+		return database.db.transaction(async (tx) => {
+			await tx.execute(sql`SELECT pg_advisory_xact_lock(7361083)`);
+			const current = await read(tx);
+			assertVersion(current, input.expectedVersion, "instance settings", "saving");
+			if (input.authentication && !input.authentication.emailPasswordEnabled) {
+				if (!config.OIDC_DISCOVERY_URL || !config.OIDC_CLIENT_ID || !config.OIDC_CLIENT_SECRET) fail(409, "oidc_required", "Configure an OIDC provider before disabling password sign-in");
+				if (!(actorId ? await tx.select({
+					idToken: account.idToken,
+					accountId: account.accountId
+				}).from(account).where(and(eq(account.userId, actorId), eq(account.providerId, "oidc"))) : []).some((binding) => matchesOIDCBinding(binding, oidcIssuer, config.OIDC_CLIENT_ID))) fail(409, "oidc_binding_required", "Link your OIDC account in User settings using the configured provider before disabling password sign-in");
+			}
+			let storageId = current.storageBackendId, searchConfig = current.searchConfig, brokerConfig = current.brokerConfig;
+			if (!config.KANVIL_STORAGE_PROVIDER) storageId = input.storage.provider === "s3" ? (await saveBackend(input.storage, tx)).id : null;
+			if (!config.KANVIL_SEARCH_PROVIDER) {
+				if (input.search.provider === "postgres") searchConfig = null;
+				else searchConfig = seal(await resolveSearch(input.search, tx));
+			}
+			if (!config.KANVIL_BROKER_PROVIDER && input.broker) brokerConfig = input.broker.provider === "postgres" ? null : seal(await resolveBroker(input.broker, tx));
+			await tx.update(instanceSettings).set({
+				...input.authentication,
+				name: input.name,
+				description: input.description,
+				storageBackendId: storageId,
+				searchConfig,
+				brokerConfig,
+				version: current.version + 1
+			}).where(eq(instanceSettings.id, 1));
+		});
+	}
+	return {
+		read,
+		authentication,
+		storage,
+		search,
+		backend,
+		saveBackend,
+		resolveS3,
+		resolveSearch,
+		broker,
+		resolveBroker,
+		update,
+		config
+	};
+}
+//#endregion
 //#region src/auth.ts
 function createAuth(database, config) {
+	const instance = createInstance(database, config);
 	return betterAuth({
 		appName: "Kanvil",
 		baseURL: config.KANVIL_URL,
 		secret: config.BETTER_AUTH_SECRET,
 		database: drizzleAdapter(database.db, {
 			provider: "pg",
-			schema: auth_schema_exports
+			schema: auth_schema_exports,
+			transaction: true
 		}),
 		trustedOrigins: config.trustedOrigins,
 		emailAndPassword: {
@@ -2611,7 +2856,26 @@ function createAuth(database, config) {
 		},
 		account: { accountLinking: {
 			enabled: true,
-			disableImplicitLinking: true
+			disableImplicitLinking: true,
+			allowDifferentEmails: true
+		} },
+		onAPIError: { errorURL: `${config.KANVIL_URL}/login` },
+		hooks: { before: createAuthMiddleware(async (ctx) => {
+			if (ctx.path === "/sign-in/email" && !(await instance.authentication()).emailPasswordEnabled) throw new APIError("FORBIDDEN", {
+				code: "password_sign_in_disabled",
+				message: "Use your identity provider to sign in"
+			});
+		}) },
+		user: { validateUserInfo: async ({ user, source }) => {
+			if (source.method !== "oauth") return void 0;
+			if (source.oauth?.providerId !== "oidc" || !user.email || user.emailVerified !== true) return {
+				error: "email_not_verified",
+				errorDescription: "The identity provider must verify your email address"
+			};
+			if (source.action === "create-user" && !(await instance.authentication()).ssoAutoProvision) return {
+				error: "signup_disabled",
+				errorDescription: "Ask an administrator to create and link your account"
+			};
 		} },
 		telemetry: { enabled: false },
 		plugins: [
@@ -2649,6 +2913,7 @@ function createAuth(database, config) {
 				providerId: "oidc",
 				discoveryUrl: config.OIDC_DISCOVERY_URL,
 				requireIdTokenVerification: true,
+				getUserInfo: createOIDCUserInfo(config),
 				clientId: config.OIDC_CLIENT_ID,
 				clientSecret: config.OIDC_CLIENT_SECRET,
 				scopes: [
@@ -2657,10 +2922,10 @@ function createAuth(database, config) {
 					"email"
 				],
 				pkce: true,
-				disableSignUp: true
+				disableSignUp: false
 			}] : [] })
 		]
 	});
 }
 //#endregion
-export { storageBackends as A, notificationPreferencesInput as B, members as C, projects as D, profilePhotos as E, ApiError as F, roles as G, okSchema as H, errorSchema as I, scopes as K, hasAdminRole as L, tickets as M, workspaceMembers as N, pushDeliveries as O, workspaces as P, isOperation as R, instanceSettings as S, notifications as T, operations as U, notificationPreferencesSchema as V, pushDeviceInput as W, attachments as _, json as a, eventClock as b, projectRoleSQL as c, createBlobStorage as d, decodeImage as f, attachmentContent as g, createPollingJob as h, fail as i, subscriptions as j, pushDevices as k, createTicketSearch as l, createObjectStore as m, assertVersion as n, one as o, imageResponse as p, createDomain as r, requireRow as s, createAuth as t, createTicketIndex as u, blobObjects as v, notificationPreferences as w, events as x, deliveryCheckpoints as y, memberSchema as z };
+export { pushDevices as A, memberSchema as B, instanceSettings as C, profilePhotos as D, notifications as E, workspaces as F, pushDeviceInput as G, notificationPreferencesSchema as H, ApiError as I, matchesOIDCBinding as J, roles as K, errorSchema as L, subscriptions as M, tickets as N, projects as O, workspaceMembers as P, hasAdminRole as R, events as S, notificationPreferences as T, okSchema as U, notificationPreferencesInput as V, operations as W, attachmentContent as _, fail as a, deliveryCheckpoints as b, requireRow as c, createTicketIndex as d, createBlobStorage as f, createPollingJob as g, createObjectStore as h, createDomain as i, storageBackends as j, pushDeliveries as k, projectRoleSQL as l, imageResponse as m, createInstance as n, json as o, decodeImage as p, scopes as q, assertVersion as r, one as s, createAuth as t, createTicketSearch as u, attachments as v, members as w, eventClock as x, blobObjects as y, isOperation as z };

package/apps/server/dist/{config-Qxr_7oqZ.mjs → config-CbNqtJEj.mjs}

@@ -385,13 +385,18 @@ const brokerSettingsSchema = z.object({
 	exchange: z.string().min(1).max(200).regex(/^[a-zA-Z0-9_.-]+$/).refine((value) => !value.startsWith("amq."), "Use an application exchange").default("kanvil.events")
 }).strict();
 const eventDeliverySettingsSchema = z.discriminatedUnion("provider", [z.object({ provider: z.literal("postgres") }).strict(), brokerSettingsSchema.extend({ provider: z.literal("rabbitmq") })]);
+const authenticationPolicySchema = z.object({
+	emailPasswordEnabled: z.boolean().default(true),
+	ssoAutoProvision: z.boolean().default(false)
+}).strict();
 const instanceUpdateSchema = z.object({
 	expectedVersion: z.number().int().positive(),
 	name: z.string().trim().min(1).max(100),
 	description: z.string().max(500),
 	storage: storageSettingsSchema,
 	search: externalSearchSettingsSchema,
-	broker: eventDeliverySettingsSchema.optional()
+	broker: eventDeliverySettingsSchema.optional(),
+	authentication: authenticationPolicySchema.optional()
 }).strict();
 z.object({
 	name: z.string(),
@@ -402,6 +407,7 @@ const adminInstanceSchema = z.object({
 	version: z.number().int(),
 	name: z.string(),
 	description: z.string(),
+	authentication: authenticationPolicySchema.default(() => authenticationPolicySchema.parse({})),
 	storage: z.object({
 		provider: z.enum(["local", "s3"]),
 		source: z.enum(["deployment", "admin"]),
@@ -572,4 +578,4 @@ function readConfig(env = process.env) {
 	};
 }
 //#endregion
-export { photoInputSchema as a, searchAuthentication as c, account as d, apikey as f, user as h, instanceUpdateSchema as i, searchSettingsSchema as l, session as m, adminInstanceSchema as n, photoResultSchema as o, auth_schema_exports as p, brokerSettingsSchema as r, s3SettingsSchema as s, readConfig as t, createDatabase as u };
+export { instanceUpdateSchema as a, s3SettingsSchema as c, createDatabase as d, account as f, user as g, session as h, brokerSettingsSchema as i, searchAuthentication as l, auth_schema_exports as m, adminInstanceSchema as n, photoInputSchema as o, apikey as p, authenticationPolicySchema as r, photoResultSchema as s, readConfig as t, searchSettingsSchema as u };