@modelprofile.com/authswitch 7.0.0 → 8.1.0

package/ts/authorityrehearsal.child.ts

@@ -1,330 +0,0 @@
-import * as plugins from './plugins.js';
-import { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
-import { assertStoredAuthorityMeta, type IStoredAuthorityMeta } from './classes.authoritymodels.js';
-import type { IAuthorityRestoredRecord } from './classes.authoritybackup.js';
-import {
-  AuthorityRehearsalFramedTransport,
-  authorityRehearsalMaximumFrameBytes,
-  parseAuthorityRehearsalChildMessage,
-  parseAuthorityRehearsalParentMessage,
-  parseAuthorityRehearsalWireEntry,
-  type IAuthorityRehearsalWireSource,
-  type TAuthorityRehearsalChildMessage,
-  type TAuthorityRehearsalParentMessage,
-  type TAuthorityRehearsalWireEntry,
-} from './classes.authorityrehearsal.js';
-
-const spoolHeaderBytes = 4 + 12 + 16;
-const childReceiveTimeoutMs = 24 * 60 * 60 * 1000;
-
-const writeAll = async (file: plugins.fs.promises.FileHandle, bytes: Uint8Array): Promise<void> => {
-  let offset = 0;
-  while (offset < bytes.byteLength) {
-    const result = await file.write(bytes, offset, bytes.byteLength - offset, null);
-    if (result.bytesWritten < 1) throw new Error('Encrypted rehearsal staging stopped making progress.');
-    offset += result.bytesWritten;
-  }
-};
-
-const readExact = async (file: plugins.fs.promises.FileHandle, bytes: Uint8Array,
-  position: number): Promise<boolean> => {
-  let offset = 0;
-  while (offset < bytes.byteLength) {
-    const result = await file.read(bytes, offset, bytes.byteLength - offset, position + offset);
-    if (result.bytesRead === 0) {
-      if (offset === 0) return true;
-      throw new Error('Encrypted rehearsal staging ended within a frame.');
-    }
-    offset += result.bytesRead;
-  }
-  return false;
-};
-
-/** Append-only encrypted staging. The key exists only in this child and every plaintext buffer is wiped. */
-class EncryptedRehearsalSpool<T> {
-  private appendFile?: plugins.fs.promises.FileHandle;
-  private readonly readFiles = new Set<plugins.fs.promises.FileHandle>();
-  private appendSequence = 0;
-  private finished = false;
-
-  constructor(private readonly path: string, private readonly domain: string,
-    private readonly key: Uint8Array, private readonly parse: (value: unknown) => T) {}
-
-  public async open(): Promise<void> {
-    if (this.appendFile) throw new Error('Encrypted rehearsal staging is already open.');
-    this.appendFile = await plugins.fs.promises.open(this.path, 'wx', 0o600);
-  }
-
-  public async append(value: T): Promise<void> {
-    if (!this.appendFile || this.finished) throw new Error('Encrypted rehearsal staging is not writable.');
-    const plaintext = Buffer.from(JSON.stringify(value), 'utf8');
-    if (plaintext.byteLength < 1 || plaintext.byteLength > authorityRehearsalMaximumFrameBytes) {
-      plaintext.fill(0);
-      throw new Error('Encrypted rehearsal staging entry exceeds its size bound.');
-    }
-    const nonce = plugins.crypto.randomBytes(12);
-    const aad = Buffer.from(JSON.stringify(['authswitch-rehearsal-stage-v1', this.domain,
-      this.appendSequence]), 'utf8');
-    let ciphertext: Buffer | undefined;
-    try {
-      const cipher = plugins.crypto.createCipheriv('aes-256-gcm', this.key, nonce);
-      cipher.setAAD(aad);
-      ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-      const tag = cipher.getAuthTag();
-      const frame = Buffer.allocUnsafe(spoolHeaderBytes + ciphertext.byteLength);
-      frame.writeUInt32BE(ciphertext.byteLength, 0);
-      nonce.copy(frame, 4); tag.copy(frame, 16); ciphertext.copy(frame, spoolHeaderBytes);
-      try { await writeAll(this.appendFile, frame); }
-      finally { frame.fill(0); tag.fill(0); }
-      this.appendSequence++;
-    } finally {
-      plaintext.fill(0); nonce.fill(0); aad.fill(0); ciphertext?.fill(0);
-    }
-  }
-
-  public async finish(): Promise<void> {
-    if (this.finished) return;
-    this.finished = true;
-    const file = this.appendFile;
-    this.appendFile = undefined;
-    if (file) await file.close();
-  }
-
-  public async *values(): AsyncGenerator<T> {
-    if (!this.finished) throw new Error('Encrypted rehearsal staging is not complete.');
-    const file = await plugins.fs.promises.open(this.path, 'r');
-    this.readFiles.add(file);
-    let position = 0;
-    let itemSequence = 0;
-    try {
-      while (true) {
-        const header = Buffer.alloc(spoolHeaderBytes);
-        const ended = await readExact(file, header, position);
-        if (ended) return;
-        const length = header.readUInt32BE(0);
-        if (length < 1 || length > authorityRehearsalMaximumFrameBytes) {
-          header.fill(0);
-          throw new Error('Encrypted rehearsal staging frame exceeds its size bound.');
-        }
-        const ciphertext = Buffer.allocUnsafe(length);
-        try {
-          if (await readExact(file, ciphertext, position + spoolHeaderBytes)) {
-            throw new Error('Encrypted rehearsal staging ended within a frame.');
-          }
-          const aad = Buffer.from(JSON.stringify(['authswitch-rehearsal-stage-v1', this.domain,
-            itemSequence]), 'utf8');
-          let plaintext: Buffer | undefined;
-          try {
-            const decipher = plugins.crypto.createDecipheriv('aes-256-gcm', this.key,
-              header.subarray(4, 16));
-            decipher.setAAD(aad);
-            decipher.setAuthTag(header.subarray(16, spoolHeaderBytes));
-            plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-            let decoded: unknown;
-            try { decoded = JSON.parse(plaintext.toString('utf8')) as unknown; }
-            catch { throw new Error('Encrypted rehearsal staging contains invalid JSON.'); }
-            yield this.parse(decoded);
-          } finally { aad.fill(0); plaintext?.fill(0); }
-        } finally { header.fill(0); ciphertext.fill(0); }
-        position += spoolHeaderBytes + length;
-        itemSequence++;
-      }
-    } finally {
-      this.readFiles.delete(file);
-      await file.close();
-    }
-  }
-
-  public async close(): Promise<void> {
-    const errors: unknown[] = [];
-    const appendFile = this.appendFile;
-    this.appendFile = undefined;
-    if (appendFile) try { await appendFile.close(); } catch (error) { errors.push(error); }
-    for (const file of this.readFiles) {
-      try { await file.close(); } catch (error) { errors.push(error); }
-    }
-    this.readFiles.clear();
-    if (errors.length) throw new AggregateError(errors, 'Encrypted rehearsal staging cleanup failed.');
-  }
-}
-
-const validateRoot = async (rootInput: string): Promise<string> => {
-  if (!plugins.path.isAbsolute(rootInput)) throw new Error('Rehearsal root must be absolute.');
-  const root = await plugins.fs.promises.realpath(rootInput);
-  if (root !== rootInput) throw new Error('Rehearsal root must be canonical.');
-  const stat = await plugins.fs.promises.lstat(root);
-  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
-    || (stat.mode & 0o077) !== 0) throw new Error('Rehearsal root is not private.');
-  return root;
-};
-
-const recordKey = (record: IAuthorityRestoredRecord): string => `${record.model}\u0000${record.id}`;
-const parseRecord = (value: unknown): IAuthorityRestoredRecord => {
-  const entry = parseAuthorityRehearsalWireEntry(value);
-  if ('kind' in entry) throw new Error('Encrypted record staging contains a source.');
-  return entry;
-};
-const parseSource = (value: unknown): IAuthorityRehearsalWireSource => {
-  const entry = parseAuthorityRehearsalWireEntry(value);
-  if (!('kind' in entry)) throw new Error('Encrypted source staging contains a record.');
-  return entry;
-};
-
-const run = async (): Promise<void> => {
-  // tsrun deliberately presents script arguments from argv[0], while built Node entrypoints retain argv[0..1].
-  const root = await validateRoot(process.argv.at(-1) ?? '');
-  const reader = plugins.fs.createReadStream('', { fd: 3, autoClose: false });
-  const writer = plugins.fs.createWriteStream('', { fd: 4, autoClose: false });
-  const transport = new AuthorityRehearsalFramedTransport<TAuthorityRehearsalParentMessage,
-    TAuthorityRehearsalChildMessage>({ readable: reader, writable: writer,
-      parseIncoming: parseAuthorityRehearsalParentMessage,
-      validateOutgoing: parseAuthorityRehearsalChildMessage });
-  const key = plugins.crypto.randomBytes(32);
-  const metaSpool = new EncryptedRehearsalSpool<IAuthorityRestoredRecord>(
-    plugins.path.join(root, 'meta.stage'), 'meta', key, parseRecord);
-  const recordSpool = new EncryptedRehearsalSpool<IAuthorityRestoredRecord>(
-    plugins.path.join(root, 'records.stage'), 'records', key, parseRecord);
-  const sourceSpool = new EncryptedRehearsalSpool<IAuthorityRehearsalWireSource>(
-    plugins.path.join(root, 'sources.stage'), 'sources', key, parseSource);
-  let database: AuthSwitchAuthorityDatabase | undefined;
-  let recordRestoreIterator: AsyncIterator<IAuthorityRestoredRecord> | undefined;
-  let recordReadbackIterator: AsyncIterator<IAuthorityRestoredRecord> | undefined;
-  let sourceReadbackIterator: AsyncIterator<IAuthorityRehearsalWireSource> | undefined;
-  let expectedSequence = 0;
-  let metaCount = 0;
-  let recordsStarted = false;
-  let lastRecordKey = '';
-  let inputComplete = false;
-  let restored = false;
-  let recordsReadbackDone = false;
-  let phase: Extract<TAuthorityRehearsalChildMessage, { type: 'failed' }>['phase'] = 'staging';
-  let cleanClose = false;
-
-  const cleanup = async (): Promise<void> => {
-    const errors: unknown[] = [];
-    for (const iterator of [recordRestoreIterator, recordReadbackIterator, sourceReadbackIterator]) {
-      if (iterator?.return) try { await iterator.return(); } catch (error) { errors.push(error); }
-    }
-    if (database) try { await database.stop(); } catch (error) { errors.push(error); }
-    database = undefined;
-    for (const spool of [metaSpool, recordSpool, sourceSpool]) {
-      try { await spool.close(); } catch (error) { errors.push(error); }
-    }
-    key.fill(0);
-    if (errors.length) throw new AggregateError(errors, 'Rehearsal child cleanup failed.');
-  };
-
-  try {
-    await Promise.all([metaSpool.open(), recordSpool.open(), sourceSpool.open()]);
-    await transport.send({ version: 1, type: 'ready' }, childReceiveTimeoutMs);
-    while (true) {
-      const message = await transport.receive(childReceiveTimeoutMs);
-      if (message.type === 'stage') {
-        phase = 'staging';
-        if (inputComplete || message.sequence !== expectedSequence) {
-          throw new Error('Rehearsal stage sequence is invalid.');
-        }
-        const entry: TAuthorityRehearsalWireEntry = message.entry;
-        if ('kind' in entry) {
-          if (recordsStarted) throw new Error('Rehearsal sources must precede records.');
-          await sourceSpool.append(entry);
-        } else {
-          recordsStarted = true;
-          const keyValue = recordKey(entry);
-          if (keyValue <= lastRecordKey) throw new Error('Rehearsal records must be strictly ordered.');
-          lastRecordKey = keyValue;
-          if (entry.model === 'authswitch_authority_meta') {
-            if (++metaCount !== 1) throw new Error('Rehearsal input contains duplicate metadata.');
-            await metaSpool.append(entry);
-          } else await recordSpool.append(entry);
-        }
-        expectedSequence++;
-        await transport.send({ version: 1, type: 'staged', sequence: message.sequence }, childReceiveTimeoutMs);
-        continue;
-      }
-      if (message.type === 'finish') {
-        phase = 'staging';
-        if (inputComplete || message.sequence !== expectedSequence || metaCount !== 1) {
-          throw new Error('Rehearsal input is incomplete.');
-        }
-        await Promise.all([metaSpool.finish(), recordSpool.finish(), sourceSpool.finish()]);
-        inputComplete = true;
-        recordRestoreIterator = recordSpool.values()[Symbol.asyncIterator]();
-        await transport.send({ version: 1, type: 'input.complete' }, childReceiveTimeoutMs);
-        continue;
-      }
-      if (message.type === 'restore.next') {
-        phase = 'restore';
-        if (!inputComplete || restored) throw new Error('Rehearsal restore state is invalid.');
-        if (!database) {
-          database = new AuthSwitchAuthorityDatabase({ dataDirectory: plugins.path.join(root, 'database'),
-            socketPath: plugins.path.join(root, 'run', 'database.sock') });
-          await database.start({ mode: 'closed_restore' });
-          const metaIterator = metaSpool.values()[Symbol.asyncIterator]();
-          try {
-            const first = await metaIterator.next();
-            const second = await metaIterator.next();
-            if (first.done || !second.done) throw new Error('Rehearsal metadata staging is not singular.');
-            assertStoredAuthorityMeta(first.value.value);
-            const meta: IStoredAuthorityMeta = first.value.value;
-            await database.restoreClosedMeta(meta);
-          } finally { await metaIterator.return?.(undefined); }
-          await transport.send({ version: 1, type: 'restore.progress', done: false }, childReceiveTimeoutMs);
-          continue;
-        }
-        const next = await recordRestoreIterator!.next();
-        if (!next.done) {
-          await database.insertClosedRestoredRecord(next.value);
-          await transport.send({ version: 1, type: 'restore.progress', done: false }, childReceiveTimeoutMs);
-          continue;
-        }
-        await database.stop();
-        database = new AuthSwitchAuthorityDatabase({ dataDirectory: plugins.path.join(root, 'database'),
-          socketPath: plugins.path.join(root, 'run', 'database.sock') });
-        await database.start();
-        recordReadbackIterator = database.readStoredRecords({ pageSize: 64 })[Symbol.asyncIterator]();
-        sourceReadbackIterator = sourceSpool.values()[Symbol.asyncIterator]();
-        restored = true;
-        await transport.send({ version: 1, type: 'restore.progress', done: true }, childReceiveTimeoutMs);
-        continue;
-      }
-      if (message.type === 'record.next') {
-        phase = 'readback';
-        if (!restored || recordsReadbackDone) throw new Error('Rehearsal record readback state is invalid.');
-        const next = await recordReadbackIterator!.next();
-        if (next.done) recordsReadbackDone = true;
-        await transport.send({ version: 1, type: 'record', record: next.done ? null : next.value }, childReceiveTimeoutMs);
-        continue;
-      }
-      if (message.type === 'source.next') {
-        phase = 'readback';
-        if (!restored || !recordsReadbackDone) throw new Error('Rehearsal source readback state is invalid.');
-        const next = await sourceReadbackIterator!.next();
-        await transport.send({ version: 1, type: 'source', source: next.done ? null : next.value }, childReceiveTimeoutMs);
-        continue;
-      }
-      if (message.type === 'close') {
-        phase = 'cleanup';
-        await cleanup();
-        await transport.send({ version: 1, type: 'closed' }, childReceiveTimeoutMs);
-        await transport.finishWritable();
-        cleanClose = true;
-        return;
-      }
-      throw new Error('Unknown rehearsal request.');
-    }
-  } catch {
-    try { await cleanup(); }
-    catch { phase = 'cleanup'; }
-    try {
-      await transport.send({ version: 1, type: 'failed', phase }, childReceiveTimeoutMs);
-      await transport.finishWritable();
-    } catch { /* The parent may already have closed the control channel. */ }
-    process.exitCode = 1;
-  } finally {
-    if (!cleanClose) key.fill(0);
-    transport.destroy();
-  }
-};
-
-await run().catch(() => { process.exitCode = 1; });