@opengeni/api-router 0.22.2 → 0.26.1

package/src/routes/enrollments.ts

@@ -20,6 +20,7 @@
 // workspace can approve it (the approve's user_code lookup is workspace-scoped) — a
 // start can never grant access to a workspace no authorized user later approves in.
 
+import { randomUUID } from "node:crypto";
 import {
   DeviceEnrollmentApproveRequest,
   DeviceEnrollmentApproveResponse,
@@ -35,11 +36,18 @@ import {
   ListEnrollmentsResponse,
   MintEnrollTokenRequest,
   MintEnrollTokenResponse,
+  RemoveEnrollmentRequest,
   RevokeEnrollmentResponse,
   type EnrollmentArch,
   type EnrollmentOs,
 } from "@opengeni/contracts";
-import { getWorkspace, listEnrollments, revokeEnrollment } from "@opengeni/db";
+import {
+  getWorkspace,
+  listEnrollments,
+  MachineRemovalIdempotencyError,
+  MachineRemovalRevisionConflictError,
+  removeEnrollment,
+} from "@opengeni/db";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { requireAccessGrant } from "@opengeni/core";
@@ -301,11 +309,12 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     await requireAccessGrant(c, deps, workspaceId, "enrollments:read");
     assertSelfhostedEnabled();
     const statusFilter = c.req.query("status");
-    const rows = await listEnrollments(
-      db,
-      workspaceId,
-      statusFilter === "active" ? { status: "active" } : {},
-    );
+    if (statusFilter !== undefined && statusFilter !== "active" && statusFilter !== "revoked") {
+      throw new HTTPException(400, { message: "status must be active or revoked" });
+    }
+    const rows = await listEnrollments(db, workspaceId, {
+      status: statusFilter === "revoked" ? "revoked" : "active",
+    });
     return c.json(
       ListEnrollmentsResponse.parse({
         enrollments: rows.map((row) =>
@@ -333,12 +342,45 @@ export function registerEnrollmentRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "enrollments:manage");
     assertSelfhostedEnabled();
-    const result = await revokeEnrollment(db, {
-      accountId: grant.accountId,
-      workspaceId,
-      enrollmentId: c.req.param("enrollmentId"),
-    });
-    return c.json(RevokeEnrollmentResponse.parse(result));
+    const parsed = RemoveEnrollmentRequest.safeParse(await c.req.json().catch(() => ({})));
+    if (!parsed.success) {
+      throw new HTTPException(400, { message: "invalid machine removal request" });
+    }
+    const idempotencyKey =
+      parsed.data.idempotencyKey?.trim() || c.req.header("idempotency-key")?.trim() || randomUUID();
+    try {
+      const result = await removeEnrollment(db, {
+        accountId: grant.accountId,
+        workspaceId,
+        enrollmentId: c.req.param("enrollmentId"),
+        operationKey: idempotencyKey,
+        ...(parsed.data.expectedUpdatedAt
+          ? { expectedUpdatedAt: parsed.data.expectedUpdatedAt }
+          : {}),
+        subjectId: grant.subjectId,
+      });
+      if (!result) {
+        throw new HTTPException(404, { message: "machine enrollment not found" });
+      }
+      return c.json(
+        RevokeEnrollmentResponse.parse({
+          revoked: result.removed,
+          ...result,
+        }),
+        200,
+      );
+    } catch (error) {
+      if (error instanceof MachineRemovalIdempotencyError) {
+        throw new HTTPException(409, { message: error.message });
+      }
+      if (error instanceof MachineRemovalRevisionConflictError) {
+        throw new HTTPException(409, {
+          message: error.message,
+          cause: { code: "stale_revision", currentUpdatedAt: error.currentUpdatedAt },
+        });
+      }
+      throw error;
+    }
   });
 }
 

package/src/routes/environments.ts

@@ -9,17 +9,19 @@ import {
   countScheduledTasksUsingVariableSet,
   countVariableSets,
   createVariableSet,
+  decryptVariableSetValue,
   deleteVariableSet,
   deleteVariableSetVariable,
   encryptVariableSetValue,
   getVariableSetByName,
   listVariableSets,
+  readVariableSetSecretAtomically,
   setVariableSetVariable,
   updateVariableSet,
 } from "@opengeni/db";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
-import { requireAccessGrant } from "@opengeni/core";
+import { requireAccessGrant, requireLiteralPermission, requirePermission } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
   assertAllowedVariableSetVariableName,
@@ -40,15 +42,21 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
   for (const prefix of prefixes) {
     app.get(`${prefix}`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      await requireAccessGrant(c, deps, workspaceId, "variable-sets:use");
+      const grant = await requireAccessGrant(c, deps, workspaceId);
+      requirePermission(grant, "variable-sets:list");
+      requirePermission(grant, "secrets:list");
       return c.json(await listVariableSets(db, workspaceId));
     });
 
     app.post(`${prefix}`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId, "variable-sets:manage");
+      const grant = await requireAccessGrant(c, deps, workspaceId);
+      requirePermission(grant, "variable-sets:write");
       const key = requireVariableSetEncryption(settings);
       const payload = CreateVariableSetRequest.parse(await c.req.json());
+      if (payload.variables.length > 0) {
+        requirePermission(grant, "secrets:write");
+      }
       const name = trimmedVariableSetName(payload.name);
       if (payload.variables.length > MAX_VARIABLES_PER_ENVIRONMENT) {
         throw new HTTPException(422, {
@@ -71,7 +79,9 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
         });
       }
       if (await getVariableSetByName(db, workspaceId, name)) {
-        throw new HTTPException(409, { message: `variable set name is already in use: ${name}` });
+        throw new HTTPException(409, {
+          message: `variable set name is already in use: ${name}`,
+        });
       }
       // Values are encrypted up front and the variableSet plus all initial
       // variables are written in one transaction: a failure leaves nothing.
@@ -95,13 +105,42 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.get(`${prefix}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      await requireAccessGrant(c, deps, workspaceId, "variable-sets:use");
+      const grant = await requireAccessGrant(c, deps, workspaceId);
+      requirePermission(grant, "variable-sets:read");
+      requirePermission(grant, "secrets:list");
       return c.json(await requireVariableSetForApi(db, workspaceId, c.req.param("variableSetId")!));
     });
 
+    if (prefix.endsWith("/variable-sets")) {
+      app.get(`${prefix}/:variableSetId/variables/:name`, async (c) => {
+        const workspaceId = c.req.param("workspaceId")!;
+        const grant = await requireAccessGrant(c, deps, workspaceId);
+        requirePermission(grant, "variable-sets:read");
+        requireLiteralPermission(grant, "secrets:read");
+        const key = requireVariableSetEncryption(settings);
+        const name = parseVariableName(c.req.param("name")!);
+        const secret = await readVariableSetSecretAtomically(db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          variableSetId: c.req.param("variableSetId")!,
+          name,
+          actor: { kind: "subject" },
+          decrypt: (valueEncrypted) => decryptVariableSetValue(key, valueEncrypted),
+        });
+        if (!secret) {
+          throw new HTTPException(404, {
+            message: "variable set variable not found",
+          });
+        }
+        return c.json(secret);
+      });
+    }
+
     app.patch(`${prefix}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId, "variable-sets:manage");
+      const grant = await requireAccessGrant(c, deps, workspaceId);
+      requirePermission(grant, "variable-sets:write");
       const variableSet = await requireVariableSetForApi(
         db,
         workspaceId,
@@ -112,7 +151,9 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
       if (name !== undefined && name !== variableSet.name) {
         const existing = await getVariableSetByName(db, workspaceId, name);
         if (existing && existing.id !== variableSet.id) {
-          throw new HTTPException(409, { message: `variable set name is already in use: ${name}` });
+          throw new HTTPException(409, {
+            message: `variable set name is already in use: ${name}`,
+          });
         }
       }
       const updated = await updateVariableSet(db, workspaceId, variableSet.id, {
@@ -129,7 +170,9 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.delete(`${prefix}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId, "variable-sets:manage");
+      const grant = await requireAccessGrant(c, deps, workspaceId);
+      requirePermission(grant, "variable-sets:write");
+      requirePermission(grant, "secrets:write");
       const variableSet = await requireVariableSetForApi(
         db,
         workspaceId,
@@ -166,7 +209,9 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.put(`${prefix}/:variableSetId/variables/:name`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId, "variable-sets:manage");
+      const grant = await requireAccessGrant(c, deps, workspaceId);
+      requirePermission(grant, "variable-sets:write");
+      requirePermission(grant, "secrets:write");
       const key = requireVariableSetEncryption(settings);
       const name = parseVariableName(c.req.param("name")!);
       const variableSet = await requireVariableSetForApi(
@@ -199,7 +244,9 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
 
     app.delete(`${prefix}/:variableSetId/variables/:name`, async (c) => {
       const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId, "variable-sets:manage");
+      const grant = await requireAccessGrant(c, deps, workspaceId);
+      requirePermission(grant, "variable-sets:write");
+      requirePermission(grant, "secrets:write");
       const name = parseVariableName(c.req.param("name")!);
       const variableSet = await requireVariableSetForApi(
         db,
@@ -208,7 +255,9 @@ export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
       );
       const deleted = await deleteVariableSetVariable(db, workspaceId, variableSet.id, name);
       if (!deleted) {
-        throw new HTTPException(404, { message: "variable set variable not found" });
+        throw new HTTPException(404, {
+          message: "variable set variable not found",
+        });
       }
       await recordVariableSetAuditEvent(db, {
         grant,