@platless/axom-cli 0.5.9 → 0.6.52

package/dist/workstation/registrations/enrollmentPending.js

@@ -0,0 +1,361 @@
+import { constants, promises as fs } from 'node:fs';
+import path from 'node:path';
+import { createHash, createPrivateKey, createPublicKey, randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { assertLockOwnership } from '../control/locks.js';
+import { LocalControlError } from '../control/protocol.js';
+import { registrationKey, registrationServerSchema } from './model.js';
+const bounded = (maximum, empty = false) => z.string().max(maximum).refine(value => !/[\x00-\x1f\x7f-\x9f]/.test(value) && (empty || value.trim().length > 0));
+const name = bounded(128).regex(/^[A-Za-z0-9._-]+$/).refine(value => value !== '.' && value !== '..');
+export const keySchema = z.string().regex(/^[A-Za-z0-9+/]{43}=$/).refine(value => Buffer.from(value, 'base64').length === 32 && Buffer.from(value, 'base64').toString('base64') === value);
+export const workspaceSchema = z.object({ name, cwd: bounded(4096).refine(value => path.isAbsolute(value)), shell: bounded(4096) }).strict();
+export const operationIdSchema = bounded(128);
+export const requestSchema = z.object({
+    protocol: z.literal(2), operationId: operationIdSchema, proposedWorkstationId: z.string().uuid(), clientPublicKey: keySchema,
+    name, os: z.object({ name: bounded(1024), version: bounded(1024, true), arch: bounded(1024), hostname: bounded(1024, true) }).strict(),
+    defaultWorkspace: workspaceSchema.optional(), shell: bounded(4096),
+    acquisition: z.discriminatedUnion('kind', [z.object({ kind: z.literal('create') }).strict(), z.object({ kind: z.literal('reattach'), expectedVersion: z.number().int().min(1).max(2147483646) }).strict()]),
+}).strict();
+export const registrationEnrollmentInputSchema = z.object({ server: z.string(), accessToken: z.string().min(1).max(32_768).refine(value => !/[\r\n]/.test(value)), expectedOwnerUserId: z.string().min(1).max(1024).optional(), operationId: operationIdSchema, defaults: z.object({ name: requestSchema.shape.name, shell: requestSchema.shape.shell, workspace: workspaceSchema.optional() }).strict() }).strict();
+const targetSchema = z.object({ schemaVersion: z.literal(1), server: registrationServerSchema, ownerUserId: bounded(1024), registrationId: z.string().uuid(), requestDigest: z.string().regex(/^[a-f0-9]{64}$/) }).strict();
+const pendingSchema = targetSchema.extend({ state: z.literal('pending'), request: requestSchema, clientPrivateKey: keySchema }).strict();
+const completedSchema = targetSchema.extend({ state: z.literal('completed'), registrationRevision: z.string().regex(/^[a-f0-9]{64}$/), workstationId: z.string().uuid() }).strict();
+const envelopeSchema = z.discriminatedUnion('state', [pendingSchema, completedSchema]);
+export const enrollmentStorageError = () => new LocalControlError('CORRUPT_IDENTITY', 'Enrollment recovery storage needs verification');
+export const requestDigest = (request) => createHash('sha256').update(JSON.stringify(requestSchema.parse(request))).digest('hex');
+const missing = (error) => error.code === 'ENOENT';
+export async function enrollmentDirectory(root, directory = root, create = true) {
+    const relative = path.relative(root, directory);
+    if (relative.startsWith('..') || path.isAbsolute(relative))
+        throw enrollmentStorageError();
+    let current = path.parse(root).root;
+    for (const component of directory.slice(current.length).split(path.sep).filter(Boolean)) {
+        current = path.join(current, component);
+        const privatePath = current === root || current.startsWith(root + path.sep);
+        if (create) {
+            try {
+                await fs.mkdir(current, { mode: 0o700 });
+                const parent = await fs.open(path.dirname(current), constants.O_RDONLY);
+                try {
+                    await parent.sync();
+                }
+                finally {
+                    await parent.close();
+                }
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+            }
+        }
+        const stat = await fs.lstat(current);
+        const trustedSystemLink = !privatePath && stat.isSymbolicLink() && stat.uid === 0;
+        if ((!stat.isDirectory() && !trustedSystemLink) || (privatePath && stat.isSymbolicLink()) || (process.getuid && stat.uid !== process.getuid() && (privatePath || stat.uid !== 0)))
+            throw enrollmentStorageError();
+        if (privatePath ? (stat.mode & 0o077) !== 0 : !trustedSystemLink && (stat.mode & 0o022) !== 0 && !(stat.uid === 0 && (stat.mode & 0o1000) !== 0))
+            throw enrollmentStorageError();
+    }
+}
+export async function enrollmentFile(root, file, limit = 65_536) {
+    await enrollmentDirectory(root, path.dirname(file), false);
+    const handle = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.nlink !== 1 || stat.size > limit || (stat.mode & 0o077) !== 0 || (process.getuid && stat.uid !== process.getuid()))
+            throw enrollmentStorageError();
+        const buffer = Buffer.alloc(stat.size + 1);
+        const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+        if (bytesRead !== stat.size)
+            throw enrollmentStorageError();
+        return buffer.subarray(0, bytesRead);
+    }
+    finally {
+        await handle.close();
+    }
+}
+function validate(value, server, ownerUserId) {
+    const envelope = envelopeSchema.parse(value);
+    if (envelope.server !== server || envelope.ownerUserId !== ownerUserId)
+        throw enrollmentStorageError();
+    if (envelope.state === 'pending') {
+        if (requestDigest(envelope.request) !== envelope.requestDigest)
+            throw enrollmentStorageError();
+        const privateKey = createPrivateKey({ key: Buffer.concat([Buffer.from('302e020100300506032b656e04220420', 'hex'), Buffer.from(envelope.clientPrivateKey, 'base64')]), format: 'der', type: 'pkcs8' });
+        const publicKey = createPublicKey(privateKey).export({ format: 'der', type: 'spki' }).subarray(-32).toString('base64');
+        if (publicKey !== envelope.request.clientPublicKey)
+            throw enrollmentStorageError();
+    }
+    return envelope;
+}
+function publicationTransition(previous, next) {
+    if (JSON.stringify(previous) === JSON.stringify(next))
+        return 'same';
+    if (!previous)
+        return next.state === 'pending' ? 'create' : null;
+    if (previous.state === 'pending' && next.state === 'completed' && previous.registrationId === next.registrationId && previous.requestDigest === next.requestDigest && previous.request.proposedWorkstationId === next.workstationId)
+        return 'committed';
+    if (previous.state === 'completed' && next.state === 'pending' && previous.registrationId !== next.registrationId)
+        return 'removed';
+    return null;
+}
+function publicationStem(name) {
+    const final = /^([a-f0-9]{64})\.json$/.exec(name);
+    if (final)
+        return final[1];
+    const candidate = /^([a-f0-9]{64})\.write-(.+)$/.exec(name);
+    if (!candidate || !z.string().uuid().safeParse(candidate[2]).success)
+        throw enrollmentStorageError();
+    return candidate[1];
+}
+async function readPublications(root, stem, names, target) {
+    const directory = path.join(root, 'enrollment-pending');
+    const parse = (value) => {
+        const parsed = envelopeSchema.parse(value);
+        const envelope = validate(parsed, target?.server ?? parsed.server, target?.ownerUserId ?? parsed.ownerUserId);
+        if (createHash('sha256').update(registrationKey(envelope.server, envelope.ownerUserId)).digest('hex') !== stem)
+            throw enrollmentStorageError();
+        return envelope;
+    };
+    let final = null;
+    try {
+        final = parse(JSON.parse((await enrollmentFile(root, path.join(directory, stem + '.json'))).toString()));
+    }
+    catch (error) {
+        if (!missing(error))
+            throw error;
+    }
+    const candidates = names.filter(name => name.startsWith(stem + '.write-'));
+    if (candidates.length > 16)
+        throw enrollmentStorageError();
+    const valid = [], incomplete = [];
+    for (const name of candidates) {
+        if (publicationStem(name) !== stem)
+            throw enrollmentStorageError();
+        const file = path.join(directory, name), buffer = await enrollmentFile(root, file);
+        let value;
+        try {
+            value = JSON.parse(buffer.toString());
+        }
+        catch (error) {
+            if (!(error instanceof SyntaxError))
+                throw error;
+            incomplete.push(file);
+            continue;
+        }
+        valid.push({ file, envelope: parse(value) });
+    }
+    if (valid.some(candidate => JSON.stringify(candidate.envelope) !== JSON.stringify(valid[0].envelope)))
+        throw enrollmentStorageError();
+    if (valid[0] && !publicationTransition(final, valid[0].envelope))
+        throw enrollmentStorageError();
+    return { final, valid, incomplete };
+}
+export async function inspectPendingEnrollments(root) {
+    const directory = path.join(root, 'enrollment-pending');
+    try {
+        try {
+            await enrollmentDirectory(root, directory, false);
+        }
+        catch (error) {
+            if (missing(error))
+                return [];
+            throw error;
+        }
+        const names = await fs.readdir(directory);
+        if (names.length > 1024)
+            throw enrollmentStorageError();
+        const pending = [];
+        for (const stem of new Set(names.map(publicationStem))) {
+            const publications = await readPublications(root, stem, names);
+            const envelope = publications.final?.state === 'pending' ? publications.final : publications.valid[0]?.envelope;
+            if (envelope?.state === 'pending')
+                pending.push({ operationId: envelope.request.operationId, registrationId: envelope.registrationId, target: { server: envelope.server, ownerUserId: envelope.ownerUserId } });
+            else if (publications.incomplete.length)
+                pending.push({ operationId: stem, registrationId: null, target: null });
+        }
+        return pending;
+    }
+    catch {
+        throw enrollmentStorageError();
+    }
+}
+export class EnrollmentPendingStore {
+    root;
+    server;
+    ownerUserId;
+    proof;
+    afterStage;
+    directory;
+    file;
+    stem;
+    constructor(root, server, ownerUserId, proof, afterStage) {
+        this.root = root;
+        this.server = server;
+        this.ownerUserId = ownerUserId;
+        this.proof = proof;
+        this.afterStage = afterStage;
+        this.directory = path.join(root, 'enrollment-pending');
+        this.stem = createHash('sha256').update(registrationKey(server, ownerUserId)).digest('hex');
+        this.file = path.join(this.directory, this.stem + '.json');
+    }
+    async sync() {
+        const directory = await fs.open(this.directory, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            await directory.sync();
+        }
+        finally {
+            await directory.close();
+        }
+    }
+    async transition(previous, next) {
+        const transition = publicationTransition(previous, next);
+        if (transition === 'same' || transition === 'create')
+            return true;
+        if (transition === 'committed')
+            return this.proof.committed(previous, next);
+        if (transition === 'removed')
+            return this.proof.removed(previous, next);
+        return false;
+    }
+    async read() {
+        try {
+            let names;
+            try {
+                await enrollmentDirectory(this.root, this.directory, false);
+                names = await fs.readdir(this.directory);
+            }
+            catch (error) {
+                if (missing(error))
+                    return null;
+                throw error;
+            }
+            const publications = await readPublications(this.root, this.stem, names, { server: this.server, ownerUserId: this.ownerUserId });
+            let final = publications.final;
+            const valid = publications.valid;
+            for (const file of publications.incomplete) {
+                assertLockOwnership();
+                await fs.unlink(file);
+                await this.sync();
+            }
+            const candidate = valid[0];
+            if (candidate) {
+                const next = candidate.envelope;
+                const promote = JSON.stringify(final) !== JSON.stringify(next);
+                if (!await this.transition(final, next))
+                    throw enrollmentStorageError();
+                if (promote) {
+                    assertLockOwnership();
+                    await fs.rename(candidate.file, this.file);
+                    await this.sync();
+                    final = next;
+                }
+                for (const orphan of valid) {
+                    if (promote && orphan.file === candidate.file)
+                        continue;
+                    assertLockOwnership();
+                    await fs.unlink(orphan.file);
+                }
+                await this.sync();
+            }
+            return final;
+        }
+        catch {
+            throw enrollmentStorageError();
+        }
+    }
+    async write(value) {
+        const text = JSON.stringify(validate(value, this.server, this.ownerUserId));
+        if (Buffer.byteLength(text) > 65_536)
+            throw enrollmentStorageError();
+        assertLockOwnership();
+        await enrollmentDirectory(this.root, this.directory);
+        if (!await this.transition(await this.read(), value))
+            throw enrollmentStorageError();
+        const temporary = path.join(this.directory, this.stem + '.write-' + randomUUID());
+        try {
+            const handle = await fs.open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600);
+            try {
+                await handle.writeFile(text);
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            await this.afterStage?.('enrollment-' + value.state + '-file-synced');
+            assertLockOwnership();
+            await fs.rename(temporary, this.file);
+            await this.sync();
+        }
+        finally {
+            assertLockOwnership();
+            await fs.rm(temporary, { force: true });
+            await this.sync();
+        }
+    }
+    async complete(pending, registrationRevision) {
+        await this.write({ schemaVersion: 1, state: 'completed', server: pending.server, ownerUserId: pending.ownerUserId, registrationId: pending.registrationId, requestDigest: pending.requestDigest, registrationRevision, workstationId: pending.request.proposedWorkstationId });
+    }
+    async purge(registrationId, workstationId) {
+        try {
+            let final = null;
+            try {
+                final = validate(JSON.parse((await enrollmentFile(this.root, this.file)).toString()), this.server, this.ownerUserId);
+            }
+            catch (error) {
+                if (!missing(error))
+                    throw error;
+            }
+            const matches = (envelope) => {
+                if (envelope.registrationId !== registrationId)
+                    return false;
+                if ((envelope.state === 'pending' ? envelope.request.proposedWorkstationId : envelope.workstationId) !== workstationId)
+                    throw enrollmentStorageError();
+                return true;
+            };
+            const finalMatches = final !== null && matches(final);
+            let names;
+            try {
+                await enrollmentDirectory(this.root, this.directory, false);
+                names = await fs.readdir(this.directory);
+            }
+            catch (error) {
+                if (missing(error) && !final)
+                    return;
+                throw error;
+            }
+            const candidates = names.filter(name => name.startsWith(this.stem + '.write-'));
+            if (candidates.length > 16)
+                throw enrollmentStorageError();
+            const targets = [];
+            for (const name of candidates) {
+                if (!z.string().uuid().safeParse(name.slice((this.stem + '.write-').length)).success)
+                    throw enrollmentStorageError();
+                const file = path.join(this.directory, name);
+                const buffer = await enrollmentFile(this.root, file);
+                let value;
+                try {
+                    value = JSON.parse(buffer.toString());
+                }
+                catch (error) {
+                    if (!(error instanceof SyntaxError) || !finalMatches)
+                        throw error;
+                    targets.push(file);
+                    continue;
+                }
+                if (matches(validate(value, this.server, this.ownerUserId)))
+                    targets.push(file);
+            }
+            if (finalMatches && final?.state === 'pending')
+                targets.push(this.file);
+            for (const file of targets) {
+                assertLockOwnership();
+                await fs.unlink(file);
+            }
+            if (targets.length)
+                await this.sync();
+        }
+        catch {
+            throw enrollmentStorageError();
+        }
+    }
+}