@readymadeit/mcp 0.0.0-stage → 0.1.0

package/bundle/hkp-rt/lib/include/log_entry.h

@@ -0,0 +1,131 @@
+#pragma once
+
+#include <chrono>
+#include <ctime>
+#include <iomanip>
+#include <sstream>
+#include <string>
+
+#include <nlohmann/json.hpp>
+
+namespace hkp
+{
+
+/// UTC, ISO 8601, to milliseconds — what every runtime stamps an entry with.
+inline std::string isoTimestamp()
+{
+  using namespace std::chrono;
+  const auto now = system_clock::now();
+  const auto seconds = time_point_cast<std::chrono::seconds>(now);
+  const auto millis = duration_cast<milliseconds>(now - seconds).count();
+
+  const std::time_t asTime = system_clock::to_time_t(seconds);
+  std::tm utc{};
+#if defined(_WIN32)
+  gmtime_s(&utc, &asTime);
+#else
+  gmtime_r(&asTime, &utc);
+#endif
+
+  std::ostringstream out;
+  out << std::put_time(&utc, "%Y-%m-%dT%H:%M:%S") << '.'
+      << std::setfill('0') << std::setw(3) << millis << 'Z';
+  return out.str();
+}
+
+enum class LogLevel
+{
+  Debug,
+  Info,
+  Warn,
+  Error
+};
+
+inline const char* toString(LogLevel level)
+{
+  switch (level)
+  {
+    case LogLevel::Debug: return "debug";
+    case LogLevel::Info:  return "info";
+    case LogLevel::Warn:  return "warn";
+    case LogLevel::Error: return "error";
+  }
+  return "info";
+}
+
+/// Severity order, so a runtime can drop anything below what it records.
+inline int levelRank(LogLevel level)
+{
+  switch (level)
+  {
+    case LogLevel::Debug: return 0;
+    case LogLevel::Info:  return 1;
+    case LogLevel::Warn:  return 2;
+    case LogLevel::Error: return 3;
+  }
+  return 1;
+}
+
+/// The level named by a board, defaulting to info for anything unrecognised.
+inline LogLevel levelFromString(const std::string& name)
+{
+  if (name == "debug") return LogLevel::Debug;
+  if (name == "warn")  return LogLevel::Warn;
+  if (name == "error") return LogLevel::Error;
+  return LogLevel::Info;
+}
+
+/**
+ * One thing worth recording about a run.
+ *
+ * A board's log is assembled by its coordinator from every runtime it spans,
+ * because only the coordinator can see the whole board — a log held per runtime
+ * would have to be stitched back together by timestamp to answer the first
+ * question anyone asks it, which is what one run did.
+ *
+ * `data` is the only free-form field and therefore the only one that can carry
+ * something a service did not mean to record. A runtime drops it unless the
+ * board asked for it, so a service that forgets to redact can only leak through
+ * a channel somebody deliberately opened.
+ */
+struct LogEntry
+{
+  std::string runId;
+  std::string parentRunId;
+  /// ISO 8601, set by the runtime that produced the entry.
+  std::string ts;
+  std::string runtimeId;
+  std::string serviceUuid;
+  LogLevel level = LogLevel::Info;
+  /// What happened, as a short stable name a reader can group by.
+  std::string event;
+  nlohmann::json data;
+  /// How long the call took, when the entry records one.
+  double durationMs = -1;
+  /// The `sub` of whoever began the run, when somebody did. Enough to answer
+  /// "who did this" from a board's log without it collecting addresses.
+  std::string caller;
+
+  nlohmann::json toJson() const
+  {
+    nlohmann::json value = {
+      {"runId", runId},
+      {"ts", ts},
+      {"runtimeId", runtimeId},
+      {"serviceUuid", serviceUuid},
+      {"level", toString(level)},
+      {"event", event},
+    };
+    if (!parentRunId.empty())
+      value["parentRunId"] = parentRunId;
+    if (!data.is_null())
+      value["data"] = data;
+    if (durationMs >= 0)
+      value["durationMs"] = durationMs;
+    if (!caller.empty())
+      value["caller"] = caller;
+    return value;
+  }
+};
+
+}

package/bundle/hkp-rt/lib/include/mounts.h

@@ -0,0 +1,139 @@
+#pragma once
+
+#include <functional>
+#include <string>
+
+#include <boost/asio/ip/tcp.hpp>
+
+namespace hkp
+{
+
+/**
+ * Endpoints a service exposes without binding a port.
+ *
+ * A service that has to be reachable from outside — an HTTP endpoint, a
+ * signalling server — is given a path on the runtime server's own port:
+ *
+ *   http://<host>:<port>/hosted/<mountId>
+ *
+ * Ports are one machine-wide namespace, so a service asking for a specific one
+ * is a land grab: two hkp-rt processes on one machine collide on whatever port
+ * a board names, and in a container each port has to be published separately.
+ * A path on the server's port needs neither, and sits behind whatever the
+ * server itself sits behind.
+ *
+ * These endpoints are unauthenticated by design — they exist for outside
+ * callers holding no token — so the unguessable id is what gates access. It is
+ * **derived, not drawn**: an HMAC of the board, the runtime and what the mount
+ * is called, keyed by a secret only the server holds. The address therefore
+ * survives reloads, restarts and redeploys, while nothing sensitive enters the
+ * board. The derivation is hkp-node's (`src/mounts.ts`), with an empty tenant:
+ * hkp-rt has one.
+ */
+
+/** Requests under this prefix are served by mounts rather than the REST API. */
+inline constexpr const char* MOUNT_PREFIX = "/hosted";
+
+/**
+ * A connection a caller opened to a mount, handed whole to the service that
+ * owns it. The service reads the request and answers on the socket itself, so
+ * a response may be held open, streamed, or upgraded to a WebSocket.
+ */
+struct MountedConnection
+{
+  boost::asio::ip::tcp::socket socket;
+  /**
+   * What was already read from the socket: the request head, with the mount's
+   * prefix taken out of its target, and whatever of the body arrived with it.
+   */
+  std::string prefetched;
+  /** The prefix this mount owns, e.g. `/hosted/ab12…`. */
+  std::string mountPath;
+};
+
+using MountAdopter = std::function<void(MountedConnection)>;
+
+/**
+ * A mount, held by the service that asked for it.
+ *
+ * The mount lasts until it is released, which destroying the handle or
+ * assigning another over it does. Releasing gives up this claim and no other:
+ * an address is derived from what the mount is called, so a second claim to
+ * the same address takes it over, and the handle of the first then releases
+ * nothing. A handle may outlive the server that issued it.
+ *
+ * Empty — false, with no url — when the server serves no mounts.
+ */
+class MountHandle
+{
+public:
+  MountHandle() = default;
+  MountHandle(std::string name, std::string url, std::function<void()> release)
+    : m_name(std::move(name)), m_url(std::move(url)), m_release(std::move(release))
+  {
+  }
+  MountHandle(const MountHandle&) = delete;
+  MountHandle& operator=(const MountHandle&) = delete;
+  MountHandle(MountHandle&& other) noexcept { take(other); }
+  MountHandle& operator=(MountHandle&& other) noexcept
+  {
+    if (this != &other)
+    {
+      release();
+      take(other);
+    }
+    return *this;
+  }
+  ~MountHandle() { release(); }
+
+  explicit operator bool() const { return !m_url.empty(); }
+  /** What the mount is called; with the board and the runtime, what its
+   *  address is derived from. */
+  const std::string& name() const { return m_name; }
+  /** The address clients are pointed at. */
+  const std::string& url() const { return m_url; }
+
+  void release()
+  {
+    if (m_release)
+    {
+      m_release();
+    }
+    m_release = nullptr;
+    m_name.clear();
+    m_url.clear();
+  }
+
+private:
+  void take(MountHandle& other)
+  {
+    m_name = std::move(other.m_name);
+    m_url = std::move(other.m_url);
+    m_release = std::move(other.m_release);
+    other.m_release = nullptr;
+    other.m_name.clear();
+    other.m_url.clear();
+  }
+
+  std::string m_name;
+  std::string m_url;
+  std::function<void()> m_release;
+};
+
+/**
+ * The id a mount always gets: the first 32 hex characters of
+ * HMAC-SHA256(secret, tenant NUL board NUL runtime NUL name).
+ */
+/**
+ * The secret kept in `file`, drawn and written there (owner-readable only)
+ * when the file does not hold one yet. Empty when it can be neither read nor
+ * written — a server then draws one for the process, and its addresses do not
+ * survive a restart.
+ */
+std::string loadOrCreateMountSecret(const std::string& file);
+
+std::string deriveMountId(const std::string& secret, const std::string& tenant,
+                          const std::string& boardName, const std::string& runtimeId,
+                          const std::string& name);
+
+}

package/bundle/hkp-rt/lib/include/origins.h

@@ -0,0 +1,363 @@
+#pragma once
+
+#include <algorithm>
+#include <cctype>
+#include <string>
+#include <vector>
+
+namespace hkp
+{
+
+/**
+ * Which browser pages may call a server, and when a request that carries no
+ * credential is let in.
+ *
+ * Being reachable only from this machine is not the same as being called only
+ * by this machine's owner: a page in their browser is a local caller too, and
+ * any site can address `127.0.0.1`. So a request admitted by where it comes
+ * from rather than by what it carries — a server running without auth, or a
+ * loopback caller of one that has it — must also not come from a foreign page,
+ * and must address the server by a name the server knows. A browser states
+ * the first in `Origin` (or, on a request it sends without one, in
+ * `Sec-Fetch-Site`) and the second in `Host`; a page cannot forge either.
+ *
+ * A caller that is not a browser sends none of these, and is let in as
+ * before: another process on this machine is not what this guards against.
+ *
+ * A request a proxy passed on is never let in this way. A reverse proxy on the
+ * same host — nginx, Caddy — makes every caller a loopback one and every
+ * request arrive at a name the server knows, so where it comes from says
+ * nothing any more. One that says so (`Forwarded`, `X-Forwarded-For`,
+ * `X-Real-IP`) is refused here; one that says nothing cannot be told apart,
+ * which is why a loopback bind is a boundary only while nothing forwards to it.
+ */
+
+namespace origins
+{
+
+inline std::string lower(std::string value)
+{
+  std::transform(value.begin(), value.end(), value.begin(),
+                 [](unsigned char c) { return static_cast<char>(std::tolower(c)); });
+  return value;
+}
+
+inline std::string trim(const std::string& value)
+{
+  const auto first = value.find_first_not_of(" \t\r\n");
+  if (first == std::string::npos)
+  {
+    return "";
+  }
+  const auto last = value.find_last_not_of(" \t\r\n");
+  return value.substr(first, last - first + 1);
+}
+
+inline bool allDigits(const std::string& value)
+{
+  return !value.empty() &&
+         std::all_of(value.begin(), value.end(), [](unsigned char c) { return std::isdigit(c) != 0; });
+}
+
+// Four dot-separated numbers and nothing else. Strict, because the names this
+// is asked about come from a request: "127.0.0.1.example.com" is a name
+// somebody else resolves, not an address.
+inline bool isIPv4Literal(const std::string& host)
+{
+  int parts = 0;
+  size_t start = 0;
+  while (start <= host.size())
+  {
+    const auto dot = host.find('.', start);
+    const auto part = host.substr(start, dot == std::string::npos ? std::string::npos : dot - start);
+    if (!allDigits(part) || part.size() > 3 || std::stoi(part) > 255)
+    {
+      return false;
+    }
+    ++parts;
+    if (dot == std::string::npos)
+    {
+      break;
+    }
+    start = dot + 1;
+  }
+  return parts == 4;
+}
+
+// "[…]" holding only what an IPv6 address is written with.
+inline bool isIPv6Literal(const std::string& host)
+{
+  if (host.size() < 4 || host.front() != '[' || host.back() != ']')
+  {
+    return false;
+  }
+  const auto inner = host.substr(1, host.size() - 2);
+  return inner.find(':') != std::string::npos &&
+         std::all_of(inner.begin(), inner.end(), [](unsigned char c) {
+           return std::isxdigit(c) != 0 || c == ':' || c == '.';
+         });
+}
+
+/** Splits "host[:port]" — a `Host` header, or what follows an origin's scheme.
+ *  False when it is neither. */
+inline bool splitHostPort(const std::string& value, std::string& host, std::string& port)
+{
+  if (value.empty())
+  {
+    return false;
+  }
+  size_t hostEnd;
+  if (value.front() == '[')
+  {
+    const auto close = value.find(']');
+    if (close == std::string::npos)
+    {
+      return false;
+    }
+    hostEnd = close + 1;
+  }
+  else
+  {
+    hostEnd = value.find(':');
+    if (hostEnd == std::string::npos)
+    {
+      hostEnd = value.size();
+    }
+  }
+  host = lower(value.substr(0, hostEnd));
+  port.clear();
+  if (hostEnd == value.size())
+  {
+    return !host.empty();
+  }
+  if (value[hostEnd] != ':')
+  {
+    return false;
+  }
+  port = value.substr(hostEnd + 1);
+  return !host.empty() && allDigits(port);
+}
+
+inline bool isLoopbackName(const std::string& host)
+{
+  return host == "localhost" || host == "[::1]" ||
+         (isIPv4Literal(host) && host.rfind("127.", 0) == 0);
+}
+
+} // namespace origins
+
+/** True for the origin of a page served from this machine, on any port. */
+inline bool isLoopbackOrigin(const std::string& origin)
+{
+  const auto value = origins::lower(origin);
+  size_t schemeLength = 0;
+  if (value.rfind("http://", 0) == 0)
+  {
+    schemeLength = 7;
+  }
+  else if (value.rfind("https://", 0) == 0)
+  {
+    schemeLength = 8;
+  }
+  else
+  {
+    return false;
+  }
+  std::string host;
+  std::string port;
+  return origins::splitHostPort(value.substr(schemeLength), host, port) &&
+         origins::isLoopbackName(host);
+}
+
+/**
+ * True when a `Host` header names the server by something a page cannot have
+ * arranged: an address, `localhost`, or a name the server was told is its own.
+ *
+ * A page that resolves its own name to this machine (DNS rebinding) is
+ * same-origin with the server as far as the browser can tell, and sends no
+ * `Origin` to refuse — but the name it used is still in `Host`. A request
+ * without the header was not sent by a browser.
+ */
+inline bool isKnownHost(const std::string& hostHeader, const std::vector<std::string>& ownNames)
+{
+  const auto value = origins::trim(hostHeader);
+  if (value.empty())
+  {
+    return true;
+  }
+  std::string host;
+  std::string port;
+  if (!origins::splitHostPort(value, host, port))
+  {
+    return false;
+  }
+  if (host == "localhost" || origins::isIPv4Literal(host) || origins::isIPv6Literal(host))
+  {
+    return true;
+  }
+  return std::any_of(ownNames.begin(), ownNames.end(), [&host](const std::string& name) {
+    return !name.empty() && origins::lower(name) == host;
+  });
+}
+
+/**
+ * The origins a server was told may call it.
+ *
+ * Read from one value, the way `ALLOWED_ORIGINS` gives it:
+ *
+ * - nothing — the origins Readymade's own apps run from, and any page served
+ *   from this machine;
+ * - a comma-separated list — exactly those;
+ * - `*` — any origin, for a request that carries a credential. A request that
+ *   carries none is never let in on the strength of `*`: for it, `*` reads as
+ *   nothing was said.
+ *
+ * A host may add origins of its own on top (`add`), e.g. the address it serves
+ * the app from, or ones the person using it chose.
+ */
+class AllowedOrigins
+{
+public:
+  AllowedOrigins() = default;
+
+  static AllowedOrigins parse(const std::string& value)
+  {
+    AllowedOrigins result;
+    const auto trimmed = origins::trim(value);
+    if (trimmed.empty())
+    {
+      return result;
+    }
+    if (trimmed == "*")
+    {
+      result.m_any = true;
+      return result;
+    }
+    result.m_listed = true;
+    size_t start = 0;
+    while (start <= trimmed.size())
+    {
+      const auto comma = trimmed.find(',', start);
+      const auto entry = origins::trim(
+        trimmed.substr(start, comma == std::string::npos ? std::string::npos : comma - start));
+      if (!entry.empty())
+      {
+        result.m_list.push_back(origins::lower(entry));
+      }
+      if (comma == std::string::npos)
+      {
+        break;
+      }
+      start = comma + 1;
+    }
+    return result;
+  }
+
+  /** Replaces what a host added before with `added`. */
+  void add(const std::vector<std::string>& added)
+  {
+    m_added.clear();
+    for (const auto& origin : added)
+    {
+      const auto entry = origins::trim(origin);
+      if (!entry.empty() && entry != "*")
+      {
+        m_added.push_back(origins::lower(entry));
+      }
+    }
+  }
+
+  /** Whether a page at `origin` may read what the server answers, and call it
+   *  with a credential. */
+  bool allows(const std::string& origin) const
+  {
+    return m_any || allowsWithoutCredential(origin);
+  }
+
+  /** Whether a page at `origin` may call the server with nothing but where it
+   *  is calling from. */
+  bool allowsWithoutCredential(const std::string& origin) const
+  {
+    const auto value = origins::lower(origins::trim(origin));
+    if (value.empty())
+    {
+      return false;
+    }
+    if (std::find(m_added.begin(), m_added.end(), value) != m_added.end())
+    {
+      return true;
+    }
+    if (m_listed)
+    {
+      return std::find(m_list.begin(), m_list.end(), value) != m_list.end();
+    }
+    return isAppOrigin(value) || isLoopbackOrigin(value);
+  }
+
+private:
+  // Where the Readymade apps load their pages from: the packaged desktop app,
+  // the iOS app and the Android app.
+  static bool isAppOrigin(const std::string& origin)
+  {
+    return origin == "saucer://embedded" || origin == "hkp://app" ||
+           origin == "https://appassets.androidplatform.net";
+  }
+
+  bool m_any = false;
+  bool m_listed = false;
+  std::vector<std::string> m_list;
+  std::vector<std::string> m_added;
+};
+
+/** What a request says about where it came from. */
+struct RequestSource
+{
+  std::string origin;       // `Origin`
+  std::string secFetchSite; // `Sec-Fetch-Site`
+  std::string host;         // `Host`
+  bool forwarded = false;   // a proxy says it passed the request on
+};
+
+/** Whether a request carries a header a proxy adds when it passes one on. */
+template <class HeaderReader>
+bool isForwarded(const HeaderReader& header)
+{
+  for (const char* name : {"Forwarded", "X-Forwarded-For", "X-Real-IP"})
+  {
+    if (!origins::trim(header(name)).empty())
+    {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Whether a request that carries no credential may be let in on the strength
+ * of where it comes from. See the top of this file.
+ */
+inline bool admitsWithoutCredential(const RequestSource& source,
+                                    const AllowedOrigins& allowed,
+                                    const std::vector<std::string>& ownNames)
+{
+  if (source.forwarded)
+  {
+    return false;
+  }
+  if (!origins::trim(source.origin).empty())
+  {
+    if (!allowed.allowsWithoutCredential(source.origin))
+    {
+      return false;
+    }
+  }
+  // A browser leaves `Origin` off a plain GET it makes for another site's
+  // page — an image, a script — and says so here instead.
+  else if (origins::lower(origins::trim(source.secFetchSite)) == "cross-site")
+  {
+    return false;
+  }
+  return isKnownHost(source.host, ownNames);
+}
+
+} // namespace hkp