@serfab/cadre-host 0.12.0 → 0.13.0

package/dist/server/routes/provision-request-validation.js

@@ -0,0 +1,97 @@
+/**
+ * The whole shape check for `POST /grants` — one call that either yields the
+ * typed {@link DonationProvisionRequest} the `DonationService` is handed, or the
+ * message the route answers 400 with.
+ *
+ * **Why a validator rather than a few more `if`s in the route.** Every field in
+ * this body is forwarded into a child process the requester cannot see:
+ * `partyId`, `bootstrapNodes` and `profile` are written into the child's
+ * `cadre.json` (`orchestrator/host-process-orchestrator.ts`) and `ownerKeys`
+ * become its cold-start seed-trust anchors. A field the route forgets to check is
+ * not a 400 — it is a donated node that dies at boot, or comes up subtly wrong,
+ * with a 201 already sent. Routing the body through one function that *constructs*
+ * the request object means a field can only reach the spawn path by having been
+ * through here; adding a field to `DonationProvisionRequest` without validating it
+ * stops compiling rather than silently shipping.
+ *
+ * **Division of labour with `DonationService.provision`.** The Ed25519 rule for
+ * `ownerKeys` stays in the service, where it is applied by cadre-core's own
+ * `requireEd25519PublicKeyB64` — the service is also reached by the respawn path,
+ * which replays a persisted record rather than an HTTP body, so the crypto rule
+ * has to live there to cover both. What this validator owns for `ownerKeys` is the
+ * *container* shape (present, non-empty, all strings), which the service's rule
+ * assumes: a number reaching it surfaces as an internal `.trim is not a function`
+ * rather than as a message naming what is wrong with the request.
+ *
+ * The multiaddr rule has no such home — it is duplicated in cadre-provider — so it
+ * lives in `bootstrap-node-validation.ts` next to the comment saying so.
+ */
+import { validateBootstrapNodes } from './bootstrap-node-validation.js';
+/** `partyId` becomes `controlNetwork.partyId` in the child's config. */
+function validatePartyId(value) {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        return { error: 'partyId is required' };
+    }
+    return { partyId: value.trim() };
+}
+/**
+ * Container shape only — see the module comment: the per-key Ed25519 rule is
+ * `DonationService.provision`'s, so the respawn path gets it too.
+ */
+function validateOwnerKeys(value) {
+    if (!Array.isArray(value) || value.length === 0) {
+        return { error: 'ownerKeys is required' };
+    }
+    if (!value.every((key) => typeof key === 'string')) {
+        return { error: 'ownerKeys must be an array of strings' };
+    }
+    return { ownerKeys: value };
+}
+/** Absent means `storage` — see {@link DonationProvisionRequest.profile}. */
+function validateProfile(value) {
+    if (value === undefined)
+        return {};
+    if (value !== 'storage' && value !== 'transaction') {
+        return { error: 'profile must be "storage" or "transaction"' };
+    }
+    return { profile: value };
+}
+/**
+ * Validate a `POST /grants` body and build the request `DonationService.provision`
+ * is handed.
+ *
+ * `grantToken` comes from the `Authorization` bearer rather than the body — a
+ * requester does not get to name which grant pays for this — so it is a
+ * parameter, not a validated field. Whether that grant is live and within quota is
+ * `provision`'s call, not this function's.
+ *
+ * @returns the typed provision request, or the message to answer `invalid_request` with.
+ */
+export function validateProvisionRequest(body, grantToken) {
+    if (typeof body !== 'object' || body === null || Array.isArray(body)) {
+        return { error: 'request body must be a JSON object' };
+    }
+    const fields = body;
+    const partyId = validatePartyId(fields.partyId);
+    if ('error' in partyId)
+        return partyId;
+    const bootstrap = validateBootstrapNodes(fields.bootstrapNodes);
+    if ('error' in bootstrap)
+        return bootstrap;
+    const ownerKeys = validateOwnerKeys(fields.ownerKeys);
+    if ('error' in ownerKeys)
+        return ownerKeys;
+    const profile = validateProfile(fields.profile);
+    if ('error' in profile)
+        return profile;
+    return {
+        request: {
+            grantToken,
+            partyId: partyId.partyId,
+            bootstrapNodes: bootstrap.nodes,
+            ownerKeys: ownerKeys.ownerKeys,
+            ...(profile.profile ? { profile: profile.profile } : {}),
+        },
+    };
+}
+//# sourceMappingURL=provision-request-validation.js.map

package/dist/server/routes/provision-request-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-request-validation.js","sourceRoot":"","sources":["../../../src/server/routes/provision-request-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,wEAAwE;AACxE,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,6EAA6E;AAC7E,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAa,EACb,UAAkB;IAElB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,IAA+B,CAAC;IAE/C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAEvC,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAChE,IAAI,OAAO,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAE3C,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAE3C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAEvC,OAAO;QACL,OAAO,EAAE;YACP,UAAU;YACV,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,cAAc,EAAE,SAAS,CAAC,KAAK;YAC/B,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serfab/cadre-host",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "type": "module",
   "description": "Self-hosted cadre node manager for basement-PC deployments",
   "main": "dist/index.js",
@@ -64,9 +64,10 @@
     "@libp2p/crypto": "^5.1.13",
     "@libp2p/interface": "^3.1.0",
     "@libp2p/peer-id": "^6.0.4",
-    "@serfab/cadre-cli": "^0.12.0",
-    "@serfab/cadre-core": "^0.12.0",
-    "@serfab/cadre-provider": "^0.12.0",
+    "@multiformats/multiaddr": "^12.5.1",
+    "@serfab/cadre-cli": "^0.13.0",
+    "@serfab/cadre-core": "^0.13.0",
+    "@serfab/cadre-provider": "^0.13.0",
     "commander": "^14.0.2",
     "debug": "^4.4.3",
     "fastify": "^5.7.1",