@serve.zone/dcrouter 17.2.4 → 17.4.0

package/ts/opsserver/handlers/index.ts

@@ -22,3 +22,4 @@ export * from './acme-config.handler.js';
 export * from './email-domain.handler.js';
 export * from './gatewayclient.handler.js';
 export * from './realtime.handler.js';
+export * from './config-event.handler.js';

package/ts/opsserver/helpers/gateway-client-auth.ts

@@ -0,0 +1,198 @@
+import * as plugins from '../../plugins.js';
+import type { OpsServer } from '../classes.opsserver.js';
+import * as interfaces from '../../../ts_interfaces/index.js';
+import { requireOpsAuth } from './auth.js';
+
+export interface IGatewayMachineAuthContext {
+  userId: string;
+  isAdmin: boolean;
+  token?: interfaces.data.IStoredApiToken;
+  credentialId?: string;
+  policy?: interfaces.data.IApiTokenPolicy;
+  gatewayClient?: interfaces.data.IGatewayClient;
+  managedZoneNames: string[];
+}
+
+export type TGatewayCredentialState = 'candidate' | 'active' | 'manual';
+
+export interface IRequireGatewayMachineAuthOptions {
+  allowCandidate?: boolean;
+}
+
+export function getGatewayCredentialState(
+  tokenArg: interfaces.data.IStoredApiToken,
+): TGatewayCredentialState {
+  const lifecycle = tokenArg.gatewayCredentialLifecycle;
+  if (lifecycle == null) return 'manual';
+  if (lifecycle.source === 'provisioned'
+    && (lifecycle.state === 'candidate' || lifecycle.state === 'active')) {
+    return lifecycle.state;
+  }
+  throw new plugins.typedrequest.TypedResponseError('gateway-client credential lifecycle is invalid');
+}
+
+export function normalizeGatewayHostname(hostnameArg: string): string {
+  const candidate = String(hostnameArg || '').trim().toLowerCase().replace(/\.+$/, '');
+  if (!candidate || candidate.includes('*')) {
+    throw new plugins.typedrequest.TypedResponseError(`invalid hostname: ${hostnameArg}`);
+  }
+  const ascii = plugins.url.domainToASCII(candidate);
+  if (!ascii) {
+    throw new plugins.typedrequest.TypedResponseError(`invalid hostname: ${hostnameArg}`);
+  }
+  return ascii;
+}
+
+export function normalizeGatewayTargetHost(hostArg: string): string {
+  const candidate = String(hostArg || '').trim().toLowerCase().replace(/\.+$/, '');
+  if (plugins.net.isIP(candidate)) return candidate;
+  const ascii = plugins.url.domainToASCII(candidate);
+  if (!ascii) {
+    throw new plugins.typedrequest.TypedResponseError(`invalid route target host: ${hostArg}`);
+  }
+  return ascii;
+}
+
+export function isHostnameInManagedZone(hostnameArg: string, managedZoneNamesArg: string[]): boolean {
+  const hostname = normalizeGatewayHostname(hostnameArg);
+  return managedZoneNamesArg.some((zoneArg) => {
+    const zone = normalizeGatewayHostname(zoneArg);
+    return hostname === zone || hostname.endsWith(`.${zone}`);
+  });
+}
+
+export function matchesGatewayHostnamePatterns(
+  hostnameArg: string,
+  patternsArg: string[],
+  managedZoneNamesArg: string[],
+): boolean {
+  const hostname = normalizeGatewayHostname(hostnameArg);
+  for (const patternArg of patternsArg) {
+    const rawPattern = String(patternArg || '').trim().toLowerCase().replace(/\.+$/, '');
+    if (!rawPattern) continue;
+    if (rawPattern === '*') {
+      if (isHostnameInManagedZone(hostname, managedZoneNamesArg)) return true;
+      continue;
+    }
+    const wildcard = rawPattern.startsWith('*.');
+    const normalizedPattern = normalizeGatewayHostname(wildcard ? rawPattern.slice(2) : rawPattern);
+    if (!wildcard && hostname === normalizedPattern) return true;
+    if (!wildcard || !hostname.endsWith(`.${normalizedPattern}`)) continue;
+    const label = hostname.slice(0, -(normalizedPattern.length + 1));
+    if (label && !label.includes('.')) return true;
+  }
+  return false;
+}
+
+export function hasOwnedEnabledGatewayRoute(
+  opsServerRefArg: OpsServer,
+  authArg: IGatewayMachineAuthContext,
+  hostnameArg: string,
+): boolean {
+  if (authArg.isAdmin) return true;
+  const liveClient = authArg.gatewayClient;
+  if (!liveClient) return false;
+  const hostname = normalizeGatewayHostname(hostnameArg);
+  const routes = opsServerRefArg.dcRouterRef.routeConfigManager?.getMergedRoutes().routes || [];
+  return routes.some((routeArg) => {
+    if (!routeArg.enabled || routeArg.metadata?.ownerType !== 'gatewayClient') return false;
+    if (routeArg.metadata.gatewayClientId !== liveClient.id) return false;
+    if ((routeArg.metadata.gatewayClientType || 'custom') !== liveClient.type) return false;
+    const domains = routeArg.route.match?.domains;
+    const values = Array.isArray(domains)
+      ? domains
+      : typeof domains === 'string'
+        ? domains.split(',')
+        : [];
+    return values.some((domainArg) => {
+      try {
+        return normalizeGatewayHostname(domainArg) === hostname;
+      } catch {
+        return false;
+      }
+    });
+  });
+}
+
+export async function requireGatewayMachineAuth(
+  opsServerRefArg: OpsServer,
+  requestArg: { identity?: interfaces.data.IIdentity; apiToken?: string },
+  scopeArg: 'gateway-clients:read' | 'gateway-clients:write',
+  optionsArg: IRequireGatewayMachineAuthOptions = {},
+): Promise<IGatewayMachineAuthContext> {
+  const auth = await requireOpsAuth(opsServerRefArg, requestArg, {
+    scope: scopeArg,
+    requireAdminIdentity: false,
+  });
+  const managedZoneNames = (await opsServerRefArg.dcRouterRef.dnsManager?.listDomains() || [])
+    .map((domainArg) => domainArg.name);
+
+  if (auth.isAdmin) {
+    return {
+      userId: auth.userId,
+      isAdmin: true,
+      token: auth.token,
+      policy: auth.token?.policy,
+      managedZoneNames,
+    };
+  }
+  if (auth.type !== 'apiToken' || auth.token?.policy?.role !== 'gatewayClient') {
+    throw new plugins.typedrequest.TypedResponseError('gateway-client credential required');
+  }
+  const credentialState = getGatewayCredentialState(auth.token);
+  if (credentialState === 'candidate' && !optionsArg.allowCandidate) {
+    throw new plugins.typedrequest.TypedResponseError('gateway-client credential is awaiting finalization');
+  }
+  const credentialLifecycle = auth.token.gatewayCredentialLifecycle;
+  const tokenBinding = auth.token.policy.gatewayClient;
+  if (!tokenBinding?.id || !tokenBinding.type || !Number.isSafeInteger(tokenBinding.policyGeneration)) {
+    throw new plugins.typedrequest.TypedResponseError('gateway-client credential binding is incomplete');
+  }
+  const manager = opsServerRefArg.dcRouterRef.gatewayClientManager;
+  if (!manager) {
+    throw new plugins.typedrequest.TypedResponseError('gateway client management not initialized');
+  }
+  // Deliberately load the durable policy on every request. Token snapshots are
+  // identity bindings only and never provide current authorization.
+  if (credentialLifecycle
+    && credentialLifecycle.policyGeneration !== tokenBinding.policyGeneration) {
+    throw new plugins.typedrequest.TypedResponseError('gateway-client credential binding is inconsistent');
+  }
+  const liveClient = credentialLifecycle
+    ? await manager.getClientForProvisionedCredential(
+        tokenBinding.id,
+        tokenBinding.type,
+        credentialLifecycle,
+      )
+    : await manager.getClient(tokenBinding.id);
+  if (!liveClient || !liveClient.enabled) {
+    throw new plugins.typedrequest.TypedResponseError('gateway client is missing or disabled');
+  }
+  if (liveClient.type !== tokenBinding.type) {
+    throw new plugins.typedrequest.TypedResponseError('gateway-client credential type does not match live policy');
+  }
+  if (liveClient.policyGeneration !== tokenBinding.policyGeneration) {
+    throw new plugins.typedrequest.TypedResponseError('gateway-client credential policy generation is stale');
+  }
+  const livePolicy: interfaces.data.IApiTokenPolicy = {
+    role: 'gatewayClient',
+    scopes: ['gateway-clients:read', 'gateway-clients:write'],
+    gatewayClient: {
+      type: liveClient.type,
+      id: liveClient.id,
+      policyGeneration: liveClient.policyGeneration,
+    },
+    hostnamePatterns: structuredClone(liveClient.hostnamePatterns),
+    allowedRouteTargets: structuredClone(liveClient.allowedRouteTargets),
+    capabilities: structuredClone(liveClient.capabilities),
+  };
+  return {
+    userId: auth.userId,
+    isAdmin: false,
+    token: auth.token,
+    credentialId: auth.token.id,
+    policy: livePolicy,
+    gatewayClient: liveClient,
+    managedZoneNames,
+  };
+}

package/ts/plugins.ts

@@ -9,6 +9,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import * as tls from 'node:tls';
 import * as util from 'node:util';
+import * as url from 'node:url';
 
 export {
   dns,
@@ -21,6 +22,7 @@ export {
   path,
   tls,
   util,
+  url,
 }
 
 // @serve.zone scope

package/ts_apiclient/classes.gatewayclient.ts

@@ -20,6 +20,35 @@ export class GatewayClientApi {
     return response.context;
   }
 
+  public async provisionCredential(options: {
+    provisioning: servezoneInterfaces.data.IGatewayClientProvisioningSpec;
+    credentialName?: string;
+    expiresInDays?: number | null;
+  }): Promise<servezoneInterfaces.requests.gateway.IReq_ProvisionGatewayClientCredential['response']> {
+    return await this.clientRef.request<servezoneInterfaces.requests.gateway.IReq_ProvisionGatewayClientCredential>(
+      'provisionGatewayClientCredential',
+      this.clientRef.buildRequestPayload(options) as any,
+    );
+  }
+
+  public async finalizeCredential(
+    credential: Pick<servezoneInterfaces.data.IGatewayClientCredential, 'tokenId' | 'tokenValue'>,
+  ): Promise<servezoneInterfaces.requests.gateway.IReq_FinalizeGatewayClientCredential['response']> {
+    return await this.clientRef.request<servezoneInterfaces.requests.gateway.IReq_FinalizeGatewayClientCredential>(
+      'finalizeGatewayClientCredential',
+      { apiToken: credential.tokenValue, tokenId: credential.tokenId },
+    );
+  }
+
+  public async getMailOverview(
+    limit?: number,
+  ): Promise<servezoneInterfaces.requests.gateway.IReq_GetGatewayClientMailOverview['response']> {
+    return await this.clientRef.request<servezoneInterfaces.requests.gateway.IReq_GetGatewayClientMailOverview>(
+      'getGatewayClientMailOverview',
+      this.clientRef.buildRequestPayload({ limit }) as any,
+    );
+  }
+
   public async getDomains(): Promise<servezoneInterfaces.data.IGatewayDomain[]> {
     const response = await this.clientRef.request<servezoneInterfaces.requests.gateway.IReq_GetGatewayClientDomains>(
       'getGatewayClientDomains',
@@ -36,10 +65,20 @@ export class GatewayClientApi {
     return response.records;
   }
 
+  public async getRoutes(): Promise<servezoneInterfaces.data.IGatewayClientRoute[]> {
+    const response = await this.clientRef.request<servezoneInterfaces.requests.gateway.IReq_GetGatewayClientRoutes>(
+      'getGatewayClientRoutes',
+      this.clientRef.buildRequestPayload() as any,
+    );
+    return response.routes;
+  }
+
   public async syncRoute(options: {
     ownership: servezoneInterfaces.data.IGatewayClientOwnership;
     route: servezoneInterfaces.data.IGatewayRouteConfig;
     enabled?: boolean;
+    dnsMode?: servezoneInterfaces.data.TGatewayRouteDnsMode;
+    sourceProfileRef?: string;
   }): Promise<servezoneInterfaces.data.IGatewayRouteSyncResult> {
     return this.clientRef.request<servezoneInterfaces.requests.gateway.IReq_SyncGatewayClientRoute>(
       'syncGatewayClientRoute',
@@ -47,18 +86,24 @@ export class GatewayClientApi {
         ownership: options.ownership,
         route: options.route,
         enabled: options.enabled,
+        dnsMode: options.dnsMode,
+        sourceProfileRef: options.sourceProfileRef,
       }) as any,
     );
   }
 
   public async deleteRoute(
     ownership: servezoneInterfaces.data.IGatewayClientOwnership,
+    options: {
+      dnsMode?: servezoneInterfaces.data.TGatewayRouteDnsMode;
+    } = {},
   ): Promise<servezoneInterfaces.data.IGatewayRouteSyncResult> {
     return this.clientRef.request<servezoneInterfaces.requests.gateway.IReq_SyncGatewayClientRoute>(
       'syncGatewayClientRoute',
       this.clientRef.buildRequestPayload({
         ownership,
         delete: true,
+        dnsMode: options.dnsMode,
       }) as any,
     );
   }

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '17.2.4',
+  version: '17.4.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts_web/appstate/config-events.ts

@@ -0,0 +1,98 @@
+import * as plugins from '../plugins.js';
+import * as interfaces from '../../ts_interfaces/index.js';
+import { appState } from './shared.js';
+import { getActionContext } from './login.js';
+
+export interface IConfigEventState {
+  events: interfaces.data.IOpsConfigEvent[];
+  total: number;
+  unacknowledgedCount: number;
+  nextCursor?: interfaces.data.IOpsConfigEventCursor;
+  showAcknowledged: boolean;
+  isLoading: boolean;
+}
+
+export const configEventStatePart = await appState.getStatePart<IConfigEventState>(
+  'configEvents',
+  {
+    events: [],
+    total: 0,
+    unacknowledgedCount: 0,
+    nextCursor: undefined,
+    showAcknowledged: false,
+    isLoading: false,
+  },
+  'soft'
+);
+
+export const fetchConfigEventsAction = configEventStatePart.createAction<{
+  showAcknowledged?: boolean;
+  cursor?: interfaces.data.IOpsConfigEventCursor;
+  append?: boolean;
+} | null>(async (statePartArg, dataArg): Promise<IConfigEventState> => {
+  const context = getActionContext();
+  const currentState = statePartArg.getState()!;
+  if (!context.identity) return currentState;
+
+  const showAcknowledged = dataArg?.showAcknowledged ?? currentState.showAcknowledged;
+  const listRequest = new plugins.domtools.plugins.typedrequest.TypedRequest<
+    interfaces.requests.IReq_ListConfigEvents
+  >('/typedrequest', 'listConfigEvents');
+  const response = await listRequest.fire({
+    identity: context.identity,
+    acknowledged: showAcknowledged ? undefined : false,
+    limit: 200,
+    cursor: dataArg?.cursor,
+  });
+  const append = dataArg?.append === true && Boolean(dataArg.cursor);
+  const events = append
+    ? Array.from(new Map([
+        ...currentState.events,
+        ...(response.events || []),
+      ].map((eventArg) => [eventArg.id, eventArg])).values())
+    : response.events || [];
+
+  return {
+    ...currentState,
+    events,
+    total: response.total || 0,
+    unacknowledgedCount: response.unacknowledgedCount || 0,
+    nextCursor: response.nextCursor,
+    showAcknowledged,
+    isLoading: false,
+  };
+});
+
+export const acknowledgeConfigEventsAction = configEventStatePart.createAction<{
+  ids: string[];
+}>(async (statePartArg, dataArg): Promise<IConfigEventState> => {
+  const context = getActionContext();
+  const currentState = statePartArg.getState()!;
+  if (!context.identity || dataArg.ids.length === 0) return currentState;
+
+  const ackRequest = new plugins.domtools.plugins.typedrequest.TypedRequest<
+    interfaces.requests.IReq_AcknowledgeConfigEvents
+  >('/typedrequest', 'acknowledgeConfigEvents');
+  await ackRequest.fire({
+    identity: context.identity,
+    ids: dataArg.ids,
+  });
+
+  const listRequest = new plugins.domtools.plugins.typedrequest.TypedRequest<
+    interfaces.requests.IReq_ListConfigEvents
+  >('/typedrequest', 'listConfigEvents');
+  const response = await listRequest.fire({
+    identity: context.identity,
+    acknowledged: currentState.showAcknowledged ? undefined : false,
+    limit: 200,
+  });
+
+  return {
+    ...currentState,
+    events: response.events || [],
+    total: response.total || 0,
+    unacknowledgedCount: response.unacknowledgedCount || 0,
+    nextCursor: response.nextCursor,
+    isLoading: false,
+  };
+});

package/ts_web/appstate/runtime.ts

@@ -39,7 +39,8 @@ type TRealtimeRefreshGroup =
   | 'dns'
   | 'routes'
   | 'edges'
-  | 'certificates';
+  | 'certificates'
+  | 'configEvents';
 
 const pendingRealtimeRefreshes = new Set<TRealtimeRefreshGroup>();
 let realtimeRefreshLoopRunning = false;
@@ -55,6 +56,7 @@ const resourceRefreshGroups: Record<
   routes: 'routes',
   edges: 'edges',
   certificates: 'certificates',
+  configEvents: 'configEvents',
 };
 
 const refreshRealtimeGroup = async (groupArg: TRealtimeRefreshGroup): Promise<void> => {
@@ -88,6 +90,11 @@ const refreshRealtimeGroup = async (groupArg: TRealtimeRefreshGroup): Promise<vo
     case 'certificates':
       await certificateStatePart.dispatchAction(fetchCertificateOverviewAction, null);
       break;
+    case 'configEvents': {
+      const { configEventStatePart, fetchConfigEventsAction } = await import('./config-events.js');
+      await configEventStatePart.dispatchAction(fetchConfigEventsAction, null);
+      break;
+    }
   }
 };
 

package/ts_web/appstate.ts

@@ -5,6 +5,7 @@ export * from './appstate/login.js';
 export * from './appstate/stats.js';
 export * from './appstate/config.js';
 export * from './appstate/logs.js';
+export * from './appstate/config-events.js';
 export * from './appstate/network.js';
 export * from './appstate/security.js';
 export * from './appstate/ui.js';