@shieldaai/agent-map 0.1.0-alpha.3 → 1.1.0

package/dist/identity-cli.js

@@ -1,13 +1,12 @@
 #!/usr/bin/env node
-import { constants } from 'node:fs';
-import { open } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
 import { parseArgs } from 'node:util';
-import { isCliEntry } from './cli-entry.js';
+import { PACKAGE_VERSION, STORE_LIMITS, isCliEntry, reportStartupFailure } from './cli-entry.js';
 import { createNeo4jMapStore } from './store.js';
 import { MapService } from './service.js';
 import { startMapIdentityServer } from './identity-http.js';
-import { fields, fail, parseRequest } from './boundary.js';
+import { fail } from './common.js';
+import { fields, parseRequest, readHostFile } from './boundary.js';
 function environment(value) {
     if (typeof value !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(value))
         fail('MAP_CONFIG_INVALID');
@@ -16,43 +15,66 @@ function environment(value) {
         fail('MAP_CREDENTIAL_REQUIRED');
     return secret;
 }
-/** POSIX launcher: owned regular files only; private inputs exclude group/other access. */
+/**
+ * The company launcher holds a TLS key and names secrets, so its files are this user's own
+ * regular files, never a link, and private inputs exclude group and other access.
+ */
 async function boundedFile(path, maximum, privateFile) {
-    if (typeof process.getuid !== 'function' || !constants.O_NOFOLLOW)
-        fail('MAP_CONFIG_INVALID');
-    const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-    try {
-        const info = await file.stat();
-        if (!info.isFile() || info.nlink !== 1 || info.uid !== process.getuid() || info.size > maximum ||
-            (privateFile && (info.mode & 0o077) !== 0) || (info.mode & 0o022) !== 0)
-            fail('MAP_CONFIG_INVALID');
-        const data = Buffer.alloc(maximum + 1);
-        let bytes = 0;
-        while (bytes < data.length) {
-            const read = await file.read(data, bytes, data.length - bytes, null);
-            if (!read.bytesRead)
-                break;
-            bytes += read.bytesRead;
-        }
-        if (bytes > maximum)
-            fail('MAP_CONFIG_INVALID');
-        return new TextDecoder('utf-8', { fatal: true }).decode(data.subarray(0, bytes));
-    }
-    finally {
-        await file.close();
-    }
+    const bytes = await readHostFile(path, maximum, {
+        noFollow: true,
+        owner: 'service',
+        singleLink: true,
+        private: privateFile,
+    });
+    return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
 }
 export async function loadMapIdentityConfig(filename) {
     const path = resolve(filename), directory = dirname(path);
-    const config = fields(parseRequest(Buffer.from(await boundedFile(path, 128 * 1024, true)), 128 * 1024), ['neo4j', 'publicOrigin', 'tls', 'oidc', 'companyId', 'bindings', 'listenHost', 'port', 'viewerDirectory',
-        'sessionTtlMs', 'loginTtlMs', 'maxSessions', 'maxLoginTransactions', 'requestTimeoutMs', 'maxRequestBytes',
-        'maxResponseBytes', 'maxConcurrentRequests', 'rateLimit'], ['neo4j', 'publicOrigin', 'tls', 'oidc', 'companyId', 'bindings']);
-    const db = fields(config.neo4j, ['uri', 'username', 'passwordEnv', 'database'], ['uri', 'username', 'passwordEnv']);
-    if (typeof db.uri !== 'string' || typeof db.username !== 'string' || (db.database !== undefined && typeof db.database !== 'string'))
+    const config = fields(parseRequest(Buffer.from(await boundedFile(path, 128 * 1024, true)), 128 * 1024), [
+        'neo4j',
+        'publicOrigin',
+        'tls',
+        'oidc',
+        'companyId',
+        'bindings',
+        'listenHost',
+        'port',
+        'viewerDirectory',
+        'sessionTtlMs',
+        'loginTtlMs',
+        'maxSessions',
+        'maxLoginTransactions',
+        'requestTimeoutMs',
+        'maxRequestBytes',
+        'maxResponseBytes',
+        'maxConcurrentRequests',
+        'rateLimit',
+    ], ['neo4j', 'publicOrigin', 'tls', 'oidc', 'companyId', 'bindings']);
+    const db = fields(config.neo4j, ['uri', 'username', 'passwordEnv', 'database', ...STORE_LIMITS], ['uri', 'username', 'passwordEnv']);
+    if (typeof db.uri !== 'string' ||
+        typeof db.username !== 'string' ||
+        (db.database !== undefined && typeof db.database !== 'string'))
         fail('MAP_CONFIG_INVALID');
-    const database = { uri: db.uri, username: db.username, password: environment(db.passwordEnv), ...(db.database === undefined ? {} : { database: db.database }) };
+    const database = {
+        uri: db.uri,
+        username: db.username,
+        password: environment(db.passwordEnv),
+        ...(db.database === undefined ? {} : { database: db.database }),
+        // Optional read limits; the store checks their type and hard maximum.
+        ...Object.fromEntries(STORE_LIMITS.filter(key => db[key] !== undefined).map(key => [key, db[key]])),
+    };
     const tls = fields(config.tls, ['keyFile', 'certFile'], ['keyFile', 'certFile']);
-    const oidc = fields(config.oidc, ['issuer', 'clientId', 'clientSecretEnv', 'clientAuthMethod', 'endpointOrigins', 'caFile', 'requestTimeoutMs', 'maxResponseBytes'], ['issuer', 'clientId', 'clientSecretEnv']);
+    const oidc = fields(config.oidc, [
+        'issuer',
+        'clientId',
+        'clientSecretEnv',
+        'clientAuthMethod',
+        'endpointOrigins',
+        'caFile',
+        'requestTimeoutMs',
+        'maxResponseBytes',
+        'clockToleranceSeconds',
+    ], ['issuer', 'clientId', 'clientSecretEnv']);
     for (const value of [tls.keyFile, tls.certFile])
         if (typeof value !== 'string' || !value)
             fail('MAP_CONFIG_INVALID');
@@ -62,22 +84,43 @@ export async function loadMapIdentityConfig(filename) {
         fail('MAP_CONFIG_INVALID');
     const { neo4j: _database, tls: _tls, oidc: _oidc, ...server } = config;
     const { clientSecretEnv: _secret, caFile: _ca, ...provider } = oidc;
-    return { database, server: { ...server,
-            tls: { key: await boundedFile(resolve(directory, tls.keyFile), 256 * 1024, true),
-                cert: await boundedFile(resolve(directory, tls.certFile), 256 * 1024, false) },
-            oidc: { ...provider, clientSecret: environment(oidc.clientSecretEnv),
-                ...(oidc.caFile === undefined ? {} : { ca: await boundedFile(resolve(directory, oidc.caFile), 256 * 1024, false) }) },
-            ...(config.viewerDirectory === undefined ? {} : { viewerDirectory: resolve(directory, config.viewerDirectory) }), } };
+    return {
+        database,
+        server: {
+            ...server,
+            tls: {
+                key: await boundedFile(resolve(directory, tls.keyFile), 256 * 1024, true),
+                cert: await boundedFile(resolve(directory, tls.certFile), 256 * 1024, false),
+            },
+            oidc: {
+                ...provider,
+                clientSecret: environment(oidc.clientSecretEnv),
+                ...(oidc.caFile === undefined
+                    ? {}
+                    : { ca: await boundedFile(resolve(directory, oidc.caFile), 256 * 1024, false) }),
+            },
+            ...(config.viewerDirectory === undefined ? {} : { viewerDirectory: resolve(directory, config.viewerDirectory) }),
+        },
+    };
 }
+const USAGE = 'agent-guard-map-identity --config PRIVATE_HOST_CONFIG.json | --help | --version';
 /** Restart reloads policy/secrets and invalidates sessions; credentials are never printed. */
 export async function runMapIdentityCli(argv = process.argv.slice(2)) {
-    const { values } = parseArgs({ args: argv, options: { config: { type: 'string' }, help: { type: 'boolean' } }, strict: true });
+    const { values } = parseArgs({
+        args: argv,
+        options: { config: { type: 'string' }, help: { type: 'boolean' }, version: { type: 'boolean' } },
+        strict: true,
+    });
     if (values.help) {
-        process.stdout.write('agent-guard-map-identity --config PRIVATE_HOST_CONFIG.json\n');
+        process.stdout.write(`${USAGE}\n`);
+        return;
+    }
+    if (values.version) {
+        process.stdout.write(`${PACKAGE_VERSION}\n`);
         return;
     }
     if (!values.config)
-        fail('MAP_CONFIG_INVALID');
+        fail('MAP_ARGUMENT_INVALID');
     const config = await loadMapIdentityConfig(values.config);
     const store = createNeo4jMapStore(config.database);
     try {
@@ -85,7 +128,11 @@ export async function runMapIdentityCli(argv = process.argv.slice(2)) {
         try {
             process.stdout.write(`${JSON.stringify({ url: server.url, mode: 'oidc-read-only' })}\n`);
             await new Promise(done => {
-                const stop = () => { process.off('SIGINT', stop); process.off('SIGTERM', stop); done(); };
+                const stop = () => {
+                    process.off('SIGINT', stop);
+                    process.off('SIGTERM', stop);
+                    done();
+                };
                 process.once('SIGINT', stop);
                 process.once('SIGTERM', stop);
             });
@@ -99,5 +146,5 @@ export async function runMapIdentityCli(argv = process.argv.slice(2)) {
     }
 }
 if (isCliEntry(import.meta)) {
-    void runMapIdentityCli().catch(() => { process.stderr.write('MAP_START_FAILED\n'); process.exitCode = 1; });
+    void runMapIdentityCli().catch(error => reportStartupFailure(error, USAGE));
 }