@shipfox/api-runners 2.0.0

package/src/presentation/routes/provisioner-tokens.test.ts

@@ -0,0 +1,219 @@
+import {
+  AUTH_USER,
+  buildUserContext,
+  setUserContext,
+  type UserContextMembership,
+} from '@shipfox/api-auth-context';
+import type {AuthMethod} from '@shipfox/node-fastify';
+import {ClientError, closeApp, createApp} from '@shipfox/node-fastify';
+import {hashOpaqueToken, tokenTypeParts} from '@shipfox/node-tokens';
+import {eq, sql} from 'drizzle-orm';
+import type {FastifyInstance, FastifyRequest} from 'fastify';
+import {db} from '#db/db.js';
+import {revokeProvisionerToken} from '#db/provisioner-tokens.js';
+import {provisionerTokens} from '#db/schema/provisioner-tokens.js';
+import {createProvisionerTokenAuthMethod} from '#presentation/auth/index.js';
+import {provisionerTokenFactory} from '#test/index.js';
+import {provisionerRoutes} from './index.js';
+
+const userId = crypto.randomUUID();
+let authenticatedMemberships: ReadonlyArray<UserContextMembership> = [];
+
+const fakeUserAuth: AuthMethod = {
+  name: AUTH_USER,
+  authenticate: (request: FastifyRequest) => {
+    if (request.headers.authorization !== 'Bearer user') {
+      throw new ClientError('Invalid user token', 'unauthorized', {status: 401});
+    }
+
+    setUserContext(
+      request,
+      buildUserContext({
+        userId,
+        email: 'user@example.com',
+        memberships: authenticatedMemberships,
+      }),
+    );
+    return Promise.resolve();
+  },
+};
+
+describe('provisioner token routes', () => {
+  let app: FastifyInstance;
+  let workspaceId: string;
+
+  beforeEach(async () => {
+    await closeApp();
+    workspaceId = crypto.randomUUID();
+    authenticatedMemberships = [{workspaceId, role: 'admin'}];
+    app = await createApp({
+      auth: [fakeUserAuth, createProvisionerTokenAuthMethod()],
+      routes: provisionerRoutes,
+      swagger: false,
+    });
+    await app.ready();
+  });
+
+  afterEach(async () => {
+    await closeApp();
+  });
+
+  test('uses user auth for provisioner token management routes', () => {
+    expect(provisionerRoutes[0]?.auth).toBe(AUTH_USER);
+    expect(provisionerRoutes[1]?.auth).toBe(AUTH_USER);
+  });
+
+  describe('GET /workspaces/:workspaceId/provisioners/tokens', () => {
+    it('returns 401 without user auth', async () => {
+      const res = await app.inject({
+        method: 'GET',
+        url: `/workspaces/${workspaceId}/provisioners/tokens`,
+      });
+
+      expect(res.statusCode).toBe(401);
+    });
+
+    it('returns 403 when the user is not a workspace member', async () => {
+      authenticatedMemberships = [{workspaceId: crypto.randomUUID(), role: 'admin'}];
+
+      const res = await app.inject({
+        method: 'GET',
+        url: `/workspaces/${workspaceId}/provisioners/tokens`,
+        headers: {authorization: 'Bearer user'},
+      });
+
+      expect(res.statusCode).toBe(403);
+      expect(res.json().code).toBe('forbidden');
+    });
+
+    it('returns only usable tokens for the workspace', async () => {
+      const usable = await provisionerTokenFactory.create({workspaceId, name: 'usable'});
+      const expired = await provisionerTokenFactory.create({
+        workspaceId,
+        name: 'expired',
+        expiresAt: new Date(Date.now() - 60_000),
+      });
+      const revoked = await provisionerTokenFactory.create({workspaceId, name: 'revoked'});
+      await provisionerTokenFactory.create({
+        workspaceId: crypto.randomUUID(),
+        name: 'other workspace',
+      });
+      await revokeProvisionerToken({tokenId: revoked.id, workspaceId, revokedByUserId: userId});
+
+      const res = await app.inject({
+        method: 'GET',
+        url: `/workspaces/${workspaceId}/provisioners/tokens`,
+        headers: {authorization: 'Bearer user'},
+      });
+
+      expect(res.statusCode).toBe(200);
+      expect(res.json().tokens.map((token: {id: string}) => token.id)).toEqual([usable.id]);
+      expect(res.json().tokens.map((token: {id: string}) => token.id)).not.toContain(expired.id);
+    });
+  });
+
+  describe('GET /workspaces/:workspaceId/provisioners/active', () => {
+    it('returns active provisioners for the workspace', async () => {
+      const active = await provisionerTokenFactory.create({workspaceId, name: 'active'});
+      await db().execute(
+        sql`UPDATE runners_provisioner_tokens SET last_seen_at = now() WHERE id = ${active.id}`,
+      );
+
+      const res = await app.inject({
+        method: 'GET',
+        url: `/workspaces/${workspaceId}/provisioners/active`,
+        headers: {authorization: 'Bearer user'},
+      });
+
+      expect(res.statusCode).toBe(200);
+      expect(res.json()).toEqual({
+        provisioners: [
+          expect.objectContaining({
+            id: active.id,
+            name: 'active',
+            prefix: active.prefix,
+            last_seen_at: expect.any(String),
+          }),
+        ],
+      });
+    });
+  });
+
+  describe('POST /workspaces/:workspaceId/provisioners/tokens', () => {
+    it('returns 401 without user auth', async () => {
+      const res = await app.inject({
+        method: 'POST',
+        url: `/workspaces/${workspaceId}/provisioners/tokens`,
+        payload: {name: 'scaler'},
+      });
+
+      expect(res.statusCode).toBe(401);
+    });
+
+    it('creates a workspace-scoped provisioner token and returns the raw token once', async () => {
+      const res = await app.inject({
+        method: 'POST',
+        url: `/workspaces/${workspaceId}/provisioners/tokens`,
+        headers: {authorization: 'Bearer user'},
+        payload: {name: 'scaler', ttl_seconds: 3600},
+      });
+
+      expect(res.statusCode).toBe(201);
+      const body = res.json();
+      expect(body.raw_token.startsWith(`sf_${tokenTypeParts.provisionerToken}_`)).toBe(true);
+      expect(body.prefix).toBe(body.raw_token.slice(0, 12));
+      expect(body.name).toBe('scaler');
+      expect(body.workspace_id).toBe(workspaceId);
+      expect(body.created_by_user_id).toBe(userId);
+      expect(body.expires_at).not.toBeNull();
+
+      const rows = await db()
+        .select()
+        .from(provisionerTokens)
+        .where(eq(provisionerTokens.id, body.id));
+      expect(rows[0]?.hashedToken).toBe(hashOpaqueToken(body.raw_token));
+      expect(rows[0]?.hashedToken).not.toBe(body.raw_token);
+    });
+
+    it('rejects a token TTL above one year', async () => {
+      const res = await app.inject({
+        method: 'POST',
+        url: `/workspaces/${workspaceId}/provisioners/tokens`,
+        headers: {authorization: 'Bearer user'},
+        payload: {ttl_seconds: 31_536_001},
+      });
+
+      expect(res.statusCode).toBe(400);
+    });
+  });
+
+  describe('POST /workspaces/:workspaceId/provisioners/tokens/:tokenId/revoke', () => {
+    it('revokes a token owned by the authenticated workspace', async () => {
+      const token = await provisionerTokenFactory.create({workspaceId});
+
+      const res = await app.inject({
+        method: 'POST',
+        url: `/workspaces/${workspaceId}/provisioners/tokens/${token.id}/revoke`,
+        headers: {authorization: 'Bearer user'},
+      });
+
+      expect(res.statusCode).toBe(200);
+      expect(res.json().id).toBe(token.id);
+      expect(res.json().revoked_at).not.toBeNull();
+      expect(res.json().revoked_by_user_id).toBe(userId);
+    });
+
+    it('returns 404 for a token owned by another workspace', async () => {
+      const token = await provisionerTokenFactory.create({workspaceId: crypto.randomUUID()});
+
+      const res = await app.inject({
+        method: 'POST',
+        url: `/workspaces/${workspaceId}/provisioners/tokens/${token.id}/revoke`,
+        headers: {authorization: 'Bearer user'},
+      });
+
+      expect(res.statusCode).toBe(404);
+      expect(res.json().code).toBe('not-found');
+    });
+  });
+});

package/src/presentation/routes/rate-limit.ts

@@ -0,0 +1,115 @@
+import {requireProvisionerContext} from '@shipfox/api-auth-context';
+import {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';
+import {config} from '#config.js';
+import {
+  checkRunnersRateLimit,
+  RunnersRateLimitExceededError,
+  RunnersRateLimitUnavailableError,
+} from '#core/rate-limit.js';
+import {getRunnerContext} from '#presentation/auth/index.js';
+
+function routeName(request: FastifyRequest): string {
+  return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';
+}
+
+async function enforceRateLimit(params: {
+  request: FastifyRequest;
+  reply: FastifyReply;
+  action: 'provisioner-mint' | 'ephemeral-register';
+  scope: 'provisioner' | 'ephemeral-token';
+  identifier: string;
+  limit: number;
+  windowSeconds: number;
+}): Promise<void> {
+  try {
+    await checkRunnersRateLimit({
+      action: params.action,
+      scope: params.scope,
+      identifier: params.identifier,
+      limit: params.limit,
+      windowSeconds: params.windowSeconds,
+    });
+  } catch (error) {
+    if (error instanceof RunnersRateLimitExceededError) {
+      params.request.log.warn(
+        {
+          action: error.action,
+          scope: error.scope,
+          route: routeName(params.request),
+          retryAfterSeconds: error.retryAfterSeconds,
+          identifierHmacPrefix: error.identifierHmacPrefix,
+        },
+        'Runners rate limit blocked request',
+      );
+      params.reply.header('Retry-After', String(error.retryAfterSeconds));
+      throw new ClientError('Rate limit exceeded', 'rate-limited', {
+        status: 429,
+        details: {retry_after_seconds: error.retryAfterSeconds},
+        data: {
+          action: error.action,
+          scope: error.scope,
+          route: routeName(params.request),
+          identifierHmacPrefix: error.identifierHmacPrefix,
+        },
+        cause: error,
+      });
+    }
+
+    if (error instanceof RunnersRateLimitUnavailableError) {
+      params.request.log.error(
+        {
+          action: error.action,
+          scope: error.scope,
+          route: routeName(params.request),
+          identifierHmacPrefix: error.identifierHmacPrefix,
+          err: error,
+        },
+        'Runners rate limiter unavailable',
+      );
+      throw new ClientError('Runners rate limiter unavailable', 'runners-rate-limit-unavailable', {
+        status: 503,
+        data: {
+          action: error.action,
+          scope: error.scope,
+          route: routeName(params.request),
+          identifierHmacPrefix: error.identifierHmacPrefix,
+        },
+        cause: error,
+      });
+    }
+
+    throw error;
+  }
+}
+
+export function createProvisionerMintRateLimitPreHandler() {
+  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {
+    const {provisionerTokenId} = requireProvisionerContext(request);
+    await enforceRateLimit({
+      request,
+      reply,
+      action: 'provisioner-mint',
+      scope: 'provisioner',
+      identifier: provisionerTokenId,
+      limit: config.PROVISIONER_MINT_RATE_LIMIT_MAX_REQUESTS,
+      windowSeconds: config.PROVISIONER_MINT_RATE_LIMIT_WINDOW_SECONDS,
+    });
+  };
+}
+
+export function createEphemeralRegisterRateLimitPreHandler() {
+  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {
+    const runner = getRunnerContext(request);
+    if (runner.kind !== 'ephemeral') return;
+
+    await enforceRateLimit({
+      request,
+      reply,
+      action: 'ephemeral-register',
+      scope: 'ephemeral-token',
+      identifier: runner.ephemeralTokenId,
+      limit: config.EPHEMERAL_REGISTER_RATE_LIMIT_MAX_REQUESTS,
+      windowSeconds: config.EPHEMERAL_REGISTER_RATE_LIMIT_WINDOW_SECONDS,
+    });
+  };
+}