@simonsbs/keylore 1.0.0-rc4

package/dist/services/backup-service.js

@@ -0,0 +1,610 @@
+import fs from "node:fs/promises";
+import * as z from "zod/v4";
+import { accessTokenRecordSchema, approvalRequestSchema, auditEventSchema, authClientRecordSchema, backupSummarySchema, breakGlassRequestSchema, credentialRecordSchema, policyFileSchema, refreshTokenRecordSchema, rotationRunSchema, tenantRecordSchema, } from "../domain/types.js";
+const storedAuthClientSchema = authClientRecordSchema.extend({
+    secretHash: z.string().min(1).optional(),
+    secretSalt: z.string().min(1).optional(),
+});
+const backupEnvelopeSchema = z.object({
+    format: z.literal("keylore-logical-backup"),
+    version: z.number().int().positive(),
+    createdAt: z.string().datetime(),
+    sourceVersion: z.string().min(1),
+    tenants: z.array(tenantRecordSchema),
+    credentials: z.array(credentialRecordSchema),
+    policies: policyFileSchema,
+    authClients: z.array(storedAuthClientSchema),
+    accessTokens: z.array(accessTokenRecordSchema.extend({ tokenHash: z.string().min(1) })),
+    refreshTokens: z.array(refreshTokenRecordSchema.extend({ tokenHash: z.string().min(1) })),
+    approvals: z.array(approvalRequestSchema),
+    breakGlassRequests: z.array(breakGlassRequestSchema),
+    rotationRuns: z.array(rotationRunSchema).default([]),
+    auditEvents: z.array(auditEventSchema),
+});
+function toIso(value) {
+    if (value === null) {
+        return null;
+    }
+    return value instanceof Date ? value.toISOString() : value;
+}
+function normalizeJwks(value) {
+    if (Array.isArray(value)) {
+        return value;
+    }
+    if (value && typeof value === "object" && "kty" in value) {
+        return [value];
+    }
+    return [];
+}
+function tenantOnly(records, tenantId) {
+    return tenantId ? records.filter((record) => record.tenantId === tenantId) : records;
+}
+export class BackupService {
+    database;
+    sourceVersion;
+    audit;
+    constructor(database, sourceVersion, audit) {
+        this.database = database;
+        this.sourceVersion = sourceVersion;
+        this.audit = audit;
+    }
+    summarizeBackup(backup) {
+        return backupSummarySchema.parse({
+            format: backup.format,
+            version: backup.version,
+            sourceVersion: backup.sourceVersion,
+            createdAt: backup.createdAt,
+            tenants: backup.tenants.length,
+            credentials: backup.credentials.length,
+            authClients: backup.authClients.length,
+            accessTokens: backup.accessTokens.length,
+            refreshTokens: backup.refreshTokens.length,
+            approvals: backup.approvals.length,
+            breakGlassRequests: backup.breakGlassRequests.length,
+            rotationRuns: backup.rotationRuns.length,
+            auditEvents: backup.auditEvents.length,
+        });
+    }
+    parseBackupPayload(payload) {
+        return backupEnvelopeSchema.parse(payload);
+    }
+    filterBackupForTenant(backup, tenantId) {
+        if (!tenantId) {
+            return backup;
+        }
+        return backupEnvelopeSchema.parse({
+            ...backup,
+            tenants: tenantOnly(backup.tenants, tenantId),
+            credentials: tenantOnly(backup.credentials, tenantId),
+            policies: {
+                ...backup.policies,
+                rules: tenantOnly(backup.policies.rules, tenantId),
+            },
+            authClients: tenantOnly(backup.authClients, tenantId),
+            accessTokens: tenantOnly(backup.accessTokens, tenantId),
+            refreshTokens: tenantOnly(backup.refreshTokens, tenantId),
+            approvals: tenantOnly(backup.approvals, tenantId),
+            breakGlassRequests: tenantOnly(backup.breakGlassRequests, tenantId),
+            rotationRuns: tenantOnly(backup.rotationRuns, tenantId),
+            auditEvents: tenantOnly(backup.auditEvents, tenantId),
+        });
+    }
+    assertTenantScopedBackup(backup, tenantId) {
+        if (!backup.tenants.some((tenant) => tenant.tenantId === tenantId)) {
+            throw new Error(`Tenant-scoped restore payload is missing tenant metadata: ${tenantId}`);
+        }
+        const mismatchedTenants = new Set();
+        const collect = (records) => {
+            for (const record of records) {
+                if (record.tenantId !== tenantId) {
+                    mismatchedTenants.add(record.tenantId);
+                }
+            }
+        };
+        collect(backup.tenants);
+        collect(backup.credentials);
+        collect(backup.policies.rules);
+        collect(backup.authClients);
+        collect(backup.accessTokens);
+        collect(backup.refreshTokens);
+        collect(backup.approvals);
+        collect(backup.breakGlassRequests);
+        collect(backup.rotationRuns);
+        collect(backup.auditEvents);
+        if (mismatchedTenants.size > 0) {
+            throw new Error(`Tenant-scoped restore payload includes foreign tenant data: ${Array.from(mismatchedTenants).sort().join(", ")}`);
+        }
+    }
+    async exportBackup(actor) {
+        const [tenants, credentials, policies, authClients, accessTokens, refreshTokens, approvals, breakGlassRequests, rotationRuns, auditEvents] = await Promise.all([
+            this.database.query("SELECT * FROM tenants ORDER BY tenant_id"),
+            this.database.query("SELECT * FROM credentials ORDER BY id"),
+            this.database.query("SELECT * FROM policy_rules ORDER BY id"),
+            this.database.query("SELECT * FROM oauth_clients ORDER BY client_id"),
+            this.database.query("SELECT * FROM access_tokens ORDER BY created_at"),
+            this.database.query("SELECT * FROM refresh_tokens ORDER BY created_at"),
+            this.database.query("SELECT * FROM approval_requests ORDER BY created_at"),
+            this.database.query("SELECT * FROM break_glass_requests ORDER BY created_at"),
+            this.database.query("SELECT * FROM rotation_runs ORDER BY planned_at"),
+            this.database.query("SELECT * FROM audit_events ORDER BY occurred_at"),
+        ]);
+        const fullBackup = backupEnvelopeSchema.parse({
+            format: "keylore-logical-backup",
+            version: 1,
+            createdAt: new Date().toISOString(),
+            sourceVersion: this.sourceVersion,
+            tenants: tenants.rows.map((row) => ({
+                tenantId: row.tenant_id,
+                displayName: row.display_name,
+                description: row.description ?? undefined,
+                status: row.status,
+                createdAt: toIso(row.created_at),
+                updatedAt: toIso(row.updated_at),
+            })),
+            credentials: credentials.rows.map((row) => ({
+                id: row.id,
+                tenantId: row.tenant_id,
+                displayName: row.display_name,
+                service: row.service,
+                owner: row.owner,
+                scopeTier: row.scope_tier,
+                sensitivity: row.sensitivity,
+                allowedDomains: row.allowed_domains,
+                permittedOperations: row.permitted_operations,
+                expiresAt: toIso(row.expires_at),
+                rotationPolicy: row.rotation_policy,
+                lastValidatedAt: toIso(row.last_validated_at),
+                selectionNotes: row.selection_notes,
+                binding: row.binding,
+                tags: row.tags,
+                status: row.status,
+            })),
+            policies: {
+                version: 1,
+                rules: policies.rows.map((row) => ({
+                    id: row.id,
+                    tenantId: row.tenant_id,
+                    effect: row.effect,
+                    description: row.description,
+                    principals: row.principals,
+                    principalRoles: row.principal_roles ?? undefined,
+                    credentialIds: row.credential_ids ?? undefined,
+                    services: row.services ?? undefined,
+                    operations: row.operations,
+                    domainPatterns: row.domain_patterns,
+                    environments: row.environments ?? undefined,
+                })),
+            },
+            authClients: authClients.rows.map((row) => storedAuthClientSchema.parse({
+                clientId: row.client_id,
+                tenantId: row.tenant_id,
+                displayName: row.display_name,
+                roles: row.roles,
+                allowedScopes: row.allowed_scopes,
+                status: row.status,
+                tokenEndpointAuthMethod: row.token_endpoint_auth_method,
+                grantTypes: row.grant_types,
+                redirectUris: row.redirect_uris,
+                jwks: normalizeJwks(row.jwks),
+                secretHash: row.secret_hash ?? undefined,
+                secretSalt: row.secret_salt ?? undefined,
+            })),
+            accessTokens: accessTokens.rows.map((row) => ({
+                tokenId: row.token_id,
+                tokenHash: row.token_hash,
+                clientId: row.client_id,
+                tenantId: row.tenant_id,
+                subject: row.subject,
+                scopes: row.scopes,
+                roles: row.roles,
+                resource: row.resource ?? undefined,
+                expiresAt: toIso(row.expires_at),
+                status: row.status,
+                createdAt: toIso(row.created_at),
+                lastUsedAt: toIso(row.last_used_at) ?? undefined,
+            })),
+            refreshTokens: refreshTokens.rows.map((row) => ({
+                refreshTokenId: row.refresh_token_id,
+                tokenHash: row.token_hash,
+                clientId: row.client_id,
+                tenantId: row.tenant_id,
+                subject: row.subject,
+                scopes: row.scopes,
+                roles: row.roles,
+                resource: row.resource ?? undefined,
+                expiresAt: toIso(row.expires_at),
+                status: row.status,
+                createdAt: toIso(row.created_at),
+                lastUsedAt: toIso(row.last_used_at) ?? undefined,
+            })),
+            approvals: approvals.rows.map((row) => ({
+                id: row.id,
+                tenantId: row.tenant_id,
+                createdAt: toIso(row.created_at),
+                expiresAt: toIso(row.expires_at),
+                status: row.status,
+                requestedBy: row.requested_by,
+                requestedRoles: row.requested_roles,
+                credentialId: row.credential_id,
+                operation: row.operation,
+                targetUrl: row.target_url,
+                targetHost: row.target_host,
+                reason: row.reason,
+                ruleId: row.rule_id ?? undefined,
+                correlationId: row.correlation_id,
+                fingerprint: row.fingerprint,
+                reviewedBy: row.reviewed_by ?? undefined,
+                reviewedAt: toIso(row.reviewed_at) ?? undefined,
+                reviewNote: row.review_note ?? undefined,
+                requiredApprovals: row.required_approvals,
+                approvalCount: row.approval_count,
+                denialCount: row.denial_count,
+                reviews: row.reviews,
+            })),
+            breakGlassRequests: breakGlassRequests.rows.map((row) => ({
+                id: row.id,
+                tenantId: row.tenant_id,
+                createdAt: toIso(row.created_at),
+                expiresAt: toIso(row.expires_at),
+                status: row.status,
+                requestedBy: row.requested_by,
+                requestedRoles: row.requested_roles,
+                credentialId: row.credential_id,
+                operation: row.operation,
+                targetUrl: row.target_url,
+                targetHost: row.target_host,
+                justification: row.justification,
+                requestedDurationSeconds: row.requested_duration_seconds,
+                correlationId: row.correlation_id,
+                fingerprint: row.fingerprint,
+                reviewedBy: row.reviewed_by ?? undefined,
+                reviewedAt: toIso(row.reviewed_at) ?? undefined,
+                reviewNote: row.review_note ?? undefined,
+                requiredApprovals: row.required_approvals,
+                approvalCount: row.approval_count,
+                denialCount: row.denial_count,
+                reviews: row.reviews,
+                revokedBy: row.revoked_by ?? undefined,
+                revokedAt: toIso(row.revoked_at) ?? undefined,
+                revokeNote: row.revoke_note ?? undefined,
+            })),
+            rotationRuns: rotationRuns.rows.map((row) => ({
+                id: row.id,
+                tenantId: row.tenant_id,
+                credentialId: row.credential_id,
+                status: row.status,
+                source: row.source,
+                reason: row.reason,
+                dueAt: toIso(row.due_at) ?? undefined,
+                plannedAt: toIso(row.planned_at),
+                startedAt: toIso(row.started_at) ?? undefined,
+                completedAt: toIso(row.completed_at) ?? undefined,
+                plannedBy: row.planned_by,
+                updatedBy: row.updated_by,
+                note: row.note ?? undefined,
+                targetRef: row.target_ref ?? undefined,
+                resultNote: row.result_note ?? undefined,
+            })),
+            auditEvents: auditEvents.rows.map((row) => ({
+                eventId: row.event_id,
+                occurredAt: toIso(row.occurred_at),
+                tenantId: row.tenant_id,
+                type: row.type,
+                action: row.action,
+                outcome: row.outcome,
+                principal: row.principal,
+                correlationId: row.correlation_id,
+                metadata: row.metadata,
+            })),
+        });
+        const backup = this.filterBackupForTenant(fullBackup, actor?.tenantId);
+        if (actor) {
+            await this.audit.record({
+                type: "system.backup",
+                action: "system.backup.export",
+                outcome: "success",
+                tenantId: actor.tenantId,
+                principal: actor.principal,
+                metadata: this.summarizeBackup(backup),
+            });
+        }
+        return backup;
+    }
+    async writeBackup(filePath, actor) {
+        const backup = await this.exportBackup(actor);
+        await fs.writeFile(filePath, `${JSON.stringify(backup, null, 2)}\n`, "utf8");
+        return backup;
+    }
+    async readBackup(filePath) {
+        const raw = await fs.readFile(filePath, "utf8");
+        return this.parseBackupPayload(JSON.parse(raw));
+    }
+    async restoreBackupPayload(backup, actor) {
+        if (actor?.tenantId) {
+            this.assertTenantScopedBackup(backup, actor.tenantId);
+        }
+        await this.database.withTransaction(async (client) => {
+            if (actor?.tenantId) {
+                await client.query("DELETE FROM access_tokens WHERE tenant_id = $1", [actor.tenantId]);
+                await client.query("DELETE FROM refresh_tokens WHERE tenant_id = $1", [actor.tenantId]);
+                await client.query("DELETE FROM approval_requests WHERE tenant_id = $1", [actor.tenantId]);
+                await client.query("DELETE FROM break_glass_requests WHERE tenant_id = $1", [actor.tenantId]);
+                await client.query("DELETE FROM rotation_runs WHERE tenant_id = $1", [actor.tenantId]);
+                await client.query("DELETE FROM audit_events WHERE tenant_id = $1", [actor.tenantId]);
+                await client.query("DELETE FROM oauth_clients WHERE tenant_id = $1", [actor.tenantId]);
+                await client.query("DELETE FROM policy_rules WHERE tenant_id = $1", [actor.tenantId]);
+                await client.query("DELETE FROM credentials WHERE tenant_id = $1", [actor.tenantId]);
+                await client.query("DELETE FROM tenants WHERE tenant_id = $1", [actor.tenantId]);
+            }
+            else {
+                await client.query("DELETE FROM access_tokens");
+                await client.query("DELETE FROM refresh_tokens");
+                await client.query("DELETE FROM approval_requests");
+                await client.query("DELETE FROM break_glass_requests");
+                await client.query("DELETE FROM rotation_runs");
+                await client.query("DELETE FROM audit_events");
+                await client.query("DELETE FROM oauth_clients");
+                await client.query("DELETE FROM policy_rules");
+                await client.query("DELETE FROM credentials");
+                await client.query("DELETE FROM tenants");
+                await client.query("DELETE FROM request_rate_limits");
+            }
+            for (const tenant of backup.tenants) {
+                await client.query(`INSERT INTO tenants (
+             tenant_id, display_name, description, status, created_at, updated_at
+           ) VALUES ($1, $2, $3, $4, $5, $6)`, [
+                    tenant.tenantId,
+                    tenant.displayName,
+                    tenant.description ?? null,
+                    tenant.status,
+                    tenant.createdAt,
+                    tenant.updatedAt,
+                ]);
+            }
+            for (const credential of backup.credentials) {
+                await client.query(`INSERT INTO credentials (
+             id, tenant_id, display_name, service, owner, scope_tier, sensitivity,
+             allowed_domains, permitted_operations, expires_at, rotation_policy,
+             last_validated_at, selection_notes, binding, tags, status
+           ) VALUES (
+             $1, $2, $3, $4, $5, $6, $7,
+             $8, $9, $10, $11,
+             $12, $13, $14, $15, $16
+           )`, [
+                    credential.id,
+                    credential.tenantId,
+                    credential.displayName,
+                    credential.service,
+                    credential.owner,
+                    credential.scopeTier,
+                    credential.sensitivity,
+                    credential.allowedDomains,
+                    credential.permittedOperations,
+                    credential.expiresAt,
+                    credential.rotationPolicy,
+                    credential.lastValidatedAt,
+                    credential.selectionNotes,
+                    credential.binding,
+                    credential.tags,
+                    credential.status,
+                ]);
+            }
+            for (const rule of backup.policies.rules) {
+                await client.query(`INSERT INTO policy_rules (
+             id, tenant_id, effect, description, principals, principal_roles, credential_ids,
+             services, operations, domain_patterns, environments
+           ) VALUES (
+             $1, $2, $3, $4, $5, $6, $7,
+             $8, $9, $10, $11
+           )`, [
+                    rule.id,
+                    rule.tenantId,
+                    rule.effect,
+                    rule.description,
+                    rule.principals,
+                    rule.principalRoles ?? null,
+                    rule.credentialIds ?? null,
+                    rule.services ?? null,
+                    rule.operations,
+                    rule.domainPatterns,
+                    rule.environments ?? null,
+                ]);
+            }
+            for (const clientRecord of backup.authClients) {
+                await client.query(`INSERT INTO oauth_clients (
+             client_id, tenant_id, display_name, secret_hash, secret_salt, roles, allowed_scopes, status,
+             token_endpoint_auth_method, grant_types, redirect_uris, jwks
+           ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)`, [
+                    clientRecord.clientId,
+                    clientRecord.tenantId,
+                    clientRecord.displayName,
+                    clientRecord.secretHash ?? null,
+                    clientRecord.secretSalt ?? null,
+                    clientRecord.roles,
+                    clientRecord.allowedScopes,
+                    clientRecord.status,
+                    clientRecord.tokenEndpointAuthMethod,
+                    clientRecord.grantTypes,
+                    clientRecord.redirectUris,
+                    clientRecord.jwks,
+                ]);
+            }
+            for (const token of backup.accessTokens) {
+                await client.query(`INSERT INTO access_tokens (
+             token_id, token_hash, client_id, tenant_id, subject, scopes, roles,
+             resource, expires_at, status, created_at, last_used_at
+           ) VALUES (
+             $1, $2, $3, $4, $5, $6, $7,
+             $8, $9, $10, $11, $12
+           )`, [
+                    token.tokenId,
+                    token.tokenHash,
+                    token.clientId,
+                    token.tenantId,
+                    token.subject,
+                    token.scopes,
+                    token.roles,
+                    token.resource ?? null,
+                    token.expiresAt,
+                    token.status,
+                    token.createdAt,
+                    token.lastUsedAt ?? null,
+                ]);
+            }
+            for (const token of backup.refreshTokens) {
+                await client.query(`INSERT INTO refresh_tokens (
+             refresh_token_id, token_hash, client_id, tenant_id, subject, scopes, roles,
+             resource, expires_at, status, created_at, last_used_at
+           ) VALUES (
+             $1, $2, $3, $4, $5, $6, $7,
+             $8, $9, $10, $11, $12
+           )`, [
+                    token.refreshTokenId,
+                    token.tokenHash,
+                    token.clientId,
+                    token.tenantId,
+                    token.subject,
+                    token.scopes,
+                    token.roles,
+                    token.resource ?? null,
+                    token.expiresAt,
+                    token.status,
+                    token.createdAt,
+                    token.lastUsedAt ?? null,
+                ]);
+            }
+            for (const approval of backup.approvals) {
+                await client.query(`INSERT INTO approval_requests (
+             id, tenant_id, created_at, expires_at, status, requested_by, requested_roles,
+             credential_id, operation, target_url, target_host, reason, rule_id,
+             correlation_id, fingerprint, reviewed_by, reviewed_at, review_note,
+             required_approvals, approval_count, denial_count, reviews
+           ) VALUES (
+             $1, $2, $3, $4, $5, $6, $7,
+             $8, $9, $10, $11, $12, $13,
+             $14, $15, $16, $17, $18,
+             $19, $20, $21, $22
+           )`, [
+                    approval.id,
+                    approval.tenantId,
+                    approval.createdAt,
+                    approval.expiresAt,
+                    approval.status,
+                    approval.requestedBy,
+                    approval.requestedRoles,
+                    approval.credentialId,
+                    approval.operation,
+                    approval.targetUrl,
+                    approval.targetHost,
+                    approval.reason,
+                    approval.ruleId ?? null,
+                    approval.correlationId,
+                    approval.fingerprint,
+                    approval.reviewedBy ?? null,
+                    approval.reviewedAt ?? null,
+                    approval.reviewNote ?? null,
+                    approval.requiredApprovals,
+                    approval.approvalCount,
+                    approval.denialCount,
+                    approval.reviews,
+                ]);
+            }
+            for (const request of backup.breakGlassRequests) {
+                await client.query(`INSERT INTO break_glass_requests (
+             id, tenant_id, created_at, expires_at, status, requested_by, requested_roles,
+             credential_id, operation, target_url, target_host, justification, requested_duration_seconds,
+             correlation_id, fingerprint, reviewed_by, reviewed_at, review_note,
+             required_approvals, approval_count, denial_count, reviews,
+             revoked_by, revoked_at, revoke_note
+           ) VALUES (
+             $1, $2, $3, $4, $5, $6, $7,
+             $8, $9, $10, $11, $12, $13,
+             $14, $15, $16, $17, $18,
+             $19, $20, $21, $22,
+             $23, $24, $25
+           )`, [
+                    request.id,
+                    request.tenantId,
+                    request.createdAt,
+                    request.expiresAt,
+                    request.status,
+                    request.requestedBy,
+                    request.requestedRoles,
+                    request.credentialId,
+                    request.operation,
+                    request.targetUrl,
+                    request.targetHost,
+                    request.justification,
+                    request.requestedDurationSeconds,
+                    request.correlationId,
+                    request.fingerprint,
+                    request.reviewedBy ?? null,
+                    request.reviewedAt ?? null,
+                    request.reviewNote ?? null,
+                    request.requiredApprovals,
+                    request.approvalCount,
+                    request.denialCount,
+                    request.reviews,
+                    request.revokedBy ?? null,
+                    request.revokedAt ?? null,
+                    request.revokeNote ?? null,
+                ]);
+            }
+            for (const rotation of backup.rotationRuns) {
+                await client.query(`INSERT INTO rotation_runs (
+             id, tenant_id, credential_id, status, source, reason, due_at, planned_at, started_at,
+             completed_at, planned_by, updated_by, note, target_ref, result_note
+           ) VALUES (
+             $1, $2, $3, $4, $5, $6, $7, $8, $9,
+             $10, $11, $12, $13, $14, $15
+           )`, [
+                    rotation.id,
+                    rotation.tenantId,
+                    rotation.credentialId,
+                    rotation.status,
+                    rotation.source,
+                    rotation.reason,
+                    rotation.dueAt ?? null,
+                    rotation.plannedAt,
+                    rotation.startedAt ?? null,
+                    rotation.completedAt ?? null,
+                    rotation.plannedBy,
+                    rotation.updatedBy,
+                    rotation.note ?? null,
+                    rotation.targetRef ?? null,
+                    rotation.resultNote ?? null,
+                ]);
+            }
+            for (const event of backup.auditEvents) {
+                await client.query(`INSERT INTO audit_events (
+             event_id, occurred_at, tenant_id, type, action, outcome, principal, correlation_id, metadata
+           ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`, [
+                    event.eventId,
+                    event.occurredAt,
+                    event.tenantId,
+                    event.type,
+                    event.action,
+                    event.outcome,
+                    event.principal,
+                    event.correlationId,
+                    event.metadata,
+                ]);
+            }
+        });
+        if (actor) {
+            await this.audit.record({
+                type: "system.backup",
+                action: "system.backup.restore",
+                outcome: "success",
+                tenantId: actor.tenantId,
+                principal: actor.principal,
+                metadata: this.summarizeBackup(backup),
+            });
+        }
+        return backup;
+    }
+    async restoreBackup(filePath, actor) {
+        const backup = await this.readBackup(filePath);
+        return this.restoreBackupPayload(backup, actor);
+    }
+}