@valentinkolb/cloud 0.4.0 → 0.5.0

package/src/services/account-lifecycle/index.ts

@@ -3,14 +3,18 @@ import type { User } from "../../contracts/shared";
 import { logger } from "../logging";
 import { notifications } from "../notifications";
 import { applyIpaAccountTransitionPolicy } from "../accounts/switching";
+import { audit } from "../audit";
 import { get as getSetting } from "../settings";
 import { renderTemplate } from "../settings/templates";
 import { session } from "../session";
 import { getConfiguredExpiryDays, parseIpaAccountTransitionPolicy } from "../account-model";
 import { getFreeIpaConfig } from "../freeipa-config";
+import { getServiceIpaSession } from "../ipa/service-account";
+import { buildEffectiveIpaGroupsByUid } from "../ipa/effective-groups";
+import { providers } from "../providers";
 import { parsePgJsonRecord } from "../postgres";
 import { dates } from "../../shared";
-import { freeipa } from "../../server/services";
+import { err, fail, freeipa, ok, type Result } from "../../server/services";
 import { writeDeletedAccountAudit } from "./audit";
 import { getIpaUrl } from "../ipa/guard";
 
@@ -55,6 +59,99 @@ const getGuestExpiresDays = async (): Promise<number> => {
 const getDeletedAccountsRetentionDays = async (): Promise<number> => settingInt("user.account.deleted_accounts_retention_days", 365);
 const getReminderHistoryRetentionDays = async (): Promise<number> => settingInt("user.account.reminder_history_retention_days", 365);
 
+const readIpaList = (config: { response: Awaited<ReturnType<typeof freeipa.client.call>>; entity: string }): Result<Record<string, unknown>[]> => {
+  if (config.response.error) {
+    return fail(err.internal(`Could not verify FreeIPA ${config.entity} before extension.`));
+  }
+  const records = config.response.result?.result;
+  if (!Array.isArray(records)) {
+    return fail(err.internal(`Could not verify FreeIPA ${config.entity} before extension.`));
+  }
+  return ok(records as Record<string, unknown>[]);
+};
+
+const verifyCurrentIpaSyncScope = async (uid: string): Promise<Result<void>> => {
+  const config = await getFreeIpaConfig();
+  const serviceSession = await getServiceIpaSession();
+  if (!serviceSession.ok) {
+    return fail({
+      code: serviceSession.status === 400 ? "BAD_INPUT" : "INTERNAL",
+      message: serviceSession.error,
+      status: serviceSession.status,
+    });
+  }
+
+  const groupsRes = await freeipa.client.call({
+    url: config.url,
+    ipaSession: serviceSession.data,
+    method: "group_find",
+    args: [],
+    options: {
+      sizelimit: 0,
+      no_members: false,
+      all: true,
+    },
+  });
+  const groups = readIpaList({ response: groupsRes, entity: "groups" });
+  if (!groups.ok) return fail(groups.error);
+
+  const effectiveGroupsByUid = buildEffectiveIpaGroupsByUid(
+    groups.data.map((raw) => ({
+      cn: freeipa.util.str(raw.cn),
+      users: (raw.member_user as string[]) ?? [],
+      groups: (raw.member_group as string[]) ?? [],
+    })),
+  );
+  const effectiveGroups = effectiveGroupsByUid.get(uid) ?? [];
+  if (!config.groupsBaseSync.some((group) => effectiveGroups.includes(group))) {
+    return fail(err.forbidden("Your FreeIPA account is no longer in sync scope and cannot be extended."));
+  }
+
+  return ok();
+};
+
+const readFreshLocalIpaAccountExpiry = async (uid: string): Promise<Result<Date | null>> => {
+  const rows = await sql<DbRow[]>`
+    SELECT account_expires
+    FROM auth.users
+    WHERE uid = ${uid} AND provider = 'ipa'
+  `;
+  const row = rows[0];
+  if (!row) return fail(err.notFound("Your FreeIPA account was not found locally."));
+  return ok((row.account_expires as Date | null | undefined) ?? null);
+};
+
+const verifyIpaExtensionFreshness = async (uid: string): Promise<Result<{ accountExpires: Date }>> => {
+  const currentScope = await verifyCurrentIpaSyncScope(uid);
+  if (!currentScope.ok) return fail(currentScope.error);
+
+  const freshness = await providers.ipa.sync.user(uid).catch((error) => ({
+    status: "fetch_failed" as const,
+    error: error instanceof Error ? error.message : String(error),
+  }));
+
+  switch (freshness.status) {
+    case "synced": {
+      const accountExpires = await readFreshLocalIpaAccountExpiry(uid);
+      if (!accountExpires.ok) return accountExpires;
+      if (accountExpires.data === null) {
+        return fail(err.badInput("Accounts without an expiration date cannot be extended."));
+      }
+      return ok({ accountExpires: accountExpires.data });
+    }
+    case "expired":
+      return fail(err.badInput("Your FreeIPA account is expired and cannot be extended."));
+    case "out_of_scope":
+      return fail(err.forbidden("Your FreeIPA account is no longer in sync scope and cannot be extended."));
+    case "not_found_local":
+      return fail(err.notFound("Your FreeIPA account was not found locally."));
+    case "fetch_failed":
+      return fail(err.internal("Could not verify your FreeIPA account before extension."));
+    case "skipped_disabled":
+      return fail(err.badInput("FreeIPA is disabled."));
+  }
+};
+
 const parseReminderDays = async (): Promise<number[]> => {
   const raw = await getSetting<number[]>("user.account.reminder_days");
   const parsed = Array.isArray(raw) ? raw.filter((entry) => Number.isInteger(entry) && entry > 0) : [];
@@ -675,20 +772,47 @@ export const accountLifecycle = {
 
   extendCurrentUserAccount: async (config: {
     user: User;
-    ipaSession?: string | null;
-  }): Promise<{ message: string; newExpiry?: string }> => {
+  }): Promise<Result<{ message: string; newExpiry?: string }>> => {
+    const auditParams = (result: Result<{ message: string; newExpiry?: string }>) => ({
+      action: "accounts.user.extend_account",
+      actor: {
+        userId: config.user.id,
+        uid: config.user.uid,
+        provider: config.user.provider,
+        roles: config.user.roles,
+      },
+      target: { type: "user", id: config.user.id, label: config.user.uid, provider: config.user.provider },
+      result,
+    });
+    const recordResult = (result: Result<{ message: string; newExpiry?: string }>) =>
+      audit.recordResult(auditParams(result));
+    const recordCompletedMutation = (result: Result<{ message: string; newExpiry?: string }>) =>
+      result.ok ? audit.recordResultAfterSideEffect(auditParams(result)) : audit.recordResult(auditParams(result));
+
+    if (config.user.accountExpires === null) {
+      return recordResult(fail(err.badInput("Accounts without an expiration date cannot be extended.")));
+    }
+
     if (config.user.provider === "ipa") {
       const freeIpaConfig = (await getFreeIpaConfig());
       if (!freeIpaConfig.enabled) {
-        return { message: "FreeIPA is disabled." };
+        return recordResult(ok({ message: "FreeIPA is disabled." }));
       }
       const configuredDays = await getIpaExpiresDays();
       if (configuredDays <= 0) {
-        return { message: "Automatic account expiry is disabled for IPA accounts." };
+        return recordResult(ok({ message: "Automatic account expiry is disabled for IPA accounts." }));
       }
 
-      if (!config.ipaSession) {
-        throw new Error("IPA session required to extend an IPA-backed account.");
+      const freshness = await verifyIpaExtensionFreshness(config.user.uid);
+      if (!freshness.ok) return recordResult(fail(freshness.error));
+
+      const serviceSession = await getServiceIpaSession();
+      if (!serviceSession.ok) {
+        return recordResult(fail({
+          code: serviceSession.status === 400 ? "BAD_INPUT" : "INTERNAL",
+          message: serviceSession.error,
+          status: serviceSession.status,
+        }));
       }
 
       const expiresAt = new Date(Date.now() + configuredDays * DAY_MS);
@@ -697,13 +821,13 @@ export const accountLifecycle = {
 
       const response = await freeipa.client.call({
         url: freeIpaConfig.url,
-        ipaSession: config.ipaSession,
+        ipaSession: serviceSession.data,
         method: "user_mod",
         args: [config.user.uid],
         options: { krbprincipalexpiration: ipaExpiry },
       });
       if (response.error) {
-        throw new Error(response.error.message || "Failed to extend IPA account.");
+        return recordResult(fail(err.badInput(response.error.message || "Failed to extend IPA account.")));
       }
 
       await sql`
@@ -717,10 +841,10 @@ export const accountLifecycle = {
         ON CONFLICT (user_id) DO UPDATE SET synced_at = EXCLUDED.synced_at
       `;
 
-      return {
+      return recordCompletedMutation(ok({
         message: `Account extended until ${dates.formatDate(expiresAt)}.`,
         newExpiry: expiresAt.toISOString(),
-      };
+      }));
     }
 
     if (config.user.provider === "local" && config.user.profile === "guest") {
@@ -731,7 +855,7 @@ export const accountLifecycle = {
           SET account_expires = NULL
           WHERE id = ${config.user.id}::uuid
         `;
-        return { message: "Guest account expiry is disabled." };
+        return recordCompletedMutation(ok({ message: "Guest account expiry is disabled." }));
       }
 
       const expiresAt = new Date(Date.now() + guestDays * DAY_MS);
@@ -741,10 +865,10 @@ export const accountLifecycle = {
         WHERE id = ${config.user.id}::uuid
       `;
 
-      return {
+      return recordCompletedMutation(ok({
         message: `Guest account extended until ${dates.formatDate(expiresAt)}.`,
         newExpiry: expiresAt.toISOString(),
-      };
+      }));
     }
 
     if (config.user.provider === "local" && config.user.profile === "user") {
@@ -755,7 +879,7 @@ export const accountLifecycle = {
           SET account_expires = NULL
           WHERE id = ${config.user.id}::uuid
         `;
-        return { message: "Local user account expiry is disabled." };
+        return recordCompletedMutation(ok({ message: "Local user account expiry is disabled." }));
       }
 
       const expiresAt = new Date(Date.now() + localUserDays * DAY_MS);
@@ -765,13 +889,13 @@ export const accountLifecycle = {
         WHERE id = ${config.user.id}::uuid
       `;
 
-      return {
+      return recordCompletedMutation(ok({
         message: `Account extended until ${dates.formatDate(expiresAt)}.`,
         newExpiry: expiresAt.toISOString(),
-      };
+      }));
     }
 
-    return { message: "Your account does not support extension." };
+    return recordResult(ok({ message: "Your account does not support extension." }));
   },
 
   listDeletedAccounts: async (config: { page: number; perPage: number; reason?: string; search?: string }) => {