@zgeoff/atc 2.17.0 → 2.20.0

package/src/store/run-migrations.ts

@@ -5,6 +5,7 @@ import { DEFAULT_MIGRATION_TABLE, Migrator } from 'kysely/migration';
 import type { Migration, MigrationProvider, MigrationResultSet } from 'kysely/migration';
 import type { IdempotencyState } from './idempotency-record';
 import type { MessageStatus } from './message-record';
+import type { RuntimeAuthBindingState, RuntimeAuthGrantPhase } from './runtime-auth-binding';
 import type { MaterializationPhase } from './workspace-materialization';
 
 interface FleetTable {
@@ -118,6 +119,41 @@ interface WorkspaceMaterializationTable {
   withheld_env: string | null;
 }
 
+// One host's runtime auth binding, keyed by the session that owns the imp.
+// The rebind columns hold a rebind in flight or the one that failed, all
+// null otherwise.
+interface RuntimeAuthBindingTable {
+  host_key: string;
+  target: string;
+  target_identity: string;
+  imp_name: string;
+  imp_id: string | null;
+  revision: number;
+  binding_hash: string;
+  binding_json: string;
+  state: RuntimeAuthBindingState;
+  attempt_id: string;
+  imp_created_by_attempt: number;
+  rebind_revision: number | null;
+  rebind_binding_hash: string | null;
+  rebind_binding_json: string | null;
+  rebind_attempt_id: string | null;
+  created_at: number;
+  updated_at: number;
+  revoked_at: number | null;
+}
+
+// One secret's grant to a host's imp, keyed by the host and the secret.
+interface RuntimeAuthGrantTable {
+  host_key: string;
+  secret: string;
+  revision: number;
+  attempt_id: string;
+  preexisting: number;
+  phase: RuntimeAuthGrantPhase;
+  updated_at: number;
+}
+
 interface MessagesTable {
   id: string;
   atc_id: string;
@@ -148,6 +184,8 @@ export interface StateStoreSchema {
   session_owner: SessionOwnerTable;
   idempotency: IdempotencyTable;
   workspace_materialization: WorkspaceMaterializationTable;
+  runtime_auth_binding: RuntimeAuthBindingTable;
+  runtime_auth_grant: RuntimeAuthGrantTable;
 }
 
 // Every shape the fleet table has shipped with: the oldest carries only
@@ -472,6 +510,45 @@ const MIGRATIONS: Record<string, Migration> = {
       }
     },
   },
+  '025_create_runtime_auth': {
+    async up(db: Kysely<StateStoreSchema>) {
+      await db.schema
+        .createTable('runtime_auth_binding')
+        .ifNotExists()
+        .addColumn('host_key', 'text', (c) => c.primaryKey())
+        .addColumn('target', 'text', (c) => c.notNull())
+        .addColumn('target_identity', 'text', (c) => c.notNull())
+        .addColumn('imp_name', 'text', (c) => c.notNull())
+        .addColumn('imp_id', 'text')
+        .addColumn('revision', 'integer', (c) => c.notNull())
+        .addColumn('binding_hash', 'text', (c) => c.notNull())
+        .addColumn('binding_json', 'text', (c) => c.notNull())
+        .addColumn('state', 'text', (c) => c.notNull())
+        .addColumn('attempt_id', 'text', (c) => c.notNull())
+        .addColumn('imp_created_by_attempt', 'integer', (c) => c.notNull().defaultTo(0))
+        .addColumn('rebind_revision', 'integer')
+        .addColumn('rebind_binding_hash', 'text')
+        .addColumn('rebind_binding_json', 'text')
+        .addColumn('rebind_attempt_id', 'text')
+        .addColumn('created_at', 'integer', (c) => c.notNull())
+        .addColumn('updated_at', 'integer', (c) => c.notNull())
+        .addColumn('revoked_at', 'integer')
+        .execute();
+
+      await db.schema
+        .createTable('runtime_auth_grant')
+        .ifNotExists()
+        .addColumn('host_key', 'text', (c) => c.notNull())
+        .addColumn('secret', 'text', (c) => c.notNull())
+        .addColumn('revision', 'integer', (c) => c.notNull())
+        .addColumn('attempt_id', 'text', (c) => c.notNull())
+        .addColumn('preexisting', 'integer', (c) => c.notNull())
+        .addColumn('phase', 'text', (c) => c.notNull())
+        .addColumn('updated_at', 'integer', (c) => c.notNull())
+        .addPrimaryKeyConstraint('runtime_auth_grant_pk', ['host_key', 'secret'])
+        .execute();
+    },
+  },
 };
 
 const PROVIDER: MigrationProvider = {

package/src/store/runtime-auth-binding.ts

@@ -0,0 +1,110 @@
+import type { SessionID } from '../shared/session-id';
+
+/**
+ * Where a session's runtime auth binding stands:
+ *
+ * - `provisioning`: an attempt is creating the imp or adding grants.
+ * - `ready`: every grant is in place and the session may launch.
+ * - `revoked`: atc withdrew the grants; the session never launches again
+ *   until an explicit rebind.
+ * - `revocation_pending`: the binding is blocked, but impd has not yet
+ *   confirmed every grant gone, so access may remain until the owner
+ *   resolves it.
+ * - `rollback_pending`: a failed attempt left effects atc could not
+ *   confirm removed.
+ * - `rebind_failed`: a rebind failed; the binding keeps its old revision,
+ *   the failed one is kept beside it, and auth stays blocked until an
+ *   explicit retry.
+ */
+export type RuntimeAuthBindingState =
+  | 'provisioning'
+  | 'ready'
+  | 'revoked'
+  | 'revocation_pending'
+  | 'rollback_pending'
+  | 'rebind_failed';
+
+/**
+ * A rebind's revision, the binding it moves to, and the attempt making it.
+ */
+interface RuntimeAuthRebind {
+  readonly revision: number;
+  readonly bindingHash: string;
+  readonly bindingJSON: string;
+  readonly attemptID: string;
+}
+
+/**
+ * One host's runtime auth binding, keyed by the session that owns the imp;
+ * its sub-sessions share it. The binding holds secret names and rules,
+ * never a credential value.
+ */
+export interface RuntimeAuthBinding {
+  readonly hostKey: SessionID;
+  readonly target: string;
+  readonly targetIdentity: string;
+  readonly impName: string;
+
+  // impd's id for the imp; null until the imp exists.
+  readonly impID: string | null;
+  readonly revision: number;
+  readonly bindingHash: string;
+  readonly bindingJSON: string;
+  readonly state: RuntimeAuthBindingState;
+
+  // The attempt that last provisioned this revision.
+  readonly attemptID: string;
+
+  // Whether that attempt created the imp, which only then may be destroyed
+  // in its rollback.
+  readonly impCreatedByAttempt: boolean;
+
+  // The next revision a rebind is adding, or the failed one it left; null
+  // when no rebind is in flight or failed.
+  readonly rebind: RuntimeAuthRebind | null;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+  readonly revokedAt: number | null;
+}
+
+// The fields a binding rewrites as it moves between states; `rebind: null`
+// clears a settled rebind.
+export interface RuntimeAuthBindingUpdate {
+  readonly state?: RuntimeAuthBindingState;
+  readonly impID?: string;
+  readonly impCreatedByAttempt?: boolean;
+  readonly revision?: number;
+  readonly bindingHash?: string;
+  readonly bindingJSON?: string;
+  readonly attemptID?: string;
+  readonly rebind?: RuntimeAuthRebind | null;
+  readonly revokedAt?: number;
+}
+
+/**
+ * Where one secret's grant to a host's imp stands. `uncertain` is a grant a
+ * stopped daemon left `granting`, which impd's grant list settles on next
+ * use; `revocation_pending` is one atc could not confirm removed.
+ */
+export type RuntimeAuthGrantPhase =
+  | 'granting'
+  | 'granted'
+  | 'uncertain'
+  | 'revoking'
+  | 'revoked'
+  | 'revocation_pending';
+
+/**
+ * One secret's grant to a host's imp: the revision and attempt that added
+ * it, and whether impd held it before that attempt, which rules it out of
+ * the attempt's rollback.
+ */
+export interface RuntimeAuthGrant {
+  readonly hostKey: SessionID;
+  readonly secret: string;
+  readonly revision: number;
+  readonly attemptID: string;
+  readonly preexisting: boolean;
+  readonly phase: RuntimeAuthGrantPhase;
+  readonly updatedAt: number;
+}

package/src/store/state-store.ts

@@ -24,6 +24,11 @@ import type { MessageOwner } from './message-owner';
 import type { MessageRecord } from './message-record';
 import { runMigrations } from './run-migrations';
 import type { StateStoreSchema } from './run-migrations';
+import type {
+  RuntimeAuthBinding,
+  RuntimeAuthBindingUpdate,
+  RuntimeAuthGrant,
+} from './runtime-auth-binding';
 import type { TrailEntry } from './trail-entry';
 import type {
   MaterializationUpdate,
@@ -951,6 +956,154 @@ export class StateStore {
       .execute();
   }
 
+  // Records a host's binding as its first attempt starts provisioning it,
+  // at the first revision, before the imp exists.
+  async createAuthBinding(
+    row: Pick<
+      RuntimeAuthBinding,
+      | 'hostKey'
+      | 'target'
+      | 'targetIdentity'
+      | 'impName'
+      | 'bindingHash'
+      | 'bindingJSON'
+      | 'attemptID'
+    >,
+    at: number,
+  ): Promise<void> {
+    await this.db
+      .insertInto('runtime_auth_binding')
+      .values({
+        host_key: row.hostKey,
+        target: row.target,
+        target_identity: row.targetIdentity,
+        imp_name: row.impName,
+        imp_id: null,
+        revision: 1,
+        binding_hash: row.bindingHash,
+        binding_json: row.bindingJSON,
+        state: 'provisioning',
+        attempt_id: row.attemptID,
+        imp_created_by_attempt: 0,
+        rebind_revision: null,
+        rebind_binding_hash: null,
+        rebind_binding_json: null,
+        rebind_attempt_id: null,
+        created_at: at,
+        updated_at: at,
+        revoked_at: null,
+      })
+      .execute();
+  }
+
+  async updateAuthBinding(
+    hostKey: SessionID,
+    fields: RuntimeAuthBindingUpdate,
+    at: number,
+  ): Promise<void> {
+    await this.db
+      .updateTable('runtime_auth_binding')
+      .set({
+        ...(fields.state === undefined ? {} : { state: fields.state }),
+        ...(fields.impID === undefined ? {} : { imp_id: fields.impID }),
+        ...(fields.impCreatedByAttempt === undefined
+          ? {}
+          : { imp_created_by_attempt: fields.impCreatedByAttempt ? 1 : 0 }),
+        ...(fields.revision === undefined ? {} : { revision: fields.revision }),
+        ...(fields.bindingHash === undefined ? {} : { binding_hash: fields.bindingHash }),
+        ...(fields.bindingJSON === undefined ? {} : { binding_json: fields.bindingJSON }),
+        ...(fields.attemptID === undefined ? {} : { attempt_id: fields.attemptID }),
+        ...(fields.rebind === undefined
+          ? {}
+          : {
+              rebind_revision: fields.rebind?.revision ?? null,
+              rebind_binding_hash: fields.rebind?.bindingHash ?? null,
+              rebind_binding_json: fields.rebind?.bindingJSON ?? null,
+              rebind_attempt_id: fields.rebind?.attemptID ?? null,
+            }),
+        ...(fields.revokedAt === undefined ? {} : { revoked_at: fields.revokedAt }),
+        updated_at: at,
+      })
+      .where('host_key', '=', hostKey)
+      .execute();
+  }
+
+  async findAuthBinding(hostKey: SessionID): Promise<RuntimeAuthBinding | null> {
+    const row = await this.db
+      .selectFrom('runtime_auth_binding')
+      .selectAll()
+      .where('host_key', '=', hostKey)
+      .executeTakeFirst();
+
+    return row === undefined ? null : toRuntimeAuthBinding(row);
+  }
+
+  // Writes one secret's grant row for a host, or moves the existing one to
+  // the given phase, revision and attempt.
+  async upsertAuthGrant(grant: Omit<RuntimeAuthGrant, 'updatedAt'>, at: number): Promise<void> {
+    await this.db
+      .insertInto('runtime_auth_grant')
+      .values({
+        host_key: grant.hostKey,
+        secret: grant.secret,
+        revision: grant.revision,
+        attempt_id: grant.attemptID,
+        preexisting: grant.preexisting ? 1 : 0,
+        phase: grant.phase,
+        updated_at: at,
+      })
+      .onConflict((oc) =>
+        oc.columns(['host_key', 'secret']).doUpdateSet((eb) => ({
+          revision: eb.ref('excluded.revision'),
+          attempt_id: eb.ref('excluded.attempt_id'),
+          preexisting: eb.ref('excluded.preexisting'),
+          phase: eb.ref('excluded.phase'),
+          updated_at: eb.ref('excluded.updated_at'),
+        })),
+      )
+      .execute();
+  }
+
+  // A host's grant rows, by secret name.
+  async collectAuthGrants(hostKey: SessionID): Promise<RuntimeAuthGrant[]> {
+    const rows = await this.db
+      .selectFrom('runtime_auth_grant')
+      .selectAll()
+      .where('host_key', '=', hostKey)
+      .orderBy('secret')
+      .execute();
+
+    return rows.map((row) => ({
+      hostKey: toSessionID(row.host_key),
+      secret: row.secret,
+      revision: row.revision,
+      attemptID: row.attempt_id,
+      preexisting: row.preexisting === 1,
+      phase: row.phase,
+      updatedAt: row.updated_at,
+    }));
+  }
+
+  // Drops a host's binding and every grant row it holds together, once
+  // impd confirms the imp and its grants gone.
+  async removeAuthBinding(hostKey: SessionID): Promise<void> {
+    await this.db.transaction().execute(async (trx) => {
+      await trx.deleteFrom('runtime_auth_grant').where('host_key', '=', hostKey).execute();
+      await trx.deleteFrom('runtime_auth_binding').where('host_key', '=', hostKey).execute();
+    });
+  }
+
+  // Runs once as a daemon starts, before it serves a request: a grant still
+  // granting belonged to a daemon that stopped before impd answered, so
+  // whether impd holds it is uncertain until its grant list is read.
+  async reconcileAuthBindings(at: number): Promise<void> {
+    await this.db
+      .updateTable('runtime_auth_grant')
+      .set({ phase: 'uncertain', updated_at: at })
+      .where('phase', '=', 'granting')
+      .execute();
+  }
+
   async stop(): Promise<void> {
     await this.db.destroy();
 
@@ -1334,3 +1487,36 @@ function toWorkspaceMaterialization(
     withheldEnv: parseWithheldEnv(row.withheld_env),
   };
 }
+
+function toRuntimeAuthBinding(
+  row: Readonly<StateStoreSchema['runtime_auth_binding']>,
+): RuntimeAuthBinding {
+  return {
+    hostKey: toSessionID(row.host_key),
+    target: row.target,
+    targetIdentity: row.target_identity,
+    impName: row.imp_name,
+    impID: row.imp_id,
+    revision: row.revision,
+    bindingHash: row.binding_hash,
+    bindingJSON: row.binding_json,
+    state: row.state,
+    attemptID: row.attempt_id,
+    impCreatedByAttempt: row.imp_created_by_attempt === 1,
+    rebind:
+      row.rebind_revision === null ||
+      row.rebind_binding_hash === null ||
+      row.rebind_binding_json === null ||
+      row.rebind_attempt_id === null
+        ? null
+        : {
+            revision: row.rebind_revision,
+            bindingHash: row.rebind_binding_hash,
+            bindingJSON: row.rebind_binding_json,
+            attemptID: row.rebind_attempt_id,
+          },
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    revokedAt: row.revoked_at,
+  };
+}