anbaric-cloud-hosting 1.0.0

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "anbaric-cloud-hosting",
+  "version": "1.0.0",
+  "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
+  "license": "MIT",
+  "author": "chris@anbaric.ai",
+  "type": "module",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "scripts": {
+    "start": "tsx src/main.ts",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@aws-sdk/client-codebuild": "^3.1110.0",
+    "@aws-sdk/client-ecs": "^3.1110.0",
+    "@aws-sdk/client-s3": "^3.1110.0",
+    "@aws-sdk/client-secrets-manager": "^3.700.0",
+    "@aws-sdk/client-servicediscovery": "^3.1110.0",
+    "anbaric-data-store": "^1.0.0",
+    "anbaric-tsapi": "^1.0.0",
+    "pg": "^8.16.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.2.0",
+    "@types/pg": "^8.15.0",
+    "anbaric-cloud": "^1.0.0",
+    "anbaric-state-machine": "^1.0.0",
+    "tsx": "^4.20.0",
+    "typescript": "^7.0.2"
+  },
+  "files": [
+    "src"
+  ]
+}

package/src/app-management/BaseBuildLayer.ts

@@ -0,0 +1,178 @@
+import {ChildProcess, spawn} from "node:child_process";
+import {mkdir, readFile, rm, symlink, writeFile} from "node:fs/promises";
+import {join} from "node:path";
+import {BuildLayer, DeploymentStatus, DeploymentSummary} from "./BuildLayer";
+
+type Deployment = {
+    appName : string,
+    status : DeploymentStatus,
+    appPort : number,
+    appHost : string,
+    consumerPort : number,
+    log : Array<string>,
+    process? : ChildProcess,
+    replaces? : Deployment,
+};
+
+type Probe = (host : string, port : number) => Promise<boolean>;
+
+const LOG_LIMIT = 200;
+const LIVENESS_TIMEOUT_MS = 30_000;
+const LIVENESS_PROBE_INTERVAL_MS = 250;
+
+const httpProbe : Probe = async (host, port) => {
+    try {
+        await fetch(`http://${host}:${port}/`, { signal: AbortSignal.timeout(LIVENESS_PROBE_INTERVAL_MS) });
+        return true;
+    } catch {
+        return false;
+    }
+};
+
+abstract class BaseBuildLayer implements BuildLayer {
+
+    protected deployments = new Map<string, Deployment>();
+    private nextAppIndex = 0;
+
+    constructor(protected appsDir : string, private consumerPortBase : number = 8800,
+                private probe : Probe = httpProbe,
+                private livenessTimeoutMs : number = LIVENESS_TIMEOUT_MS) {}
+
+    deploy(appName : string, appPort : number, tarball : Buffer) : DeploymentSummary {
+        const existing = this.deployments.get(appName);
+
+        const deployment : Deployment = {
+            appName,
+            status: "building",
+            appPort,
+            appHost: this.appHostFor(appName),
+            consumerPort: existing?.consumerPort ?? this.consumerPortBase + this.nextAppIndex++,
+            log: [],
+            replaces: existing,
+        };
+        this.deployments.set(appName, deployment);
+
+        void this.buildAndStart(deployment, tarball).catch(error => {
+            deployment.status = "failed";
+            this.log(deployment, `build failed: ${error instanceof Error ? error.message : error}`);
+        });
+
+        return this.summarize(deployment);
+    }
+
+    status(appName : string) : (DeploymentSummary & { log : Array<string> }) | undefined {
+        const deployment = this.deployments.get(appName);
+        return deployment && { ...this.summarize(deployment), log: deployment.log.slice(-20) };
+    }
+
+    list() : Array<DeploymentSummary> {
+        return Array.from(this.deployments.values(), deployment => this.summarize(deployment));
+    }
+
+    async cleanUp() : Promise<void> {
+        await Promise.all(Array.from(this.deployments.values(), deployment => {
+            deployment.status = "stopped";
+            return this.stop(deployment);
+        }));
+    }
+
+    protected abstract appHostFor(appName : string) : string;
+    protected abstract start(deployment : Deployment, appDir : string, entryPoint : string) : Promise<void>;
+    protected abstract stop(deployment : Deployment) : Promise<void>;
+
+    private async buildAndStart(deployment : Deployment, tarball : Buffer) : Promise<void> {
+        const appDir = join(this.appsDir, deployment.appName);
+        await rm(appDir, { recursive: true, force: true });
+        await mkdir(appDir, { recursive: true });
+
+        const tarballPath = join(this.appsDir, `${deployment.appName}.tar.gz`);
+        await writeFile(tarballPath, tarball);
+        this.log(deployment, "extracting application bundle");
+        await this.run(deployment, "tar", ["-xzf", tarballPath, "-C", appDir]);
+
+        this.log(deployment, "linking anbaric workspace packages");
+        const manifest = JSON.parse(await readFile(join(appDir, "package.json"), "utf8"));
+        await this.linkWorkspacePackages(appDir, manifest);
+
+        if (deployment.replaces) await this.stop(deployment.replaces);
+
+        if (!this.isCurrent(deployment)) return;
+        await this.start(deployment, appDir, manifest.main);
+        await this.awaitLive(deployment);
+    }
+
+    protected isCurrent(deployment : Deployment) : boolean {
+        return this.deployments.get(deployment.appName) === deployment && deployment.status === "building";
+    }
+
+    private async awaitLive(deployment : Deployment) : Promise<void> {
+        const deadline = Date.now() + this.livenessTimeoutMs;
+
+        while (Date.now() < deadline) {
+            if (deployment.status !== "building") return;
+            if (await this.probe(deployment.appHost, deployment.appPort)) {
+                deployment.status = "running";
+                this.log(deployment, `app is live at ${deployment.appHost}:${deployment.appPort}`);
+                return;
+            }
+            await new Promise(resolve => setTimeout(resolve, LIVENESS_PROBE_INTERVAL_MS));
+        }
+
+        await this.stop(deployment);
+        deployment.status = "failed";
+        this.log(deployment, `app did not respond at ${deployment.appHost}:${deployment.appPort} within ${this.livenessTimeoutMs / 1000}s`);
+    }
+
+    private async linkWorkspacePackages(appDir : string, manifest : { dependencies? : Record<string, string> }) : Promise<void> {
+        const workspacePackages = await this.workspacePackages();
+        await mkdir(join(appDir, "node_modules"), { recursive: true });
+
+        for (const dependency of Object.keys(manifest.dependencies ?? {})) {
+            const workspaceDir = workspacePackages.get(dependency);
+            if (workspaceDir) await symlink(workspaceDir, join(appDir, "node_modules", dependency));
+        }
+    }
+
+    private async workspacePackages() : Promise<Map<string, string>> {
+        const root = process.cwd();
+        const rootManifest = JSON.parse(await readFile(join(root, "package.json"), "utf8"));
+        const packages = new Map<string, string>();
+
+        for (const workspace of rootManifest.workspaces ?? []) {
+            const manifest = JSON.parse(await readFile(join(root, workspace, "package.json"), "utf8"));
+            packages.set(manifest.name, join(root, workspace));
+        }
+
+        return packages;
+    }
+
+    protected run(deployment : Deployment, command : string, args : Array<string>) : Promise<void> {
+        return new Promise((resolve, reject) => {
+            const child = spawn(command, args);
+            child.stdout.on("data", chunk => this.log(deployment, String(chunk).trimEnd()));
+            child.stderr.on("data", chunk => this.log(deployment, String(chunk).trimEnd()));
+            child.on("exit", code => code === 0
+                ? resolve()
+                : reject(new Error(`${command} exited with code ${code}`)));
+            child.on("error", reject);
+        });
+    }
+
+    protected summarize(deployment : Deployment) : DeploymentSummary {
+        return {
+            appName: deployment.appName,
+            status: deployment.status,
+            appPort: deployment.appPort,
+            appHost: deployment.appHost,
+        };
+    }
+
+    protected log(deployment : Deployment, line : string) : void {
+        deployment.log.push(line);
+        if (deployment.log.length > LOG_LIMIT) deployment.log.shift();
+    }
+
+}
+
+export { BaseBuildLayer, httpProbe };
+export type { Deployment, Probe };

package/src/app-management/BuildLayer.ts

@@ -0,0 +1,19 @@
+type DeploymentStatus = "building" | "running" | "failed" | "stopped";
+
+type DeploymentSummary = {
+    appName : string,
+    status : DeploymentStatus,
+    appPort : number,
+    appHost : string,
+};
+
+interface BuildLayer {
+
+    deploy(appName : string, appPort : number, tarball : Buffer) : DeploymentSummary;
+    status(appName : string) : (DeploymentSummary & { log : Array<string> }) | undefined;
+    list() : Array<DeploymentSummary>;
+    cleanUp() : Promise<void>;
+
+}
+
+export type { BuildLayer, DeploymentStatus, DeploymentSummary };

package/src/app-management/DockerBuildLayer.ts

@@ -0,0 +1,84 @@
+import {spawn} from "node:child_process";
+import {writeFile} from "node:fs/promises";
+import {join} from "node:path";
+import {BaseBuildLayer, Deployment, Probe} from "./BaseBuildLayer";
+
+type DockerBuildLayerOptions = {
+    baseImage : string,
+    network : string,
+    platformUrl : string,
+};
+
+type CommandRunner = (command : string, args : Array<string>, onOutput : (line : string) => void) => Promise<void>;
+
+const spawnRunner : CommandRunner = (command, args, onOutput) =>
+    new Promise((resolve, reject) => {
+        const child = spawn(command, args);
+        child.stdout.on("data", chunk => onOutput(String(chunk).trimEnd()));
+        child.stderr.on("data", chunk => onOutput(String(chunk).trimEnd()));
+        child.on("exit", code => code === 0
+            ? resolve()
+            : reject(new Error(`${command} ${args[0]} exited with code ${code}`)));
+        child.on("error", reject);
+    });
+
+const dockerfileFor = (baseImage : string, entryPoint : string) : string => `FROM ${baseImage}
+COPY . /anbaric-app
+WORKDIR /anbaric-app
+CMD ["/anbaric/node_modules/.bin/tsx", "${entryPoint}"]
+`;
+
+class DockerBuildLayer extends BaseBuildLayer {
+
+    constructor(appsDir : string, private options : DockerBuildLayerOptions,
+                consumerPortBase? : number,
+                private runCommand : CommandRunner = spawnRunner, probe? : Probe) {
+        super(appsDir, consumerPortBase, probe);
+    }
+
+    protected appHostFor(appName : string) : string {
+        return `anbaric-app-${appName}`;
+    }
+
+    protected async start(deployment : Deployment, appDir : string, entryPoint : string) : Promise<void> {
+        const image = this.appHostFor(deployment.appName);
+        const container = this.appHostFor(deployment.appName);
+
+        await writeFile(join(appDir, "Dockerfile"), dockerfileFor(this.options.baseImage, entryPoint));
+        this.log(deployment, `baking image ${image}`);
+        await this.docker(deployment, ["build", "-t", image, appDir]);
+
+        await this.removeContainer(deployment, container);
+
+        this.log(deployment, `starting container ${container}`);
+        await this.docker(deployment, ["run", "--detach", "--name", container,
+            "--network", this.options.network,
+            "--env", `PORT=${deployment.appPort}`,
+            "--env", `ANBARIC_CLOUD_URL=${this.options.platformUrl}`,
+            "--env", "ANBARIC_JOB_PERSISTENCE_TYPE=cloud",
+            "--env", "ANBARIC_QUEUE_TYPE=cloud",
+            "--env", "ANBARIC_JSON_STORE_TYPE=cloud",
+            "--env", "ANBARIC_SECRET_STORE_TYPE=cloud",
+            "--env", `ANBARIC_CONSUMER_PORT=${deployment.consumerPort}`,
+            "--env", `ANBARIC_CONSUMER_URL=http://${container}:${deployment.consumerPort}`,
+            image]);
+
+        void this.docker(deployment, ["logs", "--follow", container]).catch(() => {});
+    }
+
+    protected async stop(deployment : Deployment) : Promise<void> {
+        await this.removeContainer(deployment, this.appHostFor(deployment.appName));
+    }
+
+    private async removeContainer(deployment : Deployment, container : string) : Promise<void> {
+        await this.docker(deployment, ["rm", "--force", container]).catch(() => {});
+    }
+
+    private docker(deployment : Deployment, args : Array<string>) : Promise<void> {
+        return this.runCommand("docker", args, line => this.log(deployment, line));
+    }
+
+}
+
+export { DockerBuildLayer, dockerfileFor };
+export type { CommandRunner, DockerBuildLayerOptions };

package/src/app-management/FargateBuildLayer.ts

@@ -0,0 +1,232 @@
+import {readFile, writeFile} from "node:fs/promises";
+import {join} from "node:path";
+import {CodeBuildClient, BatchGetBuildsCommand, StartBuildCommand} from "@aws-sdk/client-codebuild";
+import {ECSClient, CreateServiceCommand, DeleteServiceCommand, DescribeServicesCommand,
+    RegisterTaskDefinitionCommand, UpdateServiceCommand} from "@aws-sdk/client-ecs";
+import {S3Client, PutObjectCommand} from "@aws-sdk/client-s3";
+import {ServiceDiscoveryClient, CreateServiceCommand as CreateDiscoveryServiceCommand,
+    ListServicesCommand} from "@aws-sdk/client-servicediscovery";
+import {BaseBuildLayer, Deployment, Probe} from "./BaseBuildLayer";
+import {dockerfileFor} from "./DockerBuildLayer";
+
+type FargateBuildLayerOptions = {
+    awsRegion : string,
+    cluster : string,
+    subnets : Array<string>,
+    appSecurityGroup : string,
+    namespaceId : string,
+    namespaceName : string,
+    appsRepositoryUrl : string,
+    buildBucket : string,
+    buildProject : string,
+    baseImage : string,
+    appExecutionRoleArn : string,
+    appsLogGroup : string,
+    platformUrl : string,
+};
+
+type AwsClients = {
+    s3 : { send(command : any) : Promise<any> },
+    codeBuild : { send(command : any) : Promise<any> },
+    ecs : { send(command : any) : Promise<any> },
+    serviceDiscovery : { send(command : any) : Promise<any> },
+};
+
+const defaultClients = (region : string) : AwsClients => ({
+    s3: new S3Client({ region }),
+    codeBuild: new CodeBuildClient({ region }),
+    ecs: new ECSClient({ region }),
+    serviceDiscovery: new ServiceDiscoveryClient({ region }),
+});
+
+const BUILD_TIMEOUT_MS = 900_000;
+const FARGATE_LIVENESS_TIMEOUT_MS = 180_000;
+
+class FargateBuildLayer extends BaseBuildLayer {
+
+    private aws : AwsClients;
+
+    constructor(appsDir : string, private options : FargateBuildLayerOptions,
+                consumerPortBase? : number,
+                aws? : AwsClients, probe? : Probe,
+                private buildPollIntervalMs : number = 5000) {
+        super(appsDir, consumerPortBase, probe, FARGATE_LIVENESS_TIMEOUT_MS);
+        this.aws = aws ?? defaultClients(options.awsRegion);
+    }
+
+    protected appHostFor(appName : string) : string {
+        return `${appName}.${this.options.namespaceName}`;
+    }
+
+    protected async start(deployment : Deployment, appDir : string, entryPoint : string) : Promise<void> {
+        const imageUri = `${this.options.appsRepositoryUrl}:${deployment.appName}`;
+
+        await writeFile(join(appDir, "Dockerfile"), dockerfileFor(this.options.baseImage, entryPoint));
+        await this.uploadBundle(deployment, appDir);
+        await this.bakeImage(deployment, imageUri);
+
+        if (!this.isCurrent(deployment)) return;
+        const taskDefinition = await this.registerTaskDefinition(deployment, imageUri);
+        const registryArn = await this.discoveryServiceFor(deployment.appName);
+        await this.upsertService(deployment, taskDefinition, registryArn);
+    }
+
+    protected async stop(deployment : Deployment) : Promise<void> {
+        if (this.deployments.get(deployment.appName) !== deployment) return;
+
+        await this.aws.ecs.send(new DeleteServiceCommand({
+            cluster: this.options.cluster,
+            service: this.serviceNameFor(deployment.appName),
+            force: true,
+        })).catch(() => {});
+    }
+
+    private async uploadBundle(deployment : Deployment, appDir : string) : Promise<void> {
+        const bundlePath = join(this.appsDir, `${deployment.appName}-image.tar.gz`);
+        await this.run(deployment, "tar", ["-czf", bundlePath, "-C", appDir, "."]);
+
+        this.log(deployment, "uploading build context");
+        await this.aws.s3.send(new PutObjectCommand({
+            Bucket: this.options.buildBucket,
+            Key: this.buildKeyFor(deployment.appName),
+            Body: await readFile(bundlePath),
+        }));
+    }
+
+    private async bakeImage(deployment : Deployment, imageUri : string) : Promise<void> {
+        this.log(deployment, `baking image ${imageUri} with CodeBuild`);
+        const started = await this.aws.codeBuild.send(new StartBuildCommand({
+            projectName: this.options.buildProject,
+            environmentVariablesOverride: [
+                { name: "TARBALL_S3_URI", value: `s3://${this.options.buildBucket}/${this.buildKeyFor(deployment.appName)}` },
+                { name: "IMAGE_URI", value: imageUri },
+                { name: "REPOSITORY_HOST", value: this.options.appsRepositoryUrl.split("/")[0] },
+            ],
+        }));
+
+        const deadline = Date.now() + BUILD_TIMEOUT_MS;
+        let lastPhase = "";
+        while (Date.now() < deadline) {
+            const {builds} = await this.aws.codeBuild.send(new BatchGetBuildsCommand({ ids: [started.build.id] }));
+            const build = builds[0];
+
+            if (build.currentPhase && build.currentPhase !== lastPhase) {
+                lastPhase = build.currentPhase;
+                this.log(deployment, `build ${lastPhase.toLowerCase()}`);
+            }
+            if (build.buildStatus === "SUCCEEDED") return;
+            if (build.buildStatus !== "IN_PROGRESS") {
+                throw new Error(`CodeBuild build finished with status ${build.buildStatus}`);
+            }
+            await new Promise(resolve => setTimeout(resolve, this.buildPollIntervalMs));
+        }
+
+        throw new Error(`CodeBuild build did not finish within ${BUILD_TIMEOUT_MS / 1000}s`);
+    }
+
+    private async registerTaskDefinition(deployment : Deployment, imageUri : string) : Promise<string> {
+        const registered = await this.aws.ecs.send(new RegisterTaskDefinitionCommand({
+            family: this.serviceNameFor(deployment.appName),
+            requiresCompatibilities: ["FARGATE"],
+            networkMode: "awsvpc",
+            cpu: "256",
+            memory: "512",
+            executionRoleArn: this.options.appExecutionRoleArn,
+            runtimePlatform: { operatingSystemFamily: "LINUX", cpuArchitecture: "X86_64" },
+            containerDefinitions: [{
+                name: deployment.appName,
+                image: imageUri,
+                essential: true,
+                portMappings: [
+                    { containerPort: deployment.appPort, protocol: "tcp" },
+                    { containerPort: deployment.consumerPort, protocol: "tcp" },
+                ],
+                environment: [
+                    { name: "PORT", value: String(deployment.appPort) },
+                    { name: "ANBARIC_CLOUD_URL", value: this.options.platformUrl },
+                    { name: "ANBARIC_JOB_PERSISTENCE_TYPE", value: "cloud" },
+                    { name: "ANBARIC_QUEUE_TYPE", value: "cloud" },
+                    { name: "ANBARIC_JSON_STORE_TYPE", value: "cloud" },
+                    { name: "ANBARIC_SECRET_STORE_TYPE", value: "cloud" },
+                    { name: "ANBARIC_CONSUMER_PORT", value: String(deployment.consumerPort) },
+                    { name: "ANBARIC_CONSUMER_URL", value: `http://${deployment.appHost}:${deployment.consumerPort}` },
+                ],
+                logConfiguration: {
+                    logDriver: "awslogs",
+                    options: {
+                        "awslogs-group": this.options.appsLogGroup,
+                        "awslogs-region": this.options.awsRegion,
+                        "awslogs-stream-prefix": deployment.appName,
+                    },
+                },
+            }],
+        }));
+
+        return registered.taskDefinition.taskDefinitionArn;
+    }
+
+    private async discoveryServiceFor(appName : string) : Promise<string> {
+        const {Services} = await this.aws.serviceDiscovery.send(new ListServicesCommand({
+            Filters: [{ Name: "NAMESPACE_ID", Values: [this.options.namespaceId], Condition: "EQ" }],
+        }));
+        const existing = (Services ?? []).find((service : { Name : string }) => service.Name === appName);
+        if (existing) return existing.Arn;
+
+        const created = await this.aws.serviceDiscovery.send(new CreateDiscoveryServiceCommand({
+            Name: appName,
+            NamespaceId: this.options.namespaceId,
+            DnsConfig: { DnsRecords: [{ Type: "A", TTL: 10 }], RoutingPolicy: "MULTIVALUE" },
+        }));
+        return created.Service.Arn;
+    }
+
+    private async upsertService(deployment : Deployment, taskDefinition : string, registryArn : string) : Promise<void> {
+        const serviceName = this.serviceNameFor(deployment.appName);
+        const {services} = await this.aws.ecs.send(new DescribeServicesCommand({
+            cluster: this.options.cluster,
+            services: [serviceName],
+        }));
+        const active = (services ?? []).find((service : { status : string }) => service.status === "ACTIVE");
+
+        if (active) {
+            this.log(deployment, `rolling service ${serviceName}`);
+            await this.aws.ecs.send(new UpdateServiceCommand({
+                cluster: this.options.cluster,
+                service: serviceName,
+                taskDefinition,
+                desiredCount: 1,
+                forceNewDeployment: true,
+            }));
+            return;
+        }
+
+        this.log(deployment, `creating service ${serviceName}`);
+        await this.aws.ecs.send(new CreateServiceCommand({
+            cluster: this.options.cluster,
+            serviceName,
+            taskDefinition,
+            desiredCount: 1,
+            launchType: "FARGATE",
+            networkConfiguration: {
+                awsvpcConfiguration: {
+                    subnets: this.options.subnets,
+                    securityGroups: [this.options.appSecurityGroup],
+                    assignPublicIp: "ENABLED",
+                },
+            },
+            serviceRegistries: [{ registryArn }],
+        }));
+    }
+
+    private serviceNameFor(appName : string) : string {
+        return `anbaric-app-${appName}`;
+    }
+
+    private buildKeyFor(appName : string) : string {
+        return `builds/${appName}.tar.gz`;
+    }
+
+}
+
+export { FargateBuildLayer };
+export type { AwsClients, FargateBuildLayerOptions };

package/src/auth/Authenticator.ts

@@ -0,0 +1,18 @@
+import {IncomingMessage, ServerResponse} from "node:http";
+import {Tenant} from "./Tenant";
+import {User} from "./User";
+
+const SESSION_COOKIE = "anbaric_session";
+
+abstract class Authenticator {
+
+    abstract authenticate(session : string | undefined, request : IncomingMessage,
+                          response : ServerResponse) : Promise<[User, Tenant] | undefined>;
+
+    async authorize(_user : User, _request : IncomingMessage, _response : ServerResponse) : Promise<boolean> {
+        return true;
+    }
+
+}
+
+export { Authenticator, SESSION_COOKIE }

package/src/auth/AuthenticatorLoader.ts

@@ -0,0 +1,13 @@
+import {Authenticator} from "./Authenticator";
+
+const loadAuthenticator = async (moduleName? : string) : Promise<Authenticator | undefined> => {
+    if (!moduleName) return undefined;
+
+    const module = await import(moduleName);
+    if (typeof module.createAuthenticator !== "function") {
+        throw new Error(`Authenticator module "${moduleName}" does not export a createAuthenticator function`);
+    }
+    return module.createAuthenticator();
+};
+
+export { loadAuthenticator }

package/src/auth/CliAuthorizer.ts

@@ -0,0 +1,54 @@
+import {generateKeyPairSync, randomUUID} from "node:crypto";
+import {CliKey} from "./CliKey";
+import {CliKeyStore} from "./CliKeyStore";
+import {User} from "./User";
+
+type IssuedKeyPair = {
+    keyId : string,
+    clientName : string,
+    publicKey : string,
+    privateKey : string,
+    tenant? : string,
+};
+
+class CliAuthorizer {
+
+    private issued = new Map<string, IssuedKeyPair>();
+
+    constructor(private keyStore : CliKeyStore) {}
+
+    async approve(requestId : string, clientName : string, user : User, tenant? : string) : Promise<void> {
+        const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+        const publicKeyPem = publicKey.export({ type: "spki", format: "pem" }).toString();
+        const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+
+        const key = new CliKey(randomUUID(), user.id, clientName, publicKeyPem);
+        await this.keyStore.save(key);
+
+        this.issued.set(requestId, {
+            keyId: key.id,
+            clientName,
+            publicKey: publicKeyPem,
+            privateKey: privateKeyPem,
+            tenant,
+        });
+    }
+
+    collect(requestId : string) : IssuedKeyPair | undefined {
+        const keyPair = this.issued.get(requestId);
+        this.issued.delete(requestId);
+        return keyPair;
+    }
+
+    keysFor(userId : string) : Promise<Array<CliKey>> {
+        return this.keyStore.listFor(userId);
+    }
+
+    revoke(id : string, userId : string) : Promise<void> {
+        return this.keyStore.delete(id, userId);
+    }
+
+}
+
+export { CliAuthorizer };
+export type { IssuedKeyPair };

package/src/auth/CliKey.ts

@@ -0,0 +1,20 @@
+class CliKey {
+
+    readonly id : string;
+    readonly userId : string;
+    readonly clientName : string;
+    readonly publicKey : string;
+    readonly createdAt : Date;
+
+    constructor(id : string, userId : string, clientName : string, publicKey : string,
+                createdAt : Date = new Date()) {
+        this.id = id;
+        this.userId = userId;
+        this.clientName = clientName;
+        this.publicKey = publicKey;
+        this.createdAt = createdAt;
+    }
+
+}
+
+export { CliKey }

package/src/auth/CliKeyStore.ts

@@ -0,0 +1,12 @@
+import {CliKey} from "./CliKey";
+
+interface CliKeyStore {
+
+    save(key : CliKey) : Promise<void>;
+    find(id : string) : Promise<CliKey | undefined>;
+    listFor(userId : string) : Promise<Array<CliKey>>;
+    delete(id : string, userId : string) : Promise<void>;
+
+}
+
+export { CliKeyStore }