anbaric-cloud-hosting 1.0.0

package/src/auth/InMemoryCliKeyStore.ts

@@ -0,0 +1,27 @@
+import {CliKey} from "./CliKey";
+import {CliKeyStore} from "./CliKeyStore";
+
+class InMemoryCliKeyStore implements CliKeyStore {
+
+    private keys = new Map<string, CliKey>();
+
+    async save(key : CliKey) : Promise<void> {
+        this.keys.set(key.id, key);
+    }
+
+    async find(id : string) : Promise<CliKey | undefined> {
+        return this.keys.get(id);
+    }
+
+    async listFor(userId : string) : Promise<Array<CliKey>> {
+        return Array.from(this.keys.values()).filter(key => key.userId === userId);
+    }
+
+    async delete(id : string, userId : string) : Promise<void> {
+        const key = this.keys.get(id);
+        if (key && key.userId === userId) this.keys.delete(id);
+    }
+
+}
+
+export { InMemoryCliKeyStore }

package/src/auth/KeyPair.ts

@@ -0,0 +1,13 @@
+class KeyPair {
+
+    readonly id : string;
+    readonly publicKey : string;
+
+    constructor(id : string, publicKey : string) {
+        this.id = id;
+        this.publicKey = publicKey;
+    }
+
+}
+
+export { KeyPair }

package/src/auth/Role.ts

@@ -0,0 +1,11 @@
+class Role {
+
+    readonly id : string;
+
+    constructor(id : string) {
+        this.id = id;
+    }
+
+}
+
+export { Role }

package/src/auth/Tenant.ts

@@ -0,0 +1,11 @@
+class Tenant {
+
+    readonly id : string;
+
+    constructor(id : string) {
+        this.id = id;
+    }
+
+}
+
+export { Tenant }

package/src/auth/TokenAuthenticator.ts

@@ -0,0 +1,62 @@
+import {createPublicKey, verify} from "node:crypto";
+import {IncomingMessage, ServerResponse} from "node:http";
+import {CliKeyStore} from "./CliKeyStore";
+import {User} from "./User";
+
+const BEARER_PREFIX = "Bearer ";
+
+class TokenAuthenticator {
+
+    constructor(private keyStore : CliKeyStore) {}
+
+    handles(request : IncomingMessage) : boolean {
+        return String(request.headers.authorization ?? "").startsWith(BEARER_PREFIX);
+    }
+
+    async authenticate(request : IncomingMessage, response : ServerResponse) : Promise<User | undefined> {
+        const token = String(request.headers.authorization).slice(BEARER_PREFIX.length);
+        const user = await this.verifiedUser(token);
+        if (!user) {
+            response.writeHead(401, { "content-type": "application/json" });
+            response.end(JSON.stringify({ error: "Invalid or expired token - run `anbaric login` to authorize this terminal" }));
+        }
+        return user;
+    }
+
+    private async verifiedUser(token : string) : Promise<User | undefined> {
+        const [headerPart, payloadPart, signaturePart] = token.split(".");
+        if (!headerPart || !payloadPart || !signaturePart) return undefined;
+
+        const header = this.decoded(headerPart);
+        const payload = this.decoded(payloadPart);
+        if (header?.alg !== "EdDSA" || typeof header?.kid !== "string") return undefined;
+        if (typeof payload?.exp !== "number" || payload.exp * 1000 < Date.now()) return undefined;
+
+        const key = await this.keyStore.find(header.kid);
+        if (!key) return undefined;
+        if (!this.signatureValid(headerPart, payloadPart, signaturePart, key.publicKey)) return undefined;
+
+        return new User(key.userId);
+    }
+
+    private signatureValid(headerPart : string, payloadPart : string, signaturePart : string,
+                           publicKeyPem : string) : boolean {
+        try {
+            return verify(null, Buffer.from(`${headerPart}.${payloadPart}`),
+                createPublicKey(publicKeyPem), Buffer.from(signaturePart, "base64url"));
+        } catch {
+            return false;
+        }
+    }
+
+    private decoded(part : string) : any {
+        try {
+            return JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+        } catch {
+            return undefined;
+        }
+    }
+
+}
+
+export { TokenAuthenticator }

package/src/auth/User.ts

@@ -0,0 +1,22 @@
+import {KeyPair} from "./KeyPair";
+import {Role} from "./Role";
+
+class User {
+
+    readonly id : string;
+    roles : Array<Role>;
+    keyPairs : Array<KeyPair>;
+
+    constructor(id : string, roles : Array<Role> = [], keyPairs : Array<KeyPair> = []) {
+        this.id = id;
+        this.roles = roles;
+        this.keyPairs = keyPairs;
+    }
+
+    hasRole(role : Role) : boolean {
+        return this.roles.some(existing => existing.id === role.id);
+    }
+
+}
+
+export { User }

package/src/data-store/PostgresCliKeyStore.ts

@@ -0,0 +1,44 @@
+import {Pool} from "pg";
+import {CliKey} from "../auth/CliKey";
+import {CliKeyStore} from "../auth/CliKeyStore";
+
+class PostgresCliKeyStore implements CliKeyStore {
+
+    constructor(private pool : Pool) {}
+
+    async save(key : CliKey) : Promise<void> {
+        await this.pool.query(
+            "INSERT INTO anbaric_system.cli_keys (id, user_id, client_name, public_key) VALUES ($1, $2, $3, $4)",
+            [key.id, key.userId, key.clientName, key.publicKey],
+        );
+    }
+
+    async find(id : string) : Promise<CliKey | undefined> {
+        const result = await this.pool.query(
+            "SELECT id, user_id, client_name, public_key, created_at FROM anbaric_system.cli_keys WHERE id = $1",
+            [id],
+        );
+        const row = result.rows[0];
+        return row && new CliKey(row.id, row.user_id, row.client_name, row.public_key, row.created_at);
+    }
+
+    async listFor(userId : string) : Promise<Array<CliKey>> {
+        const result = await this.pool.query(
+            "SELECT id, user_id, client_name, public_key, created_at FROM anbaric_system.cli_keys WHERE user_id = $1 ORDER BY created_at",
+            [userId],
+        );
+
+        return result.rows.map(row =>
+            new CliKey(row.id, row.user_id, row.client_name, row.public_key, row.created_at));
+    }
+
+    async delete(id : string, userId : string) : Promise<void> {
+        await this.pool.query(
+            "DELETE FROM anbaric_system.cli_keys WHERE id = $1 AND user_id = $2",
+            [id, userId],
+        );
+    }
+
+}
+
+export { PostgresCliKeyStore }

package/src/data-store/PostgresJobPersistence.ts

@@ -0,0 +1,77 @@
+import {Job, JobPersistence, JobTransition, deserializeJob} from "anbaric-tsapi";
+import {Pool} from "pg";
+
+type JobRow = {
+    id : string,
+    state : string,
+    properties : Record<string, any>,
+    workflow_id? : string,
+    started_at : Date,
+    started_by : string,
+    last_updated : Date,
+    transitions : Array<JobTransition>,
+};
+
+const JOB_COLUMNS = "id, state, properties, workflow_id, started_at, started_by, last_updated, transitions";
+
+class PostgresJobPersistence implements JobPersistence {
+
+    constructor(private pool : Pool) {}
+
+    async save(job : Job) : Promise<void> {
+        await this.pool.query(
+            `INSERT INTO jobs (id, state, properties, workflow_id, started_at, started_by, last_updated, transitions)
+             VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+             ON CONFLICT (id) DO UPDATE SET state = EXCLUDED.state, properties = EXCLUDED.properties,
+                 workflow_id = EXCLUDED.workflow_id, last_updated = EXCLUDED.last_updated,
+                 transitions = EXCLUDED.transitions`,
+            [job.id, job.stateId, Object.fromEntries(job.properties), job.workflowId,
+                job.startedAt, job.startedBy, job.lastUpdated, JSON.stringify(job.transitions)],
+        );
+    }
+
+    async retrieve(id : string) : Promise<Job> {
+        const result = await this.pool.query(
+            `SELECT ${JOB_COLUMNS} FROM jobs WHERE id = $1`,
+            [id],
+        );
+        if (result.rowCount === 0) throw new Error(`No job found with id "${id}"`);
+
+        return this.deserializeRow(result.rows[0]);
+    }
+
+    async delete(id : string) : Promise<void> {
+        await this.pool.query("DELETE FROM jobs WHERE id = $1", [id]);
+    }
+
+    async list(pageSize : number = 100, page : number = 0) : Promise<Array<Job>> {
+        const result = await this.pool.query(
+            `SELECT ${JOB_COLUMNS} FROM jobs ORDER BY inserted_at LIMIT $1 OFFSET $2`,
+            [pageSize, page * pageSize],
+        );
+
+        return result.rows.map(row => this.deserializeRow(row));
+    }
+
+    private deserializeRow(row : JobRow) : Job {
+        return deserializeJob({
+            ...row,
+            workflowId: row.workflow_id ?? undefined,
+            startedAt: row.started_at.toISOString(),
+            startedBy: row.started_by,
+            lastUpdated: row.last_updated.toISOString(),
+            transitions: row.transitions,
+        });
+    }
+
+    async updateProperties(id : string, properties : Map<string, any>) : Promise<void> {
+        const result = await this.pool.query(
+            "UPDATE jobs SET properties = properties || $2::jsonb, last_updated = now() WHERE id = $1",
+            [id, Object.fromEntries(properties)],
+        );
+        if (result.rowCount === 0) throw new Error(`No job found with id "${id}"`);
+    }
+
+}
+
+export { PostgresJobPersistence }

package/src/data-store/PostgresJsonStore.ts

@@ -0,0 +1,41 @@
+import {JsonStore} from "anbaric-tsapi";
+import {Pool} from "pg";
+
+class PostgresJsonStore implements JsonStore {
+
+    constructor(private pool : Pool, private collection : string) {}
+
+    async save(id : string, document : any) : Promise<void> {
+        await this.pool.query(
+            `INSERT INTO documents (collection, id, document) VALUES ($1, $2, $3)
+             ON CONFLICT (collection, id) DO UPDATE SET document = EXCLUDED.document`,
+            [this.collection, id, document],
+        );
+    }
+
+    async retrieve(id : string) : Promise<any> {
+        const result = await this.pool.query(
+            "SELECT document FROM documents WHERE collection = $1 AND id = $2",
+            [this.collection, id],
+        );
+        if (result.rowCount === 0) throw new Error(`No document found with id "${id}"`);
+
+        return result.rows[0].document;
+    }
+
+    async delete(id : string) : Promise<void> {
+        await this.pool.query("DELETE FROM documents WHERE collection = $1 AND id = $2", [this.collection, id]);
+    }
+
+    async list(pageSize : number = 100, page : number = 0) : Promise<Array<any>> {
+        const result = await this.pool.query(
+            "SELECT document FROM documents WHERE collection = $1 ORDER BY inserted_at LIMIT $2 OFFSET $3",
+            [this.collection, pageSize, page * pageSize],
+        );
+
+        return result.rows.map(row => row.document);
+    }
+
+}
+
+export { PostgresJsonStore }

package/src/data-store/Schema.ts

@@ -0,0 +1,55 @@
+import {Pool} from "pg";
+
+/* Workflow data (jobs, queue, documents) lives in the default public schema;
+   platform system tables are encapsulated in the anbaric_system schema so the
+   two never mix. */
+const ensureSchema = async (pool : Pool) : Promise<void> => {
+    await pool.query(`
+        CREATE TABLE IF NOT EXISTS jobs (
+            id           TEXT PRIMARY KEY,
+            state        TEXT NOT NULL,
+            properties   JSONB NOT NULL DEFAULT '{}',
+            workflow_id  TEXT,
+            started_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
+            started_by   TEXT NOT NULL DEFAULT 'system',
+            last_updated TIMESTAMPTZ NOT NULL DEFAULT now(),
+            transitions  JSONB NOT NULL DEFAULT '[]',
+            inserted_at  BIGINT GENERATED ALWAYS AS IDENTITY
+        )
+    `);
+    await pool.query("ALTER TABLE jobs ADD COLUMN IF NOT EXISTS workflow_id TEXT");
+    await pool.query("ALTER TABLE jobs ADD COLUMN IF NOT EXISTS started_at TIMESTAMPTZ NOT NULL DEFAULT now()");
+    await pool.query("ALTER TABLE jobs ADD COLUMN IF NOT EXISTS started_by TEXT NOT NULL DEFAULT 'system'");
+    await pool.query("ALTER TABLE jobs ADD COLUMN IF NOT EXISTS last_updated TIMESTAMPTZ NOT NULL DEFAULT now()");
+    await pool.query("ALTER TABLE jobs ADD COLUMN IF NOT EXISTS transitions JSONB NOT NULL DEFAULT '[]'");
+    await pool.query(`
+        CREATE TABLE IF NOT EXISTS documents (
+            collection  TEXT NOT NULL,
+            id          TEXT NOT NULL,
+            document    JSONB NOT NULL,
+            inserted_at BIGINT GENERATED ALWAYS AS IDENTITY,
+            PRIMARY KEY (collection, id)
+        )
+    `);
+    await pool.query(`
+        CREATE TABLE IF NOT EXISTS queue (
+            position     BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+            job_id       TEXT NOT NULL,
+            workflow_id  TEXT NOT NULL,
+            due          TIMESTAMPTZ,
+            leased_until TIMESTAMPTZ
+        )
+    `);
+    await pool.query("CREATE SCHEMA IF NOT EXISTS anbaric_system");
+    await pool.query(`
+        CREATE TABLE IF NOT EXISTS anbaric_system.cli_keys (
+            id          TEXT PRIMARY KEY,
+            user_id     TEXT NOT NULL,
+            client_name TEXT NOT NULL,
+            public_key  TEXT NOT NULL,
+            created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+        )
+    `);
+};
+
+export { ensureSchema }

package/src/data-store/SecretsManagerSecretStore.ts

@@ -0,0 +1,57 @@
+import {
+    CreateSecretCommand,
+    DeleteSecretCommand,
+    GetSecretValueCommand,
+    ListSecretsCommand,
+    PutSecretValueCommand,
+    ResourceExistsException,
+    ResourceNotFoundException,
+    SecretsManagerClient,
+} from "@aws-sdk/client-secrets-manager";
+import {SecretStore} from "anbaric-tsapi";
+
+class SecretsManagerSecretStore implements SecretStore {
+
+    constructor(private client : SecretsManagerClient, private prefix : string = "anbaric/") {}
+
+    async save(name : string, value : string) : Promise<void> {
+        try {
+            await this.client.send(new CreateSecretCommand({ Name: this.prefix + name, SecretString: value }));
+        } catch (error) {
+            if (!(error instanceof ResourceExistsException)) throw error;
+            await this.client.send(new PutSecretValueCommand({ SecretId: this.prefix + name, SecretString: value }));
+        }
+    }
+
+    async retrieve(name : string) : Promise<string> {
+        try {
+            const secret = await this.client.send(new GetSecretValueCommand({ SecretId: this.prefix + name }));
+            return secret.SecretString ?? "";
+        } catch (error) {
+            if (error instanceof ResourceNotFoundException) throw new Error(`No secret found with name "${name}"`);
+            throw error;
+        }
+    }
+
+    async delete(name : string) : Promise<void> {
+        try {
+            await this.client.send(new DeleteSecretCommand({ SecretId: this.prefix + name, ForceDeleteWithoutRecovery: true }));
+        } catch (error) {
+            if (!(error instanceof ResourceNotFoundException)) throw error;
+        }
+    }
+
+    async list() : Promise<Array<string>> {
+        const result = await this.client.send(new ListSecretsCommand({
+            Filters: [{ Key: "name", Values: [this.prefix] }],
+        }));
+
+        return (result.SecretList ?? [])
+            .map(secret => secret.Name ?? "")
+            .filter(name => name.startsWith(this.prefix))
+            .map(name => name.slice(this.prefix.length));
+    }
+
+}
+
+export { SecretsManagerSecretStore }

package/src/hosting/HostingServer.ts

@@ -0,0 +1,130 @@
+import {createServer, IncomingMessage, Server, ServerResponse} from "node:http";
+import {AddressInfo} from "node:net";
+import {JobPersistence, JsonStore, SecretStore} from "anbaric-tsapi";
+import {BuildLayer} from "../app-management/BuildLayer";
+import {Authenticator, SESSION_COOKIE} from "../auth/Authenticator";
+import {CliAuthorizer} from "../auth/CliAuthorizer";
+import {Tenant} from "../auth/Tenant";
+import {TokenAuthenticator} from "../auth/TokenAuthenticator";
+import {User} from "../auth/User";
+import {ConfirmableQueue} from "../queuing/ConfirmableQueue";
+import {ConsumerRegistry} from "../queuing/ConsumerRegistry";
+import {Router} from "./Router";
+
+const INTERNAL_RESOURCES = new Set(["jobs", "queue", "consumers", "state-machines", "documents", "secrets"]);
+
+class HostingServer {
+
+    private server : Server;
+    private internalServer : Server;
+    private router : Router;
+
+    constructor(persistence : JobPersistence, queue : ConfirmableQueue,
+                registry : ConsumerRegistry = new ConsumerRegistry(),
+                buildLayer? : BuildLayer,
+                documentStoreFor? : (collection : string) => JsonStore,
+                secretStore? : SecretStore,
+                private authenticator? : Authenticator,
+                cliAuthorizer? : CliAuthorizer,
+                private tokenAuthenticator? : TokenAuthenticator,
+                tenant? : string) {
+        this.router = new Router(persistence, queue, registry, buildLayer, documentStoreFor, secretStore, cliAuthorizer, tenant);
+        this.server = this.serverFor((request, response) => this.handle(request, response));
+        this.internalServer = this.serverFor((request, response) => this.handleInternal(request, response));
+    }
+
+    listen(port : number) : Promise<number> {
+        return new Promise(resolve =>
+            this.server.listen(port, () => resolve((this.server.address() as AddressInfo).port)));
+    }
+
+    listenInternal(port : number) : Promise<number> {
+        return new Promise(resolve =>
+            this.internalServer.listen(port, () => resolve((this.internalServer.address() as AddressInfo).port)));
+    }
+
+    close() : Promise<void> {
+        return new Promise((resolve, reject) => {
+            if (this.internalServer.listening) this.internalServer.close();
+            this.server.close(error => error ? reject(error) : resolve());
+        });
+    }
+
+    private serverFor(handle : (request : IncomingMessage, response : ServerResponse) => Promise<void>) : Server {
+        return createServer((request, response) => {
+            handle(request, response).catch(error => {
+                const message = error instanceof Error ? error.message : "Internal error";
+                const status = /^No .+ found/.test(message) ? 404 : 500;
+                this.reply(response, status, { error: message });
+            });
+        });
+    }
+
+    private async handle(request : IncomingMessage, response : ServerResponse) : Promise<void> {
+        const path = request.url?.split("?")[0] ?? "/";
+        if (path === "/ping" && request.method === "GET") {
+            return this.reply(response, 200, { status: "ok" });
+        }
+        if (/^\/authorize-cli\/[^/]+\/poll$/.test(path) && request.method === "GET") {
+            return this.router.route(request, response);
+        }
+
+        if (this.tokenAuthenticator?.handles(request)) {
+            const user = await this.tokenAuthenticator.authenticate(request, response);
+            if (!user) return;
+            return this.authorizeAndRoute(user, undefined, request, response);
+        }
+
+        const authenticated = await this.authenticateSession(request, response);
+        if (this.authenticator && !authenticated) return;
+        if (authenticated) return this.authorizeAndRoute(authenticated[0], authenticated[1], request, response);
+
+        await this.router.route(request, response);
+    }
+
+    private async handleInternal(request : IncomingMessage, response : ServerResponse) : Promise<void> {
+        const path = request.url?.split("?")[0] ?? "/";
+        if (path === "/ping" && request.method === "GET") {
+            return this.reply(response, 200, { status: "ok" });
+        }
+        const [resource] = path.split("/").filter(Boolean);
+        if (!resource || !INTERNAL_RESOURCES.has(resource)) {
+            return this.reply(response, 404, { error: "Not found" });
+        }
+        await this.router.route(request, response);
+    }
+
+    private async authorizeAndRoute(user : User, tenant : Tenant | undefined,
+                                    request : IncomingMessage, response : ServerResponse) : Promise<void> {
+        if (this.authenticator) {
+            const permitted = await this.authenticator.authorize(user, request, response);
+            if (!permitted) {
+                if (!response.writableEnded) this.reply(response, 403, { error: "Not authorized" });
+                return;
+            }
+        }
+        await this.router.route(request, response, user, tenant);
+    }
+
+    private async authenticateSession(request : IncomingMessage, response : ServerResponse) : Promise<[User, Tenant] | undefined> {
+        if (!this.authenticator) return undefined;
+        return this.authenticator.authenticate(this.sessionCookie(request), request, response);
+    }
+
+    private sessionCookie(request : IncomingMessage) : string | undefined {
+        const cookies = String(request.headers.cookie ?? "").split(";");
+        for (const cookie of cookies) {
+            const [name, ...value] = cookie.trim().split("=");
+            if (name === SESSION_COOKIE) return value.join("=");
+        }
+        return undefined;
+    }
+
+    private reply(response : ServerResponse, status : number, body : unknown) : void {
+        response.writeHead(status, { "content-type": "application/json" });
+        response.end(JSON.stringify(body));
+    }
+
+}
+
+export { HostingServer }