anbaric-cloud-hosting 1.1.1 → 1.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.1.1",
+  "version": "1.2.1",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -17,15 +17,15 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.1.1",
-    "anbaric-tsapi": "^1.1.1",
+    "anbaric-data-store": "^1.2.1",
+    "anbaric-tsapi": "^1.2.1",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-cloud": "^1.1.1",
-    "anbaric-state-machine": "^1.1.1",
+    "anbaric-cloud": "^1.2.1",
+    "anbaric-state-machine": "^1.2.1",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/auth/AuthenticatorLoader.ts

@@ -1,7 +1,9 @@
 import {Authenticator} from "./Authenticator";
+import {StubAuthenticator} from "./StubAuthenticator";
 
 const loadAuthenticator = async (moduleName? : string) : Promise<Authenticator | undefined> => {
     if (!moduleName) return undefined;
+    if (moduleName === "stub") return new StubAuthenticator();
 
     const module = await import(moduleName);
     if (typeof module.createAuthenticator !== "function") {

package/src/auth/CliAuthorizer.ts

@@ -22,7 +22,7 @@ class CliAuthorizer {
         const publicKeyPem = publicKey.export({ type: "spki", format: "pem" }).toString();
         const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
 
-        const key = new CliKey(randomUUID(), user.id, clientName, publicKeyPem);
+        const key = new CliKey(randomUUID(), user.id, clientName, publicKeyPem, tenant);
         await this.keyStore.save(key);
 
         this.issued.set(requestId, {

package/src/auth/CliKey.ts

@@ -4,14 +4,16 @@ class CliKey {
     readonly userId : string;
     readonly clientName : string;
     readonly publicKey : string;
+    readonly tenant? : string;
     readonly createdAt : Date;
 
     constructor(id : string, userId : string, clientName : string, publicKey : string,
-                createdAt : Date = new Date()) {
+                tenant? : string, createdAt : Date = new Date()) {
         this.id = id;
         this.userId = userId;
         this.clientName = clientName;
         this.publicKey = publicKey;
+        this.tenant = tenant;
         this.createdAt = createdAt;
     }
 

package/src/auth/HttpCliKeyStore.ts

@@ -0,0 +1,53 @@
+import {CliKey} from "./CliKey";
+import {CliKeyStore} from "./CliKeyStore";
+
+type FetchFn = (url : string, init : RequestInit) => Promise<Response>;
+
+const CACHE_TTL_MS = 60_000;
+
+/* Looks CLI keys up from a central key registry over HTTP - used when a
+   platform's keys are issued elsewhere (Anbaric Cloud's central login).
+   Read-only: key issuance, listing and revocation live with the registry. */
+class HttpCliKeyStore implements CliKeyStore {
+
+    private cache = new Map<string, { key : CliKey | undefined, expires : number }>();
+
+    constructor(private lookupUrl : string, private secret : string,
+                private fetchFn : FetchFn = (url, init) => fetch(url, init),
+                private cacheTtlMs : number = CACHE_TTL_MS) {}
+
+    async find(id : string) : Promise<CliKey | undefined> {
+        const cached = this.cache.get(id);
+        if (cached && cached.expires > Date.now()) return cached.key;
+
+        const key = await this.lookup(id);
+        this.cache.set(id, { key, expires: Date.now() + this.cacheTtlMs });
+        return key;
+    }
+
+    async save(_key : CliKey) : Promise<void> {
+        throw new Error("Keys are issued by the central registry, not by this platform");
+    }
+
+    async listFor(_userId : string) : Promise<Array<CliKey>> {
+        return [];
+    }
+
+    async delete(_id : string, _userId : string) : Promise<void> {
+        throw new Error("Keys are revoked at the central registry, not by this platform");
+    }
+
+    private async lookup(id : string) : Promise<CliKey | undefined> {
+        const response = await this.fetchFn(`${this.lookupUrl}/cli-keys/${encodeURIComponent(id)}`, {
+            headers: { "x-anbaric-central-key": this.secret },
+        });
+        if (response.status === 404) return undefined;
+        if (!response.ok) throw new Error(`The key lookup failed with status ${response.status}`);
+
+        const found = await response.json();
+        return new CliKey(id, found.userId, found.clientName ?? "", found.publicKey, found.tenant ?? undefined);
+    }
+
+}
+
+export { HttpCliKeyStore }

package/src/auth/StubAuthenticator.ts

@@ -0,0 +1,24 @@
+import {IncomingMessage, ServerResponse} from "node:http";
+import {Authenticator} from "./Authenticator";
+import {Tenant} from "./Tenant";
+import {User} from "./User";
+
+/* A development authenticator: every request is authenticated as a fixed
+   user without any credential check, so the auth-dependent surface (whoami,
+   keys, the dashboard) can be exercised with no identity provider. Never use
+   it on a platform reachable by anyone you would not trust as that user. */
+class StubAuthenticator extends Authenticator {
+
+    constructor(private userId : string = process.env.ANBARIC_STUB_USER ?? "local-admin",
+                private tenantId : string = process.env.ANBARIC_TENANT ?? "local") {
+        super();
+    }
+
+    async authenticate(_session : string | undefined, _request : IncomingMessage,
+                       _response : ServerResponse) : Promise<[User, Tenant] | undefined> {
+        return [new User(this.userId), new Tenant(this.tenantId)];
+    }
+
+}
+
+export { StubAuthenticator }

package/src/auth/TokenAuthenticator.ts

@@ -7,7 +7,7 @@ const BEARER_PREFIX = "Bearer ";
 
 class TokenAuthenticator {
 
-    constructor(private keyStore : CliKeyStore) {}
+    constructor(private keyStore : CliKeyStore, private tenant? : string) {}
 
     handles(request : IncomingMessage) : boolean {
         return String(request.headers.authorization ?? "").startsWith(BEARER_PREFIX);
@@ -34,6 +34,7 @@ class TokenAuthenticator {
 
         const key = await this.keyStore.find(header.kid);
         if (!key) return undefined;
+        if (this.tenant && key.tenant && key.tenant !== this.tenant) return undefined;
         if (!this.signatureValid(headerPart, payloadPart, signaturePart, key.publicKey)) return undefined;
 
         return new User(key.userId);

package/src/data-store/PostgresCliKeyStore.ts

@@ -8,28 +8,28 @@ class PostgresCliKeyStore implements CliKeyStore {
 
     async save(key : CliKey) : Promise<void> {
         await this.pool.query(
-            "INSERT INTO anbaric_system.cli_keys (id, user_id, client_name, public_key) VALUES ($1, $2, $3, $4)",
-            [key.id, key.userId, key.clientName, key.publicKey],
+            "INSERT INTO anbaric_system.cli_keys (id, user_id, client_name, public_key, tenant) VALUES ($1, $2, $3, $4, $5)",
+            [key.id, key.userId, key.clientName, key.publicKey, key.tenant ?? null],
         );
     }
 
     async find(id : string) : Promise<CliKey | undefined> {
         const result = await this.pool.query(
-            "SELECT id, user_id, client_name, public_key, created_at FROM anbaric_system.cli_keys WHERE id = $1",
+            "SELECT id, user_id, client_name, public_key, tenant, created_at FROM anbaric_system.cli_keys WHERE id = $1",
             [id],
         );
         const row = result.rows[0];
-        return row && new CliKey(row.id, row.user_id, row.client_name, row.public_key, row.created_at);
+        return row && new CliKey(row.id, row.user_id, row.client_name, row.public_key, row.tenant ?? undefined, row.created_at);
     }
 
     async listFor(userId : string) : Promise<Array<CliKey>> {
         const result = await this.pool.query(
-            "SELECT id, user_id, client_name, public_key, created_at FROM anbaric_system.cli_keys WHERE user_id = $1 ORDER BY created_at",
+            "SELECT id, user_id, client_name, public_key, tenant, created_at FROM anbaric_system.cli_keys WHERE user_id = $1 ORDER BY created_at",
             [userId],
         );
 
         return result.rows.map(row =>
-            new CliKey(row.id, row.user_id, row.client_name, row.public_key, row.created_at));
+            new CliKey(row.id, row.user_id, row.client_name, row.public_key, row.tenant ?? undefined, row.created_at));
     }
 
     async delete(id : string, userId : string) : Promise<void> {

package/src/data-store/Schema.ts

@@ -47,9 +47,11 @@ const ensureSchema = async (pool : Pool) : Promise<void> => {
             user_id     TEXT NOT NULL,
             client_name TEXT NOT NULL,
             public_key  TEXT NOT NULL,
+            tenant      TEXT,
             created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
         )
     `);
+    await pool.query("ALTER TABLE anbaric_system.cli_keys ADD COLUMN IF NOT EXISTS tenant TEXT");
 };
 
 export { ensureSchema }

package/src/hosting/HostingServer.ts

@@ -27,7 +27,7 @@ class HostingServer {
                 private authenticator? : Authenticator,
                 cliAuthorizer? : CliAuthorizer,
                 private tokenAuthenticator? : TokenAuthenticator,
-                tenant? : string) {
+                private tenant? : string) {
         this.router = new Router(persistence, queue, registry, buildLayer, documentStoreFor, secretStore, cliAuthorizer, tenant);
         this.server = this.serverFor((request, response) => this.handle(request, response));
         this.internalServer = this.serverFor((request, response) => this.handleInternal(request, response));
@@ -63,7 +63,7 @@ class HostingServer {
     private async handle(request : IncomingMessage, response : ServerResponse) : Promise<void> {
         const path = request.url?.split("?")[0] ?? "/";
         if (path === "/ping" && request.method === "GET") {
-            return this.reply(response, 200, { status: "ok" });
+            return this.reply(response, 200, this.tenant ? { status: "ok", tenant: this.tenant } : { status: "ok" });
         }
         if (/^\/authorize-cli\/[^/]+\/poll$/.test(path) && request.method === "GET") {
             return this.router.route(request, response);
@@ -85,7 +85,7 @@ class HostingServer {
     private async handleInternal(request : IncomingMessage, response : ServerResponse) : Promise<void> {
         const path = request.url?.split("?")[0] ?? "/";
         if (path === "/ping" && request.method === "GET") {
-            return this.reply(response, 200, { status: "ok" });
+            return this.reply(response, 200, this.tenant ? { status: "ok", tenant: this.tenant } : { status: "ok" });
         }
         const [resource] = path.split("/").filter(Boolean);
         if (!resource || !INTERNAL_RESOURCES.has(resource)) {

package/src/index.ts

@@ -3,10 +3,12 @@ export * from "./auth/Authenticator";
 export * from "./auth/CliAuthorizer";
 export * from "./auth/CliKey";
 export * from "./auth/CliKeyStore";
+export * from "./auth/HttpCliKeyStore";
 export * from "./auth/InMemoryCliKeyStore";
 export * from "./auth/AuthenticatorLoader";
 export * from "./auth/KeyPair";
 export * from "./auth/Role";
+export * from "./auth/StubAuthenticator";
 export * from "./auth/Tenant";
 export * from "./auth/TokenAuthenticator";
 export * from "./auth/User";

package/src/main.ts

@@ -4,6 +4,7 @@ import {InMemorySecretStore} from "anbaric-data-store";
 import {Pool} from "pg";
 import {loadAuthenticator} from "./auth/AuthenticatorLoader";
 import {CliAuthorizer} from "./auth/CliAuthorizer";
+import {HttpCliKeyStore} from "./auth/HttpCliKeyStore";
 import {TokenAuthenticator} from "./auth/TokenAuthenticator";
 import {PostgresCliKeyStore} from "./data-store/PostgresCliKeyStore";
 import {ensureSchema} from "./data-store/Schema";
@@ -56,9 +57,11 @@ const secretStore : SecretStore = process.env.AWS_REGION
     : new InMemorySecretStore();
 
 const authenticator = await loadAuthenticator(process.env.ANBARIC_AUTHENTICATOR);
-const cliKeyStore = new PostgresCliKeyStore(pool);
+const cliKeyStore = process.env.ANBARIC_CLI_KEY_LOOKUP_URL
+    ? new HttpCliKeyStore(process.env.ANBARIC_CLI_KEY_LOOKUP_URL, process.env.ANBARIC_CLI_KEY_LOOKUP_SECRET ?? "")
+    : new PostgresCliKeyStore(pool);
 const cliAuthorizer = new CliAuthorizer(cliKeyStore);
-const tokenAuthenticator = new TokenAuthenticator(cliKeyStore);
+const tokenAuthenticator = new TokenAuthenticator(cliKeyStore, process.env.ANBARIC_TENANT);
 
 const server = new HostingServer(new PostgresJobPersistence(pool), queue, registry, buildLayer,
     (collection) => new PostgresJsonStore(pool, collection), secretStore, authenticator, cliAuthorizer,