anbaric-cloud-hosting 1.16.4 → 1.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.16.4",
+  "version": "1.18.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,17 +18,17 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.16.4",
-    "anbaric-plugins": "^1.16.4",
-    "anbaric-tsapi": "^1.16.4",
+    "anbaric-data-store": "^1.18.0",
+    "anbaric-plugins": "^1.18.0",
+    "anbaric-tsapi": "^1.18.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.16.4",
-    "anbaric-state-machine": "^1.16.4",
+    "anbaric-impl-cloud": "^1.18.0",
+    "anbaric-state-machine": "^1.18.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/auth/SessionSigner.ts

@@ -0,0 +1,83 @@
+import {createHmac, timingSafeEqual} from "node:crypto";
+import {ServerResponse} from "node:http";
+import {SESSION_COOKIE} from "./Authenticator";
+import {Role} from "./Role";
+import {Tenant} from "./Tenant";
+import {User} from "./User";
+
+const DEFAULT_TTL_SECONDS = 30 * 24 * 60 * 60;
+
+const nowSeconds = () => Math.floor(Date.now() / 1000);
+
+const base64url = (input : Buffer | string) => Buffer.from(input).toString("base64url");
+
+/* A stateless, platform-signed session. Once an identity provider has proved
+   who the user is (once, at login), the browser holds a signed cookie carrying
+   the user, tenant and roles; every later request is authenticated by verifying
+   the signature - no per-request identity-provider round-trip and no session
+   store. The signing secret lives in the environment
+   (ANBARIC_SESSION_SIGNING_SECRET, sourced from a secret manager); with none
+   set the signer is inert and the platform falls back to the authenticator.
+   Sessions slide: a valid one is re-issued with a fresh expiry on each request. */
+class SessionSigner {
+
+    constructor(private secret : string = process.env.ANBARIC_SESSION_SIGNING_SECRET ?? "",
+                private ttlSeconds : number = DEFAULT_TTL_SECONDS) {}
+
+    get configured() : boolean {
+        return this.secret.length > 0;
+    }
+
+    mint(user : User, tenant? : Tenant) : string {
+        const claims = {
+            sub: user.id,
+            tenant: tenant?.id,
+            roles: user.roles.map(role => role.id),
+            exp: nowSeconds() + this.ttlSeconds,
+        };
+        const payload = base64url(JSON.stringify(claims));
+        return `${payload}.${this.sign(payload)}`;
+    }
+
+    verify(token : string | undefined) : [User, Tenant | undefined] | undefined {
+        if (!token || !this.configured) return undefined;
+
+        const [payload, signature] = token.split(".");
+        if (!payload || !signature || !this.signatureMatches(payload, signature)) return undefined;
+
+        let claims : { sub? : unknown, tenant? : unknown, roles? : unknown, exp? : unknown };
+        try {
+            claims = JSON.parse(Buffer.from(payload, "base64url").toString());
+        } catch {
+            return undefined;
+        }
+        if (typeof claims.sub !== "string" || typeof claims.exp !== "number" || claims.exp < nowSeconds()) {
+            return undefined;
+        }
+
+        const roles = Array.isArray(claims.roles) ? claims.roles.map(id => new Role(String(id))) : [];
+        const tenant = typeof claims.tenant === "string" ? new Tenant(claims.tenant) : undefined;
+        return [new User(claims.sub, roles), tenant];
+    }
+
+    // Sets (or, for a still-valid session, refreshes) the session cookie.
+    issue(response : ServerResponse, user : User, tenant? : Tenant) : void {
+        const cookie = `${SESSION_COOKIE}=${this.mint(user, tenant)}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${this.ttlSeconds}`;
+        const existing = response.getHeader("Set-Cookie");
+        if (existing === undefined) response.setHeader("Set-Cookie", cookie);
+        else response.setHeader("Set-Cookie", Array.isArray(existing) ? [...existing, cookie] : [String(existing), cookie]);
+    }
+
+    private sign(payload : string) : string {
+        return createHmac("sha256", this.secret).update(payload).digest("base64url");
+    }
+
+    private signatureMatches(payload : string, signature : string) : boolean {
+        const expected = Buffer.from(this.sign(payload));
+        const actual = Buffer.from(signature);
+        return expected.length === actual.length && timingSafeEqual(expected, actual);
+    }
+
+}
+
+export { SessionSigner }

package/src/hosting/HostingServer.ts

@@ -23,7 +23,6 @@ import {StateMachinesHandler} from "./handlers/StateMachinesHandler";
 import {PluginsHandler} from "./handlers/PluginsHandler";
 import {AuthenticationMiddleware} from "./middleware/AuthenticationMiddleware";
 import {SessionMiddleware} from "./middleware/SessionMiddleware";
-import {PageDirectory} from "../plugins/PageDirectory";
 import {LoadedPlugin} from "../plugins/Plugin";
 import {Request} from "./Request";
 import {Router} from "./Router";
@@ -64,41 +63,34 @@ class HostingServer {
 
         const publicRouter = new Router();
         publicRouter.registerRoot(pages);
-        if (plugins.length > 0) {
-            for (const segment of new PageDirectory(plugins).topLevelSegments) {
-                publicRouter.register(segment, pages);
-            }
-            publicRouter.register("plugins", new PluginsHandler(plugins));
-        }
         publicRouter.register("ping", ping);
-        publicRouter.register("audit", pages);
-        publicRouter.register("whoami", new WhoamiHandler());
-        publicRouter.register("jobs", jobs);
-        publicRouter.register("queue", queueHandler);
-        publicRouter.register("consumers", consumers);
-        publicRouter.register("state-machines", stateMachines);
-        if (documents) publicRouter.register("documents", documents);
-        if (secrets) publicRouter.register("secrets", secrets);
-        if (audits) publicRouter.register("audits", audits);
+        if (plugins.length > 0) publicRouter.registerApi("plugins", new PluginsHandler(plugins));
+        publicRouter.registerApi("whoami", new WhoamiHandler());
+        publicRouter.registerApi("jobs", jobs);
+        publicRouter.registerApi("queue", queueHandler);
+        publicRouter.registerApi("consumers", consumers);
+        publicRouter.registerApi("state-machines", stateMachines);
+        if (documents) publicRouter.registerApi("documents", documents);
+        if (secrets) publicRouter.registerApi("secrets", secrets);
+        if (audits) publicRouter.registerApi("audits", audits);
         if (cliAuthorizer) {
             publicRouter.register("authorize-cli", new AuthorizeCliHandler(cliAuthorizer, pages, tenant));
-            publicRouter.register("keys", new KeysHandler(cliAuthorizer));
-            publicRouter.register("manage-keys", pages);
+            publicRouter.registerApi("keys", new KeysHandler(cliAuthorizer));
         }
         if (buildLayer) {
-            publicRouter.register("apps", new AppsHandler(buildLayer));
-            publicRouter.registerFallback(new AppProxyHandler(buildLayer));
+            publicRouter.registerApi("apps", new AppsHandler(buildLayer));
+            publicRouter.register("app", new AppProxyHandler(buildLayer));
         }
 
         const internalRouter = new Router();
         internalRouter.register("ping", ping);
-        internalRouter.register("jobs", jobs);
-        internalRouter.register("queue", queueHandler);
-        internalRouter.register("consumers", consumers);
-        internalRouter.register("state-machines", stateMachines);
-        if (documents) internalRouter.register("documents", documents);
-        if (secrets) internalRouter.register("secrets", secrets);
-        if (audits) internalRouter.register("audits", audits);
+        internalRouter.registerApi("jobs", jobs);
+        internalRouter.registerApi("queue", queueHandler);
+        internalRouter.registerApi("consumers", consumers);
+        internalRouter.registerApi("state-machines", stateMachines);
+        if (documents) internalRouter.registerApi("documents", documents);
+        if (secrets) internalRouter.registerApi("secrets", secrets);
+        if (audits) internalRouter.registerApi("audits", audits);
 
         const openRequests = (request : Request) =>
             request.url.pathname === "/ping" ||

package/src/hosting/Request.ts

@@ -14,6 +14,8 @@ class Request {
     user? : User;
     tenant? : Tenant;
 
+    readonly api : boolean;
+
     private parsed : URL;
     private segments : Array<string>;
 
@@ -21,7 +23,11 @@ class Request {
                 rayId : string = randomUUID()) {
         this.rayId = rayId;
         this.parsed = new URL(incoming.url ?? "/", "http://localhost");
-        this.segments = this.parsed.pathname.split("/").filter(Boolean);
+        const raw = this.parsed.pathname.split("/").filter(Boolean);
+        // The API lives under /api/v2; strip that prefix so resource/id/subresource
+        // address the resource, and flag it so the router serves API handlers only there.
+        this.api = raw[0] === "api" && raw[1] === "v2";
+        this.segments = this.api ? raw.slice(2) : raw;
     }
 
     get method() : string {

package/src/hosting/Router.ts

@@ -1,17 +1,22 @@
 import {Request} from "./Request";
 import {RequestHandler} from "./RequestHandler";
 
-/* Deliberately hollow: other systems register a handler per top-level
-   resource, one for the root, and one fallback for anything unregistered
-   (the app proxy). All business logic lives in the handlers. */
+/* Deliberately hollow: other systems register API handlers (served only under
+   /api/v2), site handlers (top-level pages/proxies), one root handler, and one
+   fallback. All business logic lives in the handlers. */
 class Router {
 
-    private handlers = new Map<string, RequestHandler>();
+    private apiHandlers = new Map<string, RequestHandler>();
+    private siteHandlers = new Map<string, RequestHandler>();
     private rootHandler? : RequestHandler;
     private fallbackHandler? : RequestHandler;
 
+    registerApi(resource : string, handler : RequestHandler) : void {
+        this.apiHandlers.set(resource, handler);
+    }
+
     register(resource : string, handler : RequestHandler) : void {
-        this.handlers.set(resource, handler);
+        this.siteHandlers.set(resource, handler);
     }
 
     registerRoot(handler : RequestHandler) : void {
@@ -23,12 +28,17 @@ class Router {
     }
 
     async route(request : Request) : Promise<void> {
+        if (request.api) {
+            const handler = request.resource === undefined ? undefined : this.apiHandlers.get(request.resource);
+            return handler ? handler.handle(request) : request.notFound();
+        }
+
         if (request.resource === undefined) {
             if (this.rootHandler) return this.rootHandler.handle(request);
             return request.notFound();
         }
 
-        const handler = this.handlers.get(request.resource);
+        const handler = this.siteHandlers.get(request.resource);
         if (handler) return handler.handle(request);
         if (this.fallbackHandler) return this.fallbackHandler.handle(request);
 

package/src/hosting/handlers/AppProxyHandler.ts

@@ -10,22 +10,24 @@ const HOP_BY_HOP = new Set([
     "te", "trailer", "transfer-encoding", "upgrade",
 ]);
 
-/* The router's fallback: any unregistered top-level path naming a running app
-   is reverse-proxied to it. The app is exposed at /<appName>; that prefix is
-   stripped before forwarding (the app sees the sub-path) and surfaced to the
-   app as X-Forwarded-Prefix so it can rebuild public URLs. Request and response
-   headers pass through both ways - notably cookies, Set-Cookie and Location - so
-   sessions and redirects work from app-served HTML. */
+/* Serves /app/<name>: the named running app is reverse-proxied to. The
+   /app/<name> prefix is stripped before forwarding (the app sees the sub-path)
+   and surfaced as X-Forwarded-Prefix so the app can rebuild public URLs.
+   Request and response headers pass through both ways - notably cookies,
+   Set-Cookie and Location - so sessions and redirects work from app-served
+   HTML. */
 class AppProxyHandler implements RequestHandler {
 
     constructor(private buildLayer : BuildLayer) {}
 
     async handle(request : Request) : Promise<void> {
-        const appName = request.resource!;
+        await this.buildLayer.ensureHydrated();
+        const appName = request.id;
+        if (!appName) return request.notFound();
         const app = this.buildLayer.status(appName);
         if (!app || app.status !== "running") return request.notFound();
 
-        const appPath = request.url.pathname.slice(`/${appName}`.length) || "/";
+        const appPath = request.url.pathname.slice(`/app/${appName}`.length) || "/";
         const body = request.method === "GET" || request.method === "HEAD" ? undefined : await request.rawBody();
 
         await new Promise<void>((resolve, reject) => {
@@ -50,7 +52,7 @@ class AppProxyHandler implements RequestHandler {
     private forwardHeaders(request : Request, appName : string) : OutgoingHttpHeaders {
         const headers = this.passThrough(request.raw.headers);
         delete headers.host;
-        headers["x-forwarded-prefix"] = `/${appName}`;
+        headers["x-forwarded-prefix"] = `/app/${appName}`;
         headers["x-forwarded-host"] = request.raw.headers.host;
         headers["x-forwarded-proto"] = "https";
         return headers;

package/src/hosting/handlers/PluginsHandler.ts

@@ -18,7 +18,7 @@ class PluginsHandler implements RequestHandler {
     private manifest(request : Request) : void {
         request.reply(200, this.plugins.map(({ name, plugin }) => ({
             name,
-            bundle: `/plugins/${name}.js`,
+            bundle: `/api/v2/plugins/${name}.js`,
             pages: plugin.pages,
             widgets: plugin.widgets.map(({ page, id, title, position, data }) =>
                 ({ page, id, title, position, hasData: data !== undefined })),

package/src/hosting/middleware/AuthenticationMiddleware.ts

@@ -1,4 +1,5 @@
 import {Authenticator} from "../../auth/Authenticator";
+import {SessionSigner} from "../../auth/SessionSigner";
 import {TokenAuthenticator} from "../../auth/TokenAuthenticator";
 import {Middleware} from "../Middleware";
 import {Request} from "../Request";
@@ -6,15 +7,18 @@ import {Request} from "../Request";
 type OpenRequestPredicate = (request : Request) => boolean;
 
 /* Decorates the request with its authenticated user and tenant - bearer
-   tokens first, sessions otherwise - and enforces authorization. Requests
-   matching the open predicate (ping, the one-time CLI key poll) pass
-   through untouched, as does everything when no authenticator is
-   configured. */
+   tokens first, then a valid platform session cookie, then the authenticator -
+   and enforces authorization. A valid platform session short-circuits the
+   authenticator entirely (no identity-provider round-trip) and slides its
+   expiry; a fresh authenticator login mints one. Requests matching the open
+   predicate (ping, the one-time CLI key poll) pass through untouched, as does
+   everything when no authenticator is configured. */
 class AuthenticationMiddleware implements Middleware {
 
     constructor(private authenticator? : Authenticator,
                 private tokenAuthenticator? : TokenAuthenticator,
-                private isOpen : OpenRequestPredicate = () => false) {}
+                private isOpen : OpenRequestPredicate = () => false,
+                private sessionSigner : SessionSigner = new SessionSigner()) {}
 
     async apply(request : Request) : Promise<boolean> {
         if (this.isOpen(request)) return true;
@@ -26,12 +30,24 @@ class AuthenticationMiddleware implements Middleware {
             return this.authorized(request);
         }
 
+        if (this.sessionSigner.configured) {
+            const session = this.sessionSigner.verify(request.session);
+            if (session) {
+                [request.user, request.tenant] = session;
+                this.sessionSigner.issue(request.rawResponse, request.user!, request.tenant);
+                return this.authorized(request);
+            }
+        }
+
         if (!this.authenticator) return true;
 
         const authenticated = await this.authenticator.authenticate(request.session, request.raw, request.rawResponse);
         if (!authenticated) return false;
 
         [request.user, request.tenant] = authenticated;
+        if (this.sessionSigner.configured && !request.handled) {
+            this.sessionSigner.issue(request.rawResponse, request.user!, request.tenant);
+        }
         return this.authorized(request);
     }