anbaric-cloud-hosting 1.17.0 → 1.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.17.0",
+  "version": "1.18.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,17 +18,17 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.17.0",
-    "anbaric-plugins": "^1.17.0",
-    "anbaric-tsapi": "^1.17.0",
+    "anbaric-data-store": "^1.18.0",
+    "anbaric-plugins": "^1.18.0",
+    "anbaric-tsapi": "^1.18.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.17.0",
-    "anbaric-state-machine": "^1.17.0",
+    "anbaric-impl-cloud": "^1.18.0",
+    "anbaric-state-machine": "^1.18.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/auth/SessionSigner.ts

@@ -0,0 +1,83 @@
+import {createHmac, timingSafeEqual} from "node:crypto";
+import {ServerResponse} from "node:http";
+import {SESSION_COOKIE} from "./Authenticator";
+import {Role} from "./Role";
+import {Tenant} from "./Tenant";
+import {User} from "./User";
+
+const DEFAULT_TTL_SECONDS = 30 * 24 * 60 * 60;
+
+const nowSeconds = () => Math.floor(Date.now() / 1000);
+
+const base64url = (input : Buffer | string) => Buffer.from(input).toString("base64url");
+
+/* A stateless, platform-signed session. Once an identity provider has proved
+   who the user is (once, at login), the browser holds a signed cookie carrying
+   the user, tenant and roles; every later request is authenticated by verifying
+   the signature - no per-request identity-provider round-trip and no session
+   store. The signing secret lives in the environment
+   (ANBARIC_SESSION_SIGNING_SECRET, sourced from a secret manager); with none
+   set the signer is inert and the platform falls back to the authenticator.
+   Sessions slide: a valid one is re-issued with a fresh expiry on each request. */
+class SessionSigner {
+
+    constructor(private secret : string = process.env.ANBARIC_SESSION_SIGNING_SECRET ?? "",
+                private ttlSeconds : number = DEFAULT_TTL_SECONDS) {}
+
+    get configured() : boolean {
+        return this.secret.length > 0;
+    }
+
+    mint(user : User, tenant? : Tenant) : string {
+        const claims = {
+            sub: user.id,
+            tenant: tenant?.id,
+            roles: user.roles.map(role => role.id),
+            exp: nowSeconds() + this.ttlSeconds,
+        };
+        const payload = base64url(JSON.stringify(claims));
+        return `${payload}.${this.sign(payload)}`;
+    }
+
+    verify(token : string | undefined) : [User, Tenant | undefined] | undefined {
+        if (!token || !this.configured) return undefined;
+
+        const [payload, signature] = token.split(".");
+        if (!payload || !signature || !this.signatureMatches(payload, signature)) return undefined;
+
+        let claims : { sub? : unknown, tenant? : unknown, roles? : unknown, exp? : unknown };
+        try {
+            claims = JSON.parse(Buffer.from(payload, "base64url").toString());
+        } catch {
+            return undefined;
+        }
+        if (typeof claims.sub !== "string" || typeof claims.exp !== "number" || claims.exp < nowSeconds()) {
+            return undefined;
+        }
+
+        const roles = Array.isArray(claims.roles) ? claims.roles.map(id => new Role(String(id))) : [];
+        const tenant = typeof claims.tenant === "string" ? new Tenant(claims.tenant) : undefined;
+        return [new User(claims.sub, roles), tenant];
+    }
+
+    // Sets (or, for a still-valid session, refreshes) the session cookie.
+    issue(response : ServerResponse, user : User, tenant? : Tenant) : void {
+        const cookie = `${SESSION_COOKIE}=${this.mint(user, tenant)}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${this.ttlSeconds}`;
+        const existing = response.getHeader("Set-Cookie");
+        if (existing === undefined) response.setHeader("Set-Cookie", cookie);
+        else response.setHeader("Set-Cookie", Array.isArray(existing) ? [...existing, cookie] : [String(existing), cookie]);
+    }
+
+    private sign(payload : string) : string {
+        return createHmac("sha256", this.secret).update(payload).digest("base64url");
+    }
+
+    private signatureMatches(payload : string, signature : string) : boolean {
+        const expected = Buffer.from(this.sign(payload));
+        const actual = Buffer.from(signature);
+        return expected.length === actual.length && timingSafeEqual(expected, actual);
+    }
+
+}
+
+export { SessionSigner }

package/src/hosting/middleware/AuthenticationMiddleware.ts

@@ -1,4 +1,5 @@
 import {Authenticator} from "../../auth/Authenticator";
+import {SessionSigner} from "../../auth/SessionSigner";
 import {TokenAuthenticator} from "../../auth/TokenAuthenticator";
 import {Middleware} from "../Middleware";
 import {Request} from "../Request";
@@ -6,15 +7,18 @@ import {Request} from "../Request";
 type OpenRequestPredicate = (request : Request) => boolean;
 
 /* Decorates the request with its authenticated user and tenant - bearer
-   tokens first, sessions otherwise - and enforces authorization. Requests
-   matching the open predicate (ping, the one-time CLI key poll) pass
-   through untouched, as does everything when no authenticator is
-   configured. */
+   tokens first, then a valid platform session cookie, then the authenticator -
+   and enforces authorization. A valid platform session short-circuits the
+   authenticator entirely (no identity-provider round-trip) and slides its
+   expiry; a fresh authenticator login mints one. Requests matching the open
+   predicate (ping, the one-time CLI key poll) pass through untouched, as does
+   everything when no authenticator is configured. */
 class AuthenticationMiddleware implements Middleware {
 
     constructor(private authenticator? : Authenticator,
                 private tokenAuthenticator? : TokenAuthenticator,
-                private isOpen : OpenRequestPredicate = () => false) {}
+                private isOpen : OpenRequestPredicate = () => false,
+                private sessionSigner : SessionSigner = new SessionSigner()) {}
 
     async apply(request : Request) : Promise<boolean> {
         if (this.isOpen(request)) return true;
@@ -26,12 +30,24 @@ class AuthenticationMiddleware implements Middleware {
             return this.authorized(request);
         }
 
+        if (this.sessionSigner.configured) {
+            const session = this.sessionSigner.verify(request.session);
+            if (session) {
+                [request.user, request.tenant] = session;
+                this.sessionSigner.issue(request.rawResponse, request.user!, request.tenant);
+                return this.authorized(request);
+            }
+        }
+
         if (!this.authenticator) return true;
 
         const authenticated = await this.authenticator.authenticate(request.session, request.raw, request.rawResponse);
         if (!authenticated) return false;
 
         [request.user, request.tenant] = authenticated;
+        if (this.sessionSigner.configured && !request.handled) {
+            this.sessionSigner.issue(request.rawResponse, request.user!, request.tenant);
+        }
         return this.authorized(request);
     }
 

package/src/index.ts

@@ -11,6 +11,7 @@ export * from "./auth/InMemoryCliKeyStore";
 export * from "./auth/AuthenticatorLoader";
 export * from "./auth/KeyPair";
 export * from "./auth/Role";
+export * from "./auth/SessionSigner";
 export * from "./auth/StubAuthenticator";
 export * from "./auth/Tenant";
 export * from "./auth/TokenAuthenticator";