anbaric-cloud-hosting 1.18.1 → 1.19.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.18.1",
+  "version": "1.19.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,17 +18,17 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.18.1",
-    "anbaric-plugins": "^1.18.1",
-    "anbaric-tsapi": "^1.18.1",
+    "anbaric-data-store": "^1.19.0",
+    "anbaric-plugins": "^1.19.0",
+    "anbaric-tsapi": "^1.19.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.18.1",
-    "anbaric-state-machine": "^1.18.1",
+    "anbaric-impl-cloud": "^1.19.0",
+    "anbaric-state-machine": "^1.19.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/app-management/DockerBuildLayer.ts

@@ -89,6 +89,7 @@ class DockerBuildLayer extends BaseBuildLayer {
             "--env", "ANBARIC_JSON_STORE_TYPE=cloud",
             "--env", "ANBARIC_SECRET_STORE_TYPE=cloud",
             "--env", "ANBARIC_AUDITOR_TYPE=cloud",
+            "--env", "ANBARIC_SESSION_RESOLVER_TYPE=cloud",
             "--env", `ANBARIC_CONSUMER_PORT=${deployment.consumerPort}`,
             "--env", `ANBARIC_CONSUMER_URL=http://${container}:${deployment.consumerPort}`,
             ...sqlEnv,

package/src/app-management/FargateBuildLayer.ts

@@ -178,6 +178,7 @@ class FargateBuildLayer extends BaseBuildLayer {
                     { name: "ANBARIC_JSON_STORE_TYPE", value: "cloud" },
                     { name: "ANBARIC_SECRET_STORE_TYPE", value: "cloud" },
                     { name: "ANBARIC_AUDITOR_TYPE", value: "cloud" },
+                    { name: "ANBARIC_SESSION_RESOLVER_TYPE", value: "cloud" },
                     { name: "ANBARIC_CONSUMER_PORT", value: String(deployment.consumerPort) },
                     { name: "ANBARIC_CONSUMER_URL", value: `http://${deployment.appHost}:${deployment.consumerPort}` },
                     ...(this.options.servicesUrl ? [{ name: "ANBARIC_SERVICES_URL", value: this.options.servicesUrl }] : []),

package/src/hosting/HostingServer.ts

@@ -11,6 +11,7 @@ import {AppsHandler} from "./handlers/AppsHandler";
 import {AuditsHandler} from "./handlers/AuditsHandler";
 import {AuthorizeCliHandler} from "./handlers/auth/AuthorizeCliHandler";
 import {KeysHandler} from "./handlers/auth/KeysHandler";
+import {SessionsHandler} from "./handlers/auth/SessionsHandler";
 import {WhoamiHandler} from "./handlers/auth/WhoamiHandler";
 import {ConsumersHandler} from "./handlers/ConsumersHandler";
 import {DocumentsHandler} from "./handlers/DocumentsHandler";
@@ -60,12 +61,14 @@ class HostingServer {
         const documents = documentStoreFor && new DocumentsHandler(documentStoreFor);
         const secrets = secretStore && new SecretsHandler(secretStore);
         const audits = auditRecords && new AuditsHandler(auditRecords);
+        const sessions = new SessionsHandler();
 
         const publicRouter = new Router();
         publicRouter.registerRoot(pages);
         publicRouter.register("ping", ping);
         if (plugins.length > 0) publicRouter.registerApi("plugins", new PluginsHandler(plugins));
         publicRouter.registerApi("whoami", new WhoamiHandler());
+        publicRouter.registerApi("sessions", sessions);
         publicRouter.registerApi("jobs", jobs);
         publicRouter.registerApi("queue", queueHandler);
         publicRouter.registerApi("consumers", consumers);
@@ -84,6 +87,7 @@ class HostingServer {
 
         const internalRouter = new Router();
         internalRouter.register("ping", ping);
+        internalRouter.registerApi("sessions", sessions);
         internalRouter.registerApi("jobs", jobs);
         internalRouter.registerApi("queue", queueHandler);
         internalRouter.registerApi("consumers", consumers);
@@ -113,7 +117,7 @@ class HostingServer {
 
     async close() : Promise<void> {
         if (this.internalServer.listening) await this.internalServer.close();
-        await this.publicServer.close();
+        if (this.publicServer.listening) await this.publicServer.close();
     }
 
 }

package/src/hosting/handlers/auth/SessionsHandler.ts

@@ -0,0 +1,35 @@
+import {SessionSigner} from "../../../auth/SessionSigner";
+import {Request} from "../../Request";
+import {RequestHandler} from "../../RequestHandler";
+
+/* Resolves a platform session token into the user's identity, for apps that
+   cannot verify it themselves (the signing secret is platform only). The token
+   travels in the body - it is the credential - so this needs no session
+   middleware and is safe on the internal, app-facing router. */
+class SessionsHandler implements RequestHandler {
+
+    constructor(private sessionSigner : SessionSigner = new SessionSigner()) {}
+
+    async handle(request : Request) : Promise<void> {
+        if (request.method === "POST" && request.id === "resolve" && !request.subresource) {
+            return this.resolve(request);
+        }
+        request.notFound();
+    }
+
+    private async resolve(request : Request) : Promise<void> {
+        const body = await request.body() as { session? : string } | undefined;
+        const resolved = this.sessionSigner.verify(body?.session);
+        if (!resolved) return request.reply(401, { error: "Invalid or expired session" });
+
+        const [user, tenant] = resolved;
+        request.reply(200, {
+            id: user.id,
+            roles: user.roles.map(role => role.id),
+            tenant: tenant?.id,
+        });
+    }
+
+}
+
+export { SessionsHandler }