anbaric-cloud-hosting 1.33.0 → 1.35.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.33.0",
+  "version": "1.35.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,18 +18,18 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.33.0",
-    "anbaric-plugins": "^1.33.0",
-    "anbaric-tsapi": "^1.33.0",
-    "anbaric-web": "^1.33.0",
+    "anbaric-data-store": "^1.35.0",
+    "anbaric-plugins": "^1.35.0",
+    "anbaric-tsapi": "^1.35.0",
+    "anbaric-web": "^1.35.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.33.0",
-    "anbaric-state-machine": "^1.33.0",
+    "anbaric-impl-cloud": "^1.35.0",
+    "anbaric-state-machine": "^1.35.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/auth/HttpMembershipService.ts

@@ -0,0 +1,44 @@
+import {Inviter, MembershipService, PendingInvitation} from "./MembershipService";
+
+type FetchFn = (url : string, init : RequestInit) => Promise<Response>;
+
+/* Talks to the central login's invitation endpoints for one tenant, with the
+   same central api key the platform already holds for CLI key lookups. */
+class HttpMembershipService implements MembershipService {
+
+    constructor(private centralUrl : string, private secret : string, private tenantSlug : string,
+                private fetchFn : FetchFn = (url, init) => fetch(url, init)) {}
+
+    async invite(email : string, invitedBy : Inviter) : Promise<PendingInvitation> {
+        const response = await this.call("POST", "", { email, invitedBy });
+        return await response.json() as PendingInvitation;
+    }
+
+    async pending() : Promise<Array<PendingInvitation>> {
+        const response = await this.call("GET", "");
+        return await response.json() as Array<PendingInvitation>;
+    }
+
+    async revoke(token : string) : Promise<boolean> {
+        const response = await this.call("DELETE", `/${encodeURIComponent(token)}`, undefined, [404]);
+        return response.status === 204;
+    }
+
+    private async call(method : string, path : string, body? : unknown, tolerated : Array<number> = []) : Promise<Response> {
+        const headers : Record<string, string> = { "x-anbaric-central-key": this.secret };
+        if (body !== undefined) headers["content-type"] = "application/json";
+
+        const response = await this.fetchFn(
+            `${this.centralUrl.replace(/\/$/, "")}/tenants/${encodeURIComponent(this.tenantSlug)}/invitations${path}`,
+            { method, headers, body: body === undefined ? undefined : JSON.stringify(body) });
+
+        if (! response.ok && ! tolerated.includes(response.status)) {
+            const problem = await response.json().catch(() => ({})) as { error? : string };
+            throw new Error(problem.error ?? `The invitation request failed with status ${response.status}`);
+        }
+        return response;
+    }
+
+}
+
+export { HttpMembershipService }

package/src/auth/InMemoryMembershipService.ts

@@ -0,0 +1,38 @@
+import {randomUUID} from "node:crypto";
+import {Inviter, MembershipService, PendingInvitation} from "./MembershipService";
+
+class InMemoryMembershipService implements MembershipService {
+
+    private invitations = new Map<string, PendingInvitation>();
+
+    constructor(private linkBase : string = "http://localhost/invitations") {}
+
+    async invite(email : string, invitedBy : Inviter) : Promise<PendingInvitation> {
+        const token = randomUUID();
+        const now = new Date();
+        const invitation : PendingInvitation = {
+            token,
+            email: email.trim().toLowerCase(),
+            role: "member",
+            invitedBy: invitedBy.id,
+            invitedByName: invitedBy.name,
+            link: `${this.linkBase}/${token}`,
+            createdAt: now.toISOString(),
+            expiresAt: new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000).toISOString(),
+            emailed: false,
+        };
+        this.invitations.set(token, invitation);
+        return { ...invitation };
+    }
+
+    async pending() : Promise<Array<PendingInvitation>> {
+        return Array.from(this.invitations.values()).map(invitation => ({ ...invitation })).reverse();
+    }
+
+    async revoke(token : string) : Promise<boolean> {
+        return this.invitations.delete(token);
+    }
+
+}
+
+export { InMemoryMembershipService }

package/src/auth/InMemoryUserDirectory.ts

@@ -0,0 +1,29 @@
+import {User} from "./User";
+import {DirectoryUser, UserDirectory} from "./UserDirectory";
+
+class InMemoryUserDirectory implements UserDirectory {
+
+    private users = new Map<string, DirectoryUser>();
+
+    async record(user : User) : Promise<void> {
+        const now = new Date().toISOString();
+        const existing = this.users.get(user.id);
+        this.users.set(user.id, {
+            id: user.id,
+            name: user.name ?? "",
+            email: user.email ?? "",
+            picture: user.picture,
+            firstSeenAt: existing?.firstSeenAt ?? now,
+            lastSeenAt: now,
+        });
+    }
+
+    async list() : Promise<Array<DirectoryUser>> {
+        return Array.from(this.users.values())
+            .map(user => ({ ...user }))
+            .sort((a, b) => (a.name || a.id).localeCompare(b.name || b.id));
+    }
+
+}
+
+export { InMemoryUserDirectory }

package/src/auth/MembershipService.ts

@@ -0,0 +1,35 @@
+type PendingInvitation = {
+
+    token : string,
+    email : string,
+    role : string,
+    invitedBy : string,
+    invitedByName? : string,
+    link : string,
+    createdAt : string,
+    expiresAt : string,
+    emailed? : boolean,
+
+};
+
+type Inviter = {
+
+    id : string,
+    name? : string,
+
+};
+
+/* Invitations into this tenant. Membership itself is decided wherever people
+   sign in (Anbaric Cloud's central login), so a platform only asks that
+   service to invite, list and revoke on the tenant's behalf. */
+interface MembershipService {
+
+    invite(email : string, invitedBy : Inviter) : Promise<PendingInvitation>;
+
+    pending() : Promise<Array<PendingInvitation>>;
+
+    revoke(token : string) : Promise<boolean>;
+
+}
+
+export type { MembershipService, PendingInvitation, Inviter }

package/src/auth/SessionSigner.ts

@@ -42,6 +42,7 @@ class SessionSigner {
             roles: user.roles.map(role => role.id),
             name: user.name,
             picture: user.picture,
+            email: user.email,
             exp: nowSeconds() + this.ttlSeconds,
         };
         const payload = base64url(JSON.stringify(claims));
@@ -54,7 +55,7 @@ class SessionSigner {
         const [payload, signature] = token.split(".");
         if (!payload || !signature || !this.signatureMatches(payload, signature)) return undefined;
 
-        let claims : { sub? : unknown, tenant? : unknown, roles? : unknown, name? : unknown, picture? : unknown, exp? : unknown };
+        let claims : { sub? : unknown, tenant? : unknown, roles? : unknown, name? : unknown, picture? : unknown, email? : unknown, exp? : unknown };
         try {
             claims = JSON.parse(Buffer.from(payload, "base64url").toString());
         } catch {
@@ -68,7 +69,8 @@ class SessionSigner {
         const tenant = typeof claims.tenant === "string" ? new Tenant(claims.tenant) : undefined;
         const name = typeof claims.name === "string" ? claims.name : undefined;
         const picture = typeof claims.picture === "string" ? claims.picture : undefined;
-        return [new User(claims.sub, roles, [], name, picture), tenant];
+        const email = typeof claims.email === "string" ? claims.email : undefined;
+        return [new User(claims.sub, roles, [], name, picture, email), tenant];
     }
 
     // Sets (or, for a still-valid session, refreshes) the session cookie.

package/src/auth/UserDirectory.ts

@@ -0,0 +1,25 @@
+import {User} from "./User";
+
+type DirectoryUser = {
+
+    id : string,
+    name : string,
+    email : string,
+    picture? : string,
+    firstSeenAt : string,
+    lastSeenAt : string,
+
+};
+
+/* Everyone who has signed in to this tenant, as the platform saw them at
+   their last sign-in. A tenant-local directory: it needs no identity-provider
+   organisation, so it works for a single-owner tenant as much as a team. */
+interface UserDirectory {
+
+    record(user : User) : Promise<void>;
+
+    list() : Promise<Array<DirectoryUser>>;
+
+}
+
+export type { UserDirectory, DirectoryUser }

package/src/data-store/PostgresUserDirectory.ts

@@ -0,0 +1,39 @@
+import {Pool} from "pg";
+import {User} from "../auth/User";
+import {DirectoryUser, UserDirectory} from "../auth/UserDirectory";
+
+class PostgresUserDirectory implements UserDirectory {
+
+    constructor(private pool : Pool) {}
+
+    async record(user : User) : Promise<void> {
+        await this.pool.query(
+            `INSERT INTO anbaric_system.users (id, name, email, picture)
+             VALUES ($1, $2, $3, $4)
+             ON CONFLICT (id) DO UPDATE
+             SET name = EXCLUDED.name, email = EXCLUDED.email, picture = EXCLUDED.picture, last_seen = now()`,
+            [user.id, user.name ?? "", user.email ?? "", user.picture ?? null]);
+    }
+
+    async list() : Promise<Array<DirectoryUser>> {
+        const result = await this.pool.query(
+            `SELECT id, name, email, picture, first_seen, last_seen
+             FROM anbaric_system.users
+             ORDER BY NULLIF(name, '') NULLS LAST, id`);
+        return result.rows.map(row => ({
+            id: row.id,
+            name: row.name,
+            email: row.email,
+            picture: row.picture ?? undefined,
+            firstSeenAt: this.iso(row.first_seen),
+            lastSeenAt: this.iso(row.last_seen),
+        }));
+    }
+
+    private iso(value : unknown) : string {
+        return value instanceof Date ? value.toISOString() : String(value ?? "");
+    }
+
+}
+
+export { PostgresUserDirectory }

package/src/data-store/Schema.ts

@@ -156,6 +156,16 @@ const ensureSchema = async (pool : Pool) : Promise<void> => {
         )
     `);
     await pool.query("ALTER TABLE anbaric_system.cli_keys ADD COLUMN IF NOT EXISTS tenant TEXT");
+    await pool.query(`
+        CREATE TABLE IF NOT EXISTS anbaric_system.users (
+            id          TEXT PRIMARY KEY,
+            name        TEXT NOT NULL DEFAULT '',
+            email       TEXT NOT NULL DEFAULT '',
+            picture     TEXT,
+            first_seen  TIMESTAMPTZ NOT NULL DEFAULT now(),
+            last_seen   TIMESTAMPTZ NOT NULL DEFAULT now()
+        )
+    `);
     await pool.query(`
         DO $$ BEGIN
             CREATE TYPE anbaric_system.audit_interaction AS ENUM

package/src/hosting/HostingServer.ts

@@ -13,7 +13,11 @@ import {AuditsHandler} from "./handlers/AuditsHandler";
 import {AuthorizeCliHandler} from "./handlers/auth/AuthorizeCliHandler";
 import {KeysHandler} from "./handlers/auth/KeysHandler";
 import {SessionsHandler} from "./handlers/auth/SessionsHandler";
+import {UsersHandler} from "./handlers/auth/UsersHandler";
+import {InvitationsHandler} from "./handlers/auth/InvitationsHandler";
+import {MembershipService} from "../auth/MembershipService";
 import {WhoamiHandler} from "./handlers/auth/WhoamiHandler";
+import {UserDirectory} from "../auth/UserDirectory";
 import {ConsumersHandler} from "./handlers/ConsumersHandler";
 import {DocumentsHandler} from "./handlers/DocumentsHandler";
 import {EntitlementsAdminHandler} from "./handlers/EntitlementsAdminHandler";
@@ -62,7 +66,9 @@ class HostingServer {
                 plugins : Array<LoadedPlugin> = [],
                 jobRunSchedules? : JobRunSchedulePersistence,
                 notifier? : Notifier,
-                entitlements? : EntitlementStore) {
+                entitlements? : EntitlementStore,
+                userDirectory? : UserDirectory,
+                memberships? : MembershipService) {
         const pages = new PagesHandler();
         const ping = new PingHandler(tenant);
         const jobs = new JobsHandler(persistence);
@@ -92,6 +98,8 @@ class HostingServer {
         if (jobRunSchedules) publicRouter.registerApi("job-run-schedules", new JobRunSchedulesHandler(jobRunSchedules));
         if (notifier) publicRouter.registerApi("notifications", new NotificationsHandler(notifier));
         if (entitlements) publicRouter.registerApi("entitlements", new EntitlementsAdminHandler(entitlements));
+        if (userDirectory) publicRouter.registerApi("users", new UsersHandler(userDirectory));
+        if (memberships) publicRouter.registerApi("invitations", new InvitationsHandler(memberships));
         if (cliAuthorizer) {
             publicRouter.register("authorize-cli", new AuthorizeCliHandler(cliAuthorizer, pages, tenant));
             publicRouter.registerApi("keys", new KeysHandler(cliAuthorizer));
@@ -128,7 +136,7 @@ class HostingServer {
 
         this.publicServer = new Server(publicRouter, [
             new SessionMiddleware(),
-            new AuthenticationMiddleware(authenticator, tokenAuthenticator, openRequests),
+            new AuthenticationMiddleware(authenticator, tokenAuthenticator, openRequests, undefined, userDirectory),
         ]);
         this.internalServer = new Server(internalRouter);
     }

package/src/hosting/handlers/auth/InvitationsHandler.ts

@@ -0,0 +1,34 @@
+import {MembershipService} from "../../../auth/MembershipService";
+import {Request} from "../../Request";
+import {RequestHandler} from "../../RequestHandler";
+
+const EMAIL_SHAPE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+/* The console's side of inviting people into this tenant: list what is
+   pending, invite by email (attributed to the signed-in user), revoke. */
+class InvitationsHandler implements RequestHandler {
+
+    constructor(private memberships : MembershipService) {}
+
+    async handle(request : Request) : Promise<void> {
+        if (request.method === "GET" && ! request.id) return request.reply(200, await this.memberships.pending());
+        if (request.method === "POST" && ! request.id) return this.invite(request);
+        if (request.method === "DELETE" && request.id && ! request.subresource) {
+            const revoked = await this.memberships.revoke(request.id);
+            return revoked ? request.reply(204) : request.notFound();
+        }
+        request.notFound();
+    }
+
+    private async invite(request : Request) : Promise<void> {
+        const body = await request.body() as { email? : string } | undefined;
+        const email = String(body?.email ?? "").trim();
+        if (! EMAIL_SHAPE.test(email)) return request.reply(400, { error: "A valid email address is required" });
+
+        const inviter = request.user ? { id: request.user.id, name: request.user.name } : { id: "system" };
+        request.reply(201, await this.memberships.invite(email, inviter));
+    }
+
+}
+
+export { InvitationsHandler }

package/src/hosting/handlers/auth/UsersHandler.ts

@@ -0,0 +1,16 @@
+import {UserDirectory} from "../../../auth/UserDirectory";
+import {Request} from "../../Request";
+import {RequestHandler} from "../../RequestHandler";
+
+class UsersHandler implements RequestHandler {
+
+    constructor(private directory : UserDirectory) {}
+
+    async handle(request : Request) : Promise<void> {
+        if (request.method === "GET" && ! request.id) return request.reply(200, await this.directory.list());
+        request.notFound();
+    }
+
+}
+
+export { UsersHandler }

package/src/hosting/middleware/AuthenticationMiddleware.ts

@@ -1,24 +1,32 @@
 import {Authenticator} from "../../auth/Authenticator";
 import {SessionSigner} from "../../auth/SessionSigner";
 import {TokenAuthenticator} from "../../auth/TokenAuthenticator";
+import {User} from "../../auth/User";
+import {UserDirectory} from "../../auth/UserDirectory";
 import {Middleware} from "../Middleware";
 import {Request} from "../Request";
 
 type OpenRequestPredicate = (request : Request) => boolean;
 
+const DIRECTORY_REFRESH_MS = 60 * 60 * 1000;
+
 /* Decorates the request with its authenticated user and tenant - bearer
    tokens first, then a valid platform session cookie, then the authenticator -
    and enforces authorization. A valid platform session short-circuits the
    authenticator entirely (no identity-provider round-trip) and slides its
    expiry; a fresh authenticator login mints one. Requests matching the open
    predicate (ping, the one-time CLI key poll) pass through untouched, as does
-   everything when no authenticator is configured. */
+   everything when no authenticator is configured. Browser-session users are
+   recorded in the tenant's user directory, at most once an hour each. */
 class AuthenticationMiddleware implements Middleware {
 
+    private recorded = new Map<string, number>();
+
     constructor(private authenticator? : Authenticator,
                 private tokenAuthenticator? : TokenAuthenticator,
                 private isOpen : OpenRequestPredicate = () => false,
-                private sessionSigner : SessionSigner = new SessionSigner()) {}
+                private sessionSigner : SessionSigner = new SessionSigner(),
+                private userDirectory? : UserDirectory) {}
 
     async apply(request : Request) : Promise<boolean> {
         if (this.isOpen(request)) return true;
@@ -35,6 +43,7 @@ class AuthenticationMiddleware implements Middleware {
             if (session) {
                 [request.user, request.tenant] = session;
                 this.sessionSigner.issue(request.rawResponse, request.user!, request.tenant);
+                await this.remember(request.user!);
                 return this.authorized(request);
             }
         }
@@ -57,9 +66,26 @@ class AuthenticationMiddleware implements Middleware {
         if (this.sessionSigner.configured && !request.handled) {
             this.sessionSigner.issue(request.rawResponse, request.user!, request.tenant);
         }
+        await this.remember(request.user!);
         return this.authorized(request);
     }
 
+    private async remember(user : User) : Promise<void> {
+        if (! this.userDirectory) return;
+
+        const now = Date.now();
+        const last = this.recorded.get(user.id) ?? 0;
+        if (now - last < DIRECTORY_REFRESH_MS) return;
+
+        this.recorded.set(user.id, now);
+        try {
+            await this.userDirectory.record(user);
+        } catch (error) {
+            this.recorded.delete(user.id);
+            console.error(`Could not record user "${user.id}" in the directory:`, error);
+        }
+    }
+
     private isStateChanging(method : string) : boolean {
         return method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";
     }