anbaric-cloud-hosting 1.4.0 → 1.6.0

package/src/hosting/handlers/JobsHandler.ts

@@ -0,0 +1,60 @@
+import {JobPersistence, deserializeJob, serializeJob} from "anbaric-tsapi";
+import {Request} from "../Request";
+import {RequestHandler} from "../RequestHandler";
+
+class JobsHandler implements RequestHandler {
+
+    constructor(private persistence : JobPersistence) {}
+
+    async handle(request : Request) : Promise<void> {
+        switch (request.subresource) {
+            case "properties":
+                if (request.id) return this.handleProperties(request, request.id);
+                break;
+            case undefined:
+                if (request.id) return this.handleJob(request, request.id);
+                return this.handleCollection(request);
+        }
+        request.notFound();
+    }
+
+    private async handleProperties(request : Request, id : string) : Promise<void> {
+        switch (request.method) {
+            case "PATCH": {
+                const properties = new Map<string, any>(Object.entries(await request.body()));
+                await this.persistence.updateProperties(id, properties);
+                return request.reply(204);
+            }
+        }
+        request.notFound();
+    }
+
+    private async handleJob(request : Request, id : string) : Promise<void> {
+        switch (request.method) {
+            case "PUT":
+                await this.persistence.save(deserializeJob(await request.body()));
+                return request.reply(204);
+            case "GET":
+                return request.reply(200, serializeJob(await this.persistence.retrieve(id)));
+            case "DELETE":
+                await this.persistence.delete(id);
+                return request.reply(204);
+        }
+        request.notFound();
+    }
+
+    private async handleCollection(request : Request) : Promise<void> {
+        switch (request.method) {
+            case "GET": {
+                const pageSize = Number(request.query("pageSize") ?? 100);
+                const page = Number(request.query("page") ?? 0);
+                const jobs = await this.persistence.list(pageSize, page);
+                return request.reply(200, jobs.map(serializeJob));
+            }
+        }
+        request.notFound();
+    }
+
+}
+
+export { JobsHandler }

package/src/hosting/handlers/PagesHandler.ts

@@ -0,0 +1,22 @@
+import {readFile} from "node:fs/promises";
+import {Request} from "../Request";
+import {RequestHandler} from "../RequestHandler";
+
+class PagesHandler implements RequestHandler {
+
+    async handle(request : Request) : Promise<void> {
+        if (request.method === "GET" && !request.id) return this.serve(request);
+        request.notFound();
+    }
+
+    async serve(request : Request) : Promise<void> {
+        try {
+            request.replyHtml(await readFile(new URL("../pages/platform-ui.html", import.meta.url)));
+        } catch {
+            request.reply(501, { error: "The platform UI has not been built - run npm run build in anbaric-cloud-hosting/ui" });
+        }
+    }
+
+}
+
+export { PagesHandler }

package/src/hosting/handlers/PingHandler.ts

@@ -0,0 +1,18 @@
+import {Request} from "../Request";
+import {RequestHandler} from "../RequestHandler";
+
+class PingHandler implements RequestHandler {
+
+    constructor(private tenant? : string) {}
+
+    async handle(request : Request) : Promise<void> {
+        switch (request.method) {
+            case "GET":
+                return request.reply(200, this.tenant ? { status: "ok", tenant: this.tenant } : { status: "ok" });
+        }
+        request.notFound();
+    }
+
+}
+
+export { PingHandler }

package/src/hosting/handlers/QueueHandler.ts

@@ -0,0 +1,36 @@
+import {ConfirmableQueue} from "../../queuing/ConfirmableQueue";
+import {Request} from "../Request";
+import {RequestHandler} from "../RequestHandler";
+
+class QueueHandler implements RequestHandler {
+
+    constructor(private queue : ConfirmableQueue) {}
+
+    async handle(request : Request) : Promise<void> {
+        if (request.method !== "POST" || !request.id || request.subresource) return request.notFound();
+
+        switch (request.id) {
+            case "enqueue": {
+                const { jobId, workflowId } = await request.body();
+                await this.queue.enqueue(jobId, workflowId);
+                return request.reply(204);
+            }
+            case "schedule": {
+                const { jobId, workflowId, due } = await request.body();
+                await this.queue.schedule(jobId, workflowId, new Date(due));
+                return request.reply(204);
+            }
+            case "dequeue":
+                return request.reply(200, { messages: await this.queue.dequeueSome() });
+            case "confirm": {
+                const { jobId, workflowId } = await request.body();
+                await this.queue.confirm({ jobId, workflowId });
+                return request.reply(204);
+            }
+        }
+        request.notFound();
+    }
+
+}
+
+export { QueueHandler }

package/src/hosting/handlers/SecretsHandler.ts

@@ -0,0 +1,42 @@
+import {SecretStore} from "anbaric-tsapi";
+import {Request} from "../Request";
+import {RequestHandler} from "../RequestHandler";
+
+class SecretsHandler implements RequestHandler {
+
+    constructor(private secretStore : SecretStore) {}
+
+    async handle(request : Request) : Promise<void> {
+        if (request.subresource) return request.notFound();
+        if (request.id) return this.handleSecret(request, request.id);
+        return this.handleCollection(request);
+    }
+
+    private async handleSecret(request : Request, name : string) : Promise<void> {
+        switch (request.method) {
+            case "PUT": {
+                const { value } = await request.body();
+                if (typeof value !== "string") return request.reply(400, { error: "Expected a body of { value : string }" });
+                await this.secretStore.save(name, value);
+                return request.reply(204);
+            }
+            case "GET":
+                return request.reply(200, { value: await this.secretStore.retrieve(name) });
+            case "DELETE":
+                await this.secretStore.delete(name);
+                return request.reply(204);
+        }
+        request.notFound();
+    }
+
+    private async handleCollection(request : Request) : Promise<void> {
+        switch (request.method) {
+            case "GET":
+                return request.reply(200, await this.secretStore.list());
+        }
+        request.notFound();
+    }
+
+}
+
+export { SecretsHandler }

package/src/hosting/handlers/StateMachinesHandler.ts

@@ -0,0 +1,21 @@
+import {ConsumerRegistry} from "../../queuing/ConsumerRegistry";
+import {Request} from "../Request";
+import {RequestHandler} from "../RequestHandler";
+
+class StateMachinesHandler implements RequestHandler {
+
+    constructor(private registry : ConsumerRegistry) {}
+
+    async handle(request : Request) : Promise<void> {
+        if (request.id) return request.notFound();
+
+        switch (request.method) {
+            case "GET":
+                return request.reply(200, this.registry.list());
+        }
+        request.notFound();
+    }
+
+}
+
+export { StateMachinesHandler }

package/src/hosting/handlers/auth/AuthorizeCliHandler.ts

@@ -0,0 +1,50 @@
+import {CliAuthorizer} from "../../../auth/CliAuthorizer";
+import {User} from "../../../auth/User";
+import {Request} from "../../Request";
+import {RequestHandler} from "../../RequestHandler";
+import {PagesHandler} from "../PagesHandler";
+
+class AuthorizeCliHandler implements RequestHandler {
+
+    constructor(private authorizer : CliAuthorizer, private pages : PagesHandler,
+                private tenant? : string) {}
+
+    async handle(request : Request) : Promise<void> {
+        const requestId = request.id;
+        if (!requestId) return request.notFound();
+
+        switch (request.subresource) {
+            case "poll":
+                if (request.method === "GET") return this.handlePoll(request, requestId);
+                break;
+            case undefined:
+                switch (request.method) {
+                    case "GET":
+                        return this.pages.serve(request);
+                    case "POST":
+                        return this.handleApprove(request, requestId);
+                }
+                break;
+        }
+        request.notFound();
+    }
+
+    private async handlePoll(request : Request, requestId : string) : Promise<void> {
+        const keyPair = this.authorizer.collect(requestId);
+        if (!keyPair) return request.reply(202, { status: "pending" });
+        request.reply(200, keyPair);
+    }
+
+    private async handleApprove(request : Request, requestId : string) : Promise<void> {
+        const { clientName } = await request.body();
+        if (typeof clientName !== "string" || clientName.trim().length === 0) {
+            return request.reply(400, { error: "Expected a body of { clientName : string }" });
+        }
+        await this.authorizer.approve(requestId, clientName.trim(), request.user ?? new User("local"),
+            request.tenant?.id ?? this.tenant);
+        request.reply(204);
+    }
+
+}
+
+export { AuthorizeCliHandler }

package/src/hosting/handlers/auth/KeysHandler.ts

@@ -0,0 +1,36 @@
+import {CliAuthorizer} from "../../../auth/CliAuthorizer";
+import {User} from "../../../auth/User";
+import {Request} from "../../Request";
+import {RequestHandler} from "../../RequestHandler";
+
+class KeysHandler implements RequestHandler {
+
+    constructor(private authorizer : CliAuthorizer) {}
+
+    async handle(request : Request) : Promise<void> {
+        const owner = request.user ?? new User("local");
+
+        if (request.id) {
+            switch (request.method) {
+                case "DELETE":
+                    await this.authorizer.revoke(request.id, owner.id);
+                    return request.reply(204);
+            }
+        } else {
+            switch (request.method) {
+                case "GET": {
+                    const keys = await this.authorizer.keysFor(owner.id);
+                    return request.reply(200, keys.map(key => ({
+                        id: key.id,
+                        clientName: key.clientName,
+                        createdAt: key.createdAt.toISOString(),
+                    })));
+                }
+            }
+        }
+        request.notFound();
+    }
+
+}
+
+export { KeysHandler }

package/src/hosting/handlers/auth/WhoamiHandler.ts

@@ -0,0 +1,18 @@
+import {Request} from "../../Request";
+import {RequestHandler} from "../../RequestHandler";
+
+class WhoamiHandler implements RequestHandler {
+
+    async handle(request : Request) : Promise<void> {
+        if (request.method === "GET" && !request.id && request.user) {
+            return request.reply(200, {
+                id: request.user.id,
+                roles: request.user.roles.map(role => role.id),
+            });
+        }
+        request.notFound();
+    }
+
+}
+
+export { WhoamiHandler }

package/src/hosting/middleware/AuthenticationMiddleware.ts

@@ -0,0 +1,52 @@
+import {Authenticator} from "../../auth/Authenticator";
+import {TokenAuthenticator} from "../../auth/TokenAuthenticator";
+import {Middleware} from "../Middleware";
+import {Request} from "../Request";
+
+type OpenRequestPredicate = (request : Request) => boolean;
+
+/* Decorates the request with its authenticated user and tenant - bearer
+   tokens first, sessions otherwise - and enforces authorization. Requests
+   matching the open predicate (ping, the one-time CLI key poll) pass
+   through untouched, as does everything when no authenticator is
+   configured. */
+class AuthenticationMiddleware implements Middleware {
+
+    constructor(private authenticator? : Authenticator,
+                private tokenAuthenticator? : TokenAuthenticator,
+                private isOpen : OpenRequestPredicate = () => false) {}
+
+    async apply(request : Request) : Promise<boolean> {
+        if (this.isOpen(request)) return true;
+
+        if (this.tokenAuthenticator?.handles(request.raw)) {
+            const user = await this.tokenAuthenticator.authenticate(request.raw, request.rawResponse);
+            if (!user) return false;
+            request.user = user;
+            return this.authorized(request);
+        }
+
+        if (!this.authenticator) return true;
+
+        const authenticated = await this.authenticator.authenticate(request.session, request.raw, request.rawResponse);
+        if (!authenticated) return false;
+
+        [request.user, request.tenant] = authenticated;
+        return this.authorized(request);
+    }
+
+    private async authorized(request : Request) : Promise<boolean> {
+        if (!this.authenticator || !request.user) return true;
+
+        const permitted = await this.authenticator.authorize(request.user, request.raw, request.rawResponse);
+        if (!permitted) {
+            if (!request.handled) request.reply(403, { error: "Not authorized" });
+            return false;
+        }
+        return true;
+    }
+
+}
+
+export { AuthenticationMiddleware };
+export type { OpenRequestPredicate };

package/src/hosting/middleware/SessionMiddleware.ts

@@ -0,0 +1,21 @@
+import {SESSION_COOKIE} from "../../auth/Authenticator";
+import {Middleware} from "../Middleware";
+import {Request} from "../Request";
+
+class SessionMiddleware implements Middleware {
+
+    async apply(request : Request) : Promise<boolean> {
+        const cookies = String(request.header("cookie") ?? "").split(";");
+        for (const cookie of cookies) {
+            const [name, ...value] = cookie.trim().split("=");
+            if (name === SESSION_COOKIE) {
+                request.session = value.join("=");
+                break;
+            }
+        }
+        return true;
+    }
+
+}
+
+export { SessionMiddleware }

package/src/index.ts

@@ -23,7 +23,27 @@ export * from "./data-store/PostgresJsonStore";
 export * from "./data-store/Schema";
 export * from "./data-store/SecretsManagerSecretStore";
 export * from "./hosting/HostingServer";
+export * from "./hosting/Middleware";
+export * from "./hosting/Request";
+export * from "./hosting/RequestHandler";
 export * from "./hosting/Router";
+export * from "./hosting/Server";
+export * from "./hosting/middleware/AuthenticationMiddleware";
+export * from "./hosting/middleware/SessionMiddleware";
+export * from "./hosting/handlers/AppProxyHandler";
+export * from "./hosting/handlers/AppsHandler";
+export * from "./hosting/handlers/AuditsHandler";
+export * from "./hosting/handlers/ConsumersHandler";
+export * from "./hosting/handlers/DocumentsHandler";
+export * from "./hosting/handlers/JobsHandler";
+export * from "./hosting/handlers/PagesHandler";
+export * from "./hosting/handlers/PingHandler";
+export * from "./hosting/handlers/QueueHandler";
+export * from "./hosting/handlers/SecretsHandler";
+export * from "./hosting/handlers/StateMachinesHandler";
+export * from "./hosting/handlers/auth/AuthorizeCliHandler";
+export * from "./hosting/handlers/auth/KeysHandler";
+export * from "./hosting/handlers/auth/WhoamiHandler";
 export * from "./queuing/ConfirmableQueue";
 export * from "./queuing/ConsumerRegistry";
 export * from "./queuing/Dispatcher";