anbaric-cloud-hosting 1.41.0 → 1.43.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.41.0",
+  "version": "1.43.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,18 +18,18 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.41.0",
-    "anbaric-plugins": "^1.41.0",
-    "anbaric-tsapi": "^1.41.0",
-    "anbaric-web": "^1.41.0",
+    "anbaric-data-store": "^1.43.0",
+    "anbaric-plugins": "^1.43.0",
+    "anbaric-tsapi": "^1.43.0",
+    "anbaric-web": "^1.43.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.41.0",
-    "anbaric-state-machine": "^1.41.0",
+    "anbaric-impl-cloud": "^1.43.0",
+    "anbaric-state-machine": "^1.43.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/auth/CliKey.ts

@@ -1,3 +1,5 @@
+import {TenantRole} from "./TenantRole";
+
 class CliKey {
 
     readonly id : string;
@@ -5,16 +7,20 @@ class CliKey {
     readonly clientName : string;
     readonly publicKey : string;
     readonly tenant? : string;
+    // The role the key's owner held in that tenant when it was issued; the
+    // platform re-reads it on every lookup, so a demotion takes effect at once.
+    readonly tenantRole? : TenantRole;
     readonly createdAt : Date;
 
     constructor(id : string, userId : string, clientName : string, publicKey : string,
-                tenant? : string, createdAt : Date = new Date()) {
+                tenant? : string, createdAt : Date = new Date(), tenantRole? : TenantRole) {
         this.id = id;
         this.userId = userId;
         this.clientName = clientName;
         this.publicKey = publicKey;
         this.tenant = tenant;
         this.createdAt = createdAt;
+        this.tenantRole = tenantRole;
     }
 
 }

package/src/auth/HttpCliKeyStore.ts

@@ -1,5 +1,6 @@
 import {CliKey} from "./CliKey";
 import {CliKeyStore} from "./CliKeyStore";
+import {TenantRole} from "./TenantRole";
 
 type FetchFn = (url : string, init : RequestInit) => Promise<Response>;
 
@@ -44,8 +45,10 @@ class HttpCliKeyStore implements CliKeyStore {
         if (response.status === 404) return undefined;
         if (!response.ok) throw new Error(`The key lookup failed with status ${response.status}`);
 
-        const found = await response.json() as { userId : string, clientName? : string, publicKey : string, tenant? : string };
-        return new CliKey(id, found.userId, found.clientName ?? "", found.publicKey, found.tenant ?? undefined);
+        const found = await response.json() as
+            { userId : string, clientName? : string, publicKey : string, tenant? : string, tenantRole? : TenantRole };
+        return new CliKey(id, found.userId, found.clientName ?? "", found.publicKey, found.tenant ?? undefined,
+            new Date(), found.tenantRole);
     }
 
 }

package/src/auth/HttpMembershipService.ts

@@ -1,40 +1,66 @@
 import {Inviter, MembershipService, PendingInvitation} from "./MembershipService";
+import {isTenantRole, TenantRole} from "./TenantRole";
 
 type FetchFn = (url : string, init : RequestInit) => Promise<Response>;
 
-/* Talks to the central login's invitation endpoints for one tenant, with the
-   same central api key the platform already holds for CLI key lookups. */
+const ROLE_CACHE_TTL_MS = 60_000;
+
+/* Talks to the central login about this one tenant, with the same central api
+   key the platform already holds for CLI key lookups. Roles are cached briefly
+   - every authenticated request asks for one, and a minute's staleness on a
+   role change is a fair trade for not calling central on each of them. */
 class HttpMembershipService implements MembershipService {
 
+    private roles = new Map<string, { role : TenantRole | undefined, expires : number }>();
+
     constructor(private centralUrl : string, private secret : string, private tenantSlug : string,
-                private fetchFn : FetchFn = (url, init) => fetch(url, init)) {}
+                private fetchFn : FetchFn = (url, init) => fetch(url, init),
+                private cacheTtlMs : number = ROLE_CACHE_TTL_MS) {}
+
+    async roleFor(userId : string) : Promise<TenantRole | undefined> {
+        const cached = this.roles.get(userId);
+        if (cached && cached.expires > Date.now()) return cached.role;
+
+        const response = await this.call("GET", `/members/${encodeURIComponent(userId)}`, undefined, [404]);
+        const role = response.status === 404
+            ? undefined
+            : (await response.json() as { role? : unknown }).role;
+        const found = isTenantRole(role) ? role : undefined;
+
+        this.roles.set(userId, { role: found, expires: Date.now() + this.cacheTtlMs });
+        return found;
+    }
 
-    async invite(email : string, invitedBy : Inviter) : Promise<PendingInvitation> {
-        const response = await this.call("POST", "", { email, invitedBy });
+    async invite(email : string, role : TenantRole, invitedBy : Inviter) : Promise<PendingInvitation> {
+        const response = await this.call("POST", "/invitations", { email, role, invitedBy });
         return await response.json() as PendingInvitation;
     }
 
-    async pending() : Promise<Array<PendingInvitation>> {
-        const response = await this.call("GET", "");
+    async pending(asking : Inviter) : Promise<Array<PendingInvitation>> {
+        const response = await this.call("GET", "/invitations", undefined, [], asking);
         return await response.json() as Array<PendingInvitation>;
     }
 
-    async revoke(token : string) : Promise<boolean> {
-        const response = await this.call("DELETE", `/${encodeURIComponent(token)}`, undefined, [404]);
+    async revoke(token : string, asking : Inviter) : Promise<boolean> {
+        const response = await this.call("DELETE", `/invitations/${encodeURIComponent(token)}`, undefined, [403, 404], asking);
         return response.status === 204;
     }
 
-    private async call(method : string, path : string, body? : unknown, tolerated : Array<number> = []) : Promise<Response> {
+    private async call(method : string, path : string, body? : unknown,
+                       tolerated : Array<number> = [], asking? : Inviter) : Promise<Response> {
         const headers : Record<string, string> = { "x-anbaric-central-key": this.secret };
         if (body !== undefined) headers["content-type"] = "application/json";
+        // Central checks the acting person's role, not just the api key, so who
+        // is asking travels on every call that is not already carrying them.
+        if (asking) headers["x-anbaric-user"] = asking.id;
 
         const response = await this.fetchFn(
-            `${this.centralUrl.replace(/\/$/, "")}/tenants/${encodeURIComponent(this.tenantSlug)}/invitations${path}`,
+            `${this.centralUrl.replace(/\/$/, "")}/tenants/${encodeURIComponent(this.tenantSlug)}${path}`,
             { method, headers, body: body === undefined ? undefined : JSON.stringify(body) });
 
         if (! response.ok && ! tolerated.includes(response.status)) {
             const problem = await response.json().catch(() => ({})) as { error? : string };
-            throw new Error(problem.error ?? `The invitation request failed with status ${response.status}`);
+            throw new Error(problem.error ?? `The request to the central login failed with status ${response.status}`);
         }
         return response;
     }

package/src/auth/InMemoryMembershipService.ts

@@ -1,19 +1,29 @@
 import {randomUUID} from "node:crypto";
 import {Inviter, MembershipService, PendingInvitation} from "./MembershipService";
+import {canInvite, TenantRole} from "./TenantRole";
 
 class InMemoryMembershipService implements MembershipService {
 
     private invitations = new Map<string, PendingInvitation>();
+    private members = new Map<string, TenantRole>();
 
     constructor(private linkBase : string = "http://localhost/invitations") {}
 
-    async invite(email : string, invitedBy : Inviter) : Promise<PendingInvitation> {
+    add(userId : string, role : TenantRole) : void {
+        this.members.set(userId, role);
+    }
+
+    async roleFor(userId : string) : Promise<TenantRole | undefined> {
+        return this.members.get(userId);
+    }
+
+    async invite(email : string, role : TenantRole, invitedBy : Inviter) : Promise<PendingInvitation> {
         const token = randomUUID();
         const now = new Date();
         const invitation : PendingInvitation = {
             token,
             email: email.trim().toLowerCase(),
-            role: "member",
+            role,
             invitedBy: invitedBy.id,
             invitedByName: invitedBy.name,
             link: `${this.linkBase}/${token}`,
@@ -25,11 +35,13 @@ class InMemoryMembershipService implements MembershipService {
         return { ...invitation };
     }
 
-    async pending() : Promise<Array<PendingInvitation>> {
+    async pending(asking : Inviter) : Promise<Array<PendingInvitation>> {
+        if (! canInvite(this.members.get(asking.id))) return [];
         return Array.from(this.invitations.values()).map(invitation => ({ ...invitation })).reverse();
     }
 
-    async revoke(token : string) : Promise<boolean> {
+    async revoke(token : string, asking : Inviter) : Promise<boolean> {
+        if (! canInvite(this.members.get(asking.id))) return false;
         return this.invitations.delete(token);
     }
 

package/src/auth/MembershipService.ts

@@ -1,8 +1,10 @@
+import {TenantRole} from "./TenantRole";
+
 type PendingInvitation = {
 
     token : string,
     email : string,
-    role : string,
+    role : TenantRole,
     invitedBy : string,
     invitedByName? : string,
     link : string,
@@ -19,16 +21,19 @@ type Inviter = {
 
 };
 
-/* Invitations into this tenant. Membership itself is decided wherever people
-   sign in (Anbaric Cloud's central login), so a platform only asks that
-   service to invite, list and revoke on the tenant's behalf. */
+/* Who belongs to this tenant and as what, and the invitations that get them
+   here. Membership is decided wherever people sign in (Anbaric Cloud's central
+   login), which owns the tenant definitions; a platform asks it who its caller
+   is, and asks it to invite, list and revoke on the tenant's behalf. */
 interface MembershipService {
 
-    invite(email : string, invitedBy : Inviter) : Promise<PendingInvitation>;
+    roleFor(userId : string) : Promise<TenantRole | undefined>;
+
+    invite(email : string, role : TenantRole, invitedBy : Inviter) : Promise<PendingInvitation>;
 
-    pending() : Promise<Array<PendingInvitation>>;
+    pending(asking : Inviter) : Promise<Array<PendingInvitation>>;
 
-    revoke(token : string) : Promise<boolean>;
+    revoke(token : string, asking : Inviter) : Promise<boolean>;
 
 }
 

package/src/auth/SessionSigner.ts

@@ -3,6 +3,7 @@ import {ServerResponse} from "node:http";
 import {SESSION_COOKIE} from "./Authenticator";
 import {Role} from "./Role";
 import {Tenant} from "./Tenant";
+import {TenantRole, isTenantRole} from "./TenantRole";
 import {User} from "./User";
 
 const DEFAULT_TTL_SECONDS = 30 * 24 * 60 * 60;
@@ -43,6 +44,7 @@ class SessionSigner {
             name: user.name,
             picture: user.picture,
             email: user.email,
+            tenantRole: user.tenantRole,
             exp: nowSeconds() + this.ttlSeconds,
         };
         const payload = base64url(JSON.stringify(claims));
@@ -55,7 +57,7 @@ class SessionSigner {
         const [payload, signature] = token.split(".");
         if (!payload || !signature || !this.signatureMatches(payload, signature)) return undefined;
 
-        let claims : { sub? : unknown, tenant? : unknown, roles? : unknown, name? : unknown, picture? : unknown, email? : unknown, exp? : unknown };
+        let claims : { sub? : unknown, tenant? : unknown, roles? : unknown, name? : unknown, picture? : unknown, email? : unknown, tenantRole? : unknown, exp? : unknown };
         try {
             claims = JSON.parse(Buffer.from(payload, "base64url").toString());
         } catch {
@@ -70,7 +72,8 @@ class SessionSigner {
         const name = typeof claims.name === "string" ? claims.name : undefined;
         const picture = typeof claims.picture === "string" ? claims.picture : undefined;
         const email = typeof claims.email === "string" ? claims.email : undefined;
-        return [new User(claims.sub, roles, [], name, picture, email), tenant];
+        const tenantRole = isTenantRole(claims.tenantRole) ? claims.tenantRole as TenantRole : undefined;
+        return [new User(claims.sub, roles, [], name, picture, email, tenantRole), tenant];
     }
 
     // Sets (or, for a still-valid session, refreshes) the session cookie.

package/src/auth/TenantRole.ts

@@ -0,0 +1,28 @@
+/* What a person may do in the tenant this platform serves. The roles are
+   assigned in Anbaric Cloud's central login, which owns the tenant definitions
+   and the user-to-tenant mapping; the platform only enforces them. */
+type TenantRole = "OWNER" | "ADMIN" | "BUILDER" | "USER";
+
+const TENANT_ROLES : Array<TenantRole> = ["OWNER", "ADMIN", "BUILDER", "USER"];
+
+const isTenantRole = (value : unknown) : value is TenantRole =>
+    typeof value === "string" && TENANT_ROLES.includes(value as TenantRole);
+
+/* Inviting and revoking members - administering who else is in the tenant. */
+const canInvite = (role : TenantRole | undefined) : boolean =>
+    role === "OWNER" || role === "ADMIN";
+
+/* Deploying and tearing down apps, and minting the CLI keypairs that do it.
+   A USER can use the tenant's console and its apps, but cannot change them. */
+const canBuild = (role : TenantRole | undefined) : boolean =>
+    role === "OWNER" || role === "ADMIN" || role === "BUILDER";
+
+/* A platform with no membership service in play - a local or unmanaged
+   install - resolves no roles at all, and there every caller is allowed, as
+   they were before roles existed. Where one is in play the authentication
+   middleware has already refused anyone with no membership, so an undefined
+   role at a handler means only that roles are not being enforced here. */
+const deniesBuild = (role : TenantRole | undefined) : boolean => role !== undefined && ! canBuild(role);
+
+export { TENANT_ROLES, isTenantRole, canInvite, canBuild, deniesBuild };
+export type { TenantRole };

package/src/auth/TokenAuthenticator.ts

@@ -37,7 +37,7 @@ class TokenAuthenticator {
         if (this.tenant && key.tenant && key.tenant !== this.tenant) return undefined;
         if (!this.signatureValid(headerPart, payloadPart, signaturePart, key.publicKey)) return undefined;
 
-        return new User(key.userId);
+        return new User(key.userId, [], [], undefined, undefined, undefined, key.tenantRole);
     }
 
     private signatureValid(headerPart : string, payloadPart : string, signaturePart : string,

package/src/auth/User.ts

@@ -1,5 +1,6 @@
 import {KeyPair} from "./KeyPair";
 import {Role} from "./Role";
+import {TenantRole} from "./TenantRole";
 
 class User {
 
@@ -9,15 +10,20 @@ class User {
     readonly name? : string;
     readonly picture? : string;
     readonly email? : string;
+    // What this person may do in the tenant they are signed in to. Kept apart
+    // from `roles`, which are the identity provider's and are what an app's own
+    // authorization matches on - a platform capability is not a domain role.
+    tenantRole? : TenantRole;
 
     constructor(id : string, roles : Array<Role> = [], keyPairs : Array<KeyPair> = [],
-                name? : string, picture? : string, email? : string) {
+                name? : string, picture? : string, email? : string, tenantRole? : TenantRole) {
         this.id = id;
         this.roles = roles;
         this.keyPairs = keyPairs;
         this.name = name;
         this.picture = picture;
         this.email = email;
+        this.tenantRole = tenantRole;
     }
 
     hasRole(role : Role) : boolean {

package/src/hosting/HostingServer.ts

@@ -141,7 +141,7 @@ class HostingServer {
 
         this.publicServer = new Server(publicRouter, [
             new SessionMiddleware(),
-            new AuthenticationMiddleware(authenticator, tokenAuthenticator, openRequests, undefined, userDirectory),
+            new AuthenticationMiddleware(authenticator, tokenAuthenticator, openRequests, undefined, userDirectory, memberships),
         ]);
         this.internalServer = new Server(internalRouter);
     }

package/src/hosting/handlers/AppsHandler.ts

@@ -1,4 +1,5 @@
 import {BuildLayer} from "../../app-management/BuildLayer";
+import {deniesBuild} from "../../auth/TenantRole";
 import {Request} from "../Request";
 import {RequestHandler} from "../RequestHandler";
 
@@ -7,6 +8,11 @@ class AppsHandler implements RequestHandler {
     constructor(private buildLayer : BuildLayer) {}
 
     async handle(request : Request) : Promise<void> {
+        // Changing what is deployed is a builder's job; a USER may look.
+        if (this.changesApps(request) && deniesBuild(request.user?.tenantRole)) {
+            return request.reply(403, { error: "Your role in this tenant cannot deploy or remove apps" });
+        }
+
         await this.buildLayer.ensureHydrated();
         switch (request.subresource) {
             case "deploy":
@@ -25,6 +31,11 @@ class AppsHandler implements RequestHandler {
         request.notFound();
     }
 
+    private changesApps(request : Request) : boolean {
+        if (request.subresource === "deploy" || request.subresource === "docs") return true;
+        return request.subresource === undefined && request.method === "DELETE";
+    }
+
     private async handleDocs(request : Request, appName : string) : Promise<void> {
         if (request.method !== "POST") return request.notFound();
         try {

package/src/hosting/handlers/auth/AuthorizeCliHandler.ts

@@ -1,5 +1,6 @@
 import {CliAuthorizer} from "../../../auth/CliAuthorizer";
 import {User} from "../../../auth/User";
+import {deniesBuild} from "../../../auth/TenantRole";
 import {Request} from "../../Request";
 import {RequestHandler} from "../../RequestHandler";
 import {PagesHandler} from "../PagesHandler";
@@ -40,8 +41,15 @@ class AuthorizeCliHandler implements RequestHandler {
         if (typeof clientName !== "string" || clientName.trim().length === 0) {
             return request.reply(400, { error: "Expected a body of { clientName : string }" });
         }
+        // A key deploys as its owner, so only someone who may deploy may mint one.
+        if (deniesBuild(request.user?.tenantRole)) {
+            return request.reply(403, { error: "Your role in this tenant cannot create keys" });
+        }
+
+        // The tenant is this platform's own: what it is deployed as, which is
+        // the slug the edge routes on and the CLI is later checked against.
         await this.authorizer.approve(requestId, clientName.trim(), request.user ?? new User("local"),
-            request.tenant?.id ?? this.tenant);
+            this.tenant ?? request.tenant?.id);
         request.reply(204);
     }
 

package/src/hosting/handlers/auth/InvitationsHandler.ts

@@ -1,4 +1,5 @@
 import {MembershipService} from "../../../auth/MembershipService";
+import {canInvite, isTenantRole} from "../../../auth/TenantRole";
 import {Request} from "../../Request";
 import {RequestHandler} from "../../RequestHandler";
 
@@ -11,22 +12,38 @@ class InvitationsHandler implements RequestHandler {
     constructor(private memberships : MembershipService) {}
 
     async handle(request : Request) : Promise<void> {
-        if (request.method === "GET" && ! request.id) return request.reply(200, await this.memberships.pending());
+        // Only a tenant's owner or admin administers its membership. Central
+        // checks this too - it is the authority - but refusing here keeps the
+        // console honest and gives a clear answer without a round trip.
+        if (! canInvite(request.user?.tenantRole)) {
+            return request.reply(403, { error: "Your role in this tenant cannot manage members" });
+        }
+
+        const asking = this.asking(request);
+        if (request.method === "GET" && ! request.id) return request.reply(200, await this.memberships.pending(asking));
         if (request.method === "POST" && ! request.id) return this.invite(request);
         if (request.method === "DELETE" && request.id && ! request.subresource) {
-            const revoked = await this.memberships.revoke(request.id);
+            const revoked = await this.memberships.revoke(request.id, asking);
             return revoked ? request.reply(204) : request.notFound();
         }
         request.notFound();
     }
 
+    private asking(request : Request) {
+        return request.user ? { id: request.user.id, name: request.user.name } : { id: "system" };
+    }
+
     private async invite(request : Request) : Promise<void> {
-        const body = await request.body() as { email? : string } | undefined;
+        const body = await request.body() as { email? : string, role? : string } | undefined;
         const email = String(body?.email ?? "").trim();
         if (! EMAIL_SHAPE.test(email)) return request.reply(400, { error: "A valid email address is required" });
 
-        const inviter = request.user ? { id: request.user.id, name: request.user.name } : { id: "system" };
-        request.reply(201, await this.memberships.invite(email, inviter));
+        const role = body?.role ?? "USER";
+        if (! isTenantRole(role) || role === "OWNER") {
+            return request.reply(400, { error: "Invite someone as an ADMIN, BUILDER or USER" });
+        }
+
+        request.reply(201, await this.memberships.invite(email, role, this.asking(request)));
     }
 
 }

package/src/hosting/handlers/auth/WhoamiHandler.ts

@@ -14,6 +14,7 @@ class WhoamiHandler implements RequestHandler {
                 roles: request.user.roles.map(role => role.id),
                 name: request.user.name,
                 picture: request.user.picture,
+                tenantRole: request.user.tenantRole,
                 tenant: this.tenant ?? request.tenant?.id,
             });
         }

package/src/hosting/middleware/AuthenticationMiddleware.ts

@@ -3,6 +3,7 @@ import {SessionSigner} from "../../auth/SessionSigner";
 import {TokenAuthenticator} from "../../auth/TokenAuthenticator";
 import {User} from "../../auth/User";
 import {UserDirectory} from "../../auth/UserDirectory";
+import {MembershipService} from "../../auth/MembershipService";
 import {Middleware} from "../Middleware";
 import {Request} from "../Request";
 
@@ -26,7 +27,8 @@ class AuthenticationMiddleware implements Middleware {
                 private tokenAuthenticator? : TokenAuthenticator,
                 private isOpen : OpenRequestPredicate = () => false,
                 private sessionSigner : SessionSigner = new SessionSigner(),
-                private userDirectory? : UserDirectory) {}
+                private userDirectory? : UserDirectory,
+                private memberships? : MembershipService) {}
 
     async apply(request : Request) : Promise<boolean> {
         if (this.isOpen(request)) return true;
@@ -35,6 +37,7 @@ class AuthenticationMiddleware implements Middleware {
             const user = await this.tokenAuthenticator.authenticate(request.raw, request.rawResponse);
             if (!user) return false;
             request.user = user;
+            if (! await this.admitted(request)) return false;
             return this.authorized(request);
         }
 
@@ -42,6 +45,7 @@ class AuthenticationMiddleware implements Middleware {
             const session = this.sessionSigner.verify(request.session);
             if (session) {
                 [request.user, request.tenant] = session;
+                if (! await this.admitted(request)) return false;
                 this.sessionSigner.issue(request.rawResponse, request.user!, request.tenant);
                 await this.remember(request.user!);
                 return this.authorized(request);
@@ -63,6 +67,7 @@ class AuthenticationMiddleware implements Middleware {
         if (!authenticated) return false;
 
         [request.user, request.tenant] = authenticated;
+        if (! await this.admitted(request)) return false;
         if (this.sessionSigner.configured && !request.handled) {
             this.sessionSigner.issue(request.rawResponse, request.user!, request.tenant);
         }
@@ -70,6 +75,26 @@ class AuthenticationMiddleware implements Middleware {
         return this.authorized(request);
     }
 
+    /* Membership in this tenant is what admits a browser session at all, and
+       the role it carries is what the handlers gate on. A platform with no
+       membership service - a local or unmanaged install - admits everyone, as
+       it always has. Central being unreachable must not lock the tenant out,
+       so a lookup that throws is left to the handlers to refuse. */
+    private async admitted(request : Request) : Promise<boolean> {
+        if (! this.memberships || ! request.user) return true;
+
+        try {
+            request.user.tenantRole = await this.memberships.roleFor(request.user.id);
+        } catch (error) {
+            console.error(`[membership] could not resolve a role for "${request.user.id}":`, error);
+            return true;
+        }
+
+        if (request.user.tenantRole) return true;
+        if (! request.handled) request.reply(403, { error: "You are not a member of this tenant" });
+        return false;
+    }
+
     private async remember(user : User) : Promise<void> {
         if (! this.userDirectory) return;