anbaric-cloud-hosting 1.44.0 → 1.46.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.44.0",
+  "version": "1.46.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,18 +18,18 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.44.0",
-    "anbaric-plugins": "^1.44.0",
-    "anbaric-tsapi": "^1.44.0",
-    "anbaric-web": "^1.44.0",
+    "anbaric-data-store": "^1.46.0",
+    "anbaric-plugins": "^1.46.0",
+    "anbaric-tsapi": "^1.46.0",
+    "anbaric-web": "^1.46.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.44.0",
-    "anbaric-state-machine": "^1.44.0",
+    "anbaric-impl-cloud": "^1.46.0",
+    "anbaric-state-machine": "^1.46.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/data-store/Schema.ts

@@ -2,39 +2,13 @@ import {Pool} from "pg";
 import {migrate} from "./Migrations";
 import {PLATFORM_MIGRATIONS} from "./PlatformMigrations";
 
-/* Brings the database up to date at boot, then settles the app's SQL role.
-   The role is not a migration: its password comes from the environment and may
-   be rotated, so it is re-applied every time rather than recorded as done. */
+/* Brings the database up to date at boot. The platform owns its own database
+   and nothing else: app data lives in a separate cluster, and the role that
+   reaches it is created alongside that database rather than here, so the
+   platform never holds a credential that can make roles. */
 const ensureSchema = async (pool : Pool) : Promise<void> => {
     const applied = await migrate(pool, PLATFORM_MIGRATIONS);
     if (applied.length > 0) console.log(`Applied ${applied.length} migration(s): ${applied.join(", ")}`);
-
-    await ensureAppRole(pool);
-};
-
-/* The shared SQL store for apps: a dedicated schema plus a login role scoped
-   to it, so deployed apps reach only anbaric_app_data - never the platform's
-   public (jobs/documents/queue) or anbaric_system schemas. */
-const ensureAppRole = async (pool : Pool) : Promise<void> => {
-    const appSqlSchema = process.env.ANBARIC_SQL_SCHEMA ?? "anbaric_app_data";
-    if (! /^[a-z_][a-z0-9_]*$/i.test(appSqlSchema)) throw new Error(`Invalid ANBARIC_SQL_SCHEMA "${appSqlSchema}"`);
-    await pool.query(`CREATE SCHEMA IF NOT EXISTS ${appSqlSchema}`);
-
-    const appDbPassword = process.env.ANBARIC_APP_DB_PASSWORD;
-    if (! appDbPassword) return;
-
-    await pool.query(`DO $$ BEGIN
-        IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'anbaric_app') THEN CREATE ROLE anbaric_app LOGIN; END IF;
-    END $$`);
-    await pool.query(`ALTER ROLE anbaric_app LOGIN PASSWORD '${appDbPassword.replace(/'/g, "''")}'`);
-    await pool.query(`ALTER ROLE anbaric_app SET search_path TO ${appSqlSchema}`);
-    await pool.query(`GRANT USAGE, CREATE ON SCHEMA ${appSqlSchema} TO anbaric_app`);
-    await pool.query(`GRANT ALL ON ALL TABLES IN SCHEMA ${appSqlSchema} TO anbaric_app`);
-    await pool.query(`GRANT ALL ON ALL SEQUENCES IN SCHEMA ${appSqlSchema} TO anbaric_app`);
-    await pool.query(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${appSqlSchema} GRANT ALL ON TABLES TO anbaric_app`);
-    await pool.query(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${appSqlSchema} GRANT ALL ON SEQUENCES TO anbaric_app`);
-    await pool.query("REVOKE ALL ON SCHEMA public FROM anbaric_app");
-    await pool.query("REVOKE ALL ON SCHEMA anbaric_system FROM anbaric_app");
 };
 
 export { ensureSchema }

package/src/hosting/HostingServer.ts

@@ -37,6 +37,7 @@ import {StateMachinesHandler} from "./handlers/StateMachinesHandler";
 import {PluginsHandler} from "./handlers/PluginsHandler";
 import {AuthenticationMiddleware} from "./middleware/AuthenticationMiddleware";
 import {SessionMiddleware} from "./middleware/SessionMiddleware";
+import {TenantRoutingMiddleware} from "./middleware/TenantRoutingMiddleware";
 import {LoadedPlugin} from "../plugins/Plugin";
 import {Request} from "./Request";
 import {Router} from "./Router";
@@ -141,6 +142,7 @@ class HostingServer {
 
         this.publicServer = new Server(publicRouter, [
             new SessionMiddleware(),
+            new TenantRoutingMiddleware(tenant),
             new AuthenticationMiddleware(authenticator, tokenAuthenticator, openRequests, undefined, userDirectory, memberships),
         ]);
         this.internalServer = new Server(internalRouter);

package/src/hosting/middleware/TenantRoutingMiddleware.ts

@@ -0,0 +1,29 @@
+import {Middleware} from "../Middleware";
+import {Request} from "../Request";
+
+/* Many tenants share one load balancer, which picks between them on the
+   x-anbaric-tenant header. If a request arrives here naming a different tenant,
+   something upstream is wrong - a listener rule with the wrong condition, a
+   duplicated priority, a slug reused before its old rule was removed. Nothing
+   is lost when that happens, because a session signed by another tenant fails
+   verification here anyway, but it fails silently and looks like being logged
+   out. Answering 421 turns it into a named, countable error instead.
+
+   A request that names no tenant passes: the header is optional, and an
+   unmanaged platform has no tenant of its own to compare against. */
+class TenantRoutingMiddleware implements Middleware {
+
+    constructor(private tenant : string | undefined) {}
+
+    async apply(request : Request) : Promise<boolean> {
+        const claimed = String(request.header("x-anbaric-tenant") ?? "").trim();
+        if (! this.tenant || ! claimed || claimed === this.tenant) return true;
+
+        console.error(`[routing] a request for tenant "${claimed}" reached the platform for "${this.tenant}"`);
+        request.reply(421, { error: `This platform does not serve tenant "${claimed}"` });
+        return false;
+    }
+
+}
+
+export { TenantRoutingMiddleware }