anbaric-cloud-hosting 1.60.0 → 1.62.0

package/src/hosting/handlers/AppsHandler.ts

@@ -2,11 +2,14 @@ import {BuildLayer} from "../../app-management/BuildLayer";
 import {deniesBuild} from "../../auth/TenantRole";
 import {Request} from "../Request";
 import {hostnameObjection} from "../../app-management/appHostname";
+import {appAddress} from "../../app-management/appAddress";
 import {RequestHandler} from "../RequestHandler";
+import {Subdomains} from "../../subdomains/Subdomains";
 
 class AppsHandler implements RequestHandler {
 
-    constructor(private buildLayer : BuildLayer, private tenant? : string) {}
+    constructor(private buildLayer : BuildLayer, private tenant? : string,
+                private subdomains? : Subdomains) {}
 
     async handle(request : Request) : Promise<void> {
         // Changing what is deployed is a builder's job; a USER may look.
@@ -25,6 +28,9 @@ class AppsHandler implements RequestHandler {
             case "docs":
                 if (request.id) return this.handleDocs(request, request.id);
                 break;
+            case "subdomain":
+                if (request.id) return this.handleSubdomain(request, request.id);
+                break;
             case undefined:
                 if (request.id) return this.handleApp(request, request.id);
                 return this.handleCollection(request);
@@ -34,9 +40,30 @@ class AppsHandler implements RequestHandler {
 
     private changesApps(request : Request) : boolean {
         if (request.subresource === "deploy" || request.subresource === "docs") return true;
+        if (request.subresource === "subdomain") return request.method === "PUT";
         return request.subresource === undefined && request.method === "DELETE";
     }
 
+    /* Where an app answers, which is a builder's to change. The address itself
+       is the control plane's to agree, so a name already taken comes back from
+       there as a refusal and is passed on as one. */
+    private async handleSubdomain(request : Request, appName : string) : Promise<void> {
+        if (request.method !== "PUT") return request.notFound();
+        if (! this.subdomains) {
+            return request.reply(409, { error: "This platform does not give its apps addresses of their own" });
+        }
+        if (! this.buildLayer.status(appName)) return request.reply(404, { error: `No app named "${appName}"` });
+
+        const body = await request.body() as { subdomain? : string } | undefined;
+        const wanted = String(body?.subdomain ?? "").trim().toLowerCase();
+
+        try {
+            return request.reply(200, await this.subdomains.set(appName, wanted));
+        } catch (error) {
+            return request.reply(409, { error: error instanceof Error ? error.message : "That address is not available" });
+        }
+    }
+
     private async handleDocs(request : Request, appName : string) : Promise<void> {
         if (request.method !== "POST") return request.notFound();
         try {
@@ -55,7 +82,7 @@ class AppsHandler implements RequestHandler {
                    part of a hostname would deploy happily and then simply not
                    be reachable by its own address, which is a worse thing to
                    discover later. */
-                const objection = hostnameObjection(appName, this.tenant ?? "");
+                const objection = hostnameObjection(appName);
                 if (objection) return request.reply(400, { error: objection });
 
                 const appPort = Number(request.query("port"));
@@ -64,7 +91,19 @@ class AppsHandler implements RequestHandler {
                 }
                 const tarball = await request.rawBody();
                 if (tarball.length === 0) return request.reply(400, { error: "Expected a gzipped tarball body" });
-                return request.reply(202, this.buildLayer.deploy(appName, appPort, tarball));
+
+                const summary = this.buildLayer.deploy(appName, appPort, tarball);
+
+                /* An address is asked for alongside the build rather than
+                   after it: allocation is idempotent, so a redeploy costs
+                   nothing, and a first deploy has its address ready by the
+                   time the app is up. */
+                const address = await this.subdomains?.allocate(appName);
+                return request.reply(202, {
+                    ...summary,
+                    subdomain: address?.subdomain,
+                    url: appAddress(appName, address?.subdomain),
+                });
             }
         }
         request.notFound();
@@ -76,11 +115,15 @@ class AppsHandler implements RequestHandler {
                 const status = this.buildLayer.status(appName);
                 if (!status) return request.reply(404, { error: `No app named "${appName}"` });
                 const live = await this.buildLayer.ping(appName);
-                return request.reply(200, { ...status, live });
+                const subdomain = await this.addressOf(appName);
+                return request.reply(200, { ...status, live, subdomain, url: appAddress(appName, subdomain) });
             }
             case "DELETE": {
                 const outcome = await this.buildLayer.teardown(appName);
                 if (!outcome) return request.reply(404, { error: `No app named "${appName}"` });
+
+                // The address is let go by the build layer's appRemoved hook,
+                // which an app that drains reaches minutes after this returns.
                 return request.reply(200, outcome);
             }
         }
@@ -129,12 +172,28 @@ class AppsHandler implements RequestHandler {
 
     private async handleCollection(request : Request) : Promise<void> {
         switch (request.method) {
-            case "GET":
-                return request.reply(200, this.buildLayer.list());
+            case "GET": {
+                const addresses = new Map((await this.addresses()).map(held => [held.appName, held.subdomain]));
+                return request.reply(200, this.buildLayer.list().map(app => {
+                    const subdomain = addresses.get(app.appName);
+                    return { ...app, subdomain, url: appAddress(app.appName, subdomain) };
+                }));
+            }
         }
         request.notFound();
     }
 
+    private async addressOf(appName : string) : Promise<string | undefined> {
+        return (await this.addresses()).find(held => held.appName === appName)?.subdomain;
+    }
+
+    /* An address is the control plane's to know, so a platform without one -
+       self-hosted, or local - simply has none, and the console falls back to
+       serving its apps by path. */
+    private async addresses() {
+        return this.subdomains ? this.subdomains.all() : [];
+    }
+
 }
 
 export { AppsHandler }

package/src/hosting/handlers/MyAppsHandler.ts

@@ -0,0 +1,48 @@
+import {BuildLayer} from "../../app-management/BuildLayer";
+import {appAddress} from "../../app-management/appAddress";
+import {EntitlementStore} from "../../data-store/EntitlementStore";
+import {Subdomains} from "../../subdomains/Subdomains";
+import {Request} from "../Request";
+import {RequestHandler} from "../RequestHandler";
+
+/* The entitlement that says a person may open an app at all. The platform
+   seeds it as a global definition, so it exists in every tenant from the first
+   migration and nobody has to create it. Granted globally it means every app;
+   granted against one app it means that app. */
+const ACCESS = "access";
+
+/* The apps this person may open, which is what the directory shows someone who
+   is not a builder. The same question Entitlements.has answers one app at a
+   time, asked once for the whole list. */
+class MyAppsHandler implements RequestHandler {
+
+    constructor(private buildLayer : BuildLayer, private entitlements : EntitlementStore,
+                private subdomains? : Subdomains) {}
+
+    async handle(request : Request) : Promise<void> {
+        if (request.method !== "GET" || request.id) return request.notFound();
+        if (! request.user) return request.reply(401, { error: "You are not signed in" });
+
+        await this.buildLayer.ensureHydrated();
+
+        const grants = (await this.entitlements.listGrants(request.user.id))
+            .filter(grant => grant.entitlementId === ACCESS);
+        const everyApp = grants.some(grant => grant.appId === null);
+        const named = new Set(grants.map(grant => grant.appId));
+
+        const addresses = new Map(
+            (this.subdomains ? await this.subdomains.all() : []).map(held => [held.appName, held.subdomain]));
+
+        request.reply(200, this.buildLayer.list()
+            .filter(app => everyApp || named.has(app.appName))
+            .map(app => ({
+                appName: app.appName,
+                status: app.status,
+                subdomain: addresses.get(app.appName),
+                url: appAddress(app.appName, addresses.get(app.appName)),
+            })));
+    }
+
+}
+
+export { MyAppsHandler, ACCESS };

package/src/hosting/handlers/auth/InvitationsHandler.ts

@@ -1,4 +1,5 @@
 import {MembershipService} from "../../../auth/MembershipService";
+import {EntitlementOffer, EntitlementStore} from "../../../data-store/EntitlementStore";
 import {canInvite, isTenantRole} from "../../../auth/TenantRole";
 import {Request} from "../../Request";
 import {RequestHandler} from "../../RequestHandler";
@@ -6,10 +7,17 @@ import {RequestHandler} from "../../RequestHandler";
 const EMAIL_SHAPE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 
 /* The console's side of inviting people into this tenant: list what is
-   pending, invite by email (attributed to the signed-in user), revoke. */
+   pending, invite by email (attributed to the signed-in user), revoke.
+
+   An invitation may also carry the app it should open on and the entitlements
+   the inviter picked out for whoever accepts it. The two are kept apart on
+   purpose: the landing app travels to the control plane, which owns the
+   invitation and the addresses, while the entitlements stay here, because
+   grants are the platform's and are held against the email address until
+   that person first signs in. */
 class InvitationsHandler implements RequestHandler {
 
-    constructor(private memberships : MembershipService) {}
+    constructor(private memberships : MembershipService, private entitlements? : EntitlementStore) {}
 
     async handle(request : Request) : Promise<void> {
         // Only a tenant's owner or admin administers its membership. Central
@@ -34,7 +42,8 @@ class InvitationsHandler implements RequestHandler {
     }
 
     private async invite(request : Request) : Promise<void> {
-        const body = await request.body() as { email? : string, role? : string } | undefined;
+        const body = await request.body() as
+            { email? : string, role? : string, landingApp? : string, entitlements? : Array<unknown> } | undefined;
         const email = String(body?.email ?? "").trim();
         if (! EMAIL_SHAPE.test(email)) return request.reply(400, { error: "A valid email address is required" });
 
@@ -43,7 +52,38 @@ class InvitationsHandler implements RequestHandler {
             return request.reply(400, { error: "Invite someone as an ADMIN, BUILDER or USER" });
         }
 
-        request.reply(201, await this.memberships.invite(email, role, this.asking(request)));
+        const landingApp = typeof body?.landingApp === "string" && body.landingApp.trim()
+            ? body.landingApp.trim()
+            : undefined;
+
+        const invitation = await this.memberships.invite(email, role, this.asking(request), landingApp);
+
+        /* Put aside after the invitation exists, so nothing is held for an
+           email that was never actually invited. */
+        const chosen = this.chosenEntitlements(email, body?.entitlements);
+        if (chosen.length > 0 && this.entitlements) {
+            await this.entitlements.offer(chosen, request.user?.id ?? "system");
+        }
+
+        request.reply(201, { ...invitation, entitlements: chosen.length });
+    }
+
+    // Each is an app and an entitlement, with a null app meaning every app -
+    // the same scoping a grant already has.
+    private chosenEntitlements(email : string, chosen : Array<unknown> | undefined) : Array<EntitlementOffer> {
+        if (! Array.isArray(chosen)) return [];
+
+        return chosen.flatMap(each => {
+            const offer = each as { appId? : unknown, entitlementId? : unknown };
+            if (typeof offer?.entitlementId !== "string" || ! offer.entitlementId) return [];
+
+            return [{
+                email,
+                appId: typeof offer.appId === "string" && offer.appId ? offer.appId : null,
+                entitlementId: offer.entitlementId,
+                notes: "",
+            }];
+        });
     }
 
 }

package/src/hosting/middleware/AuthenticationMiddleware.ts

@@ -23,6 +23,14 @@ class AuthenticationMiddleware implements Middleware {
 
     private recorded = new Map<string, number>();
 
+    /* Anything owed to this person that could only be arranged against their
+       email address, because until now they had no user id - entitlements an
+       inviter chose for them before they ever arrived. Injected rather than
+       named here: the middleware's business is who someone is, not what they
+       are owed. Called where the directory first records them, which is that
+       moment, and safe to call again because claiming twice claims nothing. */
+    claimWhatIsOwed : (user : User) => Promise<void> = async () => {};
+
     constructor(private authenticator? : Authenticator,
                 private tokenAuthenticator? : TokenAuthenticator,
                 private isOpen : OpenRequestPredicate = () => false,
@@ -96,18 +104,25 @@ class AuthenticationMiddleware implements Middleware {
     }
 
     private async remember(user : User) : Promise<void> {
-        if (! this.userDirectory) return;
-
         const now = Date.now();
         const last = this.recorded.get(user.id) ?? 0;
         if (now - last < DIRECTORY_REFRESH_MS) return;
 
         this.recorded.set(user.id, now);
+
+        if (this.userDirectory) {
+            try {
+                await this.userDirectory.record(user);
+            } catch (error) {
+                this.recorded.delete(user.id);
+                console.error(`Could not record user "${user.id}" in the directory:`, error);
+            }
+        }
+
         try {
-            await this.userDirectory.record(user);
+            await this.claimWhatIsOwed(user);
         } catch (error) {
-            this.recorded.delete(user.id);
-            console.error(`Could not record user "${user.id}" in the directory:`, error);
+            console.error(`Could not claim what is owed to "${user.id}":`, error);
         }
     }