anbaric-cloud-hosting 1.61.0 → 1.63.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.61.0",
+  "version": "1.63.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,18 +18,18 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.61.0",
-    "anbaric-plugins": "^1.61.0",
-    "anbaric-tsapi": "^1.61.0",
-    "anbaric-web": "^1.61.0",
+    "anbaric-data-store": "^1.63.0",
+    "anbaric-plugins": "^1.63.0",
+    "anbaric-tsapi": "^1.63.0",
+    "anbaric-web": "^1.63.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.61.0",
-    "anbaric-state-machine": "^1.61.0",
+    "anbaric-impl-cloud": "^1.63.0",
+    "anbaric-state-machine": "^1.63.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/auditing/AuditRecordStore.ts

@@ -16,6 +16,12 @@ interface AuditRecordStore {
     save(record : AuditRecord) : Promise<void>;
     list(filter : AuditFilter) : Promise<Array<AuditRecord>>;
 
+    /* Removes records older than the moment given, at most `limit` of them,
+       oldest first, and says how many went - so a backlog is cleared a batch
+       at a time rather than in one statement that holds a lock and leaves
+       every dead row behind at once. */
+    deleteBefore(before : Date, limit : number) : Promise<number>;
+
 }
 
 export type { AuditFilter, AuditRecordStore }

package/src/auditing/AuditSweep.ts

@@ -0,0 +1,67 @@
+import {AuditRecordStore} from "./AuditRecordStore";
+
+const SWEEP_INTERVAL_MS = 24 * 60 * 60_000;
+const BATCH_SIZE = 5_000;
+const BATCHES_PER_SWEEP = 200;
+
+/* How long audit records are kept unless the platform is told otherwise. A
+   year: long enough that nobody is surprised by what has gone, short enough
+   that the table does not grow for ever. Zero means keep everything. */
+const DEFAULT_RETENTION_DAYS = 365;
+
+const DAY_MS = 24 * 60 * 60_000;
+
+/* Removes audit records older than the retention, once a day and once at
+   start - a platform that restarts on every release would otherwise never
+   reach its first daily tick. Deletion is done a batch at a time rather than
+   in one statement, so clearing a backlog neither holds a lock for long nor
+   leaves more dead rows at once than autovacuum can keep up with, and each
+   sweep stops after a bounded number of batches so a very large backlog is
+   worked through over several days rather than in one sitting. */
+class AuditSweep {
+
+    private ticker? : NodeJS.Timeout;
+    private sweeping = false;
+
+    constructor(private records : AuditRecordStore,
+                private retentionDays : number = DEFAULT_RETENTION_DAYS,
+                private intervalMs : number = SWEEP_INTERVAL_MS,
+                private batchSize : number = BATCH_SIZE) {}
+
+    start() : void {
+        if (this.ticker || this.retentionDays <= 0) return;
+        void this.sweep();
+        this.ticker = setInterval(() => void this.sweep(), this.intervalMs);
+        this.ticker.unref();
+    }
+
+    async sweep() : Promise<number> {
+        if (this.sweeping || this.retentionDays <= 0) return 0;
+        this.sweeping = true;
+
+        const before = new Date(Date.now() - this.retentionDays * DAY_MS);
+        let removed = 0;
+        try {
+            for (let batch = 0; batch < BATCHES_PER_SWEEP; batch++) {
+                const went = await this.records.deleteBefore(before, this.batchSize);
+                removed += went;
+                if (went < this.batchSize) break;
+            }
+            if (removed > 0) console.log(`[audit] removed ${removed} record(s) older than ${this.retentionDays} days`);
+            return removed;
+        } catch (error) {
+            console.error(`[audit] the retention sweep failed: ${error instanceof Error ? error.message : error}`);
+            return removed;
+        } finally {
+            this.sweeping = false;
+        }
+    }
+
+    async cleanUp() : Promise<void> {
+        if (this.ticker) clearInterval(this.ticker);
+        this.ticker = undefined;
+    }
+
+}
+
+export { AuditSweep, DEFAULT_RETENTION_DAYS };

package/src/auditing/InMemoryAuditRecordStore.ts

@@ -26,6 +26,16 @@ class InMemoryAuditRecordStore implements AuditRecordStore {
             .slice(page * pageSize, (page + 1) * pageSize);
     }
 
+    async deleteBefore(before : Date, limit : number) : Promise<number> {
+        const stale = this.records
+            .filter(record => new Date(record.at ?? 0) < before)
+            .sort((left, right) => String(left.at).localeCompare(String(right.at)))
+            .slice(0, limit);
+
+        this.records = this.records.filter(record => ! stale.includes(record));
+        return stale.length;
+    }
+
 }
 
 export { InMemoryAuditRecordStore }

package/src/auth/HttpMembershipService.ts

@@ -46,6 +46,12 @@ class HttpMembershipService implements MembershipService {
         return response.status === 204;
     }
 
+    async remove(userId : string, asking : Inviter) : Promise<boolean> {
+        const response = await this.call("DELETE", `/members/${encodeURIComponent(userId)}`, undefined, [404], asking);
+        this.roles.delete(userId);
+        return response.status === 204;
+    }
+
     private async call(method : string, path : string, body? : unknown,
                        tolerated : Array<number> = [], asking? : Inviter) : Promise<Response> {
         const headers : Record<string, string> = { "x-anbaric-central-key": this.secret };

package/src/auth/InMemoryMembershipService.ts

@@ -17,6 +17,10 @@ class InMemoryMembershipService implements MembershipService {
         return this.members.get(userId);
     }
 
+    async remove(userId : string, _asking : Inviter) : Promise<boolean> {
+        return this.members.delete(userId);
+    }
+
     async invite(email : string, role : TenantRole, invitedBy : Inviter, landingApp? : string) : Promise<PendingInvitation> {
         const token = randomUUID();
         const now = new Date();

package/src/auth/MembershipService.ts

@@ -39,6 +39,9 @@ interface MembershipService {
 
     revoke(token : string, asking : Inviter) : Promise<boolean>;
 
+    // Ends someone's membership. False when they were not a member.
+    remove(userId : string, asking : Inviter) : Promise<boolean>;
+
 }
 
 export type { MembershipService, PendingInvitation, Inviter }

package/src/data-store/PlatformMigrations.ts

@@ -256,6 +256,12 @@ const PLATFORM_MIGRATIONS : Array<Migration> = [
             ON entitlement_invites (email, COALESCE(app_id, ''), entitlement_id)`,
     ),
 
+    // Audit records are weeded by age, which without this is a scan of the
+    // whole table every day.
+    statements("006-audit-records-by-age",
+        "CREATE INDEX IF NOT EXISTS audit_records_at ON anbaric_system.audit_records (at)",
+    ),
+
 ];
 
 export { PLATFORM_MIGRATIONS };

package/src/data-store/PostgresAuditRecordStore.ts

@@ -92,6 +92,21 @@ class PostgresAuditRecordStore implements AuditRecordStore {
         }));
     }
 
+    /* Oldest first and bounded, so the sweep that calls this can work through
+       a large backlog a batch at a time. The subquery is what the index on
+       `at` serves; the delete itself goes by primary key. */
+    async deleteBefore(before : Date, limit : number) : Promise<number> {
+        const result = await this.pool.query(
+            `DELETE FROM anbaric_system.audit_records
+             WHERE id IN (
+                 SELECT id FROM anbaric_system.audit_records
+                 WHERE at < $1 ORDER BY at, id LIMIT $2
+             )`,
+            [before, limit],
+        );
+        return result.rowCount ?? 0;
+    }
+
 }
 
 export { PostgresAuditRecordStore }

package/src/hosting/HostingServer.ts

@@ -10,6 +10,7 @@ import {AppProxyHandler} from "./handlers/AppProxyHandler";
 import {AppLinkFallbackHandler} from "./handlers/AppLinkFallbackHandler";
 import {AppsHandler} from "./handlers/AppsHandler";
 import {MyAppsHandler} from "./handlers/MyAppsHandler";
+import {MembersHandler} from "./handlers/auth/MembersHandler";
 import {Subdomains} from "../subdomains/Subdomains";
 import {AuditsHandler} from "./handlers/AuditsHandler";
 import {AuthorizeCliHandler} from "./handlers/auth/AuthorizeCliHandler";
@@ -111,6 +112,7 @@ class HostingServer {
         if (entitlements) publicRouter.registerApi("entitlements", new EntitlementsAdminHandler(entitlements));
         if (userDirectory) publicRouter.registerApi("users", new UsersHandler(userDirectory));
         if (memberships) publicRouter.registerApi("invitations", new InvitationsHandler(memberships, entitlements));
+        if (memberships) publicRouter.registerApi("members", new MembersHandler(memberships, entitlements));
         const prompts = promptManagerFor && new PromptsHandler(promptManagerFor);
         if (prompts) publicRouter.registerApi("prompts", prompts);
         if (cliAuthorizer) {

package/src/hosting/handlers/auth/MembersHandler.ts

@@ -0,0 +1,43 @@
+import {MembershipService} from "../../../auth/MembershipService";
+import {canInvite} from "../../../auth/TenantRole";
+import {EntitlementStore} from "../../../data-store/EntitlementStore";
+import {Request} from "../../Request";
+import {RequestHandler} from "../../RequestHandler";
+
+/* The console's side of removing someone from this tenant. Membership is the
+   control plane's to end - it is what admits a session at all - and it is
+   asked to; what is this platform's own is the entitlements that person held
+   here, which go with them so nothing is left granted to somebody who can no
+   longer sign in. Their directory entry stays: it is a record of who was here. */
+class MembersHandler implements RequestHandler {
+
+    constructor(private memberships : MembershipService, private entitlements? : EntitlementStore) {}
+
+    async handle(request : Request) : Promise<void> {
+        if (request.method !== "DELETE" || ! request.id || request.subresource) return request.notFound();
+
+        if (! canInvite(request.user?.tenantRole)) {
+            return request.reply(403, { error: "Your role in this tenant cannot remove members" });
+        }
+        if (request.user?.id === request.id) {
+            return request.reply(400, { error: "You cannot remove yourself from a tenant" });
+        }
+
+        const asking = request.user ? { id: request.user.id, name: request.user.name } : { id: "system" };
+        let removed : boolean;
+        try {
+            removed = await this.memberships.remove(request.id, asking);
+        } catch (error) {
+            return request.reply(403, { error: error instanceof Error ? error.message : "Could not remove that member" });
+        }
+        if (! removed) return request.notFound();
+
+        for (const grant of await this.entitlements?.listGrants(request.id) ?? []) {
+            await this.entitlements?.revoke(grant.id);
+        }
+        request.reply(204);
+    }
+
+}
+
+export { MembersHandler }

package/src/main.ts

@@ -18,6 +18,7 @@ import {S3FileStorage} from "./data-store/S3FileStorage";
 import {PostgresJobRunSchedulePersistence} from "./data-store/PostgresJobRunSchedulePersistence";
 import {PostgresJobPersistence} from "./data-store/PostgresJobPersistence";
 import {StallSweep} from "./data-store/StallSweep";
+import {AuditSweep, DEFAULT_RETENTION_DAYS} from "./auditing/AuditSweep";
 import {PostgresJsonStore} from "./data-store/PostgresJsonStore";
 import {PostgresQueue} from "./queuing/PostgresQueue";
 import {DockerBuildLayer} from "./app-management/DockerBuildLayer";
@@ -130,9 +131,10 @@ const fileStorageFor = (appId : string) : FileStorage =>
         : new LocalFileSystemStorage(join(process.env.ANBARIC_FILE_STORAGE_PATH ?? join(tmpdir(), "anbaric", "files"), appId));
 
 const jobs = new PostgresJobPersistence(pool);
+const auditRecords = new PostgresAuditRecordStore(pool);
 const server = new HostingServer(jobs, queue, registry, buildLayer,
     (appId, collection) => new PostgresJsonStore(pool, appId, collection), secretStoreFor, authenticator, cliAuthorizer,
-    tokenAuthenticator, process.env.ANBARIC_TENANT, new PostgresAuditRecordStore(pool), plugins,
+    tokenAuthenticator, process.env.ANBARIC_TENANT, auditRecords, plugins,
     new PostgresJobRunSchedulePersistence(pool), await loadNotifier(process.env.ANBARIC_NOTIFIER_MODULE),
     new PostgresEntitlementStore(pool), new PostgresUserDirectory(pool), memberships,
     (appId) => new PostgresPromptManager(pool, appId), fileStorageFor, subdomains);
@@ -169,4 +171,8 @@ if (buildLayer && subdomains) {
 // Jobs whose long-running step stopped saying it was alive are marked, not touched.
 new StallSweep(jobs).start();
 
+/* Audit records older than the retention are removed, daily. The retention is
+   in days; zero keeps everything, and an unset value keeps a year. */
+new AuditSweep(auditRecords, Number(process.env.ANBARIC_AUDIT_RETENTION_DAYS ?? DEFAULT_RETENTION_DAYS)).start();
+
 console.log(`anbaric-cloud-hosting listening on port ${port}, internal entry point on ${internal}`);