anbaric-cloud-hosting 1.62.0 → 1.63.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.62.0",
+  "version": "1.63.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,18 +18,18 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.62.0",
-    "anbaric-plugins": "^1.62.0",
-    "anbaric-tsapi": "^1.62.0",
-    "anbaric-web": "^1.62.0",
+    "anbaric-data-store": "^1.63.0",
+    "anbaric-plugins": "^1.63.0",
+    "anbaric-tsapi": "^1.63.0",
+    "anbaric-web": "^1.63.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.62.0",
-    "anbaric-state-machine": "^1.62.0",
+    "anbaric-impl-cloud": "^1.63.0",
+    "anbaric-state-machine": "^1.63.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/auth/HttpMembershipService.ts

@@ -46,6 +46,12 @@ class HttpMembershipService implements MembershipService {
         return response.status === 204;
     }
 
+    async remove(userId : string, asking : Inviter) : Promise<boolean> {
+        const response = await this.call("DELETE", `/members/${encodeURIComponent(userId)}`, undefined, [404], asking);
+        this.roles.delete(userId);
+        return response.status === 204;
+    }
+
     private async call(method : string, path : string, body? : unknown,
                        tolerated : Array<number> = [], asking? : Inviter) : Promise<Response> {
         const headers : Record<string, string> = { "x-anbaric-central-key": this.secret };

package/src/auth/InMemoryMembershipService.ts

@@ -17,6 +17,10 @@ class InMemoryMembershipService implements MembershipService {
         return this.members.get(userId);
     }
 
+    async remove(userId : string, _asking : Inviter) : Promise<boolean> {
+        return this.members.delete(userId);
+    }
+
     async invite(email : string, role : TenantRole, invitedBy : Inviter, landingApp? : string) : Promise<PendingInvitation> {
         const token = randomUUID();
         const now = new Date();

package/src/auth/MembershipService.ts

@@ -39,6 +39,9 @@ interface MembershipService {
 
     revoke(token : string, asking : Inviter) : Promise<boolean>;
 
+    // Ends someone's membership. False when they were not a member.
+    remove(userId : string, asking : Inviter) : Promise<boolean>;
+
 }
 
 export type { MembershipService, PendingInvitation, Inviter }

package/src/hosting/HostingServer.ts

@@ -10,6 +10,7 @@ import {AppProxyHandler} from "./handlers/AppProxyHandler";
 import {AppLinkFallbackHandler} from "./handlers/AppLinkFallbackHandler";
 import {AppsHandler} from "./handlers/AppsHandler";
 import {MyAppsHandler} from "./handlers/MyAppsHandler";
+import {MembersHandler} from "./handlers/auth/MembersHandler";
 import {Subdomains} from "../subdomains/Subdomains";
 import {AuditsHandler} from "./handlers/AuditsHandler";
 import {AuthorizeCliHandler} from "./handlers/auth/AuthorizeCliHandler";
@@ -111,6 +112,7 @@ class HostingServer {
         if (entitlements) publicRouter.registerApi("entitlements", new EntitlementsAdminHandler(entitlements));
         if (userDirectory) publicRouter.registerApi("users", new UsersHandler(userDirectory));
         if (memberships) publicRouter.registerApi("invitations", new InvitationsHandler(memberships, entitlements));
+        if (memberships) publicRouter.registerApi("members", new MembersHandler(memberships, entitlements));
         const prompts = promptManagerFor && new PromptsHandler(promptManagerFor);
         if (prompts) publicRouter.registerApi("prompts", prompts);
         if (cliAuthorizer) {

package/src/hosting/handlers/auth/MembersHandler.ts

@@ -0,0 +1,43 @@
+import {MembershipService} from "../../../auth/MembershipService";
+import {canInvite} from "../../../auth/TenantRole";
+import {EntitlementStore} from "../../../data-store/EntitlementStore";
+import {Request} from "../../Request";
+import {RequestHandler} from "../../RequestHandler";
+
+/* The console's side of removing someone from this tenant. Membership is the
+   control plane's to end - it is what admits a session at all - and it is
+   asked to; what is this platform's own is the entitlements that person held
+   here, which go with them so nothing is left granted to somebody who can no
+   longer sign in. Their directory entry stays: it is a record of who was here. */
+class MembersHandler implements RequestHandler {
+
+    constructor(private memberships : MembershipService, private entitlements? : EntitlementStore) {}
+
+    async handle(request : Request) : Promise<void> {
+        if (request.method !== "DELETE" || ! request.id || request.subresource) return request.notFound();
+
+        if (! canInvite(request.user?.tenantRole)) {
+            return request.reply(403, { error: "Your role in this tenant cannot remove members" });
+        }
+        if (request.user?.id === request.id) {
+            return request.reply(400, { error: "You cannot remove yourself from a tenant" });
+        }
+
+        const asking = request.user ? { id: request.user.id, name: request.user.name } : { id: "system" };
+        let removed : boolean;
+        try {
+            removed = await this.memberships.remove(request.id, asking);
+        } catch (error) {
+            return request.reply(403, { error: error instanceof Error ? error.message : "Could not remove that member" });
+        }
+        if (! removed) return request.notFound();
+
+        for (const grant of await this.entitlements?.listGrants(request.id) ?? []) {
+            await this.entitlements?.revoke(grant.id);
+        }
+        request.reply(204);
+    }
+
+}
+
+export { MembersHandler }