anbaric-cloud-hosting 1.62.0 → 1.64.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.62.0",
+  "version": "1.64.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,18 +18,18 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.62.0",
-    "anbaric-plugins": "^1.62.0",
-    "anbaric-tsapi": "^1.62.0",
-    "anbaric-web": "^1.62.0",
+    "anbaric-data-store": "^1.64.0",
+    "anbaric-plugins": "^1.64.0",
+    "anbaric-tsapi": "^1.64.0",
+    "anbaric-web": "^1.64.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.62.0",
-    "anbaric-state-machine": "^1.62.0",
+    "anbaric-impl-cloud": "^1.64.0",
+    "anbaric-state-machine": "^1.64.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/auth/Authenticator.ts

@@ -4,6 +4,15 @@ import {User} from "./User";
 
 const SESSION_COOKIE = "anbaric_session";
 
+/* The identity cookie: who this person is, as the central login proved it,
+   set for the whole domain and never overwritten by a tenant platform. A
+   platform's own session cookie is bound to that platform - signed with its
+   secret - so moving between tenants invalidates it every time; this one is
+   bound to the person, and is what a platform falls back to before sending
+   anyone through the login again. Mirrors CENTRAL_SESSION_COOKIE in
+   anbaric-cloud-central; keep the two in step. */
+const IDENTITY_COOKIE = "anbaric_central_session";
+
 abstract class Authenticator {
 
     abstract authenticate(session : string | undefined, request : IncomingMessage,
@@ -30,4 +39,4 @@ abstract class Authenticator {
 
 }
 
-export { Authenticator, SESSION_COOKIE }
+export { Authenticator, SESSION_COOKIE, IDENTITY_COOKIE }

package/src/auth/HttpMembershipService.ts

@@ -46,6 +46,12 @@ class HttpMembershipService implements MembershipService {
         return response.status === 204;
     }
 
+    async remove(userId : string, asking : Inviter) : Promise<boolean> {
+        const response = await this.call("DELETE", `/members/${encodeURIComponent(userId)}`, undefined, [404], asking);
+        this.roles.delete(userId);
+        return response.status === 204;
+    }
+
     private async call(method : string, path : string, body? : unknown,
                        tolerated : Array<number> = [], asking? : Inviter) : Promise<Response> {
         const headers : Record<string, string> = { "x-anbaric-central-key": this.secret };

package/src/auth/InMemoryMembershipService.ts

@@ -17,6 +17,10 @@ class InMemoryMembershipService implements MembershipService {
         return this.members.get(userId);
     }
 
+    async remove(userId : string, _asking : Inviter) : Promise<boolean> {
+        return this.members.delete(userId);
+    }
+
     async invite(email : string, role : TenantRole, invitedBy : Inviter, landingApp? : string) : Promise<PendingInvitation> {
         const token = randomUUID();
         const now = new Date();

package/src/auth/MembershipService.ts

@@ -39,6 +39,9 @@ interface MembershipService {
 
     revoke(token : string, asking : Inviter) : Promise<boolean>;
 
+    // Ends someone's membership. False when they were not a member.
+    remove(userId : string, asking : Inviter) : Promise<boolean>;
+
 }
 
 export type { MembershipService, PendingInvitation, Inviter }

package/src/hosting/HostingServer.ts

@@ -10,6 +10,7 @@ import {AppProxyHandler} from "./handlers/AppProxyHandler";
 import {AppLinkFallbackHandler} from "./handlers/AppLinkFallbackHandler";
 import {AppsHandler} from "./handlers/AppsHandler";
 import {MyAppsHandler} from "./handlers/MyAppsHandler";
+import {MembersHandler} from "./handlers/auth/MembersHandler";
 import {Subdomains} from "../subdomains/Subdomains";
 import {AuditsHandler} from "./handlers/AuditsHandler";
 import {AuthorizeCliHandler} from "./handlers/auth/AuthorizeCliHandler";
@@ -111,6 +112,7 @@ class HostingServer {
         if (entitlements) publicRouter.registerApi("entitlements", new EntitlementsAdminHandler(entitlements));
         if (userDirectory) publicRouter.registerApi("users", new UsersHandler(userDirectory));
         if (memberships) publicRouter.registerApi("invitations", new InvitationsHandler(memberships, entitlements));
+        if (memberships) publicRouter.registerApi("members", new MembersHandler(memberships, entitlements));
         const prompts = promptManagerFor && new PromptsHandler(promptManagerFor);
         if (prompts) publicRouter.registerApi("prompts", prompts);
         if (cliAuthorizer) {

package/src/hosting/Request.ts

@@ -12,6 +12,8 @@ class Request {
 
     readonly rayId : string;
     session? : string;
+    // The identity cookie from the central login, when the browser holds one.
+    identity? : string;
     user? : User;
     tenant? : Tenant;
 

package/src/hosting/handlers/auth/MembersHandler.ts

@@ -0,0 +1,43 @@
+import {MembershipService} from "../../../auth/MembershipService";
+import {canInvite} from "../../../auth/TenantRole";
+import {EntitlementStore} from "../../../data-store/EntitlementStore";
+import {Request} from "../../Request";
+import {RequestHandler} from "../../RequestHandler";
+
+/* The console's side of removing someone from this tenant. Membership is the
+   control plane's to end - it is what admits a session at all - and it is
+   asked to; what is this platform's own is the entitlements that person held
+   here, which go with them so nothing is left granted to somebody who can no
+   longer sign in. Their directory entry stays: it is a record of who was here. */
+class MembersHandler implements RequestHandler {
+
+    constructor(private memberships : MembershipService, private entitlements? : EntitlementStore) {}
+
+    async handle(request : Request) : Promise<void> {
+        if (request.method !== "DELETE" || ! request.id || request.subresource) return request.notFound();
+
+        if (! canInvite(request.user?.tenantRole)) {
+            return request.reply(403, { error: "Your role in this tenant cannot remove members" });
+        }
+        if (request.user?.id === request.id) {
+            return request.reply(400, { error: "You cannot remove yourself from a tenant" });
+        }
+
+        const asking = request.user ? { id: request.user.id, name: request.user.name } : { id: "system" };
+        let removed : boolean;
+        try {
+            removed = await this.memberships.remove(request.id, asking);
+        } catch (error) {
+            return request.reply(403, { error: error instanceof Error ? error.message : "Could not remove that member" });
+        }
+        if (! removed) return request.notFound();
+
+        for (const grant of await this.entitlements?.listGrants(request.id) ?? []) {
+            await this.entitlements?.revoke(grant.id);
+        }
+        request.reply(204);
+    }
+
+}
+
+export { MembersHandler }

package/src/hosting/middleware/AuthenticationMiddleware.ts

@@ -71,7 +71,12 @@ class AuthenticationMiddleware implements Middleware {
 
         if (!this.authenticator) return true;
 
-        const authenticated = await this.authenticator.authenticate(request.session, request.raw, request.rawResponse);
+        /* No session this platform can verify. Before sending anyone back
+           through the login, offer the authenticator the identity cookie the
+           central login set for the whole domain: a person arriving from
+           another tenant carries that tenant's session, which this platform
+           cannot read, but their identity is the same and still proven. */
+        const authenticated = await this.authenticator.authenticate(request.identity ?? request.session, request.raw, request.rawResponse);
         if (!authenticated) return false;
 
         [request.user, request.tenant] = authenticated;

package/src/hosting/middleware/SessionMiddleware.ts

@@ -1,17 +1,18 @@
-import {SESSION_COOKIE} from "../../auth/Authenticator";
+import {IDENTITY_COOKIE, SESSION_COOKIE} from "../../auth/Authenticator";
 import {Middleware} from "../Middleware";
 import {Request} from "../Request";
 
+/* Lifts the two cookies authentication cares about off the request: this
+   platform's own session, and the identity the central login proved. The
+   first of each name wins, which is what a browser sends first. */
 class SessionMiddleware implements Middleware {
 
     async apply(request : Request) : Promise<boolean> {
         const cookies = String(request.header("cookie") ?? "").split(";");
         for (const cookie of cookies) {
             const [name, ...value] = cookie.trim().split("=");
-            if (name === SESSION_COOKIE) {
-                request.session = value.join("=");
-                break;
-            }
+            if (name === SESSION_COOKIE && request.session === undefined) request.session = value.join("=");
+            if (name === IDENTITY_COOKIE && request.identity === undefined) request.identity = value.join("=");
         }
         return true;
     }