anbaric-cloud-hosting 1.64.0 → 1.65.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.64.0",
+  "version": "1.65.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,18 +18,18 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.64.0",
-    "anbaric-plugins": "^1.64.0",
-    "anbaric-tsapi": "^1.64.0",
-    "anbaric-web": "^1.64.0",
+    "anbaric-data-store": "^1.65.0",
+    "anbaric-plugins": "^1.65.0",
+    "anbaric-tsapi": "^1.65.0",
+    "anbaric-web": "^1.65.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.64.0",
-    "anbaric-state-machine": "^1.64.0",
+    "anbaric-impl-cloud": "^1.65.0",
+    "anbaric-state-machine": "^1.65.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/auth/HttpMembershipService.ts

@@ -52,6 +52,15 @@ class HttpMembershipService implements MembershipService {
         return response.status === 204;
     }
 
+    async changeRole(userId : string, role : TenantRole, asking : Inviter) : Promise<TenantRole | undefined> {
+        const response = await this.call("PATCH", `/members/${encodeURIComponent(userId)}`, { role }, [404], asking);
+        this.roles.delete(userId);
+        if (response.status === 404) return undefined;
+
+        const changed = (await response.json() as { role? : unknown }).role;
+        return isTenantRole(changed) ? changed : undefined;
+    }
+
     private async call(method : string, path : string, body? : unknown,
                        tolerated : Array<number> = [], asking? : Inviter) : Promise<Response> {
         const headers : Record<string, string> = { "x-anbaric-central-key": this.secret };

package/src/auth/InMemoryMembershipService.ts

@@ -21,6 +21,12 @@ class InMemoryMembershipService implements MembershipService {
         return this.members.delete(userId);
     }
 
+    async changeRole(userId : string, role : TenantRole, _asking : Inviter) : Promise<TenantRole | undefined> {
+        if (! this.members.has(userId)) return undefined;
+        this.members.set(userId, role);
+        return role;
+    }
+
     async invite(email : string, role : TenantRole, invitedBy : Inviter, landingApp? : string) : Promise<PendingInvitation> {
         const token = randomUUID();
         const now = new Date();

package/src/auth/MembershipService.ts

@@ -42,6 +42,9 @@ interface MembershipService {
     // Ends someone's membership. False when they were not a member.
     remove(userId : string, asking : Inviter) : Promise<boolean>;
 
+    // Changes someone's role. Undefined when they were not a member.
+    changeRole(userId : string, role : TenantRole, asking : Inviter) : Promise<TenantRole | undefined>;
+
 }
 
 export type { MembershipService, PendingInvitation, Inviter }

package/src/billing/CentralBilling.ts

@@ -0,0 +1,38 @@
+type FetchFn = (url : string, init : RequestInit) => Promise<Response>;
+
+/* What this tenant is spending and where its owner pays. The numbers are the
+   control plane's - it holds the metering, the prices and the allowance - so
+   the platform asks and passes the answer on without interpreting it, the
+   same way it asks about memberships. */
+class CentralBilling {
+
+    constructor(private centralUrl : string, private secret : string, private tenantSlug : string,
+                private fetchFn : FetchFn = (url, init) => fetch(url, init)) {}
+
+    async summary() : Promise<Record<string, unknown>> {
+        const response = await this.call("GET", `/usage/${encodeURIComponent(this.tenantSlug)}`);
+        return await response.json() as Record<string, unknown>;
+    }
+
+    async portalUrl(returnUrl : string) : Promise<string> {
+        const response = await this.call("POST", `/tenants/${encodeURIComponent(this.tenantSlug)}/billing/portal`, { returnUrl });
+        return String((await response.json() as { url : string }).url);
+    }
+
+    private async call(method : string, path : string, body? : unknown) : Promise<Response> {
+        const headers : Record<string, string> = { "x-anbaric-central-key": this.secret };
+        if (body !== undefined) headers["content-type"] = "application/json";
+
+        const response = await this.fetchFn(`${this.centralUrl.replace(/\/$/, "")}${path}`,
+            { method, headers, body: body === undefined ? undefined : JSON.stringify(body) });
+
+        if (! response.ok) {
+            const problem = await response.json().catch(() => ({})) as { error? : string };
+            throw new Error(problem.error ?? `The request to the central login failed with status ${response.status}`);
+        }
+        return response;
+    }
+
+}
+
+export { CentralBilling };

package/src/hosting/HostingServer.ts

@@ -11,6 +11,8 @@ import {AppLinkFallbackHandler} from "./handlers/AppLinkFallbackHandler";
 import {AppsHandler} from "./handlers/AppsHandler";
 import {MyAppsHandler} from "./handlers/MyAppsHandler";
 import {MembersHandler} from "./handlers/auth/MembersHandler";
+import {BillingHandler} from "./handlers/BillingHandler";
+import {CentralBilling} from "../billing/CentralBilling";
 import {Subdomains} from "../subdomains/Subdomains";
 import {AuditsHandler} from "./handlers/AuditsHandler";
 import {AuthorizeCliHandler} from "./handlers/auth/AuthorizeCliHandler";
@@ -78,7 +80,8 @@ class HostingServer {
                 memberships? : MembershipService,
                 promptManagerFor? : (appId : string) => PromptManager,
                 fileStorageFor? : (appId : string) => FileStorage,
-                subdomains? : Subdomains) {
+                subdomains? : Subdomains,
+                billing? : CentralBilling) {
         const pages = new PagesHandler();
         const ping = new PingHandler(tenant);
         const jobs = new JobsHandler(persistence);
@@ -113,6 +116,7 @@ class HostingServer {
         if (userDirectory) publicRouter.registerApi("users", new UsersHandler(userDirectory));
         if (memberships) publicRouter.registerApi("invitations", new InvitationsHandler(memberships, entitlements));
         if (memberships) publicRouter.registerApi("members", new MembersHandler(memberships, entitlements));
+        if (billing) publicRouter.registerApi("billing", new BillingHandler(billing));
         const prompts = promptManagerFor && new PromptsHandler(promptManagerFor);
         if (prompts) publicRouter.registerApi("prompts", prompts);
         if (cliAuthorizer) {

package/src/hosting/handlers/BillingHandler.ts

@@ -0,0 +1,46 @@
+import {CentralBilling} from "../../billing/CentralBilling";
+import {canInvite, deniesBuild} from "../../auth/TenantRole";
+import {Request} from "../Request";
+import {RequestHandler} from "../RequestHandler";
+
+/* The console's costs page. A builder may see what the tenant is spending;
+   only an owner or admin may go and change how it pays. */
+class BillingHandler implements RequestHandler {
+
+    constructor(private billing : CentralBilling, private publicUrl : string = process.env.ANBARIC_PLATFORM_PUBLIC_URL ?? "") {}
+
+    async handle(request : Request) : Promise<void> {
+        if (request.method === "GET" && request.id === "summary") return this.summary(request);
+        if (request.method === "POST" && request.id === "portal") return this.portal(request);
+        request.notFound();
+    }
+
+    private async summary(request : Request) : Promise<void> {
+        if (deniesBuild(request.user?.tenantRole)) {
+            return request.reply(403, { error: "Your role in this tenant cannot see its costs" });
+        }
+        try {
+            request.reply(200, await this.billing.summary());
+        } catch (error) {
+            request.reply(502, { error: error instanceof Error ? error.message : "Could not read this tenant's costs" });
+        }
+    }
+
+    private async portal(request : Request) : Promise<void> {
+        if (! canInvite(request.user?.tenantRole)) {
+            return request.reply(403, { error: "Your role in this tenant cannot change its payment details" });
+        }
+
+        const body = await request.body() as { returnTo? : string } | undefined;
+        const returnTo = typeof body?.returnTo === "string" && body.returnTo.startsWith("/") ? body.returnTo : "/";
+
+        try {
+            request.reply(200, { url: await this.billing.portalUrl(`${this.publicUrl.replace(/\/$/, "")}${returnTo}`) });
+        } catch (error) {
+            request.reply(409, { error: error instanceof Error ? error.message : "Could not open the payment details page" });
+        }
+    }
+
+}
+
+export { BillingHandler };

package/src/hosting/handlers/LogoutHandler.ts

@@ -1,18 +1,35 @@
-import {Authenticator} from "../../auth/Authenticator";
+import {Authenticator, IDENTITY_COOKIE} from "../../auth/Authenticator";
 import {SessionSigner} from "../../auth/SessionSigner";
 import {Request} from "../Request";
 import {RequestHandler} from "../RequestHandler";
 
-/* Ends the platform session. The cookie is cleared here; where the browser
-   goes next is the authenticator's business, because an identity provider
-   holding its own session has to be signed out of as well - otherwise the
-   redirect home just signs the person straight back in. */
+const TENANT_COOKIE = "anbaric_tenant";
+
+/* Ends the platform session. Every cookie that could sign the person back in
+   or route them somewhere goes: the platform's own session, the identity the
+   central login left, and the tenant the edge was routing them to - both the
+   domain-scoped cookie and any host-only one from before the domain was set,
+   because a browser keeps the one whose attributes you did not match. Where
+   the browser goes next is the authenticator's business, because an identity
+   provider holding its own session has to be signed out of as well - otherwise
+   the redirect home just signs the person straight back in. */
 class LogoutHandler implements RequestHandler {
 
-    constructor(private authenticator? : Authenticator, private sessionSigner : SessionSigner = new SessionSigner()) {}
+    constructor(private authenticator? : Authenticator,
+                private sessionSigner : SessionSigner = new SessionSigner(),
+                private domain : string | undefined = process.env.ANBARIC_COOKIE_DOMAIN || undefined) {}
 
     async handle(request : Request) : Promise<void> {
         this.sessionSigner.clear(request.rawResponse);
+
+        const expired = [IDENTITY_COOKIE, TENANT_COOKIE].flatMap(name => [
+            `${name}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,
+            ...(this.domain ? [`${name}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0; Domain=${this.domain}`] : []),
+        ]);
+        const existing = request.rawResponse.getHeader("Set-Cookie");
+        const before = existing === undefined ? [] : Array.isArray(existing) ? existing : [String(existing)];
+        request.rawResponse.setHeader("Set-Cookie", [...before, ...expired]);
+
         request.redirect(this.authenticator?.logoutUrl() ?? "/");
     }
 

package/src/hosting/handlers/auth/MembersHandler.ts

@@ -1,12 +1,16 @@
 import {MembershipService} from "../../../auth/MembershipService";
-import {canInvite} from "../../../auth/TenantRole";
+import {canInvite, isTenantRole} from "../../../auth/TenantRole";
 import {EntitlementStore} from "../../../data-store/EntitlementStore";
 import {Request} from "../../Request";
 import {RequestHandler} from "../../RequestHandler";
 
-/* The console's side of removing someone from this tenant. Membership is the
-   control plane's to end - it is what admits a session at all - and it is
-   asked to; what is this platform's own is the entitlements that person held
+/* The console's side of administering who is in this tenant and as what:
+   removing someone, and moving them between admin, builder and user.
+   Membership is the control plane's - it is what admits a session at all -
+   and it is asked to make each change; it also refuses the changes that are
+   nobody's to make, such as the owner's role or your own.
+
+   What is this platform's own is the entitlements a removed person held
    here, which go with them so nothing is left granted to somebody who can no
    longer sign in. Their directory entry stays: it is a record of who was here. */
 class MembersHandler implements RequestHandler {
@@ -14,30 +18,57 @@ class MembersHandler implements RequestHandler {
     constructor(private memberships : MembershipService, private entitlements? : EntitlementStore) {}
 
     async handle(request : Request) : Promise<void> {
-        if (request.method !== "DELETE" || ! request.id || request.subresource) return request.notFound();
+        if (! request.id || request.subresource) return request.notFound();
 
         if (! canInvite(request.user?.tenantRole)) {
-            return request.reply(403, { error: "Your role in this tenant cannot remove members" });
+            return request.reply(403, { error: "Your role in this tenant cannot manage members" });
         }
         if (request.user?.id === request.id) {
-            return request.reply(400, { error: "You cannot remove yourself from a tenant" });
+            return request.reply(400, { error: "You cannot remove yourself or change your own role" });
         }
 
-        const asking = request.user ? { id: request.user.id, name: request.user.name } : { id: "system" };
+        if (request.method === "DELETE") return this.remove(request, request.id);
+        if (request.method === "PATCH") return this.changeRole(request, request.id);
+        request.notFound();
+    }
+
+    private asking(request : Request) {
+        return request.user ? { id: request.user.id, name: request.user.name } : { id: "system" };
+    }
+
+    private async remove(request : Request, userId : string) : Promise<void> {
         let removed : boolean;
         try {
-            removed = await this.memberships.remove(request.id, asking);
+            removed = await this.memberships.remove(userId, this.asking(request));
         } catch (error) {
             return request.reply(403, { error: error instanceof Error ? error.message : "Could not remove that member" });
         }
         if (! removed) return request.notFound();
 
-        for (const grant of await this.entitlements?.listGrants(request.id) ?? []) {
+        for (const grant of await this.entitlements?.listGrants(userId) ?? []) {
             await this.entitlements?.revoke(grant.id);
         }
         request.reply(204);
     }
 
+    private async changeRole(request : Request, userId : string) : Promise<void> {
+        const body = await request.body() as { role? : unknown } | undefined;
+        const role = body?.role;
+        if (! isTenantRole(role) || role === "OWNER") {
+            return request.reply(400, { error: "A member may be made an ADMIN, BUILDER or USER" });
+        }
+
+        let changed : string | undefined;
+        try {
+            changed = await this.memberships.changeRole(userId, role, this.asking(request));
+        } catch (error) {
+            return request.reply(403, { error: error instanceof Error ? error.message : "Could not change that role" });
+        }
+        if (! changed) return request.notFound();
+
+        request.reply(200, { userId, role: changed });
+    }
+
 }
 
 export { MembersHandler }