create-op-node 0.11.2 → 0.12.0

package/dist/cli.js

@@ -20,6 +20,10 @@ var SAFE_PATH_RE = /^[A-Za-z0-9_\-./ ]+$/;
 var SAFE_LAUNCHCTL_VALUE_RE = /^[A-Za-z0-9+/=._-]+$/;
 var URL_SAFE_PASSWORD_RE = /^[A-Za-z0-9_-]+$/;
 var SAFE_URL_RE = /^[A-Za-z0-9:/_.-]+$/;
+var WELL_KNOWN_GATEWAY_HMAC_SECRET = (
+  // eslint-disable-next-line sonarjs/hardcoded-secret-signatures, sonarjs/no-hardcoded-passwords -- this is the PUBLIC well-known template default we are guarding AGAINST, not a live credential
+  "local-only-hmac-secret-rotate-before-tunnel-exposure"
+);
 var VERIFY_NETWORK_TIMEOUT_MS = 1e4;
 var API_REQUEST_TIMEOUT_MS = 15e3;
 var BODY_PREVIEW_MAX = 200;
@@ -259,12 +263,12 @@ async function fetchOutput(auth, workspaceId, outputName) {
     auth.token,
     `/workspaces/${encodeURIComponent(workspaceId)}/current-state-version-outputs`
   );
-  if (res.status !== 200) return null;
+  if (res.status !== 200) return { kind: "error" };
   const body = res.body;
   const match = body.data?.find((o) => o.attributes?.name === outputName);
-  if (!match) return null;
+  if (!match) return { kind: "absent" };
   const value = match.attributes?.value;
-  return typeof value === "string" ? value : null;
+  return typeof value === "string" ? { kind: "value", value } : { kind: "absent" };
 }
 async function safeExeca(cmd, args, options) {
   try {
@@ -296,7 +300,9 @@ var FRIENDLY = {
   "dashboard-password": "Supabase Studio dashboard password",
   "prompts-db-password": "prompt-service Postgres password",
   "prompt-service-api-key": "prompt-service HMAC API key",
-  "prompt-service-admin-api-key": "prompt-service admin API key"
+  "prompt-service-admin-api-key": "prompt-service admin API key",
+  "gateway-hmac-secret": "API Gateway HMAC secret",
+  "grafana-admin-password": "Grafana admin password"
 };
 function labelFor(coords) {
   return `Opus Populi (${coords.region}) \u2014 ${FRIENDLY[coords.account]}`;
@@ -590,6 +596,15 @@ function generateDashboardPassword() {
 function generateHmacApiKey() {
   return base64url(randomBytes(32));
 }
+function generateGatewayHmacSecret() {
+  return base64url(randomBytes(32));
+}
+function renderApiKeys(gatewayHmacSecret) {
+  return JSON.stringify({ "api-gateway": gatewayHmacSecret });
+}
+function generateGrafanaAdminPassword() {
+  return base64url(randomBytes(24));
+}
 function generateJwtSecret() {
   return randomBytes(48).toString("base64");
 }
@@ -709,21 +724,28 @@ async function waitForRunOutput(input, budgets, deps, runId) {
     );
     if (r?.finished) {
       if (!r.succeeded) return { kind: "run-failed", status: r.status };
-      deps.onProgress?.("fetching");
-      const value = await safePoll(
-        () => deps.fetchOutput(
-          { token: input.token, organization: input.organization },
-          input.workspaceId,
-          input.outputName
-        ),
-        () => deps.onProgress?.("retry")
-      );
-      return value !== null ? { kind: "success", value } : { kind: "output-missing" };
+      const out = await tryFetchOutput(input, deps);
+      if (out.kind === "value") return { kind: "success", value: out.value };
+      if (out.kind === "absent") return { kind: "output-missing" };
     }
     await deps.sleep(budgets.pollMs);
   }
   return { kind: "timeout" };
 }
+async function tryFetchOutput(input, deps) {
+  deps.onProgress?.("fetching");
+  const out = await safePoll(
+    () => deps.fetchOutput(
+      { token: input.token, organization: input.organization },
+      input.workspaceId,
+      input.outputName
+    ),
+    () => deps.onProgress?.("retry")
+  );
+  if (out === null) return { kind: "error" };
+  if (out.kind === "error") deps.onProgress?.("retry");
+  return out;
+}
 
 // src/commands/init.ts
 async function ghTokenFromCli() {
@@ -1513,7 +1535,9 @@ function validatePlistInput(input) {
     ["jwtSecret", input.jwtSecret],
     ["supabaseAnonKey", input.supabaseAnonKey],
     ["supabaseServiceRoleKey", input.supabaseServiceRoleKey],
-    ["dashboardPassword", input.dashboardPassword]
+    ["dashboardPassword", input.dashboardPassword],
+    ["gatewayHmacSecret", input.gatewayHmacSecret],
+    ["grafanaAdminPassword", input.grafanaAdminPassword]
   ];
   for (const [name, value] of supabaseFields) {
     if (value !== void 0 && !SAFE_LAUNCHCTL_VALUE_RE.test(value)) {
@@ -1541,6 +1565,8 @@ function buildSetenvCommand(input) {
     ...input.supabaseAnonKey !== void 0 ? [`launchctl setenv SUPABASE_ANON_KEY "${input.supabaseAnonKey}"`] : [],
     ...input.supabaseServiceRoleKey !== void 0 ? [`launchctl setenv SUPABASE_SERVICE_ROLE_KEY "${input.supabaseServiceRoleKey}"`] : [],
     ...input.dashboardPassword !== void 0 ? [`launchctl setenv DASHBOARD_PASSWORD "${input.dashboardPassword}"`] : [],
+    ...input.gatewayHmacSecret !== void 0 ? [`launchctl setenv GATEWAY_HMAC_SECRET "${input.gatewayHmacSecret}"`] : [],
+    ...input.grafanaAdminPassword !== void 0 ? [`launchctl setenv GRAFANA_ADMIN_PASSWORD "${input.grafanaAdminPassword}"`] : [],
     ...input.supabaseUrl !== void 0 ? [`launchctl setenv SUPABASE_URL "${input.supabaseUrl}"`] : []
   ].join("; ");
 }
@@ -1579,6 +1605,8 @@ function plistInputFromSetup(input, keyFilePath) {
     ...input.supabaseAnonKey !== void 0 ? { supabaseAnonKey: input.supabaseAnonKey } : {},
     ...input.supabaseServiceRoleKey !== void 0 ? { supabaseServiceRoleKey: input.supabaseServiceRoleKey } : {},
     ...input.dashboardPassword !== void 0 ? { dashboardPassword: input.dashboardPassword } : {},
+    ...input.gatewayHmacSecret !== void 0 ? { gatewayHmacSecret: input.gatewayHmacSecret } : {},
+    ...input.grafanaAdminPassword !== void 0 ? { grafanaAdminPassword: input.grafanaAdminPassword } : {},
     ...input.supabaseUrl !== void 0 ? { supabaseUrl: input.supabaseUrl } : {}
   };
 }
@@ -1748,6 +1776,19 @@ export SUPABASE_ANON_KEY="$(require_secret supabase-anon-key)"
 export SUPABASE_SERVICE_ROLE_KEY="$(require_secret supabase-service-role-key)"
 export DASHBOARD_PASSWORD="$(require_secret dashboard-password)"
 
+# API Gateway HMAC secret. The gateway signs gateway\u2192microservice requests
+# with this (X-HMAC-Auth) in EVERY mode, so it is required. API_KEYS is the
+# JSON map each microservice reads to verify the caller; the api-gateway's
+# key MUST equal GATEWAY_HMAC_SECRET. We render the JSON from the single
+# Keychain value here so the compose \`\${GATEWAY_HMAC_SECRET:-\u2026}\` /
+# \`\${API_KEYS:-\u2026}\` well-known defaults are always overridden with a real
+# per-node value.
+export GATEWAY_HMAC_SECRET="$(require_secret gateway-hmac-secret)"
+export API_KEYS="{\\"api-gateway\\":\\"\${GATEWAY_HMAC_SECRET}\\"}"
+
+# Grafana admin password \u2014 overrides the compose \`admin\`/\`admin\` default.
+export GRAFANA_ADMIN_PASSWORD="$(require_secret grafana-admin-password)"
+
 # AUTH_JWT_SECRET historically equals JWT_SECRET in dev/UAT \u2014 supply that
 # default if the operator hasn't set one independently.
 export AUTH_JWT_SECRET="\${AUTH_JWT_SECRET:-$JWT_SECRET}"
@@ -2544,6 +2585,22 @@ async function collectCoreSecrets(args) {
     validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
     generate: generateDashboardPassword
   });
+  const gatewayHmacSecret = await loadSecret({
+    region,
+    account: "gateway-hmac-secret",
+    label: "API Gateway HMAC secret",
+    validate: (v) => URL_SAFE_PASSWORD_RE.test(v) && v !== WELL_KNOWN_GATEWAY_HMAC_SECRET ? void 0 : "must be base64url chars only (no + / =) and not the well-known template default",
+    generate: generateGatewayHmacSecret
+  });
+  const grafanaAdminPassword = await loadSecret({
+    region,
+    account: "grafana-admin-password",
+    label: "Grafana admin password",
+    // URL-safe alphabet — exported into the compose env for Grafana's
+    // GF_SECURITY_ADMIN_PASSWORD; keep it free of shell/URL metacharacters.
+    validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
+    generate: generateGrafanaAdminPassword
+  });
   return {
     pgsodiumKey,
     tunnelToken,
@@ -2551,7 +2608,9 @@ async function collectCoreSecrets(args) {
     jwtSecret,
     supabaseAnonKey,
     supabaseServiceRoleKey,
-    dashboardPassword
+    dashboardPassword,
+    gatewayHmacSecret,
+    grafanaAdminPassword
   };
 }
 async function collectPromptServiceSecrets(args) {
@@ -2648,6 +2707,8 @@ async function runLaunchAgentPhase(args) {
     supabaseAnonKey: secrets.supabaseAnonKey,
     supabaseServiceRoleKey: secrets.supabaseServiceRoleKey,
     dashboardPassword: secrets.dashboardPassword,
+    gatewayHmacSecret: secrets.gatewayHmacSecret,
+    grafanaAdminPassword: secrets.grafanaAdminPassword,
     supabaseUrl: secrets.supabaseUrl
   });
   if (!la.ok) {
@@ -2734,6 +2795,14 @@ function buildComposeEnv(args) {
     SUPABASE_ANON_KEY: secrets.supabaseAnonKey,
     SUPABASE_SERVICE_ROLE_KEY: secrets.supabaseServiceRoleKey,
     DASHBOARD_PASSWORD: secrets.dashboardPassword,
+    // Real per-node gateway HMAC secret + the derived API_KEYS map. These
+    // override the template's well-known `${GATEWAY_HMAC_SECRET:-…}` /
+    // `${API_KEYS:-…}` compose defaults so a Tunnel-exposed node never signs
+    // with the shared placeholder. The api-gateway's key MUST equal
+    // GATEWAY_HMAC_SECRET, which renderApiKeys guarantees.
+    GATEWAY_HMAC_SECRET: secrets.gatewayHmacSecret,
+    API_KEYS: renderApiKeys(secrets.gatewayHmacSecret),
+    GRAFANA_ADMIN_PASSWORD: secrets.grafanaAdminPassword,
     SUPABASE_URL: secrets.supabaseUrl,
     AUTH_JWT_SECRET: process.env["AUTH_JWT_SECRET"] ?? secrets.jwtSecret,
     ...secrets.tunnelToken !== void 0 ? { TUNNEL_TOKEN: secrets.tunnelToken } : {},
@@ -2741,6 +2810,26 @@ function buildComposeEnv(args) {
     ...embeddingModel ? { EMBEDDINGS_MODEL: embeddingModel } : {}
   };
 }
+function checkPublicProfileSecrets(env) {
+  const gateway = env["GATEWAY_HMAC_SECRET"];
+  const apiKeys = env["API_KEYS"];
+  const bad = (v) => v === void 0 || v.length === 0 || v.includes(WELL_KNOWN_GATEWAY_HMAC_SECRET);
+  if (bad(gateway) || bad(apiKeys)) {
+    return {
+      ok: false,
+      reason: "Refusing to expose this node via the Cloudflare Tunnel (public profile) with the well-known GATEWAY_HMAC_SECRET / API_KEYS default. Every copy of the template ships the same placeholder value \u2014 a Tunnel-exposed gateway signed with it is trivially forgeable. Re-run `create-op-node bootstrap` so it generates a real per-node secret (or use `--local-only` to run without the public profile)."
+    };
+  }
+  return { ok: true };
+}
+function enforcePublicProfileSecrets(args) {
+  if (args.localOnly) return;
+  const verdict = checkPublicProfileSecrets(args.env);
+  if (!verdict.ok) {
+    p3.cancel(verdict.reason);
+    process.exit(1);
+  }
+}
 function planSignatureGate(allImages, opts) {
   if (opts.skipSignatureCheck) return { kind: "skip" };
   if (allImages === null) return { kind: "enumerate-failed" };
@@ -2817,6 +2906,7 @@ async function runStackPhase(args) {
     profiles: opts.localOnly ? LOCAL_PROFILES : PUBLIC_PROFILES,
     env: composeEnv
   };
+  enforcePublicProfileSecrets({ localOnly: Boolean(opts.localOnly), env: composeEnv });
   if (opts.localOnly) {
     const evict = p3.spinner();
     evict.start("Evicting any cloudflared from a prior public bootstrap\u2026");
@@ -4997,7 +5087,7 @@ function withDefaultSubcommand(argv, known) {
 }
 
 // src/cli.ts
-var VERSION = "0.11.2";
+var VERSION = "0.12.0";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."