iec-builder 0.1.0

package/src/services/oauth-provisioner.ts

@@ -0,0 +1,286 @@
+import { getBioClient } from './bio-client.js'
+import { getServicesCollection } from './database.js'
+import { encrypt, decrypt } from './crypto.js'
+import { logger } from '../utils/logger.js'
+import type { CustomDomainRecord, OAuthCredentialRecord } from '../models/types.js'
+import type { AuthMode } from './catalog.js'
+
+export interface OAuthCredentials {
+  readonly clientId: string
+  readonly clientSecret: string
+}
+
+interface BioClientData {
+  clientId: string
+  clientSecret?: string
+  redirectUris?: string[]
+}
+
+/**
+ * Build the OAuth client ID from service name and environment.
+ */
+export function buildOAuthClientId(serviceName: string, environment: string): string {
+  return `${serviceName}-${environment}`
+}
+
+const DOMAIN_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/
+
+/**
+ * Build the set of redirect URIs for a service based on naming convention.
+ * Includes the platform hostname plus any verified custom domains for the environment.
+ */
+export function buildRedirectUris(
+  serviceName: string,
+  environment: string,
+  customDomains?: ReadonlyArray<CustomDomainRecord>
+): ReadonlyArray<string> {
+  const hostname = environment === 'prod'
+    ? `${serviceName}.tawa.insureco.io`
+    : `${serviceName}.${environment}.tawa.insureco.io`
+
+  const platformUri = `https://${hostname}/api/auth/callback`
+
+  const customUris = (customDomains ?? [])
+    .filter(d => d.dnsVerified && d.environment === environment && DOMAIN_RE.test(d.domain))
+    .map(d => `https://${d.domain}/api/auth/callback`)
+
+  return [platformUri, ...customUris]
+}
+
+/**
+ * Read stored OAuth credentials from the service's MongoDB document.
+ */
+function readStoredCredentials(
+  storedCreds: ReadonlyArray<OAuthCredentialRecord> | undefined,
+  clientId: string,
+  environment: string
+): OAuthCredentials | null {
+  const record = (storedCreds ?? []).find(
+    c => c.clientId === clientId && c.environment === environment
+  )
+  if (!record) return null
+
+  try {
+    const clientSecret = decrypt(record.clientSecretEncrypted)
+    return { clientId: record.clientId, clientSecret }
+  } catch (error) {
+    logger.warn({ clientId, error }, 'Failed to decrypt stored OAuth credentials')
+    return null
+  }
+}
+
+/**
+ * Persist OAuth credentials (encrypted) to the service's MongoDB document.
+ */
+async function storeCredentials(
+  serviceId: string,
+  credentials: OAuthCredentials,
+  environment: string,
+  existingCreds: ReadonlyArray<OAuthCredentialRecord> | undefined
+): Promise<void> {
+  const record: OAuthCredentialRecord = {
+    clientId: credentials.clientId,
+    clientSecretEncrypted: encrypt(credentials.clientSecret),
+    environment: environment as OAuthCredentialRecord['environment'],
+    provisionedAt: new Date().toISOString(),
+  }
+
+  // Replace existing record for this environment, or append
+  const filtered = (existingCreds ?? []).filter(
+    c => !(c.clientId === credentials.clientId && c.environment === environment)
+  )
+
+  await getServicesCollection().updateOne(
+    { id: serviceId },
+    { $set: { oauthCredentials: [...filtered, record], updatedAt: new Date().toISOString() } }
+  )
+
+  logger.info({ clientId: credentials.clientId, environment }, 'OAuth credentials stored in service record')
+}
+
+/**
+ * Try to create a new OAuth client in Bio-id.
+ * Returns the credentials if successful, null otherwise.
+ */
+async function createNewOAuthClient(
+  clientId: string,
+  serviceName: string,
+  environment: string,
+  redirectUris: ReadonlyArray<string>,
+  createdBy?: string,
+  grants?: ReadonlyArray<string>,
+  scopes?: ReadonlyArray<string>,
+  orgSlug?: string
+): Promise<OAuthCredentials | null> {
+  const bioClient = getBioClient()
+
+  const createResult = await bioClient.createClient({
+    clientId,
+    name: `${serviceName} (${environment})`,
+    redirectUris: [...redirectUris],
+    allowedGrantTypes: grants ? [...grants] : ['authorization_code', 'refresh_token'],
+    ...(scopes ? { allowedScopes: [...scopes] } : {}),
+    ...(createdBy ? { createdBy } : {}),
+    ...(orgSlug ? { orgSlug } : {}),
+  })
+
+  if (!createResult.success) {
+    logger.error(
+      { clientId, error: createResult.error },
+      'Failed to create OAuth client in Bio-id'
+    )
+    return null
+  }
+
+  const data = createResult.data as BioClientData
+  if (!data.clientSecret) {
+    logger.error({ clientId }, 'Bio-ID did not return clientSecret on create')
+    return null
+  }
+  return {
+    clientId: data.clientId,
+    clientSecret: data.clientSecret,
+  }
+}
+
+/**
+ * Update an existing OAuth client's redirect URIs in Bio-ID.
+ * Does NOT attempt to retrieve or regenerate the secret — the caller
+ * must already have the secret from the stored credentials.
+ */
+async function syncRedirectUris(
+  clientId: string,
+  redirectUris: ReadonlyArray<string>,
+  createdBy?: string,
+  grants?: ReadonlyArray<string>,
+  scopes?: ReadonlyArray<string>,
+  orgSlug?: string
+): Promise<void> {
+  const bioClient = getBioClient()
+
+  const updateResult = await bioClient.updateClient(clientId, {
+    redirectUris: [...redirectUris],
+    ...(grants ? { allowedGrantTypes: [...grants] } : {}),
+    ...(scopes ? { allowedScopes: [...scopes] } : {}),
+    ...(createdBy ? { createdBy } : {}),
+    ...(orgSlug ? { orgSlug } : {}),
+  })
+
+  if (!updateResult.success) {
+    logger.warn(
+      { clientId, error: updateResult.error },
+      'Failed to update OAuth client redirect URIs'
+    )
+  }
+}
+
+/**
+ * Provision an OAuth client in Bio-id for a deployed service.
+ *
+ * Priority order for the client secret:
+ * 1. Stored credentials in MongoDB (encrypted) — normal path for subsequent deploys
+ * 2. Create new client in Bio-ID — first deploy
+ * 3. Regenerate secret — client exists in Bio-ID but no stored credentials (migration)
+ *
+ * Credentials are persisted (encrypted) in the service document for future deploys.
+ * Redirect URIs are synced on every deploy to pick up custom domain changes.
+ *
+ * Returns null if Bio-id is unavailable or provisioning fails.
+ */
+export async function provisionOAuthClient(
+  serviceName: string,
+  environment: string,
+  namespace: string,
+  customDomains?: ReadonlyArray<CustomDomainRecord>,
+  createdBy?: string,
+  authMode?: AuthMode,
+  serviceId?: string,
+  storedOAuthCreds?: ReadonlyArray<OAuthCredentialRecord>,
+  hasExternalDeps?: boolean,
+  dependencyScopes?: ReadonlyArray<string>,
+  orgSlug?: string
+): Promise<OAuthCredentials | null> {
+  const clientId = buildOAuthClientId(serviceName, environment)
+
+  const grants = authMode === 'service-only'
+    ? ['client_credentials'] as const
+    : hasExternalDeps
+      ? ['authorization_code', 'refresh_token', 'client_credentials'] as const
+      : ['authorization_code', 'refresh_token'] as const
+
+  const redirectUris = authMode === 'service-only'
+    ? []
+    : buildRedirectUris(serviceName, environment, customDomains)
+
+  // Merge SSO scopes with dependency scopes (e.g. relay:send)
+  const ssoScopes = ['openid', 'profile', 'email']
+  const allScopes = Array.from(new Set([...ssoScopes, ...(dependencyScopes || [])]))
+
+  logger.info(
+    { clientId, serviceName, environment, authMode, redirectUris, grants, allowedScopes: allScopes },
+    'Provisioning OAuth client'
+  )
+
+  try {
+    // 1. Check stored credentials first (fastest, no network call to Bio-ID)
+    const stored = readStoredCredentials(storedOAuthCreds, clientId, environment)
+    if (stored) {
+      logger.info({ clientId }, 'Using stored OAuth credentials, syncing redirect URIs')
+      await syncRedirectUris(clientId, redirectUris, createdBy, [...grants], allScopes, orgSlug)
+      return stored
+    }
+
+    // 2. No stored credentials — check Bio-ID
+    const bioClient = getBioClient()
+    const existingResult = await bioClient.getClient(clientId)
+
+    let credentials: OAuthCredentials | null
+
+    if (existingResult.success && existingResult.data) {
+      // Client exists in Bio-ID but we have no stored secret.
+      // Must regenerate to get a secret we can store.
+      logger.warn({ clientId }, 'OAuth client exists in Bio-ID but no stored credentials, regenerating secret')
+      await syncRedirectUris(clientId, redirectUris, createdBy, [...grants], allScopes, orgSlug)
+      const regenResult = await bioClient.regenerateSecret(clientId)
+      const regenSecret = (regenResult.data as BioClientData | undefined)?.clientSecret
+
+      if (!regenSecret) {
+        logger.error({ clientId, error: regenResult.error }, 'Failed to regenerate OAuth client secret')
+        return null
+      }
+      credentials = { clientId, clientSecret: regenSecret }
+    } else if (
+      existingResult.error?.code === 'NOT_FOUND' ||
+      existingResult.error?.code === 'RESOURCE_NOT_FOUND'
+    ) {
+      // Client does not exist — create new
+      logger.info({ clientId }, 'OAuth client not found, creating new')
+      credentials = await createNewOAuthClient(clientId, serviceName, environment, redirectUris, createdBy, [...grants], allScopes, orgSlug)
+    } else {
+      // Bio-id returned an unexpected error (likely unavailable)
+      logger.error(
+        { clientId, error: existingResult.error },
+        'Bio-id returned unexpected error, skipping OAuth provisioning'
+      )
+      return null
+    }
+
+    if (!credentials) {
+      return null
+    }
+
+    // 3. Store credentials for future deploys
+    if (serviceId) {
+      await storeCredentials(serviceId, credentials, environment, storedOAuthCreds)
+    }
+
+    return credentials
+  } catch (error) {
+    const message = error instanceof Error ? error.message : 'Unknown error'
+    logger.error(
+      { clientId, error: message },
+      'OAuth provisioning failed'
+    )
+    return null
+  }
+}

package/src/services/pod-diagnostics.ts

@@ -0,0 +1,261 @@
+import { spawn } from 'child_process'
+import { logger } from '../utils/logger.js'
+import type { PodDiagnostic, ContainerStatusInfo, PodEventInfo, DeployDiagnostics } from '../models/types.js'
+
+const KUBECTL_TIMEOUT = 15_000
+
+// Strict K8s name validation to prevent command injection
+const K8S_NAME_REGEX = /^[a-z0-9][a-z0-9._-]{0,252}$/
+
+function validateK8sName(value: string, label: string): string {
+  if (!K8S_NAME_REGEX.test(value)) {
+    throw new Error(`Invalid ${label}: "${value}"`)
+  }
+  return value
+}
+
+async function kubectlArgs(args: ReadonlyArray<string>): Promise<string> {
+  return new Promise((resolve) => {
+    const proc = spawn('kubectl', args as string[])
+    let out = ''
+    let errOut = ''
+    proc.stdout.on('data', (chunk: Buffer) => { out += chunk.toString() })
+    proc.stderr.on('data', (chunk: Buffer) => { errOut += chunk.toString() })
+    proc.on('close', (code) => {
+      if (code !== 0 && errOut) {
+        logger.warn({ args: args.slice(0, 6), code }, 'kubectl command failed (diagnostic)')
+      }
+      resolve(out.trim())
+    })
+    proc.on('error', (err) => {
+      logger.warn({ args: args.slice(0, 6), err }, 'kubectl spawn failed (diagnostic)')
+      resolve('')
+    })
+    const timer = setTimeout(() => {
+      proc.kill('SIGTERM')
+      resolve('')
+    }, KUBECTL_TIMEOUT)
+    proc.on('close', () => clearTimeout(timer))
+  })
+}
+
+interface K8sContainerStatus {
+  name: string
+  ready: boolean
+  restartCount: number
+  state: Record<string, { reason?: string; message?: string; exitCode?: number; startedAt?: string }>
+  lastState?: Record<string, { reason?: string; message?: string; exitCode?: number }>
+}
+
+interface K8sPodItem {
+  metadata: { name: string; namespace: string }
+  status: {
+    phase: string
+    reason?: string
+    containerStatuses?: K8sContainerStatus[]
+    initContainerStatuses?: K8sContainerStatus[]
+  }
+}
+
+interface K8sEvent {
+  type: string
+  reason: string
+  message: string
+  lastTimestamp?: string
+  eventTime?: string
+  metadata?: { creationTimestamp?: string }
+  involvedObject?: { name: string }
+}
+
+function parseContainerStatus(cs: K8sContainerStatus): ContainerStatusInfo {
+  const stateKey = Object.keys(cs.state)[0] ?? 'unknown'
+  const stateDetail = cs.state[stateKey] ?? {}
+  const lastStateKey = cs.lastState ? Object.keys(cs.lastState)[0] : undefined
+  const lastDetail = lastStateKey && cs.lastState ? cs.lastState[lastStateKey] : undefined
+
+  return {
+    name: cs.name,
+    ready: cs.ready,
+    state: stateKey,
+    reason: stateDetail.reason ?? lastDetail?.reason,
+    message: stateDetail.message ?? lastDetail?.message,
+    exitCode: stateDetail.exitCode ?? lastDetail?.exitCode,
+  }
+}
+
+function computeRestartCount(containerStatuses: K8sContainerStatus[] | undefined): number {
+  if (!containerStatuses) return 0
+  return containerStatuses.reduce((sum, cs) => sum + (cs.restartCount || 0), 0)
+}
+
+export async function getPodEvents(namespace: string, podName: string): Promise<ReadonlyArray<PodEventInfo>> {
+  const ns = validateK8sName(namespace, 'namespace')
+  const pod = validateK8sName(podName, 'podName')
+  const raw = await kubectlArgs([
+    'get', 'events', '-n', ns,
+    '--field-selector', `involvedObject.name=${pod}`,
+    '--sort-by=.lastTimestamp', '-o', 'json',
+  ])
+  if (!raw) return []
+
+  try {
+    const parsed = JSON.parse(raw)
+    const items: K8sEvent[] = parsed.items ?? []
+    return items.slice(-20).map((e) => ({
+      type: e.type ?? 'Normal',
+      reason: e.reason ?? 'Unknown',
+      message: e.message ?? '',
+      age: e.lastTimestamp ?? e.eventTime ?? e.metadata?.creationTimestamp ?? '',
+    }))
+  } catch {
+    return []
+  }
+}
+
+export async function getContainerLogs(
+  namespace: string,
+  podName: string,
+  options?: { previous?: boolean; tail?: number; container?: string }
+): Promise<string> {
+  const ns = validateK8sName(namespace, 'namespace')
+  const pod = validateK8sName(podName, 'podName')
+  const tail = options?.tail ?? 50
+  const args = ['logs', '-n', ns, pod, `--tail=${tail}`]
+  if (options?.previous) args.push('--previous')
+  if (options?.container) {
+    args.push('-c', validateK8sName(options.container, 'container'))
+  }
+
+  return kubectlArgs(args)
+}
+
+export async function getPods(namespace: string, serviceName?: string): Promise<ReadonlyArray<PodDiagnostic>> {
+  const ns = validateK8sName(namespace, 'namespace')
+  const baseArgs = ['get', 'pods', '-n', ns, '-o', 'json']
+  const labelArgs = serviceName
+    ? [...baseArgs, '-l', `app=${validateK8sName(serviceName, 'serviceName')}`]
+    : baseArgs
+  const raw = await kubectlArgs(labelArgs)
+  if (!raw) {
+    // Try alternative label selector for custom charts
+    if (serviceName) {
+      const altRaw = await kubectlArgs([
+        ...baseArgs, '-l', `app.kubernetes.io/name=${validateK8sName(serviceName, 'serviceName')}`,
+      ])
+      if (altRaw) return parsePodList(altRaw, ns)
+    }
+    return []
+  }
+
+  return parsePodList(raw, ns)
+}
+
+async function parsePodList(raw: string, namespace: string): Promise<ReadonlyArray<PodDiagnostic>> {
+  try {
+    const parsed = JSON.parse(raw)
+    const items: K8sPodItem[] = parsed.items ?? []
+
+    const results = await Promise.all(
+      items.map(async (pod) => {
+        const containerStatuses = (pod.status.containerStatuses ?? []).map(parseContainerStatus)
+        const initContainerStatuses = (pod.status.initContainerStatuses ?? []).map(parseContainerStatus)
+        const restartCount = computeRestartCount(pod.status.containerStatuses)
+        const events = await getPodEvents(namespace, pod.metadata.name)
+
+        const isUnhealthy = pod.status.phase !== 'Running' && pod.status.phase !== 'Succeeded'
+        const hasCrashes = restartCount > 0
+        const logs = isUnhealthy || hasCrashes
+          ? await getContainerLogs(namespace, pod.metadata.name, { tail: 50 })
+          : undefined
+
+        const previousLogs = hasCrashes
+          ? await getContainerLogs(namespace, pod.metadata.name, { tail: 30, previous: true })
+          : undefined
+
+        const combinedLogs = [previousLogs ? `--- Previous container ---\n${previousLogs}` : '', logs]
+          .filter(Boolean)
+          .join('\n--- Current container ---\n')
+
+        const diagnostic: PodDiagnostic = {
+          name: pod.metadata.name,
+          phase: pod.status.phase,
+          reason: pod.status.reason,
+          restartCount,
+          containerStatuses,
+          ...(initContainerStatuses.length > 0 ? { initContainerStatuses } : {}),
+          events,
+          ...(combinedLogs ? { logs: combinedLogs } : {}),
+        }
+        return diagnostic
+      })
+    )
+
+    return results
+  } catch {
+    return []
+  }
+}
+
+export function summarizeDiagnostics(pods: ReadonlyArray<PodDiagnostic>): string {
+  if (pods.length === 0) return 'No pods found in namespace'
+
+  const issues: string[] = []
+
+  for (const pod of pods) {
+    const allStatuses = [...pod.containerStatuses, ...(pod.initContainerStatuses ?? [])]
+
+    for (const cs of allStatuses) {
+      if (cs.reason === 'CrashLoopBackOff') {
+        issues.push(`CrashLoopBackOff: ${cs.name} in ${pod.name} (${pod.restartCount} restarts)`)
+      }
+      if (cs.reason === 'ImagePullBackOff' || cs.reason === 'ErrImagePull') {
+        issues.push(`ImagePullBackOff: ${cs.name} in ${pod.name}`)
+      }
+      if (cs.reason === 'OOMKilled') {
+        issues.push(`OOMKilled: ${cs.name} in ${pod.name}`)
+      }
+      if (cs.reason === 'CreateContainerConfigError') {
+        issues.push(`CreateContainerConfigError: ${cs.name} in ${pod.name}`)
+      }
+    }
+
+    const vaultInit = (pod.initContainerStatuses ?? []).find(
+      (cs) => cs.name.includes('vault') && !cs.ready
+    )
+    if (vaultInit) {
+      issues.push(`Vault init failed: ${vaultInit.name} in ${pod.name}`)
+    }
+
+    if (pod.phase === 'Pending') {
+      const schedEvent = pod.events.find((e) => e.reason === 'FailedScheduling')
+      if (schedEvent) {
+        issues.push(`FailedScheduling: ${pod.name} — ${schedEvent.message.slice(0, 100)}`)
+      }
+    }
+  }
+
+  if (issues.length === 0) {
+    const allRunning = pods.every((p) => p.phase === 'Running' || p.phase === 'Succeeded')
+    const totalRestarts = pods.reduce((sum, p) => sum + p.restartCount, 0)
+    if (allRunning && totalRestarts === 0) return 'All pods healthy'
+    if (allRunning) return `All pods running (${totalRestarts} total restarts)`
+    return `${pods.length} pod(s) — mixed status`
+  }
+
+  return issues.join('; ')
+}
+
+export async function captureDeployDiagnostics(
+  serviceName: string,
+  namespace: string
+): Promise<DeployDiagnostics> {
+  const pods = await getPods(namespace, serviceName)
+  const summary = summarizeDiagnostics(pods)
+
+  return {
+    capturedAt: new Date().toISOString(),
+    namespace,
+    pods,
+    summary,
+  }
+}