laneyard 0.3.0 → 0.4.1

package/dist/src/server/app.js

@@ -6,14 +6,18 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { LEGACY_ADMIN_NAME } from "../config/load.js";
 import { RunStore } from "../db/runs.js";
+import { SessionRecords } from "../db/sessions.js";
 import { Workspace } from "../git/workspace.js";
 import { LogStore } from "../logs/store.js";
+import { materialiseCredentials } from "../runner/materialise.js";
 import { executeRun } from "../runner/orchestrate.js";
 import { RunQueue } from "../runner/queue.js";
-import { authenticate, LoginThrottle, SESSION_COOKIE, SessionStore } from "./auth.js";
+import { authenticate, LoginThrottle, COOKIE_OPTIONS, SESSION_COOKIE, SessionStore } from "./auth.js";
 import { requiresAdmin } from "./permissions.js";
+import { registerCredentialRoutes } from "./routes/credentials.js";
 import { registerFastfileRoutes } from "./routes/fastfile.js";
 import { registerProjectRoutes } from "./routes/projects.js";
+import { registerAccountRoutes } from "./routes/account.js";
 import { registerReadinessRoutes } from "./routes/readiness.js";
 import { registerRunRoutes } from "./routes/runs.js";
 import { registerSecretRoutes } from "./routes/secrets.js";
@@ -30,9 +34,10 @@ export async function buildApp(deps) {
         ...deps,
         runs: new RunStore(deps.db),
         logs: new LogStore(join(deps.root, "logs")),
-        sessions: new SessionStore(),
+        sessions: new SessionStore(new SessionRecords(deps.db)),
         workspacePath,
         artifactsDir: (runId) => join(deps.root, "artifacts", String(runId)),
+        runSecretsDir: (runId) => join(deps.root, "runs", String(runId), "secrets"),
         ensureWorkspace: async (slug) => {
             const entry = deps.config.project(slug);
             if (!entry)
@@ -61,6 +66,23 @@ export async function buildApp(deps) {
             });
             return;
         }
+        // Before the run, and outside it: `executeRun` is handed plaintext and
+        // never the vault, a boundary worth more than the convenience of moving
+        // this one call inside. A block that will not decrypt stops the run here,
+        // with the reason, rather than producing an artifact signed by nothing.
+        let credentials;
+        try {
+            credentials = await materialiseCredentials(ctx.vault, slug, ctx.runSecretsDir(runId));
+        }
+        catch (cause) {
+            ctx.runs.finish(runId, {
+                status: "failed",
+                exitCode: null,
+                errorSummary: ctx.vault.scrub(slug, cause.message),
+            });
+            ctx.sockets?.finish(runId, "failed");
+            return;
+        }
         await executeRun({
             runId,
             runs: ctx.runs,
@@ -77,6 +99,9 @@ export async function buildApp(deps) {
             },
             env: process.env,
             secrets: ctx.vault.resolve(slug),
+            credentialEnv: credentials.env,
+            androidKeystore: credentials.keystore,
+            cleanup: credentials.cleanup,
             maskedValues: ctx.vault.maskedValues(slug),
             signal,
             onChunk: (chunk, offset) => app.broadcastRunChunk?.(runId, chunk, offset),
@@ -130,7 +155,7 @@ export async function buildApp(deps) {
         throttle.recordSuccess(account);
         const token = ctx.sessions.issue(identity);
         return reply
-            .setCookie(SESSION_COOKIE, token, { path: "/", httpOnly: true, sameSite: "lax" })
+            .setCookie(SESSION_COOKIE, token, COOKIE_OPTIONS)
             .send({ ok: true, name: identity.name, role: identity.role });
     });
     // Every /api route except /api/login requires a session, and the routes on
@@ -180,9 +205,11 @@ export async function buildApp(deps) {
     await registerProjectRoutes(app, ctx);
     await registerRunRoutes(app, ctx);
     await registerSecretRoutes(app, ctx);
+    await registerCredentialRoutes(app, ctx);
     await registerReadinessRoutes(app, ctx);
     await registerFastfileRoutes(app, ctx);
     await registerUserRoutes(app, ctx);
+    await registerAccountRoutes(app, ctx);
     // Resolved from the module's location, not from the data folder:
     // `deps.root` is ~/.laneyard, the built SPA lives in the repository. Two
     // relative positions, depending on whether we're running on the sources

package/dist/src/server/auth.js

@@ -65,23 +65,47 @@ export async function authenticate(users, name, password) {
         return null;
     return { name: user.name, role: user.role };
 }
-/** In-memory sessions: they don't survive a restart, and that's just fine. */
+/**
+ * How long a session lasts, and how long the cookie is kept for.
+ *
+ * Thirty days, not forever: a browser left on a desk is the reason the password
+ * change asks for the current password, and a session that never ended would
+ * make that precaution pointless. The cookie carries the same figure, so the
+ * browser stops presenting a token the server would refuse anyway.
+ */
+export const SESSION_TTL_DAYS = 30;
+export const SESSION_TTL_MS = SESSION_TTL_DAYS * 24 * 60 * 60 * 1000;
+/**
+ * Sessions, kept in the database so they outlive a restart.
+ *
+ * They used to be a Map, with a comment saying they did not survive a restart
+ * "and that's just fine". It was not: restarting the server to pick up an edit
+ * to config.yml signed everybody out, which on a machine still being set up is
+ * several times an hour. The API is unchanged — every caller still issues, gets
+ * and revokes — only the shelf underneath is different.
+ */
 export class SessionStore {
-    tokens = new Map();
-    issue(identity) {
+    records;
+    constructor(records) {
+        this.records = records;
+    }
+    issue(identity, now = new Date()) {
         const token = randomBytes(32).toString("hex");
-        this.tokens.set(token, identity);
+        this.records.insert(token, identity, new Date(now.getTime() + SESSION_TTL_MS));
         return token;
     }
     /** Who the token belongs to, or undefined if it belongs to nobody. */
     get(token) {
-        return token === undefined ? undefined : this.tokens.get(token);
+        if (token === undefined)
+            return undefined;
+        const owner = this.records.find(token);
+        return owner ? { name: owner.name, role: owner.role } : undefined;
     }
     valid(token) {
         return this.get(token) !== undefined;
     }
     revoke(token) {
-        this.tokens.delete(token);
+        this.records.remove(token);
     }
     /**
      * Drops every session belonging to a name.
@@ -93,13 +117,29 @@ export class SessionStore {
      * every interface that offers the first implies the second.
      */
     revokeAllFor(name) {
-        for (const [token, identity] of this.tokens) {
-            if (identity.name === name)
-                this.tokens.delete(token);
-        }
+        this.records.removeAllFor(name);
     }
 }
 export const SESSION_COOKIE = "laneyard_session";
+/**
+ * How the session cookie is written, in one place so the two routes that issue
+ * one cannot disagree.
+ *
+ * `maxAge` is the half that was missing: without it the browser treats this as
+ * a session cookie and forgets it the moment the window closes, so signing in
+ * again was the price of quitting Chrome. It matches the server's own TTL, so
+ * the browser stops presenting a token the server would refuse anyway.
+ *
+ * Not `secure`: Laneyard is commonly reached over plain HTTP on a local
+ * network, and a cookie the browser refuses to send is a login page that never
+ * goes away.
+ */
+export const COOKIE_OPTIONS = {
+    path: "/",
+    httpOnly: true,
+    sameSite: "lax",
+    maxAge: SESSION_TTL_MS / 1000,
+};
 /** Past this many tracked names, the entries that no longer delay anyone go. */
 const THROTTLE_PRUNE_ABOVE = 1_000;
 /**

package/dist/src/server/permissions.js

@@ -20,6 +20,8 @@
 export const REQUIRES_ADMIN = [
     { method: "*", path: "/api/secrets" },
     { method: "*", path: "/api/projects/:slug/secrets" },
+    { method: "*", path: "/api/credentials" },
+    { method: "*", path: "/api/projects/:slug/credentials" },
     { method: "PUT", path: "/api/projects/:slug/fastfile" },
     { method: "POST", path: "/api/projects/:slug/commit" },
     { method: "POST", path: "/api/projects/:slug/push" },

package/dist/src/server/required-secrets.js

@@ -0,0 +1,30 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parseEnvExample } from "../heuristics/env-example.js";
+export async function requiredSecrets(input) {
+    const fromExample = await envExampleNames(input.workspacePath, input.fastlaneDir);
+    const required = [
+        ...new Set([...input.lanes.flatMap((l) => l.env ?? []), ...input.declared, ...fromExample]),
+    ].sort();
+    const supplied = new Set([...input.vaultKeys, ...input.blockNames, ...input.serverEnv]);
+    return {
+        required,
+        missing: required.filter((name) => !supplied.has(name)),
+    };
+}
+/**
+ * The names a committed `.env.example` advertises, if there is one.
+ *
+ * Two conventional filenames and no more: a convenience for the common case,
+ * not a search. Never throws — an absent file is the ordinary situation and
+ * means "nothing declared", not a failure.
+ */
+export async function envExampleNames(workspacePath, fastlaneDir) {
+    const names = [];
+    for (const file of [".env.example", ".env.sample"]) {
+        const text = await readFile(join(workspacePath, fastlaneDir, file), "utf8").catch(() => null);
+        if (text !== null)
+            names.push(...parseEnvExample(text));
+    }
+    return names;
+}

package/dist/src/server/routes/account.js

@@ -0,0 +1,57 @@
+import { MIN_PASSWORD_LENGTH, upsertUserInConfig } from "../../config/accounts.js";
+import { COOKIE_OPTIONS, SESSION_COOKIE, authenticate } from "../auth.js";
+/**
+ * What someone may do to their own account, whatever their role.
+ *
+ * Deliberately not under `/api/users`: that prefix is on the admin list in
+ * `permissions.ts`, and it means "the accounts on this machine". This is the
+ * other thing entirely — one person, their own password — and a builder must be
+ * able to reach it. Changing the password of somebody *else* stays admin-only,
+ * and stays over there.
+ *
+ * The current password is required even though the session already proves who
+ * this is. A session is a cookie in a browser that may have been left open on a
+ * desk; a password is the one thing that says the person at the keyboard is
+ * still the person who signed in.
+ */
+export async function registerAccountRoutes(app, ctx) {
+    app.post("/api/account/password", async (req, reply) => {
+        // Non-null: the hook in `app.ts` rejected every request without a session
+        // before this handler could run.
+        const { name, role } = req.identity;
+        const { current, next } = (req.body ?? {});
+        if (typeof next !== "string" || next.length < MIN_PASSWORD_LENGTH) {
+            return reply
+                .code(400)
+                .send({ error: `A password is at least ${MIN_PASSWORD_LENGTH} characters.` });
+        }
+        const users = ctx.config.server()?.users ?? [];
+        if (typeof current !== "string" || !(await authenticate(users, name, current))) {
+            // No throttle here, unlike `/api/login`: reaching this route already costs
+            // a valid session, so there is nobody to slow down who is not already in.
+            return reply.code(401).send({ error: "That is not your current password." });
+        }
+        if (next === current) {
+            return reply.code(400).send({ error: "That is the password you already have." });
+        }
+        // The role is carried over rather than read from the body: this route
+        // changes a password and nothing else, and an account that could hand
+        // itself `admin` in a field named `role` would make the whole permission
+        // table decorative.
+        await upsertUserInConfig(ctx.config.configPath(), { name, role, password: next });
+        // Every session this account has, gone — including this one. That is the
+        // point: changing a password is what someone does when they think another
+        // browser somewhere should stop being signed in. A fresh session is issued
+        // immediately afterwards, so the person who just did it is not signed out
+        // of the page they did it on.
+        ctx.sessions.revokeAllFor(name);
+        const token = ctx.sessions.issue({ name, role });
+        // The file is watched on a debounce; loading here is what makes the very
+        // next request see the new hash instead of the old one.
+        await ctx.config.load();
+        return reply
+            .setCookie(SESSION_COOKIE, token, COOKIE_OPTIONS)
+            .code(204)
+            .send();
+    });
+}

package/dist/src/server/routes/credentials.js

@@ -0,0 +1,108 @@
+import { CREDENTIAL_KINDS, defaultVarNames, fieldsOf } from "../../credentials/kinds.js";
+/**
+ * Signing blocks over HTTP: the file and the fields that make it usable.
+ *
+ * The file arrives base64 inside a JSON body rather than as a multipart upload.
+ * No multipart plugin is registered — see `app.ts` — and a `.p8` is two
+ * kilobytes, so adding a dependency to carry it would be paying in supply chain
+ * for a convenience the browser can provide in one `FileReader` call.
+ *
+ * A block is taken or refused whole. That is what makes it a block rather than
+ * three loose rows: a keystore stored without its alias is not a partial
+ * success, it is a build that fails in a month with an unusable artifact.
+ */
+/** POSIX environment variable names. Anything else would never reach fastlane. */
+const VALID_VAR = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export async function registerCredentialRoutes(app, ctx) {
+    app.get("/api/credentials", async () => ctx.vault.listGlobalCredentials());
+    app.get("/api/projects/:slug/credentials", async (req, reply) => {
+        const { slug } = req.params;
+        if (!ctx.config.project(slug))
+            return reply.code(404).send({ error: "Unknown project" });
+        return ctx.vault.listCredentials(slug);
+    });
+    const put = async (slug, kind, body, reply) => {
+        const spec = CREDENTIAL_KINDS.find((k) => k.kind === kind);
+        if (!spec) {
+            return reply.code(400).send({
+                error: `"${kind}" is not a kind of credential Laneyard knows: ${CREDENTIAL_KINDS.map((k) => k.kind).join(", ")}.`,
+            });
+        }
+        const { fileName, fileBase64, fields, varNames } = (body ?? {});
+        if (typeof fileName !== "string" || fileName === "") {
+            return reply.code(400).send({ error: "A file name is required" });
+        }
+        if (typeof fileBase64 !== "string" || fileBase64 === "") {
+            return reply.code(400).send({ error: `The ${spec.what} file is required, base64-encoded.` });
+        }
+        const given = (fields ?? {});
+        if (typeof given !== "object" || Array.isArray(given)) {
+            return reply.code(400).send({ error: "`fields` is an object of name to value." });
+        }
+        // Optional fields are the settings a block may leave unanswered — where a
+        // gradle properties file goes, what it is read under. Laneyard is allowed to
+        // ask; refusing the whole block over an unanswered one would be requiring.
+        const missing = fieldsOf(spec.kind)
+            .filter((f) => !f.optional && (typeof given[f.name] !== "string" || given[f.name] === ""))
+            .map((f) => f.name);
+        if (missing.length > 0) {
+            return reply.code(400).send({
+                error: `A ${spec.what} needs ${missing.join(", ")}. Without it the file alone signs nothing.`,
+            });
+        }
+        // Only the fields the kind declares are kept. An extra one would be stored,
+        // never read, and quietly disagree with what the block claims to be.
+        const kept = {};
+        for (const field of fieldsOf(spec.kind)) {
+            const value = given[field.name];
+            // An unanswered optional field is absent from the block rather than
+            // stored empty: the reader then falls back to what it would have used
+            // anyway, instead of taking "" for an answer someone gave.
+            if (typeof value === "string" && value !== "")
+                kept[field.name] = value;
+        }
+        const names = { ...defaultVarNames(spec.kind), ...(varNames ?? {}) };
+        for (const [slot, name] of Object.entries(names)) {
+            if (!(slot in defaultVarNames(spec.kind))) {
+                return reply.code(400).send({ error: `A ${spec.what} exports nothing called "${slot}".` });
+            }
+            if (typeof name !== "string" || !VALID_VAR.test(name)) {
+                return reply.code(400).send({
+                    error: `"${name}" is not a valid environment variable name: letters, digits and underscore, not starting with a digit.`,
+                });
+            }
+        }
+        // Node's base64 decoder ignores what it cannot read rather than refusing, so
+        // a truncated or mistyped upload would be stored as a shorter file and only
+        // surface as an unreadable key at signing time.
+        const fileBytes = Buffer.from(fileBase64, "base64");
+        if (fileBytes.length === 0 || fileBytes.toString("base64").replace(/=+$/, "") !== fileBase64.replace(/=+$/, "")) {
+            return reply.code(400).send({ error: "The file is not valid base64." });
+        }
+        await ctx.vault.setCredential(slug, spec.kind, { fileName, fileBytes, fields: kept, varNames: names });
+        return reply.code(204).send();
+    };
+    app.put("/api/credentials/:kind", async (req, reply) => put(null, req.params.kind, req.body, reply));
+    app.put("/api/projects/:slug/credentials/:kind", async (req, reply) => {
+        const { slug, kind } = req.params;
+        if (!ctx.config.project(slug))
+            return reply.code(404).send({ error: "Unknown project" });
+        return put(slug, kind, req.body, reply);
+    });
+    app.delete("/api/credentials/:kind", async (req, reply) => {
+        const { kind } = req.params;
+        const removed = ctx.vault.removeCredential(null, kind);
+        return removed ? reply.code(204).send() : reply.code(404).send({ error: "Unknown credential" });
+    });
+    /**
+     * Removes this project's own block, and only that one. A global block that
+     * was shadowed comes back into view, which is the deletion someone asked for:
+     * they are undoing an override, not deleting everyone's key from inside one
+     * project.
+     */
+    app.delete("/api/projects/:slug/credentials/:kind", async (req, reply) => {
+        const { slug, kind } = req.params;
+        const removed = ctx.vault.removeCredential(slug, kind);
+        return removed ? reply.code(204).send() : reply.code(404).send({ error: "Unknown credential" });
+    });
+}

package/dist/src/server/routes/projects.js

@@ -20,7 +20,15 @@ export async function registerProjectRoutes(app, ctx) {
      *    history of what this machine built is not the project's to take away;
      *  - the clone and the artifacts stay on disk, named in the answer so they
      *    can be removed by hand. Deleting files someone may still want, from a
-     *    web page, on one click, is not a thing to do.
+     *    web page, on one click, is not a thing to do;
+     *  - its secrets and its signing blocks stay in the vault, counted in the
+     *    answer. They are the one thing here that cannot be looked at from the
+     *    interface — no route ever sends a credential back — so if this does not
+     *    say they are there, nothing ever will. They are also scoped by slug: a
+     *    project set up later under the same name would find the old keystore
+     *    waiting for it, and sign with a credential nobody uploaded. Removing
+     *    them is `DELETE /api/projects/:slug/vault`, below, and it is a second
+     *    act on purpose.
      */
     app.delete("/api/projects/:slug", async (req, reply) => {
         const { slug } = req.params;
@@ -48,7 +56,57 @@ export async function registerProjectRoutes(app, ctx) {
             ctx.workspacePath(slug),
             ...runs.map((run) => ctx.artifactsDir(run.id)),
         ].filter((path) => existsSync(path));
-        return reply.send({ slug, name: entry.name, runsKept: runs.length, leftOnDisk });
+        // Counted after the block is gone, and read from the vault rather than
+        // inferred: the two stores are the only thing that knows, and this is the
+        // last moment anyone is looking.
+        const owned = ctx.vault.ownedBy(slug);
+        return reply.send({
+            slug,
+            name: entry.name,
+            runsKept: runs.length,
+            leftOnDisk,
+            vaultKept: {
+                secrets: owned.secrets.length,
+                signingBlocks: owned.credentials.length,
+                // Named separately because they are not this project's to lose. A
+                // global secret is read by every project on the machine, and an answer
+                // that folded them into one number would invite removing them.
+                globalSecrets: ctx.vault.listGlobal().length,
+                globalSigningBlocks: ctx.vault.listGlobalCredentials().length,
+            },
+        });
+    });
+    /**
+     * Removes what the vault still holds under a removed project's name.
+     *
+     * Deliberately not part of removing the project. That route destroys nothing,
+     * and the reason is the one this route has to earn instead: a signing block
+     * cannot be read back out of Laneyard — the `.p8` and the keystore that went
+     * in are the only copies it ever had — so deleting one on the same click that
+     * hides a project from a list would be destroying something unrecoverable as
+     * a side effect of tidying up.
+     *
+     * Refused while the slug is still a project, so this can only ever be the
+     * clean-up after a removal. A live project's secrets and blocks are removed
+     * one at a time, from the tabs that show them, where the user can see what
+     * each one is.
+     *
+     * Only rows carrying this slug go. A global secret and a global signing block
+     * are shared by every project and survive it.
+     */
+    app.delete("/api/projects/:slug/vault", async (req, reply) => {
+        const { slug } = req.params;
+        if (ctx.config.project(slug)) {
+            return reply.code(409).send({
+                error: `"${slug}" is still a project on this machine. Remove the project first, or remove its secrets and signing blocks one at a time from its own tabs.`,
+            });
+        }
+        const removed = ctx.vault.forget(slug);
+        return reply.send({
+            slug,
+            secretsRemoved: removed.secrets,
+            signingBlocksRemoved: removed.credentials,
+        });
     });
     app.get("/api/projects/:slug/lanes", async (req, reply) => {
         const { slug } = req.params;