myaidev-method 0.2.8 → 0.2.9

package/src/server/user-management/LinuxUserService.ts

@@ -0,0 +1,338 @@
+import { Effect, Context, Layer } from "effect";
+import { execSync } from "child_process";
+
+/**
+ * Linux User Management Service
+ *
+ * Handles creation, management, and deletion of Linux system users
+ * for multi-user isolation in MyAIDev Method web server.
+ *
+ * Security Features:
+ * - No sudo/root access granted to created users
+ * - Limited shell access (rbash or nologin)
+ * - Home directory isolation
+ * - Resource limits via ulimit
+ * - User groups for permission management
+ */
+
+export interface LinuxUser {
+  username: string;
+  uid: number;
+  gid: number;
+  homeDir: string;
+  shell: string;
+  created: boolean;
+}
+
+export interface CreateLinuxUserOptions {
+  username: string;
+  shell?: "/bin/rbash" | "/usr/sbin/nologin" | "/bin/bash";
+  createHome?: boolean;
+  groups?: string[];
+}
+
+export interface LinuxUserError {
+  readonly _tag: "LinuxUserError";
+  readonly message: string;
+  readonly cause?: unknown;
+}
+
+const LinuxUserError = (message: string, cause?: unknown): LinuxUserError => ({
+  _tag: "LinuxUserError",
+  message,
+  cause,
+});
+
+export class LinuxUserService extends Context.Tag("LinuxUserService")<
+  LinuxUserService,
+  {
+    /**
+     * Create a new Linux system user
+     */
+    readonly createUser: (
+      options: CreateLinuxUserOptions
+    ) => Effect.Effect<LinuxUser, LinuxUserError>;
+
+    /**
+     * Check if a Linux user exists
+     */
+    readonly userExists: (
+      username: string
+    ) => Effect.Effect<boolean, LinuxUserError>;
+
+    /**
+     * Get Linux user information
+     */
+    readonly getUserInfo: (
+      username: string
+    ) => Effect.Effect<LinuxUser, LinuxUserError>;
+
+    /**
+     * Delete a Linux system user
+     */
+    readonly deleteUser: (
+      username: string,
+      removeHome?: boolean
+    ) => Effect.Effect<void, LinuxUserError>;
+
+    /**
+     * Set resource limits for a user
+     */
+    readonly setResourceLimits: (
+      username: string,
+      limits: ResourceLimits
+    ) => Effect.Effect<void, LinuxUserError>;
+
+    /**
+     * Sanitize username for Linux system use
+     * Converts email-based usernames to valid Linux usernames
+     */
+    readonly sanitizeUsername: (
+      username: string
+    ) => Effect.Effect<string, LinuxUserError>;
+  }
+>() {
+  static Live = Layer.succeed(this, {
+    createUser: (options: CreateLinuxUserOptions) =>
+      Effect.gen(function* () {
+        const { username, shell = "/bin/rbash", createHome = true, groups = [] } = options;
+
+        // Validate username format (Linux username requirements)
+        if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(username)) {
+          return yield* Effect.fail(
+            LinuxUserError(
+              `Invalid Linux username format: ${username}. Must start with lowercase letter or underscore, contain only lowercase letters, digits, underscores, and hyphens, and be 1-32 characters long.`
+            )
+          );
+        }
+
+        // Check if user already exists
+        const exists = yield* Effect.tryPromise({
+          try: async () => {
+            try {
+              execSync(`id -u ${username}`, { stdio: "ignore" });
+              return true;
+            } catch {
+              return false;
+            }
+          },
+          catch: (error) => LinuxUserError("Failed to check if user exists", error),
+        });
+
+        if (exists) {
+          return yield* Effect.fail(
+            LinuxUserError(`Linux user ${username} already exists`)
+          );
+        }
+
+        // Create user command
+        const createHomeFlag = createHome ? "--create-home" : "--no-create-home";
+        const groupsFlag = groups.length > 0 ? `--groups ${groups.join(",")}` : "";
+        const command = `sudo useradd ${createHomeFlag} --shell ${shell} ${groupsFlag} ${username}`;
+
+        yield* Effect.tryPromise({
+          try: async () => {
+            execSync(command, { stdio: "pipe" });
+          },
+          catch: (error) =>
+            LinuxUserError(`Failed to create Linux user ${username}`, error),
+        });
+
+        // Get user info
+        const userInfo = yield* Effect.tryPromise({
+          try: async () => {
+            const uidOutput = execSync(`id -u ${username}`, {
+              encoding: "utf-8",
+            }).trim();
+            const gidOutput = execSync(`id -g ${username}`, {
+              encoding: "utf-8",
+            }).trim();
+            const homeDir = createHome ? `/home/${username}` : "";
+
+            return {
+              username,
+              uid: parseInt(uidOutput, 10),
+              gid: parseInt(gidOutput, 10),
+              homeDir,
+              shell,
+              created: true,
+            };
+          },
+          catch: (error) =>
+            LinuxUserError(`Failed to get user info for ${username}`, error),
+        });
+
+        return userInfo;
+      }),
+
+    userExists: (username: string) =>
+      Effect.tryPromise({
+        try: async () => {
+          try {
+            execSync(`id -u ${username}`, { stdio: "ignore" });
+            return true;
+          } catch {
+            return false;
+          }
+        },
+        catch: (error) => LinuxUserError("Failed to check if user exists", error),
+      }),
+
+    getUserInfo: (username: string) =>
+      Effect.gen(function* () {
+        const exists = yield* Effect.tryPromise({
+          try: async () => {
+            try {
+              execSync(`id -u ${username}`, { stdio: "ignore" });
+              return true;
+            } catch {
+              return false;
+            }
+          },
+          catch: (error) => LinuxUserError("Failed to check if user exists", error),
+        });
+
+        if (!exists) {
+          return yield* Effect.fail(
+            LinuxUserError(`Linux user ${username} does not exist`)
+          );
+        }
+
+        const userInfo = yield* Effect.tryPromise({
+          try: async () => {
+            const uidOutput = execSync(`id -u ${username}`, {
+              encoding: "utf-8",
+            }).trim();
+            const gidOutput = execSync(`id -g ${username}`, {
+              encoding: "utf-8",
+            }).trim();
+
+            // Get shell from /etc/passwd
+            const passwdLine = execSync(`getent passwd ${username}`, {
+              encoding: "utf-8",
+            }).trim();
+            const shell = passwdLine.split(":")[6] || "/bin/bash";
+
+            // Get home directory
+            const homeDir = passwdLine.split(":")[5] || `/home/${username}`;
+
+            return {
+              username,
+              uid: parseInt(uidOutput, 10),
+              gid: parseInt(gidOutput, 10),
+              homeDir,
+              shell,
+              created: true,
+            };
+          },
+          catch: (error) =>
+            LinuxUserError(`Failed to get user info for ${username}`, error),
+        });
+
+        return userInfo;
+      }),
+
+    deleteUser: (username: string, removeHome: boolean = true) =>
+      Effect.gen(function* () {
+        // Check if user exists
+        const exists = yield* Effect.tryPromise({
+          try: async () => {
+            try {
+              execSync(`id -u ${username}`, { stdio: "ignore" });
+              return true;
+            } catch {
+              return false;
+            }
+          },
+          catch: (error) => LinuxUserError("Failed to check if user exists", error),
+        });
+
+        if (!exists) {
+          return yield* Effect.fail(
+            LinuxUserError(`Linux user ${username} does not exist`)
+          );
+        }
+
+        // Delete user
+        const removeHomeFlag = removeHome ? "--remove" : "";
+        const command = `sudo userdel ${removeHomeFlag} ${username}`;
+
+        yield* Effect.tryPromise({
+          try: async () => {
+            execSync(command, { stdio: "pipe" });
+          },
+          catch: (error) =>
+            LinuxUserError(`Failed to delete Linux user ${username}`, error),
+        });
+      }),
+
+    setResourceLimits: (username: string, limits: ResourceLimits) =>
+      Effect.gen(function* () {
+        // Create limits configuration file
+        const limitsContent = `
+# Resource limits for ${username}
+${username} soft nofile ${limits.maxOpenFiles || 1024}
+${username} hard nofile ${limits.maxOpenFiles || 2048}
+${username} soft nproc ${limits.maxProcesses || 256}
+${username} hard nproc ${limits.maxProcesses || 512}
+${username} soft as ${limits.maxMemoryKB || 2097152}
+${username} hard as ${limits.maxMemoryKB || 4194304}
+${username} soft cpu ${limits.maxCPUTime || 60}
+${username} hard cpu ${limits.maxCPUTime || 120}
+`.trim();
+
+        const limitsFilePath = `/etc/security/limits.d/${username}.conf`;
+
+        yield* Effect.tryPromise({
+          try: async () => {
+            // Write limits file (requires sudo)
+            execSync(`echo '${limitsContent}' | sudo tee ${limitsFilePath} > /dev/null`, {
+              stdio: "pipe",
+            });
+          },
+          catch: (error) =>
+            LinuxUserError(
+              `Failed to set resource limits for ${username}`,
+              error
+            ),
+        });
+      }),
+
+    sanitizeUsername: (username: string) =>
+      Effect.gen(function* () {
+        // Convert to lowercase
+        let sanitized = username.toLowerCase();
+
+        // Replace invalid characters with underscores
+        sanitized = sanitized.replace(/[^a-z0-9_-]/g, "_");
+
+        // Ensure starts with letter or underscore
+        if (!/^[a-z_]/.test(sanitized)) {
+          sanitized = `u_${sanitized}`;
+        }
+
+        // Truncate to 32 characters
+        sanitized = sanitized.substring(0, 32);
+
+        // Remove trailing hyphens or underscores
+        sanitized = sanitized.replace(/[-_]+$/, "");
+
+        if (sanitized.length === 0) {
+          return yield* Effect.fail(
+            LinuxUserError(
+              `Could not sanitize username: ${username} results in empty string`
+            )
+          );
+        }
+
+        return sanitized;
+      }),
+  });
+}
+
+export interface ResourceLimits {
+  maxOpenFiles?: number;
+  maxProcesses?: number;
+  maxMemoryKB?: number;
+  maxCPUTime?: number;
+}

package/src/server/user-management/QuotaService.ts

@@ -0,0 +1,256 @@
+import { Effect, Context, Layer } from "effect";
+import { execSync } from "child_process";
+
+/**
+ * Quota Management Service
+ *
+ * Manages disk quotas and resource limits for Linux users.
+ * Provides storage limits to prevent individual users from
+ * consuming excessive disk space.
+ *
+ * Features:
+ * - Disk quota management (requires quota system on host)
+ * - Directory size tracking
+ * - Resource limit enforcement
+ * - Usage monitoring
+ */
+
+export interface DiskQuota {
+  softLimitMB: number;
+  hardLimitMB: number;
+}
+
+export interface QuotaUsage {
+  usedMB: number;
+  softLimitMB: number;
+  hardLimitMB: number;
+  percentUsed: number;
+  isOverSoftLimit: boolean;
+  isOverHardLimit: boolean;
+}
+
+export interface QuotaError {
+  readonly _tag: "QuotaError";
+  readonly message: string;
+  readonly cause?: unknown;
+}
+
+const QuotaError = (message: string, cause?: unknown): QuotaError => ({
+  _tag: "QuotaError",
+  message,
+  cause,
+});
+
+export class QuotaService extends Context.Tag("QuotaService")<
+  QuotaService,
+  {
+    /**
+     * Set disk quota for a user
+     * Note: Requires quota support on the filesystem
+     */
+    readonly setDiskQuota: (
+      username: string,
+      quota: DiskQuota
+    ) => Effect.Effect<void, QuotaError>;
+
+    /**
+     * Get current quota usage for a user
+     */
+    readonly getQuotaUsage: (
+      username: string
+    ) => Effect.Effect<QuotaUsage, QuotaError>;
+
+    /**
+     * Check if quota system is available
+     */
+    readonly isQuotaAvailable: () => Effect.Effect<boolean, QuotaError>;
+
+    /**
+     * Get directory size for a user (fallback if quota not available)
+     */
+    readonly getDirectorySize: (
+      dirPath: string
+    ) => Effect.Effect<number, QuotaError>;
+
+    /**
+     * Enforce storage limits (alternative to disk quotas)
+     */
+    readonly checkStorageLimit: (
+      username: string,
+      homeDir: string,
+      limitMB: number
+    ) => Effect.Effect<boolean, QuotaError>;
+  }
+>() {
+  static Live = Layer.succeed(this, {
+    setDiskQuota: (username: string, quota: DiskQuota) =>
+      Effect.gen(function* () {
+        // Check if quota is available
+        const quotaAvailable = yield* Effect.tryPromise({
+          try: async () => {
+            try {
+              execSync("which setquota", { stdio: "ignore" });
+              return true;
+            } catch {
+              return false;
+            }
+          },
+          catch: (error) =>
+            QuotaError("Failed to check quota availability", error),
+        });
+
+        if (!quotaAvailable) {
+          return yield* Effect.fail(
+            QuotaError(
+              "Quota system not available. Install quota tools: sudo apt-get install quota"
+            )
+          );
+        }
+
+        // Set quota using setquota command
+        // Format: setquota -u username soft_blocks hard_blocks soft_inodes hard_inodes filesystem
+        const softBlocks = quota.softLimitMB * 1024; // Convert MB to blocks (1 block = 1KB)
+        const hardBlocks = quota.hardLimitMB * 1024;
+        const softInodes = 10000; // Reasonable inode limit
+        const hardInodes = 15000;
+        const filesystem = "/"; // Primary filesystem
+
+        yield* Effect.tryPromise({
+          try: async () => {
+            const command = `sudo setquota -u ${username} ${softBlocks} ${hardBlocks} ${softInodes} ${hardInodes} ${filesystem}`;
+            execSync(command, { stdio: "pipe" });
+          },
+          catch: (error) =>
+            QuotaError(`Failed to set disk quota for ${username}`, error),
+        });
+      }),
+
+    getQuotaUsage: (username: string) =>
+      Effect.gen(function* () {
+        // Check if quota is available
+        const quotaAvailable = yield* Effect.tryPromise({
+          try: async () => {
+            try {
+              execSync("which quota", { stdio: "ignore" });
+              return true;
+            } catch {
+              return false;
+            }
+          },
+          catch: (error) =>
+            QuotaError("Failed to check quota availability", error),
+        });
+
+        if (!quotaAvailable) {
+          // Fallback: Calculate directory size
+          const homeDir = `/home/${username}`;
+          const usedMB = yield* Effect.tryPromise({
+            try: async () => {
+              const output = execSync(`sudo du -sm ${homeDir}`, {
+                encoding: "utf-8",
+              });
+              return parseInt(output.split("\t")[0] || "0", 10);
+            },
+            catch: (error) =>
+              QuotaError(
+                `Failed to calculate directory size for ${username}`,
+                error
+              ),
+          });
+
+          return {
+            usedMB,
+            softLimitMB: 1024, // Default 1GB soft limit
+            hardLimitMB: 2048, // Default 2GB hard limit
+            percentUsed: (usedMB / 2048) * 100,
+            isOverSoftLimit: usedMB > 1024,
+            isOverHardLimit: usedMB > 2048,
+          };
+        }
+
+        // Get quota usage using quota command
+        const usage = yield* Effect.tryPromise({
+          try: async () => {
+            const output = execSync(`sudo quota -u ${username} --show-mntpoint`, {
+              encoding: "utf-8",
+            });
+
+            // Parse quota output
+            // Expected format:
+            // Disk quotas for user username (uid 1001):
+            //     Filesystem  blocks   quota   limit   grace   files   quota   limit   grace
+            //     /dev/sda1    1024    1024000 2048000         100     10000   15000
+
+            const lines = output.trim().split("\n");
+            if (lines.length < 3) {
+              throw new Error("Invalid quota output format");
+            }
+
+            const dataLine = (lines[2] || "").trim().split(/\s+/);
+            const usedBlocks = parseInt(dataLine[1] || "0", 10);
+            const softBlocks = parseInt(dataLine[2] || "0", 10);
+            const hardBlocks = parseInt(dataLine[3] || "0", 10);
+
+            const usedMB = Math.round(usedBlocks / 1024);
+            const softLimitMB = Math.round(softBlocks / 1024);
+            const hardLimitMB = Math.round(hardBlocks / 1024);
+
+            return {
+              usedMB,
+              softLimitMB,
+              hardLimitMB,
+              percentUsed: (usedMB / hardLimitMB) * 100,
+              isOverSoftLimit: usedMB > softLimitMB,
+              isOverHardLimit: usedMB > hardLimitMB,
+            };
+          },
+          catch: (error) =>
+            QuotaError(`Failed to get quota usage for ${username}`, error),
+        });
+
+        return usage;
+      }),
+
+    isQuotaAvailable: () =>
+      Effect.tryPromise({
+        try: async () => {
+          try {
+            execSync("which quota", { stdio: "ignore" });
+            execSync("which setquota", { stdio: "ignore" });
+            return true;
+          } catch {
+            return false;
+          }
+        },
+        catch: (error) => QuotaError("Failed to check quota availability", error),
+      }),
+
+    getDirectorySize: (dirPath: string) =>
+      Effect.tryPromise({
+        try: async () => {
+          const output = execSync(`sudo du -sm ${dirPath}`, {
+            encoding: "utf-8",
+          });
+          return parseInt(output.split("\t")[0] || "0", 10);
+        },
+        catch: (error) =>
+          QuotaError(`Failed to get directory size for ${dirPath}`, error),
+      }),
+
+    checkStorageLimit: (username: string, homeDir: string, limitMB: number) =>
+      Effect.gen(function* () {
+        const usedMB = yield* Effect.tryPromise({
+          try: async () => {
+            const output = execSync(`sudo du -sm ${homeDir}`, {
+              encoding: "utf-8",
+            });
+            return parseInt(output.split("\t")[0] || "0", 10);
+          },
+          catch: (error) =>
+            QuotaError(`Failed to check storage for ${username}`, error),
+        });
+
+        return usedMB <= limitMB;
+      }),
+  });
+}