slotlock 0.9.0 → 0.10.0

package/workspaces.js

@@ -0,0 +1,433 @@
+// Who belongs to which workspace, and as what (workspace-roles.ts), as the dashboard asks on every
+// request: from slotlock.workspace_memberships and slotlock.dashboard_people, through their
+// functions, never from the session cookie. A person's own workspace has no row: they are its
+// Owner. GitHub organizations' members are recorded at each sign-in from what GitHub lists.
+import { createHash } from 'node:crypto';
+import { createSlotlockWorkspaceDomains } from './workspace-domains.js';
+import { createSlotlockWorkspaceSso } from './workspace-sso.js';
+import { createSlotlockWorkspaceScim } from './workspace-scim.js';
+import { isSlotlockWorkspaceRole } from './workspace-roles.js';
+import { isSlotlockResourceScope } from './resource-profile.js';
+/**
+ * A person as the dashboard knows them: `github:<id>`, `google:<subject>`, or `sso:<uuid>` (one a
+ * team's identity provider signed in, ddl-sso.ts), never an email.
+ */
+const PERSON = /^(github:[1-9]\d{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/;
+const ORGANIZATION_ID = /^[1-9]\d{0,19}$/;
+function refuse(message) {
+    throw Object.assign(new Error(`Slotlock workspaces: ${message}`), { code: 'invalid_person' });
+}
+function checkMemberships(organizations) {
+    if (organizations === undefined)
+        return;
+    if (organizations.length > 100)
+        refuse('at most 100 organizations');
+    for (const org of organizations) {
+        if (!ORGANIZATION_ID.test(org.id) || (org.role !== 'admin' && org.role !== 'member')) {
+            refuse('an organization needs its id and the role admin or member');
+        }
+    }
+}
+/** Through slotlock.dashboard_sign_in, dashboard_standing and dashboard_sign_out_everywhere. */
+export function createSlotlockDashboardWorkspaces(sql) {
+    return {
+        async signedIn(person, githubOrganizations) {
+            if (!PERSON.test(person))
+                refuse('needs github:<id> or google:<subject>');
+            if (githubOrganizations !== undefined && !person.startsWith('github:'))
+                refuse('only a GitHub person has organizations');
+            checkMemberships(githubOrganizations);
+            const listed = githubOrganizations === undefined
+                ? null
+                : JSON.stringify(githubOrganizations.map((org) => ({ id: org.id, role: org.role })));
+            const [row] = await sql `
+        SELECT slotlock.dashboard_sign_in(${person}::text, ${listed}::text) AS epoch`;
+            return Number(row?.epoch ?? 0);
+        },
+        async scope(tenantRef, person) {
+            if (!PERSON.test(person))
+                return null;
+            const [row] = await sql `
+        SELECT slotlock.member_scope(${tenantRef}::text, ${person}::text) AS scope`;
+            return scopeOf(row?.scope);
+        },
+        async standing(tenantRef, person, sid) {
+            if (!PERSON.test(person))
+                return { role: null, sessionEpoch: null };
+            const digest = sid === null ? null : sessionDigest(sid);
+            const [row] = await sql `
+        SELECT role, session_epoch, refusal, may_bypass
+          FROM slotlock.dashboard_standing(${tenantRef}::text, ${person}::text, ${digest}::bytea)`;
+            const role = row?.role ?? null;
+            const epoch = row?.session_epoch;
+            const refusal = row?.refusal === 'sso_required' || row?.refusal === 'sso_scope' ? row.refusal : null;
+            return {
+                role: isSlotlockWorkspaceRole(role) ? role : null,
+                sessionEpoch: epoch === null || epoch === undefined ? null : Number(epoch),
+                refusal,
+                mayBypass: row?.may_bypass === true,
+            };
+        },
+        async signOutEverywhere(person) {
+            if (!PERSON.test(person))
+                refuse('needs github:<id> or google:<subject>');
+            const [row] = await sql `
+        SELECT slotlock.dashboard_sign_out_everywhere(${person}::text) AS epoch`;
+            return Number(row?.epoch ?? 0);
+        },
+        teams: createTeams(sql),
+        sessions: createSessions(sql),
+        domains: createSlotlockWorkspaceDomains(sql),
+        sso: createSlotlockWorkspaceSso(sql),
+        scim: createSlotlockWorkspaceScim(sql),
+    };
+}
+const sessionDigest = (sid) => createHash('sha256').update(sid, 'utf8').digest();
+const SESSION_ID = /^[0-9a-f]{64}$/;
+function createSessions(sql) {
+    return {
+        async started(person, sid, expiresAt, from) {
+            if (!PERSON.test(person))
+                refuse('needs github:<id> or google:<subject>');
+            await sql `SELECT slotlock.dashboard_session_started(${person}::text, ${sessionDigest(sid)}::bytea,
+        ${expiresAt}::timestamptz, ${from.userAgent?.slice(0, 256) ?? null}::text, ${from.ipAddress?.slice(0, 64) ?? null}::text)`;
+        },
+        async seen(person, sid) {
+            if (!PERSON.test(person))
+                return false;
+            const [row] = await sql `
+        SELECT slotlock.dashboard_session_seen(${person}::text, ${sessionDigest(sid)}::bytea) AS alive`;
+            return row?.alive === true;
+        },
+        async list(person) {
+            if (!PERSON.test(person))
+                return [];
+            const rows = await sql `SELECT * FROM slotlock.dashboard_sessions_of(${person}::text)`;
+            return rows.map((row) => ({
+                id: row.sid_sha256.toString('hex'),
+                startedAt: row.started_at,
+                lastSeenAt: row.last_seen_at,
+                expiresAt: row.expires_at,
+                userAgent: row.user_agent,
+                ipAddress: row.ip_address,
+            }));
+        },
+        async end(person, id) {
+            if (!PERSON.test(person) || (id !== null && !SESSION_ID.test(id)))
+                return false;
+            const [row] = await sql `
+        SELECT slotlock.dashboard_session_end(${person}::text, ${id === null ? null : Buffer.from(id, 'hex')}::bytea) AS ended`;
+            return row?.ended === true;
+        },
+        idOf: (sid) => sessionDigest(sid).toString('hex'),
+    };
+}
+const TEAM = /^team:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * A member's scope as kept, or null for none. One that is not a scope never reads as none: that
+ * would give the whole workspace to someone limited, so it is refused (the database's check keeps
+ * such a value out).
+ */
+function scopeOf(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (!isSlotlockResourceScope(value))
+        throw new Error('Slotlock read a member scope that is not one');
+    return value;
+}
+const refusalOf = (value) => value === null || value === undefined ? null : value;
+const roleOf = (value) => {
+    if (!isSlotlockWorkspaceRole(value))
+        throw new Error(`Slotlock workspaces: unknown role ${value}`);
+    return value;
+};
+const digest = (token) => {
+    if (token.length !== 32)
+        refuse('a token digest is 32 bytes');
+    return token;
+};
+function createTeams(sql) {
+    return {
+        async setDisplay(person, display) {
+            if (!PERSON.test(person))
+                return;
+            const shown = display === null ? null : display.slice(0, 254);
+            await sql `SELECT slotlock.dashboard_display(${person}::text, ${shown}::text)`;
+        },
+        async create(person, name, handle, cap) {
+            if (!PERSON.test(person))
+                refuse('needs github:<id> or google:<subject>');
+            const [row] = await sql `
+        SELECT tenant_ref, refusal FROM slotlock.create_team(${person}::text, ${name}::text, ${handle}::text, ${cap}::integer)`;
+            return row?.tenant_ref ? { tenantRef: row.tenant_ref } : { refusal: refusalOf(row?.refusal) ?? 'not_allowed' };
+        },
+        async info(tenantRef) {
+            const [row] = await sql `
+        SELECT handle, name FROM slotlock.workspace_info(${tenantRef}::text)`;
+            return row ? { handle: row.handle, name: row.name } : null;
+        },
+        async workspacesOf(person) {
+            if (!PERSON.test(person))
+                return [];
+            const rows = await sql `
+        SELECT tenant_ref, handle, name, role FROM slotlock.person_workspaces(${person}::text)`;
+            return rows.map((row) => ({ tenantRef: row.tenant_ref, handle: row.handle, name: row.name, role: roleOf(row.role) }));
+        },
+        async members(tenantRef) {
+            if (!TEAM.test(tenantRef.replace(/~test$/, '')))
+                return [];
+            const rows = await sql `
+        SELECT person_ref, role, source, display, joined_at FROM slotlock.workspace_members(${tenantRef}::text)`;
+            return rows.map((row) => ({ person: row.person_ref, role: roleOf(row.role), source: row.source, display: row.display, joinedAt: row.joined_at }));
+        },
+        async invitations(tenantRef) {
+            if (!TEAM.test(tenantRef.replace(/~test$/, '')))
+                return [];
+            const rows = await sql `SELECT id, email, github_login, role, inviter_display, sent_at, expires_at
+          FROM slotlock.workspace_invitations_list(${tenantRef}::text)`;
+            return rows.map((row) => ({
+                id: row.id,
+                email: row.email,
+                githubLogin: row.github_login,
+                role: roleOf(row.role),
+                inviterDisplay: row.inviter_display,
+                sentAt: row.sent_at,
+                expiresAt: row.expires_at,
+            }));
+        },
+        async invite(params) {
+            if (!TEAM.test(params.tenantRef) || !PERSON.test(params.inviter))
+                refuse('needs a team workspace and the inviter');
+            const email = 'email' in params.to ? params.to.email : null;
+            const github = 'github' in params.to ? params.to.github : null;
+            const login = 'github' in params.to ? params.to.login : null;
+            const [row] = await sql `
+        SELECT invitation_id, refusal FROM slotlock.invite_member(
+          ${params.tenantRef}::text, ${params.inviter}::text, ${email}::text, ${github}::text, ${login}::text,
+          ${params.role}::text, ${digest(params.tokenSha256)}::bytea, ${params.days}::integer,
+          ${params.dailyLimit}::integer, ${params.memberCap}::integer)`;
+            return row?.invitation_id ? { id: row.invitation_id } : { refusal: refusalOf(row?.refusal) ?? 'not_allowed' };
+        },
+        async preview(tokenSha256) {
+            const [row] = await sql `SELECT * FROM slotlock.invitation_preview(${digest(tokenSha256)}::bytea)`;
+            if (!row)
+                return null;
+            return {
+                id: row.invitation_id,
+                tenantRef: row.tenant_ref,
+                workspaceName: row.workspace_name,
+                workspaceHandle: row.workspace_handle,
+                inviterDisplay: row.inviter_display,
+                role: roleOf(row.role),
+                email: row.email,
+                githubRef: row.github_ref,
+                githubLogin: row.github_login,
+                state: row.state,
+            };
+        },
+        async accept(params) {
+            if (!PERSON.test(params.person))
+                refuse('needs github:<id> or google:<subject>');
+            if ((params.tokenSha256 === undefined) === (params.id === undefined))
+                refuse('accept by the token or by id');
+            if (params.id !== undefined && !UUID.test(params.id))
+                return { refusal: 'not_found' };
+            const token = params.tokenSha256 === undefined ? null : digest(params.tokenSha256);
+            const [row] = await sql `
+        SELECT tenant_ref, refusal FROM slotlock.accept_invitation(
+          ${token}::bytea, ${params.id ?? null}::uuid, ${params.person}::text,
+          ${[...params.emails].slice(0, 20)}::text[], ${params.memberCap}::integer)`;
+            return row?.tenant_ref ? { tenantRef: row.tenant_ref } : { refusal: refusalOf(row?.refusal) ?? 'not_found' };
+        },
+        async revoke(tenantRef, actor, id) {
+            if (!UUID.test(id))
+                return false;
+            const [row] = await sql `
+        SELECT slotlock.revoke_invitation(${tenantRef}::text, ${actor}::text, ${id}::uuid) AS revoked`;
+            return row?.revoked === true;
+        },
+        async resend(tenantRef, actor, id, tokenSha256, days, dailyLimit, memberCap) {
+            if (!UUID.test(id))
+                return 'not_found';
+            const [row] = await sql `
+        SELECT slotlock.resend_invitation(${tenantRef}::text, ${actor}::text, ${id}::uuid,
+          ${digest(tokenSha256)}::bytea, ${days}::integer, ${dailyLimit}::integer, ${memberCap}::integer) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async changeRole(tenantRef, actor, person, role) {
+            const [row] = await sql `
+        SELECT slotlock.change_member_role(${tenantRef}::text, ${actor}::text, ${person}::text, ${role}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async scopes(tenantRef) {
+            if (!TEAM.test(tenantRef.replace(/~test$/, '')))
+                return new Map();
+            const rows = await sql `
+        SELECT person_ref, resource_scope FROM slotlock.member_scopes(${tenantRef}::text)`;
+            return new Map(rows.map((row) => [row.person_ref, scopeOf(row.resource_scope)]));
+        },
+        async setScope(tenantRef, actor, person, scope) {
+            if (scope !== null && !isSlotlockResourceScope(scope))
+                refuse('a scope names locations or groups');
+            const kept = scope === null ? null : { locations: [...scope.locations], groups: [...scope.groups] };
+            const [row] = await sql `
+        SELECT slotlock.set_member_scope(${tenantRef}::text, ${actor}::text, ${person}::text,
+          ${kept === null ? null : sql.json(kept)}::jsonb) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async remove(tenantRef, actor, person) {
+            const [row] = await sql `
+        SELECT slotlock.remove_member(${tenantRef}::text, ${actor}::text, ${person}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async pendingFor(person, emails) {
+            if (!PERSON.test(person))
+                return [];
+            const rows = await sql `SELECT * FROM slotlock.pending_invitations_for(${person}::text, ${[...emails].slice(0, 20)}::text[])`;
+            return rows.map((row) => ({
+                id: row.invitation_id,
+                tenantRef: row.tenant_ref,
+                workspaceName: row.workspace_name,
+                workspaceHandle: row.workspace_handle,
+                inviterDisplay: row.inviter_display,
+                role: roleOf(row.role),
+            }));
+        },
+        async isActive(tenantRef) {
+            if (!TEAM.test(tenantRef.replace(/~test$/, '')))
+                return false;
+            const [row] = await sql `SELECT slotlock.workspace_active(${tenantRef}::text) AS active`;
+            return row?.active === true;
+        },
+        async prune() {
+            const [row] = await sql `SELECT slotlock.prune_workspace_invitations() AS pruned`;
+            return Number(row?.pruned ?? 0);
+        },
+        async scheduleDeletion(tenantRef, actor, handle) {
+            const [row] = await sql `
+        SELECT slotlock.schedule_team_deletion(${tenantRef}::text, ${actor}::text, ${handle}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async cancelDeletion(tenantRef, actor) {
+            const [row] = await sql `
+        SELECT slotlock.cancel_team_deletion(${tenantRef}::text, ${actor}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async deleteAfter(tenantRef) {
+            if (!TEAM.test(tenantRef.replace(/~test$/, '')))
+                return null;
+            const [row] = await sql `SELECT slotlock.workspace_delete_after(${tenantRef}::text) AS after`;
+            return row?.after ?? null;
+        },
+    };
+}
+/**
+ * Whether a team workspace serves its keys, for `serve`: read through slotlock.workspace_active and
+ * kept for `ttlMs` (30 seconds), so deleting one stops its keys on every server within that.
+ */
+export function createSlotlockWorkspaceCheck(sql, options = {}) {
+    const ttlMs = options.ttlMs ?? 30_000;
+    const now = options.now ?? Date.now;
+    const maxEntries = options.maxEntries ?? 10_000;
+    const known = new Map();
+    const teams = createTeams(sql);
+    return (tenantRef) => {
+        const live = tenantRef.replace(/~test$/, '');
+        if (!TEAM.test(live))
+            return Promise.resolve(false);
+        const cached = known.get(live);
+        if (cached && now() - cached.at < ttlMs)
+            return cached.active;
+        const active = teams.isActive(live).then((found) => found, (error) => {
+            known.delete(live);
+            throw error;
+        });
+        known.delete(live);
+        known.set(live, { at: now(), active });
+        if (known.size > maxEntries)
+            known.delete(known.keys().next().value);
+        return active;
+    };
+}
+/**
+ * The same in memory, for tests and for a library deployment with a single server. `setRole` and
+ * `remove` stand in for what the Members page will do.
+ */
+export function createSlotlockMemoryDashboardWorkspaces() {
+    const live = (tenantRef) => tenantRef.replace(/~test$/, '');
+    const memberships = new Map();
+    const epochs = new Map();
+    /** A new epoch, never the one it replaces. */
+    const draw = (old) => {
+        let next = old ?? 0;
+        while (next === old || next === 0)
+            next = 1 + Math.floor(Math.random() * 2_147_483_646);
+        return next;
+    };
+    const key = (tenantRef, person) => `${live(tenantRef)}\n${person}`;
+    return {
+        async signedIn(person, githubOrganizations) {
+            if (!PERSON.test(person))
+                refuse('needs github:<id> or google:<subject>');
+            checkMemberships(githubOrganizations);
+            if (githubOrganizations !== undefined) {
+                const listed = new Set(githubOrganizations.map((org) => `github-org:${org.id}`));
+                for (const org of githubOrganizations) {
+                    const found = memberships.get(key(`github-org:${org.id}`, person));
+                    if (found && found.source !== 'github_org')
+                        continue;
+                    memberships.set(key(`github-org:${org.id}`, person), {
+                        role: org.role === 'admin' ? 'owner' : 'developer',
+                        source: 'github_org',
+                        active: true,
+                    });
+                }
+                for (const [at, membership] of memberships) {
+                    const [tenant, who] = at.split('\n');
+                    if (who === person && membership.source === 'github_org' && !listed.has(tenant))
+                        membership.active = false;
+                }
+            }
+            if (!epochs.has(person))
+                epochs.set(person, draw());
+            return epochs.get(person);
+        },
+        async scope(tenantRef, person) {
+            const found = memberships.get(key(tenantRef, person));
+            return found?.active && found.role !== 'owner' ? (found.scope ?? null) : null;
+        },
+        async standing(tenantRef, person) {
+            const sessionEpoch = epochs.get(person) ?? null;
+            if (live(tenantRef) === person)
+                return { role: 'owner', sessionEpoch };
+            const found = memberships.get(key(tenantRef, person));
+            return { role: found?.active ? found.role : null, sessionEpoch };
+        },
+        async signOutEverywhere(person) {
+            const next = draw(epochs.get(person));
+            epochs.set(person, next);
+            return next;
+        },
+        setRole(tenantRef, person, role, source = 'created') {
+            memberships.set(key(tenantRef, person), { role, source, active: true });
+        },
+        limit(tenantRef, person, scope) {
+            const found = memberships.get(key(tenantRef, person));
+            if (!found)
+                throw new Error('Slotlock limits only a member');
+            if (scope === null)
+                delete found.scope;
+            else
+                found.scope = { locations: [...scope.locations], groups: [...scope.groups] };
+        },
+        remove(tenantRef, person) {
+            // A removal made in Slotlock is Slotlock's: signing in again never undoes it.
+            const found = memberships.get(key(tenantRef, person));
+            if (found) {
+                found.active = false;
+                found.source = 'created';
+            }
+        },
+    };
+}