tr-plugin-auth 0.0.0-stage → 1.0.0

package/src/mesh-auth.mjs

@@ -0,0 +1,7 @@
+import { importHostModule } from './host-runtime.mjs';
+const { loadPluginModule } = await importHostModule('src/core/plugin-runtime.mjs');
+export async function normalizeRemoteAddress(...args) { return (await loadPluginModule('mesh', 'mesh-auth')).normalizeRemoteAddress(...args); }
+export async function isMeshOrLoopbackAddress(...args) { return (await loadPluginModule('mesh', 'mesh-auth')).isMeshOrLoopbackAddress(...args); }
+export async function getMeshSyncToken(...args) { return (await loadPluginModule('mesh', 'mesh-auth')).getMeshSyncToken(...args); }
+export async function getMeshSyncAuthorization(...args) { return (await loadPluginModule('mesh', 'mesh-auth')).getMeshSyncAuthorization(...args); }
+export async function requireMeshSyncAuth(...args) { return (await loadPluginModule('mesh', 'mesh-auth')).requireMeshSyncAuth(...args); }

package/src/mesh-identity.mjs

@@ -0,0 +1,16 @@
+import { importHostModule } from './host-runtime.mjs';
+
+// Loaded on first use, not at import, so importing the secrets routes does not
+// require the host runtime until a mesh-identity request actually arrives.
+let owner;
+async function mesh() {
+  if (!owner) {
+    const { loadPluginModule } = await importHostModule('src/core/plugin-runtime.mjs');
+    owner = await loadPluginModule('mesh', 'mesh-identity');
+  }
+  return owner;
+}
+export async function identifyCaller(...args) { return (await mesh()).identifyCaller(...args); }
+export async function loadPolicy(...args) { return (await mesh()).loadPolicy(...args); }
+export async function isKeyAllowed(...args) { return (await mesh()).isKeyAllowed(...args); }
+export async function allowedKeys(...args) { return (await mesh()).allowedKeys(...args); }

package/src/mesh-secrets.mjs

@@ -0,0 +1,146 @@
+/**
+ * Mesh-authenticated secrets: the leader releases individual secrets to
+ * enrolled machines that hold a grant; nodes cache what they were granted.
+ *
+ * Replaces whole-store replication behind one shared bearer token. The mesh
+ * identifies the caller (see the mesh plugin's mesh-identity), so there is no
+ * shared credential to leak, and a compromised node exposes only its grants.
+ *
+ * Uptime comes first: when the leader is unreachable a node keeps serving its
+ * cached grants. Revocation takes effect the next time the node reaches the
+ * leader (a refused or missing key purges that cache entry). The cache is
+ * encrypted with a per-node key kept beside it at mode 0600 — that protects
+ * copies and backups of the file, not an attacker who is already root on the node.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { identifyCaller, isKeyAllowed, allowedKeys, loadPolicy } from './mesh-identity.mjs';
+import { getSecret, appendAudit } from './secrets-store.mjs';
+
+export const SOFT_TTL_MS = 5 * 60_000;
+const KEY_FILE = 'mesh-cache.key';
+const CACHE_FILE = 'mesh-secret-cache.enc';
+const FETCH_TIMEOUT_MS = 8_000;
+
+/* ---------- leader side ---------- */
+
+function audit(brainDir, event) {
+  try {
+    appendAudit(brainDir, event);
+  } catch {
+    // Auditing must never turn a refusal into a crash.
+  }
+}
+
+/** Express middleware: attach `req.meshIdentity` or refuse. */
+export function createMeshIdentityMiddleware({ identify = identifyCaller } = {}) {
+  return async function requireMeshIdentity(req, res, next) {
+    const identity = await identify(req.socket?.remoteAddress || req.ip);
+    if (!identity) return res.status(403).json({ error: 'Mesh identity required' });
+    req.meshIdentity = identity;
+    return next();
+  };
+}
+
+/** GET /api/secrets/mesh/:key */
+export function createMeshSecretHandler({ brainDir, policyFor = loadPolicy, read, allowed = isKeyAllowed }) {
+  return async function meshSecretHandler(req, res) {
+    const key = String(req.params.key || '');
+    const identity = req.meshIdentity;
+    const policy = await policyFor(brainDir);
+    res.set('Cache-Control', 'no-store');
+    if (!(await allowed(identity, key, policy))) {
+      audit(brainDir, { action: 'mesh_denied', key, actor: `mesh:${identity?.node || 'unknown'}` });
+      return res.status(403).json({ error: 'No grant for this key' });
+    }
+    const result = await (read || getSecret)(brainDir, key, { action: 'mesh_get', actor: `mesh:${identity.node}` });
+    if (!result.found) return res.status(404).json({ error: 'Secret not found' });
+    return res.json({ key, value: result.value });
+  };
+}
+
+/** GET /api/secrets/mesh — key names this caller may read (never values). */
+export function createMeshListHandler({ brainDir, policyFor = loadPolicy, keysFor, filter = allowedKeys }) {
+  return async function meshListHandler(req, res) {
+    const policy = await policyFor(brainDir);
+    const names = await keysFor();
+    res.set('Cache-Control', 'no-store');
+    res.json({ keys: await filter(req.meshIdentity, names, policy) });
+  };
+}
+
+/* ---------- node side ---------- */
+
+function nodeKey(configDir) {
+  const file = path.join(configDir, KEY_FILE);
+  try {
+    const existing = fs.readFileSync(file);
+    if (existing.length === 32) return existing;
+  } catch {
+    // fall through to create
+  }
+  fs.mkdirSync(configDir, { recursive: true });
+  const fresh = crypto.randomBytes(32);
+  fs.writeFileSync(file, fresh, { mode: 0o600 });
+  return fresh;
+}
+
+function readCache(configDir) {
+  try {
+    const blob = fs.readFileSync(path.join(configDir, CACHE_FILE));
+    const decipher = crypto.createDecipheriv('aes-256-gcm', nodeKey(configDir), blob.subarray(0, 12));
+    decipher.setAuthTag(blob.subarray(12, 28));
+    const plain = Buffer.concat([decipher.update(blob.subarray(28)), decipher.final()]);
+    const parsed = JSON.parse(plain.toString('utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch {
+    // Missing, truncated or tampered cache is an empty cache, not an outage.
+    return {};
+  }
+}
+
+function writeCache(configDir, entries) {
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', nodeKey(configDir), iv);
+  const body = Buffer.concat([cipher.update(JSON.stringify(entries), 'utf8'), cipher.final()]);
+  const file = path.join(configDir, CACHE_FILE);
+  const temp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(temp, Buffer.concat([iv, cipher.getAuthTag(), body]), { mode: 0o600 });
+  fs.renameSync(temp, file);
+}
+
+/**
+ * Read one granted secret from the leader, falling back to the cache.
+ * Returns `{ value, source: 'leader' | 'cache' | 'stale-cache' }`, or throws if
+ * the leader refuses (403/404, which also purges the cached entry) or is
+ * unreachable and nothing is cached.
+ */
+export async function getMeshSecret(key, { leaderIp, configDir, fetchImpl = fetch, now = Date.now, softTtlMs = SOFT_TTL_MS }) {
+  const entries = readCache(configDir);
+  const cached = entries[key];
+  if (cached && now() - cached.at < softTtlMs) return { value: cached.value, source: 'cache' };
+
+  try {
+    const response = await fetchImpl(`http://${leaderIp}:${process.env.TR_SERVER_PORT || 3000}/api/secrets/mesh/${encodeURIComponent(key)}`, {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    if (response.status === 403 || response.status === 404) {
+      if (key in entries) {
+        delete entries[key];
+        writeCache(configDir, entries);
+      }
+      throw Object.assign(new Error(`Leader refused ${key} (${response.status})`), { refused: true });
+    }
+    if (!response.ok) throw new Error(`Leader returned ${response.status}`);
+    const { value } = await response.json();
+    entries[key] = { value, at: now() };
+    writeCache(configDir, entries);
+    return { value, source: 'leader' };
+  } catch (error) {
+    if (error.refused) throw error;
+    if (cached) return { value: cached.value, source: 'stale-cache' };
+    throw error;
+  }
+}

package/src/mesh.mjs

@@ -0,0 +1,23 @@
+import { importHostModule } from './host-runtime.mjs';
+const { loadPluginModule } = await importHostModule('src/core/plugin-runtime.mjs');
+export async function normalizeHostname(...args) { return (await loadPluginModule('mesh', 'mesh')).normalizeHostname(...args); }
+export async function meshNodeDocSlug(...args) { return (await loadPluginModule('mesh', 'mesh')).meshNodeDocSlug(...args); }
+export async function meshNodeKey(...args) { return (await loadPluginModule('mesh', 'mesh')).meshNodeKey(...args); }
+export async function clearMeshStatusCache(...args) { return (await loadPluginModule('mesh', 'mesh')).clearMeshStatusCache(...args); }
+export async function isMeshAvailable(...args) { return (await loadPluginModule('mesh', 'mesh')).isMeshAvailable(...args); }
+export async function getMeshSelf(...args) { return (await loadPluginModule('mesh', 'mesh')).getMeshSelf(...args); }
+export async function getMeshIp(...args) { return (await loadPluginModule('mesh', 'mesh')).getMeshIp(...args); }
+export async function getMeshHostname(...args) { return (await loadPluginModule('mesh', 'mesh')).getMeshHostname(...args); }
+export async function getMeshPeers(...args) { return (await loadPluginModule('mesh', 'mesh')).getMeshPeers(...args); }
+export async function meshVaultRoot(...args) { return (await loadPluginModule('mesh', 'mesh')).meshVaultRoot(...args); }
+export async function listMeshNodeEntities(...args) { return (await loadPluginModule('mesh', 'mesh')).listMeshNodeEntities(...args); }
+export async function entityForPeer(...args) { return (await loadPluginModule('mesh', 'mesh')).entityForPeer(...args); }
+export async function mergeLivePeersWithEntities(...args) { return (await loadPluginModule('mesh', 'mesh')).mergeLivePeersWithEntities(...args); }
+export async function listEnrichedMeshNodes(...args) { return (await loadPluginModule('mesh', 'mesh')).listEnrichedMeshNodes(...args); }
+export async function attachSelfInterfaces(...args) { return (await loadPluginModule('mesh', 'mesh')).attachSelfInterfaces(...args); }
+export async function findMeshNode(...args) { return (await loadPluginModule('mesh', 'mesh')).findMeshNode(...args); }
+export async function setMeshNodeAccess(...args) { return (await loadPluginModule('mesh', 'mesh')).setMeshNodeAccess(...args); }
+export async function ensureMeshNodeEntities(...args) { return (await loadPluginModule('mesh', 'mesh')).ensureMeshNodeEntities(...args); }
+export async function patchOwnMeshNode(...args) { return (await loadPluginModule('mesh', 'mesh')).patchOwnMeshNode(...args); }
+export async function execMeshCommand(...args) { return (await loadPluginModule('mesh', 'mesh')).execMeshCommand(...args); }
+export async function resolveMeshControlUrl(...args) { return (await loadPluginModule('mesh', 'mesh')).resolveMeshControlUrl(...args); }

package/src/metadata-state.mjs

@@ -0,0 +1,17 @@
+/** Non-secret auth metadata; ciphertext, hardware keys and OS projections stay in auth adapters. */
+import path from 'node:path';
+import { PluginStateStore } from './ssss-store.mjs';
+export function authState(file) { return new PluginStateStore(path.resolve(file), 'auth'); }
+export function assertNoSecretValues(value) {
+  if (!value || typeof value !== 'object') return;
+  for (const [key, item] of Object.entries(value)) {
+    if (/^(value|password|plaintext|private_key|api_key|access_token|refresh_token|token|dotenv)$/i.test(key) && item != null && item !== '') throw new Error('Secret values cannot enter SSSS auth metadata');
+    assertNoSecretValues(item);
+  }
+}
+export function authLedger(file) {
+  const rows = authState(file).read([]);
+  if (!Array.isArray(rows) || rows.some(row => !row || typeof row !== 'object' || Array.isArray(row))) throw new Error('Invalid auth metadata ledger');
+  rows.forEach(assertNoSecretValues); return rows;
+}
+export function appendAuthMetadata(file, row) { assertNoSecretValues(row); return authState(file).append(row); }

package/src/project-id.mjs

@@ -0,0 +1,3 @@
+import { importHostModule } from './host-runtime.mjs';
+const hostModule = await importHostModule('src/core/project-id.mjs');
+export const { readProjectId, ensureProjectId, repairProjectIds } = hostModule;