warpmetal 0.4.2 → 0.6.0

package/src/payment.js

@@ -694,6 +694,8 @@ export async function readPaymentArtifact(path, expected) {
 
 export function paymentWorkflow({
   taskId,
+  serverId,
+  kind = "checkout",
   requestEnvelopePath,
   paymentArtifactPath,
 }) {
@@ -746,17 +748,30 @@ export function paymentWorkflow({
       ],
     },
     submit: {
-      argv: [
-        "warpmetal",
-        "checkout",
-        "submit",
-        "--task",
-        taskId,
-        "--payment-artifact",
-        paymentArtifactPath,
-        "--wait",
-        "--json",
-      ],
+      argv:
+        kind === "renewal"
+          ? [
+              "warpmetal",
+              "renewal",
+              "submit",
+              "--server",
+              serverId,
+              "--payment-artifact",
+              paymentArtifactPath,
+              "--wait",
+              "--json",
+            ]
+          : [
+              "warpmetal",
+              "checkout",
+              "submit",
+              "--task",
+              taskId,
+              "--payment-artifact",
+              paymentArtifactPath,
+              "--wait",
+              "--json",
+            ],
     },
     compatibility: {
       alternativeInput: "--payment-signature-file <path>",

package/src/ssh.js

@@ -1,5 +1,13 @@
-import { createHash } from "node:crypto";
-import { lstat, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { createHash, randomBytes } from "node:crypto";
+import {
+  chmod,
+  lstat,
+  mkdir,
+  mkdtemp,
+  readFile,
+  rm,
+  writeFile,
+} from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
@@ -92,6 +100,107 @@ async function requireMissing(path) {
   }
 }
 
+async function isMissing(path) {
+  try {
+    await lstat(path);
+    return false;
+  } catch (error) {
+    if (error?.code === "ENOENT") return true;
+    throw error;
+  }
+}
+
+export function serverKeyName(hostname, requestedName) {
+  const normalizedHostname = String(hostname || "").trim().toLowerCase();
+  if (
+    !/^(?=.{1,63}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(
+      normalizedHostname,
+    )
+  ) {
+    throw new CliError(
+      "--hostname must be a valid DNS label before generating an SSH identity.",
+      { exitCode: 2 },
+    );
+  }
+  let value = String(requestedName || normalizedHostname)
+    .trim()
+    .toLowerCase();
+  if (!value.startsWith("warpmetal-")) value = `warpmetal-${value}`;
+  if (!/^[a-z0-9][a-z0-9._-]{0,79}$/.test(value)) {
+    throw new CliError(
+      "The SSH key name must contain only lowercase letters, digits, dots, underscores, or hyphens.",
+      { exitCode: 2 },
+    );
+  }
+  return { hostname: normalizedHostname, keyName: value };
+}
+
+export async function generateServerKey(
+  directory,
+  hostname,
+  requestedName,
+  { spawn = spawnSync, random = randomBytes } = {},
+) {
+  const normalized = serverKeyName(hostname, requestedName);
+  const identityDirectory = resolve(directory);
+  await mkdir(identityDirectory, { recursive: true, mode: 0o700 });
+  if (process.platform !== "win32") await chmod(identityDirectory, 0o700);
+
+  let keyName = normalized.keyName;
+  let privatePath = join(identityDirectory, keyName);
+  for (let attempt = 0; attempt < 32; attempt += 1) {
+    const publicPath = `${privatePath}.pub`;
+    if ((await isMissing(privatePath)) && (await isMissing(publicPath))) break;
+    const suffix = random(2).toString("hex");
+    keyName = `${normalized.keyName.slice(0, 75)}-${suffix}`;
+    privatePath = join(identityDirectory, keyName);
+  }
+  const publicPath = `${privatePath}.pub`;
+  await requireMissing(privatePath);
+  await requireMissing(publicPath);
+  const result = spawn(
+    "ssh-keygen",
+    [
+      "-q",
+      "-t",
+      "ed25519",
+      "-N",
+      "",
+      "-C",
+      `warpmetal:${normalized.hostname}`,
+      "-f",
+      privatePath,
+    ],
+    { stdio: ["ignore", "ignore", "pipe"], shell: false },
+  );
+  if (result.error?.code === "ENOENT") {
+    throw new CliError(
+      "ssh-keygen is required to generate a WarpMetal server identity.",
+      { exitCode: 2 },
+    );
+  }
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new CliError("ssh-keygen could not generate the server identity.", {
+      exitCode: 4,
+    });
+  }
+  if (process.platform !== "win32") {
+    await chmod(privatePath, 0o600);
+    await chmod(publicPath, 0o644);
+  }
+  const publicKey = await readSshPublicKey(publicPath);
+  return {
+    keyName,
+    hostnameAtCreation: normalized.hostname,
+    privateKeyPath: privatePath,
+    publicKeyPath: publicPath,
+    keyType: "ed25519",
+    sshFingerprint: sshFingerprint(publicKey),
+    sshPublicKey: publicKey,
+  };
+}
+
 export function sshFingerprint(publicKey) {
   const parts = publicKey.trim().split(/\s+/);
   if (parts.length < 2)

package/src/state.js

@@ -5,7 +5,7 @@ import { dirname, isAbsolute, join, resolve } from "node:path";
 
 import { CliError } from "./errors.js";
 
-const STATE_VERSION = 2;
+const STATE_VERSION = 3;
 
 function emptyState() {
   return {
@@ -16,6 +16,8 @@ function emptyState() {
     runtimes: {},
     sandboxes: {},
     accessGrants: {},
+    identities: {},
+    renewals: {},
   };
 }
 
@@ -62,6 +64,24 @@ function migrateState(value) {
       runtimes: {},
       sandboxes: {},
       accessGrants: {},
+      identities: {},
+      renewals: {},
+    };
+  }
+  if (
+    value?.version === 2 &&
+    value.orders &&
+    value.servers &&
+    value.operations &&
+    value.runtimes &&
+    value.sandboxes &&
+    value.accessGrants
+  ) {
+    return {
+      ...value,
+      version: STATE_VERSION,
+      identities: {},
+      renewals: {},
     };
   }
   return value;
@@ -80,7 +100,9 @@ function validateState(input) {
     !value.operations ||
     !value.runtimes ||
     !value.sandboxes ||
-    !value.accessGrants
+    !value.accessGrants ||
+    !value.identities ||
+    !value.renewals
   ) {
     throw new CliError("Incomplete WarpMetal state file.", { exitCode: 2 });
   }
@@ -121,7 +143,7 @@ export class StateStore {
     return result;
   }
 
-  async savePreparedOrder(response, checkoutBody) {
+  async savePreparedOrder(response, checkoutBody, identityId) {
     const { task, ownerToken } = response;
     if (!task?.id || !task?.serverId || !ownerToken) {
       throw new CliError("WarpMetal returned an incomplete prepared order.");
@@ -134,6 +156,7 @@ export class StateStore {
         checkoutPath: task.checkoutPath,
         checkoutBody,
         ownerToken,
+        identityId,
         createdAt: new Date().toISOString(),
       };
       state.servers[task.serverId] = {
@@ -141,8 +164,115 @@ export class StateStore {
         serverId: task.serverId,
         taskId: task.id,
         ownerToken,
+        identityId,
+      };
+      if (identityId && state.identities[identityId]) {
+        state.identities[identityId].taskId = task.id;
+        state.identities[identityId].serverId = task.serverId;
+        state.identities[identityId].boundAt = new Date().toISOString();
+      }
+    });
+  }
+
+  async saveIdentity(identity) {
+    if (!identity?.identityId || !identity?.keyName || !identity?.publicKeyPath) {
+      throw new CliError("The SSH identity record is incomplete.", { exitCode: 2 });
+    }
+    await this.update((state) => {
+      state.identities[identity.identityId] = {
+        ...identity,
+        createdAt: identity.createdAt || new Date().toISOString(),
       };
     });
+    return identity;
+  }
+
+  async bindIdentity(identityId, taskId, serverId) {
+    await this.update((state) => {
+      const identity = state.identities[identityId];
+      if (!identity) {
+        throw new CliError(`No local SSH identity exists for ${identityId}.`, {
+          exitCode: 2,
+        });
+      }
+      if (taskId) identity.taskId = taskId;
+      identity.serverId = serverId;
+      identity.boundAt = new Date().toISOString();
+      const server = state.servers[serverId] || { serverId };
+      server.identityId = identityId;
+      state.servers[serverId] = server;
+    });
+  }
+
+  async identity(identityId) {
+    return (await this.read()).identities[identityId];
+  }
+
+  async identityForServer(serverId) {
+    const state = await this.read();
+    const identityId = state.servers[serverId]?.identityId;
+    if (identityId && state.identities[identityId]) {
+      return state.identities[identityId];
+    }
+    return Object.values(state.identities).find(
+      (identity) => identity.serverId === serverId,
+    );
+  }
+
+  async saveRenewalPolicy(serverId, policy, wallet, refillTargetAtomic) {
+    await this.update((state) => {
+      state.renewals[serverId] = {
+        ...(state.renewals[serverId] || {}),
+        serverId,
+        policy,
+        wallet,
+        refillTargetAtomic,
+        updatedAt: new Date().toISOString(),
+      };
+    });
+  }
+
+  async saveRenewalChallenge(serverId, challenge) {
+    await this.update((state) => {
+      const renewal = state.renewals[serverId] || { serverId };
+      Object.assign(renewal, challenge, {
+        challengeSavedAt: new Date().toISOString(),
+      });
+      state.renewals[serverId] = renewal;
+    });
+  }
+
+  async saveRenewalPaymentAttempt(serverId, payment) {
+    await this.update((state) => {
+      const renewal = state.renewals[serverId];
+      if (!renewal) {
+        throw new CliError(`No local renewal state exists for ${serverId}.`, {
+          exitCode: 2,
+        });
+      }
+      if (
+        renewal.paymentRequestDigest &&
+        renewal.paymentRequestDigest !== payment.requestDigest
+      ) {
+        throw new CliError(
+          `The wallet payment attempt does not match the saved renewal for ${serverId}.`,
+          { exitCode: 2 },
+        );
+      }
+      Object.assign(renewal, {
+        walletPaymentAttemptId: payment.attemptId,
+        walletBuyerPaymentIdentifier: payment.buyerPaymentIdentifier,
+        walletName: payment.wallet,
+        walletPayerAddress: payment.payerAddress,
+        paymentArtifactPath: payment.path,
+        paymentArtifactExpiresAt: payment.expiresAt,
+        paymentArtifactSavedAt: new Date().toISOString(),
+      });
+    });
+  }
+
+  async renewal(serverId) {
+    return (await this.read()).renewals[serverId];
   }
 
   async savePaymentChallenge(
@@ -217,12 +347,13 @@ export class StateStore {
     });
   }
 
-  async saveOperation(operationId, serverId, kind) {
+  async saveOperation(operationId, serverId, kind, metadata = {}) {
     await this.update((state) => {
       state.operations[operationId] = {
         operationId,
         serverId,
         kind,
+        ...metadata,
         createdAt: new Date().toISOString(),
       };
     });
@@ -350,6 +481,26 @@ export class StateStore {
       runtimes: Object.values(state.runtimes),
       sandboxes: Object.values(state.sandboxes),
       accessGrants: Object.values(state.accessGrants),
+      identities: Object.values(state.identities).map((identity) => ({
+        identityId: identity.identityId,
+        keyName: identity.keyName,
+        hostnameAtCreation: identity.hostnameAtCreation,
+        publicKeyPath: identity.publicKeyPath,
+        privateKeyPath: identity.privateKeyPath,
+        sshFingerprint: identity.sshFingerprint,
+        serverId: identity.serverId,
+        taskId: identity.taskId,
+        createdAt: identity.createdAt,
+        boundAt: identity.boundAt,
+      })),
+      renewals: Object.values(state.renewals).map((renewal) => ({
+        serverId: renewal.serverId,
+        wallet: renewal.wallet,
+        refillTargetAtomic: renewal.refillTargetAtomic,
+        policy: renewal.policy,
+        paymentAttemptId: renewal.paymentAttemptId,
+        paymentArtifactExpiresAt: renewal.paymentArtifactExpiresAt,
+      })),
     };
   }