Compare commits
No commits in common. "9c98e2f2fb85f34a9c5d06fa0188813d9f1832b4" and "e7a2aa8df39957f333161d994508ee208e67168a" have entirely different histories.
9c98e2f2fb
...
e7a2aa8df3
@ -1,15 +1,303 @@
|
|||||||
import { Command } from "jsr:@cliffy/command@1.0.0-rc.7";
|
import { Command } from "jsr:@cliffy/command@1.0.0-rc.7";
|
||||||
|
import { Input, Secret, Select } from "jsr:@cliffy/prompt@1.0.0-rc.7";
|
||||||
import * as colors from "jsr:@std/fmt@0.225.2/colors";
|
import * as colors from "jsr:@std/fmt@0.225.2/colors";
|
||||||
import { runSetupWizard } from "./prompts/wizard.ts";
|
|
||||||
import { authCommand } from "./commands/auth.ts";
|
|
||||||
import { testCommand } from "./commands/test.ts";
|
|
||||||
import {
|
import {
|
||||||
buildCommand,
|
generateDockerCompose,
|
||||||
compileProtoCommand,
|
generateSpireDockerCompose,
|
||||||
releaseCommand,
|
} from "./compose.ts";
|
||||||
} from "./commands/build.ts";
|
import {
|
||||||
import { dumpComposeCommand, dumpEnvCommand } from "./commands/compose.ts";
|
AuthSetupConfig,
|
||||||
import { secretsCommand } from "./commands/secrets.ts";
|
COMPOSE_PATH,
|
||||||
|
DEFAULT_AUTH_CONFIG,
|
||||||
|
ENV_PATH,
|
||||||
|
generateEnv,
|
||||||
|
generateSpireEnv,
|
||||||
|
readEnv,
|
||||||
|
SPIRE_COMPOSE_PATH,
|
||||||
|
SPIRE_ENV_PATH,
|
||||||
|
} from "./env.ts";
|
||||||
|
import {
|
||||||
|
downloadWorkloadProto,
|
||||||
|
executeBuildImage,
|
||||||
|
executeProtobufCompilation,
|
||||||
|
generateBuildCommands,
|
||||||
|
} from "./build.ts";
|
||||||
|
|
||||||
|
export async function generateAuthSetupFiles(
|
||||||
|
config: AuthSetupConfig,
|
||||||
|
): Promise<void> {
|
||||||
|
const envContent = generateEnv(config);
|
||||||
|
await Deno.writeTextFile(ENV_PATH, envContent);
|
||||||
|
|
||||||
|
const spireEnvContent = generateSpireEnv(config);
|
||||||
|
await Deno.writeTextFile(SPIRE_ENV_PATH, spireEnvContent);
|
||||||
|
|
||||||
|
const composeContent = generateDockerCompose();
|
||||||
|
await Deno.writeTextFile(COMPOSE_PATH, composeContent);
|
||||||
|
|
||||||
|
const spireComposeContent = generateSpireDockerCompose();
|
||||||
|
await Deno.writeTextFile(SPIRE_COMPOSE_PATH, spireComposeContent);
|
||||||
|
|
||||||
|
console.log(
|
||||||
|
colors.green(
|
||||||
|
`\n✓ Successfully generated ${ENV_PATH}, ${SPIRE_ENV_PATH}, ${COMPOSE_PATH}, and ${SPIRE_COMPOSE_PATH}!`,
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.green("Setup complete. You may deploy your stacks by running:\n"),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.cyan(
|
||||||
|
"1. Deploy SPIRE Stack:\n" +
|
||||||
|
" podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml up -d\n\n" +
|
||||||
|
"2. Deploy Auth-Yes Stack:\n" +
|
||||||
|
" podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
export async function handleAuthSetup(
|
||||||
|
currentConfig: AuthSetupConfig,
|
||||||
|
): Promise<AuthSetupConfig> {
|
||||||
|
console.log(
|
||||||
|
colors.gray(
|
||||||
|
"Please provide the following Auth Yes configuration details.\n",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
|
||||||
|
const reg = await Input.prompt({
|
||||||
|
message: "Enter the Primary Container Registry URL:",
|
||||||
|
default: currentConfig.reg,
|
||||||
|
});
|
||||||
|
|
||||||
|
const ghcrReg = await Input.prompt({
|
||||||
|
message: "Enter the GHCR Mirror Registry URL (for SPIRE):",
|
||||||
|
default: currentConfig.ghcrReg || "ghcr.atyg.org",
|
||||||
|
});
|
||||||
|
|
||||||
|
const domainName = await Input.prompt({
|
||||||
|
message: "Enter the Auth Domain Name:",
|
||||||
|
hint: "E.g., auth.system.local",
|
||||||
|
default: currentConfig.domainName,
|
||||||
|
});
|
||||||
|
|
||||||
|
const dbDataPath = await Input.prompt({
|
||||||
|
message: "Enter the Database Path on the Host:",
|
||||||
|
default: currentConfig.dbDataPath,
|
||||||
|
});
|
||||||
|
|
||||||
|
const spireDataPath = await Input.prompt({
|
||||||
|
message: "Enter the SPIRE Path on the Host:",
|
||||||
|
default: currentConfig.spireDataPath,
|
||||||
|
});
|
||||||
|
|
||||||
|
const appSecret = await Secret.prompt({
|
||||||
|
message: "Enter the App Secret for the IDP:",
|
||||||
|
default: currentConfig.appSecret,
|
||||||
|
minLength: 16,
|
||||||
|
});
|
||||||
|
|
||||||
|
const pwdMessage = currentConfig.dbPassword
|
||||||
|
? "Enter the PostgreSQL database password: (Leave blank to keep existing password)"
|
||||||
|
: "Enter the PostgreSQL database password:";
|
||||||
|
|
||||||
|
const pwdInput = await Secret.prompt({
|
||||||
|
message: pwdMessage,
|
||||||
|
minLength: currentConfig.dbPassword ? 0 : 1,
|
||||||
|
});
|
||||||
|
|
||||||
|
const dbPassword = pwdInput === "" && currentConfig.dbPassword !== ""
|
||||||
|
? currentConfig.dbPassword
|
||||||
|
: pwdInput;
|
||||||
|
|
||||||
|
const newConfig: AuthSetupConfig = {
|
||||||
|
reg,
|
||||||
|
ghcrReg,
|
||||||
|
domainName,
|
||||||
|
dbPassword,
|
||||||
|
dbDataPath,
|
||||||
|
spireDataPath,
|
||||||
|
appSecret,
|
||||||
|
};
|
||||||
|
|
||||||
|
await generateAuthSetupFiles(newConfig);
|
||||||
|
|
||||||
|
return newConfig;
|
||||||
|
}
|
||||||
|
|
||||||
|
export async function handleTestConnection(domainName: string): Promise<void> {
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.blue(`\n=== Testing Auth Connection (https://${domainName}) ===`),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
|
||||||
|
try {
|
||||||
|
const controller = new AbortController();
|
||||||
|
const timeoutId = setTimeout(() => controller.abort(), 5000);
|
||||||
|
const res1 = await fetch(`https://${domainName}/`, {
|
||||||
|
signal: controller.signal,
|
||||||
|
});
|
||||||
|
clearTimeout(timeoutId);
|
||||||
|
|
||||||
|
if (res1.status === 502 || res1.status === 503 || res1.status === 504) {
|
||||||
|
throw new Error(`Gateway error: ${res1.status}`);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (res1.body) {
|
||||||
|
await res1.body.cancel();
|
||||||
|
}
|
||||||
|
|
||||||
|
console.log(
|
||||||
|
colors.green(
|
||||||
|
`✓ Auth service is up and reachable at https://${domainName}/`,
|
||||||
|
),
|
||||||
|
);
|
||||||
|
} catch (error) {
|
||||||
|
console.log(
|
||||||
|
colors.red(
|
||||||
|
`✗ Error: Could not reach the auth service at https://${domainName}/`,
|
||||||
|
),
|
||||||
|
);
|
||||||
|
if (error instanceof Error) {
|
||||||
|
console.log(colors.red(` Reason: ${error.message}`));
|
||||||
|
} else {
|
||||||
|
console.log(colors.red(` Reason: ${error}`));
|
||||||
|
}
|
||||||
|
console.log(
|
||||||
|
colors.red(
|
||||||
|
" Please verify the container is running and DNS/Traefik is resolving.",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async function handleReviewConfigs(): Promise<void> {
|
||||||
|
const envContent = await Deno.readTextFile(ENV_PATH).catch(() => null);
|
||||||
|
const composeContent = await Deno.readTextFile(COMPOSE_PATH).catch(() =>
|
||||||
|
null
|
||||||
|
);
|
||||||
|
const spireComposeContent = await Deno.readTextFile(SPIRE_COMPOSE_PATH).catch(
|
||||||
|
() => null,
|
||||||
|
);
|
||||||
|
|
||||||
|
if (!envContent && !composeContent && !spireComposeContent) {
|
||||||
|
console.log(
|
||||||
|
colors.red("\n✗ No generated configs found. Run the setup first.\n"),
|
||||||
|
);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
while (true) {
|
||||||
|
const action = await Select.prompt({
|
||||||
|
message: "Review Generated Configs",
|
||||||
|
options: [
|
||||||
|
{ name: "[Show .env]", value: "env" },
|
||||||
|
{ name: "[Show compose.yml]", value: "compose" },
|
||||||
|
{ name: "[Show compose.spire.yml]", value: "spire_compose" },
|
||||||
|
{ name: "[Back to Main Menu]", value: "back" },
|
||||||
|
],
|
||||||
|
});
|
||||||
|
|
||||||
|
if (action === "env") {
|
||||||
|
console.log(colors.bold(colors.blue(`\n=== ${ENV_PATH} ===\n`)));
|
||||||
|
console.log(envContent || colors.yellow("File not found."));
|
||||||
|
console.log();
|
||||||
|
} else if (action === "compose") {
|
||||||
|
console.log(colors.bold(colors.blue(`\n=== ${COMPOSE_PATH} ===\n`)));
|
||||||
|
console.log(composeContent || colors.yellow("File not found."));
|
||||||
|
console.log();
|
||||||
|
} else if (action === "spire_compose") {
|
||||||
|
console.log(
|
||||||
|
colors.bold(colors.blue(`\n=== ${SPIRE_COMPOSE_PATH} ===\n`)),
|
||||||
|
);
|
||||||
|
console.log(spireComposeContent || colors.yellow("File not found."));
|
||||||
|
console.log();
|
||||||
|
} else if (action === "back") {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// SIDE EFFECT: Runs the interactive CLI wizard.
|
||||||
|
export async function runSetupWizard(): Promise<void> {
|
||||||
|
console.log(colors.bold(colors.blue("=== Auth Setup Wizard ===\n")));
|
||||||
|
|
||||||
|
const loadedEnv = await readEnv();
|
||||||
|
let currentConfig: AuthSetupConfig = {
|
||||||
|
...DEFAULT_AUTH_CONFIG,
|
||||||
|
...loadedEnv,
|
||||||
|
};
|
||||||
|
|
||||||
|
if (Object.keys(loadedEnv).length > 0 && currentConfig.domainName) {
|
||||||
|
await handleTestConnection(currentConfig.domainName);
|
||||||
|
console.log();
|
||||||
|
}
|
||||||
|
|
||||||
|
while (true) {
|
||||||
|
const action = await Select.prompt({
|
||||||
|
message: "Main Menu",
|
||||||
|
options: [
|
||||||
|
{ name: "[Test Auth Connection]", value: "test" },
|
||||||
|
{ name: "[Configure Auth Yes API]", value: "auth" },
|
||||||
|
{ name: "[Compile Protobuf Definitions]", value: "compile_proto" },
|
||||||
|
{ name: "[Review Generated Configs]", value: "review" },
|
||||||
|
{ name: "[Build and Push Auth Image]", value: "build" },
|
||||||
|
{ name: "[Exit]", value: "exit" },
|
||||||
|
],
|
||||||
|
});
|
||||||
|
|
||||||
|
if (action === "test") {
|
||||||
|
await handleTestConnection(currentConfig.domainName);
|
||||||
|
console.log();
|
||||||
|
} else if (action === "auth") {
|
||||||
|
currentConfig = await handleAuthSetup(currentConfig);
|
||||||
|
} else if (action === "compile_proto") {
|
||||||
|
try {
|
||||||
|
await downloadWorkloadProto();
|
||||||
|
await executeProtobufCompilation();
|
||||||
|
console.log(colors.green("\n✓ Successfully compiled protobufs!\n"));
|
||||||
|
} catch (error) {
|
||||||
|
if (error instanceof Error) {
|
||||||
|
console.log(
|
||||||
|
colors.red(`\n✗ Protobuf compilation failed: ${error.message}\n`),
|
||||||
|
);
|
||||||
|
} else {
|
||||||
|
console.log(
|
||||||
|
colors.red(`\n✗ Protobuf compilation failed: ${error}\n`),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} else if (action === "review") {
|
||||||
|
await handleReviewConfigs();
|
||||||
|
} else if (action === "build") {
|
||||||
|
try {
|
||||||
|
const commands = generateBuildCommands(currentConfig.reg);
|
||||||
|
await executeBuildImage(commands);
|
||||||
|
console.log(colors.green("\n✓ Successfully built and pushed image!"));
|
||||||
|
console.log(
|
||||||
|
colors.green("You may now deploy your stack by running:\n"),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.cyan(
|
||||||
|
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
} catch (error) {
|
||||||
|
if (error instanceof Error) {
|
||||||
|
console.log(
|
||||||
|
colors.red(`\n✗ Build process failed: ${error.message}\n`),
|
||||||
|
);
|
||||||
|
} else {
|
||||||
|
console.log(colors.red(`\n✗ Build process failed: ${error}\n`));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} else if (action === "exit") {
|
||||||
|
console.log(colors.gray("Exiting...\n"));
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
export async function runCli(args = Deno.args): Promise<void> {
|
export async function runCli(args = Deno.args): Promise<void> {
|
||||||
if (import.meta.main || args.length === 0) {
|
if (import.meta.main || args.length === 0) {
|
||||||
@ -26,18 +314,458 @@ export async function runCli(args = Deno.args): Promise<void> {
|
|||||||
const cmd = new Command()
|
const cmd = new Command()
|
||||||
.name("auth-setup")
|
.name("auth-setup")
|
||||||
.description("Auth setup wizard and CLI")
|
.description("Auth setup wizard and CLI")
|
||||||
.version("1.0.0")
|
|
||||||
.action(() => {
|
.action(() => {
|
||||||
runSetupWizard();
|
runSetupWizard();
|
||||||
})
|
})
|
||||||
.command("auth", authCommand)
|
.command("auth", "Configure Auth Yes API")
|
||||||
.command("test", testCommand)
|
.option("--auto, --headless", "Run in headless mode")
|
||||||
.command("compile_proto", compileProtoCommand)
|
.option("--registry <reg:string>", "Container Registry URL")
|
||||||
.command("build", buildCommand)
|
.option("--ghcr-registry <ghcrReg:string>", "GHCR Mirror Registry URL")
|
||||||
.command("release", releaseCommand)
|
.option("--domain <domain:string>", "Auth Domain Name")
|
||||||
.command("dump_compose", dumpComposeCommand)
|
.option("--db-path <path:string>", "Database Path on the Host")
|
||||||
.command("dump_env", dumpEnvCommand)
|
.option("--spire-path <path:string>", "SPIRE Path on the Host")
|
||||||
.command("secrets", secretsCommand);
|
.action(async (options) => {
|
||||||
|
const loadedEnv = await readEnv();
|
||||||
|
const currentConfig: AuthSetupConfig = {
|
||||||
|
...DEFAULT_AUTH_CONFIG,
|
||||||
|
...loadedEnv,
|
||||||
|
};
|
||||||
|
|
||||||
|
if (options.auto) {
|
||||||
|
if (!options.registry || !options.domain || !options.dbPath) {
|
||||||
|
console.error(
|
||||||
|
colors.red(
|
||||||
|
"Error: --registry, --domain, and --db-path are required in headless mode.",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
Deno.exit(1);
|
||||||
|
}
|
||||||
|
const dbPassword = Deno.env.get("POSTGRES_PASSWORD") ||
|
||||||
|
currentConfig.dbPassword;
|
||||||
|
const appSecret = Deno.env.get("APP_SECRET") ||
|
||||||
|
currentConfig.appSecret;
|
||||||
|
if (!dbPassword) {
|
||||||
|
console.error(
|
||||||
|
colors.red(
|
||||||
|
"Error: POSTGRES_PASSWORD environment variable is required in headless mode.",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
Deno.exit(1);
|
||||||
|
}
|
||||||
|
if (!appSecret) {
|
||||||
|
console.error(
|
||||||
|
colors.red(
|
||||||
|
"Error: APP_SECRET environment variable is required in headless mode.",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
Deno.exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
const newConfig: AuthSetupConfig = {
|
||||||
|
reg: options.registry,
|
||||||
|
ghcrReg: options.ghcrRegistry || currentConfig.ghcrReg ||
|
||||||
|
"ghcr.atyg.org",
|
||||||
|
domainName: options.domain,
|
||||||
|
dbPassword,
|
||||||
|
dbDataPath: options.dbPath || currentConfig.dbDataPath ||
|
||||||
|
"/volume1/docker/auth-yes/data",
|
||||||
|
spireDataPath: options.spirePath || currentConfig.spireDataPath ||
|
||||||
|
"/volume1/docker/spire",
|
||||||
|
appSecret,
|
||||||
|
};
|
||||||
|
await generateAuthSetupFiles(newConfig);
|
||||||
|
} else {
|
||||||
|
if (options.registry) currentConfig.reg = options.registry;
|
||||||
|
if (options.ghcrRegistry) currentConfig.ghcrReg = options.ghcrRegistry;
|
||||||
|
if (options.domain) currentConfig.domainName = options.domain;
|
||||||
|
if (options.dbPath) currentConfig.dbDataPath = options.dbPath;
|
||||||
|
if (options.spirePath) currentConfig.spireDataPath = options.spirePath;
|
||||||
|
await handleAuthSetup(currentConfig);
|
||||||
|
}
|
||||||
|
})
|
||||||
|
.command("test", "Test Auth Connection")
|
||||||
|
.action(async () => {
|
||||||
|
const loadedEnv = await readEnv();
|
||||||
|
const currentConfig: AuthSetupConfig = {
|
||||||
|
...DEFAULT_AUTH_CONFIG,
|
||||||
|
...loadedEnv,
|
||||||
|
};
|
||||||
|
await handleTestConnection(currentConfig.domainName);
|
||||||
|
})
|
||||||
|
.command("compile_proto", "Compile Protobuf Definitions")
|
||||||
|
.action(async () => {
|
||||||
|
try {
|
||||||
|
await downloadWorkloadProto();
|
||||||
|
await executeProtobufCompilation();
|
||||||
|
console.log(colors.green("\n✓ Successfully compiled protobufs!\n"));
|
||||||
|
} catch (error) {
|
||||||
|
if (error instanceof Error) {
|
||||||
|
console.log(
|
||||||
|
colors.red(`\n✗ Protobuf compilation failed: ${error.message}\n`),
|
||||||
|
);
|
||||||
|
} else {
|
||||||
|
console.log(
|
||||||
|
colors.red(`\n✗ Protobuf compilation failed: ${error}\n`),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
Deno.exit(1);
|
||||||
|
}
|
||||||
|
})
|
||||||
|
.command("build", "Build and Push Auth Image")
|
||||||
|
.action(async () => {
|
||||||
|
try {
|
||||||
|
const loadedEnv = await readEnv();
|
||||||
|
const currentConfig: AuthSetupConfig = {
|
||||||
|
...DEFAULT_AUTH_CONFIG,
|
||||||
|
...loadedEnv,
|
||||||
|
};
|
||||||
|
const commands = generateBuildCommands(currentConfig.reg);
|
||||||
|
await executeBuildImage(commands);
|
||||||
|
console.log(
|
||||||
|
colors.green("\n✓ Successfully built and pushed auth image!"),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.green("You may now deploy your stack by running:\n"),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.cyan(
|
||||||
|
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
} catch (error) {
|
||||||
|
if (error instanceof Error) {
|
||||||
|
console.log(
|
||||||
|
colors.red(`\n✗ Build process failed: ${error.message}\n`),
|
||||||
|
);
|
||||||
|
} else {
|
||||||
|
console.log(colors.red(`\n✗ Build process failed: ${error}\n`));
|
||||||
|
}
|
||||||
|
Deno.exit(1);
|
||||||
|
}
|
||||||
|
})
|
||||||
|
.command("dump_compose", "Output all generated Compose YAML configurations")
|
||||||
|
.action(() => {
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.blue(
|
||||||
|
"\n================================================================",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.green(" STACK 1: Auth-Yes Stack (infra/compose.yml)"),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.blue(
|
||||||
|
"================================================================\n",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(generateDockerCompose());
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.blue(
|
||||||
|
"================================================================",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.green(
|
||||||
|
" STACK 2: Standalone SPIRE Stack (infra/compose.spire.yml)",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.blue(
|
||||||
|
"================================================================\n",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(generateSpireDockerCompose());
|
||||||
|
})
|
||||||
|
.command(
|
||||||
|
"dump_env",
|
||||||
|
"Output current environment configuration (.env and .env.spire)",
|
||||||
|
)
|
||||||
|
.action(async () => {
|
||||||
|
const loadedEnv = await readEnv();
|
||||||
|
const currentConfig: AuthSetupConfig = {
|
||||||
|
...DEFAULT_AUTH_CONFIG,
|
||||||
|
...loadedEnv,
|
||||||
|
};
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.blue(
|
||||||
|
"\n================================================================",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.green(" STACK 1: Auth-Yes Environment (infra/stack.env)"),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.blue(
|
||||||
|
"================================================================\n",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(generateEnv(currentConfig));
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.blue(
|
||||||
|
"================================================================",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.green(
|
||||||
|
" STACK 2: SPIRE Stack Environment (infra/.env.spire)",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.blue(
|
||||||
|
"================================================================\n",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(generateSpireEnv(currentConfig));
|
||||||
|
})
|
||||||
|
.command("secrets", "Inspect secrets status and persistence paths")
|
||||||
|
.action(async () => {
|
||||||
|
const loadedEnv = await readEnv();
|
||||||
|
const currentConfig: AuthSetupConfig = {
|
||||||
|
...DEFAULT_AUTH_CONFIG,
|
||||||
|
...loadedEnv,
|
||||||
|
};
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.blue(
|
||||||
|
"\n=== Auth-Yes Secrets & Persistence Topology ===\n",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
`${
|
||||||
|
colors.cyan("Database Persistence Path:")
|
||||||
|
} ${currentConfig.dbDataPath}`,
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
`${
|
||||||
|
colors.cyan("SPIRE Persistence Path:")
|
||||||
|
} ${currentConfig.spireDataPath}`,
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
`${
|
||||||
|
colors.cyan("Local Artifact Files:")
|
||||||
|
} ${ENV_PATH}, ${SPIRE_ENV_PATH}, ${COMPOSE_PATH}, ${SPIRE_COMPOSE_PATH}`,
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
`${colors.cyan("PostgreSQL Password:")} ${
|
||||||
|
currentConfig.dbPassword
|
||||||
|
? colors.green(
|
||||||
|
"✓ Configured (len: " + currentConfig.dbPassword.length + ")",
|
||||||
|
)
|
||||||
|
: colors.red("✗ Missing")
|
||||||
|
}`,
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
`${colors.cyan("Application Secret:")} ${
|
||||||
|
currentConfig.appSecret
|
||||||
|
? colors.green(
|
||||||
|
"✓ Configured (len: " + currentConfig.appSecret.length + ")",
|
||||||
|
)
|
||||||
|
: colors.red("✗ Missing")
|
||||||
|
}`,
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.gray(
|
||||||
|
"\nTip: To dump raw environment variables, run: deno task setup dump_env\n",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
})
|
||||||
|
.command(
|
||||||
|
"release",
|
||||||
|
"Run complete build & release pipeline with copy-paste deployment instructions",
|
||||||
|
)
|
||||||
|
.action(async () => {
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.blue(
|
||||||
|
"\n================================================================",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.green(
|
||||||
|
" Auth-Yes Infrastructure Build & Release Pipeline",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.blue(
|
||||||
|
"================================================================\n",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
|
||||||
|
// 1. Quality Gates
|
||||||
|
console.log(colors.cyan("[1/4] Running Quality Gates & Test Suite..."));
|
||||||
|
const testCmd = new Deno.Command("deno", {
|
||||||
|
args: ["task", "test"],
|
||||||
|
stdout: "inherit",
|
||||||
|
stderr: "inherit",
|
||||||
|
});
|
||||||
|
const testRes = await testCmd.output();
|
||||||
|
if (testRes.code !== 0) {
|
||||||
|
console.error(
|
||||||
|
colors.red("\n✗ Quality gates failed. Aborting release."),
|
||||||
|
);
|
||||||
|
Deno.exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
// 2. Compile Protobufs
|
||||||
|
console.log(
|
||||||
|
colors.cyan("\n[2/4] Downloading & Compiling Protobufs..."),
|
||||||
|
);
|
||||||
|
await downloadWorkloadProto();
|
||||||
|
await executeProtobufCompilation();
|
||||||
|
|
||||||
|
// 3. Build & Push Images
|
||||||
|
console.log(
|
||||||
|
colors.cyan(
|
||||||
|
"\n[3/4] Building and Pushing Custom Container Images...",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
const loadedEnv = await readEnv();
|
||||||
|
const currentConfig: AuthSetupConfig = {
|
||||||
|
...DEFAULT_AUTH_CONFIG,
|
||||||
|
...loadedEnv,
|
||||||
|
};
|
||||||
|
const commands = generateBuildCommands(currentConfig.reg);
|
||||||
|
await executeBuildImage(commands);
|
||||||
|
console.log(
|
||||||
|
colors.green(
|
||||||
|
"\n✓ Successfully built and pushed all stack images to " +
|
||||||
|
currentConfig.reg + "!",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
|
||||||
|
// 4. Output Copy-Paste Guides
|
||||||
|
console.log(
|
||||||
|
colors.cyan(
|
||||||
|
"\n[4/4] Release Complete. Deployment & Configuration Guides:\n",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.yellow(
|
||||||
|
"┌──────────────────────────────────────────────────────────────┐",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.yellow(
|
||||||
|
"│ A. FOR NEW SYSTEM INSTALLATIONS │",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.yellow(
|
||||||
|
"└──────────────────────────────────────────────────────────────┘",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.gray("# 1. Inspect environment variables and secrets:"),
|
||||||
|
);
|
||||||
|
console.log(colors.cyan("deno task setup dump_env"));
|
||||||
|
console.log(
|
||||||
|
colors.gray("\n# 2. Inspect generated Docker Compose files:"),
|
||||||
|
);
|
||||||
|
console.log(colors.cyan("deno task setup dump_compose"));
|
||||||
|
console.log(
|
||||||
|
colors.gray("\n# 3. Create persistent storage paths on host:"),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.cyan(
|
||||||
|
`mkdir -p ${currentConfig.spireDataPath} ${currentConfig.dbDataPath}`,
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(colors.gray("\n# 4. Deploy fresh stacks:"));
|
||||||
|
console.log(
|
||||||
|
colors.cyan(
|
||||||
|
"podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml up -d",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.cyan(
|
||||||
|
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.yellow(
|
||||||
|
"\n┌──────────────────────────────────────────────────────────────┐",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.yellow(
|
||||||
|
"│ B. FOR EXISTING SYSTEM UPDATES (ROLLING RESTART) │",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.bold(
|
||||||
|
colors.yellow(
|
||||||
|
"└──────────────────────────────────────────────────────────────┘",
|
||||||
|
),
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.gray(
|
||||||
|
"# Pull newly pushed custom images and restart containers:",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.cyan(
|
||||||
|
"podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml pull",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.cyan(
|
||||||
|
"podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml up -d\n",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.cyan(
|
||||||
|
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml pull",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
console.log(
|
||||||
|
colors.cyan(
|
||||||
|
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
|
||||||
|
),
|
||||||
|
);
|
||||||
|
});
|
||||||
|
|
||||||
await cmd.parse(args);
|
await cmd.parse(args);
|
||||||
}
|
}
|
||||||
|
|||||||
@ -1,71 +0,0 @@
|
|||||||
import { Command } from "jsr:@cliffy/command@1.0.0-rc.7";
|
|
||||||
import * as colors from "jsr:@std/fmt@0.225.2/colors";
|
|
||||||
import { AuthSetupConfig, DEFAULT_AUTH_CONFIG, readEnv } from "../env.ts";
|
|
||||||
import { generateAuthSetupFiles, handleAuthSetup } from "../prompts/auth.ts";
|
|
||||||
|
|
||||||
export const authCommand = new Command()
|
|
||||||
.description("Configure Auth Yes API")
|
|
||||||
.option("--auto, --headless", "Run in headless mode")
|
|
||||||
.option("--registry <reg:string>", "Container Registry URL")
|
|
||||||
.option("--ghcr-registry <ghcrReg:string>", "GHCR Mirror Registry URL")
|
|
||||||
.option("--domain <domain:string>", "Auth Domain Name")
|
|
||||||
.option("--db-path <path:string>", "Database Path on the Host")
|
|
||||||
.option("--spire-path <path:string>", "SPIRE Path on the Host")
|
|
||||||
.action(async (options) => {
|
|
||||||
const loadedEnv = await readEnv();
|
|
||||||
const currentConfig: AuthSetupConfig = {
|
|
||||||
...DEFAULT_AUTH_CONFIG,
|
|
||||||
...loadedEnv,
|
|
||||||
};
|
|
||||||
|
|
||||||
if (options.auto) {
|
|
||||||
if (!options.registry || !options.domain || !options.dbPath) {
|
|
||||||
console.error(
|
|
||||||
colors.red(
|
|
||||||
"Error: --registry, --domain, and --db-path are required in headless mode.",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
Deno.exit(1);
|
|
||||||
}
|
|
||||||
const dbPassword = Deno.env.get("POSTGRES_PASSWORD") ||
|
|
||||||
currentConfig.dbPassword;
|
|
||||||
const appSecret = Deno.env.get("APP_SECRET") || currentConfig.appSecret;
|
|
||||||
if (!dbPassword) {
|
|
||||||
console.error(
|
|
||||||
colors.red(
|
|
||||||
"Error: POSTGRES_PASSWORD environment variable is required in headless mode.",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
Deno.exit(1);
|
|
||||||
}
|
|
||||||
if (!appSecret) {
|
|
||||||
console.error(
|
|
||||||
colors.red(
|
|
||||||
"Error: APP_SECRET environment variable is required in headless mode.",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
Deno.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
const newConfig: AuthSetupConfig = {
|
|
||||||
reg: options.registry,
|
|
||||||
ghcrReg: options.ghcrRegistry || currentConfig.ghcrReg ||
|
|
||||||
"ghcr.atyg.org",
|
|
||||||
domainName: options.domain,
|
|
||||||
dbPassword,
|
|
||||||
dbDataPath: options.dbPath || currentConfig.dbDataPath ||
|
|
||||||
"/volume1/docker/auth-yes/data",
|
|
||||||
spireDataPath: options.spirePath || currentConfig.spireDataPath ||
|
|
||||||
"/volume1/docker/spire",
|
|
||||||
appSecret,
|
|
||||||
};
|
|
||||||
await generateAuthSetupFiles(newConfig);
|
|
||||||
} else {
|
|
||||||
if (options.registry) currentConfig.reg = options.registry;
|
|
||||||
if (options.ghcrRegistry) currentConfig.ghcrReg = options.ghcrRegistry;
|
|
||||||
if (options.domain) currentConfig.domainName = options.domain;
|
|
||||||
if (options.dbPath) currentConfig.dbDataPath = options.dbPath;
|
|
||||||
if (options.spirePath) currentConfig.spireDataPath = options.spirePath;
|
|
||||||
await handleAuthSetup(currentConfig);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
@ -1,235 +0,0 @@
|
|||||||
import { Command } from "jsr:@cliffy/command@1.0.0-rc.7";
|
|
||||||
import * as colors from "jsr:@std/fmt@0.225.2/colors";
|
|
||||||
import { AuthSetupConfig, DEFAULT_AUTH_CONFIG, readEnv } from "../env.ts";
|
|
||||||
import {
|
|
||||||
downloadWorkloadProto,
|
|
||||||
executeBuildImage,
|
|
||||||
executeProtobufCompilation,
|
|
||||||
generateBuildCommands,
|
|
||||||
} from "../build.ts";
|
|
||||||
|
|
||||||
export const compileProtoCommand = new Command()
|
|
||||||
.description("Compile Protobuf Definitions")
|
|
||||||
.action(async () => {
|
|
||||||
try {
|
|
||||||
await downloadWorkloadProto();
|
|
||||||
await executeProtobufCompilation();
|
|
||||||
console.log(colors.green("\n✓ Successfully compiled protobufs!\n"));
|
|
||||||
} catch (error) {
|
|
||||||
if (error instanceof Error) {
|
|
||||||
console.log(
|
|
||||||
colors.red(`\n✗ Protobuf compilation failed: ${error.message}\n`),
|
|
||||||
);
|
|
||||||
} else {
|
|
||||||
console.log(colors.red(`\n✗ Protobuf compilation failed: ${error}\n`));
|
|
||||||
}
|
|
||||||
Deno.exit(1);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
export const buildCommand = new Command()
|
|
||||||
.description("Build and Push Auth Image")
|
|
||||||
.action(async () => {
|
|
||||||
try {
|
|
||||||
const loadedEnv = await readEnv();
|
|
||||||
const currentConfig: AuthSetupConfig = {
|
|
||||||
...DEFAULT_AUTH_CONFIG,
|
|
||||||
...loadedEnv,
|
|
||||||
};
|
|
||||||
const commands = generateBuildCommands(currentConfig.reg);
|
|
||||||
await executeBuildImage(commands);
|
|
||||||
console.log(
|
|
||||||
colors.green("\n✓ Successfully built and pushed auth image!"),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.green("You may now deploy your stack by running:\n"),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.cyan(
|
|
||||||
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
} catch (error) {
|
|
||||||
if (error instanceof Error) {
|
|
||||||
console.log(
|
|
||||||
colors.red(`\n✗ Build process failed: ${error.message}\n`),
|
|
||||||
);
|
|
||||||
} else {
|
|
||||||
console.log(colors.red(`\n✗ Build process failed: ${error}\n`));
|
|
||||||
}
|
|
||||||
Deno.exit(1);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
export const releaseCommand = new Command()
|
|
||||||
.description(
|
|
||||||
"Run complete build & release pipeline with copy-paste deployment instructions",
|
|
||||||
)
|
|
||||||
.action(async () => {
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.blue(
|
|
||||||
"\n================================================================",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.green(
|
|
||||||
" Auth-Yes Infrastructure Build & Release Pipeline",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.blue(
|
|
||||||
"================================================================\n",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
|
|
||||||
// 1. Quality Gates
|
|
||||||
console.log(colors.cyan("[1/4] Running Quality Gates & Test Suite..."));
|
|
||||||
const testCmd = new Deno.Command("deno", {
|
|
||||||
args: ["task", "test"],
|
|
||||||
stdout: "inherit",
|
|
||||||
stderr: "inherit",
|
|
||||||
});
|
|
||||||
const testRes = await testCmd.output();
|
|
||||||
if (testRes.code !== 0) {
|
|
||||||
console.error(
|
|
||||||
colors.red("\n✗ Quality gates failed. Aborting release."),
|
|
||||||
);
|
|
||||||
Deno.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
// 2. Compile Protobufs
|
|
||||||
console.log(
|
|
||||||
colors.cyan("\n[2/4] Downloading & Compiling Protobufs..."),
|
|
||||||
);
|
|
||||||
await downloadWorkloadProto();
|
|
||||||
await executeProtobufCompilation();
|
|
||||||
|
|
||||||
// 3. Build & Push Images
|
|
||||||
console.log(
|
|
||||||
colors.cyan(
|
|
||||||
"\n[3/4] Building and Pushing Custom Container Images...",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
const loadedEnv = await readEnv();
|
|
||||||
const currentConfig: AuthSetupConfig = {
|
|
||||||
...DEFAULT_AUTH_CONFIG,
|
|
||||||
...loadedEnv,
|
|
||||||
};
|
|
||||||
const commands = generateBuildCommands(currentConfig.reg);
|
|
||||||
await executeBuildImage(commands);
|
|
||||||
console.log(
|
|
||||||
colors.green(
|
|
||||||
"\n✓ Successfully built and pushed all stack images to " +
|
|
||||||
currentConfig.reg + "!",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
|
|
||||||
// 4. Output Copy-Paste Guides
|
|
||||||
console.log(
|
|
||||||
colors.cyan(
|
|
||||||
"\n[4/4] Release Complete. Deployment & Configuration Guides:\n",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.yellow(
|
|
||||||
"┌──────────────────────────────────────────────────────────────┐",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.yellow(
|
|
||||||
"│ A. FOR NEW SYSTEM INSTALLATIONS │",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.yellow(
|
|
||||||
"└──────────────────────────────────────────────────────────────┘",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.gray("# 1. Inspect environment variables and secrets:"),
|
|
||||||
);
|
|
||||||
console.log(colors.cyan("deno task setup dump_env"));
|
|
||||||
console.log(
|
|
||||||
colors.gray("\n# 2. Inspect generated Docker Compose files:"),
|
|
||||||
);
|
|
||||||
console.log(colors.cyan("deno task setup dump_compose"));
|
|
||||||
console.log(
|
|
||||||
colors.gray("\n# 3. Create persistent storage paths on host:"),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.cyan(
|
|
||||||
`mkdir -p ${currentConfig.spireDataPath} ${currentConfig.dbDataPath}`,
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(colors.gray("\n# 4. Deploy fresh stacks:"));
|
|
||||||
console.log(
|
|
||||||
colors.cyan(
|
|
||||||
"podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml up -d",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.cyan(
|
|
||||||
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.yellow(
|
|
||||||
"\n┌──────────────────────────────────────────────────────────────┐",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.yellow(
|
|
||||||
"│ B. FOR EXISTING SYSTEM UPDATES (ROLLING RESTART) │",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.yellow(
|
|
||||||
"└──────────────────────────────────────────────────────────────┘",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.gray(
|
|
||||||
"# Pull newly pushed custom images and restart containers:",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.cyan(
|
|
||||||
"podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml pull",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.cyan(
|
|
||||||
"podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml up -d\n",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.cyan(
|
|
||||||
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml pull",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.cyan(
|
|
||||||
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
});
|
|
||||||
@ -1,112 +0,0 @@
|
|||||||
import { Command } from "jsr:@cliffy/command@1.0.0-rc.7";
|
|
||||||
import * as colors from "jsr:@std/fmt@0.225.2/colors";
|
|
||||||
import {
|
|
||||||
generateDockerCompose,
|
|
||||||
generateSpireDockerCompose,
|
|
||||||
} from "../compose.ts";
|
|
||||||
import {
|
|
||||||
AuthSetupConfig,
|
|
||||||
DEFAULT_AUTH_CONFIG,
|
|
||||||
generateEnv,
|
|
||||||
generateSpireEnv,
|
|
||||||
readEnv,
|
|
||||||
} from "../env.ts";
|
|
||||||
|
|
||||||
export const dumpComposeCommand = new Command()
|
|
||||||
.description("Output all generated Compose YAML configurations")
|
|
||||||
.action(() => {
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.blue(
|
|
||||||
"\n================================================================",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.green(" STACK 1: Auth-Yes Stack (infra/compose.yml)"),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.blue(
|
|
||||||
"================================================================\n",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(generateDockerCompose());
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.blue(
|
|
||||||
"================================================================",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.green(
|
|
||||||
" STACK 2: Standalone SPIRE Stack (infra/compose.spire.yml)",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.blue(
|
|
||||||
"================================================================\n",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(generateSpireDockerCompose());
|
|
||||||
});
|
|
||||||
|
|
||||||
export const dumpEnvCommand = new Command()
|
|
||||||
.description("Output current environment configuration (.env and .env.spire)")
|
|
||||||
.action(async () => {
|
|
||||||
const loadedEnv = await readEnv();
|
|
||||||
const currentConfig: AuthSetupConfig = {
|
|
||||||
...DEFAULT_AUTH_CONFIG,
|
|
||||||
...loadedEnv,
|
|
||||||
};
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.blue(
|
|
||||||
"\n================================================================",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.green(" STACK 1: Auth-Yes Environment (infra/stack.env)"),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.blue(
|
|
||||||
"================================================================\n",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(generateEnv(currentConfig));
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.blue(
|
|
||||||
"================================================================",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.green(
|
|
||||||
" STACK 2: SPIRE Stack Environment (infra/.env.spire)",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.blue(
|
|
||||||
"================================================================\n",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(generateSpireEnv(currentConfig));
|
|
||||||
});
|
|
||||||
@ -1,66 +0,0 @@
|
|||||||
import { Command } from "jsr:@cliffy/command@1.0.0-rc.7";
|
|
||||||
import * as colors from "jsr:@std/fmt@0.225.2/colors";
|
|
||||||
import {
|
|
||||||
AuthSetupConfig,
|
|
||||||
COMPOSE_PATH,
|
|
||||||
DEFAULT_AUTH_CONFIG,
|
|
||||||
ENV_PATH,
|
|
||||||
readEnv,
|
|
||||||
SPIRE_COMPOSE_PATH,
|
|
||||||
SPIRE_ENV_PATH,
|
|
||||||
} from "../env.ts";
|
|
||||||
|
|
||||||
export const secretsCommand = new Command()
|
|
||||||
.description("Inspect secrets status and persistence paths")
|
|
||||||
.action(async () => {
|
|
||||||
const loadedEnv = await readEnv();
|
|
||||||
const currentConfig: AuthSetupConfig = {
|
|
||||||
...DEFAULT_AUTH_CONFIG,
|
|
||||||
...loadedEnv,
|
|
||||||
};
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.blue(
|
|
||||||
"\n=== Auth-Yes Secrets & Persistence Topology ===\n",
|
|
||||||
),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
`${
|
|
||||||
colors.cyan("Database Persistence Path:")
|
|
||||||
} ${currentConfig.dbDataPath}`,
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
`${
|
|
||||||
colors.cyan("SPIRE Persistence Path:")
|
|
||||||
} ${currentConfig.spireDataPath}`,
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
`${
|
|
||||||
colors.cyan("Local Artifact Files:")
|
|
||||||
} ${ENV_PATH}, ${SPIRE_ENV_PATH}, ${COMPOSE_PATH}, ${SPIRE_COMPOSE_PATH}`,
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
`${colors.cyan("PostgreSQL Password:")} ${
|
|
||||||
currentConfig.dbPassword
|
|
||||||
? colors.green(
|
|
||||||
"✓ Configured (len: " + currentConfig.dbPassword.length + ")",
|
|
||||||
)
|
|
||||||
: colors.red("✗ Missing")
|
|
||||||
}`,
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
`${colors.cyan("Application Secret:")} ${
|
|
||||||
currentConfig.appSecret
|
|
||||||
? colors.green(
|
|
||||||
"✓ Configured (len: " + currentConfig.appSecret.length + ")",
|
|
||||||
)
|
|
||||||
: colors.red("✗ Missing")
|
|
||||||
}`,
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.gray(
|
|
||||||
"\nTip: To dump raw environment variables, run: deno task setup dump_env\n",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
});
|
|
||||||
@ -1,61 +0,0 @@
|
|||||||
import { Command } from "jsr:@cliffy/command@1.0.0-rc.7";
|
|
||||||
import * as colors from "jsr:@std/fmt@0.225.2/colors";
|
|
||||||
import { AuthSetupConfig, DEFAULT_AUTH_CONFIG, readEnv } from "../env.ts";
|
|
||||||
|
|
||||||
export async function handleTestConnection(domainName: string): Promise<void> {
|
|
||||||
console.log(
|
|
||||||
colors.bold(
|
|
||||||
colors.blue(`\n=== Testing Auth Connection (https://${domainName}) ===`),
|
|
||||||
),
|
|
||||||
);
|
|
||||||
|
|
||||||
try {
|
|
||||||
const controller = new AbortController();
|
|
||||||
const timeoutId = setTimeout(() => controller.abort(), 5000);
|
|
||||||
const res1 = await fetch(`https://${domainName}/`, {
|
|
||||||
signal: controller.signal,
|
|
||||||
});
|
|
||||||
clearTimeout(timeoutId);
|
|
||||||
|
|
||||||
if (res1.status === 502 || res1.status === 503 || res1.status === 504) {
|
|
||||||
throw new Error(`Gateway error: ${res1.status}`);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (res1.body) {
|
|
||||||
await res1.body.cancel();
|
|
||||||
}
|
|
||||||
|
|
||||||
console.log(
|
|
||||||
colors.green(
|
|
||||||
`✓ Auth service is up and reachable at https://${domainName}/`,
|
|
||||||
),
|
|
||||||
);
|
|
||||||
} catch (error) {
|
|
||||||
console.log(
|
|
||||||
colors.red(
|
|
||||||
`✗ Error: Could not reach the auth service at https://${domainName}/`,
|
|
||||||
),
|
|
||||||
);
|
|
||||||
if (error instanceof Error) {
|
|
||||||
console.log(colors.red(` Reason: ${error.message}`));
|
|
||||||
} else {
|
|
||||||
console.log(colors.red(` Reason: ${error}`));
|
|
||||||
}
|
|
||||||
console.log(
|
|
||||||
colors.red(
|
|
||||||
" Please verify the container is running and DNS/Traefik is resolving.",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
export const testCommand = new Command()
|
|
||||||
.description("Test Auth Connection")
|
|
||||||
.action(async () => {
|
|
||||||
const loadedEnv = await readEnv();
|
|
||||||
const currentConfig: AuthSetupConfig = {
|
|
||||||
...DEFAULT_AUTH_CONFIG,
|
|
||||||
...loadedEnv,
|
|
||||||
};
|
|
||||||
await handleTestConnection(currentConfig.domainName);
|
|
||||||
});
|
|
||||||
@ -1,134 +0,0 @@
|
|||||||
import { Input, Secret } from "jsr:@cliffy/prompt@1.0.0-rc.7";
|
|
||||||
import * as colors from "jsr:@std/fmt@0.225.2/colors";
|
|
||||||
import {
|
|
||||||
generateDockerCompose,
|
|
||||||
generateSpireDockerCompose,
|
|
||||||
} from "../compose.ts";
|
|
||||||
import {
|
|
||||||
AuthSetupConfig,
|
|
||||||
COMPOSE_PATH,
|
|
||||||
ENV_PATH,
|
|
||||||
generateEnv,
|
|
||||||
generateSpireEnv,
|
|
||||||
SPIRE_COMPOSE_PATH,
|
|
||||||
SPIRE_ENV_PATH,
|
|
||||||
} from "../env.ts";
|
|
||||||
|
|
||||||
export async function promptAuthConfig(
|
|
||||||
currentConfig: AuthSetupConfig,
|
|
||||||
): Promise<Partial<AuthSetupConfig>> {
|
|
||||||
console.log(
|
|
||||||
colors.gray(
|
|
||||||
"Please provide the following Auth Yes configuration details.\n",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
|
|
||||||
const reg = await Input.prompt({
|
|
||||||
message: "Enter the Primary Container Registry URL:",
|
|
||||||
default: currentConfig.reg,
|
|
||||||
});
|
|
||||||
|
|
||||||
const ghcrReg = await Input.prompt({
|
|
||||||
message: "Enter the GHCR Mirror Registry URL (for SPIRE):",
|
|
||||||
default: currentConfig.ghcrReg || "ghcr.atyg.org",
|
|
||||||
});
|
|
||||||
|
|
||||||
const domainName = await Input.prompt({
|
|
||||||
message: "Enter the Auth Domain Name:",
|
|
||||||
hint: "E.g., auth.system.local",
|
|
||||||
default: currentConfig.domainName,
|
|
||||||
});
|
|
||||||
|
|
||||||
const appSecret = await Secret.prompt({
|
|
||||||
message: "Enter the App Secret for the IDP:",
|
|
||||||
default: currentConfig.appSecret,
|
|
||||||
minLength: 16,
|
|
||||||
});
|
|
||||||
|
|
||||||
const pwdMessage = currentConfig.dbPassword
|
|
||||||
? "Enter the PostgreSQL database password: (Leave blank to keep existing password)"
|
|
||||||
: "Enter the PostgreSQL database password:";
|
|
||||||
|
|
||||||
const pwdInput = await Secret.prompt({
|
|
||||||
message: pwdMessage,
|
|
||||||
minLength: currentConfig.dbPassword ? 0 : 1,
|
|
||||||
});
|
|
||||||
|
|
||||||
const dbPassword = pwdInput === "" && currentConfig.dbPassword !== ""
|
|
||||||
? currentConfig.dbPassword
|
|
||||||
: pwdInput;
|
|
||||||
|
|
||||||
return { reg, ghcrReg, domainName, appSecret, dbPassword };
|
|
||||||
}
|
|
||||||
|
|
||||||
export async function promptSpireConfig(
|
|
||||||
currentConfig: AuthSetupConfig,
|
|
||||||
): Promise<Partial<AuthSetupConfig>> {
|
|
||||||
const dbDataPath = await Input.prompt({
|
|
||||||
message: "Enter the Database Path on the Host:",
|
|
||||||
default: currentConfig.dbDataPath,
|
|
||||||
});
|
|
||||||
|
|
||||||
const spireDataPath = await Input.prompt({
|
|
||||||
message: "Enter the SPIRE Path on the Host:",
|
|
||||||
default: currentConfig.spireDataPath,
|
|
||||||
});
|
|
||||||
|
|
||||||
return { dbDataPath, spireDataPath };
|
|
||||||
}
|
|
||||||
|
|
||||||
export async function promptConfirmation(): Promise<void> {
|
|
||||||
// Empty implementation as there was no explicit confirmation in cli.ts before
|
|
||||||
// But we add it to cleanly delineate the flow as requested.
|
|
||||||
}
|
|
||||||
|
|
||||||
export async function generateAuthSetupFiles(
|
|
||||||
config: AuthSetupConfig,
|
|
||||||
): Promise<void> {
|
|
||||||
const envContent = generateEnv(config);
|
|
||||||
await Deno.writeTextFile(ENV_PATH, envContent);
|
|
||||||
|
|
||||||
const spireEnvContent = generateSpireEnv(config);
|
|
||||||
await Deno.writeTextFile(SPIRE_ENV_PATH, spireEnvContent);
|
|
||||||
|
|
||||||
const composeContent = generateDockerCompose();
|
|
||||||
await Deno.writeTextFile(COMPOSE_PATH, composeContent);
|
|
||||||
|
|
||||||
const spireComposeContent = generateSpireDockerCompose();
|
|
||||||
await Deno.writeTextFile(SPIRE_COMPOSE_PATH, spireComposeContent);
|
|
||||||
|
|
||||||
console.log(
|
|
||||||
colors.green(
|
|
||||||
`\n✓ Successfully generated ${ENV_PATH}, ${SPIRE_ENV_PATH}, ${COMPOSE_PATH}, and ${SPIRE_COMPOSE_PATH}!`,
|
|
||||||
),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.green("Setup complete. You may deploy your stacks by running:\n"),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.cyan(
|
|
||||||
"1. Deploy SPIRE Stack:\n" +
|
|
||||||
" podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml up -d\n\n" +
|
|
||||||
"2. Deploy Auth-Yes Stack:\n" +
|
|
||||||
" podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
export async function handleAuthSetup(
|
|
||||||
currentConfig: AuthSetupConfig,
|
|
||||||
): Promise<AuthSetupConfig> {
|
|
||||||
const authConfig = await promptAuthConfig(currentConfig);
|
|
||||||
const spireConfig = await promptSpireConfig(currentConfig);
|
|
||||||
|
|
||||||
const newConfig: AuthSetupConfig = {
|
|
||||||
...currentConfig,
|
|
||||||
...authConfig,
|
|
||||||
...spireConfig,
|
|
||||||
};
|
|
||||||
|
|
||||||
await promptConfirmation();
|
|
||||||
await generateAuthSetupFiles(newConfig);
|
|
||||||
|
|
||||||
return newConfig;
|
|
||||||
}
|
|
||||||
@ -1,145 +0,0 @@
|
|||||||
import { Select } from "jsr:@cliffy/prompt@1.0.0-rc.7";
|
|
||||||
import * as colors from "jsr:@std/fmt@0.225.2/colors";
|
|
||||||
import {
|
|
||||||
AuthSetupConfig,
|
|
||||||
COMPOSE_PATH,
|
|
||||||
DEFAULT_AUTH_CONFIG,
|
|
||||||
ENV_PATH,
|
|
||||||
readEnv,
|
|
||||||
SPIRE_COMPOSE_PATH,
|
|
||||||
} from "../env.ts";
|
|
||||||
import { handleAuthSetup } from "./auth.ts";
|
|
||||||
import { handleTestConnection } from "../commands/test.ts";
|
|
||||||
import {
|
|
||||||
downloadWorkloadProto,
|
|
||||||
executeBuildImage,
|
|
||||||
executeProtobufCompilation,
|
|
||||||
generateBuildCommands,
|
|
||||||
} from "../build.ts";
|
|
||||||
|
|
||||||
export async function handleReviewConfigs(): Promise<void> {
|
|
||||||
const envContent = await Deno.readTextFile(ENV_PATH).catch(() => null);
|
|
||||||
const composeContent = await Deno.readTextFile(COMPOSE_PATH).catch(() =>
|
|
||||||
null
|
|
||||||
);
|
|
||||||
const spireComposeContent = await Deno.readTextFile(SPIRE_COMPOSE_PATH).catch(
|
|
||||||
() => null,
|
|
||||||
);
|
|
||||||
|
|
||||||
if (!envContent && !composeContent && !spireComposeContent) {
|
|
||||||
console.log(
|
|
||||||
colors.red("\n✗ No generated configs found. Run the setup first.\n"),
|
|
||||||
);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
while (true) {
|
|
||||||
const action = await Select.prompt({
|
|
||||||
message: "Review Generated Configs",
|
|
||||||
options: [
|
|
||||||
{ name: "[Show .env]", value: "env" },
|
|
||||||
{ name: "[Show compose.yml]", value: "compose" },
|
|
||||||
{ name: "[Show compose.spire.yml]", value: "spire_compose" },
|
|
||||||
{ name: "[Back to Main Menu]", value: "back" },
|
|
||||||
],
|
|
||||||
});
|
|
||||||
|
|
||||||
if (action === "env") {
|
|
||||||
console.log(colors.bold(colors.blue(`\n=== ${ENV_PATH} ===\n`)));
|
|
||||||
console.log(envContent || colors.yellow("File not found."));
|
|
||||||
console.log();
|
|
||||||
} else if (action === "compose") {
|
|
||||||
console.log(colors.bold(colors.blue(`\n=== ${COMPOSE_PATH} ===\n`)));
|
|
||||||
console.log(composeContent || colors.yellow("File not found."));
|
|
||||||
console.log();
|
|
||||||
} else if (action === "spire_compose") {
|
|
||||||
console.log(
|
|
||||||
colors.bold(colors.blue(`\n=== ${SPIRE_COMPOSE_PATH} ===\n`)),
|
|
||||||
);
|
|
||||||
console.log(spireComposeContent || colors.yellow("File not found."));
|
|
||||||
console.log();
|
|
||||||
} else if (action === "back") {
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// SIDE EFFECT: Runs the interactive CLI wizard.
|
|
||||||
export async function runSetupWizard(): Promise<void> {
|
|
||||||
console.log(colors.bold(colors.blue("=== Auth Setup Wizard ===\n")));
|
|
||||||
|
|
||||||
const loadedEnv = await readEnv();
|
|
||||||
let currentConfig: AuthSetupConfig = {
|
|
||||||
...DEFAULT_AUTH_CONFIG,
|
|
||||||
...loadedEnv,
|
|
||||||
};
|
|
||||||
|
|
||||||
if (Object.keys(loadedEnv).length > 0 && currentConfig.domainName) {
|
|
||||||
await handleTestConnection(currentConfig.domainName);
|
|
||||||
console.log();
|
|
||||||
}
|
|
||||||
|
|
||||||
while (true) {
|
|
||||||
const action = await Select.prompt({
|
|
||||||
message: "Main Menu",
|
|
||||||
options: [
|
|
||||||
{ name: "[Test Auth Connection]", value: "test" },
|
|
||||||
{ name: "[Configure Auth Yes API]", value: "auth" },
|
|
||||||
{ name: "[Compile Protobuf Definitions]", value: "compile_proto" },
|
|
||||||
{ name: "[Review Generated Configs]", value: "review" },
|
|
||||||
{ name: "[Build and Push Auth Image]", value: "build" },
|
|
||||||
{ name: "[Exit]", value: "exit" },
|
|
||||||
],
|
|
||||||
});
|
|
||||||
|
|
||||||
if (action === "test") {
|
|
||||||
await handleTestConnection(currentConfig.domainName);
|
|
||||||
console.log();
|
|
||||||
} else if (action === "auth") {
|
|
||||||
currentConfig = await handleAuthSetup(currentConfig);
|
|
||||||
} else if (action === "compile_proto") {
|
|
||||||
try {
|
|
||||||
await downloadWorkloadProto();
|
|
||||||
await executeProtobufCompilation();
|
|
||||||
console.log(colors.green("\n✓ Successfully compiled protobufs!\n"));
|
|
||||||
} catch (error) {
|
|
||||||
if (error instanceof Error) {
|
|
||||||
console.log(
|
|
||||||
colors.red(`\n✗ Protobuf compilation failed: ${error.message}\n`),
|
|
||||||
);
|
|
||||||
} else {
|
|
||||||
console.log(
|
|
||||||
colors.red(`\n✗ Protobuf compilation failed: ${error}\n`),
|
|
||||||
);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
} else if (action === "review") {
|
|
||||||
await handleReviewConfigs();
|
|
||||||
} else if (action === "build") {
|
|
||||||
try {
|
|
||||||
const commands = generateBuildCommands(currentConfig.reg);
|
|
||||||
await executeBuildImage(commands);
|
|
||||||
console.log(colors.green("\n✓ Successfully built and pushed image!"));
|
|
||||||
console.log(
|
|
||||||
colors.green("You may now deploy your stack by running:\n"),
|
|
||||||
);
|
|
||||||
console.log(
|
|
||||||
colors.cyan(
|
|
||||||
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
|
|
||||||
),
|
|
||||||
);
|
|
||||||
} catch (error) {
|
|
||||||
if (error instanceof Error) {
|
|
||||||
console.log(
|
|
||||||
colors.red(`\n✗ Build process failed: ${error.message}\n`),
|
|
||||||
);
|
|
||||||
} else {
|
|
||||||
console.log(colors.red(`\n✗ Build process failed: ${error}\n`));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
} else if (action === "exit") {
|
|
||||||
console.log(colors.gray("Exiting...\n"));
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,22 +1,865 @@
|
|||||||
import { Hono } from "jsr:@hono/hono@4";
|
import { Hono } from "jsr:@hono/hono@4";
|
||||||
import { requireAdmin } from "../auth-session.ts";
|
import { encodeBase64Url } from "jsr:@std/encoding@1/base64url";
|
||||||
import { adminRateLimiter } from "../middleware.ts";
|
import { sqlWrapper } from "../db.ts";
|
||||||
|
import { valkey } from "../valkey.ts";
|
||||||
import { usersAdminRoutes } from "./admin/users.ts";
|
import { auditWrapper } from "../audit.ts";
|
||||||
import { appsAdminRoutes } from "./admin/apps.ts";
|
import {
|
||||||
import { rolesAdminRoutes } from "./admin/roles.ts";
|
getAuthenticatedUser,
|
||||||
import { invitesAdminRoutes } from "./admin/invites.ts";
|
isGlobalAdmin,
|
||||||
import { hardwareKeysAdminRoutes } from "./admin/hardware_keys.ts";
|
requireAdmin,
|
||||||
import { auditAdminRoutes } from "./admin/audit.ts";
|
} from "../auth-session.ts";
|
||||||
|
import { adminRateLimiter, getClientIp } from "../middleware.ts";
|
||||||
|
import { computeJwkThumbprint } from "../http_signatures.ts";
|
||||||
|
|
||||||
export const adminRoutes = new Hono();
|
export const adminRoutes = new Hono();
|
||||||
|
|
||||||
adminRoutes.use("*", requireAdmin);
|
adminRoutes.use("*", requireAdmin);
|
||||||
adminRoutes.use("*", adminRateLimiter);
|
adminRoutes.use("*", adminRateLimiter);
|
||||||
|
|
||||||
adminRoutes.route("/users", usersAdminRoutes);
|
// ---------------------------------------------------------
|
||||||
adminRoutes.route("/apps", appsAdminRoutes);
|
// Global Admin APIs (For the Management Console)
|
||||||
adminRoutes.route("/roles", rolesAdminRoutes);
|
// ---------------------------------------------------------
|
||||||
adminRoutes.route("/invites", invitesAdminRoutes);
|
|
||||||
adminRoutes.route("/", hardwareKeysAdminRoutes);
|
adminRoutes.get("/audit-logs", async (c) => {
|
||||||
adminRoutes.route("/", auditAdminRoutes);
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const logs = await sqlWrapper.sql`
|
||||||
|
SELECT a.id, a.action, a.resource, a.details, a.ip_address, a.created_at, u.username as user
|
||||||
|
FROM audit_records a
|
||||||
|
LEFT JOIN users u ON a.user_id = u.id
|
||||||
|
ORDER BY a.created_at DESC
|
||||||
|
LIMIT 100
|
||||||
|
`;
|
||||||
|
|
||||||
|
return c.json({ logs });
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.get("/users", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const users = await sqlWrapper.sql`
|
||||||
|
SELECT id, username, display_name, account_status
|
||||||
|
FROM users
|
||||||
|
ORDER BY username ASC
|
||||||
|
`;
|
||||||
|
|
||||||
|
return c.json({ users });
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.post("/users/:id/status", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const targetUserId = c.req.param("id");
|
||||||
|
const { status } = await c.req.json();
|
||||||
|
|
||||||
|
if (!["active", "pending", "suspended"].includes(status)) {
|
||||||
|
return c.json({ error: "Invalid status" }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
const targetUser = await sqlWrapper
|
||||||
|
.sql`UPDATE users SET account_status = ${status} WHERE id = ${targetUserId} RETURNING id`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
|
||||||
|
if (!targetUser) {
|
||||||
|
return c.json({ error: "User not found" }, 404);
|
||||||
|
}
|
||||||
|
|
||||||
|
auditWrapper.auditLog(auth.userId, "user_status_changed", targetUserId, {
|
||||||
|
newStatus: status,
|
||||||
|
}, getClientIp(c));
|
||||||
|
|
||||||
|
return c.json({ success: true });
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.post("/users/:id/profile", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const targetUserId = c.req.param("id");
|
||||||
|
const { displayName } = await c.req.json();
|
||||||
|
|
||||||
|
const targetUser = await sqlWrapper
|
||||||
|
.sql`UPDATE users SET display_name = ${
|
||||||
|
displayName?.trim() || null
|
||||||
|
} WHERE id = ${targetUserId} RETURNING id, username, display_name`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
|
||||||
|
if (!targetUser) return c.json({ error: "User not found" }, 404);
|
||||||
|
|
||||||
|
auditWrapper.auditLog(auth.userId, "user_profile_updated", targetUserId, {
|
||||||
|
display_name: targetUser.display_name,
|
||||||
|
}, getClientIp(c));
|
||||||
|
|
||||||
|
return c.json({ success: true, user: targetUser });
|
||||||
|
});
|
||||||
|
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
// Admin Application Registry
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
|
||||||
|
adminRoutes.get("/apps", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const apps = await sqlWrapper.sql`
|
||||||
|
SELECT a.id, a.name, a.spiffe_id, a.description, a.created_at,
|
||||||
|
COUNT(g.id) AS active_grants_count
|
||||||
|
FROM apps a
|
||||||
|
LEFT JOIN grants g ON a.id = g.app_id
|
||||||
|
GROUP BY a.id, a.name, a.spiffe_id, a.description, a.created_at
|
||||||
|
ORDER BY a.created_at ASC
|
||||||
|
`;
|
||||||
|
return c.json({ apps });
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.post("/apps", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const {
|
||||||
|
name,
|
||||||
|
spiffeId,
|
||||||
|
description,
|
||||||
|
domain,
|
||||||
|
is_public,
|
||||||
|
bypass_paths,
|
||||||
|
allowed_cidrs,
|
||||||
|
} = await c.req.json();
|
||||||
|
if (!name || !spiffeId) {
|
||||||
|
return c.json({ error: "Name and SPIFFE ID are required" }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
try {
|
||||||
|
const newApp = await sqlWrapper.sql`
|
||||||
|
INSERT INTO apps (name, spiffe_id, description, domain, is_public, bypass_paths, allowed_cidrs)
|
||||||
|
VALUES (${name.trim()}, ${spiffeId.trim()}, ${
|
||||||
|
description?.trim() || null
|
||||||
|
}, ${domain?.trim() || null}, ${is_public || false}, ${
|
||||||
|
bypass_paths || []
|
||||||
|
}, ${allowed_cidrs || []})
|
||||||
|
RETURNING id, name, spiffe_id, description, created_at
|
||||||
|
`.then((res: any) => res[0]);
|
||||||
|
|
||||||
|
auditWrapper.auditLog(auth.userId, "app_registered", newApp.id, {
|
||||||
|
name: newApp.name,
|
||||||
|
spiffe_id: newApp.spiffe_id,
|
||||||
|
}, getClientIp(c));
|
||||||
|
return c.json({ success: true, app: newApp });
|
||||||
|
} catch (err: any) {
|
||||||
|
if (err.code === "23505") {
|
||||||
|
return c.json({
|
||||||
|
error: "An application with this SPIFFE ID already exists",
|
||||||
|
}, 409);
|
||||||
|
}
|
||||||
|
return c.json({ error: "Failed to register application" }, 500);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.put("/apps/:id", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const appId = c.req.param("id");
|
||||||
|
const {
|
||||||
|
name,
|
||||||
|
description,
|
||||||
|
domain,
|
||||||
|
is_public,
|
||||||
|
bypass_paths,
|
||||||
|
allowed_cidrs,
|
||||||
|
} = await c.req.json();
|
||||||
|
|
||||||
|
if (!name) {
|
||||||
|
return c.json({ error: "Application name is required" }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
try {
|
||||||
|
const updatedApp = await sqlWrapper.sql`
|
||||||
|
UPDATE apps
|
||||||
|
SET name = ${name.trim()},
|
||||||
|
description = ${description?.trim() || null},
|
||||||
|
domain = ${domain?.trim() || null},
|
||||||
|
is_public = ${is_public || false},
|
||||||
|
bypass_paths = ${bypass_paths || []},
|
||||||
|
allowed_cidrs = ${allowed_cidrs || []}
|
||||||
|
WHERE id = ${appId}
|
||||||
|
RETURNING id, name, spiffe_id, description, domain, is_public, bypass_paths, allowed_cidrs
|
||||||
|
`.then((res: any) => res[0]);
|
||||||
|
|
||||||
|
if (!updatedApp) return c.json({ error: "Application not found" }, 404);
|
||||||
|
|
||||||
|
auditWrapper.auditLog(auth.userId, "app_updated", updatedApp.id, {
|
||||||
|
name: updatedApp.name,
|
||||||
|
}, getClientIp(c));
|
||||||
|
|
||||||
|
return c.json({ success: true, app: updatedApp });
|
||||||
|
} catch (_err: any) {
|
||||||
|
return c.json({ error: "Failed to update application" }, 500);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.delete("/apps/:id", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const appId = c.req.param("id");
|
||||||
|
const app = await sqlWrapper
|
||||||
|
.sql`DELETE FROM apps WHERE id = ${appId} RETURNING id, name`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (app) {
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"app_deleted",
|
||||||
|
appId,
|
||||||
|
{ name: app.name },
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
return c.json({ success: true });
|
||||||
|
}
|
||||||
|
return c.json({ error: "Application not found" }, 404);
|
||||||
|
});
|
||||||
|
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
// Admin Role Catalog Management
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
|
||||||
|
adminRoutes.get("/roles", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const appId = c.req.query("appId");
|
||||||
|
let roles;
|
||||||
|
if (appId) {
|
||||||
|
roles = await sqlWrapper.sql`
|
||||||
|
SELECT r.id, r.name, r.description, r.app_id, r.created_at,
|
||||||
|
a.name AS app_name
|
||||||
|
FROM roles r
|
||||||
|
LEFT JOIN apps a ON r.app_id = a.id
|
||||||
|
WHERE r.app_id IS NULL OR r.app_id = ${appId}
|
||||||
|
ORDER BY r.app_id NULLS FIRST, r.name ASC
|
||||||
|
`;
|
||||||
|
} else {
|
||||||
|
roles = await sqlWrapper.sql`
|
||||||
|
SELECT r.id, r.name, r.description, r.app_id, r.created_at,
|
||||||
|
a.name AS app_name
|
||||||
|
FROM roles r
|
||||||
|
LEFT JOIN apps a ON r.app_id = a.id
|
||||||
|
ORDER BY r.app_id NULLS FIRST, r.name ASC
|
||||||
|
`;
|
||||||
|
}
|
||||||
|
|
||||||
|
return c.json({ roles });
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.post("/roles", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const { name, description, appId } = await c.req.json();
|
||||||
|
if (
|
||||||
|
!name || typeof name !== "string" || name.trim().length < 2 ||
|
||||||
|
name.trim().length > 32
|
||||||
|
) {
|
||||||
|
return c.json(
|
||||||
|
{ error: "Role name must be between 2 and 32 characters" },
|
||||||
|
400,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
const normalizedName = name.trim().toLowerCase().replace(/[^a-z0-9_-]/g, "_");
|
||||||
|
|
||||||
|
let validatedAppId = null;
|
||||||
|
if (appId && typeof appId === "string" && appId.trim()) {
|
||||||
|
const uuidRegex =
|
||||||
|
/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
|
||||||
|
if (!uuidRegex.test(appId)) {
|
||||||
|
return c.json({ error: "Invalid App UUID" }, 400);
|
||||||
|
}
|
||||||
|
const appExists = await sqlWrapper
|
||||||
|
.sql`SELECT id, name FROM apps WHERE id = ${appId}`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (!appExists) {
|
||||||
|
return c.json({ error: "Selected application does not exist" }, 404);
|
||||||
|
}
|
||||||
|
validatedAppId = appId;
|
||||||
|
}
|
||||||
|
|
||||||
|
try {
|
||||||
|
const newRole = await sqlWrapper.sql`
|
||||||
|
INSERT INTO roles (name, description, app_id)
|
||||||
|
VALUES (${normalizedName}, ${
|
||||||
|
description?.trim() || null
|
||||||
|
}, ${validatedAppId})
|
||||||
|
RETURNING id, name, description, app_id, created_at
|
||||||
|
`.then((res: any) => res[0]);
|
||||||
|
|
||||||
|
auditWrapper.auditLog(auth.userId, "role_created", validatedAppId, {
|
||||||
|
role_name: newRole.name,
|
||||||
|
scope: validatedAppId ? "app-specific" : "global",
|
||||||
|
}, getClientIp(c));
|
||||||
|
|
||||||
|
return c.json({ success: true, role: newRole });
|
||||||
|
} catch (err: any) {
|
||||||
|
if (err.code === "23505") {
|
||||||
|
return c.json({
|
||||||
|
error: "This role already exists for the selected scope",
|
||||||
|
}, 409);
|
||||||
|
}
|
||||||
|
return c.json({ error: "Failed to create role" }, 500);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.put("/roles/:id", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const roleId = c.req.param("id");
|
||||||
|
const { name, description } = await c.req.json();
|
||||||
|
|
||||||
|
if (!name || typeof name !== "string" || name.trim().length < 2) {
|
||||||
|
return c.json({ error: "Role name must be at least 2 characters" }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
const normalizedName = name.trim().toLowerCase().replace(/[^a-z0-9_-]/g, "_");
|
||||||
|
|
||||||
|
try {
|
||||||
|
const updatedRole = await sqlWrapper.sql`
|
||||||
|
UPDATE roles
|
||||||
|
SET name = ${normalizedName},
|
||||||
|
description = ${description?.trim() || null}
|
||||||
|
WHERE id = ${roleId}
|
||||||
|
RETURNING id, name, description, app_id, created_at
|
||||||
|
`.then((res: any) => res[0]);
|
||||||
|
|
||||||
|
if (!updatedRole) return c.json({ error: "Role not found" }, 404);
|
||||||
|
|
||||||
|
auditWrapper.auditLog(auth.userId, "role_updated", updatedRole.app_id, {
|
||||||
|
role_name: updatedRole.name,
|
||||||
|
}, getClientIp(c));
|
||||||
|
|
||||||
|
return c.json({ success: true, role: updatedRole });
|
||||||
|
} catch (_err: any) {
|
||||||
|
return c.json({ error: "Failed to update role" }, 500);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.delete("/roles/:id", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const roleId = c.req.param("id");
|
||||||
|
const role = await sqlWrapper
|
||||||
|
.sql`SELECT id, name, app_id FROM roles WHERE id = ${roleId}`.then(
|
||||||
|
(res: any) => res[0],
|
||||||
|
);
|
||||||
|
if (!role) {
|
||||||
|
return c.json({ error: "Role not found" }, 404);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (role.name === "admin" && role.app_id === null) {
|
||||||
|
return c.json({ error: "The global 'admin' role cannot be deleted" }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
await sqlWrapper.sql`DELETE FROM roles WHERE id = ${roleId}`;
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"role_deleted",
|
||||||
|
role.app_id,
|
||||||
|
{ role_name: role.name },
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
return c.json({ success: true });
|
||||||
|
});
|
||||||
|
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
// Admin Invites / Registration Tokens
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
|
||||||
|
adminRoutes.get("/invites", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const invites = await sqlWrapper.sql`
|
||||||
|
SELECT i.id, i.code, i.role, i.max_uses, i.uses_count, i.auto_activate, i.expires_at, i.created_at, i.used_at,
|
||||||
|
a.name AS app_name, a.id AS app_id,
|
||||||
|
u.username AS used_by_username
|
||||||
|
FROM invites i
|
||||||
|
LEFT JOIN apps a ON i.app_id = a.id
|
||||||
|
LEFT JOIN users u ON i.used_by = u.id
|
||||||
|
ORDER BY i.created_at DESC
|
||||||
|
`;
|
||||||
|
return c.json({ invites });
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.post("/invites/create", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const {
|
||||||
|
appId,
|
||||||
|
role,
|
||||||
|
expiresInDays,
|
||||||
|
customCode,
|
||||||
|
usageLimitType,
|
||||||
|
maxUses,
|
||||||
|
autoActivate,
|
||||||
|
} = await c.req.json();
|
||||||
|
const assignedRole = (typeof role === "string" && role.trim())
|
||||||
|
? role.trim()
|
||||||
|
: "user";
|
||||||
|
|
||||||
|
let validatedAppId = null;
|
||||||
|
if (appId) {
|
||||||
|
const uuidRegex =
|
||||||
|
/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
|
||||||
|
if (typeof appId !== "string" || !uuidRegex.test(appId)) {
|
||||||
|
return c.json({ error: "appId must be a valid UUID string" }, 400);
|
||||||
|
}
|
||||||
|
const appExists = await sqlWrapper
|
||||||
|
.sql`SELECT id FROM apps WHERE id = ${appId}`.then(
|
||||||
|
(res: any) => res[0],
|
||||||
|
);
|
||||||
|
if (!appExists) {
|
||||||
|
return c.json({ error: "Target application does not exist" }, 404);
|
||||||
|
}
|
||||||
|
validatedAppId = appId;
|
||||||
|
}
|
||||||
|
|
||||||
|
let parsedMaxUses: number | null = 1;
|
||||||
|
if (usageLimitType === "unlimited") {
|
||||||
|
parsedMaxUses = null;
|
||||||
|
} else if (usageLimitType === "limited") {
|
||||||
|
const n = parseInt(maxUses);
|
||||||
|
parsedMaxUses = (!isNaN(n) && n > 0) ? n : 5;
|
||||||
|
} else {
|
||||||
|
parsedMaxUses = 1; // single-use default
|
||||||
|
}
|
||||||
|
|
||||||
|
const shouldAutoActivate = autoActivate !== false;
|
||||||
|
|
||||||
|
const inviteCode =
|
||||||
|
(customCode && typeof customCode === "string" && customCode.trim())
|
||||||
|
? customCode.trim()
|
||||||
|
: encodeBase64Url(crypto.getRandomValues(new Uint8Array(24)));
|
||||||
|
|
||||||
|
const days = Number(expiresInDays) || 7;
|
||||||
|
if (!Number.isInteger(days) || days < 1 || days > 30) {
|
||||||
|
return c.json({
|
||||||
|
error: "expiresInDays must be an integer between 1 and 30",
|
||||||
|
}, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
const expiresAt = new Date();
|
||||||
|
expiresAt.setDate(expiresAt.getDate() + days);
|
||||||
|
|
||||||
|
try {
|
||||||
|
await sqlWrapper.sql`
|
||||||
|
INSERT INTO invites (code, app_id, role, created_by, max_uses, uses_count, auto_activate, expires_at)
|
||||||
|
VALUES (${inviteCode}, ${validatedAppId}, ${assignedRole}, ${auth.userId}, ${parsedMaxUses}, 0, ${shouldAutoActivate}, ${expiresAt})
|
||||||
|
`;
|
||||||
|
} catch (err: any) {
|
||||||
|
if (err.code === "23505") {
|
||||||
|
return c.json({ error: "An invite with this code already exists" }, 409);
|
||||||
|
}
|
||||||
|
return c.json({ error: "Failed to generate invite" }, 500);
|
||||||
|
}
|
||||||
|
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"invite_created",
|
||||||
|
validatedAppId,
|
||||||
|
{
|
||||||
|
code: inviteCode,
|
||||||
|
role: assignedRole,
|
||||||
|
max_uses: parsedMaxUses,
|
||||||
|
auto_activate: shouldAutoActivate,
|
||||||
|
expiresInDays: days,
|
||||||
|
},
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
|
||||||
|
return c.json({
|
||||||
|
success: true,
|
||||||
|
inviteCode,
|
||||||
|
expiresAt,
|
||||||
|
maxUses: parsedMaxUses,
|
||||||
|
autoActivate: shouldAutoActivate,
|
||||||
|
});
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.get("/invites/:id/redemptions", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const inviteId = c.req.param("id");
|
||||||
|
const redemptions = await sqlWrapper.sql`
|
||||||
|
SELECT ir.id, ir.redeemed_at, u.id AS user_id, u.username, u.display_name, u.account_status
|
||||||
|
FROM invite_redemptions ir
|
||||||
|
JOIN users u ON ir.user_id = u.id
|
||||||
|
WHERE ir.invite_id = ${inviteId}
|
||||||
|
ORDER BY ir.redeemed_at DESC
|
||||||
|
`;
|
||||||
|
|
||||||
|
return c.json({ redemptions });
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.delete("/invites/:id", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const inviteId = c.req.param("id");
|
||||||
|
const invite = await sqlWrapper
|
||||||
|
.sql`DELETE FROM invites WHERE id = ${inviteId} RETURNING id, code`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (invite) {
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"invite_revoked",
|
||||||
|
inviteId,
|
||||||
|
{ code: invite.code },
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
return c.json({ success: true });
|
||||||
|
}
|
||||||
|
return c.json({ error: "Invite not found" }, 404);
|
||||||
|
});
|
||||||
|
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
// Admin User RBAC Grants Management
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
|
||||||
|
adminRoutes.get("/users/:id/grants", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const targetUserId = c.req.param("id");
|
||||||
|
const grants = await sqlWrapper.sql`
|
||||||
|
SELECT g.id, g.app_id, g.role, g.created_at, a.name AS app_name, a.spiffe_id
|
||||||
|
FROM grants g
|
||||||
|
JOIN apps a ON g.app_id = a.id
|
||||||
|
WHERE g.user_id = ${targetUserId}
|
||||||
|
ORDER BY a.name ASC
|
||||||
|
`;
|
||||||
|
return c.json({ grants });
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.post("/users/:id/grants", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const targetUserId = c.req.param("id");
|
||||||
|
const { appId, role } = await c.req.json();
|
||||||
|
|
||||||
|
if (!appId || !role) {
|
||||||
|
return c.json({ error: "appId and role are required" }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
const app = await sqlWrapper
|
||||||
|
.sql`SELECT id, name FROM apps WHERE id = ${appId}`.then(
|
||||||
|
(res: any) => res[0],
|
||||||
|
);
|
||||||
|
if (!app) return c.json({ error: "Application not found" }, 404);
|
||||||
|
|
||||||
|
const targetUser = await sqlWrapper
|
||||||
|
.sql`SELECT id, username FROM users WHERE id = ${targetUserId}`.then(
|
||||||
|
(res: any) => res[0],
|
||||||
|
);
|
||||||
|
if (!targetUser) return c.json({ error: "User not found" }, 404);
|
||||||
|
|
||||||
|
await sqlWrapper.sql`
|
||||||
|
INSERT INTO grants (user_id, app_id, role)
|
||||||
|
VALUES (${targetUserId}, ${appId}, ${role})
|
||||||
|
ON CONFLICT (user_id, app_id) DO UPDATE SET role = ${role}
|
||||||
|
`;
|
||||||
|
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"user_grant_assigned",
|
||||||
|
targetUserId,
|
||||||
|
{ app_id: appId, app_name: app.name, role },
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
|
||||||
|
return c.json({ success: true });
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.delete("/users/:id/grants/:appId", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const { id: targetUserId, appId } = c.req.param();
|
||||||
|
|
||||||
|
const grant = await sqlWrapper.sql`
|
||||||
|
DELETE FROM grants
|
||||||
|
WHERE user_id = ${targetUserId} AND app_id = ${appId}
|
||||||
|
RETURNING id
|
||||||
|
`.then((res: any) => res[0]);
|
||||||
|
|
||||||
|
if (grant) {
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"user_grant_revoked",
|
||||||
|
targetUserId,
|
||||||
|
{ app_id: appId },
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
return c.json({ success: true });
|
||||||
|
}
|
||||||
|
|
||||||
|
return c.json({ error: "Grant not found" }, 404);
|
||||||
|
});
|
||||||
|
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
// Admin AAGUID Management
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
|
||||||
|
adminRoutes.get("/aaguid", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
const allowlist = await sqlWrapper
|
||||||
|
.sql`SELECT id, aaguid, description, created_at FROM aaguid_allowlist ORDER BY created_at DESC`;
|
||||||
|
return c.json({ allowlist });
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.post("/aaguid", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
const { aaguid, description } = await c.req.json();
|
||||||
|
const uuidRegex =
|
||||||
|
/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/i;
|
||||||
|
if (!aaguid || !uuidRegex.test(aaguid)) {
|
||||||
|
return c.json({ error: "Valid AAGUID (UUID) is required" }, 400);
|
||||||
|
}
|
||||||
|
try {
|
||||||
|
await sqlWrapper
|
||||||
|
.sql`INSERT INTO aaguid_allowlist (aaguid, description) VALUES (${aaguid.toLowerCase()}, ${
|
||||||
|
description || null
|
||||||
|
})`;
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"aaguid_added",
|
||||||
|
null,
|
||||||
|
{ aaguid },
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
return c.json({ success: true });
|
||||||
|
} catch (err: any) {
|
||||||
|
if (err.code === "23505") {
|
||||||
|
return c.json({ error: "AAGUID already exists" }, 409);
|
||||||
|
}
|
||||||
|
return c.json({ error: "Internal server error" }, 500);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.delete("/aaguid/:id", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
const id = c.req.param("id");
|
||||||
|
const record = await sqlWrapper
|
||||||
|
.sql`DELETE FROM aaguid_allowlist WHERE id = ${id} RETURNING aaguid`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (record) {
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"aaguid_removed",
|
||||||
|
null,
|
||||||
|
{ aaguid: record.aaguid },
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
return c.json({ success: true });
|
||||||
|
});
|
||||||
|
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
// Admin HWK (Header Web Key) Management
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
|
||||||
|
adminRoutes.post("/hwk", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const { jwk, name } = await c.req.json();
|
||||||
|
if (!jwk || !name || typeof name !== "string") {
|
||||||
|
return c.json({ error: "Missing required fields: jwk, name" }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || !jwk.x) {
|
||||||
|
return c.json({ error: "Invalid JWK: Must be an Ed25519 OKP key" }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
try {
|
||||||
|
const fingerprint = await computeJwkThumbprint(jwk);
|
||||||
|
|
||||||
|
// 1. Dual Storage: PostgreSQL (Durability)
|
||||||
|
await sqlWrapper.sql`
|
||||||
|
INSERT INTO hwk_keys (fingerprint, public_key, name)
|
||||||
|
VALUES (${fingerprint}, ${JSON.stringify(jwk)}, ${name})
|
||||||
|
`;
|
||||||
|
|
||||||
|
// 2. Dual Storage: Valkey (O(1) Verification)
|
||||||
|
await valkey.sadd("auth:hwk:fingerprints", fingerprint);
|
||||||
|
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"hwk_added",
|
||||||
|
null,
|
||||||
|
{ fingerprint, name },
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
|
||||||
|
return c.json({ success: true, fingerprint }, 201);
|
||||||
|
} catch (err: any) {
|
||||||
|
if (err.code === "23505") {
|
||||||
|
return c.json({ error: "This key has already been registered" }, 409);
|
||||||
|
}
|
||||||
|
console.error("Failed to add HWK:", err);
|
||||||
|
return c.json({ error: "Internal server error" }, 500);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.delete("/hwk/:fingerprint", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const fingerprint = c.req.param("fingerprint");
|
||||||
|
|
||||||
|
// 1. Remove from PostgreSQL
|
||||||
|
const record = await sqlWrapper.sql`
|
||||||
|
DELETE FROM hwk_keys WHERE fingerprint = ${fingerprint} RETURNING id, name
|
||||||
|
`.then((res: any) => res[0]);
|
||||||
|
|
||||||
|
if (record) {
|
||||||
|
// 2. Remove from Valkey
|
||||||
|
try {
|
||||||
|
await valkey.srem("auth:hwk:fingerprints", fingerprint);
|
||||||
|
} catch (_err) {}
|
||||||
|
|
||||||
|
auditWrapper.auditLog(auth.userId, "hwk_removed", null, {
|
||||||
|
fingerprint,
|
||||||
|
name: record.name,
|
||||||
|
}, getClientIp(c));
|
||||||
|
return c.json({ success: true });
|
||||||
|
}
|
||||||
|
|
||||||
|
return c.json({ error: "Key not found" }, 404);
|
||||||
|
});
|
||||||
|
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
// Global Session and Device Revocation (Admin)
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
|
||||||
|
adminRoutes.get("/users/:id", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
const targetUserId = c.req.param("id");
|
||||||
|
const user = await sqlWrapper
|
||||||
|
.sql`SELECT id, username, display_name, account_status FROM users WHERE id = ${targetUserId}`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (!user) return c.json({ error: "User not found" }, 404);
|
||||||
|
const sessions = await sqlWrapper
|
||||||
|
.sql`SELECT id, created_at, expires_at FROM sessions WHERE user_id = ${targetUserId} ORDER BY created_at DESC`;
|
||||||
|
const passkeys = await sqlWrapper
|
||||||
|
.sql`SELECT id, credential_id, counter FROM passkeys WHERE user_id = ${targetUserId}`;
|
||||||
|
return c.json({ user, sessions, passkeys });
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.delete("/sessions/:id", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
const sessionId = c.req.param("id");
|
||||||
|
const session = await sqlWrapper
|
||||||
|
.sql`DELETE FROM sessions WHERE id = ${sessionId} RETURNING user_id`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (session) {
|
||||||
|
try {
|
||||||
|
await valkey.del(sessionId);
|
||||||
|
} catch (_err) {}
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"admin_session_revoked",
|
||||||
|
session.user_id,
|
||||||
|
{
|
||||||
|
revoked_session_id: sessionId,
|
||||||
|
},
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
return c.json({ success: true });
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.delete("/users/:id/sessions", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
const targetUserId = c.req.param("id");
|
||||||
|
const sessions = await sqlWrapper
|
||||||
|
.sql`DELETE FROM sessions WHERE user_id = ${targetUserId} RETURNING id`;
|
||||||
|
for (const session of sessions) {
|
||||||
|
try {
|
||||||
|
await valkey.del(session.id);
|
||||||
|
} catch (_err) {}
|
||||||
|
}
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"admin_all_sessions_revoked",
|
||||||
|
targetUserId,
|
||||||
|
null,
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
return c.json({ success: true });
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.delete("/users/:userId/passkeys/:passkeyId", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
const { userId, passkeyId } = c.req.param();
|
||||||
|
const passkey = await sqlWrapper
|
||||||
|
.sql`DELETE FROM passkeys WHERE id = ${passkeyId} AND user_id = ${userId} RETURNING id`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (passkey) {
|
||||||
|
auditWrapper.auditLog(auth.userId, "admin_passkey_revoked", userId, {
|
||||||
|
passkey_id: passkey.id,
|
||||||
|
}, getClientIp(c));
|
||||||
|
return c.json({ success: true });
|
||||||
|
}
|
||||||
|
return c.json({ error: "Passkey not found" }, 404);
|
||||||
|
});
|
||||||
|
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
// Out-of-Band Account Recovery (Use Case 12)
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
|
||||||
|
adminRoutes.post("/users/:id/recovery", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
const targetUserId = c.req.param("id");
|
||||||
|
const targetUser = await sqlWrapper
|
||||||
|
.sql`SELECT id FROM users WHERE id = ${targetUserId}`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (!targetUser) return c.json({ error: "User not found" }, 404);
|
||||||
|
const recoveryCode = encodeBase64Url(
|
||||||
|
crypto.getRandomValues(new Uint8Array(24)),
|
||||||
|
);
|
||||||
|
const expiresAt = new Date();
|
||||||
|
expiresAt.setDate(expiresAt.getDate() + 1);
|
||||||
|
await sqlWrapper
|
||||||
|
.sql`INSERT INTO recovery_links (code, user_id, created_by, expires_at) VALUES (${recoveryCode}, ${targetUserId}, ${auth.userId}, ${expiresAt})`;
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"recovery_link_created",
|
||||||
|
targetUserId,
|
||||||
|
null,
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
return c.json({ success: true, recoveryCode, expiresAt });
|
||||||
|
});
|
||||||
|
|
||||||
|
adminRoutes.get("/check", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const isAdmin = await isGlobalAdmin(auth.userId);
|
||||||
|
return c.json({ isAdmin });
|
||||||
|
});
|
||||||
|
|||||||
@ -1,129 +0,0 @@
|
|||||||
import { Hono } from "jsr:@hono/hono@4";
|
|
||||||
import { sqlWrapper } from "../../db.ts";
|
|
||||||
import { auditWrapper } from "../../audit.ts";
|
|
||||||
import { getAuthenticatedUser } from "../../auth-session.ts";
|
|
||||||
import { getClientIp } from "../../middleware.ts";
|
|
||||||
|
|
||||||
export const appsAdminRoutes = new Hono();
|
|
||||||
|
|
||||||
appsAdminRoutes.get("/", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const apps = await sqlWrapper.sql`
|
|
||||||
SELECT a.id, a.name, a.spiffe_id, a.description, a.created_at,
|
|
||||||
COUNT(g.id) AS active_grants_count
|
|
||||||
FROM apps a
|
|
||||||
LEFT JOIN grants g ON a.id = g.app_id
|
|
||||||
GROUP BY a.id, a.name, a.spiffe_id, a.description, a.created_at
|
|
||||||
ORDER BY a.created_at ASC
|
|
||||||
`;
|
|
||||||
return c.json({ apps });
|
|
||||||
});
|
|
||||||
|
|
||||||
appsAdminRoutes.post("/", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const {
|
|
||||||
name,
|
|
||||||
spiffeId,
|
|
||||||
description,
|
|
||||||
domain,
|
|
||||||
is_public,
|
|
||||||
bypass_paths,
|
|
||||||
allowed_cidrs,
|
|
||||||
} = await c.req.json();
|
|
||||||
if (!name || !spiffeId) {
|
|
||||||
return c.json({ error: "Name and SPIFFE ID are required" }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
try {
|
|
||||||
const newApp = await sqlWrapper.sql`
|
|
||||||
INSERT INTO apps (name, spiffe_id, description, domain, is_public, bypass_paths, allowed_cidrs)
|
|
||||||
VALUES (${name.trim()}, ${spiffeId.trim()}, ${
|
|
||||||
description?.trim() || null
|
|
||||||
}, ${domain?.trim() || null}, ${is_public || false}, ${
|
|
||||||
bypass_paths || []
|
|
||||||
}, ${allowed_cidrs || []})
|
|
||||||
RETURNING id, name, spiffe_id, description, created_at
|
|
||||||
`.then((res: any) => res[0]);
|
|
||||||
|
|
||||||
auditWrapper.auditLog(auth.userId, "app_registered", newApp.id, {
|
|
||||||
name: newApp.name,
|
|
||||||
spiffe_id: newApp.spiffe_id,
|
|
||||||
}, getClientIp(c));
|
|
||||||
return c.json({ success: true, app: newApp });
|
|
||||||
} catch (err: any) {
|
|
||||||
if (err.code === "23505") {
|
|
||||||
return c.json({
|
|
||||||
error: "An application with this SPIFFE ID already exists",
|
|
||||||
}, 409);
|
|
||||||
}
|
|
||||||
return c.json({ error: "Failed to register application" }, 500);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
appsAdminRoutes.put("/:id", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const appId = c.req.param("id");
|
|
||||||
const {
|
|
||||||
name,
|
|
||||||
description,
|
|
||||||
domain,
|
|
||||||
is_public,
|
|
||||||
bypass_paths,
|
|
||||||
allowed_cidrs,
|
|
||||||
} = await c.req.json();
|
|
||||||
|
|
||||||
if (!name) {
|
|
||||||
return c.json({ error: "Application name is required" }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
try {
|
|
||||||
const updatedApp = await sqlWrapper.sql`
|
|
||||||
UPDATE apps
|
|
||||||
SET name = ${name.trim()},
|
|
||||||
description = ${description?.trim() || null},
|
|
||||||
domain = ${domain?.trim() || null},
|
|
||||||
is_public = ${is_public || false},
|
|
||||||
bypass_paths = ${bypass_paths || []},
|
|
||||||
allowed_cidrs = ${allowed_cidrs || []}
|
|
||||||
WHERE id = ${appId}
|
|
||||||
RETURNING id, name, spiffe_id, description, domain, is_public, bypass_paths, allowed_cidrs
|
|
||||||
`.then((res: any) => res[0]);
|
|
||||||
|
|
||||||
if (!updatedApp) return c.json({ error: "Application not found" }, 404);
|
|
||||||
|
|
||||||
auditWrapper.auditLog(auth.userId, "app_updated", updatedApp.id, {
|
|
||||||
name: updatedApp.name,
|
|
||||||
}, getClientIp(c));
|
|
||||||
|
|
||||||
return c.json({ success: true, app: updatedApp });
|
|
||||||
} catch (_err: any) {
|
|
||||||
return c.json({ error: "Failed to update application" }, 500);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
appsAdminRoutes.delete("/:id", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const appId = c.req.param("id");
|
|
||||||
const app = await sqlWrapper
|
|
||||||
.sql`DELETE FROM apps WHERE id = ${appId} RETURNING id, name`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (app) {
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"app_deleted",
|
|
||||||
appId,
|
|
||||||
{ name: app.name },
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
return c.json({ success: true });
|
|
||||||
}
|
|
||||||
return c.json({ error: "Application not found" }, 404);
|
|
||||||
});
|
|
||||||
@ -1,55 +0,0 @@
|
|||||||
import { Hono } from "jsr:@hono/hono@4";
|
|
||||||
import { sqlWrapper } from "../../db.ts";
|
|
||||||
import { valkey } from "../../valkey.ts";
|
|
||||||
import { auditWrapper } from "../../audit.ts";
|
|
||||||
import { getAuthenticatedUser, isGlobalAdmin } from "../../auth-session.ts";
|
|
||||||
import { getClientIp } from "../../middleware.ts";
|
|
||||||
|
|
||||||
export const auditAdminRoutes = new Hono();
|
|
||||||
|
|
||||||
auditAdminRoutes.get("/audit-logs", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const logs = await sqlWrapper.sql`
|
|
||||||
SELECT a.id, a.action, a.resource, a.details, a.ip_address, a.created_at, u.username as user
|
|
||||||
FROM audit_records a
|
|
||||||
LEFT JOIN users u ON a.user_id = u.id
|
|
||||||
ORDER BY a.created_at DESC
|
|
||||||
LIMIT 100
|
|
||||||
`;
|
|
||||||
|
|
||||||
return c.json({ logs });
|
|
||||||
});
|
|
||||||
|
|
||||||
auditAdminRoutes.get("/check", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const isAdmin = await isGlobalAdmin(auth.userId);
|
|
||||||
return c.json({ isAdmin });
|
|
||||||
});
|
|
||||||
|
|
||||||
auditAdminRoutes.delete("/sessions/:id", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
const sessionId = c.req.param("id");
|
|
||||||
const session = await sqlWrapper
|
|
||||||
.sql`DELETE FROM sessions WHERE id = ${sessionId} RETURNING user_id`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (session) {
|
|
||||||
try {
|
|
||||||
await valkey.del(sessionId);
|
|
||||||
} catch (_err) {}
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"admin_session_revoked",
|
|
||||||
session.user_id,
|
|
||||||
{
|
|
||||||
revoked_session_id: sessionId,
|
|
||||||
},
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
}
|
|
||||||
return c.json({ success: true });
|
|
||||||
});
|
|
||||||
@ -1,136 +0,0 @@
|
|||||||
import { Hono } from "jsr:@hono/hono@4";
|
|
||||||
import { sqlWrapper } from "../../db.ts";
|
|
||||||
import { valkey } from "../../valkey.ts";
|
|
||||||
import { auditWrapper } from "../../audit.ts";
|
|
||||||
import { getAuthenticatedUser } from "../../auth-session.ts";
|
|
||||||
import { getClientIp } from "../../middleware.ts";
|
|
||||||
import { computeJwkThumbprint } from "../../http_signatures.ts";
|
|
||||||
|
|
||||||
export const hardwareKeysAdminRoutes = new Hono();
|
|
||||||
|
|
||||||
hardwareKeysAdminRoutes.get("/aaguid", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
const allowlist = await sqlWrapper
|
|
||||||
.sql`SELECT id, aaguid, description, created_at FROM aaguid_allowlist ORDER BY created_at DESC`;
|
|
||||||
return c.json({ allowlist });
|
|
||||||
});
|
|
||||||
|
|
||||||
hardwareKeysAdminRoutes.post("/aaguid", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
const { aaguid, description } = await c.req.json();
|
|
||||||
const uuidRegex =
|
|
||||||
/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/i;
|
|
||||||
if (!aaguid || !uuidRegex.test(aaguid)) {
|
|
||||||
return c.json({ error: "Valid AAGUID (UUID) is required" }, 400);
|
|
||||||
}
|
|
||||||
try {
|
|
||||||
await sqlWrapper
|
|
||||||
.sql`INSERT INTO aaguid_allowlist (aaguid, description) VALUES (${aaguid.toLowerCase()}, ${
|
|
||||||
description || null
|
|
||||||
})`;
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"aaguid_added",
|
|
||||||
null,
|
|
||||||
{ aaguid },
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
return c.json({ success: true });
|
|
||||||
} catch (err: any) {
|
|
||||||
if (err.code === "23505") {
|
|
||||||
return c.json({ error: "AAGUID already exists" }, 409);
|
|
||||||
}
|
|
||||||
return c.json({ error: "Internal server error" }, 500);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
hardwareKeysAdminRoutes.delete("/aaguid/:id", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
const id = c.req.param("id");
|
|
||||||
const record = await sqlWrapper
|
|
||||||
.sql`DELETE FROM aaguid_allowlist WHERE id = ${id} RETURNING aaguid`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (record) {
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"aaguid_removed",
|
|
||||||
null,
|
|
||||||
{ aaguid: record.aaguid },
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
}
|
|
||||||
return c.json({ success: true });
|
|
||||||
});
|
|
||||||
|
|
||||||
hardwareKeysAdminRoutes.post("/hwk", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const { jwk, name } = await c.req.json();
|
|
||||||
if (!jwk || !name || typeof name !== "string") {
|
|
||||||
return c.json({ error: "Missing required fields: jwk, name" }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || !jwk.x) {
|
|
||||||
return c.json({ error: "Invalid JWK: Must be an Ed25519 OKP key" }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
try {
|
|
||||||
const fingerprint = await computeJwkThumbprint(jwk);
|
|
||||||
|
|
||||||
// 1. Dual Storage: PostgreSQL (Durability)
|
|
||||||
await sqlWrapper.sql`
|
|
||||||
INSERT INTO hwk_keys (fingerprint, public_key, name)
|
|
||||||
VALUES (${fingerprint}, ${JSON.stringify(jwk)}, ${name})
|
|
||||||
`;
|
|
||||||
|
|
||||||
// 2. Dual Storage: Valkey (O(1) Verification)
|
|
||||||
await valkey.sadd("auth:hwk:fingerprints", fingerprint);
|
|
||||||
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"hwk_added",
|
|
||||||
null,
|
|
||||||
{ fingerprint, name },
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
|
|
||||||
return c.json({ success: true, fingerprint }, 201);
|
|
||||||
} catch (err: any) {
|
|
||||||
if (err.code === "23505") {
|
|
||||||
return c.json({ error: "This key has already been registered" }, 409);
|
|
||||||
}
|
|
||||||
console.error("Failed to add HWK:", err);
|
|
||||||
return c.json({ error: "Internal server error" }, 500);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
hardwareKeysAdminRoutes.delete("/hwk/:fingerprint", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const fingerprint = c.req.param("fingerprint");
|
|
||||||
|
|
||||||
// 1. Remove from PostgreSQL
|
|
||||||
const record = await sqlWrapper.sql`
|
|
||||||
DELETE FROM hwk_keys WHERE fingerprint = ${fingerprint} RETURNING id, name
|
|
||||||
`.then((res: any) => res[0]);
|
|
||||||
|
|
||||||
if (record) {
|
|
||||||
// 2. Remove from Valkey
|
|
||||||
try {
|
|
||||||
await valkey.srem("auth:hwk:fingerprints", fingerprint);
|
|
||||||
} catch (_err) {}
|
|
||||||
|
|
||||||
auditWrapper.auditLog(auth.userId, "hwk_removed", null, {
|
|
||||||
fingerprint,
|
|
||||||
name: record.name,
|
|
||||||
}, getClientIp(c));
|
|
||||||
return c.json({ success: true });
|
|
||||||
}
|
|
||||||
|
|
||||||
return c.json({ error: "Key not found" }, 404);
|
|
||||||
});
|
|
||||||
@ -1,157 +0,0 @@
|
|||||||
import { Hono } from "jsr:@hono/hono@4";
|
|
||||||
import { encodeBase64Url } from "jsr:@std/encoding@1/base64url";
|
|
||||||
import { sqlWrapper } from "../../db.ts";
|
|
||||||
import { auditWrapper } from "../../audit.ts";
|
|
||||||
import { getAuthenticatedUser } from "../../auth-session.ts";
|
|
||||||
import { getClientIp } from "../../middleware.ts";
|
|
||||||
|
|
||||||
export const invitesAdminRoutes = new Hono();
|
|
||||||
|
|
||||||
invitesAdminRoutes.get("/", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const invites = await sqlWrapper.sql`
|
|
||||||
SELECT i.id, i.code, i.role, i.max_uses, i.uses_count, i.auto_activate, i.expires_at, i.created_at, i.used_at,
|
|
||||||
a.name AS app_name, a.id AS app_id,
|
|
||||||
u.username AS used_by_username
|
|
||||||
FROM invites i
|
|
||||||
LEFT JOIN apps a ON i.app_id = a.id
|
|
||||||
LEFT JOIN users u ON i.used_by = u.id
|
|
||||||
ORDER BY i.created_at DESC
|
|
||||||
`;
|
|
||||||
return c.json({ invites });
|
|
||||||
});
|
|
||||||
|
|
||||||
invitesAdminRoutes.post("/create", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const {
|
|
||||||
appId,
|
|
||||||
role,
|
|
||||||
expiresInDays,
|
|
||||||
customCode,
|
|
||||||
usageLimitType,
|
|
||||||
maxUses,
|
|
||||||
autoActivate,
|
|
||||||
} = await c.req.json();
|
|
||||||
const assignedRole = (typeof role === "string" && role.trim())
|
|
||||||
? role.trim()
|
|
||||||
: "user";
|
|
||||||
|
|
||||||
let validatedAppId = null;
|
|
||||||
if (appId) {
|
|
||||||
const uuidRegex =
|
|
||||||
/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
|
|
||||||
if (typeof appId !== "string" || !uuidRegex.test(appId)) {
|
|
||||||
return c.json({ error: "appId must be a valid UUID string" }, 400);
|
|
||||||
}
|
|
||||||
const appExists = await sqlWrapper
|
|
||||||
.sql`SELECT id FROM apps WHERE id = ${appId}`.then(
|
|
||||||
(res: any) => res[0],
|
|
||||||
);
|
|
||||||
if (!appExists) {
|
|
||||||
return c.json({ error: "Target application does not exist" }, 404);
|
|
||||||
}
|
|
||||||
validatedAppId = appId;
|
|
||||||
}
|
|
||||||
|
|
||||||
let parsedMaxUses: number | null = 1;
|
|
||||||
if (usageLimitType === "unlimited") {
|
|
||||||
parsedMaxUses = null;
|
|
||||||
} else if (usageLimitType === "limited") {
|
|
||||||
const n = parseInt(maxUses);
|
|
||||||
parsedMaxUses = (!isNaN(n) && n > 0) ? n : 5;
|
|
||||||
} else {
|
|
||||||
parsedMaxUses = 1; // single-use default
|
|
||||||
}
|
|
||||||
|
|
||||||
const shouldAutoActivate = autoActivate !== false;
|
|
||||||
|
|
||||||
const inviteCode =
|
|
||||||
(customCode && typeof customCode === "string" && customCode.trim())
|
|
||||||
? customCode.trim()
|
|
||||||
: encodeBase64Url(crypto.getRandomValues(new Uint8Array(24)));
|
|
||||||
|
|
||||||
const days = Number(expiresInDays) || 7;
|
|
||||||
if (!Number.isInteger(days) || days < 1 || days > 30) {
|
|
||||||
return c.json({
|
|
||||||
error: "expiresInDays must be an integer between 1 and 30",
|
|
||||||
}, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
const expiresAt = new Date();
|
|
||||||
expiresAt.setDate(expiresAt.getDate() + days);
|
|
||||||
|
|
||||||
try {
|
|
||||||
await sqlWrapper.sql`
|
|
||||||
INSERT INTO invites (code, app_id, role, created_by, max_uses, uses_count, auto_activate, expires_at)
|
|
||||||
VALUES (${inviteCode}, ${validatedAppId}, ${assignedRole}, ${auth.userId}, ${parsedMaxUses}, 0, ${shouldAutoActivate}, ${expiresAt})
|
|
||||||
`;
|
|
||||||
} catch (err: any) {
|
|
||||||
if (err.code === "23505") {
|
|
||||||
return c.json({ error: "An invite with this code already exists" }, 409);
|
|
||||||
}
|
|
||||||
return c.json({ error: "Failed to generate invite" }, 500);
|
|
||||||
}
|
|
||||||
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"invite_created",
|
|
||||||
validatedAppId,
|
|
||||||
{
|
|
||||||
code: inviteCode,
|
|
||||||
role: assignedRole,
|
|
||||||
max_uses: parsedMaxUses,
|
|
||||||
auto_activate: shouldAutoActivate,
|
|
||||||
expiresInDays: days,
|
|
||||||
},
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
|
|
||||||
return c.json({
|
|
||||||
success: true,
|
|
||||||
inviteCode,
|
|
||||||
expiresAt,
|
|
||||||
maxUses: parsedMaxUses,
|
|
||||||
autoActivate: shouldAutoActivate,
|
|
||||||
});
|
|
||||||
});
|
|
||||||
|
|
||||||
invitesAdminRoutes.get("/:id/redemptions", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const inviteId = c.req.param("id");
|
|
||||||
const redemptions = await sqlWrapper.sql`
|
|
||||||
SELECT ir.id, ir.redeemed_at, u.id AS user_id, u.username, u.display_name, u.account_status
|
|
||||||
FROM invite_redemptions ir
|
|
||||||
JOIN users u ON ir.user_id = u.id
|
|
||||||
WHERE ir.invite_id = ${inviteId}
|
|
||||||
ORDER BY ir.redeemed_at DESC
|
|
||||||
`;
|
|
||||||
|
|
||||||
return c.json({ redemptions });
|
|
||||||
});
|
|
||||||
|
|
||||||
invitesAdminRoutes.delete("/:id", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const inviteId = c.req.param("id");
|
|
||||||
const invite = await sqlWrapper
|
|
||||||
.sql`DELETE FROM invites WHERE id = ${inviteId} RETURNING id, code`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (invite) {
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"invite_revoked",
|
|
||||||
inviteId,
|
|
||||||
{ code: invite.code },
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
return c.json({ success: true });
|
|
||||||
}
|
|
||||||
return c.json({ error: "Invite not found" }, 404);
|
|
||||||
});
|
|
||||||
@ -1,155 +0,0 @@
|
|||||||
import { Hono } from "jsr:@hono/hono@4";
|
|
||||||
import { sqlWrapper } from "../../db.ts";
|
|
||||||
import { auditWrapper } from "../../audit.ts";
|
|
||||||
import { getAuthenticatedUser } from "../../auth-session.ts";
|
|
||||||
import { getClientIp } from "../../middleware.ts";
|
|
||||||
|
|
||||||
export const rolesAdminRoutes = new Hono();
|
|
||||||
|
|
||||||
rolesAdminRoutes.get("/", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const appId = c.req.query("appId");
|
|
||||||
let roles;
|
|
||||||
if (appId) {
|
|
||||||
roles = await sqlWrapper.sql`
|
|
||||||
SELECT r.id, r.name, r.description, r.app_id, r.created_at,
|
|
||||||
a.name AS app_name
|
|
||||||
FROM roles r
|
|
||||||
LEFT JOIN apps a ON r.app_id = a.id
|
|
||||||
WHERE r.app_id IS NULL OR r.app_id = ${appId}
|
|
||||||
ORDER BY r.app_id NULLS FIRST, r.name ASC
|
|
||||||
`;
|
|
||||||
} else {
|
|
||||||
roles = await sqlWrapper.sql`
|
|
||||||
SELECT r.id, r.name, r.description, r.app_id, r.created_at,
|
|
||||||
a.name AS app_name
|
|
||||||
FROM roles r
|
|
||||||
LEFT JOIN apps a ON r.app_id = a.id
|
|
||||||
ORDER BY r.app_id NULLS FIRST, r.name ASC
|
|
||||||
`;
|
|
||||||
}
|
|
||||||
|
|
||||||
return c.json({ roles });
|
|
||||||
});
|
|
||||||
|
|
||||||
rolesAdminRoutes.post("/", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const { name, description, appId } = await c.req.json();
|
|
||||||
if (
|
|
||||||
!name || typeof name !== "string" || name.trim().length < 2 ||
|
|
||||||
name.trim().length > 32
|
|
||||||
) {
|
|
||||||
return c.json(
|
|
||||||
{ error: "Role name must be between 2 and 32 characters" },
|
|
||||||
400,
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
const normalizedName = name.trim().toLowerCase().replace(/[^a-z0-9_-]/g, "_");
|
|
||||||
|
|
||||||
let validatedAppId = null;
|
|
||||||
if (appId && typeof appId === "string" && appId.trim()) {
|
|
||||||
const uuidRegex =
|
|
||||||
/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
|
|
||||||
if (!uuidRegex.test(appId)) {
|
|
||||||
return c.json({ error: "Invalid App UUID" }, 400);
|
|
||||||
}
|
|
||||||
const appExists = await sqlWrapper
|
|
||||||
.sql`SELECT id, name FROM apps WHERE id = ${appId}`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (!appExists) {
|
|
||||||
return c.json({ error: "Selected application does not exist" }, 404);
|
|
||||||
}
|
|
||||||
validatedAppId = appId;
|
|
||||||
}
|
|
||||||
|
|
||||||
try {
|
|
||||||
const newRole = await sqlWrapper.sql`
|
|
||||||
INSERT INTO roles (name, description, app_id)
|
|
||||||
VALUES (${normalizedName}, ${
|
|
||||||
description?.trim() || null
|
|
||||||
}, ${validatedAppId})
|
|
||||||
RETURNING id, name, description, app_id, created_at
|
|
||||||
`.then((res: any) => res[0]);
|
|
||||||
|
|
||||||
auditWrapper.auditLog(auth.userId, "role_created", validatedAppId, {
|
|
||||||
role_name: newRole.name,
|
|
||||||
scope: validatedAppId ? "app-specific" : "global",
|
|
||||||
}, getClientIp(c));
|
|
||||||
|
|
||||||
return c.json({ success: true, role: newRole });
|
|
||||||
} catch (err: any) {
|
|
||||||
if (err.code === "23505") {
|
|
||||||
return c.json({
|
|
||||||
error: "This role already exists for the selected scope",
|
|
||||||
}, 409);
|
|
||||||
}
|
|
||||||
return c.json({ error: "Failed to create role" }, 500);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
rolesAdminRoutes.put("/:id", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const roleId = c.req.param("id");
|
|
||||||
const { name, description } = await c.req.json();
|
|
||||||
|
|
||||||
if (!name || typeof name !== "string" || name.trim().length < 2) {
|
|
||||||
return c.json({ error: "Role name must be at least 2 characters" }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
const normalizedName = name.trim().toLowerCase().replace(/[^a-z0-9_-]/g, "_");
|
|
||||||
|
|
||||||
try {
|
|
||||||
const updatedRole = await sqlWrapper.sql`
|
|
||||||
UPDATE roles
|
|
||||||
SET name = ${normalizedName},
|
|
||||||
description = ${description?.trim() || null}
|
|
||||||
WHERE id = ${roleId}
|
|
||||||
RETURNING id, name, description, app_id, created_at
|
|
||||||
`.then((res: any) => res[0]);
|
|
||||||
|
|
||||||
if (!updatedRole) return c.json({ error: "Role not found" }, 404);
|
|
||||||
|
|
||||||
auditWrapper.auditLog(auth.userId, "role_updated", updatedRole.app_id, {
|
|
||||||
role_name: updatedRole.name,
|
|
||||||
}, getClientIp(c));
|
|
||||||
|
|
||||||
return c.json({ success: true, role: updatedRole });
|
|
||||||
} catch (_err: any) {
|
|
||||||
return c.json({ error: "Failed to update role" }, 500);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
rolesAdminRoutes.delete("/:id", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const roleId = c.req.param("id");
|
|
||||||
const role = await sqlWrapper
|
|
||||||
.sql`SELECT id, name, app_id FROM roles WHERE id = ${roleId}`.then(
|
|
||||||
(res: any) => res[0],
|
|
||||||
);
|
|
||||||
if (!role) {
|
|
||||||
return c.json({ error: "Role not found" }, 404);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (role.name === "admin" && role.app_id === null) {
|
|
||||||
return c.json({ error: "The global 'admin' role cannot be deleted" }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
await sqlWrapper.sql`DELETE FROM roles WHERE id = ${roleId}`;
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"role_deleted",
|
|
||||||
role.app_id,
|
|
||||||
{ role_name: role.name },
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
return c.json({ success: true });
|
|
||||||
});
|
|
||||||
@ -1,228 +0,0 @@
|
|||||||
import { Hono } from "jsr:@hono/hono@4";
|
|
||||||
import { encodeBase64Url } from "jsr:@std/encoding@1/base64url";
|
|
||||||
import { sqlWrapper } from "../../db.ts";
|
|
||||||
import { valkey } from "../../valkey.ts";
|
|
||||||
import { auditWrapper } from "../../audit.ts";
|
|
||||||
import { getAuthenticatedUser } from "../../auth-session.ts";
|
|
||||||
import { getClientIp } from "../../middleware.ts";
|
|
||||||
|
|
||||||
export const usersAdminRoutes = new Hono();
|
|
||||||
|
|
||||||
usersAdminRoutes.get("/", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const users = await sqlWrapper.sql`
|
|
||||||
SELECT id, username, display_name, account_status
|
|
||||||
FROM users
|
|
||||||
ORDER BY username ASC
|
|
||||||
`;
|
|
||||||
|
|
||||||
return c.json({ users });
|
|
||||||
});
|
|
||||||
|
|
||||||
usersAdminRoutes.post("/:id/status", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const targetUserId = c.req.param("id");
|
|
||||||
const { status } = await c.req.json();
|
|
||||||
|
|
||||||
if (!["active", "pending", "suspended"].includes(status)) {
|
|
||||||
return c.json({ error: "Invalid status" }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
const targetUser = await sqlWrapper
|
|
||||||
.sql`UPDATE users SET account_status = ${status} WHERE id = ${targetUserId} RETURNING id`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
|
|
||||||
if (!targetUser) {
|
|
||||||
return c.json({ error: "User not found" }, 404);
|
|
||||||
}
|
|
||||||
|
|
||||||
auditWrapper.auditLog(auth.userId, "user_status_changed", targetUserId, {
|
|
||||||
newStatus: status,
|
|
||||||
}, getClientIp(c));
|
|
||||||
|
|
||||||
return c.json({ success: true });
|
|
||||||
});
|
|
||||||
|
|
||||||
usersAdminRoutes.post("/:id/profile", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const targetUserId = c.req.param("id");
|
|
||||||
const { displayName } = await c.req.json();
|
|
||||||
|
|
||||||
const targetUser = await sqlWrapper
|
|
||||||
.sql`UPDATE users SET display_name = ${
|
|
||||||
displayName?.trim() || null
|
|
||||||
} WHERE id = ${targetUserId} RETURNING id, username, display_name`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
|
|
||||||
if (!targetUser) return c.json({ error: "User not found" }, 404);
|
|
||||||
|
|
||||||
auditWrapper.auditLog(auth.userId, "user_profile_updated", targetUserId, {
|
|
||||||
display_name: targetUser.display_name,
|
|
||||||
}, getClientIp(c));
|
|
||||||
|
|
||||||
return c.json({ success: true, user: targetUser });
|
|
||||||
});
|
|
||||||
|
|
||||||
usersAdminRoutes.get("/:id/grants", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const targetUserId = c.req.param("id");
|
|
||||||
const grants = await sqlWrapper.sql`
|
|
||||||
SELECT g.id, g.app_id, g.role, g.created_at, a.name AS app_name, a.spiffe_id
|
|
||||||
FROM grants g
|
|
||||||
JOIN apps a ON g.app_id = a.id
|
|
||||||
WHERE g.user_id = ${targetUserId}
|
|
||||||
ORDER BY a.name ASC
|
|
||||||
`;
|
|
||||||
return c.json({ grants });
|
|
||||||
});
|
|
||||||
|
|
||||||
usersAdminRoutes.post("/:id/grants", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const targetUserId = c.req.param("id");
|
|
||||||
const { appId, role } = await c.req.json();
|
|
||||||
|
|
||||||
if (!appId || !role) {
|
|
||||||
return c.json({ error: "appId and role are required" }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
const app = await sqlWrapper
|
|
||||||
.sql`SELECT id, name FROM apps WHERE id = ${appId}`.then(
|
|
||||||
(res: any) => res[0],
|
|
||||||
);
|
|
||||||
if (!app) return c.json({ error: "Application not found" }, 404);
|
|
||||||
|
|
||||||
const targetUser = await sqlWrapper
|
|
||||||
.sql`SELECT id, username FROM users WHERE id = ${targetUserId}`.then(
|
|
||||||
(res: any) => res[0],
|
|
||||||
);
|
|
||||||
if (!targetUser) return c.json({ error: "User not found" }, 404);
|
|
||||||
|
|
||||||
await sqlWrapper.sql`
|
|
||||||
INSERT INTO grants (user_id, app_id, role)
|
|
||||||
VALUES (${targetUserId}, ${appId}, ${role})
|
|
||||||
ON CONFLICT (user_id, app_id) DO UPDATE SET role = ${role}
|
|
||||||
`;
|
|
||||||
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"user_grant_assigned",
|
|
||||||
targetUserId,
|
|
||||||
{ app_id: appId, app_name: app.name, role },
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
|
|
||||||
return c.json({ success: true });
|
|
||||||
});
|
|
||||||
|
|
||||||
usersAdminRoutes.delete("/:id/grants/:appId", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const { id: targetUserId, appId } = c.req.param();
|
|
||||||
|
|
||||||
const grant = await sqlWrapper.sql`
|
|
||||||
DELETE FROM grants
|
|
||||||
WHERE user_id = ${targetUserId} AND app_id = ${appId}
|
|
||||||
RETURNING id
|
|
||||||
`.then((res: any) => res[0]);
|
|
||||||
|
|
||||||
if (grant) {
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"user_grant_revoked",
|
|
||||||
targetUserId,
|
|
||||||
{ app_id: appId },
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
return c.json({ success: true });
|
|
||||||
}
|
|
||||||
|
|
||||||
return c.json({ error: "Grant not found" }, 404);
|
|
||||||
});
|
|
||||||
|
|
||||||
usersAdminRoutes.get("/:id", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
const targetUserId = c.req.param("id");
|
|
||||||
const user = await sqlWrapper
|
|
||||||
.sql`SELECT id, username, display_name, account_status FROM users WHERE id = ${targetUserId}`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (!user) return c.json({ error: "User not found" }, 404);
|
|
||||||
const sessions = await sqlWrapper
|
|
||||||
.sql`SELECT id, created_at, expires_at FROM sessions WHERE user_id = ${targetUserId} ORDER BY created_at DESC`;
|
|
||||||
const passkeys = await sqlWrapper
|
|
||||||
.sql`SELECT id, credential_id, counter FROM passkeys WHERE user_id = ${targetUserId}`;
|
|
||||||
return c.json({ user, sessions, passkeys });
|
|
||||||
});
|
|
||||||
|
|
||||||
usersAdminRoutes.delete("/:id/sessions", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
const targetUserId = c.req.param("id");
|
|
||||||
const sessions = await sqlWrapper
|
|
||||||
.sql`DELETE FROM sessions WHERE user_id = ${targetUserId} RETURNING id`;
|
|
||||||
for (const session of sessions) {
|
|
||||||
try {
|
|
||||||
await valkey.del(session.id);
|
|
||||||
} catch (_err) {}
|
|
||||||
}
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"admin_all_sessions_revoked",
|
|
||||||
targetUserId,
|
|
||||||
null,
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
return c.json({ success: true });
|
|
||||||
});
|
|
||||||
|
|
||||||
usersAdminRoutes.delete("/:userId/passkeys/:passkeyId", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
const { userId, passkeyId } = c.req.param();
|
|
||||||
const passkey = await sqlWrapper
|
|
||||||
.sql`DELETE FROM passkeys WHERE id = ${passkeyId} AND user_id = ${userId} RETURNING id`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (passkey) {
|
|
||||||
auditWrapper.auditLog(auth.userId, "admin_passkey_revoked", userId, {
|
|
||||||
passkey_id: passkey.id,
|
|
||||||
}, getClientIp(c));
|
|
||||||
return c.json({ success: true });
|
|
||||||
}
|
|
||||||
return c.json({ error: "Passkey not found" }, 404);
|
|
||||||
});
|
|
||||||
|
|
||||||
usersAdminRoutes.post("/:id/recovery", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
const targetUserId = c.req.param("id");
|
|
||||||
const targetUser = await sqlWrapper
|
|
||||||
.sql`SELECT id FROM users WHERE id = ${targetUserId}`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (!targetUser) return c.json({ error: "User not found" }, 404);
|
|
||||||
const recoveryCode = encodeBase64Url(
|
|
||||||
crypto.getRandomValues(new Uint8Array(24)),
|
|
||||||
);
|
|
||||||
const expiresAt = new Date();
|
|
||||||
expiresAt.setDate(expiresAt.getDate() + 1);
|
|
||||||
await sqlWrapper
|
|
||||||
.sql`INSERT INTO recovery_links (code, user_id, created_by, expires_at) VALUES (${recoveryCode}, ${targetUserId}, ${auth.userId}, ${expiresAt})`;
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"recovery_link_created",
|
|
||||||
targetUserId,
|
|
||||||
null,
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
return c.json({ success: true, recoveryCode, expiresAt });
|
|
||||||
});
|
|
||||||
@ -1,13 +1,928 @@
|
|||||||
import { Hono } from "jsr:@hono/hono@4";
|
import { Hono } from "jsr:@hono/hono@4";
|
||||||
|
import { deleteCookie, getCookie, setCookie } from "jsr:@hono/hono@4/cookie";
|
||||||
|
import {
|
||||||
|
decodeBase64Url,
|
||||||
|
encodeBase64Url,
|
||||||
|
} from "jsr:@std/encoding@1/base64url";
|
||||||
|
import {
|
||||||
|
generateAuthenticationOptions,
|
||||||
|
generateRegistrationOptions,
|
||||||
|
MetadataService,
|
||||||
|
verifyAuthenticationResponse,
|
||||||
|
verifyRegistrationResponse,
|
||||||
|
} from "jsr:@simplewebauthn/server@13";
|
||||||
|
import type {
|
||||||
|
AuthenticationResponseJSON,
|
||||||
|
RegistrationResponseJSON,
|
||||||
|
} from "jsr:@simplewebauthn/server@13";
|
||||||
|
|
||||||
import { registerAuthRoutes } from "./auth/register.ts";
|
import { sqlWrapper } from "../db.ts";
|
||||||
import { loginAuthRoutes } from "./auth/login.ts";
|
import { valkey } from "../valkey.ts";
|
||||||
import { passkeysAuthRoutes } from "./auth/passkeys.ts";
|
import { auditWrapper } from "../audit.ts";
|
||||||
import { guestAuthRoutes } from "./auth/guest.ts";
|
import {
|
||||||
|
extractAllSessionIds,
|
||||||
|
getAuthenticatedUser,
|
||||||
|
requirePrimarySession,
|
||||||
|
} from "../auth-session.ts";
|
||||||
|
import { getClientIp, publicRateLimiter } from "../middleware.ts";
|
||||||
|
|
||||||
export const authRoutes = new Hono();
|
export const authRoutes = new Hono();
|
||||||
|
|
||||||
authRoutes.route("/", registerAuthRoutes);
|
const rpName = "Auth-Yes Identity Provider";
|
||||||
authRoutes.route("/", loginAuthRoutes);
|
const rpID = Deno.env.get("RP_ID") ||
|
||||||
authRoutes.route("/", passkeysAuthRoutes);
|
(import.meta.main ? undefined : "localhost");
|
||||||
authRoutes.route("/", guestAuthRoutes);
|
const origin = Deno.env.get("ORIGIN") ||
|
||||||
|
(import.meta.main ? undefined : "http://localhost");
|
||||||
|
const requireHardwareToken = Deno.env.get("REQUIRE_HARDWARE_TOKEN") === "true";
|
||||||
|
|
||||||
|
export function getCookieDomain(customRpId?: string): string | undefined {
|
||||||
|
const envDomain = Deno.env.get("COOKIE_DOMAIN");
|
||||||
|
if (envDomain) {
|
||||||
|
return envDomain.startsWith(".") ? envDomain : `.${envDomain}`;
|
||||||
|
}
|
||||||
|
const targetId = customRpId || Deno.env.get("RP_ID") || "";
|
||||||
|
if (!targetId || !targetId.includes(".") || targetId === "localhost") {
|
||||||
|
return undefined;
|
||||||
|
}
|
||||||
|
const parts = targetId.split(".").filter(Boolean);
|
||||||
|
if (parts.length >= 2) {
|
||||||
|
return `.${parts.slice(-2).join(".")}`;
|
||||||
|
}
|
||||||
|
return `.${targetId}`;
|
||||||
|
}
|
||||||
|
|
||||||
|
function generateSessionId() {
|
||||||
|
return crypto.randomUUID();
|
||||||
|
}
|
||||||
|
|
||||||
|
authRoutes.use("/api/register/*", publicRateLimiter);
|
||||||
|
authRoutes.use("/api/login/*", publicRateLimiter);
|
||||||
|
authRoutes.use("/api/passkeys/*", requirePrimarySession);
|
||||||
|
|
||||||
|
authRoutes.get("/.well-known/webauthn", (c) => {
|
||||||
|
if (!origin) {
|
||||||
|
return c.json({ origins: [] });
|
||||||
|
}
|
||||||
|
return c.json({ origins: [origin] });
|
||||||
|
});
|
||||||
|
|
||||||
|
// Start a WebAuthn registration ceremony
|
||||||
|
authRoutes.post("/api/register/challenge", async (c) => {
|
||||||
|
const { username, inviteCode } = await c.req.json();
|
||||||
|
|
||||||
|
if (!username || !inviteCode) {
|
||||||
|
return c.json({ error: "Username and inviteCode required" }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Validate invite code early (checks expiration and max_uses bounds)
|
||||||
|
const invite = await sqlWrapper
|
||||||
|
.sql`SELECT id, max_uses, uses_count, auto_activate FROM invites WHERE code = ${inviteCode} AND (max_uses IS NULL OR uses_count < max_uses) AND expires_at > NOW()`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (!invite) {
|
||||||
|
return c.json(
|
||||||
|
{ error: "Invalid, expired, or fully claimed invite code" },
|
||||||
|
400,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Prevent hijacking an existing user's account if they already exist
|
||||||
|
const existingUser = await sqlWrapper
|
||||||
|
.sql`SELECT id FROM users WHERE username = ${username}`.then((res: any) =>
|
||||||
|
res[0]
|
||||||
|
);
|
||||||
|
if (existingUser) {
|
||||||
|
return c.json({ error: "Username already exists" }, 409);
|
||||||
|
}
|
||||||
|
|
||||||
|
const newUserId = crypto.randomUUID();
|
||||||
|
const userIdBytes = new TextEncoder().encode(newUserId);
|
||||||
|
|
||||||
|
if (!rpID) throw new Error("rpID is missing");
|
||||||
|
|
||||||
|
const options = await generateRegistrationOptions({
|
||||||
|
rpName,
|
||||||
|
rpID,
|
||||||
|
userName: username,
|
||||||
|
userID: userIdBytes,
|
||||||
|
attestationType: "direct",
|
||||||
|
authenticatorSelection: {
|
||||||
|
residentKey: "required",
|
||||||
|
requireResidentKey: true,
|
||||||
|
userVerification: "preferred",
|
||||||
|
},
|
||||||
|
timeout: 60000,
|
||||||
|
extensions: {
|
||||||
|
["prf" as string]: {},
|
||||||
|
} as any,
|
||||||
|
});
|
||||||
|
|
||||||
|
setCookie(c, "expected_registration_challenge", options.challenge, {
|
||||||
|
httpOnly: true,
|
||||||
|
secure: true,
|
||||||
|
sameSite: "Lax",
|
||||||
|
maxAge: 300,
|
||||||
|
});
|
||||||
|
|
||||||
|
setCookie(c, "registration_user_id", newUserId, {
|
||||||
|
httpOnly: true,
|
||||||
|
secure: true,
|
||||||
|
sameSite: "Lax",
|
||||||
|
maxAge: 300,
|
||||||
|
});
|
||||||
|
|
||||||
|
return c.json({ options, username });
|
||||||
|
});
|
||||||
|
|
||||||
|
// Verify registration and create UUID/session
|
||||||
|
authRoutes.post("/api/register/verify", async (c) => {
|
||||||
|
try {
|
||||||
|
const { response, username, inviteCode, upgrade_session } = await c.req
|
||||||
|
.json();
|
||||||
|
|
||||||
|
if (!inviteCode && !upgrade_session) {
|
||||||
|
return c.json({ error: "inviteCode or upgrade_session required" }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
const expectedChallenge = getCookie(c, "expected_registration_challenge");
|
||||||
|
const registrationUserId = getCookie(c, "registration_user_id");
|
||||||
|
if (!expectedChallenge || !registrationUserId) {
|
||||||
|
return c.json({
|
||||||
|
error: "Missing or expired registration challenge/user ID",
|
||||||
|
}, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Prevent race condition account hijacking
|
||||||
|
let user = await sqlWrapper
|
||||||
|
.sql`SELECT id FROM users WHERE username = ${username}`
|
||||||
|
.then(
|
||||||
|
(res: any) => res[0],
|
||||||
|
);
|
||||||
|
if (user) {
|
||||||
|
return c.json({ error: "Username already exists" }, 409);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!origin || !rpID) throw new Error("Missing origin or rpID");
|
||||||
|
|
||||||
|
let verification;
|
||||||
|
try {
|
||||||
|
verification = await verifyRegistrationResponse({
|
||||||
|
response: response as RegistrationResponseJSON,
|
||||||
|
expectedChallenge,
|
||||||
|
expectedOrigin: origin,
|
||||||
|
expectedRPID: rpID,
|
||||||
|
requireUserVerification: false,
|
||||||
|
});
|
||||||
|
} catch (error: any) {
|
||||||
|
return c.json({ error: error.message }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
const { verified, registrationInfo } = verification;
|
||||||
|
if (!verified || !registrationInfo) {
|
||||||
|
return c.json({ error: "Verification failed" }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Enterprise Allow-List Verification
|
||||||
|
const allowlistCount = await sqlWrapper
|
||||||
|
.sql`SELECT COUNT(*) as count FROM aaguid_allowlist`.then((res: any) =>
|
||||||
|
Number(res[0].count)
|
||||||
|
);
|
||||||
|
if (allowlistCount > 0 && registrationInfo.aaguid) {
|
||||||
|
const isAllowed = await sqlWrapper
|
||||||
|
.sql`SELECT id FROM aaguid_allowlist WHERE aaguid = ${registrationInfo.aaguid}`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (!isAllowed) {
|
||||||
|
auditWrapper.auditLog(null, "failed_attestation_allowlist", null, {
|
||||||
|
aaguid: registrationInfo.aaguid,
|
||||||
|
}, getClientIp(c));
|
||||||
|
return c.json({
|
||||||
|
error: "Authenticator AAGUID is not in the enterprise allow-list.",
|
||||||
|
}, 403);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Optional Strict Hardware Attestation (e.g. YubiKey-only)
|
||||||
|
if (requireHardwareToken) {
|
||||||
|
if (
|
||||||
|
!registrationInfo.aaguid ||
|
||||||
|
registrationInfo.aaguid === "00000000-0000-0000-0000-000000000000"
|
||||||
|
) {
|
||||||
|
auditWrapper.auditLog(null, "registration_failed_attestation", null, {
|
||||||
|
username,
|
||||||
|
reason: "No AAGUID provided",
|
||||||
|
}, getClientIp(c));
|
||||||
|
return c.json({
|
||||||
|
error:
|
||||||
|
"Hardware attestation failed: No AAGUID provided. Only certified hardware security keys are permitted.",
|
||||||
|
}, 403);
|
||||||
|
}
|
||||||
|
|
||||||
|
let mdsStatement;
|
||||||
|
try {
|
||||||
|
mdsStatement = await MetadataService.getStatement(
|
||||||
|
registrationInfo.aaguid,
|
||||||
|
);
|
||||||
|
} catch (mdsError) {
|
||||||
|
console.warn("[Auth API] MetadataService lookup error:", mdsError);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!mdsStatement) {
|
||||||
|
auditWrapper.auditLog(null, "registration_failed_attestation", null, {
|
||||||
|
username,
|
||||||
|
aaguid: registrationInfo.aaguid,
|
||||||
|
reason: "AAGUID not found in MDS3",
|
||||||
|
}, getClientIp(c));
|
||||||
|
return c.json({
|
||||||
|
error:
|
||||||
|
`Hardware attestation failed: Authenticator AAGUID (${registrationInfo.aaguid}) not found in FIDO MDS3 blob. Only certified hardware security keys are permitted.`,
|
||||||
|
}, 403);
|
||||||
|
}
|
||||||
|
|
||||||
|
// @ts-ignore: TypeScript definition might be out of date for FIDO MDS3 (1)
|
||||||
|
if (mdsStatement.keyProtection?.includes(0x0001)) {
|
||||||
|
auditWrapper.auditLog(null, "registration_failed_attestation", null, {
|
||||||
|
username,
|
||||||
|
aaguid: registrationInfo.aaguid,
|
||||||
|
reason: "Software passkey detected",
|
||||||
|
}, getClientIp(c));
|
||||||
|
return c.json({
|
||||||
|
error:
|
||||||
|
"Hardware attestation failed: Authenticator is flagged as a software-based passkey. Only certified hardware security keys are permitted.",
|
||||||
|
}, 403);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
const credentialID = registrationInfo.credential.id;
|
||||||
|
const credentialPublicKey = registrationInfo.credential.publicKey;
|
||||||
|
const counter = registrationInfo.credential.counter;
|
||||||
|
|
||||||
|
const base64CredentialID = typeof credentialID === "string"
|
||||||
|
? credentialID
|
||||||
|
: encodeBase64Url(new Uint8Array(credentialID as unknown as ArrayBuffer));
|
||||||
|
const base64PublicKey = encodeBase64Url(
|
||||||
|
new Uint8Array(credentialPublicKey as unknown as ArrayBuffer),
|
||||||
|
);
|
||||||
|
|
||||||
|
const prfEnabled =
|
||||||
|
(response.clientExtensionResults as any)?.prf?.enabled === true;
|
||||||
|
let prfSalt = null;
|
||||||
|
if (prfEnabled) {
|
||||||
|
const saltBytes = crypto.getRandomValues(new Uint8Array(32));
|
||||||
|
prfSalt = encodeBase64Url(saltBytes);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (upgrade_session) {
|
||||||
|
// Ephemeral Guest Sandbox in-flight promotion
|
||||||
|
const sessionDataStr = await valkey.get(upgrade_session);
|
||||||
|
if (!sessionDataStr) {
|
||||||
|
return c.json({ error: "Invalid or expired guest session" }, 400);
|
||||||
|
}
|
||||||
|
const sessionData = JSON.parse(sessionDataStr);
|
||||||
|
if (
|
||||||
|
!sessionData || !sessionData.uuid ||
|
||||||
|
sessionData.account_status !== "guest"
|
||||||
|
) {
|
||||||
|
return c.json({ error: "Invalid guest session state" }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
const guestUuid = sessionData.uuid;
|
||||||
|
|
||||||
|
const insertRes = await sqlWrapper
|
||||||
|
.sql`INSERT INTO users (id, username, account_status) VALUES (${guestUuid}, ${username}, 'active') RETURNING id`;
|
||||||
|
user = insertRes[0];
|
||||||
|
|
||||||
|
await sqlWrapper.sql`
|
||||||
|
INSERT INTO passkeys (user_id, credential_id, public_key, counter, prf_enabled, prf_salt)
|
||||||
|
VALUES (${user.id}, ${base64CredentialID}, ${base64PublicKey}, ${counter}, ${prfEnabled}, ${prfSalt})
|
||||||
|
`;
|
||||||
|
|
||||||
|
// Promote Valkey session
|
||||||
|
await valkey.setex(
|
||||||
|
upgrade_session,
|
||||||
|
28800, // Upgrade TTL to 8 hours
|
||||||
|
JSON.stringify({ uuid: guestUuid, username, account_status: "active" }),
|
||||||
|
);
|
||||||
|
|
||||||
|
// Register session in PostgreSQL
|
||||||
|
const expiresAt = new Date(Date.now() + 8 * 60 * 60 * 1000);
|
||||||
|
await sqlWrapper.sql`
|
||||||
|
INSERT INTO sessions (id, user_id, expires_at)
|
||||||
|
VALUES (${upgrade_session}, ${user.id}, ${expiresAt})
|
||||||
|
`;
|
||||||
|
} else {
|
||||||
|
// Standard Registration Flow
|
||||||
|
const invite = await sqlWrapper
|
||||||
|
.sql`SELECT id, app_id, role, max_uses, uses_count, auto_activate FROM invites WHERE code = ${inviteCode} AND (max_uses IS NULL OR uses_count < max_uses) AND expires_at > NOW()`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (!invite) {
|
||||||
|
return c.json(
|
||||||
|
{ error: "Invalid, expired, or fully claimed invite code" },
|
||||||
|
400,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
const initialStatus = invite.auto_activate === false
|
||||||
|
? "pending"
|
||||||
|
: "active";
|
||||||
|
const insertRes = await sqlWrapper
|
||||||
|
.sql`INSERT INTO users (id, username, account_status) VALUES (${registrationUserId}, ${username}, ${initialStatus}) RETURNING id`;
|
||||||
|
user = insertRes[0];
|
||||||
|
|
||||||
|
await sqlWrapper.sql`
|
||||||
|
INSERT INTO passkeys (user_id, credential_id, public_key, counter, prf_enabled, prf_salt)
|
||||||
|
VALUES (${user.id}, ${base64CredentialID}, ${base64PublicKey}, ${counter}, ${prfEnabled}, ${prfSalt})
|
||||||
|
`;
|
||||||
|
|
||||||
|
await sqlWrapper.sql`
|
||||||
|
UPDATE invites
|
||||||
|
SET uses_count = uses_count + 1,
|
||||||
|
used_at = NOW(),
|
||||||
|
used_by = ${user.id}
|
||||||
|
WHERE id = ${invite.id}
|
||||||
|
`;
|
||||||
|
|
||||||
|
await sqlWrapper.sql`
|
||||||
|
INSERT INTO invite_redemptions (invite_id, user_id)
|
||||||
|
VALUES (${invite.id}, ${user.id})
|
||||||
|
`;
|
||||||
|
|
||||||
|
if (invite.app_id) {
|
||||||
|
await sqlWrapper.sql`
|
||||||
|
INSERT INTO grants (user_id, app_id, role)
|
||||||
|
VALUES (${user.id}, ${invite.app_id}, ${invite.role})
|
||||||
|
`;
|
||||||
|
} else if (invite.role === "admin") {
|
||||||
|
const adminApp = await sqlWrapper
|
||||||
|
.sql`SELECT id FROM apps WHERE name = 'Auth-Yes Management Console'`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (adminApp) {
|
||||||
|
await sqlWrapper.sql`
|
||||||
|
INSERT INTO grants (user_id, app_id, role)
|
||||||
|
VALUES (${user.id}, ${adminApp.id}, 'admin')
|
||||||
|
ON CONFLICT (user_id, app_id) DO UPDATE SET role = 'admin'
|
||||||
|
`;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
user.id,
|
||||||
|
"user_registered",
|
||||||
|
null,
|
||||||
|
{ username, inviteCode },
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
|
||||||
|
// Set response cookie to clear out the challenge
|
||||||
|
setCookie(c, "expected_registration_challenge", "", {
|
||||||
|
httpOnly: true,
|
||||||
|
secure: true,
|
||||||
|
sameSite: "Lax",
|
||||||
|
maxAge: 0,
|
||||||
|
});
|
||||||
|
|
||||||
|
setCookie(c, "registration_user_id", "", {
|
||||||
|
httpOnly: true,
|
||||||
|
secure: true,
|
||||||
|
sameSite: "Lax",
|
||||||
|
maxAge: 0,
|
||||||
|
});
|
||||||
|
|
||||||
|
const cookieDomain = getCookieDomain(rpID);
|
||||||
|
if (cookieDomain) {
|
||||||
|
deleteCookie(c, "session_id", { domain: cookieDomain, path: "/" });
|
||||||
|
}
|
||||||
|
deleteCookie(c, "session_id", { path: "/" });
|
||||||
|
|
||||||
|
return c.json({ success: true });
|
||||||
|
} catch (error: any) {
|
||||||
|
console.error(
|
||||||
|
"[Auth API] Uncaught Exception in /api/register/verify:",
|
||||||
|
error,
|
||||||
|
);
|
||||||
|
return c.json({ error: error.message || "Internal server error" }, 500);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
// Start a WebAuthn authentication ceremony
|
||||||
|
authRoutes.post("/api/login/challenge", async (c) => {
|
||||||
|
let body;
|
||||||
|
try {
|
||||||
|
body = await c.req.json();
|
||||||
|
} catch (_err) {
|
||||||
|
body = {};
|
||||||
|
}
|
||||||
|
const username = body.username;
|
||||||
|
let extensions: any = undefined;
|
||||||
|
let allowCredentials: any[] | undefined = undefined;
|
||||||
|
|
||||||
|
if (username) {
|
||||||
|
const user = await sqlWrapper
|
||||||
|
.sql`SELECT id FROM users WHERE username = ${username}`.then((res: any) =>
|
||||||
|
res[0]
|
||||||
|
);
|
||||||
|
if (user) {
|
||||||
|
const passkeys = await sqlWrapper
|
||||||
|
.sql`SELECT credential_id, prf_enabled, prf_salt FROM passkeys WHERE user_id = ${user.id}`;
|
||||||
|
|
||||||
|
if (passkeys.length > 0) {
|
||||||
|
allowCredentials = passkeys.map((pk: any) => ({
|
||||||
|
id: pk.credential_id,
|
||||||
|
type: "public-key",
|
||||||
|
}));
|
||||||
|
|
||||||
|
const prfPasskeys = passkeys.filter((pk: any) =>
|
||||||
|
pk.prf_enabled && pk.prf_salt
|
||||||
|
);
|
||||||
|
if (prfPasskeys.length > 0) {
|
||||||
|
extensions = {
|
||||||
|
["prf" as string]: { evalByCredential: {} },
|
||||||
|
};
|
||||||
|
for (const pk of prfPasskeys) {
|
||||||
|
const saltBytes = decodeBase64Url(pk.prf_salt);
|
||||||
|
extensions["prf"]["evalByCredential"][pk.credential_id] = {
|
||||||
|
first: saltBytes,
|
||||||
|
};
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!rpID) throw new Error("rpID is missing");
|
||||||
|
|
||||||
|
const options = await generateAuthenticationOptions({
|
||||||
|
rpID,
|
||||||
|
userVerification: "preferred",
|
||||||
|
timeout: 60000,
|
||||||
|
allowCredentials,
|
||||||
|
extensions,
|
||||||
|
});
|
||||||
|
|
||||||
|
setCookie(c, "expected_authentication_challenge", options.challenge, {
|
||||||
|
httpOnly: true,
|
||||||
|
secure: true,
|
||||||
|
sameSite: "Lax",
|
||||||
|
maxAge: 300,
|
||||||
|
});
|
||||||
|
|
||||||
|
return c.json({ options });
|
||||||
|
});
|
||||||
|
|
||||||
|
// Verify login and issue session
|
||||||
|
authRoutes.post("/api/login/verify", async (c) => {
|
||||||
|
const { response } = await c.req.json();
|
||||||
|
|
||||||
|
const expectedChallenge = getCookie(c, "expected_authentication_challenge");
|
||||||
|
if (!expectedChallenge) {
|
||||||
|
return c.json(
|
||||||
|
{ error: "Missing or expired authentication challenge" },
|
||||||
|
400,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
const base64CredentialID = response.id;
|
||||||
|
|
||||||
|
const passkey = await sqlWrapper
|
||||||
|
.sql`SELECT * FROM passkeys WHERE credential_id = ${base64CredentialID}`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (!passkey) {
|
||||||
|
return c.json({
|
||||||
|
error: "Passkey not found. Please register your passkey first.",
|
||||||
|
}, 404);
|
||||||
|
}
|
||||||
|
|
||||||
|
const user = await sqlWrapper
|
||||||
|
.sql`SELECT id, username, account_status FROM users WHERE id = ${passkey.user_id}`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (!user) {
|
||||||
|
return c.json({ error: "User not found" }, 404);
|
||||||
|
}
|
||||||
|
|
||||||
|
const userId = user.id;
|
||||||
|
|
||||||
|
if (user.account_status !== "active") {
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
userId,
|
||||||
|
"login_failed",
|
||||||
|
null,
|
||||||
|
{ reason: `Account status is ${user.account_status}` },
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
return c.json({
|
||||||
|
error: "Account is not active. Please contact an administrator.",
|
||||||
|
}, 403);
|
||||||
|
}
|
||||||
|
|
||||||
|
const publicKeyBytes = decodeBase64Url(passkey.public_key);
|
||||||
|
|
||||||
|
if (!origin || !rpID) throw new Error("Missing origin or rpID");
|
||||||
|
|
||||||
|
let verification;
|
||||||
|
try {
|
||||||
|
verification = await verifyAuthenticationResponse({
|
||||||
|
response: response as AuthenticationResponseJSON,
|
||||||
|
expectedChallenge,
|
||||||
|
expectedOrigin: origin,
|
||||||
|
expectedRPID: rpID,
|
||||||
|
requireUserVerification: false,
|
||||||
|
credential: {
|
||||||
|
id: passkey.credential_id,
|
||||||
|
publicKey: publicKeyBytes,
|
||||||
|
counter: Number(passkey.counter),
|
||||||
|
},
|
||||||
|
});
|
||||||
|
} catch (error: any) {
|
||||||
|
return c.json({ error: error.message }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
const { verified, authenticationInfo } = verification;
|
||||||
|
if (!verified || !authenticationInfo) {
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
userId,
|
||||||
|
"login_failed",
|
||||||
|
null,
|
||||||
|
{ reason: "verification failed" },
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
return c.json({ error: "Verification failed" }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
await sqlWrapper
|
||||||
|
.sql`UPDATE passkeys SET counter = ${authenticationInfo.newCounter} WHERE id = ${passkey.id}`;
|
||||||
|
|
||||||
|
const sessionId = generateSessionId();
|
||||||
|
const expiresAt = new Date();
|
||||||
|
expiresAt.setDate(expiresAt.getDate() + 7);
|
||||||
|
|
||||||
|
// Persistence in PostgreSQL
|
||||||
|
await sqlWrapper
|
||||||
|
.sql`INSERT INTO sessions (id, user_id, expires_at) VALUES (${sessionId}, ${user.id}, ${expiresAt})`;
|
||||||
|
|
||||||
|
// Write session to Valkey with TTL matching expiresAt
|
||||||
|
const ttlSeconds = Math.floor((expiresAt.getTime() - Date.now()) / 1000);
|
||||||
|
try {
|
||||||
|
const sessionData = JSON.stringify({
|
||||||
|
uuid: user.id,
|
||||||
|
username: user.username,
|
||||||
|
});
|
||||||
|
await valkey.setex(sessionId, ttlSeconds, sessionData);
|
||||||
|
} catch (_err: unknown) {
|
||||||
|
// If Valkey fails, log and fail closed for security
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
user.id,
|
||||||
|
"login_failed",
|
||||||
|
null,
|
||||||
|
{ reason: "Cache write failure" },
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
return c.json({ error: "Internal server error" }, 500);
|
||||||
|
}
|
||||||
|
|
||||||
|
const oldSessionIds = extractAllSessionIds(c);
|
||||||
|
if (oldSessionIds.length > 0) {
|
||||||
|
for (const old of oldSessionIds) {
|
||||||
|
try {
|
||||||
|
await valkey.del(old);
|
||||||
|
await sqlWrapper.sql`DELETE FROM sessions WHERE id = ${old}`;
|
||||||
|
} catch (_e) {}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
const cookieDomain = getCookieDomain(rpID);
|
||||||
|
|
||||||
|
setCookie(c, "session_id", sessionId, {
|
||||||
|
domain: cookieDomain,
|
||||||
|
path: "/",
|
||||||
|
httpOnly: true,
|
||||||
|
secure: true,
|
||||||
|
sameSite: "Lax",
|
||||||
|
expires: expiresAt,
|
||||||
|
});
|
||||||
|
|
||||||
|
setCookie(c, "expected_authentication_challenge", "", {
|
||||||
|
httpOnly: true,
|
||||||
|
secure: true,
|
||||||
|
sameSite: "Lax",
|
||||||
|
maxAge: 0,
|
||||||
|
});
|
||||||
|
|
||||||
|
auditWrapper.auditLog(userId, "login_success", null, null, getClientIp(c));
|
||||||
|
|
||||||
|
return c.json({ success: true });
|
||||||
|
});
|
||||||
|
|
||||||
|
// Generate Ephemeral Guest Sandbox
|
||||||
|
authRoutes.post("/api/guests/sandbox", async (c) => {
|
||||||
|
const guestUuid = crypto.randomUUID();
|
||||||
|
const sessionId = encodeBase64Url(crypto.getRandomValues(new Uint8Array(32)));
|
||||||
|
const username = `guest-${guestUuid.substring(0, 8)}`;
|
||||||
|
|
||||||
|
await valkey.setex(
|
||||||
|
sessionId,
|
||||||
|
7200, // 2-hour TTL
|
||||||
|
JSON.stringify({ uuid: guestUuid, username, account_status: "guest" }),
|
||||||
|
);
|
||||||
|
|
||||||
|
const cookieDomain = getCookieDomain(rpID);
|
||||||
|
|
||||||
|
setCookie(c, "session_id", sessionId, {
|
||||||
|
domain: cookieDomain,
|
||||||
|
path: "/",
|
||||||
|
httpOnly: true,
|
||||||
|
secure: true,
|
||||||
|
sameSite: "Lax",
|
||||||
|
maxAge: 7200,
|
||||||
|
});
|
||||||
|
|
||||||
|
return c.json({ success: true, sessionId, guestUuid });
|
||||||
|
});
|
||||||
|
|
||||||
|
// Revoke a session manually (used by layout logout)
|
||||||
|
authRoutes.post("/api/revoke", async (c) => {
|
||||||
|
// Try Authorization header first (SDK)
|
||||||
|
let token = "";
|
||||||
|
const authHeader = c.req.header("Authorization");
|
||||||
|
if (authHeader && authHeader.startsWith("Bearer ")) {
|
||||||
|
token = authHeader.split(" ")[1];
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!token) {
|
||||||
|
// Fallback to session cookie (Web UI)
|
||||||
|
const tokens = extractAllSessionIds(c);
|
||||||
|
if (tokens.length === 0) {
|
||||||
|
return c.json({ error: "Missing or invalid token" }, 401);
|
||||||
|
}
|
||||||
|
|
||||||
|
for (const t of tokens) {
|
||||||
|
try {
|
||||||
|
await valkey.del(t);
|
||||||
|
await sqlWrapper.sql`DELETE FROM sessions WHERE id = ${t}`;
|
||||||
|
} catch (_e) {}
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
// SDK Token Path
|
||||||
|
try {
|
||||||
|
await valkey.del(token);
|
||||||
|
await sqlWrapper.sql`DELETE FROM sessions WHERE id = ${token}`;
|
||||||
|
} catch (_e) {}
|
||||||
|
}
|
||||||
|
|
||||||
|
const cookieDomain = getCookieDomain(rpID);
|
||||||
|
|
||||||
|
if (cookieDomain) {
|
||||||
|
deleteCookie(c, "session_id", {
|
||||||
|
domain: cookieDomain,
|
||||||
|
path: "/",
|
||||||
|
httpOnly: true,
|
||||||
|
secure: true,
|
||||||
|
sameSite: "Lax",
|
||||||
|
});
|
||||||
|
}
|
||||||
|
deleteCookie(c, "session_id", {
|
||||||
|
path: "/",
|
||||||
|
httpOnly: true,
|
||||||
|
secure: true,
|
||||||
|
sameSite: "Lax",
|
||||||
|
});
|
||||||
|
|
||||||
|
return c.json({ success: true });
|
||||||
|
});
|
||||||
|
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
// Authenticated Passkey Registration (Adding a new device)
|
||||||
|
// ---------------------------------------------------------
|
||||||
|
|
||||||
|
authRoutes.post("/api/passkeys/register/challenge", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const user = await sqlWrapper
|
||||||
|
.sql`SELECT username FROM users WHERE id = ${auth.userId}`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (!user) return c.json({ error: "User not found" }, 404);
|
||||||
|
|
||||||
|
const userIdBytes = new TextEncoder().encode(auth.userId);
|
||||||
|
|
||||||
|
if (!rpID) throw new Error("rpID is missing");
|
||||||
|
|
||||||
|
const options = await generateRegistrationOptions({
|
||||||
|
rpName,
|
||||||
|
rpID,
|
||||||
|
userName: user.username,
|
||||||
|
userID: userIdBytes,
|
||||||
|
attestationType: "direct",
|
||||||
|
authenticatorSelection: {
|
||||||
|
residentKey: "required",
|
||||||
|
requireResidentKey: true,
|
||||||
|
userVerification: "preferred",
|
||||||
|
},
|
||||||
|
timeout: 60000,
|
||||||
|
});
|
||||||
|
|
||||||
|
setCookie(c, "expected_add_passkey_challenge", options.challenge, {
|
||||||
|
httpOnly: true,
|
||||||
|
secure: true,
|
||||||
|
sameSite: "Lax",
|
||||||
|
maxAge: 300,
|
||||||
|
});
|
||||||
|
|
||||||
|
return c.json({ options });
|
||||||
|
});
|
||||||
|
|
||||||
|
authRoutes.post("/api/passkeys/register/verify", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const { response } = await c.req.json();
|
||||||
|
const expectedChallenge = getCookie(c, "expected_add_passkey_challenge");
|
||||||
|
|
||||||
|
if (!expectedChallenge) {
|
||||||
|
return c.json({ error: "Missing or expired registration challenge" }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!origin || !rpID) throw new Error("Missing origin or rpID");
|
||||||
|
|
||||||
|
let verification;
|
||||||
|
try {
|
||||||
|
verification = await verifyRegistrationResponse({
|
||||||
|
response: response as RegistrationResponseJSON,
|
||||||
|
expectedChallenge,
|
||||||
|
expectedOrigin: origin,
|
||||||
|
expectedRPID: rpID,
|
||||||
|
requireUserVerification: false,
|
||||||
|
});
|
||||||
|
} catch (error: any) {
|
||||||
|
return c.json({ error: error.message }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
const { verified, registrationInfo } = verification;
|
||||||
|
if (!verified || !registrationInfo) {
|
||||||
|
return c.json({ error: "Verification failed" }, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Enterprise Allow-List Verification
|
||||||
|
const allowlistCount = await sqlWrapper
|
||||||
|
.sql`SELECT COUNT(*) as count FROM aaguid_allowlist`.then((res: any) =>
|
||||||
|
Number(res[0].count)
|
||||||
|
);
|
||||||
|
if (allowlistCount > 0 && registrationInfo.aaguid) {
|
||||||
|
const isAllowed = await sqlWrapper
|
||||||
|
.sql`SELECT id FROM aaguid_allowlist WHERE aaguid = ${registrationInfo.aaguid}`
|
||||||
|
.then((res: any) => res[0]);
|
||||||
|
if (!isAllowed) {
|
||||||
|
auditWrapper.auditLog(auth.userId, "failed_attestation_allowlist", null, {
|
||||||
|
aaguid: registrationInfo.aaguid,
|
||||||
|
}, getClientIp(c));
|
||||||
|
return c.json({
|
||||||
|
error: "Authenticator AAGUID is not in the enterprise allow-list.",
|
||||||
|
}, 403);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Optional Strict Hardware Attestation
|
||||||
|
if (requireHardwareToken) {
|
||||||
|
if (
|
||||||
|
!registrationInfo.aaguid ||
|
||||||
|
registrationInfo.aaguid === "00000000-0000-0000-0000-000000000000"
|
||||||
|
) {
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"add_passkey_failed_attestation",
|
||||||
|
null,
|
||||||
|
{
|
||||||
|
reason: "No AAGUID provided",
|
||||||
|
},
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
return c.json(
|
||||||
|
{ error: "Hardware attestation failed: No AAGUID provided." },
|
||||||
|
403,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
let mdsStatement;
|
||||||
|
try {
|
||||||
|
mdsStatement = await MetadataService.getStatement(
|
||||||
|
registrationInfo.aaguid,
|
||||||
|
);
|
||||||
|
} catch (mdsError) {
|
||||||
|
console.warn("[Auth API] MetadataService lookup error:", mdsError);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!mdsStatement) {
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"add_passkey_failed_attestation",
|
||||||
|
null,
|
||||||
|
{
|
||||||
|
aaguid: registrationInfo.aaguid,
|
||||||
|
reason: "AAGUID not found in MDS3",
|
||||||
|
},
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
return c.json({
|
||||||
|
error:
|
||||||
|
`Hardware attestation failed: Authenticator AAGUID (${registrationInfo.aaguid}) not found in FIDO MDS3 blob.`,
|
||||||
|
}, 403);
|
||||||
|
}
|
||||||
|
|
||||||
|
// @ts-ignore: FIDO MDS3 missing type
|
||||||
|
if (mdsStatement.keyProtection?.includes(0x0001)) {
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"add_passkey_failed_attestation",
|
||||||
|
null,
|
||||||
|
{
|
||||||
|
aaguid: registrationInfo.aaguid,
|
||||||
|
reason: "Software passkey detected",
|
||||||
|
},
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
return c.json({
|
||||||
|
error:
|
||||||
|
"Hardware attestation failed: Authenticator is flagged as a software-based passkey.",
|
||||||
|
}, 403);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
const credentialID = registrationInfo.credential.id;
|
||||||
|
const credentialPublicKey = registrationInfo.credential.publicKey;
|
||||||
|
const counter = registrationInfo.credential.counter;
|
||||||
|
|
||||||
|
const base64CredentialID = typeof credentialID === "string"
|
||||||
|
? credentialID
|
||||||
|
: encodeBase64Url(new Uint8Array(credentialID as unknown as ArrayBuffer));
|
||||||
|
const base64PublicKey = encodeBase64Url(
|
||||||
|
new Uint8Array(credentialPublicKey as unknown as ArrayBuffer),
|
||||||
|
);
|
||||||
|
|
||||||
|
await sqlWrapper.sql`
|
||||||
|
INSERT INTO passkeys (user_id, credential_id, public_key, counter)
|
||||||
|
VALUES (${auth.userId}, ${base64CredentialID}, ${base64PublicKey}, ${counter})
|
||||||
|
`;
|
||||||
|
|
||||||
|
auditWrapper.auditLog(
|
||||||
|
auth.userId,
|
||||||
|
"passkey_added",
|
||||||
|
null,
|
||||||
|
null,
|
||||||
|
getClientIp(c),
|
||||||
|
);
|
||||||
|
|
||||||
|
setCookie(c, "expected_add_passkey_challenge", "", {
|
||||||
|
httpOnly: true,
|
||||||
|
secure: true,
|
||||||
|
sameSite: "Lax",
|
||||||
|
maxAge: 0,
|
||||||
|
});
|
||||||
|
|
||||||
|
return c.json({ success: true });
|
||||||
|
});
|
||||||
|
|
||||||
|
// Get user's registered passkeys
|
||||||
|
authRoutes.get("/api/passkeys", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const passkeys = await sqlWrapper.sql`
|
||||||
|
SELECT id, counter
|
||||||
|
FROM passkeys
|
||||||
|
WHERE user_id = ${auth.userId}
|
||||||
|
`;
|
||||||
|
|
||||||
|
return c.json({ passkeys });
|
||||||
|
});
|
||||||
|
|
||||||
|
// Revoke a specific passkey
|
||||||
|
authRoutes.delete("/api/passkeys/:id", async (c) => {
|
||||||
|
const auth = await getAuthenticatedUser(c);
|
||||||
|
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
||||||
|
|
||||||
|
const targetPasskeyId = c.req.param("id");
|
||||||
|
|
||||||
|
// Verify the passkey belongs to the user
|
||||||
|
const passkey = await sqlWrapper.sql`
|
||||||
|
SELECT id FROM passkeys WHERE id = ${targetPasskeyId} AND user_id = ${auth.userId}
|
||||||
|
`.then((res: any) => res[0]);
|
||||||
|
|
||||||
|
if (!passkey) {
|
||||||
|
return c.json({ error: "Passkey not found or access denied" }, 404);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Prevent deleting the very last passkey to avoid locking out the user
|
||||||
|
const passkeyCount = await sqlWrapper.sql`
|
||||||
|
SELECT count(*) as count FROM passkeys WHERE user_id = ${auth.userId}
|
||||||
|
`.then((res: any) => Number(res[0].count));
|
||||||
|
|
||||||
|
if (passkeyCount <= 1) {
|
||||||
|
return c.json({
|
||||||
|
error: "Cannot delete your last passkey. Register another one first.",
|
||||||
|
}, 400);
|
||||||
|
}
|
||||||
|
|
||||||
|
await sqlWrapper.sql`DELETE FROM passkeys WHERE id = ${targetPasskeyId}`;
|
||||||
|
|
||||||
|
auditWrapper.auditLog(auth.userId, "passkey_revoked", null, {
|
||||||
|
revoked_passkey_id: targetPasskeyId,
|
||||||
|
}, getClientIp(c));
|
||||||
|
|
||||||
|
return c.json({ success: true });
|
||||||
|
});
|
||||||
|
|||||||
@ -1,90 +0,0 @@
|
|||||||
import { Hono } from "jsr:@hono/hono@4";
|
|
||||||
import { deleteCookie, setCookie } from "jsr:@hono/hono@4/cookie";
|
|
||||||
import { encodeBase64Url } from "jsr:@std/encoding@1/base64url";
|
|
||||||
|
|
||||||
import { sqlWrapper } from "../../db.ts";
|
|
||||||
import { valkey } from "../../valkey.ts";
|
|
||||||
import { extractAllSessionIds } from "../../auth-session.ts";
|
|
||||||
import { getCookieDomain } from "./utils.ts";
|
|
||||||
|
|
||||||
export const guestAuthRoutes = new Hono();
|
|
||||||
|
|
||||||
const rpID = Deno.env.get("RP_ID") ||
|
|
||||||
(import.meta.main ? undefined : "localhost");
|
|
||||||
|
|
||||||
// Generate Ephemeral Guest Sandbox
|
|
||||||
guestAuthRoutes.post("/api/guests/sandbox", async (c) => {
|
|
||||||
const guestUuid = crypto.randomUUID();
|
|
||||||
const sessionId = encodeBase64Url(crypto.getRandomValues(new Uint8Array(32)));
|
|
||||||
const username = `guest-${guestUuid.substring(0, 8)}`;
|
|
||||||
|
|
||||||
await valkey.setex(
|
|
||||||
sessionId,
|
|
||||||
7200, // 2-hour TTL
|
|
||||||
JSON.stringify({ uuid: guestUuid, username, account_status: "guest" }),
|
|
||||||
);
|
|
||||||
|
|
||||||
const cookieDomain = getCookieDomain(rpID);
|
|
||||||
|
|
||||||
setCookie(c, "session_id", sessionId, {
|
|
||||||
domain: cookieDomain,
|
|
||||||
path: "/",
|
|
||||||
httpOnly: true,
|
|
||||||
secure: true,
|
|
||||||
sameSite: "Lax",
|
|
||||||
maxAge: 7200,
|
|
||||||
});
|
|
||||||
|
|
||||||
return c.json({ success: true, sessionId, guestUuid });
|
|
||||||
});
|
|
||||||
|
|
||||||
// Revoke a session manually (used by layout logout)
|
|
||||||
guestAuthRoutes.post("/api/revoke", async (c) => {
|
|
||||||
// Try Authorization header first (SDK)
|
|
||||||
let token = "";
|
|
||||||
const authHeader = c.req.header("Authorization");
|
|
||||||
if (authHeader && authHeader.startsWith("Bearer ")) {
|
|
||||||
token = authHeader.split(" ")[1];
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!token) {
|
|
||||||
// Fallback to session cookie (Web UI)
|
|
||||||
const tokens = extractAllSessionIds(c);
|
|
||||||
if (tokens.length === 0) {
|
|
||||||
return c.json({ error: "Missing or invalid token" }, 401);
|
|
||||||
}
|
|
||||||
|
|
||||||
for (const t of tokens) {
|
|
||||||
try {
|
|
||||||
await valkey.del(t);
|
|
||||||
await sqlWrapper.sql`DELETE FROM sessions WHERE id = ${t}`;
|
|
||||||
} catch (_e) {}
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
// SDK Token Path
|
|
||||||
try {
|
|
||||||
await valkey.del(token);
|
|
||||||
await sqlWrapper.sql`DELETE FROM sessions WHERE id = ${token}`;
|
|
||||||
} catch (_e) {}
|
|
||||||
}
|
|
||||||
|
|
||||||
const cookieDomain = getCookieDomain(rpID);
|
|
||||||
|
|
||||||
if (cookieDomain) {
|
|
||||||
deleteCookie(c, "session_id", {
|
|
||||||
domain: cookieDomain,
|
|
||||||
path: "/",
|
|
||||||
httpOnly: true,
|
|
||||||
secure: true,
|
|
||||||
sameSite: "Lax",
|
|
||||||
});
|
|
||||||
}
|
|
||||||
deleteCookie(c, "session_id", {
|
|
||||||
path: "/",
|
|
||||||
httpOnly: true,
|
|
||||||
secure: true,
|
|
||||||
sameSite: "Lax",
|
|
||||||
});
|
|
||||||
|
|
||||||
return c.json({ success: true });
|
|
||||||
});
|
|
||||||
@ -1,236 +0,0 @@
|
|||||||
import { Hono } from "jsr:@hono/hono@4";
|
|
||||||
import { getCookie, setCookie } from "jsr:@hono/hono@4/cookie";
|
|
||||||
import { decodeBase64Url } from "jsr:@std/encoding@1/base64url";
|
|
||||||
import {
|
|
||||||
generateAuthenticationOptions,
|
|
||||||
verifyAuthenticationResponse,
|
|
||||||
} from "jsr:@simplewebauthn/server@13";
|
|
||||||
import type { AuthenticationResponseJSON } from "jsr:@simplewebauthn/server@13";
|
|
||||||
|
|
||||||
import { sqlWrapper } from "../../db.ts";
|
|
||||||
import { valkey } from "../../valkey.ts";
|
|
||||||
import { auditWrapper } from "../../audit.ts";
|
|
||||||
import { extractAllSessionIds } from "../../auth-session.ts";
|
|
||||||
import { getClientIp, publicRateLimiter } from "../../middleware.ts";
|
|
||||||
import { getCookieDomain } from "./utils.ts";
|
|
||||||
|
|
||||||
export const loginAuthRoutes = new Hono();
|
|
||||||
|
|
||||||
const rpID = Deno.env.get("RP_ID") ||
|
|
||||||
(import.meta.main ? undefined : "localhost");
|
|
||||||
const origin = Deno.env.get("ORIGIN") ||
|
|
||||||
(import.meta.main ? undefined : "http://localhost");
|
|
||||||
|
|
||||||
function generateSessionId() {
|
|
||||||
return crypto.randomUUID();
|
|
||||||
}
|
|
||||||
|
|
||||||
loginAuthRoutes.use("/api/login/*", publicRateLimiter);
|
|
||||||
|
|
||||||
// Start a WebAuthn authentication ceremony
|
|
||||||
loginAuthRoutes.post("/api/login/challenge", async (c) => {
|
|
||||||
let body;
|
|
||||||
try {
|
|
||||||
body = await c.req.json();
|
|
||||||
} catch (_err) {
|
|
||||||
body = {};
|
|
||||||
}
|
|
||||||
const username = body.username;
|
|
||||||
let extensions: any = undefined;
|
|
||||||
let allowCredentials: any[] | undefined = undefined;
|
|
||||||
|
|
||||||
if (username) {
|
|
||||||
const user = await sqlWrapper
|
|
||||||
.sql`SELECT id FROM users WHERE username = ${username}`.then((res: any) =>
|
|
||||||
res[0]
|
|
||||||
);
|
|
||||||
if (user) {
|
|
||||||
const passkeys = await sqlWrapper
|
|
||||||
.sql`SELECT credential_id, prf_enabled, prf_salt FROM passkeys WHERE user_id = ${user.id}`;
|
|
||||||
|
|
||||||
if (passkeys.length > 0) {
|
|
||||||
allowCredentials = passkeys.map((pk: any) => ({
|
|
||||||
id: pk.credential_id,
|
|
||||||
type: "public-key",
|
|
||||||
}));
|
|
||||||
|
|
||||||
const prfPasskeys = passkeys.filter((pk: any) =>
|
|
||||||
pk.prf_enabled && pk.prf_salt
|
|
||||||
);
|
|
||||||
if (prfPasskeys.length > 0) {
|
|
||||||
extensions = {
|
|
||||||
["prf" as string]: { evalByCredential: {} },
|
|
||||||
};
|
|
||||||
for (const pk of prfPasskeys) {
|
|
||||||
const saltBytes = decodeBase64Url(pk.prf_salt);
|
|
||||||
extensions["prf"]["evalByCredential"][pk.credential_id] = {
|
|
||||||
first: saltBytes,
|
|
||||||
};
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!rpID) throw new Error("rpID is missing");
|
|
||||||
|
|
||||||
const options = await generateAuthenticationOptions({
|
|
||||||
rpID,
|
|
||||||
userVerification: "preferred",
|
|
||||||
timeout: 60000,
|
|
||||||
allowCredentials,
|
|
||||||
extensions,
|
|
||||||
});
|
|
||||||
|
|
||||||
setCookie(c, "expected_authentication_challenge", options.challenge, {
|
|
||||||
httpOnly: true,
|
|
||||||
secure: true,
|
|
||||||
sameSite: "Lax",
|
|
||||||
maxAge: 300,
|
|
||||||
});
|
|
||||||
|
|
||||||
return c.json({ options });
|
|
||||||
});
|
|
||||||
|
|
||||||
// Verify login and issue session
|
|
||||||
loginAuthRoutes.post("/api/login/verify", async (c) => {
|
|
||||||
const { response } = await c.req.json();
|
|
||||||
|
|
||||||
const expectedChallenge = getCookie(c, "expected_authentication_challenge");
|
|
||||||
if (!expectedChallenge) {
|
|
||||||
return c.json(
|
|
||||||
{ error: "Missing or expired authentication challenge" },
|
|
||||||
400,
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
const base64CredentialID = response.id;
|
|
||||||
|
|
||||||
const passkey = await sqlWrapper
|
|
||||||
.sql`SELECT * FROM passkeys WHERE credential_id = ${base64CredentialID}`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (!passkey) {
|
|
||||||
return c.json({
|
|
||||||
error: "Passkey not found. Please register your passkey first.",
|
|
||||||
}, 404);
|
|
||||||
}
|
|
||||||
|
|
||||||
const user = await sqlWrapper
|
|
||||||
.sql`SELECT id, username, account_status FROM users WHERE id = ${passkey.user_id}`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (!user) {
|
|
||||||
return c.json({ error: "User not found" }, 404);
|
|
||||||
}
|
|
||||||
|
|
||||||
const userId = user.id;
|
|
||||||
|
|
||||||
if (user.account_status !== "active") {
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
userId,
|
|
||||||
"login_failed",
|
|
||||||
null,
|
|
||||||
{ reason: `Account status is ${user.account_status}` },
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
return c.json({
|
|
||||||
error: "Account is not active. Please contact an administrator.",
|
|
||||||
}, 403);
|
|
||||||
}
|
|
||||||
|
|
||||||
const publicKeyBytes = decodeBase64Url(passkey.public_key);
|
|
||||||
|
|
||||||
if (!origin || !rpID) throw new Error("Missing origin or rpID");
|
|
||||||
|
|
||||||
let verification;
|
|
||||||
try {
|
|
||||||
verification = await verifyAuthenticationResponse({
|
|
||||||
response: response as AuthenticationResponseJSON,
|
|
||||||
expectedChallenge,
|
|
||||||
expectedOrigin: origin,
|
|
||||||
expectedRPID: rpID,
|
|
||||||
requireUserVerification: false,
|
|
||||||
credential: {
|
|
||||||
id: passkey.credential_id,
|
|
||||||
publicKey: publicKeyBytes,
|
|
||||||
counter: Number(passkey.counter),
|
|
||||||
},
|
|
||||||
});
|
|
||||||
} catch (error: any) {
|
|
||||||
return c.json({ error: error.message }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
const { verified, authenticationInfo } = verification;
|
|
||||||
if (!verified || !authenticationInfo) {
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
userId,
|
|
||||||
"login_failed",
|
|
||||||
null,
|
|
||||||
{ reason: "verification failed" },
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
return c.json({ error: "Verification failed" }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
await sqlWrapper
|
|
||||||
.sql`UPDATE passkeys SET counter = ${authenticationInfo.newCounter} WHERE id = ${passkey.id}`;
|
|
||||||
|
|
||||||
const sessionId = generateSessionId();
|
|
||||||
const expiresAt = new Date();
|
|
||||||
expiresAt.setDate(expiresAt.getDate() + 7);
|
|
||||||
|
|
||||||
// Persistence in PostgreSQL
|
|
||||||
await sqlWrapper
|
|
||||||
.sql`INSERT INTO sessions (id, user_id, expires_at) VALUES (${sessionId}, ${user.id}, ${expiresAt})`;
|
|
||||||
|
|
||||||
// Write session to Valkey with TTL matching expiresAt
|
|
||||||
const ttlSeconds = Math.floor((expiresAt.getTime() - Date.now()) / 1000);
|
|
||||||
try {
|
|
||||||
const sessionData = JSON.stringify({
|
|
||||||
uuid: user.id,
|
|
||||||
username: user.username,
|
|
||||||
});
|
|
||||||
await valkey.setex(sessionId, ttlSeconds, sessionData);
|
|
||||||
} catch (_err: unknown) {
|
|
||||||
// If Valkey fails, log and fail closed for security
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
user.id,
|
|
||||||
"login_failed",
|
|
||||||
null,
|
|
||||||
{ reason: "Cache write failure" },
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
return c.json({ error: "Internal server error" }, 500);
|
|
||||||
}
|
|
||||||
|
|
||||||
const oldSessionIds = extractAllSessionIds(c);
|
|
||||||
if (oldSessionIds.length > 0) {
|
|
||||||
for (const old of oldSessionIds) {
|
|
||||||
try {
|
|
||||||
await valkey.del(old);
|
|
||||||
await sqlWrapper.sql`DELETE FROM sessions WHERE id = ${old}`;
|
|
||||||
} catch (_e) {}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
const cookieDomain = getCookieDomain(rpID);
|
|
||||||
|
|
||||||
setCookie(c, "session_id", sessionId, {
|
|
||||||
domain: cookieDomain,
|
|
||||||
path: "/",
|
|
||||||
httpOnly: true,
|
|
||||||
secure: true,
|
|
||||||
sameSite: "Lax",
|
|
||||||
expires: expiresAt,
|
|
||||||
});
|
|
||||||
|
|
||||||
setCookie(c, "expected_authentication_challenge", "", {
|
|
||||||
httpOnly: true,
|
|
||||||
secure: true,
|
|
||||||
sameSite: "Lax",
|
|
||||||
maxAge: 0,
|
|
||||||
});
|
|
||||||
|
|
||||||
auditWrapper.auditLog(userId, "login_success", null, null, getClientIp(c));
|
|
||||||
|
|
||||||
return c.json({ success: true });
|
|
||||||
});
|
|
||||||
@ -1,268 +0,0 @@
|
|||||||
import { Hono } from "jsr:@hono/hono@4";
|
|
||||||
import { getCookie, setCookie } from "jsr:@hono/hono@4/cookie";
|
|
||||||
import { encodeBase64Url } from "jsr:@std/encoding@1/base64url";
|
|
||||||
import {
|
|
||||||
generateRegistrationOptions,
|
|
||||||
MetadataService,
|
|
||||||
verifyRegistrationResponse,
|
|
||||||
} from "jsr:@simplewebauthn/server@13";
|
|
||||||
import type { RegistrationResponseJSON } from "jsr:@simplewebauthn/server@13";
|
|
||||||
|
|
||||||
import { sqlWrapper } from "../../db.ts";
|
|
||||||
import { auditWrapper } from "../../audit.ts";
|
|
||||||
import {
|
|
||||||
getAuthenticatedUser,
|
|
||||||
requirePrimarySession,
|
|
||||||
} from "../../auth-session.ts";
|
|
||||||
import { getClientIp } from "../../middleware.ts";
|
|
||||||
|
|
||||||
export const passkeysAuthRoutes = new Hono();
|
|
||||||
|
|
||||||
const rpName = "Auth-Yes Identity Provider";
|
|
||||||
const rpID = Deno.env.get("RP_ID") ||
|
|
||||||
(import.meta.main ? undefined : "localhost");
|
|
||||||
const origin = Deno.env.get("ORIGIN") ||
|
|
||||||
(import.meta.main ? undefined : "http://localhost");
|
|
||||||
const requireHardwareToken = Deno.env.get("REQUIRE_HARDWARE_TOKEN") === "true";
|
|
||||||
|
|
||||||
passkeysAuthRoutes.use("/api/passkeys/*", requirePrimarySession);
|
|
||||||
|
|
||||||
// ---------------------------------------------------------
|
|
||||||
// Authenticated Passkey Registration (Adding a new device)
|
|
||||||
// ---------------------------------------------------------
|
|
||||||
|
|
||||||
passkeysAuthRoutes.post("/api/passkeys/register/challenge", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const user = await sqlWrapper
|
|
||||||
.sql`SELECT username FROM users WHERE id = ${auth.userId}`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (!user) return c.json({ error: "User not found" }, 404);
|
|
||||||
|
|
||||||
const userIdBytes = new TextEncoder().encode(auth.userId);
|
|
||||||
|
|
||||||
if (!rpID) throw new Error("rpID is missing");
|
|
||||||
|
|
||||||
const options = await generateRegistrationOptions({
|
|
||||||
rpName,
|
|
||||||
rpID,
|
|
||||||
userName: user.username,
|
|
||||||
userID: userIdBytes,
|
|
||||||
attestationType: "direct",
|
|
||||||
authenticatorSelection: {
|
|
||||||
residentKey: "required",
|
|
||||||
requireResidentKey: true,
|
|
||||||
userVerification: "preferred",
|
|
||||||
},
|
|
||||||
timeout: 60000,
|
|
||||||
});
|
|
||||||
|
|
||||||
setCookie(c, "expected_add_passkey_challenge", options.challenge, {
|
|
||||||
httpOnly: true,
|
|
||||||
secure: true,
|
|
||||||
sameSite: "Lax",
|
|
||||||
maxAge: 300,
|
|
||||||
});
|
|
||||||
|
|
||||||
return c.json({ options });
|
|
||||||
});
|
|
||||||
|
|
||||||
passkeysAuthRoutes.post("/api/passkeys/register/verify", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const { response } = await c.req.json();
|
|
||||||
const expectedChallenge = getCookie(c, "expected_add_passkey_challenge");
|
|
||||||
|
|
||||||
if (!expectedChallenge) {
|
|
||||||
return c.json({ error: "Missing or expired registration challenge" }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!origin || !rpID) throw new Error("Missing origin or rpID");
|
|
||||||
|
|
||||||
let verification;
|
|
||||||
try {
|
|
||||||
verification = await verifyRegistrationResponse({
|
|
||||||
response: response as RegistrationResponseJSON,
|
|
||||||
expectedChallenge,
|
|
||||||
expectedOrigin: origin,
|
|
||||||
expectedRPID: rpID,
|
|
||||||
requireUserVerification: false,
|
|
||||||
});
|
|
||||||
} catch (error: any) {
|
|
||||||
return c.json({ error: error.message }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
const { verified, registrationInfo } = verification;
|
|
||||||
if (!verified || !registrationInfo) {
|
|
||||||
return c.json({ error: "Verification failed" }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Enterprise Allow-List Verification
|
|
||||||
const allowlistCount = await sqlWrapper
|
|
||||||
.sql`SELECT COUNT(*) as count FROM aaguid_allowlist`.then((res: any) =>
|
|
||||||
Number(res[0].count)
|
|
||||||
);
|
|
||||||
if (allowlistCount > 0 && registrationInfo.aaguid) {
|
|
||||||
const isAllowed = await sqlWrapper
|
|
||||||
.sql`SELECT id FROM aaguid_allowlist WHERE aaguid = ${registrationInfo.aaguid}`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (!isAllowed) {
|
|
||||||
auditWrapper.auditLog(auth.userId, "failed_attestation_allowlist", null, {
|
|
||||||
aaguid: registrationInfo.aaguid,
|
|
||||||
}, getClientIp(c));
|
|
||||||
return c.json({
|
|
||||||
error: "Authenticator AAGUID is not in the enterprise allow-list.",
|
|
||||||
}, 403);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Optional Strict Hardware Attestation
|
|
||||||
if (requireHardwareToken) {
|
|
||||||
if (
|
|
||||||
!registrationInfo.aaguid ||
|
|
||||||
registrationInfo.aaguid === "00000000-0000-0000-0000-000000000000"
|
|
||||||
) {
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"add_passkey_failed_attestation",
|
|
||||||
null,
|
|
||||||
{
|
|
||||||
reason: "No AAGUID provided",
|
|
||||||
},
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
return c.json(
|
|
||||||
{ error: "Hardware attestation failed: No AAGUID provided." },
|
|
||||||
403,
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
let mdsStatement;
|
|
||||||
try {
|
|
||||||
mdsStatement = await MetadataService.getStatement(
|
|
||||||
registrationInfo.aaguid,
|
|
||||||
);
|
|
||||||
} catch (mdsError) {
|
|
||||||
console.warn("[Auth API] MetadataService lookup error:", mdsError);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!mdsStatement) {
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"add_passkey_failed_attestation",
|
|
||||||
null,
|
|
||||||
{
|
|
||||||
aaguid: registrationInfo.aaguid,
|
|
||||||
reason: "AAGUID not found in MDS3",
|
|
||||||
},
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
return c.json({
|
|
||||||
error:
|
|
||||||
`Hardware attestation failed: Authenticator AAGUID (${registrationInfo.aaguid}) not found in FIDO MDS3 blob.`,
|
|
||||||
}, 403);
|
|
||||||
}
|
|
||||||
|
|
||||||
// @ts-ignore: FIDO MDS3 missing type
|
|
||||||
if (mdsStatement.keyProtection?.includes(0x0001)) {
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"add_passkey_failed_attestation",
|
|
||||||
null,
|
|
||||||
{
|
|
||||||
aaguid: registrationInfo.aaguid,
|
|
||||||
reason: "Software passkey detected",
|
|
||||||
},
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
return c.json({
|
|
||||||
error:
|
|
||||||
"Hardware attestation failed: Authenticator is flagged as a software-based passkey.",
|
|
||||||
}, 403);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
const credentialID = registrationInfo.credential.id;
|
|
||||||
const credentialPublicKey = registrationInfo.credential.publicKey;
|
|
||||||
const counter = registrationInfo.credential.counter;
|
|
||||||
|
|
||||||
const base64CredentialID = typeof credentialID === "string"
|
|
||||||
? credentialID
|
|
||||||
: encodeBase64Url(new Uint8Array(credentialID as unknown as ArrayBuffer));
|
|
||||||
const base64PublicKey = encodeBase64Url(
|
|
||||||
new Uint8Array(credentialPublicKey as unknown as ArrayBuffer),
|
|
||||||
);
|
|
||||||
|
|
||||||
await sqlWrapper.sql`
|
|
||||||
INSERT INTO passkeys (user_id, credential_id, public_key, counter)
|
|
||||||
VALUES (${auth.userId}, ${base64CredentialID}, ${base64PublicKey}, ${counter})
|
|
||||||
`;
|
|
||||||
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
auth.userId,
|
|
||||||
"passkey_added",
|
|
||||||
null,
|
|
||||||
null,
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
|
|
||||||
setCookie(c, "expected_add_passkey_challenge", "", {
|
|
||||||
httpOnly: true,
|
|
||||||
secure: true,
|
|
||||||
sameSite: "Lax",
|
|
||||||
maxAge: 0,
|
|
||||||
});
|
|
||||||
|
|
||||||
return c.json({ success: true });
|
|
||||||
});
|
|
||||||
|
|
||||||
// Get user's registered passkeys
|
|
||||||
passkeysAuthRoutes.get("/api/passkeys", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const passkeys = await sqlWrapper.sql`
|
|
||||||
SELECT id, counter
|
|
||||||
FROM passkeys
|
|
||||||
WHERE user_id = ${auth.userId}
|
|
||||||
`;
|
|
||||||
|
|
||||||
return c.json({ passkeys });
|
|
||||||
});
|
|
||||||
|
|
||||||
// Revoke a specific passkey
|
|
||||||
passkeysAuthRoutes.delete("/api/passkeys/:id", async (c) => {
|
|
||||||
const auth = await getAuthenticatedUser(c);
|
|
||||||
if (!auth) return c.json({ error: "Unauthorized" }, 401);
|
|
||||||
|
|
||||||
const targetPasskeyId = c.req.param("id");
|
|
||||||
|
|
||||||
// Verify the passkey belongs to the user
|
|
||||||
const passkey = await sqlWrapper.sql`
|
|
||||||
SELECT id FROM passkeys WHERE id = ${targetPasskeyId} AND user_id = ${auth.userId}
|
|
||||||
`.then((res: any) => res[0]);
|
|
||||||
|
|
||||||
if (!passkey) {
|
|
||||||
return c.json({ error: "Passkey not found or access denied" }, 404);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Prevent deleting the very last passkey to avoid locking out the user
|
|
||||||
const passkeyCount = await sqlWrapper.sql`
|
|
||||||
SELECT count(*) as count FROM passkeys WHERE user_id = ${auth.userId}
|
|
||||||
`.then((res: any) => Number(res[0].count));
|
|
||||||
|
|
||||||
if (passkeyCount <= 1) {
|
|
||||||
return c.json({
|
|
||||||
error: "Cannot delete your last passkey. Register another one first.",
|
|
||||||
}, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
await sqlWrapper.sql`DELETE FROM passkeys WHERE id = ${targetPasskeyId}`;
|
|
||||||
|
|
||||||
auditWrapper.auditLog(auth.userId, "passkey_revoked", null, {
|
|
||||||
revoked_passkey_id: targetPasskeyId,
|
|
||||||
}, getClientIp(c));
|
|
||||||
|
|
||||||
return c.json({ success: true });
|
|
||||||
});
|
|
||||||
@ -1,369 +0,0 @@
|
|||||||
import { Hono } from "jsr:@hono/hono@4";
|
|
||||||
import { deleteCookie, getCookie, setCookie } from "jsr:@hono/hono@4/cookie";
|
|
||||||
import { encodeBase64Url } from "jsr:@std/encoding@1/base64url";
|
|
||||||
import {
|
|
||||||
generateRegistrationOptions,
|
|
||||||
MetadataService,
|
|
||||||
verifyRegistrationResponse,
|
|
||||||
} from "jsr:@simplewebauthn/server@13";
|
|
||||||
import type { RegistrationResponseJSON } from "jsr:@simplewebauthn/server@13";
|
|
||||||
|
|
||||||
import { sqlWrapper } from "../../db.ts";
|
|
||||||
import { valkey } from "../../valkey.ts";
|
|
||||||
import { auditWrapper } from "../../audit.ts";
|
|
||||||
import { getClientIp, publicRateLimiter } from "../../middleware.ts";
|
|
||||||
import { getCookieDomain } from "./utils.ts";
|
|
||||||
|
|
||||||
export const registerAuthRoutes = new Hono();
|
|
||||||
|
|
||||||
const rpName = "Auth-Yes Identity Provider";
|
|
||||||
const rpID = Deno.env.get("RP_ID") ||
|
|
||||||
(import.meta.main ? undefined : "localhost");
|
|
||||||
const origin = Deno.env.get("ORIGIN") ||
|
|
||||||
(import.meta.main ? undefined : "http://localhost");
|
|
||||||
const requireHardwareToken = Deno.env.get("REQUIRE_HARDWARE_TOKEN") === "true";
|
|
||||||
|
|
||||||
registerAuthRoutes.use("/api/register/*", publicRateLimiter);
|
|
||||||
|
|
||||||
registerAuthRoutes.get("/.well-known/webauthn", (c) => {
|
|
||||||
if (!origin) {
|
|
||||||
return c.json({ origins: [] });
|
|
||||||
}
|
|
||||||
return c.json({ origins: [origin] });
|
|
||||||
});
|
|
||||||
|
|
||||||
// Start a WebAuthn registration ceremony
|
|
||||||
registerAuthRoutes.post("/api/register/challenge", async (c) => {
|
|
||||||
const { username, inviteCode } = await c.req.json();
|
|
||||||
|
|
||||||
if (!username || !inviteCode) {
|
|
||||||
return c.json({ error: "Username and inviteCode required" }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Validate invite code early (checks expiration and max_uses bounds)
|
|
||||||
const invite = await sqlWrapper
|
|
||||||
.sql`SELECT id, max_uses, uses_count, auto_activate FROM invites WHERE code = ${inviteCode} AND (max_uses IS NULL OR uses_count < max_uses) AND expires_at > NOW()`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (!invite) {
|
|
||||||
return c.json(
|
|
||||||
{ error: "Invalid, expired, or fully claimed invite code" },
|
|
||||||
400,
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Prevent hijacking an existing user's account if they already exist
|
|
||||||
const existingUser = await sqlWrapper
|
|
||||||
.sql`SELECT id FROM users WHERE username = ${username}`.then((res: any) =>
|
|
||||||
res[0]
|
|
||||||
);
|
|
||||||
if (existingUser) {
|
|
||||||
return c.json({ error: "Username already exists" }, 409);
|
|
||||||
}
|
|
||||||
|
|
||||||
const newUserId = crypto.randomUUID();
|
|
||||||
const userIdBytes = new TextEncoder().encode(newUserId);
|
|
||||||
|
|
||||||
if (!rpID) throw new Error("rpID is missing");
|
|
||||||
|
|
||||||
const options = await generateRegistrationOptions({
|
|
||||||
rpName,
|
|
||||||
rpID,
|
|
||||||
userName: username,
|
|
||||||
userID: userIdBytes,
|
|
||||||
attestationType: "direct",
|
|
||||||
authenticatorSelection: {
|
|
||||||
residentKey: "required",
|
|
||||||
requireResidentKey: true,
|
|
||||||
userVerification: "preferred",
|
|
||||||
},
|
|
||||||
timeout: 60000,
|
|
||||||
extensions: {
|
|
||||||
["prf" as string]: {},
|
|
||||||
} as any,
|
|
||||||
});
|
|
||||||
|
|
||||||
setCookie(c, "expected_registration_challenge", options.challenge, {
|
|
||||||
httpOnly: true,
|
|
||||||
secure: true,
|
|
||||||
sameSite: "Lax",
|
|
||||||
maxAge: 300,
|
|
||||||
});
|
|
||||||
|
|
||||||
setCookie(c, "registration_user_id", newUserId, {
|
|
||||||
httpOnly: true,
|
|
||||||
secure: true,
|
|
||||||
sameSite: "Lax",
|
|
||||||
maxAge: 300,
|
|
||||||
});
|
|
||||||
|
|
||||||
return c.json({ options, username });
|
|
||||||
});
|
|
||||||
|
|
||||||
// Verify registration and create UUID/session
|
|
||||||
registerAuthRoutes.post("/api/register/verify", async (c) => {
|
|
||||||
try {
|
|
||||||
const { response, username, inviteCode, upgrade_session } = await c.req
|
|
||||||
.json();
|
|
||||||
|
|
||||||
if (!inviteCode && !upgrade_session) {
|
|
||||||
return c.json({ error: "inviteCode or upgrade_session required" }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
const expectedChallenge = getCookie(c, "expected_registration_challenge");
|
|
||||||
const registrationUserId = getCookie(c, "registration_user_id");
|
|
||||||
if (!expectedChallenge || !registrationUserId) {
|
|
||||||
return c.json({
|
|
||||||
error: "Missing or expired registration challenge/user ID",
|
|
||||||
}, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Prevent race condition account hijacking
|
|
||||||
let user = await sqlWrapper
|
|
||||||
.sql`SELECT id FROM users WHERE username = ${username}`
|
|
||||||
.then(
|
|
||||||
(res: any) => res[0],
|
|
||||||
);
|
|
||||||
if (user) {
|
|
||||||
return c.json({ error: "Username already exists" }, 409);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!origin || !rpID) throw new Error("Missing origin or rpID");
|
|
||||||
|
|
||||||
let verification;
|
|
||||||
try {
|
|
||||||
verification = await verifyRegistrationResponse({
|
|
||||||
response: response as RegistrationResponseJSON,
|
|
||||||
expectedChallenge,
|
|
||||||
expectedOrigin: origin,
|
|
||||||
expectedRPID: rpID,
|
|
||||||
requireUserVerification: false,
|
|
||||||
});
|
|
||||||
} catch (error: any) {
|
|
||||||
return c.json({ error: error.message }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
const { verified, registrationInfo } = verification;
|
|
||||||
if (!verified || !registrationInfo) {
|
|
||||||
return c.json({ error: "Verification failed" }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Enterprise Allow-List Verification
|
|
||||||
const allowlistCount = await sqlWrapper
|
|
||||||
.sql`SELECT COUNT(*) as count FROM aaguid_allowlist`.then((res: any) =>
|
|
||||||
Number(res[0].count)
|
|
||||||
);
|
|
||||||
if (allowlistCount > 0 && registrationInfo.aaguid) {
|
|
||||||
const isAllowed = await sqlWrapper
|
|
||||||
.sql`SELECT id FROM aaguid_allowlist WHERE aaguid = ${registrationInfo.aaguid}`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (!isAllowed) {
|
|
||||||
auditWrapper.auditLog(null, "failed_attestation_allowlist", null, {
|
|
||||||
aaguid: registrationInfo.aaguid,
|
|
||||||
}, getClientIp(c));
|
|
||||||
return c.json({
|
|
||||||
error: "Authenticator AAGUID is not in the enterprise allow-list.",
|
|
||||||
}, 403);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Optional Strict Hardware Attestation (e.g. YubiKey-only)
|
|
||||||
if (requireHardwareToken) {
|
|
||||||
if (
|
|
||||||
!registrationInfo.aaguid ||
|
|
||||||
registrationInfo.aaguid === "00000000-0000-0000-0000-000000000000"
|
|
||||||
) {
|
|
||||||
auditWrapper.auditLog(null, "registration_failed_attestation", null, {
|
|
||||||
username,
|
|
||||||
reason: "No AAGUID provided",
|
|
||||||
}, getClientIp(c));
|
|
||||||
return c.json({
|
|
||||||
error:
|
|
||||||
"Hardware attestation failed: No AAGUID provided. Only certified hardware security keys are permitted.",
|
|
||||||
}, 403);
|
|
||||||
}
|
|
||||||
|
|
||||||
let mdsStatement;
|
|
||||||
try {
|
|
||||||
mdsStatement = await MetadataService.getStatement(
|
|
||||||
registrationInfo.aaguid,
|
|
||||||
);
|
|
||||||
} catch (mdsError) {
|
|
||||||
console.warn("[Auth API] MetadataService lookup error:", mdsError);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!mdsStatement) {
|
|
||||||
auditWrapper.auditLog(null, "registration_failed_attestation", null, {
|
|
||||||
username,
|
|
||||||
aaguid: registrationInfo.aaguid,
|
|
||||||
reason: "AAGUID not found in MDS3",
|
|
||||||
}, getClientIp(c));
|
|
||||||
return c.json({
|
|
||||||
error:
|
|
||||||
`Hardware attestation failed: Authenticator AAGUID (${registrationInfo.aaguid}) not found in FIDO MDS3 blob. Only certified hardware security keys are permitted.`,
|
|
||||||
}, 403);
|
|
||||||
}
|
|
||||||
|
|
||||||
// @ts-ignore: TypeScript definition might be out of date for FIDO MDS3 (1)
|
|
||||||
if (mdsStatement.keyProtection?.includes(0x0001)) {
|
|
||||||
auditWrapper.auditLog(null, "registration_failed_attestation", null, {
|
|
||||||
username,
|
|
||||||
aaguid: registrationInfo.aaguid,
|
|
||||||
reason: "Software passkey detected",
|
|
||||||
}, getClientIp(c));
|
|
||||||
return c.json({
|
|
||||||
error:
|
|
||||||
"Hardware attestation failed: Authenticator is flagged as a software-based passkey. Only certified hardware security keys are permitted.",
|
|
||||||
}, 403);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
const credentialID = registrationInfo.credential.id;
|
|
||||||
const credentialPublicKey = registrationInfo.credential.publicKey;
|
|
||||||
const counter = registrationInfo.credential.counter;
|
|
||||||
|
|
||||||
const base64CredentialID = typeof credentialID === "string"
|
|
||||||
? credentialID
|
|
||||||
: encodeBase64Url(new Uint8Array(credentialID as unknown as ArrayBuffer));
|
|
||||||
const base64PublicKey = encodeBase64Url(
|
|
||||||
new Uint8Array(credentialPublicKey as unknown as ArrayBuffer),
|
|
||||||
);
|
|
||||||
|
|
||||||
const prfEnabled =
|
|
||||||
(response.clientExtensionResults as any)?.prf?.enabled === true;
|
|
||||||
let prfSalt = null;
|
|
||||||
if (prfEnabled) {
|
|
||||||
const saltBytes = crypto.getRandomValues(new Uint8Array(32));
|
|
||||||
prfSalt = encodeBase64Url(saltBytes);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (upgrade_session) {
|
|
||||||
// Ephemeral Guest Sandbox in-flight promotion
|
|
||||||
const sessionDataStr = await valkey.get(upgrade_session);
|
|
||||||
if (!sessionDataStr) {
|
|
||||||
return c.json({ error: "Invalid or expired guest session" }, 400);
|
|
||||||
}
|
|
||||||
const sessionData = JSON.parse(sessionDataStr);
|
|
||||||
if (
|
|
||||||
!sessionData || !sessionData.uuid ||
|
|
||||||
sessionData.account_status !== "guest"
|
|
||||||
) {
|
|
||||||
return c.json({ error: "Invalid guest session state" }, 400);
|
|
||||||
}
|
|
||||||
|
|
||||||
const guestUuid = sessionData.uuid;
|
|
||||||
|
|
||||||
const insertRes = await sqlWrapper
|
|
||||||
.sql`INSERT INTO users (id, username, account_status) VALUES (${guestUuid}, ${username}, 'active') RETURNING id`;
|
|
||||||
user = insertRes[0];
|
|
||||||
|
|
||||||
await sqlWrapper.sql`
|
|
||||||
INSERT INTO passkeys (user_id, credential_id, public_key, counter, prf_enabled, prf_salt)
|
|
||||||
VALUES (${user.id}, ${base64CredentialID}, ${base64PublicKey}, ${counter}, ${prfEnabled}, ${prfSalt})
|
|
||||||
`;
|
|
||||||
|
|
||||||
// Promote Valkey session
|
|
||||||
await valkey.setex(
|
|
||||||
upgrade_session,
|
|
||||||
28800, // Upgrade TTL to 8 hours
|
|
||||||
JSON.stringify({ uuid: guestUuid, username, account_status: "active" }),
|
|
||||||
);
|
|
||||||
|
|
||||||
// Register session in PostgreSQL
|
|
||||||
const expiresAt = new Date(Date.now() + 8 * 60 * 60 * 1000);
|
|
||||||
await sqlWrapper.sql`
|
|
||||||
INSERT INTO sessions (id, user_id, expires_at)
|
|
||||||
VALUES (${upgrade_session}, ${user.id}, ${expiresAt})
|
|
||||||
`;
|
|
||||||
} else {
|
|
||||||
// Standard Registration Flow
|
|
||||||
const invite = await sqlWrapper
|
|
||||||
.sql`SELECT id, app_id, role, max_uses, uses_count, auto_activate FROM invites WHERE code = ${inviteCode} AND (max_uses IS NULL OR uses_count < max_uses) AND expires_at > NOW()`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (!invite) {
|
|
||||||
return c.json(
|
|
||||||
{ error: "Invalid, expired, or fully claimed invite code" },
|
|
||||||
400,
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
const initialStatus = invite.auto_activate === false
|
|
||||||
? "pending"
|
|
||||||
: "active";
|
|
||||||
const insertRes = await sqlWrapper
|
|
||||||
.sql`INSERT INTO users (id, username, account_status) VALUES (${registrationUserId}, ${username}, ${initialStatus}) RETURNING id`;
|
|
||||||
user = insertRes[0];
|
|
||||||
|
|
||||||
await sqlWrapper.sql`
|
|
||||||
INSERT INTO passkeys (user_id, credential_id, public_key, counter, prf_enabled, prf_salt)
|
|
||||||
VALUES (${user.id}, ${base64CredentialID}, ${base64PublicKey}, ${counter}, ${prfEnabled}, ${prfSalt})
|
|
||||||
`;
|
|
||||||
|
|
||||||
await sqlWrapper.sql`
|
|
||||||
UPDATE invites
|
|
||||||
SET uses_count = uses_count + 1,
|
|
||||||
used_at = NOW(),
|
|
||||||
used_by = ${user.id}
|
|
||||||
WHERE id = ${invite.id}
|
|
||||||
`;
|
|
||||||
|
|
||||||
await sqlWrapper.sql`
|
|
||||||
INSERT INTO invite_redemptions (invite_id, user_id)
|
|
||||||
VALUES (${invite.id}, ${user.id})
|
|
||||||
`;
|
|
||||||
|
|
||||||
if (invite.app_id) {
|
|
||||||
await sqlWrapper.sql`
|
|
||||||
INSERT INTO grants (user_id, app_id, role)
|
|
||||||
VALUES (${user.id}, ${invite.app_id}, ${invite.role})
|
|
||||||
`;
|
|
||||||
} else if (invite.role === "admin") {
|
|
||||||
const adminApp = await sqlWrapper
|
|
||||||
.sql`SELECT id FROM apps WHERE name = 'Auth-Yes Management Console'`
|
|
||||||
.then((res: any) => res[0]);
|
|
||||||
if (adminApp) {
|
|
||||||
await sqlWrapper.sql`
|
|
||||||
INSERT INTO grants (user_id, app_id, role)
|
|
||||||
VALUES (${user.id}, ${adminApp.id}, 'admin')
|
|
||||||
ON CONFLICT (user_id, app_id) DO UPDATE SET role = 'admin'
|
|
||||||
`;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
auditWrapper.auditLog(
|
|
||||||
user.id,
|
|
||||||
"user_registered",
|
|
||||||
null,
|
|
||||||
{ username, inviteCode },
|
|
||||||
getClientIp(c),
|
|
||||||
);
|
|
||||||
|
|
||||||
// Set response cookie to clear out the challenge
|
|
||||||
setCookie(c, "expected_registration_challenge", "", {
|
|
||||||
httpOnly: true,
|
|
||||||
secure: true,
|
|
||||||
sameSite: "Lax",
|
|
||||||
maxAge: 0,
|
|
||||||
});
|
|
||||||
|
|
||||||
setCookie(c, "registration_user_id", "", {
|
|
||||||
httpOnly: true,
|
|
||||||
secure: true,
|
|
||||||
sameSite: "Lax",
|
|
||||||
maxAge: 0,
|
|
||||||
});
|
|
||||||
|
|
||||||
const cookieDomain = getCookieDomain(rpID);
|
|
||||||
if (cookieDomain) {
|
|
||||||
deleteCookie(c, "session_id", { domain: cookieDomain, path: "/" });
|
|
||||||
}
|
|
||||||
deleteCookie(c, "session_id", { path: "/" });
|
|
||||||
|
|
||||||
return c.json({ success: true });
|
|
||||||
} catch (error: any) {
|
|
||||||
console.error(
|
|
||||||
"[Auth API] Uncaught Exception in /api/register/verify:",
|
|
||||||
error,
|
|
||||||
);
|
|
||||||
return c.json({ error: error.message || "Internal server error" }, 500);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
@ -1,15 +0,0 @@
|
|||||||
export function getCookieDomain(customRpId?: string): string | undefined {
|
|
||||||
const envDomain = Deno.env.get("COOKIE_DOMAIN");
|
|
||||||
if (envDomain) {
|
|
||||||
return envDomain.startsWith(".") ? envDomain : `.${envDomain}`;
|
|
||||||
}
|
|
||||||
const targetId = customRpId || Deno.env.get("RP_ID") || "";
|
|
||||||
if (!targetId || !targetId.includes(".") || targetId === "localhost") {
|
|
||||||
return undefined;
|
|
||||||
}
|
|
||||||
const parts = targetId.split(".").filter(Boolean);
|
|
||||||
if (parts.length >= 2) {
|
|
||||||
return `.${parts.slice(-2).join(".")}`;
|
|
||||||
}
|
|
||||||
return `.${targetId}`;
|
|
||||||
}
|
|
||||||
Loading…
x
Reference in New Issue
Block a user