tylerg/auth-yes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: tylerg:9c98e2f2fb85f34a9c5d06fa0188813d9f1832b4
Branches Tags
tylerg:main
tylerg:meta-state
tylerg:feat/phase-5a-runtime-switchover
tylerg:feat/phase-4-architectural-test-suite
tylerg:refactor/core-self-containment-and-domain-isolation
tylerg:feat/phase-3-realtime-slices-and-scripts-removal
tylerg:backup/jules-phase3-wip-5556705001895338576
tylerg:feat/phase-2-vertical-slices-and-shared-ui
tylerg:backup/jules-phase2-wip-11517737062236195450
tylerg:feat/ui-admin-decomposition-wip
tylerg:monolith-decomposition-phase-2-5222039191988798562
tylerg:sec/zero-trust-scope-guards
tylerg:feat/event-passes-and-magic-links
..
compare: tylerg:e7a2aa8df39957f333161d994508ee208e67168a
Branches Tags
tylerg:meta-state
tylerg:main
tylerg:feat/phase-5a-runtime-switchover
tylerg:feat/phase-4-architectural-test-suite
tylerg:refactor/core-self-containment-and-domain-isolation
tylerg:feat/phase-3-realtime-slices-and-scripts-removal
tylerg:backup/jules-phase3-wip-5556705001895338576
tylerg:feat/phase-2-vertical-slices-and-shared-ui
tylerg:backup/jules-phase2-wip-11517737062236195450
tylerg:feat/ui-admin-decomposition-wip
tylerg:monolith-decomposition-phase-2-5222039191988798562
tylerg:sec/zero-trust-scope-guards
tylerg:feat/event-passes-and-magic-links

No commits in common. "9c98e2f2fb85f34a9c5d06fa0188813d9f1832b4" and "e7a2aa8df39957f333161d994508ee208e67168a" have entirely different histories.
9c98e2f2fb ... e7a2aa8df3

22 changed files with 2527 additions and 2703 deletions
Show Stats Expand all files Collapse all files

764
infra/setup/cli.ts
View File

@ -1,15 +1,303 @@
import { Command } from "jsr:@cliffy/command@1.0.0-rc.7";
import { Input, Secret, Select } from "jsr:@cliffy/prompt@1.0.0-rc.7";
import * as colors from "jsr:@std/fmt@0.225.2/colors";
import { runSetupWizard } from "./prompts/wizard.ts";
import { authCommand } from "./commands/auth.ts";
import { testCommand } from "./commands/test.ts";
import {
buildCommand,
compileProtoCommand,
releaseCommand,
} from "./commands/build.ts";
import { dumpComposeCommand, dumpEnvCommand } from "./commands/compose.ts";
import { secretsCommand } from "./commands/secrets.ts";
generateDockerCompose,
generateSpireDockerCompose,
} from "./compose.ts";
import {
AuthSetupConfig,
COMPOSE_PATH,
DEFAULT_AUTH_CONFIG,
ENV_PATH,
generateEnv,
generateSpireEnv,
readEnv,
SPIRE_COMPOSE_PATH,
SPIRE_ENV_PATH,
} from "./env.ts";
import {
downloadWorkloadProto,
executeBuildImage,
executeProtobufCompilation,
generateBuildCommands,
} from "./build.ts";
export async function generateAuthSetupFiles(
config: AuthSetupConfig,
): Promise<void> {
const envContent = generateEnv(config);
await Deno.writeTextFile(ENV_PATH, envContent);
const spireEnvContent = generateSpireEnv(config);
await Deno.writeTextFile(SPIRE_ENV_PATH, spireEnvContent);
const composeContent = generateDockerCompose();
await Deno.writeTextFile(COMPOSE_PATH, composeContent);
const spireComposeContent = generateSpireDockerCompose();
await Deno.writeTextFile(SPIRE_COMPOSE_PATH, spireComposeContent);
console.log(
colors.green(
`\n✓ Successfully generated ${ENV_PATH}, ${SPIRE_ENV_PATH}, ${COMPOSE_PATH}, and ${SPIRE_COMPOSE_PATH}!`,
),
);
console.log(
colors.green("Setup complete. You may deploy your stacks by running:\n"),
);
console.log(
colors.cyan(
"1. Deploy SPIRE Stack:\n" +
" podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml up -d\n\n" +
"2. Deploy Auth-Yes Stack:\n" +
" podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
),
);
}
export async function handleAuthSetup(
currentConfig: AuthSetupConfig,
): Promise<AuthSetupConfig> {
console.log(
colors.gray(
"Please provide the following Auth Yes configuration details.\n",
),
);
const reg = await Input.prompt({
message: "Enter the Primary Container Registry URL:",
default: currentConfig.reg,
});
const ghcrReg = await Input.prompt({
message: "Enter the GHCR Mirror Registry URL (for SPIRE):",
default: currentConfig.ghcrReg || "ghcr.atyg.org",
});
const domainName = await Input.prompt({
message: "Enter the Auth Domain Name:",
hint: "E.g., auth.system.local",
default: currentConfig.domainName,
});
const dbDataPath = await Input.prompt({
message: "Enter the Database Path on the Host:",
default: currentConfig.dbDataPath,
});
const spireDataPath = await Input.prompt({
message: "Enter the SPIRE Path on the Host:",
default: currentConfig.spireDataPath,
});
const appSecret = await Secret.prompt({
message: "Enter the App Secret for the IDP:",
default: currentConfig.appSecret,
minLength: 16,
});
const pwdMessage = currentConfig.dbPassword
? "Enter the PostgreSQL database password: (Leave blank to keep existing password)"
: "Enter the PostgreSQL database password:";
const pwdInput = await Secret.prompt({
message: pwdMessage,
minLength: currentConfig.dbPassword ? 0 : 1,
});
const dbPassword = pwdInput === "" && currentConfig.dbPassword !== ""
? currentConfig.dbPassword
: pwdInput;
const newConfig: AuthSetupConfig = {
reg,
ghcrReg,
domainName,
dbPassword,
dbDataPath,
spireDataPath,
appSecret,
};
await generateAuthSetupFiles(newConfig);
return newConfig;
}
export async function handleTestConnection(domainName: string): Promise<void> {
console.log(
colors.bold(
colors.blue(`\n=== Testing Auth Connection (https://${domainName}) ===`),
),
);
try {
const controller = new AbortController();
const timeoutId = setTimeout(() => controller.abort(), 5000);
const res1 = await fetch(`https://${domainName}/`, {
signal: controller.signal,
});
clearTimeout(timeoutId);
if (res1.status === 502 || res1.status === 503 || res1.status === 504) {
throw new Error(`Gateway error: ${res1.status}`);
}
if (res1.body) {
await res1.body.cancel();
}
console.log(
colors.green(
`✓ Auth service is up and reachable at https://${domainName}/`,
),
);
} catch (error) {
console.log(
colors.red(
`✗ Error: Could not reach the auth service at https://${domainName}/`,
),
);
if (error instanceof Error) {
console.log(colors.red(` Reason: ${error.message}`));
} else {
console.log(colors.red(` Reason: ${error}`));
}
console.log(
colors.red(
" Please verify the container is running and DNS/Traefik is resolving.",
),
);
}
}
async function handleReviewConfigs(): Promise<void> {
const envContent = await Deno.readTextFile(ENV_PATH).catch(() => null);
const composeContent = await Deno.readTextFile(COMPOSE_PATH).catch(() =>
null
);
const spireComposeContent = await Deno.readTextFile(SPIRE_COMPOSE_PATH).catch(
() => null,
);
if (!envContent && !composeContent && !spireComposeContent) {
console.log(
colors.red("\n✗ No generated configs found. Run the setup first.\n"),
);
return;
}
while (true) {
const action = await Select.prompt({
message: "Review Generated Configs",
options: [
{ name: "[Show .env]", value: "env" },
{ name: "[Show compose.yml]", value: "compose" },
{ name: "[Show compose.spire.yml]", value: "spire_compose" },
{ name: "[Back to Main Menu]", value: "back" },
],
});
if (action === "env") {
console.log(colors.bold(colors.blue(`\n=== ${ENV_PATH} ===\n`)));
console.log(envContent || colors.yellow("File not found."));
console.log();
} else if (action === "compose") {
console.log(colors.bold(colors.blue(`\n=== ${COMPOSE_PATH} ===\n`)));
console.log(composeContent || colors.yellow("File not found."));
console.log();
} else if (action === "spire_compose") {
console.log(
colors.bold(colors.blue(`\n=== ${SPIRE_COMPOSE_PATH} ===\n`)),
);
console.log(spireComposeContent || colors.yellow("File not found."));
console.log();
} else if (action === "back") {
break;
}
}
}
// SIDE EFFECT: Runs the interactive CLI wizard.
export async function runSetupWizard(): Promise<void> {
console.log(colors.bold(colors.blue("=== Auth Setup Wizard ===\n")));
const loadedEnv = await readEnv();
let currentConfig: AuthSetupConfig = {
...DEFAULT_AUTH_CONFIG,
...loadedEnv,
};
if (Object.keys(loadedEnv).length > 0 && currentConfig.domainName) {
await handleTestConnection(currentConfig.domainName);
console.log();
}
while (true) {
const action = await Select.prompt({
message: "Main Menu",
options: [
{ name: "[Test Auth Connection]", value: "test" },
{ name: "[Configure Auth Yes API]", value: "auth" },
{ name: "[Compile Protobuf Definitions]", value: "compile_proto" },
{ name: "[Review Generated Configs]", value: "review" },
{ name: "[Build and Push Auth Image]", value: "build" },
{ name: "[Exit]", value: "exit" },
],
});
if (action === "test") {
await handleTestConnection(currentConfig.domainName);
console.log();
} else if (action === "auth") {
currentConfig = await handleAuthSetup(currentConfig);
} else if (action === "compile_proto") {
try {
await downloadWorkloadProto();
await executeProtobufCompilation();
console.log(colors.green("\n✓ Successfully compiled protobufs!\n"));
} catch (error) {
if (error instanceof Error) {
console.log(
colors.red(`\n✗ Protobuf compilation failed: ${error.message}\n`),
);
} else {
console.log(
colors.red(`\n✗ Protobuf compilation failed: ${error}\n`),
);
}
}
} else if (action === "review") {
await handleReviewConfigs();
} else if (action === "build") {
try {
const commands = generateBuildCommands(currentConfig.reg);
await executeBuildImage(commands);
console.log(colors.green("\n✓ Successfully built and pushed image!"));
console.log(
colors.green("You may now deploy your stack by running:\n"),
);
console.log(
colors.cyan(
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
),
);
} catch (error) {
if (error instanceof Error) {
console.log(
colors.red(`\n✗ Build process failed: ${error.message}\n`),
);
} else {
console.log(colors.red(`\n✗ Build process failed: ${error}\n`));
}
}
} else if (action === "exit") {
console.log(colors.gray("Exiting...\n"));
break;
}
}
}
export async function runCli(args = Deno.args): Promise<void> {
if (import.meta.main || args.length === 0) {
@ -26,18 +314,458 @@ export async function runCli(args = Deno.args): Promise<void> {
const cmd = new Command()
.name("auth-setup")
.description("Auth setup wizard and CLI")
.version("1.0.0")
.action(() => {
runSetupWizard();
})
.command("auth", authCommand)
.command("test", testCommand)
.command("compile_proto", compileProtoCommand)
.command("build", buildCommand)
.command("release", releaseCommand)
.command("dump_compose", dumpComposeCommand)
.command("dump_env", dumpEnvCommand)
.command("secrets", secretsCommand);
.command("auth", "Configure Auth Yes API")
.option("--auto, --headless", "Run in headless mode")
.option("--registry <reg:string>", "Container Registry URL")
.option("--ghcr-registry <ghcrReg:string>", "GHCR Mirror Registry URL")
.option("--domain <domain:string>", "Auth Domain Name")
.option("--db-path <path:string>", "Database Path on the Host")
.option("--spire-path <path:string>", "SPIRE Path on the Host")
.action(async (options) => {
const loadedEnv = await readEnv();
const currentConfig: AuthSetupConfig = {
...DEFAULT_AUTH_CONFIG,
...loadedEnv,
};
if (options.auto) {
if (!options.registry || !options.domain || !options.dbPath) {
console.error(
colors.red(
"Error: --registry, --domain, and --db-path are required in headless mode.",
),
);
Deno.exit(1);
}
const dbPassword = Deno.env.get("POSTGRES_PASSWORD") ||
currentConfig.dbPassword;
const appSecret = Deno.env.get("APP_SECRET") ||
currentConfig.appSecret;
if (!dbPassword) {
console.error(
colors.red(
"Error: POSTGRES_PASSWORD environment variable is required in headless mode.",
),
);
Deno.exit(1);
}
if (!appSecret) {
console.error(
colors.red(
"Error: APP_SECRET environment variable is required in headless mode.",
),
);
Deno.exit(1);
}
const newConfig: AuthSetupConfig = {
reg: options.registry,
ghcrReg: options.ghcrRegistry || currentConfig.ghcrReg ||
"ghcr.atyg.org",
domainName: options.domain,
dbPassword,
dbDataPath: options.dbPath || currentConfig.dbDataPath ||
"/volume1/docker/auth-yes/data",
spireDataPath: options.spirePath || currentConfig.spireDataPath ||
"/volume1/docker/spire",
appSecret,
};
await generateAuthSetupFiles(newConfig);
} else {
if (options.registry) currentConfig.reg = options.registry;
if (options.ghcrRegistry) currentConfig.ghcrReg = options.ghcrRegistry;
if (options.domain) currentConfig.domainName = options.domain;
if (options.dbPath) currentConfig.dbDataPath = options.dbPath;
if (options.spirePath) currentConfig.spireDataPath = options.spirePath;
await handleAuthSetup(currentConfig);
}
})
.command("test", "Test Auth Connection")
.action(async () => {
const loadedEnv = await readEnv();
const currentConfig: AuthSetupConfig = {
...DEFAULT_AUTH_CONFIG,
...loadedEnv,
};
await handleTestConnection(currentConfig.domainName);
})
.command("compile_proto", "Compile Protobuf Definitions")
.action(async () => {
try {
await downloadWorkloadProto();
await executeProtobufCompilation();
console.log(colors.green("\n✓ Successfully compiled protobufs!\n"));
} catch (error) {
if (error instanceof Error) {
console.log(
colors.red(`\n✗ Protobuf compilation failed: ${error.message}\n`),
);
} else {
console.log(
colors.red(`\n✗ Protobuf compilation failed: ${error}\n`),
);
}
Deno.exit(1);
}
})
.command("build", "Build and Push Auth Image")
.action(async () => {
try {
const loadedEnv = await readEnv();
const currentConfig: AuthSetupConfig = {
...DEFAULT_AUTH_CONFIG,
...loadedEnv,
};
const commands = generateBuildCommands(currentConfig.reg);
await executeBuildImage(commands);
console.log(
colors.green("\n✓ Successfully built and pushed auth image!"),
);
console.log(
colors.green("You may now deploy your stack by running:\n"),
);
console.log(
colors.cyan(
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
),
);
} catch (error) {
if (error instanceof Error) {
console.log(
colors.red(`\n✗ Build process failed: ${error.message}\n`),
);
} else {
console.log(colors.red(`\n✗ Build process failed: ${error}\n`));
}
Deno.exit(1);
}
})
.command("dump_compose", "Output all generated Compose YAML configurations")
.action(() => {
console.log(
colors.bold(
colors.blue(
"\n================================================================",
),
),
);
console.log(
colors.bold(
colors.green(" STACK 1: Auth-Yes Stack (infra/compose.yml)"),
),
);
console.log(
colors.bold(
colors.blue(
"================================================================\n",
),
),
);
console.log(generateDockerCompose());
console.log(
colors.bold(
colors.blue(
"================================================================",
),
),
);
console.log(
colors.bold(
colors.green(
" STACK 2: Standalone SPIRE Stack (infra/compose.spire.yml)",
),
),
);
console.log(
colors.bold(
colors.blue(
"================================================================\n",
),
),
);
console.log(generateSpireDockerCompose());
})
.command(
"dump_env",
"Output current environment configuration (.env and .env.spire)",
)
.action(async () => {
const loadedEnv = await readEnv();
const currentConfig: AuthSetupConfig = {
...DEFAULT_AUTH_CONFIG,
...loadedEnv,
};
console.log(
colors.bold(
colors.blue(
"\n================================================================",
),
),
);
console.log(
colors.bold(
colors.green(" STACK 1: Auth-Yes Environment (infra/stack.env)"),
),
);
console.log(
colors.bold(
colors.blue(
"================================================================\n",
),
),
);
console.log(generateEnv(currentConfig));
console.log(
colors.bold(
colors.blue(
"================================================================",
),
),
);
console.log(
colors.bold(
colors.green(
" STACK 2: SPIRE Stack Environment (infra/.env.spire)",
),
),
);
console.log(
colors.bold(
colors.blue(
"================================================================\n",
),
),
);
console.log(generateSpireEnv(currentConfig));
})
.command("secrets", "Inspect secrets status and persistence paths")
.action(async () => {
const loadedEnv = await readEnv();
const currentConfig: AuthSetupConfig = {
...DEFAULT_AUTH_CONFIG,
...loadedEnv,
};
console.log(
colors.bold(
colors.blue(
"\n=== Auth-Yes Secrets & Persistence Topology ===\n",
),
),
);
console.log(
`${
colors.cyan("Database Persistence Path:")
} ${currentConfig.dbDataPath}`,
);
console.log(
`${
colors.cyan("SPIRE Persistence Path:")
} ${currentConfig.spireDataPath}`,
);
console.log(
`${
colors.cyan("Local Artifact Files:")
} ${ENV_PATH}, ${SPIRE_ENV_PATH}, ${COMPOSE_PATH}, ${SPIRE_COMPOSE_PATH}`,
);
console.log(
`${colors.cyan("PostgreSQL Password:")} ${
currentConfig.dbPassword
? colors.green(
"✓ Configured (len: " + currentConfig.dbPassword.length + ")",
)
: colors.red("✗ Missing")
}`,
);
console.log(
`${colors.cyan("Application Secret:")} ${
currentConfig.appSecret
? colors.green(
"✓ Configured (len: " + currentConfig.appSecret.length + ")",
)
: colors.red("✗ Missing")
}`,
);
console.log(
colors.gray(
"\nTip: To dump raw environment variables, run: deno task setup dump_env\n",
),
);
})
.command(
"release",
"Run complete build & release pipeline with copy-paste deployment instructions",
)
.action(async () => {
console.log(
colors.bold(
colors.blue(
"\n================================================================",
),
),
);
console.log(
colors.bold(
colors.green(
" Auth-Yes Infrastructure Build & Release Pipeline",
),
),
);
console.log(
colors.bold(
colors.blue(
"================================================================\n",
),
),
);
// 1. Quality Gates
console.log(colors.cyan("[1/4] Running Quality Gates & Test Suite..."));
const testCmd = new Deno.Command("deno", {
args: ["task", "test"],
stdout: "inherit",
stderr: "inherit",
});
const testRes = await testCmd.output();
if (testRes.code !== 0) {
console.error(
colors.red("\n✗ Quality gates failed. Aborting release."),
);
Deno.exit(1);
}
// 2. Compile Protobufs
console.log(
colors.cyan("\n[2/4] Downloading & Compiling Protobufs..."),
);
await downloadWorkloadProto();
await executeProtobufCompilation();
// 3. Build & Push Images
console.log(
colors.cyan(
"\n[3/4] Building and Pushing Custom Container Images...",
),
);
const loadedEnv = await readEnv();
const currentConfig: AuthSetupConfig = {
...DEFAULT_AUTH_CONFIG,
...loadedEnv,
};
const commands = generateBuildCommands(currentConfig.reg);
await executeBuildImage(commands);
console.log(
colors.green(
"\n✓ Successfully built and pushed all stack images to " +
currentConfig.reg + "!",
),
);
// 4. Output Copy-Paste Guides
console.log(
colors.cyan(
"\n[4/4] Release Complete. Deployment & Configuration Guides:\n",
),
);
console.log(
colors.bold(
colors.yellow(
"┌──────────────────────────────────────────────────────────────┐",
),
),
);
console.log(
colors.bold(
colors.yellow(
"│ A. FOR NEW SYSTEM INSTALLATIONS │",
),
),
);
console.log(
colors.bold(
colors.yellow(
"└──────────────────────────────────────────────────────────────┘",
),
),
);
console.log(
colors.gray("# 1. Inspect environment variables and secrets:"),
);
console.log(colors.cyan("deno task setup dump_env"));
console.log(
colors.gray("\n# 2. Inspect generated Docker Compose files:"),
);
console.log(colors.cyan("deno task setup dump_compose"));
console.log(
colors.gray("\n# 3. Create persistent storage paths on host:"),
);
console.log(
colors.cyan(
`mkdir -p ${currentConfig.spireDataPath} ${currentConfig.dbDataPath}`,
),
);
console.log(colors.gray("\n# 4. Deploy fresh stacks:"));
console.log(
colors.cyan(
"podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml up -d",
),
);
console.log(
colors.cyan(
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d",
),
);
console.log(
colors.bold(
colors.yellow(
"\n┌──────────────────────────────────────────────────────────────┐",
),
),
);
console.log(
colors.bold(
colors.yellow(
"│ B. FOR EXISTING SYSTEM UPDATES (ROLLING RESTART) │",
),
),
);
console.log(
colors.bold(
colors.yellow(
"└──────────────────────────────────────────────────────────────┘",
),
),
);
console.log(
colors.gray(
"# Pull newly pushed custom images and restart containers:",
),
);
console.log(
colors.cyan(
"podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml pull",
),
);
console.log(
colors.cyan(
"podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml up -d\n",
),
);
console.log(
colors.cyan(
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml pull",
),
);
console.log(
colors.cyan(
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
),
);
});
await cmd.parse(args);
}

71
infra/setup/commands/auth.ts
View File

@ -1,71 +0,0 @@
import { Command } from "jsr:@cliffy/command@1.0.0-rc.7";
import * as colors from "jsr:@std/fmt@0.225.2/colors";
import { AuthSetupConfig, DEFAULT_AUTH_CONFIG, readEnv } from "../env.ts";
import { generateAuthSetupFiles, handleAuthSetup } from "../prompts/auth.ts";
export const authCommand = new Command()
.description("Configure Auth Yes API")
.option("--auto, --headless", "Run in headless mode")
.option("--registry <reg:string>", "Container Registry URL")
.option("--ghcr-registry <ghcrReg:string>", "GHCR Mirror Registry URL")
.option("--domain <domain:string>", "Auth Domain Name")
.option("--db-path <path:string>", "Database Path on the Host")
.option("--spire-path <path:string>", "SPIRE Path on the Host")
.action(async (options) => {
const loadedEnv = await readEnv();
const currentConfig: AuthSetupConfig = {
...DEFAULT_AUTH_CONFIG,
...loadedEnv,
};
if (options.auto) {
if (!options.registry || !options.domain || !options.dbPath) {
console.error(
colors.red(
"Error: --registry, --domain, and --db-path are required in headless mode.",
),
);
Deno.exit(1);
}
const dbPassword = Deno.env.get("POSTGRES_PASSWORD") ||
currentConfig.dbPassword;
const appSecret = Deno.env.get("APP_SECRET") || currentConfig.appSecret;
if (!dbPassword) {
console.error(
colors.red(
"Error: POSTGRES_PASSWORD environment variable is required in headless mode.",
),
);
Deno.exit(1);
}
if (!appSecret) {
console.error(
colors.red(
"Error: APP_SECRET environment variable is required in headless mode.",
),
);
Deno.exit(1);
}
const newConfig: AuthSetupConfig = {
reg: options.registry,
ghcrReg: options.ghcrRegistry || currentConfig.ghcrReg ||
"ghcr.atyg.org",
domainName: options.domain,
dbPassword,
dbDataPath: options.dbPath || currentConfig.dbDataPath ||
"/volume1/docker/auth-yes/data",
spireDataPath: options.spirePath || currentConfig.spireDataPath ||
"/volume1/docker/spire",
appSecret,
};
await generateAuthSetupFiles(newConfig);
} else {
if (options.registry) currentConfig.reg = options.registry;
if (options.ghcrRegistry) currentConfig.ghcrReg = options.ghcrRegistry;
if (options.domain) currentConfig.domainName = options.domain;
if (options.dbPath) currentConfig.dbDataPath = options.dbPath;
if (options.spirePath) currentConfig.spireDataPath = options.spirePath;
await handleAuthSetup(currentConfig);
}
});

235
infra/setup/commands/build.ts
View File

@ -1,235 +0,0 @@
import { Command } from "jsr:@cliffy/command@1.0.0-rc.7";
import * as colors from "jsr:@std/fmt@0.225.2/colors";
import { AuthSetupConfig, DEFAULT_AUTH_CONFIG, readEnv } from "../env.ts";
import {
downloadWorkloadProto,
executeBuildImage,
executeProtobufCompilation,
generateBuildCommands,
} from "../build.ts";
export const compileProtoCommand = new Command()
.description("Compile Protobuf Definitions")
.action(async () => {
try {
await downloadWorkloadProto();
await executeProtobufCompilation();
console.log(colors.green("\n✓ Successfully compiled protobufs!\n"));
} catch (error) {
if (error instanceof Error) {
console.log(
colors.red(`\n✗ Protobuf compilation failed: ${error.message}\n`),
);
} else {
console.log(colors.red(`\n✗ Protobuf compilation failed: ${error}\n`));
}
Deno.exit(1);
}
});
export const buildCommand = new Command()
.description("Build and Push Auth Image")
.action(async () => {
try {
const loadedEnv = await readEnv();
const currentConfig: AuthSetupConfig = {
...DEFAULT_AUTH_CONFIG,
...loadedEnv,
};
const commands = generateBuildCommands(currentConfig.reg);
await executeBuildImage(commands);
console.log(
colors.green("\n✓ Successfully built and pushed auth image!"),
);
console.log(
colors.green("You may now deploy your stack by running:\n"),
);
console.log(
colors.cyan(
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
),
);
} catch (error) {
if (error instanceof Error) {
console.log(
colors.red(`\n✗ Build process failed: ${error.message}\n`),
);
} else {
console.log(colors.red(`\n✗ Build process failed: ${error}\n`));
}
Deno.exit(1);
}
});
export const releaseCommand = new Command()
.description(
"Run complete build & release pipeline with copy-paste deployment instructions",
)
.action(async () => {
console.log(
colors.bold(
colors.blue(
"\n================================================================",
),
),
);
console.log(
colors.bold(
colors.green(
" Auth-Yes Infrastructure Build & Release Pipeline",
),
),
);
console.log(
colors.bold(
colors.blue(
"================================================================\n",
),
),
);
// 1. Quality Gates
console.log(colors.cyan("[1/4] Running Quality Gates & Test Suite..."));
const testCmd = new Deno.Command("deno", {
args: ["task", "test"],
stdout: "inherit",
stderr: "inherit",
});
const testRes = await testCmd.output();
if (testRes.code !== 0) {
console.error(
colors.red("\n✗ Quality gates failed. Aborting release."),
);
Deno.exit(1);
}
// 2. Compile Protobufs
console.log(
colors.cyan("\n[2/4] Downloading & Compiling Protobufs..."),
);
await downloadWorkloadProto();
await executeProtobufCompilation();
// 3. Build & Push Images
console.log(
colors.cyan(
"\n[3/4] Building and Pushing Custom Container Images...",
),
);
const loadedEnv = await readEnv();
const currentConfig: AuthSetupConfig = {
...DEFAULT_AUTH_CONFIG,
...loadedEnv,
};
const commands = generateBuildCommands(currentConfig.reg);
await executeBuildImage(commands);
console.log(
colors.green(
"\n✓ Successfully built and pushed all stack images to " +
currentConfig.reg + "!",
),
);
// 4. Output Copy-Paste Guides
console.log(
colors.cyan(
"\n[4/4] Release Complete. Deployment & Configuration Guides:\n",
),
);
console.log(
colors.bold(
colors.yellow(
"┌──────────────────────────────────────────────────────────────┐",
),
),
);
console.log(
colors.bold(
colors.yellow(
"│ A. FOR NEW SYSTEM INSTALLATIONS │",
),
),
);
console.log(
colors.bold(
colors.yellow(
"└──────────────────────────────────────────────────────────────┘",
),
),
);
console.log(
colors.gray("# 1. Inspect environment variables and secrets:"),
);
console.log(colors.cyan("deno task setup dump_env"));
console.log(
colors.gray("\n# 2. Inspect generated Docker Compose files:"),
);
console.log(colors.cyan("deno task setup dump_compose"));
console.log(
colors.gray("\n# 3. Create persistent storage paths on host:"),
);
console.log(
colors.cyan(
`mkdir -p ${currentConfig.spireDataPath} ${currentConfig.dbDataPath}`,
),
);
console.log(colors.gray("\n# 4. Deploy fresh stacks:"));
console.log(
colors.cyan(
"podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml up -d",
),
);
console.log(
colors.cyan(
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d",
),
);
console.log(
colors.bold(
colors.yellow(
"\n┌──────────────────────────────────────────────────────────────┐",
),
),
);
console.log(
colors.bold(
colors.yellow(
"│ B. FOR EXISTING SYSTEM UPDATES (ROLLING RESTART) │",
),
),
);
console.log(
colors.bold(
colors.yellow(
"└──────────────────────────────────────────────────────────────┘",
),
),
);
console.log(
colors.gray(
"# Pull newly pushed custom images and restart containers:",
),
);
console.log(
colors.cyan(
"podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml pull",
),
);
console.log(
colors.cyan(
"podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml up -d\n",
),
);
console.log(
colors.cyan(
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml pull",
),
);
console.log(
colors.cyan(
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
),
);
});

112
infra/setup/commands/compose.ts
View File

@ -1,112 +0,0 @@
import { Command } from "jsr:@cliffy/command@1.0.0-rc.7";
import * as colors from "jsr:@std/fmt@0.225.2/colors";
import {
generateDockerCompose,
generateSpireDockerCompose,
} from "../compose.ts";
import {
AuthSetupConfig,
DEFAULT_AUTH_CONFIG,
generateEnv,
generateSpireEnv,
readEnv,
} from "../env.ts";
export const dumpComposeCommand = new Command()
.description("Output all generated Compose YAML configurations")
.action(() => {
console.log(
colors.bold(
colors.blue(
"\n================================================================",
),
),
);
console.log(
colors.bold(
colors.green(" STACK 1: Auth-Yes Stack (infra/compose.yml)"),
),
);
console.log(
colors.bold(
colors.blue(
"================================================================\n",
),
),
);
console.log(generateDockerCompose());
console.log(
colors.bold(
colors.blue(
"================================================================",
),
),
);
console.log(
colors.bold(
colors.green(
" STACK 2: Standalone SPIRE Stack (infra/compose.spire.yml)",
),
),
);
console.log(
colors.bold(
colors.blue(
"================================================================\n",
),
),
);
console.log(generateSpireDockerCompose());
});
export const dumpEnvCommand = new Command()
.description("Output current environment configuration (.env and .env.spire)")
.action(async () => {
const loadedEnv = await readEnv();
const currentConfig: AuthSetupConfig = {
...DEFAULT_AUTH_CONFIG,
...loadedEnv,
};
console.log(
colors.bold(
colors.blue(
"\n================================================================",
),
),
);
console.log(
colors.bold(
colors.green(" STACK 1: Auth-Yes Environment (infra/stack.env)"),
),
);
console.log(
colors.bold(
colors.blue(
"================================================================\n",
),
),
);
console.log(generateEnv(currentConfig));
console.log(
colors.bold(
colors.blue(
"================================================================",
),
),
);
console.log(
colors.bold(
colors.green(
" STACK 2: SPIRE Stack Environment (infra/.env.spire)",
),
),
);
console.log(
colors.bold(
colors.blue(
"================================================================\n",
),
),
);
console.log(generateSpireEnv(currentConfig));
});

66
infra/setup/commands/secrets.ts
View File

@ -1,66 +0,0 @@
import { Command } from "jsr:@cliffy/command@1.0.0-rc.7";
import * as colors from "jsr:@std/fmt@0.225.2/colors";
import {
AuthSetupConfig,
COMPOSE_PATH,
DEFAULT_AUTH_CONFIG,
ENV_PATH,
readEnv,
SPIRE_COMPOSE_PATH,
SPIRE_ENV_PATH,
} from "../env.ts";
export const secretsCommand = new Command()
.description("Inspect secrets status and persistence paths")
.action(async () => {
const loadedEnv = await readEnv();
const currentConfig: AuthSetupConfig = {
...DEFAULT_AUTH_CONFIG,
...loadedEnv,
};
console.log(
colors.bold(
colors.blue(
"\n=== Auth-Yes Secrets & Persistence Topology ===\n",
),
),
);
console.log(
`${
colors.cyan("Database Persistence Path:")
} ${currentConfig.dbDataPath}`,
);
console.log(
`${
colors.cyan("SPIRE Persistence Path:")
} ${currentConfig.spireDataPath}`,
);
console.log(
`${
colors.cyan("Local Artifact Files:")
} ${ENV_PATH}, ${SPIRE_ENV_PATH}, ${COMPOSE_PATH}, ${SPIRE_COMPOSE_PATH}`,
);
console.log(
`${colors.cyan("PostgreSQL Password:")} ${
currentConfig.dbPassword
? colors.green(
"✓ Configured (len: " + currentConfig.dbPassword.length + ")",
)
: colors.red("✗ Missing")
}`,
);
console.log(
`${colors.cyan("Application Secret:")} ${
currentConfig.appSecret
? colors.green(
"✓ Configured (len: " + currentConfig.appSecret.length + ")",
)
: colors.red("✗ Missing")
}`,
);
console.log(
colors.gray(
"\nTip: To dump raw environment variables, run: deno task setup dump_env\n",
),
);
});

61
infra/setup/commands/test.ts
View File

@ -1,61 +0,0 @@
import { Command } from "jsr:@cliffy/command@1.0.0-rc.7";
import * as colors from "jsr:@std/fmt@0.225.2/colors";
import { AuthSetupConfig, DEFAULT_AUTH_CONFIG, readEnv } from "../env.ts";
export async function handleTestConnection(domainName: string): Promise<void> {
console.log(
colors.bold(
colors.blue(`\n=== Testing Auth Connection (https://${domainName}) ===`),
),
);
try {
const controller = new AbortController();
const timeoutId = setTimeout(() => controller.abort(), 5000);
const res1 = await fetch(`https://${domainName}/`, {
signal: controller.signal,
});
clearTimeout(timeoutId);
if (res1.status === 502 || res1.status === 503 || res1.status === 504) {
throw new Error(`Gateway error: ${res1.status}`);
}
if (res1.body) {
await res1.body.cancel();
}
console.log(
colors.green(
`✓ Auth service is up and reachable at https://${domainName}/`,
),
);
} catch (error) {
console.log(
colors.red(
`✗ Error: Could not reach the auth service at https://${domainName}/`,
),
);
if (error instanceof Error) {
console.log(colors.red(` Reason: ${error.message}`));
} else {
console.log(colors.red(` Reason: ${error}`));
}
console.log(
colors.red(
" Please verify the container is running and DNS/Traefik is resolving.",
),
);
}
}
export const testCommand = new Command()
.description("Test Auth Connection")
.action(async () => {
const loadedEnv = await readEnv();
const currentConfig: AuthSetupConfig = {
...DEFAULT_AUTH_CONFIG,
...loadedEnv,
};
await handleTestConnection(currentConfig.domainName);
});

134
infra/setup/prompts/auth.ts
View File

@ -1,134 +0,0 @@
import { Input, Secret } from "jsr:@cliffy/prompt@1.0.0-rc.7";
import * as colors from "jsr:@std/fmt@0.225.2/colors";
import {
generateDockerCompose,
generateSpireDockerCompose,
} from "../compose.ts";
import {
AuthSetupConfig,
COMPOSE_PATH,
ENV_PATH,
generateEnv,
generateSpireEnv,
SPIRE_COMPOSE_PATH,
SPIRE_ENV_PATH,
} from "../env.ts";
export async function promptAuthConfig(
currentConfig: AuthSetupConfig,
): Promise<Partial<AuthSetupConfig>> {
console.log(
colors.gray(
"Please provide the following Auth Yes configuration details.\n",
),
);
const reg = await Input.prompt({
message: "Enter the Primary Container Registry URL:",
default: currentConfig.reg,
});
const ghcrReg = await Input.prompt({
message: "Enter the GHCR Mirror Registry URL (for SPIRE):",
default: currentConfig.ghcrReg || "ghcr.atyg.org",
});
const domainName = await Input.prompt({
message: "Enter the Auth Domain Name:",
hint: "E.g., auth.system.local",
default: currentConfig.domainName,
});
const appSecret = await Secret.prompt({
message: "Enter the App Secret for the IDP:",
default: currentConfig.appSecret,
minLength: 16,
});
const pwdMessage = currentConfig.dbPassword
? "Enter the PostgreSQL database password: (Leave blank to keep existing password)"
: "Enter the PostgreSQL database password:";
const pwdInput = await Secret.prompt({
message: pwdMessage,
minLength: currentConfig.dbPassword ? 0 : 1,
});
const dbPassword = pwdInput === "" && currentConfig.dbPassword !== ""
? currentConfig.dbPassword
: pwdInput;
return { reg, ghcrReg, domainName, appSecret, dbPassword };
}
export async function promptSpireConfig(
currentConfig: AuthSetupConfig,
): Promise<Partial<AuthSetupConfig>> {
const dbDataPath = await Input.prompt({
message: "Enter the Database Path on the Host:",
default: currentConfig.dbDataPath,
});
const spireDataPath = await Input.prompt({
message: "Enter the SPIRE Path on the Host:",
default: currentConfig.spireDataPath,
});
return { dbDataPath, spireDataPath };
}
export async function promptConfirmation(): Promise<void> {
// Empty implementation as there was no explicit confirmation in cli.ts before
// But we add it to cleanly delineate the flow as requested.
}
export async function generateAuthSetupFiles(
config: AuthSetupConfig,
): Promise<void> {
const envContent = generateEnv(config);
await Deno.writeTextFile(ENV_PATH, envContent);
const spireEnvContent = generateSpireEnv(config);
await Deno.writeTextFile(SPIRE_ENV_PATH, spireEnvContent);
const composeContent = generateDockerCompose();
await Deno.writeTextFile(COMPOSE_PATH, composeContent);
const spireComposeContent = generateSpireDockerCompose();
await Deno.writeTextFile(SPIRE_COMPOSE_PATH, spireComposeContent);
console.log(
colors.green(
`\n✓ Successfully generated ${ENV_PATH}, ${SPIRE_ENV_PATH}, ${COMPOSE_PATH}, and ${SPIRE_COMPOSE_PATH}!`,
),
);
console.log(
colors.green("Setup complete. You may deploy your stacks by running:\n"),
);
console.log(
colors.cyan(
"1. Deploy SPIRE Stack:\n" +
" podman-compose --project-name spire --env-file infra/.env.spire -f infra/compose.spire.yml up -d\n\n" +
"2. Deploy Auth-Yes Stack:\n" +
" podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
),
);
}
export async function handleAuthSetup(
currentConfig: AuthSetupConfig,
): Promise<AuthSetupConfig> {
const authConfig = await promptAuthConfig(currentConfig);
const spireConfig = await promptSpireConfig(currentConfig);
const newConfig: AuthSetupConfig = {
...currentConfig,
...authConfig,
...spireConfig,
};
await promptConfirmation();
await generateAuthSetupFiles(newConfig);
return newConfig;
}

145
infra/setup/prompts/wizard.ts
View File

@ -1,145 +0,0 @@
import { Select } from "jsr:@cliffy/prompt@1.0.0-rc.7";
import * as colors from "jsr:@std/fmt@0.225.2/colors";
import {
AuthSetupConfig,
COMPOSE_PATH,
DEFAULT_AUTH_CONFIG,
ENV_PATH,
readEnv,
SPIRE_COMPOSE_PATH,
} from "../env.ts";
import { handleAuthSetup } from "./auth.ts";
import { handleTestConnection } from "../commands/test.ts";
import {
downloadWorkloadProto,
executeBuildImage,
executeProtobufCompilation,
generateBuildCommands,
} from "../build.ts";
export async function handleReviewConfigs(): Promise<void> {
const envContent = await Deno.readTextFile(ENV_PATH).catch(() => null);
const composeContent = await Deno.readTextFile(COMPOSE_PATH).catch(() =>
null
);
const spireComposeContent = await Deno.readTextFile(SPIRE_COMPOSE_PATH).catch(
() => null,
);
if (!envContent && !composeContent && !spireComposeContent) {
console.log(
colors.red("\n✗ No generated configs found. Run the setup first.\n"),
);
return;
}
while (true) {
const action = await Select.prompt({
message: "Review Generated Configs",
options: [
{ name: "[Show .env]", value: "env" },
{ name: "[Show compose.yml]", value: "compose" },
{ name: "[Show compose.spire.yml]", value: "spire_compose" },
{ name: "[Back to Main Menu]", value: "back" },
],
});
if (action === "env") {
console.log(colors.bold(colors.blue(`\n=== ${ENV_PATH} ===\n`)));
console.log(envContent || colors.yellow("File not found."));
console.log();
} else if (action === "compose") {
console.log(colors.bold(colors.blue(`\n=== ${COMPOSE_PATH} ===\n`)));
console.log(composeContent || colors.yellow("File not found."));
console.log();
} else if (action === "spire_compose") {
console.log(
colors.bold(colors.blue(`\n=== ${SPIRE_COMPOSE_PATH} ===\n`)),
);
console.log(spireComposeContent || colors.yellow("File not found."));
console.log();
} else if (action === "back") {
break;
}
}
}
// SIDE EFFECT: Runs the interactive CLI wizard.
export async function runSetupWizard(): Promise<void> {
console.log(colors.bold(colors.blue("=== Auth Setup Wizard ===\n")));
const loadedEnv = await readEnv();
let currentConfig: AuthSetupConfig = {
...DEFAULT_AUTH_CONFIG,
...loadedEnv,
};
if (Object.keys(loadedEnv).length > 0 && currentConfig.domainName) {
await handleTestConnection(currentConfig.domainName);
console.log();
}
while (true) {
const action = await Select.prompt({
message: "Main Menu",
options: [
{ name: "[Test Auth Connection]", value: "test" },
{ name: "[Configure Auth Yes API]", value: "auth" },
{ name: "[Compile Protobuf Definitions]", value: "compile_proto" },
{ name: "[Review Generated Configs]", value: "review" },
{ name: "[Build and Push Auth Image]", value: "build" },
{ name: "[Exit]", value: "exit" },
],
});
if (action === "test") {
await handleTestConnection(currentConfig.domainName);
console.log();
} else if (action === "auth") {
currentConfig = await handleAuthSetup(currentConfig);
} else if (action === "compile_proto") {
try {
await downloadWorkloadProto();
await executeProtobufCompilation();
console.log(colors.green("\n✓ Successfully compiled protobufs!\n"));
} catch (error) {
if (error instanceof Error) {
console.log(
colors.red(`\n✗ Protobuf compilation failed: ${error.message}\n`),
);
} else {
console.log(
colors.red(`\n✗ Protobuf compilation failed: ${error}\n`),
);
}
}
} else if (action === "review") {
await handleReviewConfigs();
} else if (action === "build") {
try {
const commands = generateBuildCommands(currentConfig.reg);
await executeBuildImage(commands);
console.log(colors.green("\n✓ Successfully built and pushed image!"));
console.log(
colors.green("You may now deploy your stack by running:\n"),
);
console.log(
colors.cyan(
"podman-compose --project-name auth-yes --env-file infra/stack.env -f infra/compose.yml up -d\n",
),
);
} catch (error) {
if (error instanceof Error) {
console.log(
colors.red(`\n✗ Build process failed: ${error.message}\n`),
);
} else {
console.log(colors.red(`\n✗ Build process failed: ${error}\n`));
}
}
} else if (action === "exit") {
console.log(colors.gray("Exiting...\n"));
break;
}
}
}

873
server/routes/admin.ts
View File

@ -1,22 +1,865 @@
import { Hono } from "jsr:@hono/hono@4";
import { requireAdmin } from "../auth-session.ts";
import { adminRateLimiter } from "../middleware.ts";
import { usersAdminRoutes } from "./admin/users.ts";
import { appsAdminRoutes } from "./admin/apps.ts";
import { rolesAdminRoutes } from "./admin/roles.ts";
import { invitesAdminRoutes } from "./admin/invites.ts";
import { hardwareKeysAdminRoutes } from "./admin/hardware_keys.ts";
import { auditAdminRoutes } from "./admin/audit.ts";
import { encodeBase64Url } from "jsr:@std/encoding@1/base64url";
import { sqlWrapper } from "../db.ts";
import { valkey } from "../valkey.ts";
import { auditWrapper } from "../audit.ts";
import {
getAuthenticatedUser,
isGlobalAdmin,
requireAdmin,
} from "../auth-session.ts";
import { adminRateLimiter, getClientIp } from "../middleware.ts";
import { computeJwkThumbprint } from "../http_signatures.ts";
export const adminRoutes = new Hono();
adminRoutes.use("*", requireAdmin);
adminRoutes.use("*", adminRateLimiter);
adminRoutes.route("/users", usersAdminRoutes);
adminRoutes.route("/apps", appsAdminRoutes);
adminRoutes.route("/roles", rolesAdminRoutes);
adminRoutes.route("/invites", invitesAdminRoutes);
adminRoutes.route("/", hardwareKeysAdminRoutes);
adminRoutes.route("/", auditAdminRoutes);
// ---------------------------------------------------------
// Global Admin APIs (For the Management Console)
// ---------------------------------------------------------
adminRoutes.get("/audit-logs", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const logs = await sqlWrapper.sql`
SELECT a.id, a.action, a.resource, a.details, a.ip_address, a.created_at, u.username as user
FROM audit_records a
LEFT JOIN users u ON a.user_id = u.id
ORDER BY a.created_at DESC
LIMIT 100
`;
return c.json({ logs });
});
adminRoutes.get("/users", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const users = await sqlWrapper.sql`
SELECT id, username, display_name, account_status
FROM users
ORDER BY username ASC
`;
return c.json({ users });
});
adminRoutes.post("/users/:id/status", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetUserId = c.req.param("id");
const { status } = await c.req.json();
if (!["active", "pending", "suspended"].includes(status)) {
return c.json({ error: "Invalid status" }, 400);
}
const targetUser = await sqlWrapper
.sql`UPDATE users SET account_status = ${status} WHERE id = ${targetUserId} RETURNING id`
.then((res: any) => res[0]);
if (!targetUser) {
return c.json({ error: "User not found" }, 404);
}
auditWrapper.auditLog(auth.userId, "user_status_changed", targetUserId, {
newStatus: status,
}, getClientIp(c));
return c.json({ success: true });
});
adminRoutes.post("/users/:id/profile", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetUserId = c.req.param("id");
const { displayName } = await c.req.json();
const targetUser = await sqlWrapper
.sql`UPDATE users SET display_name = ${
displayName?.trim() || null
} WHERE id = ${targetUserId} RETURNING id, username, display_name`
.then((res: any) => res[0]);
if (!targetUser) return c.json({ error: "User not found" }, 404);
auditWrapper.auditLog(auth.userId, "user_profile_updated", targetUserId, {
display_name: targetUser.display_name,
}, getClientIp(c));
return c.json({ success: true, user: targetUser });
});
// ---------------------------------------------------------
// Admin Application Registry
// ---------------------------------------------------------
adminRoutes.get("/apps", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const apps = await sqlWrapper.sql`
SELECT a.id, a.name, a.spiffe_id, a.description, a.created_at,
COUNT(g.id) AS active_grants_count
FROM apps a
LEFT JOIN grants g ON a.id = g.app_id
GROUP BY a.id, a.name, a.spiffe_id, a.description, a.created_at
ORDER BY a.created_at ASC
`;
return c.json({ apps });
});
adminRoutes.post("/apps", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const {
name,
spiffeId,
description,
domain,
is_public,
bypass_paths,
allowed_cidrs,
} = await c.req.json();
if (!name || !spiffeId) {
return c.json({ error: "Name and SPIFFE ID are required" }, 400);
}
try {
const newApp = await sqlWrapper.sql`
INSERT INTO apps (name, spiffe_id, description, domain, is_public, bypass_paths, allowed_cidrs)
VALUES (${name.trim()}, ${spiffeId.trim()}, ${
description?.trim() || null
}, ${domain?.trim() || null}, ${is_public || false}, ${
bypass_paths || []
}, ${allowed_cidrs || []})
RETURNING id, name, spiffe_id, description, created_at
`.then((res: any) => res[0]);
auditWrapper.auditLog(auth.userId, "app_registered", newApp.id, {
name: newApp.name,
spiffe_id: newApp.spiffe_id,
}, getClientIp(c));
return c.json({ success: true, app: newApp });
} catch (err: any) {
if (err.code === "23505") {
return c.json({
error: "An application with this SPIFFE ID already exists",
}, 409);
}
return c.json({ error: "Failed to register application" }, 500);
}
});
adminRoutes.put("/apps/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const appId = c.req.param("id");
const {
name,
description,
domain,
is_public,
bypass_paths,
allowed_cidrs,
} = await c.req.json();
if (!name) {
return c.json({ error: "Application name is required" }, 400);
}
try {
const updatedApp = await sqlWrapper.sql`
UPDATE apps
SET name = ${name.trim()},
description = ${description?.trim() || null},
domain = ${domain?.trim() || null},
is_public = ${is_public || false},
bypass_paths = ${bypass_paths || []},
allowed_cidrs = ${allowed_cidrs || []}
WHERE id = ${appId}
RETURNING id, name, spiffe_id, description, domain, is_public, bypass_paths, allowed_cidrs
`.then((res: any) => res[0]);
if (!updatedApp) return c.json({ error: "Application not found" }, 404);
auditWrapper.auditLog(auth.userId, "app_updated", updatedApp.id, {
name: updatedApp.name,
}, getClientIp(c));
return c.json({ success: true, app: updatedApp });
} catch (_err: any) {
return c.json({ error: "Failed to update application" }, 500);
}
});
adminRoutes.delete("/apps/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const appId = c.req.param("id");
const app = await sqlWrapper
.sql`DELETE FROM apps WHERE id = ${appId} RETURNING id, name`
.then((res: any) => res[0]);
if (app) {
auditWrapper.auditLog(
auth.userId,
"app_deleted",
appId,
{ name: app.name },
getClientIp(c),
);
return c.json({ success: true });
}
return c.json({ error: "Application not found" }, 404);
});
// ---------------------------------------------------------
// Admin Role Catalog Management
// ---------------------------------------------------------
adminRoutes.get("/roles", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const appId = c.req.query("appId");
let roles;
if (appId) {
roles = await sqlWrapper.sql`
SELECT r.id, r.name, r.description, r.app_id, r.created_at,
a.name AS app_name
FROM roles r
LEFT JOIN apps a ON r.app_id = a.id
WHERE r.app_id IS NULL OR r.app_id = ${appId}
ORDER BY r.app_id NULLS FIRST, r.name ASC
`;
} else {
roles = await sqlWrapper.sql`
SELECT r.id, r.name, r.description, r.app_id, r.created_at,
a.name AS app_name
FROM roles r
LEFT JOIN apps a ON r.app_id = a.id
ORDER BY r.app_id NULLS FIRST, r.name ASC
`;
}
return c.json({ roles });
});
adminRoutes.post("/roles", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const { name, description, appId } = await c.req.json();
if (
!name || typeof name !== "string" || name.trim().length < 2 ||
name.trim().length > 32
) {
return c.json(
{ error: "Role name must be between 2 and 32 characters" },
400,
);
}
const normalizedName = name.trim().toLowerCase().replace(/[^a-z0-9_-]/g, "_");
let validatedAppId = null;
if (appId && typeof appId === "string" && appId.trim()) {
const uuidRegex =
/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
if (!uuidRegex.test(appId)) {
return c.json({ error: "Invalid App UUID" }, 400);
}
const appExists = await sqlWrapper
.sql`SELECT id, name FROM apps WHERE id = ${appId}`
.then((res: any) => res[0]);
if (!appExists) {
return c.json({ error: "Selected application does not exist" }, 404);
}
validatedAppId = appId;
}
try {
const newRole = await sqlWrapper.sql`
INSERT INTO roles (name, description, app_id)
VALUES (${normalizedName}, ${
description?.trim() || null
}, ${validatedAppId})
RETURNING id, name, description, app_id, created_at
`.then((res: any) => res[0]);
auditWrapper.auditLog(auth.userId, "role_created", validatedAppId, {
role_name: newRole.name,
scope: validatedAppId ? "app-specific" : "global",
}, getClientIp(c));
return c.json({ success: true, role: newRole });
} catch (err: any) {
if (err.code === "23505") {
return c.json({
error: "This role already exists for the selected scope",
}, 409);
}
return c.json({ error: "Failed to create role" }, 500);
}
});
adminRoutes.put("/roles/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const roleId = c.req.param("id");
const { name, description } = await c.req.json();
if (!name || typeof name !== "string" || name.trim().length < 2) {
return c.json({ error: "Role name must be at least 2 characters" }, 400);
}
const normalizedName = name.trim().toLowerCase().replace(/[^a-z0-9_-]/g, "_");
try {
const updatedRole = await sqlWrapper.sql`
UPDATE roles
SET name = ${normalizedName},
description = ${description?.trim() || null}
WHERE id = ${roleId}
RETURNING id, name, description, app_id, created_at
`.then((res: any) => res[0]);
if (!updatedRole) return c.json({ error: "Role not found" }, 404);
auditWrapper.auditLog(auth.userId, "role_updated", updatedRole.app_id, {
role_name: updatedRole.name,
}, getClientIp(c));
return c.json({ success: true, role: updatedRole });
} catch (_err: any) {
return c.json({ error: "Failed to update role" }, 500);
}
});
adminRoutes.delete("/roles/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const roleId = c.req.param("id");
const role = await sqlWrapper
.sql`SELECT id, name, app_id FROM roles WHERE id = ${roleId}`.then(
(res: any) => res[0],
);
if (!role) {
return c.json({ error: "Role not found" }, 404);
}
if (role.name === "admin" && role.app_id === null) {
return c.json({ error: "The global 'admin' role cannot be deleted" }, 400);
}
await sqlWrapper.sql`DELETE FROM roles WHERE id = ${roleId}`;
auditWrapper.auditLog(
auth.userId,
"role_deleted",
role.app_id,
{ role_name: role.name },
getClientIp(c),
);
return c.json({ success: true });
});
// ---------------------------------------------------------
// Admin Invites / Registration Tokens
// ---------------------------------------------------------
adminRoutes.get("/invites", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const invites = await sqlWrapper.sql`
SELECT i.id, i.code, i.role, i.max_uses, i.uses_count, i.auto_activate, i.expires_at, i.created_at, i.used_at,
a.name AS app_name, a.id AS app_id,
u.username AS used_by_username
FROM invites i
LEFT JOIN apps a ON i.app_id = a.id
LEFT JOIN users u ON i.used_by = u.id
ORDER BY i.created_at DESC
`;
return c.json({ invites });
});
adminRoutes.post("/invites/create", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const {
appId,
role,
expiresInDays,
customCode,
usageLimitType,
maxUses,
autoActivate,
} = await c.req.json();
const assignedRole = (typeof role === "string" && role.trim())
? role.trim()
: "user";
let validatedAppId = null;
if (appId) {
const uuidRegex =
/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
if (typeof appId !== "string" || !uuidRegex.test(appId)) {
return c.json({ error: "appId must be a valid UUID string" }, 400);
}
const appExists = await sqlWrapper
.sql`SELECT id FROM apps WHERE id = ${appId}`.then(
(res: any) => res[0],
);
if (!appExists) {
return c.json({ error: "Target application does not exist" }, 404);
}
validatedAppId = appId;
}
let parsedMaxUses: number | null = 1;
if (usageLimitType === "unlimited") {
parsedMaxUses = null;
} else if (usageLimitType === "limited") {
const n = parseInt(maxUses);
parsedMaxUses = (!isNaN(n) && n > 0) ? n : 5;
} else {
parsedMaxUses = 1; // single-use default
}
const shouldAutoActivate = autoActivate !== false;
const inviteCode =
(customCode && typeof customCode === "string" && customCode.trim())
? customCode.trim()
: encodeBase64Url(crypto.getRandomValues(new Uint8Array(24)));
const days = Number(expiresInDays) || 7;
if (!Number.isInteger(days) || days < 1 || days > 30) {
return c.json({
error: "expiresInDays must be an integer between 1 and 30",
}, 400);
}
const expiresAt = new Date();
expiresAt.setDate(expiresAt.getDate() + days);
try {
await sqlWrapper.sql`
INSERT INTO invites (code, app_id, role, created_by, max_uses, uses_count, auto_activate, expires_at)
VALUES (${inviteCode}, ${validatedAppId}, ${assignedRole}, ${auth.userId}, ${parsedMaxUses}, 0, ${shouldAutoActivate}, ${expiresAt})
`;
} catch (err: any) {
if (err.code === "23505") {
return c.json({ error: "An invite with this code already exists" }, 409);
}
return c.json({ error: "Failed to generate invite" }, 500);
}
auditWrapper.auditLog(
auth.userId,
"invite_created",
validatedAppId,
{
code: inviteCode,
role: assignedRole,
max_uses: parsedMaxUses,
auto_activate: shouldAutoActivate,
expiresInDays: days,
},
getClientIp(c),
);
return c.json({
success: true,
inviteCode,
expiresAt,
maxUses: parsedMaxUses,
autoActivate: shouldAutoActivate,
});
});
adminRoutes.get("/invites/:id/redemptions", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const inviteId = c.req.param("id");
const redemptions = await sqlWrapper.sql`
SELECT ir.id, ir.redeemed_at, u.id AS user_id, u.username, u.display_name, u.account_status
FROM invite_redemptions ir
JOIN users u ON ir.user_id = u.id
WHERE ir.invite_id = ${inviteId}
ORDER BY ir.redeemed_at DESC
`;
return c.json({ redemptions });
});
adminRoutes.delete("/invites/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const inviteId = c.req.param("id");
const invite = await sqlWrapper
.sql`DELETE FROM invites WHERE id = ${inviteId} RETURNING id, code`
.then((res: any) => res[0]);
if (invite) {
auditWrapper.auditLog(
auth.userId,
"invite_revoked",
inviteId,
{ code: invite.code },
getClientIp(c),
);
return c.json({ success: true });
}
return c.json({ error: "Invite not found" }, 404);
});
// ---------------------------------------------------------
// Admin User RBAC Grants Management
// ---------------------------------------------------------
adminRoutes.get("/users/:id/grants", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetUserId = c.req.param("id");
const grants = await sqlWrapper.sql`
SELECT g.id, g.app_id, g.role, g.created_at, a.name AS app_name, a.spiffe_id
FROM grants g
JOIN apps a ON g.app_id = a.id
WHERE g.user_id = ${targetUserId}
ORDER BY a.name ASC
`;
return c.json({ grants });
});
adminRoutes.post("/users/:id/grants", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetUserId = c.req.param("id");
const { appId, role } = await c.req.json();
if (!appId || !role) {
return c.json({ error: "appId and role are required" }, 400);
}
const app = await sqlWrapper
.sql`SELECT id, name FROM apps WHERE id = ${appId}`.then(
(res: any) => res[0],
);
if (!app) return c.json({ error: "Application not found" }, 404);
const targetUser = await sqlWrapper
.sql`SELECT id, username FROM users WHERE id = ${targetUserId}`.then(
(res: any) => res[0],
);
if (!targetUser) return c.json({ error: "User not found" }, 404);
await sqlWrapper.sql`
INSERT INTO grants (user_id, app_id, role)
VALUES (${targetUserId}, ${appId}, ${role})
ON CONFLICT (user_id, app_id) DO UPDATE SET role = ${role}
`;
auditWrapper.auditLog(
auth.userId,
"user_grant_assigned",
targetUserId,
{ app_id: appId, app_name: app.name, role },
getClientIp(c),
);
return c.json({ success: true });
});
adminRoutes.delete("/users/:id/grants/:appId", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const { id: targetUserId, appId } = c.req.param();
const grant = await sqlWrapper.sql`
DELETE FROM grants
WHERE user_id = ${targetUserId} AND app_id = ${appId}
RETURNING id
`.then((res: any) => res[0]);
if (grant) {
auditWrapper.auditLog(
auth.userId,
"user_grant_revoked",
targetUserId,
{ app_id: appId },
getClientIp(c),
);
return c.json({ success: true });
}
return c.json({ error: "Grant not found" }, 404);
});
// ---------------------------------------------------------
// Admin AAGUID Management
// ---------------------------------------------------------
adminRoutes.get("/aaguid", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const allowlist = await sqlWrapper
.sql`SELECT id, aaguid, description, created_at FROM aaguid_allowlist ORDER BY created_at DESC`;
return c.json({ allowlist });
});
adminRoutes.post("/aaguid", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const { aaguid, description } = await c.req.json();
const uuidRegex =
/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/i;
if (!aaguid || !uuidRegex.test(aaguid)) {
return c.json({ error: "Valid AAGUID (UUID) is required" }, 400);
}
try {
await sqlWrapper
.sql`INSERT INTO aaguid_allowlist (aaguid, description) VALUES (${aaguid.toLowerCase()}, ${
description || null
})`;
auditWrapper.auditLog(
auth.userId,
"aaguid_added",
null,
{ aaguid },
getClientIp(c),
);
return c.json({ success: true });
} catch (err: any) {
if (err.code === "23505") {
return c.json({ error: "AAGUID already exists" }, 409);
}
return c.json({ error: "Internal server error" }, 500);
}
});
adminRoutes.delete("/aaguid/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const id = c.req.param("id");
const record = await sqlWrapper
.sql`DELETE FROM aaguid_allowlist WHERE id = ${id} RETURNING aaguid`
.then((res: any) => res[0]);
if (record) {
auditWrapper.auditLog(
auth.userId,
"aaguid_removed",
null,
{ aaguid: record.aaguid },
getClientIp(c),
);
}
return c.json({ success: true });
});
// ---------------------------------------------------------
// Admin HWK (Header Web Key) Management
// ---------------------------------------------------------
adminRoutes.post("/hwk", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const { jwk, name } = await c.req.json();
if (!jwk || !name || typeof name !== "string") {
return c.json({ error: "Missing required fields: jwk, name" }, 400);
}
if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || !jwk.x) {
return c.json({ error: "Invalid JWK: Must be an Ed25519 OKP key" }, 400);
}
try {
const fingerprint = await computeJwkThumbprint(jwk);
// 1. Dual Storage: PostgreSQL (Durability)
await sqlWrapper.sql`
INSERT INTO hwk_keys (fingerprint, public_key, name)
VALUES (${fingerprint}, ${JSON.stringify(jwk)}, ${name})
`;
// 2. Dual Storage: Valkey (O(1) Verification)
await valkey.sadd("auth:hwk:fingerprints", fingerprint);
auditWrapper.auditLog(
auth.userId,
"hwk_added",
null,
{ fingerprint, name },
getClientIp(c),
);
return c.json({ success: true, fingerprint }, 201);
} catch (err: any) {
if (err.code === "23505") {
return c.json({ error: "This key has already been registered" }, 409);
}
console.error("Failed to add HWK:", err);
return c.json({ error: "Internal server error" }, 500);
}
});
adminRoutes.delete("/hwk/:fingerprint", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const fingerprint = c.req.param("fingerprint");
// 1. Remove from PostgreSQL
const record = await sqlWrapper.sql`
DELETE FROM hwk_keys WHERE fingerprint = ${fingerprint} RETURNING id, name
`.then((res: any) => res[0]);
if (record) {
// 2. Remove from Valkey
try {
await valkey.srem("auth:hwk:fingerprints", fingerprint);
} catch (_err) {}
auditWrapper.auditLog(auth.userId, "hwk_removed", null, {
fingerprint,
name: record.name,
}, getClientIp(c));
return c.json({ success: true });
}
return c.json({ error: "Key not found" }, 404);
});
// ---------------------------------------------------------
// Global Session and Device Revocation (Admin)
// ---------------------------------------------------------
adminRoutes.get("/users/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetUserId = c.req.param("id");
const user = await sqlWrapper
.sql`SELECT id, username, display_name, account_status FROM users WHERE id = ${targetUserId}`
.then((res: any) => res[0]);
if (!user) return c.json({ error: "User not found" }, 404);
const sessions = await sqlWrapper
.sql`SELECT id, created_at, expires_at FROM sessions WHERE user_id = ${targetUserId} ORDER BY created_at DESC`;
const passkeys = await sqlWrapper
.sql`SELECT id, credential_id, counter FROM passkeys WHERE user_id = ${targetUserId}`;
return c.json({ user, sessions, passkeys });
});
adminRoutes.delete("/sessions/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const sessionId = c.req.param("id");
const session = await sqlWrapper
.sql`DELETE FROM sessions WHERE id = ${sessionId} RETURNING user_id`
.then((res: any) => res[0]);
if (session) {
try {
await valkey.del(sessionId);
} catch (_err) {}
auditWrapper.auditLog(
auth.userId,
"admin_session_revoked",
session.user_id,
{
revoked_session_id: sessionId,
},
getClientIp(c),
);
}
return c.json({ success: true });
});
adminRoutes.delete("/users/:id/sessions", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetUserId = c.req.param("id");
const sessions = await sqlWrapper
.sql`DELETE FROM sessions WHERE user_id = ${targetUserId} RETURNING id`;
for (const session of sessions) {
try {
await valkey.del(session.id);
} catch (_err) {}
}
auditWrapper.auditLog(
auth.userId,
"admin_all_sessions_revoked",
targetUserId,
null,
getClientIp(c),
);
return c.json({ success: true });
});
adminRoutes.delete("/users/:userId/passkeys/:passkeyId", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const { userId, passkeyId } = c.req.param();
const passkey = await sqlWrapper
.sql`DELETE FROM passkeys WHERE id = ${passkeyId} AND user_id = ${userId} RETURNING id`
.then((res: any) => res[0]);
if (passkey) {
auditWrapper.auditLog(auth.userId, "admin_passkey_revoked", userId, {
passkey_id: passkey.id,
}, getClientIp(c));
return c.json({ success: true });
}
return c.json({ error: "Passkey not found" }, 404);
});
// ---------------------------------------------------------
// Out-of-Band Account Recovery (Use Case 12)
// ---------------------------------------------------------
adminRoutes.post("/users/:id/recovery", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetUserId = c.req.param("id");
const targetUser = await sqlWrapper
.sql`SELECT id FROM users WHERE id = ${targetUserId}`
.then((res: any) => res[0]);
if (!targetUser) return c.json({ error: "User not found" }, 404);
const recoveryCode = encodeBase64Url(
crypto.getRandomValues(new Uint8Array(24)),
);
const expiresAt = new Date();
expiresAt.setDate(expiresAt.getDate() + 1);
await sqlWrapper
.sql`INSERT INTO recovery_links (code, user_id, created_by, expires_at) VALUES (${recoveryCode}, ${targetUserId}, ${auth.userId}, ${expiresAt})`;
auditWrapper.auditLog(
auth.userId,
"recovery_link_created",
targetUserId,
null,
getClientIp(c),
);
return c.json({ success: true, recoveryCode, expiresAt });
});
adminRoutes.get("/check", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const isAdmin = await isGlobalAdmin(auth.userId);
return c.json({ isAdmin });
});

129
server/routes/admin/apps.ts
View File

@ -1,129 +0,0 @@
import { Hono } from "jsr:@hono/hono@4";
import { sqlWrapper } from "../../db.ts";
import { auditWrapper } from "../../audit.ts";
import { getAuthenticatedUser } from "../../auth-session.ts";
import { getClientIp } from "../../middleware.ts";
export const appsAdminRoutes = new Hono();
appsAdminRoutes.get("/", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const apps = await sqlWrapper.sql`
SELECT a.id, a.name, a.spiffe_id, a.description, a.created_at,
COUNT(g.id) AS active_grants_count
FROM apps a
LEFT JOIN grants g ON a.id = g.app_id
GROUP BY a.id, a.name, a.spiffe_id, a.description, a.created_at
ORDER BY a.created_at ASC
`;
return c.json({ apps });
});
appsAdminRoutes.post("/", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const {
name,
spiffeId,
description,
domain,
is_public,
bypass_paths,
allowed_cidrs,
} = await c.req.json();
if (!name || !spiffeId) {
return c.json({ error: "Name and SPIFFE ID are required" }, 400);
}
try {
const newApp = await sqlWrapper.sql`
INSERT INTO apps (name, spiffe_id, description, domain, is_public, bypass_paths, allowed_cidrs)
VALUES (${name.trim()}, ${spiffeId.trim()}, ${
description?.trim() || null
}, ${domain?.trim() || null}, ${is_public || false}, ${
bypass_paths || []
}, ${allowed_cidrs || []})
RETURNING id, name, spiffe_id, description, created_at
`.then((res: any) => res[0]);
auditWrapper.auditLog(auth.userId, "app_registered", newApp.id, {
name: newApp.name,
spiffe_id: newApp.spiffe_id,
}, getClientIp(c));
return c.json({ success: true, app: newApp });
} catch (err: any) {
if (err.code === "23505") {
return c.json({
error: "An application with this SPIFFE ID already exists",
}, 409);
}
return c.json({ error: "Failed to register application" }, 500);
}
});
appsAdminRoutes.put("/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const appId = c.req.param("id");
const {
name,
description,
domain,
is_public,
bypass_paths,
allowed_cidrs,
} = await c.req.json();
if (!name) {
return c.json({ error: "Application name is required" }, 400);
}
try {
const updatedApp = await sqlWrapper.sql`
UPDATE apps
SET name = ${name.trim()},
description = ${description?.trim() || null},
domain = ${domain?.trim() || null},
is_public = ${is_public || false},
bypass_paths = ${bypass_paths || []},
allowed_cidrs = ${allowed_cidrs || []}
WHERE id = ${appId}
RETURNING id, name, spiffe_id, description, domain, is_public, bypass_paths, allowed_cidrs
`.then((res: any) => res[0]);
if (!updatedApp) return c.json({ error: "Application not found" }, 404);
auditWrapper.auditLog(auth.userId, "app_updated", updatedApp.id, {
name: updatedApp.name,
}, getClientIp(c));
return c.json({ success: true, app: updatedApp });
} catch (_err: any) {
return c.json({ error: "Failed to update application" }, 500);
}
});
appsAdminRoutes.delete("/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const appId = c.req.param("id");
const app = await sqlWrapper
.sql`DELETE FROM apps WHERE id = ${appId} RETURNING id, name`
.then((res: any) => res[0]);
if (app) {
auditWrapper.auditLog(
auth.userId,
"app_deleted",
appId,
{ name: app.name },
getClientIp(c),
);
return c.json({ success: true });
}
return c.json({ error: "Application not found" }, 404);
});

55
server/routes/admin/audit.ts
View File

@ -1,55 +0,0 @@
import { Hono } from "jsr:@hono/hono@4";
import { sqlWrapper } from "../../db.ts";
import { valkey } from "../../valkey.ts";
import { auditWrapper } from "../../audit.ts";
import { getAuthenticatedUser, isGlobalAdmin } from "../../auth-session.ts";
import { getClientIp } from "../../middleware.ts";
export const auditAdminRoutes = new Hono();
auditAdminRoutes.get("/audit-logs", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const logs = await sqlWrapper.sql`
SELECT a.id, a.action, a.resource, a.details, a.ip_address, a.created_at, u.username as user
FROM audit_records a
LEFT JOIN users u ON a.user_id = u.id
ORDER BY a.created_at DESC
LIMIT 100
`;
return c.json({ logs });
});
auditAdminRoutes.get("/check", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const isAdmin = await isGlobalAdmin(auth.userId);
return c.json({ isAdmin });
});
auditAdminRoutes.delete("/sessions/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const sessionId = c.req.param("id");
const session = await sqlWrapper
.sql`DELETE FROM sessions WHERE id = ${sessionId} RETURNING user_id`
.then((res: any) => res[0]);
if (session) {
try {
await valkey.del(sessionId);
} catch (_err) {}
auditWrapper.auditLog(
auth.userId,
"admin_session_revoked",
session.user_id,
{
revoked_session_id: sessionId,
},
getClientIp(c),
);
}
return c.json({ success: true });
});

136
server/routes/admin/hardware_keys.ts
View File

@ -1,136 +0,0 @@
import { Hono } from "jsr:@hono/hono@4";
import { sqlWrapper } from "../../db.ts";
import { valkey } from "../../valkey.ts";
import { auditWrapper } from "../../audit.ts";
import { getAuthenticatedUser } from "../../auth-session.ts";
import { getClientIp } from "../../middleware.ts";
import { computeJwkThumbprint } from "../../http_signatures.ts";
export const hardwareKeysAdminRoutes = new Hono();
hardwareKeysAdminRoutes.get("/aaguid", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const allowlist = await sqlWrapper
.sql`SELECT id, aaguid, description, created_at FROM aaguid_allowlist ORDER BY created_at DESC`;
return c.json({ allowlist });
});
hardwareKeysAdminRoutes.post("/aaguid", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const { aaguid, description } = await c.req.json();
const uuidRegex =
/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/i;
if (!aaguid || !uuidRegex.test(aaguid)) {
return c.json({ error: "Valid AAGUID (UUID) is required" }, 400);
}
try {
await sqlWrapper
.sql`INSERT INTO aaguid_allowlist (aaguid, description) VALUES (${aaguid.toLowerCase()}, ${
description || null
})`;
auditWrapper.auditLog(
auth.userId,
"aaguid_added",
null,
{ aaguid },
getClientIp(c),
);
return c.json({ success: true });
} catch (err: any) {
if (err.code === "23505") {
return c.json({ error: "AAGUID already exists" }, 409);
}
return c.json({ error: "Internal server error" }, 500);
}
});
hardwareKeysAdminRoutes.delete("/aaguid/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const id = c.req.param("id");
const record = await sqlWrapper
.sql`DELETE FROM aaguid_allowlist WHERE id = ${id} RETURNING aaguid`
.then((res: any) => res[0]);
if (record) {
auditWrapper.auditLog(
auth.userId,
"aaguid_removed",
null,
{ aaguid: record.aaguid },
getClientIp(c),
);
}
return c.json({ success: true });
});
hardwareKeysAdminRoutes.post("/hwk", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const { jwk, name } = await c.req.json();
if (!jwk || !name || typeof name !== "string") {
return c.json({ error: "Missing required fields: jwk, name" }, 400);
}
if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || !jwk.x) {
return c.json({ error: "Invalid JWK: Must be an Ed25519 OKP key" }, 400);
}
try {
const fingerprint = await computeJwkThumbprint(jwk);
// 1. Dual Storage: PostgreSQL (Durability)
await sqlWrapper.sql`
INSERT INTO hwk_keys (fingerprint, public_key, name)
VALUES (${fingerprint}, ${JSON.stringify(jwk)}, ${name})
`;
// 2. Dual Storage: Valkey (O(1) Verification)
await valkey.sadd("auth:hwk:fingerprints", fingerprint);
auditWrapper.auditLog(
auth.userId,
"hwk_added",
null,
{ fingerprint, name },
getClientIp(c),
);
return c.json({ success: true, fingerprint }, 201);
} catch (err: any) {
if (err.code === "23505") {
return c.json({ error: "This key has already been registered" }, 409);
}
console.error("Failed to add HWK:", err);
return c.json({ error: "Internal server error" }, 500);
}
});
hardwareKeysAdminRoutes.delete("/hwk/:fingerprint", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const fingerprint = c.req.param("fingerprint");
// 1. Remove from PostgreSQL
const record = await sqlWrapper.sql`
DELETE FROM hwk_keys WHERE fingerprint = ${fingerprint} RETURNING id, name
`.then((res: any) => res[0]);
if (record) {
// 2. Remove from Valkey
try {
await valkey.srem("auth:hwk:fingerprints", fingerprint);
} catch (_err) {}
auditWrapper.auditLog(auth.userId, "hwk_removed", null, {
fingerprint,
name: record.name,
}, getClientIp(c));
return c.json({ success: true });
}
return c.json({ error: "Key not found" }, 404);
});

157
server/routes/admin/invites.ts
View File

@ -1,157 +0,0 @@
import { Hono } from "jsr:@hono/hono@4";
import { encodeBase64Url } from "jsr:@std/encoding@1/base64url";
import { sqlWrapper } from "../../db.ts";
import { auditWrapper } from "../../audit.ts";
import { getAuthenticatedUser } from "../../auth-session.ts";
import { getClientIp } from "../../middleware.ts";
export const invitesAdminRoutes = new Hono();
invitesAdminRoutes.get("/", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const invites = await sqlWrapper.sql`
SELECT i.id, i.code, i.role, i.max_uses, i.uses_count, i.auto_activate, i.expires_at, i.created_at, i.used_at,
a.name AS app_name, a.id AS app_id,
u.username AS used_by_username
FROM invites i
LEFT JOIN apps a ON i.app_id = a.id
LEFT JOIN users u ON i.used_by = u.id
ORDER BY i.created_at DESC
`;
return c.json({ invites });
});
invitesAdminRoutes.post("/create", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const {
appId,
role,
expiresInDays,
customCode,
usageLimitType,
maxUses,
autoActivate,
} = await c.req.json();
const assignedRole = (typeof role === "string" && role.trim())
? role.trim()
: "user";
let validatedAppId = null;
if (appId) {
const uuidRegex =
/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
if (typeof appId !== "string" || !uuidRegex.test(appId)) {
return c.json({ error: "appId must be a valid UUID string" }, 400);
}
const appExists = await sqlWrapper
.sql`SELECT id FROM apps WHERE id = ${appId}`.then(
(res: any) => res[0],
);
if (!appExists) {
return c.json({ error: "Target application does not exist" }, 404);
}
validatedAppId = appId;
}
let parsedMaxUses: number | null = 1;
if (usageLimitType === "unlimited") {
parsedMaxUses = null;
} else if (usageLimitType === "limited") {
const n = parseInt(maxUses);
parsedMaxUses = (!isNaN(n) && n > 0) ? n : 5;
} else {
parsedMaxUses = 1; // single-use default
}
const shouldAutoActivate = autoActivate !== false;
const inviteCode =
(customCode && typeof customCode === "string" && customCode.trim())
? customCode.trim()
: encodeBase64Url(crypto.getRandomValues(new Uint8Array(24)));
const days = Number(expiresInDays) || 7;
if (!Number.isInteger(days) || days < 1 || days > 30) {
return c.json({
error: "expiresInDays must be an integer between 1 and 30",
}, 400);
}
const expiresAt = new Date();
expiresAt.setDate(expiresAt.getDate() + days);
try {
await sqlWrapper.sql`
INSERT INTO invites (code, app_id, role, created_by, max_uses, uses_count, auto_activate, expires_at)
VALUES (${inviteCode}, ${validatedAppId}, ${assignedRole}, ${auth.userId}, ${parsedMaxUses}, 0, ${shouldAutoActivate}, ${expiresAt})
`;
} catch (err: any) {
if (err.code === "23505") {
return c.json({ error: "An invite with this code already exists" }, 409);
}
return c.json({ error: "Failed to generate invite" }, 500);
}
auditWrapper.auditLog(
auth.userId,
"invite_created",
validatedAppId,
{
code: inviteCode,
role: assignedRole,
max_uses: parsedMaxUses,
auto_activate: shouldAutoActivate,
expiresInDays: days,
},
getClientIp(c),
);
return c.json({
success: true,
inviteCode,
expiresAt,
maxUses: parsedMaxUses,
autoActivate: shouldAutoActivate,
});
});
invitesAdminRoutes.get("/:id/redemptions", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const inviteId = c.req.param("id");
const redemptions = await sqlWrapper.sql`
SELECT ir.id, ir.redeemed_at, u.id AS user_id, u.username, u.display_name, u.account_status
FROM invite_redemptions ir
JOIN users u ON ir.user_id = u.id
WHERE ir.invite_id = ${inviteId}
ORDER BY ir.redeemed_at DESC
`;
return c.json({ redemptions });
});
invitesAdminRoutes.delete("/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const inviteId = c.req.param("id");
const invite = await sqlWrapper
.sql`DELETE FROM invites WHERE id = ${inviteId} RETURNING id, code`
.then((res: any) => res[0]);
if (invite) {
auditWrapper.auditLog(
auth.userId,
"invite_revoked",
inviteId,
{ code: invite.code },
getClientIp(c),
);
return c.json({ success: true });
}
return c.json({ error: "Invite not found" }, 404);
});

155
server/routes/admin/roles.ts
View File

@ -1,155 +0,0 @@
import { Hono } from "jsr:@hono/hono@4";
import { sqlWrapper } from "../../db.ts";
import { auditWrapper } from "../../audit.ts";
import { getAuthenticatedUser } from "../../auth-session.ts";
import { getClientIp } from "../../middleware.ts";
export const rolesAdminRoutes = new Hono();
rolesAdminRoutes.get("/", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const appId = c.req.query("appId");
let roles;
if (appId) {
roles = await sqlWrapper.sql`
SELECT r.id, r.name, r.description, r.app_id, r.created_at,
a.name AS app_name
FROM roles r
LEFT JOIN apps a ON r.app_id = a.id
WHERE r.app_id IS NULL OR r.app_id = ${appId}
ORDER BY r.app_id NULLS FIRST, r.name ASC
`;
} else {
roles = await sqlWrapper.sql`
SELECT r.id, r.name, r.description, r.app_id, r.created_at,
a.name AS app_name
FROM roles r
LEFT JOIN apps a ON r.app_id = a.id
ORDER BY r.app_id NULLS FIRST, r.name ASC
`;
}
return c.json({ roles });
});
rolesAdminRoutes.post("/", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const { name, description, appId } = await c.req.json();
if (
!name || typeof name !== "string" || name.trim().length < 2 ||
name.trim().length > 32
) {
return c.json(
{ error: "Role name must be between 2 and 32 characters" },
400,
);
}
const normalizedName = name.trim().toLowerCase().replace(/[^a-z0-9_-]/g, "_");
let validatedAppId = null;
if (appId && typeof appId === "string" && appId.trim()) {
const uuidRegex =
/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
if (!uuidRegex.test(appId)) {
return c.json({ error: "Invalid App UUID" }, 400);
}
const appExists = await sqlWrapper
.sql`SELECT id, name FROM apps WHERE id = ${appId}`
.then((res: any) => res[0]);
if (!appExists) {
return c.json({ error: "Selected application does not exist" }, 404);
}
validatedAppId = appId;
}
try {
const newRole = await sqlWrapper.sql`
INSERT INTO roles (name, description, app_id)
VALUES (${normalizedName}, ${
description?.trim() || null
}, ${validatedAppId})
RETURNING id, name, description, app_id, created_at
`.then((res: any) => res[0]);
auditWrapper.auditLog(auth.userId, "role_created", validatedAppId, {
role_name: newRole.name,
scope: validatedAppId ? "app-specific" : "global",
}, getClientIp(c));
return c.json({ success: true, role: newRole });
} catch (err: any) {
if (err.code === "23505") {
return c.json({
error: "This role already exists for the selected scope",
}, 409);
}
return c.json({ error: "Failed to create role" }, 500);
}
});
rolesAdminRoutes.put("/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const roleId = c.req.param("id");
const { name, description } = await c.req.json();
if (!name || typeof name !== "string" || name.trim().length < 2) {
return c.json({ error: "Role name must be at least 2 characters" }, 400);
}
const normalizedName = name.trim().toLowerCase().replace(/[^a-z0-9_-]/g, "_");
try {
const updatedRole = await sqlWrapper.sql`
UPDATE roles
SET name = ${normalizedName},
description = ${description?.trim() || null}
WHERE id = ${roleId}
RETURNING id, name, description, app_id, created_at
`.then((res: any) => res[0]);
if (!updatedRole) return c.json({ error: "Role not found" }, 404);
auditWrapper.auditLog(auth.userId, "role_updated", updatedRole.app_id, {
role_name: updatedRole.name,
}, getClientIp(c));
return c.json({ success: true, role: updatedRole });
} catch (_err: any) {
return c.json({ error: "Failed to update role" }, 500);
}
});
rolesAdminRoutes.delete("/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const roleId = c.req.param("id");
const role = await sqlWrapper
.sql`SELECT id, name, app_id FROM roles WHERE id = ${roleId}`.then(
(res: any) => res[0],
);
if (!role) {
return c.json({ error: "Role not found" }, 404);
}
if (role.name === "admin" && role.app_id === null) {
return c.json({ error: "The global 'admin' role cannot be deleted" }, 400);
}
await sqlWrapper.sql`DELETE FROM roles WHERE id = ${roleId}`;
auditWrapper.auditLog(
auth.userId,
"role_deleted",
role.app_id,
{ role_name: role.name },
getClientIp(c),
);
return c.json({ success: true });
});

228
server/routes/admin/users.ts
View File

@ -1,228 +0,0 @@
import { Hono } from "jsr:@hono/hono@4";
import { encodeBase64Url } from "jsr:@std/encoding@1/base64url";
import { sqlWrapper } from "../../db.ts";
import { valkey } from "../../valkey.ts";
import { auditWrapper } from "../../audit.ts";
import { getAuthenticatedUser } from "../../auth-session.ts";
import { getClientIp } from "../../middleware.ts";
export const usersAdminRoutes = new Hono();
usersAdminRoutes.get("/", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const users = await sqlWrapper.sql`
SELECT id, username, display_name, account_status
FROM users
ORDER BY username ASC
`;
return c.json({ users });
});
usersAdminRoutes.post("/:id/status", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetUserId = c.req.param("id");
const { status } = await c.req.json();
if (!["active", "pending", "suspended"].includes(status)) {
return c.json({ error: "Invalid status" }, 400);
}
const targetUser = await sqlWrapper
.sql`UPDATE users SET account_status = ${status} WHERE id = ${targetUserId} RETURNING id`
.then((res: any) => res[0]);
if (!targetUser) {
return c.json({ error: "User not found" }, 404);
}
auditWrapper.auditLog(auth.userId, "user_status_changed", targetUserId, {
newStatus: status,
}, getClientIp(c));
return c.json({ success: true });
});
usersAdminRoutes.post("/:id/profile", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetUserId = c.req.param("id");
const { displayName } = await c.req.json();
const targetUser = await sqlWrapper
.sql`UPDATE users SET display_name = ${
displayName?.trim() || null
} WHERE id = ${targetUserId} RETURNING id, username, display_name`
.then((res: any) => res[0]);
if (!targetUser) return c.json({ error: "User not found" }, 404);
auditWrapper.auditLog(auth.userId, "user_profile_updated", targetUserId, {
display_name: targetUser.display_name,
}, getClientIp(c));
return c.json({ success: true, user: targetUser });
});
usersAdminRoutes.get("/:id/grants", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetUserId = c.req.param("id");
const grants = await sqlWrapper.sql`
SELECT g.id, g.app_id, g.role, g.created_at, a.name AS app_name, a.spiffe_id
FROM grants g
JOIN apps a ON g.app_id = a.id
WHERE g.user_id = ${targetUserId}
ORDER BY a.name ASC
`;
return c.json({ grants });
});
usersAdminRoutes.post("/:id/grants", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetUserId = c.req.param("id");
const { appId, role } = await c.req.json();
if (!appId || !role) {
return c.json({ error: "appId and role are required" }, 400);
}
const app = await sqlWrapper
.sql`SELECT id, name FROM apps WHERE id = ${appId}`.then(
(res: any) => res[0],
);
if (!app) return c.json({ error: "Application not found" }, 404);
const targetUser = await sqlWrapper
.sql`SELECT id, username FROM users WHERE id = ${targetUserId}`.then(
(res: any) => res[0],
);
if (!targetUser) return c.json({ error: "User not found" }, 404);
await sqlWrapper.sql`
INSERT INTO grants (user_id, app_id, role)
VALUES (${targetUserId}, ${appId}, ${role})
ON CONFLICT (user_id, app_id) DO UPDATE SET role = ${role}
`;
auditWrapper.auditLog(
auth.userId,
"user_grant_assigned",
targetUserId,
{ app_id: appId, app_name: app.name, role },
getClientIp(c),
);
return c.json({ success: true });
});
usersAdminRoutes.delete("/:id/grants/:appId", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const { id: targetUserId, appId } = c.req.param();
const grant = await sqlWrapper.sql`
DELETE FROM grants
WHERE user_id = ${targetUserId} AND app_id = ${appId}
RETURNING id
`.then((res: any) => res[0]);
if (grant) {
auditWrapper.auditLog(
auth.userId,
"user_grant_revoked",
targetUserId,
{ app_id: appId },
getClientIp(c),
);
return c.json({ success: true });
}
return c.json({ error: "Grant not found" }, 404);
});
usersAdminRoutes.get("/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetUserId = c.req.param("id");
const user = await sqlWrapper
.sql`SELECT id, username, display_name, account_status FROM users WHERE id = ${targetUserId}`
.then((res: any) => res[0]);
if (!user) return c.json({ error: "User not found" }, 404);
const sessions = await sqlWrapper
.sql`SELECT id, created_at, expires_at FROM sessions WHERE user_id = ${targetUserId} ORDER BY created_at DESC`;
const passkeys = await sqlWrapper
.sql`SELECT id, credential_id, counter FROM passkeys WHERE user_id = ${targetUserId}`;
return c.json({ user, sessions, passkeys });
});
usersAdminRoutes.delete("/:id/sessions", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetUserId = c.req.param("id");
const sessions = await sqlWrapper
.sql`DELETE FROM sessions WHERE user_id = ${targetUserId} RETURNING id`;
for (const session of sessions) {
try {
await valkey.del(session.id);
} catch (_err) {}
}
auditWrapper.auditLog(
auth.userId,
"admin_all_sessions_revoked",
targetUserId,
null,
getClientIp(c),
);
return c.json({ success: true });
});
usersAdminRoutes.delete("/:userId/passkeys/:passkeyId", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const { userId, passkeyId } = c.req.param();
const passkey = await sqlWrapper
.sql`DELETE FROM passkeys WHERE id = ${passkeyId} AND user_id = ${userId} RETURNING id`
.then((res: any) => res[0]);
if (passkey) {
auditWrapper.auditLog(auth.userId, "admin_passkey_revoked", userId, {
passkey_id: passkey.id,
}, getClientIp(c));
return c.json({ success: true });
}
return c.json({ error: "Passkey not found" }, 404);
});
usersAdminRoutes.post("/:id/recovery", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetUserId = c.req.param("id");
const targetUser = await sqlWrapper
.sql`SELECT id FROM users WHERE id = ${targetUserId}`
.then((res: any) => res[0]);
if (!targetUser) return c.json({ error: "User not found" }, 404);
const recoveryCode = encodeBase64Url(
crypto.getRandomValues(new Uint8Array(24)),
);
const expiresAt = new Date();
expiresAt.setDate(expiresAt.getDate() + 1);
await sqlWrapper
.sql`INSERT INTO recovery_links (code, user_id, created_by, expires_at) VALUES (${recoveryCode}, ${targetUserId}, ${auth.userId}, ${expiresAt})`;
auditWrapper.auditLog(
auth.userId,
"recovery_link_created",
targetUserId,
null,
getClientIp(c),
);
return c.json({ success: true, recoveryCode, expiresAt });
});

931
server/routes/auth.ts
View File

@ -1,13 +1,928 @@
import { Hono } from "jsr:@hono/hono@4";
import { deleteCookie, getCookie, setCookie } from "jsr:@hono/hono@4/cookie";
import {
decodeBase64Url,
encodeBase64Url,
} from "jsr:@std/encoding@1/base64url";
import {
generateAuthenticationOptions,
generateRegistrationOptions,
MetadataService,
verifyAuthenticationResponse,
verifyRegistrationResponse,
} from "jsr:@simplewebauthn/server@13";
import type {
AuthenticationResponseJSON,
RegistrationResponseJSON,
} from "jsr:@simplewebauthn/server@13";
import { registerAuthRoutes } from "./auth/register.ts";
import { loginAuthRoutes } from "./auth/login.ts";
import { passkeysAuthRoutes } from "./auth/passkeys.ts";
import { guestAuthRoutes } from "./auth/guest.ts";
import { sqlWrapper } from "../db.ts";
import { valkey } from "../valkey.ts";
import { auditWrapper } from "../audit.ts";
import {
extractAllSessionIds,
getAuthenticatedUser,
requirePrimarySession,
} from "../auth-session.ts";
import { getClientIp, publicRateLimiter } from "../middleware.ts";
export const authRoutes = new Hono();
authRoutes.route("/", registerAuthRoutes);
authRoutes.route("/", loginAuthRoutes);
authRoutes.route("/", passkeysAuthRoutes);
authRoutes.route("/", guestAuthRoutes);
const rpName = "Auth-Yes Identity Provider";
const rpID = Deno.env.get("RP_ID") ||
(import.meta.main ? undefined : "localhost");
const origin = Deno.env.get("ORIGIN") ||
(import.meta.main ? undefined : "http://localhost");
const requireHardwareToken = Deno.env.get("REQUIRE_HARDWARE_TOKEN") === "true";
export function getCookieDomain(customRpId?: string): string | undefined {
const envDomain = Deno.env.get("COOKIE_DOMAIN");
if (envDomain) {
return envDomain.startsWith(".") ? envDomain : `.${envDomain}`;
}
const targetId = customRpId || Deno.env.get("RP_ID") || "";
if (!targetId || !targetId.includes(".") || targetId === "localhost") {
return undefined;
}
const parts = targetId.split(".").filter(Boolean);
if (parts.length >= 2) {
return `.${parts.slice(-2).join(".")}`;
}
return `.${targetId}`;
}
function generateSessionId() {
return crypto.randomUUID();
}
authRoutes.use("/api/register/*", publicRateLimiter);
authRoutes.use("/api/login/*", publicRateLimiter);
authRoutes.use("/api/passkeys/*", requirePrimarySession);
authRoutes.get("/.well-known/webauthn", (c) => {
if (!origin) {
return c.json({ origins: [] });
}
return c.json({ origins: [origin] });
});
// Start a WebAuthn registration ceremony
authRoutes.post("/api/register/challenge", async (c) => {
const { username, inviteCode } = await c.req.json();
if (!username || !inviteCode) {
return c.json({ error: "Username and inviteCode required" }, 400);
}
// Validate invite code early (checks expiration and max_uses bounds)
const invite = await sqlWrapper
.sql`SELECT id, max_uses, uses_count, auto_activate FROM invites WHERE code = ${inviteCode} AND (max_uses IS NULL OR uses_count < max_uses) AND expires_at > NOW()`
.then((res: any) => res[0]);
if (!invite) {
return c.json(
{ error: "Invalid, expired, or fully claimed invite code" },
400,
);
}
// Prevent hijacking an existing user's account if they already exist
const existingUser = await sqlWrapper
.sql`SELECT id FROM users WHERE username = ${username}`.then((res: any) =>
res[0]
);
if (existingUser) {
return c.json({ error: "Username already exists" }, 409);
}
const newUserId = crypto.randomUUID();
const userIdBytes = new TextEncoder().encode(newUserId);
if (!rpID) throw new Error("rpID is missing");
const options = await generateRegistrationOptions({
rpName,
rpID,
userName: username,
userID: userIdBytes,
attestationType: "direct",
authenticatorSelection: {
residentKey: "required",
requireResidentKey: true,
userVerification: "preferred",
},
timeout: 60000,
extensions: {
["prf" as string]: {},
} as any,
});
setCookie(c, "expected_registration_challenge", options.challenge, {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 300,
});
setCookie(c, "registration_user_id", newUserId, {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 300,
});
return c.json({ options, username });
});
// Verify registration and create UUID/session
authRoutes.post("/api/register/verify", async (c) => {
try {
const { response, username, inviteCode, upgrade_session } = await c.req
.json();
if (!inviteCode && !upgrade_session) {
return c.json({ error: "inviteCode or upgrade_session required" }, 400);
}
const expectedChallenge = getCookie(c, "expected_registration_challenge");
const registrationUserId = getCookie(c, "registration_user_id");
if (!expectedChallenge || !registrationUserId) {
return c.json({
error: "Missing or expired registration challenge/user ID",
}, 400);
}
// Prevent race condition account hijacking
let user = await sqlWrapper
.sql`SELECT id FROM users WHERE username = ${username}`
.then(
(res: any) => res[0],
);
if (user) {
return c.json({ error: "Username already exists" }, 409);
}
if (!origin || !rpID) throw new Error("Missing origin or rpID");
let verification;
try {
verification = await verifyRegistrationResponse({
response: response as RegistrationResponseJSON,
expectedChallenge,
expectedOrigin: origin,
expectedRPID: rpID,
requireUserVerification: false,
});
} catch (error: any) {
return c.json({ error: error.message }, 400);
}
const { verified, registrationInfo } = verification;
if (!verified || !registrationInfo) {
return c.json({ error: "Verification failed" }, 400);
}
// Enterprise Allow-List Verification
const allowlistCount = await sqlWrapper
.sql`SELECT COUNT(*) as count FROM aaguid_allowlist`.then((res: any) =>
Number(res[0].count)
);
if (allowlistCount > 0 && registrationInfo.aaguid) {
const isAllowed = await sqlWrapper
.sql`SELECT id FROM aaguid_allowlist WHERE aaguid = ${registrationInfo.aaguid}`
.then((res: any) => res[0]);
if (!isAllowed) {
auditWrapper.auditLog(null, "failed_attestation_allowlist", null, {
aaguid: registrationInfo.aaguid,
}, getClientIp(c));
return c.json({
error: "Authenticator AAGUID is not in the enterprise allow-list.",
}, 403);
}
}
// Optional Strict Hardware Attestation (e.g. YubiKey-only)
if (requireHardwareToken) {
if (
!registrationInfo.aaguid ||
registrationInfo.aaguid === "00000000-0000-0000-0000-000000000000"
) {
auditWrapper.auditLog(null, "registration_failed_attestation", null, {
username,
reason: "No AAGUID provided",
}, getClientIp(c));
return c.json({
error:
"Hardware attestation failed: No AAGUID provided. Only certified hardware security keys are permitted.",
}, 403);
}
let mdsStatement;
try {
mdsStatement = await MetadataService.getStatement(
registrationInfo.aaguid,
);
} catch (mdsError) {
console.warn("[Auth API] MetadataService lookup error:", mdsError);
}
if (!mdsStatement) {
auditWrapper.auditLog(null, "registration_failed_attestation", null, {
username,
aaguid: registrationInfo.aaguid,
reason: "AAGUID not found in MDS3",
}, getClientIp(c));
return c.json({
error:
`Hardware attestation failed: Authenticator AAGUID (${registrationInfo.aaguid}) not found in FIDO MDS3 blob. Only certified hardware security keys are permitted.`,
}, 403);
}
// @ts-ignore: TypeScript definition might be out of date for FIDO MDS3 (1)
if (mdsStatement.keyProtection?.includes(0x0001)) {
auditWrapper.auditLog(null, "registration_failed_attestation", null, {
username,
aaguid: registrationInfo.aaguid,
reason: "Software passkey detected",
}, getClientIp(c));
return c.json({
error:
"Hardware attestation failed: Authenticator is flagged as a software-based passkey. Only certified hardware security keys are permitted.",
}, 403);
}
}
const credentialID = registrationInfo.credential.id;
const credentialPublicKey = registrationInfo.credential.publicKey;
const counter = registrationInfo.credential.counter;
const base64CredentialID = typeof credentialID === "string"
? credentialID
: encodeBase64Url(new Uint8Array(credentialID as unknown as ArrayBuffer));
const base64PublicKey = encodeBase64Url(
new Uint8Array(credentialPublicKey as unknown as ArrayBuffer),
);
const prfEnabled =
(response.clientExtensionResults as any)?.prf?.enabled === true;
let prfSalt = null;
if (prfEnabled) {
const saltBytes = crypto.getRandomValues(new Uint8Array(32));
prfSalt = encodeBase64Url(saltBytes);
}
if (upgrade_session) {
// Ephemeral Guest Sandbox in-flight promotion
const sessionDataStr = await valkey.get(upgrade_session);
if (!sessionDataStr) {
return c.json({ error: "Invalid or expired guest session" }, 400);
}
const sessionData = JSON.parse(sessionDataStr);
if (
!sessionData || !sessionData.uuid ||
sessionData.account_status !== "guest"
) {
return c.json({ error: "Invalid guest session state" }, 400);
}
const guestUuid = sessionData.uuid;
const insertRes = await sqlWrapper
.sql`INSERT INTO users (id, username, account_status) VALUES (${guestUuid}, ${username}, 'active') RETURNING id`;
user = insertRes[0];
await sqlWrapper.sql`
INSERT INTO passkeys (user_id, credential_id, public_key, counter, prf_enabled, prf_salt)
VALUES (${user.id}, ${base64CredentialID}, ${base64PublicKey}, ${counter}, ${prfEnabled}, ${prfSalt})
`;
// Promote Valkey session
await valkey.setex(
upgrade_session,
28800, // Upgrade TTL to 8 hours
JSON.stringify({ uuid: guestUuid, username, account_status: "active" }),
);
// Register session in PostgreSQL
const expiresAt = new Date(Date.now() + 8 * 60 * 60 * 1000);
await sqlWrapper.sql`
INSERT INTO sessions (id, user_id, expires_at)
VALUES (${upgrade_session}, ${user.id}, ${expiresAt})
`;
} else {
// Standard Registration Flow
const invite = await sqlWrapper
.sql`SELECT id, app_id, role, max_uses, uses_count, auto_activate FROM invites WHERE code = ${inviteCode} AND (max_uses IS NULL OR uses_count < max_uses) AND expires_at > NOW()`
.then((res: any) => res[0]);
if (!invite) {
return c.json(
{ error: "Invalid, expired, or fully claimed invite code" },
400,
);
}
const initialStatus = invite.auto_activate === false
? "pending"
: "active";
const insertRes = await sqlWrapper
.sql`INSERT INTO users (id, username, account_status) VALUES (${registrationUserId}, ${username}, ${initialStatus}) RETURNING id`;
user = insertRes[0];
await sqlWrapper.sql`
INSERT INTO passkeys (user_id, credential_id, public_key, counter, prf_enabled, prf_salt)
VALUES (${user.id}, ${base64CredentialID}, ${base64PublicKey}, ${counter}, ${prfEnabled}, ${prfSalt})
`;
await sqlWrapper.sql`
UPDATE invites
SET uses_count = uses_count + 1,
used_at = NOW(),
used_by = ${user.id}
WHERE id = ${invite.id}
`;
await sqlWrapper.sql`
INSERT INTO invite_redemptions (invite_id, user_id)
VALUES (${invite.id}, ${user.id})
`;
if (invite.app_id) {
await sqlWrapper.sql`
INSERT INTO grants (user_id, app_id, role)
VALUES (${user.id}, ${invite.app_id}, ${invite.role})
`;
} else if (invite.role === "admin") {
const adminApp = await sqlWrapper
.sql`SELECT id FROM apps WHERE name = 'Auth-Yes Management Console'`
.then((res: any) => res[0]);
if (adminApp) {
await sqlWrapper.sql`
INSERT INTO grants (user_id, app_id, role)
VALUES (${user.id}, ${adminApp.id}, 'admin')
ON CONFLICT (user_id, app_id) DO UPDATE SET role = 'admin'
`;
}
}
}
auditWrapper.auditLog(
user.id,
"user_registered",
null,
{ username, inviteCode },
getClientIp(c),
);
// Set response cookie to clear out the challenge
setCookie(c, "expected_registration_challenge", "", {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 0,
});
setCookie(c, "registration_user_id", "", {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 0,
});
const cookieDomain = getCookieDomain(rpID);
if (cookieDomain) {
deleteCookie(c, "session_id", { domain: cookieDomain, path: "/" });
}
deleteCookie(c, "session_id", { path: "/" });
return c.json({ success: true });
} catch (error: any) {
console.error(
"[Auth API] Uncaught Exception in /api/register/verify:",
error,
);
return c.json({ error: error.message || "Internal server error" }, 500);
}
});
// Start a WebAuthn authentication ceremony
authRoutes.post("/api/login/challenge", async (c) => {
let body;
try {
body = await c.req.json();
} catch (_err) {
body = {};
}
const username = body.username;
let extensions: any = undefined;
let allowCredentials: any[] | undefined = undefined;
if (username) {
const user = await sqlWrapper
.sql`SELECT id FROM users WHERE username = ${username}`.then((res: any) =>
res[0]
);
if (user) {
const passkeys = await sqlWrapper
.sql`SELECT credential_id, prf_enabled, prf_salt FROM passkeys WHERE user_id = ${user.id}`;
if (passkeys.length > 0) {
allowCredentials = passkeys.map((pk: any) => ({
id: pk.credential_id,
type: "public-key",
}));
const prfPasskeys = passkeys.filter((pk: any) =>
pk.prf_enabled && pk.prf_salt
);
if (prfPasskeys.length > 0) {
extensions = {
["prf" as string]: { evalByCredential: {} },
};
for (const pk of prfPasskeys) {
const saltBytes = decodeBase64Url(pk.prf_salt);
extensions["prf"]["evalByCredential"][pk.credential_id] = {
first: saltBytes,
};
}
}
}
}
}
if (!rpID) throw new Error("rpID is missing");
const options = await generateAuthenticationOptions({
rpID,
userVerification: "preferred",
timeout: 60000,
allowCredentials,
extensions,
});
setCookie(c, "expected_authentication_challenge", options.challenge, {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 300,
});
return c.json({ options });
});
// Verify login and issue session
authRoutes.post("/api/login/verify", async (c) => {
const { response } = await c.req.json();
const expectedChallenge = getCookie(c, "expected_authentication_challenge");
if (!expectedChallenge) {
return c.json(
{ error: "Missing or expired authentication challenge" },
400,
);
}
const base64CredentialID = response.id;
const passkey = await sqlWrapper
.sql`SELECT * FROM passkeys WHERE credential_id = ${base64CredentialID}`
.then((res: any) => res[0]);
if (!passkey) {
return c.json({
error: "Passkey not found. Please register your passkey first.",
}, 404);
}
const user = await sqlWrapper
.sql`SELECT id, username, account_status FROM users WHERE id = ${passkey.user_id}`
.then((res: any) => res[0]);
if (!user) {
return c.json({ error: "User not found" }, 404);
}
const userId = user.id;
if (user.account_status !== "active") {
auditWrapper.auditLog(
userId,
"login_failed",
null,
{ reason: `Account status is ${user.account_status}` },
getClientIp(c),
);
return c.json({
error: "Account is not active. Please contact an administrator.",
}, 403);
}
const publicKeyBytes = decodeBase64Url(passkey.public_key);
if (!origin || !rpID) throw new Error("Missing origin or rpID");
let verification;
try {
verification = await verifyAuthenticationResponse({
response: response as AuthenticationResponseJSON,
expectedChallenge,
expectedOrigin: origin,
expectedRPID: rpID,
requireUserVerification: false,
credential: {
id: passkey.credential_id,
publicKey: publicKeyBytes,
counter: Number(passkey.counter),
},
});
} catch (error: any) {
return c.json({ error: error.message }, 400);
}
const { verified, authenticationInfo } = verification;
if (!verified || !authenticationInfo) {
auditWrapper.auditLog(
userId,
"login_failed",
null,
{ reason: "verification failed" },
getClientIp(c),
);
return c.json({ error: "Verification failed" }, 400);
}
await sqlWrapper
.sql`UPDATE passkeys SET counter = ${authenticationInfo.newCounter} WHERE id = ${passkey.id}`;
const sessionId = generateSessionId();
const expiresAt = new Date();
expiresAt.setDate(expiresAt.getDate() + 7);
// Persistence in PostgreSQL
await sqlWrapper
.sql`INSERT INTO sessions (id, user_id, expires_at) VALUES (${sessionId}, ${user.id}, ${expiresAt})`;
// Write session to Valkey with TTL matching expiresAt
const ttlSeconds = Math.floor((expiresAt.getTime() - Date.now()) / 1000);
try {
const sessionData = JSON.stringify({
uuid: user.id,
username: user.username,
});
await valkey.setex(sessionId, ttlSeconds, sessionData);
} catch (_err: unknown) {
// If Valkey fails, log and fail closed for security
auditWrapper.auditLog(
user.id,
"login_failed",
null,
{ reason: "Cache write failure" },
getClientIp(c),
);
return c.json({ error: "Internal server error" }, 500);
}
const oldSessionIds = extractAllSessionIds(c);
if (oldSessionIds.length > 0) {
for (const old of oldSessionIds) {
try {
await valkey.del(old);
await sqlWrapper.sql`DELETE FROM sessions WHERE id = ${old}`;
} catch (_e) {}
}
}
const cookieDomain = getCookieDomain(rpID);
setCookie(c, "session_id", sessionId, {
domain: cookieDomain,
path: "/",
httpOnly: true,
secure: true,
sameSite: "Lax",
expires: expiresAt,
});
setCookie(c, "expected_authentication_challenge", "", {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 0,
});
auditWrapper.auditLog(userId, "login_success", null, null, getClientIp(c));
return c.json({ success: true });
});
// Generate Ephemeral Guest Sandbox
authRoutes.post("/api/guests/sandbox", async (c) => {
const guestUuid = crypto.randomUUID();
const sessionId = encodeBase64Url(crypto.getRandomValues(new Uint8Array(32)));
const username = `guest-${guestUuid.substring(0, 8)}`;
await valkey.setex(
sessionId,
7200, // 2-hour TTL
JSON.stringify({ uuid: guestUuid, username, account_status: "guest" }),
);
const cookieDomain = getCookieDomain(rpID);
setCookie(c, "session_id", sessionId, {
domain: cookieDomain,
path: "/",
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 7200,
});
return c.json({ success: true, sessionId, guestUuid });
});
// Revoke a session manually (used by layout logout)
authRoutes.post("/api/revoke", async (c) => {
// Try Authorization header first (SDK)
let token = "";
const authHeader = c.req.header("Authorization");
if (authHeader && authHeader.startsWith("Bearer ")) {
token = authHeader.split(" ")[1];
}
if (!token) {
// Fallback to session cookie (Web UI)
const tokens = extractAllSessionIds(c);
if (tokens.length === 0) {
return c.json({ error: "Missing or invalid token" }, 401);
}
for (const t of tokens) {
try {
await valkey.del(t);
await sqlWrapper.sql`DELETE FROM sessions WHERE id = ${t}`;
} catch (_e) {}
}
} else {
// SDK Token Path
try {
await valkey.del(token);
await sqlWrapper.sql`DELETE FROM sessions WHERE id = ${token}`;
} catch (_e) {}
}
const cookieDomain = getCookieDomain(rpID);
if (cookieDomain) {
deleteCookie(c, "session_id", {
domain: cookieDomain,
path: "/",
httpOnly: true,
secure: true,
sameSite: "Lax",
});
}
deleteCookie(c, "session_id", {
path: "/",
httpOnly: true,
secure: true,
sameSite: "Lax",
});
return c.json({ success: true });
});
// ---------------------------------------------------------
// Authenticated Passkey Registration (Adding a new device)
// ---------------------------------------------------------
authRoutes.post("/api/passkeys/register/challenge", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const user = await sqlWrapper
.sql`SELECT username FROM users WHERE id = ${auth.userId}`
.then((res: any) => res[0]);
if (!user) return c.json({ error: "User not found" }, 404);
const userIdBytes = new TextEncoder().encode(auth.userId);
if (!rpID) throw new Error("rpID is missing");
const options = await generateRegistrationOptions({
rpName,
rpID,
userName: user.username,
userID: userIdBytes,
attestationType: "direct",
authenticatorSelection: {
residentKey: "required",
requireResidentKey: true,
userVerification: "preferred",
},
timeout: 60000,
});
setCookie(c, "expected_add_passkey_challenge", options.challenge, {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 300,
});
return c.json({ options });
});
authRoutes.post("/api/passkeys/register/verify", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const { response } = await c.req.json();
const expectedChallenge = getCookie(c, "expected_add_passkey_challenge");
if (!expectedChallenge) {
return c.json({ error: "Missing or expired registration challenge" }, 400);
}
if (!origin || !rpID) throw new Error("Missing origin or rpID");
let verification;
try {
verification = await verifyRegistrationResponse({
response: response as RegistrationResponseJSON,
expectedChallenge,
expectedOrigin: origin,
expectedRPID: rpID,
requireUserVerification: false,
});
} catch (error: any) {
return c.json({ error: error.message }, 400);
}
const { verified, registrationInfo } = verification;
if (!verified || !registrationInfo) {
return c.json({ error: "Verification failed" }, 400);
}
// Enterprise Allow-List Verification
const allowlistCount = await sqlWrapper
.sql`SELECT COUNT(*) as count FROM aaguid_allowlist`.then((res: any) =>
Number(res[0].count)
);
if (allowlistCount > 0 && registrationInfo.aaguid) {
const isAllowed = await sqlWrapper
.sql`SELECT id FROM aaguid_allowlist WHERE aaguid = ${registrationInfo.aaguid}`
.then((res: any) => res[0]);
if (!isAllowed) {
auditWrapper.auditLog(auth.userId, "failed_attestation_allowlist", null, {
aaguid: registrationInfo.aaguid,
}, getClientIp(c));
return c.json({
error: "Authenticator AAGUID is not in the enterprise allow-list.",
}, 403);
}
}
// Optional Strict Hardware Attestation
if (requireHardwareToken) {
if (
!registrationInfo.aaguid ||
registrationInfo.aaguid === "00000000-0000-0000-0000-000000000000"
) {
auditWrapper.auditLog(
auth.userId,
"add_passkey_failed_attestation",
null,
{
reason: "No AAGUID provided",
},
getClientIp(c),
);
return c.json(
{ error: "Hardware attestation failed: No AAGUID provided." },
403,
);
}
let mdsStatement;
try {
mdsStatement = await MetadataService.getStatement(
registrationInfo.aaguid,
);
} catch (mdsError) {
console.warn("[Auth API] MetadataService lookup error:", mdsError);
}
if (!mdsStatement) {
auditWrapper.auditLog(
auth.userId,
"add_passkey_failed_attestation",
null,
{
aaguid: registrationInfo.aaguid,
reason: "AAGUID not found in MDS3",
},
getClientIp(c),
);
return c.json({
error:
`Hardware attestation failed: Authenticator AAGUID (${registrationInfo.aaguid}) not found in FIDO MDS3 blob.`,
}, 403);
}
// @ts-ignore: FIDO MDS3 missing type
if (mdsStatement.keyProtection?.includes(0x0001)) {
auditWrapper.auditLog(
auth.userId,
"add_passkey_failed_attestation",
null,
{
aaguid: registrationInfo.aaguid,
reason: "Software passkey detected",
},
getClientIp(c),
);
return c.json({
error:
"Hardware attestation failed: Authenticator is flagged as a software-based passkey.",
}, 403);
}
}
const credentialID = registrationInfo.credential.id;
const credentialPublicKey = registrationInfo.credential.publicKey;
const counter = registrationInfo.credential.counter;
const base64CredentialID = typeof credentialID === "string"
? credentialID
: encodeBase64Url(new Uint8Array(credentialID as unknown as ArrayBuffer));
const base64PublicKey = encodeBase64Url(
new Uint8Array(credentialPublicKey as unknown as ArrayBuffer),
);
await sqlWrapper.sql`
INSERT INTO passkeys (user_id, credential_id, public_key, counter)
VALUES (${auth.userId}, ${base64CredentialID}, ${base64PublicKey}, ${counter})
`;
auditWrapper.auditLog(
auth.userId,
"passkey_added",
null,
null,
getClientIp(c),
);
setCookie(c, "expected_add_passkey_challenge", "", {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 0,
});
return c.json({ success: true });
});
// Get user's registered passkeys
authRoutes.get("/api/passkeys", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const passkeys = await sqlWrapper.sql`
SELECT id, counter
FROM passkeys
WHERE user_id = ${auth.userId}
`;
return c.json({ passkeys });
});
// Revoke a specific passkey
authRoutes.delete("/api/passkeys/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetPasskeyId = c.req.param("id");
// Verify the passkey belongs to the user
const passkey = await sqlWrapper.sql`
SELECT id FROM passkeys WHERE id = ${targetPasskeyId} AND user_id = ${auth.userId}
`.then((res: any) => res[0]);
if (!passkey) {
return c.json({ error: "Passkey not found or access denied" }, 404);
}
// Prevent deleting the very last passkey to avoid locking out the user
const passkeyCount = await sqlWrapper.sql`
SELECT count(*) as count FROM passkeys WHERE user_id = ${auth.userId}
`.then((res: any) => Number(res[0].count));
if (passkeyCount <= 1) {
return c.json({
error: "Cannot delete your last passkey. Register another one first.",
}, 400);
}
await sqlWrapper.sql`DELETE FROM passkeys WHERE id = ${targetPasskeyId}`;
auditWrapper.auditLog(auth.userId, "passkey_revoked", null, {
revoked_passkey_id: targetPasskeyId,
}, getClientIp(c));
return c.json({ success: true });
});

90
server/routes/auth/guest.ts
View File

@ -1,90 +0,0 @@
import { Hono } from "jsr:@hono/hono@4";
import { deleteCookie, setCookie } from "jsr:@hono/hono@4/cookie";
import { encodeBase64Url } from "jsr:@std/encoding@1/base64url";
import { sqlWrapper } from "../../db.ts";
import { valkey } from "../../valkey.ts";
import { extractAllSessionIds } from "../../auth-session.ts";
import { getCookieDomain } from "./utils.ts";
export const guestAuthRoutes = new Hono();
const rpID = Deno.env.get("RP_ID") ||
(import.meta.main ? undefined : "localhost");
// Generate Ephemeral Guest Sandbox
guestAuthRoutes.post("/api/guests/sandbox", async (c) => {
const guestUuid = crypto.randomUUID();
const sessionId = encodeBase64Url(crypto.getRandomValues(new Uint8Array(32)));
const username = `guest-${guestUuid.substring(0, 8)}`;
await valkey.setex(
sessionId,
7200, // 2-hour TTL
JSON.stringify({ uuid: guestUuid, username, account_status: "guest" }),
);
const cookieDomain = getCookieDomain(rpID);
setCookie(c, "session_id", sessionId, {
domain: cookieDomain,
path: "/",
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 7200,
});
return c.json({ success: true, sessionId, guestUuid });
});
// Revoke a session manually (used by layout logout)
guestAuthRoutes.post("/api/revoke", async (c) => {
// Try Authorization header first (SDK)
let token = "";
const authHeader = c.req.header("Authorization");
if (authHeader && authHeader.startsWith("Bearer ")) {
token = authHeader.split(" ")[1];
}
if (!token) {
// Fallback to session cookie (Web UI)
const tokens = extractAllSessionIds(c);
if (tokens.length === 0) {
return c.json({ error: "Missing or invalid token" }, 401);
}
for (const t of tokens) {
try {
await valkey.del(t);
await sqlWrapper.sql`DELETE FROM sessions WHERE id = ${t}`;
} catch (_e) {}
}
} else {
// SDK Token Path
try {
await valkey.del(token);
await sqlWrapper.sql`DELETE FROM sessions WHERE id = ${token}`;
} catch (_e) {}
}
const cookieDomain = getCookieDomain(rpID);
if (cookieDomain) {
deleteCookie(c, "session_id", {
domain: cookieDomain,
path: "/",
httpOnly: true,
secure: true,
sameSite: "Lax",
});
}
deleteCookie(c, "session_id", {
path: "/",
httpOnly: true,
secure: true,
sameSite: "Lax",
});
return c.json({ success: true });
});

236
server/routes/auth/login.ts
View File

@ -1,236 +0,0 @@
import { Hono } from "jsr:@hono/hono@4";
import { getCookie, setCookie } from "jsr:@hono/hono@4/cookie";
import { decodeBase64Url } from "jsr:@std/encoding@1/base64url";
import {
generateAuthenticationOptions,
verifyAuthenticationResponse,
} from "jsr:@simplewebauthn/server@13";
import type { AuthenticationResponseJSON } from "jsr:@simplewebauthn/server@13";
import { sqlWrapper } from "../../db.ts";
import { valkey } from "../../valkey.ts";
import { auditWrapper } from "../../audit.ts";
import { extractAllSessionIds } from "../../auth-session.ts";
import { getClientIp, publicRateLimiter } from "../../middleware.ts";
import { getCookieDomain } from "./utils.ts";
export const loginAuthRoutes = new Hono();
const rpID = Deno.env.get("RP_ID") ||
(import.meta.main ? undefined : "localhost");
const origin = Deno.env.get("ORIGIN") ||
(import.meta.main ? undefined : "http://localhost");
function generateSessionId() {
return crypto.randomUUID();
}
loginAuthRoutes.use("/api/login/*", publicRateLimiter);
// Start a WebAuthn authentication ceremony
loginAuthRoutes.post("/api/login/challenge", async (c) => {
let body;
try {
body = await c.req.json();
} catch (_err) {
body = {};
}
const username = body.username;
let extensions: any = undefined;
let allowCredentials: any[] | undefined = undefined;
if (username) {
const user = await sqlWrapper
.sql`SELECT id FROM users WHERE username = ${username}`.then((res: any) =>
res[0]
);
if (user) {
const passkeys = await sqlWrapper
.sql`SELECT credential_id, prf_enabled, prf_salt FROM passkeys WHERE user_id = ${user.id}`;
if (passkeys.length > 0) {
allowCredentials = passkeys.map((pk: any) => ({
id: pk.credential_id,
type: "public-key",
}));
const prfPasskeys = passkeys.filter((pk: any) =>
pk.prf_enabled && pk.prf_salt
);
if (prfPasskeys.length > 0) {
extensions = {
["prf" as string]: { evalByCredential: {} },
};
for (const pk of prfPasskeys) {
const saltBytes = decodeBase64Url(pk.prf_salt);
extensions["prf"]["evalByCredential"][pk.credential_id] = {
first: saltBytes,
};
}
}
}
}
}
if (!rpID) throw new Error("rpID is missing");
const options = await generateAuthenticationOptions({
rpID,
userVerification: "preferred",
timeout: 60000,
allowCredentials,
extensions,
});
setCookie(c, "expected_authentication_challenge", options.challenge, {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 300,
});
return c.json({ options });
});
// Verify login and issue session
loginAuthRoutes.post("/api/login/verify", async (c) => {
const { response } = await c.req.json();
const expectedChallenge = getCookie(c, "expected_authentication_challenge");
if (!expectedChallenge) {
return c.json(
{ error: "Missing or expired authentication challenge" },
400,
);
}
const base64CredentialID = response.id;
const passkey = await sqlWrapper
.sql`SELECT * FROM passkeys WHERE credential_id = ${base64CredentialID}`
.then((res: any) => res[0]);
if (!passkey) {
return c.json({
error: "Passkey not found. Please register your passkey first.",
}, 404);
}
const user = await sqlWrapper
.sql`SELECT id, username, account_status FROM users WHERE id = ${passkey.user_id}`
.then((res: any) => res[0]);
if (!user) {
return c.json({ error: "User not found" }, 404);
}
const userId = user.id;
if (user.account_status !== "active") {
auditWrapper.auditLog(
userId,
"login_failed",
null,
{ reason: `Account status is ${user.account_status}` },
getClientIp(c),
);
return c.json({
error: "Account is not active. Please contact an administrator.",
}, 403);
}
const publicKeyBytes = decodeBase64Url(passkey.public_key);
if (!origin || !rpID) throw new Error("Missing origin or rpID");
let verification;
try {
verification = await verifyAuthenticationResponse({
response: response as AuthenticationResponseJSON,
expectedChallenge,
expectedOrigin: origin,
expectedRPID: rpID,
requireUserVerification: false,
credential: {
id: passkey.credential_id,
publicKey: publicKeyBytes,
counter: Number(passkey.counter),
},
});
} catch (error: any) {
return c.json({ error: error.message }, 400);
}
const { verified, authenticationInfo } = verification;
if (!verified || !authenticationInfo) {
auditWrapper.auditLog(
userId,
"login_failed",
null,
{ reason: "verification failed" },
getClientIp(c),
);
return c.json({ error: "Verification failed" }, 400);
}
await sqlWrapper
.sql`UPDATE passkeys SET counter = ${authenticationInfo.newCounter} WHERE id = ${passkey.id}`;
const sessionId = generateSessionId();
const expiresAt = new Date();
expiresAt.setDate(expiresAt.getDate() + 7);
// Persistence in PostgreSQL
await sqlWrapper
.sql`INSERT INTO sessions (id, user_id, expires_at) VALUES (${sessionId}, ${user.id}, ${expiresAt})`;
// Write session to Valkey with TTL matching expiresAt
const ttlSeconds = Math.floor((expiresAt.getTime() - Date.now()) / 1000);
try {
const sessionData = JSON.stringify({
uuid: user.id,
username: user.username,
});
await valkey.setex(sessionId, ttlSeconds, sessionData);
} catch (_err: unknown) {
// If Valkey fails, log and fail closed for security
auditWrapper.auditLog(
user.id,
"login_failed",
null,
{ reason: "Cache write failure" },
getClientIp(c),
);
return c.json({ error: "Internal server error" }, 500);
}
const oldSessionIds = extractAllSessionIds(c);
if (oldSessionIds.length > 0) {
for (const old of oldSessionIds) {
try {
await valkey.del(old);
await sqlWrapper.sql`DELETE FROM sessions WHERE id = ${old}`;
} catch (_e) {}
}
}
const cookieDomain = getCookieDomain(rpID);
setCookie(c, "session_id", sessionId, {
domain: cookieDomain,
path: "/",
httpOnly: true,
secure: true,
sameSite: "Lax",
expires: expiresAt,
});
setCookie(c, "expected_authentication_challenge", "", {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 0,
});
auditWrapper.auditLog(userId, "login_success", null, null, getClientIp(c));
return c.json({ success: true });
});

268
server/routes/auth/passkeys.ts
View File

@ -1,268 +0,0 @@
import { Hono } from "jsr:@hono/hono@4";
import { getCookie, setCookie } from "jsr:@hono/hono@4/cookie";
import { encodeBase64Url } from "jsr:@std/encoding@1/base64url";
import {
generateRegistrationOptions,
MetadataService,
verifyRegistrationResponse,
} from "jsr:@simplewebauthn/server@13";
import type { RegistrationResponseJSON } from "jsr:@simplewebauthn/server@13";
import { sqlWrapper } from "../../db.ts";
import { auditWrapper } from "../../audit.ts";
import {
getAuthenticatedUser,
requirePrimarySession,
} from "../../auth-session.ts";
import { getClientIp } from "../../middleware.ts";
export const passkeysAuthRoutes = new Hono();
const rpName = "Auth-Yes Identity Provider";
const rpID = Deno.env.get("RP_ID") ||
(import.meta.main ? undefined : "localhost");
const origin = Deno.env.get("ORIGIN") ||
(import.meta.main ? undefined : "http://localhost");
const requireHardwareToken = Deno.env.get("REQUIRE_HARDWARE_TOKEN") === "true";
passkeysAuthRoutes.use("/api/passkeys/*", requirePrimarySession);
// ---------------------------------------------------------
// Authenticated Passkey Registration (Adding a new device)
// ---------------------------------------------------------
passkeysAuthRoutes.post("/api/passkeys/register/challenge", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const user = await sqlWrapper
.sql`SELECT username FROM users WHERE id = ${auth.userId}`
.then((res: any) => res[0]);
if (!user) return c.json({ error: "User not found" }, 404);
const userIdBytes = new TextEncoder().encode(auth.userId);
if (!rpID) throw new Error("rpID is missing");
const options = await generateRegistrationOptions({
rpName,
rpID,
userName: user.username,
userID: userIdBytes,
attestationType: "direct",
authenticatorSelection: {
residentKey: "required",
requireResidentKey: true,
userVerification: "preferred",
},
timeout: 60000,
});
setCookie(c, "expected_add_passkey_challenge", options.challenge, {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 300,
});
return c.json({ options });
});
passkeysAuthRoutes.post("/api/passkeys/register/verify", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const { response } = await c.req.json();
const expectedChallenge = getCookie(c, "expected_add_passkey_challenge");
if (!expectedChallenge) {
return c.json({ error: "Missing or expired registration challenge" }, 400);
}
if (!origin || !rpID) throw new Error("Missing origin or rpID");
let verification;
try {
verification = await verifyRegistrationResponse({
response: response as RegistrationResponseJSON,
expectedChallenge,
expectedOrigin: origin,
expectedRPID: rpID,
requireUserVerification: false,
});
} catch (error: any) {
return c.json({ error: error.message }, 400);
}
const { verified, registrationInfo } = verification;
if (!verified || !registrationInfo) {
return c.json({ error: "Verification failed" }, 400);
}
// Enterprise Allow-List Verification
const allowlistCount = await sqlWrapper
.sql`SELECT COUNT(*) as count FROM aaguid_allowlist`.then((res: any) =>
Number(res[0].count)
);
if (allowlistCount > 0 && registrationInfo.aaguid) {
const isAllowed = await sqlWrapper
.sql`SELECT id FROM aaguid_allowlist WHERE aaguid = ${registrationInfo.aaguid}`
.then((res: any) => res[0]);
if (!isAllowed) {
auditWrapper.auditLog(auth.userId, "failed_attestation_allowlist", null, {
aaguid: registrationInfo.aaguid,
}, getClientIp(c));
return c.json({
error: "Authenticator AAGUID is not in the enterprise allow-list.",
}, 403);
}
}
// Optional Strict Hardware Attestation
if (requireHardwareToken) {
if (
!registrationInfo.aaguid ||
registrationInfo.aaguid === "00000000-0000-0000-0000-000000000000"
) {
auditWrapper.auditLog(
auth.userId,
"add_passkey_failed_attestation",
null,
{
reason: "No AAGUID provided",
},
getClientIp(c),
);
return c.json(
{ error: "Hardware attestation failed: No AAGUID provided." },
403,
);
}
let mdsStatement;
try {
mdsStatement = await MetadataService.getStatement(
registrationInfo.aaguid,
);
} catch (mdsError) {
console.warn("[Auth API] MetadataService lookup error:", mdsError);
}
if (!mdsStatement) {
auditWrapper.auditLog(
auth.userId,
"add_passkey_failed_attestation",
null,
{
aaguid: registrationInfo.aaguid,
reason: "AAGUID not found in MDS3",
},
getClientIp(c),
);
return c.json({
error:
`Hardware attestation failed: Authenticator AAGUID (${registrationInfo.aaguid}) not found in FIDO MDS3 blob.`,
}, 403);
}
// @ts-ignore: FIDO MDS3 missing type
if (mdsStatement.keyProtection?.includes(0x0001)) {
auditWrapper.auditLog(
auth.userId,
"add_passkey_failed_attestation",
null,
{
aaguid: registrationInfo.aaguid,
reason: "Software passkey detected",
},
getClientIp(c),
);
return c.json({
error:
"Hardware attestation failed: Authenticator is flagged as a software-based passkey.",
}, 403);
}
}
const credentialID = registrationInfo.credential.id;
const credentialPublicKey = registrationInfo.credential.publicKey;
const counter = registrationInfo.credential.counter;
const base64CredentialID = typeof credentialID === "string"
? credentialID
: encodeBase64Url(new Uint8Array(credentialID as unknown as ArrayBuffer));
const base64PublicKey = encodeBase64Url(
new Uint8Array(credentialPublicKey as unknown as ArrayBuffer),
);
await sqlWrapper.sql`
INSERT INTO passkeys (user_id, credential_id, public_key, counter)
VALUES (${auth.userId}, ${base64CredentialID}, ${base64PublicKey}, ${counter})
`;
auditWrapper.auditLog(
auth.userId,
"passkey_added",
null,
null,
getClientIp(c),
);
setCookie(c, "expected_add_passkey_challenge", "", {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 0,
});
return c.json({ success: true });
});
// Get user's registered passkeys
passkeysAuthRoutes.get("/api/passkeys", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const passkeys = await sqlWrapper.sql`
SELECT id, counter
FROM passkeys
WHERE user_id = ${auth.userId}
`;
return c.json({ passkeys });
});
// Revoke a specific passkey
passkeysAuthRoutes.delete("/api/passkeys/:id", async (c) => {
const auth = await getAuthenticatedUser(c);
if (!auth) return c.json({ error: "Unauthorized" }, 401);
const targetPasskeyId = c.req.param("id");
// Verify the passkey belongs to the user
const passkey = await sqlWrapper.sql`
SELECT id FROM passkeys WHERE id = ${targetPasskeyId} AND user_id = ${auth.userId}
`.then((res: any) => res[0]);
if (!passkey) {
return c.json({ error: "Passkey not found or access denied" }, 404);
}
// Prevent deleting the very last passkey to avoid locking out the user
const passkeyCount = await sqlWrapper.sql`
SELECT count(*) as count FROM passkeys WHERE user_id = ${auth.userId}
`.then((res: any) => Number(res[0].count));
if (passkeyCount <= 1) {
return c.json({
error: "Cannot delete your last passkey. Register another one first.",
}, 400);
}
await sqlWrapper.sql`DELETE FROM passkeys WHERE id = ${targetPasskeyId}`;
auditWrapper.auditLog(auth.userId, "passkey_revoked", null, {
revoked_passkey_id: targetPasskeyId,
}, getClientIp(c));
return c.json({ success: true });
});

369
server/routes/auth/register.ts
View File

@ -1,369 +0,0 @@
import { Hono } from "jsr:@hono/hono@4";
import { deleteCookie, getCookie, setCookie } from "jsr:@hono/hono@4/cookie";
import { encodeBase64Url } from "jsr:@std/encoding@1/base64url";
import {
generateRegistrationOptions,
MetadataService,
verifyRegistrationResponse,
} from "jsr:@simplewebauthn/server@13";
import type { RegistrationResponseJSON } from "jsr:@simplewebauthn/server@13";
import { sqlWrapper } from "../../db.ts";
import { valkey } from "../../valkey.ts";
import { auditWrapper } from "../../audit.ts";
import { getClientIp, publicRateLimiter } from "../../middleware.ts";
import { getCookieDomain } from "./utils.ts";
export const registerAuthRoutes = new Hono();
const rpName = "Auth-Yes Identity Provider";
const rpID = Deno.env.get("RP_ID") ||
(import.meta.main ? undefined : "localhost");
const origin = Deno.env.get("ORIGIN") ||
(import.meta.main ? undefined : "http://localhost");
const requireHardwareToken = Deno.env.get("REQUIRE_HARDWARE_TOKEN") === "true";
registerAuthRoutes.use("/api/register/*", publicRateLimiter);
registerAuthRoutes.get("/.well-known/webauthn", (c) => {
if (!origin) {
return c.json({ origins: [] });
}
return c.json({ origins: [origin] });
});
// Start a WebAuthn registration ceremony
registerAuthRoutes.post("/api/register/challenge", async (c) => {
const { username, inviteCode } = await c.req.json();
if (!username || !inviteCode) {
return c.json({ error: "Username and inviteCode required" }, 400);
}
// Validate invite code early (checks expiration and max_uses bounds)
const invite = await sqlWrapper
.sql`SELECT id, max_uses, uses_count, auto_activate FROM invites WHERE code = ${inviteCode} AND (max_uses IS NULL OR uses_count < max_uses) AND expires_at > NOW()`
.then((res: any) => res[0]);
if (!invite) {
return c.json(
{ error: "Invalid, expired, or fully claimed invite code" },
400,
);
}
// Prevent hijacking an existing user's account if they already exist
const existingUser = await sqlWrapper
.sql`SELECT id FROM users WHERE username = ${username}`.then((res: any) =>
res[0]
);
if (existingUser) {
return c.json({ error: "Username already exists" }, 409);
}
const newUserId = crypto.randomUUID();
const userIdBytes = new TextEncoder().encode(newUserId);
if (!rpID) throw new Error("rpID is missing");
const options = await generateRegistrationOptions({
rpName,
rpID,
userName: username,
userID: userIdBytes,
attestationType: "direct",
authenticatorSelection: {
residentKey: "required",
requireResidentKey: true,
userVerification: "preferred",
},
timeout: 60000,
extensions: {
["prf" as string]: {},
} as any,
});
setCookie(c, "expected_registration_challenge", options.challenge, {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 300,
});
setCookie(c, "registration_user_id", newUserId, {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 300,
});
return c.json({ options, username });
});
// Verify registration and create UUID/session
registerAuthRoutes.post("/api/register/verify", async (c) => {
try {
const { response, username, inviteCode, upgrade_session } = await c.req
.json();
if (!inviteCode && !upgrade_session) {
return c.json({ error: "inviteCode or upgrade_session required" }, 400);
}
const expectedChallenge = getCookie(c, "expected_registration_challenge");
const registrationUserId = getCookie(c, "registration_user_id");
if (!expectedChallenge || !registrationUserId) {
return c.json({
error: "Missing or expired registration challenge/user ID",
}, 400);
}
// Prevent race condition account hijacking
let user = await sqlWrapper
.sql`SELECT id FROM users WHERE username = ${username}`
.then(
(res: any) => res[0],
);
if (user) {
return c.json({ error: "Username already exists" }, 409);
}
if (!origin || !rpID) throw new Error("Missing origin or rpID");
let verification;
try {
verification = await verifyRegistrationResponse({
response: response as RegistrationResponseJSON,
expectedChallenge,
expectedOrigin: origin,
expectedRPID: rpID,
requireUserVerification: false,
});
} catch (error: any) {
return c.json({ error: error.message }, 400);
}
const { verified, registrationInfo } = verification;
if (!verified || !registrationInfo) {
return c.json({ error: "Verification failed" }, 400);
}
// Enterprise Allow-List Verification
const allowlistCount = await sqlWrapper
.sql`SELECT COUNT(*) as count FROM aaguid_allowlist`.then((res: any) =>
Number(res[0].count)
);
if (allowlistCount > 0 && registrationInfo.aaguid) {
const isAllowed = await sqlWrapper
.sql`SELECT id FROM aaguid_allowlist WHERE aaguid = ${registrationInfo.aaguid}`
.then((res: any) => res[0]);
if (!isAllowed) {
auditWrapper.auditLog(null, "failed_attestation_allowlist", null, {
aaguid: registrationInfo.aaguid,
}, getClientIp(c));
return c.json({
error: "Authenticator AAGUID is not in the enterprise allow-list.",
}, 403);
}
}
// Optional Strict Hardware Attestation (e.g. YubiKey-only)
if (requireHardwareToken) {
if (
!registrationInfo.aaguid ||
registrationInfo.aaguid === "00000000-0000-0000-0000-000000000000"
) {
auditWrapper.auditLog(null, "registration_failed_attestation", null, {
username,
reason: "No AAGUID provided",
}, getClientIp(c));
return c.json({
error:
"Hardware attestation failed: No AAGUID provided. Only certified hardware security keys are permitted.",
}, 403);
}
let mdsStatement;
try {
mdsStatement = await MetadataService.getStatement(
registrationInfo.aaguid,
);
} catch (mdsError) {
console.warn("[Auth API] MetadataService lookup error:", mdsError);
}
if (!mdsStatement) {
auditWrapper.auditLog(null, "registration_failed_attestation", null, {
username,
aaguid: registrationInfo.aaguid,
reason: "AAGUID not found in MDS3",
}, getClientIp(c));
return c.json({
error:
`Hardware attestation failed: Authenticator AAGUID (${registrationInfo.aaguid}) not found in FIDO MDS3 blob. Only certified hardware security keys are permitted.`,
}, 403);
}
// @ts-ignore: TypeScript definition might be out of date for FIDO MDS3 (1)
if (mdsStatement.keyProtection?.includes(0x0001)) {
auditWrapper.auditLog(null, "registration_failed_attestation", null, {
username,
aaguid: registrationInfo.aaguid,
reason: "Software passkey detected",
}, getClientIp(c));
return c.json({
error:
"Hardware attestation failed: Authenticator is flagged as a software-based passkey. Only certified hardware security keys are permitted.",
}, 403);
}
}
const credentialID = registrationInfo.credential.id;
const credentialPublicKey = registrationInfo.credential.publicKey;
const counter = registrationInfo.credential.counter;
const base64CredentialID = typeof credentialID === "string"
? credentialID
: encodeBase64Url(new Uint8Array(credentialID as unknown as ArrayBuffer));
const base64PublicKey = encodeBase64Url(
new Uint8Array(credentialPublicKey as unknown as ArrayBuffer),
);
const prfEnabled =
(response.clientExtensionResults as any)?.prf?.enabled === true;
let prfSalt = null;
if (prfEnabled) {
const saltBytes = crypto.getRandomValues(new Uint8Array(32));
prfSalt = encodeBase64Url(saltBytes);
}
if (upgrade_session) {
// Ephemeral Guest Sandbox in-flight promotion
const sessionDataStr = await valkey.get(upgrade_session);
if (!sessionDataStr) {
return c.json({ error: "Invalid or expired guest session" }, 400);
}
const sessionData = JSON.parse(sessionDataStr);
if (
!sessionData || !sessionData.uuid ||
sessionData.account_status !== "guest"
) {
return c.json({ error: "Invalid guest session state" }, 400);
}
const guestUuid = sessionData.uuid;
const insertRes = await sqlWrapper
.sql`INSERT INTO users (id, username, account_status) VALUES (${guestUuid}, ${username}, 'active') RETURNING id`;
user = insertRes[0];
await sqlWrapper.sql`
INSERT INTO passkeys (user_id, credential_id, public_key, counter, prf_enabled, prf_salt)
VALUES (${user.id}, ${base64CredentialID}, ${base64PublicKey}, ${counter}, ${prfEnabled}, ${prfSalt})
`;
// Promote Valkey session
await valkey.setex(
upgrade_session,
28800, // Upgrade TTL to 8 hours
JSON.stringify({ uuid: guestUuid, username, account_status: "active" }),
);
// Register session in PostgreSQL
const expiresAt = new Date(Date.now() + 8 * 60 * 60 * 1000);
await sqlWrapper.sql`
INSERT INTO sessions (id, user_id, expires_at)
VALUES (${upgrade_session}, ${user.id}, ${expiresAt})
`;
} else {
// Standard Registration Flow
const invite = await sqlWrapper
.sql`SELECT id, app_id, role, max_uses, uses_count, auto_activate FROM invites WHERE code = ${inviteCode} AND (max_uses IS NULL OR uses_count < max_uses) AND expires_at > NOW()`
.then((res: any) => res[0]);
if (!invite) {
return c.json(
{ error: "Invalid, expired, or fully claimed invite code" },
400,
);
}
const initialStatus = invite.auto_activate === false
? "pending"
: "active";
const insertRes = await sqlWrapper
.sql`INSERT INTO users (id, username, account_status) VALUES (${registrationUserId}, ${username}, ${initialStatus}) RETURNING id`;
user = insertRes[0];
await sqlWrapper.sql`
INSERT INTO passkeys (user_id, credential_id, public_key, counter, prf_enabled, prf_salt)
VALUES (${user.id}, ${base64CredentialID}, ${base64PublicKey}, ${counter}, ${prfEnabled}, ${prfSalt})
`;
await sqlWrapper.sql`
UPDATE invites
SET uses_count = uses_count + 1,
used_at = NOW(),
used_by = ${user.id}
WHERE id = ${invite.id}
`;
await sqlWrapper.sql`
INSERT INTO invite_redemptions (invite_id, user_id)
VALUES (${invite.id}, ${user.id})
`;
if (invite.app_id) {
await sqlWrapper.sql`
INSERT INTO grants (user_id, app_id, role)
VALUES (${user.id}, ${invite.app_id}, ${invite.role})
`;
} else if (invite.role === "admin") {
const adminApp = await sqlWrapper
.sql`SELECT id FROM apps WHERE name = 'Auth-Yes Management Console'`
.then((res: any) => res[0]);
if (adminApp) {
await sqlWrapper.sql`
INSERT INTO grants (user_id, app_id, role)
VALUES (${user.id}, ${adminApp.id}, 'admin')
ON CONFLICT (user_id, app_id) DO UPDATE SET role = 'admin'
`;
}
}
}
auditWrapper.auditLog(
user.id,
"user_registered",
null,
{ username, inviteCode },
getClientIp(c),
);
// Set response cookie to clear out the challenge
setCookie(c, "expected_registration_challenge", "", {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 0,
});
setCookie(c, "registration_user_id", "", {
httpOnly: true,
secure: true,
sameSite: "Lax",
maxAge: 0,
});
const cookieDomain = getCookieDomain(rpID);
if (cookieDomain) {
deleteCookie(c, "session_id", { domain: cookieDomain, path: "/" });
}
deleteCookie(c, "session_id", { path: "/" });
return c.json({ success: true });
} catch (error: any) {
console.error(
"[Auth API] Uncaught Exception in /api/register/verify:",
error,
);
return c.json({ error: error.message || "Internal server error" }, 500);
}
});

15
server/routes/auth/utils.ts
View File

@ -1,15 +0,0 @@
export function getCookieDomain(customRpId?: string): string | undefined {
const envDomain = Deno.env.get("COOKIE_DOMAIN");
if (envDomain) {
return envDomain.startsWith(".") ? envDomain : `.${envDomain}`;
}
const targetId = customRpId || Deno.env.get("RP_ID") || "";
if (!targetId || !targetId.includes(".") || targetId === "localhost") {
return undefined;
}
const parts = targetId.split(".").filter(Boolean);
if (parts.length >= 2) {
return `.${parts.slice(-2).join(".")}`;
}
return `.${targetId}`;
}

0
tasks/complete/2026-0825.01.jul.story.arch.monolith-decomposition-roadmap-1845.ph4.1.md → tasks/new/2026-0825.01.jul.story.arch.monolith-decomposition-roadmap-1845.ph4.1.md
View File