306 lines
14 KiB
TypeScript
306 lines
14 KiB
TypeScript
import { writeFileSync } from 'node:fs'
|
|
import type { FastifyInstance } from 'fastify'
|
|
import type { CredentialKind, CredentialProfile, CredentialsDocument } from '../shared/credentials.ts'
|
|
import { HttpError, strict } from './http.ts'
|
|
import type { Log } from './log.ts'
|
|
import { readJsonObject } from './process.ts'
|
|
import { decrypt, encrypt, encryptionKey } from './secrets.ts'
|
|
|
|
/**
|
|
* A credential store: the list under key of config.json at configPath, of the kinds the application gives, with the
|
|
* names reserved for its own credentials. With missingAsEmpty a missing config.json reads as {}, and the first write
|
|
* creates it.
|
|
*/
|
|
export type CredentialStore = {
|
|
configPath: string
|
|
key: string
|
|
kinds: CredentialKind[]
|
|
reserved?: string[]
|
|
missingAsEmpty: boolean
|
|
}
|
|
|
|
/** A credential with its secrets decrypted; a secret that is not kept is absent. */
|
|
export type CredentialValues = { name: string; kind: string; values: Record<string, string | number> }
|
|
|
|
/**
|
|
* The kind of a PostgreSQL connection: host, port, database, user, SSL mode and an encrypted password. The SSL modes
|
|
* are those libpq and node-postgres both take: disable, require (no check of the certificate) and verify-full.
|
|
*/
|
|
export const POSTGRESQL_KIND: CredentialKind = {
|
|
kind: 'postgresql',
|
|
label: 'PostgreSQL connection',
|
|
fields: [
|
|
{ key: 'host', label: 'Host', help: 'The host name or address of the server.', type: 'text', required: true, secret: false },
|
|
{ key: 'port', label: 'Port', help: 'Usually 5432.', type: 'port', required: true, secret: false },
|
|
{ key: 'database', label: 'Database', help: 'The database to connect to.', type: 'text', required: true, secret: false },
|
|
{ key: 'user', label: 'User', help: 'The role to log in as.', type: 'text', required: true, secret: false },
|
|
{
|
|
key: 'ssl_mode',
|
|
label: 'SSL mode',
|
|
help: 'disable: no SSL; require: SSL without checking the server\'s certificate; verify-full: SSL with the certificate checked against the trusted CAs and the host name.',
|
|
type: 'choice',
|
|
choices: ['disable', 'require', 'verify-full'],
|
|
required: true,
|
|
secret: false,
|
|
},
|
|
{ key: 'password', label: 'Password', help: 'The password of the role.', type: 'text', required: false, secret: true },
|
|
],
|
|
}
|
|
|
|
const GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
|
|
|
|
const text = (value: unknown) => typeof value === 'string' && value.trim() !== ''
|
|
|
|
/**
|
|
* The problems of the value of the store's key in config.json, by <key>, <key>.<index> or <key>.<index>.<field key>,
|
|
* each with what it must be; empty when every value is allowed.
|
|
*/
|
|
export function credentialProblems(entries: unknown, store: Pick<CredentialStore, 'key' | 'kinds' | 'reserved'>): Record<string, string> {
|
|
if (entries === undefined) {
|
|
return {}
|
|
}
|
|
if (!Array.isArray(entries)) {
|
|
return { [store.key]: 'must be a list of credentials' }
|
|
}
|
|
const problems: Record<string, string> = {}
|
|
const reserved = store.reserved ?? []
|
|
entries.forEach((entry: unknown, index) => {
|
|
const at = `${store.key}.${index}`
|
|
if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) {
|
|
problems[at] = 'must be an object with name and kind'
|
|
return
|
|
}
|
|
const record = entry as Record<string, unknown>
|
|
const { name } = record
|
|
if (!text(name)) {
|
|
problems[`${at}.name`] = 'must be a name'
|
|
} else if (reserved.includes(name as string)) {
|
|
problems[`${at}.name`] = `must not be ${reserved.join(' or ')}`
|
|
} else if (entries.findIndex((other) => (other as Record<string, unknown> | null)?.name === name) !== index) {
|
|
problems[`${at}.name`] = 'must differ from the names of the other credentials'
|
|
}
|
|
const kind = store.kinds.find((item) => item.kind === record.kind)
|
|
if (kind === undefined) {
|
|
problems[`${at}.kind`] = `must be one of ${store.kinds.map((item) => item.kind).join(', ')}`
|
|
return
|
|
}
|
|
const keys = ['name', 'kind', ...kind.fields.map((field) => field.key)]
|
|
const unknown = Object.keys(record).filter((key) => !keys.includes(key))
|
|
if (unknown.length > 0) {
|
|
problems[at] = `must hold only ${keys.join(', ')}; ${unknown.join(', ')} is not a field of ${kind.kind}`
|
|
}
|
|
for (const field of kind.fields) {
|
|
const value = record[field.key]
|
|
const path = `${at}.${field.key}`
|
|
if (value === undefined) {
|
|
if (field.required && !field.secret) {
|
|
problems[path] = `must be set: ${field.help}`
|
|
}
|
|
} else if (field.secret) {
|
|
if (!text(value)) {
|
|
problems[path] = 'must be an encrypted secret'
|
|
}
|
|
} else if (field.type === 'port') {
|
|
if (!(Number.isInteger(value) && (value as number) >= 1 && (value as number) <= 65535)) {
|
|
problems[path] = 'must be a port number from 1 to 65535'
|
|
}
|
|
} else if (field.type === 'guid') {
|
|
if (typeof value !== 'string' || !GUID.test(value)) {
|
|
problems[path] = 'must be a GUID'
|
|
}
|
|
} else if (field.type === 'choice') {
|
|
if (!field.choices?.includes(value as string)) {
|
|
problems[path] = `must be one of ${field.choices?.join(', ')}`
|
|
}
|
|
} else if (!text(value)) {
|
|
problems[path] = `must be set: ${field.help}`
|
|
}
|
|
}
|
|
})
|
|
return problems
|
|
}
|
|
|
|
/** The entries of the store's key in config.json; a value that is not a list reads as none. */
|
|
function entriesOf(data: Record<string, unknown>, store: CredentialStore): Record<string, unknown>[] {
|
|
const entries = data[store.key]
|
|
return Array.isArray(entries) ? entries.filter((entry) => entry !== null && typeof entry === 'object') : []
|
|
}
|
|
|
|
/** The key of the secrets, a file of ENCRYPTION_KEY_FILE that cannot be read being 500. */
|
|
function key(): Buffer | null {
|
|
try {
|
|
return encryptionKey()
|
|
} catch (error) {
|
|
throw new HttpError(500, (error as Error).message)
|
|
}
|
|
}
|
|
|
|
/** config.json of the store with its version, a file that cannot be read being 500. */
|
|
function read(store: CredentialStore) {
|
|
try {
|
|
return readJsonObject(store.configPath, { missingAsEmpty: store.missingAsEmpty })
|
|
} catch (error) {
|
|
throw new HttpError(500, `${(error as Error).message}.`)
|
|
}
|
|
}
|
|
|
|
/** The credentials of the entries, without their secrets. */
|
|
function toProfiles(data: Record<string, unknown>, store: CredentialStore): CredentialProfile[] {
|
|
return entriesOf(data, store).map((entry) => {
|
|
const kind = store.kinds.find((item) => item.kind === entry.kind)
|
|
const fields = kind?.fields ?? []
|
|
const shown = (value: unknown) => (typeof value === 'string' || typeof value === 'number' ? String(value) : '')
|
|
return {
|
|
original: typeof entry.name === 'string' ? entry.name : null,
|
|
name: typeof entry.name === 'string' ? entry.name : '',
|
|
kind: typeof entry.kind === 'string' ? entry.kind : '',
|
|
values: Object.fromEntries(fields.filter((field) => !field.secret).map((field) => [field.key, shown(entry[field.key])])),
|
|
secrets: Object.fromEntries(fields.filter((field) => field.secret).map((field) => [field.key, null])),
|
|
stored: Object.fromEntries(fields.filter((field) => field.secret).map((field) => [field.key, typeof entry[field.key] === 'string'])),
|
|
}
|
|
})
|
|
}
|
|
|
|
/**
|
|
* The entries of the credentials, with each secret: kept from the entry named original for null, none for '', else
|
|
* the new secret through seal, which encrypts it; for validation seal only marks it. A port of digits is a number,
|
|
* other text is kept as typed; an empty field that is not required is left out.
|
|
*/
|
|
function toEntries(profiles: CredentialProfile[], data: Record<string, unknown>, store: CredentialStore, seal: (secret: string) => string) {
|
|
const stored = entriesOf(data, store)
|
|
return profiles.map((profile) => {
|
|
const kind = store.kinds.find((item) => item.kind === profile.kind)
|
|
const previous = profile.original === null ? undefined : stored.find((entry) => entry.name === profile.original)
|
|
const entry: Record<string, unknown> = { name: profile.name.trim(), kind: profile.kind }
|
|
for (const field of kind?.fields ?? []) {
|
|
if (field.secret) {
|
|
const secret = profile.secrets[field.key] ?? null
|
|
const value = secret === null ? (previous?.kind === profile.kind ? previous?.[field.key] : undefined) : secret === '' ? undefined : seal(secret)
|
|
if (value !== undefined) {
|
|
entry[field.key] = value
|
|
}
|
|
continue
|
|
}
|
|
const value = (profile.values[field.key] ?? '').trim()
|
|
if (value !== '' || field.required) {
|
|
entry[field.key] = field.type === 'port' && /^\d+$/.test(value) ? Number(value) : value
|
|
}
|
|
}
|
|
return entry
|
|
})
|
|
}
|
|
|
|
/**
|
|
* The credential named name of the store with its secrets decrypted. A config.json whose credentials are not valid
|
|
* is 500, a name that does not exist 404, and a secret without a key, or that the key does not decrypt, 400.
|
|
*/
|
|
export function credentialValues(store: CredentialStore, name: string): CredentialValues {
|
|
const { data } = read(store)
|
|
const [problem] = Object.entries(credentialProblems(data[store.key], store))
|
|
if (problem !== undefined) {
|
|
throw new HttpError(500, `${problem[0]} in ${store.configPath} ${problem[1]}.`)
|
|
}
|
|
const entry = entriesOf(data, store).find((item) => item.name === name)
|
|
if (entry === undefined) {
|
|
throw new HttpError(404, `The credential ${name} does not exist.`)
|
|
}
|
|
const kind = store.kinds.find((item) => item.kind === entry.kind)!
|
|
const values: Record<string, string | number> = {}
|
|
for (const field of kind.fields) {
|
|
const value = entry[field.key]
|
|
if (value === undefined) {
|
|
continue
|
|
}
|
|
if (!field.secret) {
|
|
values[field.key] = value as string | number
|
|
continue
|
|
}
|
|
const secretKey = key()
|
|
if (secretKey === null) {
|
|
throw new HttpError(400, `The ${field.label.toLowerCase()} of ${name} needs ENCRYPTION_KEY or ENCRYPTION_KEY_FILE in the server's environment.`)
|
|
}
|
|
try {
|
|
values[field.key] = decrypt(value as string, secretKey)
|
|
} catch {
|
|
throw new HttpError(400, `The ${field.label.toLowerCase()} of ${name} cannot be decrypted with the server's encryption key; enter it again.`)
|
|
}
|
|
}
|
|
return { name, kind: kind.kind, values }
|
|
}
|
|
|
|
/**
|
|
* Registers the routes of the store under prefix: read, validate and write edit the store's key of config.json,
|
|
* keeping its other keys, with each new secret encrypted by the key of ENCRYPTION_KEY or ENCRYPTION_KEY_FILE. A
|
|
* secret is never answered.
|
|
*/
|
|
export function registerCredentialRoutes(app: FastifyInstance, store: CredentialStore, prefix: string, log: Log) {
|
|
const record = { type: 'object', additionalProperties: { type: 'string' } }
|
|
const secrets = { type: 'object', additionalProperties: { type: ['string', 'null'] } }
|
|
const flags = { type: 'object', additionalProperties: { type: 'boolean' } }
|
|
const profiles = {
|
|
type: 'array',
|
|
items: strict({ original: { type: ['string', 'null'] }, name: { type: 'string' }, kind: { type: 'string' }, values: record, secrets, stored: flags }),
|
|
}
|
|
|
|
/** The problems of the credentials by <index>.<field key>, a new secret included when the server has no key. */
|
|
function problemsOf(value: CredentialProfile[], data: Record<string, unknown>): Record<string, string> {
|
|
const problems: Record<string, string> = {}
|
|
for (const [path, message] of Object.entries(credentialProblems(toEntries(value, data, store, () => 'new'), store))) {
|
|
const [, index, field] = path.split('.')
|
|
problems[field === undefined ? index ?? store.key : `${index}.${field}`] = `${field ?? 'The credential'} ${message}.`
|
|
}
|
|
if (key() === null) {
|
|
value.forEach((profile, index) => {
|
|
for (const [field, secret] of Object.entries(profile.secrets)) {
|
|
if (secret !== null && secret !== '') {
|
|
problems[`${index}.${field}`] ??= 'A secret needs ENCRYPTION_KEY or ENCRYPTION_KEY_FILE in the server\'s environment.'
|
|
}
|
|
}
|
|
})
|
|
}
|
|
return problems
|
|
}
|
|
|
|
function document(file: { data: Record<string, unknown>; version: string }): CredentialsDocument {
|
|
return {
|
|
version: file.version,
|
|
value: toProfiles(file.data, store),
|
|
path: store.configPath,
|
|
encryption: key() !== null,
|
|
kinds: store.kinds,
|
|
reserved: store.reserved ?? [],
|
|
}
|
|
}
|
|
|
|
app.get(`${prefix}/read`, async (): Promise<CredentialsDocument> => document(read(store)))
|
|
|
|
app.post<{ Body: { value: CredentialProfile[] } }>(`${prefix}/validate`, {
|
|
schema: { body: strict({ value: profiles }) },
|
|
}, async (request) => ({ problems: problemsOf(request.body.value, read(store).data), message: '' }))
|
|
|
|
// The file is read, compared and written synchronously.
|
|
app.post<{ Body: { version: string; value: CredentialProfile[] } }>(`${prefix}/write`, {
|
|
schema: { body: strict({ version: { type: 'string' }, value: profiles }) },
|
|
}, async (request): Promise<CredentialsDocument> => {
|
|
const file = read(store)
|
|
if (file.version !== request.body.version) {
|
|
throw new HttpError(409, `${store.configPath} changed since it was read. Close the dialog and open it again.`)
|
|
}
|
|
const problems = problemsOf(request.body.value, file.data)
|
|
if (Object.keys(problems).length > 0) {
|
|
throw new HttpError(422, 'The credentials are not valid.', problems)
|
|
}
|
|
const sealing = key()!
|
|
const others = { ...file.data }
|
|
delete others[store.key]
|
|
const entries = toEntries(request.body.value, file.data, store, (secret) => encrypt(secret, sealing))
|
|
try {
|
|
writeFileSync(store.configPath, `${JSON.stringify({ ...others, [store.key]: entries }, null, 2)}\n`)
|
|
} catch (error) {
|
|
throw new HttpError(500, `${store.configPath} cannot be written: ${(error as Error).message}`)
|
|
}
|
|
log.event(`file write ${store.configPath} (${store.key})`)
|
|
return document(read(store))
|
|
})
|
|
}
|