feat(auth): load immutable runtime projection snapshots
This commit is contained in:
User
@@ -0,0 +1,534 @@
|
||||
import { createHash } from "node:crypto";
|
||||
import {
|
||||
closeSync,
|
||||
constants,
|
||||
fstatSync,
|
||||
lstatSync,
|
||||
openSync,
|
||||
readSync,
|
||||
readdirSync,
|
||||
} from "node:fs";
|
||||
import type { Stats } from "node:fs";
|
||||
import { isAbsolute, join, normalize } from "node:path";
|
||||
import { parseAuthenticationConfigSource } from "./config.js";
|
||||
import { parseLocalUserRegistrySource } from "./local-registry.js";
|
||||
import type {
|
||||
AuthenticationConfigProvider,
|
||||
LoadedAuthConfig,
|
||||
LocalUserRecord,
|
||||
RuntimeProjectionSnapshot,
|
||||
} from "./types.js";
|
||||
|
||||
const MAX_AUTH_BYTES = 1 << 20;
|
||||
const MAX_USERS_BYTES = 1 << 20;
|
||||
const MAX_SELECTOR_BYTES = 4096;
|
||||
const MAX_MANIFEST_BYTES = 4096;
|
||||
const DIR_MODE = 0o700;
|
||||
const FILE_MODE = 0o600;
|
||||
const GENERATION = /^[0-9a-f]{64}$/;
|
||||
const TRANSACTION = /^[0-9a-f]{32}$/;
|
||||
const invalid = (): Error =>
|
||||
new Error("authentication runtime projection is invalid");
|
||||
|
||||
interface Identity {
|
||||
dev: number;
|
||||
ino: number;
|
||||
uid: number;
|
||||
gid: number;
|
||||
mode: number;
|
||||
nlink: number;
|
||||
size: number;
|
||||
mtimeMs: number;
|
||||
ctimeMs: number;
|
||||
}
|
||||
interface Selector {
|
||||
version: 1;
|
||||
state: "ready" | "blocked";
|
||||
transaction: string;
|
||||
generation?: string;
|
||||
previousGenerations?: readonly string[];
|
||||
}
|
||||
interface ManifestFile {
|
||||
name: "auth.yaml" | "users.yaml";
|
||||
size: number;
|
||||
sha256: string;
|
||||
}
|
||||
interface Manifest {
|
||||
version: 1;
|
||||
generation: string;
|
||||
mode: "local" | "oidc";
|
||||
canonicalRevision: string;
|
||||
files: readonly ManifestFile[];
|
||||
}
|
||||
class CurrentReplaced extends Error {}
|
||||
|
||||
function runtimeOwner(): number {
|
||||
if (process.platform === "win32" || typeof process.geteuid !== "function")
|
||||
throw invalid();
|
||||
const uid = process.geteuid();
|
||||
if (!Number.isSafeInteger(uid) || uid < 0) throw invalid();
|
||||
return uid;
|
||||
}
|
||||
function meta(info: Stats): Identity {
|
||||
return {
|
||||
dev: info.dev,
|
||||
ino: info.ino,
|
||||
uid: info.uid,
|
||||
gid: info.gid,
|
||||
mode: info.mode & 0o7777,
|
||||
nlink: info.nlink,
|
||||
size: info.size,
|
||||
mtimeMs: info.mtimeMs,
|
||||
ctimeMs: info.ctimeMs,
|
||||
};
|
||||
}
|
||||
function same(a: Identity, b: Identity): boolean {
|
||||
return (
|
||||
a.dev === b.dev &&
|
||||
a.ino === b.ino &&
|
||||
a.uid === b.uid &&
|
||||
a.gid === b.gid &&
|
||||
a.mode === b.mode &&
|
||||
a.nlink === b.nlink &&
|
||||
a.size === b.size &&
|
||||
a.mtimeMs === b.mtimeMs &&
|
||||
a.ctimeMs === b.ctimeMs
|
||||
);
|
||||
}
|
||||
function directory(info: Stats, uid: number): Identity {
|
||||
const value = meta(info);
|
||||
if (!info.isDirectory() || value.uid !== uid || value.mode !== DIR_MODE)
|
||||
throw invalid();
|
||||
return value;
|
||||
}
|
||||
function regular(info: Stats, uid: number, maximum: number): Identity {
|
||||
const value = meta(info);
|
||||
if (
|
||||
!info.isFile() ||
|
||||
value.uid !== uid ||
|
||||
value.mode !== FILE_MODE ||
|
||||
value.nlink !== 1 ||
|
||||
value.size < 0 ||
|
||||
value.size > maximum
|
||||
)
|
||||
throw invalid();
|
||||
return value;
|
||||
}
|
||||
function checkRoot(root: string): void {
|
||||
if (
|
||||
typeof root !== "string" ||
|
||||
root.length === 0 ||
|
||||
root.includes("\0") ||
|
||||
!isAbsolute(root) ||
|
||||
normalize(root) !== root
|
||||
)
|
||||
throw invalid();
|
||||
}
|
||||
function openDirectory(
|
||||
path: string,
|
||||
uid: number,
|
||||
): { fd: number; identity: Identity } {
|
||||
let fd: number | undefined;
|
||||
try {
|
||||
const before = directory(lstatSync(path) as Stats, uid);
|
||||
fd = openSync(
|
||||
path,
|
||||
constants.O_RDONLY |
|
||||
(constants.O_DIRECTORY ?? 0) |
|
||||
constants.O_NOFOLLOW |
|
||||
constants.O_NONBLOCK,
|
||||
);
|
||||
const opened = directory(fstatSync(fd) as Stats, uid);
|
||||
if (!same(before, opened)) throw invalid();
|
||||
return { fd, identity: opened };
|
||||
} catch {
|
||||
if (fd !== undefined)
|
||||
try {
|
||||
closeSync(fd);
|
||||
} catch {}
|
||||
throw invalid();
|
||||
}
|
||||
}
|
||||
function stableDirectory(
|
||||
path: string,
|
||||
opened: { fd: number; identity: Identity },
|
||||
uid: number,
|
||||
): void {
|
||||
if (
|
||||
!same(opened.identity, directory(fstatSync(opened.fd) as Stats, uid)) ||
|
||||
!same(opened.identity, directory(lstatSync(path) as Stats, uid))
|
||||
)
|
||||
throw invalid();
|
||||
}
|
||||
function entries(path: string, uid: number, expected: readonly string[]): void {
|
||||
const opened = openDirectory(path, uid);
|
||||
try {
|
||||
const names = readdirSync(path);
|
||||
if (
|
||||
names.length !== expected.length ||
|
||||
new Set(names).size !== names.length ||
|
||||
names.some((name) => !expected.includes(name))
|
||||
)
|
||||
throw invalid();
|
||||
stableDirectory(path, opened, uid);
|
||||
} finally {
|
||||
try {
|
||||
closeSync(opened.fd);
|
||||
} catch {}
|
||||
}
|
||||
}
|
||||
function replaced(before: Identity, after: Identity): boolean {
|
||||
return before.dev !== after.dev || before.ino !== after.ino;
|
||||
}
|
||||
function readRegular(
|
||||
path: string,
|
||||
parentPath: string,
|
||||
uid: number,
|
||||
maximum: number,
|
||||
retryOnReplacement = false,
|
||||
): { bytes: Buffer; identity: Identity } {
|
||||
let fd: number | undefined;
|
||||
let parent: { fd: number; identity: Identity } | undefined;
|
||||
try {
|
||||
parent = openDirectory(parentPath, uid);
|
||||
const before = regular(lstatSync(path) as Stats, uid, maximum);
|
||||
fd = openSync(
|
||||
path,
|
||||
constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK,
|
||||
);
|
||||
const opened = regular(fstatSync(fd) as Stats, uid, maximum);
|
||||
if (!same(before, opened)) {
|
||||
if (retryOnReplacement && replaced(before, opened))
|
||||
throw new CurrentReplaced();
|
||||
throw invalid();
|
||||
}
|
||||
const buffer = Buffer.allocUnsafe(maximum + 1);
|
||||
let offset = 0;
|
||||
while (offset < buffer.length) {
|
||||
const count = readSync(fd, buffer, offset, buffer.length - offset, null);
|
||||
if (count === 0) break;
|
||||
offset += count;
|
||||
}
|
||||
if (offset > maximum) throw invalid();
|
||||
const after = regular(fstatSync(fd) as Stats, uid, maximum);
|
||||
const atPath = regular(lstatSync(path) as Stats, uid, maximum);
|
||||
if (!same(opened, after) || !same(after, atPath)) {
|
||||
if (retryOnReplacement && replaced(after, atPath))
|
||||
throw new CurrentReplaced();
|
||||
throw invalid();
|
||||
}
|
||||
stableDirectory(parentPath, parent, uid);
|
||||
return { bytes: buffer.subarray(0, offset), identity: after };
|
||||
} catch (error) {
|
||||
if (error instanceof CurrentReplaced) throw error;
|
||||
throw invalid();
|
||||
} finally {
|
||||
if (fd !== undefined)
|
||||
try {
|
||||
closeSync(fd);
|
||||
} catch {}
|
||||
if (parent)
|
||||
try {
|
||||
closeSync(parent.fd);
|
||||
} catch {}
|
||||
}
|
||||
}
|
||||
function text(bytes: Buffer): string {
|
||||
try {
|
||||
return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
|
||||
} catch {
|
||||
throw invalid();
|
||||
}
|
||||
}
|
||||
function object(value: unknown): Record<string, unknown> {
|
||||
if (!value || typeof value !== "object" || Array.isArray(value))
|
||||
throw invalid();
|
||||
return value as Record<string, unknown>;
|
||||
}
|
||||
function safeGeneration(value: unknown): string {
|
||||
if (typeof value !== "string" || !GENERATION.test(value)) throw invalid();
|
||||
return value;
|
||||
}
|
||||
function strictJson<T>(
|
||||
contents: string,
|
||||
normalizeValue: (raw: unknown) => T,
|
||||
): T {
|
||||
try {
|
||||
const value = normalizeValue(JSON.parse(contents));
|
||||
if (`${JSON.stringify(value)}\n` !== contents) throw invalid();
|
||||
return value;
|
||||
} catch {
|
||||
throw invalid();
|
||||
}
|
||||
}
|
||||
function selector(contents: string): Selector {
|
||||
return strictJson(contents, (raw) => {
|
||||
const value = object(raw);
|
||||
if (
|
||||
value.version !== 1 ||
|
||||
typeof value.transaction !== "string" ||
|
||||
!TRANSACTION.test(value.transaction)
|
||||
)
|
||||
throw invalid();
|
||||
if (value.state === "blocked" && Object.keys(value).length === 3)
|
||||
return { version: 1, state: "blocked", transaction: value.transaction };
|
||||
if (
|
||||
value.state !== "ready" ||
|
||||
(Object.keys(value).length !== 4 && Object.keys(value).length !== 5)
|
||||
)
|
||||
throw invalid();
|
||||
const generation = safeGeneration(value.generation);
|
||||
const previousGenerations =
|
||||
value.previousGenerations === undefined
|
||||
? []
|
||||
: Array.isArray(value.previousGenerations)
|
||||
? value.previousGenerations.map(safeGeneration)
|
||||
: (() => {
|
||||
throw invalid();
|
||||
})();
|
||||
if (
|
||||
previousGenerations.length > 2 ||
|
||||
(previousGenerations.length === 0 && Object.keys(value).length !== 4) ||
|
||||
(previousGenerations.length > 0 && Object.keys(value).length !== 5)
|
||||
)
|
||||
throw invalid();
|
||||
if (
|
||||
new Set([generation, ...previousGenerations]).size !==
|
||||
previousGenerations.length + 1
|
||||
)
|
||||
throw invalid();
|
||||
return {
|
||||
version: 1,
|
||||
state: "ready",
|
||||
transaction: value.transaction,
|
||||
generation,
|
||||
...(previousGenerations.length > 0 ? { previousGenerations } : {}),
|
||||
};
|
||||
});
|
||||
}
|
||||
function manifest(contents: string): Manifest {
|
||||
return strictJson(contents, (raw) => {
|
||||
const value = object(raw);
|
||||
if (
|
||||
Object.keys(value).length !== 5 ||
|
||||
value.version !== 1 ||
|
||||
(value.mode !== "local" && value.mode !== "oidc")
|
||||
)
|
||||
throw invalid();
|
||||
const mode = value.mode;
|
||||
const generation = safeGeneration(value.generation);
|
||||
if (
|
||||
value.canonicalRevision !== `sha256:${generation}` ||
|
||||
!Array.isArray(value.files)
|
||||
)
|
||||
throw invalid();
|
||||
const wanted: readonly ("auth.yaml" | "users.yaml")[] =
|
||||
mode === "local" ? ["auth.yaml", "users.yaml"] : ["auth.yaml"];
|
||||
if (value.files.length !== wanted.length) throw invalid();
|
||||
const files: ManifestFile[] = value.files.map((candidate, index) => {
|
||||
const item = object(candidate);
|
||||
const name = wanted[index]!;
|
||||
const maximum = name === "auth.yaml" ? MAX_AUTH_BYTES : MAX_USERS_BYTES;
|
||||
if (
|
||||
Object.keys(item).length !== 3 ||
|
||||
item.name !== name ||
|
||||
!Number.isSafeInteger(item.size) ||
|
||||
(item.size as number) < 0 ||
|
||||
(item.size as number) > maximum ||
|
||||
typeof item.sha256 !== "string" ||
|
||||
!GENERATION.test(item.sha256)
|
||||
)
|
||||
throw invalid();
|
||||
return { name, size: item.size as number, sha256: item.sha256 };
|
||||
});
|
||||
return {
|
||||
version: 1,
|
||||
generation,
|
||||
mode,
|
||||
canonicalRevision: value.canonicalRevision as string,
|
||||
files,
|
||||
};
|
||||
});
|
||||
}
|
||||
function digest(bytes: Buffer): string {
|
||||
return createHash("sha256").update(bytes).digest("hex");
|
||||
}
|
||||
function generationFor(
|
||||
mode: "local" | "oidc",
|
||||
auth: Buffer,
|
||||
users?: Buffer,
|
||||
): string {
|
||||
return digest(
|
||||
Buffer.from(
|
||||
`thothii-auth-projection-v1\nmode=${mode}\nauth=${digest(auth)}\nusers=${mode === "local" && users ? digest(users) : "-"}\n`,
|
||||
"utf8",
|
||||
),
|
||||
);
|
||||
}
|
||||
function snapshot(
|
||||
generation: string,
|
||||
users?: readonly LocalUserRecord[],
|
||||
): RuntimeProjectionSnapshot {
|
||||
const localUsers =
|
||||
users === undefined
|
||||
? undefined
|
||||
: Object.freeze(
|
||||
users.map((user) =>
|
||||
Object.freeze({ ...user, roles: Object.freeze([...user.roles]) }),
|
||||
),
|
||||
);
|
||||
return Object.freeze({
|
||||
generation,
|
||||
canonicalRevision: `sha256:${generation}`,
|
||||
...(localUsers ? { localUsers } : {}),
|
||||
});
|
||||
}
|
||||
interface ValidGeneration {
|
||||
value: ReturnType<typeof parseAuthenticationConfigSource>;
|
||||
users?: readonly LocalUserRecord[];
|
||||
}
|
||||
function validateGeneration(
|
||||
generationsPath: string,
|
||||
generation: string,
|
||||
uid: number,
|
||||
): ValidGeneration {
|
||||
const selectedPath = join(generationsPath, generation);
|
||||
const openedGeneration = openDirectory(selectedPath, uid);
|
||||
try {
|
||||
const readManifest = readRegular(
|
||||
join(selectedPath, "manifest.json"),
|
||||
selectedPath,
|
||||
uid,
|
||||
MAX_MANIFEST_BYTES,
|
||||
);
|
||||
const loadedManifest = manifest(text(readManifest.bytes));
|
||||
if (loadedManifest.generation !== generation) throw invalid();
|
||||
entries(
|
||||
selectedPath,
|
||||
uid,
|
||||
[
|
||||
...loadedManifest.files.map((item) => item.name),
|
||||
"manifest.json",
|
||||
].sort(),
|
||||
);
|
||||
const auth = readRegular(
|
||||
join(selectedPath, "auth.yaml"),
|
||||
selectedPath,
|
||||
uid,
|
||||
MAX_AUTH_BYTES,
|
||||
);
|
||||
if (
|
||||
loadedManifest.files[0]?.size !== auth.bytes.length ||
|
||||
loadedManifest.files[0]?.sha256 !== digest(auth.bytes)
|
||||
)
|
||||
throw invalid();
|
||||
const value = parseAuthenticationConfigSource(text(auth.bytes));
|
||||
if (value.mode !== loadedManifest.mode) throw invalid();
|
||||
let users: readonly LocalUserRecord[] | undefined;
|
||||
let userBytes: Buffer | undefined;
|
||||
if (loadedManifest.mode === "local") {
|
||||
const readUsers = readRegular(
|
||||
join(selectedPath, "users.yaml"),
|
||||
selectedPath,
|
||||
uid,
|
||||
MAX_USERS_BYTES,
|
||||
);
|
||||
if (
|
||||
loadedManifest.files[1]?.size !== readUsers.bytes.length ||
|
||||
loadedManifest.files[1]?.sha256 !== digest(readUsers.bytes)
|
||||
)
|
||||
throw invalid();
|
||||
userBytes = readUsers.bytes;
|
||||
users = parseLocalUserRegistrySource(text(userBytes));
|
||||
}
|
||||
if (
|
||||
generationFor(loadedManifest.mode, auth.bytes, userBytes) !== generation
|
||||
)
|
||||
throw invalid();
|
||||
stableDirectory(selectedPath, openedGeneration, uid);
|
||||
return { value, users };
|
||||
} finally {
|
||||
try {
|
||||
closeSync(openedGeneration.fd);
|
||||
} catch {}
|
||||
}
|
||||
}
|
||||
function load(root: string): LoadedAuthConfig {
|
||||
const uid = runtimeOwner();
|
||||
checkRoot(root);
|
||||
const openedRoot = openDirectory(root, uid);
|
||||
try {
|
||||
entries(root, uid, ["CURRENT", "generations"]);
|
||||
const currentPath = join(root, "CURRENT");
|
||||
const selectedCurrent = readRegular(
|
||||
currentPath,
|
||||
root,
|
||||
uid,
|
||||
MAX_SELECTOR_BYTES,
|
||||
true,
|
||||
);
|
||||
const selected = selector(text(selectedCurrent.bytes));
|
||||
if (selected.state !== "ready" || !selected.generation) throw invalid();
|
||||
const generationsPath = join(root, "generations");
|
||||
const openedGenerations = openDirectory(generationsPath, uid);
|
||||
try {
|
||||
entries(generationsPath, uid, [
|
||||
selected.generation,
|
||||
...(selected.previousGenerations ?? []),
|
||||
]);
|
||||
const selectedGeneration = validateGeneration(
|
||||
generationsPath,
|
||||
selected.generation,
|
||||
uid,
|
||||
);
|
||||
for (const predecessor of selected.previousGenerations ?? [])
|
||||
validateGeneration(generationsPath, predecessor, uid);
|
||||
stableDirectory(generationsPath, openedGenerations, uid);
|
||||
const afterCurrent = regular(
|
||||
lstatSync(currentPath) as Stats,
|
||||
uid,
|
||||
MAX_SELECTOR_BYTES,
|
||||
);
|
||||
if (!same(selectedCurrent.identity, afterCurrent)) {
|
||||
if (replaced(selectedCurrent.identity, afterCurrent))
|
||||
throw new CurrentReplaced();
|
||||
throw invalid();
|
||||
}
|
||||
stableDirectory(root, openedRoot, uid);
|
||||
return {
|
||||
value: selectedGeneration.value,
|
||||
revision: `sha256:${selected.generation}`,
|
||||
sourcePath: join(generationsPath, selected.generation, "auth.yaml"),
|
||||
runtimeProjection: snapshot(
|
||||
selected.generation,
|
||||
selectedGeneration.users,
|
||||
),
|
||||
};
|
||||
} finally {
|
||||
try {
|
||||
closeSync(openedGenerations.fd);
|
||||
} catch {}
|
||||
}
|
||||
} finally {
|
||||
try {
|
||||
closeSync(openedRoot.fd);
|
||||
} catch {}
|
||||
}
|
||||
}
|
||||
export function createProjectedAuthenticationConfigProvider(
|
||||
root: string,
|
||||
): AuthenticationConfigProvider {
|
||||
return {
|
||||
current(): LoadedAuthConfig {
|
||||
for (let attempt = 0; attempt < 2; attempt += 1) {
|
||||
try {
|
||||
return load(root);
|
||||
} catch (error) {
|
||||
if (error instanceof CurrentReplaced && attempt === 0) continue;
|
||||
throw invalid();
|
||||
}
|
||||
}
|
||||
throw invalid();
|
||||
},
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user