mirror of
https://github.com/Termix-SSH/Termix.git
synced 2026-10-30 07:05:24 +00:00
release-2.9.0 (#1532)
* fix(macos): skip single-instance lock in Mac App Store builds (#1454)
fix(macos): skip single-instance lock in Mac App Store builds
* Fix/backend optional sharp (#1455)
Fix/backend optional sharp
* feat: issue #1218 (#1218)
https://github.com/Termix-SSH/Support/issues/1218
* feat: Add option to use saved global custom theme under Connection Defaults (#1209)
https://github.com/Termix-SSH/Support/issues/1209
* feat: Add Fleet Sharing functionality to the UI (#1228)
https://github.com/Termix-SSH/Support/issues/1228
* feat: Add a list view to the Docker management page (#1237)
https://github.com/Termix-SSH/Support/issues/1237
* feat: issue #1264 (#1264)
https://github.com/Termix-SSH/Support/issues/1264
* feat: 2FA With FortiToken (#1288)
https://github.com/Termix-SSH/Support/issues/1288
* feat: Allow to disable showing paths to folders (#1274)
https://github.com/Termix-SSH/Support/issues/1274
* feat: Sync Network Graph between Desktop and Remote Server (#1245)
https://github.com/Termix-SSH/Support/issues/1245
* feat: Version Number on offline servers (#1291)
https://github.com/Termix-SSH/Support/issues/1291
* feat: Support OrbStack Docker socket path on macOS / Fix "Docker is not installed" on mac... (#1302)
https://github.com/Termix-SSH/Support/issues/1302
* feat: Sidebar host click should focus existing tab instead of opening a new connection (#1289)
https://github.com/Termix-SSH/Support/issues/1289
* fix: Search in side bar shows overlapping hosts when grouped by tags (#1303)
https://github.com/Termix-SSH/Support/issues/1303
* fix: I can't send a file on its own. (#1304)
https://github.com/Termix-SSH/Support/issues/1304
* fix: sudo password not autofilling (#1248)
https://github.com/Termix-SSH/Support/issues/1248
* fix: node-MainThread (#1300)
https://github.com/Termix-SSH/Support/issues/1300
* fix: Tunnel authentication with shared credentials (#1295)
https://github.com/Termix-SSH/Support/issues/1295
* fix: host key updates not syncing, metrics 404 race on first connect
Host key writes never bumped updatedAt so sync never picked them up.
Also retry the first metrics fetch briefly instead of failing right away.
* chore: increment ver
* feat: add category and icon fields to plugin manifest schema
* ci(deps): bump the github-actions group with 2 updates (#1458)
Bumps the github-actions group with 2 updates: [crowdin/github-action](https://github.com/crowdin/github-action) and [actions/github-script](https://github.com/actions/github-script).
Updates `crowdin/github-action` from 2 to 3
- [Release notes](https://github.com/crowdin/github-action/releases)
- [Commits](https://github.com/crowdin/github-action/compare/v2...v3)
Updates `actions/github-script` from 7 to 9
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v7...v9)
---
updated-dependencies:
- dependency-name: crowdin/github-action
dependency-version: '3'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/github-script
dependency-version: '9'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps-dev): bump the dev-patch-updates group with 13 updates (#1459)
Bumps the dev-patch-updates group with 13 updates:
| Package | From | To |
| --- | --- | --- |
| [@codemirror/commands](https://github.com/codemirror/commands) | `6.11.0` | `6.11.1` |
| [@codemirror/search](https://github.com/codemirror/search) | `6.7.1` | `6.7.2` |
| [@codemirror/view](https://github.com/codemirror/view) | `6.43.9` | `6.43.12` |
| [@testing-library/dom](https://github.com/testing-library/dom-testing-library) | `10.4.1` | `10.4.2` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.5` | `14.6.7` |
| [@types/ssh2](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ssh2) | `1.15.5` | `1.15.6` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.0` | `6.1.1` |
| [cytoscape](https://github.com/cytoscape/cytoscape.js) | `3.34.1` | `3.34.3` |
| [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.4` | `0.5.7` |
| [i18next](https://github.com/i18next/i18next) | `26.4.0` | `26.4.2` |
| [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.8` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.12` | `17.0.14` |
Updates `@codemirror/commands` from 6.11.0 to 6.11.1
- [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/commands/commits)
Updates `@codemirror/search` from 6.7.1 to 6.7.2
- [Changelog](https://github.com/codemirror/search/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/search/commits)
Updates `@codemirror/view` from 6.43.9 to 6.43.12
- [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/view/commits)
Updates `@testing-library/dom` from 10.4.1 to 10.4.2
- [Release notes](https://github.com/testing-library/dom-testing-library/releases)
- [Changelog](https://github.com/testing-library/dom-testing-library/blob/main/CHANGELOG.md)
- [Commits](https://github.com/testing-library/dom-testing-library/compare/v10.4.1...v10.4.2)
Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](https://github.com/testing-library/react-testing-library/compare/v16.3.2...v16.3.3)
Updates `@testing-library/user-event` from 14.6.5 to 14.6.7
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](https://github.com/testing-library/user-event/compare/v14.6.5...v14.6.7)
Updates `@types/ssh2` from 1.15.5 to 1.15.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ssh2)
Updates `@vitejs/plugin-react` from 6.1.0 to 6.1.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)
Updates `cytoscape` from 3.34.1 to 3.34.3
- [Release notes](https://github.com/cytoscape/cytoscape.js/releases)
- [Commits](https://github.com/cytoscape/cytoscape.js/compare/v3.34.1...v3.34.3)
Updates `eslint-plugin-react-refresh` from 0.5.4 to 0.5.7
- [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases)
- [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.4...v0.5.7)
Updates `i18next` from 26.4.0 to 26.4.2
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/i18next/compare/v26.4.0...v26.4.2)
Updates `prettier` from 3.9.6 to 3.9.8
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.6...3.9.8)
Updates `react-i18next` from 17.0.12 to 17.0.14
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/react-i18next/compare/v17.0.12...v17.0.14)
---
updated-dependencies:
- dependency-name: "@codemirror/commands"
dependency-version: 6.11.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: "@codemirror/search"
dependency-version: 6.7.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: "@codemirror/view"
dependency-version: 6.43.12
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: "@testing-library/dom"
dependency-version: 10.4.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: "@testing-library/react"
dependency-version: 16.3.3
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: "@testing-library/user-event"
dependency-version: 14.6.7
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: "@types/ssh2"
dependency-version: 1.15.6
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: "@vitejs/plugin-react"
dependency-version: 6.1.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: cytoscape
dependency-version: 3.34.3
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: eslint-plugin-react-refresh
dependency-version: 0.5.7
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: i18next
dependency-version: 26.4.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: prettier
dependency-version: 3.9.8
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
- dependency-name: react-i18next
dependency-version: 17.0.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: dev-patch-updates
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps): bump the prod-patch-updates group with 6 updates (#1461)
Bumps the prod-patch-updates group with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.10` | `3.14.13` |
| [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` |
| [jose](https://github.com/panva/jose) | `6.2.9` | `6.2.12` |
| [jszip](https://github.com/Stuk/jszip) | `3.10.1` | `3.10.2` |
| [socks](https://github.com/JoshGlazebrook/socks) | `2.8.9` | `2.8.10` |
| [undici](https://github.com/nodejs/undici) | `8.10.0` | `8.10.2` |
Updates `@tanstack/react-virtual` from 3.14.10 to 3.14.13
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.13/packages/react-virtual)
Updates `compression` from 1.8.1 to 1.8.2
- [Release notes](https://github.com/expressjs/compression/releases)
- [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md)
- [Commits](https://github.com/expressjs/compression/compare/v1.8.1...v1.8.2)
Updates `jose` from 6.2.9 to 6.2.12
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](https://github.com/panva/jose/compare/v6.2.9...v6.2.12)
Updates `jszip` from 3.10.1 to 3.10.2
- [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md)
- [Commits](https://github.com/Stuk/jszip/compare/v3.10.1...v3.10.2)
Updates `socks` from 2.8.9 to 2.8.10
- [Release notes](https://github.com/JoshGlazebrook/socks/releases)
- [Commits](https://github.com/JoshGlazebrook/socks/compare/2.8.9...2.8.10)
Updates `undici` from 8.10.0 to 8.10.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v8.10.0...v8.10.2)
---
updated-dependencies:
- dependency-name: "@tanstack/react-virtual"
dependency-version: 3.14.13
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: prod-patch-updates
- dependency-name: compression
dependency-version: 1.8.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: prod-patch-updates
- dependency-name: jose
dependency-version: 6.2.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: prod-patch-updates
- dependency-name: jszip
dependency-version: 3.10.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: prod-patch-updates
- dependency-name: socks
dependency-version: 2.8.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: prod-patch-updates
- dependency-name: undici
dependency-version: 8.10.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: prod-patch-updates
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* feat: add plugin worker protocol, bootstrap and plugin_storage table
Worker-side ctx proxy plus the message envelope it talks over, and the
per-plugin key/value table behind ctx.storage with migrations for all
three dialects. Rows cascade with the plugin so uninstalling leaves
nothing behind.
* feat: add allowlisted host view for plugins
An allowlist rather than a list of fields to strip. A blocklist rots:
the moment a new secret-bearing column lands on SSHHost it starts
leaking silently. With an allowlist a new field stays invisible to
plugins until someone adds it here on purpose.
* feat: add plugin loader with manifest validation and crash restart
Validates an unpacked plugin, spawns a worker_threads worker and manages
activate/deactivate/crash-restart with backoff, disabling after three
tries.
The crash counter clears only after a plugin stays up past a stability
window, not on activation. Clearing it on activation let a plugin that
activates cleanly and then dies restart forever, because every attempt
looked like the first.
loader.ts documents what the worker boundary does and does not buy you.
Node's permission model is process-wide, not per-worker, so it cannot be
enabled for plugin workers alone and is not claimed here.
* feat: route internal events through a shared plugin event bus
Formalises three ad-hoc publish paths that already existed:
automation-events.ts, metrics/automation-bridge.ts and the
hostSessionStatus singleton, now the host.session.status topic.
Both invariants the old code relied on are preserved. Publishing stays
fire-and-forget, so a failing subscriber cannot disturb a metrics poll or
a host delete. The automations engine subscribes to the bus at scheduler
start instead of being imported ad hoc, which keeps the edge
one-directional: automations may import repositories, hosts modules must
not import automations.
* feat: add plugin ctx broker with permission gate and audit
Every ctx call a plugin makes is checked against its granted
capabilities, performed by the main thread, then audited. A capability
must be both declared in the manifest and granted in the database, so
widening a plugin's reach always needs a new manifest the user can see,
never just a database row.
Audit attribution is set by the broker, not the plugin. The plugin
supplies only the details, so it cannot forge the actor.
fix: stop plugin workers seeing plaintext credentials in error messages
A failing ctx.ssh.connect handed the worker the raw error from deep in
the SSH stack, which embeds the connect config. The worker received, in
full:
Authentication failed for root using password <SECRET>
where <SECRET> was the host's real plaintext password. Any plugin with
ssh.exec could read it by catching the error, defeating the whole point
of the handle-based ssh API.
Errors crossing the boundary are now sanitised. Only PluginFacingError
and PluginPermissionError, both authored here, reach a plugin verbatim;
anything else becomes a generic message and the real one goes to the
log. This uses a marker class rather than matching on message text,
because matching would start leaking again the moment an upstream error
happened to contain a familiar phrase.
Covered by credential-isolation.test.ts, which plants a sentinel in
every secret-bearing field and asserts it appears in no message the
worker ever receives.
* feat: dispatch plugin HTTP routes and wire the runtime into startup
ctx.http.route now registers a real router on the /plugin-api/:pluginId
dispatcher, replacing its stub 404. A plugin never touches the Express
req/res: it gets a plain summary and returns a plain object, so sockets
and session cookies stay on this side of the boundary. Authorization and
cookie headers are not forwarded.
Plugins load last in the start-up sequence, after the server is fully
wired, and are terminated before the database on shutdown so none can
outlive it. A plugin that fails to load cannot stop the backend.
fix: correct the nginx plugin-api location regex
The pattern was ^/plugin-api/(/.*)?$, which needs a double slash and so
never matched /plugin-api/<id>/<route>. Every other block in the file
uses ^/prefix(/.*)?$. Left alone, plugin routes would work in dev and
404 only behind Docker.
* fix: update stale SFTP transfer test for single file destination paths
The test still asserted transferToHost was called with the destination
directory "/srv". Commit 7727fa09 (#1304) deliberately changed a single
file transfer to send the full destination path including the filename,
so the correct expectation is "/srv/remote-1.txt". The code was right
and the test was left behind.
* feat: ship the ssh terminal as a first-party in-process plugin
Adds a hardcoded process:transport-owner tier so the terminal can own its
WebSocket server and ssh2 clients, which cannot cross the worker boundary.
* feat: ship docker as a first-party in-process plugin
Moves docker backend and frontend into plugins/docker/, alongside
ssh-terminal. Adds a host editor tab seam, a dashboard card registry,
and a build step to compile plugin backends into dist.
* feat: ship host metrics as a first-party in-process plugin
* fix: harden plugin auth and add per-request identity for ctx calls
Require auth on /plugin-api, gate plugin enable/grant/revoke routes
behind admin.plugins.manage, and thread the calling user through
worker ctx.hosts/ctx.ssh calls instead of always using the install
owner. Also adds the plugin permissions grant/revoke UI.
* feat: ship the AI assistant as a first-party in-process plugin
Moves src/backend/ai and its routes into plugins/ai, mounted through a
small /ai dispatcher instead of its own port. Moves the ai-enabled and
ai-private-endpoints settings routes out of user-settings-routes.ts
into the plugin too, so it has no leftover core dependents.
* fix: remove compiled plugin JS left behind in plugins/ after build
copy-bundled-plugins.cjs compiled and rewrote plugin backend TS in
place, copied it to dist/plugins, but never deleted the .js it had
just emitted next to the .ts sources. Those files shadowed the real
source for vitest/tsx and had import paths rewritten for the dist
layout, so tests failed with "Cannot find module" once a local build
had run. Affects docker, host-metrics and ai, not just this one.
* feat: add a permission-gated backend service registry for plugins
* feat: add a permission-gated UI action registry and action slots for plugins
Moves the terminal toolbar's hardwired AI button into a slot the ssh-terminal
plugin offers and the ai plugin fills, gated on ai.services.use.
* feat: add cross-plugin secret references gated by the provider's RBAC permission
* feat: move proxmox discovery/import/sync into a first-party plugin
* feat: move remote desktop (RDP/VNC/Telnet) into a first-party plugin
Relocates guacamole backend/frontend source and tests into
plugins/remote-desktop, following the ssh-terminal/docker pattern.
* feat: wire remote-desktop plugin into core and rename i18n keys
Repoints core consumers (dispatcher, collab, session-sharing, tab
utils) at the plugin, adds isTabTypeAvailable gating for rdp/vnc/
telnet, widens hostCapability to accept an array, and renames the
guacamole i18n namespace to remoteDesktop.
* feat: move fleets into a first-party plugin
* feat: move automations into a first-party plugin
* feat: remove legacy alert rules, superseded by automations
Alert rules already auto-migrate into automations on boot and the old
engine stands down after. Deletes the rule/firing tables, routes, UI,
and AI tools; keeps notification channels since automations still use
them. Also fixes automations' notify step, which still called the
deleted repository.
* feat: move network topology into a first-party plugin
* feat: move tailscale device discovery and settings into a plugin
Adds plugins/tailscale/ with a devices sidebar tab, admin settings
section, and re-auth dialog. Host Metrics tailscale manager card and
SSH re-auth banner parsing stay in core.
* feat: move workspaces into a first-party plugin
* feat: move web endpoint into a first-party plugin
* feat: collapse plugin runtime to one tier behind a plugin SDK
* feat: make each plugin an npm workspace built by a termix-plugin CLI
* feat: give plugins their own tables, migrations and sync entities
* feat: serve plugin http and websockets from one mount instead of ports
* feat: namespace plugin permissions and keep them valid when a plugin is off
* feat: give plugins their own settings and one settings screen
* feat: load plugin frontends at runtime and remove plugin ids from the shell
* fix: mock the ai status fetch in its activate test
* feat: add auth extension points and one ssh connect pipeline
* feat: rebuild workspaces as the reference plugin
* fix: gate second factors after SSO/LDAP behind an admin setting
* feat: convert network-topology to a full plugin (B1)
* feat: move snippets backend and tables into a plugin (B2)
* feat: point core frontend snippets pickers at the plugin (B2)
* feat: add the snippets plugin (B2)
* feat: wire ai, automations, fleets and ssh-terminal to snippets (B2)
* feat: finish the tailscale plugin, including SSH auth (B3)
* feat: finish the fleets plugin, add ctx.hosts and host-commands SDK (B4)
* chore: update proxmox and host-metrics locale files for B5
* chore: regenerate drizzle migration journals for B5
* feat: add ctx.hosts create/update to the SDK, host-metrics drops proxmox
* feat: move proxmox node stats and collectors into the proxmox plugin
* feat: drop proxmox host columns, use plugin settings instead
* feat: finish the fleets plugin, add ctx.hosts and host-commands SDK (B4)
* feat: convert file manager into a plugin
* feat: convert ssh tunnels into a plugin
* feat: finish the web-endpoint plugin, add ctx.desktop (B8)
* feat: move the terminal fully into the ssh-terminal plugin (B9)
* feat: convert tmux monitoring into a plugin (B10)
* feat: convert serial console into the serial plugin
* feat: move session sharing and collab rooms into a plugin (B12)
* feat: turn session recording into a plugin (B13)
* feat: finish the remote-desktop plugin (B14)
* feat: finish the host-metrics plugin, move host status into core (B16)
* feat: finish the docker plugin (B15)
* feat: finish the automations plugin (B17)
* feat: finish the ai plugin (B18)
* feat: finish the homepage plugin, move service links and canvas out of core (B19)
* feat: convert wake-on-lan into a plugin (B20)
* feat: convert secret-sources into a plugin (B20)
* feat: move totp and passkeys into plugins (C1)
* feat: move sso and ldap logins into plugins (C2)
* feat: move opkssh and warpgate into plugins (C3)
* feat: move step-ca into a plugin (C4)
* feat: move vault ssh signing into a plugin (C5)
* feat: move termix identity into a plugin (C6)
* feat: move acme certificate automation into a plugin (C7)
* fix: finish 2.9.0 plugin moves and get every check green
* chore: lock the plugin boundary and remove 2.9.0 leftovers
* fix: harden the plugin runtime after the 2.9.0 security review
* feat: add plugin packing, signing, pinned trust and tmxplug bundling
* test: prove 2.8 to 2.9.0 upgrade is lossless and fix what it caught
* fix: give bundled plugin backends a real require for CJS deps
* feat: improve UI loading time and jitter
* feat: show credential sharing inline in the sidebar like host sharing
* feat: tailscale add host and copy ip, fix outbound fetch hang and plugin ESM warning
* feat: unify alerts into one plugin, channels, rules and inbox
* feat: rebuild desktop sync as linked server accounts, fix packaged plugin bundles and UI scaling
* fix: set blacksmith builder cache-key to stop broken gha cache fallback
* fix: link plugin-sdk workspace before npm ci in docker deps stage
* fix: link every plugin workspace before npm ci in docker deps stage
* fix(host-metrics): exclude image and firmware filesystems (#1469)
* fix(host-metrics): exclude image and firmware filesystems
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* fix(hosts): normalize imported jump host references (#1470)
* fix(hosts): normalize imported jump host references
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* fix(ci): build plugin SDK and repair MySQL settings migration (#1471)
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* fix(file-manager): keep inline rename consistent (#1476)
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* fix(file-manager): keep inline rename consistent
* fix(dashboard): reuse translated host status labels (#1475)
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* fix(dashboard): reuse translated host status labels
* docs(api): clarify local and remote version fields (#1474)
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* docs(api): clarify local and remote version fields
* fix(file-manager): preserve selected backgrounds on hover (#1473)
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* fix(file-manager): preserve selection feedback on hover
* test(ui): await dialog focus cleanup before teardown
* fix(file-manager): restore Ctrl/Cmd+F file search (#1472)
* fix(ci): build plugin SDK before dependent checks
* fix(mysql): keep plugin settings scope indexes within limits
* test(mysql): refresh reviewed plugin upgrade SQL
* fix(file-manager): focus file search with Ctrl or Cmd F
* fix: keep rounded-full circular in production builds
* fix(file-manager): cancel uploads and stop remote writes (#1477)
* fix(file-manager): cancel uploads and stop remote writes
* test(css): exercise the configured PostCSS plugin chain
* fix(file-manager): apply compact density to directory tree (#1478)
* fix(file-manager): apply compact density to directory tree
* test(css): exercise the configured PostCSS plugin chain
* fix(file-manager): preserve font sizes in compact mode (#1480)
* fix(file-manager): preserve font sizes in compact mode
* test(css): exercise the configured PostCSS plugin chain
* fix(file-manager): prioritize file names in narrow lists (#1483)
* fix(file-manager): prioritize file names in narrow lists
* test(css): exercise the configured PostCSS plugin chain
* test(identity): preserve full Ed25519 public keys in fixtures
* test(remote-desktop): always mutate ciphertext in tamper test
* fix(remote-desktop): probe the saved host guacd endpoint (#1481)
* fix(remote-desktop): probe the saved host guacd endpoint
* test(css): exercise the configured PostCSS plugin chain
* test(identity): preserve full Ed25519 public keys in fixtures
* fix(homepage): check allowlisted private service reachability (#1479)
* fix(homepage): check allowlisted private service reachability
* test(css): exercise the configured PostCSS plugin chain
* fix(remote-desktop): stop unsolicited clipboard read prompts (#1482)
* fix(remote-desktop): read clipboard only on explicit paste
* test(css): exercise the configured PostCSS plugin chain
* test(identity): preserve full Ed25519 public keys in fixtures
* test(remote-desktop): always mutate ciphertext in tamper test
* chore: simplify plugin readmes, changelogs and manifest descriptions
* fix: keep plugins loaded after signing in from the login screen
* fix(file-manager): accept OS file drops over existing rows (#1484)
* fix(file-manager): accept OS file drops over existing rows
* test(file-manager): target the file label in drop tests
* test(css): exercise the configured PostCSS plugin chain
* test(identity): preserve full Ed25519 public keys in fixtures
* test(remote-desktop): always mutate ciphertext in tamper test
* fix(file-manager): pipeline SFTP download reads (#1485)
* feat: add plugin sdk build to beta release
* fix: make link-store secret check immune to random base64 matches
* fix(ldap): preserve the directory-provided bind DN (#1486)
* fix: compute beta changes across dev branches and move the beta tag
* chore: untrack plugin sdk ARCHITECTURE.md
* chore: remove references to plugin sdk ARCHITECTURE.md
* feat: merge host editor terminal tabs into one owned by ssh-terminal
* feat: add descriptions to plugin host enable toggles
* fix(file-manager): show download progress in file viewers (#1487)
* fix(electron): signal backend readiness over IPC (#1488)
* fix(split-screen): allow layout creation without randomUUID (#1490)
* fix(split-screen): allow layout creation without randomUUID
* test(credentials): avoid flaky Ed25519 key generation
* fix(sidebar): remeasure visible rows after density changes (#1489)
* fix(sidebar): remeasure visible rows after density changes
* test(credentials): avoid flaky Ed25519 key generation
* feat(split-screen): redesign split screen with free-form panes and pane picker
* feat(sidebar): add host click behavior setting, default to always opening a new tab
* feat(snippets): redesign panel to match the host list
* fix(session-recording): stop session logs panel from refetching in a loop
* feat(snippets): bring back sharing, target hosts and drag reorder
* feat(ssh-terminal): add toolbar position, start state, display and fade host settings
* feat(ssh-terminal): add host setting to turn off password prompt auto-fill
* fix(ai): stop streams getting cut off and keep tool steps across messages
* feat: improve quick connect system using plugin api
* fix: proxmox guest sync, startup snippet sync, drop dead cloudflare ssh transport
* feat: move terminal settings, look and ssh tools into ssh-terminal plugin
* feat: move snippets, keybinding actions and macros out of core into plugins
* feat: store rdp, vnc and telnet logins in a generic per-protocol table
* feat: type the plugin host record, move plugin strings out of core and add lint checks
* feat: replace core homepage widget registry with generic extension points
* feat: plugins only see their own host settings in the browser
* feat: harden plugin api for separate repos, signed updates and generic external login
* fix: keep plugin css below core utilities and version plugin assets by their css
* fix: load and save plugin host settings in the editor and tighten settings row spacing
* feat: redesign user host defaults system
* fix(remote-desktop): release held keys on focus loss (#1498)
* fix(session-sharing): replace local presentation after takeover (#1500)
* fix(file-manager): refresh disk usage with directory listing (#1503)
* fix(ssh-terminal): preserve input order during local echo reconciliation (#1505)
* feat(remote-desktop): expose display zoom controls for RDP (#1514)
* fix(file-manager): restore text selection and copying in Markdown previews (#1518)
* fix(sidebar): keep compact host addresses visible (#1524)
* fix(hosts): preserve plugin settings when reopening the editor (#1499)
* fix(ssh-terminal): close owner sockets when presentations unmount (#1501)
* fix(session-sharing): synchronize shared SSH terminal dimensions (#1502)
* fix(session-sharing): show participant presence in member terminals (#1504)
* fix(ai): sync provider configuration and keys across linked devices (#1506)
* feat(ssh-terminal): add a duplicate tab action (#1510)
* feat(file-manager): allow disabling move-to-trash confirmation (#1511)
* feat(file-manager): default to the remote login directory (#1512)
* feat(homepage): synchronize canvas layouts across devices (#1515)
* fix(shortcuts): prevent accidental double-Shift palette activation (#1519)
* feat(tmux-monitor): add a unified multi-host view (#1520)
* fix(electron): allow explicit quit with active connections (#1522)
* feat: reconnect all disconnected terminal tabs (#1523)
* fix(hosts): preserve recording and sharing settings in the dev editor (#1509)
* fix(database): preserve RDP domain during startup backfill (#1497)
* feat(sidebar): add keyboard type-ahead search for hosts (#1516)
* feat(automations): add per-host maintenance mode and recurring schedules (#1521)
* feat(tmux): add a per-host mouse toggle and preserve remote configuration (#1513)
* fix(session-sharing): use the linked server for desktop meetings and links (#1507)
* fix(tunnels): support TOTP for client tunnels and jump hosts (#1508)
* fix: type errors and lint failures from merged plugin prs
* feat(installer): make the Windows desktop shortcut optional (#1517)
* fix: ship the plugin sdk and serialport in desktop builds
* fix: prefer ipv4 when resolving ssh host names (#1365)
* fix: readable terminal selection with the light theme (#1319)
* fix: build desktop session share links on the linked server (#1350)
* fix: show meeting guests to members and hide the roster from guests (#1353)
* fix: reliable file manager saves with sudo prompt and no base64 guessing (#1335)
* fix: show disk usage for the mount being browsed (#1347)
* fix: load the linux tray icon reliably and log tray failures (#1332)
* fix: cover the gnome close path in the desktop quit test (#1332)
* fix: prompt for jump host TOTP in terminal, file manager and metrics (#1312)
* feat: optional auto reconnect for dropped ssh sessions (#1321)
* feat: tighter compact host rows with inline tags (#1325)
* feat: bring back the alert feed homepage widget
* feat: pick target terminals for snippets again
* feat: share button on connection tabs again
* feat: recent servers list when linking the desktop app
* feat: list the fixed app shortcuts in keyboard shortcuts
* fix: translate hardcoded toasts and drop em dashes from ui text
* fix: translate leftover hardcoded ui text
* fix: toolbar files button opens at the shell directory again
* fix: show the remote desktop note under connection origin again
* chore: openapi docs for host metrics manager routes
* chore: openapi docs for undocumented routes and fix two broken doc blocks
* fix: declare terminal.listSessions use for snippet targets
* revert: drop the alert feed widget, the notification center replaces it
* feat: restore the alert feed homepage widget
* fix: quick connect fills the host address from plugin auth editors like tailscale
* fix: docker container logs use the base background color
* chore: fix dependabot alerts and apply safe npm upgrades
* fix: proxmox stats tab reads its switch from plugin host settings
* fix: count plugin ssh logins toward host status and stop showing reachable as a warning
* fix: hide the built-in source pill in the host editor
* fix: host status shows online when the port answers and only warns on a failed login
* fix: drop the top border on the split layout menu
* fix: host defaults tabs sit where the host editor puts them and skip plugins with nothing to default
* fix: remote desktop auth method labels and notes for vnc and telnet
* fix: add description to the web endpoint enable switch
* fix: crowdin sync and pretranslate for plugin locales, run plugin tests on release
* feat: move telemetry out of core into a usage statistics plugin
* fix: recent activity card no longer cuts off host names early
* fix: remove duplicate top border on split screen menu
* fix: redesign session log player controls, fix tooltip overlap and drop dot separators
* fix: file manager and sftp text showing raw i18n keys
* fix: onboarding rerunning for existing users after upgrading
* fix: fleet detail buttons overflowing the sidebar
* fix: session log player scrolling off screen horizontally
* fix: network graph lag when adding hosts and on every render
* fix: maintenance index name, shared host read only view and badge polling
* fix: meeting tabs, workspace tab merging, rail panels as tabs and general ui lag
* chore: update release notes
* fix: remote desktop tabs reconnecting on every tab switch
* fix: build plugin sdk before linting in release workflow
* chore: lint, format, and bump version to 2.9.0
* chore: skip crowdin pre-translate in release for now
* chore: sync Crowdin translations for 2.9.0
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Koi <38512047+datlt4@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>
This commit is contained in:
4405 files changed
+1341026
-289722
No files matched your search
@@ -0,0 +1,145 @@
|
||||
import crypto from "crypto";
|
||||
|
||||
// Minimal OpenSSH ed25519 user-certificate signer + per-user CA generation.
|
||||
// Implemented in pure Node so we never shell out or move private keys to disk.
|
||||
// Format reference: PROTOCOL.certkeys (ssh-ed25519-cert-v01@openssh.com).
|
||||
|
||||
const ED25519 = "ssh-ed25519";
|
||||
const CERT_TYPE = "ssh-ed25519-cert-v01@openssh.com";
|
||||
const SSH2_CERT_TYPE_USER = 1;
|
||||
|
||||
// Standard login extensions OpenSSH grants by default; must be name-sorted.
|
||||
const DEFAULT_EXTENSIONS = [
|
||||
"permit-X11-forwarding",
|
||||
"permit-agent-forwarding",
|
||||
"permit-port-forwarding",
|
||||
"permit-pty",
|
||||
"permit-user-rc",
|
||||
];
|
||||
|
||||
// --- SSH wire-format primitives -------------------------------------------
|
||||
|
||||
function sshString(value: Buffer | string): Buffer {
|
||||
const buf = typeof value === "string" ? Buffer.from(value, "utf8") : value;
|
||||
const len = Buffer.alloc(4);
|
||||
len.writeUInt32BE(buf.length, 0);
|
||||
return Buffer.concat([len, buf]);
|
||||
}
|
||||
|
||||
function sshUint32(n: number): Buffer {
|
||||
const b = Buffer.alloc(4);
|
||||
b.writeUInt32BE(n >>> 0, 0);
|
||||
return b;
|
||||
}
|
||||
|
||||
function sshUint64(n: bigint): Buffer {
|
||||
const b = Buffer.alloc(8);
|
||||
b.writeBigUInt64BE(n, 0);
|
||||
return b;
|
||||
}
|
||||
|
||||
function ed25519PublicBlob(raw32: Buffer): Buffer {
|
||||
return Buffer.concat([sshString(ED25519), sshString(raw32)]);
|
||||
}
|
||||
|
||||
/** Extract the 32-byte raw ed25519 key from an `ssh-ed25519 <base64>` line. */
|
||||
export function ed25519RawFromLine(line: string): Buffer | null {
|
||||
const parts = line.trim().split(/\s+/);
|
||||
if (parts[0] !== ED25519 || !parts[1]) return null;
|
||||
let blob: Buffer;
|
||||
try {
|
||||
blob = Buffer.from(parts[1], "base64");
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
try {
|
||||
let off = 0;
|
||||
const typeLen = blob.readUInt32BE(off);
|
||||
off += 4;
|
||||
if (blob.toString("utf8", off, off + typeLen) !== ED25519) return null;
|
||||
off += typeLen;
|
||||
const keyLen = blob.readUInt32BE(off);
|
||||
off += 4;
|
||||
const pk = blob.subarray(off, off + keyLen);
|
||||
return pk.length === 32 ? pk : null;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
// --- CA generation ---------------------------------------------------------
|
||||
|
||||
export interface GeneratedCa {
|
||||
publicKeyLine: string; // "ssh-ed25519 <base64>"
|
||||
privateKeyPem: string; // PKCS#8 PEM (to be stored encrypted)
|
||||
}
|
||||
|
||||
export function generateCa(): GeneratedCa {
|
||||
const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
|
||||
const jwk = publicKey.export({ format: "jwk" }) as { x: string };
|
||||
const raw = Buffer.from(jwk.x, "base64url");
|
||||
const publicKeyLine = `${ED25519} ${ed25519PublicBlob(raw).toString("base64")}`;
|
||||
const privateKeyPem = privateKey
|
||||
.export({ format: "pem", type: "pkcs8" })
|
||||
.toString();
|
||||
return { publicKeyLine, privateKeyPem };
|
||||
}
|
||||
|
||||
// --- Certificate signing ---------------------------------------------------
|
||||
|
||||
export interface SignCertOptions {
|
||||
userPublicKeyLine: string; // ed25519 public key to certify
|
||||
caPrivateKeyPem: string;
|
||||
caPublicKeyLine: string;
|
||||
keyId: string;
|
||||
principals: string[]; // empty = valid for all usernames
|
||||
validAfter: number; // unix seconds
|
||||
validBefore: number; // unix seconds
|
||||
serial?: bigint;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sign an ed25519 user public key into an OpenSSH user certificate.
|
||||
* Returns the certificate line, or null if the inputs aren't ed25519.
|
||||
*/
|
||||
export function signUserCertificate(opts: SignCertOptions): string | null {
|
||||
const pk = ed25519RawFromLine(opts.userPublicKeyLine);
|
||||
const caRaw = ed25519RawFromLine(opts.caPublicKeyLine);
|
||||
if (!pk || !caRaw) return null;
|
||||
|
||||
const signatureKey = ed25519PublicBlob(caRaw);
|
||||
const principals = Buffer.concat(opts.principals.map((p) => sshString(p)));
|
||||
const extensions = Buffer.concat(
|
||||
[...DEFAULT_EXTENSIONS]
|
||||
.sort()
|
||||
.map((name) => Buffer.concat([sshString(name), sshString("")])),
|
||||
);
|
||||
|
||||
// Everything up to (not including) the signature: this is what gets signed.
|
||||
const body = Buffer.concat([
|
||||
sshString(CERT_TYPE),
|
||||
sshString(crypto.randomBytes(32)), // nonce
|
||||
sshString(pk),
|
||||
sshUint64(opts.serial ?? 0n),
|
||||
sshUint32(SSH2_CERT_TYPE_USER),
|
||||
sshString(opts.keyId),
|
||||
sshString(principals),
|
||||
sshUint64(BigInt(opts.validAfter)),
|
||||
sshUint64(BigInt(opts.validBefore)),
|
||||
sshString(Buffer.alloc(0)), // critical options (none)
|
||||
sshString(extensions),
|
||||
sshString(Buffer.alloc(0)), // reserved
|
||||
sshString(signatureKey),
|
||||
]);
|
||||
|
||||
const caKey = crypto.createPrivateKey({
|
||||
key: opts.caPrivateKeyPem,
|
||||
format: "pem",
|
||||
type: "pkcs8",
|
||||
});
|
||||
const rawSig = crypto.sign(null, body, caKey); // ed25519 -> 64 bytes
|
||||
const signature = Buffer.concat([sshString(ED25519), sshString(rawSig)]);
|
||||
|
||||
const cert = Buffer.concat([body, sshString(signature)]);
|
||||
return `${CERT_TYPE} ${cert.toString("base64")} ${opts.keyId}`;
|
||||
}
|
||||
@@ -0,0 +1,69 @@
|
||||
/** A GitHub-like public namespace: lowercase, starts alphanumeric, 1-39 chars. */
|
||||
export const HANDLE_REGEX = /^[a-z0-9][a-z0-9_-]{0,38}$/;
|
||||
|
||||
const RESERVED_HANDLES = new Set(["u", "me", "keys", "check", "admin", "api"]);
|
||||
|
||||
const MAX_DESCRIPTION_LENGTH = 500;
|
||||
|
||||
export function isValidHandle(handle: string): boolean {
|
||||
return HANDLE_REGEX.test(handle) && !RESERVED_HANDLES.has(handle);
|
||||
}
|
||||
|
||||
export function cleanDescription(value: unknown): string | null {
|
||||
if (typeof value !== "string") return null;
|
||||
return value.trim().slice(0, MAX_DESCRIPTION_LENGTH) || null;
|
||||
}
|
||||
|
||||
export function cleanLabel(value: unknown): string | null {
|
||||
return typeof value === "string" ? value.trim() || null : null;
|
||||
}
|
||||
|
||||
/** Validity in days: a positive whole number, at most ten years. */
|
||||
export function clampValidityDays(value: unknown, fallback: number): number {
|
||||
const days = Number(value);
|
||||
if (!Number.isFinite(days) || days <= 0) return fallback;
|
||||
return Math.min(Math.floor(days), 3650);
|
||||
}
|
||||
|
||||
interface DbError {
|
||||
code?: string;
|
||||
errno?: number;
|
||||
message?: string;
|
||||
cause?: unknown;
|
||||
}
|
||||
|
||||
function errorChain(error: unknown): DbError[] {
|
||||
const chain: DbError[] = [];
|
||||
let current = error as DbError | undefined;
|
||||
while (current && typeof current === "object" && chain.length < 5) {
|
||||
chain.push(current);
|
||||
current = current.cause as DbError | undefined;
|
||||
}
|
||||
return chain;
|
||||
}
|
||||
|
||||
/** A UNIQUE violation on sqlite, Postgres or MySQL. */
|
||||
export function isUniqueViolation(error: unknown): boolean {
|
||||
return errorChain(error).some(
|
||||
(entry) =>
|
||||
entry.code === "SQLITE_CONSTRAINT_UNIQUE" ||
|
||||
entry.code === "23505" ||
|
||||
entry.code === "ER_DUP_ENTRY" ||
|
||||
entry.errno === 1062 ||
|
||||
(typeof entry.message === "string" &&
|
||||
entry.message.includes("UNIQUE constraint failed")),
|
||||
);
|
||||
}
|
||||
|
||||
/** Whether a UNIQUE violation was on user_id (one handle per user) rather than the handle. */
|
||||
export function isUserIdViolation(error: unknown): boolean {
|
||||
return errorChain(error).some(
|
||||
(entry) =>
|
||||
typeof entry.message === "string" &&
|
||||
(entry.message.includes("user_id") || entry.message.includes("userId")),
|
||||
);
|
||||
}
|
||||
|
||||
export function asError(error: unknown): Error {
|
||||
return error instanceof Error ? error : new Error(String(error));
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
import type { Router } from "express";
|
||||
import type { PluginContext } from "@termix/plugin-sdk/backend";
|
||||
import { ca, identities, keys } from "./tables.js";
|
||||
import { createStore } from "./store.js";
|
||||
import { PUBLIC_PATHS } from "./resolver.js";
|
||||
import { registerRoutes } from "./routes.js";
|
||||
|
||||
export async function activate(ctx: PluginContext) {
|
||||
const store = createStore(ctx, {
|
||||
identities: await ctx.db.define(identities),
|
||||
keys: await ctx.db.define(keys),
|
||||
ca: await ctx.db.define(ca),
|
||||
});
|
||||
|
||||
registerRoutes(ctx, ctx.http.router<Router>({ public: PUBLIC_PATHS }), store);
|
||||
}
|
||||
|
||||
export async function deactivate() {
|
||||
// Everything above was registered through ctx and is disposed by core.
|
||||
}
|
||||
@@ -0,0 +1,89 @@
|
||||
// Pure, dependency-free helpers for SSH public-key parsing/classification used
|
||||
// by the Termix Identity plugin.
|
||||
|
||||
// Upper bound on an accepted public-key line. Public keys are tiny (an RSA-4096
|
||||
// line is ~720 chars); this caps the value the unauthenticated resolver later
|
||||
// streams, preventing a multi-MB blob being stored and amplified.
|
||||
export const MAX_PUBLIC_KEY_LENGTH = 8192;
|
||||
|
||||
// Normalized algorithm groups, used both for storage and for the `/<ALGO>`
|
||||
// resolver filter (mirrors sshid.io's RSA/ED25519/ECDSA suffixes).
|
||||
export const ALGO_GROUPS: Record<string, string> = {
|
||||
"ssh-rsa": "RSA",
|
||||
"rsa-sha2-256": "RSA",
|
||||
"rsa-sha2-512": "RSA",
|
||||
"ssh-dss": "DSA",
|
||||
"ssh-ed25519": "ED25519",
|
||||
"sk-ssh-ed25519@openssh.com": "ED25519-SK",
|
||||
"ecdsa-sha2-nistp256": "ECDSA",
|
||||
"ecdsa-sha2-nistp384": "ECDSA",
|
||||
"ecdsa-sha2-nistp521": "ECDSA",
|
||||
"sk-ecdsa-sha2-nistp256@openssh.com": "ECDSA-SK",
|
||||
};
|
||||
|
||||
export function classifyAlgo(type: string): string {
|
||||
if (ALGO_GROUPS[type]) return ALGO_GROUPS[type];
|
||||
if (type.startsWith("ecdsa-")) return "ECDSA";
|
||||
if (type.includes("ed25519")) return "ED25519";
|
||||
if (type.includes("rsa")) return "RSA";
|
||||
if (type.includes("dss") || type.includes("dsa")) return "DSA";
|
||||
return type.toUpperCase();
|
||||
}
|
||||
|
||||
export interface ParsedPublicKey {
|
||||
type: string;
|
||||
algorithm: string;
|
||||
comment: string;
|
||||
normalized: string; // "<type> <base64blob>"
|
||||
}
|
||||
|
||||
/**
|
||||
* Parse and validate a single OpenSSH public key line. Returns null when the
|
||||
* input is not a well-formed public key.
|
||||
*/
|
||||
export function parsePublicKey(
|
||||
raw: string | null | undefined,
|
||||
): ParsedPublicKey | null {
|
||||
if (typeof raw !== "string") return null;
|
||||
if (raw.length > MAX_PUBLIC_KEY_LENGTH) return null;
|
||||
const line = raw.trim().replace(/\s+/g, " ");
|
||||
if (!line) return null;
|
||||
|
||||
const parts = line.split(" ");
|
||||
if (parts.length < 2) return null;
|
||||
|
||||
const [type, blob, ...rest] = parts;
|
||||
if (!/^[A-Za-z0-9@.-]+$/.test(type)) return null;
|
||||
if (!/^[A-Za-z0-9+/]+={0,2}$/.test(blob)) return null;
|
||||
|
||||
const decoded = Buffer.from(blob, "base64");
|
||||
// The blob is an SSH wire-format string whose first field repeats the type.
|
||||
if (decoded.length < 8) return null;
|
||||
try {
|
||||
const len = decoded.readUInt32BE(0);
|
||||
if (len <= 0 || len > 64 || 4 + len > decoded.length) return null;
|
||||
const embeddedType = decoded.toString("utf8", 4, 4 + len);
|
||||
if (embeddedType !== type) return null;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
|
||||
return {
|
||||
type,
|
||||
algorithm: classifyAlgo(type),
|
||||
comment: rest.join(" "),
|
||||
normalized: `${type} ${blob}`,
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether a key's normalized algorithm group matches a `/<ALGO>` resolver
|
||||
* filter. Exact match only: `ED25519` must NOT also return `ED25519-SK`.
|
||||
*/
|
||||
export function matchesAlgoFilter(
|
||||
algorithm: string,
|
||||
filter: string | null,
|
||||
): boolean {
|
||||
if (!filter) return true;
|
||||
return algorithm.toUpperCase() === filter.toUpperCase();
|
||||
}
|
||||
@@ -0,0 +1,173 @@
|
||||
import type { Request, Response } from "express";
|
||||
import type { PluginContext } from "@termix/plugin-sdk/backend";
|
||||
import { HANDLE_REGEX, asError } from "./handles.js";
|
||||
import { matchesAlgoFilter } from "./keys.js";
|
||||
import type { KeyRow, Store } from "./store.js";
|
||||
|
||||
/**
|
||||
* The resolver needs no login: servers fetch it from scripts. Paths are
|
||||
* relative to /plugin-api/termix-identity/.
|
||||
*/
|
||||
export const PUBLIC_PATHS = ["/u/:handle", "/u/:handle/:algo"];
|
||||
|
||||
/** The public resolver path for a handle, below the base URL. */
|
||||
export function resolverPath(handle: string): string {
|
||||
return `/plugin-api/termix-identity/u/${handle}`;
|
||||
}
|
||||
|
||||
// A disabled or removed key must not keep being served by a cache, and the
|
||||
// feed stays out of search indexes. Set on every response, 404s included.
|
||||
function setResolverHeaders(res: Response) {
|
||||
res.setHeader("Cache-Control", "no-store, max-age=0");
|
||||
res.setHeader("X-Robots-Tag", "noindex, nofollow");
|
||||
}
|
||||
|
||||
function notFound(res: Response, body = "Not found\n") {
|
||||
return res.status(404).type("text/plain").send(body);
|
||||
}
|
||||
|
||||
export function escapeHtml(value: string): string {
|
||||
return value
|
||||
.replace(/&/g, "&")
|
||||
.replace(/</g, "<")
|
||||
.replace(/>/g, ">")
|
||||
.replace(/"/g, """)
|
||||
.replace(/'/g, "'");
|
||||
}
|
||||
|
||||
export function renderHtml(
|
||||
handle: string,
|
||||
keys: Array<Pick<KeyRow, "algorithm" | "publicKey">>,
|
||||
resolverUrl: string,
|
||||
): string {
|
||||
const keyRows = keys.length
|
||||
? keys
|
||||
.map(
|
||||
(key) =>
|
||||
`<div class="key"><span class="algo">${escapeHtml(
|
||||
key.algorithm,
|
||||
)}</span><code>${escapeHtml(key.publicKey)}</code></div>`,
|
||||
)
|
||||
.join("")
|
||||
: `<p class="empty">No public keys published yet.</p>`;
|
||||
|
||||
// A standalone page, not the React app, so the dark theme is inlined.
|
||||
return `<!doctype html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
||||
<meta name="robots" content="noindex, nofollow" />
|
||||
<meta name="color-scheme" content="dark" />
|
||||
<title>Termix ID @${escapeHtml(handle)}</title>
|
||||
<style>
|
||||
:root {
|
||||
--bg: #0c0d0b; --panel: #141614; --panel-2: #181a17; --border: rgba(255,255,255,.12);
|
||||
--fg: #f8f8f6; --muted: #8f9189; --accent: #f59145;
|
||||
}
|
||||
* { box-sizing: border-box; }
|
||||
body { margin: 0; background: var(--bg); color: var(--fg); line-height: 1.5;
|
||||
font-family: ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, sans-serif; }
|
||||
.wrap { max-width: 820px; margin: 0 auto; padding: 32px 16px 48px; }
|
||||
.card { background: var(--panel); border: 1px solid var(--border); }
|
||||
header.card { padding: 16px 18px; display: flex; align-items: center; gap: 10px; }
|
||||
h1 { font-size: 1.05rem; font-weight: 700; margin: 0; letter-spacing: .02em; color: var(--fg); }
|
||||
h1 .handle { color: var(--accent); }
|
||||
.label { font-size: 10px; font-weight: 700; letter-spacing: .18em; text-transform: uppercase;
|
||||
color: var(--muted); margin: 22px 0 8px; }
|
||||
pre.cmd { margin: 0; background: var(--panel-2); border: 1px solid var(--border); color: var(--muted);
|
||||
padding: 12px 14px; overflow-x: auto; font-size: 12px;
|
||||
font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
|
||||
.keys { display: flex; flex-direction: column; gap: 8px; }
|
||||
.key { background: var(--panel); border: 1px solid var(--border); padding: 10px 12px;
|
||||
display: flex; align-items: center; gap: 10px; overflow-x: auto; }
|
||||
.algo { flex: 0 0 auto; font-size: 10px; font-weight: 700; letter-spacing: .06em; text-transform: uppercase;
|
||||
color: var(--accent); border: 1px solid rgba(245,145,69,.4); padding: 1px 5px; line-height: 1.4; }
|
||||
code { white-space: pre; word-break: break-all; font-size: 12px; color: var(--muted);
|
||||
font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
|
||||
.empty { color: var(--muted); font-size: 13px; }
|
||||
footer { margin-top: 28px; color: var(--muted); font-size: 11px; letter-spacing: .04em; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div class="wrap">
|
||||
<header class="card">
|
||||
<h1>Termix ID <span class="handle">@${escapeHtml(handle)}</span></h1>
|
||||
</header>
|
||||
|
||||
<div class="label">Provision a server</div>
|
||||
<pre class="cmd">curl -fsSL ${escapeHtml(resolverUrl)} >> ~/.ssh/authorized_keys</pre>
|
||||
|
||||
<div class="label">Published keys</div>
|
||||
<div class="keys">${keyRows}</div>
|
||||
|
||||
<footer>Served by Termix</footer>
|
||||
</div>
|
||||
</body>
|
||||
</html>`;
|
||||
}
|
||||
|
||||
export function createResolver(ctx: PluginContext, store: Store) {
|
||||
const handleOf = (req: Request) =>
|
||||
String(req.params.handle || "").toLowerCase();
|
||||
|
||||
/** authorized_keys as text, or a small viewer for browsers. */
|
||||
async function keys(req: Request, res: Response) {
|
||||
setResolverHeaders(res);
|
||||
const handle = handleOf(req);
|
||||
if (!HANDLE_REGEX.test(handle)) return notFound(res);
|
||||
const algoFilter = req.params.algo
|
||||
? String(req.params.algo).toUpperCase()
|
||||
: null;
|
||||
|
||||
try {
|
||||
const identity = await store.identityByHandle(handle);
|
||||
if (!identity) return notFound(res);
|
||||
|
||||
const published = (await store.enabledKeys(identity.id)).filter((key) =>
|
||||
matchesAlgoFilter(key.algorithm, algoFilter),
|
||||
);
|
||||
|
||||
if ((req.headers.accept || "").includes("text/html")) {
|
||||
res.setHeader("Content-Type", "text/html; charset=utf-8");
|
||||
return res.send(
|
||||
renderHtml(
|
||||
handle,
|
||||
published,
|
||||
`${ctx.http.baseUrl(req)}${resolverPath(handle)}`,
|
||||
),
|
||||
);
|
||||
}
|
||||
|
||||
const body = published
|
||||
.map((key) => `${key.publicKey} #termix-id @${handle}`)
|
||||
.join("\n");
|
||||
res.setHeader("Content-Type", "text/plain; charset=utf-8");
|
||||
return res.send(body ? `${body}\n` : "");
|
||||
} catch (error) {
|
||||
ctx.log.error("Termix ID resolve failed", asError(error));
|
||||
return res.status(500).type("text/plain").send("Internal Server Error\n");
|
||||
}
|
||||
}
|
||||
|
||||
/** The CA public key, for TrustedUserCAKeys or an @cert-authority line. */
|
||||
async function caKey(req: Request, res: Response) {
|
||||
setResolverHeaders(res);
|
||||
const handle = handleOf(req);
|
||||
if (!HANDLE_REGEX.test(handle)) return notFound(res);
|
||||
|
||||
try {
|
||||
const identity = await store.identityByHandle(handle);
|
||||
if (!identity) return notFound(res);
|
||||
const ca = await store.caForIdentity(identity.id);
|
||||
if (!ca) return notFound(res, "No CA configured\n");
|
||||
res.setHeader("Content-Type", "text/plain; charset=utf-8");
|
||||
return res.send(`${ca.publicKey} termix-id-ca@${handle}\n`);
|
||||
} catch (error) {
|
||||
ctx.log.error("Termix ID CA resolve failed", asError(error));
|
||||
return res.status(500).type("text/plain").send("Internal Server Error\n");
|
||||
}
|
||||
}
|
||||
|
||||
return { keys, caKey };
|
||||
}
|
||||
@@ -0,0 +1,987 @@
|
||||
import type { Request, Response, Router } from "express";
|
||||
// ssh2 is CommonJS and its `utils` named export is not visible to ESM, so it
|
||||
// is read off the default import.
|
||||
import ssh2 from "ssh2";
|
||||
import type { PluginContext } from "@termix/plugin-sdk/backend";
|
||||
import { parsePublicKey } from "./keys.js";
|
||||
import {
|
||||
ed25519RawFromLine,
|
||||
generateCa,
|
||||
signUserCertificate,
|
||||
} from "./certificate.js";
|
||||
import {
|
||||
asError,
|
||||
clampValidityDays,
|
||||
cleanDescription,
|
||||
cleanLabel,
|
||||
isUniqueViolation,
|
||||
isUserIdViolation,
|
||||
isValidHandle,
|
||||
} from "./handles.js";
|
||||
import { createResolver, resolverPath } from "./resolver.js";
|
||||
import type { IdentityRow, Store } from "./store.js";
|
||||
|
||||
const ALREADY_HAVE_ONE =
|
||||
"You already have a Termix ID. Use update to rename it.";
|
||||
|
||||
function parseId(value: unknown): number | null {
|
||||
const id = Number.parseInt(String(value), 10);
|
||||
return Number.isInteger(id) && id > 0 ? id : null;
|
||||
}
|
||||
|
||||
export function registerRoutes(
|
||||
ctx: PluginContext,
|
||||
router: Router,
|
||||
store: Store,
|
||||
): void {
|
||||
const resolver = createResolver(ctx, store);
|
||||
|
||||
const userId = () => {
|
||||
const actor = ctx.currentActor();
|
||||
if (!actor) throw new Error("No acting user");
|
||||
return actor;
|
||||
};
|
||||
|
||||
const withUrls = (req: Request, handle: string, suffix = "") => {
|
||||
const path = `${resolverPath(handle)}${suffix}`;
|
||||
return {
|
||||
resolverPath: path,
|
||||
resolverUrl: `${ctx.http.baseUrl(req)}${path}`,
|
||||
};
|
||||
};
|
||||
|
||||
const fail = (res: Response, message: string, error: unknown) => {
|
||||
ctx.log.error(message, asError(error));
|
||||
res.status(500).json({ error: message });
|
||||
};
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/u/{handle}/ca:
|
||||
* get:
|
||||
* summary: Public CA key for a handle
|
||||
* description: Public. The certificate authority's public key, for TrustedUserCAKeys or an @cert-authority line. The 2.8 URL /termix-id/u/{handle}/ca redirects here.
|
||||
* tags: [Termix ID]
|
||||
* parameters:
|
||||
* - in: path
|
||||
* name: handle
|
||||
* required: true
|
||||
* schema:
|
||||
* type: string
|
||||
* responses:
|
||||
* 200:
|
||||
* description: The CA public key as text.
|
||||
* 404:
|
||||
* description: No such handle, or it has no CA.
|
||||
*/
|
||||
router.get("/u/:handle/ca", resolver.caKey);
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/u/{handle}:
|
||||
* get:
|
||||
* summary: Published keys for a handle
|
||||
* description: Public. authorized_keys lines for every enabled key, or an HTML viewer when the client accepts text/html. Never cached. The 2.8 URL /termix-id/u/{handle} redirects here.
|
||||
* tags: [Termix ID]
|
||||
* parameters:
|
||||
* - in: path
|
||||
* name: handle
|
||||
* required: true
|
||||
* schema:
|
||||
* type: string
|
||||
* responses:
|
||||
* 200:
|
||||
* description: The keys as text or HTML.
|
||||
* 404:
|
||||
* description: No such handle.
|
||||
*/
|
||||
router.get("/u/:handle", resolver.keys);
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/u/{handle}/{algo}:
|
||||
* get:
|
||||
* summary: Published keys of one algorithm for a handle
|
||||
* description: Public. Like /u/{handle}, keeping only keys whose algorithm group matches (RSA, ED25519, ECDSA and so on). The 2.8 URL /termix-id/u/{handle}/{algo} redirects here.
|
||||
* tags: [Termix ID]
|
||||
* parameters:
|
||||
* - in: path
|
||||
* name: handle
|
||||
* required: true
|
||||
* schema:
|
||||
* type: string
|
||||
* - in: path
|
||||
* name: algo
|
||||
* required: true
|
||||
* schema:
|
||||
* type: string
|
||||
* responses:
|
||||
* 200:
|
||||
* description: The matching keys as text or HTML.
|
||||
* 404:
|
||||
* description: No such handle.
|
||||
*/
|
||||
router.get("/u/:handle/:algo", resolver.keys);
|
||||
|
||||
// Everything below needs a signed-in user holding termix-identity.use.
|
||||
router.use(ctx.rbac.require("use") as never);
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/me:
|
||||
* get:
|
||||
* summary: Get the current user's Termix ID and keys
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* responses:
|
||||
* 200:
|
||||
* description: Identity and keys (identity may be null)
|
||||
*/
|
||||
router.get("/me", async (req, res) => {
|
||||
try {
|
||||
const identity = await store.identityForUser(userId());
|
||||
if (!identity) return res.json({ identity: null, keys: [] });
|
||||
res.json({
|
||||
identity: { ...identity, ...withUrls(req, identity.handle) },
|
||||
keys: await store.keysForIdentity(identity.id),
|
||||
});
|
||||
} catch (error) {
|
||||
fail(res, "Failed to fetch Termix ID", error);
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/check/{handle}:
|
||||
* get:
|
||||
* summary: Check if a handle is available
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* parameters:
|
||||
* - in: path
|
||||
* name: handle
|
||||
* required: true
|
||||
* schema:
|
||||
* type: string
|
||||
* responses:
|
||||
* 200:
|
||||
* description: Availability and validity status
|
||||
*/
|
||||
router.get("/check/:handle", async (req, res) => {
|
||||
const handle = String(req.params.handle || "").toLowerCase();
|
||||
if (!isValidHandle(handle)) {
|
||||
return res.json({ available: false, valid: false });
|
||||
}
|
||||
try {
|
||||
res.json({
|
||||
available: !(await store.isHandleTaken(handle)),
|
||||
valid: true,
|
||||
});
|
||||
} catch (error) {
|
||||
fail(res, "Failed to check handle", error);
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity:
|
||||
* post:
|
||||
* summary: Create a Termix ID
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* requestBody:
|
||||
* required: true
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* type: object
|
||||
* required: [handle]
|
||||
* properties:
|
||||
* handle:
|
||||
* type: string
|
||||
* description:
|
||||
* type: string
|
||||
* responses:
|
||||
* 201:
|
||||
* description: Created identity
|
||||
* 400:
|
||||
* description: Invalid handle
|
||||
* 409:
|
||||
* description: Handle taken or user already has an identity
|
||||
*/
|
||||
router.post("/", async (req, res) => {
|
||||
const handle = String(req.body?.handle || "").toLowerCase();
|
||||
if (!isValidHandle(handle)) {
|
||||
return res.status(400).json({ error: "Invalid handle" });
|
||||
}
|
||||
try {
|
||||
const owner = userId();
|
||||
if (await store.identityForUser(owner)) {
|
||||
return res.status(409).json({ error: ALREADY_HAVE_ONE });
|
||||
}
|
||||
if (await store.isHandleTaken(handle)) {
|
||||
return res.status(409).json({ error: "Handle already taken" });
|
||||
}
|
||||
const identity = await store.createIdentity({
|
||||
userId: owner,
|
||||
handle,
|
||||
description: cleanDescription(req.body?.description),
|
||||
});
|
||||
await ctx.audit.record({
|
||||
action: "create_termix_id",
|
||||
resourceType: "termix_id",
|
||||
resourceId: String(identity.id),
|
||||
resourceName: handle,
|
||||
success: true,
|
||||
});
|
||||
res.status(201).json(identity);
|
||||
} catch (error) {
|
||||
// The checks above race a double submit; the UNIQUE constraints on
|
||||
// handle and user_id are the real guard.
|
||||
if (isUniqueViolation(error)) {
|
||||
return res.status(409).json({
|
||||
error: isUserIdViolation(error)
|
||||
? ALREADY_HAVE_ONE
|
||||
: "Handle already taken",
|
||||
});
|
||||
}
|
||||
fail(res, "Failed to create Termix ID", error);
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity:
|
||||
* put:
|
||||
* summary: Update Termix ID handle or description
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* requestBody:
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* type: object
|
||||
* properties:
|
||||
* handle:
|
||||
* type: string
|
||||
* description:
|
||||
* type: string
|
||||
* responses:
|
||||
* 200:
|
||||
* description: Updated identity
|
||||
* 404:
|
||||
* description: No Termix ID
|
||||
* 409:
|
||||
* description: Handle taken
|
||||
*/
|
||||
router.put("/", async (req, res) => {
|
||||
try {
|
||||
const owner = userId();
|
||||
const identity = await store.identityForUser(owner);
|
||||
if (!identity)
|
||||
return res.status(404).json({ error: "No Termix ID found" });
|
||||
|
||||
const update: { handle?: string; description?: string | null } = {};
|
||||
if (req.body?.handle !== undefined) {
|
||||
const handle = String(req.body.handle || "").toLowerCase();
|
||||
if (!isValidHandle(handle)) {
|
||||
return res.status(400).json({ error: "Invalid handle" });
|
||||
}
|
||||
if (handle !== identity.handle && (await store.isHandleTaken(handle))) {
|
||||
return res.status(409).json({ error: "Handle already taken" });
|
||||
}
|
||||
update.handle = handle;
|
||||
}
|
||||
if (req.body?.description !== undefined) {
|
||||
update.description = cleanDescription(req.body.description);
|
||||
}
|
||||
|
||||
const updated = await store.updateIdentity(owner, update);
|
||||
await ctx.audit.record({
|
||||
action: "update_termix_id",
|
||||
resourceType: "termix_id",
|
||||
resourceId: String(identity.id),
|
||||
resourceName: updated?.handle ?? identity.handle,
|
||||
details:
|
||||
update.handle && update.handle !== identity.handle
|
||||
? `renamed ${identity.handle} -> ${update.handle}`
|
||||
: undefined,
|
||||
success: true,
|
||||
});
|
||||
res.json(updated);
|
||||
} catch (error) {
|
||||
if (isUniqueViolation(error)) {
|
||||
return res.status(409).json({ error: "Handle already taken" });
|
||||
}
|
||||
fail(res, "Failed to update Termix ID", error);
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity:
|
||||
* delete:
|
||||
* summary: Delete Termix ID with its keys and CA
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* responses:
|
||||
* 200:
|
||||
* description: Deleted
|
||||
* 404:
|
||||
* description: No Termix ID
|
||||
*/
|
||||
router.delete("/", async (_req, res) => {
|
||||
try {
|
||||
const identity = await store.identityForUser(userId());
|
||||
if (!identity)
|
||||
return res.status(404).json({ error: "No Termix ID found" });
|
||||
await store.deleteIdentity(identity);
|
||||
await ctx.audit.record({
|
||||
action: "delete_termix_id",
|
||||
resourceType: "termix_id",
|
||||
resourceId: String(identity.id),
|
||||
resourceName: identity.handle,
|
||||
success: true,
|
||||
});
|
||||
res.json({ success: true });
|
||||
} catch (error) {
|
||||
fail(res, "Failed to delete Termix ID", error);
|
||||
}
|
||||
});
|
||||
|
||||
const needIdentity = async (res: Response): Promise<IdentityRow | null> => {
|
||||
const identity = await store.identityForUser(userId());
|
||||
if (!identity) {
|
||||
res
|
||||
.status(400)
|
||||
.json({ error: "Create a Termix ID handle before adding keys" });
|
||||
}
|
||||
return identity;
|
||||
};
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/keys:
|
||||
* post:
|
||||
* summary: Publish a public key
|
||||
* description: Publishes a pasted key, or the public half of one of the user's saved SSH key credentials.
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* requestBody:
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* type: object
|
||||
* properties:
|
||||
* publicKey:
|
||||
* type: string
|
||||
* credentialId:
|
||||
* type: integer
|
||||
* label:
|
||||
* type: string
|
||||
* responses:
|
||||
* 201:
|
||||
* description: Published key
|
||||
* 400:
|
||||
* description: No identity, or the key is invalid
|
||||
* 404:
|
||||
* description: Credential not found
|
||||
* 409:
|
||||
* description: Already published
|
||||
*/
|
||||
router.post("/keys", async (req, res) => {
|
||||
const credentialId =
|
||||
req.body?.credentialId != null ? parseId(req.body.credentialId) : null;
|
||||
try {
|
||||
const identity = await needIdentity(res);
|
||||
if (!identity) return;
|
||||
|
||||
let rawPublicKey: string | null = null;
|
||||
let source = "manual";
|
||||
let label = cleanLabel(req.body?.label);
|
||||
|
||||
if (credentialId) {
|
||||
const credential = (await ctx.credentials.listSshKeys()).find(
|
||||
(key) => key.id === credentialId,
|
||||
);
|
||||
if (!credential) {
|
||||
return res.status(404).json({ error: "Credential not found" });
|
||||
}
|
||||
if (!credential.publicKey) {
|
||||
return res.status(400).json({
|
||||
error:
|
||||
"This credential has no public key and one could not be derived. Paste the public key manually.",
|
||||
});
|
||||
}
|
||||
source = "credential";
|
||||
label = label || credential.name || null;
|
||||
rawPublicKey = credential.publicKey;
|
||||
} else if (typeof req.body?.publicKey === "string") {
|
||||
rawPublicKey = req.body.publicKey;
|
||||
}
|
||||
|
||||
const parsed = parsePublicKey(rawPublicKey);
|
||||
if (!parsed) {
|
||||
return res.status(400).json({ error: "Invalid SSH public key" });
|
||||
}
|
||||
|
||||
const existing = await store.keysForIdentity(identity.id);
|
||||
if (existing.some((key) => key.publicKey === parsed.normalized)) {
|
||||
return res.status(409).json({ error: "This key is already published" });
|
||||
}
|
||||
|
||||
const key = await store.createKey({
|
||||
identityId: identity.id,
|
||||
userId: identity.userId,
|
||||
publicKey: parsed.normalized,
|
||||
keyType: parsed.type,
|
||||
algorithm: parsed.algorithm,
|
||||
label,
|
||||
comment: parsed.comment || null,
|
||||
source,
|
||||
credentialId: credentialId || null,
|
||||
});
|
||||
await ctx.audit.record({
|
||||
action: "add_termix_id_key",
|
||||
resourceType: "termix_id_key",
|
||||
resourceId: String(key.id),
|
||||
resourceName: identity.handle,
|
||||
details: `${parsed.algorithm} (${source})`,
|
||||
success: true,
|
||||
});
|
||||
res.status(201).json(key);
|
||||
} catch (error) {
|
||||
fail(res, "Failed to add key", error);
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/keys/generate:
|
||||
* post:
|
||||
* summary: Generate a new key pair and publish the public key
|
||||
* description: The private key is returned once. With saveCredential (the default) the pair is also saved as an SSH key credential.
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* requestBody:
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* type: object
|
||||
* properties:
|
||||
* type:
|
||||
* type: string
|
||||
* enum: [ed25519, rsa]
|
||||
* label:
|
||||
* type: string
|
||||
* saveCredential:
|
||||
* type: boolean
|
||||
* username:
|
||||
* type: string
|
||||
* responses:
|
||||
* 201:
|
||||
* description: Generated key info with the private key (shown once)
|
||||
*/
|
||||
router.post("/keys/generate", async (req, res) => {
|
||||
const keyType = req.body?.type === "rsa" ? "rsa" : "ed25519";
|
||||
const saveCredential = req.body?.saveCredential !== false;
|
||||
const username =
|
||||
typeof req.body?.username === "string" ? req.body.username.trim() : null;
|
||||
try {
|
||||
const identity = await needIdentity(res);
|
||||
if (!identity) return;
|
||||
|
||||
const comment = `termix-${identity.handle}`;
|
||||
const pair =
|
||||
keyType === "rsa"
|
||||
? ssh2.utils.generateKeyPairSync("rsa", { bits: 4096, comment })
|
||||
: ssh2.utils.generateKeyPairSync("ed25519", { comment });
|
||||
const parsed = parsePublicKey(pair.public);
|
||||
if (!parsed) {
|
||||
return res.status(500).json({ error: "Key generation failed" });
|
||||
}
|
||||
|
||||
// The published row only ever holds the public key; the pair goes to
|
||||
// the user's encrypted credentials. Publish first so a failed save can
|
||||
// be undone here, since the plugin cannot delete credentials.
|
||||
const key = await store.createKey({
|
||||
identityId: identity.id,
|
||||
userId: identity.userId,
|
||||
publicKey: parsed.normalized,
|
||||
keyType: parsed.type,
|
||||
algorithm: parsed.algorithm,
|
||||
label: cleanLabel(req.body?.label) || `Generated ${parsed.algorithm}`,
|
||||
comment: parsed.comment || null,
|
||||
source: "generated",
|
||||
credentialId: null,
|
||||
});
|
||||
|
||||
let credentialId: number | null = null;
|
||||
if (saveCredential) {
|
||||
try {
|
||||
({ id: credentialId } = await ctx.credentials.createSshKey({
|
||||
name: `Termix ID @${identity.handle} (${parsed.algorithm})`,
|
||||
description: "Auto-generated by Termix ID",
|
||||
username,
|
||||
privateKey: pair.private,
|
||||
publicKey: parsed.normalized,
|
||||
keyType: parsed.type,
|
||||
}));
|
||||
await store.updateKey(identity.userId, key.id, { credentialId });
|
||||
} catch (error) {
|
||||
await store.deleteKey(identity.userId, key.id);
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
await ctx.audit.record({
|
||||
action: "generate_termix_id_key",
|
||||
resourceType: "termix_id_key",
|
||||
resourceId: String(key.id),
|
||||
resourceName: identity.handle,
|
||||
details: `${parsed.algorithm}${credentialId !== null ? " (saved to credentials)" : ""}`,
|
||||
success: true,
|
||||
});
|
||||
res.status(201).json({
|
||||
key: { ...key, credentialId },
|
||||
privateKey: pair.private,
|
||||
publicKey: parsed.normalized,
|
||||
credentialId,
|
||||
});
|
||||
} catch (error) {
|
||||
fail(res, "Failed to generate key", error);
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/keys/{id}:
|
||||
* patch:
|
||||
* summary: Update key metadata (enabled state or label)
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* parameters:
|
||||
* - in: path
|
||||
* name: id
|
||||
* required: true
|
||||
* schema:
|
||||
* type: integer
|
||||
* requestBody:
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* type: object
|
||||
* properties:
|
||||
* enabled:
|
||||
* type: boolean
|
||||
* label:
|
||||
* type: string
|
||||
* responses:
|
||||
* 200:
|
||||
* description: Updated key
|
||||
* 404:
|
||||
* description: Key not found
|
||||
*/
|
||||
router.patch("/keys/:id", async (req, res) => {
|
||||
const id = parseId(req.params.id);
|
||||
if (!id) return res.status(400).json({ error: "Invalid key id" });
|
||||
try {
|
||||
const update: { enabled?: boolean; label?: string | null } = {};
|
||||
if (req.body?.enabled !== undefined) update.enabled = !!req.body.enabled;
|
||||
if (req.body?.label !== undefined)
|
||||
update.label = cleanLabel(req.body.label);
|
||||
const key = await store.updateKey(userId(), id, update);
|
||||
if (!key) return res.status(404).json({ error: "Key not found" });
|
||||
await ctx.audit.record({
|
||||
action: "update_termix_id_key",
|
||||
resourceType: "termix_id_key",
|
||||
resourceId: String(id),
|
||||
resourceName: key.label ?? key.algorithm,
|
||||
details:
|
||||
update.enabled !== undefined
|
||||
? `enabled: ${update.enabled}`
|
||||
: "label updated",
|
||||
success: true,
|
||||
});
|
||||
res.json(key);
|
||||
} catch (error) {
|
||||
fail(res, "Failed to update key", error);
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/keys/{id}:
|
||||
* delete:
|
||||
* summary: Revoke and delete a published key
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* parameters:
|
||||
* - in: path
|
||||
* name: id
|
||||
* required: true
|
||||
* schema:
|
||||
* type: integer
|
||||
* responses:
|
||||
* 200:
|
||||
* description: Deleted
|
||||
* 404:
|
||||
* description: Key not found
|
||||
*/
|
||||
router.delete("/keys/:id", async (req, res) => {
|
||||
const id = parseId(req.params.id);
|
||||
if (!id) return res.status(400).json({ error: "Invalid key id" });
|
||||
try {
|
||||
const deleted = await store.deleteKey(userId(), id);
|
||||
if (!deleted) return res.status(404).json({ error: "Key not found" });
|
||||
await ctx.audit.record({
|
||||
action: "delete_termix_id_key",
|
||||
resourceType: "termix_id_key",
|
||||
resourceId: String(id),
|
||||
resourceName: deleted.algorithm,
|
||||
success: true,
|
||||
});
|
||||
res.json({ success: true });
|
||||
} catch (error) {
|
||||
fail(res, "Failed to delete key", error);
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/ca:
|
||||
* get:
|
||||
* summary: Get the current user's certificate authority
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* responses:
|
||||
* 200:
|
||||
* description: CA info or null
|
||||
*/
|
||||
router.get("/ca", async (req, res) => {
|
||||
try {
|
||||
const identity = await store.identityForUser(userId());
|
||||
if (!identity) return res.json({ ca: null });
|
||||
const ca = await store.caForIdentity(identity.id);
|
||||
if (!ca) return res.json({ ca: null });
|
||||
res.json({
|
||||
ca: {
|
||||
publicKey: ca.publicKey,
|
||||
validityDays: ca.validityDays,
|
||||
...withUrls(req, identity.handle, "/ca"),
|
||||
},
|
||||
});
|
||||
} catch (error) {
|
||||
fail(res, "Failed to fetch CA", error);
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/ca:
|
||||
* post:
|
||||
* summary: Create a certificate authority
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* requestBody:
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* type: object
|
||||
* properties:
|
||||
* validityDays:
|
||||
* type: integer
|
||||
* responses:
|
||||
* 201:
|
||||
* description: Created CA
|
||||
* 409:
|
||||
* description: CA already exists
|
||||
*/
|
||||
router.post("/ca", async (req, res) => {
|
||||
try {
|
||||
const identity = await store.identityForUser(userId());
|
||||
if (!identity) {
|
||||
return res
|
||||
.status(400)
|
||||
.json({ error: "Create a Termix ID handle first" });
|
||||
}
|
||||
if (await store.caForIdentity(identity.id)) {
|
||||
return res.status(409).json({ error: "CA already exists" });
|
||||
}
|
||||
const validityDays = clampValidityDays(req.body?.validityDays, 90);
|
||||
const generated = generateCa();
|
||||
await store.createCa({
|
||||
identityId: identity.id,
|
||||
userId: identity.userId,
|
||||
publicKey: generated.publicKeyLine,
|
||||
privateKey: await ctx.secrets.seal(generated.privateKeyPem),
|
||||
validityDays,
|
||||
});
|
||||
await ctx.audit.record({
|
||||
action: "create_termix_id_ca",
|
||||
resourceType: "termix_id_ca",
|
||||
resourceName: identity.handle,
|
||||
success: true,
|
||||
});
|
||||
res.status(201).json({
|
||||
publicKey: generated.publicKeyLine,
|
||||
validityDays,
|
||||
...withUrls(req, identity.handle, "/ca"),
|
||||
});
|
||||
} catch (error) {
|
||||
if (isUniqueViolation(error)) {
|
||||
return res.status(409).json({ error: "CA already exists" });
|
||||
}
|
||||
fail(res, "Failed to create CA", error);
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/ca/rotate:
|
||||
* post:
|
||||
* summary: Rotate the certificate authority (revokes all issued certificates)
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* requestBody:
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* type: object
|
||||
* properties:
|
||||
* validityDays:
|
||||
* type: integer
|
||||
* responses:
|
||||
* 200:
|
||||
* description: New CA public key
|
||||
* 404:
|
||||
* description: No Termix ID or no CA
|
||||
*/
|
||||
router.post("/ca/rotate", async (req, res) => {
|
||||
try {
|
||||
const identity = await store.identityForUser(userId());
|
||||
if (!identity)
|
||||
return res.status(404).json({ error: "No Termix ID found" });
|
||||
const existing = await store.caForIdentity(identity.id);
|
||||
if (!existing) return res.status(404).json({ error: "No CA to rotate" });
|
||||
|
||||
const validityDays = clampValidityDays(
|
||||
req.body?.validityDays,
|
||||
existing.validityDays,
|
||||
);
|
||||
// A new key invalidates every certificate the old one signed: this is
|
||||
// the revocation mechanism.
|
||||
const generated = generateCa();
|
||||
await store.replaceCa(identity.id, {
|
||||
publicKey: generated.publicKeyLine,
|
||||
privateKey: await ctx.secrets.seal(generated.privateKeyPem),
|
||||
validityDays,
|
||||
});
|
||||
await ctx.audit.record({
|
||||
action: "rotate_termix_id_ca",
|
||||
resourceType: "termix_id_ca",
|
||||
resourceName: identity.handle,
|
||||
success: true,
|
||||
});
|
||||
res.json({
|
||||
publicKey: generated.publicKeyLine,
|
||||
validityDays,
|
||||
...withUrls(req, identity.handle, "/ca"),
|
||||
});
|
||||
} catch (error) {
|
||||
fail(res, "Failed to rotate CA", error);
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/ca:
|
||||
* delete:
|
||||
* summary: Delete the certificate authority
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* responses:
|
||||
* 200:
|
||||
* description: Deleted
|
||||
* 404:
|
||||
* description: No Termix ID or no CA
|
||||
*/
|
||||
router.delete("/ca", async (_req, res) => {
|
||||
try {
|
||||
const identity = await store.identityForUser(userId());
|
||||
if (!identity)
|
||||
return res.status(404).json({ error: "No Termix ID found" });
|
||||
if (!(await store.deleteCa(identity.id))) {
|
||||
return res.status(404).json({ error: "No CA to delete" });
|
||||
}
|
||||
await ctx.audit.record({
|
||||
action: "delete_termix_id_ca",
|
||||
resourceType: "termix_id_ca",
|
||||
resourceName: identity.handle,
|
||||
success: true,
|
||||
});
|
||||
res.json({ success: true });
|
||||
} catch (error) {
|
||||
fail(res, "Failed to delete CA", error);
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/keys/{id}/certificate:
|
||||
* post:
|
||||
* summary: Issue an SSH certificate for a key (Ed25519 only)
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* parameters:
|
||||
* - in: path
|
||||
* name: id
|
||||
* required: true
|
||||
* schema:
|
||||
* type: integer
|
||||
* requestBody:
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* type: object
|
||||
* properties:
|
||||
* validityDays:
|
||||
* type: integer
|
||||
* principals:
|
||||
* type: array
|
||||
* items:
|
||||
* type: string
|
||||
* responses:
|
||||
* 200:
|
||||
* description: Issued certificate
|
||||
* 400:
|
||||
* description: Not an Ed25519 key, or no CA
|
||||
* 404:
|
||||
* description: Key not found
|
||||
*/
|
||||
router.post("/keys/:id/certificate", async (req, res) => {
|
||||
const id = parseId(req.params.id);
|
||||
if (!id) return res.status(400).json({ error: "Invalid key id" });
|
||||
try {
|
||||
const owner = userId();
|
||||
const key = await store.keyForUser(owner, id);
|
||||
if (!key) return res.status(404).json({ error: "Key not found" });
|
||||
if (!ed25519RawFromLine(key.publicKey)) {
|
||||
return res
|
||||
.status(400)
|
||||
.json({ error: "Certificates are only supported for Ed25519 keys" });
|
||||
}
|
||||
const identity = await store.identityForUser(owner);
|
||||
if (!identity)
|
||||
return res.status(404).json({ error: "No Termix ID found" });
|
||||
const ca = await store.caForIdentity(identity.id);
|
||||
const caPrivateKey = ca ? await ctx.secrets.unseal(ca.privateKey) : null;
|
||||
if (!ca || !caPrivateKey) {
|
||||
return res
|
||||
.status(400)
|
||||
.json({ error: "Enable a certificate authority first" });
|
||||
}
|
||||
|
||||
const validityDays = clampValidityDays(
|
||||
req.body?.validityDays,
|
||||
ca.validityDays,
|
||||
);
|
||||
const principals: string[] = Array.isArray(req.body?.principals)
|
||||
? req.body.principals
|
||||
.filter((p: unknown) => typeof p === "string" && p.trim())
|
||||
.map((p: string) => p.trim())
|
||||
.slice(0, 32)
|
||||
: [];
|
||||
|
||||
const now = Math.floor(Date.now() / 1000);
|
||||
const validBefore = now + validityDays * 86400;
|
||||
const keyId = `termix:@${identity.handle}:${id}`;
|
||||
const certificate = signUserCertificate({
|
||||
userPublicKeyLine: key.publicKey,
|
||||
caPrivateKeyPem: caPrivateKey,
|
||||
caPublicKeyLine: ca.publicKey,
|
||||
keyId,
|
||||
principals,
|
||||
validAfter: now - 60,
|
||||
validBefore,
|
||||
});
|
||||
if (!certificate) {
|
||||
return res.status(500).json({ error: "Failed to sign certificate" });
|
||||
}
|
||||
|
||||
await ctx.audit.record({
|
||||
action: "issue_termix_id_certificate",
|
||||
resourceType: "termix_id_key",
|
||||
resourceId: String(id),
|
||||
resourceName: identity.handle,
|
||||
details: `validity ${validityDays}d${principals.length ? `, principals: ${principals.join(",")}` : ""}`,
|
||||
success: true,
|
||||
});
|
||||
res.json({ certificate, keyId, validBefore, principals, validityDays });
|
||||
} catch (error) {
|
||||
fail(res, "Failed to issue certificate", error);
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/linked-credentials:
|
||||
* get:
|
||||
* summary: Credential ids with at least one enabled published key
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* responses:
|
||||
* 200:
|
||||
* description: List of credential ids
|
||||
*/
|
||||
router.get("/linked-credentials", async (_req, res) => {
|
||||
try {
|
||||
const identity = await store.identityForUser(userId());
|
||||
if (!identity) return res.json({ credentialIds: [] });
|
||||
res.json({
|
||||
credentialIds: await store.linkedCredentialIds(identity.id),
|
||||
});
|
||||
} catch (error) {
|
||||
fail(res, "Failed to fetch linked credentials", error);
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* @openapi
|
||||
* /plugin-api/termix-identity/credentials:
|
||||
* get:
|
||||
* summary: The user's SSH key credentials that can be published
|
||||
* description: Id and name of each saved SSH key credential, for the import picker. No key material.
|
||||
* tags: [Termix ID]
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* responses:
|
||||
* 200:
|
||||
* description: List of key credentials
|
||||
*/
|
||||
router.get("/credentials", async (_req, res) => {
|
||||
try {
|
||||
const keys = await ctx.credentials.listSshKeys();
|
||||
res.json({
|
||||
credentials: keys.map((key) => ({ id: key.id, name: key.name })),
|
||||
});
|
||||
} catch (error) {
|
||||
fail(res, "Failed to fetch credentials", error);
|
||||
}
|
||||
});
|
||||
}
|
||||
@@ -0,0 +1,292 @@
|
||||
import { and, asc, eq, isNotNull } from "drizzle-orm";
|
||||
import type { PluginContext } from "@termix/plugin-sdk/backend";
|
||||
|
||||
/* eslint-disable @typescript-eslint/no-explicit-any */
|
||||
// ctx.db.define hands the tables back untyped and the drizzle handle is the
|
||||
// server's own, so both are typed at this module's edge.
|
||||
type Table = any;
|
||||
type Drizzle = any;
|
||||
/* eslint-enable @typescript-eslint/no-explicit-any */
|
||||
|
||||
export interface IdentityRow {
|
||||
id: number;
|
||||
userId: string;
|
||||
handle: string;
|
||||
description: string | null;
|
||||
createdAt: string;
|
||||
updatedAt: string;
|
||||
}
|
||||
|
||||
export interface KeyRow {
|
||||
id: number;
|
||||
identityId: number;
|
||||
userId: string;
|
||||
publicKey: string;
|
||||
keyType: string;
|
||||
algorithm: string;
|
||||
label: string | null;
|
||||
comment: string | null;
|
||||
source: string;
|
||||
credentialId: number | null;
|
||||
enabled: boolean;
|
||||
createdAt: string;
|
||||
}
|
||||
|
||||
export interface CaRow {
|
||||
id: number;
|
||||
identityId: number;
|
||||
userId: string;
|
||||
publicKey: string;
|
||||
/** Sealed with ctx.secrets.seal. */
|
||||
privateKey: string;
|
||||
validityDays: number;
|
||||
createdAt: string;
|
||||
updatedAt: string;
|
||||
}
|
||||
|
||||
export type NewKey = Omit<KeyRow, "id" | "enabled" | "createdAt">;
|
||||
|
||||
export interface Tables {
|
||||
identities: Table;
|
||||
keys: Table;
|
||||
ca: Table;
|
||||
}
|
||||
|
||||
function toKey(row: Record<string, unknown>): KeyRow {
|
||||
return {
|
||||
...(row as unknown as KeyRow),
|
||||
enabled: row.enabled === true || row.enabled === 1 || row.enabled === "1",
|
||||
};
|
||||
}
|
||||
|
||||
export type Store = ReturnType<typeof createStore>;
|
||||
|
||||
export function createStore(ctx: PluginContext, tables: Tables) {
|
||||
const { identities, keys, ca } = tables;
|
||||
const client = () => ctx.db.client<Drizzle>();
|
||||
|
||||
async function first<T>(query: Promise<T[]>): Promise<T | null> {
|
||||
const rows = await query;
|
||||
return rows[0] ?? null;
|
||||
}
|
||||
|
||||
const identityForUser = async (userId: string) =>
|
||||
first<IdentityRow>(
|
||||
(await client())
|
||||
.select()
|
||||
.from(identities)
|
||||
.where(eq(identities.userId, userId))
|
||||
.limit(1),
|
||||
);
|
||||
|
||||
const identityByHandle = async (handle: string) =>
|
||||
first<IdentityRow>(
|
||||
(await client())
|
||||
.select()
|
||||
.from(identities)
|
||||
.where(eq(identities.handle, handle))
|
||||
.limit(1),
|
||||
);
|
||||
|
||||
const keysForIdentity = async (identityId: number): Promise<KeyRow[]> =>
|
||||
(
|
||||
await (
|
||||
await client()
|
||||
)
|
||||
.select()
|
||||
.from(keys)
|
||||
.where(eq(keys.identityId, identityId))
|
||||
.orderBy(asc(keys.id))
|
||||
).map(toKey);
|
||||
|
||||
const keyForUser = async (userId: string, id: number) => {
|
||||
const row = await first<Record<string, unknown>>(
|
||||
(await client())
|
||||
.select()
|
||||
.from(keys)
|
||||
.where(and(eq(keys.id, id), eq(keys.userId, userId)))
|
||||
.limit(1),
|
||||
);
|
||||
return row ? toKey(row) : null;
|
||||
};
|
||||
|
||||
const caForIdentity = async (identityId: number) =>
|
||||
first<CaRow>(
|
||||
(await client())
|
||||
.select()
|
||||
.from(ca)
|
||||
.where(eq(ca.identityId, identityId))
|
||||
.limit(1),
|
||||
);
|
||||
|
||||
return {
|
||||
identityForUser,
|
||||
identityByHandle,
|
||||
|
||||
async isHandleTaken(handle: string): Promise<boolean> {
|
||||
return (await identityByHandle(handle)) !== null;
|
||||
},
|
||||
|
||||
async createIdentity(input: {
|
||||
userId: string;
|
||||
handle: string;
|
||||
description: string | null;
|
||||
}): Promise<IdentityRow> {
|
||||
const now = new Date().toISOString();
|
||||
await (
|
||||
await client()
|
||||
)
|
||||
.insert(identities)
|
||||
.values({ ...input, createdAt: now, updatedAt: now });
|
||||
await ctx.db.persist();
|
||||
return (await identityForUser(input.userId)) as IdentityRow;
|
||||
},
|
||||
|
||||
async updateIdentity(
|
||||
userId: string,
|
||||
update: { handle?: string; description?: string | null },
|
||||
): Promise<IdentityRow | null> {
|
||||
await (
|
||||
await client()
|
||||
)
|
||||
.update(identities)
|
||||
.set({ ...update, updatedAt: new Date().toISOString() })
|
||||
.where(eq(identities.userId, userId));
|
||||
await ctx.db.persist();
|
||||
return identityForUser(userId);
|
||||
},
|
||||
|
||||
/** Deletes the identity with its keys and CA. */
|
||||
async deleteIdentity(identity: IdentityRow): Promise<void> {
|
||||
const db = await client();
|
||||
await db.delete(keys).where(eq(keys.identityId, identity.id));
|
||||
await db.delete(ca).where(eq(ca.identityId, identity.id));
|
||||
await db.delete(identities).where(eq(identities.id, identity.id));
|
||||
await ctx.db.persist();
|
||||
},
|
||||
|
||||
keysForIdentity,
|
||||
keyForUser,
|
||||
|
||||
async enabledKeys(identityId: number): Promise<KeyRow[]> {
|
||||
return (await keysForIdentity(identityId)).filter((key) => key.enabled);
|
||||
},
|
||||
|
||||
async createKey(input: NewKey): Promise<KeyRow> {
|
||||
await (await client()).insert(keys).values({
|
||||
...input,
|
||||
enabled: true,
|
||||
createdAt: new Date().toISOString(),
|
||||
});
|
||||
await ctx.db.persist();
|
||||
// A public key appears once per identity, so it finds the new row.
|
||||
const row = await first<Record<string, unknown>>(
|
||||
(await client())
|
||||
.select()
|
||||
.from(keys)
|
||||
.where(
|
||||
and(
|
||||
eq(keys.identityId, input.identityId),
|
||||
eq(keys.publicKey, input.publicKey),
|
||||
),
|
||||
)
|
||||
.limit(1),
|
||||
);
|
||||
return toKey(row as Record<string, unknown>);
|
||||
},
|
||||
|
||||
async updateKey(
|
||||
userId: string,
|
||||
id: number,
|
||||
update: {
|
||||
enabled?: boolean;
|
||||
label?: string | null;
|
||||
credentialId?: number | null;
|
||||
},
|
||||
): Promise<KeyRow | null> {
|
||||
if (!(await keyForUser(userId, id))) return null;
|
||||
if (Object.keys(update).length > 0) {
|
||||
await (
|
||||
await client()
|
||||
)
|
||||
.update(keys)
|
||||
.set(update)
|
||||
.where(and(eq(keys.id, id), eq(keys.userId, userId)));
|
||||
await ctx.db.persist();
|
||||
}
|
||||
return keyForUser(userId, id);
|
||||
},
|
||||
|
||||
async deleteKey(userId: string, id: number): Promise<KeyRow | null> {
|
||||
const existing = await keyForUser(userId, id);
|
||||
if (!existing) return null;
|
||||
await (
|
||||
await client()
|
||||
)
|
||||
.delete(keys)
|
||||
.where(and(eq(keys.id, id), eq(keys.userId, userId)));
|
||||
await ctx.db.persist();
|
||||
return existing;
|
||||
},
|
||||
|
||||
async linkedCredentialIds(identityId: number): Promise<number[]> {
|
||||
const rows: Array<{ credentialId: number | null }> = await (
|
||||
await client()
|
||||
)
|
||||
.select({ credentialId: keys.credentialId })
|
||||
.from(keys)
|
||||
.where(
|
||||
and(
|
||||
eq(keys.identityId, identityId),
|
||||
eq(keys.enabled, true),
|
||||
isNotNull(keys.credentialId),
|
||||
),
|
||||
);
|
||||
return [
|
||||
...new Set(
|
||||
rows
|
||||
.map((row) => Number(row.credentialId))
|
||||
.filter((id) => Number.isInteger(id) && id > 0),
|
||||
),
|
||||
];
|
||||
},
|
||||
|
||||
caForIdentity,
|
||||
|
||||
async createCa(input: {
|
||||
identityId: number;
|
||||
userId: string;
|
||||
publicKey: string;
|
||||
privateKey: string;
|
||||
validityDays: number;
|
||||
}): Promise<void> {
|
||||
const now = new Date().toISOString();
|
||||
await (
|
||||
await client()
|
||||
)
|
||||
.insert(ca)
|
||||
.values({ ...input, createdAt: now, updatedAt: now });
|
||||
await ctx.db.persist();
|
||||
},
|
||||
|
||||
async replaceCa(
|
||||
identityId: number,
|
||||
update: { publicKey: string; privateKey: string; validityDays: number },
|
||||
): Promise<void> {
|
||||
await (
|
||||
await client()
|
||||
)
|
||||
.update(ca)
|
||||
.set({ ...update, updatedAt: new Date().toISOString() })
|
||||
.where(eq(ca.identityId, identityId));
|
||||
await ctx.db.persist();
|
||||
},
|
||||
|
||||
async deleteCa(identityId: number): Promise<boolean> {
|
||||
if (!(await caForIdentity(identityId))) return false;
|
||||
await (await client()).delete(ca).where(eq(ca.identityId, identityId));
|
||||
await ctx.db.persist();
|
||||
return true;
|
||||
},
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,78 @@
|
||||
import {
|
||||
adoptLegacyTable,
|
||||
boolean,
|
||||
defineTable,
|
||||
id,
|
||||
integer,
|
||||
refUser,
|
||||
text,
|
||||
varchar,
|
||||
} from "@termix/plugin-sdk/db";
|
||||
|
||||
/** One public handle per user. Adopted from core's termix_identities. */
|
||||
export const identities = adoptLegacyTable(
|
||||
"termix_identities",
|
||||
defineTable("identities", {
|
||||
id: id(),
|
||||
userId: refUser().unique(),
|
||||
handle: varchar().notNull().unique(),
|
||||
description: text(),
|
||||
createdAt: text().notNull().defaultNow(),
|
||||
updatedAt: text().notNull().defaultNow(),
|
||||
}),
|
||||
);
|
||||
|
||||
/**
|
||||
* Published public keys, plaintext because the resolver serves them without
|
||||
* auth. Adopted from core's termix_identity_keys. The migrations keep the
|
||||
* legacy links to identities (cascade) and ssh_credentials (set null) by hand.
|
||||
*/
|
||||
export const keys = adoptLegacyTable(
|
||||
"termix_identity_keys",
|
||||
defineTable(
|
||||
"keys",
|
||||
{
|
||||
id: id(),
|
||||
identityId: integer().notNull(),
|
||||
userId: refUser(),
|
||||
publicKey: text().notNull(),
|
||||
keyType: text().notNull(),
|
||||
algorithm: text().notNull(),
|
||||
label: text(),
|
||||
comment: text(),
|
||||
source: text().notNull().default("manual"),
|
||||
credentialId: integer(),
|
||||
enabled: boolean().notNull().default(true),
|
||||
createdAt: text().notNull().defaultNow(),
|
||||
},
|
||||
{
|
||||
indexes: [
|
||||
{
|
||||
name: "idx_termix_identity_keys_identity",
|
||||
columns: ["identityId"],
|
||||
},
|
||||
],
|
||||
},
|
||||
),
|
||||
);
|
||||
|
||||
/**
|
||||
* One certificate authority per identity. The private key is sealed with
|
||||
* ctx.secrets.seal; 2.8 rows are resealed by core's
|
||||
* termix-identity-ca-migration. Adopted from core's termix_identity_ca.
|
||||
*/
|
||||
export const ca = adoptLegacyTable(
|
||||
"termix_identity_ca",
|
||||
defineTable("ca", {
|
||||
id: id(),
|
||||
identityId: integer().notNull().unique(),
|
||||
userId: refUser(),
|
||||
publicKey: text().notNull(),
|
||||
privateKey: text().notNull(),
|
||||
validityDays: integer().notNull().default(90),
|
||||
createdAt: text().notNull().defaultNow(),
|
||||
updatedAt: text().notNull().defaultNow(),
|
||||
}),
|
||||
);
|
||||
|
||||
export const tables = [identities, keys, ca];
|
||||
Reference in new issue
Block a user