192 lines
14 KiB
JavaScript
192 lines
14 KiB
JavaScript
"use strict";
|
|
|
|
const crypto = require("node:crypto");
|
|
|
|
function stable(value) {
|
|
if (Array.isArray(value)) return value.map(stable);
|
|
if (value && typeof value === "object") return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stable(value[key])]));
|
|
return value;
|
|
}
|
|
|
|
function planId(value) {
|
|
return crypto.createHash("sha256").update(JSON.stringify(stable(value))).digest("hex");
|
|
}
|
|
|
|
function keyMaterial(value) {
|
|
return String(value || "").trim().split(/\s+/).slice(0, 2).join(" ");
|
|
}
|
|
|
|
class DeployKeyLifecycleService {
|
|
constructor({ store, gitea, keyHost, audit = null, clock = () => new Date().toISOString() }) {
|
|
this.store = store;
|
|
this.gitea = gitea;
|
|
this.keyHost = keyHost;
|
|
this.audit = audit;
|
|
this.clock = clock;
|
|
}
|
|
|
|
coordinates(repository) {
|
|
const [owner, repo] = String(repository?.fullName || "").split("/");
|
|
if (!owner || !repo) throw Object.assign(new Error("A full Gitea repository name is required."), { code: "DEPLOY_KEY_REPOSITORY_REQUIRED" });
|
|
return { owner, repo };
|
|
}
|
|
|
|
profile(repository, profileId) {
|
|
const profile = this.store.getDeploymentProfile(repository.fullName, profileId);
|
|
if (!profile) throw Object.assign(new Error("Deployment profile not found."), { code: "DEPLOY_KEY_PROFILE_NOT_FOUND" });
|
|
const server = this.store.getServer(profile.serverId);
|
|
if (!server) throw Object.assign(new Error("Deployment server not found."), { code: "DEPLOY_KEY_SERVER_NOT_FOUND" });
|
|
return { profile, server };
|
|
}
|
|
|
|
configuredReferences() {
|
|
const references = [];
|
|
const configured = this.store.data?.deploymentProfiles
|
|
? Object.entries(this.store.data.deploymentProfiles).map(([fullName, profiles]) => ({ fullName, profiles }))
|
|
: (this.store.getRepositories?.() || []).map((repository) => ({ fullName: repository.fullName, profiles: this.store.getDeploymentProfiles(repository.fullName) || [] }));
|
|
for (const repository of configured) {
|
|
for (const profile of repository.profiles || []) {
|
|
if (!profile.serverGitAccess?.deployKeyId && !profile.serverGitAccess?.keyFingerprint) continue;
|
|
references.push({ repository: repository.fullName, profileId: profile.id, serverId: profile.serverId, keyId: profile.serverGitAccess.deployKeyId || null, fingerprint: profile.serverGitAccess.keyFingerprint || null });
|
|
}
|
|
}
|
|
return references;
|
|
}
|
|
|
|
async inventory({ repository, profileId }) {
|
|
const { profile, server } = this.profile(repository, profileId);
|
|
const { owner, repo } = this.coordinates(repository);
|
|
const [remoteKeys, serverKey] = await Promise.all([
|
|
this.gitea.listDeployKeys(owner, repo),
|
|
this.keyHost.inspect({ repository, profile, server }),
|
|
]);
|
|
const configuredId = Number(profile.serverGitAccess?.deployKeyId) || null;
|
|
const configured = remoteKeys.find((key) => Number(key.id) === configuredId) || null;
|
|
const material = keyMaterial(serverKey?.publicKey);
|
|
const matching = material ? remoteKeys.filter((key) => keyMaterial(key.key) === material) : [];
|
|
const references = this.configuredReferences();
|
|
const shared = references.filter((reference) => reference.fingerprint && reference.fingerprint === serverKey?.fingerprint && (reference.repository !== repository.fullName || reference.profileId !== profileId));
|
|
const conflicts = remoteKeys.filter((key) => key.read_only !== true && (!configuredId || Number(key.id) === configuredId || keyMaterial(key.key) === material));
|
|
const stale = Boolean(configuredId && !configured) || Boolean(profile.serverGitAccess?.keyFingerprint && serverKey?.fingerprint && profile.serverGitAccess.keyFingerprint !== serverKey.fingerprint);
|
|
const orphaned = remoteKeys.filter((key) => /ForgeFlow/i.test(String(key.title || "")) && !references.some((reference) => Number(reference.keyId) === Number(key.id)));
|
|
return {
|
|
repository: repository.fullName, profileId, server: { id: server.id, name: server.name },
|
|
configuredKey: configured ? { id: configured.id, title: configured.title, readOnly: configured.read_only === true, key: configured.key || null } : null,
|
|
serverKey, matchingKeys: matching.map((key) => ({ id: key.id, readOnly: key.read_only === true })),
|
|
stale, orphaned: orphaned.map((key) => ({ id: key.id, title: key.title })), shared, conflicts: conflicts.map((key) => ({ id: key.id, title: key.title, readOnly: false })),
|
|
ready: Boolean(configured && configured.read_only === true && serverKey?.privateKeyPresent && serverKey?.fingerprint === profile.serverGitAccess?.keyFingerprint && !shared.length && !conflicts.length),
|
|
checkedAt: this.clock(),
|
|
};
|
|
}
|
|
|
|
async planRotation({ repository, profileId }) {
|
|
const evidence = await this.inventory({ repository, profileId });
|
|
const plan = {
|
|
operation: "rotate-deploy-key", repository: repository.fullName, profileId,
|
|
currentKeyId: evidence.configuredKey?.id || null, currentFingerprint: evidence.serverKey?.fingerprint || null,
|
|
serverId: evidence.server.id, impact: ["Generate a new private key on the linked server", "Register only its public key in this repository", "Verify read-only branch access", "Switch the profile atomically", "Revoke the previous key after the switch"],
|
|
recovery: "The previous server key and profile metadata remain recoverable until post-rotation verification succeeds.", evidence,
|
|
};
|
|
plan.id = planId(plan);
|
|
await this.audit?.append?.("deployment.deploy-key-rotation-planned", { repository: repository.fullName, profileId, planId: plan.id });
|
|
return plan;
|
|
}
|
|
|
|
async rotate({ repository, profileId, expectedPlanId }) {
|
|
const plan = await this.planRotation({ repository, profileId });
|
|
if (!expectedPlanId) throw Object.assign(new Error("Review a deploy-key rotation plan before applying it."), { code: "DEPLOY_KEY_ROTATION_PLAN_REQUIRED", plan });
|
|
if (expectedPlanId !== plan.id) throw Object.assign(new Error("Deploy-key evidence changed after preview. Review a fresh plan."), { code: "DEPLOY_KEY_ROTATION_PLAN_STALE", plan });
|
|
const { profile, server } = this.profile(repository, profileId);
|
|
const { owner, repo } = this.coordinates(repository);
|
|
const snapshot = await this.store.createRecoverySnapshot?.(`deploy-key-rotation:${repository.fullName}:${profileId}`);
|
|
const previous = { profile: structuredClone(profile), key: await this.keyHost.backup({ repository, profile, server }), remoteKey: plan.evidence.configuredKey };
|
|
let candidate = null;
|
|
let registered = null;
|
|
let switched = false;
|
|
let oldRevoked = false;
|
|
try {
|
|
candidate = await this.keyHost.generate({ repository, profile, server });
|
|
if (!candidate?.publicKey || !candidate?.fingerprint || candidate.privateKey) throw Object.assign(new Error("The server did not return safe public-key evidence."), { code: "DEPLOY_KEY_CANDIDATE_INVALID" });
|
|
registered = await this.gitea.createReadOnlyDeployKey({ owner, repo, title: `ForgeFlow · ${server.name} · ${candidate.fingerprint.slice(-12)}`, publicKey: candidate.publicKey });
|
|
if (registered.read_only !== true) throw Object.assign(new Error("Gitea registered the candidate with write access."), { code: "DEPLOY_KEY_NOT_READ_ONLY" });
|
|
const proof = await this.keyHost.verifyCandidate({ repository, profile, server, candidate, keyId: registered.id });
|
|
if (!proof?.ready || proof.fingerprint !== candidate.fingerprint) throw Object.assign(new Error("The candidate deploy key could not prove read-only repository access."), { code: "DEPLOY_KEY_CANDIDATE_VERIFICATION_FAILED", proof });
|
|
await this.keyHost.preflightCandidate({ repository, profile, server, candidate, proof });
|
|
await this.keyHost.promote({ repository, profile, server, candidate, previous });
|
|
const updated = await this.store.saveDeploymentProfile(repository.fullName, { ...profile, serverGitAccess: { configured: true, deployKeyId: registered.id, keyFingerprint: candidate.fingerprint, hostFingerprint: proof.hostFingerprint, configuredAt: this.clock(), rotatedAt: this.clock(), previousKeyId: previous.remoteKey?.id || null } });
|
|
switched = true;
|
|
if (previous.remoteKey?.id) {
|
|
await this.gitea.deleteDeployKey(owner, repo, previous.remoteKey.id);
|
|
oldRevoked = true;
|
|
}
|
|
const post = await this.keyHost.verifyActive({ repository, profile: updated, server });
|
|
if (!post?.ready || post.fingerprint !== candidate.fingerprint) throw Object.assign(new Error("Post-rotation verification failed."), { code: "DEPLOY_KEY_POST_ROTATION_FAILED", post });
|
|
await this.keyHost.commit({ repository, profile: updated, server, candidate, previous });
|
|
await this.audit?.append?.("deployment.deploy-key-rotated", { repository: repository.fullName, profileId, oldKeyId: previous.remoteKey?.id || null, newKeyId: registered.id, fingerprint: candidate.fingerprint, snapshot: snapshot?.filePath || null });
|
|
return { profile: updated, proof: post, snapshot, recovery: previous.key?.recovery || null };
|
|
} catch (error) {
|
|
try {
|
|
if (candidate) await this.keyHost.rollback({ repository, profile, server, candidate, previous });
|
|
if (registered?.id) await this.gitea.deleteDeployKey(owner, repo, registered.id).catch(() => {});
|
|
let restoredKey = null;
|
|
if (oldRevoked && previous.remoteKey?.key) restoredKey = await this.gitea.createReadOnlyDeployKey({ owner, repo, title: previous.remoteKey.title || `ForgeFlow · ${server.name} · restored`, publicKey: previous.remoteKey.key });
|
|
if (switched) await this.store.saveDeploymentProfile(repository.fullName, restoredKey ? { ...previous.profile, serverGitAccess: { ...previous.profile.serverGitAccess, deployKeyId: restoredKey.id } } : previous.profile);
|
|
} catch (rollbackError) {
|
|
error.rollbackError = rollbackError.message;
|
|
}
|
|
await this.audit?.append?.("deployment.deploy-key-rotation-failed", { repository: repository.fullName, profileId, code: error.code || "DEPLOY_KEY_ROTATION_FAILED", rollbackError: error.rollbackError || null });
|
|
throw error;
|
|
}
|
|
}
|
|
|
|
async planRevocation({ repository, profileId }) {
|
|
const evidence = await this.inventory({ repository, profileId });
|
|
const plan = { operation: "revoke-deploy-key", repository: repository.fullName, profileId, keyId: evidence.configuredKey?.id || null, fingerprint: evidence.serverKey?.fingerprint || null, linkedDeployments: [profileId], impact: ["Remove this repository deploy key from Gitea", "Disable server-pull deployment until restored", "Preserve server-side recovery material"], containersUnaffected: true, evidence };
|
|
plan.id = planId(plan);
|
|
return plan;
|
|
}
|
|
|
|
async revoke({ repository, profileId, expectedPlanId }) {
|
|
const plan = await this.planRevocation({ repository, profileId });
|
|
if (!expectedPlanId) throw Object.assign(new Error("Review revocation impact before applying it."), { code: "DEPLOY_KEY_REVOCATION_PLAN_REQUIRED", plan });
|
|
if (plan.id !== expectedPlanId) throw Object.assign(new Error("Deploy-key evidence changed after preview."), { code: "DEPLOY_KEY_REVOCATION_PLAN_STALE", plan });
|
|
const { profile, server } = this.profile(repository, profileId);
|
|
const { owner, repo } = this.coordinates(repository);
|
|
const snapshot = await this.store.createRecoverySnapshot?.(`deploy-key-revocation:${repository.fullName}:${profileId}`);
|
|
const recovery = await this.keyHost.backup({ repository, profile, server });
|
|
let remoteDeleted = false;
|
|
try {
|
|
if (plan.keyId) { await this.gitea.deleteDeployKey(owner, repo, plan.keyId); remoteDeleted = true; }
|
|
await this.keyHost.revoke({ repository, profile, server, recovery });
|
|
const updated = await this.store.saveDeploymentProfile(repository.fullName, { ...profile, serverGitAccess: { ...profile.serverGitAccess, configured: false, revokedAt: this.clock(), recoveryAvailable: true }, deploymentMode: "monitor-only" });
|
|
await this.audit?.append?.("deployment.deploy-key-revoked", { repository: repository.fullName, profileId, keyId: plan.keyId, snapshot: snapshot?.filePath || null });
|
|
return { profile: updated, snapshot, recovery: recovery?.recovery || null };
|
|
} catch (error) {
|
|
if (remoteDeleted && plan.evidence.configuredKey?.key) {
|
|
const restored = await this.gitea.createReadOnlyDeployKey({ owner, repo, title: plan.evidence.configuredKey.title || `ForgeFlow · ${server.name} · restored`, publicKey: plan.evidence.configuredKey.key });
|
|
await this.store.saveDeploymentProfile(repository.fullName, { ...profile, serverGitAccess: { ...profile.serverGitAccess, deployKeyId: restored.id } });
|
|
}
|
|
await this.keyHost.restore({ repository, profile, server }).catch(() => {});
|
|
await this.audit?.append?.("deployment.deploy-key-revocation-failed", { repository: repository.fullName, profileId, code: error.code || "DEPLOY_KEY_REVOCATION_FAILED" });
|
|
throw error;
|
|
}
|
|
}
|
|
|
|
async restore({ repository, profileId }) {
|
|
const { profile, server } = this.profile(repository, profileId);
|
|
const restored = await this.keyHost.restore({ repository, profile, server });
|
|
if (!restored?.publicKey || !restored?.fingerprint) throw Object.assign(new Error("No valid deploy-key recovery material exists."), { code: "DEPLOY_KEY_RECOVERY_UNAVAILABLE" });
|
|
const { owner, repo } = this.coordinates(repository);
|
|
const key = await this.gitea.createReadOnlyDeployKey({ owner, repo, title: `ForgeFlow · ${server.name} · restored`, publicKey: restored.publicKey });
|
|
if (key.read_only !== true) throw Object.assign(new Error("The restored key is not read-only."), { code: "DEPLOY_KEY_NOT_READ_ONLY" });
|
|
const proposed = { ...profile, deploymentMode: "server-git", serverGitAccess: { configured: true, deployKeyId: key.id, keyFingerprint: restored.fingerprint, hostFingerprint: restored.hostFingerprint, restoredAt: this.clock() } };
|
|
const proof = await this.keyHost.verifyActive({ repository, profile: proposed, server });
|
|
if (!proof?.ready) throw Object.assign(new Error("Restored access could not be verified."), { code: "DEPLOY_KEY_RECOVERY_VERIFICATION_FAILED" });
|
|
const updated = await this.store.saveDeploymentProfile(repository.fullName, proposed);
|
|
await this.audit?.append?.("deployment.deploy-key-restored", { repository: repository.fullName, profileId, keyId: key.id, fingerprint: restored.fingerprint });
|
|
return { profile: updated, proof };
|
|
}
|
|
}
|
|
|
|
module.exports = { DeployKeyLifecycleService, keyMaterial, deployKeyPlanId: planId };
|