139 lines
4.2 KiB
TypeScript
139 lines
4.2 KiB
TypeScript
import { createHash, randomUUID } from 'node:crypto';
|
|
import { Inject, Injectable } from '@nestjs/common';
|
|
import { eq, users as usersTable, type Db } from '@mosaicstack/db';
|
|
import type { CommandDef, SlashCommandPayload } from '@mosaicstack/types';
|
|
import { DB } from '../database/database.module.js';
|
|
import { COMMANDS_REDIS } from './commands.tokens.js';
|
|
|
|
export type CommandRole = 'admin' | 'member' | 'viewer';
|
|
|
|
export interface CommandApproval {
|
|
approvalId: string;
|
|
actionDigest: string;
|
|
actorId: string;
|
|
command: string;
|
|
expiresAt: string;
|
|
}
|
|
|
|
export interface CommandAuthorizationResult {
|
|
allowed: boolean;
|
|
reason?: string;
|
|
}
|
|
|
|
@Injectable()
|
|
export class CommandAuthorizationService {
|
|
constructor(
|
|
@Inject(DB) private readonly db: Db,
|
|
@Inject(COMMANDS_REDIS)
|
|
private readonly redis: {
|
|
get(key: string): Promise<string | null>;
|
|
set(key: string, value: string, ...args: string[]): Promise<unknown>;
|
|
del(key: string): Promise<number>;
|
|
},
|
|
) {}
|
|
|
|
async authorize(
|
|
command: CommandDef,
|
|
payload: SlashCommandPayload,
|
|
actorId: string,
|
|
approvalId?: string,
|
|
): Promise<CommandAuthorizationResult> {
|
|
const role = await this.resolveRole(actorId);
|
|
if (!role || !this.hasScope(role, command.scope)) {
|
|
return { allowed: false, reason: 'not authorized for this command scope' };
|
|
}
|
|
if (command.scope !== 'admin') return { allowed: true };
|
|
if (!approvalId) return { allowed: false, reason: 'durable approval is required' };
|
|
const actionDigest = this.actionDigest(command.name, payload);
|
|
const approved = await this.consumeApproval(approvalId, actorId, actionDigest);
|
|
return approved
|
|
? { allowed: true }
|
|
: {
|
|
allowed: false,
|
|
reason: 'approval is invalid, expired, replayed, or does not match this action',
|
|
};
|
|
}
|
|
|
|
async createApproval(
|
|
command: CommandDef,
|
|
payload: SlashCommandPayload,
|
|
actorId: string,
|
|
): Promise<CommandApproval | null> {
|
|
const role = await this.resolveRole(actorId);
|
|
if (!role || command.scope !== 'admin' || !this.hasScope(role, command.scope)) return null;
|
|
|
|
const approvalId = randomUUID();
|
|
const expiresAt = new Date(Date.now() + 5 * 60_000).toISOString();
|
|
const approval: CommandApproval = {
|
|
approvalId,
|
|
actionDigest: this.actionDigest(command.name, payload),
|
|
actorId,
|
|
command: command.name,
|
|
expiresAt,
|
|
};
|
|
await this.redis.set(this.key(approvalId), JSON.stringify(approval), 'EX', '300');
|
|
return approval;
|
|
}
|
|
|
|
private async resolveRole(actorId: string): Promise<CommandRole | null> {
|
|
const [user] = await this.db
|
|
.select({ role: usersTable.role })
|
|
.from(usersTable)
|
|
.where(eq(usersTable.id, actorId))
|
|
.limit(1);
|
|
const role = user?.role;
|
|
return role === 'admin' || role === 'member' || role === 'viewer' ? role : null;
|
|
}
|
|
|
|
private hasScope(role: CommandRole, scope: CommandDef['scope']): boolean {
|
|
if (role === 'admin') return true;
|
|
return role === 'member' && (scope === 'core' || scope === 'agent');
|
|
}
|
|
|
|
private async consumeApproval(
|
|
approvalId: string,
|
|
actorId: string,
|
|
actionDigest: string,
|
|
): Promise<boolean> {
|
|
const key = this.key(approvalId);
|
|
const encoded = await this.redis.get(key);
|
|
if (!encoded) return false;
|
|
const parsed: unknown = JSON.parse(encoded);
|
|
if (
|
|
!this.isApproval(parsed) ||
|
|
parsed.actorId !== actorId ||
|
|
parsed.actionDigest !== actionDigest ||
|
|
Date.parse(parsed.expiresAt) <= Date.now()
|
|
)
|
|
return false;
|
|
return (await this.redis.del(key)) === 1;
|
|
}
|
|
|
|
private actionDigest(command: string, payload: SlashCommandPayload): string {
|
|
return createHash('sha256')
|
|
.update(
|
|
JSON.stringify({
|
|
command,
|
|
args: payload.args?.trim() ?? '',
|
|
conversationId: payload.conversationId,
|
|
}),
|
|
)
|
|
.digest('hex');
|
|
}
|
|
|
|
private isApproval(value: unknown): value is CommandApproval {
|
|
return (
|
|
typeof value === 'object' &&
|
|
value !== null &&
|
|
'approvalId' in value &&
|
|
'actionDigest' in value &&
|
|
'actorId' in value &&
|
|
'expiresAt' in value
|
|
);
|
|
}
|
|
|
|
private key(approvalId: string): string {
|
|
return `tess:command-approval:${approvalId}`;
|
|
}
|
|
}
|