Door epic phases 4-5: inbound access-log ingest + universal API-call buttons
Phase 4 (migration 053): pull entry/denied events into door_access_log and match each card to a member, via two transports sharing one ingest core. Poll: a CRON_SECRET-guarded /api/cron/door-ingest reads each opted-in native-HeatSync connection's ?z log through the existing hardened executor and parses it (firmware-characterized, best-effort ring buffer). Webhook: /api/door/inbound/[connection] accepts pushed event JSON authenticated by a per-connection bearer secret from the vault. Both dedupe on (connection_id, dedupe_key) so re-polls and retries are no-ops. Adds an inbound config panel to /door/manage. Phase 5 (migration 054): admins define api_buttons that fire a configured HTTP call (full verbs + headers + body) when an authorized member presses them, through the same hardened egress (now shared between callDoor and the new callApi). Each button carries a required_permission (default the new apicall.invoke code); members see only buttons they may press. Builder at /door/buttons with a door-template preset; members press from /doors. Every press is recorded in api_call_log with secrets redacted. Both subsystems are inert until an admin enables inbound on a connection or creates a button. 624 unit + 50 integration tests; migrations applied top-to-bottom in schema.sql; types and docs updated.
This commit is contained in:
Moheeb Zara
@@ -0,0 +1,80 @@
|
||||
// Door inbound-log poll. Hit once a minute by the droplet's crontab (see
|
||||
// docs/DEPLOYMENT.md) to pull access events from each native-HeatSync
|
||||
// connection that has opted into inbound ingest. Unauthenticated by session
|
||||
// (cron has none); proxy.ts whitelists this exact path and trust is the
|
||||
// CRON_SECRET shared secret, compared in constant time.
|
||||
//
|
||||
// Each connection's `?z` log is read through the SAME hardened executor as the
|
||||
// outbound actions (SSRF host pin, no redirects, time/body caps, secret
|
||||
// redaction). Parsed events are resolved to members and idempotently inserted
|
||||
// (dedupe_key + ON-CONFLICT no-op), so overlapping runs and unchanged re-polls
|
||||
// are safe. Generic controllers ingest via the per-connection webhook instead;
|
||||
// only native_heatsync has a characterized log format to parse.
|
||||
import { NextRequest, NextResponse } from 'next/server'
|
||||
import { timingSafeEqual } from 'node:crypto'
|
||||
import { createAdminClient } from '@/lib/supabase/admin'
|
||||
import { pollConnectionLog, ingestEvents, type IngestConn } from '@/lib/door/ingest'
|
||||
|
||||
export const runtime = 'nodejs'
|
||||
export const dynamic = 'force-dynamic'
|
||||
|
||||
// Bounded work per run: cap the connections polled so a misconfigured fleet
|
||||
// cannot make one cron tick run unbounded. A single hackerspace has one or two
|
||||
// doors, so this is generous.
|
||||
const MAX_CONNECTIONS = 50
|
||||
|
||||
function authorized(req: NextRequest): boolean {
|
||||
const expected = process.env.CRON_SECRET
|
||||
if (!expected) return false
|
||||
const header = req.headers.get('authorization') ?? ''
|
||||
const provided = header.startsWith('Bearer ') ? header.slice(7) : header
|
||||
const a = Buffer.from(provided)
|
||||
const b = Buffer.from(expected)
|
||||
return a.length === b.length && timingSafeEqual(a, b)
|
||||
}
|
||||
|
||||
export async function POST(req: NextRequest) {
|
||||
if (!process.env.CRON_SECRET) {
|
||||
return NextResponse.json({ error: 'CRON_SECRET not configured' }, { status: 503 })
|
||||
}
|
||||
if (!authorized(req)) {
|
||||
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
||||
}
|
||||
|
||||
const admin = createAdminClient()
|
||||
const { data: conns, error } = await admin
|
||||
.from('door_connections')
|
||||
.select('id, space_id, adapter, base_url, pinned_host, auth_param, secret_ref, verbs, is_enabled')
|
||||
.eq('is_enabled', true)
|
||||
.eq('inbound_enabled', true)
|
||||
.eq('adapter', 'native_heatsync')
|
||||
.order('created_at', { ascending: true })
|
||||
.limit(MAX_CONNECTIONS)
|
||||
if (error) return NextResponse.json({ error: error.message }, { status: 500 })
|
||||
|
||||
let polled = 0
|
||||
let inserted = 0
|
||||
let resolved = 0
|
||||
let failed = 0
|
||||
for (const c of (conns ?? []) as unknown as IngestConn[]) {
|
||||
polled++
|
||||
// Isolate each connection: a single misbehaving controller (the body is
|
||||
// untrusted, plaintext HTTP) must not 500 the whole run and starve the rest.
|
||||
try {
|
||||
const poll = await pollConnectionLog(admin, c)
|
||||
if (!poll.ok) {
|
||||
failed++
|
||||
console.error(`[door-ingest] connection ${c.id}: ${poll.detail}`)
|
||||
continue
|
||||
}
|
||||
const res = await ingestEvents(admin, c.space_id, c.id, poll.events)
|
||||
inserted += res.inserted
|
||||
resolved += res.resolved
|
||||
} catch (e) {
|
||||
failed++
|
||||
console.error(`[door-ingest] connection ${c.id} threw:`, e instanceof Error ? e.message : e)
|
||||
}
|
||||
}
|
||||
|
||||
return NextResponse.json({ ok: true, polled, inserted, resolved, failed })
|
||||
}
|
||||
@@ -0,0 +1,89 @@
|
||||
// Per-connection inbound door-event webhook. A controller or a relay (e.g. a
|
||||
// small agent on the space's LAN that reads a non-HeatSync controller, or any
|
||||
// system that can POST) pushes normalized access events here. Unauthenticated
|
||||
// by session (the caller has none); proxy.ts whitelists the /api/door/inbound
|
||||
// prefix and trust is the per-connection bearer secret in the AES vault,
|
||||
// compared in constant time. Every DB write is post-auth.
|
||||
//
|
||||
// This is the reliable inbound transport: each event carries a caller-supplied
|
||||
// stable id, so retries are idempotent (dedupe_key) and there is none of the
|
||||
// ring-buffer ambiguity of the HeatSync `?z` poll. Events are resolved to
|
||||
// members and inserted through the same shared ingest core as the poll.
|
||||
import { NextRequest, NextResponse } from 'next/server'
|
||||
import { timingSafeEqual } from 'node:crypto'
|
||||
import { createAdminClient } from '@/lib/supabase/admin'
|
||||
import { resolveDoorSecret } from '@/lib/door/secret'
|
||||
import { ingestEvents } from '@/lib/door/ingest'
|
||||
import { normalizeWebhookEvents } from '@/lib/door-log-logic'
|
||||
import { doorWebhookPayloadSchema } from '@/lib/validations'
|
||||
import { checkRateLimit } from '@/lib/security'
|
||||
|
||||
export const runtime = 'nodejs'
|
||||
export const dynamic = 'force-dynamic'
|
||||
|
||||
const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
|
||||
|
||||
function bearerMatches(req: NextRequest, expected: string): boolean {
|
||||
const header = req.headers.get('authorization') ?? ''
|
||||
const provided = header.startsWith('Bearer ') ? header.slice(7) : header
|
||||
const a = Buffer.from(provided)
|
||||
const b = Buffer.from(expected)
|
||||
return a.length === b.length && timingSafeEqual(a, b)
|
||||
}
|
||||
|
||||
export async function POST(
|
||||
req: NextRequest,
|
||||
{ params }: { params: Promise<{ connection: string }> },
|
||||
) {
|
||||
const { connection: connectionId } = await params
|
||||
// Generic 404 for a malformed id so the endpoint does not double as a
|
||||
// uuid-shape oracle.
|
||||
if (!UUID_RE.test(connectionId)) {
|
||||
return NextResponse.json({ error: 'Not found' }, { status: 404 })
|
||||
}
|
||||
|
||||
const admin = createAdminClient()
|
||||
const { data: conn } = await admin
|
||||
.from('door_connections')
|
||||
.select('id, space_id, inbound_enabled, inbound_secret_ref')
|
||||
.eq('id', connectionId)
|
||||
.maybeSingle()
|
||||
|
||||
// Do not reveal whether the connection exists vs. has inbound disabled vs.
|
||||
// has no secret: an unauthenticated caller gets the same 401 for all of
|
||||
// "can't authenticate this request".
|
||||
const secret = conn && conn.inbound_enabled
|
||||
? await resolveDoorSecret(admin, conn.space_id as string, (conn.inbound_secret_ref as string | null) ?? null)
|
||||
: null
|
||||
if (!secret || !bearerMatches(req, secret)) {
|
||||
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
||||
}
|
||||
|
||||
const rl = checkRateLimit(`door-inbound:${connectionId}`, 120, 60_000)
|
||||
if (!rl.allowed) {
|
||||
return NextResponse.json({ error: 'Rate limited' }, { status: 429 })
|
||||
}
|
||||
|
||||
// Bound the body before parsing it into memory. The schema caps at 100
|
||||
// events, but req.json() reads the whole body first, so reject an oversized
|
||||
// declared length up front (64KB is far more than 100 small events need).
|
||||
const declaredLen = Number(req.headers.get('content-length') ?? '0')
|
||||
if (declaredLen > 65536) {
|
||||
return NextResponse.json({ error: 'Payload too large' }, { status: 413 })
|
||||
}
|
||||
|
||||
let body: unknown
|
||||
try {
|
||||
body = await req.json()
|
||||
} catch {
|
||||
return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 })
|
||||
}
|
||||
const parsed = doorWebhookPayloadSchema.safeParse(body)
|
||||
if (!parsed.success) {
|
||||
return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })
|
||||
}
|
||||
|
||||
const events = normalizeWebhookEvents(parsed.data.events)
|
||||
const res = await ingestEvents(admin, conn!.space_id as string, conn!.id as string, events)
|
||||
return NextResponse.json({ received: true, ...res })
|
||||
}
|
||||
Reference in New Issue
Block a user