Moheeb Zara
7ec90b0f1e
Phase 4 (migration 053): pull entry/denied events into door_access_log and match each card to a member, via two transports sharing one ingest core. Poll: a CRON_SECRET-guarded /api/cron/door-ingest reads each opted-in native-HeatSync connection's ?z log through the existing hardened executor and parses it (firmware-characterized, best-effort ring buffer). Webhook: /api/door/inbound/[connection] accepts pushed event JSON authenticated by a per-connection bearer secret from the vault. Both dedupe on (connection_id, dedupe_key) so re-polls and retries are no-ops. Adds an inbound config panel to /door/manage. Phase 5 (migration 054): admins define api_buttons that fire a configured HTTP call (full verbs + headers + body) when an authorized member presses them, through the same hardened egress (now shared between callDoor and the new callApi). Each button carries a required_permission (default the new apicall.invoke code); members see only buttons they may press. Builder at /door/buttons with a door-template preset; members press from /doors. Every press is recorded in api_call_log with secrets redacted. Both subsystems are inert until an admin enables inbound on a connection or creates a button. 624 unit + 50 integration tests; migrations applied top-to-bottom in schema.sql; types and docs updated.
90 lines
3.8 KiB
TypeScript
90 lines
3.8 KiB
TypeScript
// Per-connection inbound door-event webhook. A controller or a relay (e.g. a
|
|
// small agent on the space's LAN that reads a non-HeatSync controller, or any
|
|
// system that can POST) pushes normalized access events here. Unauthenticated
|
|
// by session (the caller has none); proxy.ts whitelists the /api/door/inbound
|
|
// prefix and trust is the per-connection bearer secret in the AES vault,
|
|
// compared in constant time. Every DB write is post-auth.
|
|
//
|
|
// This is the reliable inbound transport: each event carries a caller-supplied
|
|
// stable id, so retries are idempotent (dedupe_key) and there is none of the
|
|
// ring-buffer ambiguity of the HeatSync `?z` poll. Events are resolved to
|
|
// members and inserted through the same shared ingest core as the poll.
|
|
import { NextRequest, NextResponse } from 'next/server'
|
|
import { timingSafeEqual } from 'node:crypto'
|
|
import { createAdminClient } from '@/lib/supabase/admin'
|
|
import { resolveDoorSecret } from '@/lib/door/secret'
|
|
import { ingestEvents } from '@/lib/door/ingest'
|
|
import { normalizeWebhookEvents } from '@/lib/door-log-logic'
|
|
import { doorWebhookPayloadSchema } from '@/lib/validations'
|
|
import { checkRateLimit } from '@/lib/security'
|
|
|
|
export const runtime = 'nodejs'
|
|
export const dynamic = 'force-dynamic'
|
|
|
|
const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
|
|
|
|
function bearerMatches(req: NextRequest, expected: string): boolean {
|
|
const header = req.headers.get('authorization') ?? ''
|
|
const provided = header.startsWith('Bearer ') ? header.slice(7) : header
|
|
const a = Buffer.from(provided)
|
|
const b = Buffer.from(expected)
|
|
return a.length === b.length && timingSafeEqual(a, b)
|
|
}
|
|
|
|
export async function POST(
|
|
req: NextRequest,
|
|
{ params }: { params: Promise<{ connection: string }> },
|
|
) {
|
|
const { connection: connectionId } = await params
|
|
// Generic 404 for a malformed id so the endpoint does not double as a
|
|
// uuid-shape oracle.
|
|
if (!UUID_RE.test(connectionId)) {
|
|
return NextResponse.json({ error: 'Not found' }, { status: 404 })
|
|
}
|
|
|
|
const admin = createAdminClient()
|
|
const { data: conn } = await admin
|
|
.from('door_connections')
|
|
.select('id, space_id, inbound_enabled, inbound_secret_ref')
|
|
.eq('id', connectionId)
|
|
.maybeSingle()
|
|
|
|
// Do not reveal whether the connection exists vs. has inbound disabled vs.
|
|
// has no secret: an unauthenticated caller gets the same 401 for all of
|
|
// "can't authenticate this request".
|
|
const secret = conn && conn.inbound_enabled
|
|
? await resolveDoorSecret(admin, conn.space_id as string, (conn.inbound_secret_ref as string | null) ?? null)
|
|
: null
|
|
if (!secret || !bearerMatches(req, secret)) {
|
|
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
|
}
|
|
|
|
const rl = checkRateLimit(`door-inbound:${connectionId}`, 120, 60_000)
|
|
if (!rl.allowed) {
|
|
return NextResponse.json({ error: 'Rate limited' }, { status: 429 })
|
|
}
|
|
|
|
// Bound the body before parsing it into memory. The schema caps at 100
|
|
// events, but req.json() reads the whole body first, so reject an oversized
|
|
// declared length up front (64KB is far more than 100 small events need).
|
|
const declaredLen = Number(req.headers.get('content-length') ?? '0')
|
|
if (declaredLen > 65536) {
|
|
return NextResponse.json({ error: 'Payload too large' }, { status: 413 })
|
|
}
|
|
|
|
let body: unknown
|
|
try {
|
|
body = await req.json()
|
|
} catch {
|
|
return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 })
|
|
}
|
|
const parsed = doorWebhookPayloadSchema.safeParse(body)
|
|
if (!parsed.success) {
|
|
return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })
|
|
}
|
|
|
|
const events = normalizeWebhookEvents(parsed.data.events)
|
|
const res = await ingestEvents(admin, conn!.space_id as string, conn!.id as string, events)
|
|
return NextResponse.json({ received: true, ...res })
|
|
}
|