Moheeb Zara
7ec90b0f1e
Phase 4 (migration 053): pull entry/denied events into door_access_log and match each card to a member, via two transports sharing one ingest core. Poll: a CRON_SECRET-guarded /api/cron/door-ingest reads each opted-in native-HeatSync connection's ?z log through the existing hardened executor and parses it (firmware-characterized, best-effort ring buffer). Webhook: /api/door/inbound/[connection] accepts pushed event JSON authenticated by a per-connection bearer secret from the vault. Both dedupe on (connection_id, dedupe_key) so re-polls and retries are no-ops. Adds an inbound config panel to /door/manage. Phase 5 (migration 054): admins define api_buttons that fire a configured HTTP call (full verbs + headers + body) when an authorized member presses them, through the same hardened egress (now shared between callDoor and the new callApi). Each button carries a required_permission (default the new apicall.invoke code); members see only buttons they may press. Builder at /door/buttons with a door-template preset; members press from /doors. Every press is recorded in api_call_log with secrets redacted. Both subsystems are inert until an admin enables inbound on a connection or creates a button. 624 unit + 50 integration tests; migrations applied top-to-bottom in schema.sql; types and docs updated.
81 lines
3.3 KiB
TypeScript
81 lines
3.3 KiB
TypeScript
// Door inbound-log poll. Hit once a minute by the droplet's crontab (see
|
|
// docs/DEPLOYMENT.md) to pull access events from each native-HeatSync
|
|
// connection that has opted into inbound ingest. Unauthenticated by session
|
|
// (cron has none); proxy.ts whitelists this exact path and trust is the
|
|
// CRON_SECRET shared secret, compared in constant time.
|
|
//
|
|
// Each connection's `?z` log is read through the SAME hardened executor as the
|
|
// outbound actions (SSRF host pin, no redirects, time/body caps, secret
|
|
// redaction). Parsed events are resolved to members and idempotently inserted
|
|
// (dedupe_key + ON-CONFLICT no-op), so overlapping runs and unchanged re-polls
|
|
// are safe. Generic controllers ingest via the per-connection webhook instead;
|
|
// only native_heatsync has a characterized log format to parse.
|
|
import { NextRequest, NextResponse } from 'next/server'
|
|
import { timingSafeEqual } from 'node:crypto'
|
|
import { createAdminClient } from '@/lib/supabase/admin'
|
|
import { pollConnectionLog, ingestEvents, type IngestConn } from '@/lib/door/ingest'
|
|
|
|
export const runtime = 'nodejs'
|
|
export const dynamic = 'force-dynamic'
|
|
|
|
// Bounded work per run: cap the connections polled so a misconfigured fleet
|
|
// cannot make one cron tick run unbounded. A single hackerspace has one or two
|
|
// doors, so this is generous.
|
|
const MAX_CONNECTIONS = 50
|
|
|
|
function authorized(req: NextRequest): boolean {
|
|
const expected = process.env.CRON_SECRET
|
|
if (!expected) return false
|
|
const header = req.headers.get('authorization') ?? ''
|
|
const provided = header.startsWith('Bearer ') ? header.slice(7) : header
|
|
const a = Buffer.from(provided)
|
|
const b = Buffer.from(expected)
|
|
return a.length === b.length && timingSafeEqual(a, b)
|
|
}
|
|
|
|
export async function POST(req: NextRequest) {
|
|
if (!process.env.CRON_SECRET) {
|
|
return NextResponse.json({ error: 'CRON_SECRET not configured' }, { status: 503 })
|
|
}
|
|
if (!authorized(req)) {
|
|
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
|
}
|
|
|
|
const admin = createAdminClient()
|
|
const { data: conns, error } = await admin
|
|
.from('door_connections')
|
|
.select('id, space_id, adapter, base_url, pinned_host, auth_param, secret_ref, verbs, is_enabled')
|
|
.eq('is_enabled', true)
|
|
.eq('inbound_enabled', true)
|
|
.eq('adapter', 'native_heatsync')
|
|
.order('created_at', { ascending: true })
|
|
.limit(MAX_CONNECTIONS)
|
|
if (error) return NextResponse.json({ error: error.message }, { status: 500 })
|
|
|
|
let polled = 0
|
|
let inserted = 0
|
|
let resolved = 0
|
|
let failed = 0
|
|
for (const c of (conns ?? []) as unknown as IngestConn[]) {
|
|
polled++
|
|
// Isolate each connection: a single misbehaving controller (the body is
|
|
// untrusted, plaintext HTTP) must not 500 the whole run and starve the rest.
|
|
try {
|
|
const poll = await pollConnectionLog(admin, c)
|
|
if (!poll.ok) {
|
|
failed++
|
|
console.error(`[door-ingest] connection ${c.id}: ${poll.detail}`)
|
|
continue
|
|
}
|
|
const res = await ingestEvents(admin, c.space_id, c.id, poll.events)
|
|
inserted += res.inserted
|
|
resolved += res.resolved
|
|
} catch (e) {
|
|
failed++
|
|
console.error(`[door-ingest] connection ${c.id} threw:`, e instanceof Error ? e.message : e)
|
|
}
|
|
}
|
|
|
|
return NextResponse.json({ ok: true, polled, inserted, resolved, failed })
|
|
}
|