mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-14 16:20:03 +00:00
rcourtman
300 lines
9.6 KiB
Go
300 lines
9.6 KiB
Go
package api
|
|
|
|
import (
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/rcourtman/pulse-go-rewrite/internal/agentexec"
|
|
"github.com/rcourtman/pulse-go-rewrite/internal/config"
|
|
"github.com/rs/zerolog/log"
|
|
)
|
|
|
|
const (
|
|
agentInstallIssuedViaConfig = "config_agent_install_command"
|
|
agentInstallIssuedViaHosted = "hosted_agent_install_command"
|
|
agentExecBindingVersionKey = "agent_exec_binding_version"
|
|
agentExecBindingVersion = "2"
|
|
)
|
|
|
|
type agentExecMetadataValue struct {
|
|
value string
|
|
present bool
|
|
}
|
|
|
|
func snapshotAgentExecMetadata(metadata map[string]string, keys ...string) map[string]agentExecMetadataValue {
|
|
snapshot := make(map[string]agentExecMetadataValue, len(keys))
|
|
for _, key := range keys {
|
|
value, present := metadata[key]
|
|
snapshot[key] = agentExecMetadataValue{value: value, present: present}
|
|
}
|
|
return snapshot
|
|
}
|
|
|
|
func restoreAgentExecMetadata(metadata map[string]string, snapshot map[string]agentExecMetadataValue) {
|
|
for key, previous := range snapshot {
|
|
if previous.present {
|
|
metadata[key] = previous.value
|
|
} else {
|
|
delete(metadata, key)
|
|
}
|
|
}
|
|
}
|
|
|
|
func (r *Router) validateAgentExecToken(token string, agentID string, hostname string) bool {
|
|
_, ok := r.admitAgentExecToken(token, agentID, hostname)
|
|
return ok
|
|
}
|
|
|
|
func (r *Router) admitAgentExecToken(token string, agentID string, hostname string) (agentexec.AgentAdmission, bool) {
|
|
if r == nil || r.config == nil {
|
|
return agentexec.AgentAdmission{}, false
|
|
}
|
|
|
|
requestedID := strings.TrimSpace(agentID)
|
|
requestedHost := strings.TrimSpace(hostname)
|
|
|
|
config.Mu.Lock()
|
|
record, ok := r.config.ValidateAPIToken(token)
|
|
if !ok {
|
|
config.Mu.Unlock()
|
|
// This is the branch a stale-enrollment agent hits: it holds a token
|
|
// from a prior install that this server no longer recognises. It was
|
|
// previously the only rejection path with no log, which made a looping
|
|
// "Invalid token" agent impossible to diagnose without reading source.
|
|
log.Warn().
|
|
Str("agent_id", requestedID).
|
|
Str("hostname", requestedHost).
|
|
Msg("Agent exec token not recognized by this server — re-run the agent installer to re-enroll this agent")
|
|
return agentexec.AgentAdmission{}, false
|
|
}
|
|
|
|
tokenID := record.ID
|
|
if !record.HasScope(config.ScopeAgentExec) {
|
|
config.Mu.Unlock()
|
|
log.Warn().
|
|
Str("token_id", tokenID).
|
|
Msg("Agent exec token missing required scope: agent:exec")
|
|
return agentexec.AgentAdmission{}, false
|
|
}
|
|
orgs := record.GetBoundOrgs()
|
|
if len(orgs) > 1 {
|
|
config.Mu.Unlock()
|
|
log.Warn().
|
|
Str("token_id", tokenID).
|
|
Strs("organization_ids", orgs).
|
|
Msg("Agent exec token rejected because command sessions require one organization binding")
|
|
return agentexec.AgentAdmission{}, false
|
|
}
|
|
organizationID := "default"
|
|
if len(orgs) == 1 && strings.TrimSpace(orgs[0]) != "" {
|
|
organizationID = strings.TrimSpace(orgs[0])
|
|
}
|
|
|
|
boundID := strings.TrimSpace(record.Metadata["bound_agent_id"])
|
|
boundHost := strings.TrimSpace(record.Metadata["bound_hostname"])
|
|
if boundID == "" && boundHost == "" && canBindAgentInstallExecToken(record, requestedID, requestedHost) {
|
|
issuedVia := strings.TrimSpace(record.Metadata["issued_via"])
|
|
installType := strings.TrimSpace(record.Metadata["install_type"])
|
|
if record.Metadata == nil {
|
|
record.Metadata = make(map[string]string)
|
|
}
|
|
previousMetadata := snapshotAgentExecMetadata(
|
|
record.Metadata,
|
|
"bound_agent_id",
|
|
"bound_hostname",
|
|
"bound_at",
|
|
agentExecBindingVersionKey,
|
|
)
|
|
record.Metadata["bound_agent_id"] = requestedID
|
|
record.Metadata["bound_hostname"] = requestedHost
|
|
record.Metadata["bound_at"] = time.Now().UTC().Format(time.RFC3339)
|
|
record.Metadata[agentExecBindingVersionKey] = agentExecBindingVersion
|
|
if r.persistence != nil {
|
|
if err := r.persistence.SaveAPITokens(r.config.APITokens); err != nil {
|
|
restoreAgentExecMetadata(record.Metadata, previousMetadata)
|
|
config.Mu.Unlock()
|
|
log.Error().
|
|
Err(err).
|
|
Str("token_id", tokenID).
|
|
Str("hostname", requestedHost).
|
|
Msg("Failed to persist first-use agent exec token binding; command registration denied")
|
|
return agentexec.AgentAdmission{}, false
|
|
}
|
|
}
|
|
config.Mu.Unlock()
|
|
|
|
log.Info().
|
|
Str("token_id", tokenID).
|
|
Str("hostname", requestedHost).
|
|
Str("issued_via", issuedVia).
|
|
Str("install_type", installType).
|
|
Msg("Bound agent install token to first command agent registration")
|
|
return agentexec.AgentAdmission{
|
|
OrganizationID: organizationID,
|
|
TokenID: tokenID,
|
|
AgentID: requestedID,
|
|
Hostname: requestedHost,
|
|
}, true
|
|
}
|
|
|
|
if boundID == "" && boundHost == "" {
|
|
config.Mu.Unlock()
|
|
log.Warn().
|
|
Str("token_id", tokenID).
|
|
Msg("Agent exec token missing binding metadata")
|
|
return agentexec.AgentAdmission{}, false
|
|
}
|
|
|
|
// Pre-v6.1.1 deploy tokens could carry a server-synthesized agent ID even
|
|
// though the runtime derives its ID from machine-id. Migrate that
|
|
// hostname-bound legacy record exactly once, then enforce both fields.
|
|
if strings.TrimSpace(record.Metadata[agentExecBindingVersionKey]) != agentExecBindingVersion &&
|
|
boundHost != "" && strings.EqualFold(boundHost, requestedHost) {
|
|
previousID := boundID
|
|
previousMetadata := snapshotAgentExecMetadata(
|
|
record.Metadata,
|
|
"bound_agent_id",
|
|
"bound_at",
|
|
agentExecBindingVersionKey,
|
|
)
|
|
record.Metadata["bound_agent_id"] = requestedID
|
|
record.Metadata["bound_at"] = time.Now().UTC().Format(time.RFC3339)
|
|
record.Metadata[agentExecBindingVersionKey] = agentExecBindingVersion
|
|
if r.persistence != nil {
|
|
if err := r.persistence.SaveAPITokens(r.config.APITokens); err != nil {
|
|
restoreAgentExecMetadata(record.Metadata, previousMetadata)
|
|
config.Mu.Unlock()
|
|
log.Error().
|
|
Err(err).
|
|
Str("token_id", tokenID).
|
|
Msg("Failed to persist legacy agent exec identity migration; command registration denied")
|
|
return agentexec.AgentAdmission{}, false
|
|
}
|
|
}
|
|
config.Mu.Unlock()
|
|
log.Info().
|
|
Str("token_id", tokenID).
|
|
Str("previous_agent_id", previousID).
|
|
Str("agent_id", requestedID).
|
|
Str("hostname", requestedHost).
|
|
Msg("Migrated legacy hostname-bound agent exec token to immutable runtime identity")
|
|
return agentexec.AgentAdmission{
|
|
OrganizationID: organizationID,
|
|
TokenID: tokenID,
|
|
AgentID: requestedID,
|
|
Hostname: requestedHost,
|
|
}, true
|
|
}
|
|
|
|
idMatches := boundID == "" || boundID == requestedID
|
|
hostMatches := boundHost == "" || strings.EqualFold(boundHost, requestedHost)
|
|
if idMatches && hostMatches {
|
|
previousMetadata := snapshotAgentExecMetadata(
|
|
record.Metadata,
|
|
"bound_agent_id",
|
|
"bound_hostname",
|
|
"bound_at",
|
|
agentExecBindingVersionKey,
|
|
)
|
|
metadataChanged := false
|
|
if boundID == "" && boundHost != "" {
|
|
record.Metadata["bound_agent_id"] = requestedID
|
|
boundID = requestedID
|
|
metadataChanged = true
|
|
}
|
|
if boundHost == "" && boundID != "" {
|
|
record.Metadata["bound_hostname"] = requestedHost
|
|
boundHost = requestedHost
|
|
metadataChanged = true
|
|
}
|
|
if metadataChanged {
|
|
record.Metadata["bound_at"] = time.Now().UTC().Format(time.RFC3339)
|
|
record.Metadata[agentExecBindingVersionKey] = agentExecBindingVersion
|
|
}
|
|
if metadataChanged && r.persistence != nil {
|
|
if err := r.persistence.SaveAPITokens(r.config.APITokens); err != nil {
|
|
restoreAgentExecMetadata(record.Metadata, previousMetadata)
|
|
config.Mu.Unlock()
|
|
log.Error().
|
|
Err(err).
|
|
Str("token_id", tokenID).
|
|
Msg("Failed to persist migrated agent exec token binding; command registration denied")
|
|
return agentexec.AgentAdmission{}, false
|
|
}
|
|
}
|
|
config.Mu.Unlock()
|
|
return agentexec.AgentAdmission{
|
|
OrganizationID: organizationID,
|
|
TokenID: tokenID,
|
|
AgentID: requestedID,
|
|
Hostname: requestedHost,
|
|
}, true
|
|
}
|
|
|
|
config.Mu.Unlock()
|
|
log.Warn().
|
|
Str("token_id", tokenID).
|
|
Str("bound_id", boundID).
|
|
Str("bound_hostname", boundHost).
|
|
Str("requested_id", requestedID).
|
|
Str("requested_hostname", requestedHost).
|
|
Msg("Agent token mismatch: token is not bound to the registering agent")
|
|
return agentexec.AgentAdmission{}, false
|
|
}
|
|
|
|
func (r *Router) validateAgentExecSession(admission agentexec.AgentAdmission) bool {
|
|
if r == nil || r.config == nil {
|
|
return false
|
|
}
|
|
tokenID := strings.TrimSpace(admission.TokenID)
|
|
requestedID := strings.TrimSpace(admission.AgentID)
|
|
requestedHost := strings.TrimSpace(admission.Hostname)
|
|
if tokenID == "" || requestedID == "" || requestedHost == "" {
|
|
return false
|
|
}
|
|
|
|
config.Mu.Lock()
|
|
defer config.Mu.Unlock()
|
|
for index := range r.config.APITokens {
|
|
record := &r.config.APITokens[index]
|
|
if record.ID != tokenID || record.IsExpired() || !record.HasScope(config.ScopeAgentExec) {
|
|
continue
|
|
}
|
|
orgs := record.GetBoundOrgs()
|
|
organizationID := "default"
|
|
if len(orgs) > 1 {
|
|
return false
|
|
}
|
|
if len(orgs) == 1 && strings.TrimSpace(orgs[0]) != "" {
|
|
organizationID = strings.TrimSpace(orgs[0])
|
|
}
|
|
return organizationID == strings.TrimSpace(admission.OrganizationID) &&
|
|
strings.TrimSpace(record.Metadata["bound_agent_id"]) == requestedID &&
|
|
strings.EqualFold(strings.TrimSpace(record.Metadata["bound_hostname"]), requestedHost)
|
|
}
|
|
return false
|
|
}
|
|
|
|
func canBindAgentInstallExecToken(record *config.APITokenRecord, agentID string, hostname string) bool {
|
|
if record == nil || strings.TrimSpace(agentID) == "" || strings.TrimSpace(hostname) == "" {
|
|
return false
|
|
}
|
|
if strings.TrimSpace(record.Metadata["bound_agent_id"]) != "" ||
|
|
strings.TrimSpace(record.Metadata["bound_hostname"]) != "" {
|
|
return false
|
|
}
|
|
|
|
switch strings.TrimSpace(record.Metadata["install_type"]) {
|
|
case proxmoxInstallTypePVE, proxmoxInstallTypePBS, agentInstallTypeHost:
|
|
default:
|
|
return false
|
|
}
|
|
|
|
switch strings.TrimSpace(record.Metadata["issued_via"]) {
|
|
case agentInstallIssuedViaConfig, agentInstallIssuedViaHosted:
|
|
return true
|
|
default:
|
|
return false
|
|
}
|
|
}
|