edit, test and live-apply S3 bucket settings from the admin console (v3.0.131)

@@ -0,0 +1,127 @@1+import type { Context, Hono } from "hono";2+import { checkS3Access, openBucket } from "../bucket/reader.ts";3+import { html } from "../pages/html.ts";4+import { type BucketSource, saveConfig } from "../server/config.ts";5+import { type AdminContext, adminPage, formField, notice, textFields } from "./console.ts";6+7+type S3Source = Extract<BucketSource, { kind: "s3" }>;8+9+// The fields shown back to the operator; the two secrets are never among them.10+const SHOWN: [key: string, label: string][] = [11+	["endpoint", "endpoint"],12+	["name", "bucket name"],13+	["region", "region"],14+	["access_key_id", "read access key ID"],15+	["write_access_key_id", "write access key ID"],16+];17+const REQUIRED = new Set(["endpoint", "name", "region", "access_key_id"]);18+// Keys, names and URLs have neither; a newline would also end the TOML line it is written to.19+const UNPRINTABLE = /[\s\p{C}]/u;20+21+/** The S3 settings a form describes, a blank secret keeping the stored one; or what is wrong. */22+function candidate(fields: Record<string, string>, current: S3Source): S3Source | string {23+	const value = (key: string) => (fields[key] ?? "").trim();24+	for (const [key, label] of SHOWN) {25+		if (REQUIRED.has(key) && value(key) === "") return `The ${label} is required.`;26+		if (UNPRINTABLE.test(fields[key] ?? ""))27+			return `The ${label} cannot contain spaces or control characters.`;28+	}29+	for (const key of ["secret_access_key", "write_secret_access_key"]) {30+		if (UNPRINTABLE.test(value(key)))31+			return "A secret cannot contain spaces or control characters.";32+	}33+	const endpoint = value("endpoint");34+	if (!URL.canParse(endpoint) || !/^https?:$/.test(new URL(endpoint).protocol))35+		return "The endpoint must be an http or https URL.";36+	const source: S3Source = {37+		kind: "s3",38+		endpoint,39+		name: value("name"),40+		region: value("region"),41+		accessKeyId: value("access_key_id"),42+		secretAccessKey: value("secret_access_key") || current.secretAccessKey,43+	};44+	if (value("write_access_key_id") === "") return source;45+	const writeSecret = value("write_secret_access_key") || current.write?.secretAccessKey;46+	if (!writeSecret) return "A new write key needs its secret.";47+	return {48+		...source,49+		write: { accessKeyId: value("write_access_key_id"), secretAccessKey: writeSecret },50+	};51+}52+53+/** §24's Bucket section: edit and test the S3 settings, then write them to kepr.toml (§19). */54+export function registerBucket(app: Hono, ctx: AdminContext): void {55+	app.get("/admin/bucket", (c) => c.html(bucketPage(c, ctx)));56+57+	app.post("/admin/bucket", async (c) => {58+		const current = ctx.config.bucket;59+		if (current.kind !== "s3") return c.html(bucketPage(c, ctx), 400);60+		const fields = await textFields(c);61+		const next = candidate(fields, current);62+		if (typeof next === "string") return c.html(bucketPage(c, ctx, { fields, error: next }), 400);63+		const failure = await checkS3Access(next);64+		if (failure) return c.html(bucketPage(c, ctx, { fields, error: failure }), 400);65+		if (fields.action !== "save") {66+			return c.html(bucketPage(c, ctx, { fields, status: "Connection works. Nothing was saved." }));67+		}68+		try {69+			await saveConfig(ctx.configPath, { ...ctx.config, bucket: next });70+		} catch (error) {71+			const reason = error instanceof Error ? error.message : String(error);72+			const failed = `The settings work, but kepr.toml could not be written: ${reason}`;73+			return c.html(bucketPage(c, ctx, { fields, error: failed }), 500);74+		}75+		// In place, so the sync loop, downloads, the image policy and /connect all see it now.76+		ctx.config.bucket = next;77+		Object.assign(ctx.sync.bucket, openBucket(next));78+		return c.redirect("/admin/bucket?saved=1", 303);79+	});80+}81+82+function bucketPage(83+	c: Context,84+	ctx: AdminContext,85+	shown: { fields?: Record<string, string>; error?: string; status?: string } = {},86+): string {87+	const source = ctx.config.bucket;88+	if (source.kind === "folder") {89+		const body = html`<p class="admin-intro">This instance reads a Koh folder remote at90+<span class="mono">${source.path}</span>.</p>91+<p class="muted">A folder remote is set in kepr.toml only.</p>`;92+		return adminPage(c, ctx, "bucket", body);93+	}94+	const stored: Record<string, string> = {95+		endpoint: source.endpoint,96+		name: source.name,97+		region: source.region,98+		access_key_id: source.accessKeyId,99+		write_access_key_id: source.write?.accessKeyId ?? "",100+	};101+	const value = (key: string) => shown.fields?.[key] ?? stored[key] ?? "";102+	const input = ([key, label]: (typeof SHOWN)[number]) =>103+		html`<label class="issues-label" for="${key}">${label}</label>104+<input class="issues-input mono" id="${key}" name="${key}" value="${value(key)}"105+autocomplete="off" spellcheck="false">`;106+	const secret = (key: string, label: string, hint: string) =>107+		html`<label class="issues-label" for="${key}">${label}</label>108+<input class="issues-input mono" id="${key}" name="${key}" type="password"109+autocomplete="new-password" placeholder="${hint}">`;110+	const body = html`${notice(shown.error ?? "")}111+${shown.status && html`<p class="admin-notice" role="status">${shown.status}</p>`}112+<p class="admin-intro">The S3 bucket Kepr reads with its read-only key. Secrets are never shown.</p>113+<form class="issues-form" method="post" action="/admin/bucket">114+${formField(c)}115+${SHOWN.slice(0, 4).map(input)}116+${secret("secret_access_key", "read secret key", "unchanged")}117+${input(SHOWN[4] as (typeof SHOWN)[number])}118+${secret("write_secret_access_key", "write secret key", source.write ? "unchanged" : "")}119+<p class="muted">The write key is optional: it signs machines in (/connect). Clear its ID to turn that120+off. Saving tests the settings first and rewrites kepr.toml without its comments.</p>121+<div class="issues-actions">122+<button class="issues-submit" type="submit" name="action" value="test">test connection</button>123+<button class="issues-submit" type="submit" name="action" value="save">save</button>124+</div>125+</form>`;126+	return adminPage(c, ctx, "bucket", body);127+}

@@ -0,0 +1,198 @@1+// Covers §24's Bucket section: masked secrets, the connection test, and a save that rewrites2+// kepr.toml and applies the new settings without a restart.3+4+import { afterAll, beforeEach, describe, expect, test } from "bun:test";5+import { mkdtemp, stat } from "node:fs/promises";6+import { tmpdir } from "node:os";7+import { join } from "node:path";8+import { openBucket } from "../src/bucket/reader.ts";9+import { createApp } from "../src/server/app.ts";10+import { type Config, loadConfig } from "../src/server/config.ts";11+import { openKeprDb } from "../src/server/db.ts";12+import { Browser, PASSWORD } from "./browser.ts";13+14+const HASH = await Bun.password.hash(PASSWORD, "argon2id");15+const READ_IDS = new Set(["READ-ID", "NEW-READ"]);16+const WRITE_ID = "WRITE-ID";17+const written: string[] = [];18+19+// Just enough S3 for the connection test: ListObjectsV2 and PUT, allowed by the signing key's ID.20+function fakeS3() {21+	return Bun.serve({22+		port: 0,23+		async fetch(request) {24+			const keyId = /Credential=([^/]+)\//.exec(request.headers.get("authorization") ?? "")?.[1];25+			const denied = () =>26+				new Response("<Error><Code>AccessDenied</Code><Message>no</Message></Error>", {27+					status: 403,28+				});29+			if (request.method === "PUT") {30+				if (keyId !== WRITE_ID) return denied();31+				written.push(new URL(request.url).pathname);32+				return new Response("", { headers: { etag: '"1"' } });33+			}34+			if (!keyId || !READ_IDS.has(keyId)) return denied();35+			return new Response(36+				"<ListBucketResult><IsTruncated>false</IsTruncated><Contents><Key>app/head</Key></Contents></ListBucketResult>",37+			);38+		},39+	});40+}41+const first = fakeS3();42+const second = fakeS3();43+afterAll(() => {44+	first.stop(true);45+	second.stop(true);46+});47+48+async function build(folder = false) {49+	const dataDir = await mkdtemp(join(tmpdir(), "kepr-bucket-admin-"));50+	const configPath = join(dataDir, "kepr.toml");51+	const bucket: Config["bucket"] = folder52+		? { kind: "folder", path: dataDir }53+		: {54+				kind: "s3",55+				endpoint: `http://127.0.0.1:${first.port}`,56+				name: "koh",57+				region: "fr-par",58+				accessKeyId: "READ-ID",59+				secretAccessKey: "READ-SECRET",60+			};61+	const config: Config = { domain: "kepr.example", dataDir, adminPasswordHash: HASH, bucket };62+	const original = folder63+		? "folder instance\n"64+		: `# hand-written\ndomain = "kepr.example"\ndata_dir = "${dataDir}"\nadmin_password_hash = "${HASH}"\n[bucket]\nendpoint = "${bucket.kind === "s3" ? bucket.endpoint : ""}"\nname = "koh"\nregion = "fr-par"\naccess_key_id = "READ-ID"\nsecret_access_key = "READ-SECRET"\n`;65+	await Bun.write(configPath, original);66+	const kepr = openKeprDb(dataDir);67+	const shared = openBucket(config.bucket);68+	const app = createApp(config, kepr, shared, configPath);69+	const browser = new Browser(app);70+	await browser.signIn();71+	await browser.get("/admin/bucket");72+	return { app, config, configPath, original, shared, browser };73+}74+75+const form = (fields: Record<string, string>) => ({76+	endpoint: `http://127.0.0.1:${first.port}`,77+	name: "koh",78+	region: "fr-par",79+	access_key_id: "READ-ID",80+	secret_access_key: "",81+	write_access_key_id: "",82+	write_secret_access_key: "",83+	...fields,84+});85+86+beforeEach(() => {87+	written.length = 0;88+});89+90+describe("the Bucket section (§24)", () => {91+	test("shows every setting but the secrets", async () => {92+		const { browser } = await build();93+		const text = await (await browser.get("/admin/bucket")).text();94+		expect(text).toContain(`http://127.0.0.1:${first.port}`);95+		expect(text).toContain('value="READ-ID"');96+		expect(text).toContain('href="/admin/bucket" aria-current="page"');97+		expect(text).not.toContain("READ-SECRET");98+	});99+100+	test("the test checks the form and writes nothing to kepr.toml", async () => {101+		const { browser, configPath, original } = await build();102+		const works = await browser.post("/admin/bucket", form({ action: "test" }));103+		expect(works.status).toBe(200);104+		expect(await works.text()).toContain("Connection works");105+		const refused = await browser.post(106+			"/admin/bucket",107+			form({ action: "test", access_key_id: "WRONG" }),108+		);109+		expect(refused.status).toBe(400);110+		expect(await refused.text()).toContain("The read key cannot list the bucket");111+		expect(await Bun.file(configPath).text()).toBe(original);112+	});113+114+	test("a write key must write Kepr's own test file, and only that", async () => {115+		const { browser, configPath, original } = await build();116+		const refused = await browser.post(117+			"/admin/bucket",118+			form({ action: "save", write_access_key_id: "READ-ID", write_secret_access_key: "x" }),119+		);120+		expect(refused.status).toBe(400);121+		expect(await refused.text()).toContain("The write key cannot write");122+		expect(await Bun.file(configPath).text()).toBe(original);123+		const works = await browser.post(124+			"/admin/bucket",125+			form({ action: "test", write_access_key_id: WRITE_ID, write_secret_access_key: "ws" }),126+		);127+		expect(works.status).toBe(200);128+		expect(written).toEqual(["/koh/.kepr/connection-test"]);129+	});130+131+	test("save rewrites kepr.toml, keeps blank secrets and applies at once", async () => {132+		const { app, browser, configPath, shared } = await build();133+		expect((await browser.get("/connect?machine=laptop")).status).toBe(404);134+		const endpoint = `http://127.0.0.1:${second.port}`;135+		const saved = await browser.post(136+			"/admin/bucket",137+			form({138+				action: "save",139+				endpoint,140+				region: "nl-ams",141+				write_access_key_id: WRITE_ID,142+				write_secret_access_key: "WRITE-SECRET",143+			}),144+		);145+		expect(saved.status).toBe(303);146+		expect(saved.headers.get("location")).toBe("/admin/bucket?saved=1");147+		const reloaded = await loadConfig(configPath);148+		expect(reloaded.bucket).toEqual({149+			kind: "s3",150+			endpoint,151+			name: "koh",152+			region: "nl-ams",153+			accessKeyId: "READ-ID",154+			secretAccessKey: "READ-SECRET",155+			write: { accessKeyId: WRITE_ID, secretAccessKey: "WRITE-SECRET" },156+		});157+		expect(reloaded.adminPasswordHash).toBe(HASH);158+		expect((await stat(configPath)).mode & 0o777).toBe(0o600);159+		expect(shared.downloadUrl("app/x", "x", "t/x")).toStartWith(`${endpoint}/koh/app/x`);160+		const csp = (await app.request("/")).headers.get("content-security-policy") ?? "";161+		expect(csp).toContain(endpoint);162+		expect(csp).not.toContain(`127.0.0.1:${first.port}`);163+		expect((await browser.get("/connect?machine=laptop")).status).toBe(200);164+		const page = await (await browser.get("/admin/bucket")).text();165+		expect(page).not.toContain("WRITE-SECRET");166+167+		const cleared = await browser.post("/admin/bucket", form({ action: "save", endpoint }));168+		expect(cleared.status).toBe(303);169+		expect((await loadConfig(configPath)).bucket).not.toHaveProperty("write");170+		expect((await browser.get("/connect?machine=laptop")).status).toBe(404);171+	});172+173+	test("refuses a malformed form before testing anything", async () => {174+		const { browser, configPath, original } = await build();175+		const cases: [Record<string, string>, string][] = [176+			[{ endpoint: "ftp://example.com" }, "The endpoint must be an http or https URL."],177+			[{ name: "" }, "The bucket name is required."],178+			[{ region: "fr\npar" }, "The region cannot contain spaces or control characters."],179+			[{ write_access_key_id: "NEW-WRITE" }, "A new write key needs its secret."],180+		];181+		for (const [fields, error] of cases) {182+			const response = await browser.post("/admin/bucket", form({ action: "save", ...fields }));183+			expect(response.status).toBe(400);184+			expect(await response.text()).toContain(error);185+		}186+		expect(await Bun.file(configPath).text()).toBe(original);187+	});188+189+	test("a folder remote is shown read-only and never rewritten", async () => {190+		const { browser, configPath, original, config } = await build(true);191+		const text = await (await browser.get("/admin/bucket")).text();192+		expect(text).toContain(config.bucket.kind === "folder" ? config.bucket.path : "");193+		expect(text).not.toContain('name="endpoint"');194+		const response = await browser.post("/admin/bucket", form({ action: "save" }));195+		expect(response.status).toBe(400);196+		expect(await Bun.file(configPath).text()).toBe(original);197+	});198+});