Complete preliminary ssh host group feature

2026-10-16 06:45:28 +00:00 · 2025-04-30 18:14:31 -07:00
parent b06eeb0d40
commit b21b0b340b
46 changed files with 561 additions and 94 deletions
@@ -6,6 +6,8 @@ import { DatabaseError } from "@app/lib/errors";
 import { groupBy, unique } from "@app/lib/fn";
 import { ormify } from "@app/lib/knex";

+import { LoginMappingSource } from "./ssh-host-types";
+
 export type TSshHostDALFactory = ReturnType<typeof sshHostDALFactory>;

 export const sshHostDALFactory = (db: TDbClient) => {
@@ -13,20 +15,22 @@ export const sshHostDALFactory = (db: TDbClient) => {

  const findUserAccessibleSshHosts = async (projectIds: string[], userId: string, tx?: Knex) => {
    try {
-      const user = await (tx || db.replicaNode())(TableName.Users).where({ id: userId }).select("username").first();
+      const knex = tx || db.replicaNode();
+
+      const user = await knex(TableName.Users).where({ id: userId }).select("username").first();

      if (!user) {
        throw new DatabaseError({ name: `${TableName.Users}: UserNotFound`, error: new Error("User not found") });
      }

-      const rows = await (tx || db.replicaNode())(TableName.SshHost)
+      // get hosts where user has direct login mappings
+      const directHostRows = await knex(TableName.SshHost)
        .leftJoin(TableName.SshHostLoginUser, `${TableName.SshHost}.id`, `${TableName.SshHostLoginUser}.sshHostId`)
        .leftJoin(
          TableName.SshHostLoginUserMapping,
          `${TableName.SshHostLoginUser}.id`,
          `${TableName.SshHostLoginUserMapping}.sshHostLoginUserId`
        )
-        .leftJoin(TableName.Users, `${TableName.Users}.id`, `${TableName.SshHostLoginUserMapping}.userId`)
        .whereIn(`${TableName.SshHost}.projectId`, projectIds)
        .andWhere(`${TableName.SshHostLoginUserMapping}.userId`, userId)
        .select(
@@ -37,26 +41,66 @@ export const sshHostDALFactory = (db: TDbClient) => {
          db.ref("userCertTtl").withSchema(TableName.SshHost),
          db.ref("hostCertTtl").withSchema(TableName.SshHost),
          db.ref("loginUser").withSchema(TableName.SshHostLoginUser),
-          db.ref("username").withSchema(TableName.Users),
-          db.ref("userId").withSchema(TableName.SshHostLoginUserMapping),
          db.ref("userSshCaId").withSchema(TableName.SshHost),
          db.ref("hostSshCaId").withSchema(TableName.SshHost)
-        )
-        .orderBy(`${TableName.SshHost}.updatedAt`, "desc");
+        );

-      const grouped = groupBy(rows, (r) => r.sshHostId);
-      return Object.values(grouped).map((hostRows) => {
+      // get hosts where user has login mappings via host groups
+      const groupHostRows = await knex(TableName.SshHostGroupMembership)
+        .join(
+          TableName.SshHostLoginUser,
+          `${TableName.SshHostGroupMembership}.sshHostGroupId`,
+          `${TableName.SshHostLoginUser}.sshHostGroupId`
+        )
+        .leftJoin(
+          TableName.SshHostLoginUserMapping,
+          `${TableName.SshHostLoginUser}.id`,
+          `${TableName.SshHostLoginUserMapping}.sshHostLoginUserId`
+        )
+        .join(TableName.SshHost, `${TableName.SshHostGroupMembership}.sshHostId`, `${TableName.SshHost}.id`)
+        .whereIn(`${TableName.SshHost}.projectId`, projectIds)
+        .andWhere(`${TableName.SshHostLoginUserMapping}.userId`, userId)
+        .select(
+          db.ref("id").withSchema(TableName.SshHost).as("sshHostId"),
+          db.ref("projectId").withSchema(TableName.SshHost),
+          db.ref("hostname").withSchema(TableName.SshHost),
+          db.ref("alias").withSchema(TableName.SshHost),
+          db.ref("userCertTtl").withSchema(TableName.SshHost),
+          db.ref("hostCertTtl").withSchema(TableName.SshHost),
+          db.ref("loginUser").withSchema(TableName.SshHostLoginUser),
+          db.ref("userSshCaId").withSchema(TableName.SshHost),
+          db.ref("hostSshCaId").withSchema(TableName.SshHost)
+        );
+
+      const directHostRowsWithSource = directHostRows.map((row) => ({
+        ...row,
+        source: LoginMappingSource.HOST
+      }));
+
+      const groupHostRowsWithSource = groupHostRows.map((row) => ({
+        ...row,
+        source: LoginMappingSource.HOST_GROUP
+      }));
+
+      const mergedRows = [...directHostRowsWithSource, ...groupHostRowsWithSource];
+
+      const hostsGrouped = groupBy(mergedRows, (r) => r.sshHostId);
+
+      return Object.values(hostsGrouped).map((hostRows) => {
        const { sshHostId, hostname, alias, userCertTtl, hostCertTtl, userSshCaId, hostSshCaId, projectId } =
          hostRows[0];

-        const loginMappingGrouped = groupBy(hostRows, (r) => r.loginUser);
-
-        const loginMappings = Object.entries(loginMappingGrouped).map(([loginUser]) => ({
-          loginUser,
-          allowedPrincipals: {
-            usernames: [user.username]
-          }
-        }));
+        const loginMappingGrouped = groupBy(hostRows, (r) => `${r.loginUser}|${r.source}`);
+        const loginMappings = Object.entries(loginMappingGrouped).map(([key]) => {
+          const [loginUser, source] = key.split("|");
+          return {
+            loginUser,
+            allowedPrincipals: {
+              usernames: [user.username]
+            },
+            source: source as LoginMappingSource
+          };
+        });

        return {
          id: sshHostId,
@@ -101,20 +145,57 @@ export const sshHostDALFactory = (db: TDbClient) => {
        )
        .orderBy(`${TableName.SshHost}.updatedAt`, "desc");

+      // process login mappings inherited from groups that hosts are part of
+      const hostIds = unique(rows.map((r) => r.sshHostId)).filter(Boolean);
+      const groupRows = await (tx || db.replicaNode())(TableName.SshHostGroupMembership)
+        .join(
+          TableName.SshHostLoginUser,
+          `${TableName.SshHostGroupMembership}.sshHostGroupId`,
+          `${TableName.SshHostLoginUser}.sshHostGroupId`
+        )
+        .leftJoin(
+          TableName.SshHostLoginUserMapping,
+          `${TableName.SshHostLoginUser}.id`,
+          `${TableName.SshHostLoginUserMapping}.sshHostLoginUserId`
+        )
+        .leftJoin(TableName.Users, `${TableName.SshHostLoginUserMapping}.userId`, `${TableName.Users}.id`)
+        .select(
+          db.ref("sshHostId").withSchema(TableName.SshHostGroupMembership),
+          db.ref("loginUser").withSchema(TableName.SshHostLoginUser),
+          db.ref("username").withSchema(TableName.Users)
+        )
+        .whereIn(`${TableName.SshHostGroupMembership}.sshHostId`, hostIds);
+
+      const groupedGroupMappings = groupBy(groupRows, (r) => r.sshHostId);
+
      const hostsGrouped = groupBy(rows, (r) => r.sshHostId);
      return Object.values(hostsGrouped).map((hostRows) => {
        const { sshHostId, hostname, alias, userCertTtl, hostCertTtl, userSshCaId, hostSshCaId } = hostRows[0];

+        // direct login mappings
        const loginMappingGrouped = groupBy(
          hostRows.filter((r) => r.loginUser),
          (r) => r.loginUser
        );

-        const loginMappings = Object.entries(loginMappingGrouped).map(([loginUser, entries]) => ({
+        const directMappings = Object.entries(loginMappingGrouped).map(([loginUser, entries]) => ({
          loginUser,
          allowedPrincipals: {
            usernames: unique(entries.map((e) => e.username)).filter(Boolean)
-          }
+          },
+          source: LoginMappingSource.HOST
+        }));
+
+        // group-inherited login mappings
+        const inheritedGroupRows = groupedGroupMappings[sshHostId] || [];
+        const inheritedGrouped = groupBy(inheritedGroupRows, (r) => r.loginUser);
+
+        const groupMappings = Object.entries(inheritedGrouped).map(([loginUser, entries]) => ({
+          loginUser,
+          allowedPrincipals: {
+            usernames: unique(entries.map((e) => e.username)).filter(Boolean)
+          },
+          source: LoginMappingSource.HOST_GROUP
        }));

        return {
@@ -124,7 +205,7 @@ export const sshHostDALFactory = (db: TDbClient) => {
          projectId,
          userCertTtl,
          hostCertTtl,
-          loginMappings,
+          loginMappings: [...directMappings, ...groupMappings],
          userSshCaId,
          hostSshCaId
        };
@@ -163,16 +244,50 @@ export const sshHostDALFactory = (db: TDbClient) => {

      const { sshHostId: id, projectId, hostname, alias, userCertTtl, hostCertTtl, userSshCaId, hostSshCaId } = rows[0];

-      const loginMappingGrouped = groupBy(
+      // direct login mappings
+      const directGrouped = groupBy(
        rows.filter((r) => r.loginUser),
        (r) => r.loginUser
      );

-      const loginMappings = Object.entries(loginMappingGrouped).map(([loginUser, entries]) => ({
+      const directMappings = Object.entries(directGrouped).map(([loginUser, entries]) => ({
        loginUser,
        allowedPrincipals: {
          usernames: unique(entries.map((e) => e.username)).filter(Boolean)
-        }
+        },
+        source: LoginMappingSource.HOST
+      }));
+
+      // group login mappings
+      const groupRows = await (tx || db.replicaNode())(TableName.SshHostGroupMembership)
+        .join(
+          TableName.SshHostLoginUser,
+          `${TableName.SshHostGroupMembership}.sshHostGroupId`,
+          `${TableName.SshHostLoginUser}.sshHostGroupId`
+        )
+        .leftJoin(
+          TableName.SshHostLoginUserMapping,
+          `${TableName.SshHostLoginUser}.id`,
+          `${TableName.SshHostLoginUserMapping}.sshHostLoginUserId`
+        )
+        .leftJoin(TableName.Users, `${TableName.SshHostLoginUserMapping}.userId`, `${TableName.Users}.id`)
+        .where(`${TableName.SshHostGroupMembership}.sshHostId`, sshHostId)
+        .select(
+          db.ref("loginUser").withSchema(TableName.SshHostLoginUser),
+          db.ref("username").withSchema(TableName.Users)
+        );
+
+      const groupGrouped = groupBy(
+        groupRows.filter((r) => r.loginUser),
+        (r) => r.loginUser
+      );
+
+      const groupMappings = Object.entries(groupGrouped).map(([loginUser, entries]) => ({
+        loginUser,
+        allowedPrincipals: {
+          usernames: unique(entries.map((e) => e.username)).filter(Boolean)
+        },
+        source: LoginMappingSource.HOST_GROUP
      }));

      return {
@@ -182,7 +297,7 @@ export const sshHostDALFactory = (db: TDbClient) => {
        alias,
        userCertTtl,
        hostCertTtl,
-        loginMappings,
+        loginMappings: [...directMappings, ...groupMappings],
        userSshCaId,
        hostSshCaId
      };
@@ -16,6 +16,11 @@ export type TLoginMapping = {
  };
 };

+export enum LoginMappingSource {
+  HOST = "host",
+  HOST_GROUP = "hostGroup"
+}
+
 export type TCreateSshHostDTO = {
  hostname: string;
  alias?: string;