From dcb6850306dd1f4bc98d31c8ee41f154ba0a13a1 Mon Sep 17 00:00:00 2001 From: Narayanan Madaswamy Date: Sat, 1 Aug 2026 09:51:36 +0530 Subject: [PATCH] Fixed PEM Keys issue --- .DS_Store | Bin 8196 -> 8196 bytes .vscode/launch.json | 4 +- ...rem_to_Cloud_Authentication_Workflow.docx# | 1 - .../cygnus/installer/DeploymentWriter.java | 18 +++ .../cygnus/installer/InstallationService.java | 22 ++++ .../installer/DeploymentWriterTest.java | 81 ++++++++++++ .../nimble/controller/SessionController.java | 20 +-- matrix-installation/.env | 17 --- matrix-installation/compose.yml | 12 -- matrix-installation/config/installation.yml | 13 -- .../config/keys/client-signing-private.pem | 40 ------ .../config/keys/client-signing-public.pem | 11 -- .../config/keys/login-public.pem | 11 -- .../config/machine-assertion.jwt | 1 - scripts/setup-local-communication.sh | 116 +++++++++++++----- 15 files changed, 217 insertions(+), 150 deletions(-) delete mode 100644 .~lock.Cygnus_OnPrem_to_Cloud_Authentication_Workflow.docx# delete mode 100644 matrix-installation/.env delete mode 100644 matrix-installation/compose.yml delete mode 100644 matrix-installation/config/installation.yml delete mode 100644 matrix-installation/config/keys/client-signing-private.pem delete mode 100644 matrix-installation/config/keys/client-signing-public.pem delete mode 100644 matrix-installation/config/keys/login-public.pem delete mode 100644 matrix-installation/config/machine-assertion.jwt diff --git a/.DS_Store b/.DS_Store index 2c3b7dddffb64c2b59f71d3c1feb210d4482807b..42d1eb91cd258dc52a180266ecd45c66c59083f5 100644 GIT binary patch delta 550 zcmZp1XmOYj$z94&%%IDV%#g#7zp-!{`@{y`&FmZ;9Gk5Lt~1tWCYKc?<>V(ZFfiUp zD#*z!E-^5;FCfUs#LU9V#?HaX#m&RZ$1fl#BrGB%DkLT*A|@^&DJ3l<9WNl9l$e~I zUX)*&m*SkClV9YNQ<@r`UX+;l3Gy`oLQ9`FCc`bG$=JC4lGm;)*ez> z08}J`rpUc0H8l@xpnqCgacW5f5<4;~u_6R+Jb!U=QGQNNKz?y%NoIatWK3~Jez|8! zYOZHqT0YSBvdq+S{{oOyaad|mF_4ZIfas}*Yl?_WEGkOOOHXyGjLk_*O3m@lbILC% z$Xm|vW)tS z7L1OJUW`7Bp^RaS>5K)8rHo~a^$;VN7$G!+9F&Gqj18OL33@VZEc?K?nO))=%Vt?& KDaMUuZy5pn!k1P6 delta 100 zcmZp1XmOYj$(_lN?wOOHoRpKFw6Sm+`@{y`&FmZ;9GYwl$qe}nc?@X`NGcc@7zBXW p35fOng8>7>W*&iCjGI3Rt1?Y?kWtti&a;7eGrPn$mW>tc%m5_5AIAUy diff --git a/.vscode/launch.json b/.vscode/launch.json index 993e443..20f11d0 100644 --- a/.vscode/launch.json +++ b/.vscode/launch.json @@ -64,9 +64,9 @@ "CYGNUS_TOKEN_URL": "http://localhost:8090/oauth2/token", "CYGNUS_CLIENT_ID": "matrix", "CYGNUS_INSTALLATION_ID": "matrix-delhi-cygnus-01", - "CYGNUS_CLIENT_ASSERTION": "file:${workspaceFolder}/matrix-installation/config/machine-assertion.jwt", + "CYGNUS_CLIENT_ASSERTION": "file:${workspaceFolder}/config/clients/matrix/matrix-matrix-delhi-cygnus-01-assertion.jwt", "CYGNUS_LOGIN_KEY_ID": "cygnus-login-2026-01", - "CYGNUS_LOGIN_PUBLIC_KEY": "file:${workspaceFolder}/matrix-installation/config/keys/login-public.pem", + "CYGNUS_LOGIN_PUBLIC_KEY": "file:${workspaceFolder}/config/keys/login-public.pem", "CYGNUS_CLOUD_REQUEST_TIMEOUT": "PT10S", "CYGNUS_TOKEN_REFRESH_SKEW": "PT30S" }, diff --git a/.~lock.Cygnus_OnPrem_to_Cloud_Authentication_Workflow.docx# b/.~lock.Cygnus_OnPrem_to_Cloud_Authentication_Workflow.docx# deleted file mode 100644 index 451fe35..0000000 --- a/.~lock.Cygnus_OnPrem_to_Cloud_Authentication_Workflow.docx# +++ /dev/null @@ -1 +0,0 @@ -,maddy,Narayanans-MacBook-Pro.local,27.07.2026 21:29,file:///Users/maddy/Library/Application%20Support/LibreOffice/4; \ No newline at end of file diff --git a/cygnus-installer/src/main/java/com/cygnus/installer/DeploymentWriter.java b/cygnus-installer/src/main/java/com/cygnus/installer/DeploymentWriter.java index 764cd17..a5ba958 100644 --- a/cygnus-installer/src/main/java/com/cygnus/installer/DeploymentWriter.java +++ b/cygnus-installer/src/main/java/com/cygnus/installer/DeploymentWriter.java @@ -30,6 +30,7 @@ public class DeploymentWriter { try { Path normalizedOutput = output.toAbsolutePath().normalize(); Path config = normalizedOutput.resolve("config"); + protectCloudConfiguration(config, profile); Path keyDirectory = config.resolve("keys"); Files.createDirectories(keyDirectory); @@ -82,6 +83,23 @@ public class DeploymentWriter { } } + private void protectCloudConfiguration(Path deploymentConfig, ProductProfile profile) { + if (isInside(deploymentConfig, profile.assertionEncryptionPublicKey()) + || isInside(deploymentConfig, profile.loginEncryptionPublicKey())) { + throw new IllegalArgumentException( + "Refusing to write deployment files over the cloud-service " + + "configuration directory"); + } + } + + private boolean isInside(Path directory, Path file) { + if (file == null) { + return false; + } + return file.toAbsolutePath().normalize().startsWith( + directory.toAbsolutePath().normalize()); + } + private String installationConfiguration( UUID installationUuid, String installationCode, diff --git a/cygnus-installer/src/main/java/com/cygnus/installer/InstallationService.java b/cygnus-installer/src/main/java/com/cygnus/installer/InstallationService.java index 3844389..a8c62f8 100644 --- a/cygnus-installer/src/main/java/com/cygnus/installer/InstallationService.java +++ b/cygnus-installer/src/main/java/com/cygnus/installer/InstallationService.java @@ -156,6 +156,7 @@ public class InstallationService { if (request.outputDirectory() == null) { throw new IllegalArgumentException("Output directory is required"); } + validateOutputIsolation(request.outputDirectory()); RuntimeConfiguration runtime = request.runtimeConfiguration(); if (runtime == null) { throw new IllegalArgumentException("Runtime configuration is required"); @@ -204,6 +205,27 @@ public class InstallationService { } } + private void validateOutputIsolation(Path outputDirectory) { + Path deploymentConfig = outputDirectory + .toAbsolutePath() + .normalize() + .resolve("config"); + if (isInside(deploymentConfig, profile.assertionEncryptionPublicKey()) + || isInside(deploymentConfig, profile.loginEncryptionPublicKey())) { + throw new IllegalArgumentException( + "Output directory would overwrite the cloud-service config folder. " + + "Select a dedicated deployment directory, such as " + + "'matrix-installation'."); + } + } + + private boolean isInside(Path directory, Path file) { + if (file == null) { + return false; + } + return file.toAbsolutePath().normalize().startsWith(directory); + } + private String normalizedCloudServiceUrl(String value) { String normalized = value.trim(); return normalized.endsWith("/") diff --git a/cygnus-installer/src/test/java/com/cygnus/installer/DeploymentWriterTest.java b/cygnus-installer/src/test/java/com/cygnus/installer/DeploymentWriterTest.java index 7885666..07c9ec7 100644 --- a/cygnus-installer/src/test/java/com/cygnus/installer/DeploymentWriterTest.java +++ b/cygnus-installer/src/test/java/com/cygnus/installer/DeploymentWriterTest.java @@ -1,6 +1,7 @@ package com.cygnus.installer; import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; import java.net.URI; import java.nio.file.Files; @@ -121,4 +122,84 @@ class DeploymentWriterTest { assertThat(output.resolve("config/keys/client-signing-private.pem")) .isRegularFile(); } + + @Test + void refusesToOverwriteCloudServiceConfiguration() throws Exception { + Path cloudConfig = temporaryDirectory.resolve("config"); + Path cloudKeys = cloudConfig.resolve("keys"); + Files.createDirectories(cloudKeys); + Path assertionPublic = cloudKeys.resolve("assertion-decryption-public.pem"); + Path loginPublic = cloudKeys.resolve("login-public.pem"); + Files.writeString(assertionPublic, "assertion-public-key"); + Files.writeString(loginPublic, "login-public-key"); + + var profile = new ProductProfile( + "matrix", + "Matrix", + "matrix-onprem", + "MATRIX_IMAGE", + "matrix", + "installation.yml", + "MATRIX_INSTALLATION_CONFIG", + "/srv/matrix/config/installation.yml", + "8080:8080", + "/matrix/", + "/oauth2/token", + assertionPublic, + loginPublic, + "cygnus-login-2026-01", + List.of()); + + assertThatThrownBy(() -> new DeploymentWriter().write( + temporaryDirectory, + UUID.randomUUID(), + "primary", + "matrix-client", + new ActivationDtos.ValidationResponse( + "activation-token", + OffsetDateTime.now().plusMinutes(5), + UUID.randomUUID(), + "matrix-client", + "FULL", + 2), + new ActivationDtos.RegistrationResponse( + UUID.randomUUID(), + UUID.randomUUID(), + UUID.randomUUID(), + null, + "primary", + 1, + "ACTIVE"), + new InstallationKeyService().generate(), + "assertion", + new InstallerSettings( + "matrix", + URI.create("https://cloud.example.com"), + URI.create("https://cloud.example.com"), + "/api/v1/installations", + "production", + temporaryDirectory, + temporaryDirectory, + "1", + new IniDocument(Map.of())), + profile, + "registry.example.com/matrix:1.0.0", + Map.of(), + new RuntimeConfiguration( + "https://cloud.example.com", + "jdbc:postgresql://db/matrix", + "postgres", + "secret", + "redis", + "7901", + "secret", + false, + "PT10S", + "PT30S"))) + .isInstanceOf(IllegalArgumentException.class) + .hasMessageContaining("cloud-service configuration"); + + assertThat(assertionPublic).hasContent("assertion-public-key"); + assertThat(loginPublic).hasContent("login-public-key"); + } } diff --git a/cygnus-onprem-app/src/main/java/matrix/nimble/controller/SessionController.java b/cygnus-onprem-app/src/main/java/matrix/nimble/controller/SessionController.java index 7d2c402..0cce47b 100644 --- a/cygnus-onprem-app/src/main/java/matrix/nimble/controller/SessionController.java +++ b/cygnus-onprem-app/src/main/java/matrix/nimble/controller/SessionController.java @@ -1,7 +1,5 @@ package matrix.nimble.controller; -import java.util.Map; - import matrix.nimble.cloud.identity.CloudAuthenticationException; import matrix.nimble.cloud.identity.CloudAuthenticationGateway; import matrix.nimble.model.Login; @@ -27,18 +25,12 @@ public class SessionController { public SessionController(CloudAuthenticationGateway cloudAuthenticationGateway) { this.cloudAuthenticationGateway = cloudAuthenticationGateway; } - // @RequestMapping(value="login",method=RequestMethod.POST ) - // public String LoginPage(ModelMap model,@RequestHeader Map headers) - // { - // model.addAttribute("login", new Login()); - // String host = headers.get("host").toString(); - // if(!host.contains("192.168.10.205:8585") && - // !host.contains("192.168.10.250:8585") && - // !host.startsWith("localhost:") && !host.startsWith("127.0.0.1:")) { - // return "error"; - // } - // return "login"; - // } + @RequestMapping(value="login", method={RequestMethod.GET, RequestMethod.POST}) + public String LoginPage(ModelMap model) + { + model.addAttribute("login", new Login()); + return "login"; + } @RequestMapping(value="logout",method=RequestMethod.POST ) public String LogoutPage(HttpServletRequest request, ModelMap model,@ModelAttribute(value="Sessvals") Session Sessvals) { diff --git a/matrix-installation/.env b/matrix-installation/.env deleted file mode 100644 index 533ce63..0000000 --- a/matrix-installation/.env +++ /dev/null @@ -1,17 +0,0 @@ -MATRIX_IMAGE="hub.technobeesolutions.in/matrix-onprem:1.0.0" -MATRIX_DB_URL="jdbc:postgresql://103.125.129.116:5333/matrix" -MATRIX_DB_USERNAME="postgres" -MATRIX_DB_PASSWORD="M@triXR3d1s@6202" -REDIS_HOST="103.125.129.116" -REDIS_PORT="7901" -REDIS_PASSWORD="M@triXR3d1s@6202" -REDIS_SSL="false" -CYGNUS_CLOUD_BASE_URL="http://host.docker.internal:8090" -CYGNUS_TOKEN_URL="http://host.docker.internal:8090/oauth2/token" -CYGNUS_CLIENT_ID="matrix" -CYGNUS_INSTALLATION_ID="matrix-delhi-cygnus-01" -CYGNUS_CLIENT_ASSERTION="file:/opt/matrix/config/machine-assertion.jwt" -CYGNUS_LOGIN_KEY_ID="cygnus-login-2026-01" -CYGNUS_LOGIN_PUBLIC_KEY="file:/opt/matrix/config/keys/login-public.pem" -CYGNUS_CLOUD_REQUEST_TIMEOUT="PT10S" -CYGNUS_TOKEN_REFRESH_SKEW="PT30S" diff --git a/matrix-installation/compose.yml b/matrix-installation/compose.yml deleted file mode 100644 index a94764f..0000000 --- a/matrix-installation/compose.yml +++ /dev/null @@ -1,12 +0,0 @@ -services: - matrix-onprem: - image: ${MATRIX_IMAGE:?Set MATRIX_IMAGE} - restart: unless-stopped - ports: - - "8080:8080" - volumes: - - ./config:/opt/matrix/config:ro - env_file: - - ./.env - environment: - MATRIX_INSTALLATION_CONFIG: /opt/matrix/config/installation.yml diff --git a/matrix-installation/config/installation.yml b/matrix-installation/config/installation.yml deleted file mode 100644 index 1915999..0000000 --- a/matrix-installation/config/installation.yml +++ /dev/null @@ -1,13 +0,0 @@ -matrix: - product: "matrix" - cloud-url: "http://host.docker.internal:8090" - token-url: "http://host.docker.internal:8090/oauth2/token" - tenant-id: "00000000-0000-4000-8000-000000000001" - client-id: "matrix" - installation-id: "5aecfd98-dcd0-4ac4-b973-2b65b7ceda08" - installation-uuid: "579a040e-6803-4648-a9ef-74733cc94a21" - installation-code: "matrix-delhi-cygnus-01" - environment: "production" - machine-assertion: "file:./config/machine-assertion.jwt" - signing-private-key: "file:./config/keys/client-signing-private.pem" - signing-public-key: "file:./config/keys/client-signing-public.pem" diff --git a/matrix-installation/config/keys/client-signing-private.pem b/matrix-installation/config/keys/client-signing-private.pem deleted file mode 100644 index 34c51bb..0000000 --- a/matrix-installation/config/keys/client-signing-private.pem +++ /dev/null @@ -1,40 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQDoPaKADkY3b17L -Qx1lHpmR/VRl+ypyYnefVvHTqEiJ9fC5epsn+GUFLA4F4IyhDECpwMNOlW0GkFzP -ZpIlFCLXaHaMrCNVQNL2oZXDoFcK6IEod9F5dK0gjdFvDCKROhNfVQJ6wtLmgF9o -AO946i0vUfpdMGr+p2LF4Jqyo5y7BlKF+Vq1wFipCG2qaEqMiyOHd7QJ7+aPbKaZ -XdYlh410I7gOefOd7C8VMNl8bHQmpKh4i987NlNaN3tLR2tfLw2N1xWAijXpYXe8 -lzNaCtA1cVnEOIsLwmFoQ61jfSIH11h8ZqxIXFt/0gfSUNoM3cn+ujm6x4gwqbcN -z3uzglhewHJvCVuzmlZRr1iAjz9jOo1Q9tJMEon2Jr41Wopby18mgwk6xoceZMrN -ApRiONA9IkT1F5N6F6jwQjZFkEEgKq5X30ayIfTT9Ya57b+4BBEW6gYPEnwcaMPa -S/5L1IxkZ1zAVM9Fs4vw7OLzwO+oIm1HfpDiBidTf6McLDFWhPECAwEAAQKCAYAK -o3Un0M+UX0KMRN4qOUs/YeeNduKYRAy3BL5168fr4vNkqbpFC9bD1INtbz5965/k -Ls97kHKCuhb4TLpt3qTkcXV5xvJk57/qOpdv007dce5ltkxnGApMuxZglAGa3bpQ -tAYVrcpHsxJ7www1QaPxfpu9jFfgY7ZNencXrxFBS345AyXNvNqK3rcYVufwVXja -jigWCvJouElO7fqe9D1NeEvohNtdLPowqjDSR20QLpuFjyG6Fohdsfwww/wmC3OJ -BdO9KyBeq7RA5cTYsCOstfp1vPc8iuTUCmsLqp7DUfuHe4CdxphmTPxZ5uBzpnw4 -9xECl6nGC/U94Utm+uz3EqF+ZcRX+TWyTNVnay86OXNIgYFHfxz/uf3/9dBy1yud -R7c8cw4bzdxPTXtXUHSgRZK/A9xNshOKiMVpw9AufkMZy/ddT44GDAmkPcJfExIN -ybr0Hn10DHPpTyghYOSOEfd/+Onh5ZwgO+kIPRtJud9MRjDVYAjBG0GZr3JE28EC -gcEA7FWbIW9z4VVxbmMV9yiAmeFlXRLUSFED7GBY9kemBf0lT34Sjz/8dxCD9EQg -qusKf/4djmDI7WnTWrO9WEt2Xi98PnPiOlwb6P4PkLwcswLcRhnlzYEGl873Swrd -bUFS1CbS3yPOjILmlsqir8bKE1LO76P+ZPPa33TpcUB9hdeW9Lx27mkxrw+i0IGX -3WSu5l68IlNERG5CgDd93FNN/TS9VNddvzuTAWcvmYB1YuRGjlQQ5p4dG1AtH1Vg -N9URAoHBAPuQ034lCmyT1AdGoVQXI3slQ4HP5kf03fa+yywvUZxAAd6M/NRDS0U5 -ZVlo15Ehf8S4ICrv2yk4uSbPW4tP9S2XxGYMkc8mqDJvX3LcQgX0eXrt/yiMP3kT -oqK9jrXt3+YT/Bo6T1rlBrOQ8jclveryfvpjjkxwXtmB/3kagUmjzglvDZs+yyE5 -3jelxO4k9pvLEB9h7xz7pjMNHr3j2KTIxZA6jG8zUKmuPxooTOtnnPlFWgpnhySa -i8pf+Lwx4QKBwEHKQvk30YZ1BrK4GrFHMSWlPVZ/m2DWTMVMvPcyUuFv6ycJ7Zi7 -M0jh7BnfrUhnTfD7iLbN8qFEyHWDe75Mo5LsnSW1lNCyO4LM1wBvnX2n2jIZm4Nt -26v/DZByYdm8SZaNiD5d9W3gMtjfaBKOwEpIzxqfCH6J8/Ao16OTVF4h+f//Rwxv -dElLjQOGUARtttKipLTZgTObjh+rUvo2potKVzp7Cbnml7HYS8ProsH40jtk45+P -fILR+v2yAqsIQQKBwG8q69sFwVqD5SGl+6ruYraLnA5kcg4AToo4fA41hun2exz+ -zsd6SWv41imxo/k1hYHIICb5Qa8wqtlUrs6ccetI8vhpu5GAMrm+774RSXfaNki1 -nZksiOwXWjpya/tHeDbzQ+fPNrwjE1gMyIzIN+n4aVZ64iozSibyRJQeu11wbp9K -nQeqsxcmvGV48tKOMRBdpu1HWORE7IgI1znw0w7Wzj9TMDX/xjiFkMsdXgh1DDA3 -jnekklsBlJ7E1GVN4QKBwQCWZTs5UcE+0At58AyN3fK+g3f0Bon9TNhqmmQ+ZB/N -StWe1Kc95DlS75jeEMX6xEhdXX7VMNbLEvNroh8xA307x/zWs4znkbsY1ONg16W/ -beqEfnr7szk/3KcLh6UE0FswHDxMZwprNhYDT/Eo5GLC4uzIE6wy2Nznmhh6IJ2R -Ujv6Wh5+nvLX0M+RzZaNj2WI5j1kkA6EwQFVS7srBQlqChRGa2n7pOV1UxRKjfsf -SO8FID8TwwH38mtCqMgIDLU= ------END PRIVATE KEY----- diff --git a/matrix-installation/config/keys/client-signing-public.pem b/matrix-installation/config/keys/client-signing-public.pem deleted file mode 100644 index 6833326..0000000 --- a/matrix-installation/config/keys/client-signing-public.pem +++ /dev/null @@ -1,11 +0,0 @@ ------BEGIN PUBLIC KEY----- -MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA6D2igA5GN29ey0MdZR6Z -kf1UZfsqcmJ3n1bx06hIifXwuXqbJ/hlBSwOBeCMoQxAqcDDTpVtBpBcz2aSJRQi -12h2jKwjVUDS9qGVw6BXCuiBKHfReXStII3RbwwikToTX1UCesLS5oBfaADveOot -L1H6XTBq/qdixeCasqOcuwZShflatcBYqQhtqmhKjIsjh3e0Ce/mj2ymmV3WJYeN -dCO4DnnznewvFTDZfGx0JqSoeIvfOzZTWjd7S0drXy8NjdcVgIo16WF3vJczWgrQ -NXFZxDiLC8JhaEOtY30iB9dYfGasSFxbf9IH0lDaDN3J/ro5useIMKm3Dc97s4JY -XsBybwlbs5pWUa9YgI8/YzqNUPbSTBKJ9ia+NVqKW8tfJoMJOsaHHmTKzQKUYjjQ -PSJE9ReTeheo8EI2RZBBICquV99GsiH00/WGue2/uAQRFuoGDxJ8HGjD2kv+S9SM -ZGdcwFTPRbOL8Ozi88DvqCJtR36Q4gYnU3+jHCwxVoTxAgMBAAE= ------END PUBLIC KEY----- diff --git a/matrix-installation/config/keys/login-public.pem b/matrix-installation/config/keys/login-public.pem deleted file mode 100644 index 5243598..0000000 --- a/matrix-installation/config/keys/login-public.pem +++ /dev/null @@ -1,11 +0,0 @@ ------BEGIN PUBLIC KEY----- -MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAvbjaZHePDwZQj1R1s23I -CSR6SzUi707WsGHoJZLLcFruXGTreNWIonU8Ye+iHwCUIJVhhoz0d7eGdfUc70ZO -Kn7dKfTfdsiWJi5RiM6loUk8iSAjrgh07chUgyL6luak7ZNevmWTCkSIuvVV9UZe -ZiH5Xh99zXr6Y0cLs7TcB0Tfc3y72dtU9VLjqhcc7KYibzHDWWfwVcpG7mkmmkEM -2tDHGmiZGoKk9uJoSMesh4w7XPE+UHxMEsK2wXpZLrwlN9ikxk56Cd/Z016MkkXZ -mMAofaTQ8NtfV/UuJjALUER0REJ8jb3qXBq5Pgh2ZkpmSaysZQPpNdll5SSHjhVV -t/UQ2QNgZiBh5bHZGpZJIvZ4E3RQ1Dtj2Q/QtSKgbffY3owNLu+2Lb/qQ90JV580 -dMg8D+89uy+MOL8JpQxHvTjKk5tqFlBhmVo+Y9i2KfPgv3rM1R3q+A4j9hN37x+a -f2tulHI5quy0KLbANp/32qlVVgd6TgnMikWCkwNpo7YZAgMBAAE= ------END PUBLIC KEY----- diff --git a/matrix-installation/config/machine-assertion.jwt b/matrix-installation/config/machine-assertion.jwt deleted file mode 100644 index 8da68d3..0000000 --- a/matrix-installation/config/machine-assertion.jwt +++ /dev/null @@ -1 +0,0 @@ -eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.D21KmNzi4shZx538-fArwUt0frd6nViAjl3E4ptHYfVlxWb5700VrK5HuLBl5fi2mG2e7ymeEGun83Qg7NMCl0-H9Df5vmjDwoQWzzVPS2TEcn0PhsyrHXWi7d3H2pHZUT9o8vHcVRSg9ROIofrwO-yUzGSixDxoEeIRQm3k3MSuuGOBp6MwTGthskPpAhYTJbFs9LNvMgJGJb3Sg4F0Ycz2bSFP_eqfIwKvkCcDOh-sjXK-1F0bDuZpeG0-Wh3L6uX7tdQmAm6NIm1sxVKB9dKwff_oryMGu-PgsIzeiGwCD50UelQVe1LLGayew_ysNt8PoGnVAJQrXMsF9tZG11dcQiqS8Xze78U6Z2seiEhGAchE5A3UB60FHkY_iJ7JA_k9u-AhH994KF0eUGI8zcIFCj53vc2oNd6ortVq1CPyUn9GD3QD8xEIfrRreYWI94Fhf5od_i2YduMtVzY-MhGFTjElNKdnfaajCVQIRb-sMDOmxSDgeT_uVYiAcAU_.PQaHgpGtExOh36HB.9k2OZPRwFc5etToeQtTJ9cjT5n3RwMTnffLIw56Co0eEEZ-szIBJXiwdqJoOpp5MG7uz8kNXSwhfnz1v5JTD6FEqpJ0886wr30eJTpQE9Mi0XIwrzFS0IddAa4lgdOcgY_mgs4HQv9TAy-0a9eg7tZwpLjGutTCZHMW5oS_mzr-DIw2qkEanpK8M2ZH6uO8P15h2E2D-WPPCZ4lJes7qA5tOaU8c5UlauWtkTR0HL-pQw348UincBIYwap5dT5j1ToUrkhXUzo_rxfFdZ9H8_jEOnFbaltOH90aVhIMKGDfqKWQIgjdEXA8VgwfdcfwJxKuF-Jhz7FpRyEEoXDM4ios4D9a576dqM_1AtnsgmmHuCGvsgZ3aEuZlWDjOJT7-qkvWEDg4_tuiLYZV69ZIUNzUwxS9uqPizO_W79yV-e0DblGH0lSZwToFq3UHhorxXxAGn4hCqgW5l5xqjrF_sfooZwLYi9v2BKONRj_2TrVbbM7g7EJ4eoaEVftBzdTSARMogpR8NzNUTNcl08p59kiYsbx2yOFtBP6G6_jicjeyv-8fPopmPcLzpo0XCX6dF_toSL3bQsmcTSwmtv70lxKJk383cATJjVjI9ulDeOJbB5_ebudIkIFmQ_gMJuXp5A1rVC9aV_-Ppfq7lmtVv-o3SIft_qh_ihdOe8UxA99yt3IWq9-pfwQry0cH5gGqG4g43-CTNyt4xl_xAYEgFyBG9on2r6hIEFdQ7OJw32V308m3xPI-gHp5_z2yn82cBNskImS56a6ffj05kDuI-1e_1s1EhAZW8X-Z-weWCCv00Co2P1haS_9MjzGfcRW06tbAxsyrJ8xy8yIp97_8S9sgCHeYr3ig7CCDTnOCCIW5jwcFJDF8jWYP8H_3oKpAqgUH867Ar-eAktF4z6Kv6NGji4h4dCPWLGNdD_CglfM6ST0BKizE45leiyxEEDIkIuwBD7lxcy_ItJdVs9ejew.2oEBIqW9A6rXQbyMWu85ew \ No newline at end of file diff --git a/scripts/setup-local-communication.sh b/scripts/setup-local-communication.sh index 2a4d143..6e3f624 100644 --- a/scripts/setup-local-communication.sh +++ b/scripts/setup-local-communication.sh @@ -228,60 +228,120 @@ register_client_in_database() { -d "${DB_NAME_VALUE}" \ -X -v ON_ERROR_STOP=1 \ -c " - WITH account AS ( + WITH registration AS ( + SELECT registration_id + FROM identity.client_registration_details + WHERE lower(client_code) = lower( + convert_from(decode('${client_id_b64}', 'base64'), 'UTF8')) + AND status = 'ACTIVE' + ORDER BY created_at + LIMIT 1 + ), account AS ( INSERT INTO identity.client_account - (tenant_id, client_slug, client_name, status) - VALUES ( + (tenant_id, registration_id, client_slug, client_name, status) + SELECT gen_random_uuid(), + registration_id, convert_from(decode('${client_id_b64}', 'base64'), 'UTF8'), convert_from(decode('${client_name_b64}', 'base64'), 'UTF8'), - 'ACTIVE') + 'ACTIVE' + FROM registration ON CONFLICT (client_slug) DO UPDATE SET + registration_id = EXCLUDED.registration_id, client_name = EXCLUDED.client_name, status = 'ACTIVE', updated_at = now() RETURNING tenant_id - ), installation AS ( - INSERT INTO identity.client_installation - (installation_id, tenant_id, client_id, installation_code, - assertion_public_key, allowed_scopes, enabled) + ), new_license AS ( + INSERT INTO identity.client_license + (license_id, tenant_id, license_type, package_code, + valid_from, valid_until, status) SELECT gen_random_uuid(), tenant_id, + convert_from(decode('${license_type_b64}', 'base64'), 'UTF8'), + convert_from(decode('${package_code_b64}', 'base64'), 'UTF8'), + now(), + now() + make_interval(months => ${LICENSE_MONTHS}), + 'ACTIVE' + FROM account + WHERE NOT EXISTS ( + SELECT 1 + FROM identity.client_license existing + WHERE existing.tenant_id = account.tenant_id + AND existing.status = 'ACTIVE' + AND existing.valid_until > now() + ) + RETURNING license_id, tenant_id + ), selected_license AS ( + SELECT existing.license_id, existing.tenant_id + FROM identity.client_license existing + JOIN account ON account.tenant_id = existing.tenant_id + WHERE existing.status = 'ACTIVE' + AND existing.valid_until > now() + UNION ALL + SELECT license_id, tenant_id + FROM new_license + ORDER BY license_id + LIMIT 1 + ), installation AS ( + INSERT INTO identity.client_installation + (installation_id, tenant_id, client_id, installation_code, + assertion_public_key, allowed_scopes, enabled, license_id, + installation_uuid, installation_name, status, + software_version, environment) + SELECT + gen_random_uuid(), + account.tenant_id, convert_from(decode('${client_id_b64}', 'base64'), 'UTF8'), convert_from(decode('${installation_b64}', 'base64'), 'UTF8'), convert_from(decode('${public_key_b64}', 'base64'), 'UTF8'), ARRAY['identity.login']::text[], - true + true, + selected_license.license_id, + gen_random_uuid(), + convert_from(decode('${client_name_b64}', 'base64'), 'UTF8') + || ' ' || + convert_from(decode('${installation_b64}', 'base64'), 'UTF8'), + 'ACTIVE', + 'development', + 'development' FROM account + JOIN selected_license + ON selected_license.tenant_id = account.tenant_id ON CONFLICT (client_id, installation_code) DO UPDATE SET tenant_id = EXCLUDED.tenant_id, assertion_public_key = EXCLUDED.assertion_public_key, allowed_scopes = EXCLUDED.allowed_scopes, enabled = true, + license_id = EXCLUDED.license_id, + status = 'ACTIVE', security_version = identity.client_installation.security_version + 1, updated_at = now() RETURNING tenant_id ) - INSERT INTO identity.client_license - (license_id, tenant_id, license_type, package_code, - valid_from, valid_until, status) - SELECT - gen_random_uuid(), - tenant_id, - convert_from(decode('${license_type_b64}', 'base64'), 'UTF8'), - convert_from(decode('${package_code_b64}', 'base64'), 'UTF8'), - now(), - now() + make_interval(months => ${LICENSE_MONTHS}), - 'ACTIVE' - FROM installation - WHERE NOT EXISTS ( - SELECT 1 - FROM identity.client_license existing - WHERE existing.tenant_id = installation.tenant_id - AND existing.status = 'ACTIVE' - AND existing.valid_until > now() - );" + SELECT count(*) AS provisioned_installations + FROM installation;" + + local installation_count + installation_count="$( + PGPASSWORD="${DB_PASSWORD_VALUE}" "${PSQL_BIN}" \ + -h "${DB_HOST_VALUE}" \ + -p "${DB_PORT_VALUE}" \ + -U "${DB_USER_VALUE}" \ + -d "${DB_NAME_VALUE}" \ + -X -A -t \ + -c " + SELECT count(*) + FROM identity.client_installation + WHERE client_id = + convert_from(decode('${client_id_b64}', 'base64'), 'UTF8') + AND installation_code = + convert_from(decode('${installation_b64}', 'base64'), 'UTF8') + AND enabled = true;" + )" + [[ "${installation_count//[[:space:]]/}" == "1" ]] || fail \ + "No active registration/account was found for '${CLIENT_ID}'. Create or activate client_registration_details first." } generate_machine_assertion() {