admin/Dune
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rotate administrator keys with safe re-enable and exact retry

Browse Source
This commit is contained in:
Quintine committed 2026-09-30 00:01:16 +10:00
1 parent 9cf8249398
commit 55b47ce039
20 files changed
+3072 -104
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

db/admin-accounts.ts
+51 -12
View File
@@ -6,6 +6,7 @@ const authority = `SELECT a.role FROM admin_sessions s JOIN admin_accounts a ON
AND s.expires_at>? AND s.generation=a.session_generation`;
const accountFields = 'id,name,role,enabled,created_at,updated_at';
const receiptFields = 'operation_id,actor_admin_id,request_hash,target_admin_id,name,role,enabled,created_at,updated_at';
const allReceipts = `SELECT ${receiptFields} FROM admin_account_operations UNION ALL SELECT ${receiptFields} FROM admin_account_rotations`;
type Account = { id: string; name: string; role: AdminAccountRow['role']; enabled: number; created_at: number; updated_at: number };
type Receipt = Omit<Account, 'id'> & { operation_id: string; actor_admin_id: string; request_hash: string; target_admin_id: string };
const project = (row: Account): AdminAccountRow => ({ id: row.id, name: row.name, role: row.role, enabled: row.enabled === 1, createdAt: row.created_at, updatedAt: row.updated_at });
@@ -43,11 +44,13 @@ export async function applyAdminAccount(database: D1Database, identity: AdminIde
? { action:input.action,id:input.id,key:input.key,name:input.name,role:input.role,reason:input.reason }
: input.action === 'role'
? { action:input.action,target,expectedUpdatedAt:input.expectedUpdatedAt,role:input.role,reason:input.reason }
: { action:input.action,target,expectedUpdatedAt:input.expectedUpdatedAt,reason:input.reason }));
: input.action === 'rotate'
? { action:input.action,target,expectedUpdatedAt:input.expectedUpdatedAt,key:input.key,reason:input.reason }
: { action:input.action,target,expectedUpdatedAt:input.expectedUpdatedAt,reason:input.reason }));
const previous = await database.batch([
database.prepare(authority).bind(...args),
database.prepare(`SELECT ${receiptFields} FROM admin_account_operations WHERE operation_id=? AND EXISTS (${authority})`).bind(input.operationId,...args),
database.prepare(`SELECT ${accountFields} FROM admin_accounts WHERE id=? AND EXISTS (${authority})`).bind(target,...args),
database.prepare(`SELECT ${receiptFields} FROM (${allReceipts}) WHERE operation_id=? AND EXISTS (${authority})`).bind(input.operationId,...args),
database.prepare(`SELECT ${accountFields},key_hash FROM admin_accounts WHERE id=? AND EXISTS (${authority})`).bind(target,...args),
]);
authorized(previous[0]);
const resolve = (receipt: Receipt | undefined, replayed: boolean): AdminAccountResult | null => {
@@ -58,27 +61,63 @@ export async function applyAdminAccount(database: D1Database, identity: AdminIde
};
const existing = resolve(previous[1].results[0] as Receipt | undefined,true);
if (existing) return existing;
const account = previous[2].results[0] as Account | undefined;
const account = previous[2].results[0] as (Account & { key_hash: string }) | undefined;
if (input.action !== 'provision') {
if (target === identity.id) throw new AdminError('You cannot disable or demote your own account.',409);
if (!account || !account.enabled || account.updated_at !== input.expectedUpdatedAt)
if (target === identity.id) throw new AdminError('You cannot change your own account credentials or authority.',409);
if (!account || input.action !== 'rotate' && !account.enabled || account.updated_at !== input.expectedUpdatedAt)
throw new AdminError('The account changed or was disabled. Refresh before choosing a new operation.',409);
if (input.action === 'role' && account.role === input.role)
throw new AdminError('Choose a different role for this account.',409);
}
const nextTime = input.action === 'provision' ? now : Math.max(now,account!.updated_at+1);
if (input.action === 'rotate') {
const keyHash = await fingerprint(input.key);
const result = await database.batch([
database.prepare(authority).bind(...args),
database.prepare(`UPDATE admin_accounts SET key_hash=?,enabled=1,session_generation=session_generation+1,updated_at=?
WHERE id=? AND updated_at=? AND role=? AND key_hash=? AND key_hash<>? AND id!=?
AND NOT EXISTS (SELECT 1 FROM admin_account_retired_keys WHERE key_hash=?)
AND EXISTS (${authority}) AND NOT EXISTS (SELECT 1 FROM admin_account_operations WHERE operation_id=?)
AND NOT EXISTS (SELECT 1 FROM admin_account_rotations WHERE operation_id=?) RETURNING id`)
.bind(keyHash,nextTime,target,input.expectedUpdatedAt,account!.role,account!.key_hash,keyHash,identity.id,keyHash,...args,input.operationId,input.operationId),
database.prepare(`INSERT INTO admin_account_retired_keys (key_hash,admin_id)
SELECT ?,? WHERE changes()=1 AND EXISTS (${authority})`)
.bind(account!.key_hash,target,...args),
database.prepare(`INSERT INTO admin_account_rotations
(operation_id,actor_admin_id,request_hash,target_admin_id,name,role,previous_enabled,enabled,created_at,updated_at,expected_updated_at,reason,rotated_at)
SELECT ?,?,?,?,name,role,?,enabled,created_at,updated_at,?,?,? FROM admin_accounts
WHERE id=? AND changes()=1 AND EXISTS (${authority})`)
.bind(input.operationId,identity.id,requestHash,target,account!.enabled, input.expectedUpdatedAt,reason,now,target,...args),
database.prepare(`INSERT INTO admin_audit (id,actor_admin_id,target_admin_id,action,created_at,detail,reason)
SELECT ?,?,?,'rotate',?,json_object('previousEnabled',?,'enabled',1),?
WHERE changes()=1 AND EXISTS (${authority})`)
.bind(crypto.randomUUID(),identity.id,target,now,account!.enabled,reason,...args),
database.prepare(`UPDATE admin_sessions SET revoked_at=? WHERE admin_id=? AND revoked_at IS NULL
AND changes()=1 AND EXISTS (SELECT 1 FROM admin_account_rotations WHERE operation_id=? AND actor_admin_id=? AND request_hash=? AND target_admin_id=?)
AND EXISTS (${authority})`)
.bind(now,target,input.operationId,identity.id,requestHash,target,...args),
database.prepare(`SELECT ${receiptFields} FROM (${allReceipts}) WHERE operation_id=? AND EXISTS (${authority})`).bind(input.operationId,...args),
]);
authorized(result[0]);
const committed = resolve(result[6].results[0] as Receipt | undefined,result[1].results.length !== 1);
if (committed) return committed;
throw new AdminError('The account or administrator authority changed. Refresh before choosing a new operation.',409);
}
const mutation = input.action === 'provision'
? database.prepare(`INSERT INTO admin_accounts(id,name,role,key_hash,created_at,updated_at)
SELECT ?,?,?,?,?,? WHERE EXISTS (${authority}) AND NOT EXISTS (SELECT 1 FROM admin_account_operations WHERE operation_id=?)
AND NOT EXISTS (SELECT 1 FROM admin_account_rotations WHERE operation_id=?)
AND NOT EXISTS (SELECT 1 FROM admin_accounts WHERE id=?) RETURNING id`)
.bind(input.id,input.name,input.role,await fingerprint(input.key),now,now,...args,input.operationId,input.id)
.bind(input.id,input.name,input.role,await fingerprint(input.key),now,now,...args,input.operationId,input.operationId,input.id)
: input.action === 'role'
? database.prepare(`UPDATE admin_accounts SET role=?,updated_at=? WHERE id=? AND enabled=1 AND updated_at=? AND role=? AND role<>?
AND id!=? AND EXISTS (${authority}) AND NOT EXISTS (SELECT 1 FROM admin_account_operations WHERE operation_id=?) RETURNING id`)
.bind(input.role,nextTime,target,input.expectedUpdatedAt,account!.role,input.role,identity.id,...args,input.operationId)
AND id!=? AND EXISTS (${authority}) AND NOT EXISTS (SELECT 1 FROM admin_account_operations WHERE operation_id=?)
AND NOT EXISTS (SELECT 1 FROM admin_account_rotations WHERE operation_id=?) RETURNING id`)
.bind(input.role,nextTime,target,input.expectedUpdatedAt,account!.role,input.role,identity.id,...args,input.operationId,input.operationId)
: database.prepare(`UPDATE admin_accounts SET enabled=0,updated_at=? WHERE id=? AND enabled=1 AND updated_at=? AND role=?
AND id!=? AND EXISTS (${authority}) AND NOT EXISTS (SELECT 1 FROM admin_account_operations WHERE operation_id=?) RETURNING id`)
.bind(nextTime,target,input.expectedUpdatedAt,account!.role,identity.id,...args,input.operationId);
AND id!=? AND EXISTS (${authority}) AND NOT EXISTS (SELECT 1 FROM admin_account_operations WHERE operation_id=?)
AND NOT EXISTS (SELECT 1 FROM admin_account_rotations WHERE operation_id=?) RETURNING id`)
.bind(nextTime,target,input.expectedUpdatedAt,account!.role,identity.id,...args,input.operationId,input.operationId);
const result = await database.batch([
database.prepare(authority).bind(...args),
mutation,
@@ -94,7 +133,7 @@ export async function applyAdminAccount(database: D1Database, identity: AdminIde
: database.prepare(`UPDATE admin_audit SET actor_admin_id=?,reason=? WHERE id=(
SELECT id FROM admin_audit WHERE target_admin_id=? AND action=? AND actor_admin_id IS NULL ORDER BY rowid DESC LIMIT 1)
AND changes()=1 AND EXISTS (${authority})`).bind(identity.id,reason,target,input.action === 'provision' ? 'provision' : 'revoke',...args),
database.prepare(`SELECT ${receiptFields} FROM admin_account_operations WHERE operation_id=? AND EXISTS (${authority})`).bind(input.operationId,...args),
database.prepare(`SELECT ${receiptFields} FROM (${allReceipts}) WHERE operation_id=? AND EXISTS (${authority})`).bind(input.operationId,...args),
]);
authorized(result[0]);
const committed = resolve(result[4].results[0] as Receipt | undefined,result[1].results.length !== 1);