msa-agent/cmd/msa-agent/enroll.go

package main

import (
	"context"
	"crypto/ed25519"
	"encoding/json"
	"fmt"
	"log/slog"
	"os"
	"path/filepath"
	"time"

	"fun.chick/msa-agent/internal/config"
	"fun.chick/msa-agent/internal/enroll"
	"fun.chick/msa-agent/internal/install"
	"fun.chick/msa-agent/internal/policy"
	"fun.chick/msa-agent/internal/transport"
)

// EnrollOptions is what `msa-agent enroll` was asked to do.
type EnrollOptions struct {
	ConfigPath      string
	RelayURL        string
	LocalPort       int
	AuditPath       string
	NodeID          string
	AgentToken      string
	ProvisionSecret string
	RelayCAFile     string
	NodePassword    string
	// Code is a one-time enrollment code. When set, the node registers itself with the relay and does
	// not print a registration entry for anyone to copy.
	Code string
	// Force overwrites an existing config. Without it, an existing file is a refusal rather than an
	// overwrite, because the file holds the node's private keys: replacing it silently would unpair
	// every phone and orphan the node at the relay.
	Force bool
	// PrintOnly mints and prints without writing anything.
	PrintOnly bool
}

// runEnroll mints this node's identity and writes its config, optionally registering with the relay.
//
// It is the on-node counterpart of `msa-keygen`, and both call internal/enroll, so the two cannot
// disagree about what a config looks like. The difference is where they run: msa-keygen needs a Go
// toolchain, which a node with a cross-compiled binary does not have.
func runEnroll(ctx context.Context, opts EnrollOptions) error {
	if _, err := os.Stat(opts.ConfigPath); err == nil && !opts.Force && !opts.PrintOnly {
		return fmt.Errorf("%s already exists; pass --force to replace it (this discards the node's keys "+
			"and unpairs every phone)", opts.ConfigPath)
	}

	result, err := enroll.Generate(enroll.Options{
		RelayURL:        opts.RelayURL,
		LocalPort:       opts.LocalPort,
		AuditPath:       opts.AuditPath,
		NodeID:          opts.NodeID,
		AgentToken:      opts.AgentToken,
		ProvisionSecret: opts.ProvisionSecret,
		RelayCAFile:     opts.RelayCAFile,
		NodePassword:    opts.NodePassword,
	})
	if err != nil {
		return err
	}

	if opts.PrintOnly {
		os.Stdout.Write(result.Config)
		fmt.Fprintf(os.Stderr, "\n# relay registration\n%s\n", result.Registration)
		fmt.Fprintf(os.Stderr, "# pairing secret: %s\n", result.ProvisionSecret)
		return nil
	}

	// The registration goes first, and that order is the point of this command: a config written for a
	// relay that does not know the node is a node that retries 401 forever, and an operator has no way
	// to tell that apart from a network problem.
	if opts.Code != "" {
		var registration enroll.Registration
		if err := json.Unmarshal(result.Registration, &registration); err != nil {
			return fmt.Errorf("enroll: decoding the registration: %w", err)
		}
		if err := enroll.Register(ctx, enroll.RegisterOptions{
			RelayURL:     opts.RelayURL,
			Code:         opts.Code,
			Registration: registration,
			RelayCAFile:  opts.RelayCAFile,
		}); err != nil {
			// Nothing has been written, so a retry with a fresh code is safe and the node is untouched.
			return err
		}
		slog.Info("relay accepted the enrollment", "node", result.NodeID, "relay", opts.RelayURL)
	}

	if err := os.MkdirAll(filepath.Dir(opts.ConfigPath), 0o755); err != nil {
		return err
	}
	// 0600: private keys, the relay bearer, and the node password when the node is protected.
	if err := os.WriteFile(opts.ConfigPath, result.Config, 0o600); err != nil {
		return err
	}

	fmt.Printf("node id:        %s\n", result.NodeID)
	fmt.Printf("wrote config:   %s (mode 0600)\n", opts.ConfigPath)
	if opts.Code == "" {
		// Without a code the relay still has to be told by hand, so the entry is printed for copying.
		fmt.Printf("\n# the relay does not know this node yet. Add this to its agents.json:\n%s\n", result.Registration)
	}
	fmt.Printf("\npairing secret: %s\n", result.ProvisionSecret)
	fmt.Printf("  (only needed on an unprotected node; a node with nodePassword uses that instead)\n")
	fmt.Printf("\nnext: systemctl enable --now msa-agent, then `msa-agent --pair` once and pair from the app\n")
	return nil
}

// runUninstall removes the agent from this node.
//
// The relay is told first, through the same mechanism a revocation uses: the device list is emptied and
// the relay is told directly, so it retires this node's device bearers before the node stops existing.
// Removing the node first would leave the relay routing to a node that is gone.
func runUninstall(ctx context.Context, opts install.Options, configPath string) error {
	// A dry run needs no privileges: it reads nothing and removes nothing, and an operator checking
	// what an uninstall would do should not have to be root to ask.
	if !opts.DryRun {
		if err := install.RequireRoot(); err != nil {
			return err
		}
	}
	paths := install.DefaultPaths()
	// The config path is a flag, so it can differ from the layout the defaults assume.
	paths.ConfigPath = configPath
	opts.Paths = paths

	if opts.NotifyRelay == nil && !opts.DryRun {
		opts.NotifyRelay = func() error { return retireAtRelay(ctx, configPath) }
	}
	return install.Uninstall(opts)
}

// retireAtRelay empties the paired-device list and tells the relay, so it drops this node's bearers.
//
// It talks to the relay itself rather than waiting for the running agent to notice. The agent does
// notice — it re-reads its config every poll cycle — but a poll window is 24 seconds, and making an
// uninstall wait on one, with a timeout, to learn something it can say in one round trip is a worse
// trade than holding a session for two requests.
//
// The order matters: the file is cleared first, so an agent that notices mid-way pushes the same empty
// set this function does. Both converge, and neither can resurrect a device.
func retireAtRelay(ctx context.Context, configPath string) error {
	cfg, err := config.LoadForPairing(configPath)
	if err != nil {
		return fmt.Errorf("reading %s: %w", configPath, err)
	}
	if len(cfg.Devices) == 0 {
		return nil
	}

	cleared := cfg
	cleared.Devices = nil
	if err := config.Save(configPath, cleared); err != nil {
		return fmt.Errorf("clearing the device list: %w", err)
	}

	sign, err := decodeKey(cfg.SignKey, ed25519.PrivateKeySize, "signKey")
	if err != nil {
		return err
	}
	roots, err := relayRoots(cfg.RelayCAFile)
	if err != nil {
		return err
	}
	client, err := transport.New(transport.Config{
		BaseURL:   cfg.RelayURL,
		NodeID:    cfg.NodeID,
		Token:     cfg.AgentToken,
		Signer:    sign,
		UserAgent: "msa-agent/" + version,
		RootCAs:   roots,
	})
	if err != nil {
		return err
	}
	pol, err := policy.Load()
	if err != nil {
		return err
	}

	// A short, bounded attempt: the uninstall must finish even when the relay is unreachable, and the
	// caller prints what to do by hand in that case.
	attemptCtx, cancel := context.WithTimeout(ctx, 20*time.Second)
	defer cancel()
	if _, err := client.Hello(attemptCtx, version, pol.SHA256()); err != nil {
		return fmt.Errorf("handshaking with the relay: %w", err)
	}
	if err := client.PushDevices(attemptCtx, nil); err != nil {
		return fmt.Errorf("reporting an empty device set: %w", err)
	}
	return nil
}