Initial project snapshot

backend/internal/modules/cluster/postgres_store_test.go

@@ -0,0 +1,34 @@
+package cluster
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestMeshLatestObservationKeySeparatesRouteHealthByRoute(t *testing.T) {
+	key := meshLatestObservationKey(json.RawMessage(`{
+		"observation_type":"synthetic_route_health",
+		"route_id":"route-1"
+	}`))
+	if key != "synthetic_route_health:route-1" {
+		t.Fatalf("key = %q", key)
+	}
+}
+
+func TestMeshLatestObservationKeySeparatesConnectionManagerMode(t *testing.T) {
+	key := meshLatestObservationKey(json.RawMessage(`{
+		"observation_type":"peer_connection_manager",
+		"transport_mode":"relay_control",
+		"relay_node_id":"node-r"
+	}`))
+	if key != "peer_connection_manager:relay_control:node-r" {
+		t.Fatalf("key = %q", key)
+	}
+}
+
+func TestMeshLatestObservationKeyDefaults(t *testing.T) {
+	key := meshLatestObservationKey(json.RawMessage(`{}`))
+	if key != "default" {
+		t.Fatalf("key = %q", key)
+	}
+}

backend/internal/modules/cluster/repository.go

@@ -0,0 +1,91 @@
+package cluster
+
+import (
+	"context"
+	"encoding/json"
+	"time"
+)
+
+type Repository interface {
+	GetPlatformRole(ctx context.Context, userID string) (string, error)
+
+	ListClusters(ctx context.Context) ([]Cluster, error)
+	GetCluster(ctx context.Context, clusterID string) (Cluster, error)
+	CreateCluster(ctx context.Context, input CreateClusterInput) (Cluster, error)
+	UpdateCluster(ctx context.Context, input UpdateClusterInput) (Cluster, error)
+	GetClusterAuthority(ctx context.Context, clusterID string) (ClusterAuthorityKey, error)
+	EnsureClusterAuthority(ctx context.Context, clusterID string, actorUserID *string) (ClusterAuthorityKey, error)
+
+	ListClusterNodes(ctx context.Context, clusterID string) ([]ClusterNode, error)
+	ListNodeGroups(ctx context.Context, clusterID string) ([]ClusterNodeGroup, error)
+	CreateNodeGroup(ctx context.Context, input CreateNodeGroupInput) (ClusterNodeGroup, error)
+	AssignNodeToGroup(ctx context.Context, input AssignNodeGroupInput) (ClusterNode, error)
+
+	CreateJoinToken(ctx context.Context, input CreateJoinTokenInput, tokenHash string) (NodeJoinToken, error)
+	SetJoinTokenAuthority(ctx context.Context, clusterID, tokenID string, payload json.RawMessage, signature ClusterSignature) (NodeJoinToken, error)
+	GetValidJoinTokenByHash(ctx context.Context, clusterID, tokenHash string) (NodeJoinToken, error)
+	RevokeJoinToken(ctx context.Context, input RevokeJoinTokenInput) (NodeJoinToken, error)
+	ExpireJoinTokens(ctx context.Context, clusterID string) error
+
+	CreateJoinRequest(ctx context.Context, input CreateJoinRequestInput, joinTokenID string) (NodeJoinRequest, error)
+	GetJoinRequestForBootstrap(ctx context.Context, input GetJoinRequestBootstrapInput) (NodeJoinRequest, error)
+	ListJoinRequests(ctx context.Context, clusterID string) ([]NodeJoinRequest, error)
+	ApproveJoinRequest(ctx context.Context, input ApproveJoinRequestInput) (ApprovedJoinRequest, error)
+	SetJoinRequestApprovalAuthority(ctx context.Context, clusterID, joinRequestID string, payload json.RawMessage, signature ClusterSignature) (NodeJoinRequest, error)
+	RejectJoinRequest(ctx context.Context, input RejectJoinRequestInput) (NodeJoinRequest, error)
+
+	AssignNodeRole(ctx context.Context, input AssignNodeRoleInput) (NodeRoleAssignment, error)
+	ListNodeRoleAssignments(ctx context.Context, clusterID, nodeID string) ([]NodeRoleAssignment, error)
+	AttachExistingNodeToCluster(ctx context.Context, input AttachExistingNodeInput) (ClusterNode, error)
+
+	RecordHeartbeat(ctx context.Context, input RecordHeartbeatInput) (NodeHeartbeat, error)
+	ListNodeHeartbeats(ctx context.Context, clusterID, nodeID string, limit int) ([]NodeHeartbeat, error)
+	RevokeNodeIdentity(ctx context.Context, input RevokeNodeIdentityInput) error
+	DisableClusterMembership(ctx context.Context, input DisableMembershipInput) error
+	UpsertFabricTestingFlag(ctx context.Context, input UpsertFabricTestingFlagInput) (FabricTestingFlag, error)
+	ListFabricTestingFlags(ctx context.Context) ([]FabricTestingFlag, error)
+	GetEffectiveNodeTestingFlags(ctx context.Context, clusterID, nodeID string) (EffectiveNodeTestingFlags, error)
+	RecordNodeTelemetry(ctx context.Context, input RecordNodeTelemetryInput) (NodeTelemetryObservation, error)
+	ListNodeTelemetry(ctx context.Context, clusterID, nodeID string, limit int) ([]NodeTelemetryObservation, error)
+	SetDesiredWorkload(ctx context.Context, input SetDesiredWorkloadInput) (NodeWorkloadDesiredState, error)
+	ListDesiredWorkloads(ctx context.Context, clusterID, nodeID string) ([]NodeWorkloadDesiredState, error)
+	ReportWorkloadStatus(ctx context.Context, input ReportWorkloadStatusInput) (NodeWorkloadStatus, error)
+	ListLatestWorkloadStatuses(ctx context.Context, clusterID, nodeID string) ([]NodeWorkloadStatus, error)
+	ReportMeshLink(ctx context.Context, input ReportMeshLinkInput) (MeshLinkObservation, error)
+	ListMeshLinks(ctx context.Context, clusterID string) ([]MeshLinkObservation, error)
+	CreateRouteIntent(ctx context.Context, input CreateRouteIntentInput) (MeshRouteIntent, error)
+	ListRouteIntents(ctx context.Context, clusterID string) ([]MeshRouteIntent, error)
+	ListQoSPolicies(ctx context.Context, clusterID string) ([]MeshQoSPolicy, error)
+	ListFabricEntryPoints(ctx context.Context, clusterID string) ([]FabricEntryPoint, error)
+	CreateFabricEntryPoint(ctx context.Context, input CreateFabricEntryPointInput) (FabricEntryPoint, error)
+	SetFabricEntryPointNode(ctx context.Context, input SetFabricEntryPointNodeInput) (FabricEntryPointNode, error)
+	ListFabricEntryPointNodes(ctx context.Context, clusterID, entryPointID string) ([]FabricEntryPointNode, error)
+	ListFabricEgressPools(ctx context.Context, clusterID string) ([]FabricEgressPool, error)
+	CreateFabricEgressPool(ctx context.Context, input CreateFabricEgressPoolInput) (FabricEgressPool, error)
+	SetFabricEgressPoolNode(ctx context.Context, input SetFabricEgressPoolNodeInput) (FabricEgressPoolNode, error)
+	ListFabricEgressPoolNodes(ctx context.Context, clusterID, egressPoolID string) ([]FabricEgressPoolNode, error)
+	GetClusterAuthorityState(ctx context.Context, clusterID string) (ClusterAuthorityState, error)
+	UpdateClusterAuthorityState(ctx context.Context, input UpdateClusterAuthorityInput) (ClusterAuthorityState, error)
+	ListClusterAdminSummaries(ctx context.Context) ([]ClusterAdminSummary, error)
+
+	CreateVPNConnection(ctx context.Context, input CreateVPNConnectionInput) (VPNConnection, error)
+	ListVPNConnections(ctx context.Context, clusterID string) ([]VPNConnection, error)
+	GetVPNConnection(ctx context.Context, clusterID, vpnConnectionID string) (VPNConnection, error)
+	UpdateVPNConnectionDesiredState(ctx context.Context, input UpdateVPNConnectionDesiredStateInput) (VPNConnection, error)
+	UpsertVPNConnectionRoutePolicy(ctx context.Context, input UpsertVPNConnectionRoutePolicyInput) (VPNConnectionRoutePolicy, error)
+	ListVPNConnectionRoutePolicies(ctx context.Context, clusterID, vpnConnectionID string) ([]VPNConnectionRoutePolicy, error)
+	SetVPNConnectionAllowedNodes(ctx context.Context, input SetVPNConnectionAllowedNodesInput) ([]VPNConnectionAllowedNode, error)
+	ListVPNConnectionAllowedNodes(ctx context.Context, clusterID, vpnConnectionID string) ([]VPNConnectionAllowedNode, error)
+	AcquireVPNConnectionLease(ctx context.Context, input AcquireVPNConnectionLeaseInput, expiresAt time.Time, fencingToken string) (VPNConnectionLease, error)
+	RenewVPNConnectionLease(ctx context.Context, input RenewVPNConnectionLeaseInput, expiresAt time.Time) (VPNConnectionLease, error)
+	ReleaseVPNConnectionLease(ctx context.Context, input ReleaseVPNConnectionLeaseInput) (VPNConnectionLease, error)
+	FenceVPNConnectionLease(ctx context.Context, input FenceVPNConnectionLeaseInput) (VPNConnectionLease, error)
+	GetActiveVPNConnectionLease(ctx context.Context, clusterID, vpnConnectionID string) (VPNConnectionLease, error)
+	CheckVPNLeaseOwnerEligibility(ctx context.Context, clusterID, vpnConnectionID, ownerNodeID string) (VPNLeaseOwnerEligibility, error)
+	ExpireStaleVPNConnectionLeases(ctx context.Context, clusterID string, now time.Time) ([]VPNConnectionLease, error)
+	ListNodeVPNAssignments(ctx context.Context, clusterID, nodeID string) ([]NodeVPNAssignment, error)
+	ReportNodeVPNAssignmentStatus(ctx context.Context, input ReportNodeVPNAssignmentStatusInput) (NodeVPNAssignmentStatus, error)
+
+	RecordAudit(ctx context.Context, event ClusterAuditEvent) error
+	ListAuditEvents(ctx context.Context, clusterID string, limit int) ([]ClusterAuditEvent, error)
+}

backend/internal/modules/cluster/token.go

@@ -0,0 +1,43 @@
+package cluster
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"strings"
+	"time"
+)
+
+const joinTokenHashPrefix = "sha256:"
+
+func generateJoinToken() (string, error) {
+	var random [32]byte
+	if _, err := rand.Read(random[:]); err != nil {
+		return "", err
+	}
+	return "rap_join_" + base64.RawURLEncoding.EncodeToString(random[:]), nil
+}
+
+func hashJoinToken(token string) (string, error) {
+	trimmed := strings.TrimSpace(token)
+	if trimmed == "" {
+		return "", errors.New("join token is required")
+	}
+	sum := sha256.Sum256([]byte(trimmed))
+	return joinTokenHashPrefix + hex.EncodeToString(sum[:]), nil
+}
+
+func isPlatformAdminRole(role string) bool {
+	return role == PlatformRoleAdmin || role == PlatformRoleRecoveryAdmin
+}
+
+func isAllowedNodeRole(role string) bool {
+	_, ok := allowedNodeRoles[role]
+	return ok
+}
+
+func defaultJoinTokenExpiry(now time.Time) time.Time {
+	return now.Add(30 * time.Minute)
+}