feat: implement TASK-WP1-04 admin security

apps/api/src/main.ts

@@ -1,19 +1,52 @@
+import { createHmac } from "node:crypto";
 import { join, resolve } from "node:path";
 
+import { registrationNotice } from "@dada/shared-contracts";
+
 import { createApp } from "./app.js";
 import { readBrowserSupportRelease } from "./browser-support.js";
-import { readConfiguredLocalDataRoot } from "./local-data-root.js";
+import { defaultInstanceConfigPath, readConfiguredLocalDataRoot } from "./local-data-root.js";
 import { ManagedStorage } from "./managed-storage.js";
+import { RegistrationService } from "./registration.js";
+import { MockResendAdapter } from "./resend-adapter.js";
+import { readSecureConfigCandidate } from "./secure-config.js";
 import { StructuredJsonlLogger } from "./structured-log.js";
 import { attachApiSupervisorControl, initializeApiCredentialClients, receiveApiCredentials } from "./supervisor-channel.js";
 
 const credentialChannelEnabled = process.argv.includes("--dada-credential-stdin");
+let registration: RegistrationService | undefined;
+const instanceConfigPath = process.env.DADA_INSTANCE_CONFIG_PATH ?? defaultInstanceConfigPath();
 if (credentialChannelEnabled) {
-  initializeApiCredentialClients(await receiveApiCredentials());
+  const clients = initializeApiCredentialClients(await receiveApiCredentials());
+  try {
+    const derivePepper = (purpose: string) => createHmac("sha256", clients.adminAllowlistPepper)
+      .update(`Dada/P0A/${purpose}/v1`, "utf8")
+      .digest();
+    const dataRoot = readConfiguredLocalDataRoot(instanceConfigPath);
+    registration = new RegistrationService({
+      adminAllowlistPepper: Buffer.from(clients.adminAllowlistPepper),
+      challengePepper: derivePepper("challenge-pepper"),
+      currentPrivacyNoticeVersion: registrationNotice.version,
+      databasePath: join(dataRoot, "db", "dada.sqlite3"),
+      invitePepper: derivePepper("invite-pepper"),
+      resend: new MockResendAdapter(),
+      sessionPepper: derivePepper("session-pepper"),
+    });
+    registration.applySecureConfig(readSecureConfigCandidate(instanceConfigPath));
+  } catch (error) {
+    registration?.close();
+    registration = undefined;
+    throw error;
+  } finally {
+    clients.adminAllowlistPepper.fill(0);
+  }
 }
 
 const browserSupportRelease = readBrowserSupportRelease(resolve("RELEASE.json"));
-const app = await createApp(browserSupportRelease ? { browserSupportRelease } : {});
+const app = await createApp({
+  ...(browserSupportRelease ? { browserSupportRelease } : {}),
+  ...(registration ? { registration } : {}),
+});
 
 await app.listen({
   host: "127.0.0.1",
@@ -27,10 +60,11 @@ if (controlPipeIndex >= 0) {
   let storage: ManagedStorage | undefined;
   const control = attachApiSupervisorControl(controlPipe, async () => {
     await app.close();
+    registration?.close();
     storage?.close();
   });
   try {
-    const dataRoot = readConfiguredLocalDataRoot();
+    const dataRoot = readConfiguredLocalDataRoot(instanceConfigPath);
     storage = new ManagedStorage({ dataRoot, databasePath: join(dataRoot, "db", "dada.sqlite3") });
     const logger = new StructuredJsonlLogger({
       component: "api",