src/auth.ts

Functions

Imports

It imports src/encoding.ts. Imported by src/access-login.ts, src/agents-admin.ts, src/agents.ts, src/approval.ts, src/bench.ts, src/canon.ts, src/controls-token.ts, src/doc-statements.ts, src/index.ts, src/job-signing.ts, src/namespace-delete-token.ts, src/namespace-delete.ts, src/operator-key.ts, src/ops-feed.ts, src/policy-sign.ts, src/portal-actions.ts, src/portal-auth.ts, src/routes.ts, src/signed-docs.ts, src/signed-requests.ts, src/store-guards.ts, src/tools/docs-lifecycle.ts, src/tools/docs-write.ts.

Source

1import { safeEqual } from "@dustinedwards/site-runtime/compare";
2import { bytesToHex } from "./encoding";
3
4export async function sha256Hex(input: string): Promise<string> {
5  return bytesToHex(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input)));
6}
7
8// HMAC-SHA256, hex. The one definition.
9export async function hmacHex(secret: string, payload: string): Promise<string> {
10  const key = await crypto.subtle.importKey(
11    "raw",
12    new TextEncoder().encode(secret),
13    { name: "HMAC", hash: "SHA-256" },
14    false,
15    ["sign"]
16  );
17  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload));
18  return bytesToHex(sig);
19}
20
21// Cookie lookup, once, for the consent flow and the Portal session.
22export function getCookie(request: Request, name: string): string | null {
23  const header = request.headers.get("Cookie");
24  if (!header) return null;
25  for (const part of header.split(";")) {
26    const eq = part.indexOf("=");
27    if (eq === -1) continue;
28    if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();
29  }
30  return null;
31}
32
33// OPERATOR_KEY_HASH: comma-separated sha256 hex. Plain = write, "ro:" = read.
34// Revoke by removing a hash. A single unprefixed hash still parses as write.
35type OperatorGrant = "write" | "read" | null;
36
37// Fingerprint is 12 hex of the presented key's sha256, not the stored verifier.
38export interface OperatorIdentity {
39  grant: OperatorGrant;
40  fingerprint: string | null;
41}
42
43/**
44 * The token of an `Authorization: Bearer` header, or null. The scheme is case-insensitive
45 * (RFC 6750 via RFC 9110), and a token is one run without whitespace, as in Carrel and
46 * site-api; a header with anything after the token is refused.
47 */
48export function bearerToken(request: Request): string | null {
49  const match = /^Bearer +(\S+) *$/i.exec(request.headers.get("Authorization") ?? "");
50  return match ? match[1] : null;
51}
52
53export async function operatorIdentity(
54  request: Request,
55  env: { OPERATOR_KEY_HASH?: string }
56): Promise<OperatorIdentity> {
57  const token = bearerToken(request);
58  if (!token || !env.OPERATOR_KEY_HASH) return { grant: null, fingerprint: null };
59  const hash = await sha256Hex(token);
60  for (const raw of env.OPERATOR_KEY_HASH.split(",")) {
61    const entry = raw.trim().toLowerCase();
62    if (!entry) continue;
63    const readonly = entry.startsWith("ro:");
64    if (await safeEqual(readonly ? entry.slice(3) : entry, hash)) {
65      return { grant: readonly ? "read" : "write", fingerprint: hash.slice(0, 12) };
66    }
67  }
68  return { grant: null, fingerprint: null };
69}
70
71type AdminEnv = { ADMIN_EMAIL?: string; CO_OWNER_EMAILS?: string };
72
73// The admin, by the email Access verified: ADMIN_EMAIL, the primary owner, or an entry
74// of CO_OWNER_EMAILS (comma separated). Each entry is trimmed and compared exactly, with
75// no case folding; empty entries are skipped. An unset ADMIN_EMAIL admits nobody, a
76// co-owner included, so losing the primary owner's secret closes both logins. Both
77// secrets are set only in Cloudflare: nothing inside Capsid can change who is admin.
78export async function isAdminEmail(env: AdminEnv, email: string): Promise<boolean> {
79  const admin = (env.ADMIN_EMAIL ?? "").trim();
80  if (!admin) return false;
81  const candidate = email.trim();
82  let admitted = false;
83  for (const raw of [admin, ...(env.CO_OWNER_EMAILS ?? "").split(",")]) {
84    const entry = raw.trim();
85    if (entry && (await safeEqual(candidate, entry))) admitted = true;
86  }
87  return admitted;
88}
89
90// A grant's props on /mcp, checked on every request: only a grant whose email Access
91// verified as an admin (isAdminEmail) passes. A grant from before the move to Access
92// carries a GitHub login and no email, and fails here, so its client signs in again once.
93export async function adminGrantEmail(env: AdminEnv, props: unknown): Promise<string | null> {
94  const email = props && typeof props === "object" ? (props as { email?: unknown }).email : undefined;
95  return typeof email === "string" && (await isAdminEmail(env, email)) ? email : null;
96}