src/namespace-delete-token.ts

Functions

Imports

It imports src/auth.ts, src/encoding.ts, src/env.ts. Imported by src/namespace-delete.ts.

Source

1import { safeEqual } from "@dustinedwards/site-runtime/compare";
2import { hmacHex } from "./auth";
3import { b64urlEncode, b64urlDecode } from "./encoding";
4import type { Env } from "./env";
5
6// The namespace delete's confirmation token (src/namespace-delete.ts previews and
7// performs the delete).
8
9// Its own context string, so this key differs from the Portal's confirmation key and
10// every other key derived from COOKIE_ENCRYPTION_KEY: a Portal token never verifies
11// here. A version bump retires every outstanding token.
12const TOKEN_CONTEXT = "capsid-namespace-delete:v1";
13
14const TOKEN_SHAPE = /^[A-Za-z0-9_-]+\.[0-9a-f]{64}$/;
15
16
17export interface DeleteClaims {
18  v: 1;
19  namespace: string;
20  cascade: boolean;
21  allow_improve_paths: boolean;
22  actor: string;
23  plan: string;
24  exp: number;
25}
26
27function canonicalClaims(c: DeleteClaims): string {
28  return JSON.stringify({
29    v: c.v,
30    namespace: c.namespace,
31    cascade: c.cascade,
32    allow_improve_paths: c.allow_improve_paths,
33    actor: c.actor,
34    plan: c.plan,
35    exp: c.exp,
36  });
37}
38
39async function tokenKey(env: Pick<Env, "COOKIE_ENCRYPTION_KEY">): Promise<string> {
40  // Fails closed: with no root secret there is nothing to sign with, and an empty key
41  // would sign with a value anybody knows.
42  if (!env.COOKIE_ENCRYPTION_KEY) throw new Error("COOKIE_ENCRYPTION_KEY is unset, so no delete confirmation can be signed or checked");
43  return hmacHex(env.COOKIE_ENCRYPTION_KEY, TOKEN_CONTEXT);
44}
45
46export async function signDeleteToken(env: Pick<Env, "COOKIE_ENCRYPTION_KEY">, claims: DeleteClaims): Promise<string> {
47  const payload = b64urlEncode(canonicalClaims(claims));
48  return `${payload}.${await hmacHex(await tokenKey(env), payload)}`;
49}
50
51export type Verified = { ok: true; claims: DeleteClaims } | { ok: false; refusal: string };
52
53/** Checks the signature, the shape, the caller, the expiry and the arguments the token
54 *  was signed for. The plan is compared by the caller after it re-reads it. */
55export async function verifyDeleteToken(
56  env: Pick<Env, "COOKIE_ENCRYPTION_KEY">,
57  token: string,
58  expect: { actor: string; namespace: string; cascade: boolean; allowImprovePaths: boolean },
59  now: Date
60): Promise<Verified> {
61  if (!TOKEN_SHAPE.test(token)) return { ok: false, refusal: "the confirmation token is malformed: preview again." };
62  const dot = token.indexOf(".");
63  const payload = token.slice(0, dot);
64  if (!await safeEqual(token.slice(dot + 1), await hmacHex(await tokenKey(env), payload))) {
65    return { ok: false, refusal: "the confirmation token does not verify: preview again." };
66  }
67  let claims: DeleteClaims;
68  try {
69    claims = JSON.parse(b64urlDecode(payload)) as DeleteClaims;
70  } catch (err) {
71    // Signed by this Worker and unreadable: a defect, said so.
72    return { ok: false, refusal: `the confirmation token verifies but does not parse (${err instanceof Error ? err.message : String(err)}): preview again.` };
73  }
74  if (
75    claims?.v !== 1 ||
76    typeof claims.namespace !== "string" ||
77    typeof claims.cascade !== "boolean" ||
78    typeof claims.allow_improve_paths !== "boolean" ||
79    typeof claims.actor !== "string" ||
80    typeof claims.plan !== "string" ||
81    typeof claims.exp !== "number"
82  ) {
83    return { ok: false, refusal: "the confirmation token verifies but its claims are not the shape this Worker signs: preview again." };
84  }
85  if (claims.actor !== expect.actor) return { ok: false, refusal: "the confirmation was issued to another caller: preview again." };
86  if (claims.exp * 1000 <= now.getTime()) return { ok: false, refusal: "the confirmation expired: preview again." };
87  if (claims.namespace !== expect.namespace) {
88    return { ok: false, refusal: `the confirmation was issued for namespace ${claims.namespace}, not ${expect.namespace}: preview again.` };
89  }
90  if (claims.cascade !== expect.cascade) {
91    return { ok: false, refusal: `the confirmation was issued with cascade ${claims.cascade}, and this call passes ${expect.cascade}: preview again with the arguments you mean.` };
92  }
93  if (claims.allow_improve_paths !== expect.allowImprovePaths) {
94    return {
95      ok: false,
96      refusal: `the confirmation was issued with allow_improve_paths ${claims.allow_improve_paths}, and this call passes ${expect.allowImprovePaths}: preview again with the arguments you mean.`,
97    };
98  }
99  return { ok: true, claims };
100}