app/lib/access.server.ts

Functions

Imports

It imports no other module of this repo. Imported by workers/gate.ts.

Source

1// Identity comes only from the Access token Cloudflare puts on every request it lets through.
2//
3// NOT ctx.access. A Worker with Static Assets (the Vite plugin adds them for React Router) runs
4// behind a router Worker that does not pass ctx.access through, so this Worker verifies the
5// Cf-Access-Jwt-Assertion header itself. The check (signature by the team's keys, issuer, AUD,
6// RS256, 60 s skew) is @dustinedwards/site-runtime/access, the family's one copy; what is Carrel's
7// is reading a person's email from the verified claims.
8
9import { verifyAccessRequest, type AccessRefusal } from "@dustinedwards/site-runtime/access";
10import type { KeySource } from "@dustinedwards/site-runtime/access-login";
11
12export type AccessResult = { ok: true; email: string } | { ok: false; reason: AccessRefusal | "no-email" };
13
14/**
15 * Verifies the request's Access token against one Access application's audience. Every fault is a refusal with its
16 * reason: a missing setting, a missing header, a bad signature, the wrong issuer or audience, an expired token, or a
17 * token with no email. Keys that cannot be fetched throw. `keys` defaults to the team's published keys.
18 */
19export async function verifyAccess(
20  request: Request,
21  config: { teamDomain: string | undefined; audience: string | undefined },
22  keys?: KeySource,
23): Promise<AccessResult> {
24  const verdict = await verifyAccessRequest(request, { teamDomain: config.teamDomain, audience: config.audience, keys });
25  if (!verdict.ok) return verdict;
26  const email = typeof verdict.claims.email === "string" ? verdict.claims.email.trim() : "";
27  if (!email) return { ok: false, reason: "no-email" };
28  return { ok: true, email };
29}