app/lab/access-sync.server.ts

Functions

Imports

It imports app/db/members.ts, app/lab/titles.mjs. Imported by app/lab/members.server.ts.

Source

1import { allowList } from "@dustinedwards/site-runtime/members";
2
3import { latestAuditId, listMembers, pendingAfter, recordSync, unsyncedRemovals } from "~/db/members";
4
5import { LAB_CATALOG } from "./titles.mjs";
6
7/**
8 * Asks Capsid to make the lab's Cloudflare Access group (`lab-people`) hold exactly the people /lab/members says may
9 * sign in (capsid docs/design/design-identity-roles.md, "The Cloudflare sync"; Dustin's ruling of 2026-10-09: Capsid
10 * is the only holder of the Cloudflare token, and apps ask it). Capsid's POST /ops/access-sync takes this namespace's
11 * whole list, writes the group it pinned for the namespace (never one this site names), frees the seats of the people
12 * listed as removed and audits the call. Every change on the members page ends here.
13 *
14 * The answer is written onto every member_audit row still waiting: one sync carries the whole list, so it settles
15 * every earlier change too. Nothing here ever throws away a change: a refusal leaves the rows `failed` with the
16 * reason, the page shows it beside each person, and Retry runs this again.
17 */
18
19export const ACCESS_SYNC_URL = "https://mcp.dustinedwards.info/ops/access-sync";
20const ACCESS_SYNC_NAMESPACE = "dustinedwards";
21const TIMEOUT_MS = 15_000;
22
23/** What the page says while the site holds no key: the change is recorded and Access is untouched. */
24export const SYNC_NOT_SET_UP =
25  "Access sync is not set up yet: this site has no CAPSID_ACCESS_SYNC_KEY (Dustin's step). The change is recorded here and nothing was changed in Cloudflare Access.";
26
27/** The same, as the reason kept on each audit row and shown beside each person, where a sentence does not fit. */
28export const SYNC_NOT_SET_UP_REASON = "Access sync is not set up yet (no CAPSID_ACCESS_SYNC_KEY). Access is unchanged.";
29
30export type SyncOutcome = { ok: true } | { ok: false; error: string };
31
32type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
33
34/** Capsid's refusal in its own words: JSON `refusal` on a 409 or 502, plain text otherwise. */
35async function refusalText(response: Response): Promise<string> {
36  const text = (await response.text()).slice(0, 600);
37  try {
38    const body = JSON.parse(text) as { refusal?: unknown };
39    if (typeof body.refusal === "string" && body.refusal) return `Cloudflare refused: ${body.refusal}`;
40  } catch {
41    // Plain text: Capsid's own refusals (401, 403, 409 with no pin, 503 with no token) are words already.
42  }
43  const notSetUp = /CF_ACCESS_SYNC_TOKEN is not set/.test(text) ? " Access sync is not set up yet at Capsid (Dustin's step), so nothing was changed in Cloudflare Access." : "";
44  return `Capsid answered ${response.status}: ${text.trim() || response.statusText}.${notSetUp}`;
45}
46
47/**
48 * Two managers' changes can sync at once and finish in either order. So a sync settles only the audit rows that existed
49 * when it read the list, and when a newer change is still pending after it, it sends the list again: the last write to
50 * the group is always a list read after the last change.
51 */
52const MAX_ROUNDS = 3;
53
54export async function syncAccess(env: Env, nowMs: number, fetchImpl: FetchLike = (input, init) => fetch(input, init)): Promise<SyncOutcome> {
55  let outcome: SyncOutcome = { ok: true };
56  for (let round = 0; round < MAX_ROUNDS; round += 1) {
57    const upto = await latestAuditId(env);
58    outcome = await callCapsid(env, nowMs, fetchImpl);
59    await recordSync(env, outcome.ok ? "accepted" : "failed", outcome.ok ? null : outcome.error, upto);
60    if (!outcome.ok || !(await pendingAfter(env, upto))) break;
61  }
62  return outcome;
63}
64
65async function callCapsid(env: Env, nowMs: number, fetchImpl: FetchLike): Promise<SyncOutcome> {
66  const key = env.CAPSID_ACCESS_SYNC_KEY?.trim();
67  if (!key) return { ok: false, error: SYNC_NOT_SET_UP_REASON };
68
69  const rows = await listMembers(env);
70  const body = { namespace: ACCESS_SYNC_NAMESPACE, members: allowList(rows, nowMs, LAB_CATALOG), removed: await unsyncedRemovals(env) };
71  let response: Response;
72  try {
73    response = await fetchImpl(ACCESS_SYNC_URL, {
74      method: "POST",
75      headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
76      body: JSON.stringify(body),
77      signal: AbortSignal.timeout(TIMEOUT_MS),
78    });
79  } catch (error) {
80    return { ok: false, error: `Capsid could not be reached: ${error instanceof Error ? error.message : String(error)}` };
81  }
82  if (response.ok) return { ok: true };
83  return { ok: false, error: await refusalText(response) };
84}