app/lab/access.server.ts

Functions

Imports

It imports app/lib/access.server.ts. Imported by app/routes/workspace.tsx.

Source

1import { verifyAccessRequest, type AccessIdentity, type TeamKeys } from "~/lib/access.server";
2
3/**
4 * Who the lab's own Cloudflare Access application says is asking (capsid docs/design/design-identity-roles.md, "How a
5 * person signs in"). /lab sits behind `dustinedwards-lab-login`, a separate application from /admin's, so its token
6 * carries ACCESS_LAB_AUD and never ACCESS_AUD: a /admin token is refused here for its audience, and a /lab token is
7 * refused at /admin for the same reason. Being admitted by Access proves only an email; the person's row in `members`
8 * decides what they may do (app/lab/actor.server.ts).
9 *
10 * Only the header is read, never the `CF_Authorization` cookie: two Access applications on one host each set that
11 * cookie, and the header is the one Access adds for the application in front of this path.
12 */
13export function labIdentity(env: Env, request: Request, keys?: TeamKeys): Promise<AccessIdentity> {
14  return verifyAccessRequest(env, request, { audience: env.ACCESS_LAB_AUD, cookie: false }, keys);
15}