app/lib/access.server.ts

Functions

Imports

It imports no other module of this repo. Imported by app/lab/access.server.ts, app/routes/about.tsx, app/routes/admin.tsx, app/routes/content-page.tsx, app/routes/kb-library.tsx, app/routes/lab.kind.tsx, app/routes/phages.tsx, app/routes/procedure.sheet.tsx, app/routes/procedure.tsx, app/routes/protocols.tsx.

Source

1import { accessKeys, verifyAccessRequest as verifyAccess } from "@dustinedwards/site-runtime/access";
2import type { KeySource } from "@dustinedwards/site-runtime/access-login";
3
4/**
5 * Who Cloudflare Access says is asking. Access sits in front of /admin on the apex and signs a token
6 * for each request it lets through; this reads that token and trusts nothing else. The allowed people
7 * live in ONE place, the Access policy (Zero Trust > Access > Applications > dustinedwards-login >
8 * Policies): anyone it admits holds a token for this application, so adding or removing an
9 * administrator is a policy edit and no code or deploy.
10 *
11 * The token check itself (signature by a published key, RS256 pinned, issuer, audience, dates, the
12 * cached key set) is the family's one copy, `@dustinedwards/site-runtime/access`. What is here is the
13 * site's own reading of a verdict:
14 *
15 * - `human`: a person Access admitted; `email` is who (lowercased), and is what edits are attributed to.
16 * - `service`: an Access service token (no person). Never an administrator; it only gets a request
17 *   past Access, and the bearer credentials below still decide what it may do.
18 * - `absent`: no token, or this Worker has no Access configuration.
19 * - `refused`: a token was presented and failed verification, which is an answer and not a login page.
20 */
21export type AccessIdentity =
22  | { kind: "human"; email: string }
23  | { kind: "service"; id: string }
24  | { kind: "absent" }
25  | { kind: "refused"; reason: string };
26
27/** The team's signing keys for a team domain; the shared, isolate-cached set unless a test passes its own. */
28export type TeamKeys = (teamDomain: string) => KeySource;
29
30/** Local development only: `vite dev` on localhost has no Access in front of it. */
31function localDevelopment(request: Request): boolean {
32  if (!import.meta.env.DEV) return false;
33  const { hostname } = new URL(request.url);
34  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
35}
36
37/**
38 * True when Access vouches that an administrator is making this request. For a public page that
39 * shows a draft to the administrator only: a token that fails verification is simply not an
40 * administrator here, since the admin layout is where a bad token is answered.
41 */
42export async function isAdminViewer(env: Env, request: Request): Promise<boolean> {
43  return (await accessIdentity(env, request)).kind === "human";
44}
45
46const LOCAL_DEV_EMAIL = "dev@localhost";
47
48export async function accessIdentity(env: Env, request: Request, keys: TeamKeys = accessKeys): Promise<AccessIdentity> {
49  // The header is added only on paths the Access application covers (/admin). The same token also
50  // rides in the `CF_Authorization` cookie on every path of the host, which is how a public page
51  // tells the administrator is looking at it (a draft shows to them and 404s for everyone else).
52  return verifyAccessRequest(env, request, { audience: env.ACCESS_AUD, cookie: true }, keys);
53}
54
55/**
56 * One Access application's verdict on a request, as this site reads it: its token, from the header (or, with `cookie`,
57 * the `CF_Authorization` cookie), checked against `audience`. /admin and /lab (app/lab/access.server.ts) each pass their
58 * own application's tag, so a token for one is refused at the other. A key set that cannot be fetched throws.
59 */
60export async function verifyAccessRequest(
61  env: Env,
62  request: Request,
63  { audience, cookie }: { audience: string; cookie: boolean },
64  keys: TeamKeys = accessKeys,
65): Promise<AccessIdentity> {
66  if (localDevelopment(request)) return { kind: "human", email: LOCAL_DEV_EMAIL };
67
68  const teamDomain = env.ACCESS_TEAM_DOMAIN;
69  if (!teamDomain || !audience) return { kind: "absent" };
70
71  // The key source is made on first use, so a request with no token never touches the team domain's keys.
72  let source: KeySource | undefined;
73  const lazyKeys: KeySource = (kid, fresh) => (source ??= keys(teamDomain))(kid, fresh);
74  const verdict = await verifyAccess(request, { teamDomain, audience, cookie, keys: lazyKeys });
75  if (!verdict.ok) return verdict.reason === "not-configured" || verdict.reason === "no-token" ? { kind: "absent" } : { kind: "refused", reason: verdict.reason };
76
77  const { email, common_name: commonName } = verdict.claims;
78  if (typeof email === "string" && email !== "") return { kind: "human", email: email.toLowerCase() };
79  if (typeof commonName === "string" && commonName !== "") return { kind: "service", id: commonName };
80  return { kind: "refused", reason: "no-identity" };
81}