app/lib/operator/auth.server.ts

Functions

Imports

It imports app/lib/bearer.server.ts, app/lib/rate-limit.mjs. Imported by app/lib/media/backup.server.ts, app/lib/operator/api.server.ts, app/lib/operator/sync-tools.server.ts, app/lib/operator/upload-media.server.ts, app/routes/api.operator.ts.

Source

1// The token is the whole boundary: compared in constant time, and never echoed, logged or put in an error.
2
3import { safeEqual } from "@dustinedwards/site-runtime/compare";
4
5import { tokenLabel } from "~/lib/bearer.server";
6import { limitHit } from "~/lib/rate-limit.mjs";
7
8const OPERATOR_RATE_LIMIT = 30;
9const OPERATOR_RATE_PERIOD_SECONDS = 60;
10
11const MIN_TOKEN_LENGTH = 32;
12
13export type OperatorEnv = Env & { OPERATOR_TOKEN?: string };
14
15type AuthResult =
16  | { ok: true; id: string }
17  | { ok: false; status: number; error: string; retryAfter?: number };
18
19// Authenticate FIRST: the limiter is keyed to a proven identity, so an anonymous flood cannot spend a
20// real operator's budget or reach a Durable Object.
21export async function authenticateOperator(
22  env: OperatorEnv,
23  request: Request,
24): Promise<AuthResult> {
25  const configured = env.OPERATOR_TOKEN;
26
27  // No secret set means the path is closed, not open to everyone.
28  if (!configured || configured.length < MIN_TOKEN_LENGTH) {
29    return {
30      ok: false,
31      status: 503,
32      error:
33        "The operator publish path is not configured on this deployment. " +
34        "Set the OPERATOR_TOKEN wrangler secret to enable it.",
35    };
36  }
37
38  const header = request.headers.get("authorization") ?? "";
39  const presented = /^Bearer\s+(.+)$/i.exec(header.trim())?.[1] ?? "";
40
41  // Refused on length BEFORE the hash: `safeEqual` hashes both operands, which an anonymous caller
42  // could otherwise request in any size. Twice the length, not equal, so it is not a length oracle.
43  if (presented.length > configured.length * 2) {
44    return { ok: false, status: 401, error: "Invalid or missing bearer token." };
45  }
46
47  // Still compared when absent, so a missing header and a wrong token take the same path and time
48  // (an empty side is refused by `safeEqual` after both hashes, never before them).
49  const valid = await safeEqual(presented, configured);
50  if (!valid) {
51    return { ok: false, status: 401, error: "Invalid or missing bearer token." };
52  }
53
54  const id = tokenLabel(presented);
55
56  return { ok: true, id };
57}
58
59// Separate from authentication so reading the describe call does not spend publish budget.
60export async function meterOperator(
61  env: OperatorEnv,
62  id: string,
63): Promise<AuthResult> {
64  const verdict = await limitHit(env, `op:${id}`, OPERATOR_RATE_LIMIT, OPERATOR_RATE_PERIOD_SECONDS);
65  if (verdict.status === "unavailable") {
66    return {
67      ok: false,
68      status: 503,
69      error: "Rate limiting is unavailable, so the operator path is disabled.",
70    };
71  }
72  if (verdict.status === "limited") {
73    return {
74      ok: false,
75      status: 429,
76      error: `Rate limit: ${OPERATOR_RATE_LIMIT} requests per ${OPERATOR_RATE_PERIOD_SECONDS} seconds.`,
77      retryAfter: verdict.retryAfterSeconds,
78    };
79  }
80
81  return { ok: true, id };
82}
83