app/lib/smoke.server.ts

Functions

Imports

It imports app/lib/bearer.server.ts, app/lib/rate-limit.mjs. Imported by app/routes/admin.tsx.

Source

1/**
2 * Read-only machine principal for the admin plane: `decide()` refuses it writes and the `/admin`
3 * middleware refuses non-GET methods. Handle it like the operator token: never in a log or error body.
4 */
5
6import { safeEqual } from "@dustinedwards/site-runtime/compare";
7
8import { tokenLabel } from "~/lib/bearer.server";
9import { limitHit } from "~/lib/rate-limit.mjs";
10
11/**
12 * Own `smoke:` key prefix so a CI sweep and the publish path cannot exhaust each other. High because
13 * nothing behind it costs money and a legitimate sweep bursts tens of loads in seconds.
14 */
15const SMOKE_RATE_LIMIT = 240;
16const SMOKE_RATE_PERIOD_SECONDS = 60;
17
18const MIN_TOKEN_LENGTH = 32;
19
20/** A realistic length, because the topbar's width is what the smoke render measures. Not a real mailbox. */
21const SMOKE_ACTOR_EMAIL = "smoke-reader@dustinedwards.info";
22
23// `absent` is not a failure: most `/admin` requests are a browser and must fall through to the session gate.
24type SmokeResult =
25  | { kind: "ok"; id: string; email: string }
26  | { kind: "absent" }
27  | { kind: "refused"; status: number; error: string; retryAfter?: number };
28
29// Authenticate before rate limiting, so an unauthenticated flood cannot drain the real budget.
30export async function authenticateSmoke(env: Env, request: Request): Promise<SmokeResult> {
31  const header = request.headers.get("authorization") ?? "";
32  const presented = /^Bearer\s+(.+)$/i.exec(header.trim())?.[1] ?? "";
33
34  if (!presented) return { kind: "absent" };
35
36  const configured = env.SMOKE_TOKEN;
37
38  // Refused, not fallen through: a token was presented, and a login redirect would mislead CI.
39  if (!configured || configured.length < MIN_TOKEN_LENGTH) {
40    return {
41      kind: "refused",
42      status: 503,
43      error:
44        "The smoke credential is not configured on this deployment. " +
45        "Set the SMOKE_TOKEN wrangler secret to enable it.",
46    };
47  }
48
49  if (!(await safeEqual(presented, configured))) {
50    return { kind: "refused", status: 401, error: "Invalid smoke bearer token." };
51  }
52
53  const id = tokenLabel(presented);
54
55  const verdict = await limitHit(env, `smoke:${id}`, SMOKE_RATE_LIMIT, SMOKE_RATE_PERIOD_SECONDS);
56  if (verdict.status === "unavailable") {
57    return {
58      kind: "refused",
59      status: 503,
60      error: "Rate limiting is unavailable, so the smoke credential is disabled.",
61    };
62  }
63  if (verdict.status === "limited") {
64    return {
65      kind: "refused",
66      status: 429,
67      error: `Rate limit: ${SMOKE_RATE_LIMIT} requests per ${SMOKE_RATE_PERIOD_SECONDS} seconds.`,
68      retryAfter: verdict.retryAfterSeconds,
69    };
70  }
71
72  // Resolved here, not in `admin.tsx`: the secrets boundary is a path rule and routes may not read secrets.
73  return { kind: "ok", id, email: SMOKE_ACTOR_EMAIL };
74}