1tube 0.1.51 → 0.1.52

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "1tube",
-  "version": "0.1.51",
+  "version": "0.1.52",
   "private": false,
   "description": "Self-hosted Supabase Edge Functions gateway for Deno, plus an ESLint plugin for consumers",
   "license": "MIT",

package/src/gateway/auth.ts

@@ -53,7 +53,7 @@ function getSecret(): string {
     verifyCache.clear();
     if (!current && !_warnedNoSecret) {
       console.warn(
-        "[1tube] JWT_SECRET not set — authenticated endpoints will reject all requests",
+        "[1tube] JWT_SECRET not set — authenticated endpoints return 503, not 401",
       );
       _warnedNoSecret = true;
     }
@@ -165,6 +165,64 @@ async function verifyToken(token: string): Promise<JWTPayload | null> {
   }
 }
 
+export type RequestAuthProbe =
+  | { status: "ok"; auth: AuthContext }
+  | { status: "missing" }
+  | { status: "invalid" }
+  | { status: "unavailable" };
+
+function serviceRoleAuth(token: string): AuthContext {
+  const nowSec = Math.floor(Date.now() / 1000);
+  return {
+    userId: "",
+    email: "",
+    payload: {
+      sub: "",
+      email: "",
+      role: "service_role",
+      iss: "supabase",
+      aud: "service_role",
+      iat: nowSec,
+      // Synthetic exp matching JWTPayload shape; the token has no real
+      // expiry of its own — rotation is governed by env reload.
+      exp: nowSec + 60 * 60,
+    },
+    rawToken: token,
+  };
+}
+
+/**
+ * Probe the Authorization header without collapsing every miss into `null`.
+ *
+ * A missing `JWT_SECRET` is `unavailable` — the gateway cannot tell a live
+ * session from a bad one, so the dispatcher must return 503 rather than 401.
+ * Treating that as Unauthorized signs SPAs out during deploys.
+ */
+export async function probeRequest(req: Request): Promise<RequestAuthProbe> {
+  const token = parseBearer(req.headers.get("Authorization"));
+  if (!token) return { status: "missing" };
+
+  const serviceKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") || "";
+  if (serviceKey && token === serviceKey) {
+    return { status: "ok", auth: serviceRoleAuth(token) };
+  }
+
+  if (!getSecret()) return { status: "unavailable" };
+
+  const payload = await verifyToken(token);
+  if (!payload) return { status: "invalid" };
+
+  return {
+    status: "ok",
+    auth: {
+      userId: payload.sub,
+      email: payload.email,
+      payload,
+      rawToken: token,
+    },
+  };
+}
+
 /**
  * Validate the Authorization header and return an AuthContext, or null if invalid.
  *
@@ -187,39 +245,8 @@ async function verifyToken(token: string): Promise<JWTPayload | null> {
 export async function validateRequest(
   req: Request,
 ): Promise<AuthContext | null> {
-  const token = parseBearer(req.headers.get("Authorization"));
-  if (!token) return null;
-
-  const serviceKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") || "";
-  if (serviceKey && token === serviceKey) {
-    const nowSec = Math.floor(Date.now() / 1000);
-    return {
-      userId: "",
-      email: "",
-      payload: {
-        sub: "",
-        email: "",
-        role: "service_role",
-        iss: "supabase",
-        aud: "service_role",
-        iat: nowSec,
-        // Synthetic exp matching JWTPayload shape; the token has no real
-        // expiry of its own — rotation is governed by env reload.
-        exp: nowSec + 60 * 60,
-      },
-      rawToken: token,
-    };
-  }
-
-  const payload = await verifyToken(token);
-  if (!payload) return null;
-
-  return {
-    userId: payload.sub,
-    email: payload.email,
-    payload,
-    rawToken: token,
-  };
+  const probed = await probeRequest(req);
+  return probed.status === "ok" ? probed.auth : null;
 }
 
 // ---------------------------------------------------------------------------

package/src/gateway/cors.ts

@@ -36,7 +36,8 @@ const DEFAULT_ALLOWED_METHODS = "POST, GET, OPTIONS, PUT, PATCH, DELETE";
 // its HMR respawn is still in flight; `retry-after` lets clients
 // honour the gateway's suggested backoff. These are always exposed —
 // operator config only ADDS to them.
-const INTERNAL_EXPOSED_HEADERS = "x-1tube-warming, x-1tube-stale, retry-after";
+const INTERNAL_EXPOSED_HEADERS =
+  "x-1tube-warming, x-1tube-stale, x-1tube-auth-unavailable, retry-after";
 
 interface CorsConfig {
   /** "*" means allow any. Empty array means CORS disabled. */

package/src/server.ts

@@ -19,7 +19,7 @@
 import { type Context, Hono } from "npm:hono@4";
 import { bodyLimit } from "npm:hono@4/body-limit";
 import { currentRequestStorage, FunctionRegistry } from "./registry.ts";
-import { validateRequest } from "./gateway/auth.ts";
+import { probeRequest } from "./gateway/auth.ts";
 import { watchdogBody } from "./gateway/body-watchdog.ts";
 import { corsMiddleware } from "./gateway/cors.ts";
 import {
@@ -1842,13 +1842,15 @@ app.use(fnRouteWildcard, async (c, next) => {
   // unauthenticated requests here. Public functions need to pass through and
   // rate-limit by IP; protected functions are gated below in the dispatcher.
   try {
-    const auth = await validateRequest(c.req.raw);
-    if (auth) {
-      c.set("userId", auth.userId);
-      (c as any).set("__authContext", auth);
+    const probed = await probeRequest(c.req.raw);
+    (c as any).set("__authProbe", probed.status);
+    if (probed.status === "ok") {
+      c.set("userId", probed.auth.userId);
+      (c as any).set("__authContext", probed.auth);
     }
   } catch {
-    // Ignore validation errors at probe time — dispatcher will return 401.
+    // Ignore validation errors at probe time — dispatcher will 401/503.
+    (c as any).set("__authProbe", "invalid");
   }
   await next();
 });
@@ -2024,6 +2026,15 @@ app.all(routeDispatchPattern(), async (c) => {
       duplex: "half",
     });
     const auth = (c as any).get("__authContext") ?? null;
+    const knownPublic = registry.get(name)?.isPublic ??
+      registry.workerHandle(name)?.isPublic;
+    if (knownPublic === false && !auth && (c as any).get("__authProbe") === "unavailable") {
+      return c.json(
+        { error: "Auth temporarily unavailable", reason: "jwt_secret_unavailable" },
+        503,
+        { "X-1tube-Auth-Unavailable": "1" },
+      );
+    }
 
     // Per-function timeout from the manifest, falling back to the
     // gateway-wide default. Same precedence the Deno path uses.
@@ -2248,6 +2259,13 @@ app.all(routeDispatchPattern(), async (c) => {
 
   const auth = (c as any).get("__authContext") ?? null;
   if (!handle.isPublic && !auth) {
+    if ((c as any).get("__authProbe") === "unavailable") {
+      return c.json(
+        { error: "Auth temporarily unavailable", reason: "jwt_secret_unavailable" },
+        503,
+        { "X-1tube-Auth-Unavailable": "1" },
+      );
+    }
     return c.json({ error: "Unauthorized" }, 401);
   }