@3sln/trove 0.0.11 → 0.0.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@3sln/trove",
-  "version": "0.0.11",
+  "version": "0.0.12",
   "type": "module",
   "description": "Trove — a self-hostable, plugin-extensible Google Drive. Semantic search, pluggable storage (S3 / filesystem / NAS), and a VS Code-style contribution system with sandboxed plugins.",
   "repository": {

package/packages/server/src/access/externalEvaluation.js

@@ -35,6 +35,18 @@
 //        Evaluate URL   https://<your drive>/api/access/evaluate
 //        Keys URL       https://<your drive>/api/access/keys
 //
+//   4. AND let Access reach them. If the drive sits behind Access — which is the whole
+//      point — then by default these two paths do as well, and Access would have to
+//      authenticate to itself to call them. It cannot, so it fails with nothing useful to
+//      say. Add a Bypass policy for `/api/access/*`.
+//
+//      Bypassing is safe here rather than a concession, and that is by construction: the
+//      keys endpoint serves a public key, and the evaluate endpoint authenticates its
+//      caller itself by verifying the assertion. Neither ever depended on Access for its
+//      own protection. They are also `public: true`, so this drive's OWN identity
+//      requirement does not apply to them either — Access holds no Trove session and
+//      never will.
+//
 // WHY IT REFUSES TO RUN UNVERIFIED
 //
 // This endpoint answers "does this email have access to this drive". That is a question
@@ -116,6 +128,10 @@ export function externalEvaluation({ privateJwk, team, kid = 'trove-access', jwk
           method: 'POST',
           path: '/api/access/evaluate',
           deps: ['collections'],
+          // No Trove identity: the caller is Cloudflare, not a user of this drive, and it
+          // authenticates by signing the assertion — which `verifyJwt` below checks. A
+          // session requirement here would be asking Access to log in as somebody.
+          public: true,
           async handler(ctx) {
             const token = await parseAssertion(ctx.req);
             if (!token) throw TroveError.invalid('No access assertion in the request');
@@ -141,6 +157,7 @@ export function externalEvaluation({ privateJwk, team, kid = 'trove-access', jwk
           method: 'GET',
           path: '/api/access/keys',
           deps: [],
+          public: true,
           // Public by design: it is a public key, and Cloudflare fetches it unauthenticated.
           handler() {
             return { keys: [publicJwkOf(privateJwk, { kid })] };

package/packages/server/src/index.js

@@ -330,11 +330,18 @@ export async function createServer(config = {}) {
   // exist. A drive that has not configured one has no `/api/access/*` at all, rather than
   // endpoints that exist to answer "no" — which is the difference between a feature that is
   // off and a feature that is broken.
+  // Paths a contributed component declared as needing no Trove identity. Exact matches
+  // only, and that is deliberate: the check below runs BEFORE routing, so it cannot know
+  // which parameterised route would have matched. A component that wants a public route
+  // gives it a fixed path.
+  const publicPaths = new Set();
+
   const accessPolicy = config.accessEvaluation
     ? externalEvaluation({ ...config.accessEvaluation, team: config.accessEvaluation.team || config.identity?.access?.team })
     : null;
   for (const route of accessPolicy?.routes?.(routeHelpers) || []) {
     router.add(route.method, route.path, route.deps || [], route.handler);
+    if (route.public) publicPaths.add(route.path);
   }
 
   // Said at boot, because that is when someone is looking and can still fix it. The
@@ -409,8 +416,14 @@ export async function createServer(config = {}) {
       let principal = null;
       let grant = null;
       try {
-        grant = await capabilities.resolve(req);
-        if (!grant) principal = await identity.authenticate(req);
+        // A public route answers to something other than this drive's identity — the
+        // external policy endpoints verify a Cloudflare-signed assertion themselves, and
+        // the keys endpoint serves a public key. Requiring a session on those is asking
+        // the caller to authenticate as a user it is not and does not have.
+        if (!publicPaths.has(url.pathname)) {
+          grant = await capabilities.resolve(req);
+          if (!grant) principal = await identity.authenticate(req);
+        }
       } catch (err) {
         const e = err instanceof TroveError ? err : TroveError.unauthorized('Authentication failed');
         return withChallenge(new Response(JSON.stringify(e.toJSON()), { status: e.status, headers: { 'content-type': 'application/json', 'x-content-type-options': 'nosniff' } }), req);