@dbx-tools/cli-tunnel 0.6.59 → 0.6.85

package/src/proxy.ts

@@ -1,298 +1,176 @@
 /**
- * The tunnel gate reverse-proxy.
+ * The reverse proxy that makes the wrapper path possible.
  *
- * Binds the PUBLIC port (the container's `DATABRICKS_APP_PORT`) and forwards to
- * the real app on a private loopback port. It is the single front door for both
- * traffic paths into the container:
+ * The wrapper claims the PUBLIC port and the wrapped app runs as a child process
+ * on a private loopback port, so - unlike the in-process plugin - there is no
+ * middleware chain to insert the gate into. This proxy is that insertion point: it
+ * answers the login routes itself, applies the gate to everything else, and
+ * forwards what survives to the child.
  *
- *   - **portr client** (same container, connects over LOOPBACK) - the public
- *     tunnel. This is what the gate protects.
- *   - **the hosting platform's front door** (Databricks Apps' control plane, or
- *     any other host reaching the `0.0.0.0` port from a NON-loopback
- *     container-network address) - passed through UNGATED, per the rule "if it's
- *     not from the portr client, let it in". The platform already authenticates
- *     that path; the gate exists for the tunnel, which nothing else protects.
- *
- * The distinguisher is the connection's source address: a loopback
- * `req.socket.remoteAddress` is the portr client; anything else is the platform.
- *
- * For portr traffic the gate is a standard SPA gate: static assets + the login
- * flow (`/api/email/auth/*`, answered IN-PROCESS by this proxy via the
- * {@link AuthGateApi}) are open so the browser can load the client and render the
- * `<AuthGate>`; every other `/api/*` needs a valid session cookie or gets 401.
- * WebSocket upgrades are gated the same way and forwarded with `http-proxy-3`.
+ * The gating DECISION is not reimplemented here. `@dbx-tools/tunnel`'s
+ * `gate.gateRequest` makes it - the same function the Express middleware calls -
+ * and this module only differs in how the outcome is written: a proxied request
+ * instead of `next()`, a `writeHead` instead of `res.json`. That is deliberate:
+ * two independent implementations of "which requests are gated and which headers
+ * are stripped" is the one way this package could become a security bug.
  *
  * @module
  */
 
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
 import type { Socket } from "node:net";
-import { http, json, log, token } from "@dbx-tools/shared-core";
+import { http, json, log } from "@dbx-tools/shared-core";
 import { authRequestSchema, authVerifySchema, SESSION_COOKIE_NAME } from "@dbx-tools/shared-email";
+import { gate as gateModule, headers as headersModule, type AuthGateApi } from "@dbx-tools/tunnel";
 import ProxyModule from "http-proxy-3";
-import { toHeaderPolicy, type HeaderPolicy } from "./headers.ts";
-import type { AuthGateApi } from "./plugin.ts";
 
 const logger = log.logger("tunnel:proxy");
 
-/** Route prefix the login flow lives under (open, answered in-process). */
-const AUTH_PREFIX = "/api/email/auth";
-
-/** True when a socket address is loopback (the portr client, same container). */
-function isLoopback(addr: string | undefined): boolean {
-  if (!addr) return false;
-  // Normalize IPv4-mapped IPv6 (`::ffff:127.0.0.1`) and bare IPv6 loopback.
-  const a = addr.replace(/^::ffff:/, "");
-  return a === "127.0.0.1" || a.startsWith("127.") || a === "::1" || a === "localhost";
-}
-
-/** Read the whole request body as text (small JSON payloads only). */
-function readBody(req: IncomingMessage): Promise<string> {
-  return new Promise((resolve) => {
-    let data = "";
-    req.on("data", (chunk) => (data += chunk));
-    req.on("end", () => resolve(data));
-    req.on("error", () => resolve(data));
-  });
-}
-
-function sendJson(res: ServerResponse, status: number, body: unknown, setCookie?: string): void {
-  const headers: Record<string, string> = { "content-type": "application/json" };
-  if (setCookie) headers["set-cookie"] = setCookie;
-  res.writeHead(status, headers);
-  res.end(JSON.stringify(body));
-}
-
-/** Options for {@link startProxy}. */
 export interface ProxyOptions {
-  /** Public port to listen on (the container's DATABRICKS_APP_PORT). */
+  /** The port this proxy listens on - the port portr and the platform route to. */
   publicPort: number;
-  /** Private port the real app listens on (loopback). */
+  /** The private loopback port the wrapped app listens on. */
   appPort: number;
-  /**
-   * The in-process gate API, or `undefined` to run OPEN (insecure mode): every
-   * request - including portr traffic - is forwarded ungated. Used when the
-   * operator passed `--insecure` / `TUNNEL_INSECURE=true`.
-   */
+  /** The gate handlers. Omitted (an `--insecure` run) forwards everything. */
   gate?: AuthGateApi;
-  /**
-   * Extra `x-` request headers tunnel traffic may forward, as literals, globs, or
-   * `/regex/`es - unioned with {@link DEFAULT_FORWARD_HEADERS}. Every other `x-`
-   * header is stripped, and {@link PROTECTED_HEADERS} is stripped regardless. See
-   * `./headers.ts` for why the policy is an allow-list.
-   */
+  /** Extra `x-` headers tunnel traffic may forward. */
   forwardHeaders?: readonly string[];
 }
 
-/** Start the gate proxy. Resolves once it is listening. */
-export function startProxy({
-  publicPort,
-  appPort,
-  gate,
-  forwardHeaders,
-}: ProxyOptions): Promise<void> {
-  const proxy = ProxyModule.createProxyServer({
-    target: { host: "127.0.0.1", port: appPort },
-    ws: true,
-    xfwd: true,
-  });
-  proxy.on("error", (err: Error, _req: unknown, res: unknown) => {
-    logger.warn("upstream proxy error", { error: err.message });
-    const r = res as ServerResponse | undefined;
-    if (r && "writeHead" in r && !r.headersSent) {
-      sendJson(r, 502, { error: "upstream unavailable" });
-    }
+/** Read a request body as text; a transport error yields whatever arrived. */
+function readBody(request: IncomingMessage): Promise<string> {
+  return new Promise((resolve) => {
+    let body = "";
+    request.on("data", (chunk) => (body += chunk));
+    request.on("end", () => resolve(body));
+    request.on("error", () => resolve(body));
   });
+}
 
-  // Compiled once: the inbound-header allow-list applied to every gated request.
-  const headerPolicy = toHeaderPolicy(forwardHeaders);
-  logger.debug("inbound header policy", { forward: headerPolicy.patterns });
-
-  /** The session cookie for a verified email, as a Set-Cookie string. */
-  const sessionCookie = (token: string, maxAgeSeconds: number): string =>
-    [
-      `${SESSION_COOKIE_NAME}=${token}`,
-      "Path=/",
-      "HttpOnly",
-      "SameSite=Lax",
-      `Max-Age=${maxAgeSeconds}`,
-      process.env.NODE_ENV === "production" ? "Secure" : "",
-    ]
-      .filter(Boolean)
-      .join("; ");
-
-  /**
-   * Client IP for rate-limiting: the portr client's forwarded XFF, else the socket.
-   *
-   * Deliberately the RIGHTMOST `x-forwarded-for` entry, not the leftmost. The
-   * list grows left-to-right as each hop appends, so the last entry is the one
-   * the nearest trusted proxy (portr) wrote and every earlier entry is a value
-   * the caller could have sent. Reading the leftmost lets a client vary one
-   * header to get a fresh rate-limit bucket per request, which defeats both the
-   * per-IP code-request and verify-attempt limiters. Called BEFORE
-   * {@link HeaderPolicy.apply} strips the header, so the honest hop value is
-   * still available here.
-   */
-  const clientIp = (req: IncomingMessage): string => {
-    const forwarded = req.headers["x-forwarded-for"];
-    const chain = (Array.isArray(forwarded) ? forwarded.join(",") : (forwarded ?? ""))
-      .split(",")
-      .map((entry) => entry.trim())
-      .filter(Boolean);
-    return chain.at(-1) ?? req.socket.remoteAddress ?? "unknown";
-  };
-
-  /**
-   * Remove the gate's session cookie from the `Cookie` header before forwarding,
-   * so the app never sees `dbx_auth` (it is the proxy's concern, not the app's).
-   * Preserves any other cookies. Removes the header entirely when it becomes empty.
-   */
-  const stripSessionCookie = (req: IncomingMessage): void => {
-    const raw = req.headers.cookie;
-    if (!raw) return;
-    const kept = raw
-      .split(";")
-      .map((c) => c.trim())
-      .filter((c) => c && !c.startsWith(`${SESSION_COOKIE_NAME}=`));
-    if (kept.length) req.headers.cookie = kept.join("; ");
-    else delete req.headers.cookie;
-  };
-
-  /**
-   * Present an OTP-authenticated caller to the app the SAME way a platform front
-   * door does: set the front door's own identity headers to the verified address
-   * (AppKit reads {@link token.USER_ID_HEADER} for the OBO user id), so the app
-   * needs no gate-specific code path. The names come from
-   * `@dbx-tools/shared-core`'s `token` module - the same constants AppKit-side
-   * code reads them by - rather than being re-spelled here.
-   *
-   * What the gate CANNOT set is {@link token.ACCESS_TOKEN_HEADER}: an OTP session
-   * proves an email address, not possession of a Databricks credential, and
-   * there is no way to mint one for the caller. Its absence is exactly what
-   * `@dbx-tools/appkit`'s `identity` `"auto"` mode detects, so a gated request
-   * runs as the app's service principal instead of throwing.
-   */
-  const injectIdentity = (req: IncomingMessage, email: string): void => {
-    req.headers[token.USER_ID_HEADER] = email;
-    req.headers[token.USER_EMAIL_HEADER] = email;
-  };
-
-  /**
-   * Apply the inbound-header policy to a tunnel request: every `x-` header the
-   * allow-list does not name is deleted, and the platform identity/transport set
-   * is deleted regardless. See `./headers.ts` for the reasoning; the
-   * security-critical case is {@link token.ACCESS_TOKEN_HEADER}, which the gate
-   * never sets but an app running `identity: "auto"` treats as proof the request
-   * can do OBO.
-   *
-   * `xfwd: true` on the proxy re-adds `x-forwarded-for`/`-proto`/`-port`/`-host`
-   * afterwards from the real socket, so the app still sees those - it just sees
-   * the honest values rather than the caller's claim.
-   */
-  const applyHeaderPolicy = (req: IncomingMessage): void => {
-    const removed = headerPolicy.apply(req.headers as Record<string, unknown>);
-    if (removed.length) logger.debug("stripped inbound headers", { removed });
-  };
-
-  const server = createServer(async (req, res) => {
-    const path = (req.url ?? "/").split("?")[0]!;
-
-    // Insecure/open mode (no gate) OR non-loopback traffic (the hosting
-    // platform's front door / control plane): forward ungated.
-    if (!gate || !isLoopback(req.socket.remoteAddress)) {
-      proxy.web(req, res);
-      return;
-    }
-
-    // --- portr traffic: the gate applies ---
-
-    // The login flow is answered IN-PROCESS (the app has no server to forward to).
-    if (path === `${AUTH_PREFIX}/status`) {
-      const token = http.parseCookies(req.headers.cookie ?? null)[SESSION_COOKIE_NAME];
-      sendJson(res, 200, await gate.status(token));
-      return;
-    }
-    if (path === `${AUTH_PREFIX}/request` && req.method === "POST") {
-      const parsed = authRequestSchema.safeParse(json.parseRecord(await readBody(req)));
-      if (!parsed.success) return sendJson(res, 200, { ok: true }); // anti-enumeration
-      return sendJson(res, 200, await gate.request(parsed.data.email, clientIp(req)));
-    }
-    if (path === `${AUTH_PREFIX}/verify` && req.method === "POST") {
-      const parsed = authVerifySchema.safeParse(json.parseRecord(await readBody(req)));
-      if (!parsed.success) return sendJson(res, 200, { ok: false });
-      const result = await gate.verify(parsed.data.email, parsed.data.code, clientIp(req));
-      const cookie =
-        result.ok && result.token ? sessionCookie(result.token, gate.sessionTtlSeconds) : undefined;
-      return sendJson(
-        res,
-        200,
-        { ok: result.ok, ...(result.retryAfter ? { retryAfter: result.retryAfter } : {}) },
-        cookie,
-      );
-    }
-    if (path === `${AUTH_PREFIX}/logout` && req.method === "POST") {
-      return sendJson(
-        res,
-        200,
-        { ok: true },
-        `${SESSION_COOKIE_NAME}=; Path=/; HttpOnly; Max-Age=0`,
-      );
-    }
+function sendJson(
+  response: ServerResponse,
+  status: number,
+  body: unknown,
+  setCookie?: string,
+): void {
+  response.writeHead(status, {
+    "content-type": "application/json",
+    ...(setCookie ? { "set-cookie": setCookie } : {}),
+  });
+  response.end(JSON.stringify(body));
+}
 
-    // Anti-spoof: apply the inbound-header allow-list to portr traffic - only the
-    // gate may assert identity, and it does so below for a verified session.
-    applyHeaderPolicy(req);
+function sessionCookieValue(request: IncomingMessage): string | undefined {
+  return http.parseCookies(request.headers.cookie ?? null)[SESSION_COOKIE_NAME];
+}
 
-    // Static (non-API) loads freely so the SPA + <AuthGate> can render. Strip the
-    // session cookie so it never leaks to the static handler.
-    if (!path.startsWith("/api/")) {
-      stripSessionCookie(req);
-      proxy.web(req, res);
-      return;
+/**
+ * Answer one of the four login routes, or return `false` when the request is not
+ * one of them. Mirrors the plugin's route handlers: `request` always reports
+ * success (anti-enumeration) and `verify` sets the session cookie on success.
+ */
+async function handleAuthRoute(
+  request: IncomingMessage,
+  response: ServerResponse,
+  path: string,
+  gate: AuthGateApi,
+): Promise<boolean> {
+  const prefix = gateModule.AUTH_PREFIX;
+  const ip = gateModule.clientIp(request);
+
+  if (path === `${prefix}/status`) {
+    sendJson(response, 200, await gate.status(sessionCookieValue(request)));
+    return true;
+  }
+  if (path === `${prefix}/request` && request.method === "POST") {
+    const parsed = authRequestSchema.safeParse(json.parseRecord(await readBody(request)));
+    sendJson(response, 200, parsed.success ? await gate.request(parsed.data.email, ip) : { ok: true });
+    return true;
+  }
+  if (path === `${prefix}/verify` && request.method === "POST") {
+    const parsed = authVerifySchema.safeParse(json.parseRecord(await readBody(request)));
+    if (!parsed.success) {
+      sendJson(response, 200, { ok: false });
+      return true;
     }
+    const result = await gate.verify(parsed.data.email, parsed.data.code, ip);
+    const cookie =
+      result.ok && result.token
+        ? gateModule.sessionSetCookie(result.token, gate.sessionTtlSeconds)
+        : undefined;
+    sendJson(
+      response,
+      200,
+      { ok: result.ok, ...(result.retryAfter ? { retryAfter: result.retryAfter } : {}) },
+      cookie,
+    );
+    return true;
+  }
+  if (path === `${prefix}/logout` && request.method === "POST") {
+    sendJson(response, 200, { ok: true }, gateModule.LOGOUT_SET_COOKIE);
+    return true;
+  }
+  return false;
+}
 
-    // Every other /api/* requires a valid session.
-    const token = http.parseCookies(req.headers.cookie ?? null)[SESSION_COOKIE_NAME];
-    const email = await gate.session(token);
-    if (email) {
-      // Present the OTP user like a platform front door, and drop the gate
-      // cookie so the app sees a clean, front-door-shaped request.
-      injectIdentity(req, email);
-      stripSessionCookie(req);
-      proxy.web(req, res);
-    } else {
-      sendJson(res, 401, { error: "authentication required", loginPath: AUTH_PREFIX });
-    }
+/**
+ * Start the proxy and resolve once it is listening.
+ *
+ * `publicDomain` is intentionally NOT passed to `gateRequest`: on this path every
+ * request arrived on the public port, so it IS tunnel traffic by construction -
+ * whereas the in-process gate shares a port with the platform front door and has
+ * to tell them apart by `Host`. Passing the request's own host keeps the shared
+ * decision function's contract satisfied without weakening it.
+ */
+export function startProxy(options: ProxyOptions): Promise<void> {
+  const proxy = ProxyModule.createProxyServer({
+    target: `http://127.0.0.1:${options.appPort}`,
+    ws: true,
+    xfwd: true,
   });
-
-  // WebSocket upgrades: forward front-door traffic untouched; gate loopback
-  // (portr) API upgrades the same way as HTTP (strip cookie + inject identity).
-  server.on("upgrade", (req: IncomingMessage, socket: Socket, head: Buffer) => {
-    if (!gate || !isLoopback(req.socket.remoteAddress)) {
-      proxy.ws(req, socket, head);
-      return;
-    }
-    applyHeaderPolicy(req);
-    if (!(req.url ?? "").startsWith("/api/")) {
-      stripSessionCookie(req);
-      proxy.ws(req, socket, head);
-      return;
-    }
-    const token = http.parseCookies(req.headers.cookie ?? null)[SESSION_COOKIE_NAME];
-    void gate.session(token).then((email) => {
-      if (!email) {
-        socket.destroy();
+  const headerPolicy = headersModule.toHeaderPolicy(options.forwardHeaders);
+  const gate = options.gate;
+
+  const decide = (request: IncomingMessage): Promise<gateModule.GateAction> =>
+    gate
+      ? gateModule.gateRequest(request, {
+          gate,
+          publicDomain: (request.headers.host ?? "").split(":")[0] || "localhost",
+          headerPolicy,
+        })
+      : Promise.resolve<gateModule.GateAction>("pass");
+
+  const server = createServer((request, response) => {
+    void (async () => {
+      const path = (request.url ?? "/").split("?")[0] ?? "/";
+      if (gate && (await handleAuthRoute(request, response, path, gate))) return;
+      if ((await decide(request)) === "deny") {
+        sendJson(response, 401, gateModule.UNAUTHORIZED_BODY);
         return;
       }
-      injectIdentity(req, email);
-      stripSessionCookie(req);
-      proxy.ws(req, socket, head);
+      proxy.web(request, response);
+    })().catch((error: unknown) => {
+      logger.error("proxy request failed", { error });
+      if (!response.headersSent) sendJson(response, 502, { error: "bad gateway" });
+      else response.end();
     });
   });
 
+  // A websocket upgrade cannot be answered with a 401 body, so a denied one is
+  // destroyed - the client sees the handshake fail, which is what a browser's
+  // WebSocket error handler expects.
+  server.on("upgrade", (request: IncomingMessage, socket: Socket, head: Buffer) => {
+    void decide(request)
+      .then((action) => {
+        if (action === "deny") socket.destroy();
+        else proxy.ws(request, socket, head);
+      })
+      .catch(() => socket.destroy());
+  });
+
   return new Promise((resolve) => {
-    server.listen(publicPort, "0.0.0.0", () => {
-      logger.info(`gate proxy on 0.0.0.0:${publicPort} -> app 127.0.0.1:${appPort}`);
+    server.listen(options.publicPort, "0.0.0.0", () => {
+      logger.info("proxy listening", { publicPort: options.publicPort, appPort: options.appPort });
       resolve();
     });
   });

package/bin/dbx-tools-tunnel.ts

@@ -1,13 +0,0 @@
-#!/usr/bin/env node
-/**
- * `dbx-tools-tunnel` / `dbxt-tunnel` entry: front an app with a public
- * portr tunnel + email-OTP gate, wrapping the start command after `--`.
- * Delegates to the commander program in `../src/cli`.
- */
-import { CommanderError, runCli } from "../src/cli.ts";
-
-runCli(process.argv).catch((err: unknown) => {
-  if (err instanceof CommanderError) process.exit(err.exitCode);
-  process.stderr.write(`${err instanceof Error ? (err.stack ?? err.message) : String(err)}\n`);
-  process.exit(1);
-});

package/lib/bin/dbx-tools-tunnel.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-export {};

package/lib/bin/dbx-tools-tunnel.js

@@ -1,14 +0,0 @@
-#!/usr/bin/env node
-/**
- * `dbx-tools-tunnel` / `dbxt-tunnel` entry: front an app with a public
- * portr tunnel + email-OTP gate, wrapping the start command after `--`.
- * Delegates to the commander program in `../src/cli`.
- */
-import { CommanderError, runCli } from "../src/cli.js";
-runCli(process.argv).catch((err) => {
-    if (err instanceof CommanderError)
-        process.exit(err.exitCode);
-    process.stderr.write(`${err instanceof Error ? (err.stack ?? err.message) : String(err)}\n`);
-    process.exit(1);
-});
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGJ4LXRvb2xzLXR1bm5lbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL2Jpbi9kYngtdG9vbHMtdHVubmVsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUFDQTs7OztHQUlHO0FBQ0gsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLEVBQUUsTUFBTSxlQUFlLENBQUM7QUFFdkQsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFZLEVBQUUsRUFBRTtJQUMxQyxJQUFJLEdBQUcsWUFBWSxjQUFjO1FBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDOUQsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxHQUFHLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxLQUFLLElBQUksR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzdGLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDbEIsQ0FBQyxDQUFDLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIjIS91c3IvYmluL2VudiBub2RlXG4vKipcbiAqIGBkYngtdG9vbHMtdHVubmVsYCAvIGBkYnh0LXR1bm5lbGAgZW50cnk6IGZyb250IGFuIGFwcCB3aXRoIGEgcHVibGljXG4gKiBwb3J0ciB0dW5uZWwgKyBlbWFpbC1PVFAgZ2F0ZSwgd3JhcHBpbmcgdGhlIHN0YXJ0IGNvbW1hbmQgYWZ0ZXIgYC0tYC5cbiAqIERlbGVnYXRlcyB0byB0aGUgY29tbWFuZGVyIHByb2dyYW0gaW4gYC4uL3NyYy9jbGlgLlxuICovXG5pbXBvcnQgeyBDb21tYW5kZXJFcnJvciwgcnVuQ2xpIH0gZnJvbSBcIi4uL3NyYy9jbGkudHNcIjtcblxucnVuQ2xpKHByb2Nlc3MuYXJndikuY2F0Y2goKGVycjogdW5rbm93bikgPT4ge1xuICBpZiAoZXJyIGluc3RhbmNlb2YgQ29tbWFuZGVyRXJyb3IpIHByb2Nlc3MuZXhpdChlcnIuZXhpdENvZGUpO1xuICBwcm9jZXNzLnN0ZGVyci53cml0ZShgJHtlcnIgaW5zdGFuY2VvZiBFcnJvciA/IChlcnIuc3RhY2sgPz8gZXJyLm1lc3NhZ2UpIDogU3RyaW5nKGVycil9XFxuYCk7XG4gIHByb2Nlc3MuZXhpdCgxKTtcbn0pO1xuIl19

package/lib/src/allowlist.d.ts

@@ -1,32 +0,0 @@
-/**
- * Unified access allow-list matching for the email-OTP gate.
- *
- * Each pattern in the configured list is one of three shapes:
- *
- *   - **domain shortcut** - `example.com` or `@example.com`: matches any
- *     address whose domain equals it. This is the gate's OWN semantic (a bare
- *     value means "the domain", not "the whole address"), so it is handled here.
- *   - **glob** - contains `*` or `?`, e.g. `*@example.com`: matched against the
- *     WHOLE address with shell-style wildcards.
- *   - **regex** - wrapped in slashes, `/.../ [flags]`: tested against the whole
- *     address. An invalid regex never matches (it is skipped with a warning
- *     rather than throwing).
- *
- * Only the first shape is this module's business: the glob and regex shapes are
- * delegated to `@dbx-tools/shared-core`'s {@link pattern.toPattern}, which is
- * where that compilation lives for every allow-list in the repo (the tunnel's
- * inbound-header policy uses the same one). Matching is case-insensitive
- * throughout.
- *
- * An EMPTY list matches nobody (fail closed): an app that enables the gate but
- * configures no patterns lets no one in, which is the safe default.
- *
- * @module
- */
-/**
- * True when `email` is allowed by ANY pattern in `patterns`. An empty (or
- * missing) list allows nobody - the gate fails closed.
- */
-export declare function matchesAllowlist(email: string, patterns: readonly string[] | undefined): boolean;
-/** Rough shape check so a clearly-invalid address is rejected before any work. */
-export declare function looksLikeEmail(value: string): boolean;

package/lib/src/allowlist.js

@@ -1,57 +0,0 @@
-/**
- * Unified access allow-list matching for the email-OTP gate.
- *
- * Each pattern in the configured list is one of three shapes:
- *
- *   - **domain shortcut** - `example.com` or `@example.com`: matches any
- *     address whose domain equals it. This is the gate's OWN semantic (a bare
- *     value means "the domain", not "the whole address"), so it is handled here.
- *   - **glob** - contains `*` or `?`, e.g. `*@example.com`: matched against the
- *     WHOLE address with shell-style wildcards.
- *   - **regex** - wrapped in slashes, `/.../ [flags]`: tested against the whole
- *     address. An invalid regex never matches (it is skipped with a warning
- *     rather than throwing).
- *
- * Only the first shape is this module's business: the glob and regex shapes are
- * delegated to `@dbx-tools/shared-core`'s {@link pattern.toPattern}, which is
- * where that compilation lives for every allow-list in the repo (the tunnel's
- * inbound-header policy uses the same one). Matching is case-insensitive
- * throughout.
- *
- * An EMPTY list matches nobody (fail closed): an app that enables the gate but
- * configures no patterns lets no one in, which is the safe default.
- *
- * @module
- */
-import { pattern } from "@dbx-tools/shared-core";
-/** True when `email` matches a single allow-list `pattern`. */
-function matchesPattern(email, entry) {
-    const trimmed = entry.trim();
-    if (!trimmed)
-        return false;
-    const address = email.trim().toLowerCase();
-    // A bare value with no wildcard and no regex delimiters is a DOMAIN shortcut,
-    // the one shape shared-core cannot infer: there it would mean whole-string
-    // equality against the address, which is never what an operator writing
-    // `example.com` in an access list intends.
-    if (!trimmed.startsWith("/") && !trimmed.includes("*") && !trimmed.includes("?")) {
-        const domain = trimmed.replace(/^@/, "").toLowerCase();
-        const at = address.lastIndexOf("@");
-        return at >= 0 && address.slice(at + 1) === domain;
-    }
-    return pattern.toPattern(trimmed)?.(address) ?? false;
-}
-/**
- * True when `email` is allowed by ANY pattern in `patterns`. An empty (or
- * missing) list allows nobody - the gate fails closed.
- */
-export function matchesAllowlist(email, patterns) {
-    if (!email || !patterns || patterns.length === 0)
-        return false;
-    return patterns.some((entry) => matchesPattern(email, entry));
-}
-/** Rough shape check so a clearly-invalid address is rejected before any work. */
-export function looksLikeEmail(value) {
-    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value.trim());
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWxsb3dsaXN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FsbG93bGlzdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBd0JHO0FBRUgsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBRWpELCtEQUErRDtBQUMvRCxTQUFTLGNBQWMsQ0FBQyxLQUFhLEVBQUUsS0FBYTtJQUNsRCxNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDN0IsSUFBSSxDQUFDLE9BQU87UUFBRSxPQUFPLEtBQUssQ0FBQztJQUMzQixNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUM7SUFFM0MsOEVBQThFO0lBQzlFLDJFQUEyRTtJQUMzRSx3RUFBd0U7SUFDeEUsMkNBQTJDO0lBQzNDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNqRixNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUN2RCxNQUFNLEVBQUUsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3BDLE9BQU8sRUFBRSxJQUFJLENBQUMsSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUMsS0FBSyxNQUFNLENBQUM7SUFDckQsQ0FBQztJQUVELE9BQU8sT0FBTyxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEtBQUssQ0FBQztBQUN4RCxDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQixDQUFDLEtBQWEsRUFBRSxRQUF1QztJQUNyRixJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsUUFBUSxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQy9ELE9BQU8sUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsY0FBYyxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDO0FBQ2hFLENBQUM7QUFFRCxrRkFBa0Y7QUFDbEYsTUFBTSxVQUFVLGNBQWMsQ0FBQyxLQUFhO0lBQzFDLE9BQU8sNEJBQTRCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO0FBQ3pELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIFVuaWZpZWQgYWNjZXNzIGFsbG93LWxpc3QgbWF0Y2hpbmcgZm9yIHRoZSBlbWFpbC1PVFAgZ2F0ZS5cbiAqXG4gKiBFYWNoIHBhdHRlcm4gaW4gdGhlIGNvbmZpZ3VyZWQgbGlzdCBpcyBvbmUgb2YgdGhyZWUgc2hhcGVzOlxuICpcbiAqICAgLSAqKmRvbWFpbiBzaG9ydGN1dCoqIC0gYGV4YW1wbGUuY29tYCBvciBgQGV4YW1wbGUuY29tYDogbWF0Y2hlcyBhbnlcbiAqICAgICBhZGRyZXNzIHdob3NlIGRvbWFpbiBlcXVhbHMgaXQuIFRoaXMgaXMgdGhlIGdhdGUncyBPV04gc2VtYW50aWMgKGEgYmFyZVxuICogICAgIHZhbHVlIG1lYW5zIFwidGhlIGRvbWFpblwiLCBub3QgXCJ0aGUgd2hvbGUgYWRkcmVzc1wiKSwgc28gaXQgaXMgaGFuZGxlZCBoZXJlLlxuICogICAtICoqZ2xvYioqIC0gY29udGFpbnMgYCpgIG9yIGA/YCwgZS5nLiBgKkBleGFtcGxlLmNvbWA6IG1hdGNoZWQgYWdhaW5zdCB0aGVcbiAqICAgICBXSE9MRSBhZGRyZXNzIHdpdGggc2hlbGwtc3R5bGUgd2lsZGNhcmRzLlxuICogICAtICoqcmVnZXgqKiAtIHdyYXBwZWQgaW4gc2xhc2hlcywgYC8uLi4vIFtmbGFnc11gOiB0ZXN0ZWQgYWdhaW5zdCB0aGUgd2hvbGVcbiAqICAgICBhZGRyZXNzLiBBbiBpbnZhbGlkIHJlZ2V4IG5ldmVyIG1hdGNoZXMgKGl0IGlzIHNraXBwZWQgd2l0aCBhIHdhcm5pbmdcbiAqICAgICByYXRoZXIgdGhhbiB0aHJvd2luZykuXG4gKlxuICogT25seSB0aGUgZmlyc3Qgc2hhcGUgaXMgdGhpcyBtb2R1bGUncyBidXNpbmVzczogdGhlIGdsb2IgYW5kIHJlZ2V4IHNoYXBlcyBhcmVcbiAqIGRlbGVnYXRlZCB0byBgQGRieC10b29scy9zaGFyZWQtY29yZWAncyB7QGxpbmsgcGF0dGVybi50b1BhdHRlcm59LCB3aGljaCBpc1xuICogd2hlcmUgdGhhdCBjb21waWxhdGlvbiBsaXZlcyBmb3IgZXZlcnkgYWxsb3ctbGlzdCBpbiB0aGUgcmVwbyAodGhlIHR1bm5lbCdzXG4gKiBpbmJvdW5kLWhlYWRlciBwb2xpY3kgdXNlcyB0aGUgc2FtZSBvbmUpLiBNYXRjaGluZyBpcyBjYXNlLWluc2Vuc2l0aXZlXG4gKiB0aHJvdWdob3V0LlxuICpcbiAqIEFuIEVNUFRZIGxpc3QgbWF0Y2hlcyBub2JvZHkgKGZhaWwgY2xvc2VkKTogYW4gYXBwIHRoYXQgZW5hYmxlcyB0aGUgZ2F0ZSBidXRcbiAqIGNvbmZpZ3VyZXMgbm8gcGF0dGVybnMgbGV0cyBubyBvbmUgaW4sIHdoaWNoIGlzIHRoZSBzYWZlIGRlZmF1bHQuXG4gKlxuICogQG1vZHVsZVxuICovXG5cbmltcG9ydCB7IHBhdHRlcm4gfSBmcm9tIFwiQGRieC10b29scy9zaGFyZWQtY29yZVwiO1xuXG4vKiogVHJ1ZSB3aGVuIGBlbWFpbGAgbWF0Y2hlcyBhIHNpbmdsZSBhbGxvdy1saXN0IGBwYXR0ZXJuYC4gKi9cbmZ1bmN0aW9uIG1hdGNoZXNQYXR0ZXJuKGVtYWlsOiBzdHJpbmcsIGVudHJ5OiBzdHJpbmcpOiBib29sZWFuIHtcbiAgY29uc3QgdHJpbW1lZCA9IGVudHJ5LnRyaW0oKTtcbiAgaWYgKCF0cmltbWVkKSByZXR1cm4gZmFsc2U7XG4gIGNvbnN0IGFkZHJlc3MgPSBlbWFpbC50cmltKCkudG9Mb3dlckNhc2UoKTtcblxuICAvLyBBIGJhcmUgdmFsdWUgd2l0aCBubyB3aWxkY2FyZCBhbmQgbm8gcmVnZXggZGVsaW1pdGVycyBpcyBhIERPTUFJTiBzaG9ydGN1dCxcbiAgLy8gdGhlIG9uZSBzaGFwZSBzaGFyZWQtY29yZSBjYW5ub3QgaW5mZXI6IHRoZXJlIGl0IHdvdWxkIG1lYW4gd2hvbGUtc3RyaW5nXG4gIC8vIGVxdWFsaXR5IGFnYWluc3QgdGhlIGFkZHJlc3MsIHdoaWNoIGlzIG5ldmVyIHdoYXQgYW4gb3BlcmF0b3Igd3JpdGluZ1xuICAvLyBgZXhhbXBsZS5jb21gIGluIGFuIGFjY2VzcyBsaXN0IGludGVuZHMuXG4gIGlmICghdHJpbW1lZC5zdGFydHNXaXRoKFwiL1wiKSAmJiAhdHJpbW1lZC5pbmNsdWRlcyhcIipcIikgJiYgIXRyaW1tZWQuaW5jbHVkZXMoXCI/XCIpKSB7XG4gICAgY29uc3QgZG9tYWluID0gdHJpbW1lZC5yZXBsYWNlKC9eQC8sIFwiXCIpLnRvTG93ZXJDYXNlKCk7XG4gICAgY29uc3QgYXQgPSBhZGRyZXNzLmxhc3RJbmRleE9mKFwiQFwiKTtcbiAgICByZXR1cm4gYXQgPj0gMCAmJiBhZGRyZXNzLnNsaWNlKGF0ICsgMSkgPT09IGRvbWFpbjtcbiAgfVxuXG4gIHJldHVybiBwYXR0ZXJuLnRvUGF0dGVybih0cmltbWVkKT8uKGFkZHJlc3MpID8/IGZhbHNlO1xufVxuXG4vKipcbiAqIFRydWUgd2hlbiBgZW1haWxgIGlzIGFsbG93ZWQgYnkgQU5ZIHBhdHRlcm4gaW4gYHBhdHRlcm5zYC4gQW4gZW1wdHkgKG9yXG4gKiBtaXNzaW5nKSBsaXN0IGFsbG93cyBub2JvZHkgLSB0aGUgZ2F0ZSBmYWlscyBjbG9zZWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBtYXRjaGVzQWxsb3dsaXN0KGVtYWlsOiBzdHJpbmcsIHBhdHRlcm5zOiByZWFkb25seSBzdHJpbmdbXSB8IHVuZGVmaW5lZCk6IGJvb2xlYW4ge1xuICBpZiAoIWVtYWlsIHx8ICFwYXR0ZXJucyB8fCBwYXR0ZXJucy5sZW5ndGggPT09IDApIHJldHVybiBmYWxzZTtcbiAgcmV0dXJuIHBhdHRlcm5zLnNvbWUoKGVudHJ5KSA9PiBtYXRjaGVzUGF0dGVybihlbWFpbCwgZW50cnkpKTtcbn1cblxuLyoqIFJvdWdoIHNoYXBlIGNoZWNrIHNvIGEgY2xlYXJseS1pbnZhbGlkIGFkZHJlc3MgaXMgcmVqZWN0ZWQgYmVmb3JlIGFueSB3b3JrLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGxvb2tzTGlrZUVtYWlsKHZhbHVlOiBzdHJpbmcpOiBib29sZWFuIHtcbiAgcmV0dXJuIC9eW15cXHNAXStAW15cXHNAXStcXC5bXlxcc0BdKyQvLnRlc3QodmFsdWUudHJpbSgpKTtcbn1cbiJdfQ==

package/lib/src/env.d.ts

@@ -1,57 +0,0 @@
-/**
- * Environment-variable names the tunnel reads.
- *
- * Every setting is `TUNNEL_`-prefixed, matching the repo convention of naming a
- * variable after the package that owns it (`MASTRA_*`, `TEAMS_*`,
- * `WEB_SEARCH_*`). The gate's original names were unprefixed (`AUTH_SUBJECT`,
- * `PUBLIC_DOMAIN`, ...), which is a real hazard for a package that runs as a
- * WRAPPER: the tunnel and the app it wraps share one environment, so a generic
- * name is one the wrapped app may already use for something else, and
- * `PUBLIC_DOMAIN` in particular reads like an app-wide setting rather than a
- * portr detail. `EMAIL_AUTH_ALLOW` was worse than generic - it sat in
- * `@dbx-tools/email`'s `EMAIL_*` namespace while configuring the gate, not email.
- *
- * Each entry is an {@link EnvKey} list, EARLIEST-WINS, whose first element is the
- * current name and whose remaining elements are the deprecated originals. A
- * deployment set up against the old names keeps working; nothing needs a
- * coordinated rename. Read them through `env.string` / `env.positiveInt` /
- * `env.list`, which accept the list directly.
- *
- * Not renamed:
- *
- *   - `DATABRICKS_APP_PORT` - the Databricks Apps runtime contract. The platform
- *     sets it; the gate honours it.
- *   - `PORTR_TOKEN` / `PORTR_SERVER` / `PORTR_AUTO_ADD_PATH` - upstream
- *     [portr](https://github.com/amalshaji/portr)'s own namespace, and
- *     `PORTR_AUTO_ADD_PATH` is passed straight to that binary. Renaming these
- *     would rename someone else's contract.
- *
- * @module
- */
-import type { EnvKey } from "@dbx-tools/shared-core";
-/** Access allow-list patterns (domain / glob / `/regex/`). */
-export declare const ALLOW_ENV: EnvKey;
-/** Subject line for the code email. */
-export declare const SUBJECT_ENV: EnvKey;
-/** Display name used in the code email copy. */
-export declare const BRAND_NAME_ENV: EnvKey;
-/** Line shown immediately above the code in the email. */
-export declare const MESSAGE_ENV: EnvKey;
-/** Session lifetime, in seconds. */
-export declare const SESSION_TTL_ENV: EnvKey;
-/** One-time-code lifetime, in seconds. */
-export declare const CODE_TTL_ENV: EnvKey;
-/** HS256 signing secret for the session JWT. */
-export declare const JWT_SECRET_ENV: EnvKey;
-/**
- * Force-clear cutoff: every session issued BEFORE it stops verifying. Anything
- * `object.toDate` accepts - a date, an ISO instant, epoch seconds/millis, or a
- * relative duration (`-30d`, `7 days ago`).
- */
-export declare const SESSION_CUTOFF_ENV: EnvKey;
-/** The public `<subdomain>.<server>` portr should serve on. */
-export declare const PUBLIC_DOMAIN_ENV: EnvKey;
-/** Run the tunnel OPEN, with no gate. Ignored unless truthy. */
-export declare const INSECURE_ENV: EnvKey;
-/** Extra `x-` request headers tunnel traffic may forward. */
-export declare const FORWARD_HEADERS_ENV: EnvKey;