@electr0zed/auth-gateway-cf 0.1.0

package/dist/utils/verifyInternal.js

@@ -0,0 +1,69 @@
+import { decodeJsonFromBase64, signHmac } from './propagation';
+export async function verifyGatewayUser(request, cfg, env, options = {}) {
+    const headerName = cfg.propagation.headerName ?? 'X-User';
+    const sigHeaderName = cfg.propagation.sigHeaderName ?? 'X-User-Sig';
+    const payloadB64 = request.headers.get(headerName);
+    const sig = request.headers.get(sigHeaderName);
+    if (!payloadB64 || !sig) {
+        if (options.require)
+            throw new Error('missing_user_headers');
+        return null;
+    }
+    const secret = env[cfg.propagation.hmacSecretEnv];
+    if (!secret)
+        throw new Error('missing_hmac_secret');
+    const computedSig = await signHmac(payloadB64, secret);
+    if (!timingSafeEqual(computedSig, sig)) {
+        if (options.require)
+            throw new Error('bad_user_sig');
+        return null;
+    }
+    let payload;
+    try {
+        payload = decodeJsonFromBase64(payloadB64);
+    }
+    catch {
+        if (options.require)
+            throw new Error('bad_user_payload');
+        return null;
+    }
+    if (!isPropagatedUserPayload(payload)) {
+        if (options.require)
+            throw new Error('bad_user_shape');
+        return null;
+    }
+    const maxSkewSec = options.maxSkewSec ?? 120;
+    const now = Math.floor(Date.now() / 1000);
+    if (Math.abs(now - payload.ts) > maxSkewSec) {
+        if (options.require)
+            throw new Error('user_ts_out_of_window');
+        return null;
+    }
+    return payload;
+}
+function isPropagatedUserPayload(x) {
+    if (!x || typeof x !== 'object')
+        return false;
+    const o = x;
+    return (typeof o.userId === 'string' &&
+        o.userId.length > 0 &&
+        typeof o.email === 'string' &&
+        o.email.length > 0 &&
+        typeof o.ts === 'number' &&
+        Number.isFinite(o.ts));
+}
+/**
+ * Timing-safe compare for short strings.
+ * (Avoids early-return. Better than `===`.)
+ */
+function timingSafeEqual(a, b) {
+    let out = a.length ^ b.length;
+    const len = Math.max(a.length, b.length);
+    for (let i = 0; i < len; i++) {
+        const ca = i < a.length ? a.charCodeAt(i) : 0;
+        const cb = i < b.length ? b.charCodeAt(i) : 0;
+        out |= ca ^ cb;
+    }
+    return out === 0;
+}
+//# sourceMappingURL=verifyInternal.js.map

package/dist/utils/verifyInternal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyInternal.js","sourceRoot":"","sources":["../../src/utils/verifyInternal.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAA8B,MAAM,eAAe,CAAC;AAO3F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAAgB,EAChB,GAAuC,EACvC,GAAQ,EACR,UAAoC,EAAE;IAEtC,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,QAAQ,CAAC;IAC1D,MAAM,aAAa,GAAG,GAAG,CAAC,WAAW,CAAC,aAAa,IAAI,YAAY,CAAC;IAEpE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAE/C,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAEpD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACR,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAU;IAC1C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IAEvC,OAAO,CACN,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACnB,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAC3B,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAClB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CACrB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC5C,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,CAAC;AAClB,CAAC"}

package/package.json

@@ -0,0 +1,48 @@
+{
+	"name": "@electr0zed/auth-gateway-cf",
+	"version": "0.1.0",
+	"type": "module",
+	"sideEffects": false,
+	"files": [
+		"dist"
+	],
+	"exports": {
+		".": {
+			"import": "./dist/index.js",
+			"types": "./dist/index.d.ts"
+		}
+	},
+	"types": "./dist/index.d.ts",
+	"scripts": {
+		"build": "tsc",
+		"lint": "eslint . --ext .ts",
+		"lint:fix": "eslint . --ext .ts --fix",
+		"check-types": "tsc --noEmit"
+	},
+	"dependencies": {
+		"kysely": "^0.29.0",
+		"pg": "^8.20.0",
+		"unique-names-generator": "^4.7.1"
+	},
+	"devDependencies": {
+		"@cloudflare/workers-types": "^4.20260511.1",
+		"@eslint/js": "^9.38.0",
+		"@types/pg": "^8.20.0",
+		"eslint": "^9.38.0",
+		"eslint-config-prettier": "^10.1.8",
+		"eslint-plugin-prettier": "^5.5.4",
+		"globals": "^16.4.0",
+		"jiti": "^2.7.0",
+		"prettier": "3.8.3",
+		"typescript": "^5.9.3",
+		"typescript-eslint": "^8.59.3"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/ELECTR0ZED/auth-gateway-cf.git"
+	},
+	"engines": {
+		"node": ">=22"
+	},
+	"license": "MIT"
+}