@enkaku/server 0.2.1 → 0.3.1

package/lib/access-control.d.ts

@@ -0,0 +1,13 @@
+import type { SignedToken } from '@enkaku/jwt';
+import type { AnyClientPayloadOf, AnyDefinitions } from '@enkaku/protocol';
+export type CommandAccessRecord = Record<string, boolean | Array<string>>;
+export type CommandAccessPayload = {
+    iss?: string;
+    sub?: string;
+    aud?: string;
+    cmd?: string;
+    exp?: number;
+};
+export declare function checkCommandAccess(serverID: string, record: CommandAccessRecord, token: SignedToken<CommandAccessPayload>, atTime?: number): Promise<void>;
+export declare function checkClientToken<Definition extends AnyDefinitions>(serverID: string, record: CommandAccessRecord, token: SignedToken<AnyClientPayloadOf<Definition>>, atTime?: number): Promise<void>;
+//# sourceMappingURL=access-control.d.ts.map

package/lib/access-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../src/access-control.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAE1E,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;AAEzE,MAAM,MAAM,oBAAoB,GAAG;IACjC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,WAAW,CAAC,oBAAoB,CAAC,EACxC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED,wBAAsB,gBAAgB,CAAC,UAAU,SAAS,cAAc,EACtE,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,WAAW,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,EAClD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CA4Bf"}

package/lib/access-control.js

@@ -0,0 +1,63 @@
+import { assertNonExpired, checkCapability, hasPartsMatch } from '@enkaku/capability';
+export async function checkCommandAccess(serverID, record, token, atTime) {
+    const payload = token.payload;
+    if (payload.cmd == null) {
+        throw new Error('No command to check');
+    }
+    for (const [command, access] of Object.entries(record)){
+        if (hasPartsMatch(payload.cmd, command)) {
+            if (access === true) {
+                // Command can be publicly accessed
+                return;
+            }
+            if (access === false) {
+                continue;
+            }
+            if (access.includes(payload.iss)) {
+                // Issuer is allowed directly
+                return;
+            }
+            if (payload.sub == null || !access.includes(payload.sub)) {
+                continue;
+            }
+            try {
+                // Check delegation from subject
+                await checkCapability({
+                    act: payload.cmd,
+                    res: serverID
+                }, payload, atTime);
+                return;
+            } catch  {}
+        }
+    }
+    throw new Error('Access denied');
+}
+export async function checkClientToken(serverID, record, token, atTime) {
+    const payload = token.payload;
+    const command = payload.cmd;
+    if (command == null) {
+        throw new Error('No command to check');
+    }
+    if (payload.iss === serverID) {
+        // If issuer uses the server's signer, only check audience and expiration if provided
+        if (payload.aud != null && payload.aud !== serverID) {
+            throw new Error('Invalid audience');
+        }
+        if (payload.exp != null) {
+            assertNonExpired(payload, atTime);
+        }
+        return;
+    }
+    if (payload.sub === serverID) {
+        // If subject is the server, check capability directly
+        await checkCapability({
+            act: command,
+            res: serverID
+        }, payload, atTime);
+        return;
+    }
+    if (payload.aud !== serverID) {
+        throw new Error('Invalid audience');
+    }
+    await checkCommandAccess(serverID, record, token, atTime);
+}

package/lib/index.d.ts

@@ -1,3 +1,4 @@
+export type { CommandAccessRecord } from './access-control.js';
 export type { RejectionType } from './rejections.js';
 export { type ServeParams, type Server, serve } from './server.js';
 export type { ChannelHandler, ChannelHandlerContext, CommandHandlers, EventHandler, EventHandlerContext, HandlerReturn, RequestHandler, RequestHandlerContext, StreamHandler, StreamHandlerContext, } from './types.js';

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAClE,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,oBAAoB,GACrB,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAC9D,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAClE,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,oBAAoB,GACrB,MAAM,YAAY,CAAA"}

package/lib/rejections.js

@@ -1,9 +1,9 @@
-export var RejectionReason;
-(function(RejectionReason) {
+export var RejectionReason = /*#__PURE__*/ function(RejectionReason) {
     RejectionReason[RejectionReason["ABORT"] = 1] = "ABORT";
     RejectionReason[RejectionReason["ERROR"] = 2] = "ERROR";
     RejectionReason[RejectionReason["TIMEOUT"] = 3] = "TIMEOUT";
-})(RejectionReason || (RejectionReason = {}));
+    return RejectionReason;
+}({});
 export class Rejection {
     #reason;
     #info;

package/lib/server.d.ts

@@ -1,5 +1,6 @@
 import type { AnyDefinitions, ServerTransportOf } from '@enkaku/protocol';
 import { type Disposer } from '@enkaku/util';
+import { type CommandAccessRecord } from './access-control.js';
 import { type RejectionType } from './rejections.js';
 import type { CommandHandlers, HandlerController } from './types.js';
 export type HandleMessagesParams<Definitions extends AnyDefinitions> = {
@@ -8,12 +9,24 @@ export type HandleMessagesParams<Definitions extends AnyDefinitions> = {
     reject: (rejection: RejectionType) => void;
     signal: AbortSignal;
     transport: ServerTransportOf<Definitions>;
-};
+} & ({
+    insecure: true;
+} | {
+    insecure: false;
+    serverID: string;
+    access: CommandAccessRecord;
+});
 export type ServeParams<Definitions extends AnyDefinitions> = {
     handlers: CommandHandlers<Definitions>;
     signal?: AbortSignal;
     transport: ServerTransportOf<Definitions>;
-};
+} & ({
+    insecure: true;
+} | {
+    insecure?: false;
+    id: string;
+    access?: CommandAccessRecord;
+});
 export type Server = Disposer & {
     rejections: ReadableStream<RejectionType>;
 };

package/lib/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAsB,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAE7F,OAAO,EAAE,KAAK,QAAQ,EAAkB,MAAM,cAAc,CAAA;AAM5D,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,KAAK,EAEV,eAAe,EAEf,iBAAiB,EAClB,MAAM,YAAY,CAAA;AAEnB,MAAM,MAAM,oBAAoB,CAAC,WAAW,SAAS,cAAc,IAAI;IACrE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC9C,QAAQ,EAAE,eAAe,CAAC,WAAW,CAAC,CAAA;IACtC,MAAM,EAAE,CAAC,SAAS,EAAE,aAAa,KAAK,IAAI,CAAA;IAC1C,MAAM,EAAE,WAAW,CAAA;IACnB,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAA;CAC1C,CAAA;AAkFD,MAAM,MAAM,WAAW,CAAC,WAAW,SAAS,cAAc,IAAI;IAC5D,QAAQ,EAAE,eAAe,CAAC,WAAW,CAAC,CAAA;IACtC,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAA;CAC1C,CAAA;AAED,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG;IAC9B,UAAU,EAAE,cAAc,CAAC,aAAa,CAAC,CAAA;CAC1C,CAAA;AAED,wBAAgB,KAAK,CAAC,WAAW,SAAS,cAAc,EACtD,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,GAC/B,MAAM,CA8BR"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,cAAc,EAEd,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,KAAK,QAAQ,EAAkB,MAAM,cAAc,CAAA;AAE5D,OAAO,EAAE,KAAK,mBAAmB,EAAoB,MAAM,qBAAqB,CAAA;AAKhF,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpE,OAAO,KAAK,EAEV,eAAe,EAEf,iBAAiB,EAClB,MAAM,YAAY,CAAA;AAQnB,MAAM,MAAM,oBAAoB,CAAC,WAAW,SAAS,cAAc,IAAI;IACrE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC9C,QAAQ,EAAE,eAAe,CAAC,WAAW,CAAC,CAAA;IACtC,MAAM,EAAE,CAAC,SAAS,EAAE,aAAa,KAAK,IAAI,CAAA;IAC1C,MAAM,EAAE,WAAW,CAAA;IACnB,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAA;CAC1C,GAAG,CAAC;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC,CAAA;AAwH7F,MAAM,MAAM,WAAW,CAAC,WAAW,SAAS,cAAc,IAAI;IAC5D,QAAQ,EAAE,eAAe,CAAC,WAAW,CAAC,CAAA;IACtC,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAA;CAC1C,GAAG,CAAC;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,mBAAmB,CAAA;CAAE,CAAC,CAAA;AAEzF,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG;IAC9B,UAAU,EAAE,cAAc,CAAC,aAAa,CAAC,CAAA;CAC1C,CAAA;AAED,wBAAgB,KAAK,CAAC,WAAW,SAAS,cAAc,EACtD,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,GAC/B,MAAM,CAiCR"}

package/lib/server.js

@@ -1,6 +1,7 @@
-import { createUnsignedToken } from '@enkaku/jwt';
+import { createUnsignedToken, isSignedToken } from '@enkaku/jwt';
 import { createPipe } from '@enkaku/stream';
 import { createDisposer } from '@enkaku/util';
+import { checkClientToken } from './access-control.js';
 import { handleChannel } from './handlers/channel.js';
 import { handleEvent } from './handlers/event.js';
 import { handleRequest } from './handlers/request.js';
@@ -23,17 +24,45 @@ async function handleMessages(params) {
         // Wait until all running handlers are done
         await Promise.all(Object.values(running));
     }, signal);
-    function process(payload, returned) {
+    function processHandler(message, handle) {
+        const returned = handle();
         if (returned instanceof ErrorRejection) {
             reject(returned);
         } else {
-            const id = payload.typ === 'event' ? Math.random().toString(36).slice(2) : payload.rid;
+            const id = message.payload.typ === 'event' ? Math.random().toString(36).slice(2) : message.payload.rid;
             running[id] = returned;
             returned.then(()=>{
                 delete running[id];
             });
         }
     }
+    const process = params.insecure ? processHandler : async (message, handle)=>{
+        try {
+            if (!params.insecure) {
+                if (!isSignedToken(message)) {
+                    throw new Error('Message is not signed');
+                }
+                await checkClientToken(params.serverID, params.access, message);
+            }
+        } catch (err) {
+            const errorMessage = err.message ?? 'Access denied';
+            if (message.payload.typ === 'event') {
+                reject(new ErrorRejection(errorMessage, {
+                    cause: err,
+                    info: message
+                }));
+            } else {
+                context.send({
+                    typ: 'error',
+                    rid: message.payload.rid,
+                    code: 'EKK1000',
+                    msg: errorMessage
+                });
+            }
+            return;
+        }
+        processHandler(message, handle);
+    };
     async function handleNext() {
         const next = await transport.read();
         if (next.done) {
@@ -46,14 +75,23 @@ async function handleMessages(params) {
                 controllers[msg.payload.rid]?.abort();
                 break;
             case 'channel':
-                process(msg.payload, handleChannel(context, msg));
-                break;
+                {
+                    const message = msg;
+                    process(message, ()=>handleChannel(context, message));
+                    break;
+                }
             case 'event':
-                process(msg.payload, handleEvent(context, msg));
-                break;
+                {
+                    const message = msg;
+                    process(message, ()=>handleEvent(context, message));
+                    break;
+                }
             case 'request':
-                process(msg.payload, handleRequest(context, msg));
-                break;
+                {
+                    const message = msg;
+                    process(message, ()=>handleRequest(context, message));
+                    break;
+                }
             case 'send':
                 {
                     const controller = controllers[msg.payload.rid];
@@ -61,8 +99,11 @@ async function handleMessages(params) {
                     break;
                 }
             case 'stream':
-                process(msg.payload, handleStream(context, msg));
-                break;
+                {
+                    const message = msg;
+                    process(message, ()=>handleStream(context, message));
+                    break;
+                }
         }
         handleNext();
     }
@@ -81,8 +122,15 @@ export function serve(params) {
         controllers,
         handlers: params.handlers,
         reject,
+        signal: abortController.signal,
         transport: params.transport,
-        signal: abortController.signal
+        ...params.insecure ? {
+            insecure: true
+        } : {
+            insecure: false,
+            serverID: params.id,
+            access: params.access ?? {}
+        }
     });
     const disposer = createDisposer(async ()=>{
         // Signal messages handler to stop execution and run cleanup logic

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enkaku/server",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "license": "MIT",
   "keywords": [],
   "type": "module",
@@ -14,13 +14,14 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@enkaku/jwt": "^0.2.3",
-    "@enkaku/util": "^0.2.0",
-    "@enkaku/stream": "^0.2.1"
+    "@enkaku/capability": "^0.3.0",
+    "@enkaku/jwt": "^0.3.0",
+    "@enkaku/stream": "^0.3.0",
+    "@enkaku/util": "^0.3.0"
   },
   "devDependencies": {
-    "@enkaku/protocol": "^0.2.1",
-    "@enkaku/transport": "^0.2.0"
+    "@enkaku/protocol": "^0.3.1",
+    "@enkaku/transport": "^0.3.0"
   },
   "scripts": {
     "build:clean": "del lib",