@inkeep/agents-work-apps 0.0.0-dev-20260203033642

package/dist/github/jwks.d.ts

@@ -0,0 +1,20 @@
+import { CryptoKey, JWSHeaderParameters } from "jose";
+
+//#region src/github/jwks.d.ts
+interface JwksResult {
+  success: true;
+  key: CryptoKey;
+}
+interface JwksError {
+  success: false;
+  error: string;
+}
+type GetJwkResult = JwksResult | JwksError;
+declare function getJwkForToken(header: JWSHeaderParameters): Promise<GetJwkResult>;
+declare function clearJwksCache(): void;
+declare function getJwksCacheStatus(): {
+  cached: boolean;
+  expiresIn?: number;
+};
+//#endregion
+export { GetJwkResult, JwksError, JwksResult, clearJwksCache, getJwkForToken, getJwksCacheStatus };

package/dist/github/jwks.js

@@ -0,0 +1,85 @@
+import { getLogger } from "../logger.js";
+import { createRemoteJWKSet } from "jose";
+
+//#region src/github/jwks.ts
+const logger = getLogger("github-jwks");
+const GITHUB_OIDC_JWKS_URL = "https://token.actions.githubusercontent.com/.well-known/jwks";
+const CACHE_TTL_MS = 3600 * 1e3;
+let jwksCache = null;
+function createJwksWithLogging() {
+	logger.info({}, "Creating new JWKS fetch function for GitHub OIDC");
+	return createRemoteJWKSet(new URL(GITHUB_OIDC_JWKS_URL), { cacheMaxAge: CACHE_TTL_MS });
+}
+function isCacheExpired() {
+	if (!jwksCache) return true;
+	return Date.now() - jwksCache.fetchedAt > CACHE_TTL_MS;
+}
+function getOrCreateJwksFunction() {
+	if (!jwksCache || isCacheExpired()) jwksCache = {
+		jwks: createJwksWithLogging(),
+		fetchedAt: Date.now()
+	};
+	return jwksCache.jwks;
+}
+async function getJwkForToken(header) {
+	const kid = header.kid;
+	if (!kid) return {
+		success: false,
+		error: "Token is missing key ID (kid) in header"
+	};
+	try {
+		const key = await getOrCreateJwksFunction()(header);
+		logger.debug({ kid }, "Successfully retrieved JWK for token");
+		return {
+			success: true,
+			key
+		};
+	} catch (error) {
+		const errorMessage = error instanceof Error ? error.message : "Unknown error";
+		if (errorMessage.includes("no applicable key found")) {
+			logger.warn({ kid }, "Key ID not found in JWKS, refreshing cache");
+			jwksCache = null;
+			try {
+				const key = await getOrCreateJwksFunction()(header);
+				logger.info({ kid }, "Successfully retrieved JWK after cache refresh");
+				return {
+					success: true,
+					key
+				};
+			} catch (retryError) {
+				const retryErrorMessage = retryError instanceof Error ? retryError.message : "Unknown error";
+				logger.error({
+					kid,
+					error: retryErrorMessage
+				}, "Failed to retrieve JWK after cache refresh");
+				return {
+					success: false,
+					error: `Key ID '${kid}' not found in GitHub OIDC JWKS`
+				};
+			}
+		}
+		logger.error({
+			kid,
+			error: errorMessage
+		}, "Failed to fetch JWKS from GitHub");
+		return {
+			success: false,
+			error: `Failed to fetch GitHub OIDC JWKS: ${errorMessage}`
+		};
+	}
+}
+function clearJwksCache() {
+	jwksCache = null;
+	logger.debug({}, "JWKS cache cleared");
+}
+function getJwksCacheStatus() {
+	if (!jwksCache) return { cached: false };
+	const expiresIn = CACHE_TTL_MS - (Date.now() - jwksCache.fetchedAt);
+	return {
+		cached: true,
+		expiresIn: Math.max(0, expiresIn)
+	};
+}
+
+//#endregion
+export { clearJwksCache, getJwkForToken, getJwksCacheStatus };

package/dist/github/mcp/auth.d.ts

@@ -0,0 +1,10 @@
+import * as hono0 from "hono";
+
+//#region src/github/mcp/auth.d.ts
+declare const githubMcpAuth: () => hono0.MiddlewareHandler<{
+  Variables: {
+    toolId: string;
+  };
+}, string, {}, Response>;
+//#endregion
+export { githubMcpAuth };

package/dist/github/mcp/auth.js

@@ -0,0 +1,43 @@
+import { env } from "../../env.js";
+import { createApiError } from "@inkeep/agents-core";
+import { createMiddleware } from "hono/factory";
+
+//#region src/github/mcp/auth.ts
+const githubMcpAuth = () => createMiddleware(async (c, next) => {
+	const toolId = c.req.header("x-inkeep-tool-id");
+	if (!toolId) throw createApiError({
+		code: "unauthorized",
+		message: "Missing required header: x-inkeep-tool-id",
+		extensions: { parameter: {
+			in: "header",
+			name: "x-inkeep-tool-id"
+		} }
+	});
+	const authHeader = c.req.header("Authorization");
+	if (!authHeader) throw createApiError({
+		code: "unauthorized",
+		message: "Missing required header: Authorization",
+		extensions: { parameter: {
+			in: "header",
+			name: "Authorization"
+		} }
+	});
+	const apiKey = authHeader.startsWith("Bearer ") ? authHeader.substring(7) : void 0;
+	if (!apiKey) throw createApiError({
+		code: "unauthorized",
+		message: "Invalid Authorization header format. Expected: Bearer <token>",
+		extensions: { parameter: {
+			in: "header",
+			name: "Authorization"
+		} }
+	});
+	if (apiKey !== env.GITHUB_MCP_API_KEY) throw createApiError({
+		code: "unauthorized",
+		message: "Invalid API key"
+	});
+	c.set("toolId", toolId);
+	await next();
+});
+
+//#endregion
+export { githubMcpAuth };

package/dist/github/mcp/index.d.ts

@@ -0,0 +1,11 @@
+import { Hono } from "hono";
+import * as hono_types0 from "hono/types";
+
+//#region src/github/mcp/index.d.ts
+declare const app: Hono<{
+  Variables: {
+    toolId: string;
+  };
+}, hono_types0.BlankSchema, "/">;
+//#endregion
+export { app as default };