@jeffusion/bungee-core 5.9.0 → 5.11.0

package/dist/plugins/key-access/ingress.js.map

@@ -3,7 +3,7 @@
   "sources": ["../../../../../plugins/key-access/server/policy.ts", "../../../src/plugin-extensions.ts", "../../../src/data-admission/errors.ts"],
   "sourcesContent": [
     "import { createHash, timingSafeEqual } from 'node:crypto';\nimport { ANONYMOUS_PRINCIPAL, type DataPrincipal, type AdmissionTarget, type AdmissionDenial, type IngressPlugin } from '../../../packages/core/src/plugin-extensions';\nimport { DataAdmissionError } from '../../../packages/core/src/data-admission/errors';\n\nexport interface AccessPolicy { routes: string[] | null; models: string[] | null }\nexport interface AccessCredential {\n  id: string; domain: 'data'; name: string; prefix: string; digest: string;\n  createdAt: number; expiresAt: number | null; revokedAt: number | null; credentialVersion: number;\n}\nexport interface AccessPublication {\n  protectedRouteIds: string[];\n  byKey: Record<string, AccessPolicy | null>;\n  credentials: AccessCredential[];\n}\nexport function stringIds(value: unknown): string[] {\n  if (!Array.isArray(value) || value.length > 1000 || value.some(x => typeof x !== 'string' || !x.length || x.length > 256)\n    || new Set(value).size !== value.length) throw new Error('invalid_policy');\n  return [...value];\n}\nexport function validatePolicy(value: unknown): AccessPolicy | null {\n  if (value === null) return null;\n  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some(k => !['routes', 'models'].includes(k))) throw new Error('invalid_policy');\n  const p = value as AccessPolicy;\n  return {routes: p.routes === null ? null : stringIds(p.routes), models: p.models === null ? null : stringIds(p.models)};\n}\nexport function validatePublication(value: unknown): AccessPublication {\n  const p = value as AccessPublication;\n  if (!p || typeof p !== 'object' || !p.byKey || typeof p.byKey !== 'object' || Array.isArray(p.byKey)\n    || !Array.isArray(p.credentials)) throw new Error('invalid_policy');\n  const protectedRouteIds = stringIds(p.protectedRouteIds);\n  for (const key of p.credentials) {\n    if (!key || key.domain !== 'data' || typeof key.id !== 'string' || !key.id || !/^[a-f0-9]{64}$/.test(key.digest)\n      || !Number.isSafeInteger(key.credentialVersion) || key.credentialVersion < 1\n      || (key.expiresAt !== null && !Number.isSafeInteger(key.expiresAt))\n      || (key.revokedAt !== null && !Number.isSafeInteger(key.revokedAt))) throw new Error('invalid_credentials');\n  }\n  return {...p, protectedRouteIds};\n}\nexport function validPrincipal(principal: DataPrincipal, value: AccessPublication, now: number): boolean {\n  const key = value.credentials.find(key => key.id === principal.keyId);\n  return principal.domain === 'data' && !!key && key.credentialVersion === principal.credentialVersion\n    && key.revokedAt === null && (key.expiresAt === null || key.expiresAt > now);\n}\n/** Only * is special; every other character is literal. Match the entire model. */\nfunction matchesModel(pattern: string, model: string): boolean {\n  const parts = pattern.split('*');\n  if (parts.length === 1) return pattern === model;\n  const first = parts[0]!, last = parts[parts.length - 1]!;\n  if (!model.startsWith(first) || !model.endsWith(last)) return false;\n  let cursor = first.length;\n  const end = model.length - last.length;\n  for (const part of parts.slice(1, -1)) {\n    const index = model.indexOf(part, cursor);\n    if (index < 0) return false;\n    cursor = index + part.length;\n  }\n  return cursor <= end;\n}\nfunction check(target: AdmissionTarget, policy: AccessPolicy | null): AdmissionDenial | null {\n  if (target.principal.domain === 'anonymous') return null;\n  if (policy && ((policy.routes !== null && !policy.routes.includes(target.routeId))\n    || (policy.models !== null && (!target.model || !policy.models.some(pattern => matchesModel(pattern, target.model!)))))) return {error: 'key-access.scope_denied', status: 403};\n  return null;\n}\nexport function createIngress(): IngressPlugin { return {\n  authenticate(request, value, now) {\n    const p = validatePublication(value);\n    const match = /^Bearer (bng_data_[A-Za-z0-9_-]{43})$/i.exec(request.headers.get('authorization') ?? '');\n    if (!match) return null;\n    const digest = createHash('sha256').update(match[1]!).digest('hex');\n    const key = p.credentials.find(key => timingSafeEqual(Buffer.from(key.digest, 'hex'), Buffer.from(digest, 'hex')));\n    if (!key) return null;\n    const principal = {domain: 'data', keyId: key.id, credentialVersion: key.credentialVersion};\n    return validPrincipal(principal, p, now) ? principal : null;\n  },\n  resolveIdentity(target, value) {\n    const p = validatePublication(value);\n    if (!p.protectedRouteIds.includes(target.routeId)) return ANONYMOUS_PRINCIPAL;\n    if (!validPrincipal(target.principal, p, target.now)) throw new DataAdmissionError(401, 'unauthorized');\n    return target.principal;\n  },\n  plan(target, value) {\n    try {\n      const p = validatePublication(value);\n      if (!p.protectedRouteIds.includes(target.routeId)) return {snapshot: null};\n      if (target.principal.domain === 'anonymous') return {denial: {error: 'unauthorized', status: 401}};\n      const policy = validatePolicy(p.byKey[target.principal.keyId] ?? null);\n      const denial = check(target, policy);\n      return denial ? {denial} : {snapshot: {routeId: target.routeId, policy: policy as any}};\n    } catch { return {denial: {error: 'key-access.policy_unavailable', status: 503}}; }\n  },\n  beforeAttempt(target, snapshot) {\n    if (snapshot === null) return target.principal.domain === 'anonymous' ? null : {error: 'key-access.invalid_grant', status: 503};\n    try {\n      const s = snapshot as {routeId: string; policy: AccessPolicy | null};\n      if (!s || s.routeId !== target.routeId) return {error: 'key-access.scope_denied', status: 403};\n      return check(target, validatePolicy(s.policy));\n    } catch { return {error: 'key-access.policy_unavailable', status: 503}; }\n  },\n}; }\n",
-    "import type { PluginDurableState, DurableJson } from './plugin-durable-state';\n\n/** Anonymous is an explicit, signed data identity; it carries no key authority. */\nexport type DataPrincipal = { readonly domain: string; readonly keyId: string; readonly credentialVersion: number };\nexport const ANONYMOUS_PRINCIPAL: DataPrincipal = Object.freeze({domain: 'anonymous', keyId: '', credentialVersion: 0});\nexport interface AdmissionRequirement { readonly plugin: string; readonly routeIds: readonly string[] }\n/** Public contracts. Business rules belong to the implementing plugin. */\nexport interface ManagementSubject {\n  readonly id: string;\n  readonly provider: string;\n  readonly capabilities: readonly string[];\n  readonly requiresPasswordChange?: boolean;\n}\nexport interface ManagementProvider {\n  authenticate(request: Request): Promise<ManagementSubject | null>;\n  authorize(subject: ManagementSubject, capability: string): boolean;\n  login(request: Request): Promise<Response>;\n  logout(request: Request): Promise<Response>;\n  bootstrap(input: unknown): Promise<void>;\n  hasIdentity(): boolean;\n  revokeSessions(): void;\n  validateWrite?(request: Request): void;\n  csrfToken?(request: Request): string | undefined;\n}\nexport interface AdmissionTarget {\n  readonly requestId: string;\n  readonly attemptId: string;\n  readonly principal: DataPrincipal;\n  readonly routeId: string;\n  readonly serviceId: string | null;\n  readonly upstreamId: string;\n  readonly url: string;\n  readonly model: string | null;\n  readonly now: number;\n}\nexport interface AdmissionDenial {\n  readonly error: string;\n  readonly status: 401 | 403 | 429 | 503 | 422;\n  readonly retryAfter?: number;\n}\nexport interface AdmissionPlan {\n  /** A complete JSON state replacement, staged by Host before the common decision. */\n  readonly state?: DurableJson;\n  /** Immutable policy snapshot retained by the grant for subsequent attempts. */\n  readonly snapshot?: DurableJson;\n  readonly denial?: AdmissionDenial;\n}\nexport interface IngressPlugin {\n  /** Optional per-principal state. Policies are frozen; plans receive only this key's clones.\n   * Expiry must mean absence is behaviorally equivalent to retaining the state. */\n  keyedState?: {\n    readonly capacity: number;\n    policyForKey(policy: DurableJson, keyId: string): DurableJson;\n    expiresAt(state: DurableJson): number;\n    reconcile(state: DurableJson, policy: DurableJson, now: number): DurableJson;\n  };\n  authenticate?(request: Request, policy: DurableJson, now: number): DataPrincipal | null;\n  resolveIdentity?(target: AdmissionTarget, policy: DurableJson): DataPrincipal;\n  plan(target: AdmissionTarget, policy: DurableJson, state: DurableJson): AdmissionPlan;\n  beforeAttempt?(target: AdmissionTarget, snapshot: DurableJson): AdmissionDenial | null;\n}\nexport interface IngressPluginModule { createIngress(): IngressPlugin }\nexport interface PluginStateRpcContext {\n  readonly state: PluginDurableState;\n  readonly requestId: string;\n  readonly attemptId: string;\n  readonly principal: DataPrincipal;\n}\nexport interface PluginPolicyPublication {\n  readonly version: number;\n  readonly value: DurableJson;\n}\n",
+    "import type { PluginDurableState, DurableJson } from './plugin-durable-state';\n\n/** Anonymous is an explicit, signed data identity; it carries no key authority. */\nexport type DataPrincipal = { readonly domain: string; readonly keyId: string; readonly credentialVersion: number };\nexport const ANONYMOUS_PRINCIPAL: DataPrincipal = Object.freeze({domain: 'anonymous', keyId: '', credentialVersion: 0});\nexport interface AdmissionRequirement { readonly plugin: string; readonly routeIds: readonly string[] }\n/** Public contracts. Business rules belong to the implementing plugin. */\nexport interface ManagementSubject {\n  readonly id: string;\n  readonly provider: string;\n  readonly capabilities: readonly string[];\n  readonly requiresPasswordChange?: boolean;\n}\nexport interface ManagementProvider {\n  authenticate(request: Request): Promise<ManagementSubject | null>;\n  authorize(subject: ManagementSubject, capability: string): boolean;\n  login(request: Request): Promise<Response>;\n  logout(request: Request): Promise<Response>;\n  bootstrap(input: unknown): Promise<void>;\n  hasIdentity(): boolean;\n  revokeSessions(): void;\n  validateWrite?(request: Request): void;\n  csrfToken?(request: Request): string | undefined;\n  /** Optional browser cookie renewal after successful session verification. Must not extend the server-side absolute deadline. */\n  sessionCookie?(request: Request): string | undefined;\n}\nexport interface AdmissionTarget {\n  readonly requestId: string;\n  readonly attemptId: string;\n  readonly principal: DataPrincipal;\n  readonly routeId: string;\n  readonly serviceId: string | null;\n  readonly upstreamId: string;\n  readonly url: string;\n  readonly model: string | null;\n  readonly now: number;\n}\nexport interface AdmissionDenial {\n  readonly error: string;\n  readonly status: 401 | 403 | 429 | 503 | 422;\n  readonly retryAfter?: number;\n}\nexport interface AdmissionPlan {\n  /** A complete JSON state replacement, staged by Host before the common decision. */\n  readonly state?: DurableJson;\n  /** Immutable policy snapshot retained by the grant for subsequent attempts. */\n  readonly snapshot?: DurableJson;\n  readonly denial?: AdmissionDenial;\n}\nexport interface IngressPlugin {\n  /** Optional per-principal state. Policies are frozen; plans receive only this key's clones.\n   * Expiry must mean absence is behaviorally equivalent to retaining the state. */\n  keyedState?: {\n    readonly capacity: number;\n    policyForKey(policy: DurableJson, keyId: string): DurableJson;\n    expiresAt(state: DurableJson): number;\n    reconcile(state: DurableJson, policy: DurableJson, now: number): DurableJson;\n  };\n  authenticate?(request: Request, policy: DurableJson, now: number): DataPrincipal | null;\n  resolveIdentity?(target: AdmissionTarget, policy: DurableJson): DataPrincipal;\n  plan(target: AdmissionTarget, policy: DurableJson, state: DurableJson): AdmissionPlan;\n  beforeAttempt?(target: AdmissionTarget, snapshot: DurableJson): AdmissionDenial | null;\n}\nexport interface IngressPluginModule { createIngress(): IngressPlugin }\nexport interface PluginStateRpcContext {\n  readonly state: PluginDurableState;\n  readonly requestId: string;\n  readonly attemptId: string;\n  readonly principal: DataPrincipal;\n}\nexport interface PluginPolicyPublication {\n  readonly version: number;\n  readonly value: DurableJson;\n}\n",
     "/** Shared inert error contract; importing it never loads admission runtime modules. */\nexport class DataAdmissionError extends Error {\n  readonly name = 'DataAdmissionError';\n  constructor(readonly status: number, readonly code: string, readonly retryAfter?: number) { super(code); }\n}\n\n/** Plugin bundles have their own class identity; normalize their explicit error contract. */\nexport function normalizeAdmissionError(error: unknown): DataAdmissionError | null {\n  if (error instanceof DataAdmissionError) return error;\n  if (!(error instanceof Error) || error.name !== 'DataAdmissionError') return null;\n  const value = error as Error & {status?: unknown; code?: unknown; retryAfter?: unknown};\n  if (typeof value.status !== 'number' || ![401,403,409,422,429,503].includes(value.status)\n    || typeof value.code !== 'string' || !/^[a-zA-Z0-9_.-]{1,128}$/.test(value.code)\n    || (value.retryAfter !== undefined && (typeof value.retryAfter !== 'number' || !Number.isFinite(value.retryAfter) || value.retryAfter < 0))) return null;\n  return new DataAdmissionError(value.status,value.code,value.retryAfter as number | undefined);\n}\n"
   ],
   "mappings": ";;AAAA;;;ACIO,IAAM,sBAAqC,OAAO,OAAO,EAAC,QAAQ,aAAa,OAAO,IAAI,mBAAmB,EAAC,CAAC;;;ACH/G,MAAM,2BAA2B,MAAM;AAAA,EAEvB;AAAA,EAAyB;AAAA,EAAuB;AAAA,EAD5D,OAAO;AAAA,EAChB,WAAW,CAAU,QAAyB,MAAuB,YAAqB;AAAA,IAAE,MAAM,IAAI;AAAA,IAAjF;AAAA,IAAyB;AAAA,IAAuB;AAAA;AACvE;;;AFUO,SAAS,SAAS,CAAC,OAA0B;AAAA,EAClD,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,QAAQ,MAAM,KAAK,OAAK,OAAO,MAAM,YAAY,CAAC,EAAE,UAAU,EAAE,SAAS,GAAG,KACnH,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM;AAAA,IAAQ,MAAM,IAAI,MAAM,gBAAgB;AAAA,EAC3E,OAAO,CAAC,GAAG,KAAK;AAAA;AAEX,SAAS,cAAc,CAAC,OAAqC;AAAA,EAClE,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,KAAK,OAAO,KAAK,KAAK,EAAE,KAAK,OAAK,CAAC,CAAC,UAAU,QAAQ,EAAE,SAAS,CAAC,CAAC;AAAA,IAAG,MAAM,IAAI,MAAM,gBAAgB;AAAA,EACpK,MAAM,IAAI;AAAA,EACV,OAAO,EAAC,QAAQ,EAAE,WAAW,OAAO,OAAO,UAAU,EAAE,MAAM,GAAG,QAAQ,EAAE,WAAW,OAAO,OAAO,UAAU,EAAE,MAAM,EAAC;AAAA;AAEjH,SAAS,mBAAmB,CAAC,OAAmC;AAAA,EACrE,MAAM,IAAI;AAAA,EACV,IAAI,CAAC,KAAK,OAAO,MAAM,YAAY,CAAC,EAAE,SAAS,OAAO,EAAE,UAAU,YAAY,MAAM,QAAQ,EAAE,KAAK,KAC9F,CAAC,MAAM,QAAQ,EAAE,WAAW;AAAA,IAAG,MAAM,IAAI,MAAM,gBAAgB;AAAA,EACpE,MAAM,oBAAoB,UAAU,EAAE,iBAAiB;AAAA,EACvD,WAAW,OAAO,EAAE,aAAa;AAAA,IAC/B,IAAI,CAAC,OAAO,IAAI,WAAW,UAAU,OAAO,IAAI,OAAO,YAAY,CAAC,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI,MAAM,KAC1G,CAAC,OAAO,cAAc,IAAI,iBAAiB,KAAK,IAAI,oBAAoB,KACvE,IAAI,cAAc,QAAQ,CAAC,OAAO,cAAc,IAAI,SAAS,KAC7D,IAAI,cAAc,QAAQ,CAAC,OAAO,cAAc,IAAI,SAAS;AAAA,MAAI,MAAM,IAAI,MAAM,qBAAqB;AAAA,EAC9G;AAAA,EACA,OAAO,KAAI,GAAG,kBAAiB;AAAA;AAE1B,SAAS,cAAc,CAAC,WAA0B,OAA0B,KAAsB;AAAA,EACvG,MAAM,MAAM,MAAM,YAAY,KAAK,SAAO,IAAI,OAAO,UAAU,KAAK;AAAA,EACpE,OAAO,UAAU,WAAW,UAAU,CAAC,CAAC,OAAO,IAAI,sBAAsB,UAAU,qBAC9E,IAAI,cAAc,SAAS,IAAI,cAAc,QAAQ,IAAI,YAAY;AAAA;AAG5E,SAAS,YAAY,CAAC,SAAiB,OAAwB;AAAA,EAC7D,MAAM,QAAQ,QAAQ,MAAM,GAAG;AAAA,EAC/B,IAAI,MAAM,WAAW;AAAA,IAAG,OAAO,YAAY;AAAA,EAC3C,MAAM,QAAQ,MAAM,IAAK,OAAO,MAAM,MAAM,SAAS;AAAA,EACrD,IAAI,CAAC,MAAM,WAAW,KAAK,KAAK,CAAC,MAAM,SAAS,IAAI;AAAA,IAAG,OAAO;AAAA,EAC9D,IAAI,SAAS,MAAM;AAAA,EACnB,MAAM,MAAM,MAAM,SAAS,KAAK;AAAA,EAChC,WAAW,QAAQ,MAAM,MAAM,GAAG,EAAE,GAAG;AAAA,IACrC,MAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM;AAAA,IACxC,IAAI,QAAQ;AAAA,MAAG,OAAO;AAAA,IACtB,SAAS,QAAQ,KAAK;AAAA,EACxB;AAAA,EACA,OAAO,UAAU;AAAA;AAEnB,SAAS,KAAK,CAAC,QAAyB,QAAqD;AAAA,EAC3F,IAAI,OAAO,UAAU,WAAW;AAAA,IAAa,OAAO;AAAA,EACpD,IAAI,WAAY,OAAO,WAAW,QAAQ,CAAC,OAAO,OAAO,SAAS,OAAO,OAAO,KAC1E,OAAO,WAAW,SAAS,CAAC,OAAO,SAAS,CAAC,OAAO,OAAO,KAAK,aAAW,aAAa,SAAS,OAAO,KAAM,CAAC;AAAA,IAAM,OAAO,EAAC,OAAO,2BAA2B,QAAQ,IAAG;AAAA,EAChL,OAAO;AAAA;AAEF,SAAS,aAAa,GAAkB;AAAA,EAAE,OAAO;AAAA,IACtD,YAAY,CAAC,SAAS,OAAO,KAAK;AAAA,MAChC,MAAM,IAAI,oBAAoB,KAAK;AAAA,MACnC,MAAM,QAAQ,yCAAyC,KAAK,QAAQ,QAAQ,IAAI,eAAe,KAAK,EAAE;AAAA,MACtG,IAAI,CAAC;AAAA,QAAO,OAAO;AAAA,MACnB,MAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAG,EAAE,OAAO,KAAK;AAAA,MAClE,MAAM,MAAM,EAAE,YAAY,KAAK,SAAO,gBAAgB,OAAO,KAAK,IAAI,QAAQ,KAAK,GAAG,OAAO,KAAK,QAAQ,KAAK,CAAC,CAAC;AAAA,MACjH,IAAI,CAAC;AAAA,QAAK,OAAO;AAAA,MACjB,MAAM,YAAY,EAAC,QAAQ,QAAQ,OAAO,IAAI,IAAI,mBAAmB,IAAI,kBAAiB;AAAA,MAC1F,OAAO,eAAe,WAAW,GAAG,GAAG,IAAI,YAAY;AAAA;AAAA,IAEzD,eAAe,CAAC,QAAQ,OAAO;AAAA,MAC7B,MAAM,IAAI,oBAAoB,KAAK;AAAA,MACnC,IAAI,CAAC,EAAE,kBAAkB,SAAS,OAAO,OAAO;AAAA,QAAG,OAAO;AAAA,MAC1D,IAAI,CAAC,eAAe,OAAO,WAAW,GAAG,OAAO,GAAG;AAAA,QAAG,MAAM,IAAI,mBAAmB,KAAK,cAAc;AAAA,MACtG,OAAO,OAAO;AAAA;AAAA,IAEhB,IAAI,CAAC,QAAQ,OAAO;AAAA,MAClB,IAAI;AAAA,QACF,MAAM,IAAI,oBAAoB,KAAK;AAAA,QACnC,IAAI,CAAC,EAAE,kBAAkB,SAAS,OAAO,OAAO;AAAA,UAAG,OAAO,EAAC,UAAU,KAAI;AAAA,QACzE,IAAI,OAAO,UAAU,WAAW;AAAA,UAAa,OAAO,EAAC,QAAQ,EAAC,OAAO,gBAAgB,QAAQ,IAAG,EAAC;AAAA,QACjG,MAAM,SAAS,eAAe,EAAE,MAAM,OAAO,UAAU,UAAU,IAAI;AAAA,QACrE,MAAM,SAAS,MAAM,QAAQ,MAAM;AAAA,QACnC,OAAO,SAAS,EAAC,OAAM,IAAI,EAAC,UAAU,EAAC,SAAS,OAAO,SAAS,OAAqB,EAAC;AAAA,QACtF,MAAM;AAAA,QAAE,OAAO,EAAC,QAAQ,EAAC,OAAO,iCAAiC,QAAQ,IAAG,EAAC;AAAA;AAAA;AAAA,IAEjF,aAAa,CAAC,QAAQ,UAAU;AAAA,MAC9B,IAAI,aAAa;AAAA,QAAM,OAAO,OAAO,UAAU,WAAW,cAAc,OAAO,EAAC,OAAO,4BAA4B,QAAQ,IAAG;AAAA,MAC9H,IAAI;AAAA,QACF,MAAM,IAAI;AAAA,QACV,IAAI,CAAC,KAAK,EAAE,YAAY,OAAO;AAAA,UAAS,OAAO,EAAC,OAAO,2BAA2B,QAAQ,IAAG;AAAA,QAC7F,OAAO,MAAM,QAAQ,eAAe,EAAE,MAAM,CAAC;AAAA,QAC7C,MAAM;AAAA,QAAE,OAAO,EAAC,OAAO,iCAAiC,QAAQ,IAAG;AAAA;AAAA;AAAA,EAEzE;AAAA;",