@jungjaehoon/mama-os 0.53.0 → 0.57.0

package/dist/api/auth-middleware.js

@@ -1,249 +1,72 @@
 "use strict";
-/**
- * Shared authentication middleware for MAMA API routes.
- *
- * Extracted from graph-api.ts to allow reuse across all API endpoints.
- * Uses timing-safe comparison and supports localhost bypass when no token is configured.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isLocalRequest = isLocalRequest;
-exports.hasCloudflareAccessIdentity = hasCloudflareAccessIdentity;
-exports.isTrustedCloudflareAccessRequest = isTrustedCloudflareAccessRequest;
-exports.getClientAddress = getClientAddress;
-exports.getSecurityLogContext = getSecurityLogContext;
-exports.logUnauthorizedAttempt = logUnauthorizedAttempt;
+exports.isTunnelRequest = isTunnelRequest;
+exports.authenticateViewerRequest = authenticateViewerRequest;
 exports.isAuthenticated = isAuthenticated;
-exports.requireAuth = requireAuth;
-exports.requireAdminAuth = requireAdminAuth;
+exports.requireViewerAuth = requireViewerAuth;
 const node_crypto_1 = require("node:crypto");
-const debugLogger = __importStar(require("@jungjaehoon/mama-core/debug-logger"));
-const security_monitor_js_1 = require("../security/security-monitor.js");
-const trusted_proxy_js_1 = require("../security/trusted-proxy.js");
-const { DebugLogger } = debugLogger;
-const authLogger = new DebugLogger('AuthSecurity');
-/**
- * Check if request originates from localhost
- */
+const cf_access_js_1 = require("./cf-access.js");
+/** The archive's local-dashboard / remote-Bearer authentication boundary. */
 function isLocalRequest(req) {
-    const remoteAddr = req.socket?.remoteAddress;
-    return remoteAddr === '127.0.0.1' || remoteAddr === '::1' || remoteAddr === '::ffff:127.0.0.1';
+    const remoteAddress = req.socket?.remoteAddress;
+    return (remoteAddress === '127.0.0.1' || remoteAddress === '::1' || remoteAddress === '::ffff:127.0.0.1');
 }
-/**
- * Detect if request is proxied through Cloudflare Tunnel (not truly local).
- * Tunnel adds cf-connecting-ip / cf-ray headers; real localhost requests don't.
- */
 function isTunnelRequest(req) {
-    return !!(req.headers['cf-connecting-ip'] || req.headers['cf-ray']);
+    return Object.keys(req.headers).some((name) => name === 'cf-connecting-ip' || name === 'cf-ray' || name.startsWith('cf-access-'));
 }
-function hasCloudflareAccessIdentity(req) {
-    const headers = req.headers;
-    return (typeof headers['cf-access-jwt-assertion'] === 'string' ||
-        typeof headers['cf-access-authenticated-user-email'] === 'string' ||
-        typeof headers['cf-access-authenticated-user-uuid'] === 'string');
+function safeTokenEqual(token, configured) {
+    const provided = Buffer.from(token);
+    const expected = Buffer.from(configured);
+    return provided.length === expected.length && (0, node_crypto_1.timingSafeEqual)(provided, expected);
 }
-/**
- * Trust Cloudflare Access authenticated requests when:
- * 1. Peer is localhost (request came through local Cloudflare Tunnel), AND
- * 2. Request has CF Access identity headers (user passed Cloudflare Access login)
- *
- * No environment variable needed — if cf-ray + CF Access headers arrive
- * from localhost, it's a Cloudflare Tunnel by definition.
- * MAMA_TRUST_CLOUDFLARE_ACCESS=true is still supported as explicit opt-in
- * but is no longer required.
- */
-function isTrustedCloudflareAccessRequest(req) {
-    if (!(0, trusted_proxy_js_1.isTrustedProxyPeer)(req.socket?.remoteAddress || null)) {
-        return false;
-    }
-    return hasCloudflareAccessIdentity(req);
+function requestToken(req) {
+    const header = req.headers.authorization;
+    if (typeof header !== 'string')
+        return null;
+    return header.startsWith('Bearer ') ? header.slice(7) : header;
 }
-function getClientAddress(req) {
-    return (0, trusted_proxy_js_1.getForwardedClientAddress)(req);
+async function authenticateViewerRequest(req, observation) {
+    const configured = process.env.MAMA_AUTH_TOKEN;
+    if (isLocalRequest(req) && !isTunnelRequest(req))
+        return 'local';
+    const token = requestToken(req);
+    const validToken = configured && token !== null && safeTokenEqual(token, configured);
+    if (validToken && !observation)
+        return 'token';
+    const email = await (0, cf_access_js_1.verifiedCfAccessEmail)(req.headers);
+    if (observation) {
+        observation.accessVerified = email !== null;
+        const owners = process.env.MAMA_VIEWER_OWNER_EMAILS;
+        observation.unknownIdentity =
+            email !== null &&
+                owners !== undefined &&
+                !owners
+                    .split(',')
+                    .map((owner) => owner.trim().toLowerCase())
+                    .includes(email.toLowerCase());
+    }
+    if (validToken)
+        return 'token';
+    return email === null
+        ? null
+        : `access:${(0, node_crypto_1.createHash)('sha256').update(email).digest('hex').slice(0, 12)}`;
 }
-function getSecurityLogContext(req) {
-    const rawUrl = req.url || '/';
-    let path = rawUrl;
-    try {
-        const host = req.headers.host || 'localhost';
-        path = new URL(rawUrl, `http://${host}`).pathname;
-    }
-    catch {
-        // Keep raw URL if parsing fails.
-    }
-    return {
-        clientAddress: getClientAddress(req),
-        remoteAddress: req.socket?.remoteAddress || null,
-        forwardedFor: typeof req.headers['x-forwarded-for'] === 'string' ? req.headers['x-forwarded-for'] : null,
-        cfConnectingIp: typeof req.headers['cf-connecting-ip'] === 'string' ? req.headers['cf-connecting-ip'] : null,
-        cfRay: typeof req.headers['cf-ray'] === 'string' ? req.headers['cf-ray'] : null,
-        method: 'method' in req && typeof req.method === 'string' ? req.method : null,
-        path,
-        viaTunnel: isTunnelRequest(req),
-    };
-}
-function logUnauthorizedAttempt(req, options = {}) {
-    let hasQueryToken = false;
-    if (options.allowQueryToken && req.url) {
-        try {
-            hasQueryToken = new URL(req.url, `http://${req.headers.host || 'localhost'}`).searchParams.has('token');
-        }
-        catch {
-            hasQueryToken = false;
-        }
-    }
-    const context = getSecurityLogContext(req);
-    const details = {
-        hasAuthorizationHeader: !!req.headers.authorization,
-        hasQueryToken,
-        allowQueryToken: !!options.allowQueryToken,
-    };
-    authLogger.warn('[SECURITY] Unauthorized request blocked', { ...context, ...details });
-    (0, security_monitor_js_1.recordSecurityEvent)({
-        type: 'unauthorized_request',
-        severity: 'warn',
-        message: 'Unauthorized request blocked',
-        ...context,
-        details,
-    });
+async function isAuthenticated(req) {
+    return (await authenticateViewerRequest(req)) !== null;
 }
-function safeTokenEqual(token, adminToken) {
-    if (token.length !== adminToken.length) {
-        return false;
-    }
-    return (0, node_crypto_1.timingSafeEqual)(Buffer.from(token), Buffer.from(adminToken));
-}
-function getRequestToken(req, options = {}) {
-    const authHeader = req.headers.authorization;
-    if (authHeader) {
-        return authHeader.startsWith('Bearer ') ? authHeader.slice(7) : authHeader;
-    }
-    if (options.allowQueryToken && req.url) {
-        try {
-            const host = req.headers.host || 'localhost';
-            const url = new URL(req.url, `http://${host}`);
-            return url.searchParams.get('token');
-        }
-        catch {
-            return null;
-        }
-    }
-    return null;
-}
-/**
- * Check if request is authenticated.
- *
- * - If no token configured: allows direct localhost only
- * - If token configured + real localhost (no tunnel headers): allows without token
- * - If token configured + tunnel/remote: requires Bearer token
- */
-function isAuthenticated(req, options = {}) {
-    const adminToken = process.env.MAMA_AUTH_TOKEN || process.env.MAMA_SERVER_TOKEN;
-    if (!adminToken) {
-        if (isTrustedCloudflareAccessRequest(req)) {
-            return true;
-        }
-        return isLocalRequest(req) && !isTunnelRequest(req);
-    }
-    // Real localhost (not via tunnel) — allow without token for local dashboard
-    if (isLocalRequest(req) && !isTunnelRequest(req)) {
+async function requireViewerAuth(req, res, identity) {
+    if ((identity === undefined ? await authenticateViewerRequest(req) : identity) !== null)
         return true;
-    }
-    if (isTrustedCloudflareAccessRequest(req)) {
-        return true;
-    }
-    // Remote or tunnel request — require Bearer token
-    const token = getRequestToken(req, options);
-    if (!token) {
-        return false;
-    }
-    return safeTokenEqual(token, adminToken);
-}
-/**
- * Express middleware that rejects unauthenticated requests with 401.
- *
- * Usage:
- *   app.post('/api/sensitive', requireAuth, handler);
- *   app.use('/api/cron', requireAuth, cronRouter);
- */
-function requireAuth(req, res, next) {
-    const clientAddress = getClientAddress(req);
-    // Banned IP → reject immediately
-    if ((0, security_monitor_js_1.isIpBanned)(clientAddress)) {
-        res.status(403).json({ error: true, code: 'FORBIDDEN', message: 'Access denied.' });
-        return;
-    }
-    if (!isAuthenticated(req)) {
-        logUnauthorizedAttempt(req);
-        (0, security_monitor_js_1.recordAuthFailure)(clientAddress);
-        res.status(401).json({
-            error: true,
-            code: 'UNAUTHORIZED',
-            message: 'Authentication required. Provide Authorization: Bearer <token> header.',
-        });
-        return;
-    }
-    next();
-}
-function requireAdminAuth(req, res, next) {
-    const clientAddress = getClientAddress(req);
-    const adminToken = process.env.MAMA_ADMIN_TOKEN;
-    if ((0, security_monitor_js_1.isIpBanned)(clientAddress)) {
-        res.status(403).json({ error: true, code: 'FORBIDDEN', message: 'Access denied.' });
-        return;
-    }
-    if (!adminToken) {
-        res.status(503).json({
-            error: true,
-            code: 'admin_token_required',
-            message: 'MAMA_ADMIN_TOKEN is required for admin provenance reads.',
-        });
-        return;
-    }
-    const authHeader = req.headers.authorization;
-    const token = typeof authHeader === 'string' && authHeader.startsWith('Bearer ') ? authHeader.slice(7) : null;
-    if (!token || !safeTokenEqual(token, adminToken)) {
-        logUnauthorizedAttempt(req);
-        (0, security_monitor_js_1.recordAuthFailure)(clientAddress);
-        res.status(401).json({
-            error: true,
-            code: 'UNAUTHORIZED',
-            message: 'Admin authentication required.',
-        });
-        return;
-    }
-    next();
+    res.writeHead(401, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'WWW-Authenticate': 'Bearer realm="MAMA API"',
+    });
+    res.end(JSON.stringify({
+        error: true,
+        code: 'UNAUTHORIZED',
+        message: 'Authentication required. Provide Authorization: Bearer <token> header.',
+    }));
+    return false;
 }
 //# sourceMappingURL=auth-middleware.js.map

package/dist/api/auth-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../src/api/auth-middleware.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCH,wCAGC;AAUD,kEAOC;AAYD,4EAMC;AAED,4CAEC;AAED,sDAsBC;AAED,wDA2BC;AAmCD,0CAwBC;AASD,kCAoBC;AAED,4CAkCC;AA/PD,6CAA8C;AAG9C,iFAAmE;AACnE,yEAIyC;AACzC,mEAA6F;AAE7F,MAAM,EAAE,WAAW,EAAE,GAAG,WAIvB,CAAC;AACF,MAAM,UAAU,GAAG,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC;AAiBnD;;GAEG;AACH,SAAgB,cAAc,CAAC,GAAoB;IACjD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC;IAC7C,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,kBAAkB,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,GAAoB;IAC3C,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAgB,2BAA2B,CAAC,GAAoB;IAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,OAAO,CACL,OAAO,OAAO,CAAC,yBAAyB,CAAC,KAAK,QAAQ;QACtD,OAAO,OAAO,CAAC,oCAAoC,CAAC,KAAK,QAAQ;QACjE,OAAO,OAAO,CAAC,mCAAmC,CAAC,KAAK,QAAQ,CACjE,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,gCAAgC,CAAC,GAAoB;IACnE,IAAI,CAAC,IAAA,qCAAkB,EAAC,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAoB;IACnD,OAAO,IAAA,4CAAyB,EAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,qBAAqB,CAAC,GAAoB;IACxD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;IAC9B,IAAI,IAAI,GAAkB,MAAM,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;QAC7C,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IAED,OAAO;QACL,aAAa,EAAE,gBAAgB,CAAC,GAAG,CAAC;QACpC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;QAChD,YAAY,EACV,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QAC5F,cAAc,EACZ,OAAO,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9F,KAAK,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/E,MAAM,EAAE,QAAQ,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAC7E,IAAI;QACJ,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CAAC,GAAoB,EAAE,UAAuB,EAAE;IACpF,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,OAAO,CAAC,eAAe,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,aAAa,GAAG,IAAI,GAAG,CACrB,GAAG,CAAC,GAAG,EACP,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAC5C,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG;QACd,sBAAsB,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa;QACnD,aAAa;QACb,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe;KAC3C,CAAC;IACF,UAAU,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACvF,IAAA,yCAAmB,EAAC;QAClB,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,8BAA8B;QACvC,GAAG,OAAO;QACV,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,UAAkB;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAA,6BAAe,EAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,eAAe,CAAC,GAAoB,EAAE,UAAuB,EAAE;IACtE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7E,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;YAC/C,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,GAAoB,EAAE,UAAuB,EAAE;IAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAChF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,gCAAgC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,4EAA4E;IAC5E,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,gCAAgC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kDAAkD;IAClD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACzE,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAE5C,iCAAiC;IACjC,IAAI,IAAA,gCAAU,EAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAA,uCAAiB,EAAC,aAAa,CAAC,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC9E,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAEhD,IAAI,IAAA,gCAAU,EAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,0DAA0D;SACpE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,MAAM,KAAK,GACT,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAElG,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QACjD,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAA,uCAAiB,EAAC,aAAa,CAAC,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC"}
+{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../src/api/auth-middleware.ts"],"names":[],"mappings":";;AAKA,wCAKC;AAED,0CAIC;AA2BD,8DAyBC;AAED,0CAEC;AAED,8CAmBC;AA7FD,6CAA0D;AAE1D,iDAAuD;AAEvD,6EAA6E;AAC7E,SAAgB,cAAc,CAAC,GAAoB;IACjD,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC;IAChD,OAAO,CACL,aAAa,KAAK,WAAW,IAAI,aAAa,KAAK,KAAK,IAAI,aAAa,KAAK,kBAAkB,CACjG,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAAC,GAAoB;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAClC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,UAAkB;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,YAAY,CAAC,GAAoB;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACjE,CAAC;AAeM,KAAK,UAAU,yBAAyB,CAC7C,GAAoB,EACpB,WAAmC;IAEnC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC/C,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACjE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACrF,IAAI,UAAU,IAAI,CAAC,WAAW;QAAE,OAAO,OAAO,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,IAAA,oCAAqB,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,WAAW,EAAE,CAAC;QAChB,WAAW,CAAC,cAAc,GAAG,KAAK,KAAK,IAAI,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACpD,WAAW,CAAC,eAAe;YACzB,KAAK,KAAK,IAAI;gBACd,MAAM,KAAK,SAAS;gBACpB,CAAC,MAAM;qBACJ,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;qBAC1C,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,UAAU;QAAE,OAAO,OAAO,CAAC;IAC/B,OAAO,KAAK,KAAK,IAAI;QACnB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,UAAU,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,GAAoB;IACxD,OAAO,CAAC,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;AACzD,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,GAAoB,EACpB,GAAmB,EACnB,QAAgC;IAEhC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI;QACrF,OAAO,IAAI,CAAC;IACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,iCAAiC;QACjD,kBAAkB,EAAE,yBAAyB;KAC9C,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,wEAAwE;KAClF,CAAC,CACH,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/api/cf-access.d.ts

@@ -0,0 +1,6 @@
+import type { IncomingHttpHeaders } from 'node:http';
+/** Called when the viewer is constructed, so the daemon reports this once at startup. */
+export declare function logCfAccessConfiguration(): void;
+/** Verify the signed assertion, never the unsigned identity headers. No credentials are logged. */
+export declare function verifiedCfAccessEmail(headers: IncomingHttpHeaders): Promise<string | null>;
+//# sourceMappingURL=cf-access.d.ts.map

package/dist/api/cf-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cf-access.d.ts","sourceRoot":"","sources":["../../src/api/cf-access.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAqCrD,yFAAyF;AACzF,wBAAgB,wBAAwB,IAAI,IAAI,CAO/C;AA4BD,mGAAmG;AACnG,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwDhG"}

package/dist/api/cf-access.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logCfAccessConfiguration = logCfAccessConfiguration;
+exports.verifiedCfAccessEmail = verifiedCfAccessEmail;
+const node_crypto_1 = require("node:crypto");
+const CACHE_MS = 10 * 60 * 1000;
+const SKEW_SECONDS = 60;
+const UNKNOWN_KID_REFRESH_MS = 60_000;
+const unknownKidRefreshes = new Map();
+const cache = new Map();
+let loggedDisabled = false;
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function config() {
+    const issuer = process.env.MAMA_CF_ACCESS_ISSUER?.trim().replace(/\/$/, '');
+    const audience = process.env.MAMA_CF_ACCESS_AUD?.trim();
+    if (!issuer || !audience)
+        return null;
+    try {
+        const url = new URL(issuer);
+        if (url.protocol !== 'https:' ||
+            url.username ||
+            url.password ||
+            url.search ||
+            url.hash ||
+            url.pathname !== '/')
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return { issuer, audience };
+}
+/** Called when the viewer is constructed, so the daemon reports this once at startup. */
+function logCfAccessConfiguration() {
+    if (!config() && !loggedDisabled) {
+        loggedDisabled = true;
+        console.warn('[auth] Access verification is off; tunnelled requests require the viewer token. Configure MAMA_CF_ACCESS_ISSUER and MAMA_CF_ACCESS_AUD.');
+    }
+}
+async function jwks(issuer, force = false) {
+    const existing = cache.get(issuer);
+    if (!force && existing && existing.expires > Date.now())
+        return existing.keys;
+    // Never follow a redirect away from the configured issuer. Bound auth request latency.
+    const response = await fetch(`${issuer}/cdn-cgi/access/certs`, {
+        redirect: 'error',
+        signal: AbortSignal.timeout(5_000),
+    });
+    if (!response.ok)
+        throw new Error('Access key retrieval failed');
+    const payload = await response.json();
+    if (!record(payload) || !Array.isArray(payload.keys))
+        throw new Error('Invalid Access keys');
+    const keys = payload.keys.filter(record);
+    cache.set(issuer, { expires: Date.now() + CACHE_MS, keys });
+    return keys;
+}
+/** One shared rotation lookup per issuer per minute, including failed fetches. */
+function refreshUnknownKid(issuer) {
+    const previous = unknownKidRefreshes.get(issuer);
+    const now = Date.now();
+    if (previous && now - previous.at < UNKNOWN_KID_REFRESH_MS)
+        return previous.keys;
+    const keys = jwks(issuer, true);
+    unknownKidRefreshes.set(issuer, { at: now, keys });
+    return keys;
+}
+/** Verify the signed assertion, never the unsigned identity headers. No credentials are logged. */
+async function verifiedCfAccessEmail(headers) {
+    const settings = config();
+    const token = headers['cf-access-jwt-assertion'];
+    if (!settings || typeof token !== 'string')
+        return null;
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3 || parts.some((part) => !/^[A-Za-z0-9_-]+$/.test(part)))
+            return null;
+        const header = JSON.parse(Buffer.from(parts[0], 'base64url').toString('utf8'));
+        const claims = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+        if (!record(header) ||
+            !record(claims) ||
+            header.alg !== 'RS256' ||
+            typeof header.kid !== 'string')
+            return null;
+        if (claims.iss !== settings.issuer)
+            return null;
+        if (claims.aud !== settings.audience &&
+            !(Array.isArray(claims.aud) && claims.aud.includes(settings.audience)))
+            return null;
+        const now = Math.floor(Date.now() / 1000);
+        if (typeof claims.exp !== 'number' ||
+            !Number.isFinite(claims.exp) ||
+            claims.exp <= now - SKEW_SECONDS)
+            return null;
+        for (const time of [claims.nbf, claims.iat]) {
+            if (time !== undefined &&
+                (typeof time !== 'number' || !Number.isFinite(time) || time > now + SKEW_SECONDS))
+                return null;
+        }
+        if (typeof claims.email !== 'string' || !/^[^\s@]+@[^\s@]+$/.test(claims.email))
+            return null;
+        const matches = (item) => item.kid === header.kid &&
+            item.kty === 'RSA' &&
+            (item.alg === undefined || item.alg === 'RS256') &&
+            (item.use === undefined || item.use === 'sig');
+        let key = (await jwks(settings.issuer)).find(matches);
+        if (!key)
+            key = (await refreshUnknownKid(settings.issuer)).find(matches);
+        if (!key)
+            return null;
+        const valid = (0, node_crypto_1.verify)('RSA-SHA256', Buffer.from(`${parts[0]}.${parts[1]}`), (0, node_crypto_1.createPublicKey)({ key: key, format: 'jwk' }), Buffer.from(parts[2], 'base64url'));
+        return valid ? claims.email : null;
+    }
+    catch {
+        // Fetch errors may contain deployment details; authentication fails closed without logging them.
+        return null;
+    }
+}
+//# sourceMappingURL=cf-access.js.map

package/dist/api/cf-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cf-access.js","sourceRoot":"","sources":["../../src/api/cf-access.ts"],"names":[],"mappings":";;AAuCA,4DAOC;AA6BD,sDAwDC;AAnID,6CAAuE;AAGvE,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAGhC,CAAC;AACJ,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgE,CAAC;AACtF,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,MAAM;IACb,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,MAAM;YACV,GAAG,CAAC,IAAI;YACR,GAAG,CAAC,QAAQ,KAAK,GAAG;YAEpB,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,yFAAyF;AACzF,SAAgB,wBAAwB;IACtC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;QACjC,cAAc,GAAG,IAAI,CAAC;QACtB,OAAO,CAAC,IAAI,CACV,yIAAyI,CAC1I,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,KAAK,GAAG,KAAK;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;IAC9E,uFAAuF;IACvF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,uBAAuB,EAAE;QAC7D,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjE,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,QAAQ,IAAI,GAAG,GAAG,QAAQ,CAAC,EAAE,GAAG,sBAAsB;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;IACjF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mGAAmG;AAC5F,KAAK,UAAU,qBAAqB,CAAC,OAA4B;IACtE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,IACE,CAAC,MAAM,CAAC,MAAM,CAAC;YACf,CAAC,MAAM,CAAC,MAAM,CAAC;YACf,MAAM,CAAC,GAAG,KAAK,OAAO;YACtB,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAE9B,OAAO,IAAI,CAAC;QACd,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChD,IACE,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ;YAChC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAEtE,OAAO,IAAI,CAAC;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IACE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;YAC5B,MAAM,CAAC,GAAG,IAAI,GAAG,GAAG,YAAY;YAEhC,OAAO,IAAI,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,IACE,IAAI,KAAK,SAAS;gBAClB,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,GAAG,YAAY,CAAC;gBAEjF,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7F,MAAM,OAAO,GAAG,CAAC,IAA6B,EAAW,EAAE,CACzD,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YACvB,IAAI,CAAC,GAAG,KAAK,KAAK;YAClB,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC;YAChD,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;QACjD,IAAI,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG;YAAE,GAAG,GAAG,CAAC,MAAM,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,KAAK,GAAG,IAAA,oBAAM,EAClB,YAAY,EACZ,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EACtC,IAAA,6BAAe,EAAC,EAAE,GAAG,EAAE,GAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAC1D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CACpC,CAAC;QACF,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,iGAAiG;QACjG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/api/file-delivery.d.ts

@@ -0,0 +1,29 @@
+export declare const OWNER_FILE_MAX_UPLOAD_BYTES: number;
+export declare const TELEGRAM_MAX_UPLOAD_BYTES: number;
+export declare const TELEGRAM_MAX_PHOTO_BYTES: number;
+export declare const TELEGRAM_IMAGE_EXTENSIONS: Set<string>;
+export interface OwnerFileDeliveryResult {
+    messageId?: number | string;
+    sentAs: 'photo' | 'document';
+    size: number;
+    idempotent?: boolean;
+}
+export interface OwnerFileSender {
+    sendFile(path: string, caption: string | undefined, operationId: string): Promise<TelegramFileDeliveryResult>;
+}
+export type TelegramFileDeliveryResult = OwnerFileDeliveryResult;
+export type TelegramFileSender = OwnerFileSender;
+export interface ValidatedWorkspaceFile {
+    path: string;
+    size: number;
+    sentAs: 'photo' | 'document';
+}
+export declare function validateWorkspaceFile(filesRoot: string, inputPath: string): ValidatedWorkspaceFile;
+/** Keep this descriptor open through upload so a later path replacement cannot change its bytes. */
+export declare function openWorkspaceFile(filesRoot: string, inputPath: string): ValidatedWorkspaceFile & {
+    fd: number;
+};
+/** Read the validated descriptor without reopening its mutable pathname. The caller closes it. */
+export declare function readWorkspaceFile(fd: number): AsyncGenerator<Buffer>;
+export declare function workspaceFileIdentity(fd: number, caption?: string): string;
+//# sourceMappingURL=file-delivery.d.ts.map

package/dist/api/file-delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-delivery.d.ts","sourceRoot":"","sources":["../../src/api/file-delivery.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,2BAA2B,QAAmB,CAAC;AAC5D,eAAO,MAAM,yBAAyB,QAA8B,CAAC;AACrE,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AACzD,eAAO,MAAM,yBAAyB,aAAsD,CAAC;AAE7F,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACxC;AAED,MAAM,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AACjE,MAAM,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAEjD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;CAC9B;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,sBAAsB,CAIxB;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,sBAAsB,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CA2CzC;AAED,kGAAkG;AAClG,wBAAuB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAW3E;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAY1E"}

package/dist/api/file-delivery.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TELEGRAM_IMAGE_EXTENSIONS = exports.TELEGRAM_MAX_PHOTO_BYTES = exports.TELEGRAM_MAX_UPLOAD_BYTES = exports.OWNER_FILE_MAX_UPLOAD_BYTES = void 0;
+exports.validateWorkspaceFile = validateWorkspaceFile;
+exports.openWorkspaceFile = openWorkspaceFile;
+exports.readWorkspaceFile = readWorkspaceFile;
+exports.workspaceFileIdentity = workspaceFileIdentity;
+const node_fs_1 = require("node:fs");
+const node_crypto_1 = require("node:crypto");
+const node_path_1 = require("node:path");
+exports.OWNER_FILE_MAX_UPLOAD_BYTES = 50 * 1024 * 1024;
+exports.TELEGRAM_MAX_UPLOAD_BYTES = exports.OWNER_FILE_MAX_UPLOAD_BYTES;
+exports.TELEGRAM_MAX_PHOTO_BYTES = 10 * 1024 * 1024;
+exports.TELEGRAM_IMAGE_EXTENSIONS = new Set(['.png', '.jpg', '.jpeg', '.webp', '.gif']);
+function validateWorkspaceFile(filesRoot, inputPath) {
+    const { fd, ...validated } = openWorkspaceFile(filesRoot, inputPath);
+    (0, node_fs_1.closeSync)(fd);
+    return validated;
+}
+/** Keep this descriptor open through upload so a later path replacement cannot change its bytes. */
+function openWorkspaceFile(filesRoot, inputPath) {
+    const rootPath = (0, node_path_1.resolve)(filesRoot);
+    const rootMetadata = (0, node_fs_1.lstatSync)(rootPath);
+    if (!rootMetadata.isDirectory() || rootMetadata.isSymbolicLink()) {
+        throw new Error('workspace files root must be a directory, not a symlink');
+    }
+    const root = (0, node_fs_1.realpathSync)(rootPath);
+    if (root !== (0, node_path_1.join)((0, node_fs_1.realpathSync)((0, node_path_1.dirname)(rootPath)), (0, node_path_1.basename)(rootPath))) {
+        throw new Error('workspace files root must resolve to its own directory');
+    }
+    const resolved = (0, node_path_1.resolve)(inputPath);
+    const metadata = (0, node_fs_1.lstatSync)(resolved);
+    if (metadata.isSymbolicLink() || !metadata.isFile()) {
+        throw new Error('path must be a regular file, not a symlink or directory');
+    }
+    const real = (0, node_fs_1.realpathSync)(resolved);
+    if (real === root || !real.startsWith(`${root}${node_path_1.sep}`)) {
+        throw new Error('path must stay under the workspace files directory');
+    }
+    const fd = (0, node_fs_1.openSync)(real, node_fs_1.constants.O_RDONLY | node_fs_1.constants.O_NOFOLLOW);
+    try {
+        const opened = (0, node_fs_1.fstatSync)(fd);
+        if (!opened.isFile())
+            throw new Error('path must be a regular file');
+        const size = opened.size;
+        if (size > exports.OWNER_FILE_MAX_UPLOAD_BYTES) {
+            throw new Error(`file exceeds owner messenger upload limit of ${exports.OWNER_FILE_MAX_UPLOAD_BYTES} bytes`);
+        }
+        return {
+            fd,
+            path: real,
+            size,
+            sentAs: size <= exports.TELEGRAM_MAX_PHOTO_BYTES &&
+                exports.TELEGRAM_IMAGE_EXTENSIONS.has((0, node_path_1.extname)(real).toLowerCase())
+                ? 'photo'
+                : 'document',
+        };
+    }
+    catch (error) {
+        (0, node_fs_1.closeSync)(fd);
+        throw error;
+    }
+}
+/** Read the validated descriptor without reopening its mutable pathname. The caller closes it. */
+async function* readWorkspaceFile(fd) {
+    while (true) {
+        const buffer = Buffer.allocUnsafe(64 * 1024);
+        const bytesRead = await new Promise((resolve, reject) => {
+            (0, node_fs_1.read)(fd, buffer, 0, buffer.length, null, (error, size) => error ? reject(error) : resolve(size));
+        });
+        if (bytesRead === 0)
+            return;
+        yield buffer.subarray(0, bytesRead);
+    }
+}
+function workspaceFileIdentity(fd, caption) {
+    const hash = (0, node_crypto_1.createHash)('sha256').update(`caption\0${caption ?? ''}\0`);
+    const fileSize = (0, node_fs_1.fstatSync)(fd).size;
+    let position = 0;
+    while (position < fileSize) {
+        const buffer = Buffer.allocUnsafe(64 * 1024);
+        const size = (0, node_fs_1.readSync)(fd, buffer, 0, Math.min(buffer.length, fileSize - position), position);
+        if (size === 0)
+            throw new Error('Workspace file changed while calculating its identity');
+        position += size;
+        hash.update(buffer.subarray(0, size));
+    }
+    return hash.digest('hex');
+}
+//# sourceMappingURL=file-delivery.js.map

package/dist/api/file-delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-delivery.js","sourceRoot":"","sources":["../../src/api/file-delivery.ts"],"names":[],"mappings":";;;AA0CA,sDAOC;AAGD,8CA8CC;AAGD,8CAWC;AAED,sDAYC;AA9HD,qCASiB;AACjB,6CAAyC;AACzC,yCAA2E;AAE9D,QAAA,2BAA2B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,QAAA,yBAAyB,GAAG,mCAA2B,CAAC;AACxD,QAAA,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,QAAA,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AA0B7F,SAAgB,qBAAqB,CACnC,SAAiB,EACjB,SAAiB;IAEjB,MAAM,EAAE,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACrE,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;IACd,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oGAAoG;AACpG,SAAgB,iBAAiB,CAC/B,SAAiB,EACjB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,IAAA,mBAAO,EAAC,SAAS,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,IAAA,mBAAS,EAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,sBAAY,EAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,IAAA,gBAAI,EAAC,IAAA,sBAAY,EAAC,IAAA,mBAAO,EAAC,QAAQ,CAAC,CAAC,EAAE,IAAA,oBAAQ,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,mBAAO,EAAC,SAAS,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAA,mBAAS,EAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,sBAAY,EAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,eAAG,EAAE,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,GAAG,IAAA,kBAAQ,EAAC,IAAI,EAAE,mBAAS,CAAC,QAAQ,GAAG,mBAAS,CAAC,UAAU,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,IAAI,GAAG,mCAA2B,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,gDAAgD,mCAA2B,QAAQ,CACpF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE;YACF,IAAI,EAAE,IAAI;YACV,IAAI;YACJ,MAAM,EACJ,IAAI,IAAI,gCAAwB;gBAChC,iCAAyB,CAAC,GAAG,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBACxD,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,UAAU;SACjB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,kGAAkG;AAC3F,KAAK,SAAS,CAAC,CAAC,iBAAiB,CAAC,EAAU;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9D,IAAA,cAAI,EAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACvD,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CACtC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,SAAS,KAAK,CAAC;YAAE,OAAO;QAC5B,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CAAC,EAAU,EAAE,OAAgB;IAChE,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,OAAO,IAAI,EAAE,IAAI,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC,IAAI,CAAC;IACpC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,OAAO,QAAQ,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7F,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACzF,QAAQ,IAAI,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/api/owner-timezone-actions.d.ts

@@ -0,0 +1,10 @@
+import type { ActionRegistration } from '@jungjaehoon/mama-core';
+import type { TimeZoneSetting } from '../runtime/timezone.js';
+export interface OwnerTimeZoneActionPorts {
+    configPath: string;
+    ownerPrincipalId: string;
+    setting: TimeZoneSetting;
+    isOwnerMessageTurn(sourceMessageRef: string): boolean;
+}
+export declare function ownerTimeZoneActionRegistrations(ports: OwnerTimeZoneActionPorts): ActionRegistration[];
+//# sourceMappingURL=owner-timezone-actions.d.ts.map

package/dist/api/owner-timezone-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-timezone-actions.d.ts","sourceRoot":"","sources":["../../src/api/owner-timezone-actions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAiB,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAG9D,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,eAAe,CAAC;IACzB,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC;CACvD;AAyBD,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,wBAAwB,GAC9B,kBAAkB,EAAE,CAwCtB"}