@kedge/server 0.10.1 → 0.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kedge/server",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -22,8 +22,8 @@
     "hono": "4.13.13",
     "@hono/zod-openapi": "1.6.3",
     "zod": "4.6.7",
-    "@kedge/core": "0.10.1",
-    "@kedge/plugin-sdk": "0.10.1"
+    "@kedge/core": "0.11.0",
+    "@kedge/plugin-sdk": "0.11.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "5.20261024.1"

package/src/access.ts

@@ -307,9 +307,10 @@ export function adminGate(auth: AuthDeps, perms: AdminPermissions, now: () => nu
     if (cred?.via === "bearer" && cred.token.startsWith("sk_")) {
       const found = await resolveKey(c, auth, cred.token, t);
       access = { ctx: found.ctx, via: "key", key: found.key, resolved: found };
-    } else if (cred?.via === "bearer" && cred.token.startsWith("kcs_")) {
-      // A CLI session (p0.10 §6.2): admitted here, on /admin/* only, never as a staff session.
-      const found = await auth.access.cliSession(cred.token, t);
+    } else if (cred?.via === "bearer" && (cred.token.startsWith("kcs_") || cred.token.startsWith("kcb_"))) {
+      // A CLI session (p0.10 §6.2): admitted here, on /admin/* only, never as a staff session. A bound one
+      // only at its origin, the one Cloudflare routed this request to, never a header the client sends (p0.11 §3).
+      const found = await auth.access.cliSession(cred.token, t, new URL(c.req.url).origin);
       if (!found) throw new KedgeError("UNAUTHORIZED", "This CLI session has ended; run the command again");
       access = { ctx: found.ctx, via: "bearer", resolved: found };
     } else if (cred) {

package/src/types.ts

@@ -232,7 +232,8 @@ export interface AccessStore {
   maintain(session: AccessSession, now: number): Promise<number | null>;
   apiKey(presented: string, now: number): Promise<ResolvedAccess | null>;
   /** A CLI session's principal (p0.10 §6.2), or null when the token names no unexpired one. */
-  cliSession(token: string, now: number): Promise<ResolvedAccess | null>;
+  /** `origin` is the request's own URL's: a bound (`kcb_`) session is admitted only there (p0.11 §3). */
+  cliSession(token: string, now: number, origin: string): Promise<ResolvedAccess | null>;
   keyTouchDue(key: { lastUsedAt: number | null }, now: number): boolean;
   touchKey(keyId: string, now: number): Promise<void>;
   /** Counts a failed key verification against the address; false once past the limit (§4.3). */