@krantho/api 0.0.0-stage → 1.0.1

package/dist/workload-identity.d.ts

@@ -0,0 +1,23 @@
+import type { AuthSection } from '@krantho/config';
+import type { AuthResult } from './middleware/auth.js';
+import type { ApiRequest } from './types.js';
+/**
+ * Workload identity: a CI job presents the identity token its platform issues
+ * (GitHub Actions, GitLab and others sign a JWT per job) as a Bearer token,
+ * and the site verifies it against the one issuer the configuration trusts.
+ * No secret is stored anywhere. The grant is narrow — an editor's read access on the
+ * paths listed here, nothing else.
+ */
+/** The only paths a workload identity may read; every other path answers 403 */
+export declare const WORKLOAD_PATHS: readonly string[];
+/**
+ * Check a request that carries a workload identity token.
+ *
+ * Returns `null` when the request is not a workload request — the feature is
+ * off, the site has no authentication, or the Bearer token names another
+ * issuer — and the normal checks apply unchanged. A token that names the
+ * workload issuer is verified strictly and never falls through: it is granted
+ * an editor on {@link WORKLOAD_PATHS}, or refused.
+ */
+export declare function checkWorkloadAuth(req: ApiRequest, auth: AuthSection): Promise<AuthResult | null>;
+//# sourceMappingURL=workload-identity.d.ts.map

package/dist/workload-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload-identity.d.ts","sourceRoot":"","sources":["../src/workload-identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAGtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C;;;;;;GAMG;AAEH,gFAAgF;AAChF,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAAkD,CAAA;AAyG9F;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAkC5B"}

package/dist/workload-identity.js

@@ -0,0 +1,145 @@
+import { bearerToken } from './middleware/auth.js';
+import { getDiscovery, verifySignedJwt } from './oidc.js';
+/**
+ * Workload identity: a CI job presents the identity token its platform issues
+ * (GitHub Actions, GitLab and others sign a JWT per job) as a Bearer token,
+ * and the site verifies it against the one issuer the configuration trusts.
+ * No secret is stored anywhere. The grant is narrow — an editor's read access on the
+ * paths listed here, nothing else.
+ */
+/** The only paths a workload identity may read; every other path answers 403 */
+export const WORKLOAD_PATHS = ['/api/changes', '/api/migrations/conflicts'];
+/** The methods a workload identity may use */
+const WORKLOAD_METHODS = new Set(['GET', 'HEAD']);
+/** How far a token's clocks may differ from this server's, in seconds */
+const CLOCK_SKEW_SEC = 60;
+const INVALID_TOKEN = {
+    isAuthenticated: false,
+    response: { status: 401, body: { error: 'Invalid workload token' } },
+};
+/** The workload settings when the feature is on: issuer, audience and at least one subject */
+function configuredWorkload(workload) {
+    const { issuer, audience, subjects } = workload;
+    if (!issuer || !audience || subjects.length === 0)
+        return null;
+    return { issuer, audience, subjects };
+}
+/**
+ * The `iss` claim of a token, read without trusting it: the payload is decoded,
+ * nothing is verified. It only decides which check the token goes through.
+ */
+function unverifiedIssuer(token) {
+    const parts = token.split('.');
+    const payload = parts.length === 3 ? parts[1] : undefined;
+    if (!payload)
+        return undefined;
+    try {
+        const claims = JSON.parse(Buffer.from(payload, 'base64url').toString());
+        if (claims === null || typeof claims !== 'object')
+            return undefined;
+        const { iss } = claims;
+        return typeof iss === 'string' ? iss : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function matchesSubject(subject, pattern) {
+    if (!pattern.endsWith('*'))
+        return subject === pattern;
+    return subject.startsWith(pattern.slice(0, -1));
+}
+/** A NumericDate claim, which must be a finite number */
+function timeClaim(value) {
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+        throw new Error('Invalid time claim');
+    }
+    return value;
+}
+/** exp is required and must lie ahead; nbf and iat, when present, must not lie ahead */
+function checkTimes(claims) {
+    const now = Math.floor(Date.now() / 1000);
+    if (timeClaim(claims['exp']) + CLOCK_SKEW_SEC <= now)
+        throw new Error('Token expired');
+    for (const name of ['nbf', 'iat']) {
+        const value = claims[name];
+        if (value !== undefined && timeClaim(value) - CLOCK_SKEW_SEC > now) {
+            throw new Error(`Token ${name} lies in the future`);
+        }
+    }
+}
+/**
+ * Verify a workload token against the configured issuer and return its subject.
+ *
+ * The issuer's key set is found through the discovery document of the
+ * *configured* issuer, never through anything the token says. Throws on any
+ * failure; the caller turns every throw into the same 401.
+ */
+async function verifyWorkloadToken(token, workload) {
+    const discovery = await getDiscovery(workload.issuer);
+    if (discovery.issuer !== workload.issuer || typeof discovery.jwks_uri !== 'string') {
+        throw new Error('Discovery document does not belong to the configured issuer');
+    }
+    const claims = await verifySignedJwt(token, discovery.jwks_uri);
+    if (claims['iss'] !== workload.issuer)
+        throw new Error('Issuer mismatch');
+    const aud = claims['aud'];
+    const audiences = Array.isArray(aud) ? aud : [aud];
+    if (!audiences.includes(workload.audience))
+        throw new Error('Audience mismatch');
+    checkTimes(claims);
+    const subject = claims['sub'];
+    if (typeof subject !== 'string' || subject === '')
+        throw new Error('Missing subject');
+    if (!workload.subjects.some((pattern) => matchesSubject(subject, pattern))) {
+        throw new Error('Subject not allowed');
+    }
+    return subject;
+}
+function allowedRead(req) {
+    return WORKLOAD_METHODS.has(req.method.toUpperCase()) && WORKLOAD_PATHS.includes(req.path);
+}
+/**
+ * Check a request that carries a workload identity token.
+ *
+ * Returns `null` when the request is not a workload request — the feature is
+ * off, the site has no authentication, or the Bearer token names another
+ * issuer — and the normal checks apply unchanged. A token that names the
+ * workload issuer is verified strictly and never falls through: it is granted
+ * an editor on {@link WORKLOAD_PATHS}, or refused.
+ */
+export async function checkWorkloadAuth(req, auth) {
+    const workload = configuredWorkload(auth.workload);
+    if (!workload || auth.mode === 'none')
+        return null;
+    const token = bearerToken(req);
+    if (!token || unverifiedIssuer(token) !== workload.issuer)
+        return null;
+    let subject;
+    try {
+        subject = await verifyWorkloadToken(token, workload);
+    }
+    catch {
+        return INVALID_TOKEN;
+    }
+    if (!allowedRead(req)) {
+        return {
+            isAuthenticated: false,
+            response: {
+                status: 403,
+                body: { error: `This token may only read ${WORKLOAD_PATHS.join(', ')}` },
+            },
+        };
+    }
+    return {
+        isAuthenticated: true,
+        user: {
+            id: `workload:${subject}`,
+            email: subject,
+            name: 'CI workload',
+            roles: ['editor'],
+            mode: auth.mode,
+        },
+    };
+}
+//# sourceMappingURL=workload-identity.js.map

package/dist/workload-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload-identity.js","sourceRoot":"","sources":["../src/workload-identity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAGzD;;;;;;GAMG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAsB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAA;AAE9F,8CAA8C;AAC9C,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAEtE,yEAAyE;AACzE,MAAM,cAAc,GAAG,EAAE,CAAA;AAEzB,MAAM,aAAa,GAAG;IACpB,eAAe,EAAE,KAAK;IACtB,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE;CACvC,CAAA;AAU/B,8FAA8F;AAC9F,SAAS,kBAAkB,CAAC,QAAyB;IACnD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAA;IAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;QAChF,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACnE,MAAM,EAAE,GAAG,EAAE,GAAG,MAA2B,CAAA;QAC3C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,OAAe;IACtD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,KAAK,OAAO,CAAA;IACtD,OAAO,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AACjD,CAAC;AAED,yDAAyD;AACzD,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,wFAAwF;AACxF,SAAS,UAAU,CAAC,MAA+B;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,cAAc,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;IACtF,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,cAAc,GAAG,GAAG,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,qBAAqB,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,QAA4B;IAC5E,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACrD,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAA;IAC/D,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;IAEzE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACzB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAClD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;IAEhF,UAAU,CAAC,MAAM,CAAC,CAAA;IAElB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC7B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACrF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,GAAe;IAClC,OAAO,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AAC5F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAe,EACf,IAAiB;IAEjB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAClD,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAElD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAEtE,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE;gBACR,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,EAAE,KAAK,EAAE,4BAA4B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;aACzE;SACF,CAAA;IACH,CAAC;IAED,OAAO;QACL,eAAe,EAAE,IAAI;QACrB,IAAI,EAAE;YACJ,EAAE,EAAE,YAAY,OAAO,EAAE;YACzB,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,CAAC,QAAQ,CAAC;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "@krantho/api",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "1.0.1",
+  "description": "The krantho REST API: framework-neutral handlers for content, versions, media, SEO, auth, plugins and webhooks, with an OpenAPI 3.1 specification.",
+  "license": "MIT",
+  "homepage": "https://krantho.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/descoped/krantho.git",
+    "directory": "packages/api"
+  },
+  "bugs": {
+    "url": "https://github.com/descoped/krantho/issues"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "sharp": "^0.35.5",
+    "@krantho/ai": "1.0.1",
+    "@krantho/config": "1.0.1",
+    "@krantho/core": "1.0.1",
+    "@krantho/persistence": "1.0.1",
+    "@krantho/schema": "1.0.1",
+    "@krantho/seo-shared": "1.0.1"
+  },
+  "peerDependencies": {
+    "zod": "^4.0.0",
+    "@krantho/seo": "1.0.1"
+  },
+  "peerDependenciesMeta": {
+    "@krantho/seo": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^25.9.9",
+    "typescript": "^6.0.3",
+    "zod": "^4.6.7",
+    "@krantho/persistence-sqlite": "1.0.1"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.