@lunora/cloudflare-access 1.0.0-alpha.97 → 1.0.0-alpha.99

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/admin.d.mts +10 -3
  2. package/dist/admin.d.ts +10 -3
  3. package/dist/admin.mjs +1 -1
  4. package/package.json +2 -2
package/dist/admin.d.mts CHANGED
@@ -14,9 +14,16 @@ interface AccessAdminGateOptions extends AccessJwtFallbackOptions {
14
14
  * Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
15
15
  * predicate that authenticates the caller through Cloudflare Access and applies
16
16
  * your `isAdmin(claims)` test. When it resolves `true` the request authorizes the
17
- * `/_lunora/admin/*` plane (the Studio's HTTP + WS endpoints) in addition to — or
18
- * instead of — the static admin bearer, so the Studio can sit behind Cloudflare
19
- * Access.
17
+ * admin **HTTP** plane (`/_lunora/admin/*` plus `/_lunora/migrate`) in addition
18
+ * to — or instead of — the static admin bearer, so the Studio's pages can sit
19
+ * behind Cloudflare Access.
20
+ *
21
+ * It does NOT cover `/_lunora/ws`, which is not an admin path: the runtime never
22
+ * evaluates the gate there. The Studio's live views authenticate their socket
23
+ * with a sub-token minted at `/_lunora/admin/ws-token`, signed with the static
24
+ * admin token — so with no `LUNORA_ADMIN_TOKEN` configured, minting refuses
25
+ * (`ADMIN_TOKEN_NOT_CONFIGURED`) and every live panel fails while the HTTP pages
26
+ * work. Configure both.
20
27
  *
21
28
  * It accepts exactly one proof, and **which one is your choice, not the
22
29
  * platform's**:
package/dist/admin.d.ts CHANGED
@@ -14,9 +14,16 @@ interface AccessAdminGateOptions extends AccessJwtFallbackOptions {
14
14
  * Build an admin gate for `@lunora/runtime`'s `WorkerOptions.adminGate`: a
15
15
  * predicate that authenticates the caller through Cloudflare Access and applies
16
16
  * your `isAdmin(claims)` test. When it resolves `true` the request authorizes the
17
- * `/_lunora/admin/*` plane (the Studio's HTTP + WS endpoints) in addition to — or
18
- * instead of — the static admin bearer, so the Studio can sit behind Cloudflare
19
- * Access.
17
+ * admin **HTTP** plane (`/_lunora/admin/*` plus `/_lunora/migrate`) in addition
18
+ * to — or instead of — the static admin bearer, so the Studio's pages can sit
19
+ * behind Cloudflare Access.
20
+ *
21
+ * It does NOT cover `/_lunora/ws`, which is not an admin path: the runtime never
22
+ * evaluates the gate there. The Studio's live views authenticate their socket
23
+ * with a sub-token minted at `/_lunora/admin/ws-token`, signed with the static
24
+ * admin token — so with no `LUNORA_ADMIN_TOKEN` configured, minting refuses
25
+ * (`ADMIN_TOKEN_NOT_CONFIGURED`) and every live panel fails while the HTTP pages
26
+ * work. Configure both.
20
27
  *
21
28
  * It accepts exactly one proof, and **which one is your choice, not the
22
29
  * platform's**:
package/dist/admin.mjs CHANGED
@@ -1 +1 @@
1
- import{r as e}from"./packem_shared/platform-identity-Dy6G1EoF.mjs";import{assertJwtFallbackOptions as o,verifyRequest as n}from"./packem_shared/accessIssuer-CLO6p5MF.mjs";const d=t=>{const a=o(t);return async(s,i)=>{const r=a===void 0?await e(i):await n(s,a);return r===void 0?!1:t.isAdmin(r)}};export{d as accessAdminGate};
1
+ import{LunoraError as e}from"@lunora/errors";import{r as n}from"./packem_shared/platform-identity-Dy6G1EoF.mjs";import{assertJwtFallbackOptions as o,verifyRequest as m}from"./packem_shared/accessIssuer-CLO6p5MF.mjs";const l=i=>{if(typeof i.isAdmin!="function")throw new e("INTERNAL",'accessAdminGate: `isAdmin` is required and must be a function — it is the entire admin boundary, so there is no implicit grant. Pass e.g. `isAdmin: (claims) => claims.groups?.includes("lunora-admins") ?? false`.');const t=o(i);return async(s,a)=>{const r=t===void 0?await n(a):await m(s,t);return r===void 0?!1:await i.isAdmin(r)===!0}};export{l as accessAdminGate};
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@lunora/cloudflare-access",
3
- "version": "1.0.0-alpha.97",
3
+ "version": "1.0.0-alpha.99",
4
4
  "description": "Cloudflare Access (Zero Trust) identity for Lunora — verify the Cf-Access-Jwt-Assertion JWT against your team JWKS and feed the verified identity into ctx.auth / RLS via a resolveIdentity adapter",
5
5
  "keywords": [
6
6
  "access",
@@ -54,7 +54,7 @@
54
54
  "access": "public"
55
55
  },
56
56
  "dependencies": {
57
- "@lunora/errors": "1.0.0-alpha.29",
57
+ "@lunora/errors": "1.0.0-alpha.30",
58
58
  "jose": "^6.2.8"
59
59
  },
60
60
  "peerDependencies": {