@lunora/runtime 1.0.0-alpha.8 → 1.0.0-alpha.9

package/dist/index.d.mts

@@ -1614,6 +1614,22 @@ interface BackupManifest {
   tables?: string;
 }
 interface WorkerOptions {
+  /**
+  * An additional, async authorization gate for the `/_lunora/admin/*` plane
+  * (the Studio's HTTP + WS endpoints), OR-ed with the static {@link WorkerOptions.adminToken}
+  * bearer. When it resolves `true` for a request, that request is treated as
+  * admin-authorized even without the bearer; when it resolves `false` (or is
+  * unset) the bearer remains the only path. Evaluated once per admin request
+  * and never on the RPC/WebSocket data hot path.
+  *
+  * The intended producer is `@lunora/cloudflare-access`'s `accessAdminGate(...)`,
+  * which verifies the request's `Cf-Access-Jwt-Assertion` JWT and applies an
+  * `isAdmin(claims)` predicate — so the Studio can sit behind Cloudflare Access
+  * instead of (or alongside) a shared admin token. It takes only the request
+  * (verification needs static team-domain/aud config + the remote JWKS, no env
+  * binding), so it composes without threading async through every admin route.
+  */
+  adminGate?: (request: Request) => boolean | Promise<boolean>;
   /**
   * Admin bearer token expected by the export/import endpoints. When unset,
   * the endpoints respond with `ADMIN_FORBIDDEN` — the same posture the

package/dist/index.d.ts

@@ -1614,6 +1614,22 @@ interface BackupManifest {
   tables?: string;
 }
 interface WorkerOptions {
+  /**
+  * An additional, async authorization gate for the `/_lunora/admin/*` plane
+  * (the Studio's HTTP + WS endpoints), OR-ed with the static {@link WorkerOptions.adminToken}
+  * bearer. When it resolves `true` for a request, that request is treated as
+  * admin-authorized even without the bearer; when it resolves `false` (or is
+  * unset) the bearer remains the only path. Evaluated once per admin request
+  * and never on the RPC/WebSocket data hot path.
+  *
+  * The intended producer is `@lunora/cloudflare-access`'s `accessAdminGate(...)`,
+  * which verifies the request's `Cf-Access-Jwt-Assertion` JWT and applies an
+  * `isAdmin(claims)` predicate — so the Studio can sit behind Cloudflare Access
+  * instead of (or alongside) a shared admin token. It takes only the request
+  * (verification needs static team-domain/aud config + the remote JWKS, no env
+  * binding), so it composes without threading async through every admin route.
+  */
+  adminGate?: (request: Request) => boolean | Promise<boolean>;
   /**
   * Admin bearer token expected by the export/import endpoints. When unset,
   * the endpoints respond with `ADMIN_FORBIDDEN` — the same posture the

package/dist/index.mjs

@@ -1,5 +1,5 @@
 export { toAirbyteMessages, toFivetranResponse } from './packem_shared/toAirbyteMessages-DrHdplb4.mjs';
-export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-Y3uASpzc.mjs';
+export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-CxhwYzSP.mjs';
 export { createCrossShardRelationCapabilities } from './packem_shared/createCrossShardRelationCapabilities-C0KOf7er.mjs';
 export { DEFAULT_REGISTRY_CACHE_TTL_MS, SHARD_REGISTRY_DO_NAME, createDynamicShardRegistry } from './packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-ocax8v0n.mjs';
 export { LunoraError, toErrorResponse } from './packem_shared/LunoraError-CL0aOtpo.mjs';

package/dist/packem_shared/{composeWorker-Y3uASpzc.mjs → composeWorker-CxhwYzSP.mjs}

@@ -967,7 +967,7 @@ const buildIntrospectionAdminRoutes = (deps) => {
   };
 };
 
-const MIGRATE_PATH = "/_lunora/migrate";
+const MIGRATE_PATH$1 = "/_lunora/migrate";
 const PITR_PATH = "/_lunora/admin/pitr";
 const RANK_PATH = "/_lunora/admin/rank";
 const RANKPAGE_PATH = "/_lunora/admin/rankpage";
@@ -1224,7 +1224,7 @@ const buildOrchestrationAdminRoutes = (deps) => {
     return forwardToShard(shardDO, pitr.shardKey ?? defaultShard, forwarded);
   };
   return {
-    [MIGRATE_PATH]: handleMigrate,
+    [MIGRATE_PATH$1]: handleMigrate,
     [PITR_PATH]: handlePitr,
     [RANK_PATH]: handleRank,
     [RANKPAGE_PATH]: handleRankPage,
@@ -1558,6 +1558,9 @@ const RPC_PATH = "/_lunora/rpc";
 const WS_PATH = "/_lunora/ws";
 const SCHEDULER_DISPATCH_PATH = "/_lunora/scheduler/dispatch";
 const CRON_JOBS_RUN_PATH = "/_lunora/admin/cron-jobs/run";
+const ADMIN_PATH_PREFIX = "/_lunora/admin/";
+const MIGRATE_PATH = "/_lunora/migrate";
+const isAdminPath = (pathname) => pathname.startsWith(ADMIN_PATH_PREFIX) || pathname === MIGRATE_PATH;
 const DEFAULT_AUTH_BASE_PATH = "/api/auth";
 const RECORD_AUTH_EVENT_OP = "__lunora_admin__:recordAuthEvent";
 const AUTH_ATTEMPT_SEGMENTS = ["/sign-in", "/sign-up", "/callback"];
@@ -1768,6 +1771,18 @@ const createWorker = (options) => {
       envAdminToken = value;
     }
   };
+  const accessAdminGrants = /* @__PURE__ */ new WeakSet();
+  const requestIsAdmin = (request) => checkAdminAuth(request, effectiveAdminToken()) || accessAdminGrants.has(request);
+  const resolveAdminForwardContext = async (request, env) => {
+    const context = await resolveForwardContext(request, env, options.resolveIdentity);
+    if (accessAdminGrants.has(request) && context.headers["authorization"] === void 0) {
+      const token = effectiveAdminToken();
+      if (token !== void 0) {
+        context.headers["authorization"] = `Bearer ${token}`;
+      }
+    }
+    return context;
+  };
   const hasAnyShardAuth = Boolean(options.authorizeShard) || Boolean(options.authorizeFanOut);
   let warnedUnauthenticatedShardAccess = false;
   const warnUnauthenticatedShardAccessOnce = (kind) => {
@@ -1786,9 +1801,9 @@ const createWorker = (options) => {
   const orchestrationAdminRoutes = buildOrchestrationAdminRoutes({
     defaultShard,
     forwardToShard,
-    isAdmin: (request) => checkAdminAuth(request, effectiveAdminToken()),
+    isAdmin: requestIsAdmin,
     queryCoordinator: options.queryCoordinator,
-    resolveForwardContext: (request, env) => resolveForwardContext(request, env, options.resolveIdentity),
+    resolveForwardContext: resolveAdminForwardContext,
     shardDO
   });
   const dispatchToShard = async (functionPath, args, shardKey) => {
@@ -1852,7 +1867,7 @@ const createWorker = (options) => {
     }
   };
   const handleRunCronJob = async (request, env) => {
-    if (!checkAdminAuth(request, effectiveAdminToken())) {
+    if (!requestIsAdmin(request)) {
       throw new LunoraError("admin endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
     }
     if (request.method !== "POST") {
@@ -1926,17 +1941,17 @@ const createWorker = (options) => {
   };
   const dataMovementAdminRoutes = buildDataMovementAdminRoutes({
     applyGlobals: options.applyGlobals,
-    isAdmin: (request) => checkAdminAuth(request, effectiveAdminToken()),
+    isAdmin: requestIsAdmin,
     knownTables: () => collectKnownTables(),
     queryCoordinator: options.queryCoordinator,
-    resolveForwardContext: (request, env) => resolveForwardContext(request, env, options.resolveIdentity),
+    resolveForwardContext: resolveAdminForwardContext,
     shardDO,
     streamExportRows: (coordinator, headers, tables, writeRow) => streamExportRows(options, coordinator, headers, tables, writeRow, shardDO),
     streamingImport: (request, headers) => streamingImport(request, options, headers, shardDO),
     syncGlobals: options.syncGlobals
   });
   const assertAdminAuthorized = (request) => {
-    if (!checkAdminAuth(request, effectiveAdminToken())) {
+    if (!requestIsAdmin(request)) {
       throw new LunoraError("admin endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
     }
   };
@@ -1973,7 +1988,7 @@ const createWorker = (options) => {
     return resolveShard(requireSchedulerNamespace(), options.schedulerInstanceName ?? "default");
   };
   const scheduledAdminRoutes = buildScheduledAdminRoutes({
-    checkWsAdmin: (request) => checkAdminAuth(request, effectiveAdminToken()) || checkAdminWsToken(request, effectiveAdminToken()),
+    checkWsAdmin: (request) => requestIsAdmin(request) || checkAdminWsToken(request, effectiveAdminToken()),
     requireSchedulerNamespace,
     resolveSchedulerStub,
     schedulerInstanceName: options.schedulerInstanceName ?? "default"
@@ -2432,6 +2447,17 @@ const createWorker = (options) => {
       resolvedSecurity = resolveSecurity(options.security, env ?? {});
     }
   };
+  const applyAdminGate = async (request, pathname) => {
+    if (options.adminGate === void 0 || !isAdminPath(pathname)) {
+      return;
+    }
+    try {
+      if (await options.adminGate(request)) {
+        accessAdminGrants.add(request);
+      }
+    } catch {
+    }
+  };
   const handle = async (request, env, context) => {
     const url = new URL(request.url);
     if (request.method === "POST" || request.method === "PUT") {
@@ -2453,6 +2479,7 @@ const createWorker = (options) => {
     }
     const internalRoute = internalRoutes[url.pathname];
     if (internalRoute) {
+      await applyAdminGate(request, url.pathname);
       return internalRoute(request, env, url, context);
     }
     const httpRouteResponse = await dispatchHttpRoute(request, env, context);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/runtime",
-  "version": "1.0.0-alpha.8",
+  "version": "1.0.0-alpha.9",
   "description": "Lunora Worker runtime: the RPC router, shard resolver, and query coordinator",
   "keywords": [
     "cloudflare",