@mettlelabs/mettle 0.0.0-beta.1-linux-arm64 → 0.0.0-beta.11

package/harness/chunk-4jtnt9k5.mjs

@@ -1,95 +0,0 @@
-import {
-  sha256
-} from "./chunk-2gt4cy7x.mjs";
-import {
-  ApiPrincipalSchema,
-  ApiTokenRecordSchema,
-  BEARER_TOKEN_PATTERN
-} from "./chunk-zvkxtj82.mjs";
-import {
-  number
-} from "./chunk-1sygmp11.mjs";
-
-// apps/harness/src/api/auth.ts
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { mkdir, rm, writeFile } from "node:fs/promises";
-import { join, resolve } from "node:path";
-var ApiTokenIssueRequestSchema = ApiPrincipalSchema.omit({
-  expiresAt: true
-}).extend({
-  ttlSeconds: number().int().min(60).max(86400).default(3600)
-});
-function issueApiToken(input, now = Date.now()) {
-  const { ttlSeconds, ...authority } = ApiTokenIssueRequestSchema.parse(input);
-  const principal = ApiPrincipalSchema.parse({
-    ...authority,
-    expiresAt: now + ttlSeconds * 1000
-  });
-  const token = randomBytes(32).toString("base64url");
-  const record = {
-    tokenSha256: sha256(token),
-    principal
-  };
-  return { token, record };
-}
-async function writePrivateFile(path, contents) {
-  await writeFile(path, contents, { flag: "wx", mode: 384 });
-}
-async function writeApiTokenFiles(request, outputDirectory) {
-  const { token, record } = issueApiToken(request);
-  const directory = resolve(outputDirectory);
-  const tokenFile = join(directory, "token.key");
-  const serverTokensFile = join(directory, "server-tokens.json");
-  await mkdir(directory, { mode: 448 });
-  try {
-    await writePrivateFile(tokenFile, `${token}
-`);
-    await writePrivateFile(serverTokensFile, `${JSON.stringify([record], null, 2)}
-`);
-  } catch (error) {
-    await rm(directory, { recursive: true, force: true });
-    throw error;
-  }
-  return {
-    tokenFile,
-    serverTokensFile,
-    expiresAt: record.principal.expiresAt,
-    credentialsPrinted: false
-  };
-}
-
-class ApiError extends Error {
-  status;
-  code;
-  constructor(status, code) {
-    super(code);
-    this.status = status;
-    this.code = code;
-  }
-}
-function tokenAuthenticator(entries, now = Date.now) {
-  if (!entries.length)
-    throw new Error("At least one explicitly configured API token is required.");
-  const records = entries.map((entry) => {
-    const record = ApiTokenRecordSchema.parse(entry);
-    return {
-      hash: Buffer.from(record.tokenSha256, "hex"),
-      principal: record.principal
-    };
-  });
-  if (new Set(entries.map((entry) => entry.tokenSha256)).size !== entries.length)
-    throw new Error("Duplicate API token.");
-  return async (request) => {
-    const header = request.headers.get("authorization") ?? "";
-    const match = BEARER_TOKEN_PATTERN.exec(header);
-    if (!match)
-      throw new ApiError(401, "unauthorized");
-    const actual = createHash("sha256").update(match[1]).digest();
-    const record = records.find((entry) => timingSafeEqual(entry.hash, actual));
-    if (!record || record.principal.expiresAt <= now())
-      throw new ApiError(401, "unauthorized");
-    return structuredClone(record.principal);
-  };
-}
-
-export { writeApiTokenFiles, ApiError, tokenAuthenticator };