@mettlelabs/mettle 0.0.0-beta.1 → 0.0.0-beta.1-linux-x64

package/harness/chunk-4jtnt9k5.mjs

@@ -0,0 +1,95 @@
+import {
+  sha256
+} from "./chunk-2gt4cy7x.mjs";
+import {
+  ApiPrincipalSchema,
+  ApiTokenRecordSchema,
+  BEARER_TOKEN_PATTERN
+} from "./chunk-zvkxtj82.mjs";
+import {
+  number
+} from "./chunk-1sygmp11.mjs";
+
+// apps/harness/src/api/auth.ts
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+var ApiTokenIssueRequestSchema = ApiPrincipalSchema.omit({
+  expiresAt: true
+}).extend({
+  ttlSeconds: number().int().min(60).max(86400).default(3600)
+});
+function issueApiToken(input, now = Date.now()) {
+  const { ttlSeconds, ...authority } = ApiTokenIssueRequestSchema.parse(input);
+  const principal = ApiPrincipalSchema.parse({
+    ...authority,
+    expiresAt: now + ttlSeconds * 1000
+  });
+  const token = randomBytes(32).toString("base64url");
+  const record = {
+    tokenSha256: sha256(token),
+    principal
+  };
+  return { token, record };
+}
+async function writePrivateFile(path, contents) {
+  await writeFile(path, contents, { flag: "wx", mode: 384 });
+}
+async function writeApiTokenFiles(request, outputDirectory) {
+  const { token, record } = issueApiToken(request);
+  const directory = resolve(outputDirectory);
+  const tokenFile = join(directory, "token.key");
+  const serverTokensFile = join(directory, "server-tokens.json");
+  await mkdir(directory, { mode: 448 });
+  try {
+    await writePrivateFile(tokenFile, `${token}
+`);
+    await writePrivateFile(serverTokensFile, `${JSON.stringify([record], null, 2)}
+`);
+  } catch (error) {
+    await rm(directory, { recursive: true, force: true });
+    throw error;
+  }
+  return {
+    tokenFile,
+    serverTokensFile,
+    expiresAt: record.principal.expiresAt,
+    credentialsPrinted: false
+  };
+}
+
+class ApiError extends Error {
+  status;
+  code;
+  constructor(status, code) {
+    super(code);
+    this.status = status;
+    this.code = code;
+  }
+}
+function tokenAuthenticator(entries, now = Date.now) {
+  if (!entries.length)
+    throw new Error("At least one explicitly configured API token is required.");
+  const records = entries.map((entry) => {
+    const record = ApiTokenRecordSchema.parse(entry);
+    return {
+      hash: Buffer.from(record.tokenSha256, "hex"),
+      principal: record.principal
+    };
+  });
+  if (new Set(entries.map((entry) => entry.tokenSha256)).size !== entries.length)
+    throw new Error("Duplicate API token.");
+  return async (request) => {
+    const header = request.headers.get("authorization") ?? "";
+    const match = BEARER_TOKEN_PATTERN.exec(header);
+    if (!match)
+      throw new ApiError(401, "unauthorized");
+    const actual = createHash("sha256").update(match[1]).digest();
+    const record = records.find((entry) => timingSafeEqual(entry.hash, actual));
+    if (!record || record.principal.expiresAt <= now())
+      throw new ApiError(401, "unauthorized");
+    return structuredClone(record.principal);
+  };
+}
+
+export { writeApiTokenFiles, ApiError, tokenAuthenticator };