@mybuildex/pkg 0.4.0 → 0.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -0
- package/dist/tenant/auth.d.ts +15 -0
- package/dist/tenant/auth.js +19 -0
- package/dist/tenant/auth.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -33,6 +33,7 @@ Quatro módulos novos, todos opt-in (nada muda numa API que não os usar):
|
|
|
33
33
|
- `createRequestScopePlugin()` + `requestScoped(Ctor, ...args)` — escopo por request via `AsyncLocalStorage`. Resolve o padrão `const service = new XService(fastify)` + `service.setRequest(request)` no preHandler, que compartilhava `this.request` (e o `request.prisma` do tenant) entre requests concorrentes. Troca mecânica: `new XService(fastify)` → `requestScoped(XService, fastify)`; registrar o plugin antes dos controllers. Uso fora de request lança `RequestScopeError`.
|
|
34
34
|
- `createTenantMembershipAssert({getTenantClient})` — o `assertTenant` pronto: consulta `users.firebase_id = uid` no schema do `:id_school` da URL; sem vínculo → 403. Fail-closed em erro de banco; cache positivo por `escola:uid` (120 s).
|
|
35
35
|
- `createTenantMiddleware({..., strictTenant: true})` — `id_school` presente mas inválido responde 400 (`InvalidTenantError`) em vez de cair no client default, que é a escola do `DATABASE_URL`. Sem `id_school` nenhum, o default continua.
|
|
36
|
+
- `createAuthMiddleware({..., internalAuth: {routes: [publicRoute("emailsend", "", {methods: ["POST"]})]}})` (0.4.1) — autenticação de serviço entre APIs dentro do próprio auth: header `x-internal-secret` com `INTERNAL_API_SECRET`, aceito só nas rotas listadas; o request vira `internal` e não passa por `assertTenant`. Segredo errado/rota fora da lista caem no fluxo de token.
|
|
36
37
|
- `createSharedSecretGuard({env: "INTERNAL_API_SECRET", header: "x-internal-secret"})` — `preHandler` para rotas chamadas entre APIs (ex: `emailsend`): compara o segredo do env em tempo constante; 401 se inválido, 503 (fail-closed) se a variável não existe em produção.
|
|
37
38
|
- `publicRoute(recurso, sufixo, {methods, prefix})`, `publicPath`, `isPublicRoute`, `safeEqual` — rotas públicas ancoradas (`^/v1/\d+/recurso/sufixo$`, com filtro de método) no lugar de regex de substring, e comparação de segredo/HMAC em tempo constante. `createAuthMiddleware.publicRoutes` aceita as regras e continua aceitando `RegExp`.
|
|
38
39
|
|
package/dist/tenant/auth.d.ts
CHANGED
|
@@ -19,6 +19,21 @@ export interface AuthMiddlewareOptions {
|
|
|
19
19
|
/** Vínculo tenant↔recurso: lança para negar (vira 403). Recebe o token
|
|
20
20
|
* decodificado e o request (com params/query/headers). */
|
|
21
21
|
assertTenant?: (decodedToken: any, request: any) => void | Promise<void>;
|
|
22
|
+
/** Autenticação de SERVIÇO entre APIs (ex: v2_payments -> v1_atendimento/
|
|
23
|
+
* emailsend): header com segredo compartilhado (Secret Manager, o mesmo
|
|
24
|
+
* valor nas duas functions), comparado em tempo constante e aceito SÓ nas
|
|
25
|
+
* rotas listadas. Request autenticado assim recebe
|
|
26
|
+
* request.user = {uid: "internal-service", internal: true} e request.internal
|
|
27
|
+
* = true, e NÃO passa por assertTenant (não há usuário na escola).
|
|
28
|
+
* Segredo ausente/errado ou rota fora da lista: cai no fluxo de token normal. */
|
|
29
|
+
internalAuth?: {
|
|
30
|
+
/** Variável de ambiente com o segredo (default INTERNAL_API_SECRET) */
|
|
31
|
+
env?: string;
|
|
32
|
+
/** Header lido (default x-internal-secret) */
|
|
33
|
+
header?: string;
|
|
34
|
+
/** Rotas que aceitam o segredo (publicRoute()/regex) */
|
|
35
|
+
routes: PublicRouteLike[];
|
|
36
|
+
};
|
|
22
37
|
/** TTL máximo do cache de tokens verificados, em ms (default 120s) */
|
|
23
38
|
cacheTtlMs?: number;
|
|
24
39
|
/** Tamanho máximo do cache (default 2000) */
|
package/dist/tenant/auth.js
CHANGED
|
@@ -56,6 +56,25 @@ function createAuthMiddleware(options) {
|
|
|
56
56
|
if ((0, public_route_1.isPublicRoute)(options.publicRoutes, pathname, request.method) || pathname === "" || pathname === "/") {
|
|
57
57
|
return;
|
|
58
58
|
}
|
|
59
|
+
// Serviço interno: segredo compartilhado nas rotas permitidas.
|
|
60
|
+
if (options.internalAuth) {
|
|
61
|
+
const ia = options.internalAuth;
|
|
62
|
+
const headerName = (ia.header ?? "x-internal-secret").toLowerCase();
|
|
63
|
+
let provided = request.headers?.[headerName];
|
|
64
|
+
if (Array.isArray(provided))
|
|
65
|
+
provided = provided[0];
|
|
66
|
+
if (provided !== undefined) {
|
|
67
|
+
const expected = process.env[ia.env ?? "INTERNAL_API_SECRET"];
|
|
68
|
+
const routeAllowed = (0, public_route_1.isPublicRoute)(ia.routes, pathname, request.method);
|
|
69
|
+
if (routeAllowed && expected && (0, public_route_1.safeEqual)(provided, expected)) {
|
|
70
|
+
request.user = { uid: "internal-service", internal: true };
|
|
71
|
+
request.user_id = "internal-service";
|
|
72
|
+
request.internal = true;
|
|
73
|
+
return;
|
|
74
|
+
}
|
|
75
|
+
console.warn(`[auth] x-internal-secret rejeitado em ${request.method} ${pathname} (${!expected ? "segredo não configurado" : !routeAllowed ? "rota não permitida" : "valor inválido"}); seguindo para o token`);
|
|
76
|
+
}
|
|
77
|
+
}
|
|
59
78
|
let authHeader = request.headers?.authorization;
|
|
60
79
|
if (options.allowQueryToken && request.query?.token) {
|
|
61
80
|
authHeader = request.query.token;
|
package/dist/tenant/auth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/tenant/auth.ts"],"names":[],"mappings":";AAAA,8DAA8D;AAC9D,EAAE;AACF,qEAAqE;AACrE,4EAA4E;AAC5E,uEAAuE;AACvE,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,0EAA0E;AAC1E,oEAAoE;AACpE,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,mDAAmD;;
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/tenant/auth.ts"],"names":[],"mappings":";AAAA,8DAA8D;AAC9D,EAAE;AACF,qEAAqE;AACrE,4EAA4E;AAC5E,uEAAuE;AACvE,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,0EAA0E;AAC1E,oEAAoE;AACpE,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,mDAAmD;;AAiDnD,oDA2HC;AA1KD,uDAA+E;AA+C/E,SAAgB,oBAAoB,CAAC,OAA8B;IAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IACnD,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC;IAEpD,SAAS,SAAS,CAAC,KAAa;QAC5B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1B,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,SAAS,SAAS,CAAC,KAAa,EAAE,IAAS,EAAE,UAAkB;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,IAAI,EAAE,GAAG,GAAG,UAAU,CAAC,CAAC;QAC5D,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,EAAC,KAAK,EAAE,IAAI,EAAC,CAAC,CAAC;QACtC,IAAI,WAAW,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YACpC,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,WAAW,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBAC1B,IAAI,CAAC,CAAC;oBAAE,MAAM;gBACd,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,KAAK,UAAU,cAAc,CAAC,OAAY;QAC7C,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,EAAE,OAAY,EAAE,KAAU,EAAE,EAAE;YAChE,IAAI,CAAC;gBACD,8DAA8D;gBAC9D,0DAA0D;gBAC1D,8DAA8D;gBAC9D,gEAAgE;gBAChE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtC,IAAI,IAAA,4BAAa,EAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;oBACvG,OAAO;gBACX,CAAC;gBAED,+DAA+D;gBAC/D,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;oBACvB,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;oBAChC,MAAM,UAAU,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC;oBACpE,IAAI,QAAQ,GAAY,OAAO,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;oBACtD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;wBAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;oBACpD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;wBAC9D,MAAM,YAAY,GAAG,IAAA,4BAAa,EAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;wBACxE,IAAI,YAAY,IAAI,QAAQ,IAAI,IAAA,wBAAS,EAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;4BAC5D,OAAO,CAAC,IAAI,GAAG,EAAC,GAAG,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAC,CAAC;4BACzD,OAAO,CAAC,OAAO,GAAG,kBAAkB,CAAC;4BACrC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;4BACxB,OAAO;wBACX,CAAC;wBACD,OAAO,CAAC,IAAI,CAAC,yCAAyC,OAAO,CAAC,MAAM,IAAI,QAAQ,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB,0BAA0B,CAAC,CAAC;oBACpN,CAAC;gBACL,CAAC;gBAED,IAAI,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC;gBAChD,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;oBAClD,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBACrC,CAAC;gBAED,IAAI,CAAC,UAAU,EAAE,CAAC;oBACd,4DAA4D;oBAC5D,IAAI,OAAO,CAAC,SAAS;wBAAE,OAAO;oBAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,2BAA2B,EAAC,CAAC,CAAC;gBAC1E,CAAC;gBAED,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACrB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gBAAgB,EAAC,CAAC,CAAC;gBAC/D,CAAC;gBAED,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;gBACrC,IAAI,MAAM,EAAE,CAAC;oBACT,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;wBACvB,IAAI,CAAC;4BACD,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;wBAChD,CAAC;wBAAC,MAAM,CAAC;4BACL,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gCAAgC,EAAC,CAAC,CAAC;wBAC/E,CAAC;oBACL,CAAC;oBACD,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC;oBACtB,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;oBAC7B,OAAO,CAAC,SAAS,GAAG,UAAU,CAAC;oBAC/B,OAAO;gBACX,CAAC;gBAED,sEAAsE;gBACtE,IAAI,QAA4B,CAAC;gBACjC,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;oBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC9E,QAAQ,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC;gBACzC,CAAC;gBACD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC7C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAEhE,SAAS,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC;gBAEtD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;oBACvB,IAAI,CAAC;wBACD,MAAM,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;oBACtD,CAAC;oBAAC,MAAM,CAAC;wBACL,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gCAAgC,EAAC,CAAC,CAAC;oBAC/E,CAAC;gBACL,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;gBAC5B,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC;gBACnC,OAAO,CAAC,SAAS,GAAG,UAAU,CAAC;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;gBAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAC,OAAO,EAAE,gBAAgB,EAAC,CAAC,CAAC;YAC/D,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC,CAAC;AACN,CAAC"}
|