@nerdsystem/sdk 0.0.6 → 0.0.8

package/dist/auth/client.d.ts

@@ -21,9 +21,16 @@ export declare class AuthServiceError extends Error {
 export declare class AuthServiceClient {
     private readonly env;
     private readonly fetchImpl;
+    /** The visitor's address, forwarded so the platform rate-limits per person rather than per app. */
+    private readonly clientIp?;
     private readonly base;
-    constructor(env: Pick<NerdEnv, "NERD_AUTH_URL" | "NERD_PROJECT_ID" | "NERD_AUTH_SECRET">, fetchImpl?: typeof fetch);
+    constructor(env: Pick<NerdEnv, "NERD_AUTH_URL" | "NERD_PROJECT_ID" | "NERD_AUTH_SECRET">, fetchImpl?: typeof fetch, 
+    /** The visitor's address, forwarded so the platform rate-limits per person rather than per app. */
+    clientIp?: string | undefined);
     get jwksUrl(): string;
+    private signature?;
+    /** HMAC of the visitor address keyed by SHA-256(tenant secret), which is what the platform stores; an unsigned address is ignored there. */
+    private signVisitor;
     private call;
     signup(input: {
         email: string;

package/dist/auth/client.js

@@ -13,23 +13,41 @@ export class AuthServiceError extends Error {
 export class AuthServiceClient {
     env;
     fetchImpl;
+    clientIp;
     base;
     constructor(env, 
     // Wrapped, not bare: calling a stored `fetch` as a method breaks in workerd (illegal invocation).
-    fetchImpl = (input, init) => fetch(input, init)) {
+    fetchImpl = (input, init) => fetch(input, init), 
+    /** The visitor's address, forwarded so the platform rate-limits per person rather than per app. */
+    clientIp) {
         this.env = env;
         this.fetchImpl = fetchImpl;
+        this.clientIp = clientIp;
         this.base = `${env.NERD_AUTH_URL.replace(/\/$/, "")}/t/${env.NERD_PROJECT_ID}`;
     }
     get jwksUrl() {
         return `${this.env.NERD_AUTH_URL.replace(/\/$/, "")}/.well-known/jwks.json`;
     }
+    signature;
+    /** HMAC of the visitor address keyed by SHA-256(tenant secret), which is what the platform stores; an unsigned address is ignored there. */
+    signVisitor(ip) {
+        this.signature ??= (async () => {
+            const enc = new TextEncoder();
+            const digest = await crypto.subtle.digest("SHA-256", enc.encode(this.env.NERD_AUTH_SECRET));
+            const keyHex = Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+            const key = await crypto.subtle.importKey("raw", enc.encode(keyHex), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+            return Array.from(new Uint8Array(await crypto.subtle.sign("HMAC", key, enc.encode(ip))), (b) => b.toString(16).padStart(2, "0")).join("");
+        })();
+        return this.signature;
+    }
     async call(method, path, body, auth) {
+        const visitor = this.clientIp && this.env.NERD_AUTH_SECRET ? { "x-nerd-client-ip": this.clientIp, "x-nerd-client-sig": await this.signVisitor(this.clientIp) } : {};
         const res = await this.fetchImpl(`${this.base}${path}`, {
             method,
             headers: {
                 ...(body !== undefined ? { "content-type": "application/json" } : {}),
                 ...(auth ? { authorization: `Bearer ${auth}` } : {}),
+                ...visitor,
             },
             body: body !== undefined ? JSON.stringify(body) : null,
         });

package/dist/auth/middleware.js

@@ -16,7 +16,7 @@ export async function resolveUser(c) {
     const token = bearer?.toLowerCase().startsWith("bearer ") ? bearer.slice(7) : readAccessCookie(c);
     if (!token)
         return null;
-    const client = new AuthServiceClient(c.env);
+    const client = new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip"));
     const verified = await verifyAccessToken(token, { jwksUrl: client.jwksUrl, projectId: c.env.NERD_PROJECT_ID });
     if (!verified)
         return null;

package/dist/auth/routes.js

@@ -39,7 +39,7 @@ export function authRoutes() {
         if (c.env.NERD_TURNSTILE_SECRET && !(await verifyTurnstile(c.env.NERD_TURNSTILE_SECRET, str(body.turnstileToken), c.req.header("cf-connecting-ip")))) {
             return c.json({ error: { code: "bad_request", message: "Please complete the verification challenge" } }, 400);
         }
-        const session = await new AuthServiceClient(c.env).signup({ email, password, name });
+        const session = await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).signup({ email, password, name });
         setSessionCookies(c, session);
         return c.json({ user: session.user }, 201);
     });
@@ -49,7 +49,7 @@ export function authRoutes() {
         const password = str(body.password);
         if (!email || !password)
             return c.json({ error: { code: "bad_request", message: "email and password are required" } }, 400);
-        const session = await new AuthServiceClient(c.env).login({ email, password });
+        const session = await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).login({ email, password });
         setSessionCookies(c, session);
         return c.json({ user: session.user }, 200);
     });
@@ -58,7 +58,7 @@ export function authRoutes() {
         if (!refreshToken)
             return c.json({ error: { code: "unauthorized", message: "No session" } }, 401);
         try {
-            const session = await new AuthServiceClient(c.env).refresh(refreshToken);
+            const session = await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).refresh(refreshToken);
             setSessionCookies(c, session);
             return c.json({ user: session.user }, 200);
         }
@@ -73,7 +73,7 @@ export function authRoutes() {
     r.post("/logout", async (c) => {
         const refreshToken = readRefreshCookie(c);
         if (refreshToken)
-            await new AuthServiceClient(c.env).logout(refreshToken).catch(() => { });
+            await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).logout(refreshToken).catch(() => { });
         clearSessionCookies(c);
         return c.json({ ok: true }, 200);
     });
@@ -84,7 +84,7 @@ export function authRoutes() {
         if (!email)
             return c.json({ error: { code: "bad_request", message: "email is required" } }, 400);
         const origin = new URL(c.req.url).origin;
-        await new AuthServiceClient(c.env).forgotPassword({ email, resetUrl: `${origin}/reset-password`, ...(c.env.NERD_APP_NAME ? { appName: c.env.NERD_APP_NAME } : {}) });
+        await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).forgotPassword({ email, resetUrl: `${origin}/reset-password`, ...(c.env.NERD_APP_NAME ? { appName: c.env.NERD_APP_NAME } : {}) });
         return c.json({ ok: true }, 200);
     });
     r.post("/reset", async (c) => {
@@ -93,7 +93,7 @@ export function authRoutes() {
         const password = str(body.password);
         if (!token || !password)
             return c.json({ error: { code: "bad_request", message: "token and password are required" } }, 400);
-        const session = await new AuthServiceClient(c.env).resetPassword({ token, password });
+        const session = await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).resetPassword({ token, password });
         setSessionCookies(c, session);
         return c.json({ user: session.user }, 200);
     });
@@ -106,7 +106,7 @@ export function authRoutes() {
         if (!refreshToken || readAccessCookie(c))
             return c.json({ user: null }, 200);
         try {
-            const session = await new AuthServiceClient(c.env).refresh(refreshToken);
+            const session = await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).refresh(refreshToken);
             setSessionCookies(c, session);
             return c.json({ user: { id: session.user.id, email: session.user.email, name: session.user.name, roles: session.user.roles } }, 200);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nerdsystem/sdk",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "description": "Runtime for apps deployed on nerdsystem: auth, authorization, and platform bindings.",
   "type": "module",
   "main": "./dist/index.js",