@neutrome/open-ai-router 0.4.2 → 0.5.0

package/src/admission/jwt.ts

@@ -1,221 +0,0 @@
-import type { AuthPrincipal, RuntimeAuthenticator } from "./types.ts";
-
-export const DEFAULT_RUNTIME_AUTH_ISSUER = "neutrome-platform";
-export const DEFAULT_RUNTIME_AUTH_AUDIENCE = "workspace-runtime";
-
-export type RuntimeJwtAuthConfig = {
-  jwksJson?: string;
-  issuer?: string;
-  audience?: string;
-  revokedKeyIdsJson?: string;
-  workspaceId?: string;
-};
-
-type JsonWebKeySet = {
-  keys?: JsonWebKey[];
-};
-
-type JwtHeader = {
-  alg?: unknown;
-  kid?: unknown;
-};
-
-type RuntimeJwtClaims = {
-  iss?: unknown;
-  aud?: unknown;
-  sub?: unknown;
-  jti?: unknown;
-  models?: unknown;
-  namespaces?: unknown;
-  exp?: unknown;
-  nbf?: unknown;
-};
-
-type RuntimeJwtEnv = Record<string, unknown> & {
-  LIL_RUNTIME_AUTH_JWKS_JSON?: unknown;
-  LIL_RUNTIME_AUTH_ISSUER?: unknown;
-  LIL_RUNTIME_AUTH_AUDIENCE?: unknown;
-  LIL_RUNTIME_REVOKED_KEY_IDS_JSON?: unknown;
-};
-
-const encoder = new TextEncoder();
-const importedKeys = new Map<string, Promise<CryptoKey>>();
-
-export function createRuntimeJwtAuthenticator(
-  config: RuntimeJwtAuthConfig = {},
-): RuntimeAuthenticator {
-  return {
-    async authenticate(request, env) {
-      const token = readRuntimeToken(request);
-      if (!token) return null;
-      return verifyRuntimeJwt(token, readConfig(config, env));
-    },
-  };
-}
-
-export async function verifyRuntimeJwt(
-  token: string,
-  config: Required<RuntimeJwtAuthConfig>,
-): Promise<AuthPrincipal | null> {
-  const parts = token.split(".");
-  if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2]) return null;
-
-  const header = parseJsonPart<JwtHeader>(parts[0]);
-  const claims = parseJsonPart<RuntimeJwtClaims>(parts[1]);
-  if (!header || !claims || header.alg !== "ES256" || typeof header.kid !== "string") return null;
-
-  const key = findJwk(config.jwksJson, header.kid);
-  if (!key) return null;
-
-  const signature = base64UrlToBytes(parts[2]);
-  const signingInput = `${parts[0]}.${parts[1]}`;
-  const verified = await crypto.subtle.verify(
-    { name: "ECDSA", hash: "SHA-256" },
-    await importVerifyKey(key),
-    toArrayBuffer(derToJose(signature)),
-    toArrayBuffer(encoder.encode(signingInput)),
-  ).catch(() => false);
-  if (!verified) return null;
-
-  const now = Math.floor(Date.now() / 1000);
-  if (claims.iss !== config.issuer) return null;
-  if (!audienceMatches(claims.aud, config.audience)) return null;
-  if (typeof claims.sub !== "string" || !claims.sub) return null;
-  if (typeof claims.jti !== "string" || !claims.jti) return null;
-  if (typeof claims.exp !== "number" || claims.exp <= now) return null;
-  if (typeof claims.nbf === "number" && claims.nbf > now) return null;
-  if (config.workspaceId && claims.sub !== config.workspaceId) return null;
-  if (revokedKeyIds(config.revokedKeyIdsJson).has(claims.jti)) return null;
-
-  const allowedModels = readStringArrayClaim(claims.models);
-  const allowedNamespaces = readStringArrayClaim(claims.namespaces);
-  if (allowedModels === undefined || allowedNamespaces === undefined) return null;
-
-  return {
-    workspaceId: claims.sub,
-    keyId: claims.jti,
-    allowedModels,
-    allowedNamespaces,
-  };
-}
-
-export function readRuntimeToken(request: Request): string | null {
-  const authHeader = request.headers.get("authorization");
-  const bearerMatch = authHeader?.match(/^Bearer\s+(.+)$/i);
-  if (bearerMatch?.[1]) return bearerMatch[1];
-
-  const headerToken = request.headers.get("x-api-key")
-    ?? request.headers.get("x-goog-api-key");
-  if (headerToken) return headerToken;
-
-  const url = new URL(request.url);
-  return url.searchParams.get("key") ?? url.searchParams.get("api_key");
-}
-
-function readConfig(
-  config: RuntimeJwtAuthConfig,
-  env: Record<string, unknown>,
-): Required<RuntimeJwtAuthConfig> {
-  const runtimeEnv = env as RuntimeJwtEnv;
-  return {
-    jwksJson: config.jwksJson ?? stringBinding(runtimeEnv.LIL_RUNTIME_AUTH_JWKS_JSON) ?? "",
-    issuer: config.issuer ?? stringBinding(runtimeEnv.LIL_RUNTIME_AUTH_ISSUER) ?? DEFAULT_RUNTIME_AUTH_ISSUER,
-    audience: config.audience ?? stringBinding(runtimeEnv.LIL_RUNTIME_AUTH_AUDIENCE) ?? DEFAULT_RUNTIME_AUTH_AUDIENCE,
-    revokedKeyIdsJson: config.revokedKeyIdsJson ?? stringBinding(runtimeEnv.LIL_RUNTIME_REVOKED_KEY_IDS_JSON) ?? "",
-    workspaceId: config.workspaceId ?? "",
-  };
-}
-
-function stringBinding(value: unknown): string | undefined {
-  return typeof value === "string" && value ? value : undefined;
-}
-
-function findJwk(jwksJson: string, kid: string): JsonWebKey | null {
-  try {
-    const parsed = JSON.parse(jwksJson) as JsonWebKeySet;
-    const key = parsed.keys?.find((item) => (item as { kid?: unknown }).kid === kid);
-    return key ?? null;
-  } catch {
-    return null;
-  }
-}
-
-function revokedKeyIds(value: string): Set<string> {
-  try {
-    const parsed = JSON.parse(value) as unknown;
-    return new Set(Array.isArray(parsed) ? parsed.filter((item): item is string => typeof item === "string") : []);
-  } catch {
-    return new Set();
-  }
-}
-
-function audienceMatches(value: unknown, expected: string): boolean {
-  return value === expected || (Array.isArray(value) && value.includes(expected));
-}
-
-function readStringArrayClaim(value: unknown): readonly string[] | null | undefined {
-  if (value === undefined || value === null) return null;
-  if (!Array.isArray(value)) return undefined;
-  return value.every((item) => typeof item === "string") ? value : undefined;
-}
-
-function parseJsonPart<T>(part: string): T | null {
-  try {
-    return JSON.parse(new TextDecoder().decode(base64UrlToBytes(part))) as T;
-  } catch {
-    return null;
-  }
-}
-
-function importVerifyKey(jwk: JsonWebKey): Promise<CryptoKey> {
-  const cacheKey = JSON.stringify(jwk);
-  let imported = importedKeys.get(cacheKey);
-  if (!imported) {
-    imported = crypto.subtle.importKey(
-      "jwk",
-      jwk,
-      { name: "ECDSA", namedCurve: "P-256" },
-      false,
-      ["verify"],
-    );
-    importedKeys.set(cacheKey, imported);
-  }
-  return imported;
-}
-
-function base64UrlToBytes(value: string): Uint8Array {
-  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
-  const binary = atob(padded);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
-  return bytes;
-}
-
-function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
-  return bytes.buffer.slice(
-    bytes.byteOffset,
-    bytes.byteOffset + bytes.byteLength,
-  ) as ArrayBuffer;
-}
-
-function derToJose(signature: Uint8Array): Uint8Array {
-  if (signature.byteLength === 64) return signature;
-  const bytes = [...signature];
-  if (bytes[0] !== 0x30) return signature;
-  let offset = 2;
-  if (bytes[1] === 0x81) offset = 3;
-  if (bytes[offset] !== 0x02) return signature;
-  const rLength = bytes[offset + 1] ?? 0;
-  const r = bytes.slice(offset + 2, offset + 2 + rLength);
-  offset += 2 + rLength;
-  if (bytes[offset] !== 0x02) return signature;
-  const sLength = bytes[offset + 1] ?? 0;
-  const s = bytes.slice(offset + 2, offset + 2 + sLength);
-  return new Uint8Array([...normalizeInteger(r), ...normalizeInteger(s)]);
-}
-
-function normalizeInteger(value: number[]): number[] {
-  const trimmed = value[0] === 0 ? value.slice(1) : value;
-  return [...new Array(Math.max(0, 32 - trimmed.length)).fill(0), ...trimmed].slice(-32);
-}

package/src/app/handlers.ts

@@ -1,198 +0,0 @@
-import type { Context } from "hono";
-import type { RequestContext } from "../upstream-auth/types.ts";
-import {
-  handleAnthropicMessages,
-  handleChatCompletions,
-  handleGoogleGenAI,
-  handleResponses,
-  listConfiguredModels,
-  type RouterExecutionOptions,
-  type RouterRuntime,
-} from "../router/index.ts";
-
-type OpenAiModel = {
-  id: string;
-  object: "model";
-  created: number;
-  owned_by: string;
-};
-
-export type ChatCompletionsHandlerOptions = RouterExecutionOptions;
-
-export type ResponsesHandlerOptions = ChatCompletionsHandlerOptions;
-export type AnthropicMessagesHandlerOptions = ChatCompletionsHandlerOptions;
-export type GoogleGenAIHandlerOptions = ChatCompletionsHandlerOptions;
-
-export function listModelsHandler(runtime: RouterRuntime) {
-  return (c: Context) => {
-    const modelIds = listAvailableModels(runtime);
-    const models: OpenAiModel[] = modelIds.map((id) => ({
-      id,
-      object: "model",
-      created: 0,
-      owned_by: ownerFromModelId(id),
-    }));
-    return c.json({ object: "list", data: models });
-  };
-}
-
-function listAvailableModels(runtime: RouterRuntime): string[] {
-  return listConfiguredModels(runtime);
-}
-
-export function chatCompletionsHandler(
-  runtime: RouterRuntime,
-  options: ChatCompletionsHandlerOptions = {},
-) {
-  return async (c: Context) => {
-    const handlerOptions = createExecutionHandlerOptions(c, runtime, options);
-    return handleChatCompletions(handlerOptions);
-  };
-}
-
-export function responsesHandler(
-  runtime: RouterRuntime,
-  options: ResponsesHandlerOptions = {},
-) {
-  return async (c: Context) => {
-    const handlerOptions = createExecutionHandlerOptions(c, runtime, options);
-    return handleResponses(handlerOptions);
-  };
-}
-
-export function anthropicMessagesHandler(
-  runtime: RouterRuntime,
-  options: AnthropicMessagesHandlerOptions = {},
-) {
-  return async (c: Context) => {
-    const handlerOptions = createExecutionHandlerOptions(c, runtime, options);
-    return handleAnthropicMessages(handlerOptions);
-  };
-}
-
-export function googleGenAIHandler(
-  runtime: RouterRuntime,
-  options: GoogleGenAIHandlerOptions = {},
-) {
-  return async (c: Context) => {
-    const route = parseGoogleGenAIRoute(c.req.raw);
-    if (!route) {
-      return c.text("Not Found", 404);
-    }
-
-    const request = await rewriteGoogleGenAIRequest(c.req.raw, route);
-    const handlerOptions = createExecutionHandlerOptions(
-      c,
-      runtime,
-      options,
-      request,
-    ) as Parameters<typeof handleGoogleGenAI>[0];
-    if (route.stream) {
-      handlerOptions.forceStreaming = true;
-    }
-    return handleGoogleGenAI(handlerOptions);
-  };
-}
-
-function createExecutionHandlerOptions(
-  c: Context,
-  runtime: RouterRuntime,
-  options: ChatCompletionsHandlerOptions,
-  request = c.req.raw,
-) {
-  const ctx = createRequestContext(c, request);
-  collectIncomingAuth(ctx, runtime);
-  const handlerOptions = {
-    runtime,
-    ctx,
-  } as Parameters<typeof handleChatCompletions>[0];
-
-  if (options.executorImplementations) {
-    handlerOptions.executorImplementations = options.executorImplementations;
-  }
-  if (options.resolveExecutor) {
-    handlerOptions.resolveExecutor = options.resolveExecutor;
-  }
-  if (options.transforms) {
-    handlerOptions.transforms = options.transforms;
-  }
-  if (options.observe) {
-    handlerOptions.observe = options.observe;
-  }
-  if (options.requestIdFactory) {
-    handlerOptions.requestIdFactory = options.requestIdFactory;
-  }
-  if (options.executionIdFactory) {
-    handlerOptions.executionIdFactory = options.executionIdFactory;
-  }
-  if (options.upstreamTimeoutMs !== undefined) {
-    handlerOptions.upstreamTimeoutMs = options.upstreamTimeoutMs;
-  }
-  if (options.remoteMcpClientFactory) {
-    handlerOptions.remoteMcpClientFactory = options.remoteMcpClientFactory;
-  }
-
-  return handlerOptions;
-}
-
-function createRequestContext(c: Context, request = c.req.raw): RequestContext {
-  return {
-    request,
-    incomingAuth: new Map(),
-    env: (c.env ?? {}) as Record<string, unknown>,
-    state: new Map(),
-  };
-}
-
-function collectIncomingAuth(ctx: RequestContext, runtime: RouterRuntime): void {
-  for (const driver of runtime.upstreamAuthChain) {
-    driver.collectIncoming?.(ctx);
-  }
-}
-
-function ownerFromModelId(id: string): string {
-  const slash = id.indexOf("/");
-  if (slash <= 0) {
-    return "unknown";
-  }
-  return id.slice(0, slash);
-}
-
-function parseGoogleGenAIRoute(request: Request): { model: string; stream: boolean } | null {
-  const pathname = new URL(request.url).pathname;
-  const match = pathname.match(/^\/v1\/models\/(.+):(generateContent|streamGenerateContent)$/);
-  if (!match?.[1] || !match[2]) {
-    return null;
-  }
-
-  try {
-    return {
-      model: decodeURIComponent(match[1]),
-      stream: match[2] === "streamGenerateContent",
-    };
-  } catch {
-    return null;
-  }
-}
-
-async function rewriteGoogleGenAIRequest(
-  request: Request,
-  route: { model: string; stream: boolean },
-): Promise<Request> {
-  const bodyText = await request.text();
-  const headers = new Headers(request.headers);
-
-  try {
-    const raw = JSON.parse(bodyText) as Record<string, unknown>;
-    if (raw && typeof raw === "object" && !Array.isArray(raw)) {
-      const body = JSON.stringify({
-        ...raw,
-        model: route.model,
-        ...(route.stream ? { stream: true } : {}),
-      });
-      return new Request(request.url, { method: request.method, headers, body });
-    }
-  } catch {}
-
-  return new Request(request.url, { method: request.method, headers, body: bodyText });
-}