@opengeni/api-router 0.5.7 → 0.9.0

package/src/codex-redemption-security.ts

@@ -0,0 +1,96 @@
+type CodexRedemptionConfirmationClaims = {
+  version: 1;
+  attemptId: string;
+  workspaceId: string;
+  credentialId: string;
+  creditId: string;
+  subjectId: string;
+  browserSessionHash: string;
+  expiresAt: number;
+};
+
+const encoder = new TextEncoder();
+
+function base64UrlEncode(bytes: Uint8Array): string {
+  return Buffer.from(bytes).toString("base64url");
+}
+
+function base64UrlDecode(value: string): Uint8Array | null {
+  try {
+    return new Uint8Array(Buffer.from(value, "base64url"));
+  } catch {
+    return null;
+  }
+}
+
+async function hmac(secret: string, payload: string): Promise<Uint8Array> {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  return new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(payload)));
+}
+
+function constantTimeEqual(left: Uint8Array, right: Uint8Array): boolean {
+  if (left.length !== right.length) return false;
+  let diff = 0;
+  for (let index = 0; index < left.length; index += 1) {
+    diff |= left[index]! ^ right[index]!;
+  }
+  return diff === 0;
+}
+
+export async function hashCodexBrowserSession(sessionId: string): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", encoder.encode(sessionId));
+  return base64UrlEncode(new Uint8Array(digest));
+}
+
+/** Five-minute, session-bound, HMAC-confirmed browser mutation token. */
+export async function signCodexRedemptionConfirmation(
+  secret: string,
+  claims: CodexRedemptionConfirmationClaims,
+): Promise<string> {
+  const payload = base64UrlEncode(encoder.encode(JSON.stringify(claims)));
+  return `${payload}.${base64UrlEncode(await hmac(secret, payload))}`;
+}
+
+export async function verifyCodexRedemptionConfirmation(
+  secret: string,
+  token: string,
+  now = Date.now(),
+): Promise<CodexRedemptionConfirmationClaims | null> {
+  const [payload, signature, extra] = token.split(".");
+  if (!payload || !signature || extra !== undefined) return null;
+  const supplied = base64UrlDecode(signature);
+  const encodedClaims = base64UrlDecode(payload);
+  if (!supplied || !encodedClaims) return null;
+  if (!constantTimeEqual(supplied, await hmac(secret, payload))) return null;
+  let claims: unknown;
+  try {
+    claims = JSON.parse(new TextDecoder().decode(encodedClaims));
+  } catch {
+    return null;
+  }
+  if (!claims || typeof claims !== "object") return null;
+  const value = claims as Record<string, unknown>;
+  if (
+    value.version !== 1 ||
+    typeof value.attemptId !== "string" ||
+    typeof value.workspaceId !== "string" ||
+    typeof value.credentialId !== "string" ||
+    typeof value.creditId !== "string" ||
+    typeof value.subjectId !== "string" ||
+    typeof value.browserSessionHash !== "string" ||
+    typeof value.expiresAt !== "number" ||
+    !Number.isFinite(value.expiresAt) ||
+    value.expiresAt * 1000 <= now
+  ) {
+    return null;
+  }
+  return value as CodexRedemptionConfirmationClaims;
+}
+
+export type { CodexRedemptionConfirmationClaims };

package/src/github-access.ts

@@ -0,0 +1,46 @@
+import type { GitHubInstallationBinding, GitHubRepository } from "@opengeni/contracts";
+import { listGitHubInstallationAccessForWorkspace } from "@opengeni/db";
+import { listGitHubAppRepositories } from "@opengeni/github";
+import type { ApiRouteDeps } from "@opengeni/core";
+
+export async function listWorkspaceGitHubInstallationBindings(
+  deps: ApiRouteDeps,
+  workspaceId: string,
+): Promise<GitHubInstallationBinding[]> {
+  const installations = await listGitHubInstallationAccessForWorkspace(deps.db, workspaceId);
+  return installations.map((installation) => ({
+    installationId: installation.installationId,
+    accountLogin: installation.accountLogin,
+    accountType: installation.accountType,
+    repositoryScope: installation.repositoryScope,
+    repositoryCount: installation.repositoryIds.length,
+    createdAt: installation.createdAt,
+    updatedAt: installation.updatedAt,
+  }));
+}
+
+export async function listWorkspaceGitHubRepositories(
+  deps: ApiRouteDeps,
+  workspaceId: string,
+): Promise<GitHubRepository[]> {
+  const access = await listGitHubInstallationAccessForWorkspace(deps.db, workspaceId);
+  if (access.length === 0) {
+    return [];
+  }
+  const installationIds = access.map((installation) => installation.installationId);
+  const repositories = deps.githubAppApi?.listRepositories
+    ? await deps.githubAppApi.listRepositories({ installationIds })
+    : await listGitHubAppRepositories(deps.settings, { installationIds });
+  const accessByInstallation = new Map(
+    access.map((installation) => [installation.installationId, installation]),
+  );
+  return repositories.filter((repository) => {
+    const installation = accessByInstallation.get(repository.installationId);
+    if (!installation) {
+      return false;
+    }
+    return (
+      installation.repositoryScope === "all" || installation.repositoryIds.includes(repository.id)
+    );
+  });
+}

package/src/github-browser-flow.ts

@@ -0,0 +1,83 @@
+import type { Settings } from "@opengeni/config";
+import type { AccessGrant } from "@opengeni/contracts";
+import { hasPermission } from "@opengeni/core";
+import type { GitHubSignedStatePayload } from "@opengeni/github";
+
+/**
+ * Dormant compatibility helpers for tests and decoding already-issued browser
+ * handoffs. No production route imports this module. Its signed claims preserve
+ * a prior OpenGeni grant across a redirect; they do not prove that GitHub
+ * authorizes the human to install, configure, or bind an App installation.
+ */
+export const githubBrowserGrantMaxAgeSeconds = 10 * 60;
+
+export function githubBrowserGrantClaims(
+  settings: Pick<Settings, "productAccessMode">,
+  grant: AccessGrant,
+  nowSeconds = Math.floor(Date.now() / 1000),
+): Record<string, unknown> {
+  if (
+    settings.productAccessMode !== "configured" ||
+    !hasPermission(grant.permissions, "github:manage")
+  ) {
+    return {};
+  }
+  return {
+    browserGrantSubjectId: grant.subjectId,
+    browserGrantExpiresAt: nowSeconds + githubBrowserGrantMaxAgeSeconds,
+  };
+}
+
+export function continuedGitHubBrowserGrantClaims(
+  payload: GitHubSignedStatePayload,
+): Record<string, unknown> {
+  return typeof payload.browserGrantSubjectId === "string" &&
+    typeof payload.browserGrantExpiresAt === "number"
+    ? {
+        browserGrantSubjectId: payload.browserGrantSubjectId,
+        browserGrantExpiresAt: payload.browserGrantExpiresAt,
+      }
+    : {};
+}
+
+export function githubBrowserGrantFromState(
+  settings: Pick<Settings, "productAccessMode">,
+  payload: GitHubSignedStatePayload,
+  workspaceId: string,
+  nowSeconds = Math.floor(Date.now() / 1000),
+): AccessGrant | null {
+  const subjectId = payload.browserGrantSubjectId;
+  const expiresAt = payload.browserGrantExpiresAt;
+  if (
+    settings.productAccessMode !== "configured" ||
+    typeof payload.accountId !== "string" ||
+    payload.workspaceId !== workspaceId ||
+    typeof subjectId !== "string" ||
+    subjectId.length === 0 ||
+    typeof expiresAt !== "number" ||
+    !Number.isInteger(expiresAt) ||
+    expiresAt < nowSeconds ||
+    expiresAt > payload.iat + githubBrowserGrantMaxAgeSeconds
+  ) {
+    return null;
+  }
+  return {
+    accountId: payload.accountId,
+    workspaceId,
+    subjectId,
+    permissions: ["github:manage"],
+    metadata: { githubBrowserHandoff: true, expiresAt },
+  };
+}
+
+export function githubBrowserBaseUrl(
+  settings: Pick<Settings, "githubAppManifestBaseUrl" | "publicBaseUrl">,
+  requestOrigin?: string | null,
+): string {
+  return (
+    settings.githubAppManifestBaseUrl ??
+    settings.publicBaseUrl ??
+    requestOrigin ??
+    ""
+  ).replace(/\/+$/, "");
+}

package/src/http/auth.ts

@@ -3,6 +3,7 @@ import type { Context, MiddlewareHandler } from "hono";
 import { installExactPaths, isInstallRedirectPath } from "../routes/install";
 
 const githubConnectPathPattern = /^\/v1\/workspaces\/[^/]+\/github\/connect$/;
+const githubInstallationLinkPathPattern = /^\/v1\/workspaces\/[^/]+\/github\/installations$/;
 
 export function requireAccessKey(settings: Settings): MiddlewareHandler {
   return async (c, next) => {
@@ -58,15 +59,22 @@ function isAuthExempt(c: Context, settings: Settings): boolean {
   if (path.startsWith("/v1/catalog-assets/")) {
     return true;
   }
-  // Browser entry for MCP-issued GitHub install links: opened in a browser
-  // that holds no API credentials, like the callbacks above. The route itself
-  // verifies the signed workspace-bound state before doing anything.
+  // Compatibility entry for already-issued GitHub install/link URLs. It stays
+  // public like the callbacks above, verifies signed workspace-bound state,
+  // and then terminates with 410 while new installation binding is disabled.
   if (githubConnectPathPattern.test(path)) {
     return true;
   }
+  // Compatibility endpoint for stale chooser submissions. It remains public
+  // only so already-rendered forms can authenticate their signed account and
+  // workspace state locally before terminating with 410; it does not parse a
+  // ticket, resolve browser authority, or write an installation binding.
+  if (c.req.method === "POST" && githubInstallationLinkPathPattern.test(path)) {
+    return true;
+  }
   // The get.<domain> install-serving routes (install.sh/.ps1/uninstall.sh/
   // minisign pub + the release-binary redirects). Reached by a fresh machine
-  // with no credentials; the bodies carry no secrets (dossier §23.1).
+  // with no credentials; the bodies carry no secrets.
   if (installExactPaths.has(path) || isInstallRedirectPath(path)) {
     return true;
   }