@positronic/cloudflare 0.0.58 → 0.0.59

package/dist/src/api/auth-middleware.js

@@ -1,11 +1,3 @@
-function _array_like_to_array(arr, len) {
-    if (len == null || len > arr.length) len = arr.length;
-    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
-    return arr2;
-}
-function _array_with_holes(arr) {
-    if (Array.isArray(arr)) return arr;
-}
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
@@ -42,44 +34,6 @@ function _instanceof(left, right) {
         return left instanceof right;
     }
 }
-function _iterable_to_array_limit(arr, i) {
-    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
-    if (_i == null) return;
-    var _arr = [];
-    var _n = true;
-    var _d = false;
-    var _s, _e;
-    try {
-        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
-            _arr.push(_s.value);
-            if (i && _arr.length === i) break;
-        }
-    } catch (err) {
-        _d = true;
-        _e = err;
-    } finally{
-        try {
-            if (!_n && _i["return"] != null) _i["return"]();
-        } finally{
-            if (_d) throw _e;
-        }
-    }
-    return _arr;
-}
-function _non_iterable_rest() {
-    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
-}
-function _sliced_to_array(arr, i) {
-    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array(arr, i) || _non_iterable_rest();
-}
-function _unsupported_iterable_to_array(o, minLen) {
-    if (!o) return;
-    if (typeof o === "string") return _array_like_to_array(o, minLen);
-    var n = Object.prototype.toString.call(o).slice(8, -1);
-    if (n === "Object" && o.constructor) n = o.constructor.name;
-    if (n === "Map" || n === "Set") return Array.from(n);
-    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
-}
 function _ts_generator(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -171,114 +125,34 @@ function _ts_generator(thisArg, body) {
         };
     }
 }
-import { parseRequestSignature } from '@misskey-dev/node-http-message-signatures';
+import { jwtVerify, decodeJwt, importJWK } from 'jose';
 /**
- * Get the algorithm parameters for SubtleCrypto based on JWK key type
+ * Get the JWT algorithm based on JWK key type
  */ function getAlgorithmForJwk(jwk) {
     if (jwk.kty === 'RSA') {
-        return {
-            name: 'RSASSA-PKCS1-v1_5',
-            hash: 'SHA-256'
-        };
+        return 'RS256';
     } else if (jwk.kty === 'EC') {
-        return {
-            name: 'ECDSA',
-            namedCurve: jwk.crv || 'P-256'
-        };
-    } else if (jwk.kty === 'OKP' && jwk.crv === 'Ed25519') {
-        return {
-            name: 'Ed25519'
-        };
-    }
-    throw new Error("Unsupported key type: ".concat(jwk.kty));
-}
-/**
- * Get the algorithm parameters for signature verification
- */ function getVerifyAlgorithm(jwk) {
-    if (jwk.kty === 'RSA') {
-        return {
-            name: 'RSASSA-PKCS1-v1_5',
-            hash: 'SHA-256'
-        };
-    } else if (jwk.kty === 'EC') {
-        return {
-            name: 'ECDSA',
-            hash: 'SHA-256'
-        };
+        if (jwk.crv === 'P-256') {
+            return 'ES256';
+        } else if (jwk.crv === 'P-384') {
+            return 'ES384';
+        } else if (jwk.crv === 'P-521') {
+            return 'ES512';
+        }
+        // Default to ES256 for unknown curves
+        return 'ES256';
     } else if (jwk.kty === 'OKP' && jwk.crv === 'Ed25519') {
-        return {
-            name: 'Ed25519'
-        };
+        return 'EdDSA';
     }
     throw new Error("Unsupported key type: ".concat(jwk.kty));
 }
-/**
- * Convert a JWK to a CryptoKey for signature verification
- */ function jwkToCryptoKey(jwkString) {
-    return _async_to_generator(function() {
-        var jwk, algorithm;
-        return _ts_generator(this, function(_state) {
-            jwk = JSON.parse(jwkString);
-            algorithm = getAlgorithmForJwk(jwk);
-            return [
-                2,
-                crypto.subtle.importKey('jwk', jwk, algorithm, true, [
-                    'verify'
-                ])
-            ];
-        });
-    })();
-}
-/**
- * Verify a signature using Web Crypto API
- */ function verifySignatureWithKey(signatureBase, signatureB64, cryptoKey, jwk) {
-    return _async_to_generator(function() {
-        var encoder, data, signatureBytes, algorithm;
-        return _ts_generator(this, function(_state) {
-            encoder = new TextEncoder();
-            data = encoder.encode(signatureBase);
-            signatureBytes = Uint8Array.from(atob(signatureB64), function(c) {
-                return c.charCodeAt(0);
-            });
-            algorithm = getVerifyAlgorithm(jwk);
-            return [
-                2,
-                crypto.subtle.verify(algorithm, cryptoKey, signatureBytes, data)
-            ];
-        });
-    })();
-}
-/**
- * Extract keyId and signature info from parsed signature
- * Handles both draft and RFC9421 formats
- */ function extractSignatureInfo(parsed) {
-    if (parsed.version === 'draft') {
-        return {
-            keyId: parsed.value.keyId,
-            signature: parsed.value.params.signature,
-            base: parsed.value.signingString
-        };
-    } else if (parsed.version === 'rfc9421') {
-        // RFC9421 returns an array of [label, value] tuples
-        var signatures = parsed.value;
-        if (signatures.length === 0) return null;
-        // Use the first signature (usually 'sig1')
-        var _signatures_ = _sliced_to_array(signatures[0], 2), sigValue = _signatures_[1];
-        return {
-            keyId: sigValue.keyid,
-            signature: sigValue.signature,
-            base: sigValue.base
-        };
-    }
-    return null;
-}
 /**
  * Authentication middleware for the Positronic API
- * Verifies HTTP message signatures (RFC 9421) using @misskey-dev/node-http-message-signatures for parsing
+ * Verifies JWT Bearer tokens
  */ export function authMiddleware() {
     return function(c, next) {
         return _async_to_generator(function() {
-            var signatureHeader, signatureInputHeader, parsedSignature, requestForParsing, errorMessage, sigInfo, keyId, signature, base, authDoId, authDo, userKey, jwk, cryptoKey, isValid, error, errorMessage1, jwk1, cryptoKey1, isValid1, error1, errorMessage2;
+            var authHeader, token, fingerprint, decoded, userKey, authDoId, authDo, jwk, algorithm, publicKey, error, errorMessage, jwk1, algorithm1, publicKey1, error1, errorMessage1;
             return _ts_generator(this, function(_state) {
                 switch(_state.label){
                     case 0:
@@ -293,11 +167,10 @@ import { parseRequestSignature } from '@misskey-dev/node-http-message-signatures
                                 next()
                             ];
                         }
-                        // Get signature headers
-                        signatureHeader = c.req.header('Signature');
-                        signatureInputHeader = c.req.header('Signature-Input');
-                        // If no signature headers, return 401
-                        if (!signatureHeader || !signatureInputHeader) {
+                        // Get Authorization header
+                        authHeader = c.req.header('Authorization');
+                        // If no Authorization header, return 401
+                        if (!authHeader) {
                             return [
                                 2,
                                 c.json({
@@ -305,84 +178,82 @@ import { parseRequestSignature } from '@misskey-dev/node-http-message-signatures
                                 }, 401)
                             ];
                         }
-                        try {
-                            // Build a request-like object for the library
-                            requestForParsing = {
-                                method: c.req.method,
-                                url: c.req.url,
-                                headers: Object.fromEntries(c.req.raw.headers.entries())
-                            };
-                            parsedSignature = parseRequestSignature(requestForParsing, {
-                                clockSkew: {
-                                    now: new Date(),
-                                    forward: 300000,
-                                    delay: 300000
-                                }
-                            });
-                        } catch (error) {
-                            // Log error type only - avoid logging request details that could contain sensitive data
-                            errorMessage = _instanceof(error, Error) ? error.message : 'Unknown error';
-                            console.error('Failed to parse signature:', errorMessage);
+                        // Check for Bearer token format
+                        if (!authHeader.startsWith('Bearer ')) {
                             return [
                                 2,
                                 c.json({
-                                    error: 'Invalid signature format'
+                                    error: 'Authentication required'
                                 }, 401)
                             ];
                         }
-                        // Extract signature info from parsed result
-                        sigInfo = extractSignatureInfo(parsedSignature);
-                        if (!sigInfo) {
+                        token = authHeader.slice(7); // Remove 'Bearer ' prefix
+                        try {
+                            decoded = decodeJwt(token);
+                            if (!decoded.sub) {
+                                return [
+                                    2,
+                                    c.json({
+                                        error: 'Invalid or expired token'
+                                    }, 401)
+                                ];
+                            }
+                            fingerprint = decoded.sub;
+                        } catch (e) {
                             return [
                                 2,
                                 c.json({
-                                    error: 'No valid signature found'
+                                    error: 'Invalid or expired token'
                                 }, 401)
                             ];
                         }
-                        keyId = sigInfo.keyId, signature = sigInfo.signature, base = sigInfo.base;
                         // Try to find the key in the auth database
+                        userKey = null;
+                        if (!c.env.AUTH_DO) return [
+                            3,
+                            2
+                        ];
                         authDoId = c.env.AUTH_DO.idFromName('auth');
                         authDo = c.env.AUTH_DO.get(authDoId);
                         return [
                             4,
-                            authDo.getKeyByFingerprint(keyId)
+                            authDo.getKeyByFingerprint(fingerprint)
                         ];
                     case 1:
                         userKey = _state.sent();
+                        _state.label = 2;
+                    case 2:
                         if (!userKey) return [
                             3,
-                            6
+                            7
                         ];
-                        _state.label = 2;
-                    case 2:
+                        _state.label = 3;
+                    case 3:
                         _state.trys.push([
-                            2,
-                            5,
+                            3,
+                            6,
                             ,
-                            6
+                            7
                         ]);
                         jwk = JSON.parse(userKey.jwk);
+                        algorithm = getAlgorithmForJwk(jwk);
                         return [
                             4,
-                            jwkToCryptoKey(userKey.jwk)
+                            importJWK(jwk, algorithm)
                         ];
-                    case 3:
-                        cryptoKey = _state.sent();
+                    case 4:
+                        publicKey = _state.sent();
+                        // Verify the JWT - this checks both signature and expiry
                         return [
                             4,
-                            verifySignatureWithKey(base, signature, cryptoKey, jwk)
+                            jwtVerify(token, publicKey, {
+                                algorithms: [
+                                    algorithm
+                                ]
+                            })
                         ];
-                    case 4:
-                        isValid = _state.sent();
-                        if (!isValid) {
-                            return [
-                                2,
-                                c.json({
-                                    error: 'Invalid signature'
-                                }, 401)
-                            ];
-                        }
+                    case 5:
+                        _state.sent();
                         c.set('auth', {
                             userId: userKey.userId,
                             isRoot: false
@@ -391,67 +262,67 @@ import { parseRequestSignature } from '@misskey-dev/node-http-message-signatures
                             2,
                             next()
                         ];
-                    case 5:
+                    case 6:
                         error = _state.sent();
-                        // Log error type only - avoid logging key material or signature data
-                        errorMessage1 = _instanceof(error, Error) ? error.message : 'Unknown error';
-                        console.error('Signature verification failed:', errorMessage1);
+                        // Log error type only - avoid logging key material or token data
+                        errorMessage = _instanceof(error, Error) ? error.message : 'Unknown error';
+                        console.error('JWT verification failed:', errorMessage);
                         return [
                             2,
                             c.json({
-                                error: 'Signature verification failed'
+                                error: 'Invalid or expired token'
                             }, 401)
                         ];
-                    case 6:
+                    case 7:
                         if (!c.env.ROOT_PUBLIC_KEY) return [
                             3,
-                            11
+                            12
                         ];
-                        _state.label = 7;
-                    case 7:
+                        _state.label = 8;
+                    case 8:
                         _state.trys.push([
-                            7,
-                            10,
+                            8,
+                            11,
                             ,
-                            11
+                            12
                         ]);
                         jwk1 = JSON.parse(c.env.ROOT_PUBLIC_KEY);
+                        algorithm1 = getAlgorithmForJwk(jwk1);
                         return [
                             4,
-                            jwkToCryptoKey(c.env.ROOT_PUBLIC_KEY)
+                            importJWK(jwk1, algorithm1)
                         ];
-                    case 8:
-                        cryptoKey1 = _state.sent();
+                    case 9:
+                        publicKey1 = _state.sent();
+                        // Verify the JWT - this checks both signature and expiry
                         return [
                             4,
-                            verifySignatureWithKey(base, signature, cryptoKey1, jwk1)
+                            jwtVerify(token, publicKey1, {
+                                algorithms: [
+                                    algorithm1
+                                ]
+                            })
                         ];
-                    case 9:
-                        isValid1 = _state.sent();
-                        if (isValid1) {
-                            c.set('auth', {
-                                userId: null,
-                                isRoot: true
-                            });
-                            return [
-                                2,
-                                next()
-                            ];
-                        }
+                    case 10:
+                        _state.sent();
+                        c.set('auth', {
+                            userId: null,
+                            isRoot: true
+                        });
                         return [
-                            3,
-                            11
+                            2,
+                            next()
                         ];
-                    case 10:
+                    case 11:
                         error1 = _state.sent();
                         // Log error type only - avoid logging key material
-                        errorMessage2 = _instanceof(error1, Error) ? error1.message : 'Unknown error';
-                        console.error('Root key verification failed:', errorMessage2);
+                        errorMessage1 = _instanceof(error1, Error) ? error1.message : 'Unknown error';
+                        console.error('Root key JWT verification failed:', errorMessage1);
                         return [
                             3,
-                            11
+                            12
                         ];
-                    case 11:
+                    case 12:
                         // No matching key found
                         // Check if ROOT_PUBLIC_KEY is configured - if not, return specific error
                         if (!c.env.ROOT_PUBLIC_KEY) {
@@ -465,7 +336,7 @@ import { parseRequestSignature } from '@misskey-dev/node-http-message-signatures
                         return [
                             2,
                             c.json({
-                                error: 'Unknown key'
+                                error: 'Invalid or expired token'
                             }, 401)
                         ];
                 }

package/dist/types/api/auth-middleware.d.ts

@@ -11,7 +11,7 @@ declare module 'hono' {
 }
 /**
  * Authentication middleware for the Positronic API
- * Verifies HTTP message signatures (RFC 9421) using @misskey-dev/node-http-message-signatures for parsing
+ * Verifies JWT Bearer tokens
  */
 export declare function authMiddleware(): MiddlewareHandler<{
     Bindings: Bindings;

package/dist/types/api/auth-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../../src/api/auth-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAO3C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CACjB;AAGD,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,IAAI,EAAE,WAAW,CAAC;KACnB;CACF;AAsGD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,iBAAiB,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CAoG1E"}
+{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../../src/api/auth-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CACjB;AAGD,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,IAAI,EAAE,WAAW,CAAC;KACnB;CACF;AAwBD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,iBAAiB,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CA4F1E"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@positronic/cloudflare",
-  "version": "0.0.58",
+  "version": "0.0.59",
   "publishConfig": {
     "access": "public"
   },
@@ -31,16 +31,16 @@
     "clean": "rm -rf tsconfig.tsbuildinfo dist"
   },
   "dependencies": {
-    "@misskey-dev/node-http-message-signatures": "^0.0.10",
-    "@positronic/core": "^0.0.58",
-    "@positronic/spec": "^0.0.58",
-    "@positronic/template-new-project": "^0.0.58",
+    "@positronic/core": "^0.0.59",
+    "@positronic/spec": "^0.0.59",
+    "@positronic/template-new-project": "^0.0.59",
     "aws4fetch": "^1.0.18",
     "caz": "^2.0.0",
     "cron-schedule": "^5.0.4",
     "dotenv": "^16.0.3",
     "fuse.js": "^7.1.0",
     "hono": "^4.2.3",
+    "jose": "^5.2.0",
     "uuid": "^9.0.1"
   },
   "devDependencies": {