@pramen/server 0.0.14 → 0.0.16

package/src/worker.ts

@@ -4,7 +4,7 @@
 // endpoints (/tenants, /admin/recover, /admin/schema). createPramen() pairs the
 // returned fetch with the matching DO class; a consumer just re-exports both.
 
-import { authorizeTenant, HmacStrategy, isAdmin, JwksStrategy, resolveIdentity, type VerifyStrategy } from "./auth";
+import { authorizeTenant, HmacStrategy, isAdmin, JwksStrategy, resolveIdentity, type VerifyOptions, type VerifyStrategy } from "./auth";
 import { dispatch, tasksFacade, bindTasks } from "./runtime/dispatch";
 import { ensureOutbox, drainOutbox, listTasks } from "./runtime/outbox";
 import { createMail } from "./runtime/mail";
@@ -17,10 +17,10 @@ import { D1Driver, type D1SessionStart, type Driver } from "./runtime/driver";
 import { toResponse } from "./runtime/errors";
 import { Kv } from "./runtime/kv";
 import { listDOs, partitionDoName } from "./runtime/registry";
-import { createFiles, handleFileRequest, R2Adapter } from "./runtime/storage";
+import { createFiles, handleFileRequest, handleMediaRequest, R2Adapter } from "./runtime/storage";
 import type { Identity } from "./sdk/acl";
 import type { HandlerContext } from "./sdk/handlers";
-import { DEFAULT_PARTITION } from "./sdk/schema";
+import { DEFAULT_PARTITION, partitionsOf } from "./sdk/schema";
 import type { PramenApp } from "./pramen";
 
 export interface Env {
@@ -33,6 +33,16 @@ export interface Env {
   /** Optional: a JWKS endpoint. When set, tokens are verified as RS256 against the
    * fetched public keys (HmacStrategy/AUTH_SECRET is bypassed). */
   JWKS_URL?: string;
+  /** "true" to REJECT any bearer token with no numeric `exp` claim. Off by default
+   * (a token without exp is accepted) so existing issuers keep working; turn it on to
+   * refuse non-expiring tokens. Applies to both the HS256 and JWKS strategies. */
+  AUTH_REQUIRE_EXP?: string;
+  /** Optional required audience. When set, a token's `aud` (string or array) must
+   * contain this value or the token is rejected. Unset ⇒ `aud` is not checked. */
+  AUTH_AUDIENCE?: string;
+  /** Optional required issuer. When set, a token's `iss` must equal this exactly.
+   * Unset ⇒ `iss` is not checked. */
+  AUTH_ISSUER?: string;
   /** D1 binding. Enables the "Worker + D1 (no DO)" path — the same schema/ACL/read
    * engine over D1 instead of a Durable Object. Selected per-request via
    * `x-pramen-store: d1`. RPC only (live queries need the DO). */
@@ -52,6 +62,11 @@ export interface Env {
    * per-tenant Durable Object. The header still overrides per-request. /live always
    * needs the DO regardless of this setting. */
   PRAMEN_STORE?: string;
+  /** "true" to allow the shared D1 store to serve a non-`main` tenant. OFF by default:
+   * the D1 proof uses ONE database with no tenant column, so multiple tenants would
+   * commingle. Only set this if the app genuinely single-tenants that D1 (or has added
+   * its own tenant isolation). */
+  PRAMEN_D1_ALLOW_MULTITENANT?: string;
   /** Cloudflare Queues producer binding for ctx.queue (declared in oblaka.ts). Optional —
    * ctx.queue discovers any producer binding by name; this just types the common one. */
   JOBS?: QueueProducerBinding;
@@ -156,12 +171,20 @@ export function makeWorker(app: PramenApp) {
   // JwksStrategy caches fetched public keys, so keep one instance per isolate (keyed
   // by URL) rather than rebuilding it per request. HmacStrategy is stateless.
   let jwks: JwksStrategy | undefined;
+  // Opt-in claim validation from env — default OFF (unset) so existing tokens keep
+  // verifying. Threaded into whichever strategy the deployment uses.
+  const verifyOptsFor = (env: Env): VerifyOptions => ({
+    requireExp: env.AUTH_REQUIRE_EXP === "true",
+    audience: env.AUTH_AUDIENCE || undefined,
+    issuer: env.AUTH_ISSUER || undefined,
+  });
   const strategyFor = (env: Env): VerifyStrategy => {
+    const opts = verifyOptsFor(env);
     if (env.JWKS_URL) {
-      if (!jwks || jwks.url !== env.JWKS_URL) jwks = new JwksStrategy(env.JWKS_URL);
+      if (!jwks || jwks.url !== env.JWKS_URL) jwks = new JwksStrategy(env.JWKS_URL, undefined, opts);
       return jwks;
     }
-    return new HmacStrategy(env.AUTH_SECRET);
+    return new HmacStrategy(env.AUTH_SECRET, opts);
   };
 
   // ACL is compiled once per isolate; the Worker's D1 path reuses it (the DO compiles
@@ -223,6 +246,14 @@ export function makeWorker(app: PramenApp) {
       if (res) return res;
     }
 
+    // Public media serving: `GET /media/<tenant>/media/<key>` streams a CMS media blob
+    // from R2 (cache-friendly, no auth — published-site assets are public). Put Cloudflare
+    // Image Resizing (/cdn-cgi/image) in front for transforms. Restricted to media keys.
+    if (url.pathname.startsWith("/media/") && env.FILES) {
+      const res = await handleMediaRequest(request, { adapter: new R2Adapter(env.FILES) });
+      if (res) return res;
+    }
+
     // Public (pre-auth) routes — matched before identity resolution, so a
     // signature-authed webhook can live outside the JWT-gated /rpc surface.
     for (const r of app.routes ?? []) {
@@ -396,19 +427,30 @@ export function makeWorker(app: PramenApp) {
     const useD1 = useD1Store({ storeHeader, isLive, defaultStore: env.PRAMEN_STORE });
     if (useD1) {
       if (!env.DB) return badRequest("D1 store is not configured");
+      // COMMINGLING GUARD: this D1 path is ONE shared database with no tenant column, so
+      // every tenant's rows live together. Selecting it for a non-`main` tenant (a
+      // multi-tenant scenario) would leak/mix tenants — and `PRAMEN_STORE=d1` makes it a
+      // silent global default. Fail closed unless the operator explicitly opts in.
+      if (tenant !== "main" && env.PRAMEN_D1_ALLOW_MULTITENANT !== "true") {
+        return withCors(
+          forbidden(`D1 store for tenant '${tenant}' (shared D1 has no tenant isolation — set PRAMEN_D1_ALLOW_MULTITENANT=true to allow)`),
+          cors,
+        );
+      }
       // (isLive is excluded by useD1Store — live always routes to the DO below.)
       const name = url.pathname.replace(/^\/rpc\//, "");
       let input: unknown;
       if (request.method === "POST") input = await request.json().catch(() => undefined);
 
-      // Pick where the D1 session may start its first read. A client-supplied bookmark
-      // wins (read-your-writes); otherwise default by handler kind: a mutation pins the
-      // primary so its reads see current data, a query may begin at the nearest replica.
+      // Pick where the D1 session may start its first read. A mutation ALWAYS pins the
+      // primary (`first-primary` is a superset of read-your-writes) so a read-modify-write
+      // can't run off a lagging replica — an inbound bookmark must not widen that window.
+      // A query honors a client-supplied bookmark (read-your-writes), else the nearest replica.
       const inboundBookmark = req.headers.get(D1_BOOKMARK_HEADER);
       const kind = app.handlers[name]?.kind;
       let start: D1SessionStart;
-      if (inboundBookmark) start = inboundBookmark;
-      else if (kind === "mutation") start = "first-primary";
+      if (kind === "mutation") start = "first-primary";
+      else if (inboundBookmark) start = inboundBookmark;
       else start = "first-unconstrained";
 
       const driver = new D1Driver(env.DB, { start });
@@ -436,13 +478,22 @@ export function makeWorker(app: PramenApp) {
       const name = url.pathname.replace(/^\/rpc\//, "");
       partition = app.handlers[name]?.partition ?? DEFAULT_PARTITION;
     } else {
+      // /live's partition is client-supplied (?partition= / x-pramen-partition), so
+      // validate it against the schema's known partitions BEFORE routing — otherwise an
+      // anonymous caller could spin up unbounded junk DOs + permanent registry KV keys.
       partition = req.headers.get("x-pramen-partition") || DEFAULT_PARTITION;
+      if (!partitionsOf(app.schema).includes(partition)) {
+        return withCors(badRequest(`unknown partition '${partition}'`), cors);
+      }
     }
 
-    // Forward a trusted identity to the DO (the DO never re-derives it).
+    // Forward a trusted identity to the DO (the DO never re-derives it). Also set the
+    // tenant header so the DO learns its own name — without it, `main` (the default when
+    // the client omits x-pramen-tenant) never registers and re-runs its guard forever.
     const headers = new Headers(req.headers);
     if (identity) headers.set("x-pramen-identity", JSON.stringify(identity as Identity));
     else headers.delete("x-pramen-identity");
+    headers.set("x-pramen-tenant", tenant);
     headers.set("x-pramen-partition", partition);
 
     // Routed to the DO but no DO is bound — return a clear, actionable error instead of