@segmentstream/ontology 0.0.0-stage → 0.92.1

package/dist/service/runtime-identity.js

@@ -0,0 +1,122 @@
+import { Effect, Redacted } from "effect";
+import { createRemoteJWKSet, decodeJwt, errors, jwtVerify } from "jose";
+/**
+ * The header in which a runtime caller names the member it acts for: the member's user id. The
+ * service honours it only with a verified runtime token, so nobody else can claim a member with it.
+ */
+export const ACT_AS_HEADER = "x-segmentstream-act-as";
+/**
+ * The header in which the app's agent, running a task a workflow handed it, presents the task's
+ * secret instead of naming a member. With a verified runtime token it authenticates as the task's
+ * workflow user, on `/mcp` and the task routes only; every other route refuses it.
+ */
+export const AGENT_TASK_HEADER = "x-segmentstream-agent-task";
+const CLOCK_TOLERANCE_SECONDS = 5;
+const JWKS_TIMEOUT_MS = 5_000;
+/** The environment that a Vercel function token must name: channels run only in production. */
+const PRODUCTION = "production";
+/** The issuer without a trailing slash, as Vercel writes it in `iss` and as its JWKS URL starts. */
+function normalizedIssuer(issuer) {
+    let end = issuer.length;
+    while (end > 0 && issuer[end - 1] === "/") {
+        end -= 1;
+    }
+    return issuer.slice(0, end);
+}
+/** The issuer's key set, at `<issuer>/.well-known/jwks` as Vercel publishes it. */
+export function runtimeKeySet(issuer) {
+    return createRemoteJWKSet(new URL(`${normalizedIssuer(issuer)}/.well-known/jwks`), {
+        timeoutDuration: JWKS_TIMEOUT_MS,
+    });
+}
+/** The key set could not be read: not the token's fault. Every other jose error is about the token. */
+function keySetUnavailable(error) {
+    if (!(error instanceof errors.JOSEError)) {
+        return true;
+    }
+    return (error instanceof errors.JWKSTimeout ||
+        error instanceof errors.JWKSInvalid ||
+        error.code === errors.JOSEError.code);
+}
+/** What about a token failed, for the operator's log: a jose code or a claim name, never a value. */
+function failureReason(error) {
+    if (error instanceof errors.JWTClaimValidationFailed || error instanceof errors.JWTExpired) {
+        return `claim:${error.claim}`;
+    }
+    return error instanceof errors.JOSEError ? error.code : "invalid";
+}
+function claimedIssuer(token) {
+    try {
+        const { iss } = decodeJwt(token);
+        return typeof iss === "string" ? iss : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Verifies the Vercel OIDC token of a function of this deployment's project, as backend-next
+ * verifies the ontology service's own: RS256 from the team's issuer, for the team's audience,
+ * unexpired, with `project_id` equal to the configured project and `environment` `production`.
+ * The issuer and the audience name the team, so no further owner check is needed. A token that
+ * claims another issuer is `other`, without a key-set fetch.
+ */
+export function makeRuntimeTokenVerifier(config, keySet) {
+    const issuer = normalizedIssuer(config.issuer);
+    return async function verifyRuntimeToken(token) {
+        if (claimedIssuer(token) !== issuer) {
+            return { status: "other" };
+        }
+        try {
+            const { payload } = await jwtVerify(token, keySet, {
+                algorithms: ["RS256"],
+                issuer,
+                audience: config.audience,
+                clockTolerance: CLOCK_TOLERANCE_SECONDS,
+                requiredClaims: ["exp", "iat", "iss", "aud", "project_id", "environment"],
+            });
+            if (payload.project_id !== config.projectId) {
+                return { status: "invalid", reason: "claim:project_id" };
+            }
+            if (payload.environment !== PRODUCTION) {
+                return { status: "invalid", reason: "claim:environment" };
+            }
+            return { status: "valid" };
+        }
+        catch (error) {
+            return keySetUnavailable(error)
+                ? { status: "unavailable" }
+                : { status: "invalid", reason: failureReason(error) };
+        }
+    };
+}
+/** The runtime verifier on the issuer's remote key set, which jose caches between requests. */
+export function runtimeTokenVerifier(config) {
+    return makeRuntimeTokenVerifier(config, runtimeKeySet(config.issuer));
+}
+/** A runtime token that failed verification: the reason is logged, the token never. */
+export function logRuntimeRejection(reason) {
+    return Effect.logWarning("ontology.runtime_identity.rejected").pipe(Effect.annotateLogs({ reason }));
+}
+/** How a request may authenticate as the runtime: the verifier and the member it names, if any. */
+export const ACT_AS_PROVIDER_HEADER = "x-segmentstream-identity-provider";
+/** The task secret a request presents; `undefined` without the header. */
+export function agentTaskSecret(request) {
+    const secret = request.headers[AGENT_TASK_HEADER]?.trim();
+    return secret === undefined || secret === "" ? undefined : Redacted.make(secret);
+}
+/** The request's runtime credential, or `undefined` while runtime authentication is disabled. */
+export function runtimeCredential(verify, request) {
+    if (verify === undefined) {
+        return undefined;
+    }
+    const actAs = request.headers[ACT_AS_HEADER]?.trim();
+    const provider = request.headers[ACT_AS_PROVIDER_HEADER]?.trim();
+    const agentTask = agentTaskSecret(request);
+    return {
+        verify,
+        actAs: actAs === undefined || actAs === "" ? undefined : actAs,
+        ...(provider ? { provider } : {}),
+        ...(agentTask === undefined ? {} : { agentTask }),
+    };
+}