@synoikia/core 0.9.0 → 0.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/approvals/links.d.ts +1 -1
- package/dist/approvals/links.js +1 -1
- package/dist/approvals/links.js.map +1 -1
- package/dist/approvals/service.d.ts +6 -3
- package/dist/approvals/service.js +1 -4
- package/dist/approvals/service.js.map +1 -1
- package/dist/audit-query.d.ts +1 -0
- package/dist/audit-query.js +17 -11
- package/dist/audit-query.js.map +1 -1
- package/dist/auth/external-cloudflare.d.ts +11 -0
- package/dist/auth/external-cloudflare.js +76 -0
- package/dist/auth/external-cloudflare.js.map +1 -0
- package/dist/auth/external.d.ts +24 -0
- package/dist/auth/external.js +12 -0
- package/dist/auth/external.js.map +1 -0
- package/dist/auth/mcp-auth.d.ts +5 -19
- package/dist/auth/mcp-auth.js +60 -119
- package/dist/auth/mcp-auth.js.map +1 -1
- package/dist/auth/oauth.d.ts +1 -1
- package/dist/auth/oidc.d.ts +1 -1
- package/dist/auth/oidc.js +16 -2
- package/dist/auth/oidc.js.map +1 -1
- package/dist/auth/sessions.d.ts +0 -6
- package/dist/auth/sessions.js +0 -15
- package/dist/auth/sessions.js.map +1 -1
- package/dist/catalog/rules.d.ts +18 -18
- package/dist/config/env.d.ts +1 -1
- package/dist/db/schema.d.ts +8 -8
- package/dist/db/schema.js +2 -2
- package/dist/db/schema.js.map +1 -1
- package/dist/gate/pipeline.js +2 -0
- package/dist/gate/pipeline.js.map +1 -1
- package/dist/http/admin/auth.js +6 -6
- package/dist/http/admin/auth.js.map +1 -1
- package/dist/http/admin/instances.js +11 -7
- package/dist/http/admin/instances.js.map +1 -1
- package/dist/http/admin/system.js +3 -3
- package/dist/http/admin/system.js.map +1 -1
- package/dist/http/mcp/approval-routes.d.ts +2 -2
- package/dist/http/mcp/approval-routes.js +54 -46
- package/dist/http/mcp/approval-routes.js.map +1 -1
- package/dist/http/mcp/endpoint.js +5 -2
- package/dist/http/mcp/endpoint.js.map +1 -1
- package/dist/http/mcp/oauth-routes.d.ts +4 -2
- package/dist/http/mcp/oauth-routes.js +15 -7
- package/dist/http/mcp/oauth-routes.js.map +1 -1
- package/dist/http/mcp/pages.d.ts +2 -2
- package/dist/http/mcp/pages.js +4 -13
- package/dist/http/mcp/pages.js.map +1 -1
- package/dist/instances/manager.d.ts +16 -11
- package/dist/instances/manager.js +27 -11
- package/dist/instances/manager.js.map +1 -1
- package/dist/maintenance.js +1 -1
- package/dist/maintenance.js.map +1 -1
- package/dist/notify/service.d.ts +2 -2
- package/dist/settings.d.ts +10 -7
- package/dist/settings.js +59 -11
- package/dist/settings.js.map +1 -1
- package/drizzle/0016_client_auth_methods.sql +55 -0
- package/drizzle/meta/0016_snapshot.json +2848 -0
- package/drizzle/meta/_journal.json +7 -0
- package/package.json +1 -1
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import type { Db } from '../db/index.js';
|
|
2
2
|
/** Approval page tokens (design §5.3): single-use, hashed, expiring with their approval. A token only
|
|
3
|
-
* opens the page; deciding needs a
|
|
3
|
+
* opens the page; deciding needs the call's owner and a CSRF-protected POST. */
|
|
4
4
|
export declare class ApprovalLinkService {
|
|
5
5
|
private readonly db;
|
|
6
6
|
private readonly now;
|
package/dist/approvals/links.js
CHANGED
|
@@ -2,7 +2,7 @@ import { and, eq, gt, isNull, lt } from 'drizzle-orm';
|
|
|
2
2
|
import { approvalLinks } from '../db/schema.js';
|
|
3
3
|
import { randomToken, sha256 } from '../auth/tokens.js';
|
|
4
4
|
/** Approval page tokens (design §5.3): single-use, hashed, expiring with their approval. A token only
|
|
5
|
-
* opens the page; deciding needs a
|
|
5
|
+
* opens the page; deciding needs the call's owner and a CSRF-protected POST. */
|
|
6
6
|
export class ApprovalLinkService {
|
|
7
7
|
db;
|
|
8
8
|
now;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"links.js","sourceRoot":"","sources":["../../src/approvals/links.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAExD;
|
|
1
|
+
{"version":3,"file":"links.js","sourceRoot":"","sources":["../../src/approvals/links.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAExD;gFACgF;AAChF,MAAM,OAAO,mBAAmB;IAEX;IACA;IAFnB,YACmB,EAAM,EACN,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QADlC,OAAE,GAAF,EAAE,CAAI;QACN,QAAG,GAAH,GAAG,CAA+B;IAClD,CAAC;IAEJ,MAAM,CAAC,UAAkB,EAAE,SAAe;QACxC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,aAAa,CAAC;aACrB,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;aAC3E,GAAG,EAAE,CAAC;QACT,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2EAA2E;IAC3E,OAAO,CAAC,KAAa;QACnB,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,OAAO,CACL,IAAI,CAAC,EAAE;aACJ,MAAM,EAAE;aACR,IAAI,CAAC,aAAa,CAAC;aACnB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAC1C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAC5B,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CACxC,CACF;aACA,GAAG,EAAE,IAAI,IAAI,CACjB,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,UAAU,CAAC,UAAkB;QAC3B,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,aAAa,CAAC;aACrB,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;aAC3B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;aAClF,GAAG,EAAE,CAAC;IACX,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,CAAC,aAAa,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;aAClF,GAAG,EAAE,CAAC,OAAO,CAAC;IACnB,CAAC;CACF"}
|
|
@@ -5,10 +5,14 @@ import type { ApprovalLinkService } from './links.js';
|
|
|
5
5
|
* A client's answer never approves a risky call. */
|
|
6
6
|
export type DecisionOutcome = 'approved' | 'denied' | 'timed_out' | 'cancelled';
|
|
7
7
|
export type DecisionChannel = 'elicitation' | 'url';
|
|
8
|
+
/** How the approval page knew the approver (design §5.3). */
|
|
9
|
+
export type ApproverSignIn = 'session' | 'external';
|
|
8
10
|
export interface Decision {
|
|
9
11
|
outcome: DecisionOutcome;
|
|
10
12
|
via?: DecisionChannel;
|
|
11
13
|
decidedBy?: string;
|
|
14
|
+
/** Set for decisions on the approval page. */
|
|
15
|
+
signIn?: ApproverSignIn;
|
|
12
16
|
reason?: string;
|
|
13
17
|
/** The approver also granted this client the endpoint's Ask operations until then (§5.8). */
|
|
14
18
|
sessionGrantUntil?: Date;
|
|
@@ -89,8 +93,6 @@ export interface ApprovalRequestInput {
|
|
|
89
93
|
/** Present when the execution can park; used only when no client prompt applies. */
|
|
90
94
|
park?: ParkHook;
|
|
91
95
|
}
|
|
92
|
-
/** Every approval needs a TOTP proof in the deciding session (OIDC sign-ins have none); locked ops a fresh one. */
|
|
93
|
-
export declare const needsTotpProof: (locked: boolean, sinceProofMs: number) => boolean;
|
|
94
96
|
/** Only the credential's owner decides (design §5.3); a call without one, only an admin. */
|
|
95
97
|
export declare const mayDecide: (approval: {
|
|
96
98
|
ownerUserId: string | null;
|
|
@@ -176,7 +178,7 @@ export declare class ApprovalService {
|
|
|
176
178
|
enabled: boolean;
|
|
177
179
|
config: unknown;
|
|
178
180
|
secretsEnc: Buffer<ArrayBufferLike> | null;
|
|
179
|
-
|
|
181
|
+
authMethods: ("bearer" | "oauth" | "external")[] | null;
|
|
180
182
|
settings: unknown;
|
|
181
183
|
status: "stopped" | "starting" | "ready" | "error";
|
|
182
184
|
statusError: string | null;
|
|
@@ -193,6 +195,7 @@ export declare class ApprovalService {
|
|
|
193
195
|
approve: boolean;
|
|
194
196
|
confirm?: string;
|
|
195
197
|
decidedBy: string;
|
|
198
|
+
signIn?: ApproverSignIn;
|
|
196
199
|
sessionGrantUntil?: Date;
|
|
197
200
|
}): Decision;
|
|
198
201
|
/** Cancels one open request (its execution ended). Returns false if it was already decided. */
|
|
@@ -3,10 +3,6 @@ import { and, eq } from 'drizzle-orm';
|
|
|
3
3
|
import { writeAudit } from '../audit.js';
|
|
4
4
|
import { operations, pendingApprovals, pluginInstances } from '../db/schema.js';
|
|
5
5
|
import { ConflictError, NotFoundError, ValidationError } from '../errors.js';
|
|
6
|
-
/** A locked operation needs a TOTP code proved this recently (design §5.3). */
|
|
7
|
-
const LOCKED_TOTP_MAX_AGE_MS = 5 * 60_000;
|
|
8
|
-
/** Every approval needs a TOTP proof in the deciding session (OIDC sign-ins have none); locked ops a fresh one. */
|
|
9
|
-
export const needsTotpProof = (locked, sinceProofMs) => locked ? sinceProofMs > LOCKED_TOTP_MAX_AGE_MS : sinceProofMs === Infinity;
|
|
10
6
|
/** Only the credential's owner decides (design §5.3); a call without one, only an admin. */
|
|
11
7
|
export const mayDecide = (approval, userId, isAdmin) => approval.ownerUserId ? approval.ownerUserId === userId : isAdmin;
|
|
12
8
|
export class ApprovalService {
|
|
@@ -188,6 +184,7 @@ export class ApprovalService {
|
|
|
188
184
|
outcome: input.approve ? 'approved' : 'denied',
|
|
189
185
|
via: 'url',
|
|
190
186
|
decidedBy: input.decidedBy,
|
|
187
|
+
...(input.signIn ? { signIn: input.signIn } : {}),
|
|
191
188
|
...(input.approve && input.sessionGrantUntil ? { sessionGrantUntil: input.sessionGrantUntil } : {}),
|
|
192
189
|
};
|
|
193
190
|
live.settle(decision);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/approvals/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/approvals/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAkG7E,4FAA4F;AAC5F,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAwC,EAAE,MAAc,EAAE,OAAgB,EAAE,EAAE,CACtG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAOnE,MAAM,OAAO,eAAe;IAIP;IACA;IACA;IALF,IAAI,GAAG,IAAI,GAAG,EAAgB,CAAC;IAEhD,YACmB,EAAM,EACN,KAA0B,EAC1B,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAFlC,OAAE,GAAF,EAAE,CAAI;QACN,UAAK,GAAL,KAAK,CAAqB;QAC1B,QAAG,GAAH,GAAG,CAA+B;IAClD,CAAC;IAEJ,iHAAiH;IACjH,MAAM,CAAC,WAAW,CAAC,EAAM,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;QACzC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACvG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC;qBACxB,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;qBACzC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;qBACpC,GAAG,EAAE,CAAC;gBACT,UAAU,CACR,EAAE,EACF;oBACE,IAAI,EAAE,MAAM;oBACZ,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,QAAQ,EAAE,QAAQ;oBAClB,SAAS,EAAE,QAAQ;oBACnB,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE;iBACvD,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,KAA2B;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG;YACV,EAAE;YACF,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;YAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;YAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;YAC5C,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;YACxC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YAC7B,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACtC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;YACxC,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YACpD,MAAM,EAAE,SAAkB;YAC1B,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB,CAAC;QAEF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QACpC,IAAI,OAAO,GAAmC,OAAO,CAAC,GAAG;YACvD,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,aAAa;gBACnC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3B,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW;gBAAE,OAAO,GAAG,MAAM,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,+FAA+F;YAC/F,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAC5F,IAAI,CAAC,EAAE;iBACJ,MAAM,CAAC,gBAAgB,CAAC;iBACxB,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACpD,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,EAAE;YACjD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAClF,MAAM,MAAM,GAAG,CAAC,CAAW,EAAE,EAAE;gBAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAAE,OAAO,CAAC,sBAAsB;gBACzD,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;gBACnE,IAAI,CAAC,EAAE;qBACJ,MAAM,CAAC,gBAAgB,CAAC;qBACxB,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;qBACjG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;qBAC/E,GAAG,EAAE,CAAC;gBACT,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBAC1B,IAAI,OAAO,KAAK,KAAK;oBAAE,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;gBACjD,OAAO,CAAC,CAAC,CAAC,CAAC;YACb,CAAC,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,KAAK,KAAK;YAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;aAC1D,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACnD,KAAK,CAAC,IAAK,CAAC,KAAK,CAAC;gBAChB,UAAU,EAAE,EAAE;gBACd,IAAI,EAAE,MAAM,KAAK,EAAE;gBACnB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC,CAAC;QACL,CAAC;;YAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IAC1B,CAAC;IAEO,OAAO,CAAC,KAA2B,EAAE,OAAe;QAC1D,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,cAAc,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,cAAc,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnH,CAAC;IAEO,QAAQ,CAAC,EAAU,EAAE,SAAe,EAAE,KAA2B;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,CAAC,MAAc,EAAY,EAAE,CAAC,CAAC;YAClD,OAAO,EAAE,QAAQ;YACjB,GAAG,EAAE,aAAa;YAClB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;YAC1B,MAAM;SACP,CAAC,CAAC;QACH,KAAK,CAAC,OAAQ,CAAC,GAAI,CAAC;YAClB,UAAU,EAAE,EAAE;YACd,IAAI,EAAE,MAAM,KAAK,EAAE;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,mEAAmE,CAAC;SAClG,CAAC,CAAC,IAAI,CACL,CAAC,GAAG,EAAE,EAAE;YACN,uEAAuE;YACvE,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,kGAAkG;QAClG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAC/D,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,EAAU,EAAE,KAA2B;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAC1B,KAAK,EACL,eAAe,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACpH,CAAC;QACF,KAAK,CAAC,OAAQ,CAAC,IAAK,CAAC;YACnB,UAAU,EAAE,EAAE;YACd,OAAO;YACP,eAAe,EAAE;gBACf,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE;gBACzE,QAAQ,EAAE,CAAC,SAAS,CAAC;aACtB;SACF,CAAC,CAAC,IAAI,CACL,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;YAC1E,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7G,CAAC,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAChF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,WAAW,CAAC,EAAU;QACpB,OAAO,CACL,IAAI,CAAC,EAAE;aACJ,MAAM,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;aACjF,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;aACtE,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;aAC/E,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aAClC,GAAG,EAAE,IAAI,IAAI,CACjB,CAAC;IACJ,CAAC;IAED,sGAAsG;IACtG,MAAM,CACJ,EAAU,EACV,KAAmH;QAEnH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC7F,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;YAC5E,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,4BAA4B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAC1F,MAAM,IAAI,eAAe,CAAC,uBAAuB,EAAE,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,sBAAsB,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,QAAQ,GAAa;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YAC9C,GAAG,EAAE,KAAK;YACV,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpG,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,+FAA+F;IAC/F,MAAM,CAAC,EAAU,EAAE,MAAc;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qGAAqG;IACrG,iBAAiB,CAAC,UAAkB,EAAE,MAAc;QAClD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QACpF,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,wFAAwF;IACxF,SAAS,CAAC,MAAM,GAAG,UAAU;QAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;CACF"}
|
package/dist/audit-query.d.ts
CHANGED
|
@@ -22,6 +22,7 @@ declare const AuditQuerySchema: z.ZodObject<{
|
|
|
22
22
|
export type AuditQuery = z.infer<typeof AuditQuerySchema>;
|
|
23
23
|
export declare function queryAudit(db: DbLike, raw: unknown): {
|
|
24
24
|
rows: {
|
|
25
|
+
actorName: string | null;
|
|
25
26
|
id: number;
|
|
26
27
|
at: Date;
|
|
27
28
|
kind: "search" | "config" | "call" | "auth" | "plugin";
|
package/dist/audit-query.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { and, desc, eq, gte, lt, lte, or, sql } from 'drizzle-orm';
|
|
2
2
|
import { z } from 'zod';
|
|
3
|
-
import { auditLog } from './db/schema.js';
|
|
3
|
+
import { auditLog, users } from './db/schema.js';
|
|
4
4
|
/** Audit log reads for the portal (design §8.2): filterable, paginated, exportable. Never writes. */
|
|
5
5
|
const AuditQuerySchema = z.object({
|
|
6
6
|
instance: z.string().optional(),
|
|
@@ -29,24 +29,30 @@ function where(q) {
|
|
|
29
29
|
c.push(sql `${auditLog.operationKey} LIKE ${`${escapeLike(q.operation)}%`} ESCAPE '\\'`);
|
|
30
30
|
if (q.target)
|
|
31
31
|
c.push(sql `${auditLog.resolvedTargets} LIKE ${`%${escapeLike(q.target)}%`} ESCAPE '\\'`);
|
|
32
|
-
if (q.actor)
|
|
33
|
-
|
|
32
|
+
if (q.actor) {
|
|
33
|
+
const byName = sql `${auditLog.actorKind} = 'user' AND ${auditLog.actorId} IN (SELECT ${users.id} FROM ${users} WHERE lower(${users.username}) = lower(${q.actor}))`;
|
|
34
|
+
c.push(or(eq(auditLog.actorId, q.actor), byName));
|
|
35
|
+
}
|
|
34
36
|
if (q.from)
|
|
35
37
|
c.push(gte(auditLog.at, q.from));
|
|
36
38
|
if (q.to)
|
|
37
39
|
c.push(lte(auditLog.at, q.to));
|
|
38
40
|
return c.length ? and(...c) : undefined;
|
|
39
41
|
}
|
|
42
|
+
/** Audit rows plus the acting user's current name; null when the actor isn't a user or no longer exists. */
|
|
43
|
+
const selectWithActorName = (db) => db
|
|
44
|
+
.select({ row: auditLog, actorName: users.username })
|
|
45
|
+
.from(auditLog)
|
|
46
|
+
.leftJoin(users, and(eq(auditLog.actorKind, 'user'), eq(auditLog.actorId, users.id)));
|
|
40
47
|
export function queryAudit(db, raw) {
|
|
41
48
|
const q = AuditQuerySchema.parse(raw);
|
|
42
|
-
const rows = db
|
|
43
|
-
.select()
|
|
44
|
-
.from(auditLog)
|
|
49
|
+
const rows = selectWithActorName(db)
|
|
45
50
|
.where(where(q))
|
|
46
51
|
.orderBy(desc(auditLog.at), desc(auditLog.id))
|
|
47
52
|
.limit(q.limit)
|
|
48
53
|
.offset(q.offset)
|
|
49
|
-
.all()
|
|
54
|
+
.all()
|
|
55
|
+
.map(({ row, actorName }) => ({ ...row, actorName }));
|
|
50
56
|
const total = db
|
|
51
57
|
.select({ n: sql `count(*)` })
|
|
52
58
|
.from(auditLog)
|
|
@@ -64,6 +70,7 @@ const CSV_COLUMNS = [
|
|
|
64
70
|
'decision',
|
|
65
71
|
'actorKind',
|
|
66
72
|
'actorId',
|
|
73
|
+
'actorName',
|
|
67
74
|
'decidedBy',
|
|
68
75
|
'decidedVia',
|
|
69
76
|
'resultStatus',
|
|
@@ -91,13 +98,12 @@ export function* auditCsvChunks(db, raw) {
|
|
|
91
98
|
const after = last
|
|
92
99
|
? or(lt(auditLog.at, last.at), and(eq(auditLog.at, last.at), lt(auditLog.id, last.id)))
|
|
93
100
|
: undefined;
|
|
94
|
-
const rows = db
|
|
95
|
-
.select()
|
|
96
|
-
.from(auditLog)
|
|
101
|
+
const rows = selectWithActorName(db)
|
|
97
102
|
.where(and(where(q), after))
|
|
98
103
|
.orderBy(desc(auditLog.at), desc(auditLog.id))
|
|
99
104
|
.limit(CSV_PAGE)
|
|
100
|
-
.all()
|
|
105
|
+
.all()
|
|
106
|
+
.map(({ row, actorName }) => ({ ...row, actorName }));
|
|
101
107
|
if (rows.length)
|
|
102
108
|
yield rows.map((r) => `${CSV_COLUMNS.map((c) => csvCell(r[c])).join(',')}\n`).join('');
|
|
103
109
|
if (rows.length < CSV_PAGE)
|
package/dist/audit-query.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-query.js","sourceRoot":"","sources":["../src/audit-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"audit-query.js","sourceRoot":"","sources":["../src/audit-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAEjD,qGAAqG;AAErG,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvE,yDAAyD;IACzD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAClD,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAExE,SAAS,KAAK,CAAC,CAAa;IAC1B,MAAM,CAAC,GAAU,EAAE,CAAC;IACpB,IAAI,CAAC,CAAC,QAAQ;QAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,IAAI;QAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,QAAQ;QAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA,GAAG,QAAQ,CAAC,QAAQ,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,CAAC;IACnG,IAAI,CAAC,CAAC,SAAS;QAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA,GAAG,QAAQ,CAAC,YAAY,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,cAAc,CAAC,CAAC;IACzG,IAAI,CAAC,CAAC,MAAM;QAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA,GAAG,QAAQ,CAAC,eAAe,SAAS,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,cAAc,CAAC,CAAC;IACvG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,GAAG,CAAA,GAAG,QAAQ,CAAC,SAAS,iBAAiB,QAAQ,CAAC,OAAO,eAAe,KAAK,CAAC,EAAE,SAAS,KAAK,gBAAgB,KAAK,CAAC,QAAQ,aAAa,CAAC,CAAC,KAAK,IAAI,CAAC;QACpK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,CAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,CAAC,IAAI;QAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,EAAE;QAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1C,CAAC;AAED,4GAA4G;AAC5G,MAAM,mBAAmB,GAAG,CAAC,EAAU,EAAE,EAAE,CACzC,EAAE;KACC,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;KACpD,IAAI,CAAC,QAAQ,CAAC;KACd,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE1F,MAAM,UAAU,UAAU,CAAC,EAAU,EAAE,GAAY;IACjD,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,mBAAmB,CAAC,EAAE,CAAC;SACjC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACf,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;SAC7C,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;SACd,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;SAChB,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACxD,MAAM,KAAK,GACT,EAAE;SACC,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAQ,UAAU,EAAE,CAAC;SACpC,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACf,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACnB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,YAAY;IACZ,cAAc;IACd,gBAAgB;IAChB,UAAU;IACV,WAAW;IACX,SAAS;IACT,WAAW;IACX,WAAW;IACX,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,iBAAiB;IACjB,QAAQ;CACA,CAAC;AAEX,SAAS,OAAO,CAAC,CAAU;IACzB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpG,4CAA4C;IAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IACxC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,CAAC;AAEtB,wGAAwG;AACxG,MAAM,SAAS,CAAC,CAAC,cAAc,CAAC,EAAU,EAAE,GAAY;IACtD,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,GAAI,GAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACnC,IAAI,IAA0C,CAAC;IAC/C,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,IAAI;YAChB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACvF,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,mBAAmB,CAAC,EAAE,CAAC;aACjC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;aAC3B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;aAC7C,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxG,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ;YAAE,OAAO;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;QAC1B,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,GAAY;IACrD,OAAO,CAAC,GAAG,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/C,CAAC"}
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
import type { JWTVerifyGetKey } from 'jose';
|
|
2
|
+
import type { ExternalIdentity, ExternalProvider } from './external.js';
|
|
3
|
+
/** A JWT's claimed issuer and audience, unverified, only to explain a rejection: strings only, clipped. */
|
|
4
|
+
export declare function claimedIssuer(token: string): {
|
|
5
|
+
iss?: string;
|
|
6
|
+
aud?: string;
|
|
7
|
+
} | null;
|
|
8
|
+
/** Verifies a `Cf-Access-Jwt-Assertion` (signature, issuer, audience, expiry) and returns the user's email
|
|
9
|
+
* or why it was rejected. `keys` replaces the team's key set (tests). */
|
|
10
|
+
export declare function checkCloudflareAccess(teamDomain: string, aud: string, assertion: string, keys?: JWTVerifyGetKey): Promise<ExternalIdentity>;
|
|
11
|
+
export declare const cloudflareAccess: ExternalProvider;
|
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
import { createRemoteJWKSet, decodeJwt, jwtVerify } from 'jose';
|
|
2
|
+
/** Cloudflare Access as an external provider (design §6.2): the `Cf-Access-Jwt-Assertion` of a user. */
|
|
3
|
+
const jwksCache = new Map();
|
|
4
|
+
const MAX_CLAIM = 120;
|
|
5
|
+
const clip = (v) => (v.length > MAX_CLAIM ? `${v.slice(0, MAX_CLAIM)}…` : v);
|
|
6
|
+
/** A JWT's claimed issuer and audience, unverified, only to explain a rejection: strings only, clipped. */
|
|
7
|
+
export function claimedIssuer(token) {
|
|
8
|
+
let payload;
|
|
9
|
+
try {
|
|
10
|
+
payload = decodeJwt(token);
|
|
11
|
+
}
|
|
12
|
+
catch {
|
|
13
|
+
return null;
|
|
14
|
+
}
|
|
15
|
+
const { iss, aud } = payload;
|
|
16
|
+
const auds = (Array.isArray(aud) ? aud : [aud]).filter((a) => typeof a === 'string');
|
|
17
|
+
return {
|
|
18
|
+
iss: typeof iss === 'string' ? clip(iss) : undefined,
|
|
19
|
+
aud: auds.length ? clip(auds.join(',')) : undefined,
|
|
20
|
+
};
|
|
21
|
+
}
|
|
22
|
+
/** Verifies a `Cf-Access-Jwt-Assertion` (signature, issuer, audience, expiry) and returns the user's email
|
|
23
|
+
* or why it was rejected. `keys` replaces the team's key set (tests). */
|
|
24
|
+
export async function checkCloudflareAccess(teamDomain, aud, assertion, keys) {
|
|
25
|
+
const domain = teamDomain.replace(/^https?:\/\//, '').replace(/\/+$/, '');
|
|
26
|
+
let jwks = keys ?? jwksCache.get(domain);
|
|
27
|
+
if (!jwks) {
|
|
28
|
+
const remote = createRemoteJWKSet(new URL(`https://${domain}/cdn-cgi/access/certs`));
|
|
29
|
+
jwksCache.set(domain, remote);
|
|
30
|
+
jwks = remote;
|
|
31
|
+
}
|
|
32
|
+
const issuer = `https://${domain}`;
|
|
33
|
+
try {
|
|
34
|
+
const { payload } = await jwtVerify(assertion, jwks, {
|
|
35
|
+
issuer,
|
|
36
|
+
audience: aud,
|
|
37
|
+
algorithms: ['RS256'],
|
|
38
|
+
requiredClaims: ['exp', 'iat'],
|
|
39
|
+
});
|
|
40
|
+
// A service token's assertion has an empty `sub` and names the token's client ID in `common_name`:
|
|
41
|
+
// it is no user, so it is refused (design §6.2).
|
|
42
|
+
if (payload.common_name !== undefined || !payload.sub)
|
|
43
|
+
return { ok: false, reason: 'service token assertion: only user identities are accepted' };
|
|
44
|
+
const email = typeof payload.email === 'string' ? payload.email : '';
|
|
45
|
+
return email.includes('@')
|
|
46
|
+
? { ok: true, identity: email }
|
|
47
|
+
: { ok: false, reason: 'valid assertion without a user email' };
|
|
48
|
+
}
|
|
49
|
+
catch (err) {
|
|
50
|
+
const why = err instanceof Error ? err.message : String(err);
|
|
51
|
+
const claimed = claimedIssuer(assertion);
|
|
52
|
+
if (!claimed)
|
|
53
|
+
return { ok: false, reason: `${why} (not a JWT)` };
|
|
54
|
+
// The AUD tag and team domain are not secrets: every assertion Access issues carries them.
|
|
55
|
+
return {
|
|
56
|
+
ok: false,
|
|
57
|
+
reason: `${why} (assertion iss=${claimed.iss ?? '-'} aud=${claimed.aud ?? '-'}; expected iss=${issuer} aud=${aud})`,
|
|
58
|
+
};
|
|
59
|
+
}
|
|
60
|
+
}
|
|
61
|
+
export const cloudflareAccess = {
|
|
62
|
+
id: 'cloudflare',
|
|
63
|
+
name: 'Cloudflare Access',
|
|
64
|
+
configured: (settings) => !!settings.cfAccess.teamDomain && !!settings.cfAccess.aud,
|
|
65
|
+
async identify(headers, settings) {
|
|
66
|
+
const assertion = headers.get('cf-access-jwt-assertion');
|
|
67
|
+
if (!assertion)
|
|
68
|
+
return {
|
|
69
|
+
ok: false,
|
|
70
|
+
reason: 'no Cf-Access-Jwt-Assertion header: the request did not come through the Cloudflare Access application',
|
|
71
|
+
};
|
|
72
|
+
const checked = await checkCloudflareAccess(settings.cfAccess.teamDomain, settings.cfAccess.aud, assertion);
|
|
73
|
+
return checked.ok ? checked : { ok: false, reason: `Cloudflare Access assertion rejected: ${checked.reason}` };
|
|
74
|
+
},
|
|
75
|
+
};
|
|
76
|
+
//# sourceMappingURL=external-cloudflare.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"external-cloudflare.js","sourceRoot":"","sources":["../../src/auth/external-cloudflare.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAIhE,wGAAwG;AAExG,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAErF,2GAA2G;AAC3G,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAClG,OAAO;QACL,GAAG,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACpD,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KACpD,CAAC;AACJ,CAAC;AAED;yEACyE;AACzE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAkB,EAClB,GAAW,EACX,SAAiB,EACjB,IAAsB;IAEtB,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,IAAI,IAAI,GAAG,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,WAAW,MAAM,uBAAuB,CAAC,CAAC,CAAC;QACrF,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,MAAM,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE;YACnD,MAAM;YACN,QAAQ,EAAE,GAAG;YACb,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;SAC/B,CAAC,CAAC;QACH,mGAAmG;QACnG,iDAAiD;QACjD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC;QAC7F,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YACxB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC/B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,cAAc,EAAE,CAAC;QACjE,2FAA2F;QAC3F,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,GAAG,mBAAmB,OAAO,CAAC,GAAG,IAAI,GAAG,QAAQ,OAAO,CAAC,GAAG,IAAI,GAAG,kBAAkB,MAAM,QAAQ,GAAG,GAAG;SACpH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,EAAE,EAAE,YAAY;IAChB,IAAI,EAAE,mBAAmB;IACzB,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG;IACnF,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ;QAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACzD,IAAI,CAAC,SAAS;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,uGAAuG;aAChH,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5G,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IACjH,CAAC;CACF,CAAC"}
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
import type { Settings } from '../settings.js';
|
|
2
|
+
/** External client auth (design §6.2): a provider in front of the MCP port names the user behind a request.
|
|
3
|
+
* A new provider is one module here and one id in {@link EXTERNAL_PROVIDER_IDS}. */
|
|
4
|
+
export declare const EXTERNAL_PROVIDER_IDS: readonly ["cloudflare"];
|
|
5
|
+
export type ExternalProviderId = (typeof EXTERNAL_PROVIDER_IDS)[number];
|
|
6
|
+
export type McpSettings = Settings<'mcp'>;
|
|
7
|
+
export type ExternalIdentity = {
|
|
8
|
+
ok: true;
|
|
9
|
+
identity: string;
|
|
10
|
+
} | {
|
|
11
|
+
ok: false;
|
|
12
|
+
reason: string;
|
|
13
|
+
};
|
|
14
|
+
export interface ExternalProvider {
|
|
15
|
+
id: ExternalProviderId;
|
|
16
|
+
/** Shown in logs and messages. */
|
|
17
|
+
name: string;
|
|
18
|
+
/** The settings this provider needs are present. */
|
|
19
|
+
configured(settings: McpSettings): boolean;
|
|
20
|
+
/** The user the request comes from, or why none; `reason` is for the server log only. */
|
|
21
|
+
identify(headers: Headers, settings: McpSettings): Promise<ExternalIdentity>;
|
|
22
|
+
}
|
|
23
|
+
/** The provider the settings select. */
|
|
24
|
+
export declare function externalProvider(settings: Pick<McpSettings, 'external'>): ExternalProvider;
|
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
import { cloudflareAccess } from './external-cloudflare.js';
|
|
2
|
+
/** External client auth (design §6.2): a provider in front of the MCP port names the user behind a request.
|
|
3
|
+
* A new provider is one module here and one id in {@link EXTERNAL_PROVIDER_IDS}. */
|
|
4
|
+
export const EXTERNAL_PROVIDER_IDS = ['cloudflare'];
|
|
5
|
+
const PROVIDERS = {
|
|
6
|
+
cloudflare: cloudflareAccess,
|
|
7
|
+
};
|
|
8
|
+
/** The provider the settings select. */
|
|
9
|
+
export function externalProvider(settings) {
|
|
10
|
+
return PROVIDERS[settings.external.provider];
|
|
11
|
+
}
|
|
12
|
+
//# sourceMappingURL=external.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"external.js","sourceRoot":"","sources":["../../src/auth/external.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D;oFACoF;AAEpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAY,CAAU,CAAC;AAiB7D,MAAM,SAAS,GAAiD;IAC9D,UAAU,EAAE,gBAAgB;CAC7B,CAAC;AAEF,wCAAwC;AACxC,MAAM,UAAU,gBAAgB,CAAC,QAAuC;IACtE,OAAO,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC"}
|
package/dist/auth/mcp-auth.d.ts
CHANGED
|
@@ -1,11 +1,9 @@
|
|
|
1
1
|
import type { Context } from 'hono';
|
|
2
|
-
import type { JWTVerifyGetKey } from 'jose';
|
|
3
2
|
import type { AppContext } from '../app.js';
|
|
4
3
|
import type { OAuthService } from './oauth.js';
|
|
5
4
|
import type { AccessCeiling } from '../gate/access.js';
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
* request yields an identity recorded on each audited call. */
|
|
5
|
+
/** Authentication for `/{slug}` (design §6.2): the endpoint's client auth methods narrowed to the enabled
|
|
6
|
+
* ones; every accepted request yields an identity recorded on each audited call. */
|
|
9
7
|
export interface McpIdentity {
|
|
10
8
|
kind: 'token' | 'oauth' | 'external';
|
|
11
9
|
/** Stable principal for session binding: a token id, `grant:<id>`, or the external identity. */
|
|
@@ -13,9 +11,9 @@ export interface McpIdentity {
|
|
|
13
11
|
/** Human-readable, shown in audit and approvals: `token:Claude Code`, `oauth:Claude for admin`. */
|
|
14
12
|
label: string;
|
|
15
13
|
/** Ceiling on what this principal can reach (design §6.3): from OAuth consent or the bearer token;
|
|
16
|
-
* `external`
|
|
14
|
+
* `external` is not limited here. */
|
|
17
15
|
access: AccessCeiling;
|
|
18
|
-
/** The user who owns the credential, or whom the
|
|
16
|
+
/** The user who owns the credential, or whom the external provider named; their role decides the reach (§6.4). */
|
|
19
17
|
userId: string;
|
|
20
18
|
roleId: string;
|
|
21
19
|
}
|
|
@@ -35,7 +33,6 @@ export type McpAuthResult = {
|
|
|
35
33
|
* depends on it (the approval link back to the same client, sign-in redirects). */
|
|
36
34
|
export declare function publicMcpBase(ctx: AppContext, c: Context): string;
|
|
37
35
|
export declare const resourceUrl: (base: string, slug: string) => string;
|
|
38
|
-
export declare function effectiveAuthMode(ctx: AppContext, instanceAuthMode: string | null): AuthMode;
|
|
39
36
|
/** The endpoints that accept OAuth (design §6.2), with their resource URLs under `base`. */
|
|
40
37
|
export declare function oauthEndpoints(ctx: AppContext, base: string): {
|
|
41
38
|
resource: string;
|
|
@@ -43,17 +40,6 @@ export declare function oauthEndpoints(ctx: AppContext, base: string): {
|
|
|
43
40
|
name: string;
|
|
44
41
|
id: string;
|
|
45
42
|
}[];
|
|
46
|
-
/** Verifies a `Cf-Access-Jwt-Assertion` (signature, issuer, audience, expiry) and returns who it names
|
|
47
|
-
* or why it was rejected. `keys` replaces the team's key set (tests). */
|
|
48
|
-
export declare function checkCloudflareAccess(teamDomain: string, aud: string, assertion: string, keys?: JWTVerifyGetKey): Promise<{
|
|
49
|
-
ok: true;
|
|
50
|
-
who: string;
|
|
51
|
-
} | {
|
|
52
|
-
ok: false;
|
|
53
|
-
reason: string;
|
|
54
|
-
}>;
|
|
55
|
-
/** {@link checkCloudflareAccess}, returning who the assertion names, or null. */
|
|
56
|
-
export declare function verifyCloudflareAccess(teamDomain: string, aud: string, assertion: string, keys?: JWTVerifyGetKey): Promise<string | null>;
|
|
57
43
|
/** The owner is still enabled, in the same role, and the role still has the endpoint (parked runs). */
|
|
58
44
|
export declare function ownerLive(ctx: AppContext, identity: McpIdentity, instanceId: string): boolean;
|
|
59
45
|
/** Whether the credential behind a principal still reaches the instance; external identities have no
|
|
@@ -62,5 +48,5 @@ export declare function principalLive(ctx: AppContext, principal: string, instan
|
|
|
62
48
|
export declare function authenticateMcp(ctx: AppContext, oauth: OAuthService, c: Context, instance: {
|
|
63
49
|
id: string;
|
|
64
50
|
slug: string;
|
|
65
|
-
|
|
51
|
+
authMethods: unknown;
|
|
66
52
|
}): Promise<McpAuthResult>;
|