@veducio/keja 0.3.0 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@veducio/keja",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "packageManager": "bun@1.4.4",
   "description": "Veducio Keja - RESTFUL Web Server, Based on Lightweight Hono Framework, Written in TypeScript, Powered by Bun",
   "license": "MIT",

package/src/grant/grant.test.ts

@@ -1,26 +1,21 @@
 import { decodeJwt, decodeProtectedHeader } from "jose";
 import { afterEach, describe, expect, it } from "vitest";
-import { connectVault, setVault, VaultError } from "../vault/client.ts";
+import { connectVault, setVault } from "../vault/client.ts";
 import { grant, verifyGrant } from "./grant.ts";
-
-const settings = {
-  address: "https://vault.example",
-  token: "s.token",
-  namespace: "apps" as string | null,
-  mount: "secret",
-  transit_key: "keja-grants" as string | null,
-  transit_mount: "transit",
-  grant_max_exp: 900,
-};
+import { setGrants } from "./settings.ts";
 
 afterEach(() => {
   setVault(null);
+  setGrants(null);
 });
 
 describe("grant", () => {
-  it("signs a subject, action, expiry, and context with the transit key", async () => {
-    const calls: { url: string; body: unknown }[] = [];
-    await connect(calls, { type: "ecdsa-p256", valid: true });
+  it("signs with a secret from grants config", async () => {
+    setGrants({
+      mode: "secret",
+      max_exp: 900,
+      secret: "test-secret",
+    });
     const now = 1_700_000_000_000;
     const clock = Date.now;
     Date.now = () => now;
@@ -32,9 +27,8 @@ describe("grant", () => {
         context: { postId: "posts_01h455vb4pex5vsknk084sn02q" },
       });
       expect(decodeProtectedHeader(token)).toEqual({
-        alg: "ES256",
+        alg: "HS256",
         typ: "JWT",
-        kid: "1",
       });
       expect(decodeJwt(token)).toMatchObject({
         sub: "tenant_01h455vb4pex5vsknk084sn02q",
@@ -43,6 +37,69 @@ describe("grant", () => {
         exp: 1_700_000_060,
         context: { postId: "posts_01h455vb4pex5vsknk084sn02q" },
       });
+      await expect(
+        verifyGrant(token, { action: "posts.read" }),
+      ).resolves.toEqual({
+        subject: "tenant_01h455vb4pex5vsknk084sn02q",
+        action: "posts.read",
+        context: { postId: "posts_01h455vb4pex5vsknk084sn02q" },
+      });
+    } finally {
+      Date.now = clock;
+    }
+  });
+
+  it("signs a subject, action, expiry, and context with the transit key", async () => {
+    const calls: { url: string; body: unknown }[] = [];
+    await connectVault(
+      {
+        address: "https://vault.example",
+        token: "s.token",
+        namespace: "apps",
+        mount: "secret",
+      },
+      async (url, init) => {
+        const body = init?.body ? JSON.parse(String(init.body)) : null;
+        calls.push({ url, body });
+        if (url.endsWith("/v1/auth/token/lookup-self")) {
+          return Response.json({ data: { id: "s.token" } });
+        }
+        if (url.endsWith("/keys/keja-grants")) {
+          return Response.json({
+            data: { type: "ecdsa-p256", latest_version: 1 },
+          });
+        }
+        if (url.endsWith("/sign/keja-grants")) {
+          return Response.json({
+            data: {
+              signature: `vault:v1:${Buffer.from("signed").toString("base64")}`,
+            },
+          });
+        }
+        return Response.json({ data: { valid: true } });
+      },
+    );
+    setGrants({
+      mode: "transit",
+      max_exp: 900,
+      transit_key: "keja-grants",
+      transit_mount: "transit",
+    });
+    const now = 1_700_000_000_000;
+    const clock = Date.now;
+    Date.now = () => now;
+    try {
+      const token = await grant({
+        subject: "tenant_01h455vb4pex5vsknk084sn02q",
+        action: "posts.read",
+        exp: 60,
+        context: { postId: "posts_01h455vb4pex5vsknk084sn02q" },
+      });
+      expect(decodeProtectedHeader(token)).toEqual({
+        alg: "ES256",
+        typ: "JWT",
+        kid: "1",
+      });
       const sign = calls.find((call) => call.url.endsWith("/sign/keja-grants"));
       expect(sign?.body).toMatchObject({
         hash_algorithm: "sha2-256",
@@ -59,24 +116,61 @@ describe("grant", () => {
       await expect(
         verifyGrant(token, { action: "posts.read" }),
       ).rejects.toThrow("grant is expired");
-      Date.now = () => now;
-      await expect(
-        verifyGrant(token, { action: "posts.write" }),
-      ).rejects.toThrow("grant action does not match");
     } finally {
       Date.now = clock;
     }
   });
 
   it("rejects a lifetime past the configured maximum", async () => {
-    await connect([], { type: "rsa-2048", valid: true });
+    setGrants({
+      mode: "secret",
+      max_exp: 900,
+      secret: "test-secret",
+    });
     await expect(
       grant({ subject: "tenant", action: "posts.read", exp: 901 }),
     ).rejects.toThrow("grant exp must be at most 900 seconds");
   });
 
+  it("requires grants to be enabled", async () => {
+    await expect(
+      grant({ subject: "tenant", action: "posts.read", exp: 60 }),
+    ).rejects.toThrow("grant requires grants");
+  });
+
   it("rejects a signature Vault does not accept", async () => {
-    await connect([], { type: "rsa-2048", valid: false });
+    await connectVault(
+      {
+        address: "https://vault.example",
+        token: "s.token",
+        namespace: null,
+        mount: "secret",
+      },
+      async (url) => {
+        if (url.endsWith("/v1/auth/token/lookup-self")) {
+          return Response.json({ data: { id: "s.token" } });
+        }
+        if (url.endsWith("/keys/keja-grants")) {
+          return Response.json({
+            data: { type: "rsa-2048", latest_version: 1 },
+          });
+        }
+        if (url.endsWith("/sign/keja-grants")) {
+          return Response.json({
+            data: {
+              signature: `vault:v1:${Buffer.from("signed").toString("base64")}`,
+            },
+          });
+        }
+        return Response.json({ data: { valid: false } });
+      },
+    );
+    setGrants({
+      mode: "transit",
+      max_exp: 900,
+      transit_key: "keja-grants",
+      transit_mount: "transit",
+    });
     const now = Date.now;
     Date.now = () => 1_700_000_000_000;
     try {
@@ -92,39 +186,4 @@ describe("grant", () => {
       Date.now = now;
     }
   });
-
-  it("requires vault and a transit key", async () => {
-    await expect(
-      grant({ subject: "tenant", action: "posts.read", exp: 60 }),
-    ).rejects.toThrow("grant requires vault");
-    await connect([], { type: "rsa-2048", valid: true });
-    setVault({ ...settings, transit_key: null });
-    await expect(
-      grant({ subject: "tenant", action: "posts.read", exp: 60 }),
-    ).rejects.toBeInstanceOf(VaultError);
-  });
 });
-
-async function connect(
-  calls: { url: string; body: unknown }[],
-  result: { type: string; valid: boolean },
-) {
-  await connectVault(settings, async (url, init) => {
-    const body = init?.body ? JSON.parse(String(init.body)) : null;
-    calls.push({ url, body });
-    if (url.endsWith("/v1/auth/token/lookup-self")) {
-      return Response.json({ data: { id: "s.token" } });
-    }
-    if (url.endsWith("/keys/keja-grants")) {
-      return Response.json({ data: { type: result.type, latest_version: 1 } });
-    }
-    if (url.endsWith("/sign/keja-grants")) {
-      return Response.json({
-        data: {
-          signature: `vault:v1:${Buffer.from("signed").toString("base64")}`,
-        },
-      });
-    }
-    return Response.json({ data: { valid: result.valid } });
-  });
-}

package/src/grant/grant.ts

@@ -1,9 +1,12 @@
-import { decodeJwt, decodeProtectedHeader, type JWTPayload } from "jose";
 import {
-  openVault,
-  requireVaultSettings,
-  VaultError,
-} from "../vault/client.ts";
+  decodeJwt,
+  decodeProtectedHeader,
+  type JWTPayload,
+  jwtVerify,
+  SignJWT,
+} from "jose";
+import { openVault, VaultError } from "../vault/client.ts";
+import { requireGrants } from "./settings.ts";
 
 export type Grant = {
   subject: string;
@@ -36,23 +39,30 @@ const keySpecs: Record<string, KeySpec> = {
 };
 
 export async function grant(input: GrantInput) {
-  const settings = grantSettings("grant");
+  const settings = requireGrants("grant");
   const subject = requiredText(input.subject, "subject");
   const action = requiredText(input.action, "action");
-  const lifetime = lifetimeSeconds(input.exp, settings.grant_max_exp);
+  const lifetime = lifetimeSeconds(input.exp, settings.max_exp);
   const context = contextObject(input.context);
+  const now = Math.floor(Date.now() / 1000);
+  const payload = {
+    sub: subject,
+    action,
+    iat: now,
+    exp: now + lifetime,
+    context,
+  };
+  if (settings.mode === "secret") {
+    return new SignJWT({ action, context })
+      .setProtectedHeader({ alg: "HS256", typ: "JWT" })
+      .setSubject(subject)
+      .setIssuedAt(now)
+      .setExpirationTime(now + lifetime)
+      .sign(secretKey(settings.secret));
+  }
   const vault = openVault("grant");
   const key = await readKey(vault, settings);
-  const now = Math.floor(Date.now() / 1000);
-  const body = base64url(
-    JSON.stringify({
-      sub: subject,
-      action,
-      iat: now,
-      exp: now + lifetime,
-      context,
-    }),
-  );
+  const body = base64url(JSON.stringify(payload));
   const header = base64url(
     JSON.stringify({ alg: key.alg, typ: "JWT", kid: String(key.version) }),
   );
@@ -70,12 +80,27 @@ export async function grant(input: GrantInput) {
 }
 
 export async function verifyGrant(token: string, options: { action: string }) {
-  const settings = grantSettings("verifyGrant");
+  const settings = requireGrants("verifyGrant");
   const action = requiredText(options.action, "action");
   const parts = token.split(".");
   if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
     throw new VaultError("grant token is unreadable");
   }
+  if (settings.mode === "secret") {
+    try {
+      const verified = await jwtVerify(token, secretKey(settings.secret), {
+        algorithms: ["HS256"],
+        clockTolerance: 0,
+        currentDate: new Date(Date.now()),
+      });
+      return claims(verified.payload, action);
+    } catch (error) {
+      if (error instanceof VaultError) {
+        throw error;
+      }
+      throw new VaultError("grant signature was rejected");
+    }
+  }
   const header = decodeProtectedHeader(token);
   const payload = decodeJwt(token);
   const vault = openVault("verifyGrant");
@@ -101,14 +126,6 @@ export async function verifyGrant(token: string, options: { action: string }) {
   return claims(payload, action);
 }
 
-function grantSettings(feature: "grant" | "verifyGrant") {
-  const settings = requireVaultSettings(feature);
-  if (!settings.transit_key) {
-    throw new VaultError("vault transit key is required");
-  }
-  return settings as typeof settings & { transit_key: string };
-}
-
 async function readKey(
   vault: ReturnType<typeof openVault>,
   settings: { transit_mount: string; transit_key: string },
@@ -162,6 +179,10 @@ function vaultSignature(value: unknown) {
   };
 }
 
+function secretKey(secret: string) {
+  return new TextEncoder().encode(secret);
+}
+
 function claims(payload: JWTPayload, action: string): Grant {
   const now = Math.floor(Date.now() / 1000);
   if (

package/src/grant/settings.ts

@@ -0,0 +1,67 @@
+import { DependencyNotMet } from "../errors/framework-errors.ts";
+import { processValue } from "../process/slot.ts";
+import type { GrantsConfig } from "../project/config.ts";
+import { VaultError, vaultSecret } from "../vault/client.ts";
+
+export type ActiveGrants =
+  | {
+      mode: "transit";
+      max_exp: number;
+      transit_key: string;
+      transit_mount: string;
+    }
+  | {
+      mode: "secret";
+      max_exp: number;
+      secret: string;
+    };
+
+const state = processValue("grants", () => ({
+  active: null as ActiveGrants | null,
+}));
+
+export function setGrants(settings: ActiveGrants | null) {
+  state.active = settings;
+}
+
+export function requireGrants(feature: string) {
+  if (!state.active) {
+    throw new DependencyNotMet(feature, "grants");
+  }
+  return state.active;
+}
+
+export async function connectGrants(config: GrantsConfig) {
+  if (!config.enabled) {
+    setGrants(null);
+    return;
+  }
+  if (config.mode === "transit") {
+    setGrants({
+      mode: "transit",
+      max_exp: config.max_exp,
+      transit_key: config.transit_key,
+      transit_mount: config.transit_mount,
+    });
+    return;
+  }
+  let secret = config.secret;
+  if (config.secret_vault) {
+    const data = await vaultSecret(config.secret_vault);
+    const value = data[config.secret_field];
+    if (typeof value !== "string" || value.trim() === "") {
+      throw new VaultError(
+        `Vault secret ${config.secret_vault} field ${config.secret_field} is required`,
+      );
+    }
+    secret = value.trim();
+  }
+  if (typeof secret !== "string" || secret.trim() === "") {
+    throw new VaultError("grant secret is required");
+  }
+  setGrants({
+    mode: "secret",
+    max_exp: config.max_exp,
+    secret: secret.trim(),
+  });
+}