@vzn/vx-devtools 0.0.652 → 0.0.653

package/README.md

@@ -25,8 +25,9 @@ option.
   `public`, `named` when ALLOW names it, or `undefined` when none is named.
 - `errorJson(status, message)` is every server's refusal, `{ code, message }`
   (Turbo's spec's `Error`); `notAllowed(allow)` its `405`, naming the methods in `Allow`.
-- `hashPart(text)` is what a server stores in place of an issuer, a repository name or a scope: the first
-  128 bits of its SHA-256 in hex (Web Crypto, so Bun and Workers agree), never the plain value.
+- `hashPart(text)` is what a request names its issuer and repository by (`vx-issuer`, `vx-repository`):
+  the first 128 bits of its SHA-256 in hex (Web Crypto, so Bun and Workers agree). A server stores
+  them plain: a cache object's name and a history row hold the issuer, repository and ref.
 - `statusLine(tone, name, text)` is the line a server prints when it starts (`'ok'`) or refuses to
   (`'err'`): `✓ vx-cache-server  listening on …`, painted as vx's own status lines (NO_COLOR, then
   FORCE_COLOR, then a terminal whose `TERM` is not `dumb`), with any lines after the first dim.
@@ -95,7 +96,7 @@ export function cachedFetchJson(
   checkout's origin names (2026-10-25). One `ALLOW` does not name is
   `403`, and so is one other than the request names.
 - The token's workflow (`job_workflow_ref` on GitHub, `ci_config_ref_uri`
-  on GitLab, up to the `@` before its ref) must be one an entry names for that
+  on GitLab, up to its last `@`, before the ref or SHA) must be one an entry names for that
   repository: any other is `403`.
 - With `readAccess: 'public'` (`READ_ACCESS`), a request with no token
   reads the repository it names when `ALLOW` names it (else `403`), and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-devtools",
-  "version": "0.0.652",
+  "version": "0.0.653",
   "license": "MIT",
   "description": "Code vx's servers and plugins share, never core: first, the CI OIDC token check.",
   "keywords": [

package/src/hash-part.ts

@@ -1,6 +1,7 @@
-// What a server stores in place of an issuer, a repository name or a scope
-// (2026-10-25: "issuer and scope should be hashed"): a cache object's
-// name and a history row hold no plain value of a token's.
+// What a request names its issuer and repository by (`vx-issuer`,
+// `vx-repository`, 2026-10-25), never their plain values. What a server
+// stores is plain: a cache object's name and a history row hold the
+// issuer, repository and ref as they are (2026-10-27, 2026-11-03).
 
 const parts = new Map<string, Promise<string>>()
 

package/src/oidc.ts

@@ -155,7 +155,7 @@ function branchOf(iss: string, claims: JWTPayload): string | undefined {
 export interface OidcOptions {
   /** `ALLOW` (`parseAllow`): who may take part. */
   readonly allow: readonly Allowed[]
-  /** The `aud` a token must name; unset, the origin the server is reached at. */
+  /** The `aud` a token must name, read as its origin (a URL that is not one throws); unset, the origin the server is reached at. */
   readonly audience?: string
   /**
    * Reads a URL as JSON (`cachedFetchJson` on a Worker); tests serve keys
@@ -291,9 +291,7 @@ const bearerOf = (req: Request): string | undefined =>
 
 /** A token checked: jose's checks, then ALLOW's repository and workflow, and the branch it may write. */
 function tokenVerifier(opts: OidcOptions): (token: string, req: Request) => Promise<Access> {
-  // A blank one is no origin a token names: every token was "wrong audience".
-  if (opts.audience !== undefined && opts.audience.trim() === '')
-    throw new Error('AUDIENCE: the aud CI tokens name, or unset, not blank')
+  const own = opts.audience === undefined ? undefined : originOf(opts.audience)
   const fetchJson = opts.fetchJson ?? defaultFetchJson
   const now = opts.now ?? (() => Date.now() / 1000)
   // jose keeps each issuer's keys, and refetches them for a key it lacks.
@@ -360,7 +358,7 @@ function tokenVerifier(opts: OidcOptions): (token: string, req: Request) => Prom
           : 'the token names no issuer (iss)',
       )
     }
-    const audience = opts.audience ?? new URL(req.url).origin
+    const audience = own ?? new URL(req.url).origin
     let claims: JWTPayload
     try {
       claims = (
@@ -390,9 +388,13 @@ function tokenVerifier(opts: OidcOptions): (token: string, req: Request) => Prom
     const wclaim = workflowClaimOf(iss)
     const ran = claims[wclaim]
     if (typeof ran !== 'string') throw new Refusal(403, `no ${wclaim} claim`)
-    // Cut at the `@` before the ref: GitLab's CI file may itself hold one
-    // (`.gitlab-ci.yml@group/project`, a file kept in another project).
-    const workflow = ran.replace(/@(?:refs\/.*)?$/, '')
+    // Cut at the last `@`: the ref after it is `refs/…` or a SHA (a reusable
+    // workflow pinned by one), and GitLab's CI file may itself hold one
+    // (`.gitlab-ci.yml@group/project`, a file kept in another project, which
+    // a cut at the first `@refs/` matched as this project's own when that
+    // project was `refs/…`). A ref holding an `@` is refused, never widened.
+    const at = ran.lastIndexOf('@')
+    const workflow = at < 0 ? ran : ran.slice(0, at)
     if (!ofRepo.some((a) => same(workflow, workflowPath(iss, a.repository, a.workflow))))
       throw new Refusal(403, `${wclaim} ${workflow} is not in this server's ALLOW`)
     const repo = { issuer: iss, repository }
@@ -401,6 +403,22 @@ function tokenVerifier(opts: OidcOptions): (token: string, req: Request) => Prom
   }
 }
 
+/**
+ * `AUDIENCE` as tokens name it: the origin, which vxCache() and vxHistory()
+ * ask CI for, so `https://c/` or a URL with a path refused every token.
+ */
+function originOf(audience: string): string {
+  const said = audience.trim()
+  // A blank one is no origin a token names: every token was "wrong audience".
+  if (said === '') throw new Error('AUDIENCE: the aud CI tokens name, or unset, not blank')
+  const url = URL.parse(said)
+  if (url === null || (url.protocol !== 'https:' && url.protocol !== 'http:'))
+    throw new Error(
+      `AUDIENCE: the origin clients reach this server at (https://cache.example.com), not ${said}`,
+    )
+  return url.origin
+}
+
 /** An issuer as a key names it: its URL, no trailing slash. */
 const issuerOf = (iss: string): string => iss.replace(/\/$/, '')
 
@@ -469,11 +487,14 @@ export function cachedFetchJson(
     const res = await (fetchImpl ?? fetch)(url, { signal: AbortSignal.timeout(10_000) })
     if (!res.ok) throw new Error(`${url}: ${res.status}`)
     const body = await res.text()
+    // Parsed before it is kept: a 200 that is not JSON (a proxy's page) is
+    // not served to every token for the next ten minutes.
+    const json: unknown = JSON.parse(body)
     await cache.put(
       url,
       new Response(body, { headers: { 'cache-control': `max-age=${KEYS_TTL_S}` } }),
     )
-    return JSON.parse(body)
+    return json
   }
 }