@zackbart/connecta 0.23.0 → 0.24.0

package/dist/access-tokens.js

@@ -1,236 +0,0 @@
-import { validIdentityReference } from "./identity.js";
-const TOKEN_PREFIX = "cta_";
-const TOKEN_BYTES = 32;
-const TOKEN_VALUE_RE = /^cta_[A-Za-z0-9_-]{43}$/;
-const RECORD_PREFIX = "access-token:v1:record:";
-const LOOKUP_PREFIX = "access-token:v1:lookup:";
-const MAX_NAME_CHARACTERS = 80;
-const DEFAULT_MAX_ACTIVE = 100;
-const MAX_CONFIGURED_ACTIVE = 1_000;
-const encoder = new TextEncoder();
-function recordKey(id) {
-    return `${RECORD_PREFIX}${id}`;
-}
-function lookupKey(hash) {
-    return `${LOOKUP_PREFIX}${hash}`;
-}
-function bytesToBase64Url(bytes) {
-    let binary = "";
-    for (const byte of bytes)
-        binary += String.fromCharCode(byte);
-    return btoa(binary)
-        .replaceAll("+", "-")
-        .replaceAll("/", "_")
-        .replace(/=+$/u, "");
-}
-function bytesToHex(bytes) {
-    return [...bytes]
-        .map((byte) => byte.toString(16).padStart(2, "0"))
-        .join("");
-}
-async function hashToken(token) {
-    return bytesToHex(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(token))));
-}
-function normalizeName(value) {
-    if (typeof value !== "string") {
-        throw new Error("Token name must be a string");
-    }
-    const compact = value.replace(/\s+/gu, " ").trim();
-    if (!compact)
-        throw new Error("Token name cannot be empty");
-    if (Array.from(compact).length > MAX_NAME_CHARACTERS) {
-        throw new Error(`Token name cannot exceed ${MAX_NAME_CHARACTERS} characters`);
-    }
-    return compact;
-}
-function parseRecord(raw) {
-    try {
-        const value = JSON.parse(raw);
-        if (value.version !== 1 ||
-            typeof value.id !== "string" ||
-            !/^[0-9a-f-]{36}$/u.test(value.id) ||
-            typeof value.name !== "string" ||
-            typeof value.tokenHash !== "string" ||
-            !/^[0-9a-f]{64}$/u.test(value.tokenHash) ||
-            typeof value.tokenPrefix !== "string" ||
-            typeof value.createdAt !== "string" ||
-            typeof value.createdBy !== "string" ||
-            (value.principal !== undefined &&
-                !validIdentityReference(value.principal)) ||
-            (value.revokedAt !== undefined &&
-                typeof value.revokedAt !== "string") ||
-            (value.revokedBy !== undefined &&
-                typeof value.revokedBy !== "string")) {
-            throw new Error("invalid token record");
-        }
-        return value;
-    }
-    catch {
-        throw new Error("Stored access token metadata is invalid or corrupted");
-    }
-}
-function parseLookup(raw) {
-    try {
-        const value = JSON.parse(raw);
-        return value.version === 1 && typeof value.id === "string"
-            ? { version: 1, id: value.id }
-            : null;
-    }
-    catch {
-        return null;
-    }
-}
-function metadata(record) {
-    return {
-        id: record.id,
-        name: record.name,
-        tokenPrefix: record.tokenPrefix,
-        createdAt: record.createdAt,
-        ...(record.revokedAt ? { revokedAt: record.revokedAt } : {}),
-    };
-}
-function unauthorized() {
-    return {
-        ok: false,
-        response: new Response(JSON.stringify({ error: "unauthorized" }), {
-            status: 401,
-            headers: {
-                "Content-Type": "application/json",
-                "WWW-Authenticate": "Bearer",
-            },
-        }),
-    };
-}
-/**
- * Deployment-scoped personal access tokens. Secret material is never
- * recoverable: authentication indexes a SHA-256 digest of a random 256-bit
- * token, while separately enumerable metadata powers operator management.
- */
-export class AccessTokenManager {
-    storage;
-    auth;
-    maxActive;
-    constructor(storage, options = {}) {
-        this.storage = storage;
-        if (!storage.list) {
-            throw new Error("accessTokens requires a storage adapter that implements list(prefix)");
-        }
-        const maxActive = options.maxActive ?? DEFAULT_MAX_ACTIVE;
-        if (!Number.isInteger(maxActive) ||
-            maxActive < 1 ||
-            maxActive > MAX_CONFIGURED_ACTIVE) {
-            throw new Error(`accessTokens.maxActive must be a whole number from 1 to ${MAX_CONFIGURED_ACTIVE}`);
-        }
-        this.maxActive = maxActive;
-        this.auth = {
-            kind: "access_token",
-            activityActorNamespace: "connecta:access-tokens:v1",
-            activityActorLabel: async (id) => {
-                try {
-                    return (await this.read(id))?.name;
-                }
-                catch {
-                    return undefined;
-                }
-            },
-            authorize: (request) => this.authorize(request),
-        };
-    }
-    async read(id) {
-        const raw = await this.storage.get(recordKey(id));
-        return raw ? parseRecord(raw) : null;
-    }
-    async list() {
-        const keys = await this.storage.list(RECORD_PREFIX);
-        const records = await Promise.all(keys.map(async (key) => {
-            const raw = await this.storage.get(key);
-            return raw ? parseRecord(raw) : null;
-        }));
-        return records
-            .filter((record) => Boolean(record))
-            .sort((a, b) => b.createdAt.localeCompare(a.createdAt))
-            .map(metadata);
-    }
-    async create(name, createdBy) {
-        const normalizedName = normalizeName(name);
-        const active = (await this.list()).filter((token) => !token.revokedAt);
-        if (active.length >= this.maxActive) {
-            throw new Error(`This deployment already has the maximum of ${this.maxActive} active access tokens`);
-        }
-        const secretBytes = crypto.getRandomValues(new Uint8Array(TOKEN_BYTES));
-        const token = TOKEN_PREFIX + bytesToBase64Url(secretBytes);
-        const hash = await hashToken(token);
-        if (await this.storage.get(lookupKey(hash))) {
-            throw new Error("Access token collision; create another token");
-        }
-        const record = {
-            version: 1,
-            id: crypto.randomUUID(),
-            name: normalizedName,
-            tokenHash: hash,
-            tokenPrefix: token.slice(0, 12),
-            createdAt: new Date().toISOString(),
-            createdBy: typeof createdBy === "string"
-                ? createdBy
-                : `${createdBy.namespace}:${createdBy.id}`,
-            ...(typeof createdBy === "string"
-                ? {}
-                : { principal: { ...createdBy } }),
-        };
-        await this.storage.set(recordKey(record.id), JSON.stringify(record));
-        try {
-            await this.storage.set(lookupKey(hash), JSON.stringify({ version: 1, id: record.id }));
-        }
-        catch (error) {
-            await this.storage.delete(recordKey(record.id)).catch(() => { });
-            throw error;
-        }
-        return { token, accessToken: metadata(record) };
-    }
-    async rename(id, name) {
-        const record = await this.read(id);
-        if (!record)
-            return null;
-        record.name = normalizeName(name);
-        await this.storage.set(recordKey(id), JSON.stringify(record));
-        return metadata(record);
-    }
-    async revoke(id, revokedBy) {
-        const record = await this.read(id);
-        if (!record)
-            return null;
-        if (!record.revokedAt) {
-            // Admission disappears first. A metadata-write failure may leave the UI
-            // calling the record active, but can never leave a token labelled
-            // revoked while its lookup still admits requests.
-            await this.storage.delete(lookupKey(record.tokenHash));
-            record.revokedAt = new Date().toISOString();
-            record.revokedBy = revokedBy;
-            await this.storage.set(recordKey(id), JSON.stringify(record));
-        }
-        return metadata(record);
-    }
-    async authorize(request) {
-        const header = request.headers.get("authorization") ?? "";
-        const match = /^Bearer\s+(.+)$/iu.exec(header);
-        const token = match?.[1];
-        if (!token || !TOKEN_VALUE_RE.test(token))
-            return unauthorized();
-        const hash = await hashToken(token);
-        const lookupRaw = await this.storage.get(lookupKey(hash));
-        if (!lookupRaw)
-            return unauthorized();
-        const lookup = parseLookup(lookupRaw);
-        if (!lookup)
-            return unauthorized();
-        const record = await this.read(lookup.id);
-        if (!record || record.revokedAt || record.tokenHash !== hash) {
-            return unauthorized();
-        }
-        return {
-            ok: true,
-            subjectId: record.id,
-            ...(record.principal ? { principal: { ...record.principal } } : {}),
-        };
-    }
-}

package/dist/routes/access-tokens.d.ts

@@ -1,6 +0,0 @@
-import { type RouteContext } from "./shared.js";
-/**
- * Interactive-operator lifecycle for deployment access tokens. The token itself
- * is deliberately never an administrator credential and cannot reach here.
- */
-export declare function routeAccessTokens(context: RouteContext): Promise<Response | null>;

package/dist/routes/access-tokens.js

@@ -1,83 +0,0 @@
-import { authorizeUiAdmin, isSameOrigin, msg, privateJson, } from "./shared.js";
-async function readName(request) {
-    if (!request.headers
-        .get("content-type")
-        ?.toLowerCase()
-        .startsWith("application/json")) {
-        return {
-            ok: false,
-            response: privateJson({ error: "Content-Type must be application/json" }, { status: 415 }),
-        };
-    }
-    const raw = await request.text();
-    if (raw.length > 1_000) {
-        return {
-            ok: false,
-            response: privateJson({ error: "request body is too large" }, { status: 413 }),
-        };
-    }
-    try {
-        const body = JSON.parse(raw);
-        return { ok: true, name: body.name };
-    }
-    catch {
-        return {
-            ok: false,
-            response: privateJson({ error: "invalid JSON body" }, { status: 400 }),
-        };
-    }
-}
-/**
- * Interactive-operator lifecycle for deployment access tokens. The token itself
- * is deliberately never an administrator credential and cannot reach here.
- */
-export async function routeAccessTokens(context) {
-    const match = /^\/ui\/access-tokens(?:\/([0-9a-f-]{36}))?$/.exec(context.path);
-    if (!match)
-        return null;
-    const { request, baseUrl, opts } = context;
-    if (request.method === "OPTIONS") {
-        return privateJson({ error: "CORS is not allowed" }, { status: 403 });
-    }
-    if (!opts.accessTokens) {
-        return privateJson({ error: "access token management is not configured" }, { status: 404 });
-    }
-    const mutating = request.method !== "GET";
-    if (mutating && !isSameOrigin(request, baseUrl)) {
-        return privateJson({ error: "same-origin request required" }, { status: 403 });
-    }
-    const admin = await authorizeUiAdmin(request, baseUrl, opts.auth, "access token management", context.runtimeContext, opts.identity);
-    if (!admin.ok)
-        return admin.response;
-    const id = match[1];
-    try {
-        if (!id && request.method === "GET") {
-            return privateJson({ accessTokens: await opts.accessTokens.list() });
-        }
-        if (!id && request.method === "POST") {
-            const input = await readName(request);
-            if (!input.ok)
-                return input.response;
-            return privateJson(await opts.accessTokens.create(input.name, admin.principal ?? admin.userId), { status: 201 });
-        }
-        if (id && request.method === "PUT") {
-            const input = await readName(request);
-            if (!input.ok)
-                return input.response;
-            const accessToken = await opts.accessTokens.rename(id, input.name);
-            return accessToken
-                ? privateJson({ accessToken })
-                : privateJson({ error: "unknown access token" }, { status: 404 });
-        }
-        if (id && request.method === "DELETE") {
-            const accessToken = await opts.accessTokens.revoke(id, admin.userId);
-            return accessToken
-                ? privateJson({ accessToken })
-                : privateJson({ error: "unknown access token" }, { status: 404 });
-        }
-        return privateJson({ error: "method not allowed" }, { status: 405 });
-    }
-    catch (error) {
-        return privateJson({ error: msg(error) }, { status: 400 });
-    }
-}