@zackbart/connecta 0.34.0 → 0.35.0

package/dist/auth/cloudflare-access.js

@@ -1,6 +1,7 @@
-import { withDeadline } from "../timeout.js";
-import { authorizationCredential } from "../inbound-credential.js";
+import { withAuthenticationDeadline } from "../auth-admission.js";
 import { validIdentityReference } from "../identity.js";
+import { authorizationCredential } from "../inbound-credential.js";
+import { authCall, authFlow, authInvoke, authMethod } from "./native.js";
 function identityString(identity, field) {
     const value = identity[field];
     return typeof value === "string" && validIdentityReference({ namespace: "cloudflare-access", id: value })
@@ -27,47 +28,50 @@ export function cloudflareAccessAuth() {
         challenge: () => 'Bearer scope="openid email"',
         activityActorNamespace: "cloudflare-access",
         uiAuth: { kind: "cloudflare-access" },
-        async authorize(request, _baseUrl, runtimeContext) {
-            if (authorizationCredential(request).kind !== "absent")
-                return unauthorized();
-            const access = runtimeContext?.access;
-            if (!access || typeof access.aud !== "string" || !/^[\x21-\x7e]{1,256}$/.test(access.aud))
-                return unauthorized();
-            let identity;
-            try {
-                identity = await withDeadline(() => access.getIdentity(), {
-                    timeoutMs: 5000,
-                    signal: request.signal,
-                    timeoutError: new Error("Access identity lookup timed out"),
-                });
-            }
-            catch {
-                return {
+        authorize: authMethod(function (request, _baseUrl, runtimeContext) {
+            return authFlow(function* () {
+                if (authorizationCredential(request).kind !== "absent")
+                    return unauthorized();
+                const access = runtimeContext?.access;
+                if (!access || typeof access.aud !== "string" || !/^[\x21-\x7e]{1,256}$/.test(access.aud))
+                    return unauthorized();
+                let identity;
+                try {
+                    identity = (yield authCall(withAuthenticationDeadline, [
+                        request,
+                        authMethod(() => {
+                            return authInvoke(access, "getIdentity", []);
+                        }),
+                    ]));
+                }
+                catch {
+                    return {
+                        ok: false,
+                        response: Response.json({ error: "Cloudflare Access identity unavailable", problem: "identity_unavailable" }, { status: 503, headers: { "Cache-Control": "no-store", "Retry-After": "1" } }),
+                    };
+                }
+                // Access binds ctx.access.aud to its Worker application at the edge.
+                // Service credentials can pass that edge, but connecta machines must
+                // present a cta_ token to the machine provider instead.
+                const forbidden = () => ({
                     ok: false,
-                    response: Response.json({ error: "Cloudflare Access identity unavailable", problem: "identity_unavailable" }, { status: 503, headers: { "Cache-Control": "no-store", "Retry-After": "1" } }),
-                };
-            }
-            // Access binds ctx.access.aud to its Worker application at the edge.
-            // Service credentials can pass that edge, but connecta machines must
-            // present a cta_ token to the machine provider instead.
-            const forbidden = () => ({
-                ok: false,
-                response: Response.json({ error: "Cloudflare Access human identity required" }, { status: 403, headers: { "Cache-Control": "no-store" } }),
+                    response: Response.json({ error: "Cloudflare Access human identity required" }, { status: 403, headers: { "Cache-Control": "no-store" } }),
+                });
+                if (!identity || typeof identity !== "object" || Array.isArray(identity))
+                    return forbidden();
+                const userId = identityString(identity, "user_uuid") ?? identityString(identity, "email");
+                if (identity.service_token_status === true ||
+                    identityString(identity, "service_token_id") ||
+                    identityString(identity, "common_name"))
+                    return forbidden();
+                if (!userId) {
+                    return {
+                        ok: false,
+                        response: Response.json({ error: "Cloudflare Access user identity required" }, { status: 403, headers: { "Cache-Control": "no-store" } }),
+                    };
+                }
+                return { ok: true, userId, subjectId: userId };
             });
-            if (!identity || typeof identity !== "object" || Array.isArray(identity))
-                return forbidden();
-            const userId = identityString(identity, "user_uuid") ?? identityString(identity, "email");
-            if (identity.service_token_status === true ||
-                identityString(identity, "service_token_id") ||
-                identityString(identity, "common_name"))
-                return forbidden();
-            if (!userId) {
-                return {
-                    ok: false,
-                    response: Response.json({ error: "Cloudflare Access user identity required" }, { status: 403, headers: { "Cache-Control": "no-store" } }),
-                };
-            }
-            return { ok: true, userId, subjectId: userId };
-        },
+        }),
     };
 }

package/dist/auth/downstream-client-metadata.js

@@ -17,7 +17,7 @@ export function trackRemoteClientRequest(secrets, input, init) {
                 const decode = (value) => new URLSearchParams(`value=${value}`).get("value");
                 const secret = decode(decoded.slice(colon + 1));
                 if (secret) {
-                    secrets.add(decode(decoded.slice(0, colon)));
+                    secrets.identifier(decode(decoded.slice(0, colon)));
                     secrets.secret(secret);
                 }
             }
@@ -31,7 +31,7 @@ export function trackRemoteClientRequest(secrets, input, init) {
         const form = new URLSearchParams(init.body);
         const secret = form.get("client_secret");
         if (secret) {
-            secrets.add(form.get("client_id") ?? "");
+            secrets.identifier(form.get("client_id") ?? "");
             secrets.secret(secret);
         }
         // RFC 7009 uses token, rather than the token endpoint's refresh_token.