@zgeoff/atc 2.30.0 → 2.31.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/atc",
-  "version": "2.30.0",
+  "version": "2.31.0",
   "description": "Terminal control tower for coding-agent sessions",
   "homepage": "https://github.com/zgeoff/atc#readme",
   "bugs": "https://github.com/zgeoff/atc/issues",
@@ -76,7 +76,10 @@
     "hono": ">=4.13.5",
     "ip-address": "10.7.2",
     "js-yaml": ">=4.3.2 <5",
-    "qs": "6.16.0"
+    "proxy-addr": "2.0.8",
+    "qs": "6.16.0",
+    "smol-toml": "1.9.0",
+    "tinypool": "2.1.2"
   },
   "packageManager": "bun@1.3.10"
 }

package/src/shared/collect-auth-profiles.ts

@@ -2,11 +2,14 @@ import { isRecord } from './report';
 
 /**
  * A named reference to a credential impd holds: the secret's name, never
- * its value, and the rule impd applies when a request reaches the host,
- * plus the profiles a session selecting this one needs beside it. Only
- * the `custom` kind and the `bearer` scheme are bound.
+ * its value, and the profiles a session selecting this one needs beside
+ * it. A `custom` profile holds the one rule impd applies when a request
+ * reaches its host, always a bearer header. A `github` profile holds no
+ * rule: impd's `github` kind fixes its hosts and headers.
  */
-export interface AuthProfile {
+export type AuthProfile = CustomAuthProfile | GitHubAuthProfile;
+
+interface CustomAuthProfile {
   readonly name: string;
   readonly secret: string;
   readonly kind: 'custom';
@@ -16,6 +19,13 @@ export interface AuthProfile {
   readonly dependencies: readonly string[];
 }
 
+interface GitHubAuthProfile {
+  readonly name: string;
+  readonly secret: string;
+  readonly kind: 'github';
+  readonly dependencies: readonly string[];
+}
+
 interface AuthProfiles {
   readonly profiles: ReadonlyMap<string, AuthProfile>;
   readonly errors: readonly string[];
@@ -78,15 +88,33 @@ function parseAuthProfile(name: string, entry: unknown): AuthProfile | string {
   const header = entry['header'];
   const scheme = entry['scheme'];
   const dependencies = entry['dependencies'];
+  const kind = entry['kind'] ?? 'custom';
 
-  if (entry['kind'] !== undefined && entry['kind'] !== 'custom') {
-    return 'kind must be custom, the one kind atc binds';
+  if (kind !== 'custom' && kind !== 'github') {
+    return 'kind must be custom or github, the kinds atc binds';
   }
 
   if (typeof secret !== 'string' || !SECRET_NAME.test(secret)) {
     return 'secret must be a lowercase letter followed by up to 30 lowercase letters, digits or hyphens';
   }
 
+  if (
+    dependencies !== undefined &&
+    (!Array.isArray(dependencies) || !dependencies.every((dep) => typeof dep === 'string'))
+  ) {
+    return 'dependencies must be an array of profile names';
+  }
+
+  if (kind === 'github') {
+    const extra = ['host', 'header', 'scheme', 'user'].find((key) => entry[key] !== undefined);
+
+    if (extra !== undefined) {
+      return `${extra} cannot be set on a github profile, whose hosts and headers impd's github kind fixes`;
+    }
+
+    return { name, secret, kind, dependencies: dependencies ?? [] };
+  }
+
   if (typeof host !== 'string' || host.length > BROKER_HOST_MAX || !BROKER_HOST.test(host)) {
     return 'host must be a lowercase hostname such as api.example.com';
   }
@@ -103,13 +131,6 @@ function parseAuthProfile(name: string, entry: unknown): AuthProfile | string {
     return 'user pairs only with the basic scheme, which atc does not bind';
   }
 
-  if (
-    dependencies !== undefined &&
-    (!Array.isArray(dependencies) || !dependencies.every((dep) => typeof dep === 'string'))
-  ) {
-    return 'dependencies must be an array of profile names';
-  }
-
   return {
     name,
     secret,

package/src/shared/resolve-auth-profiles.ts

@@ -1,12 +1,14 @@
 import type { AuthProfile } from './collect-auth-profiles';
 
 /**
- * How impd applies one secret to requests for one host.
+ * How impd applies one secret to requests for one host. Only a basic rule
+ * holds a user.
  */
 interface AuthRule {
   readonly host: string;
   readonly header: string;
-  readonly scheme: 'bearer';
+  readonly scheme: 'basic' | 'bearer';
+  readonly user?: string;
 }
 
 /**
@@ -15,7 +17,7 @@ interface AuthRule {
  */
 export interface ResolvedAuthSecret {
   readonly secret: string;
-  readonly kind: 'custom';
+  readonly kind: AuthProfile['kind'];
   readonly rules: readonly AuthRule[];
 }
 
@@ -49,11 +51,18 @@ export type AuthProfileResolution =
   | { readonly resolved: ResolvedAuthProfiles }
   | { readonly problem: AuthProfileProblem };
 
+// One rule of a profile, with the profile it came from.
+interface ProfileRule {
+  readonly profile: AuthProfile;
+  readonly rule: AuthRule;
+}
+
 /**
  * Expands the selected profiles through their dependencies, then checks
  * the whole expanded set: each host must get exactly one rule, so a
- * credential is never picked by order. Two profiles holding the identical
- * secret and rule for a host merge into one rule.
+ * credential is never picked by order, and each secret one kind. Two
+ * profiles holding the identical secret and rule for a host merge into one
+ * rule.
  */
 export function resolveAuthProfiles(
   profiles: ReadonlyMap<string, AuthProfile>,
@@ -73,21 +82,37 @@ export function resolveAuthProfiles(
 
   const ordered = [...reached.values()].toSorted((a, b) => (a.name < b.name ? -1 : 1));
 
-  const byHost = new Map<string, AuthProfile>();
+  const byHost = new Map<string, ProfileRule>();
+  const kinds = new Map<string, AuthProfile>();
 
   for (const profile of ordered) {
-    const other = byHost.get(profile.host);
+    const kindOwner = kinds.get(profile.secret);
 
-    if (other === undefined) {
-      byHost.set(profile.host, profile);
-    } else if (!hasSameRule(other, profile)) {
+    if (kindOwner === undefined) {
+      kinds.set(profile.secret, profile);
+    } else if (kindOwner.kind !== profile.kind) {
       return {
         problem: {
           code: 'auth_collision',
-          message: `profiles ${other.name} and ${profile.name} both send a credential to ${profile.host}`,
+          message: `profiles ${kindOwner.name} and ${profile.name} bind secret ${profile.secret} as different kinds`,
         },
       };
     }
+
+    for (const rule of getProfileRules(profile)) {
+      const other = byHost.get(rule.host);
+
+      if (other === undefined) {
+        byHost.set(rule.host, { profile, rule });
+      } else if (!hasSameRule(other, { profile, rule })) {
+        return {
+          problem: {
+            code: 'auth_collision',
+            message: `profiles ${other.profile.name} and ${profile.name} both send a credential to ${rule.host}`,
+          },
+        };
+      }
+    }
   }
 
   return {
@@ -156,31 +181,50 @@ function isAuthProfileProblem(
   return 'code' in value;
 }
 
-function hasSameRule(left: AuthProfile, right: AuthProfile): boolean {
+// The rules impd's github kind applies: git over HTTPS on github.com takes
+// Basic auth for x-access-token, and the REST and upload APIs take a bearer
+// token.
+const GITHUB_RULES: readonly AuthRule[] = [
+  { host: 'api.github.com', header: 'authorization', scheme: 'bearer' },
+  { host: 'github.com', header: 'authorization', scheme: 'basic', user: 'x-access-token' },
+  { host: 'uploads.github.com', header: 'authorization', scheme: 'bearer' },
+];
+
+// The rules impd holds for a profile's secret on the hosts it covers.
+function getProfileRules(profile: AuthProfile): readonly AuthRule[] {
+  if (profile.kind === 'github') {
+    return GITHUB_RULES;
+  }
+
+  return [{ host: profile.host, header: profile.header, scheme: profile.scheme }];
+}
+
+function hasSameRule(left: ProfileRule, right: ProfileRule): boolean {
   return (
-    left.secret === right.secret &&
-    left.header === right.header &&
-    left.scheme === right.scheme &&
-    left.kind === right.kind
+    left.profile.secret === right.profile.secret &&
+    left.profile.kind === right.profile.kind &&
+    left.rule.header === right.rule.header &&
+    left.rule.scheme === right.rule.scheme &&
+    left.rule.user === right.rule.user
   );
 }
 
 // One entry per secret, sorted by secret, each with its rules sorted by host.
-function buildSecrets(profiles: readonly AuthProfile[]): ResolvedAuthSecret[] {
-  const rules = new Map<string, AuthRule[]>();
+function buildSecrets(entries: readonly ProfileRule[]): ResolvedAuthSecret[] {
+  const bySecret = new Map<string, { kind: AuthProfile['kind']; rules: AuthRule[] }>();
 
-  for (const profile of profiles) {
-    const list = rules.get(profile.secret) ?? [];
+  for (const item of entries) {
+    const entry = bySecret.get(item.profile.secret) ?? { kind: item.profile.kind, rules: [] };
 
-    list.push({ host: profile.host, header: profile.header, scheme: profile.scheme });
-    rules.set(profile.secret, list);
+    entry.rules.push(item.rule);
+    bySecret.set(item.profile.secret, entry);
   }
 
-  return [...rules.entries()]
+  return [...bySecret.entries()]
     .toSorted(([a], [b]) => (a < b ? -1 : 1))
-    .map(([secret, list]) => ({
+    .map(([secret, entry]) => ({
       secret,
-      kind: 'custom',
-      rules: list.toSorted((a, b) => (a.host < b.host ? -1 : 1)),
+      kind: entry.kind,
+      rules: entry.rules.toSorted((a, b) => (a.host < b.host ? -1 : 1)),
     }));
 }