anbaric-cloud-hosting 1.63.0 → 1.64.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.63.0",
+  "version": "1.64.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,18 +18,18 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.63.0",
-    "anbaric-plugins": "^1.63.0",
-    "anbaric-tsapi": "^1.63.0",
-    "anbaric-web": "^1.63.0",
+    "anbaric-data-store": "^1.64.0",
+    "anbaric-plugins": "^1.64.0",
+    "anbaric-tsapi": "^1.64.0",
+    "anbaric-web": "^1.64.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.63.0",
-    "anbaric-state-machine": "^1.63.0",
+    "anbaric-impl-cloud": "^1.64.0",
+    "anbaric-state-machine": "^1.64.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/auth/Authenticator.ts

@@ -4,6 +4,15 @@ import {User} from "./User";
 
 const SESSION_COOKIE = "anbaric_session";
 
+/* The identity cookie: who this person is, as the central login proved it,
+   set for the whole domain and never overwritten by a tenant platform. A
+   platform's own session cookie is bound to that platform - signed with its
+   secret - so moving between tenants invalidates it every time; this one is
+   bound to the person, and is what a platform falls back to before sending
+   anyone through the login again. Mirrors CENTRAL_SESSION_COOKIE in
+   anbaric-cloud-central; keep the two in step. */
+const IDENTITY_COOKIE = "anbaric_central_session";
+
 abstract class Authenticator {
 
     abstract authenticate(session : string | undefined, request : IncomingMessage,
@@ -30,4 +39,4 @@ abstract class Authenticator {
 
 }
 
-export { Authenticator, SESSION_COOKIE }
+export { Authenticator, SESSION_COOKIE, IDENTITY_COOKIE }

package/src/hosting/Request.ts

@@ -12,6 +12,8 @@ class Request {
 
     readonly rayId : string;
     session? : string;
+    // The identity cookie from the central login, when the browser holds one.
+    identity? : string;
     user? : User;
     tenant? : Tenant;
 

package/src/hosting/middleware/AuthenticationMiddleware.ts

@@ -71,7 +71,12 @@ class AuthenticationMiddleware implements Middleware {
 
         if (!this.authenticator) return true;
 
-        const authenticated = await this.authenticator.authenticate(request.session, request.raw, request.rawResponse);
+        /* No session this platform can verify. Before sending anyone back
+           through the login, offer the authenticator the identity cookie the
+           central login set for the whole domain: a person arriving from
+           another tenant carries that tenant's session, which this platform
+           cannot read, but their identity is the same and still proven. */
+        const authenticated = await this.authenticator.authenticate(request.identity ?? request.session, request.raw, request.rawResponse);
         if (!authenticated) return false;
 
         [request.user, request.tenant] = authenticated;

package/src/hosting/middleware/SessionMiddleware.ts

@@ -1,17 +1,18 @@
-import {SESSION_COOKIE} from "../../auth/Authenticator";
+import {IDENTITY_COOKIE, SESSION_COOKIE} from "../../auth/Authenticator";
 import {Middleware} from "../Middleware";
 import {Request} from "../Request";
 
+/* Lifts the two cookies authentication cares about off the request: this
+   platform's own session, and the identity the central login proved. The
+   first of each name wins, which is what a browser sends first. */
 class SessionMiddleware implements Middleware {
 
     async apply(request : Request) : Promise<boolean> {
         const cookies = String(request.header("cookie") ?? "").split(";");
         for (const cookie of cookies) {
             const [name, ...value] = cookie.trim().split("=");
-            if (name === SESSION_COOKIE) {
-                request.session = value.join("=");
-                break;
-            }
+            if (name === SESSION_COOKIE && request.session === undefined) request.session = value.join("=");
+            if (name === IDENTITY_COOKIE && request.identity === undefined) request.identity = value.join("=");
         }
         return true;
     }