create-safest-tools 0.2.0

package/template/src/report-auth.ts

@@ -0,0 +1,292 @@
+import { createRemoteJWKSet, decodeJwt, jwtVerify, type JWTPayload } from "jose";
+import { ApiError } from "./report-http";
+import { secretsEqual, sha256 } from "./report-crypto";
+import {
+  permissionsForRoles,
+  resolveBetterAuthOperator,
+  resolveOperatorAccountSession,
+  verifyOperatorCsrf,
+} from "./report-operator-accounts";
+import {
+  appendBetterAuthCsrfCookie,
+  betterAuthCsrfHash,
+  betterAuthCsrfToken,
+  invitationIdFromRequest,
+  resolveBetterAuthSession,
+} from "./report-better-auth";
+import { loadIntegration } from "./report-repository";
+import type { OperatorPermissions, OperatorSession } from "./report-types";
+
+type AccessIdentity = JWTPayload & {
+  email?: unknown;
+  name?: unknown;
+  picture?: unknown;
+  user_uuid?: unknown;
+  groups?: unknown;
+  custom?: unknown;
+};
+type AccessContext = Pick<ExecutionContext, "access">;
+
+const accessKeySets = new Map<string, ReturnType<typeof createRemoteJWKSet>>();
+function bounded(value: unknown, maximum: number): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const normalized = value.trim();
+  return normalized ? normalized.slice(0, maximum) : undefined;
+}
+
+function avatarUrl(value: unknown): string | undefined {
+  const candidate = bounded(value, 2_048);
+  if (!candidate) return undefined;
+  try {
+    const url = new URL(candidate);
+    return url.protocol === "https:" && !url.username && !url.password ? url.href : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function issuer(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && !url.username && !url.password && !url.port
+      && (url.pathname === "/" || url.pathname === "") && !url.search && !url.hash
+      && url.hostname.endsWith(".cloudflareaccess.com")
+      ? url.origin
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+async function accessIdentity(request: Request, env: Env, ctx: AccessContext): Promise<AccessIdentity | null> {
+  if (ctx.access) {
+    try {
+      return await ctx.access.getIdentity() as AccessIdentity;
+    } catch (error) {
+      console.warn("Cloudflare Access runtime identity was unavailable", error instanceof Error ? error.message : typeof error);
+    }
+  }
+  const token = request.headers.get("cf-access-jwt-assertion");
+  const audience = bounded(env.ACCESS_AUD, 200);
+  if (!token || !audience) return null;
+  try {
+    const tokenIssuer = issuer(decodeJwt(token).iss);
+    if (!tokenIssuer) return null;
+    let keySet = accessKeySets.get(tokenIssuer);
+    if (!keySet) {
+      keySet = createRemoteJWKSet(new URL("/cdn-cgi/access/certs", tokenIssuer));
+      accessKeySets.set(tokenIssuer, keySet);
+    }
+    const { payload } = await jwtVerify(token, keySet, {
+      algorithms: ["RS256"], audience, issuer: tokenIssuer,
+    });
+    return payload as AccessIdentity;
+  } catch (error) {
+    console.warn("Cloudflare Access JWT validation failed", error instanceof Error ? error.message : typeof error);
+    return null;
+  }
+}
+
+export async function resolveOperatorSession(request: Request, env: Env): Promise<OperatorSession | null> {
+  return (await resolveOperatorAuthentication(request, env))?.session ?? null;
+}
+
+interface ResolvedOperatorAuthentication {
+  session: OperatorSession;
+  csrfHash?: string;
+  csrfToken?: string;
+  expiresAt?: Date;
+}
+
+export async function resolveOperatorAuthentication(
+  request: Request,
+  env: Env,
+): Promise<ResolvedOperatorAuthentication | null> {
+  const ownerSession = await resolveOperatorAccountSession(request, env.DB);
+  if (ownerSession) return { session: ownerSession.session, csrfHash: ownerSession.csrfHash };
+  const better = await resolveBetterAuthSession(request, env);
+  if (better) {
+    const session = await resolveBetterAuthOperator(env.DB, {
+      email: better.user.email,
+      name: better.user.name,
+      image: better.user.image,
+    }, await invitationIdFromRequest(request, env));
+    if (session) {
+      const csrfToken = await betterAuthCsrfToken(env, better.session.id);
+      return {
+        session,
+        csrfHash: await betterAuthCsrfHash(csrfToken),
+        csrfToken,
+        expiresAt: better.session.expiresAt,
+      };
+    }
+  }
+  const adminKey = request.headers.get("x-admin-key");
+  if (adminKey && env.ADMIN_API_KEY && await secretsEqual(adminKey, env.ADMIN_API_KEY)) {
+    return { session: {
+        actor: { type: "admin_key", id: "deployment-owner" },
+        authMethod: "admin_key",
+        verified: false,
+        displayName: "Deployment owner",
+        roles: ["owner"],
+        permissions: permissionsForRoles(["owner"]),
+        queueScope: null,
+        fieldScope: null,
+      } };
+  }
+  return null;
+}
+
+export function appendOperatorAuthenticationCookies(
+  response: Response,
+  request: Request,
+  authentication: ResolvedOperatorAuthentication,
+): Response {
+  return authentication.csrfToken && authentication.expiresAt
+    ? appendBetterAuthCsrfCookie(response, request, authentication.csrfToken, authentication.expiresAt)
+    : response;
+}
+
+export async function resolveInfrastructureOwnerIdentity(
+  request: Request,
+  env: Env,
+  ctx: AccessContext,
+): Promise<{ email: string; displayName: string; avatarUrl?: string } | null> {
+  const identity = await accessIdentity(request, env, ctx);
+  if (!identity) return null;
+  const email = bounded(identity.email, 254)?.toLowerCase();
+  if (!email) return null;
+  const allowedOwners = new Set((env.INFRASTRUCTURE_OWNER_EMAILS ?? "").split(",")
+    .map((value) => value.trim().toLowerCase()).filter(Boolean));
+  if (!allowedOwners.has(email)) return null;
+  const picture = avatarUrl(identity.picture);
+  return {
+    email,
+    displayName: bounded(identity.name, 100) ?? email,
+    ...(picture ? { avatarUrl: picture } : {}),
+  };
+}
+
+export async function requireOperator(
+  request: Request,
+  env: Env,
+  permission: keyof OperatorPermissions,
+): Promise<OperatorSession> {
+  const authentication = await resolveOperatorAuthentication(request, env);
+  const session = authentication?.session;
+  if (!session) throw new ApiError(401, "operator_authentication_required", "Sign in to your Safest workspace to continue.");
+  if (authentication.csrfHash) await verifyOperatorCsrf(request, authentication.csrfHash);
+  if (!session.permissions[permission]) throw new ApiError(403, "operator_permission_denied", "Your role does not permit this operation.");
+  return session;
+}
+
+export function assertOperatorQueueAccess(session: OperatorSession, queueId: string | null): void {
+  if (session.queueScope === null || session.queueScope === undefined) return;
+  if (!queueId || !session.queueScope.includes(queueId)) throw new ApiError(403, "operator_queue_scope_denied", "Your role is not authorized for this queue.");
+}
+
+export async function assertOperatorReportAccess(
+  db: D1Database,
+  session: OperatorSession,
+  reportId: string,
+): Promise<void> {
+  if (session.queueScope === null || session.queueScope === undefined) return;
+  const report = await db.prepare(`SELECT queue_id AS queueId FROM reports WHERE id = ?1 LIMIT 1`)
+    .bind(reportId).first<{ queueId: string | null }>();
+  if (!report) throw new ApiError(404, "report_not_found", "The report does not exist.");
+  assertOperatorQueueAccess(session, report.queueId);
+}
+
+export async function assertOperatorWorkflowRunAccess(
+  db: D1Database,
+  session: OperatorSession,
+  runId: string,
+): Promise<void> {
+  if (session.queueScope === null || session.queueScope === undefined) return;
+  const run = await db.prepare(`SELECT queue_id AS queueId FROM workflow_runs WHERE id = ?1 LIMIT 1`)
+    .bind(runId).first<{ queueId: string | null }>();
+  if (!run) throw new ApiError(404, "workflow_run_not_found", "The workflow run does not exist.");
+  assertOperatorQueueAccess(session, run.queueId);
+}
+
+export function projectOperatorFields<T>(session: OperatorSession, resource: string, value: T): T {
+  if (session.fieldScope === null || session.fieldScope === undefined) return value;
+  const allowed = new Set(session.fieldScope[resource] ?? []);
+  const project = (entry: unknown): unknown => {
+    if (Array.isArray(entry)) return entry.map(project);
+    if (!entry || typeof entry !== "object") return entry;
+    return Object.fromEntries(Object.entries(entry as Record<string, unknown>).filter(([key]) => allowed.has(key)));
+  };
+  return project(value) as T;
+}
+
+function bearer(request: Request): string | null {
+  const authorization = request.headers.get("authorization") ?? "";
+  const match = /^Bearer\s+([^\s]+)$/iu.exec(authorization);
+  return match?.[1] ?? null;
+}
+
+export async function requireIntegration(request: Request, env: Env): Promise<{
+  id: string;
+  allowedOrigins: string[];
+  scopes: string[];
+  channelMode: "contextual" | "anonymous";
+  formVersionId: string | null;
+  contextSchema: unknown;
+}> {
+  const integrationId = request.headers.get("x-safest-integration-id")?.trim();
+  const suppliedKey = bearer(request);
+  if (!integrationId || integrationId.length > 200 || !suppliedKey || suppliedKey.length > 500) {
+    throw new ApiError(401, "integration_authentication_required", "A valid integration ID and bearer credential are required.");
+  }
+  let configured: unknown = {};
+  let environmentConfigurationValid = true;
+  try {
+    configured = JSON.parse(env.INTEGRATION_API_KEYS_JSON ?? "{}");
+  } catch {
+    environmentConfigurationValid = false;
+  }
+  if (!configured || typeof configured !== "object" || Array.isArray(configured)) {
+    configured = {};
+    environmentConfigurationValid = false;
+  }
+  const integration = await loadIntegration(env.DB, integrationId);
+  const expectedKey = integration ? (configured as Record<string, unknown>)[integration.key_id] : undefined;
+  const managedKey = integration ? await env.DB.prepare(`
+    SELECT key_hash AS keyHash FROM integration_api_keys
+    WHERE integration_id = ?1 AND status = 'active' AND valid_from <= ?2
+      AND (expires_at IS NULL OR expires_at > ?2)
+    ORDER BY created_at DESC, id DESC
+  `).bind(integration.id, new Date().toISOString()).all<{ keyHash: string }>() : { results: [] as { keyHash: string }[] };
+  const suppliedHash = await sha256(`integration-key-v1:${suppliedKey}`);
+  const managedValid = (await Promise.all(managedKey.results.map((entry) => secretsEqual(suppliedHash, entry.keyHash)))).some(Boolean);
+  const environmentValid = typeof expectedKey === "string" && expectedKey.length >= 16 && await secretsEqual(suppliedKey, expectedKey);
+  const valid = managedValid || environmentValid;
+  if (!integration || integration.enabled !== 1 || !valid) {
+    if (integration && !environmentConfigurationValid && managedKey.results.length === 0) {
+      throw new ApiError(503, "integration_credentials_misconfigured", "Integration credentials are not configured correctly.");
+    }
+    throw new ApiError(401, "invalid_integration_credential", "The integration credential is invalid.");
+  }
+  let allowedOrigins: string[] = [];
+  try {
+    const parsed: unknown = JSON.parse(integration.allowed_origins_json);
+    if (Array.isArray(parsed)) allowedOrigins = parsed.filter((value): value is string => typeof value === "string");
+  } catch {
+    allowedOrigins = [];
+  }
+  const scopesRow = await env.DB.prepare(`SELECT scopes_json AS scopesJson FROM application_integrations WHERE id = ?1`).bind(integration.id).first<{ scopesJson: string }>();
+  let scopes: string[] = [];
+  try { const parsed = JSON.parse(scopesRow?.scopesJson ?? "[]"); if (Array.isArray(parsed)) scopes = parsed.filter((entry): entry is string => typeof entry === "string"); } catch { scopes = []; }
+  let contextSchema: unknown = undefined;
+  try { contextSchema = JSON.parse(integration.context_schema_json); } catch { contextSchema = undefined; }
+  return {
+    id: integration.id,
+    allowedOrigins,
+    scopes,
+    channelMode: integration.channel_mode,
+    formVersionId: integration.form_version_id,
+    contextSchema,
+  };
+}