hammerkit 1.27.0-next.29 → 1.27.0-next.30

package/dist/server/endpoints.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ownPath = exports.EndpointGateway = exports.LOGIN_HOST = void 0;
+exports.ownPath = exports.returnPath = exports.EndpointGateway = exports.LOGIN_HOST = void 0;
 const crypto_1 = require("crypto");
 const promises_1 = require("fs/promises");
 const http_1 = require("http");
@@ -15,6 +15,18 @@ const units_1 = require("../utils/units");
 // interface, for testing) goes without the prefix.
 const SESSION_COOKIE = '__Host-hammerkit-session';
 const PLAIN_SESSION_COOKIE = 'hammerkit-session';
+// The cookie of a sign-in under way, on the login host, one per sign-in (by its state): the
+// browser keeps what the callback needs, so a caller who is not signed in fills no table of
+// the server's.
+const LOGIN_COOKIE = '__Host-hammerkit-login-';
+const PLAIN_LOGIN_COOKIE = 'hammerkit-login-';
+// The cookie of the endpoint host that a sign-in started from, which the one-time code that
+// comes back has to match: a code is for the browser that asked for it, not one it is sent to.
+const BIND_COOKIE = '__Host-hammerkit-bind-';
+const PLAIN_BIND_COOKIE = 'hammerkit-bind-';
+// the most of the page to go back to that a sign-in keeps: its cookie stays below what a
+// browser takes (4096 bytes for name and value)
+const MAX_RETURN_PATH = 1024;
 // the host of the domain that signs people in, the one redirect URI registered at the issuer
 exports.LOGIN_HOST = 'login';
 // the paths of an endpoint host that are the server's, never the app's
@@ -22,7 +34,9 @@ const OWN_PATH = '/.hammerkit/';
 // how long a sign-in may take at the issuer, and how long its one-time code holds
 const LOGIN_TIMEOUT_MS = 10 * 60 * 1000;
 const CODE_TIMEOUT_MS = 60 * 1000;
-const MAX_PENDING_LOGINS = 1000;
+// the states of sign-ins that came back, so one is taken once; the oldest goes first when
+// there are more, then only the issuer's one-time code holds
+const MAX_SPENT_LOGINS = 10000;
 const DISCOVERY_TTL_MS = 10 * 60 * 1000;
 const FETCH_TIMEOUT_MS = 10000;
 /**
@@ -37,7 +51,8 @@ class EndpointGateway {
         this.config = config;
         this.registry = registry;
         this.options = options;
-        this.pending = new Map();
+        // the state of each sign-in that came back, until it would have expired
+        this.spent = new Map();
         this.codes = new Map();
         this.base = { scheme: 'https', port: '' };
         this.fetcher = options.fetch ?? fetch;
@@ -105,11 +120,17 @@ class EndpointGateway {
         }
         const principal = await this.caller(label, req);
         if (!principal) {
-            if (this.loginVerifier && req.method === 'GET' && acceptsHtml(req.headers)) {
+            if (this.loginVerifier && req.method === 'GET' && acceptsHtml(req.headers) && isPageLoad(req.headers)) {
+                const bind = (0, crypto_1.randomBytes)(18).toString('base64url');
                 const start = new URL(this.url(exports.LOGIN_HOST, '/start'));
                 start.searchParams.set('host', label);
                 start.searchParams.set('path', url.pathname + url.search);
-                res.writeHead(302, { location: start.toString(), 'cache-control': 'no-store' });
+                start.searchParams.set('bind', bind);
+                res.writeHead(302, {
+                    location: start.toString(),
+                    'set-cookie': this.cookie(this.bindCookieName(bind), bind, LOGIN_TIMEOUT_MS),
+                    'cache-control': 'no-store',
+                });
                 res.end();
                 return;
             }
@@ -359,24 +380,31 @@ ${run.state === 'up'
         if (url.pathname === '/start') {
             const host = url.searchParams.get('host') ?? '';
             const path = url.searchParams.get('path') ?? '/';
+            const bind = url.searchParams.get('bind') ?? '';
             if (!/^[a-z0-9-]+$/.test(host) || host === exports.LOGIN_HOST || !this.registry.endpoint(host)) {
                 return page(res, 404, 'Not found', '<p>There is no endpoint at this address.</p>');
             }
-            const endpoints = await this.endpointsOf(login.issuer);
-            this.sweep();
-            if (this.pending.size >= MAX_PENDING_LOGINS) {
-                return page(res, 503, 'Busy', '<p>Too many sign-ins at once, try again in a minute.</p>');
+            if (!BIND_PATTERN.test(bind)) {
+                return page(res, 400, 'Not signed in', '<p>Open the endpoint to sign in.</p>');
+            }
+            // a sign-in starts when a person goes to it, not from a request of a page, which could
+            // pile up cookies of sign-ins in their browser
+            if (req.headers['sec-fetch-mode'] !== undefined && req.headers['sec-fetch-mode'] !== 'navigate') {
+                return page(res, 403, 'Not allowed', '<p>Open the endpoint to sign in.</p>');
             }
+            const endpoints = await this.endpointsOf(login.issuer);
             const state = (0, crypto_1.randomBytes)(24).toString('base64url');
             const verifier = (0, crypto_1.randomBytes)(32).toString('base64url');
             const nonce = (0, crypto_1.randomBytes)(24).toString('base64url');
-            this.pending.set(state, {
+            const pending = {
+                state,
+                bind,
                 host,
-                path: ownPath(path),
+                path: returnPath(path),
                 verifier,
                 nonce,
                 expires: this.now() + LOGIN_TIMEOUT_MS,
-            });
+            };
             const authorize = new URL(endpoints.authorize);
             authorize.searchParams.set('response_type', 'code');
             authorize.searchParams.set('client_id', login.clientId);
@@ -386,22 +414,28 @@ ${run.state === 'up'
             authorize.searchParams.set('nonce', nonce);
             authorize.searchParams.set('code_challenge', (0, crypto_1.createHash)('sha256').update(verifier).digest('base64url'));
             authorize.searchParams.set('code_challenge_method', 'S256');
-            res.writeHead(302, { location: authorize.toString(), 'cache-control': 'no-store' });
+            res.writeHead(302, {
+                location: authorize.toString(),
+                'set-cookie': this.loginCookie(pending),
+                'cache-control': 'no-store',
+            });
             res.end();
             return;
         }
         if (url.pathname === '/callback') {
             const state = url.searchParams.get('state') ?? '';
-            const pending = this.pending.get(state);
-            this.pending.delete(state);
-            if (!pending || pending.expires < this.now()) {
-                return page(res, 400, 'Sign-in expired', '<p>The sign-in took too long or was used already, open the endpoint again.</p>');
+            const pending = this.readLogin(state, req.headers.cookie);
+            if (pending) {
+                res.setHeader('set-cookie', this.clearLoginCookie(state));
             }
             const code = url.searchParams.get('code');
-            if (!code) {
+            if (pending && !code) {
                 const error = url.searchParams.get('error') ?? 'no code';
                 return page(res, 400, 'Not signed in', `<p>The sign-in did not succeed: ${escape(error.slice(0, 200))}.</p>`);
             }
+            if (!pending || !code || !this.spend(pending)) {
+                return page(res, 400, 'Sign-in expired', '<p>The sign-in took too long or was used already, open the endpoint again.</p>');
+            }
             let principal;
             try {
                 principal = await this.exchange(code, pending);
@@ -417,6 +451,7 @@ ${run.state === 'up'
             }
             const issued = (0, crypto_1.randomBytes)(24).toString('base64url');
             this.codes.set(issued, {
+                bind: pending.bind,
                 host: pending.host,
                 path: pending.path,
                 principal,
@@ -432,6 +467,61 @@ ${run.state === 'up'
         return page(res, 404, 'Not found', '<p>There is nothing here.</p>');
     }
     // The code of the issuer for its tokens, and the ID token for who signed in.
+    // A sign-in comes back once: its state is kept as spent until it would have expired. Past
+    // MAX_SPENT_LOGINS the oldest are forgotten, which anybody can bring about with sign-ins of
+    // their own; a state forgotten that way still needs its cookie and a code the issuer takes
+    // a second time, which it doesn't (codes of the authorization code flow are one-time).
+    spend(pending) {
+        const now = this.now();
+        if (pending.expires < now || this.spent.has(pending.state)) {
+            return false;
+        }
+        this.sweep();
+        while (this.spent.size >= MAX_SPENT_LOGINS) {
+            const oldest = this.spent.keys().next().value;
+            this.spent.delete(oldest);
+        }
+        this.spent.set(pending.state, pending.expires);
+        return true;
+    }
+    loginCookieName(state) {
+        // the state is base64url, which a cookie name may carry
+        return `${this.base.scheme === 'https' ? LOGIN_COOKIE : PLAIN_LOGIN_COOKIE}${state.slice(0, 16)}`;
+    }
+    bindCookieName(bind) {
+        return `${this.base.scheme === 'https' ? BIND_COOKIE : PLAIN_BIND_COOKIE}${bind.slice(0, 16)}`;
+    }
+    // A cookie of the host the request is for (no Domain), for so long; 0 clears it.
+    cookie(name, value, ms) {
+        return `${name}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${Math.max(0, Math.floor(ms / 1000))}${this.base.scheme === 'https' ? '; Secure' : ''}`;
+    }
+    loginCookie(pending) {
+        const payload = Buffer.from(JSON.stringify(pending)).toString('base64url');
+        return this.cookie(this.loginCookieName(pending.state), `${payload}.${this.sign(`login\0${payload}`)}`, LOGIN_TIMEOUT_MS);
+    }
+    clearLoginCookie(state) {
+        return this.cookie(this.loginCookieName(state), '', 0);
+    }
+    // The sign-in of this state, from its cookie, when the server signed it.
+    readLogin(state, header) {
+        if (!/^[A-Za-z0-9_-]{32}$/.test(state)) {
+            return null;
+        }
+        const value = readCookie(header, this.loginCookieName(state));
+        const [payload, signature] = (value ?? '').split('.');
+        if (!payload || !signature || !safeEqual(signature, this.sign(`login\0${payload}`))) {
+            return null;
+        }
+        try {
+            const pending = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+            return pending.state === state && typeof pending.verifier === 'string' && typeof pending.bind === 'string'
+                ? pending
+                : null;
+        }
+        catch {
+            return null;
+        }
+    }
     async exchange(code, pending) {
         const login = this.config.endpoints?.login;
         if (!login || !this.loginVerifier) {
@@ -484,23 +574,35 @@ ${run.state === 'up'
         const code = url.searchParams.get('code') ?? '';
         const issued = this.codes.get(code);
         this.codes.delete(code);
-        if (!issued || issued.host !== label || issued.expires < this.now()) {
+        const bind = issued ? readCookie(req.headers.cookie, this.bindCookieName(issued.bind)) : undefined;
+        if (issued) {
+            res.setHeader('set-cookie', this.cookie(this.bindCookieName(issued.bind), '', 0));
+        }
+        if (!issued ||
+            issued.host !== label ||
+            issued.expires < this.now() ||
+            // the browser that started the sign-in at this host, no other one the link was sent to
+            !bind ||
+            !safeEqual(bind, issued.bind)) {
             return page(res, 400, 'Sign-in expired', '<p>The sign-in took too long or was used already, open the endpoint again.</p>');
         }
         const found = this.registry.endpoint(label);
         const ends = Date.parse(found?.run.expiresAt ?? '');
-        const session = this.now() + (0, units_1.parseDuration)(this.config.endpoints?.session ?? '8h');
+        const session = this.now() + (0, units_1.parseDuration)(this.config.endpoints?.session ?? '1h');
         const exp = Number.isFinite(ends) ? Math.min(session, Math.max(ends, this.now() + LOGIN_TIMEOUT_MS)) : session;
         res.writeHead(303, {
             location: issued.path,
-            'set-cookie': this.sessionCookie({
-                host: label,
-                iss: issued.principal.iss,
-                sub: issued.principal.sub,
-                groups: issued.principal.groups,
-                claims: this.matchedClaims(issued.principal),
-                exp,
-            }),
+            'set-cookie': [
+                this.cookie(this.bindCookieName(issued.bind), '', 0),
+                this.sessionCookie({
+                    host: label,
+                    iss: issued.principal.iss,
+                    sub: issued.principal.sub,
+                    groups: issued.principal.groups,
+                    claims: this.matchedClaims(issued.principal),
+                    exp,
+                }),
+            ],
             'cache-control': 'no-store',
         });
         res.end();
@@ -523,11 +625,7 @@ ${run.state === 'up'
         return `${this.cookieName()}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${this.base.scheme === 'https' ? '; Secure' : ''}`;
     }
     readSession(label, header) {
-        const name = this.cookieName();
-        const value = (header ?? '')
-            .split(/;\s*/)
-            .find((cookie) => cookie.startsWith(`${name}=`))
-            ?.slice(name.length + 1);
+        const value = readCookie(header, this.cookieName());
         const [payload, signature] = (value ?? '').split('.');
         if (!payload || !signature || !safeEqual(signature, this.sign(payload))) {
             return null;
@@ -555,9 +653,9 @@ ${run.state === 'up'
     }
     sweep() {
         const now = this.now();
-        for (const [state, login] of this.pending) {
-            if (login.expires < now) {
-                this.pending.delete(state);
+        for (const [state, expires] of this.spent) {
+            if (expires < now) {
+                this.spent.delete(state);
             }
         }
         for (const [code, issued] of this.codes) {
@@ -568,11 +666,37 @@ ${run.state === 'up'
     }
 }
 exports.EndpointGateway = EndpointGateway;
+const BIND_PATTERN = /^[A-Za-z0-9_-]{24}$/;
+// The page a sign-in goes back to: a path of its own host, and only the path when the query
+// is too long for the cookie of the sign-in.
+function returnPath(path) {
+    const own = ownPath(path);
+    if (own.length <= MAX_RETURN_PATH) {
+        return own;
+    }
+    const pathname = own.split('?')[0];
+    return pathname.length <= MAX_RETURN_PATH ? pathname : '/';
+}
+exports.returnPath = returnPath;
+function readCookie(header, name) {
+    return (header ?? '')
+        .split(/;\s*/)
+        .find((cookie) => cookie.startsWith(`${name}=`))
+        ?.slice(name.length + 1);
+}
 function safeEqual(a, b) {
     const left = Buffer.from(a);
     const right = Buffer.from(b);
     return left.length === right.length && (0, crypto_1.timingSafeEqual)(left, right);
 }
+// Whether the browser loads a page of its own, which a sign-in can go through: not a request
+// of a page (fetch, htmx, a frame), which would only pile up cookies of sign-ins. Without
+// Sec-Fetch-*, an older browser or another client, by its Accept alone.
+function isPageLoad(headers) {
+    const mode = headers['sec-fetch-mode'];
+    const dest = headers['sec-fetch-dest'];
+    return (mode === undefined || mode === 'navigate') && (dest === undefined || dest === 'document');
+}
 function acceptsHtml(headers) {
     return (headers.accept ?? '').includes('text/html');
 }

package/dist/server/server-config.js

@@ -615,8 +615,9 @@ exports.serverConfigSchema = zod_1.z
         })
             .strict()
             .optional(),
-        // how long a sign-in at one endpoint lasts, at most until its run ends
-        session: duration.default('8h'),
+        // how long a sign-in at one endpoint lasts, at most until its run ends: the groups and
+        // claims of the sign-in hold that long, a change at the issuer counts at the next one
+        session: duration.default('1h'),
     })
         .strict()
         .optional(),
@@ -930,6 +931,15 @@ exports.serverConfigSchema = zod_1.z
                 });
             }
         }
+        // only the server is to reach the services behind endpoints, which the NetworkPolicy of
+        // a service run says: without it, any pod of the cluster would get past the sign-in
+        if (backend.type === 'kubernetes' && backend.networkPolicy !== 'enforced') {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['backend', 'networkPolicy'],
+                message: 'endpoints keep the services of a run to the server with a NetworkPolicy, set networkPolicy: enforced once the network plugin of the cluster enforces them',
+            });
+        }
         if (backend.type === 'kubernetes' && backend.kubeconfig) {
             ctx.addIssue({
                 code: zod_1.z.ZodIssueCode.custom,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.27.0-next.29",
+  "version": "1.27.0-next.30",
   "keywords": [
     "build",
     "build-tool",