stellarium-ts 0.18.0 → 0.19.0

package/dist/client/runTokens.d.ts

@@ -1,10 +1,12 @@
-import { type JWTVerifyGetKey } from "jose";
+import { type JWTPayload, type JWTVerifyGetKey } from "jose";
 /** The `iss` of every run token. Copied from RUN_TOKEN_ISSUER in apps/operator/src/runs/tokens.ts. */
 export declare const RUN_TOKEN_ISSUER = "stellarium";
 /** Who a run token lets run scripts on this node, and which organization pays. */
 export interface RunTokenClaims {
     clientId: string;
     organizationId: string;
+    /** Every claim of the verified token, which scripts read as the built-in `jwt`. */
+    payload: JWTPayload;
 }
 /** Whether `token` has the three base64url segments of a JWT, as opposed to an API key. */
 export declare function looksLikeJwt(token: string): boolean;

package/dist/client/runTokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runTokens.d.ts","sourceRoot":"","sources":["../../src/client/runTokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,eAAe,EAAa,MAAM,MAAM,CAAC;AAE3E,sGAAsG;AACtG,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CAC1B;AAED,2FAA2F;AAC3F,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;GAGG;AACH,qBAAa,gBAAgB;IAIQ,OAAO,CAAC,QAAQ,CAAC,aAAa;IAH/D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IAEvC,gFAAgF;IAChF,YAAY,WAAW,EAAE,MAAM,EAAmB,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,eAAe,EAG9F;IAED,kHAAkH;IAC5G,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAU/D;CACJ"}
+{"version":3,"file":"runTokens.d.ts","sourceRoot":"","sources":["../../src/client/runTokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,UAAU,EAAE,KAAK,eAAe,EAAa,MAAM,MAAM,CAAC;AAE5F,sGAAsG;AACtG,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,OAAO,EAAE,UAAU,CAAC;CACvB;AAED,2FAA2F;AAC3F,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;GAGG;AACH,qBAAa,gBAAgB;IAIQ,OAAO,CAAC,QAAQ,CAAC,aAAa;IAH/D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IAEvC,gFAAgF;IAChF,YAAY,WAAW,EAAE,MAAM,EAAmB,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,eAAe,EAG9F;IAED,kHAAkH;IAC5G,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAU/D;CACJ"}

package/dist/client/runTokens.js

@@ -25,7 +25,7 @@ export class RunTokenVerifier {
             if (typeof payload.sub !== 'string' || typeof payload.org !== 'string') {
                 return undefined;
             }
-            return { clientId: payload.sub, organizationId: payload.org };
+            return { clientId: payload.sub, organizationId: payload.org, payload };
         }
         catch {
             return undefined;

package/dist/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAgC,MAAM,SAAS,CAAC;AAEhF,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAM1E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAK5C,MAAM,WAAW,eAAe;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;CAC/B;AAED,UAAU,YAAY;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC/B;AAoCD;;;GAGG;AACH,KAAK,SAAS,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAAC,CAAC;AAE3F,OAAO,QAAQ,SAAS,CAAC;IACrB,UAAU,cAAc;QACpB,SAAS,CAAC,EAAE,SAAS,CAAC;KACzB;CACJ;AAkBD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,eAAO,MAAM,aAAa,MAAM,CAAC;AAwKjC;;;;GAIG;AACH,QAAA,MAAM,MAAM,EAAE,kBAAkB,CAAC,YAAY,CAma5C,CAAC;eAGa,MAAM"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAgC,MAAM,SAAS,CAAC;AAEhF,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAM1E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAK5C,MAAM,WAAW,eAAe;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;CAC/B;AAED,UAAU,YAAY;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC/B;AAoCD;;;GAGG;AACH,KAAK,SAAS,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAAC,CAAC;AAE3F,OAAO,QAAQ,SAAS,CAAC;IACrB,UAAU,cAAc;QACpB,SAAS,CAAC,EAAE,SAAS,CAAC;KACzB;CACJ;AAkBD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,eAAO,MAAM,aAAa,MAAM,CAAC;AAwKjC;;;;GAIG;AACH,QAAA,MAAM,MAAM,EAAE,kBAAkB,CAAC,YAAY,CAqa5C,CAAC;eAGa,MAAM"}

package/dist/routes.js

@@ -345,6 +345,8 @@ const routes = async (fastify, options) => {
                 resourceResolver: options.service.resourceResolver,
                 resourceInvoker,
                 meter,
+                // The run token's claims, or null for an API-key run, so the name is always reserved.
+                builtins: { jwt: caller.kind === 'client' ? caller.payload : null },
             });
             settle('capture', meter.tokens);
             return reply.status(200).send({ returnValue: result.returnValue ?? null, usage: { tokens: meter.tokens } });

package/dist/tests/routes.test.js

@@ -305,6 +305,26 @@ describe("routes", () => {
                 expect(response.json()).toEqual({ error: "Invalid run token" });
                 expect(authorizeRun).not.toHaveBeenCalled();
             });
+            test("gives the script the run token's claims as the built-in jwt", async () => {
+                const response = await runWith(await runToken("org_caller"), "request R {\n  return jwt\n}");
+                expect(response.statusCode).toBe(200);
+                expect(response.json().returnValue).toEqual({
+                    iss: "stellarium", sub: "cli_test", aud: config.publicKey, org: "org_caller", iat: expect.any(Number), exp: expect.any(Number),
+                });
+            });
+            test.each([
+                ["redeclares", "var jwt = 1", /'jwt' is a built-in variable/],
+                ["changes", 'jwt.sub = "cli_other"', /read-only/],
+            ])("fails a script that %s jwt", async (_, statement, details) => {
+                const response = await runWith(await runToken(ORGANIZATION), `request R {\n  ${statement}\n}`);
+                expect(response.statusCode).toBe(422);
+                expect(response.json()).toMatchObject({ error: "Script failed", details: expect.stringMatching(details) });
+            });
+            test("gives an API-key run a null jwt", async () => {
+                const response = await tokenApp.inject({ method: "POST", url: "/v1/run", headers: { authorization: "Bearer secret" }, payload: { source: "request R {\n  return jwt\n}" } });
+                expect(response.statusCode).toBe(200);
+                expect(response.json().returnValue).toBeNull();
+            });
             test("still accepts the API key", async () => {
                 const response = await tokenApp.inject({ method: "POST", url: "/v1/run", headers: { authorization: "Bearer secret" }, payload: { source: temperatureSource } });
                 expect(response.statusCode).toBe(200);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stellarium-ts",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "A Stellarium Node in TypeScript.",
   "homepage": "https://github.com/qualletio/stellarium-ts#readme",
   "bugs": {
@@ -46,7 +46,7 @@
     "dotenv": "^18.0.5",
     "fastify": "^5.12.5",
     "jose": "6.1.0",
-    "requestscript": "1.2.0",
+    "requestscript": "1.3.0",
     "sqlite": "^5.1.1",
     "sqlite3": "^6.0.1"
   },