veryfront 0.1.811 → 0.1.813

package/esm/src/proxy/handler.js

@@ -1,46 +1,12 @@
 import { TokenManager } from "./token-manager.js";
 import { parseProjectDomain } from "../server/utils/domain-parser.js";
-import { getEnv } from "../platform/compat/process.js";
 import { injectContext, ProxySpanNames, withSpan } from "./tracing.js";
 import { computeContentSourceId } from "../cache/keys.js";
-import { resolve as resolveContract } from "../extensions/contracts.js";
+import { checkProtectedProxyAccess } from "./proxy-access-control.js";
 import { createLocalProjectResolver } from "./local-project-resolver.js";
 import { isMissingCustomDomainProjectError, resolveProxyRequestToken, } from "./proxy-token-resolution.js";
-/**
- * Cache the resolved AuthProvider at module scope so the proxy does not pay
- * the registry lookup on every request. The cache is cleared implicitly when
- * `ExtensionLoader.teardownAll()` clears the registry — the next call
- * re-resolves (or surfaces the "install ext-auth-jwt" hint if the extension was
- * removed).
- */
-let cachedAuthProvider;
-function getAuthProvider() {
-    if (cachedAuthProvider)
-        return cachedAuthProvider;
-    try {
-        cachedAuthProvider = resolveContract("AuthProvider");
-        return cachedAuthProvider;
-    }
-    catch (err) {
-        // resolve() already throws with a helpful "Recommended: @veryfront/ext-auth-jwt"
-        // message, but the proxy is a load-bearing code path — append a concrete
-        // remediation hint that names the project-root extension directory so
-        // the user knows exactly what's missing.
-        const base = err instanceof Error ? err.message : String(err);
-        throw new Error(`${base}\nTo enable JWT verification in the proxy, install ext-auth-jwt ` +
-            `(scaffold with \`deno task cli extension init ext-auth-jwt\` or add the ` +
-            `npm package @veryfront/ext-auth-jwt).`, { cause: err });
-    }
-}
-/**
- * Reset the cached AuthProvider. Intended for tests that `register()` a mock
- * after the handler module has been imported.
- *
- * @internal
- */
-export function __resetCachedAuthProviderForTests() {
-    cachedAuthProvider = undefined;
-}
+import { createProjectNotFoundProxyContext, createProxyErrorContext, createReleaseNotFoundProxyContext, } from "./proxy-error-context.js";
+export { __resetCachedAuthProviderForTests } from "./proxy-access-control.js";
 export const INTERNAL_PROXY_HEADERS = [
     "x-token",
     "x-project-slug",
@@ -75,18 +41,6 @@ function isSignedInternalControlPlaneRequest(req, url) {
     }
     return !!req.headers.get("x-token");
 }
-function resolveApiJwksUrl(apiBaseUrl, logger) {
-    try {
-        const normalizedBaseUrl = apiBaseUrl.endsWith("/") ? apiBaseUrl : `${apiBaseUrl}/`;
-        return new URL(".well-known/jwks.json", normalizedBaseUrl).toString();
-    }
-    catch (error) {
-        logger?.error("Invalid API base URL for JWKS lookup", error, {
-            apiBaseUrl,
-        });
-        return undefined;
-    }
-}
 async function lookupProjectByDomain(domain, apiBaseUrl, token, logger) {
     return withSpan(ProxySpanNames.PROXY_DOMAIN_LOOKUP, async () => {
         const domainWithoutPort = domain.replace(/:\d+$/, "");
@@ -141,59 +95,6 @@ function parseStatusFromError(error) {
     const match = message.match(/failed: (\d+)/);
     return match ? Number(match[1]) : null;
 }
-async function extractUserIdFromToken(token, apiBaseUrl, log) {
-    const auth = getAuthProvider();
-    const header = auth.decode(token);
-    if (!header) {
-        log?.debug("Failed to decode JWT header");
-        return undefined;
-    }
-    const algorithm = header.alg;
-    if (algorithm === "RS256") {
-        const jwksUrl = resolveApiJwksUrl(apiBaseUrl, log);
-        if (!jwksUrl)
-            return undefined;
-        try {
-            const payload = await auth.verifyWithJwks(token, jwksUrl, {
-                algorithms: ["RS256"],
-            });
-            return payload.userId;
-        }
-        catch (error) {
-            log?.debug("RS256 JWT verification failed", {
-                error: error instanceof Error ? error.message : String(error),
-            });
-            return undefined;
-        }
-    }
-    if (algorithm !== "HS256") {
-        log?.debug("Unsupported JWT algorithm", { algorithm: algorithm ?? null });
-        return undefined;
-    }
-    const jwtSecret = getEnv("JWT_SECRET");
-    if (!jwtSecret) {
-        log?.warn("JWT_SECRET not configured — cannot verify user token");
-        return undefined;
-    }
-    try {
-        // ext-auth-jwt reads JWT_SECRET from the environment when no `secret` was
-        // passed to the extension factory; the explicit env check above is kept
-        // so callers can warn once before we attempt verification.
-        const payload = await auth.verify(token, { algorithms: ["HS256"] });
-        return payload.userId;
-    }
-    catch (error) {
-        log?.debug("JWT verification failed", {
-            error: error instanceof Error ? error.message : String(error),
-        });
-        return undefined;
-    }
-}
-function isProjectMember(users, userId) {
-    if (!users || !userId)
-        return false;
-    return users.some((u) => u.id === userId);
-}
 export function createProxyHandler(options) {
     const { config, cache, logger } = options;
     const localProjects = config.localProjects ?? {};
@@ -213,85 +114,22 @@ export function createProxyHandler(options) {
             missing.push("VERYFRONT_PROXY_API_CLIENT_SECRET");
         return missing;
     }
-    function makeErrorContext(base, status, message, token, redirectUrl, slug) {
-        return {
-            token,
-            projectSlug: undefined,
-            projectId: undefined,
-            environment: base.scope,
-            contentSourceId: "error",
-            localPath: undefined,
-            host: base.host,
-            parsedDomain: base.parsedDomain,
-            isLocalProject: false,
-            error: { status, message, redirectUrl, slug },
-        };
-    }
-    function makeAuthRedirectUrl(url) {
-        // Collapse leading slashes to prevent protocol-relative open redirects (e.g. "//evil.com/path")
-        const safePath = url.pathname.replace(/^\/\/+/, "/");
-        let returnPath = safePath + url.search;
-        // Ensure the return path stays within the application and is not an absolute URL.
-        // - It must start with "/".
-        // - It must not contain a scheme delimiter ("://").
-        // If it fails validation, fall back to the root path.
-        if (!returnPath.startsWith("/") || returnPath.includes("://")) {
-            returnPath = "/";
-        }
-        const isHostedProductionDeployment = url.hostname.endsWith(".production.veryfront.org") ||
-            url.hostname.endsWith(".production.veryfront.com");
-        const returnTarget = isHostedProductionDeployment ? url.toString() : returnPath;
-        return `https://veryfront.com/sign-in?from=${encodeURIComponent(returnTarget)}`;
-    }
-    function makeProjectNotFoundContext(base, message, token) {
-        return makeErrorContext(base, 404, message, token, undefined, "project-not-found");
-    }
-    async function checkProtectedAccess(req, url, matchingEnv, userToken, users, logContext) {
-        if (!matchingEnv?.protected)
-            return null;
-        if (isSignedInternalControlPlaneRequest(req, url)) {
-            logger?.debug("Allowing signed internal control-plane request through protected environment", {
-                ...logContext,
-                environmentName: matchingEnv.name,
-                pathname: url.pathname,
-            });
-            return null;
-        }
-        if (!userToken) {
-            const redirectUrl = makeAuthRedirectUrl(url);
-            logger?.info("Protected environment requires authentication", {
-                ...logContext,
-                environmentName: matchingEnv.name,
-                redirectUrl,
-            });
-            return { status: 302, message: "Authentication required", redirectUrl };
-        }
-        const userId = await extractUserIdFromToken(userToken, config.apiBaseUrl, logger);
-        if (!userId) {
-            const redirectUrl = makeAuthRedirectUrl(url);
-            logger?.info("Could not extract userId from token", {
-                ...logContext,
-                environmentName: matchingEnv.name,
-                redirectUrl,
-            });
-            return { status: 302, message: "Authentication required", redirectUrl };
-        }
-        if (!isProjectMember(users, userId)) {
-            logger?.info("User is not a member of the project", {
-                ...logContext,
-                environmentName: matchingEnv.name,
-                userId,
-            });
-            return { status: 403, message: "Access denied" };
-        }
-        return null;
-    }
     async function resolveReleaseAndProtection(req, url, token, userToken, lookupKey, envMatcher, logContext) {
         const lookupResult = await lookupProjectByDomain(lookupKey, config.apiBaseUrl, token, logger);
         if (!lookupResult)
             return { projectId: undefined, releaseId: undefined };
         const matchingEnv = lookupResult.environments?.find(envMatcher);
-        const protectionError = await checkProtectedAccess(req, url, matchingEnv, userToken, lookupResult.users, logContext);
+        const protectionError = await checkProtectedProxyAccess({
+            req,
+            url,
+            matchingEnv,
+            userToken,
+            users: lookupResult.users,
+            apiBaseUrl: config.apiBaseUrl,
+            logger,
+            logContext,
+            isSignedInternalControlPlaneRequest: isSignedInternalControlPlaneRequest(req, url),
+        });
         if (protectionError)
             return { error: protectionError };
         return {
@@ -359,10 +197,10 @@ export function createProxyHandler(options) {
                 if (status === 404) {
                     if (scope === "preview") {
                         logger?.info("Preview project not found", { projectSlug, host });
-                        return makeProjectNotFoundContext(base, "Preview project not found");
+                        return createProjectNotFoundProxyContext(base, "Preview project not found");
                     }
                     logger?.info("Project not found", { projectSlug, host, scope });
-                    return makeProjectNotFoundContext(base, "Project not found");
+                    return createProjectNotFoundProxyContext(base, "Project not found");
                 }
                 const message = scope === "preview"
                     ? "Failed to authenticate preview request"
@@ -374,7 +212,7 @@ export function createProxyHandler(options) {
                     hadUserToken: !!userToken,
                     hadTokenFetchError: !!tokenFetchError,
                 });
-                return makeErrorContext(base, 502, message);
+                return createProxyErrorContext(base, { status: 502, message });
             }
             if (isCustomDomain && !projectSlug) {
                 if (!token) {
@@ -382,15 +220,26 @@ export function createProxyHandler(options) {
                         logger?.info("Custom domain project not found during token fetch", {
                             domain: host,
                         });
-                        return makeErrorContext(base, 404, `No project configured for domain: ${host}`);
+                        return createProxyErrorContext(base, {
+                            status: 404,
+                            message: `No project configured for domain: ${host}`,
+                        });
                     }
                     logger?.error("Cannot process custom domain without token", undefined, { domain: host });
-                    return makeErrorContext(base, 502, `Failed to authenticate for domain: ${host}`, token);
+                    return createProxyErrorContext(base, {
+                        status: 502,
+                        message: `Failed to authenticate for domain: ${host}`,
+                        token,
+                    });
                 }
                 const lookupResult = await lookupProjectByDomain(host, config.apiBaseUrl, token, logger);
                 if (!lookupResult) {
                     logger?.info("Custom domain not found", { domain: host });
-                    return makeErrorContext(base, 404, `No project configured for domain: ${host}`, token);
+                    return createProxyErrorContext(base, {
+                        status: 404,
+                        message: `No project configured for domain: ${host}`,
+                        token,
+                    });
                 }
                 projectSlug = lookupResult.slug;
                 projectId = lookupResult.id;
@@ -398,9 +247,24 @@ export function createProxyHandler(options) {
                 const matchingEnv = lookupResult.environments?.find((env) => env.domains?.some((d) => d.toLowerCase() === normalizedHost));
                 releaseId = matchingEnv?.active_release_id ?? undefined;
                 environmentId = matchingEnv?.id;
-                const protectionError = await checkProtectedAccess(req, url, matchingEnv, userToken, lookupResult.users, { domain: host });
+                const protectionError = await checkProtectedProxyAccess({
+                    req,
+                    url,
+                    matchingEnv,
+                    userToken,
+                    users: lookupResult.users,
+                    apiBaseUrl: config.apiBaseUrl,
+                    logger,
+                    logContext: { domain: host },
+                    isSignedInternalControlPlaneRequest: isSignedInternalControlPlaneRequest(req, url),
+                });
                 if (protectionError) {
-                    return makeErrorContext(base, protectionError.status, protectionError.message, token, protectionError.redirectUrl);
+                    return createProxyErrorContext(base, {
+                        status: protectionError.status,
+                        message: protectionError.message,
+                        token,
+                        redirectUrl: protectionError.redirectUrl,
+                    });
                 }
                 logger?.info("Resolved custom domain to project", {
                     domain: host,
@@ -414,7 +278,12 @@ export function createProxyHandler(options) {
                 const targetEnv = parsedDomain.environment.toLowerCase();
                 const resolved = await resolveReleaseAndProtection(req, url, token, userToken, projectSlug, (env) => env.name.toLowerCase() === targetEnv, { projectSlug });
                 if ("error" in resolved) {
-                    return makeErrorContext(base, resolved.error.status, resolved.error.message, token, resolved.error.redirectUrl);
+                    return createProxyErrorContext(base, {
+                        status: resolved.error.status,
+                        message: resolved.error.message,
+                        token,
+                        redirectUrl: resolved.error.redirectUrl,
+                    });
                 }
                 if (!resolved.projectId) {
                     logger?.info("Project not found after lookup", {
@@ -423,7 +292,7 @@ export function createProxyHandler(options) {
                         scope,
                         targetEnvName: parsedDomain.environment,
                     });
-                    return makeProjectNotFoundContext(base, "Project not found", token);
+                    return createProjectNotFoundProxyContext(base, "Project not found", token);
                 }
                 projectId = resolved.projectId;
                 releaseId = resolved.releaseId;
@@ -441,11 +310,16 @@ export function createProxyHandler(options) {
                 // still enforce the environment's `protected` flag like other scopes.
                 const resolved = await resolveReleaseAndProtection(req, url, token, userToken, projectSlug, (env) => env.name.toLowerCase() === "preview", { projectSlug });
                 if ("error" in resolved) {
-                    return makeErrorContext(base, resolved.error.status, resolved.error.message, token, resolved.error.redirectUrl);
+                    return createProxyErrorContext(base, {
+                        status: resolved.error.status,
+                        message: resolved.error.message,
+                        token,
+                        redirectUrl: resolved.error.redirectUrl,
+                    });
                 }
                 if (!resolved.projectId) {
                     logger?.info("Preview project not found after lookup", { projectSlug, host });
-                    return makeProjectNotFoundContext(base, "Preview project not found", token);
+                    return createProjectNotFoundProxyContext(base, "Preview project not found", token);
                 }
                 projectId = resolved.projectId;
                 environmentId = resolved.environmentId;
@@ -465,7 +339,7 @@ export function createProxyHandler(options) {
                 host,
                 environment: scope,
             });
-            return makeErrorContext({ scope, host, parsedDomain }, 404, "No active release found", token, undefined, "release-not-found");
+            return createReleaseNotFoundProxyContext({ scope, host, parsedDomain }, token);
         }
         const contentSourceId = computeContentSourceId(isLocalProject, scope, parsedDomain.branch, releaseId);
         return {

package/esm/src/proxy/main.js

@@ -35,6 +35,8 @@ import { exit, getEnv, onSignal } from "../platform/compat/process.js";
 import { createHttpServer, upgradeWebSocket } from "../platform/compat/http/index.js";
 import { createProxyErrorResponse, jsonErrorResponse } from "./error-response.js";
 import { handleReleaseAssetRequest, isReleaseAssetPath } from "./asset-handler.js";
+import { runProxyRequestLifecycle } from "./request-lifecycle.js";
+import { createUpstreamFailureResponse, createUpstreamTimeoutResponse, UPSTREAM_FAILURE_STATUS, UPSTREAM_TIMEOUT_STATUS, } from "./upstream-error-response.js";
 function getLocalProjects() {
     const raw = getEnv("LOCAL_PROJECTS");
     return raw ? JSON.parse(raw) : {};
@@ -231,9 +233,7 @@ function forwardToServer(req, url) {
     const startTime = performance.now();
     const requestId = dntShim.crypto.randomUUID();
     const host = req.headers.get("host") || "";
-    const parentContext = extractContext(req.headers);
-    const spanInfo = startServerSpan(req.method, url.pathname, parentContext);
-    const execute = async () => {
+    const execute = async (lifecycle) => {
         try {
             const ctx = await proxyHandler.processRequest(req, { url });
             return runWithProxyRequestContext({
@@ -250,7 +250,7 @@ function forwardToServer(req, url) {
                     const ms = Math.round(performance.now() - startTime);
                     const logLevel = getProxyFailureLogLevel(ctx.error.status, req.method, url.pathname);
                     proxyLogger[logLevel](`${ctx.error.status} ${req.method} ${url.pathname}`, { ms });
-                    endSpan(spanInfo?.span, ctx.error.status);
+                    lifecycle.end(ctx.error.status);
                     return createProxyErrorResponse(ctx.error);
                 }
                 const reqLogger = proxyLogger.child({
@@ -332,7 +332,6 @@ function forwardToServer(req, url) {
                         else {
                             reqLogger.info(`${response.status} ${req.method} ${url.pathname}`, { ms });
                         }
-                        endSpan(spanInfo?.span, response.status);
                         return new Response(response.body, {
                             status: response.status,
                             statusText: response.statusText,
@@ -344,15 +343,12 @@ function forwardToServer(req, url) {
                         lastError = error;
                         if (error instanceof Error && error.name === "AbortError") {
                             const ms = Math.round(performance.now() - startTime);
-                            proxyLogger.error(`504 ${req.method} ${url.pathname}`, {
+                            proxyLogger.error(`${UPSTREAM_TIMEOUT_STATUS} ${req.method} ${url.pathname}`, {
                                 ms,
                                 timeoutMs: VERYFRONT_SERVER_REQUEST_TIMEOUT_MS,
                             });
-                            endSpan(spanInfo?.span, 504, error);
-                            return jsonErrorResponse(504, {
-                                error: "Gateway Timeout",
-                                message: `Server request timed out after ${VERYFRONT_SERVER_REQUEST_TIMEOUT_MS}ms`,
-                            });
+                            lifecycle.end(UPSTREAM_TIMEOUT_STATUS, error);
+                            return createUpstreamTimeoutResponse(VERYFRONT_SERVER_REQUEST_TIMEOUT_MS);
                         }
                         // Check if this is a retryable error and we have retries left
                         if (isRetryableConnectionError(error) && attempt < maxRetries) {
@@ -379,26 +375,31 @@ function forwardToServer(req, url) {
                 }
                 // All retries exhausted or non-retryable error
                 const ms = Math.round(performance.now() - startTime);
-                const logLevel = getProxyFailureLogLevel(502, req.method, url.pathname);
-                proxyLogger[logLevel](`502 ${req.method} ${url.pathname}`, { ms }, lastError);
-                endSpan(spanInfo?.span, 502, lastError);
-                return jsonErrorResponse(502, {
-                    error: "Proxy Error",
-                    message: lastError instanceof Error ? lastError.message : "Unknown error",
-                });
+                const logLevel = getProxyFailureLogLevel(UPSTREAM_FAILURE_STATUS, req.method, url.pathname);
+                proxyLogger[logLevel](`${UPSTREAM_FAILURE_STATUS} ${req.method} ${url.pathname}`, { ms }, lastError);
+                lifecycle.end(UPSTREAM_FAILURE_STATUS, lastError);
+                return createUpstreamFailureResponse(lastError);
             });
         }
         catch (error) {
             const ms = Math.round(performance.now() - startTime);
             proxyLogger.error(`500 ${req.method} ${url.pathname}`, { ms }, error);
-            endSpan(spanInfo?.span, 500, error);
+            lifecycle.end(500, error);
             return jsonErrorResponse(500, {
                 error: "Internal Proxy Error",
                 message: error instanceof Error ? error.message : "Unknown error",
             });
         }
     };
-    return spanInfo?.context ? withContext(spanInfo.context, execute) : execute();
+    return runProxyRequestLifecycle({
+        req,
+        url,
+        startServerSpan,
+        endSpan,
+        extractContext,
+        withContext,
+        handle: execute,
+    });
 }
 /**
  * Handle stats endpoint for monitoring.

package/esm/src/proxy/proxy-access-control.d.ts

@@ -0,0 +1,41 @@
+export interface ProxyAccessControlLogger {
+    debug: (msg: string, extra?: Record<string, unknown>) => void;
+    info: (msg: string, extra?: Record<string, unknown>) => void;
+    warn: (msg: string, extra?: Record<string, unknown>) => void;
+    error: (msg: string, error?: Error, extra?: Record<string, unknown>) => void;
+}
+export interface ProtectedProxyEnvironment {
+    name: string;
+    protected?: boolean;
+}
+export interface ProtectedProxyProjectUser {
+    id: string;
+}
+export interface ProxyAccessError {
+    status: number;
+    message: string;
+    redirectUrl?: string;
+}
+/**
+ * Reset the cached AuthProvider. Intended for tests that `register()` a mock
+ * after the handler module has been imported.
+ *
+ * @internal
+ */
+export declare function __resetCachedAuthProviderForTests(): void;
+export declare function extractUserIdFromToken(token: string, apiBaseUrl: string, log?: ProxyAccessControlLogger): Promise<string | undefined>;
+export declare function buildProxyAuthRedirectUrl(url: URL): string;
+export declare function isProjectMember(users: ProtectedProxyProjectUser[] | undefined, userId: string | undefined): boolean;
+export declare function checkProtectedProxyAccess(input: {
+    req: Request;
+    url: URL;
+    matchingEnv: ProtectedProxyEnvironment | undefined;
+    userToken: string | undefined;
+    users: ProtectedProxyProjectUser[] | undefined;
+    apiBaseUrl: string;
+    logger?: ProxyAccessControlLogger;
+    logContext?: Record<string, unknown>;
+    isSignedInternalControlPlaneRequest: boolean;
+    extractUserIdFromToken?: (token: string, apiBaseUrl: string, log?: ProxyAccessControlLogger) => Promise<string | undefined>;
+}): Promise<ProxyAccessError | null>;
+//# sourceMappingURL=proxy-access-control.d.ts.map

package/esm/src/proxy/proxy-access-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-access-control.d.ts","sourceRoot":"","sources":["../../../src/src/proxy/proxy-access-control.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC9D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC7D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC7D,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAC9E;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA2BD;;;;;GAKG;AACH,wBAAgB,iCAAiC,IAAI,IAAI,CAExD;AAiBD,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,wBAAwB,GAC7B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAoD7B;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAa1D;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,yBAAyB,EAAE,GAAG,SAAS,EAC9C,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,OAAO,CAGT;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,WAAW,EAAE,yBAAyB,GAAG,SAAS,CAAC;IACnD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,EAAE,yBAAyB,EAAE,GAAG,SAAS,CAAC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,mCAAmC,EAAE,OAAO,CAAC;IAC7C,sBAAsB,CAAC,EAAE,CACvB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,wBAAwB,KAC3B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAClC,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA4DnC"}

package/esm/src/proxy/proxy-access-control.js

@@ -0,0 +1,151 @@
+import { getEnv } from "../platform/compat/process.js";
+import { resolve as resolveContract } from "../extensions/contracts.js";
+/**
+ * Cache the resolved AuthProvider at module scope so the proxy does not pay
+ * the registry lookup on every request. The cache is cleared implicitly when
+ * `ExtensionLoader.teardownAll()` clears the registry. The next call re-resolves
+ * or surfaces the install hint if the extension was removed.
+ */
+let cachedAuthProvider;
+function getAuthProvider() {
+    if (cachedAuthProvider)
+        return cachedAuthProvider;
+    try {
+        cachedAuthProvider = resolveContract("AuthProvider");
+        return cachedAuthProvider;
+    }
+    catch (err) {
+        const base = err instanceof Error ? err.message : String(err);
+        throw new Error(`${base}\nTo enable JWT verification in the proxy, install ext-auth-jwt ` +
+            `(scaffold with \`deno task cli extension init ext-auth-jwt\` or add the ` +
+            `npm package @veryfront/ext-auth-jwt).`, { cause: err });
+    }
+}
+/**
+ * Reset the cached AuthProvider. Intended for tests that `register()` a mock
+ * after the handler module has been imported.
+ *
+ * @internal
+ */
+export function __resetCachedAuthProviderForTests() {
+    cachedAuthProvider = undefined;
+}
+function resolveApiJwksUrl(apiBaseUrl, logger) {
+    try {
+        const normalizedBaseUrl = apiBaseUrl.endsWith("/") ? apiBaseUrl : `${apiBaseUrl}/`;
+        return new URL(".well-known/jwks.json", normalizedBaseUrl).toString();
+    }
+    catch (error) {
+        logger?.error("Invalid API base URL for JWKS lookup", error, {
+            apiBaseUrl,
+        });
+        return undefined;
+    }
+}
+export async function extractUserIdFromToken(token, apiBaseUrl, log) {
+    const auth = getAuthProvider();
+    const header = auth.decode(token);
+    if (!header) {
+        log?.debug("Failed to decode JWT header");
+        return undefined;
+    }
+    const algorithm = header.alg;
+    if (algorithm === "RS256") {
+        const jwksUrl = resolveApiJwksUrl(apiBaseUrl, log);
+        if (!jwksUrl)
+            return undefined;
+        try {
+            const payload = await auth.verifyWithJwks(token, jwksUrl, {
+                algorithms: ["RS256"],
+            });
+            return payload.userId;
+        }
+        catch (error) {
+            log?.debug("RS256 JWT verification failed", {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return undefined;
+        }
+    }
+    if (algorithm !== "HS256") {
+        log?.debug("Unsupported JWT algorithm", { algorithm: algorithm ?? null });
+        return undefined;
+    }
+    const jwtSecret = getEnv("JWT_SECRET");
+    if (!jwtSecret) {
+        log?.warn("JWT_SECRET not configured - cannot verify user token");
+        return undefined;
+    }
+    try {
+        // ext-auth-jwt reads JWT_SECRET from the environment when no `secret` was
+        // passed to the extension factory; the explicit env check above is kept
+        // so callers can warn once before attempting verification.
+        const payload = await auth.verify(token, { algorithms: ["HS256"] });
+        return payload.userId;
+    }
+    catch (error) {
+        log?.debug("JWT verification failed", {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return undefined;
+    }
+}
+export function buildProxyAuthRedirectUrl(url) {
+    const safePath = url.pathname.replace(/^\/\/+/, "/");
+    let returnPath = safePath + url.search;
+    if (!returnPath.startsWith("/") || returnPath.includes("://")) {
+        returnPath = "/";
+    }
+    const isHostedProductionDeployment = url.hostname.endsWith(".production.veryfront.org") ||
+        url.hostname.endsWith(".production.veryfront.com");
+    const returnTarget = isHostedProductionDeployment ? url.toString() : returnPath;
+    return `https://veryfront.com/sign-in?from=${encodeURIComponent(returnTarget)}`;
+}
+export function isProjectMember(users, userId) {
+    if (!users || !userId)
+        return false;
+    return users.some((u) => u.id === userId);
+}
+export async function checkProtectedProxyAccess(input) {
+    const { apiBaseUrl, logger, matchingEnv, url, userToken, users, } = input;
+    const logContext = input.logContext ?? {};
+    if (!matchingEnv?.protected)
+        return null;
+    if (input.isSignedInternalControlPlaneRequest) {
+        logger?.debug("Allowing signed internal control-plane request through protected environment", {
+            ...logContext,
+            environmentName: matchingEnv.name,
+            pathname: url.pathname,
+        });
+        return null;
+    }
+    if (!userToken) {
+        const redirectUrl = buildProxyAuthRedirectUrl(url);
+        logger?.info("Protected environment requires authentication", {
+            ...logContext,
+            environmentName: matchingEnv.name,
+            redirectUrl,
+        });
+        return { status: 302, message: "Authentication required", redirectUrl };
+    }
+    const resolveUserId = input.extractUserIdFromToken ?? extractUserIdFromToken;
+    const userId = await resolveUserId(userToken, apiBaseUrl, logger);
+    if (!userId) {
+        const redirectUrl = buildProxyAuthRedirectUrl(url);
+        logger?.info("Could not extract userId from token", {
+            ...logContext,
+            environmentName: matchingEnv.name,
+            redirectUrl,
+        });
+        return { status: 302, message: "Authentication required", redirectUrl };
+    }
+    if (!isProjectMember(users, userId)) {
+        logger?.info("User is not a member of the project", {
+            ...logContext,
+            environmentName: matchingEnv.name,
+            userId,
+        });
+        return { status: 403, message: "Access denied" };
+    }
+    return null;
+}

package/esm/src/proxy/proxy-error-context.d.ts

@@ -0,0 +1,20 @@
+import type { ParsedDomain } from "../server/utils/domain-parser.js";
+import type { TokenScope } from "./token-manager.js";
+import type { ProxyContext } from "./handler.js";
+export type ProxyErrorSlug = "authentication-failed" | "project-not-found" | "release-not-found";
+export interface ProxyErrorContextBase {
+    scope: TokenScope;
+    host: string;
+    parsedDomain: ParsedDomain;
+}
+export interface ProxyErrorContextOptions {
+    status: number;
+    message: string;
+    token?: string;
+    redirectUrl?: string;
+    slug?: ProxyErrorSlug;
+}
+export declare function createProxyErrorContext(base: ProxyErrorContextBase, options: ProxyErrorContextOptions): ProxyContext;
+export declare function createProjectNotFoundProxyContext(base: ProxyErrorContextBase, message: "Preview project not found" | "Project not found", token?: string): ProxyContext;
+export declare function createReleaseNotFoundProxyContext(base: ProxyErrorContextBase, token?: string): ProxyContext;
+//# sourceMappingURL=proxy-error-context.d.ts.map