Something went wrong. Try again.
This repository has no description
Something went wrong. Try again.
11 kB · 313 lines
TypeScript
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314import * as Effect from "effect/Effect";import { loadControlPlaneOrigin } from "../configuration/control-plane.ts";import { handleBridge, resumeBridge } from "./bridge.ts";import { exchange, revoke, subject, type CloudflareFetch,} from "./cloudflare.ts";import { configuration, type Env } from "./config.ts";import { hash, opaque, random } from "./crypto.ts";import { messages, OAuthError, safeCode, type ErrorCode } from "./errors.ts";import { checkOrigin, form, json, redirect } from "./http-response.ts";import { beginOAuth } from "./oauth-authorization.ts";import { authenticatedPrincipal, authorizedGrant, cookie, grantedAccounts, readCookie, SESSION_COOKIE, TRANSACTION_COOKIE, vault,} from "./session.ts";
function one(params: URLSearchParams, key: string) { const values = params.getAll(key); if ( values.length !== 1 || !values[0] || values[0].length > 2048 || /[\u0000-\u0020\u007f]/.test(values[0]) ) throw new OAuthError("oauth_invalid_callback"); return values[0];}function failure(code: ErrorCode, status = 400) { return json({ error: code, message: messages[code] }, status);}
export function handleOAuth( request: Request, env: Env, network: CloudflareFetch = fetch,) { return Effect.gen(function* () { const url = new URL(request.url); const bridgeResponse = yield* handleBridge(request, env); if (bridgeResponse) return bridgeResponse; if (!( url.pathname.startsWith("/auth/") || url.pathname.startsWith("/api/") )) return null;
if (url.pathname === "/auth/disconnect" && request.method === "POST") { yield* checkOrigin(request, loadControlPlaneOrigin(env)); const ref = readCookie(request, SESSION_COOKIE); let revoked = true; if (ref) { const principal = yield* vault(env, "session", ref).retireSession(); if (principal) { const grant = yield* vault(env, "grant", principal.grantRef).grant( principal.subject, ); yield* vault(env, "grant", principal.grantRef).destroy(); if (grant) { revoked = yield* configuration(env).pipe( Effect.flatMap((config) => revoke(config, grant.accessToken, network), ), Effect.catch(() => Effect.succeed(false)), ); } } } return redirect( `/connect${revoked ? "" : "?notice=revocation_pending"}`, [cookie(SESSION_COOKIE, "", 0), cookie(TRANSACTION_COOKIE, "", 0)], ); } const config = yield* configuration(env); if (url.origin !== config.publicOrigin) return yield* new OAuthError("forbidden"); if (request.method === "POST") yield* checkOrigin(request, config.publicOrigin); if (url.pathname === "/auth/start" && request.method === "POST") { const input = yield* form(request); const providerInstallationId = input.get("providerInstallationId"); const domainInstallationId = input.get("domainInstallationId"); // Only a fixed local setup route may survive reconnect; never accept an // arbitrary return URL or a caller-supplied account/owner. if ( [...input.keys()].some( (key) => ![ "returnTo", "providerInstallationId", "domainInstallationId", ].includes(key), ) || input.getAll("returnTo").length > 1 || (input.has("returnTo") && input.get("returnTo") !== "/connect") || input.getAll("providerInstallationId").length > 1 || input.getAll("domainInstallationId").length > 1 || (providerInstallationId !== null && (!/^[a-f0-9]{32}$/.test(providerInstallationId) || input.has("returnTo") || input.has("domainInstallationId"))) || (domainInstallationId !== null && (!/^[a-f0-9]{32}$/.test(domainInstallationId) || input.has("returnTo") || input.has("providerInstallationId"))) ) return yield* new OAuthError("invalid_request"); return yield* beginOAuth( request, env, undefined, providerInstallationId ?? undefined, domainInstallationId ?? undefined, ); } if (url.pathname === "/auth/callback" && request.method === "GET") return yield* oauthCallback(request, env, network, config, url); if (url.pathname === "/api/connection" && request.method === "GET") { if (!readCookie(request, SESSION_COOKIE)) return json({ error: "not_connected" }, 401); const principal = yield* authenticatedPrincipal(request, env); const available = yield* grantedAccounts(env, principal, network); return json({ ownerSubject: principal.subject, accounts: available, selectedAccountId: available.some( (a) => a.id === principal.selectedAccountId, ) ? principal.selectedAccountId : null, grantExpiresAt: (yield* authorizedGrant(env, principal)).expiresAt, }); } if (url.pathname === "/api/account" && request.method === "POST") { const principal = yield* authenticatedPrincipal(request, env); const input = yield* form(request); if ( [...input.keys()].some((key) => key !== "accountId") || input.getAll("accountId").length !== 1 || !/^[a-f0-9]{32}$/.test(input.get("accountId") ?? "") ) return yield* new OAuthError("invalid_request"); const accountId = input.get("accountId")!; const available = yield* grantedAccounts(env, principal, network); if (!available.some((account) => account.id === accountId)) return yield* new OAuthError("account_denied"); if ( !(yield* vault( env, "session", readCookie(request, SESSION_COOKIE)!, ).selectAccount(principal.subject, principal.grantRef, accountId)) ) return yield* new OAuthError("reauthorization_required"); return json({ ownerSubject: principal.subject, selectedAccountId: accountId, }); } return failure("invalid_request", 404); }).pipe( Effect.catch(oauthFailureEffect), Effect.catchDefect(oauthFailureEffect), );}
function oauthFailure(error: unknown) { const code = safeCode(error); return failure( code, code === "forbidden" ? 403 : code === "reauthorization_required" ? 401 : code.includes("setup") || code === "oauth_capability_unavailable" || code === "temporarily_unavailable" ? 503 : 400, );}function oauthCallback( request: Request, env: Env, network: CloudflareFetch, config: import("./config.ts").OAuthConfiguration, url: URL,) { return Effect.gen(function* () { if ( request.url.length > 8192 || [...url.searchParams.keys()].some( (key) => ![ "state", "code", // Cloudflare returns scope metadata here. Granted permissions // remain authoritative only in the token exchange response. "scope", "error", "error_description", "error_uri", "iss", ].includes(key), ) || [...new Set(url.searchParams.keys())].some( (key) => url.searchParams.getAll(key).length !== 1, ) ) return yield* new OAuthError("oauth_invalid_callback"); const state = one(url.searchParams, "state"); const binding = readCookie(request, TRANSACTION_COOKIE); if ( !opaque(state) || !binding || (url.searchParams.has("iss") && url.searchParams.get("iss") !== "https://dash.cloudflare.com") || (url.searchParams.has("code") && (url.searchParams.has("error_description") || url.searchParams.has("error_uri"))) || url.searchParams.has("code") === url.searchParams.has("error") ) return yield* new OAuthError("oauth_invalid_callback"); if (url.searchParams.has("code")) one(url.searchParams, "code"); else one(url.searchParams, "error"); const transaction = yield* vault( env, "transaction", state, ).claimTransaction( yield* hash(binding), readCookie(request, SESSION_COOKIE), ); if (!transaction) return yield* new OAuthError("oauth_invalid_callback"); if (url.searchParams.has("error")) return yield* new OAuthError( url.searchParams.get("error") === "access_denied" ? "oauth_denied" : "oauth_invalid_callback", ); const grant = yield* exchange( config, one(url.searchParams, "code"), transaction.verifier, network, ); const owner = yield* subject(grant.accessToken, network).pipe( Effect.onError(() => revoke(config, grant.accessToken, network)), ); const sessionRef = random(); const grantRef = random(); // Expiring grants are not refreshed/offline. Browser identity lasts 8h; // an expired grant explicitly requests another OAuth connection. yield* vault(env, "grant", grantRef).createGrant({ ...grant, subject: owner, }); yield* vault(env, "session", sessionRef).createSession({ subject: owner, grantRef, selectedAccountId: null, expiresAt: Date.now() + 8 * 60 * 60_000, }); if (transaction.previousSession) { const previous = yield* vault( env, "session", transaction.previousSession, ).session(); yield* vault(env, "session", transaction.previousSession).destroy(); if (previous) { const oldGrant = yield* vault(env, "grant", previous.grantRef).grant( previous.subject, ); yield* vault(env, "grant", previous.grantRef).destroy(); if (oldGrant && oldGrant.accessToken !== grant.accessToken) yield* revoke(config, oldGrant.accessToken, network); } } const destination = transaction.bridgeContinuation ? yield* resumeBridge( env, owner, transaction.bridgeContinuation, yield* hash(binding), ) : transaction.providerInstallationId ? `/connect?enableProvider=openrouter&installationId=${transaction.providerInstallationId}` : transaction.domainInstallationId ? `/connect?configureDomain=${transaction.domainInstallationId}` : transaction.returnTo; return redirect(destination, [ cookie(SESSION_COOKIE, sessionRef, 8 * 60 * 60), cookie(TRANSACTION_COOKIE, "", 0), ]); }).pipe(Effect.catch(callbackFailure), Effect.catchDefect(callbackFailure));}
const oauthFailureEffect = (error: unknown) => Effect.succeed(oauthFailure(error));const callbackFailure = (error: unknown) => Effect.succeed( redirect(`/connect?error=${safeCode(error)}`, [ cookie(TRANSACTION_COOKIE, "", 0), ]), );