65 lines
2.9 KiB
JavaScript
65 lines
2.9 KiB
JavaScript
import { createHash, randomBytes } from 'node:crypto'
|
|
|
|
function digest(value) { return createHash('sha256').update(value).digest('hex') }
|
|
function token(random) { return `dshcap_${random(32).toString('base64url')}` }
|
|
|
|
export function capabilityTarget(path) {
|
|
if (typeof path !== 'string' || path.length === 0 || path.length > 8_192 || !path.startsWith('/')) {
|
|
throw new TypeError('capability target is invalid')
|
|
}
|
|
const value = new URL(path, 'http://capability.internal')
|
|
if (value.origin !== 'http://capability.internal' || value.hash !== '') throw new TypeError('capability target is invalid')
|
|
return `${value.pathname}${value.search}`
|
|
}
|
|
|
|
export class CapabilityStore {
|
|
constructor({ now = Date.now, random = randomBytes, ttlMs = 5_000 } = {}) {
|
|
this.now = now
|
|
this.random = random
|
|
this.ttlMs = ttlMs
|
|
this.capabilities = new Map()
|
|
}
|
|
|
|
prune() {
|
|
const now = this.now()
|
|
for (const [key, value] of this.capabilities) if (value.expiresAt <= now) this.capabilities.delete(key)
|
|
}
|
|
|
|
issue(session, account, { audience, method, target }) {
|
|
if (!['management', 'maintenance', 'plugin'].includes(audience)) throw new TypeError('capability audience is invalid')
|
|
if (!/^(?:GET|HEAD|POST|PUT|DELETE)$/.test(method ?? '')) throw new TypeError('capability method is invalid')
|
|
this.prune()
|
|
const value = token(this.random)
|
|
this.capabilities.set(digest(value), {
|
|
audience,
|
|
method,
|
|
target: capabilityTarget(target),
|
|
sessionId: session.sessionId,
|
|
accountId: account.accountId,
|
|
mainCredentialVersion: account.mainCredential.version,
|
|
managementAdditionalCredentialVersion: account.managementAdditionalCredential.enabled
|
|
? account.managementAdditionalCredential.version : null,
|
|
managementAccessVersion: account.managementAccess.version,
|
|
expiresAt: this.now() + this.ttlMs,
|
|
})
|
|
return Object.freeze({ token: value, expiresAt: new Date(this.now() + this.ttlMs).toISOString() })
|
|
}
|
|
|
|
consume(value, account, { audience, method, target }) {
|
|
this.prune()
|
|
if (typeof value !== 'string' || value.length > 512) return undefined
|
|
const key = digest(value)
|
|
const capability = this.capabilities.get(key)
|
|
this.capabilities.delete(key)
|
|
const additionalVersion = account.managementAdditionalCredential.enabled
|
|
? account.managementAdditionalCredential.version : null
|
|
if (capability === undefined || capability.accountId !== account.accountId
|
|
|| capability.mainCredentialVersion !== account.mainCredential.version
|
|
|| capability.managementAdditionalCredentialVersion !== additionalVersion
|
|
|| capability.managementAccessVersion !== account.managementAccess.version
|
|
|| capability.audience !== audience || capability.method !== method
|
|
|| capability.target !== capabilityTarget(target)) return undefined
|
|
return Object.freeze({ sessionId: capability.sessionId, audience: capability.audience })
|
|
}
|
|
}
|