Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp
248 linesCodeBlameRaw
1import assert from "node:assert/strict";
2import { beforeEach, test } from "node:test";
3
4import {
5 type AccessSettings,
6 authorize,
7 clearKeyCache,
8 isSameOrigin,
9 isStaff,
10 parseServiceTokens,
11 parseStaff,
12 readSettings,
13 verifyAccessJwt,
14} from "./access.ts";
15
16const TEAM = "g1t.cloudflareaccess.com";
17const AUD = "a".repeat(64);
18const CLIENT = "434297ede60761875e84742d0486cf27.access";
19const SETTINGS: AccessSettings = { teamDomain: TEAM, aud: AUD, staff: ["owner@g1t.sh"], services: new Map([[CLIENT, "claude"]]) };
20const NOW = Date.UTC(2026, 9, 4, 12, 0, 0);
21const NOW_SECONDS = Math.floor(NOW / 1000);
22const RSA = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" } as const;
23
24async function rsaKey() {
25 return crypto.subtle.generateKey({ ...RSA, modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]) }, true, ["sign", "verify"]);
26}
27
28const signing = await rsaKey();
29const stranger = await rsaKey();
30const publicJwk = { ...(await crypto.subtle.exportKey("jwk", signing.publicKey)), kid: "key-1", alg: "RS256", use: "sig" };
31
32function b64url(bytes: Uint8Array | string): string {
33 const raw = typeof bytes === "string" ? new TextEncoder().encode(bytes) : bytes;
34 let binary = "";
35 for (const byte of raw) binary += String.fromCharCode(byte);
36 return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
37}
38
39async function sign(
40 claims: Record<string, unknown>,
41 { key = signing.privateKey, kid = "key-1", alg = "RS256" }: { key?: CryptoKey; kid?: string; alg?: string } = {},
42): Promise<string> {
43 const body = `${b64url(JSON.stringify({ alg, kid, typ: "JWT" }))}.${b64url(JSON.stringify(claims))}`;
44 const signature = new Uint8Array(await crypto.subtle.sign(RSA, key, new TextEncoder().encode(body)));
45 return `${body}.${b64url(signature)}`;
46}
47
48function claims(overrides: Record<string, unknown> = {}): Record<string, unknown> {
49 return {
50 iss: `https://${TEAM}`,
51 aud: [AUD],
52 email: "owner@g1t.sh",
53 sub: "user-1",
54 iat: NOW_SECONDS - 60,
55 nbf: NOW_SECONDS - 60,
56 exp: NOW_SECONDS + 3600,
57 ...overrides,
58 };
59}
60
61let fetches: string[] = [];
62async function fetcher(url: string): Promise<Response> {
63 fetches.push(url);
64 return Response.json({ keys: [publicJwk], public_cert: { kid: "key-1", cert: "" } });
65}
66
67function request(token?: string): Request {
68 return new Request("https://sudo.g1t.sh/", {
69 headers: token ? { "cf-access-jwt-assertion": token } : {},
70 });
71}
72
73beforeEach(() => {
74 clearKeyCache();
75 fetches = [];
76});
77
78test("a valid token from staff is let in, by its email", async () => {
79 const result = await authorize(request(await sign(claims())), SETTINGS, { fetcher, now: NOW });
80 assert.deepEqual(result, { ok: true, email: "owner@g1t.sh" });
81 assert.deepEqual(fetches, [`https://${TEAM}/cdn-cgi/access/certs`]);
82});
83
84test("an audience given as a string is accepted too", async () => {
85 const result = await verifyAccessJwt(await sign(claims({ aud: AUD })), SETTINGS, { fetcher, now: NOW });
86 assert.equal(result.ok, true);
87});
88
89test("a token for another Access application is refused", async () => {
90 const result = await verifyAccessJwt(await sign(claims({ aud: ["b".repeat(64)] })), SETTINGS, { fetcher, now: NOW });
91 assert.deepEqual(result, { ok: false, reason: "wrong audience" });
92});
93
94test("a token from another team is refused", async () => {
95 const result = await verifyAccessJwt(await sign(claims({ iss: "https://evil.cloudflareaccess.com" })), SETTINGS, { fetcher, now: NOW });
96 assert.deepEqual(result, { ok: false, reason: "wrong issuer" });
97});
98
99test("an expired token is refused", async () => {
100 const result = await verifyAccessJwt(await sign(claims({ exp: NOW_SECONDS - 3600 })), SETTINGS, { fetcher, now: NOW });
101 assert.deepEqual(result, { ok: false, reason: "expired" });
102});
103
104test("a token without an expiry is refused", async () => {
105 const result = await verifyAccessJwt(await sign(claims({ exp: undefined })), SETTINGS, { fetcher, now: NOW });
106 assert.deepEqual(result, { ok: false, reason: "no expiry" });
107});
108
109test("a token not valid yet is refused", async () => {
110 const result = await verifyAccessJwt(await sign(claims({ nbf: NOW_SECONDS + 3600 })), SETTINGS, { fetcher, now: NOW });
111 assert.deepEqual(result, { ok: false, reason: "not yet valid" });
112});
113
114test("a token signed by another key under a known key id is refused", async () => {
115 const result = await verifyAccessJwt(await sign(claims(), { key: stranger.privateKey }), SETTINGS, { fetcher, now: NOW });
116 assert.deepEqual(result, { ok: false, reason: "bad signature" });
117});
118
119test("a token whose claims were changed after signing is refused", async () => {
120 const token = await sign(claims({ email: "intern@g1t.sh" }));
121 const [header, , signature] = token.split(".");
122 const forged = `${header}.${b64url(JSON.stringify(claims()))}.${signature}`;
123 const result = await authorize(request(forged), SETTINGS, { fetcher, now: NOW });
124 assert.deepEqual(result, { ok: false, reason: "bad signature" });
125});
126
127test("a token signed by a key the team does not publish is refused", async () => {
128 const result = await verifyAccessJwt(await sign(claims(), { kid: "key-9" }), SETTINGS, { fetcher, now: NOW });
129 assert.deepEqual(result, { ok: false, reason: "unknown signing key" });
130});
131
132test("alg none and HS256 are refused before any key is fetched", async () => {
133 for (const alg of ["none", "HS256"]) {
134 const result = await verifyAccessJwt(await sign(claims(), { alg }), SETTINGS, { fetcher, now: NOW });
135 assert.deepEqual(result, { ok: false, reason: "unexpected algorithm" });
136 }
137 assert.deepEqual(fetches, []);
138});
139
140test("a valid token whose email is not staff is refused", async () => {
141 const result = await authorize(request(await sign(claims({ email: "someone@example.com" }))), SETTINGS, {
142 fetcher,
143 now: NOW,
144 });
145 assert.deepEqual(result, { ok: false, reason: "not staff", email: "someone@example.com" });
146});
147
148test("a token with neither an email nor a client id is refused", async () => {
149 const result = await authorize(request(await sign(claims({ email: undefined }))), SETTINGS, { fetcher, now: NOW });
150 assert.deepEqual(result, { ok: false, reason: "token has no email" });
151});
152
153test("a listed service token is let in as its name at service.g1t.sh", async () => {
154 const token = await sign(claims({ email: undefined, sub: "", common_name: CLIENT }));
155 const result = await authorize(request(token), SETTINGS, { fetcher, now: NOW });
156 assert.deepEqual(result, { ok: true, email: "claude@service.g1t.sh" });
157});
158
159test("a service token not listed is refused", async () => {
160 const token = await sign(claims({ email: undefined, common_name: "ffffffffffffffffffffffffffffffff.access" }));
161 const result = await authorize(request(token), SETTINGS, { fetcher, now: NOW });
162 assert.deepEqual(result, { ok: false, reason: "service token not staff" });
163});
164
165test("a listed service token still needs a valid signature and audience", async () => {
166 const forged = await sign(claims({ email: undefined, common_name: CLIENT }), { key: stranger.privateKey });
167 assert.deepEqual(await authorize(request(forged), SETTINGS, { fetcher, now: NOW }), { ok: false, reason: "bad signature" });
168 const elsewhere = await sign(claims({ email: undefined, common_name: CLIENT, aud: ["b".repeat(64)] }));
169 assert.deepEqual(await authorize(request(elsewhere), SETTINGS, { fetcher, now: NOW }), { ok: false, reason: "wrong audience" });
170});
171
172test("an email wins over a client id on the same token", async () => {
173 const token = await sign(claims({ email: "someone@example.com", common_name: CLIENT }));
174 const result = await authorize(request(token), SETTINGS, { fetcher, now: NOW });
175 assert.deepEqual(result, { ok: false, reason: "not staff", email: "someone@example.com" });
176});
177
178test("service tokens are read as client id to name, dropping malformed entries", () => {
179 assert.deepEqual(
180 parseServiceTokens(` ${CLIENT}=claude , short.access=x, abcdefabcdefabcdef.access=Bad Name, abcdefabcdefabcdef.access=`),
181 new Map([[CLIENT, "claude"]]),
182 );
183 assert.deepEqual(parseServiceTokens(""), new Map());
184});
185
186test("staff emails match without regard to case", async () => {
187 const result = await authorize(request(await sign(claims({ email: "Owner@G1T.sh" }))), SETTINGS, { fetcher, now: NOW });
188 assert.deepEqual(result, { ok: true, email: "owner@g1t.sh" });
189});
190
191test("a request without a token is refused", async () => {
192 assert.deepEqual(await authorize(request(), SETTINGS, { fetcher, now: NOW }), { ok: false, reason: "no Access token" });
193});
194
195test("garbage is refused", async () => {
196 for (const token of ["", "a.b", "a.b.c.d", "!!.??.**", "e30.e30.e30"]) {
197 const result = await verifyAccessJwt(token, SETTINGS, { fetcher, now: NOW });
198 assert.equal(result.ok, false, token);
199 }
200});
201
202test("the team's keys are fetched once and kept for a few minutes", async () => {
203 await verifyAccessJwt(await sign(claims()), SETTINGS, { fetcher, now: NOW });
204 await verifyAccessJwt(await sign(claims()), SETTINGS, { fetcher, now: NOW + 60_000 });
205 assert.equal(fetches.length, 1);
206 await verifyAccessJwt(await sign(claims()), SETTINGS, { fetcher, now: NOW + 10 * 60_000 });
207 assert.equal(fetches.length, 2);
208});
209
210test("when the keys cannot be fetched, nothing is let in", async () => {
211 const down = async () => new Response("no", { status: 503 });
212 const result = await verifyAccessJwt(await sign(claims()), SETTINGS, { fetcher: down, now: NOW });
213 assert.deepEqual(result, { ok: false, reason: "unknown signing key" });
214});
215
216test("sudo is closed until every setting is given", () => {
217 const full = { ACCESS_TEAM_DOMAIN: "https://g1t.cloudflareaccess.com/", ACCESS_AUD: AUD, STAFF_EMAILS: "A@g1t.sh, b@g1t.sh" };
218 assert.deepEqual(readSettings(full), { teamDomain: TEAM, aud: AUD, staff: ["a@g1t.sh", "b@g1t.sh"], services: new Map() });
219 assert.deepEqual(readSettings({ ...full, STAFF_SERVICE_TOKENS: `${CLIENT}=claude` })?.services, new Map([[CLIENT, "claude"]]));
220 assert.equal(readSettings({ ...full, ACCESS_AUD: "" }), null);
221 assert.equal(readSettings({ ...full, ACCESS_TEAM_DOMAIN: "" }), null);
222 assert.equal(readSettings({ ...full, STAFF_EMAILS: " , " }), null);
223 assert.equal(readSettings({ ...full, ACCESS_TEAM_DOMAIN: "evil.example.com" }), null);
224 assert.equal(readSettings({}), null);
225});
226
227test("changes are only taken from sudo's own pages", () => {
228 const post = (headers: Record<string, string>) => new Request("https://sudo.g1t.sh/x", { method: "POST", headers });
229 assert.equal(isSameOrigin(post({ origin: "https://sudo.g1t.sh" })), true);
230 assert.equal(isSameOrigin(post({ referer: "https://sudo.g1t.sh/accounts/x" })), true);
231 assert.equal(isSameOrigin(post({ origin: "https://evil.example" })), false);
232 assert.equal(isSameOrigin(post({ origin: "null" })), false);
233 assert.equal(isSameOrigin(post({ referer: "https://sudo.g1t.sh.evil.example/" })), false);
234 assert.equal(isSameOrigin(post({ origin: "https://sudo.g1t.sh", "sec-fetch-site": "cross-site" })), false);
235 assert.equal(isSameOrigin(post({})), false);
236});
237
238test("everyone at a staff domain is staff, and nobody at a lookalike", () => {
239 const staff = parseStaff("syntaqx@gmail.com, @g1t.sh");
240 assert.deepEqual(staff, ["syntaqx@gmail.com", "@g1t.sh"]);
241 assert.equal(isStaff("syntaqx@gmail.com", staff), true);
242 assert.equal(isStaff("ada@g1t.sh", staff), true);
243 assert.equal(isStaff("ada@xg1t.sh", staff), false);
244 assert.equal(isStaff("ada@g1t.sh.evil.com", staff), false);
245 assert.equal(isStaff("someone@gmail.com", staff), false);
246 assert.equal(isStaff("@g1t.sh", staff), false);
247 assert.equal(isStaff("a@b@g1t.sh", staff), false);
248});