Skip to content
Sign in

flagon-io/g1t

public
0

g1t/services/identity/src/tokens.rs

607 lines22,144 bytesCodeBlame
1//! Access tokens: the `g1t_…` secrets used by git, the API and the MCP
2//! server.
3//!
4//! There is one implementation and two kinds of owner. A personal token
5//! acts as the person who made it. A workspace's token belongs to the
6//! workspace and acts as it, so automation needs no account of its own and
7//! keeps working when the member who set it up leaves.
8
9use g1t_contracts::identity::*;
10use g1t_contracts::scopes::{FULL_ACCESS, JobToken, Scope, TokenAccess, parse_scopes, scopes_text};
11use g1t_contracts::time::{SQL_NOW, rfc3339};
12use g1t_contracts::{FailureCode, Membership, Outcome, PrincipalKind, Role, User, Viewer, new_id};
13use g1t_kit::now_ms;
14use serde::Deserialize;
15use worker::Result;
16use worker::wasm_bindgen::JsValue;
17
18use crate::{Identity, crypto};
19
20pub const TOKEN_PREFIX: &str = "g1t_";
21/// How stale a token's last-used time may get before it is written again.
22const LAST_USED_RESOLUTION_MS: u64 = 5 * 60 * 1000;
23const MAX_TOKENS_PER_WORKSPACE: usize = 50;
24const WORKSPACE_ID_PREFIX: &str = "wsp_";
25
26const TOKEN_COLUMNS: &str = "access_tokens.id, access_tokens.name, access_tokens.created_at,
27 access_tokens.last_used_at, users.username AS created_by, access_tokens.scopes,
28 access_tokens.expires_at";
29
30/// Who a new token belongs to.
31enum Owner<'a> {
32 User(&'a str),
33 Workspace {
34 id: &'a str,
35 created_by: Option<&'a str>,
36 },
37}
38
39#[derive(Deserialize)]
40struct TokenRow {
41 id: String,
42 name: String,
43 created_at: String,
44 last_used_at: Option<String>,
45 created_by: Option<String>,
46 scopes: Option<String>,
47 expires_at: Option<String>,
48}
49
50/// What a token or grant may do, as it is to be stored. A token reaches
51/// whatever its owner can; only its scopes narrow that.
52///
53/// The `resources` columns (migration 0022) held a limit to some
54/// workspaces or repositories. That limit was retired (migration 0023);
55/// the columns stay, since D1 cannot drop them in place, and nothing
56/// reads or writes them.
57#[derive(Clone, Debug, Default)]
58pub(crate) struct Grant {
59 /// Null: full access.
60 pub scopes: Option<Vec<Scope>>,
61}
62
63impl Grant {
64 /// From what a caller asked for: unknown scopes are left out.
65 pub(crate) fn asked(scopes: &Option<Vec<String>>) -> Self {
66 Grant {
67 scopes: scopes.as_ref().map(|scopes| parse_scopes(&scopes.join(" "))),
68 }
69 }
70
71 /// The `scopes` column: `*` for full access.
72 pub(crate) fn scopes_column(&self) -> String {
73 match &self.scopes {
74 None => FULL_ACCESS.to_owned(),
75 Some(scopes) => scopes_text(scopes),
76 }
77 }
78}
79
80/// A `scopes` column read back: the scopes (null for full access), and
81/// whether it is a legacy row, made before scopes.
82pub(crate) fn stored_scopes(column: Option<&str>) -> (Option<Vec<String>>, bool) {
83 match column {
84 None => (None, true),
85 Some(FULL_ACCESS) => (None, false),
86 Some(text) => (
87 Some(parse_scopes(text).iter().map(|scope| scope.as_str().to_owned()).collect()),
88 false,
89 ),
90 }
91}
92
93/// The owner of a token being used.
94#[derive(Deserialize)]
95struct Presented {
96 id: String,
97 user_id: Option<String>,
98 workspace_id: Option<String>,
99 last_used_at: Option<String>,
100 /// Set on an agent's token: what it may do, as JSON `AgentScope`.
101 agent_scope: Option<String>,
102 scopes: Option<String>,
103 #[serde(default)]
104 name: Option<String>,
105 /// Set on a workflow job's token (job_tokens.rs): its repository, job
106 /// and run.
107 #[serde(default)]
108 repo: Option<String>,
109 #[serde(default)]
110 job_id: Option<String>,
111 #[serde(default)]
112 job_run_id: Option<String>,
113 #[serde(default)]
114 job_pulls: Option<u32>,
115}
116
117#[derive(Deserialize)]
118struct WorkspaceRef {
119 id: String,
120 slug: String,
121}
122
123fn text(value: Option<&str>) -> JsValue {
124 value.map_or(JsValue::NULL, JsValue::from)
125}
126
127impl Identity {
128 pub async fn user_for_access_token(&self, token: &str) -> Result<Viewer> {
129 if !token.starts_with(TOKEN_PREFIX) {
130 return Ok(None);
131 }
132 let Some(presented) = self
133 .db
134 .prepare(format!(
135 "SELECT id, user_id, workspace_id, last_used_at, agent_scope, scopes, name,
136 repo, job_id, job_run_id, job_pulls
137 FROM access_tokens
138 WHERE token_hash = ? AND (expires_at IS NULL OR expires_at > {SQL_NOW})"
139 ))
140 .bind(&[crypto::sha256_hex(token).into()])?
141 .first::<Presented>(None)
142 .await?
143 else {
144 return Ok(None);
145 };
146 // An agent's token: g1t on behalf of the person it was made
147 // for, in its repository's workspace while they belong to it, and
148 // only for what its scope lists. See run_credentials.rs.
149 if let Some(scope) = presented
150 .agent_scope
151 .as_deref()
152 .and_then(|scope| serde_json::from_str::<AgentScope>(scope).ok())
153 {
154 return self
155 .agent_principal(
156 &presented.id,
157 presented.user_id.as_deref(),
158 presented.workspace_id.as_deref(),
159 scope,
160 )
161 .await;
162 }
163 let mut viewer = match (&presented.user_id, &presented.workspace_id) {
164 (Some(user_id), _) => {
165 self.find_user(
166 "SELECT id, username, email_verified_at IS NOT NULL AS verified
167 FROM users WHERE id = ?",
168 user_id,
169 )
170 .await?
171 }
172 (None, Some(workspace_id)) => self.workspace_principal(workspace_id).await?,
173 (None, None) => None,
174 };
175 if let Some(user) = viewer.as_mut() {
176 self.note_use(&presented).await?;
177 let (scopes, legacy) = stored_scopes(presented.scopes.as_deref());
178 user.token = Some(Box::new(TokenAccess {
179 token_id: presented.id.clone(),
180 scopes,
181 legacy,
182 name: presented.name.clone(),
183 repo: presented.repo.clone(),
184 job: match (&presented.job_id, &presented.job_run_id) {
185 (Some(job_id), Some(run_id)) => Some(JobToken {
186 run_id: run_id.clone(),
187 job_id: job_id.clone(),
188 pull_requests: presented.job_pulls == Some(1),
189 }),
190 _ => None,
191 },
192 }));
193 }
194 Ok(viewer)
195 }
196
197 fn info(row: TokenRow) -> AccessToken {
198 let (scopes, legacy) = stored_scopes(row.scopes.as_deref());
199 AccessToken {
200 id: row.id,
201 name: row.name,
202 created_at: row.created_at,
203 last_used_at: row.last_used_at,
204 created_by: row.created_by,
205 scopes,
206 legacy,
207 expires_at: row.expires_at,
208 }
209 }
210
211 /// A workspace as the actor behind one of its own tokens. It can do
212 /// what a member can, in that workspace only.
213 pub(crate) async fn workspace_principal(&self, workspace_id: &str) -> Result<Viewer> {
214 let workspace = self
215 .db
216 // A deleted workspace's tokens are refused until it is restored.
217 .prepare("SELECT id, slug FROM workspaces WHERE id = ? AND deleted_at IS NULL")
218 .bind(&[workspace_id.into()])?
219 .first::<WorkspaceRef>(None)
220 .await?;
221 Ok(workspace.map(|workspace| User {
222 id: workspace.id,
223 username: workspace.slug.clone(),
224 kind: PrincipalKind::Workspace,
225 verified: true,
226 workspaces: vec![Membership::member(workspace.slug)],
227 ..User::default()
228 }))
229 }
230
231 async fn note_use(&self, presented: &Presented) -> Result<()> {
232 let now = now_ms();
233 let stale = rfc3339(now.saturating_sub(LAST_USED_RESOLUTION_MS));
234 if presented
235 .last_used_at
236 .as_deref()
237 .is_some_and(|at| at >= stale.as_str())
238 {
239 return Ok(());
240 }
241 self.db
242 .prepare("UPDATE access_tokens SET last_used_at = ? WHERE id = ?")
243 .bind(&[rfc3339(now).into(), presented.id.as_str().into()])?
244 .run()
245 .await?;
246 Ok(())
247 }
248
249 async fn mint(
250 &self,
251 owner: Owner<'_>,
252 name: &str,
253 ttl_seconds: Option<u64>,
254 grant: &Grant,
255 listed: bool,
256 ) -> Result<CreatedAccessToken> {
257 let token = format!("{TOKEN_PREFIX}{}", crypto::random_hex(20));
258 let now = now_ms();
259 let name: String = match name.trim() {
260 "" => "Access token".to_owned(),
261 name => name.chars().take(100).collect(),
262 };
263 let (user_id, workspace_id, created_by) = match owner {
264 Owner::User(id) => (Some(id), None, Some(id)),
265 Owner::Workspace { id, created_by } => (None, Some(id), created_by),
266 };
267 let expires_at = ttl_seconds.map(|ttl| rfc3339(now + ttl * 1000));
268 let info = AccessToken {
269 id: new_id("tok", now),
270 name,
271 created_at: rfc3339(now),
272 last_used_at: None,
273 created_by: None,
274 scopes: grant
275 .scopes
276 .as_ref()
277 .map(|scopes| scopes.iter().map(|scope| scope.as_str().to_owned()).collect()),
278 legacy: false,
279 expires_at: expires_at.clone(),
280 };
281 self.db
282 .prepare(
283 "INSERT INTO access_tokens
284 (id, user_id, workspace_id, created_by, name, token_hash, created_at, expires_at,
285 scopes, listed)
286 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
287 )
288 .bind(&[
289 info.id.as_str().into(),
290 text(user_id),
291 text(workspace_id),
292 text(created_by),
293 info.name.as_str().into(),
294 crypto::sha256_hex(&token).into(),
295 info.created_at.as_str().into(),
296 text(expires_at.as_deref()),
297 grant.scopes_column().into(),
298 JsValue::from(u8::from(listed)),
299 ])?
300 .run()
301 .await?;
302 Ok(CreatedAccessToken { token, info })
303 }
304
305 /// A workspace's own token that expires and is never listed: what a
306 /// workflow job's token is minted as (job_tokens.rs).
307 pub(crate) async fn mint_for_workspace(
308 &self,
309 workspace_id: &str,
310 name: &str,
311 ttl_seconds: u64,
312 grant: &Grant,
313 ) -> Result<CreatedAccessToken> {
314 self.mint(
315 Owner::Workspace {
316 id: workspace_id,
317 created_by: None,
318 },
319 name,
320 Some(ttl_seconds),
321 grant,
322 false,
323 )
324 .await
325 }
326
327 pub async fn create_access_token(
328 &self,
329 a: CreateAccessTokenArgs,
330 ) -> Result<CreatedAccessToken> {
331 // Told apart by the id, which says what it names, since callers pass
332 // on actors that other services stored as an id and a name.
333 let owner = if a.user.id.starts_with(WORKSPACE_ID_PREFIX) {
334 Owner::Workspace {
335 id: &a.user.id,
336 created_by: None,
337 }
338 } else {
339 Owner::User(&a.user.id)
340 };
341 let created = self.mint(owner, &a.name, a.ttl_seconds, &Grant::asked(&a.scopes), a.listed).await?;
342 // A person's lasting token: in their security log and their
343 // workspaces' audit logs. Short-lived ones (agents' runs, OAuth
344 // access tokens) are recorded where they are made.
345 if a.ttl_seconds.is_none() && !a.user.id.starts_with(WORKSPACE_ID_PREFIX) && !a.user.username.is_empty() {
346 self.log_security(&a.user.id, "token_created", Some(&created.info.name), None).await;
347 self.audit_account(&a.user, "token.created", &format!("Created access token {}", created.info.name)).await;
348 }
349 Ok(created)
350 }
351
352 /// `remove_access_token`: deletes one of a person's own tokens.
353 pub async fn remove_access_token(&self, a: RemoveArgs) -> Result<()> {
354 let name: Option<String> = self
355 .db
356 .prepare("DELETE FROM access_tokens WHERE id = ? AND user_id = ? RETURNING name")
357 .bind(&[a.id.as_str().into(), a.user.id.as_str().into()])?
358 .first(Some("name"))
359 .await?;
360 if let Some(name) = name {
361 self.log_security(&a.user.id, "token_deleted", Some(&name), None).await;
362 self.audit_account(&a.user, "token.deleted", &format!("Deleted access token {name}")).await;
363 }
364 Ok(())
365 }
366
367 /// Changes what one of a person's own tokens may do.
368 pub async fn update_access_token(&self, a: UpdateAccessTokenArgs) -> Result<Outcome<AccessToken>> {
369 let grant = Grant::asked(&a.scopes);
370 let found: Option<String> = self
371 .db
372 .prepare(
373 "UPDATE access_tokens SET scopes = ?
374 WHERE id = ? AND user_id = ? AND agent_scope IS NULL
375 RETURNING id",
376 )
377 .bind(&[
378 grant.scopes_column().into(),
379 a.id.as_str().into(),
380 a.user.id.as_str().into(),
381 ])?
382 .first(Some("id"))
383 .await?;
384 if found.is_none() {
385 return Ok(Outcome::fail(FailureCode::NotFound, "No such token."));
386 }
387 let row = self
388 .db
389 .prepare(format!(
390 "SELECT {TOKEN_COLUMNS} FROM access_tokens
391 LEFT JOIN users ON users.id = access_tokens.created_by
392 WHERE access_tokens.id = ?"
393 ))
394 .bind(&[a.id.into()])?
395 .first::<TokenRow>(None)
396 .await?;
397 match row {
398 Some(row) => {
399 let info = Self::info(row);
400 self.log_security(&a.user.id, "token_rescoped", Some(&info.name), None).await;
401 self.audit_account(&a.user, "token.rescoped", &format!("Changed the scopes of access token {}", info.name)).await;
402 Ok(Outcome::Ok(info))
403 }
404 None => Ok(Outcome::fail(FailureCode::NotFound, "No such token.")),
405 }
406 }
407
408 /// A token for a g1t agent working for `on_behalf_of`, which can do
409 /// only what `scope` lists. It is recorded as theirs, so it is listed and
410 /// can be deleted with their other tokens.
411 pub async fn create_agent_token(&self, a: CreateAgentTokenArgs) -> Result<CreatedAccessToken> {
412 let created = self
413 .mint(
414 Owner::User(&a.on_behalf_of.id),
415 &format!("g1t agent in {}/{}", a.scope.repo.namespace, a.scope.repo.name),
416 Some(a.ttl_seconds),
417 &Grant::default(),
418 false,
419 )
420 .await?;
421 self.db
422 .prepare("UPDATE access_tokens SET agent_scope = ? WHERE id = ?")
423 .bind(&[
424 serde_json::to_string(&a.scope)?.into(),
425 created.info.id.as_str().into(),
426 ])?
427 .run()
428 .await?;
429 Ok(created)
430 }
431
432 /// What an agent's token may do, or `None` for any other token.
433 pub async fn agent_scope(&self, a: TokenArgs) -> Result<Option<AgentScope>> {
434 let scope: Option<Option<String>> = self
435 .db
436 .prepare(format!(
437 "SELECT agent_scope FROM access_tokens
438 WHERE token_hash = ? AND (expires_at IS NULL OR expires_at > {SQL_NOW})"
439 ))
440 .bind(&[crypto::sha256_hex(&a.token).into()])?
441 .first::<Option<String>>(Some("agent_scope"))
442 .await?;
443 Ok(scope
444 .flatten()
445 .and_then(|scope| serde_json::from_str(&scope).ok()))
446 }
447
448 pub async fn list_access_tokens(&self, a: UserArgs) -> Result<Vec<AccessToken>> {
449 self.tokens_where("access_tokens.user_id = ?", &a.user.id)
450 .await
451 }
452
453 /// The tokens a person or workspace made on purpose: those that do not
454 /// expire, and those made with an expiry from settings, rather than
455 /// those issued to an application or a hosted agent.
456 async fn tokens_where(&self, owner: &str, id: &str) -> Result<Vec<AccessToken>> {
457 let rows = self
458 .db
459 .prepare(format!(
460 "SELECT {TOKEN_COLUMNS} FROM access_tokens
461 LEFT JOIN users ON users.id = access_tokens.created_by
462 WHERE {owner} AND (access_tokens.expires_at IS NULL OR access_tokens.listed = 1)
463 AND access_tokens.agent_scope IS NULL
464 ORDER BY access_tokens.id"
465 ))
466 .bind(&[id.into()])?
467 .all()
468 .await?
469 .results::<TokenRow>()?;
470 Ok(rows.into_iter().map(Self::info).collect())
471 }
472
473 pub async fn list_workspace_tokens(
474 &self,
475 a: WorkspaceTokensArgs,
476 ) -> Result<Outcome<Vec<AccessToken>>> {
477 let slug = a.slug.to_lowercase();
478 if !a.viewer.is_some_and(|viewer| viewer.is_member(&slug)) {
479 return Ok(Outcome::fail(
480 FailureCode::Forbidden,
481 "Only members can see a workspace's access tokens.",
482 ));
483 }
484 let Some(workspace) = self.get_workspace(SlugArgs { slug }).await? else {
485 return Ok(Outcome::fail(FailureCode::NotFound, "Workspace not found."));
486 };
487 Ok(Outcome::Ok(
488 self.tokens_where("access_tokens.workspace_id = ?", &workspace.id)
489 .await?,
490 ))
491 }
492
493 /// The workspace's id, if `actor` is a person who owns it.
494 async fn owned_workspace(&self, actor: &User, slug: &str) -> Result<Outcome<String>> {
495 let slug = slug.to_lowercase();
496 if actor.kind != PrincipalKind::User || actor.role_in(&slug) != Some(Role::Owner) {
497 return Ok(Outcome::fail(
498 FailureCode::Forbidden,
499 "Only an owner can manage a workspace's access tokens.",
500 ));
501 }
502 Ok(match self.get_workspace(SlugArgs { slug }).await? {
503 Some(workspace) => Outcome::Ok(workspace.id),
504 None => Outcome::fail(FailureCode::NotFound, "Workspace not found."),
505 })
506 }
507
508 pub async fn create_workspace_token(
509 &self,
510 a: CreateWorkspaceTokenArgs,
511 ) -> Result<Outcome<CreatedAccessToken>> {
512 let workspace_id = match self.owned_workspace(&a.actor, &a.slug).await? {
513 Outcome::Ok(id) => id,
514 Outcome::Fail(failure) => return Ok(Outcome::Fail(failure)),
515 };
516 if a.name.trim().is_empty() {
517 return Ok(Outcome::fail(
518 FailureCode::Invalid,
519 "Name the token after what will use it.",
520 ));
521 }
522 let existing = self
523 .tokens_where("access_tokens.workspace_id = ?", &workspace_id)
524 .await?;
525 if existing.len() >= MAX_TOKENS_PER_WORKSPACE {
526 return Ok(Outcome::fail(
527 FailureCode::Conflict,
528 "This workspace has the maximum number of access tokens. Delete one first.",
529 ));
530 }
531 // A workspace's token reaches that workspace only: it acts as the
532 // workspace (see `workspace_principal`), narrowed by its scopes.
533 let grant = Grant::asked(&a.scopes);
534 let mut created = self
535 .mint(
536 Owner::Workspace {
537 id: &workspace_id,
538 created_by: Some(&a.actor.id),
539 },
540 &a.name,
541 a.ttl_seconds,
542 &grant,
543 true,
544 )
545 .await?;
546 created.info.created_by = Some(a.actor.username.clone());
547 self.audit_workspace(
548 &a.actor,
549 "workspace_token.created",
550 &a.slug.to_lowercase(),
551 g1t_contracts::audit::Surface::Web,
552 format!("Created workspace access token {}", created.info.name),
553 )
554 .await;
555 Ok(Outcome::Ok(created))
556 }
557
558 pub async fn remove_workspace_token(
559 &self,
560 a: RemoveWorkspaceTokenArgs,
561 ) -> Result<Outcome<bool>> {
562 let workspace_id = match self.owned_workspace(&a.actor, &a.slug).await? {
563 Outcome::Ok(id) => id,
564 Outcome::Fail(failure) => return Ok(Outcome::Fail(failure)),
565 };
566 let name: Option<String> = self
567 .db
568 .prepare("DELETE FROM access_tokens WHERE id = ? AND workspace_id = ? RETURNING name")
569 .bind(&[a.id.into(), workspace_id.into()])?
570 .first(Some("name"))
571 .await?;
572 if let Some(name) = name {
573 self.audit_workspace(
574 &a.actor,
575 "workspace_token.deleted",
576 &a.slug.to_lowercase(),
577 g1t_contracts::audit::Surface::Web,
578 format!("Deleted workspace access token {name}"),
579 )
580 .await;
581 }
582 Ok(Outcome::Ok(true))
583 }
584}
585
586#[cfg(test)]
587mod tests {
588 use super::*;
589
590 #[test]
591 fn a_row_without_scopes_is_legacy_full_access() {
592 assert_eq!(stored_scopes(None), (None, true));
593 assert_eq!(stored_scopes(Some("*")), (None, false));
594 assert_eq!(
595 stored_scopes(Some("issues:write repo:read nonsense")),
596 (Some(vec!["repo:read".to_owned(), "issues:write".to_owned()]), false)
597 );
598 }
599
600 #[test]
601 fn scopes_are_stored_as_text() {
602 let grant = Grant::asked(&Some(vec!["issues:read".to_owned(), "bogus".to_owned()]));
603 assert_eq!(grant.scopes_column(), "issues:read");
604 assert_eq!(Grant::asked(&None).scopes_column(), "*");
605 assert_eq!(Grant::asked(&Some(vec![])).scopes_column(), "");
606 }
607}