Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp
285 linesCodeBlameRaw
1/**
2 * Who is asking: sudo sits behind Cloudflare Access, and checks Access's
3 * work itself on every request. Access signs a JWT for each request it
4 * lets through and sends it in `Cf-Access-Jwt-Assertion`; this verifies
5 * its RS256 signature against the team's published keys, its audience,
6 * issuer and lifetime, and then that its email belongs to g1t staff.
7 *
8 * Plain Web Crypto, no dependencies and no Workers imports, so the tests
9 * run it under Node as it runs on Workers.
10 */
11
12/** Where sudo is served; the only origin a change may be posted from. */
13export const ORIGIN = "https://sudo.g1t.sh";
14
15/** How far clocks may disagree, in seconds. */
16const LEEWAY_SECONDS = 30;
17/** How long the team's keys are trusted before they are fetched again. */
18const JWKS_TTL_MS = 5 * 60_000;
19/** A token signed by a key not seen yet refetches the keys, at most this often. */
20const JWKS_REFETCH_MS = 30_000;
21/** Access tokens are a few kilobytes; anything far larger is not one. */
22const MAX_TOKEN_LENGTH = 16_384;
23
24export type AccessSettings = {
25 /** The Zero Trust team domain, such as `g1t.cloudflareaccess.com`. */
26 teamDomain: string;
27 /** The Access application's Audience (AUD) tag. */
28 aud: string;
29 /** Lowercased staff emails, and `@domain` for everyone at a domain. */
30 staff: string[];
31 /**
32 * Access service tokens let in as staff, by client id: the name each
33 * acts as. A service token's JWT has no email, only `common_name`, the
34 * token's client id; it is recorded as `<name>@service.g1t.sh`.
35 */
36 services: Map<string, string>;
37};
38
39export type AccessEnv = {
40 ACCESS_TEAM_DOMAIN?: string;
41 ACCESS_AUD?: string;
42 STAFF_EMAILS?: string;
43 /** `<client id>=<name>`, comma separated: service tokens let in as staff. */
44 STAFF_SERVICE_TOKENS?: string;
45};
46
47/** The domain a service token's staff identity is recorded under. */
48export const SERVICE_STAFF_DOMAIN = "service.g1t.sh";
49
50/**
51 * `abc.access=claude, def.access=ci` as client id to name. Entries without
52 * a name, or whose name is not a plain lowercase word, are dropped.
53 */
54export function parseServiceTokens(raw: string): Map<string, string> {
55 const out = new Map<string, string>();
56 for (const entry of raw.split(",")) {
57 const [id = "", name = ""] = entry.split("=").map((part) => part.trim());
58 if (/^[A-Za-z0-9]{16,64}\.access$/.test(id) && /^[a-z][a-z0-9-]{0,31}$/.test(name)) out.set(id, name);
59 }
60 return out;
61}
62
63/**
64 * Reads the settings, or null when any is missing or malformed: sudo then
65 * refuses everything rather than guess.
66 */
67export function readSettings(env: AccessEnv): AccessSettings | null {
68 const teamDomain = normalizeTeamDomain(env.ACCESS_TEAM_DOMAIN ?? "");
69 const aud = (env.ACCESS_AUD ?? "").trim();
70 const staff = parseStaff(env.STAFF_EMAILS ?? "");
71 if (!teamDomain || !/^[A-Za-z0-9]{16,128}$/.test(aud) || staff.length === 0) return null;
72 return { teamDomain, aud, staff, services: parseServiceTokens(env.STAFF_SERVICE_TOKENS ?? "") };
73}
74
75/**
76 * `g1t.cloudflareaccess.com`, given with or without its scheme. Only a
77 * Cloudflare Access team domain is accepted, since that is where the
78 * signing keys are fetched from.
79 */
80export function normalizeTeamDomain(raw: string): string | null {
81 const host = raw
82 .trim()
83 .toLowerCase()
84 .replace(/^https:\/\//, "")
85 .replace(/\/+$/, "");
86 return /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.cloudflareaccess\.com$/.test(host) ? host : null;
87}
88
89/**
90 * The staff list: emails, and `@g1t.sh` for everyone with an address at
91 * that domain. Access proves the address belongs to whoever signed in.
92 */
93export function parseStaff(raw: string): string[] {
94 return raw
95 .split(/[,\s]+/)
96 .map((email) => email.trim().toLowerCase())
97 .filter((email) => /^[^@\s]*@[a-z0-9.-]+\.[a-z]{2,}$/.test(email));
98}
99
100/** Whether a signed-in email is on the staff list: exactly, or by its whole domain. */
101export function isStaff(email: string, staff: string[]): boolean {
102 const at = email.lastIndexOf("@");
103 if (at <= 0 || email.indexOf("@") !== at) return false;
104 const domain = email.slice(at);
105 return staff.some((entry) => (entry.startsWith("@") ? entry === domain : entry === email));
106}
107
108export type AccessClaims = {
109 iss: string;
110 aud: string | string[];
111 exp: number;
112 nbf?: number;
113 iat?: number;
114 sub?: string;
115 email?: string;
116 /** A service token's client id, on tokens with no email. */
117 common_name?: string;
118 [claim: string]: unknown;
119};
120
121export type Verified = { ok: true; claims: AccessClaims } | { ok: false; reason: string };
122
123export type VerifyOptions = {
124 /** Fetches the team's keys; the global `fetch` unless a test gives another. */
125 fetcher?: (url: string) => Promise<Response>;
126 /** Milliseconds since the epoch. */
127 now?: number;
128};
129
130type KeySet = { keys: Map<string, CryptoKey>; fetchedAt: number };
131
132/** The team's signing keys, by team domain, kept briefly in memory. */
133const keySets = new Map<string, KeySet>();
134
135/** Forgets the cached keys. For tests. */
136export function clearKeyCache(): void {
137 keySets.clear();
138}
139
140const RSA = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" } as const;
141
142async function fetchKeySet(teamDomain: string, fetcher: (url: string) => Promise<Response>, now: number): Promise<KeySet> {
143 const response = await fetcher(`https://${teamDomain}/cdn-cgi/access/certs`);
144 if (!response.ok) throw new Error(`Access keys answered ${response.status}`);
145 const body = (await response.json()) as { keys?: unknown };
146 const keys = new Map<string, CryptoKey>();
147 for (const jwk of Array.isArray(body.keys) ? body.keys : []) {
148 if (!jwk || typeof jwk !== "object") continue;
149 const { kid, kty, n, e, alg, use } = jwk as Record<string, unknown>;
150 if (typeof kid !== "string" || kty !== "RSA" || typeof n !== "string" || typeof e !== "string") continue;
151 if (alg !== undefined && alg !== "RS256") continue;
152 if (use !== undefined && use !== "sig") continue;
153 try {
154 keys.set(kid, await crypto.subtle.importKey("jwk", { kty, n, e }, RSA, false, ["verify"]));
155 } catch {
156 // A key that does not import is skipped; tokens signed by it fail.
157 }
158 }
159 return { keys, fetchedAt: now };
160}
161
162/** The key a token names, fetching the team's keys when they are stale or it is new. */
163async function keyFor(teamDomain: string, kid: string, fetcher: (url: string) => Promise<Response>, now: number): Promise<CryptoKey | null> {
164 let set = keySets.get(teamDomain);
165 const stale = !set || now - set.fetchedAt >= JWKS_TTL_MS;
166 const unknown = set && !set.keys.has(kid) && now - set.fetchedAt >= JWKS_REFETCH_MS;
167 if (stale || unknown) {
168 try {
169 set = await fetchKeySet(teamDomain, fetcher, now);
170 keySets.set(teamDomain, set);
171 } catch {
172 // Keys that could not be refreshed are not trusted past their time.
173 if (stale) {
174 keySets.delete(teamDomain);
175 return null;
176 }
177 }
178 }
179 return set?.keys.get(kid) ?? null;
180}
181
182function base64UrlBytes(segment: string): Uint8Array<ArrayBuffer> {
183 const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
184 const binary = atob(base64 + "=".repeat((4 - (base64.length % 4)) % 4));
185 const bytes = new Uint8Array(binary.length);
186 for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
187 return bytes;
188}
189
190function decodeJson(segment: string): Record<string, unknown> | null {
191 try {
192 const value: unknown = JSON.parse(new TextDecoder().decode(base64UrlBytes(segment)));
193 return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : null;
194 } catch {
195 return null;
196 }
197}
198
199/** Verifies an Access JWT: signature, algorithm, issuer, audience and lifetime. */
200export async function verifyAccessJwt(token: string, settings: Pick<AccessSettings, "teamDomain" | "aud">, options: VerifyOptions = {}): Promise<Verified> {
201 const now = options.now ?? Date.now();
202 const fetcher = options.fetcher ?? ((url: string) => fetch(url));
203
204 if (token.length > MAX_TOKEN_LENGTH) return { ok: false, reason: "token too long" };
205 const parts = token.split(".");
206 if (parts.length !== 3 || !parts.every((part) => /^[A-Za-z0-9_-]+$/.test(part))) {
207 return { ok: false, reason: "malformed token" };
208 }
209 const [encodedHeader, encodedPayload, encodedSignature] = parts;
210 const header = decodeJson(encodedHeader);
211 const payload = decodeJson(encodedPayload);
212 if (!header || !payload) return { ok: false, reason: "malformed token" };
213 // Only RS256: never `none`, and never a symmetric algorithm keyed with a public key.
214 if (header.alg !== "RS256") return { ok: false, reason: "unexpected algorithm" };
215 if (typeof header.kid !== "string" || !header.kid) return { ok: false, reason: "no key id" };
216
217 const key = await keyFor(settings.teamDomain, header.kid, fetcher, now);
218 if (!key) return { ok: false, reason: "unknown signing key" };
219
220 let signature: Uint8Array<ArrayBuffer>;
221 try {
222 signature = base64UrlBytes(encodedSignature);
223 } catch {
224 return { ok: false, reason: "malformed signature" };
225 }
226 const signed = new TextEncoder().encode(`${encodedHeader}.${encodedPayload}`);
227 const valid = await crypto.subtle.verify(RSA, key, signature, signed);
228 if (!valid) return { ok: false, reason: "bad signature" };
229
230 // Only now that the signature holds do the claims mean anything.
231 if (payload.iss !== `https://${settings.teamDomain}`) return { ok: false, reason: "wrong issuer" };
232 const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
233 if (!audiences.includes(settings.aud)) return { ok: false, reason: "wrong audience" };
234 const seconds = Math.floor(now / 1000);
235 if (typeof payload.exp !== "number") return { ok: false, reason: "no expiry" };
236 if (seconds >= payload.exp + LEEWAY_SECONDS) return { ok: false, reason: "expired" };
237 if (payload.nbf !== undefined) {
238 if (typeof payload.nbf !== "number") return { ok: false, reason: "malformed nbf" };
239 if (seconds + LEEWAY_SECONDS < payload.nbf) return { ok: false, reason: "not yet valid" };
240 }
241 return { ok: true, claims: payload as AccessClaims };
242}
243
244export type Authorized = { ok: true; email: string } | { ok: false; reason: string; email?: string };
245
246/**
247 * Whether a request comes from g1t staff, through Access: a valid token
248 * whose email is on the staff list, or a service token's (no email, its
249 * client id as `common_name`) listed in STAFF_SERVICE_TOKENS, which acts as
250 * `<name>@service.g1t.sh`. Any other service token is refused.
251 */
252export async function authorize(request: Request, settings: AccessSettings, options: VerifyOptions = {}): Promise<Authorized> {
253 const token = request.headers.get("cf-access-jwt-assertion");
254 if (!token) return { ok: false, reason: "no Access token" };
255 const verified = await verifyAccessJwt(token, settings, options);
256 if (!verified.ok) return verified;
257 const email = typeof verified.claims.email === "string" ? verified.claims.email.trim().toLowerCase() : "";
258 if (!email) {
259 const client = typeof verified.claims.common_name === "string" ? verified.claims.common_name.trim() : "";
260 const name = client ? settings.services.get(client) : undefined;
261 if (!name) return { ok: false, reason: client ? "service token not staff" : "token has no email" };
262 return { ok: true, email: `${name}@${SERVICE_STAFF_DOMAIN}` };
263 }
264 if (!isStaff(email, settings.staff)) return { ok: false, reason: "not staff", email };
265 return { ok: true, email };
266}
267
268/**
269 * Whether a change was posted from sudo's own pages: the browser's
270 * `Origin`, or failing that its `Referer`, must be sudo's. A request that
271 * says neither is refused.
272 */
273export function isSameOrigin(request: Request): boolean {
274 const site = request.headers.get("sec-fetch-site");
275 if (site !== null && site !== "same-origin") return false;
276 const origin = request.headers.get("origin");
277 if (origin !== null) return origin === ORIGIN;
278 const referer = request.headers.get("referer");
279 if (!referer) return false;
280 try {
281 return new URL(referer).origin === ORIGIN;
282 } catch {
283 return false;
284 }
285}