217 lines
9.1 KiB
JavaScript
217 lines
9.1 KiB
JavaScript
import { createHash, randomBytes } from "node:crypto";
|
|
|
|
const IDENTIFIER = /^[a-z][a-z0-9._:-]{2,127}$/;
|
|
const TOKEN_PREFIX = "ndc_edprb_";
|
|
const SECRET_LIKE_KEY = /(token|secret|password|authorization|access[_-]?token|refresh[_-]?token|api[_-]?key)/i;
|
|
const REQUEST_KEYS = new Set(["source", "allowedDataProductIds", "expiresAt"]);
|
|
const MANAGED_REQUEST_KEYS = new Set([
|
|
"source",
|
|
"allowedDataProductIds",
|
|
"expiresAt",
|
|
"generation",
|
|
"capabilityDigest",
|
|
]);
|
|
const MANAGED_CONSUMER_REQUEST_KEYS = new Set([
|
|
"allowedDataProductIds",
|
|
"expiresAt",
|
|
"generation",
|
|
"capabilityDigest",
|
|
]);
|
|
const MANAGED_CONSUMER_PLAN_KEYS = new Set(["allowedDataProductIds"]);
|
|
const SOURCE_KEYS = new Set(["tenantId", "connectionId", "providerId"]);
|
|
const SHA256_DIGEST = /^[a-f0-9]{64}$/;
|
|
|
|
export function createReaderToken() {
|
|
return `${TOKEN_PREFIX}${randomBytes(32).toString("base64url")}`;
|
|
}
|
|
|
|
export function hashReaderToken(token) {
|
|
return createHash("sha256").update(String(token), "utf8").digest("hex");
|
|
}
|
|
|
|
export function normalizeReaderBindingRequest(value, { now = new Date(), maxTtlDays = 90 } = {}) {
|
|
if (!isPlainObject(value) || !isPlainObject(value.source)) throw readerError("reader_binding_request_invalid");
|
|
if (containsSecretLikeKey(value)) throw readerError("reader_binding_request_secret_material_forbidden");
|
|
if (!hasOnlyKeys(value, REQUEST_KEYS) || !hasOnlyKeys(value.source, SOURCE_KEYS)) {
|
|
throw readerError("reader_binding_request_fields_invalid");
|
|
}
|
|
const tenantId = identifier(value.source.tenantId);
|
|
const connectionId = identifier(value.source.connectionId);
|
|
const providerId = identifier(value.source.providerId);
|
|
const allowedDataProductIds = uniqueIdentifiers(value.allowedDataProductIds);
|
|
if (!tenantId || !connectionId || !providerId || !allowedDataProductIds.length) {
|
|
throw readerError("reader_binding_scope_invalid");
|
|
}
|
|
const expiresAt = new Date(String(value.expiresAt || ""));
|
|
const maxExpiresAt = new Date(now.getTime() + maxTtlDays * 24 * 60 * 60 * 1000);
|
|
if (Number.isNaN(expiresAt.getTime()) || expiresAt <= now || expiresAt > maxExpiresAt) {
|
|
throw readerError("reader_binding_expiry_invalid");
|
|
}
|
|
return Object.freeze({ tenantId, connectionId, providerId, allowedDataProductIds, expiresAt: expiresAt.toISOString() });
|
|
}
|
|
|
|
export function normalizeManagedReaderBindingRequest(value) {
|
|
if (!isPlainObject(value) || !isPlainObject(value.source)) {
|
|
throw readerError("managed_reader_binding_request_invalid");
|
|
}
|
|
if (containsSecretLikeKey(value)) {
|
|
throw readerError("managed_reader_binding_secret_material_forbidden");
|
|
}
|
|
if (!hasOnlyKeys(value, MANAGED_REQUEST_KEYS) || !hasOnlyKeys(value.source, SOURCE_KEYS)) {
|
|
throw readerError("managed_reader_binding_request_fields_invalid");
|
|
}
|
|
const tenantId = identifier(value.source.tenantId);
|
|
const connectionId = identifier(value.source.connectionId);
|
|
const providerId = identifier(value.source.providerId);
|
|
const allowedDataProductIds = uniqueIdentifiers(value.allowedDataProductIds);
|
|
if (!tenantId || !connectionId || !providerId || !allowedDataProductIds.length) {
|
|
throw readerError("managed_reader_binding_scope_invalid");
|
|
}
|
|
if (value.expiresAt !== null) {
|
|
throw readerError("managed_reader_binding_must_be_durable");
|
|
}
|
|
const generation = Number(value.generation);
|
|
if (!Number.isSafeInteger(generation) || generation < 1 || generation > 2_147_483_647) {
|
|
throw readerError("managed_reader_binding_generation_invalid");
|
|
}
|
|
const capabilityDigest = String(value.capabilityDigest || "").toLowerCase();
|
|
if (!SHA256_DIGEST.test(capabilityDigest)) {
|
|
throw readerError("managed_reader_binding_capability_digest_invalid");
|
|
}
|
|
return Object.freeze({
|
|
tenantId,
|
|
connectionId,
|
|
providerId,
|
|
allowedDataProductIds: Object.freeze([...allowedDataProductIds].sort()),
|
|
expiresAt: null,
|
|
generation,
|
|
capabilityDigest,
|
|
});
|
|
}
|
|
|
|
export function normalizeManagedConsumerReaderPlanRequest(value) {
|
|
if (!isPlainObject(value) || containsSecretLikeKey(value) || !hasOnlyKeys(value, MANAGED_CONSUMER_PLAN_KEYS)) {
|
|
throw readerError("managed_consumer_reader_plan_request_invalid");
|
|
}
|
|
const allowedDataProductIds = uniqueIdentifiers(value.allowedDataProductIds);
|
|
if (!allowedDataProductIds.length) throw readerError("managed_consumer_reader_scope_invalid");
|
|
return Object.freeze({ allowedDataProductIds: Object.freeze([...allowedDataProductIds].sort()) });
|
|
}
|
|
|
|
export function normalizeManagedConsumerReaderBindingRequest(value) {
|
|
if (!isPlainObject(value) || containsSecretLikeKey(value) || !hasOnlyKeys(value, MANAGED_CONSUMER_REQUEST_KEYS)) {
|
|
throw readerError("managed_consumer_reader_binding_request_invalid");
|
|
}
|
|
const allowedDataProductIds = uniqueIdentifiers(value.allowedDataProductIds);
|
|
if (!allowedDataProductIds.length) throw readerError("managed_consumer_reader_scope_invalid");
|
|
if (value.expiresAt !== null) throw readerError("managed_consumer_reader_must_be_durable");
|
|
const generation = Number(value.generation);
|
|
if (!Number.isSafeInteger(generation) || generation < 1 || generation > 2_147_483_647) {
|
|
throw readerError("managed_consumer_reader_generation_invalid");
|
|
}
|
|
const capabilityDigest = String(value.capabilityDigest || "").toLowerCase();
|
|
if (!SHA256_DIGEST.test(capabilityDigest)) {
|
|
throw readerError("managed_consumer_reader_capability_digest_invalid");
|
|
}
|
|
return Object.freeze({
|
|
allowedDataProductIds: Object.freeze([...allowedDataProductIds].sort()),
|
|
expiresAt: null,
|
|
generation,
|
|
capabilityDigest,
|
|
});
|
|
}
|
|
|
|
export function readerBindingRequestHash(policy) {
|
|
const canonical = JSON.stringify({
|
|
tenantId: policy.tenantId,
|
|
connectionId: policy.connectionId,
|
|
providerId: policy.providerId,
|
|
allowedDataProductIds: [...policy.allowedDataProductIds].sort(),
|
|
expiresAt: null,
|
|
generation: policy.generation,
|
|
capabilityDigest: policy.capabilityDigest,
|
|
});
|
|
return createHash("sha256").update(canonical, "utf8").digest("hex");
|
|
}
|
|
|
|
export function consumerReaderBindingRequestHash(policy) {
|
|
return createHash("sha256").update(JSON.stringify({
|
|
allowedDataProductIds: [...policy.allowedDataProductIds].sort(),
|
|
expiresAt: null,
|
|
generation: policy.generation,
|
|
capabilityDigest: policy.capabilityDigest,
|
|
}), "utf8").digest("hex");
|
|
}
|
|
|
|
export function assertReaderProduct(binding, dataProductId, now = new Date()) {
|
|
const expired = binding?.expiresAt !== null && new Date(binding?.expiresAt) <= now;
|
|
if (!isPlainObject(binding) || binding.active !== true || expired) {
|
|
throw readerError("reader_binding_inactive", 401);
|
|
}
|
|
const normalized = identifier(dataProductId);
|
|
if (!normalized || !uniqueIdentifiers(binding.allowedDataProductIds).includes(normalized)) {
|
|
throw readerError("reader_binding_data_product_forbidden", 403);
|
|
}
|
|
return normalized;
|
|
}
|
|
|
|
export function safeReaderBinding(binding) {
|
|
return {
|
|
id: binding.id,
|
|
...(binding.bindingKey ? { bindingKey: binding.bindingKey } : {}),
|
|
...(Number.isInteger(Number(binding.generation)) ? { generation: Number(binding.generation) } : {}),
|
|
tenantId: binding.tenantId,
|
|
connectionId: binding.connectionId,
|
|
providerId: binding.providerId,
|
|
allowedDataProductIds: uniqueIdentifiers(binding.allowedDataProductIds),
|
|
active: binding.active === true,
|
|
expiresAt: binding.expiresAt === null ? null : new Date(binding.expiresAt).toISOString(),
|
|
createdAt: binding.createdAt ? new Date(binding.createdAt).toISOString() : undefined,
|
|
rotatedAt: binding.rotatedAt ? new Date(binding.rotatedAt).toISOString() : undefined,
|
|
revokedAt: binding.revokedAt ? new Date(binding.revokedAt).toISOString() : undefined,
|
|
};
|
|
}
|
|
|
|
export function safeManagedConsumerReaderBinding(binding) {
|
|
return {
|
|
id: binding.id,
|
|
bindingKey: binding.bindingKey,
|
|
generation: Number(binding.generation),
|
|
allowedDataProductIds: uniqueIdentifiers(binding.allowedDataProductIds),
|
|
active: binding.active === true,
|
|
expiresAt: binding.expiresAt === null ? null : new Date(binding.expiresAt).toISOString(),
|
|
createdAt: binding.createdAt ? new Date(binding.createdAt).toISOString() : undefined,
|
|
rotatedAt: binding.rotatedAt ? new Date(binding.rotatedAt).toISOString() : undefined,
|
|
revokedAt: binding.revokedAt ? new Date(binding.revokedAt).toISOString() : undefined,
|
|
sourceScope: "resolved-server-side",
|
|
};
|
|
}
|
|
|
|
function readerError(code, status = 400) {
|
|
return Object.assign(new Error(code), { status, code });
|
|
}
|
|
|
|
function identifier(value) {
|
|
const normalized = typeof value === "string" ? value.trim() : "";
|
|
return IDENTIFIER.test(normalized) ? normalized : "";
|
|
}
|
|
|
|
function uniqueIdentifiers(value) {
|
|
if (!Array.isArray(value)) return [];
|
|
return [...new Set(value.map(identifier).filter(Boolean))];
|
|
}
|
|
|
|
function containsSecretLikeKey(value) {
|
|
if (Array.isArray(value)) return value.some(containsSecretLikeKey);
|
|
if (!isPlainObject(value)) return false;
|
|
return Object.entries(value).some(([key, child]) => SECRET_LIKE_KEY.test(key) || containsSecretLikeKey(child));
|
|
}
|
|
|
|
function isPlainObject(value) {
|
|
return Boolean(value) && typeof value === "object" && !Array.isArray(value);
|
|
}
|
|
|
|
function hasOnlyKeys(value, allowed) {
|
|
return Object.keys(value).every((key) => allowed.has(key));
|
|
}
|