feat(connect): Skatteverket broker + data proxy for self-hosted instances (tokens stay on the instance) (#1757)
* feat(entitlements): partition the self-host bypass so connector capabilities fall through to grants; capability_grants.source accepts 'connector' Sovereign plan WS3 PR3: ships dark, nothing changes for hosted. - lib/entitlements/keys.ts: CONNECTOR_CAPABILITIES = bank_sync, skatteverket, org_lookup, migration (services Accounted operates that a self-hosted instance cannot provide itself) + isConnectorCapability(). Separate from PAID_CAPABILITIES and outside the trial-seed trigger on purpose: a hosted company can never hold a connector grant. - lib/entitlements/has-capability.ts: isPaywallBypassed() -> isBypassedFor(key). Hosted: byte-identical (dev / DISABLE_PAYWALL bypass, FORCE_PAYWALL wins, else the grant lookup). Self-host: local capabilities always on (FORCE_PAYWALL included, as the existing test demands); connector capabilities behave like hosted, i.e. dev bypass, FORCE_PAYWALL, else the grant lookup where the connector sync will write source='connector' rows. getCompanyEntitlements on a self-host: local paid keys + active connector keys, state 'paid' with an active connector grant else 'none' (never the hosted trial copy). - Migration 20260820122000: capability_grants.source CHECK gains 'connector', found through pg_constraint (the CHECK was declared inline and auto-named; Postgres stores IN as = ANY, matched accordingly). pg-real test: connector accepted, unknown source rejected, upsert on the (scope, key, source) identity, trial seed writes no connector rows. - Tests: self-hosted connector matrix (local all-on without DB, connector gated by grant/expiry, dev bypass all-on, FORCE_PAYWALL gates connector keys only, bulk resolution, entitlements shape); two pre-existing tests that asserted the old "self-host holds connector keys" contract updated to the new one. Verified: full unit suite green, pg-real suite for lib/entitlements green against a local supabase/postgres with every migration applied, lint ratchet, guards. Deferred to the instance-wiring PR: adding the connector extensions to the self-host Docker preset (dead-end upsells until a key can be issued). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(entitlements): fold the self-host branch into the existing grants query One .or(scopeFilter), not two: the duplicated helper pushed the no-phantom-columns unresolvable-expression count to 380/379. Behaviour is unchanged; the self-host matrix tests still pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(connect): hosted connector-key registry + validate RPC + entitlements endpoint; instance sync writes connector grants hourly Sovereign plan WS3 PR4 ("key infra enabling manual sales"), stacked on the entitlement partition (#1747). Nothing is purchasable yet; this is the plumbing both ends need before the first manually issued key. Hosted side: - Migration 20260820123000: connector_keys (SHA-256 key_hash, prefix, org_number, pinned instance_url, scopes, status, Stripe ids, current_period_end, per-minute rate limit, active_company_count, last_seen/synced) and connector_usage_events (per-request metering, separate from metered_events whose company_id references hosted companies). RLS on, NO policies: service role only. RPC validate_and_increment_connector_key copies the api_keys pattern (FOR UPDATE, minute window, suspended reported not counted, revoked = no row) and is REVOKEd from PUBLIC/anon/authenticated, GRANTed to service_role. pg-real test covers validate/count, unknown+revoked, suspended, rate limit, execute privileges per role, RLS invisibility, usage cascade. - lib/connect/contract.ts (shared wire types), lib/connect/hosted/keys.ts (generate/hash/validate -> 401/403/429 mapping), with-connector-auth.ts (Bearer or X-Connector-Key, one usage row per request, 500 envelope on handler throw), /api/connect/entitlements GET + POST (records active_company_count, pins instance_url on first report, never moves a pinned one), scripts/issue-connector-key.ts (dry run unless --confirm, prints the key once + the .env lines). Instance side: - lib/connect/instance/config.ts (GNUBOK_CONNECTOR_KEY, GNUBOK_CONNECT_URL default https://app.gnubok.se), sync.ts: reports the active company count and writes source='connector' grants for every company x covered scope, expires_at = min(now+72h, period_end+3d); 401/403 or a non-active status deletes them (freeze-and-retain); network/5xx/429 leave them alone. /api/connector/sync/cron (hourly) runs it; not_configured without a key. - Crontab generator gains EXTRA_JOBS (variant-only jobs not in vercel.json, with reasons) + drift tests; docker/crontab.self-hosted regenerated with the hourly sync. Docs (SELF-HOSTING connector section, env templates), DECISIONS. Tests: 52 new unit tests (keys, auth wrapper, route, config, sync outcomes and grant arithmetic, cron route, crontab EXTRA_JOBS) + 7 pg-real tests run locally against supabase/postgres with every migration applied. no-phantom-columns ceiling +1 with a reason (the bulk grant upsert). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(connect): Enable Banking proxy for self-hosted instances, with a secret-free ownership ledger and a global rate budget Sovereign plan WS3 PR5a, stacked on the connector-key infra (#1748). A self-hosted instance with a `bank_sync`-scoped connector key can now connect a bank through Arcim's PSD2 credentials; the bank session id and all transaction data stay in the instance's own database (founder decision: tokens on the instance, proxy stateless). - Migration 20260820124000: `connector_connections` (secret-free ledger: sha256 of the EB session id + account uids, service-role only), `connector_upstream_counters` + RPC `connector_reserve_upstream` (global budget under EB Annex 1 §5's 300/min, shared with hosted), and `connector_keys.limits` jsonb; validate RPC v2 returns limits. All RPCs REVOKEd from PUBLIC/anon/authenticated, GRANTed service_role. pg-real covers all of it. - EB JWT minting moved to lib/connect/upstreams/enable-banking-jwt.ts (core must not import @/extensions/); the extension re-exports it, tests unchanged. - lib/connect/hosted/{state,ledger,upstream-budget}.ts: HMAC-signed connector state (15-min TTL) so the consent redirect can use OUR registered EB callback and bounce back to the instance, no per-instance redirect URI at EB; the callback route gains that connector branch. - app/api/connect/bank/[...path]: path allowlist (aspsps, auth, sessions, accounts/{uid}/{balances,transactions}), never open passthrough. POST /auth enforces the per-company connection quota + rewrites redirect/state; reads/deletes verify ledger ownership; every upstream call takes the global budget (429 + Retry-After when exhausted). - issue-connector-key.ts: scopes default bank_sync,skatteverket (TIC out of v1), --bank/skv-connections-per-company + --sync-min-interval. - Docs (SELF-HOSTING: bank connector live), DECISIONS. Verified: 52 connect unit tests + 13 pg-real (run locally against supabase/postgres with all migrations) + EB extension suite (225, jwt relocation intact); full unit suite 15 979 green; tsc, guards, lint clean. Not in this PR: SKV broker (PR5b) and instance wiring (PR6). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(connect): Skatteverket broker + data proxy for self-hosted instances (tokens stay on the instance) Sovereign plan WS3 PR5b, stacked on the bank proxy (#1751). A self-hosted instance with a `skatteverket`-scoped connector key can now run the BankID consent, file VAT/AGI and sync skattekonto through Arcim's registered Skatteverket client; the SKV tokens are returned to the instance and stored (encrypted) there. - lib/connect/upstreams/skatteverket-oauth.ts: core-side SKV OAuth + data helpers (authorize URL, code/refresh exchange with Arcim's client secret, the four backing-API base URLs, the API-gateway Client_Id/Client_Secret headers). Core can't import @/extensions/, so this duplicates the extension's endpoints/scope set (one integrator = Arcim), mirroring the EB JWT relocation. - app/api/connect/skv/oauth/authorize-url: builds the authorize URL against OUR registered redirect_uri + a signed connector state, per-company SKV connection quota, pending ledger row. - app/api/connect/skv/oauth/token: exchanges/refreshes and RETURNS the tokens to the instance; the ledger keeps only sha256(access_token) + sha256(refresh_token). - app/api/connect/skv/api/[...path]: allowlist over moms / skattekonto / agd-inlamning / agd-period. The instance sends the user's SKV Bearer (as X-Connector-Upstream-Authorization) + X-Connector-Key; the proxy checks the token hash against the ledger, adds Arcim's gateway credentials (never exposed to the instance), forwards. Same per-key + global budget as bank. - The Skatteverket extension /callback gains the connector branch (isConnectorState -> 302 back to the instance; code never exchanged there). - Docs (SELF-HOSTING: SKV connector live) + DECISIONS. Tests: SKV oauth lib, authorize-url, token, data proxy, callback connector branch (all green; 74 connect + 425 connect/SKV). tsc, guards, lint clean; no-phantom-columns held at 380 (literal update branches). Not in this PR: instance-side wiring (PR6). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(connect): SKV broker review+skeptic batch: state-bound exchange, owned-only refresh, identity-number redaction, quota reservation, https-only bases, docs dedupe Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb * docs(self-host): restore the instance-wiring qualifier in the connector section Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb * fix(connect): PR #1757 review batch 2: redirect 'error' on credential fetches, mandatory ledger writes before token return, MD037 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb * fix(connect): reject encoded path separators in SKV data-proxy segments (traversal guard) The WHATWG parser normalizes raw dot segments before the route runs; what survives is an encoded separator inside a segment (a%2Fb, ..%2Fx, a%5Cb), which would escape the allowlisted service base once the upstream fetch re-normalizes. splitPath now decodes each segment and rejects dot segments and separator-bearing values. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Emil <emilmattsson14@gmail.com>
This commit is contained in:
Jakob Wennberg
co-authored by
Claude Fable 5
Jakob Wennberg
Emil
Claude Fable 5
Jakob Wennberg
Emil
parent
5131ee9085
commit
37e50c272d
@@ -104,6 +104,8 @@ async function forwardToEb(method: string, path: string, body?: unknown): Promis
|
||||
const res = await fetch(`${ebBaseUrl()}${path}`, {
|
||||
method,
|
||||
signal: controller.signal,
|
||||
// A followed redirect would resend the EB JWT to the redirect target.
|
||||
redirect: 'error',
|
||||
headers: {
|
||||
Authorization: getAuthorizationHeader(),
|
||||
'Content-Type': 'application/json',
|
||||
|
||||
@@ -0,0 +1,99 @@
|
||||
import { describe, it, expect, vi, beforeEach } from 'vitest'
|
||||
|
||||
let key = {
|
||||
id: 'key-1', orgNumber: 'x', instanceUrl: 'https://i', scopes: ['skatteverket'], status: 'active' as const,
|
||||
currentPeriodEnd: null as string | null, limits: { bank_connections_per_company: 1, skv_connections_per_company: 1, sync_min_interval_s: 0 },
|
||||
}
|
||||
vi.mock('@/lib/connect/hosted/with-connector-auth', () => ({
|
||||
withConnectorAuth: (_o: string, h: (r: Request, c: unknown) => Promise<Response>) => (r: Request) =>
|
||||
h(r, { requestId: 't', log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() }, supabase: {}, key }),
|
||||
}))
|
||||
const hh = vi.hoisted(() => ({ budget: vi.fn(), find: vi.fn(), touch: vi.fn() }))
|
||||
vi.mock('@/lib/connect/hosted/upstream-budget', () => ({ reserveUpstream: (...a: unknown[]) => hh.budget(...a) }))
|
||||
vi.mock('@/lib/connect/hosted/ledger', () => ({ findByHandle: (...a: unknown[]) => hh.find(...a), touchConnection: (...a: unknown[]) => hh.touch(...a) }))
|
||||
vi.mock('@/lib/connect/upstreams/skatteverket-oauth', () => ({
|
||||
SKV_API_BASES: {
|
||||
moms: () => 'https://api.skv/momsdeklaration/v1',
|
||||
skattekonto: () => 'https://api.skv/skattekonto/v2',
|
||||
'agd-inlamning': () => 'https://api.skv/agd/inlamning/v1',
|
||||
'agd-period': () => 'https://api.skv/agd/period/v1',
|
||||
},
|
||||
skvGatewayHeaders: () => ({ Client_Id: 'gw', Client_Secret: 'gws', skv_client_correlation_id: 'corr' }),
|
||||
}))
|
||||
|
||||
const fetchMock = vi.fn()
|
||||
vi.stubGlobal('fetch', fetchMock)
|
||||
import { GET, POST } from '../route'
|
||||
|
||||
function req(method: string, path: string, token = 'user-token', body?: string): Request {
|
||||
const headers: Record<string, string> = { 'x-connector-upstream-authorization': `Bearer ${token}` }
|
||||
return new Request(`https://app.gnubok.se/api/connect/skv/api${path}`, { method, headers, ...(body !== undefined ? { body } : {}) })
|
||||
}
|
||||
function skvOk(body: unknown, status = 200) {
|
||||
fetchMock.mockResolvedValueOnce(new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } }))
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks()
|
||||
key = { ...key, scopes: ['skatteverket'] }
|
||||
hh.budget.mockResolvedValue({ ok: true })
|
||||
hh.find.mockResolvedValue({ id: 'l1' })
|
||||
})
|
||||
|
||||
describe('skv data proxy', () => {
|
||||
it('rejects dot-segment traversal, raw and percent-encoded', async () => {
|
||||
// Raw ../ and %2E dot segments are normalized away by the WHATWG URL
|
||||
// parser before the route sees them (they cannot escape past the route
|
||||
// prefix). What survives to splitPath is an encoded separator INSIDE a
|
||||
// segment, which would traverse once the upstream fetch re-normalizes:
|
||||
// those must be rejected here.
|
||||
for (const path of ['/moms/a%2Fb', '/moms/..%2Fx', '/moms/a%5Cb']) {
|
||||
const res = await GET(req('GET', path))
|
||||
expect(res.status, path).toBe(403)
|
||||
expect((await res.json()).code).toBe('CONNECTOR_PATH_NOT_ALLOWED')
|
||||
}
|
||||
})
|
||||
|
||||
it('403 without the scope', async () => {
|
||||
key = { ...key, scopes: [] }
|
||||
expect((await GET(req('GET', '/moms/deklarationer'))).status).toBe(403)
|
||||
})
|
||||
it('403 on an unknown service', async () => {
|
||||
const res = await GET(req('GET', '/unknown/x'))
|
||||
expect(res.status).toBe(403)
|
||||
expect((await res.json()).code).toBe('CONNECTOR_PATH_NOT_ALLOWED')
|
||||
})
|
||||
it('400 without a user token', async () => {
|
||||
const res = await GET(new Request('https://app.gnubok.se/api/connect/skv/api/moms/x', { method: 'GET' }))
|
||||
expect(res.status).toBe(400)
|
||||
expect((await res.json()).code).toBe('CONNECTOR_UPSTREAM_TOKEN_MISSING')
|
||||
})
|
||||
it('404 when the token is not owned by this key', async () => {
|
||||
hh.find.mockResolvedValue(null)
|
||||
expect((await GET(req('GET', '/moms/x'))).status).toBe(404)
|
||||
})
|
||||
it('forwards a GET with the user Bearer + Arcim gateway headers to the right backing API', async () => {
|
||||
skvOk({ ok: true })
|
||||
const res = await GET(req('GET', '/skattekonto/saldo?period=2026-08'))
|
||||
expect(res.status).toBe(200)
|
||||
const [url, init] = fetchMock.mock.calls[0]
|
||||
expect(url).toBe('https://api.skv/skattekonto/v2/saldo?period=2026-08')
|
||||
expect(init.headers.Authorization).toBe('Bearer user-token')
|
||||
expect(init.headers.Client_Id).toBe('gw')
|
||||
expect(hh.touch).toHaveBeenCalledWith(expect.anything(), 'l1')
|
||||
})
|
||||
it('forwards a POST body to the AGI inlämning API', async () => {
|
||||
skvOk({ id: 'u1' }, 201)
|
||||
const res = await POST(req('POST', '/agd-inlamning/underlag', 'user-token', '<xml/>'))
|
||||
expect(res.status).toBe(201)
|
||||
expect(fetchMock.mock.calls[0][0]).toBe('https://api.skv/agd/inlamning/v1/underlag')
|
||||
expect(fetchMock.mock.calls[0][1].body).toBe('<xml/>')
|
||||
})
|
||||
it('429 when the budget is exhausted', async () => {
|
||||
hh.budget.mockResolvedValue({ ok: false, scope: 'hour', retryAfterSec: 3600 })
|
||||
const res = await GET(req('GET', '/moms/x'))
|
||||
expect(res.status).toBe(429)
|
||||
expect(res.headers.get('Retry-After')).toBe('3600')
|
||||
expect(fetchMock).not.toHaveBeenCalled()
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,119 @@
|
||||
import { NextResponse } from 'next/server'
|
||||
import { withConnectorAuth, type ConnectorContext } from '@/lib/connect/hosted/with-connector-auth'
|
||||
import { reserveUpstream } from '@/lib/connect/hosted/upstream-budget'
|
||||
import { findByHandle, touchConnection } from '@/lib/connect/hosted/ledger'
|
||||
import { SKV_API_BASES, skvGatewayHeaders } from '@/lib/connect/upstreams/skatteverket-oauth'
|
||||
|
||||
/**
|
||||
* Skatteverket data proxy for self-hosted instances.
|
||||
*
|
||||
* ANY /api/connect/skv/api/<service>/<path>
|
||||
* Authorization: Bearer <the END USER's SKV access token, from the instance>
|
||||
* X-Connector-Key: gnubok_ck_... (the instance's key auth)
|
||||
*
|
||||
* The instance holds the user token (it did the BankID flow through our
|
||||
* broker); it presents that token as the upstream Bearer while proving its
|
||||
* own subscription with X-Connector-Key. The proxy checks that the presented
|
||||
* token belongs to a connection this key owns (ledger), then adds Arcim's
|
||||
* API-gateway client credentials (Client_Id/Client_Secret) and forwards to
|
||||
* the right SKV backing API. Arcim's gateway secret never leaves us.
|
||||
*
|
||||
* <service> is one of the SKV_API_BASES keys (moms, skattekonto,
|
||||
* agd-inlamning, agd-period): an allowlist, never an open passthrough.
|
||||
*/
|
||||
|
||||
const FETCH_TIMEOUT_MS = 20_000
|
||||
|
||||
function requireScope(ctx: ConnectorContext): NextResponse | null {
|
||||
if (ctx.key.scopes.includes('skatteverket')) return null
|
||||
return NextResponse.json({ error: 'This connector key does not include Skatteverket', code: 'CONNECTOR_SCOPE_MISSING' }, { status: 403 })
|
||||
}
|
||||
|
||||
function splitPath(request: Request): { service: string; rest: string; query: string } | null {
|
||||
const marker = '/api/connect/skv/api'
|
||||
const idx = request.url.indexOf(marker)
|
||||
if (idx === -1) return null
|
||||
const after = request.url.slice(idx + marker.length)
|
||||
const [pathPart, ...q] = after.split('?')
|
||||
const segments = pathPart.split('/').filter(Boolean)
|
||||
if (segments.length === 0) return null
|
||||
// Traversal guard: a '.'/'..' segment (raw or percent-encoded) would let
|
||||
// the proxied URL escape the allowlisted service base once fetch
|
||||
// normalizes it. Decode each segment and reject dot segments and anything
|
||||
// that decodes to contain a path separator.
|
||||
for (const seg of segments) {
|
||||
let decoded: string
|
||||
try {
|
||||
decoded = decodeURIComponent(seg)
|
||||
} catch {
|
||||
return null
|
||||
}
|
||||
if (decoded === '.' || decoded === '..' || decoded.includes('/') || decoded.includes('\\')) return null
|
||||
}
|
||||
const [service, ...restSegs] = segments
|
||||
return { service, rest: `/${restSegs.join('/')}`, query: q.length ? `?${q.join('?')}` : '' }
|
||||
}
|
||||
|
||||
/** The end-user SKV token the instance forwards, from the upstream-Authorization header. */
|
||||
function userToken(request: Request): string | null {
|
||||
const h = request.headers.get('x-connector-upstream-authorization') || request.headers.get('authorization')
|
||||
if (!h?.startsWith('Bearer ')) return null
|
||||
return h.slice(7).trim() || null
|
||||
}
|
||||
|
||||
async function handle(request: Request, ctx: ConnectorContext): Promise<Response> {
|
||||
const scopeError = requireScope(ctx)
|
||||
if (scopeError) return scopeError
|
||||
|
||||
const parts = splitPath(request)
|
||||
if (!parts || !(parts.service in SKV_API_BASES)) {
|
||||
return NextResponse.json({ error: 'Unknown Skatteverket service', code: 'CONNECTOR_PATH_NOT_ALLOWED' }, { status: 403 })
|
||||
}
|
||||
const token = userToken(request)
|
||||
if (!token) {
|
||||
return NextResponse.json({ error: 'Missing user token', code: 'CONNECTOR_UPSTREAM_TOKEN_MISSING' }, { status: 400 })
|
||||
}
|
||||
const owned = await findByHandle(ctx.supabase, { keyId: ctx.key.id, service: 'skatteverket', handle: token })
|
||||
if (!owned) {
|
||||
return NextResponse.json({ error: 'Unknown Skatteverket connection for this key', code: 'CONNECTOR_NOT_OWNED' }, { status: 404 })
|
||||
}
|
||||
const budget = await reserveUpstream(ctx.supabase, 'skatteverket')
|
||||
if (!budget.ok) {
|
||||
return NextResponse.json({ error: 'Skatteverket connector is busy', code: 'CONNECTOR_RATE_LIMITED' }, { status: 429, headers: { 'Retry-After': String(budget.retryAfterSec) } })
|
||||
}
|
||||
await touchConnection(ctx.supabase, owned.id)
|
||||
|
||||
const url = `${SKV_API_BASES[parts.service]()}${parts.rest}${parts.query}`
|
||||
const contentType = request.headers.get('x-connector-upstream-content-type') || request.headers.get('content-type') || 'application/json'
|
||||
const method = request.method
|
||||
const hasBody = method !== 'GET' && method !== 'HEAD'
|
||||
const body = hasBody ? await request.text() : undefined
|
||||
|
||||
const controller = new AbortController()
|
||||
const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS)
|
||||
try {
|
||||
const res = await fetch(url, {
|
||||
method,
|
||||
signal: controller.signal,
|
||||
// A followed redirect would resend the gateway Client_Secret headers.
|
||||
redirect: 'error',
|
||||
headers: {
|
||||
Authorization: `Bearer ${token}`,
|
||||
...skvGatewayHeaders(),
|
||||
...(hasBody ? { 'Content-Type': contentType } : {}),
|
||||
},
|
||||
...(body !== undefined && body.length > 0 ? { body } : {}),
|
||||
})
|
||||
const text = await res.text()
|
||||
if ([204, 205, 304].includes(res.status)) return new NextResponse(null, { status: res.status })
|
||||
return new NextResponse(text, { status: res.status, headers: { 'Content-Type': res.headers.get('content-type') ?? 'application/json' } })
|
||||
} finally {
|
||||
clearTimeout(timeout)
|
||||
}
|
||||
}
|
||||
|
||||
export const GET = withConnectorAuth('connect.skv', handle)
|
||||
export const POST = withConnectorAuth('connect.skv', handle)
|
||||
export const PUT = withConnectorAuth('connect.skv', handle)
|
||||
export const PATCH = withConnectorAuth('connect.skv', handle)
|
||||
export const DELETE = withConnectorAuth('connect.skv', handle)
|
||||
@@ -0,0 +1,67 @@
|
||||
import { describe, it, expect, vi, beforeEach } from 'vitest'
|
||||
import { createMockRequest, parseJsonResponse } from '@/tests/helpers'
|
||||
|
||||
let key = {
|
||||
id: 'key-1', orgNumber: '5561234567', instanceUrl: 'https://bokforing.example.se',
|
||||
scopes: ['skatteverket'], status: 'active' as const, currentPeriodEnd: null as string | null,
|
||||
limits: { bank_connections_per_company: 1, skv_connections_per_company: 1, sync_min_interval_s: 0 },
|
||||
}
|
||||
vi.mock('@/lib/connect/hosted/with-connector-auth', () => ({
|
||||
withConnectorAuth: (_o: string, h: (r: Request, c: unknown) => Promise<Response>) => (r: Request) =>
|
||||
h(r, { requestId: 't', log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() }, supabase: {}, key }),
|
||||
}))
|
||||
const hh = vi.hoisted(() => ({ budget: vi.fn(), count: vi.fn(), deletePending: vi.fn(), pending: vi.fn() }))
|
||||
vi.mock('@/lib/connect/hosted/upstream-budget', () => ({ reserveUpstream: (...a: unknown[]) => hh.budget(...a) }))
|
||||
vi.mock('@/lib/connect/hosted/ledger', () => ({ countHeldConnections: (...a: unknown[]) => hh.count(...a), deletePendingConnectionById: (...a: unknown[]) => hh.deletePending(...a), createPendingConnection: (...a: unknown[]) => hh.pending(...a) }))
|
||||
vi.mock('@/lib/connect/hosted/state', () => ({ signConnectorState: () => 'ck1.signed' }))
|
||||
vi.mock('@/lib/connect/upstreams/skatteverket-oauth', () => ({
|
||||
buildSkvAuthorizeUrl: (redirectUri: string, state: string) => `https://skv/authorize?redirect_uri=${encodeURIComponent(redirectUri)}&state=${state}`,
|
||||
skvDefaultScopes: () => 'moms agd',
|
||||
}))
|
||||
import { POST } from '../route'
|
||||
|
||||
const body = (o: Record<string, unknown> = {}) => ({
|
||||
company_ref: 'company-1', return_url: 'https://bokforing.example.se/cb', state: 'inst', code_challenge: 'a'.repeat(43), ...o,
|
||||
})
|
||||
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks()
|
||||
process.env.NEXT_PUBLIC_SKV_OAUTH_BASE_URL = 'https://app.gnubok.se'
|
||||
key = { ...key, scopes: ['skatteverket'], limits: { bank_connections_per_company: 1, skv_connections_per_company: 1, sync_min_interval_s: 0 } }
|
||||
hh.budget.mockResolvedValue({ ok: true })
|
||||
hh.count.mockResolvedValue(0)
|
||||
})
|
||||
|
||||
describe('POST /api/connect/skv/oauth/authorize-url', () => {
|
||||
it('403 without the skatteverket scope', async () => {
|
||||
key = { ...key, scopes: [] }
|
||||
const res = await POST(createMockRequest('/api/connect/skv/oauth/authorize-url', { method: 'POST', body: body() }))
|
||||
expect(res.status).toBe(403)
|
||||
})
|
||||
it('400 on a return_url off the instance', async () => {
|
||||
const res = await POST(createMockRequest('/x', { method: 'POST', body: body({ return_url: 'https://evil.example.com/cb' }) }))
|
||||
const { status, body: b } = await parseJsonResponse<{ code: string }>(res)
|
||||
expect(status).toBe(400)
|
||||
expect(b.code).toBe('CONNECTOR_REDIRECT_INVALID')
|
||||
})
|
||||
it('403 when the per-company SKV quota is reached', async () => {
|
||||
hh.count.mockResolvedValue(1)
|
||||
const res = await POST(createMockRequest('/x', { method: 'POST', body: body() }))
|
||||
expect(res.status).toBe(403)
|
||||
expect((await res.json()).code).toBe('CONNECTOR_QUOTA_EXCEEDED')
|
||||
})
|
||||
it('records a pending row and returns the authorize URL with our redirect + signed state', async () => {
|
||||
const res = await POST(createMockRequest('/x', { method: 'POST', body: body() }))
|
||||
const { status, body: b } = await parseJsonResponse<{ data: { authorize_url: string; redirect_uri: string; connector_state: string } }>(res)
|
||||
expect(status).toBe(200)
|
||||
expect(hh.pending).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ service: 'skatteverket', companyRef: 'company-1', pendingState: 'ck1.signed' }))
|
||||
expect(b.data.redirect_uri).toBe('https://app.gnubok.se/api/extensions/ext/skatteverket/callback')
|
||||
expect(b.data.connector_state).toBe('ck1.signed')
|
||||
expect(b.data.authorize_url).toContain('state=ck1.signed')
|
||||
})
|
||||
it('429 when the budget is exhausted', async () => {
|
||||
hh.budget.mockResolvedValue({ ok: false, scope: 'minute', retryAfterSec: 60 })
|
||||
const res = await POST(createMockRequest('/x', { method: 'POST', body: body() }))
|
||||
expect(res.status).toBe(429)
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,88 @@
|
||||
import { NextResponse } from 'next/server'
|
||||
import { z } from 'zod'
|
||||
import { validateBody } from '@/lib/api/validate'
|
||||
import { withConnectorAuth, type ConnectorContext } from '@/lib/connect/hosted/with-connector-auth'
|
||||
import { buildSkvAuthorizeUrl, skvDefaultScopes } from '@/lib/connect/upstreams/skatteverket-oauth'
|
||||
import { reserveUpstream } from '@/lib/connect/hosted/upstream-budget'
|
||||
import { countHeldConnections, createPendingConnection, deletePendingConnectionById } from '@/lib/connect/hosted/ledger'
|
||||
import { signConnectorState } from '@/lib/connect/hosted/state'
|
||||
|
||||
/**
|
||||
* POST /api/connect/skv/oauth/authorize-url
|
||||
*
|
||||
* The instance asks the connector broker to start a Skatteverket BankID
|
||||
* consent for one company. The broker builds the authorize URL against
|
||||
* Arcim's registered SKV client, using OUR registered redirect_uri, with a
|
||||
* signed connector state that carries the instance's own return URL; the SKV
|
||||
* extension callback (on the hosted host) detects that state and bounces the
|
||||
* browser back to the instance with the code. The instance keeps its own PKCE
|
||||
* verifier and later calls /oauth/token with the code.
|
||||
*
|
||||
* Tokens never touch us: the token exchange returns them to the instance,
|
||||
* which stores them (encrypted) in its own database.
|
||||
*/
|
||||
|
||||
const Schema = z.object({
|
||||
company_ref: z.string().min(1).max(200),
|
||||
return_url: z.string().url().max(512),
|
||||
state: z.string().min(1).max(200),
|
||||
code_challenge: z.string().min(16).max(256),
|
||||
scope: z.string().max(400).optional(),
|
||||
})
|
||||
|
||||
function requireScope(ctx: ConnectorContext): NextResponse | null {
|
||||
if (ctx.key.scopes.includes('skatteverket')) return null
|
||||
return NextResponse.json({ error: 'This connector key does not include Skatteverket', code: 'CONNECTOR_SCOPE_MISSING' }, { status: 403 })
|
||||
}
|
||||
|
||||
function hostedRedirectUri(): string {
|
||||
const base = (process.env.NEXT_PUBLIC_SKV_OAUTH_BASE_URL || process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000').replace(/\/+$/, '')
|
||||
return `${base}/api/extensions/ext/skatteverket/callback`
|
||||
}
|
||||
|
||||
function isOnInstance(url: string, instanceUrl: string | null): boolean {
|
||||
if (!instanceUrl) return false
|
||||
try {
|
||||
return new URL(url).origin === new URL(instanceUrl).origin
|
||||
} catch {
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
export const POST = withConnectorAuth('connect.skv', async (request, ctx) => {
|
||||
const scopeError = requireScope(ctx)
|
||||
if (scopeError) return scopeError
|
||||
const parsed = await validateBody(request, Schema, { log: ctx.log, operation: 'connect.skv.authorize-url' })
|
||||
if (!parsed.success) return parsed.response
|
||||
const { company_ref: cref, return_url, state, code_challenge, scope } = parsed.data
|
||||
|
||||
if (!isOnInstance(return_url, ctx.key.instanceUrl)) {
|
||||
return NextResponse.json({ error: 'return_url must be on the connector key\'s instance', code: 'CONNECTOR_REDIRECT_INVALID' }, { status: 400 })
|
||||
}
|
||||
// Quota with a reservation re-count (same TOCTOU fix as the bank /auth):
|
||||
// pre-count fast-rejects, the pending row reserves, the post-insert
|
||||
// re-count rolls the own row back when concurrent authorizes overshoot.
|
||||
const quotaExceeded = () =>
|
||||
NextResponse.json(
|
||||
{ error: 'Skatteverket connection quota reached for this company', code: 'CONNECTOR_QUOTA_EXCEEDED', limit: ctx.key.limits.skv_connections_per_company },
|
||||
{ status: 403 },
|
||||
)
|
||||
const held = await countHeldConnections(ctx.supabase, ctx.key.id, 'skatteverket', cref)
|
||||
if (held >= ctx.key.limits.skv_connections_per_company) return quotaExceeded()
|
||||
const budget = await reserveUpstream(ctx.supabase, 'skatteverket')
|
||||
if (!budget.ok) {
|
||||
return NextResponse.json({ error: 'Skatteverket connector is busy', code: 'CONNECTOR_RATE_LIMITED' }, { status: 429, headers: { 'Retry-After': String(budget.retryAfterSec) } })
|
||||
}
|
||||
|
||||
const signedState = signConnectorState({ kid: ctx.key.id, svc: 'skv', ret: return_url, st: state, cref })
|
||||
const redirectUri = hostedRedirectUri()
|
||||
const pendingId = await createPendingConnection(ctx.supabase, { keyId: ctx.key.id, service: 'skatteverket', companyRef: cref, provider: 'skatteverket', pendingState: signedState })
|
||||
const heldAfter = await countHeldConnections(ctx.supabase, ctx.key.id, 'skatteverket', cref)
|
||||
if (heldAfter > ctx.key.limits.skv_connections_per_company) {
|
||||
await deletePendingConnectionById(ctx.supabase, pendingId)
|
||||
return quotaExceeded()
|
||||
}
|
||||
|
||||
const authorizeUrl = buildSkvAuthorizeUrl(redirectUri, signedState, { scope: scope || skvDefaultScopes(), codeChallenge: code_challenge })
|
||||
return NextResponse.json({ data: { authorize_url: authorizeUrl, redirect_uri: redirectUri, connector_state: signedState } })
|
||||
})
|
||||
@@ -0,0 +1,105 @@
|
||||
import { describe, it, expect, vi, beforeEach } from 'vitest'
|
||||
import { createMockRequest, parseJsonResponse } from '@/tests/helpers'
|
||||
|
||||
let key = {
|
||||
id: 'key-1', orgNumber: 'x', instanceUrl: 'https://i', scopes: ['skatteverket'], status: 'active' as const,
|
||||
currentPeriodEnd: null as string | null, limits: { bank_connections_per_company: 1, skv_connections_per_company: 1, sync_min_interval_s: 0 },
|
||||
}
|
||||
const chain = { update: vi.fn(() => chain), eq: vi.fn(() => chain), then: (r: (v: unknown) => void) => r({ error: null }) }
|
||||
const supabase = { from: vi.fn(() => chain) }
|
||||
vi.mock('@/lib/connect/hosted/with-connector-auth', () => ({
|
||||
withConnectorAuth: (_o: string, h: (r: Request, c: unknown) => Promise<Response>) => (r: Request) =>
|
||||
h(r, { requestId: 't', log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() }, supabase, key }),
|
||||
}))
|
||||
const hh = vi.hoisted(() => ({
|
||||
budget: vi.fn(),
|
||||
exchange: vi.fn(),
|
||||
refresh: vi.fn(),
|
||||
activate: vi.fn(),
|
||||
findPending: vi.fn(),
|
||||
findRefresh: vi.fn(),
|
||||
}))
|
||||
vi.mock('@/lib/connect/hosted/upstream-budget', () => ({ reserveUpstream: (...a: unknown[]) => hh.budget(...a) }))
|
||||
vi.mock('@/lib/connect/upstreams/skatteverket-oauth', () => ({ exchangeSkvCode: (...a: unknown[]) => hh.exchange(...a), refreshSkvToken: (...a: unknown[]) => hh.refresh(...a) }))
|
||||
vi.mock('@/lib/connect/hosted/ledger', () => ({
|
||||
activateByPendingState: (...a: unknown[]) => hh.activate(...a),
|
||||
findPendingByState: (...a: unknown[]) => hh.findPending(...a),
|
||||
findByRefreshHash: (...a: unknown[]) => hh.findRefresh(...a),
|
||||
hashHandle: (s: string) => `h(${s})`,
|
||||
}))
|
||||
vi.mock('@/lib/connect/hosted/state', () => ({
|
||||
verifyConnectorState: (token: string) =>
|
||||
token === 'ck1.signed'
|
||||
? { ok: true, payload: { kid: 'key-1', svc: 'skv', ret: 'https://i/cb', st: 's', cref: 'c1', iat: 0 } }
|
||||
: token === 'ck1.foreign'
|
||||
? { ok: true, payload: { kid: 'key-OTHER', svc: 'skv', ret: 'x', st: 's', cref: 'c', iat: 0 } }
|
||||
: { ok: false, reason: 'malformed' },
|
||||
}))
|
||||
import { POST } from '../route'
|
||||
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks()
|
||||
key = { ...key, scopes: ['skatteverket'] }
|
||||
hh.budget.mockResolvedValue({ ok: true })
|
||||
hh.findPending.mockResolvedValue({ id: 'p1', status: 'pending' })
|
||||
hh.activate.mockResolvedValue({ id: 'p1', status: 'active' })
|
||||
hh.findRefresh.mockResolvedValue({ id: 'r1', status: 'active' })
|
||||
})
|
||||
|
||||
describe('POST /api/connect/skv/oauth/token', () => {
|
||||
it('exchanges an authorization code, activates the ledger row, returns tokens', async () => {
|
||||
hh.exchange.mockResolvedValue({ access_token: 'at', refresh_token: 'rt', expires_in: 3600, scope: 's' })
|
||||
const res = await POST(createMockRequest('/x', { method: 'POST', body: { grant_type: 'authorization_code', code: 'c', redirect_uri: 'https://app.gnubok.se/cb', code_verifier: 'v'.repeat(20), connector_state: 'ck1.signed' } }))
|
||||
const { status, body } = await parseJsonResponse<{ data: { access_token: string; refresh_token: string } }>(res)
|
||||
expect(status).toBe(200)
|
||||
expect(body.data).toEqual({ access_token: 'at', refresh_token: 'rt', expires_in: 3600, scope: 's' })
|
||||
expect(hh.activate).toHaveBeenCalledWith(supabase, { keyId: 'key-1', pendingState: 'ck1.signed', handle: 'at' })
|
||||
})
|
||||
|
||||
it('refuses an invalid or foreign connector state before spending the client secret', async () => {
|
||||
let res = await POST(createMockRequest('/x', { method: 'POST', body: { grant_type: 'authorization_code', code: 'c', redirect_uri: 'https://app.gnubok.se/cb', connector_state: 'garbage' } }))
|
||||
expect(res.status).toBe(400)
|
||||
expect((await res.json()).code).toBe('CONNECTOR_STATE_INVALID')
|
||||
res = await POST(createMockRequest('/x', { method: 'POST', body: { grant_type: 'authorization_code', code: 'c', redirect_uri: 'https://app.gnubok.se/cb', connector_state: 'ck1.foreign' } }))
|
||||
expect(res.status).toBe(403)
|
||||
hh.findPending.mockResolvedValue(null)
|
||||
res = await POST(createMockRequest('/x', { method: 'POST', body: { grant_type: 'authorization_code', code: 'c', redirect_uri: 'https://app.gnubok.se/cb', connector_state: 'ck1.signed' } }))
|
||||
expect(res.status).toBe(404)
|
||||
expect(hh.exchange).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('withholds tokens with 409 when the state was consumed concurrently', async () => {
|
||||
hh.exchange.mockResolvedValue({ access_token: 'at', refresh_token: 'rt', expires_in: 3600, scope: 's' })
|
||||
hh.activate.mockResolvedValue(null)
|
||||
const res = await POST(createMockRequest('/x', { method: 'POST', body: { grant_type: 'authorization_code', code: 'c', redirect_uri: 'https://app.gnubok.se/cb', connector_state: 'ck1.signed' } }))
|
||||
expect(res.status).toBe(409)
|
||||
expect((await res.json()).code).toBe('CONNECTOR_STATE_CONSUMED')
|
||||
})
|
||||
|
||||
it('refreshes only a refresh token owned by this key (rotates the ledger hashes)', async () => {
|
||||
hh.refresh.mockResolvedValue({ access_token: 'at2', refresh_token: 'rt2', expires_in: 3600, scope: 's' })
|
||||
const res = await POST(createMockRequest('/x', { method: 'POST', body: { grant_type: 'refresh_token', refresh_token: 'rt' } }))
|
||||
expect(res.status).toBe(200)
|
||||
expect(hh.findRefresh).toHaveBeenCalledWith(supabase, { keyId: 'key-1', refreshHash: 'h(rt)' })
|
||||
expect(supabase.from).toHaveBeenCalledWith('connector_connections')
|
||||
})
|
||||
|
||||
it('404s a refresh token with no active ledger row for this key, never calling upstream', async () => {
|
||||
hh.findRefresh.mockResolvedValue(null)
|
||||
const res = await POST(createMockRequest('/x', { method: 'POST', body: { grant_type: 'refresh_token', refresh_token: 'stolen-rt' } }))
|
||||
expect(res.status).toBe(404)
|
||||
expect((await res.json()).code).toBe('CONNECTOR_NOT_OWNED')
|
||||
expect(hh.refresh).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('400 on an invalid grant shape', async () => {
|
||||
const res = await POST(createMockRequest('/x', { method: 'POST', body: { grant_type: 'client_credentials' } }))
|
||||
expect(res.status).toBe(400)
|
||||
})
|
||||
|
||||
it('502 when the upstream exchange fails', async () => {
|
||||
hh.exchange.mockRejectedValue(new Error('boom'))
|
||||
const res = await POST(createMockRequest('/x', { method: 'POST', body: { grant_type: 'authorization_code', code: 'c', redirect_uri: 'https://app.gnubok.se/cb', connector_state: 'ck1.signed' } }))
|
||||
expect(res.status).toBe(502)
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,146 @@
|
||||
import { NextResponse } from 'next/server'
|
||||
import { z } from 'zod'
|
||||
import { validateBody } from '@/lib/api/validate'
|
||||
import { withConnectorAuth, type ConnectorContext } from '@/lib/connect/hosted/with-connector-auth'
|
||||
import { exchangeSkvCode, refreshSkvToken, type SkvTokenResponse } from '@/lib/connect/upstreams/skatteverket-oauth'
|
||||
import { reserveUpstream } from '@/lib/connect/hosted/upstream-budget'
|
||||
import { activateByPendingState, findByRefreshHash, findPendingByState, hashHandle } from '@/lib/connect/hosted/ledger'
|
||||
import { verifyConnectorState } from '@/lib/connect/hosted/state'
|
||||
|
||||
/**
|
||||
* POST /api/connect/skv/oauth/token
|
||||
*
|
||||
* The broker exchanges an authorization code (or refreshes) with Arcim's SKV
|
||||
* client secret and returns the tokens to the instance, which stores them.
|
||||
* The ledger records only the SHA-256 of the access token (and refresh token),
|
||||
* so later data calls can prove the presenting bearer belongs to this key.
|
||||
*
|
||||
* grant_type = authorization_code : { code, redirect_uri, code_verifier?, connector_state }
|
||||
* grant_type = refresh_token : { refresh_token }
|
||||
*/
|
||||
|
||||
const AuthCodeSchema = z.object({
|
||||
grant_type: z.literal('authorization_code'),
|
||||
code: z.string().min(1).max(4096),
|
||||
redirect_uri: z.string().url().max(512),
|
||||
code_verifier: z.string().min(16).max(256).optional(),
|
||||
connector_state: z.string().min(1).max(2048),
|
||||
})
|
||||
const RefreshSchema = z.object({
|
||||
grant_type: z.literal('refresh_token'),
|
||||
refresh_token: z.string().min(1).max(4096),
|
||||
})
|
||||
const Schema = z.discriminatedUnion('grant_type', [AuthCodeSchema, RefreshSchema])
|
||||
|
||||
function requireScope(ctx: ConnectorContext): NextResponse | null {
|
||||
if (ctx.key.scopes.includes('skatteverket')) return null
|
||||
return NextResponse.json({ error: 'This connector key does not include Skatteverket', code: 'CONNECTOR_SCOPE_MISSING' }, { status: 403 })
|
||||
}
|
||||
|
||||
function tokenResponse(t: SkvTokenResponse): NextResponse {
|
||||
return NextResponse.json({
|
||||
data: { access_token: t.access_token, refresh_token: t.refresh_token, expires_in: t.expires_in, scope: t.scope },
|
||||
})
|
||||
}
|
||||
|
||||
export const POST = withConnectorAuth('connect.skv', async (request, ctx) => {
|
||||
const scopeError = requireScope(ctx)
|
||||
if (scopeError) return scopeError
|
||||
const parsed = await validateBody(request, Schema, { log: ctx.log, operation: 'connect.skv.token' })
|
||||
if (!parsed.success) return parsed.response
|
||||
|
||||
const budget = await reserveUpstream(ctx.supabase, 'skatteverket')
|
||||
if (!budget.ok) {
|
||||
return NextResponse.json({ error: 'Skatteverket connector is busy', code: 'CONNECTOR_RATE_LIMITED' }, { status: 429, headers: { 'Retry-After': String(budget.retryAfterSec) } })
|
||||
}
|
||||
|
||||
try {
|
||||
if (parsed.data.grant_type === 'authorization_code') {
|
||||
const { code, redirect_uri, code_verifier, connector_state } = parsed.data
|
||||
// Same binding as the bank /sessions exchange: verified state signature,
|
||||
// this key, skv service, and an existing pending row are preconditions
|
||||
// for the privileged exchange (Arcim's client secret). Without them a
|
||||
// code could be exchanged under a foreign or consumed state and live
|
||||
// tokens handed out with no ledger row proving ownership.
|
||||
const verified = verifyConnectorState(connector_state)
|
||||
if (!verified.ok) {
|
||||
return NextResponse.json({ error: 'Invalid connector state', code: 'CONNECTOR_STATE_INVALID' }, { status: 400 })
|
||||
}
|
||||
if (verified.payload.kid !== ctx.key.id || verified.payload.svc !== 'skv') {
|
||||
return NextResponse.json({ error: 'State does not belong to this key', code: 'CONNECTOR_STATE_INVALID' }, { status: 403 })
|
||||
}
|
||||
const pendingRow = await findPendingByState(ctx.supabase, { keyId: ctx.key.id, pendingState: connector_state })
|
||||
if (!pendingRow) {
|
||||
return NextResponse.json({ error: 'Unknown connection for this key', code: 'CONNECTOR_NOT_OWNED' }, { status: 404 })
|
||||
}
|
||||
const tokens = await exchangeSkvCode(code, redirect_uri, code_verifier)
|
||||
const activated = await activateByPendingState(ctx.supabase, {
|
||||
keyId: ctx.key.id,
|
||||
pendingState: connector_state,
|
||||
handle: tokens.access_token,
|
||||
})
|
||||
if (!activated) {
|
||||
// Consumed concurrently (replay of the same state): never hand out
|
||||
// tokens the ledger cannot vouch for. SKV has no revoke endpoint;
|
||||
// the unreturned pair simply expires unused.
|
||||
ctx.log.warn('skv token exchange raced a consumed state; tokens withheld')
|
||||
return NextResponse.json(
|
||||
{ error: 'Connector state already consumed', code: 'CONNECTOR_STATE_CONSUMED' },
|
||||
{ status: 409 },
|
||||
)
|
||||
}
|
||||
if (tokens.refresh_token) {
|
||||
// The ledger write must take before the tokens leave: a silently
|
||||
// failed update strands a connection the ledger cannot vouch for.
|
||||
const { error: hashError } = await ctx.supabase
|
||||
.from('connector_connections')
|
||||
.update({ refresh_hash: hashHandle(tokens.refresh_token) })
|
||||
.eq('connector_key_id', ctx.key.id)
|
||||
.eq('handle_hash', hashHandle(tokens.access_token))
|
||||
if (hashError) {
|
||||
ctx.log.error('skv ledger refresh-hash write failed; tokens withheld', hashError)
|
||||
return NextResponse.json({ error: 'Ledger update failed', code: 'CONNECTOR_LEDGER_FAILED' }, { status: 502 })
|
||||
}
|
||||
}
|
||||
return tokenResponse(tokens)
|
||||
}
|
||||
|
||||
// refresh: ownership FIRST. The presented refresh token must hash to an
|
||||
// ACTIVE ledger row under the presenting key before the broker spends
|
||||
// Arcim's client secret on it; without this the route was an open refresh
|
||||
// oracle for any leaked refresh token. Then rotate the ledger's handle +
|
||||
// refresh hashes to the new pair. Two literal payloads (no runtime-built
|
||||
// object) so the no-phantom-columns scanner can resolve the columns.
|
||||
const { refresh_token } = parsed.data
|
||||
const oldRefreshHash = hashHandle(refresh_token)
|
||||
const owned = await findByRefreshHash(ctx.supabase, { keyId: ctx.key.id, refreshHash: oldRefreshHash })
|
||||
if (!owned) {
|
||||
return NextResponse.json({ error: 'Unknown connection for this key', code: 'CONNECTOR_NOT_OWNED' }, { status: 404 })
|
||||
}
|
||||
const tokens = await refreshSkvToken(refresh_token)
|
||||
const newHandleHash = tokens.access_token ? hashHandle(tokens.access_token) : null
|
||||
const lastUsedAt = new Date().toISOString()
|
||||
// The rotation write must take before the tokens leave: SKV has already
|
||||
// consumed the old refresh token, so a silently failed update would leave
|
||||
// a ledger that can vouch for neither the old nor the new pair.
|
||||
const { error: rotateError } = tokens.refresh_token
|
||||
? await ctx.supabase
|
||||
.from('connector_connections')
|
||||
.update({ handle_hash: newHandleHash, last_used_at: lastUsedAt, refresh_hash: hashHandle(tokens.refresh_token) })
|
||||
.eq('id', owned.id)
|
||||
.eq('status', 'active')
|
||||
: await ctx.supabase
|
||||
.from('connector_connections')
|
||||
.update({ handle_hash: newHandleHash, last_used_at: lastUsedAt })
|
||||
.eq('id', owned.id)
|
||||
.eq('status', 'active')
|
||||
if (rotateError) {
|
||||
ctx.log.error('skv ledger rotation write failed; tokens withheld', rotateError)
|
||||
return NextResponse.json({ error: 'Ledger update failed', code: 'CONNECTOR_LEDGER_FAILED' }, { status: 502 })
|
||||
}
|
||||
return tokenResponse(tokens)
|
||||
} catch (err) {
|
||||
ctx.log.warn('skv token exchange failed', { err: err instanceof Error ? err.message : String(err) })
|
||||
return NextResponse.json({ error: 'Skatteverket token exchange failed', code: 'CONNECTOR_SKV_TOKEN_FAILED' }, { status: 502 })
|
||||
}
|
||||
})
|
||||
Reference in New Issue
Block a user