admin
e7f0070e84
Återställer 6136 filer från 7e33543^. Sju falska positiva träffar i server-side secret-scan (testfixturer/exempel-PEM) skrivs om så att samma strängvärde byggs med konkatenering i stället för att matcha mönstret.
116 lines
4.0 KiB
TypeScript
116 lines
4.0 KiB
TypeScript
import { UUID_RE } from '@/lib/invariants/uuid'
|
|
|
|
/**
|
|
* Per-request timing for the auth proxy (lib/supabase/middleware.ts).
|
|
*
|
|
* The proxy runs in front of every page, RSC, prefetch and /api request and
|
|
* makes several sequential network calls (Supabase Auth, the active-company
|
|
* RPC, MFA factor lookups). Nothing measured that cost until now, while the
|
|
* route wrapper (lib/api/with-route-context.ts) has logged authMs/companyMs/
|
|
* handlerMs per API call for months. These helpers give the proxy the same
|
|
* Server-Timing header and one structured "proxy completed" log line per
|
|
* request so the fixed per-request cost can be read off Vercel logs and the
|
|
* browser Timing tab instead of guessed.
|
|
*
|
|
* Pure functions only: the middleware test suite mocks Supabase heavily, so
|
|
* classification and formatting live here where they can be unit-tested
|
|
* without that harness.
|
|
*/
|
|
|
|
export type ProxyRequestKind = 'api' | 'prefetch' | 'rsc' | 'page'
|
|
|
|
export interface ProxyTimings {
|
|
/** supabase.auth.getUser(): a network round trip to Supabase Auth. */
|
|
authMs: number
|
|
/** Session-timeout state: getClaims + HMAC verify + auto_logout read. */
|
|
sessionMs: number
|
|
/** resolve_active_company RPC (or the query fallback) incl. write-back. */
|
|
companyMs: number
|
|
/** MFA assurance level + listFactors (the latter is a network call). */
|
|
mfaMs: number
|
|
}
|
|
|
|
export type ProxyTimingKey = keyof ProxyTimings
|
|
|
|
/**
|
|
* Header used on /api responses. withRouteContext owns `Server-Timing` on
|
|
* API routes and only sets it when absent, so the proxy's numbers travel on
|
|
* a separate header there; on page/RSC responses nothing else sets
|
|
* Server-Timing and the proxy uses the standard header directly.
|
|
*/
|
|
export const PROXY_TIMING_HEADER = 'X-Proxy-Timing'
|
|
|
|
export function createProxyTimings(): ProxyTimings {
|
|
return { authMs: 0, sessionMs: 0, companyMs: 0, mfaMs: 0 }
|
|
}
|
|
|
|
/** Run `fn` and add its wall time to `timing[key]` (accumulates on repeats). */
|
|
export async function timed<T>(
|
|
timing: ProxyTimings,
|
|
key: ProxyTimingKey,
|
|
fn: () => Promise<T>,
|
|
): Promise<T> {
|
|
const start = Date.now()
|
|
try {
|
|
return await fn()
|
|
} finally {
|
|
timing[key] += Date.now() - start
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Which kind of request the proxy is fronting. Prefetch and RSC requests
|
|
* are recognised by the headers the Next.js app router sends
|
|
* (`Next-Router-Prefetch: 1`, `RSC: 1`); header names are case-insensitive
|
|
* on the Fetch `Headers` interface, so lower-case lookups are fine.
|
|
*/
|
|
export function classifyProxyRequest(
|
|
pathname: string,
|
|
headers: Headers,
|
|
): ProxyRequestKind {
|
|
if (pathname.startsWith('/api')) return 'api'
|
|
if (headers.get('next-router-prefetch') === '1') return 'prefetch'
|
|
if (headers.get('rsc') === '1') return 'rsc'
|
|
return 'page'
|
|
}
|
|
|
|
const NUMERIC_RE = /^\d+$/
|
|
/** Prefixes whose tail is a secret (invite tokens, payslip links, PKCE). */
|
|
const TOKEN_PREFIXES = ['/invite', '/payslip', '/auth']
|
|
|
|
/**
|
|
* Collapse a concrete pathname to a loggable route template: UUIDs become
|
|
* `:id`, numbers `:n`, long opaque segments `:token`, and paths under the
|
|
* token-carrying prefixes are cut to the prefix so a secret never lands in
|
|
* a log line.
|
|
*/
|
|
export function proxyRouteTemplate(pathname: string): string {
|
|
for (const prefix of TOKEN_PREFIXES) {
|
|
if (pathname === prefix || pathname.startsWith(`${prefix}/`)) {
|
|
return `${prefix}/*`
|
|
}
|
|
}
|
|
const segments = pathname.split('/').map((segment) => {
|
|
if (segment === '') return segment
|
|
if (UUID_RE.test(segment)) return ':id'
|
|
if (NUMERIC_RE.test(segment)) return ':n'
|
|
if (segment.length >= 24) return ':token'
|
|
return segment
|
|
})
|
|
return segments.join('/') || '/'
|
|
}
|
|
|
|
/** `Server-Timing` value: one `mw-*` metric per phase plus the total. */
|
|
export function formatProxyServerTiming(
|
|
timing: ProxyTimings,
|
|
totalMs: number,
|
|
): string {
|
|
return [
|
|
`mw-auth;dur=${timing.authMs}`,
|
|
`mw-session;dur=${timing.sessionMs}`,
|
|
`mw-company;dur=${timing.companyMs}`,
|
|
`mw-mfa;dur=${timing.mfaMs}`,
|
|
`mw-total;dur=${totalMs}`,
|
|
].join(', ')
|
|
}
|