feat(connect): Enable Banking proxy for self-hosted instances, with a secret-free ownership ledger and a global rate budget (#1751)
* feat(entitlements): partition the self-host bypass so connector capabilities fall through to grants; capability_grants.source accepts 'connector' Sovereign plan WS3 PR3: ships dark, nothing changes for hosted. - lib/entitlements/keys.ts: CONNECTOR_CAPABILITIES = bank_sync, skatteverket, org_lookup, migration (services Accounted operates that a self-hosted instance cannot provide itself) + isConnectorCapability(). Separate from PAID_CAPABILITIES and outside the trial-seed trigger on purpose: a hosted company can never hold a connector grant. - lib/entitlements/has-capability.ts: isPaywallBypassed() -> isBypassedFor(key). Hosted: byte-identical (dev / DISABLE_PAYWALL bypass, FORCE_PAYWALL wins, else the grant lookup). Self-host: local capabilities always on (FORCE_PAYWALL included, as the existing test demands); connector capabilities behave like hosted, i.e. dev bypass, FORCE_PAYWALL, else the grant lookup where the connector sync will write source='connector' rows. getCompanyEntitlements on a self-host: local paid keys + active connector keys, state 'paid' with an active connector grant else 'none' (never the hosted trial copy). - Migration 20260820122000: capability_grants.source CHECK gains 'connector', found through pg_constraint (the CHECK was declared inline and auto-named; Postgres stores IN as = ANY, matched accordingly). pg-real test: connector accepted, unknown source rejected, upsert on the (scope, key, source) identity, trial seed writes no connector rows. - Tests: self-hosted connector matrix (local all-on without DB, connector gated by grant/expiry, dev bypass all-on, FORCE_PAYWALL gates connector keys only, bulk resolution, entitlements shape); two pre-existing tests that asserted the old "self-host holds connector keys" contract updated to the new one. Verified: full unit suite green, pg-real suite for lib/entitlements green against a local supabase/postgres with every migration applied, lint ratchet, guards. Deferred to the instance-wiring PR: adding the connector extensions to the self-host Docker preset (dead-end upsells until a key can be issued). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(entitlements): fold the self-host branch into the existing grants query One .or(scopeFilter), not two: the duplicated helper pushed the no-phantom-columns unresolvable-expression count to 380/379. Behaviour is unchanged; the self-host matrix tests still pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(connect): hosted connector-key registry + validate RPC + entitlements endpoint; instance sync writes connector grants hourly Sovereign plan WS3 PR4 ("key infra enabling manual sales"), stacked on the entitlement partition (#1747). Nothing is purchasable yet; this is the plumbing both ends need before the first manually issued key. Hosted side: - Migration 20260820123000: connector_keys (SHA-256 key_hash, prefix, org_number, pinned instance_url, scopes, status, Stripe ids, current_period_end, per-minute rate limit, active_company_count, last_seen/synced) and connector_usage_events (per-request metering, separate from metered_events whose company_id references hosted companies). RLS on, NO policies: service role only. RPC validate_and_increment_connector_key copies the api_keys pattern (FOR UPDATE, minute window, suspended reported not counted, revoked = no row) and is REVOKEd from PUBLIC/anon/authenticated, GRANTed to service_role. pg-real test covers validate/count, unknown+revoked, suspended, rate limit, execute privileges per role, RLS invisibility, usage cascade. - lib/connect/contract.ts (shared wire types), lib/connect/hosted/keys.ts (generate/hash/validate -> 401/403/429 mapping), with-connector-auth.ts (Bearer or X-Connector-Key, one usage row per request, 500 envelope on handler throw), /api/connect/entitlements GET + POST (records active_company_count, pins instance_url on first report, never moves a pinned one), scripts/issue-connector-key.ts (dry run unless --confirm, prints the key once + the .env lines). Instance side: - lib/connect/instance/config.ts (GNUBOK_CONNECTOR_KEY, GNUBOK_CONNECT_URL default https://app.gnubok.se), sync.ts: reports the active company count and writes source='connector' grants for every company x covered scope, expires_at = min(now+72h, period_end+3d); 401/403 or a non-active status deletes them (freeze-and-retain); network/5xx/429 leave them alone. /api/connector/sync/cron (hourly) runs it; not_configured without a key. - Crontab generator gains EXTRA_JOBS (variant-only jobs not in vercel.json, with reasons) + drift tests; docker/crontab.self-hosted regenerated with the hourly sync. Docs (SELF-HOSTING connector section, env templates), DECISIONS. Tests: 52 new unit tests (keys, auth wrapper, route, config, sync outcomes and grant arithmetic, cron route, crontab EXTRA_JOBS) + 7 pg-real tests run locally against supabase/postgres with every migration applied. no-phantom-columns ceiling +1 with a reason (the bulk grant upsert). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(connect): Enable Banking proxy for self-hosted instances, with a secret-free ownership ledger and a global rate budget Sovereign plan WS3 PR5a, stacked on the connector-key infra (#1748). A self-hosted instance with a `bank_sync`-scoped connector key can now connect a bank through Arcim's PSD2 credentials; the bank session id and all transaction data stay in the instance's own database (founder decision: tokens on the instance, proxy stateless). - Migration 20260820124000: `connector_connections` (secret-free ledger: sha256 of the EB session id + account uids, service-role only), `connector_upstream_counters` + RPC `connector_reserve_upstream` (global budget under EB Annex 1 §5's 300/min, shared with hosted), and `connector_keys.limits` jsonb; validate RPC v2 returns limits. All RPCs REVOKEd from PUBLIC/anon/authenticated, GRANTed service_role. pg-real covers all of it. - EB JWT minting moved to lib/connect/upstreams/enable-banking-jwt.ts (core must not import @/extensions/); the extension re-exports it, tests unchanged. - lib/connect/hosted/{state,ledger,upstream-budget}.ts: HMAC-signed connector state (15-min TTL) so the consent redirect can use OUR registered EB callback and bounce back to the instance, no per-instance redirect URI at EB; the callback route gains that connector branch. - app/api/connect/bank/[...path]: path allowlist (aspsps, auth, sessions, accounts/{uid}/{balances,transactions}), never open passthrough. POST /auth enforces the per-company connection quota + rewrites redirect/state; reads/deletes verify ledger ownership; every upstream call takes the global budget (429 + Retry-After when exhausted). - issue-connector-key.ts: scopes default bank_sync,skatteverket (TIC out of v1), --bank/skv-connections-per-company + --sync-min-interval. - Docs (SELF-HOSTING: bank connector live), DECISIONS. Verified: 52 connect unit tests + 13 pg-real (run locally against supabase/postgres with all migrations) + EB extension suite (225, jwt relocation intact); full unit suite 15 979 green; tsc, guards, lint clean. Not in this PR: SKV broker (PR5b) and instance wiring (PR6). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(connect): update ledger pg test to re-versioned migration 20260831200000 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb * fix(connect): redact opaque path segments before usage metering; correct stale RPC-source comment GET/DELETE /sessions/{id} and /accounts/{uid}/... carry the raw EB session id / account uid in the pathname; metering persisted it in cleartext next to the ledger that stores only sha256(handle). Opaque segments (UUID, long hex, long base64url) now become ':id' before the connector_usage_events insert. Migration comment now cites the real prior RPC source (20260831190000). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb * fix(connect): percent-encoded path segments count as opaque in metering redaction Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb * fix(connect): PR #1751 review batch: https-only EB URL, body-covering timeout, quota reservation, delete-after-success, doc fix Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb * fix(connect): bind the /sessions code exchange to its verified pending state; ceiling +1 Verified state signature, key/service match, and an existing pending row now precede the EB exchange; a concurrently consumed state closes the just-minted upstream session and 409s. no-phantom-columns ceiling 391 for countHeldConnections' computed .or() timestamp filter. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UzNkSsR18pLFitJdYn8QEb --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Emil <emilmattsson14@gmail.com>
This commit is contained in:
Jakob Wennberg
co-authored by
Claude Fable 5
Jakob Wennberg
Emil
Claude Fable 5
Jakob Wennberg
Emil
parent
0ff1b05553
commit
36123cef23
@@ -0,0 +1,224 @@
|
||||
import { describe, it, expect, vi, beforeEach } from 'vitest'
|
||||
|
||||
let currentKey = {
|
||||
id: 'key-1',
|
||||
orgNumber: '5561234567',
|
||||
instanceUrl: 'https://bokforing.example.se',
|
||||
scopes: ['bank_sync'],
|
||||
status: 'active' as const,
|
||||
currentPeriodEnd: null as string | null,
|
||||
limits: { bank_connections_per_company: 1, skv_connections_per_company: 1, sync_min_interval_s: 0 },
|
||||
}
|
||||
vi.mock('@/lib/connect/hosted/with-connector-auth', () => ({
|
||||
withConnectorAuth: (_op: string, handler: (req: Request, ctx: unknown) => Promise<Response>) => (req: Request) =>
|
||||
handler(req, { requestId: 'conn_test', log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() }, supabase: {}, key: currentKey }),
|
||||
}))
|
||||
vi.mock('@/lib/connect/upstreams/enable-banking-jwt', () => ({ getAuthorizationHeader: () => 'Bearer eb-jwt' }))
|
||||
const h = vi.hoisted(() => ({
|
||||
budget: vi.fn(),
|
||||
ledger: {
|
||||
countHeldConnections: vi.fn(),
|
||||
deletePendingConnectionById: vi.fn(),
|
||||
createPendingConnection: vi.fn(),
|
||||
activateByPendingState: vi.fn(),
|
||||
findByHandle: vi.fn(),
|
||||
findPendingByState: vi.fn(),
|
||||
findByAccountUid: vi.fn(),
|
||||
revokeByHandle: vi.fn(),
|
||||
touchConnection: vi.fn(),
|
||||
},
|
||||
}))
|
||||
const budget = h.budget
|
||||
const ledger = h.ledger
|
||||
vi.mock('@/lib/connect/hosted/upstream-budget', () => ({ reserveUpstream: (...a: unknown[]) => h.budget(...a) }))
|
||||
vi.mock('@/lib/connect/hosted/ledger', () => h.ledger)
|
||||
vi.mock('@/lib/connect/hosted/state', () => ({
|
||||
signConnectorState: () => 'ck1.signed.state',
|
||||
verifyConnectorState: (token: string) =>
|
||||
token === 'ck1.signed.state'
|
||||
? { ok: true, payload: { kid: 'key-1', svc: 'bank', ret: 'https://bokforing.example.se/cb', st: 's', cref: 'company-1', iat: 0 } }
|
||||
: token === 'ck1.other-key.state'
|
||||
? { ok: true, payload: { kid: 'key-OTHER', svc: 'bank', ret: 'x', st: 's', cref: 'c', iat: 0 } }
|
||||
: { ok: false, reason: 'malformed' },
|
||||
}))
|
||||
|
||||
const fetchMock = vi.fn()
|
||||
vi.stubGlobal('fetch', fetchMock)
|
||||
|
||||
import { GET, POST, DELETE } from '../route'
|
||||
|
||||
function req(method: string, path: string, body?: unknown, headers: Record<string, string> = {}): Request {
|
||||
return new Request(`https://app.gnubok.se/api/connect/bank${path}`, {
|
||||
method,
|
||||
headers: { 'x-connector-company': 'company-1', ...headers },
|
||||
...(body !== undefined ? { body: JSON.stringify(body) } : {}),
|
||||
})
|
||||
}
|
||||
function ebOk(body: unknown, status = 200) {
|
||||
fetchMock.mockResolvedValueOnce(new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } }))
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks()
|
||||
process.env.ENABLE_BANKING_API_URL = 'https://api.enablebanking.com'
|
||||
process.env.NEXT_PUBLIC_APP_URL = 'https://app.gnubok.se'
|
||||
currentKey = { ...currentKey, scopes: ['bank_sync'], limits: { bank_connections_per_company: 1, skv_connections_per_company: 1, sync_min_interval_s: 0 } }
|
||||
budget.mockResolvedValue({ ok: true })
|
||||
})
|
||||
|
||||
describe('bank proxy', () => {
|
||||
it('403s when the key lacks the bank_sync scope', async () => {
|
||||
currentKey = { ...currentKey, scopes: [] }
|
||||
const res = await GET(req('GET', '/aspsps'))
|
||||
expect(res.status).toBe(403)
|
||||
expect((await res.json()).code).toBe('CONNECTOR_SCOPE_MISSING')
|
||||
expect(fetchMock).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('forwards GET /aspsps with the EB JWT', async () => {
|
||||
ebOk({ aspsps: [] })
|
||||
const res = await GET(req('GET', '/aspsps?country=SE'))
|
||||
expect(res.status).toBe(200)
|
||||
const [url, init] = fetchMock.mock.calls[0]
|
||||
expect(url).toBe('https://api.enablebanking.com/aspsps?country=SE')
|
||||
expect((init.headers as Record<string, string>).Authorization).toBe('Bearer eb-jwt')
|
||||
})
|
||||
|
||||
it('refuses an unknown path', async () => {
|
||||
const res = await GET(req('GET', '/accounts'))
|
||||
expect(res.status).toBe(403)
|
||||
expect((await res.json()).code).toBe('CONNECTOR_PATH_NOT_ALLOWED')
|
||||
})
|
||||
|
||||
it('POST /auth rewrites redirect + state, checks quota, records a pending row', async () => {
|
||||
ledger.countHeldConnections.mockResolvedValue(0)
|
||||
ledger.createPendingConnection.mockResolvedValue('p1')
|
||||
ebOk({ url: 'https://bank.example/consent', authorization_id: 'a1' })
|
||||
const res = await POST(req('POST', '/auth', {
|
||||
aspsp: { name: 'SEB', country: 'SE' },
|
||||
redirect_url: 'https://bokforing.example.se/api/extensions/enable-banking/callback',
|
||||
state: 'inst-state',
|
||||
}))
|
||||
expect(res.status).toBe(200)
|
||||
expect(ledger.createPendingConnection).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ keyId: 'key-1', service: 'bank', companyRef: 'company-1', provider: 'SEB', pendingState: 'ck1.signed.state' }))
|
||||
const body = JSON.parse(fetchMock.mock.calls[0][1].body)
|
||||
expect(body.redirect_url).toBe('https://app.gnubok.se/api/extensions/enable-banking/callback')
|
||||
expect(body.state).toBe('ck1.signed.state')
|
||||
})
|
||||
|
||||
it('POST /auth rejects a redirect_url off the pinned instance', async () => {
|
||||
const res = await POST(req('POST', '/auth', { aspsp: { name: 'SEB', country: 'SE' }, redirect_url: 'https://evil.example.com/cb', state: 's' }))
|
||||
expect(res.status).toBe(400)
|
||||
expect((await res.json()).code).toBe('CONNECTOR_REDIRECT_INVALID')
|
||||
expect(ledger.createPendingConnection).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('POST /auth 403s when the per-company quota is reached', async () => {
|
||||
ledger.countHeldConnections.mockResolvedValue(1)
|
||||
const res = await POST(req('POST', '/auth', { aspsp: { name: 'SEB', country: 'SE' }, redirect_url: 'https://bokforing.example.se/cb', state: 's' }))
|
||||
expect(res.status).toBe(403)
|
||||
expect(await res.json()).toMatchObject({ code: 'CONNECTOR_QUOTA_EXCEEDED', limit: 1 })
|
||||
expect(fetchMock).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('POST /auth rolls back its own reservation when the post-insert re-count exceeds the limit (concurrent race)', async () => {
|
||||
// Two concurrent /auth calls both pre-count 0; the re-count after insert
|
||||
// sees both reservations and the loser deletes its own row.
|
||||
ledger.countHeldConnections.mockResolvedValueOnce(0).mockResolvedValueOnce(2)
|
||||
ledger.createPendingConnection.mockResolvedValue('p-race')
|
||||
const res = await POST(req('POST', '/auth', { aspsp: { name: 'SEB', country: 'SE' }, redirect_url: 'https://bokforing.example.se/cb', state: 's' }))
|
||||
expect(res.status).toBe(403)
|
||||
expect((await res.json()).code).toBe('CONNECTOR_QUOTA_EXCEEDED')
|
||||
expect(ledger.deletePendingConnectionById).toHaveBeenCalledWith(expect.anything(), 'p-race')
|
||||
})
|
||||
|
||||
it('POST /auth 400s without the company header', async () => {
|
||||
const res = await POST(new Request('https://app.gnubok.se/api/connect/bank/auth', { method: 'POST', body: '{}' }))
|
||||
expect(res.status).toBe(400)
|
||||
expect((await res.json()).code).toBe('CONNECTOR_COMPANY_MISSING')
|
||||
})
|
||||
|
||||
it('POST /sessions activates the ledger row from the connector_state', async () => {
|
||||
ledger.findPendingByState.mockResolvedValue({ id: 'p1', status: 'pending' })
|
||||
ledger.activateByPendingState.mockResolvedValue({ id: 'p1', status: 'active' })
|
||||
ebOk({ session_id: 'sess-9', accounts: [{ uid: 'acc-1' }, { uid: 'acc-2' }] })
|
||||
const res = await POST(req('POST', '/sessions', { code: 'auth-code', connector_state: 'ck1.signed.state' }))
|
||||
expect(res.status).toBe(200)
|
||||
expect(ledger.activateByPendingState).toHaveBeenCalledWith(expect.anything(), { keyId: 'key-1', pendingState: 'ck1.signed.state', handle: 'sess-9', accountUids: ['acc-1', 'acc-2'] })
|
||||
})
|
||||
|
||||
it('POST /sessions refuses an invalid or foreign connector state before touching EB', async () => {
|
||||
let res = await POST(req('POST', '/sessions', { code: 'c', connector_state: 'garbage' }))
|
||||
expect(res.status).toBe(400)
|
||||
expect((await res.json()).code).toBe('CONNECTOR_STATE_INVALID')
|
||||
res = await POST(req('POST', '/sessions', { code: 'c', connector_state: 'ck1.other-key.state' }))
|
||||
expect(res.status).toBe(403)
|
||||
ledger.findPendingByState.mockResolvedValue(null)
|
||||
res = await POST(req('POST', '/sessions', { code: 'c', connector_state: 'ck1.signed.state' }))
|
||||
expect(res.status).toBe(404)
|
||||
expect(fetchMock).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('POST /sessions closes the upstream session and 409s when the state was consumed concurrently', async () => {
|
||||
ledger.findPendingByState.mockResolvedValue({ id: 'p1', status: 'pending' })
|
||||
ledger.activateByPendingState.mockResolvedValue(null)
|
||||
ebOk({ session_id: 'sess-dup', accounts: [] })
|
||||
fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 })) // the revoking DELETE
|
||||
const res = await POST(req('POST', '/sessions', { code: 'c', connector_state: 'ck1.signed.state' }))
|
||||
expect(res.status).toBe(409)
|
||||
expect((await res.json()).code).toBe('CONNECTOR_STATE_CONSUMED')
|
||||
expect(fetchMock.mock.calls[1][0]).toContain('/sessions/sess-dup')
|
||||
expect(fetchMock.mock.calls[1][1].method).toBe('DELETE')
|
||||
})
|
||||
|
||||
it('GET /sessions/{id} requires ownership', async () => {
|
||||
ledger.findByHandle.mockResolvedValueOnce(null)
|
||||
expect((await GET(req('GET', '/sessions/sess-x'))).status).toBe(404)
|
||||
ledger.findByHandle.mockResolvedValueOnce({ id: 'l1' })
|
||||
ebOk({ session_id: 'sess-x' })
|
||||
expect((await GET(req('GET', '/sessions/sess-x'))).status).toBe(200)
|
||||
expect(ledger.touchConnection).toHaveBeenCalledWith(expect.anything(), 'l1')
|
||||
})
|
||||
|
||||
it('GET /accounts/{uid}/transactions requires account ownership', async () => {
|
||||
ledger.findByAccountUid.mockResolvedValueOnce(null)
|
||||
expect((await GET(req('GET', '/accounts/acc-1/transactions'))).status).toBe(404)
|
||||
ledger.findByAccountUid.mockResolvedValueOnce({ id: 'l2' })
|
||||
ebOk({ transactions: [] })
|
||||
const res = await GET(req('GET', '/accounts/acc-1/transactions?date_from=2026-01-01'))
|
||||
expect(res.status).toBe(200)
|
||||
expect(fetchMock.mock.calls[0][0]).toBe('https://api.enablebanking.com/accounts/acc-1/transactions?date_from=2026-01-01')
|
||||
})
|
||||
|
||||
it('DELETE /sessions/{id} revokes the ledger row after the upstream delete', async () => {
|
||||
ledger.findByHandle.mockResolvedValueOnce({ id: 'l3' })
|
||||
fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 }))
|
||||
const res = await DELETE(req('DELETE', '/sessions/sess-z'))
|
||||
expect(res.status).toBe(204)
|
||||
expect(ledger.revokeByHandle).toHaveBeenCalledWith(expect.anything(), { keyId: 'key-1', service: 'bank', handle: 'sess-z' })
|
||||
})
|
||||
|
||||
it('DELETE /sessions/{id} keeps the ledger row on a transient upstream error', async () => {
|
||||
ledger.findByHandle.mockResolvedValueOnce({ id: 'l4' })
|
||||
fetchMock.mockResolvedValueOnce(new Response('upstream boom', { status: 502 }))
|
||||
const res = await DELETE(req('DELETE', '/sessions/sess-w'))
|
||||
expect(res.status).toBe(502)
|
||||
expect(ledger.revokeByHandle).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('rejects a non-https EB base URL before sending the JWT', async () => {
|
||||
process.env.ENABLE_BANKING_API_URL = 'http://api.enablebanking.com'
|
||||
ledger.findByHandle.mockResolvedValueOnce({ id: 'l5' })
|
||||
await expect(GET(req('GET', '/aspsps'))).rejects.toThrow(/must be https/)
|
||||
expect(fetchMock).not.toHaveBeenCalled()
|
||||
process.env.ENABLE_BANKING_API_URL = 'https://api.enablebanking.com'
|
||||
})
|
||||
|
||||
it('returns 429 with Retry-After when the global budget is exhausted', async () => {
|
||||
budget.mockResolvedValue({ ok: false, scope: 'minute', retryAfterSec: 60 })
|
||||
const res = await GET(req('GET', '/aspsps'))
|
||||
expect(res.status).toBe(429)
|
||||
expect(res.headers.get('Retry-After')).toBe('60')
|
||||
expect(fetchMock).not.toHaveBeenCalled()
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,346 @@
|
||||
import { NextResponse } from 'next/server'
|
||||
import { withConnectorAuth, type ConnectorContext } from '@/lib/connect/hosted/with-connector-auth'
|
||||
import { getAuthorizationHeader } from '@/lib/connect/upstreams/enable-banking-jwt'
|
||||
import { reserveUpstream } from '@/lib/connect/hosted/upstream-budget'
|
||||
import {
|
||||
activateByPendingState,
|
||||
countHeldConnections,
|
||||
createPendingConnection,
|
||||
deletePendingConnectionById,
|
||||
findByAccountUid,
|
||||
findByHandle,
|
||||
findPendingByState,
|
||||
revokeByHandle,
|
||||
touchConnection,
|
||||
} from '@/lib/connect/hosted/ledger'
|
||||
import { signConnectorState, verifyConnectorState } from '@/lib/connect/hosted/state'
|
||||
|
||||
/**
|
||||
* Enable Banking proxy for self-hosted instances (WS3 PR5).
|
||||
*
|
||||
* The instance calls this with its connector key; the proxy adds Arcim's EB
|
||||
* JWT and forwards to Enable Banking. The instance never holds the EB
|
||||
* credential; the bank session id it gets back rests on the instance. This
|
||||
* route is what makes that split safe: a strict path allowlist (never an open
|
||||
* passthrough), per-key + global rate budget on every upstream call, a
|
||||
* per-company connection quota checked at authorize time, and an ownership
|
||||
* ledger so an instance can only use sessions/accounts it obtained through its
|
||||
* own key.
|
||||
*
|
||||
* Consent handoff: POST /auth's redirect_url is rewritten to OUR hosted EB
|
||||
* callback (already registered with EB), and the upstream `state` is replaced
|
||||
* by a signed connector state carrying the instance's own return URL. The
|
||||
* hosted EB callback (app/api/extensions/enable-banking/callback) detects that
|
||||
* signed state and 302s the browser back to the instance with the code, so no
|
||||
* new redirect URI has to be registered at Enable Banking per instance.
|
||||
*/
|
||||
|
||||
/**
|
||||
* The EB base URL must be https (http only for loopback dev): forwardToEb
|
||||
* sends Arcim's EB JWT in Authorization, so a plaintext override would ship
|
||||
* the credential unencrypted. Resolved lazily so a bad env fails the request
|
||||
* (500 via the wrapper), never the build.
|
||||
*/
|
||||
function ebBaseUrl(): string {
|
||||
const raw = (
|
||||
process.env.ENABLE_BANKING_API_URL_PRODUCTION ||
|
||||
process.env.ENABLE_BANKING_API_URL ||
|
||||
'https://api.enablebanking.com'
|
||||
).replace(/\/+$/, '')
|
||||
const url = new URL(raw)
|
||||
const loopback = url.hostname === 'localhost' || url.hostname === '127.0.0.1'
|
||||
if (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)) {
|
||||
throw new Error('ENABLE_BANKING_API_URL must be https: the EB JWT is sent in Authorization')
|
||||
}
|
||||
return raw
|
||||
}
|
||||
|
||||
const COMPANY_HEADER = 'x-connector-company'
|
||||
const FETCH_TIMEOUT_MS = 30_000
|
||||
|
||||
function requireScope(ctx: ConnectorContext): NextResponse | null {
|
||||
if (ctx.key.scopes.includes('bank_sync')) return null
|
||||
return NextResponse.json(
|
||||
{ error: 'This connector key does not include bank sync', code: 'CONNECTOR_SCOPE_MISSING' },
|
||||
{ status: 403 },
|
||||
)
|
||||
}
|
||||
|
||||
function companyRef(request: Request): string | null {
|
||||
return request.headers.get(COMPANY_HEADER)?.trim() || null
|
||||
}
|
||||
|
||||
async function budgetOr429(ctx: ConnectorContext): Promise<NextResponse | null> {
|
||||
const budget = await reserveUpstream(ctx.supabase, 'bank')
|
||||
if (budget.ok) return null
|
||||
ctx.log.warn('bank connector budget exhausted', { scope: budget.scope })
|
||||
return NextResponse.json(
|
||||
{ error: 'Bank connector is busy, try again shortly', code: 'CONNECTOR_RATE_LIMITED', scope: budget.scope },
|
||||
{ status: 429, headers: { 'Retry-After': String(budget.retryAfterSec) } },
|
||||
)
|
||||
}
|
||||
|
||||
// Statuses that must carry no body (RFC 9110). new Response(text, {status:204})
|
||||
// throws in undici, so pass a null body through for these.
|
||||
const NULL_BODY_STATUS = new Set([204, 205, 304])
|
||||
|
||||
interface EbResult {
|
||||
status: number
|
||||
ok: boolean
|
||||
/** null for the RFC 9110 bodyless statuses. */
|
||||
text: string | null
|
||||
contentType: string | null
|
||||
}
|
||||
|
||||
/**
|
||||
* Forward a request to Enable Banking with Arcim's JWT and read the body
|
||||
* INSIDE the timeout window: clearing the timer at headers-received left an
|
||||
* upstream that stalls mid-body holding the request open forever.
|
||||
*/
|
||||
async function forwardToEb(method: string, path: string, body?: unknown): Promise<EbResult> {
|
||||
const controller = new AbortController()
|
||||
const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS)
|
||||
try {
|
||||
const res = await fetch(`${ebBaseUrl()}${path}`, {
|
||||
method,
|
||||
signal: controller.signal,
|
||||
headers: {
|
||||
Authorization: getAuthorizationHeader(),
|
||||
'Content-Type': 'application/json',
|
||||
Accept: 'application/json',
|
||||
},
|
||||
...(body !== undefined ? { body: JSON.stringify(body) } : {}),
|
||||
})
|
||||
const text = NULL_BODY_STATUS.has(res.status) ? null : await res.text()
|
||||
return { status: res.status, ok: res.ok, text, contentType: res.headers.get('content-type') }
|
||||
} finally {
|
||||
clearTimeout(timeout)
|
||||
}
|
||||
}
|
||||
|
||||
function passthrough(res: EbResult): NextResponse {
|
||||
if (res.text === null) {
|
||||
return new NextResponse(null, { status: res.status })
|
||||
}
|
||||
return new NextResponse(res.text, {
|
||||
status: res.status,
|
||||
headers: { 'Content-Type': res.contentType ?? 'application/json' },
|
||||
})
|
||||
}
|
||||
|
||||
function pathOf(request: Request): string {
|
||||
const idx = request.url.indexOf('/api/connect/bank')
|
||||
const rest = idx === -1 ? '' : request.url.slice(idx + '/api/connect/bank'.length)
|
||||
return rest.split('?')[0].replace(/\/+$/, '') || '/'
|
||||
}
|
||||
function queryOf(request: Request): string {
|
||||
const q = request.url.indexOf('?')
|
||||
return q === -1 ? '' : request.url.slice(q)
|
||||
}
|
||||
|
||||
const HOSTED_EB_CALLBACK = () =>
|
||||
`${(process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000').replace(/\/+$/, '')}/api/extensions/enable-banking/callback`
|
||||
|
||||
export const GET = withConnectorAuth('connect.bank', async (request, ctx) => {
|
||||
const scopeError = requireScope(ctx)
|
||||
if (scopeError) return scopeError
|
||||
const path = pathOf(request)
|
||||
|
||||
// GET /aspsps — bank list. Rate-budgeted, no ownership.
|
||||
if (path === '/aspsps') {
|
||||
const blocked = await budgetOr429(ctx)
|
||||
if (blocked) return blocked
|
||||
return passthrough(await forwardToEb('GET', `/aspsps${queryOf(request)}`))
|
||||
}
|
||||
|
||||
// GET /sessions/{id} — must own the session.
|
||||
const sessionMatch = /^\/sessions\/([^/]+)$/.exec(path)
|
||||
if (sessionMatch) {
|
||||
const sessionId = decodeURIComponent(sessionMatch[1])
|
||||
const owned = await findByHandle(ctx.supabase, { keyId: ctx.key.id, service: 'bank', handle: sessionId })
|
||||
if (!owned) return notOwned()
|
||||
const blocked = await budgetOr429(ctx)
|
||||
if (blocked) return blocked
|
||||
await touchConnection(ctx.supabase, owned.id)
|
||||
return passthrough(await forwardToEb('GET', `/sessions/${encodeURIComponent(sessionId)}`))
|
||||
}
|
||||
|
||||
// GET /accounts/{uid}/balances|transactions — must own the account.
|
||||
const acctMatch = /^\/accounts\/([^/]+)\/(balances|transactions)$/.exec(path)
|
||||
if (acctMatch) {
|
||||
const uid = decodeURIComponent(acctMatch[1])
|
||||
const owned = await findByAccountUid(ctx.supabase, { keyId: ctx.key.id, accountUid: uid })
|
||||
if (!owned) return notOwned()
|
||||
const blocked = await budgetOr429(ctx)
|
||||
if (blocked) return blocked
|
||||
await touchConnection(ctx.supabase, owned.id)
|
||||
return passthrough(await forwardToEb('GET', `/accounts/${encodeURIComponent(uid)}/${acctMatch[2]}${queryOf(request)}`))
|
||||
}
|
||||
|
||||
return notAllowed()
|
||||
})
|
||||
|
||||
export const POST = withConnectorAuth('connect.bank', async (request, ctx) => {
|
||||
const scopeError = requireScope(ctx)
|
||||
if (scopeError) return scopeError
|
||||
const path = pathOf(request)
|
||||
const cref = companyRef(request)
|
||||
|
||||
// POST /auth — start a bank authorization for one company.
|
||||
if (path === '/auth') {
|
||||
if (!cref) return missingCompany()
|
||||
let payload: Record<string, unknown>
|
||||
try {
|
||||
payload = (await request.json()) as Record<string, unknown>
|
||||
} catch {
|
||||
return NextResponse.json({ error: 'Invalid JSON', code: 'BAD_REQUEST' }, { status: 400 })
|
||||
}
|
||||
const instanceReturn = typeof payload.redirect_url === 'string' ? payload.redirect_url : null
|
||||
if (!instanceReturn || !isOnInstance(instanceReturn, ctx.key.instanceUrl)) {
|
||||
return NextResponse.json(
|
||||
{ error: 'redirect_url must be on the connector key\'s instance', code: 'CONNECTOR_REDIRECT_INVALID' },
|
||||
{ status: 400 },
|
||||
)
|
||||
}
|
||||
// Per-company connection quota (the sold package). Counting alone is a
|
||||
// TOCTOU race under concurrent /auth calls, so the pending row doubles as
|
||||
// a reservation: fast-reject on the pre-count, insert, then RE-count and
|
||||
// roll the own row back when over the limit. Fresh pending rows reserve
|
||||
// quota for the 15-minute consent window (see countHeldConnections).
|
||||
const quotaExceeded = () =>
|
||||
NextResponse.json(
|
||||
{
|
||||
error: 'Bank connection quota reached for this company',
|
||||
code: 'CONNECTOR_QUOTA_EXCEEDED',
|
||||
limit: ctx.key.limits.bank_connections_per_company,
|
||||
},
|
||||
{ status: 403 },
|
||||
)
|
||||
const held = await countHeldConnections(ctx.supabase, ctx.key.id, 'bank', cref)
|
||||
if (held >= ctx.key.limits.bank_connections_per_company) return quotaExceeded()
|
||||
const blocked = await budgetOr429(ctx)
|
||||
if (blocked) return blocked
|
||||
|
||||
const instanceState = typeof payload.state === 'string' ? payload.state : ''
|
||||
const signedState = signConnectorState({ kid: ctx.key.id, svc: 'bank', ret: instanceReturn, st: instanceState, cref })
|
||||
const provider = typeof (payload.aspsp as { name?: string } | undefined)?.name === 'string'
|
||||
? String((payload.aspsp as { name: string }).name)
|
||||
: null
|
||||
const pendingId = await createPendingConnection(ctx.supabase, {
|
||||
keyId: ctx.key.id,
|
||||
service: 'bank',
|
||||
companyRef: cref,
|
||||
provider,
|
||||
pendingState: signedState,
|
||||
})
|
||||
const heldAfter = await countHeldConnections(ctx.supabase, ctx.key.id, 'bank', cref)
|
||||
if (heldAfter > ctx.key.limits.bank_connections_per_company) {
|
||||
await deletePendingConnectionById(ctx.supabase, pendingId)
|
||||
return quotaExceeded()
|
||||
}
|
||||
// Rewrite the redirect to OUR registered callback and swap in the signed state.
|
||||
const ebBody = { ...payload, redirect_url: HOSTED_EB_CALLBACK(), state: signedState }
|
||||
return passthrough(await forwardToEb('POST', '/auth', ebBody))
|
||||
}
|
||||
|
||||
// POST /sessions — finalize after consent, record the session in the ledger.
|
||||
if (path === '/sessions') {
|
||||
let payload: Record<string, unknown>
|
||||
try {
|
||||
payload = (await request.json()) as Record<string, unknown>
|
||||
} catch {
|
||||
return NextResponse.json({ error: 'Invalid JSON', code: 'BAD_REQUEST' }, { status: 400 })
|
||||
}
|
||||
// The instance sends back the signed connector state it received. The
|
||||
// code is only exchanged AGAINST that state's own pending row: verified
|
||||
// signature, this key, bank service, and the row still pending. Without
|
||||
// the binding, a code could be exchanged under a foreign or consumed
|
||||
// state, minting an upstream session the ledger never records.
|
||||
const pendingState = typeof payload.connector_state === 'string' ? payload.connector_state : null
|
||||
if (!pendingState) {
|
||||
return NextResponse.json({ error: 'Missing connector_state', code: 'BAD_REQUEST' }, { status: 400 })
|
||||
}
|
||||
const verified = verifyConnectorState(pendingState)
|
||||
if (!verified.ok) {
|
||||
return NextResponse.json({ error: 'Invalid connector state', code: 'CONNECTOR_STATE_INVALID' }, { status: 400 })
|
||||
}
|
||||
if (verified.payload.kid !== ctx.key.id || verified.payload.svc !== 'bank') {
|
||||
return NextResponse.json({ error: 'State does not belong to this key', code: 'CONNECTOR_STATE_INVALID' }, { status: 403 })
|
||||
}
|
||||
const pendingRow = await findPendingByState(ctx.supabase, { keyId: ctx.key.id, pendingState })
|
||||
if (!pendingRow) return notOwned()
|
||||
const blocked = await budgetOr429(ctx)
|
||||
if (blocked) return blocked
|
||||
const ebRes = await forwardToEb('POST', '/sessions', { code: payload.code })
|
||||
if (ebRes.ok && ebRes.text !== null) {
|
||||
try {
|
||||
const session = JSON.parse(ebRes.text) as { session_id?: string; accounts?: Array<{ uid?: string }> }
|
||||
if (session.session_id) {
|
||||
const accountUids = (session.accounts ?? [])
|
||||
.map((a) => a.uid)
|
||||
.filter((u): u is string => typeof u === 'string')
|
||||
const activated = await activateByPendingState(ctx.supabase, {
|
||||
keyId: ctx.key.id,
|
||||
pendingState,
|
||||
handle: session.session_id,
|
||||
accountUids,
|
||||
})
|
||||
if (!activated) {
|
||||
// The pending row was consumed between the precheck and now (a
|
||||
// concurrent replay of the same state). An unrecorded upstream
|
||||
// session must not be handed out: close it and refuse.
|
||||
await forwardToEb('DELETE', `/sessions/${encodeURIComponent(session.session_id)}`)
|
||||
return NextResponse.json(
|
||||
{ error: 'Connector state already consumed', code: 'CONNECTOR_STATE_CONSUMED' },
|
||||
{ status: 409 },
|
||||
)
|
||||
}
|
||||
}
|
||||
} catch (err) {
|
||||
ctx.log.warn('could not record session in ledger', { err: err instanceof Error ? err.message : String(err) })
|
||||
}
|
||||
}
|
||||
return passthrough(ebRes)
|
||||
}
|
||||
|
||||
return notAllowed()
|
||||
})
|
||||
|
||||
export const DELETE = withConnectorAuth('connect.bank', async (request, ctx) => {
|
||||
const scopeError = requireScope(ctx)
|
||||
if (scopeError) return scopeError
|
||||
const path = pathOf(request)
|
||||
const sessionMatch = /^\/sessions\/([^/]+)$/.exec(path)
|
||||
if (!sessionMatch) return notAllowed()
|
||||
const sessionId = decodeURIComponent(sessionMatch[1])
|
||||
const owned = await findByHandle(ctx.supabase, { keyId: ctx.key.id, service: 'bank', handle: sessionId })
|
||||
if (!owned) return notOwned()
|
||||
const blocked = await budgetOr429(ctx)
|
||||
if (blocked) return blocked
|
||||
const res = await forwardToEb('DELETE', `/sessions/${encodeURIComponent(sessionId)}`)
|
||||
// Revoke the ledger row only when the upstream delete actually took (or the
|
||||
// session is already gone upstream): revoking on a transient EB error would
|
||||
// leave the remote session alive but permanently unreachable via the proxy.
|
||||
if (res.ok || res.status === 404) {
|
||||
await revokeByHandle(ctx.supabase, { keyId: ctx.key.id, service: 'bank', handle: sessionId })
|
||||
}
|
||||
return passthrough(res)
|
||||
})
|
||||
|
||||
function isOnInstance(url: string, instanceUrl: string | null): boolean {
|
||||
if (!instanceUrl) return false
|
||||
try {
|
||||
return new URL(url).origin === new URL(instanceUrl).origin
|
||||
} catch {
|
||||
return false
|
||||
}
|
||||
}
|
||||
function notAllowed(): NextResponse {
|
||||
return NextResponse.json({ error: 'Not allowed', code: 'CONNECTOR_PATH_NOT_ALLOWED' }, { status: 403 })
|
||||
}
|
||||
function notOwned(): NextResponse {
|
||||
return NextResponse.json({ error: 'Unknown connection for this key', code: 'CONNECTOR_NOT_OWNED' }, { status: 404 })
|
||||
}
|
||||
function missingCompany(): NextResponse {
|
||||
return NextResponse.json({ error: 'Missing X-Connector-Company header', code: 'CONNECTOR_COMPANY_MISSING' }, { status: 400 })
|
||||
}
|
||||
@@ -16,6 +16,7 @@ import { fanOutSessionRenewal } from '@/extensions/general/enable-banking/lib/se
|
||||
import { supersedeSiblingConnections } from '@/extensions/general/enable-banking/lib/supersede'
|
||||
import { getBankConnectionErrorMessage } from '@/lib/errors/get-error-message'
|
||||
import { renderFinalizeShell, renderFinalizeRedirect } from './finalize-page'
|
||||
import { isConnectorState, verifyConnectorState } from '@/lib/connect/hosted/state'
|
||||
|
||||
// This route emits bank_connection.consent_granted / .cash_account_mirror_failed
|
||||
// (ASVS V16 / GDPR Art.30 audit events). ensureInitialized() must run at module
|
||||
@@ -82,6 +83,28 @@ export async function GET(request: Request) {
|
||||
|
||||
const baseUrl = process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
|
||||
|
||||
// Connector branch: a self-hosted instance started this authorization through
|
||||
// the /api/connect/bank proxy, which replaced the upstream state with a
|
||||
// signed connector state carrying the instance's own return URL. We never
|
||||
// create a session here (the instance does, through the proxy): we just
|
||||
// bounce the browser back to the instance with the code + its original
|
||||
// state, so no per-instance redirect URI has to be registered with EB.
|
||||
if (isConnectorState(state)) {
|
||||
const verified = verifyConnectorState(state as string)
|
||||
if (!verified.ok || verified.payload.svc !== 'bank') {
|
||||
return NextResponse.redirect(`${baseUrl}/?connector_error=${encodeURIComponent(verified.ok ? 'wrong_service' : verified.reason)}`)
|
||||
}
|
||||
const ret = new URL(verified.payload.ret)
|
||||
if (error) ret.searchParams.set('error', error)
|
||||
if (errorDescription) ret.searchParams.set('error_description', errorDescription)
|
||||
if (code) ret.searchParams.set('code', code)
|
||||
if (verified.payload.st) ret.searchParams.set('state', verified.payload.st)
|
||||
// Echo the signed connector state so the instance can present it back to
|
||||
// the proxy's POST /sessions (which finds the pending ledger row by it).
|
||||
ret.searchParams.set('connector_state', state as string)
|
||||
return NextResponse.redirect(ret.toString())
|
||||
}
|
||||
|
||||
if (error) {
|
||||
// Swedish user-facing message carrying the underlying provider error; the
|
||||
// raw code/description stays in the log lines and the audit event below.
|
||||
|
||||
Reference in New Issue
Block a user