Mattsson
16164ea14c
* feat(voucher): add create voucher and correct entry previews; update commit methods * feat: add support for pending operations in API key scopes and OAuth client management - Introduced new API key scopes for reading and approving pending operations. - Updated the scope groups to include pending operations. - Added new tools for listing and managing pending operations. - Implemented OAuth client registration and revocation endpoints. - Created a UI panel for managing OAuth clients, including registration and revocation. - Added tests for pending operations tools and OAuth allowlist functionality. - Implemented a database migration for OAuth client registrations with appropriate policies and constraints. * feat: Implement OAuth client registration rate limiting and enhance security measures - Added IP-based rate limiting to the OAuth client registration endpoint to prevent enumeration attacks. - Introduced a service-role client for allowlist lookups, ensuring trust boundaries are maintained. - Updated error responses to be uniform across different types of redirect URI validation failures. - Enhanced tests to reflect changes in OAuth scope handling, ensuring fallback to read-only scopes when no scopes are provided. - Improved handling of high-risk pending operations, requiring explicit confirmation for approvals. - Added audit logging for OAuth client revocations and pending operation approvals/rejections to maintain a security audit trail. - Refactored API key scope management to include default read-only scopes for OAuth-issued keys and added segregation-of-duties checks.
96 lines
2.7 KiB
TypeScript
96 lines
2.7 KiB
TypeScript
import crypto from 'crypto'
|
|
|
|
/**
|
|
* Stateless OAuth auth codes.
|
|
* The auth code is an AES-256-GCM encrypted JSON payload containing
|
|
* the user ID, PKCE code_challenge, and expiry.
|
|
*
|
|
* The API key is NOT embedded — it gets created at token exchange
|
|
* after PKCE verification, preventing orphaned keys.
|
|
*/
|
|
|
|
const ALGORITHM = 'aes-256-gcm'
|
|
const CODE_TTL_MS = 5 * 60 * 1000 // 5 minutes
|
|
|
|
function getEncryptionKey(): Buffer {
|
|
const secret = process.env.SUPABASE_SERVICE_ROLE_KEY
|
|
if (!secret) throw new Error('SUPABASE_SERVICE_ROLE_KEY is required')
|
|
return crypto.createHash('sha256').update(secret).digest()
|
|
}
|
|
|
|
export interface AuthCodePayload {
|
|
userId: string
|
|
codeChallenge: string
|
|
redirectUri: string
|
|
/**
|
|
* Scopes the user consented to grant the resulting API key. Undefined on
|
|
* codes minted before this field was added — the token endpoint falls back
|
|
* to ALL_SCOPES so existing Claude flows are unaffected.
|
|
*/
|
|
scopes?: string[]
|
|
exp: number
|
|
}
|
|
|
|
export function createAuthCode(payload: Omit<AuthCodePayload, 'exp'>): string {
|
|
const data: AuthCodePayload = {
|
|
...payload,
|
|
exp: Date.now() + CODE_TTL_MS,
|
|
}
|
|
|
|
const key = getEncryptionKey()
|
|
const iv = crypto.randomBytes(12)
|
|
const cipher = crypto.createCipheriv(ALGORITHM, key, iv)
|
|
|
|
const json = JSON.stringify(data)
|
|
const encrypted = Buffer.concat([cipher.update(json, 'utf8'), cipher.final()])
|
|
const tag = cipher.getAuthTag()
|
|
|
|
const combined = Buffer.concat([iv, tag, encrypted])
|
|
return combined.toString('base64url')
|
|
}
|
|
|
|
export function decryptAuthCode(code: string): AuthCodePayload | null {
|
|
try {
|
|
const key = getEncryptionKey()
|
|
const combined = Buffer.from(code, 'base64url')
|
|
|
|
const iv = combined.subarray(0, 12)
|
|
const tag = combined.subarray(12, 28)
|
|
const encrypted = combined.subarray(28)
|
|
|
|
const decipher = crypto.createDecipheriv(ALGORITHM, key, iv)
|
|
decipher.setAuthTag(tag)
|
|
|
|
const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()])
|
|
const payload: AuthCodePayload = JSON.parse(decrypted.toString('utf8'))
|
|
|
|
if (Date.now() > payload.exp) return null
|
|
|
|
return payload
|
|
} catch {
|
|
return null
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Verify PKCE: SHA256(code_verifier) must equal the stored code_challenge.
|
|
* Only S256 is supported (plain is insecure and not advertised).
|
|
*/
|
|
export function verifyPkce(
|
|
codeVerifier: string,
|
|
codeChallenge: string
|
|
): boolean {
|
|
const hash = crypto
|
|
.createHash('sha256')
|
|
.update(codeVerifier)
|
|
.digest('base64url')
|
|
return hash === codeChallenge
|
|
}
|
|
|
|
/**
|
|
* Hash an auth code for replay tracking.
|
|
*/
|
|
export function hashAuthCode(code: string): string {
|
|
return crypto.createHash('sha256').update(code).digest('hex')
|
|
}
|