pike/glyph Public Public: anyone can read this; nobody can change it.

/**

 * Who is asking. The forge signs every request it proxies to the app:

 *

 *   x-forge-identity:  <userId>|<username>|<role>|<expiresMs>

 *   x-forge-signature: base64url(HMAC-SHA256(FORGE_APP_IDENTITY_KEY, that string))

 *

 * `role` is `user` (signed in and allowed to see this app) or `admin`

 * (allowed to write its repository). The forge strips these two headers

 * from whatever a client sends, so a signature that verifies is the only

 * trust there is: no headers, no key, a bad signature or a stamp in the

 * past all mean `anon`. Nothing here reads a cookie.

 */

import { createHmac, timingSafeEqual } from "node:crypto";

export type Who =

  | { role: "anon" }

  | { role: "user" | "admin"; id: string; name: string };

export const ANON: Who = { role: "anon" };

export function who(request: Request, key: string, now = Date.now()): Who {

  const identity = request.headers.get("x-forge-identity");

  const signature = request.headers.get("x-forge-signature");

  if (key === "" || identity === null || signature === null) return ANON;

  if (!same(sign(identity, key), signature)) return ANON;

  const parts = identity.split("|");

  if (parts.length !== 4) return ANON;

  const [id, name, role, expires] = parts as [string, string, string, string];

  if (role !== "user" && role !== "admin") return ANON;

  if (

    id === "" ||

    name === "" ||

    !/^\d+$/.test(expires) ||

    Number(expires) <= now

  )

    return ANON;

  return { role, id, name };

}

/** The signature the forge computes. Exported so a test can be the forge. */

export const sign = (identity: string, key: string): string =>

  createHmac("sha256", key).update(identity).digest("base64url");

const same = (a: string, b: string): boolean => {

  const x = Buffer.from(a);

  const y = Buffer.from(b);

  return x.length === y.length && timingSafeEqual(x, y);

};

/**

 * The person at the terminal. A tty session is started by the forge itself,

 * so its environment is trusted: `FORGE_APP_USER` is the account at the

 * keyboard (empty for a guest), `FORGE_APP_USER_ID` and `FORGE_APP_USER_ROLE`

 * say the rest when the forge knows them.

 */

export function whoAtTty(

  env: Record<string, string | undefined> = process.env,

): Who {

  const name = env.FORGE_APP_USER ?? "";

  if (name === "") return ANON;

  return {

    role: env.FORGE_APP_USER_ROLE === "admin" ? "admin" : "user",

    id: env.FORGE_APP_USER_ID ?? name,

    name,

  };

}