Expose authenticated devices list
This commit is contained in:
@@ -0,0 +1,138 @@
|
||||
import type { AuthContext } from "./auth.js";
|
||||
import type { Env } from "./bindings.js";
|
||||
|
||||
const DEVICE_ID_PATTERN = /^[a-zA-Z0-9._:-]{3,128}$/;
|
||||
const PUBLIC_KEY_PATTERN = /^[a-fA-F0-9]{64,256}$/;
|
||||
const DEVICE_TEXT_PATTERN = /^[^\p{Cc}\p{Cs}]{1,128}$/u;
|
||||
const APPROVAL_STATUS = new Set(["pending", "approved", "revoked"]);
|
||||
|
||||
const DEVICE_LIST_QUERY = `
|
||||
SELECT
|
||||
device_id,
|
||||
public_key,
|
||||
device_name,
|
||||
platform,
|
||||
approval_status,
|
||||
created_at,
|
||||
approved_at,
|
||||
last_active_at,
|
||||
revoked_at
|
||||
FROM user_devices
|
||||
WHERE user_id = ?
|
||||
ORDER BY
|
||||
revoked_at IS NOT NULL,
|
||||
COALESCE(last_active_at, approved_at, created_at) DESC,
|
||||
device_id ASC
|
||||
`;
|
||||
|
||||
export interface DeviceListDocument {
|
||||
version: 1;
|
||||
user_id: string;
|
||||
devices: DeviceDocument[];
|
||||
}
|
||||
|
||||
export interface DeviceDocument {
|
||||
device_id: string;
|
||||
public_key: string;
|
||||
device_name: string;
|
||||
platform: string;
|
||||
approval_status: "pending" | "approved" | "revoked";
|
||||
created_at: number;
|
||||
approved_at: number | null;
|
||||
last_active_at: number | null;
|
||||
revoked_at: number | null;
|
||||
current: boolean;
|
||||
}
|
||||
|
||||
interface DeviceRow {
|
||||
device_id: unknown;
|
||||
public_key: unknown;
|
||||
device_name: unknown;
|
||||
platform: unknown;
|
||||
approval_status: unknown;
|
||||
created_at: unknown;
|
||||
approved_at: unknown;
|
||||
last_active_at: unknown;
|
||||
revoked_at: unknown;
|
||||
}
|
||||
|
||||
export class DeviceSchemaError extends Error {
|
||||
constructor(message: string) {
|
||||
super(message);
|
||||
this.name = "DeviceSchemaError";
|
||||
}
|
||||
}
|
||||
|
||||
export async function deviceListDocument(
|
||||
env: Env,
|
||||
context: AuthContext,
|
||||
): Promise<DeviceListDocument> {
|
||||
const result = await env.ELY_DB.prepare(DEVICE_LIST_QUERY).bind(context.userId).all<DeviceRow>();
|
||||
return {
|
||||
version: 1,
|
||||
user_id: context.userId,
|
||||
devices: result.results.map((row) => deviceDocument(row, context)),
|
||||
};
|
||||
}
|
||||
|
||||
function deviceDocument(row: DeviceRow, context: AuthContext): DeviceDocument {
|
||||
const deviceId = deviceIdValue(row.device_id, "device_id");
|
||||
return {
|
||||
device_id: deviceId,
|
||||
public_key: publicKeyValue(row.public_key),
|
||||
device_name: deviceText(row.device_name, "device_name"),
|
||||
platform: deviceText(row.platform, "platform"),
|
||||
approval_status: approvalStatus(row.approval_status),
|
||||
created_at: timestamp(row.created_at, "created_at"),
|
||||
approved_at: nullableTimestamp(row.approved_at, "approved_at"),
|
||||
last_active_at: nullableTimestamp(row.last_active_at, "last_active_at"),
|
||||
revoked_at: nullableTimestamp(row.revoked_at, "revoked_at"),
|
||||
current: context.deviceId === deviceId,
|
||||
};
|
||||
}
|
||||
|
||||
function deviceIdValue(value: unknown, label: string): string {
|
||||
if (typeof value !== "string" || !DEVICE_ID_PATTERN.test(value)) {
|
||||
throw new DeviceSchemaError(`${label}_invalid`);
|
||||
}
|
||||
return value;
|
||||
}
|
||||
|
||||
function publicKeyValue(value: unknown): string {
|
||||
if (typeof value !== "string" || !PUBLIC_KEY_PATTERN.test(value)) {
|
||||
throw new DeviceSchemaError("public_key_invalid");
|
||||
}
|
||||
return value.toLowerCase();
|
||||
}
|
||||
|
||||
function deviceText(value: unknown, label: string): string {
|
||||
if (typeof value !== "string") {
|
||||
throw new DeviceSchemaError(`${label}_invalid`);
|
||||
}
|
||||
const trimmed = value.trim();
|
||||
if (!DEVICE_TEXT_PATTERN.test(trimmed)) {
|
||||
throw new DeviceSchemaError(`${label}_invalid`);
|
||||
}
|
||||
return trimmed;
|
||||
}
|
||||
|
||||
function approvalStatus(value: unknown): DeviceDocument["approval_status"] {
|
||||
if (typeof value !== "string" || !APPROVAL_STATUS.has(value)) {
|
||||
throw new DeviceSchemaError("approval_status_invalid");
|
||||
}
|
||||
return value as DeviceDocument["approval_status"];
|
||||
}
|
||||
|
||||
function nullableTimestamp(value: unknown, label: string): number | null {
|
||||
if (value === null) {
|
||||
return null;
|
||||
}
|
||||
return timestamp(value, label);
|
||||
}
|
||||
|
||||
function timestamp(value: unknown, label: string): number {
|
||||
if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
|
||||
throw new DeviceSchemaError(`${label}_invalid`);
|
||||
}
|
||||
return value;
|
||||
}
|
||||
+16
-1
@@ -1,5 +1,6 @@
|
||||
import type { Env } from "./bindings.js";
|
||||
import { withPublicApiControls } from "./api_controls.js";
|
||||
import { withAuthenticatedApiControls, withPublicApiControls } from "./api_controls.js";
|
||||
import { DeviceSchemaError, deviceListDocument } from "./devices.js";
|
||||
import {
|
||||
PluginRegistrySchemaError,
|
||||
parsePluginRegistryDocument,
|
||||
@@ -32,6 +33,20 @@ export default {
|
||||
|
||||
export async function handleRequest(request: Request, env: Env): Promise<Response> {
|
||||
const url = new URL(request.url);
|
||||
if (url.pathname === "/api/devices") {
|
||||
return withAuthenticatedApiControls(request, env, "devices.list", ["GET"], async (context) => {
|
||||
try {
|
||||
return jsonResponse(await deviceListDocument(env, context), 200, {
|
||||
"Cache-Control": "no-store",
|
||||
});
|
||||
} catch (error) {
|
||||
if (error instanceof DeviceSchemaError) {
|
||||
return jsonResponse({ error: "devices_invalid" }, 500, { "Cache-Control": "no-store" });
|
||||
}
|
||||
throw error;
|
||||
}
|
||||
});
|
||||
}
|
||||
if (url.pathname === "/api/plugins/signing-keys") {
|
||||
return withPublicApiControls(request, env, "plugins.signing_keys", ["GET"], () =>
|
||||
handlePublicSigningKeys(env),
|
||||
|
||||
@@ -0,0 +1,258 @@
|
||||
import assert from "node:assert/strict";
|
||||
import { describe, it } from "node:test";
|
||||
|
||||
import type {
|
||||
ElyAnalyticsDataPoint,
|
||||
ElyD1Database,
|
||||
ElyD1PreparedStatement,
|
||||
ElyR2PutOptions,
|
||||
Env,
|
||||
} from "../src/bindings.js";
|
||||
import { authSessionCacheKvKey, authTokenHash } from "../src/auth.js";
|
||||
import { handleRequest } from "../src/index.js";
|
||||
|
||||
const ACCESS_TOKEN = "D".repeat(48);
|
||||
const PUBLIC_KEY = "a".repeat(64);
|
||||
|
||||
describe("device routes", () => {
|
||||
it("returns authenticated user devices from D1", async () => {
|
||||
const tokenHash = await authTokenHash(ACCESS_TOKEN);
|
||||
const auditEvents: ElyAnalyticsDataPoint[] = [];
|
||||
const d1 = testD1Database([
|
||||
{
|
||||
device_id: "device-01",
|
||||
public_key: PUBLIC_KEY,
|
||||
device_name: "MacBook Pro",
|
||||
platform: "macOS",
|
||||
approval_status: "approved",
|
||||
created_at: 1_780_000_000,
|
||||
approved_at: 1_780_000_010,
|
||||
last_active_at: 1_780_000_020,
|
||||
revoked_at: null,
|
||||
},
|
||||
{
|
||||
device_id: "device-02",
|
||||
public_key: PUBLIC_KEY,
|
||||
device_name: "iMac",
|
||||
platform: "macOS",
|
||||
approval_status: "revoked",
|
||||
created_at: 1_770_000_000,
|
||||
approved_at: 1_770_000_010,
|
||||
last_active_at: 1_770_000_020,
|
||||
revoked_at: 1_770_000_030,
|
||||
},
|
||||
]);
|
||||
|
||||
const response = await handleRequest(
|
||||
new Request("https://elydora.test/api/devices", {
|
||||
headers: { authorization: `Bearer ${ACCESS_TOKEN}`, "cf-ray": "ray-devices" },
|
||||
}),
|
||||
testEnv({
|
||||
auditEvents,
|
||||
d1,
|
||||
kvEntries: [[authSessionCacheKvKey("local", tokenHash), sessionDocument()]],
|
||||
}),
|
||||
);
|
||||
|
||||
assert.equal(response.status, 200);
|
||||
assert.equal(response.headers.get("cache-control"), "no-store");
|
||||
assert.deepEqual(await response.json(), {
|
||||
version: 1,
|
||||
user_id: "user-01",
|
||||
devices: [
|
||||
{
|
||||
device_id: "device-01",
|
||||
public_key: PUBLIC_KEY,
|
||||
device_name: "MacBook Pro",
|
||||
platform: "macOS",
|
||||
approval_status: "approved",
|
||||
created_at: 1_780_000_000,
|
||||
approved_at: 1_780_000_010,
|
||||
last_active_at: 1_780_000_020,
|
||||
revoked_at: null,
|
||||
current: true,
|
||||
},
|
||||
{
|
||||
device_id: "device-02",
|
||||
public_key: PUBLIC_KEY,
|
||||
device_name: "iMac",
|
||||
platform: "macOS",
|
||||
approval_status: "revoked",
|
||||
created_at: 1_770_000_000,
|
||||
approved_at: 1_770_000_010,
|
||||
last_active_at: 1_770_000_020,
|
||||
revoked_at: 1_770_000_030,
|
||||
current: false,
|
||||
},
|
||||
],
|
||||
});
|
||||
assert.deepEqual(d1.binds, [["user-01"]]);
|
||||
assert.ok(d1.queries[0]?.includes("FROM user_devices"));
|
||||
assert.deepEqual(auditEvents[0]?.blobs?.slice(0, 8), [
|
||||
"devices.list",
|
||||
"GET",
|
||||
"/api/devices",
|
||||
"handled",
|
||||
"ray-devices",
|
||||
"",
|
||||
"user-01",
|
||||
"device-01",
|
||||
]);
|
||||
});
|
||||
|
||||
it("rejects unauthenticated device list requests before D1 reads", async () => {
|
||||
const d1 = testD1Database([]);
|
||||
const response = await handleRequest(
|
||||
new Request("https://elydora.test/api/devices"),
|
||||
testEnv({ d1 }),
|
||||
);
|
||||
|
||||
assert.equal(response.status, 401);
|
||||
assert.deepEqual(await response.json(), { error: "authorization_missing" });
|
||||
assert.deepEqual(d1.queries, []);
|
||||
});
|
||||
|
||||
it("rejects unsupported device list methods before session reads", async () => {
|
||||
const d1 = testD1Database([]);
|
||||
const kvReads: string[] = [];
|
||||
const response = await handleRequest(
|
||||
new Request("https://elydora.test/api/devices", { method: "POST" }),
|
||||
testEnv({ d1, kvReads }),
|
||||
);
|
||||
|
||||
assert.equal(response.status, 405);
|
||||
assert.equal(response.headers.get("allow"), "GET");
|
||||
assert.deepEqual(await response.json(), { error: "method_not_allowed" });
|
||||
assert.deepEqual(kvReads, []);
|
||||
assert.deepEqual(d1.queries, []);
|
||||
});
|
||||
|
||||
it("returns a generic server error for malformed D1 device rows", async () => {
|
||||
const tokenHash = await authTokenHash(ACCESS_TOKEN);
|
||||
const response = await handleRequest(
|
||||
new Request("https://elydora.test/api/devices", {
|
||||
headers: { authorization: `Bearer ${ACCESS_TOKEN}` },
|
||||
}),
|
||||
testEnv({
|
||||
d1: testD1Database([
|
||||
{
|
||||
device_id: "device-01",
|
||||
public_key: PUBLIC_KEY,
|
||||
device_name: "MacBook Pro",
|
||||
platform: "macOS",
|
||||
approval_status: "deleted",
|
||||
created_at: 1_780_000_000,
|
||||
approved_at: null,
|
||||
last_active_at: null,
|
||||
revoked_at: null,
|
||||
},
|
||||
]),
|
||||
kvEntries: [[authSessionCacheKvKey("local", tokenHash), sessionDocument()]],
|
||||
}),
|
||||
);
|
||||
|
||||
assert.equal(response.status, 500);
|
||||
assert.deepEqual(await response.json(), { error: "devices_invalid" });
|
||||
});
|
||||
});
|
||||
|
||||
interface TestEnvOptions {
|
||||
auditEvents?: ElyAnalyticsDataPoint[];
|
||||
d1?: RecordedD1Database;
|
||||
kvEntries?: [string, string][];
|
||||
kvReads?: string[];
|
||||
}
|
||||
|
||||
interface RecordedD1Database extends ElyD1Database {
|
||||
binds: unknown[][];
|
||||
queries: string[];
|
||||
}
|
||||
|
||||
function testEnv(options: TestEnvOptions): Env {
|
||||
const values = new Map(options.kvEntries ?? []);
|
||||
return {
|
||||
ELY_ENVIRONMENT: "local",
|
||||
ELY_DB: options.d1 ?? testD1Database([]),
|
||||
ELY_KV: {
|
||||
get(key: string): Promise<string | null> {
|
||||
options.kvReads?.push(key);
|
||||
return Promise.resolve(values.get(key) ?? null);
|
||||
},
|
||||
},
|
||||
ELY_STORAGE: testR2Bucket(),
|
||||
ELY_RATE_LIMITER: {
|
||||
limit(): Promise<{ success: boolean }> {
|
||||
return Promise.resolve({ success: true });
|
||||
},
|
||||
},
|
||||
ELY_API_AUDIT: {
|
||||
writeDataPoint(event?: ElyAnalyticsDataPoint): void {
|
||||
if (event !== undefined) {
|
||||
options.auditEvents?.push(event);
|
||||
}
|
||||
},
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function testD1Database(rows: unknown[]): RecordedD1Database {
|
||||
const binds: unknown[][] = [];
|
||||
const queries: string[] = [];
|
||||
return {
|
||||
binds,
|
||||
queries,
|
||||
prepare(query: string) {
|
||||
queries.push(query);
|
||||
return testD1PreparedStatement(rows, binds);
|
||||
},
|
||||
batch() {
|
||||
return Promise.resolve([]);
|
||||
},
|
||||
exec() {
|
||||
return Promise.resolve({});
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function testD1PreparedStatement(rows: unknown[], binds: unknown[][]): ElyD1PreparedStatement {
|
||||
return {
|
||||
bind(...values: unknown[]) {
|
||||
binds.push(values);
|
||||
return this;
|
||||
},
|
||||
first() {
|
||||
return Promise.resolve(null);
|
||||
},
|
||||
all<T>() {
|
||||
return Promise.resolve({ results: rows as T[] });
|
||||
},
|
||||
run() {
|
||||
return Promise.resolve({});
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function testR2Bucket(): Env["ELY_STORAGE"] {
|
||||
return {
|
||||
get() {
|
||||
return Promise.resolve(null);
|
||||
},
|
||||
put(_key: string, value: ArrayBuffer, _options?: ElyR2PutOptions) {
|
||||
return Promise.resolve({
|
||||
arrayBuffer() {
|
||||
return Promise.resolve(value);
|
||||
},
|
||||
});
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function sessionDocument(): string {
|
||||
return JSON.stringify({
|
||||
version: 1,
|
||||
user_id: "user-01",
|
||||
session_id: "session-01",
|
||||
device_id: "device-01",
|
||||
expires_at: "2099-01-01T00:00:00.000Z",
|
||||
});
|
||||
}
|
||||
Reference in New Issue
Block a user