eve/dist/src/channel/forwarded-principal.js

Filesystem-first framework for durable backend AI agents that run anywhere.

import{z}from"#compiled/zod/index.js";import{createLogger,logError}from"#internal/logging.js";const log=createLogger(`channel.forwarded-principal`),FORWARDED_BY_ATTRIBUTE=`eve:forwarded-by`,attributeValueSchema=z.union([z.string(),z.array(z.string()).readonly()]),forwardedPrincipalContextSchema=z.object({attributes:z.record(z.string(),attributeValueSchema).readonly(),authenticator:z.string().min(1),issuer:z.string().min(1).optional(),principalId:z.string().min(1),principalType:z.string().min(1),subject:z.string().min(1).optional()}).strict(),forwardedPrincipalSchema=z.object({current:forwardedPrincipalContextSchema,initiator:forwardedPrincipalContextSchema.optional()}).strict();async function resolveForwardedPrincipal(e){let t=e.payload.forwardedPrincipal;if(t===void 0)return{accepted:!1,auth:e.forwarder};if(e.trustedForwarders===void 0)return Response.json({error:`This deployment does not accept a forwarded principal.`,ok:!1},{status:403});let n=parseForwardedPrincipal(t);if(!n.ok)return Response.json({error:n.message,ok:!1},{status:400});let r;try{r=await e.trustedForwarders(e.forwarder)}catch(t){let n=logError(log,`trustedForwarders handler failed`,t,{forwarder:e.forwarder.principalId});return Response.json({error:`trustedForwarders handler failed.`,errorId:n,ok:!1},{status:500})}if(!r)return Response.json({error:`Caller is not authorized to assert a forwarded principal.`,ok:!1},{status:403});let i=stampForwardedBy(n.forwardedPrincipal.current,e.forwarder.principalId);return{accepted:!0,auth:i,initiatorAuth:n.forwardedPrincipal.initiator===void 0?i:stampForwardedBy(n.forwardedPrincipal.initiator,e.forwarder.principalId)}}function parseForwardedPrincipal(e){let t=forwardedPrincipalSchema.safeParse(e);if(t.success){let e=toSessionAuthContext(t.data.current);return{forwardedPrincipal:t.data.initiator===void 0?{current:e}:{current:e,initiator:toSessionAuthContext(t.data.initiator)},ok:!0}}return{cause:t.error,message:formatForwardedPrincipalParseError(t.error),ok:!1}}function stampForwardedBy(e,t){return{...e,attributes:{...e.attributes,[FORWARDED_BY_ATTRIBUTE]:t}}}function toSessionAuthContext(e){let t={attributes:e.attributes,authenticator:e.authenticator,principalId:e.principalId,principalType:e.principalType};return e.issuer!==void 0&&(t.issuer=e.issuer),e.subject!==void 0&&(t.subject=e.subject),t}function formatForwardedPrincipalParseError(e){return`Invalid forwardedPrincipal metadata: ${e.issues.map(e=>`${e.path.length===0?`forwardedPrincipal`:`forwardedPrincipal.${e.path.join(`.`)}`}: ${e.message}`).join(`; `)}`}export{FORWARDED_BY_ATTRIBUTE,parseForwardedPrincipal,resolveForwardedPrincipal,stampForwardedBy};