gilles
08919752e3
Checkpoint multi-chantiers (arbre vert : tsc 0 erreur, 70 tests, build OK). - tâche 1.9 Phase 1 : schéma socle (machine_state/events/reports/raw_artifacts/ hardware/metrics + colonnes étendues) + wiring refresh/execute. Migration 0002. - tâche 1.9 Phase 2 : machine_credentials + machine_host_keys (non destructif, dual-read + backfill). Migration 0003. Fix séquence journal de migration. - tâche 2 : SJ-0 (types étendus rétro-compatibles, réducteur Docker, resolveTemplate), SJ-1 (update-analyze enrichi), SJ-2 (apply + diff dpkg + timeout inactivité SSH), SJ-3 (reboot vérifié boot_id). - WIP parallèle inclus : /api/capabilities, auth/apiTokens/apiClients, system metrics, scaffold app_rust, ajustements frontend. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
35 lines
1.1 KiB
TypeScript
35 lines
1.1 KiB
TypeScript
// server/auth/apiAuth.ts
|
|
import type { MiddlewareHandler } from "hono";
|
|
import type { ApiClientScope, ApiClientView } from "@shared/types.js";
|
|
import { authenticateApiToken, hasApiScope } from "../services/apiClients.js";
|
|
|
|
export interface ApiAuthVariables {
|
|
apiClient: ApiClientView;
|
|
}
|
|
|
|
export function extractBearerToken(authorization: string | null | undefined): string | null {
|
|
if (!authorization) return null;
|
|
const match = /^Bearer\s+(.+)$/i.exec(authorization.trim());
|
|
return match?.[1]?.trim() || null;
|
|
}
|
|
|
|
export function requireApiScope(required: ApiClientScope): MiddlewareHandler<{
|
|
Variables: ApiAuthVariables;
|
|
}> {
|
|
return async (c, next) => {
|
|
const token = extractBearerToken(c.req.header("Authorization"));
|
|
if (!token) return c.json({ error: "Token API manquant" }, 401);
|
|
|
|
const client = authenticateApiToken(token);
|
|
if (!client) return c.json({ error: "Token API invalide ou révoqué" }, 401);
|
|
if (!hasApiScope(client.scopes, required)) {
|
|
return c.json({ error: "Scope API insuffisant" }, 403);
|
|
}
|
|
|
|
c.set("apiClient", client);
|
|
await next();
|
|
};
|
|
}
|
|
|
|
export const apiAuthInternals = { extractBearerToken };
|