callerOf

tcmts.cli.sync.callerOf · #qistj4lg · term · runs on the server

uses node:crypto

Who a request's authorization header says it's from, or undefined if it's no one this server knows (a wrong token, or none on a server that isn't public).

import { tokenDigest } from "#codebase/tcmts/cli/sync";
import type { Caller, ServerUser } from "#codebase/tcmts/cli/sync";
import { timingSafeEqual } from "node:crypto";

export function callerOf(
  users: ServerUser[],
  header: string | undefined,
  token: string,
  isPublic: boolean,
): Caller | undefined {
  if (!header) return isPublic ? { role: "reader" } : undefined;
  const got = Buffer.from(header);
  const expected = Buffer.from(`Bearer ${token}`);
  if (got.length === expected.length && timingSafeEqual(got, expected))
    return { role: "maintainer" };
  const bearer = /^Bearer (.+)$/.exec(header)?.[1];
  if (!bearer) return undefined;
  // (a digest of a random token: comparing it gives nothing away)
  const digest = tokenDigest(bearer);
  const user = users.find((u) => u.digest === digest);
  return user ? { role: "contributor", handle: user.handle } : undefined;
}

uses

used by