mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-19 13:23:50 +03:00
1b2dd3d282
Merged as part of the owner batch of 2026-09-11. This PR had a live worktree in another session, so it sat outside the main 39. Merged on your explicit call, validated first rather than taken on trust: boarded with the other 10 worktree-held PRs into a consolidated worktree off `release/v3.8.51`. - ESLint over every changed file: no errors - `typecheck:core` clean; `check:dashboard-typecheck` OK; `check:changelog-integrity` OK - complexity 2821 / baseline 3218 and cognitive-complexity 1272 / baseline 1437 - 203 of 208 assertions green. The 5 remaining (`guide-settings-route` ×4, `hard-session-lease-bypass-inventory` ×1) reproduce on the pure tip with nothing from this batch applied. - `imageGeneration.ts` rebaselined 3259 → 3293 for #12945's image-only-model guard, landed separately in #13392 so nothing was pushed onto a live branch. ⚠️ base-red inherited: #12732 — provider count 356 vs 358 and `open-sse/utils/stream.ts` 3115 > frozen 3098, both reproducing on the pure tip.
64 lines
2.7 KiB
TypeScript
64 lines
2.7 KiB
TypeScript
/**
|
|
* Shared A2A authentication + caller-owner resolution (GHSA-jcm5-6wpp-wjj8).
|
|
*
|
|
* The JSON-RPC router (/a2a) grew its own authenticate() for GHSA-v54m, but
|
|
* the REST task routes under /api/a2a/tasks/ had no auth call at all. Both
|
|
* surfaces now share this single implementation so they cannot drift again:
|
|
* same REQUIRE_API_KEY posture as /v1, same keyless local-first default, and
|
|
* a stable owner id (hashed API key) used to scope task visibility.
|
|
*/
|
|
|
|
import { createHash, timingSafeEqual } from "crypto";
|
|
import type { NextRequest } from "next/server";
|
|
import { extractApiKey, isValidApiKey } from "@/sse/services/auth";
|
|
import { isDashboardSessionAuthenticated } from "@/shared/utils/apiAuth";
|
|
import { isRequireApiKeyEnabled } from "@/shared/utils/featureFlags";
|
|
|
|
function tokensMatch(provided: string, expected: string): boolean {
|
|
const a = Buffer.from(provided);
|
|
const b = Buffer.from(expected);
|
|
if (a.length !== b.length) return false;
|
|
return timingSafeEqual(a, b);
|
|
}
|
|
|
|
/**
|
|
* Whether the request may use the A2A surface at all. Mirrors the JSON-RPC
|
|
* posture: when a client key is required, demand a valid OmniRoute key;
|
|
* otherwise honor the legacy explicit A2A key; otherwise stay keyless (the
|
|
* same local-first default as /v1).
|
|
*/
|
|
export async function authenticateA2ARequest(req: NextRequest | Request): Promise<boolean> {
|
|
const apiKey = extractApiKey(req as NextRequest);
|
|
if (isRequireApiKeyEnabled()) {
|
|
if (apiKey) return isValidApiKey(apiKey);
|
|
// #12888: mirror clientApiPolicy's dashboard-session fallback so the
|
|
// dashboard's own A2A playground (no Authorization header, session
|
|
// cookie only) is accepted the same way /api/v1/* already accepts it.
|
|
return isDashboardSessionAuthenticated(req);
|
|
}
|
|
|
|
const configuredKey = process.env.OMNIROUTE_API_KEY;
|
|
if (configuredKey) {
|
|
if (apiKey) return tokensMatch(apiKey, configuredKey);
|
|
return isDashboardSessionAuthenticated(req);
|
|
}
|
|
|
|
// No API key required and none configured — allow (keyless local-first).
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Owner id for task scoping (GHSA-jcm5-6wpp-wjj8): a stable hash of the
|
|
* caller's API key, `"dashboard"` for a session-authenticated caller with no
|
|
* API key (#12888 — keeps dashboard-originated tasks scoped consistently
|
|
* instead of falling into the ownerless keyless bucket), or `undefined` when
|
|
* the call carries neither (keyless posture — ownerless tasks stay visible to
|
|
* everyone, by design).
|
|
*/
|
|
export async function resolveA2AOwner(req: NextRequest | Request): Promise<string | undefined> {
|
|
const apiKey = extractApiKey(req as NextRequest);
|
|
if (apiKey) return createHash("sha256").update(apiKey).digest("hex").slice(0, 32);
|
|
if (await isDashboardSessionAuthenticated(req)) return "dashboard";
|
|
return undefined;
|
|
}
|