aaronrene / knowtation public
local-auth-oauth-guard.mjs
45 lines 1.5 KB
Raw
sha256:c2dbf04d56308f3bbf2d06e6d2eb022b8948b1e827195fe525a44e5e18d5f9c0 feat(auth): Phase B Connect cloud agent (RFC 8628) + Hermes… Human minor ⚠ breaking 11 days ago
1 /**
2 * Phase 8 P1b-b — OAuth fail-closed guards when offline-locked auth is active (§6.3).
3 */
4
5 import { appendLocalAuthAudit } from './local-auth-audit.mjs';
6 import { requestAuditMeta } from './local-auth-audit.mjs';
7
8 /**
9 * Express middleware: block OAuth routes when offline-locked auth is active.
10 * @param {boolean} offlineLockedActive
11 * @param {string} [dataDir]
12 * @returns {import('express').RequestHandler}
13 */
14 export function oauthDisabledGuard(offlineLockedActive, dataDir = '') {
15 return (req, res, next) => {
16 if (!offlineLockedActive) return next();
17 const { ip } = requestAuditMeta(req);
18 if (dataDir) {
19 appendLocalAuthAudit(dataDir, 'local_auth.oauth_blocked', {
20 route: req.path,
21 ip,
22 ts: new Date().toISOString(),
23 });
24 }
25 return res.status(403).json({
26 error: 'OAuth disabled in offline-locked mode',
27 code: 'OAUTH_DISABLED',
28 });
29 };
30 }
31
32 /**
33 * Log bootstrap instruction once at boot when gate on but not bootstrapped (§2.3).
34 * @param {boolean} offlineLockedActive
35 * @param {boolean} bootstrapped
36 */
37 export function logBootstrapInstructionOnce(offlineLockedActive, bootstrapped) {
38 if (!offlineLockedActive || bootstrapped) return;
39 if (globalThis.__knowtation_offline_locked_bootstrap_logged) return;
40 globalThis.__knowtation_offline_locked_bootstrap_logged = true;
41 console.log(
42 '[hub] KNOWTATION_OFFLINE_LOCKED_AUTH=enabled but no local admin bootstrapped. ' +
43 'Run: node cli/index.mjs auth bootstrap-admin --username admin OR auth generate-setup-token'
44 );
45 }
File History 1 commit
sha256:93bcf8f9bd56d8c5b9339f4ec73b9ebd66571398d56262d38eedc2cfa9db9882 fix(test): align Band B landing assertion with desktop MCP … Human 11 days ago