refactor(hosted-access): split HTTP authorization helpers

Author: 777genius

src/features/hosted-access/main/adapters/input/http/HostedAuthHttpController.ts

@@ -1,7 +1,6 @@
 import {
   HOSTED_AUTH_HEADERS,
   HOSTED_AUTH_ROUTES,
-  type HostedAuthStatus,
   type HostedPrincipal,
   parseOidcLoginAttemptId,
   parseOpaqueAuthoritySecret,
@@ -36,8 +35,14 @@ import {
   SESSION_COOKIE,
 } from '../../../../core/domain';
 
+import { projectHostedAuthStatus } from './HostedAuthStatusProjection';
 import { applyHostedCapabilityAdvertisements } from './HostedCapabilityAdvertisement';
+import { setHostedCredentialCookies as setCookies } from './HostedCredentialCookies';
 import { HostedEventStreamRequestFenceRegistry } from './HostedEventStreamRequestFence';
+import {
+  isHostedTeamWorkspaceAuthorized,
+  isHostedTeamWorkspaceEventAuthorized,
+} from './HostedTeamWorkspaceEventAuthorization';
 import {
   captureHostedTeamWorkspaceGrantFence,
   type HostedRequestGrantFence,
@@ -188,41 +193,32 @@ export class HostedAuthHttpController {
     return context !== null && roleAllows(context.principal.role, 'hosted.query');
   }
   async isTeamWorkspaceAuthorized(request: unknown, teamId: TeamId): Promise<boolean> {
-    const context = await this.liveRequestContext(request as HostedHttpRequest);
-    if (!context) return false;
-    return this.workspaceAccess
-      .hasTeamWorkspaceGrant(
-        context.principal.userId,
-        teamId,
-        this.dependencies.resolveTeamWorkspaceId
-      )
-      .catch(() => false);
+    return isHostedTeamWorkspaceAuthorized({
+      request: request as HostedHttpRequest,
+      teamId,
+      workspaceAccess: this.workspaceAccess,
+      ...(this.dependencies.resolveTeamWorkspaceId === undefined
+        ? {}
+        : { resolveTeamWorkspaceId: this.dependencies.resolveTeamWorkspaceId }),
+      liveRequestContext: (candidate) => this.liveRequestContext(candidate),
+    });
   }
   async isTeamWorkspaceEventAuthorized(
     request: unknown,
     teamId: TeamId,
     runtimeWorkspaceId: string
   ): Promise<boolean> {
     const hostedRequest = request as HostedHttpRequest;
-    const context = await this.liveRequestContext(hostedRequest);
-    if (context === null || !roleAllows(context.principal.role, 'hosted.events')) return false;
-    try {
-      const fence = await this.workspaceAccess.captureTeamWorkspaceGrantFence(
-        context.principal.userId,
-        teamId,
-        this.dependencies.resolveTeamWorkspaceId
-      );
-      return (
-        fence !== null &&
-        fence.runtimeWorkspaceId === runtimeWorkspaceId &&
-        (await this.workspaceAccess.revalidateTeamWorkspaceGrantFence(
-          fence,
-          this.dependencies.resolveTeamWorkspaceId
-        ))
-      );
-    } catch {
-      return false;
-    }
+    return isHostedTeamWorkspaceEventAuthorized({
+      request: hostedRequest,
+      teamId,
+      runtimeWorkspaceId,
+      workspaceAccess: this.workspaceAccess,
+      ...(this.dependencies.resolveTeamWorkspaceId === undefined
+        ? {}
+        : { resolveTeamWorkspaceId: this.dependencies.resolveTeamWorkspaceId }),
+      liveRequestContext: (candidate) => this.liveRequestContext(candidate),
+    });
   }
   async isHostedTaskMutationAuthorized(request: unknown, teamId?: TeamId): Promise<boolean> {
     const hostedRequest = request as HostedHttpRequest;
@@ -301,7 +297,7 @@ export class HostedAuthHttpController {
           'auth.personal.pair',
           'success'
         );
-        this.setCredentialCookies(reply, result.value.sessionSecret, result.value.deviceSecret);
+        setCookies(reply, result.value.sessionSecret, result.value.deviceSecret, this.dependencies);
         return this.status(result.value.principal, result.value.csrfToken);
       } catch (error) {
         const storageUnavailable =
@@ -687,10 +683,11 @@ export class HostedAuthHttpController {
           'auth.personal.renew',
           'success'
         );
-        this.setCredentialCookies(
+        setCookies(
           reply,
           result.context.sessionSecret,
-          result.replacementDeviceSecret
+          result.replacementDeviceSecret,
+          this.dependencies
         );
       }
       const context = result.context;
@@ -757,34 +754,14 @@ export class HostedAuthHttpController {
       (fetchSite === undefined || fetchSite === 'same-origin' || fetchSite === 'same-site')
     );
   }
-  private setCredentialCookies(
-    reply: HostedHttpReply,
-    sessionSecret: string,
-    deviceSecret: string
-  ): void {
-    reply.header('set-cookie', [
-      cookie(SESSION_COOKIE, sessionSecret, {
-        maxAge: this.dependencies.sessionMaxAgeSeconds,
-        secure: this.dependencies.secureCookies,
-        sameSite: 'Strict',
-      }),
-      cookie(DEVICE_COOKIE, deviceSecret, {
-        maxAge: this.dependencies.deviceMaxAgeSeconds,
-        secure: this.dependencies.secureCookies,
-        sameSite: 'Strict',
-      }),
-    ]);
-  }
-  private status(principal: HostedPrincipal | null, csrf: string | null): HostedAuthStatus {
-    return Object.freeze({
+  private status(principal: HostedPrincipal | null, csrfToken: string | null) {
+    return projectHostedAuthStatus({
       mode: this.dependencies.mode,
-      authenticated: principal !== null,
       principal,
-      csrfToken: csrf,
+      csrfToken,
       oidcProviderName:
         this.dependencies.oidc === null ? null : this.dependencies.authentication.displayName,
-      deploymentId: (principal && this.dependencies.runtimeIdentity?.deploymentId) ?? null,
-      bootId: (principal && this.dependencies.runtimeIdentity?.bootId) ?? null,
+      runtimeIdentity: this.dependencies.runtimeIdentity,
     });
   }
   private admitOidcLogin(source: string): boolean {

src/features/hosted-access/main/adapters/input/http/HostedAuthStatusProjection.ts

@@ -0,0 +1,19 @@
+import type { HostedAuthMode, HostedAuthStatus, HostedPrincipal } from '../../../../contracts';
+
+export function projectHostedAuthStatus(options: {
+  readonly mode: HostedAuthMode;
+  readonly principal: HostedPrincipal | null;
+  readonly csrfToken: string | null;
+  readonly oidcProviderName: string | null;
+  readonly runtimeIdentity?: { readonly deploymentId: string; readonly bootId: string } | null;
+}): HostedAuthStatus {
+  return Object.freeze({
+    mode: options.mode,
+    authenticated: options.principal !== null,
+    principal: options.principal,
+    csrfToken: options.csrfToken,
+    oidcProviderName: options.oidcProviderName,
+    deploymentId: (options.principal && options.runtimeIdentity?.deploymentId) ?? null,
+    bootId: (options.principal && options.runtimeIdentity?.bootId) ?? null,
+  });
+}

src/features/hosted-access/main/adapters/input/http/HostedCredentialCookies.ts

@@ -0,0 +1,30 @@
+import {
+  cookie,
+  DEVICE_COOKIE,
+  type HostedHttpReply,
+  SESSION_COOKIE,
+} from '../../../../core/domain';
+
+export function setHostedCredentialCookies(
+  reply: HostedHttpReply,
+  sessionSecret: string,
+  deviceSecret: string,
+  options: {
+    readonly sessionMaxAgeSeconds: number;
+    readonly deviceMaxAgeSeconds: number;
+    readonly secureCookies: boolean;
+  }
+): void {
+  reply.header('set-cookie', [
+    cookie(SESSION_COOKIE, sessionSecret, {
+      maxAge: options.sessionMaxAgeSeconds,
+      secure: options.secureCookies,
+      sameSite: 'Strict',
+    }),
+    cookie(DEVICE_COOKIE, deviceSecret, {
+      maxAge: options.deviceMaxAgeSeconds,
+      secure: options.secureCookies,
+      sameSite: 'Strict',
+    }),
+  ]);
+}

src/features/hosted-access/main/adapters/input/http/HostedTeamWorkspaceEventAuthorization.ts

@@ -0,0 +1,55 @@
+import { type HostedHttpRequest, roleAllows } from '../../../../core/domain';
+
+import type {
+  HostedAuthenticationContext,
+  HostedTeamWorkspaceAttribution,
+  HostedWorkspaceAccessService,
+} from '../../../../core/application';
+import type { TeamId } from '@shared/contracts/hosted';
+
+export async function isHostedTeamWorkspaceEventAuthorized(options: {
+  readonly request: HostedHttpRequest;
+  readonly teamId: TeamId;
+  readonly runtimeWorkspaceId: string;
+  readonly workspaceAccess: HostedWorkspaceAccessService;
+  readonly resolveTeamWorkspaceId?: (teamId: TeamId) => Promise<HostedTeamWorkspaceAttribution>;
+  readonly liveRequestContext: (
+    request: HostedHttpRequest
+  ) => Promise<HostedAuthenticationContext | null>;
+}): Promise<boolean> {
+  const context = await options.liveRequestContext(options.request);
+  if (context === null || !roleAllows(context.principal.role, 'hosted.events')) return false;
+  try {
+    const fence = await options.workspaceAccess.captureTeamWorkspaceGrantFence(
+      context.principal.userId,
+      options.teamId,
+      options.resolveTeamWorkspaceId
+    );
+    return (
+      fence !== null &&
+      fence.runtimeWorkspaceId === options.runtimeWorkspaceId &&
+      (await options.workspaceAccess.revalidateTeamWorkspaceGrantFence(
+        fence,
+        options.resolveTeamWorkspaceId
+      ))
+    );
+  } catch {
+    return false;
+  }
+}
+
+export async function isHostedTeamWorkspaceAuthorized(options: {
+  readonly request: HostedHttpRequest;
+  readonly teamId: TeamId;
+  readonly workspaceAccess: HostedWorkspaceAccessService;
+  readonly resolveTeamWorkspaceId?: (teamId: TeamId) => Promise<HostedTeamWorkspaceAttribution>;
+  readonly liveRequestContext: (
+    request: HostedHttpRequest
+  ) => Promise<HostedAuthenticationContext | null>;
+}): Promise<boolean> {
+  const context = await options.liveRequestContext(options.request);
+  if (context === null) return false;
+  return options.workspaceAccess
+    .hasTeamWorkspaceGrant(context.principal.userId, options.teamId, options.resolveTeamWorkspaceId)
+    .catch(() => false);
+}