feat(auth): add OIDC administration compatibility

Author: jarvis

.env.example

@@ -14,6 +14,13 @@ NUXT_OIDC_REDIRECT_URI=
 NUXT_OIDC_SESSION_SECRET=
 NUXT_OIDC_SESSION_TTL_SECONDS=28800
 
+# Optional OIDC multi-user administration and identity continuity
+# Comma-separated OIDC email claims allowed to run site-wide administration.
+NUXT_SITE_ADMIN_EMAILS=
+# JSON map from a current OIDC subject to prior owner IDs it may continue to access.
+# Example: {"current-subject":["previous-subject"]}
+NUXT_LINK_OWNER_ALIASES=
+
 # Required deployment configuration
 # Workers Build: set in Workers Builds variables.
 # Pages: set in the unified Variables and Secrets.

nuxt.config.ts

@@ -29,6 +29,8 @@ export default defineNuxtConfig({
     oidcSessionSecret: '',
     oidcSessionTtlSeconds: 28_800,
     oidcAllowInsecure: false,
+    siteAdminEmails: '',
+    linkOwnerAliases: '',
     redirectStatusCode: '301',
     linkCacheTtl: 60,
     redirectWithQuery: false,

server/services/link-store/d1.ts

@@ -7,6 +7,7 @@ import { drizzle } from 'drizzle-orm/d1'
 import { createError } from 'h3'
 import { parseURL, stringifyParsedURL } from 'ufo'
 import { links, linkTags, linkTombstones, tags } from '../../database/schema'
+import { getCurrentLinkOwnerId, getCurrentLinkOwnerIds } from '../../utils/link-owner'
 import { getExpiration } from '../../utils/time'
 
 const D1_CURSOR_PREFIX = 'd1:v1:'
@@ -73,7 +74,7 @@ function statusCondition(status: LinkStatus, now = Math.floor(Date.now() / 1000)
 }
 
 function ownerCondition(event: H3Event) {
-  return eq(links.ownerId, getCurrentLinkOwnerId(event))
+  return inArray(links.ownerId, getCurrentLinkOwnerIds(event))
 }
 
 function exactTagCondition(db: ReturnType<typeof getDatabase>, tag: string | undefined) {

server/utils/admin-auth.ts

@@ -2,11 +2,27 @@ import type { H3Event } from 'h3'
 import { createError } from 'h3'
 
 export function assertSiteAdministrator(event: H3Event): void {
-  if (event.context.authMethod === 'site-token' && event.context.userID === 'root')
+  if (isSiteAdministrator(event))
     return
 
   throw createError({
     status: 403,
     statusText: 'Administrator access required',
   })
 }
+
+export function isSiteAdministrator(event: H3Event): boolean {
+  if (event.context.authMethod === 'site-token' && event.context.userID === 'root')
+    return true
+
+  if (event.context.authMethod !== 'oidc-session' || !event.context.userEmail)
+    return false
+
+  const { siteAdminEmails } = useRuntimeConfig(event)
+  const administrators = String(siteAdminEmails)
+    .split(',')
+    .map(email => email.trim().toLowerCase())
+    .filter(Boolean)
+
+  return administrators.includes(event.context.userEmail.trim().toLowerCase())
+}

server/utils/link-owner.ts

@@ -1,12 +1,54 @@
 import type { H3Event } from 'h3'
+import { createError } from 'h3'
 
 export function getCurrentLinkOwnerId(event: H3Event): string {
   const ownerId = event.context.userID
-  if (ownerId)
-    return ownerId
+  if (!ownerId) {
+    throw createError({
+      status: 401,
+      statusText: 'Unauthorized',
+    })
+  }
+  return ownerId
+}
+
+export function getCurrentLinkOwnerIds(event: H3Event): string[] {
+  const ownerId = getCurrentLinkOwnerId(event)
+  const aliases = parseOwnerAliases(configString(event, 'linkOwnerAliases', 'NUXT_LINK_OWNER_ALIASES'))
+  return [...new Set([ownerId, ...(aliases[ownerId] ?? [])])]
+}
+
+function parseOwnerAliases(value: string): Record<string, string[]> {
+  if (!value)
+    return {}
+
+  try {
+    const parsed = JSON.parse(value) as unknown
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+      throw new Error('Owner aliases must be an object')
+
+    return Object.fromEntries(Object.entries(parsed).map(([ownerId, aliases]) => {
+      if (!Array.isArray(aliases) || aliases.some(alias => typeof alias !== 'string' || !alias))
+        throw new Error(`Owner aliases for ${ownerId} must be non-empty strings`)
+      return [ownerId, aliases]
+    }))
+  }
+  catch (cause) {
+    throw createError({
+      status: 500,
+      statusText: 'NUXT_LINK_OWNER_ALIASES is invalid',
+      cause,
+    })
+  }
+}
+
+function configString(event: H3Event, key: string, envKey: string): string {
+  const config = useRuntimeConfig(event) as unknown as Record<string, unknown>
+  const configured = config[key]
+  if (typeof configured === 'string' && configured.trim())
+    return configured.trim()
 
-  throw createError({
-    status: 401,
-    statusText: 'Unauthorized',
-  })
+  const env = event.context.cloudflare?.env as unknown as Record<string, unknown> | undefined
+  const value = env?.[envKey]
+  return typeof value === 'string' ? value.trim() : ''
 }

tests/unit/admin-auth.spec.ts

@@ -1,21 +1,41 @@
 import type { H3Event } from 'h3'
-import { describe, expect, it } from 'vitest'
-import { assertSiteAdministrator } from '../../server/utils/admin-auth'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { assertSiteAdministrator, isSiteAdministrator } from '../../server/utils/admin-auth'
 
 describe('site administrator authorization', () => {
-  it('allows only the root site-token identity', () => {
-    expect(() => assertSiteAdministrator(eventWithIdentity('site-token', 'root'))).not.toThrow()
-    expect(() => assertSiteAdministrator(eventWithIdentity('oidc-session', 'root'))).toThrowError(
+  beforeEach(() => {
+    vi.stubGlobal('useRuntimeConfig', () => ({
+      siteAdminEmails: ' admin@example.com,OWNER@example.com ',
+    }))
+  })
+
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('allows the root site-token identity', () => {
+    expect(isSiteAdministrator(eventWithIdentity('site-token', 'root', 'root@example.com'))).toBe(true)
+    expect(() => assertSiteAdministrator(eventWithIdentity('site-token', 'root', 'root@example.com'))).not.toThrow()
+  })
+
+  it('allows configured OIDC administrators case-insensitively', () => {
+    expect(isSiteAdministrator(eventWithIdentity('oidc-session', 'test-user', 'owner@example.com'))).toBe(true)
+    expect(() => assertSiteAdministrator(eventWithIdentity('oidc-session', 'test-user', 'OWNER@example.com'))).not.toThrow()
+  })
+
+  it('rejects identities outside the administrator allowlist', () => {
+    expect(isSiteAdministrator(eventWithIdentity('oidc-session', 'root', 'user@example.com'))).toBe(false)
+    expect(() => assertSiteAdministrator(eventWithIdentity('oidc-session', 'test-user', 'user@example.com'))).toThrowError(
       expect.objectContaining({ statusCode: 403 }),
     )
-    expect(() => assertSiteAdministrator(eventWithIdentity('oidc-session', 'test-user'))).toThrowError(
+    expect(() => assertSiteAdministrator(eventWithIdentity('access-user', 'test-user', 'admin@example.com'))).toThrowError(
       expect.objectContaining({ statusCode: 403 }),
     )
   })
 })
 
-function eventWithIdentity(authMethod: string, userID: string): H3Event {
+function eventWithIdentity(authMethod: string, userID: string, userEmail: string): H3Event {
   return {
-    context: { authMethod, userID },
+    context: { authMethod, userID, userEmail },
   } as H3Event
 }

tests/unit/link-owner.spec.ts

@@ -0,0 +1,64 @@
+import type { H3Event } from 'h3'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { getCurrentLinkOwnerId, getCurrentLinkOwnerIds } from '../../server/utils/link-owner'
+
+describe('link owner identities', () => {
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('uses the authenticated subject as the canonical owner', () => {
+    vi.stubGlobal('useRuntimeConfig', () => ({ linkOwnerAliases: '' }))
+    const event = eventWithOwner('current-subject')
+
+    expect(getCurrentLinkOwnerId(event)).toBe('current-subject')
+    expect(getCurrentLinkOwnerIds(event)).toEqual(['current-subject'])
+  })
+
+  it('includes configured prior owner IDs without duplicates', () => {
+    vi.stubGlobal('useRuntimeConfig', () => ({
+      linkOwnerAliases: JSON.stringify({
+        'current-subject': ['previous-subject', 'current-subject', 'previous-subject'],
+      }),
+    }))
+
+    expect(getCurrentLinkOwnerIds(eventWithOwner('current-subject'))).toEqual([
+      'current-subject',
+      'previous-subject',
+    ])
+  })
+
+  it('reads aliases from the Worker environment when runtime config is empty', () => {
+    vi.stubGlobal('useRuntimeConfig', () => ({ linkOwnerAliases: '' }))
+    const event = eventWithOwner('current-subject', {
+      NUXT_LINK_OWNER_ALIASES: '{"current-subject":["previous-subject"]}',
+    })
+
+    expect(getCurrentLinkOwnerIds(event)).toEqual(['current-subject', 'previous-subject'])
+  })
+
+  it('fails closed when alias configuration is invalid', () => {
+    vi.stubGlobal('useRuntimeConfig', () => ({ linkOwnerAliases: '{"current-subject":"previous-subject"}' }))
+
+    expect(() => getCurrentLinkOwnerIds(eventWithOwner('current-subject'))).toThrowError(
+      expect.objectContaining({ statusCode: 500 }),
+    )
+  })
+
+  it('requires an authenticated owner', () => {
+    vi.stubGlobal('useRuntimeConfig', () => ({ linkOwnerAliases: '' }))
+
+    expect(() => getCurrentLinkOwnerId(eventWithOwner(''))).toThrowError(
+      expect.objectContaining({ statusCode: 401 }),
+    )
+  })
+})
+
+function eventWithOwner(userID: string, env: Record<string, string> = {}): H3Event {
+  return {
+    context: {
+      userID,
+      cloudflare: { env },
+    },
+  } as H3Event
+}