identity: public origin for claim links, the id_token audience and the cookie behind the proxy

dami committed Aug 27a3dd760

commit: a3dd7603504b1e3ef0180c7da1b40adda3490ac8
parent: f7891dbca13d64fdca15ca90c0fe1c2f510fe897
author: dami <gazey55@gmail.com>

5 files changed, +17 -5wrap lines

M	site/routes/api/keys/link-token.ts	3	++-
M	site/routes/api/logout.ts	3	++-
M	site/routes/api/session.ts	5	++++-
M	site/routes/identity.md.ts	6	+++++-
M	site/routes/identity.tsx	5	++++-

M site/routes/api/keys/link-token.ts +2 -1

@@ -4,6 +4,7 @@
44 import { define } from "../../../utils.ts";55 import { createLink, machineOfBearer } from "../../../lib/identity.ts";66 import { machineRegistry } from "../../../lib/mcp.ts";7+import { publicOrigin } from "../../../lib/prompt.ts";78 89 export const handler = define.handlers({910   async POST(ctx) {@@ -19,7 +20,7 @@ export const handler = define.handlers({
1920         status: 401,2021       });2122     }22-    const link = await createLink(store, m.machine_id, ctx.url.origin);23+    const link = await createLink(store, m.machine_id, publicOrigin());2324     return Response.json({ ...link, machine_id: m.machine_id }, {2425       headers: { "Cache-Control": "no-store" },2526     });

M site/routes/api/logout.ts +2 -1

@@ -1,12 +1,13 @@
11 // POST /api/logout: clear the session cookie.22 import { define } from "../../utils.ts";33 import { sessionCookie } from "../../lib/identity.ts";4+import { publicOrigin } from "../../lib/prompt.ts";45 56 export const handler = define.handlers({67   POST(ctx) {78     return Response.json({ ok: true }, {89       headers: {9-        "Set-Cookie": sessionCookie("", ctx.url.protocol === "https:", 0),10+        "Set-Cookie": sessionCookie("", publicOrigin().startsWith("https:"), 0),1011         "Cache-Control": "no-store",1112       },1213     });

M site/routes/api/session.ts +4 -1

@@ -10,6 +10,7 @@ import {
1010   verifyIdToken,1111 } from "../../lib/identity.ts";1212 import { machineRegistry } from "../../lib/mcp.ts";13+import { publicOrigin } from "../../lib/prompt.ts";1314 1415 export const handler = define.handlers({1516   async POST(ctx) {@@ -23,7 +24,9 @@ export const handler = define.handlers({
2324       return Response.json({ error: "id_token is required" }, { status: 400 });2425     }2526     try {26-      const claims = await verifyIdToken(body.id_token, ctx.url.origin);27+      // the audience is the public origin (behind the proxy the request28+      // itself arrives over http)29+      const claims = await verifyIdToken(body.id_token, publicOrigin());2730       const store = await machineRegistry();2831       const account = store.upsertAccount(claims.sub, claims.name);2932       const exp = Math.floor(Date.now() / 1000) + SESSION_TTL_S;

M site/routes/identity.md.ts +5 -1

@@ -1,10 +1,14 @@
11 // GET /identity.md: the identity spec as plain markdown, for agents.22 import { define } from "../utils.ts";33 import { identitySpec } from "../lib/identity_spec.ts";4+import { publicOrigin } from "../lib/prompt.ts";45 56 export const handler = define.handlers({67   GET(ctx) {7-    return new Response(identitySpec(ctx.url.origin), {8+    const origin = Deno.env.get("MOSAIC_PUBLIC_URL")9+      ? publicOrigin()10+      : ctx.url.origin;11+    return new Response(identitySpec(origin), {812       headers: { "Content-Type": "text/markdown; charset=utf-8" },913     });1014   },

M site/routes/identity.tsx +4 -1

@@ -3,6 +3,7 @@
33 // (node, openssl, python, deno). Plain text at /identity.md.44 import { define } from "../utils.ts";55 import { identitySections } from "../lib/identity_spec.ts";6+import { publicOrigin } from "../lib/prompt.ts";67 78 const CSS = `89 .spec{max-width:820px;margin:0 auto;padding:16px 16px 48px}@@ -14,7 +15,9 @@ const CSS = `
1415 `;1516 1617 export default define.page(function Identity(ctx) {17-  const origin = ctx.url.origin;18+  const origin = Deno.env.get("MOSAIC_PUBLIC_URL")19+    ? publicOrigin()20+    : ctx.url.origin;1821   return (1922     <div class="spec">2023       <style>{CSS}</style>