devsam/core2026
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): atomically exchange gateway tokens

Browse Source
This commit is contained in:
Hide_D
2026-07-31 18:00:07 +00:00
parent 2596c47fc5
commit c29b40ba5a
4 changed files with 112 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/game-api/src/auth/accessTokenStore.ts
+36 -9
View File
@@ -7,6 +7,7 @@ interface RedisClientLike {
get(key: string): Promise<string | null>;
set(key: string, value: string, options?: { EX?: number; NX?: boolean }): Promise<string | null>;
del?(key: string): Promise<number>;
eval?(script: string, options: { keys: string[]; arguments: string[] }): Promise<unknown>;
}
const ACCESS_TOKEN_PREFIX = 'ga_';
@@ -16,6 +17,15 @@ const buildAccessKey = (profileName: string, token: string): string => `sammo:ga
const buildGatewayUsedKey = (profileName: string, sessionId: string): string =>
`sammo:game:gateway-used:${profileName}:${sessionId}`;
const ISSUE_FROM_GATEWAY_SCRIPT = `
if redis.call('EXISTS', KEYS[1]) == 1 then
return 0
end
redis.call('SET', KEYS[2], ARGV[1], 'EX', ARGV[2])
redis.call('SET', KEYS[1], '1', 'EX', ARGV[2])
return 1
`;
const resolveTtlSeconds = (expiresAt: string): number => {
const parsed = parseISO(expiresAt);
if (!isValid(parsed)) {
@@ -49,6 +59,32 @@ export class RedisAccessTokenStore {
return { accessToken, expiresAt: payload.expiresAt };
}
async issueFromGateway(
payload: GameSessionTokenPayload
): Promise<{ accessToken: string; expiresAt: string } | null | 'ALREADY_USED'> {
const ttlSeconds = resolveTtlSeconds(payload.expiresAt);
if (ttlSeconds <= 0) {
return null;
}
if (!this.client.eval) {
throw new Error('Redis client does not support atomic gateway token exchange.');
}
const accessToken = `${ACCESS_TOKEN_PREFIX}${randomUUID()}`;
const accessKey = buildAccessKey(this.profileName, accessToken);
const usedKey = buildGatewayUsedKey(this.profileName, payload.sessionId);
const result = await this.client.eval(ISSUE_FROM_GATEWAY_SCRIPT, {
keys: [usedKey, accessKey],
arguments: [JSON.stringify(payload), String(ttlSeconds)],
});
if (Number(result) === 0) {
return 'ALREADY_USED';
}
if (Number(result) !== 1) {
throw new Error('Unexpected Redis result while issuing an access token.');
}
return { accessToken, expiresAt: payload.expiresAt };
}
async get(accessToken: string): Promise<GameSessionTokenPayload | null> {
if (!RedisAccessTokenStore.isAccessToken(accessToken)) {
return null;
@@ -83,13 +119,4 @@ export class RedisAccessTokenStore {
const key = buildAccessKey(this.profileName, accessToken);
return (await this.client.del(key)) > 0;
}
async markGatewayTokenUsed(sessionId: string, ttlSeconds: number): Promise<boolean> {
if (ttlSeconds <= 0) {
return false;
}
const key = buildGatewayUsedKey(this.profileName, sessionId);
const result = await this.client.set(key, '1', { NX: true, EX: ttlSeconds });
return result === 'OK';
}
}
app/game-api/src/router/auth/index.ts
+2 -4
View File
@@ -87,15 +87,13 @@ export const authRouter = router({
await enqueueProfileIconResetForUser(ctx, payload.user.id, payload.user.profileIconResetAt);
}
const used = await ctx.accessTokenStore.markGatewayTokenUsed(payload.sessionId, ttlSeconds);
if (!used) {
const created = await ctx.accessTokenStore.issueFromGateway(payload);
if (created === 'ALREADY_USED') {
throw new TRPCError({
code: 'CONFLICT',
message: 'Gateway token already used.',
});
}
const created = await ctx.accessTokenStore.create(payload);
if (!created) {
throw new TRPCError({
code: 'INTERNAL_SERVER_ERROR',
app/game-api/test/accessTokenStore.test.ts
+68
View File
@@ -1,5 +1,7 @@
import { describe, expect, it, vi } from 'vitest';
import type { GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken';
import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js';
describe('RedisAccessTokenStore.revoke', () => {
@@ -33,3 +35,69 @@ describe('RedisAccessTokenStore.revoke', () => {
expect(del).not.toHaveBeenCalled();
});
});
describe('RedisAccessTokenStore.issueFromGateway', () => {
const payload = {
sessionId: 'gateway-session-1',
profile: 'che:default',
issuedAt: '2099-01-01T00:00:00.000Z',
expiresAt: '2099-01-01T01:00:00.000Z',
user: { id: 'user-1', username: 'tester' },
roles: [],
sanctions: [],
} as unknown as GameSessionTokenPayload;
it('issues the access key and consumes the gateway token in one Redis evaluation', async () => {
const evalCommand = vi.fn(async (_script: string, _options: { keys: string[]; arguments: string[] }) => 1);
const store = new RedisAccessTokenStore(
{
get: async () => null,
set: async () => null,
eval: evalCommand,
},
'che:default'
);
const issued = await store.issueFromGateway(payload);
expect(issued).toMatchObject({ expiresAt: payload.expiresAt });
expect(issued && issued !== 'ALREADY_USED' ? issued.accessToken : '').toMatch(/^ga_/);
expect(evalCommand).toHaveBeenCalledTimes(1);
expect(evalCommand.mock.calls[0]?.[1].keys[0]).toBe('sammo:game:gateway-used:che:default:gateway-session-1');
expect(evalCommand.mock.calls[0]?.[1].keys[1]).toBe(
`sammo:game:access:che:default:${issued && issued !== 'ALREADY_USED' ? issued.accessToken : ''}`
);
});
it('can retry after an atomic Redis evaluation fails before commit', async () => {
const keys = new Set<string>();
let attempts = 0;
const evalCommand = vi.fn(async (_script: string, options: { keys: string[] }) => {
attempts += 1;
if (attempts === 1) {
throw new Error('injected Redis failure');
}
if (keys.has(options.keys[0] ?? '')) {
return 0;
}
keys.add(options.keys[0] ?? '');
keys.add(options.keys[1] ?? '');
return 1;
});
const store = new RedisAccessTokenStore(
{
get: async () => null,
set: async () => null,
eval: evalCommand,
},
'che:default'
);
await expect(store.issueFromGateway(payload)).rejects.toThrow('injected Redis failure');
expect(keys.size).toBe(0);
await expect(store.issueFromGateway(payload)).resolves.toMatchObject({ expiresAt: payload.expiresAt });
expect([...keys].filter((key) => key.includes(':access:'))).toHaveLength(1);
expect([...keys].filter((key) => key.includes(':gateway-used:'))).toHaveLength(1);
await expect(store.issueFromGateway(payload)).resolves.toBe('ALREADY_USED');
});
});
app/game-api/test/router.test.ts
+6 -8
View File
@@ -309,8 +309,7 @@ describe('appRouter', () => {
throw new Error('ordinary exchange must not read the icon source');
});
const accessTokenStore = {
markGatewayTokenUsed: vi.fn(async () => true),
create: vi.fn(async () => ({
issueFromGateway: vi.fn(async () => ({
accessToken: 'ga_access',
expiresAt: '2099-01-01T01:00:00.000Z',
})),
@@ -342,14 +341,13 @@ describe('appRouter', () => {
const calls: string[] = [];
const revision = '2099-01-01T00:00:00.001Z';
const accessTokenStore = {
markGatewayTokenUsed: vi.fn(async () => {
issueFromGateway: vi.fn(async () => {
calls.push('mark-used');
return true;
return {
accessToken: 'ga_access',
expiresAt: '2099-01-01T01:00:00.000Z',
};
}),
create: vi.fn(async () => ({
accessToken: 'ga_access',
expiresAt: '2099-01-01T01:00:00.000Z',
})),
} as unknown as RedisAccessTokenStore;
const payload = buildAuth();
payload.issuedAt = '2099-01-01T00:00:00.000Z';