54 lines
1.8 KiB
TypeScript
54 lines
1.8 KiB
TypeScript
import {readFileSync} from "node:fs";
|
|
|
|
export type ChatIdentity = {issuer: string; sub: string; username: string; name: string; email: string};
|
|
type HeaderReader = Pick<Headers, "get">;
|
|
|
|
const keyVaultUrl = process.env.KEY_VAULT_URL || "http://ai-gateway:8093";
|
|
const authentikIssuer = process.env.AUTHENTIK_ISSUER || "https://auth.xiteng.site";
|
|
const serviceTokenFile = process.env.KEY_VAULT_TOKEN_FILE || "/run/secrets/portal_gateway_hmac";
|
|
let serviceToken: string | null = null;
|
|
|
|
function loadServiceToken() {
|
|
if (!serviceToken) serviceToken = readFileSync(/* turbopackIgnore: true */ serviceTokenFile, "utf8").trim();
|
|
return serviceToken;
|
|
}
|
|
|
|
export function identityFromHeaders(headers: HeaderReader): ChatIdentity {
|
|
const username = headers.get("x-authentik-username")?.trim() || "";
|
|
const sub = headers.get("x-authentik-uid")?.trim() || "";
|
|
if (!username || !sub) {
|
|
const error = new Error("Authenticated user context is required");
|
|
Object.assign(error, {statusCode: 401});
|
|
throw error;
|
|
}
|
|
return {
|
|
issuer: authentikIssuer,
|
|
sub,
|
|
username,
|
|
name: headers.get("x-authentik-name")?.trim() || username,
|
|
email: headers.get("x-authentik-email")?.trim() || ""
|
|
};
|
|
}
|
|
|
|
export function keyVaultFetch(
|
|
pathname: string,
|
|
identity: ChatIdentity,
|
|
init: {method?: string; body?: string; headers?: HeadersInit} = {}
|
|
) {
|
|
const method = init.method || "GET";
|
|
return fetch(new URL(pathname, keyVaultUrl), {
|
|
method,
|
|
headers: {
|
|
"Accept": "application/json",
|
|
"Authorization": `Bearer ${loadServiceToken()}`,
|
|
...init.headers,
|
|
"X-Key-Vault-Actor-Issuer": identity.issuer,
|
|
"X-Key-Vault-Actor-Sub": identity.sub,
|
|
"X-Key-Vault-Actor-Username": identity.username
|
|
},
|
|
body: init.body,
|
|
cache: "no-store",
|
|
signal: AbortSignal.timeout(300000)
|
|
});
|
|
}
|