mirror of
https://github.com/hanzoai/chat.git
synced 2026-09-30 20:51:17 +00:00
zooqueen
3c15370f7d
Chat was minting its own credentials on top of an identity IAM had already established: the browser ran the PKCE flow, posted the resulting IAM token to a bridge, and got back a Chat JWT, a refresh cookie and a Session row. Everything after login was authenticated by that second credential, and IAM's was filed away server-side for calls to cloud. The token IAM issues is now the only one. It rides every request as the bearer, is verified against IAM's JWKS on the spot, and is not stored — so there is one credential, and the principal that authenticates here is by construction the principal cloud bills. `resolveTenantBearer` loses the machinery that existed to keep a stored copy honest (principal binding, expiry checks, cookie fallback, the renewal middleware in front of the completion route); a token that IS the request cannot name a different user or outlive the request it arrived on. The audience is now checked. One issuer serves every Hanzo relying party, so a token addressed to another app would otherwise authenticate here on the strength of a shared signature. Removed, because IAM owns them: two-factor enrolment and verification, email verification, password reset, the admin panel's OAuth code exchange, and the server-initiated OpenID redirect. Sign-out now ends the session where it lives — revoking both tokens at the issuer — rather than dropping the local copy and leaving the browser recognised. A guest holds nothing at all. Anonymous chat used to mint a signed guest token, which proved nothing: minting was unauthenticated and the free-message quota keyed on the client address regardless. A request without a bearer is now the guest, identified by that same address, hashed so it stays out of job metadata and logs.
34 lines
1.5 KiB
JavaScript
34 lines
1.5 KiB
JavaScript
const removePorts = require('./removePorts');
|
|
|
|
/**
|
|
* Resolves the real client IP for per-IP guest rate limiting.
|
|
*
|
|
* hanzo.chat is served behind Cloudflare → the DO LB → the ingress. With that
|
|
* many hops, Express `req.ip` (via `trust proxy`) is not reliably the visitor's
|
|
* address, which would let anonymous users share/reset their free-message bucket
|
|
* (or collapse everyone into one bucket). Cloudflare always sets
|
|
* `CF-Connecting-IP` to the true originating client and — unlike a
|
|
* client-supplied `X-Forwarded-For` entry — a browser cannot forge it through
|
|
* the CF edge. Prefer it; fall back to the trust-proxy-resolved `req.ip` when the
|
|
* request did not transit Cloudflare (e.g. in-cluster/local).
|
|
*
|
|
* The returned string is the SOLE identity an anonymous visitor has — the guest
|
|
* quota keys on it and so does the guest principal — so it must be stable across
|
|
* cookie clears and incognito sessions from the same network origin.
|
|
*
|
|
* @param {import('express').Request} req
|
|
* @returns {string}
|
|
*/
|
|
const guestClientIp = (req) => {
|
|
const cf = req.headers?.['cf-connecting-ip'];
|
|
if (typeof cf === 'string' && cf.trim()) {
|
|
return cf.trim();
|
|
}
|
|
/* Always a string. A request with no address the server can resolve is not an
|
|
error — it is one more anonymous visitor, and they all share this bucket
|
|
rather than crashing the request or each getting a free quota. */
|
|
return removePorts(req) || 'unknown';
|
|
};
|
|
|
|
module.exports = guestClientIp;
|