File size: 2,031 Bytes
4440aec | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 | // Plugin HTTP route auth helpers decide when gateway auth must protect a plugin route path.
import type { PluginRegistry } from "../../../plugins/registry.js";
import {
isProtectedPluginRoutePathFromContext,
resolvePluginRoutePathContext,
type PluginRoutePathContext,
} from "./path-context.js";
import { findMatchingPluginHttpRoutes } from "./route-match.js";
/**
* Gateway-auth decisions for plugin HTTP routes.
*/
export function matchedPluginRoutesRequireGatewayAuth(
routes: readonly Pick<NonNullable<PluginRegistry["httpRoutes"]>[number], "auth">[],
): boolean {
return routes.some((route) => route.auth === "gateway");
}
/** Returns true when a plugin path must pass gateway auth before routing. */
export function shouldEnforceGatewayAuthForPluginPath(
registry: PluginRegistry,
pathnameOrContext: string | PluginRoutePathContext,
): boolean {
const pathContext =
typeof pathnameOrContext === "string"
? resolvePluginRoutePathContext(pathnameOrContext)
: pathnameOrContext;
if (pathContext.malformedEncoding || pathContext.decodePassLimitReached) {
return true;
}
if (isProtectedPluginRoutePathFromContext(pathContext)) {
return true;
}
return matchedPluginRoutesRequireGatewayAuth(findMatchingPluginHttpRoutes(registry, pathContext));
}
/** Returns true only when an existing route owns authentication entirely inside its plugin. */
export function isPluginAuthenticatedRoutePath(
registry: PluginRegistry,
pathnameOrContext: string | PluginRoutePathContext,
): boolean {
const pathContext =
typeof pathnameOrContext === "string"
? resolvePluginRoutePathContext(pathnameOrContext)
: pathnameOrContext;
if (
pathContext.malformedEncoding ||
pathContext.decodePassLimitReached ||
isProtectedPluginRoutePathFromContext(pathContext)
) {
return false;
}
const matchedRoutes = findMatchingPluginHttpRoutes(registry, pathContext);
return matchedRoutes.length > 0 && matchedRoutes.every((route) => route.auth === "plugin");
}
|