Add PAT (Personal Access Token) authentication to registry service #42
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Bearer token auth (Authorization: Bearer oba_...) lets CLIs and agents call authenticated endpoints without a browser session. Token management endpoints (create/list/revoke) remain session-cookie-only to prevent token-bootstrap attacks. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…dation - Rate-limit only auth failures, not all token-auth attempts (production breaker) - Case-insensitive, whitespace-tolerant Bearer header parsing - Add Cache-Control: no-store to token create and list responses - Validate scope array entries are strings before checking against allowlist - Add tests for lowercase "bearer" and extra whitespace Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…boundary - Move hashToken into utils/crypto.ts so tokens.ts does not import rate-limiter side-effects from token-auth.ts - Set Cache-Control: no-store at top of POST/GET handlers to cover error responses too - Use <= instead of < for expiry check to reject tokens at exact expiration moment Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- catch block in token-auth now uses fail() so error-spam brute-force gets 429 instead of unlimited 500s - Remove unused beforeEach import in token-auth tests - Add Cache-Control: no-store to DELETE handler for symmetry Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add beforeEach to reset ipCounter so watch-mode reruns don't accumulate IPs past 10.0.0.255 - Check Array.isArray(scopes) before applying nullish default so non-array inputs (string, number) are caught and the type annotation is honest Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Authorization: Bearer oba_...) to the registry-service so CLIs/agents can call authenticated endpoints (keys, agents, profiles) without a browser sessionWhat changed
New files:
infra/neon/migrations/005_api_tokens.sql—api_tokenstable with SHA-256 hash indexsrc/middleware/token-auth.ts— Bearer token middleware that populatesreq.sessiontransparentlysrc/middleware/rate-limit.ts— Reusable in-memory rate limiter factorysrc/routes/tokens.ts— POST (create, 201), GET (list), DELETE (revoke) endpointssrc/utils/crypto.ts—hashTokenutility (isolated from middleware side-effects)vitest.config.ts+ 2 test files (28 tests)Modified files:
src/middleware/session.ts— AddedauthMethod,authTokenId,authScopesto Express.Request; skips cookie parsing when token already authedsrc/routes/auth.ts— Mounts tokens router at/auth/tokenssrc/server.ts— WirestokenAuthMiddlewarebeforesessionMiddlewareDesign decisions
/^Bearer\s+(.+)$/i)oba_header is present, middleware owns the response — no silent fallback to cookiesreq.authScopeswithout needing another migrationCache-Control: no-storeon all token management endpoints (including error paths)Test plan
pnpm buildpassespnpm test— 28/28 tests pass (13 middleware, 15 route)/keys→ list tokens → revoke → verify revoked token fails🤖 Generated with Claude Code