feat(auth): add Bearer service-token path to isAuthorized#13
Merged
Conversation
Sister services (specifically NyTex staff-portal — mints I-9 invites at hire signup, syncs submission status on an hourly cron) can't carry an OAuth user session, so they got 401 Unauthorized on every call after #9 dropped the database-stored ADMIN_SECRET in favor of NextAuth-only auth. staff-portal silently fell back to a local I-9 wizard that wrote to ITS DB only — no submission ever reached this service. New: isAuthorizedService(request) reads SERVICE_TOKEN from env and compares the Bearer header against it with crypto.timingSafeEqual so callers can't infer the token from response timing. isAuthorized() accepts either path — cookie session for human admins on this app's UI, Bearer token for machine callers. When SERVICE_TOKEN is unset, the Bearer path is a no-op — no behavior change vs current state. Set the env var on Railway (open-i9 service) + mirror as I9_SERVICE_TOKEN on staff-portal via cross-service ref to enable the path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
After #9 (Switch admin auth to OAuth) every callsite of `isAuthorized()` now requires a NextAuth cookie + AdminUser allowlist entry. Server-to-server callers can't carry a cookie session, so the NyTex staff-portal has been getting 401 Unauthorized on every `/api/invites`, `/api/submissions`, `/api/documents` call since the ADMIN_SECRET path was removed back in March (#0e8e44d).
End-user impact: every new hire that started I-9 in staff-portal silently fell through to a local-only wizard that wrote to staff-portal's DB and never reached open-i9. No submissions made it to the federal-form service.
What
After merge
Test plan