RBAC: send a client_credentials service token to tenant-registry (#21)

src/lib/service-token.ts

@@ -0,0 +1,96 @@
+// Client-credentials service token for portal → tenant-registry calls.
+//
+// tenant-registry's API is INTERNAL_SERVICE_ONLY: once its AUTH_ENABLED
+// flips, every route except /healthz and /readyz needs a Keycloak token
+// whose audience contains `tenant-registry`. The portal is a service
+// principal here — this is machine-to-machine, unrelated to the visitor's
+// SSO session (that one authenticates a human against `dev-portal`).
+//
+// Inert until configured: with no PORTAL_SVC_CLIENT_ID / _SECRET the
+// helper returns null and callers send no Authorization header, which is
+// exactly today's behaviour against a tenant-registry that is not yet
+// enforcing. Configure both to switch the portal over.
+//
+// Server-only: the client secret must never reach the browser. Every
+// caller (src/lib/tenant-registry.ts) already runs server-side.
+
+const REFRESH_MARGIN_SECONDS = 30;
+
+type CachedToken = { value: string; expiresAt: number };
+
+let cached: CachedToken | null = null;
+// de-dupes concurrent fetches: many parallel renders share one request
+let inFlight: Promise<CachedToken> | null = null;
+
+function config(): { issuer: string; clientId: string; secret: string } | null {
+  const clientId = process.env.PORTAL_SVC_CLIENT_ID;
+  const secret = process.env.PORTAL_SVC_CLIENT_SECRET;
+  const issuer = process.env.KEYCLOAK_ISSUER;
+  if (!clientId || !secret || !issuer) return null;
+  return { issuer, clientId, secret };
+}
+
+async function fetchToken(cfg: {
+  issuer: string;
+  clientId: string;
+  secret: string;
+}): Promise<CachedToken> {
+  const res = await fetch(`${cfg.issuer}/protocol/openid-connect/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "client_credentials",
+      client_id: cfg.clientId,
+      client_secret: cfg.secret,
+    }),
+    cache: "no-store",
+  });
+  if (!res.ok) {
+    throw new Error(`service token request failed: ${res.status}`);
+  }
+  const body = (await res.json()) as {
+    access_token?: string;
+    expires_in?: number;
+  };
+  if (!body.access_token) {
+    throw new Error("service token response carried no access_token");
+  }
+  return {
+    value: body.access_token,
+    expiresAt: Date.now() / 1000 + (body.expires_in ?? 300),
+  };
+}
+
+/**
+ * A valid service token, or null when the portal is not configured to
+ * send one. Cached in memory and refreshed shortly before expiry (realm
+ * tokens live 5 minutes).
+ */
+export async function serviceToken(): Promise<string | null> {
+  const cfg = config();
+  if (!cfg) return null;
+
+  const now = Date.now() / 1000;
+  if (cached && now < cached.expiresAt - REFRESH_MARGIN_SECONDS) {
+    return cached.value;
+  }
+  if (!inFlight) {
+    inFlight = fetchToken(cfg).finally(() => {
+      inFlight = null;
+    });
+  }
+  cached = await inFlight;
+  return cached.value;
+}
+
+/** Authorization header for an outbound call, or {} when unconfigured. */
+export async function serviceAuthHeader(): Promise<Record<string, string>> {
+  const token = await serviceToken();
+  return token ? { authorization: `Bearer ${token}` } : {};
+}
+
+/** Test seam: drop the cached token. */
+export function resetServiceTokenCache(): void {
+  cached = null;
+  inFlight = null;
+}