40 lines
1.7 KiB
JavaScript
40 lines
1.7 KiB
JavaScript
// Trusted Ed25519 public keys for verifying connect links
|
|
// (openwork://connect?token=<JWT>), keyed by the token's `kid` header.
|
|
//
|
|
// These are VERIFICATION keys only — safe to publish. The matching private
|
|
// keys are held by the deployment operator that mints connect links (for
|
|
// OpenWork Cloud: the vendor's secret store) and never enter this repository.
|
|
// Rotation: generate a fresh pair with scripts/generate-connect-link-keypair.mjs,
|
|
// add the new public key here under its kid, ship a release, flip the minting
|
|
// side to the new kid, then drop the old entry in a later release.
|
|
//
|
|
// `owc-dev-2026-07` is the evaluation key used by the demo/eval flows while
|
|
// this feature is dark. Before enabling connect links for production, the
|
|
// vendor mints a production keypair (kid `owc-<yyyy-mm>`) and replaces it.
|
|
|
|
export const VENDOR_CONNECT_LINK_PUBLIC_KEYS = Object.freeze({
|
|
"owc-dev-2026-07": `-----BEGIN PUBLIC KEY-----
|
|
MCowBQYDK2VwAyEA9XFgVZM5y/kpwpsrTWy1glrB2sw+XiUjyntDPrxTTt8=
|
|
-----END PUBLIC KEY-----`,
|
|
});
|
|
|
|
/**
|
|
* The key map the running app trusts. Packaged builds use exactly the
|
|
* embedded vendor keys. Dev mode (OPENWORK_DEV_MODE=1) may add ONE ephemeral
|
|
* test key from the environment so evals and local e2e can mint their own
|
|
* tokens without weakening packaged builds.
|
|
*
|
|
* @returns {Record<string, string>}
|
|
*/
|
|
export function resolveConnectLinkPublicKeys() {
|
|
const keys = { ...VENDOR_CONNECT_LINK_PUBLIC_KEYS };
|
|
if (process.env.OPENWORK_DEV_MODE === "1") {
|
|
const testPem = process.env.OPENWORK_CONNECT_TEST_PUBLIC_KEY_PEM?.trim();
|
|
const testKid = process.env.OPENWORK_CONNECT_TEST_PUBLIC_KEY_KID?.trim();
|
|
if (testPem && testKid) {
|
|
keys[testKid] = testPem;
|
|
}
|
|
}
|
|
return keys;
|
|
}
|