js-auth-header-relay-federation

Answer

Root cause. The edge terminates the client's Authorization and re-presents Authorization: Bearer <FEDERATION_TOKEN> with the real key moved to X-9r-Client-Authorization. Central's extractApiKey() (in both the SSE handler path and the dashboard middleware) read only Authorization, so the federation token was looked up as the client key → 401 Invalid API key on every authenticated /v1 request through the edge.

The fix. One shared helper, getRelayedClientApiKey(), wired into both central auth layers.

src/shared/auth/relay.js:

'use strict';
const crypto = require('node:crypto');

const FEDERATION_HEADER = 'x-9r-client-authorization';

// Constant-time compare: SHA-256 both sides so lengths are normalized —
// no length early-exit, no timing channel on size.
function safeEqual(a, b) {
  const ha = crypto.createHash('sha256').update(String(a)).digest();
  const hb = crypto.createHash('sha256').update(String(b)).digest();
  return crypto.timingSafeEqual(ha, hb);
}

// null when this deployment is standalone (no federation configured).
function getToken() {
  const t = process.env.FEDERATION_TOKEN;
  return t && t.length > 0 ? t : null;
}

function stripBearer(value) {
  const v = String(value == null ? '' : value).trim();
  if (v.length === 0) return null;
  const m = /^Bearer\s+(.+)$/i.exec(v);
  return m ? m[1].trim() : v;
}

function getRelayedClientApiKey(req) {
  const authorization = stripBearer(req.headers['authorization']);
  const token = getToken();

  // Standalone zero-drift: no federation token configured => relay is never
  // honored; Authorization is always the client's own key.
  if (!token) return authorization;

  // Federated: honor the relay ONLY when Authorization IS the federation token.
  if (authorization !== null && safeEqual(authorization, token)) {
    return stripBearer(req.headers[FEDERATION_HEADER]);
  }

  // Direct call to central: Authorization is the client's own key.
  return authorization;
}

module.exports = { getRelayedClientApiKey, getToken, safeEqual, FEDERATION_HEADER };

Wiring — layer 1, src/central/sse/services/auth.js (handler path):

const { getRelayedClientApiKey } = require('../../../shared/auth/relay');

function extractApiKey(req) {
  return getRelayedClientApiKey(req);          // was: req.headers.authorization only
}

async function authenticate(req) {
  const key = extractApiKey(req);
  if (!key)  return { ok: false, error: httpError(401, 'Missing API key') };
  const client = lookupClientByKey(key);
  if (!client) return { ok: false, error: httpError(401, 'Invalid API key') };
  return { ok: true, client, apiKey: key };
}

Wiring — layer 2, src/central/dashboardGuard.js (middleware path):

const { getRelayedClientApiKey } = require('../shared/auth/relay');
const { isValidClientKey } = require('./db');

function extractApiKey(req) {
  return getRelayedClientApiKey(req);          // same helper, same rule
}

function dashboardGuard(req, res, next) {
  const key = extractApiKey(req);
  if (!key)          { res.writeHead(401); res.end('Missing API key'); return; }
  if (!isValidClientKey(key)) { res.writeHead(401); res.end('Invalid API key'); return; }
  req.clientApiKey = key;
  next();
}

The edge contract is unchanged — it already relays correctly (src/edge/proxy.js):

headers: {
  ...clientReq.headers,
  authorization: `Bearer ${federationToken}`,
  'x-9r-client-authorization': clientReq.headers['authorization'],
}