31:T4cd,challenge_implementation = deploy("challenge_implementation", async (req, res, context) => { res.header("Access-Control-Allow-Origin", "*"); res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept"); // Use a secret Google Service Account Key (JSON) const service_account = JSON.parse(context.secrets["tomlarkworthy_webadmin_service_account_key"]); // Mint a JWT from it, exchange for access_token and signin as a public user const result = await signinWithGoogleServiceAccountKeyJson(service_account); // Generate an unguessable challenge key using Crypto const challenge = jsrsasign.KJUR.crypto.Util.getRandomHexOfNbytes(16); const challangeContext = JSON.parse(req.body); // Record we made a challenge (the admin user is allowlisted to make the write, other users cannot) await firebase.firestore().collection("/services/ownership/challenges").add({ uid: challangeContext.uid, time: firebase.firestore.FieldValue.serverTimestamp(), host: challangeContext.host, challenge: challenge }) // Tell the user the key res.send(challenge); }, { secrets: ["tomlarkworthy_webadmin_service_account_key"], cell: "challenge_implementation" })32:Tabc,validation_implementation = deploy("validation_implementation", async (req, res, context) => { res.header("Access-Control-Allow-Origin", "*"); res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept"); // Use a secret Google Service Account Key (JSON) const service_account = JSON.parse(context.secrets["tomlarkworthy_webadmin_service_account_key"]); // Mint a JWT from it, exchange for access_token and signin as a public user const result = await signinWithGoogleServiceAccountKeyJson(service_account); // The caller supplies the challenge context const responseContext = JSON.parse(req.body); const challenge_response_promise = remoteCellValue(responseContext.notebook, 'challenge_response'); // Lookup a matching challenge record const matches = await firebase.firestore() .collection("/services/ownership/challenges") .where("challenge", '==', responseContext.challenge) .where("host", '==', responseContext.host) .where("uid", '==', responseContext.uid) .orderBy("time", "desc").limit(1).get() if (matches.empty) { res.status(404).send("No matching challenge code found") return; } const match = matches.docs[0].data(); // Check challenge is recent function timestamp2date(timestamp) { const date = new Date(0) date.setUTCSeconds(timestamp.seconds) return date; } const age_millis = new Date() - timestamp2date(match.time) if (age_millis > 60 * 60 * 1000) { // > 1 hour res.status(400).send("Challenge stale") return; } // Check the remote notbook with the challange response is valid for the host const subdomain = responseContext.host.split(".")[0] if (!responseContext.notebook.startsWith(`@${subdomain}/`)) { res.status(400).send(`Notebook ${responseContext.notebook} cannot verify ${responseContext.host}`) } // THE MAIN BIT -- CHECK THE USER WROTE THE CORRECT VALUE IN THE REMOTE NOTEBOOK const challenge_response = await challenge_response_promise if (challenge_response != match.challenge) { res.status(400).send(`Challenge in ${responseContext.notebook} is ${challenge_response} which does not match ${match.challenge}`) } // OK ITS A FACT. Now we can record this in the ownership table await firebase.firestore().collection("/services/ownership/owners").doc(`${subdomain}|${match.uid}`).set({ uid: match.uid, time: firebase.firestore.FieldValue.serverTimestamp(), host: match.host, subdomain: subdomain }) // Tell the user the key res.send(`${match.uid} owns ${match.host} proved in ${responseContext.notebook}`); }, { secrets: ["tomlarkworthy_webadmin_service_account_key"], cell: "validation_implementation" })33:T43e,async function getAccessTokenFromServiceAccount(serviceAccountKey) { // First create a JWT from the credentials const tNow = Math.floor((new Date()).getTime() / 1000); const sHeader = JSON.stringify({alg: 'RS256', typ: 'JWT'}); const sPayload = JSON.stringify({ iss: serviceAccountKey.client_email, scope: "https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/cloud-platform", iat: tNow, exp: tNow + 600, aud: "https://oauth2.googleapis.com/token", }); const JWT = jsrsasign.KJUR.jws.JWS.sign("RS256", sHeader, sPayload, serviceAccountKey.private_key); // Swap JWT for access_token const tokenResponse = await fetch( 'https://oauth2.googleapis.com/token', { method: 'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'}, body: `grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=${JWT}`, } ); if (tokenResponse.status != 200) { throw new Error(await tokenResponse.text()) } return (await tokenResponse.json()).access_token; }34:[] 2f:{"title":"Certify Subdomain Ownership","cells":[{"id":0,"value":"md`\n# Certify Subdomain Ownership \n\nBefore you can set [serverside secrets](https://observablehq.com/@tomlarkworthy/secret-manager) we need to figure out *securely* which _Observable_ domain you own. We implement a challange based protocol inspired by [DNS-01 verification](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge). You prove control of a subdomain by writing a unique code into it.\n\n1. Login to _\"endpointservices\"_ using an identity provider and make note of uid.\n- Fork this notebook into your personal collection. Copy over uid\n- Prove ownership of notebook to endpointservices by writing a challenge code to the notebook **and publishing it**\n- Trigger validation of your challenge response\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":1372,"value":"certified_domains = JSON.stringify(subdomain_certificates.reduce(\n (acc, cert) => {\n if (!acc.includes(cert.subdomain)) acc.push(cert.subdomain)\n return acc\n },\n []\n))","pinned":false,"hidden":false,"mode":"ojs"},{"id":44,"value":"md`## Step 1: Login to Endpointservices\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":55,"value":"viewof user","pinned":false,"hidden":false,"mode":"ojs"},{"id":125,"value":"md`After logging in you have a uid`","pinned":false,"hidden":false,"mode":"ojs"},{"id":121,"value":"endpoint_uid = user.uid","pinned":false,"hidden":false,"mode":"ojs"},{"id":1440,"value":"md`make note of the uid, it will not transfer to the fork`","pinned":false,"hidden":false,"mode":"ojs"},{"id":16,"value":"md`## Step 2: Fork notebook\n\n**${notebook}** can be used to certify the **${location.host.split(\".\")[0]}** subdomain _only_.\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":703,"value":"notebook = html``.href.replace(\"https://observablehq.com/\", \"\")","pinned":false,"hidden":false,"mode":"ojs"},{"id":72,"value":"md`## Step 3: Prove you have write access\nWe want to proove that the uid has write access to an Observable user content subdomain.\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":1444,"value":"viewof uid = html``","pinned":false,"hidden":false,"mode":"ojs"},{"id":781,"value":"md`We wish to prove uid: _${uid}_, has write access to notebook: _${notebook}_ which will demonstrate ownership of **${relation.host}**\n\nWe have generated a challenge code below which you should write into the _challenge_response_ cell below and publish.\n`\n\n","pinned":false,"hidden":false,"mode":"ojs"},{"id":83,"value":"challenge_code = {\n if (uid == \"\") return 'Please paste uid in box first'\n return await (await fetch(\"https://serversidecells-ibyw6dtm4q-ey.a.run.app/notebooks/@tomlarkworthy/subdomain-certification/deployments/challenge_implementation/secrets/tomlarkworthy_webadmin_service_account_key/cells/challenge_implementation\", {\n method: \"POST\",\n body: JSON.stringify(relation)\n })).text()\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":79,"value":"challenge_response = \"2c2d48511f6d08e271900888f5ca4409\" // <-- Write challenge_code here","pinned":true,"hidden":false,"mode":"ojs"},{"id":540,"value":"{\n if (challenge_response != challenge_code) {\n return md`\nTo prove you have write access to **${relation.host}**, please update the cell above with the challenge code\n\nCurrently the cell reads _**${challenge_response}**_ when it should be _${challenge_code}_\n `\n } else {\n // Once challenge code matches we can try to validate\n return md`Great now **publish** the notebook to do an observable action that only an owner could do`\n }\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":772,"value":"md`## Step 4: Trigger validation\n\nEnsure your notebook is **published in your workspace**, the challange code is correct, then click the button below.\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":737,"value":"{\n if (challenge_response != challenge_code) return html`Please make challange_code match challenge_response first.`\n async function validate() {\n const response = await fetch(\"https://serversidecells-ibyw6dtm4q-ey.a.run.app/notebooks/@tomlarkworthy/subdomain-certification/deployments/validation_implementation/secrets/tomlarkworthy_webadmin_service_account_key/cells/validation_implementation\", {\n method: 'POST',\n body: JSON.stringify({\n ...relation,\n challenge: challenge_code,\n notebook\n })\n })\n return response.text();\n }\n \n async function click() {\n const button = document.getElementById(\"validatebutton\");\n button.style.display = \"none\";\n document.getElementById(\"usermessage\").innerHTML = await validate();\n button.style.display = \"block\";\n }\n \n return html`\n
\n
\n
\n
\n \n
\n `\n}\n","pinned":false,"hidden":false,"mode":"ojs"},{"id":1407,"value":"md`# Implementation\nCertification is implementated using [serverside cells](https://observablehq.com/@tomlarkworthy/serverside-cells) containing a [secret](https://observablehq.com/@tomlarkworthy/secret-manager) Google Identity. Its plain Observable code you can inspect for transparency.\n\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":102,"value":"$31","pinned":false,"hidden":false,"mode":"ojs"},{"id":566,"value":"$32","pinned":false,"hidden":false,"mode":"ojs"},{"id":1369,"value":"viewof subdomain_certificates = new DocsView(firebase.firestore().collection(\"/services/ownership/owners\").where(\"uid\", \"==\", user.uid))","pinned":false,"hidden":false,"mode":"ojs"},{"id":84,"value":"relation = ({\n \"uid\": uid, \n \"host\": location.host\n})","pinned":false,"hidden":false,"mode":"ojs"},{"id":582,"value":"import {remoteCellValue} from '@tomlarkworthy/remote-cell-value'","pinned":false,"hidden":false,"mode":"ojs"},{"id":799,"value":"$33","pinned":false,"hidden":false,"mode":"ojs"},{"id":310,"value":"async function signinWithGoogleServiceAccountKeyJson(serviceAccountKey) {\n const access_token = await getAccessTokenFromServiceAccount(serviceAccountKey)\n const credential = firebase.auth.GoogleAuthProvider.credential(null, access_token);\n return await firebase.auth().signInWithCredential(credential)\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":51,"value":"import {viewof user, firebase, DocsView} with {firebaseConfig as firebaseConfig} from '@tomlarkworthy/firebaseui'","pinned":false,"hidden":false,"mode":"ojs"},{"id":58,"value":"firebaseConfig = ({\n apiKey: \"AIzaSyD882c8YEgeYpNkX01fhpUDfioWl_ETQyQ\",\n authDomain: \"endpointservice.firebaseapp.com\",\n databaseURL: \"https://endpointservice.firebaseio.com\",\n projectId: \"endpointservice\",\n storageBucket: \"endpointservice.appspot.com\",\n messagingSenderId: \"1986724398\",\n appId: \"1:1986724398:web:9b8bc33895b45dd2e095bf\",\n uiConfig: { // https://github.com/firebase/firebaseui-web#configuration\n signInOptions: [\"google.com\", \"facebook.com\", \"phone\"],\n },\n});","pinned":false,"hidden":false,"mode":"ojs"},{"id":250,"value":"jsrsasign = require('https://bundle.run/jsrsasign@10.1.4')","pinned":false,"hidden":false,"mode":"ojs"},{"id":1362,"value":"import {deploy} from '@tomlarkworthy/serverside-cells'","pinned":false,"hidden":false,"mode":"ojs"},{"id":475,"value":"import {html} from \"@observablehq/htl\"","pinned":false,"hidden":false,"mode":"ojs"},{"id":860,"value":"import {viewof suite, expect} from '@tomlarkworthy/testing'","pinned":false,"hidden":false,"mode":"ojs"},{"id":1109,"value":"import {encode, decode} from '@mbostock/base64'","pinned":false,"hidden":false,"mode":"ojs"}],"files":"$W34","stdlib":"1","titling":"auto"}