Update messages and minor fixes

Makefile

@@ -1,4 +1,5 @@
 TEST_FLAGS ?= -p 8 -failfast -race -shuffle on
+GOTOOLCHAIN := $(shell cat go.mod | grep "^go" | tr -d ' ')
 
 all:
 	@echo "make <cmd>:"
@@ -22,11 +23,10 @@ test-coverage-inspect: test-coverage
 	go tool cover -html=coverage.out
 
 generate:
-	go generate -x ./...
+	WEBRPC_SCHEMA_VERSION=$(shell git log -1 --date=format:'v0-%y.%-m.%-d' --format='%ad+%h' ./proto/*.ridl) \
+	GOTOOLCHAIN=$(GOTOOLCHAIN) go generate -x ./...
 
-.PHONY: proto
-proto:
-	go generate -x ./proto/...
+proto: generate
 
 lint:
 	golangci-lint run ./... --fix -c .golangci.yml

go.work.sum

@@ -15,6 +15,7 @@ github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtX
 golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
+golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
 golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=

middleware.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"log/slog"
 	"net/http"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -211,13 +212,11 @@ func Session(cfg Options) func(next http.Handler) http.Handler {
 				}
 
 				if adminClaim {
-					if scopeClaim == "" || scopeClaim == cfg.ServiceName || strings.Contains(scopeClaim, cfg.ServiceName) {
-						// Allow admin if no scope claim is provided or if it matches service name.
-						sessionType = proto.SessionType_Admin
-					} else {
-						// Reduce to public if scope claim does not match.
-						sessionType = proto.SessionType_Public
+					if scopeClaim != "" && !slices.Contains(strings.Split(scopeClaim, ","), cfg.ServiceName) {
+						cfg.ErrHandler(r, w, proto.ErrInvalidScope)
+						return
 					}
+					sessionType = proto.SessionType_Admin
 				}
 			}
 

middleware_test.go

@@ -196,6 +196,7 @@ func TestInvalid(t *testing.T) {
 			AdminAddress: true,
 		},
 		AccessKeyFuncs: []authcontrol.AccessKeyFunc{keyFunc},
+		ServiceName:    ServiceName,
 	}
 
 	r := chi.NewRouter()
@@ -227,7 +228,7 @@ func TestInvalid(t *testing.T) {
 
 	claims := map[string]any{"service": "client_service"}
 
-	// Valid Request
+	// Valid S2S Request
 	ok, err = executeRequest(t, ctx, r, fmt.Sprintf("/rpc/%s/%s", ServiceName, MethodName), accessKey(AccessKey), jwt(authcontrol.S2SToken(JWTSecret, claims)))
 	assert.True(t, ok)
 	assert.NoError(t, err)
@@ -270,6 +271,30 @@ func TestInvalid(t *testing.T) {
 	ok, err = executeRequest(t, ctx, r, fmt.Sprintf("/rpc/%s/%s", ServiceName, MethodNameInvalid), accessKey(AccessKey), jwt(expiredJWT))
 	assert.False(t, ok)
 	assert.ErrorIs(t, err, proto.ErrSessionExpired)
+
+	// Valid Admin Request (no scope claim)
+	claims = map[string]any{"account": AdminAddress, "admin": true}
+	ok, err = executeRequest(t, ctx, r, fmt.Sprintf("/rpc/%s/%s", ServiceName, MethodName), accessKey(AccessKey), jwt(authcontrol.S2SToken(JWTSecret, claims)))
+	assert.True(t, ok)
+	assert.NoError(t, err)
+
+	// Valid Admin Request (with matching scope claim)
+	claims = map[string]any{"account": AdminAddress, "admin": true, "scope": ServiceName}
+	ok, err = executeRequest(t, ctx, r, fmt.Sprintf("/rpc/%s/%s", ServiceName, MethodName), accessKey(AccessKey), jwt(authcontrol.S2SToken(JWTSecret, claims)))
+	assert.True(t, ok)
+	assert.NoError(t, err)
+
+	// Valid Admin Request (with multiple scope claims)
+	claims = map[string]any{"account": AdminAddress, "admin": true, "scope": ServiceName + ",other_service"}
+	ok, err = executeRequest(t, ctx, r, fmt.Sprintf("/rpc/%s/%s", ServiceName, MethodName), accessKey(AccessKey), jwt(authcontrol.S2SToken(JWTSecret, claims)))
+	assert.True(t, ok)
+	assert.NoError(t, err)
+
+	// Invalid Admin Request (with non-matching scope claim)
+	claims = map[string]any{"account": AdminAddress, "admin": true, "scope": "other_service"}
+	ok, err = executeRequest(t, ctx, r, fmt.Sprintf("/rpc/%s/%s", ServiceName, MethodName), accessKey(AccessKey), jwt(authcontrol.S2SToken(JWTSecret, claims)))
+	assert.False(t, ok)
+	assert.ErrorIs(t, err, proto.ErrInvalidScope)
 }
 
 func TestCustomErrHandler(t *testing.T) {

proto/authcontrol.errors.ridl

@@ -1,16 +1,16 @@
 webrpc = v1
 
 name = authcontrol
-version = v0.9.1
-
-error 1000 Unauthorized            "Unauthorized access"                                                 HTTP 401
-error 1001 PermissionDenied        "Permission denied"                                                   HTTP 403
-error 1002 SessionExpired          "Session expired"                                                     HTTP 403
-error 1003 MethodNotFound          "Method not found"                                                    HTTP 404
-error 1004 RequestConflict         "Conflict with target resource"                                       HTTP 409
-error 1005 Aborted                 "Request aborted"                                                     HTTP 400
-error 1006 Geoblocked              "Geoblocked region"                                                   HTTP 451
-error 1007 RateLimited             "Rate-limited. Please slow down."                                     HTTP 429
-error 1008 ProjectNotFound         "Project not found"                                                   HTTP 401
-error 1009 SecretKeyCorsDisallowed "CORS disallowed. Admin API Secret Key can't be used from a web app." HTTP 403
+version = v0.4.12
 
+error 1000 Unauthorized            "Unauthorized access"                                                                                                                HTTP 401
+error 1001 PermissionDenied        "Permission denied"                                                                                                                  HTTP 403
+error 1002 SessionExpired          "Session expired"                                                                                                                    HTTP 403
+error 1003 MethodNotFound          "Method not found"                                                                                                                   HTTP 404
+error 1004 RequestConflict         "Conflict with target resource"                                                                                                      HTTP 409
+error 1005 Aborted                 "Request aborted"                                                                                                                    HTTP 400
+error 1006 Geoblocked              "Geoblocked region"                                                                                                                  HTTP 451
+error 1007 RateLimited             "Rate limit exceeded. Configure an Access Key to increase your limits: https://dashboard.trails.build or https://sequence.build"     HTTP 429
+error 1008 ProjectNotFound         "Project not found"                                                                                                                  HTTP 401
+error 1009 SecretKeyCorsDisallowed "CORS disallowed. Admin API Secret Key can't be used from a web app."                                                                HTTP 403
+error 1010 InvalidScope            "Scope not allowed"                                                                                                                  HTTP 403

proto/authcontrol.gen.ts

@@ -1,5 +1,5 @@
 /* eslint-disable */
-// authcontrol v0.9.1 efc70751a8d3d04b62886c568ebe71265a4e3d5b
+// authcontrol v0.9.1 e2f897586406dc5bbb7662e9f3b3588339777911
 // --
 // Code generated by webrpc-gen@v0.22.1 with typescript generator. DO NOT EDIT.
 //
@@ -16,7 +16,7 @@ export const WebRPCVersion = "v1"
 export const WebRPCSchemaVersion = "v0.9.1"
 
 // Schema hash generated from your RIDL schema
-export const WebRPCSchemaHash = "efc70751a8d3d04b62886c568ebe71265a4e3d5b"
+export const WebRPCSchemaHash = "e2f897586406dc5bbb7662e9f3b3588339777911"
 
 type WebrpcGenVersions = {
   webrpcGenVersion: string;
@@ -391,7 +391,7 @@ export class RateLimitedError extends WebrpcError {
   constructor(
     name: string = 'RateLimited',
     code: number = 1007,
-    message: string = `Rate-limited. Please slow down.`,
+    message: string = `Rate limit exceeded. Configure an Access Key to increase your limits: https://dashboard.trails.build or https://sequence.build`,
     status: number = 0,
     cause?: string
   ) {
@@ -426,6 +426,19 @@ export class SecretKeyCorsDisallowedError extends WebrpcError {
   }
 }
 
+export class InvalidScopeError extends WebrpcError {
+  constructor(
+    name: string = 'InvalidScope',
+    code: number = 1010,
+    message: string = `Scope not allowed`,
+    status: number = 0,
+    cause?: string
+  ) {
+    super(name, code, message, status, cause)
+    Object.setPrototypeOf(this, InvalidScopeError.prototype)
+  }
+}
+
 
 export enum errors {
   WebrpcEndpoint = 'WebrpcEndpoint',
@@ -449,6 +462,7 @@ export enum errors {
   RateLimited = 'RateLimited',
   ProjectNotFound = 'ProjectNotFound',
   SecretKeyCorsDisallowed = 'SecretKeyCorsDisallowed',
+  InvalidScope = 'InvalidScope',
 }
 
 export enum WebrpcErrorCodes {
@@ -473,6 +487,7 @@ export enum WebrpcErrorCodes {
   RateLimited = 1007,
   ProjectNotFound = 1008,
   SecretKeyCorsDisallowed = 1009,
+  InvalidScope = 1010,
 }
 
 export const webrpcErrorByCode: { [code: number]: any } = {
@@ -497,6 +512,7 @@ export const webrpcErrorByCode: { [code: number]: any } = {
   [1007]: RateLimitedError,
   [1008]: ProjectNotFoundError,
   [1009]: SecretKeyCorsDisallowedError,
+  [1010]: InvalidScopeError,
 }
 
 export type Fetch = (input: RequestInfo, init?: RequestInit) => Promise<Response>