server/x_accel.ts

Fail-loud validation of the X-Accel facts nginx location.

The X-Accel-Redirect serving path's confidentiality depends on the facts nginx location being internal; — only the authz'd handler's redirect (an internal subrequest) may reach it. A *public* facts location would serve any fact's bytes to anyone who guesses the <shard>/<rest> path, bypassing every cell-visibility check. XAccelConfig makes that assertion structural: a consumer can only obtain the redirect prefix by building an XAccelConfig, which runs this check and throws loudly on a missing or non-internal; location — it cannot silently fall closed.

This is a best-effort string check (brace-matched location blocks), the TS twin of the Rust fuz_fact_serving nginx.rs — not a real nginx parser, but it catches the security-critical omission. Distinct from validate_nginx_config (server/validate_nginx.ts), which validates the /api Authorization-strip + security headers and takes no facts-location path.

view source

Declarations
#

5 declarations

create_x_accel_config
#

server/x_accel.ts view source

(redirect_prefix: string, nginx_config: string): { redirect_prefix: string; } & $brand<"XAccelConfig"> import {create_x_accel_config} from '@fuzdev/fuz_app/server/x_accel.js';

Build a validated XAccelConfig, asserting the nginx location serving redirect_prefix is internal;.

The make-impossible-states gate: serving can only emit X-Accel-Redirect into a location proven internal; at boot.

redirect_prefix

the X-Accel redirect prefix (e.g. /_facts/)

type string

nginx_config

the nginx config template string to validate against

type string

returns

{ redirect_prefix: string; } & $brand<"XAccelConfig">

the validated XAccelConfig carrying redirect_prefix

throws

  • `XAccelConfigError` when `nginx_config` has no matching `location` for `redirect_prefix`, or the matching block is not marked `internal;` — either is a public facts location that bypasses every cell-visibility check.

NginxFactsValidation
#

server/x_accel.ts view source

NginxFactsValidation import type {NginxFactsValidation} from '@fuzdev/fuz_app/server/x_accel.js';

Result of the facts-location check.

ok

true when the facts location exists and is internal;.

type boolean

errors

Fatal issues — a missing or non-internal facts location.

type Array<string>

validate_facts_internal_location
#

server/x_accel.ts view source

(config: string, facts_location: string): NginxFactsValidation import {validate_facts_internal_location} from '@fuzdev/fuz_app/server/x_accel.js';

Assert the nginx location serving the X-Accel facts prefix is internal;.

facts_location is the path the X-Accel redirect prefix points at (e.g. /_facts/). Returns a fatal error when no matching location block exists, or when the matching block is not marked internal; — either is a public facts location that bypasses cell visibility.

config

the nginx config template string to check

type string

facts_location

the facts location path the redirect prefix points at

type string

returns

NginxFactsValidation

{ok, errors} — ok is true only when the location exists and is internal;

XAccelConfig
#

server/x_accel.ts view source

$ZodBranded<ZodObject<{ redirect_prefix: ZodString; }, $strict>, "XAccelConfig", "out"> import type {XAccelConfig} from '@fuzdev/fuz_app/server/x_accel.js';

A validated X-Accel redirect configuration — the only handle that enables the X-Accel-Redirect serving path in server/serve_fact_route.ts.

The redirect prefix can be obtained only by passing the nginx config through validate_facts_internal_location (via create_x_accel_config), so X-Accel serving is impossible to enable without proving the facts location is internal; at boot — a public facts location would bypass every cell-visibility check. A Zod-branded type: the brand can't be forged without an explicit cast, so the factory is the only ordinary construction path.

XAccelConfigError
#

server/x_accel.ts view source

import {XAccelConfigError} from '@fuzdev/fuz_app/server/x_accel.js';

A misconfigured X-Accel facts location — a fail-loud boot error thrown by create_x_accel_config.

inheritance

extends: Error

errors

The validator errors that made the location unsafe.

type Array<string>

readonly

constructor

type new (errors: string[]): XAccelConfigError

errors

type string[]

Imported by
#