Merge pull request #41 from zenstackhq/auth

feat: support Authentication and Authorization for the proxy

Author: jiashengguo

.github/workflows/build-test.yml

@@ -57,3 +57,6 @@ jobs:
         run: |
           pnpm run build
           pnpm tsx scripts/post-build.ts
+          
+      - name: Test
+        run: pnpm test

README.md

@@ -22,7 +22,9 @@ zenstack-proxy [options]
 - `-p, --port <number>` Port number for the server (default: `8008`)
 - `-s, --schema <path>` - Path to ZModel schema file (default: "schema.zmodel")
 - `-d, --datasource-url <url>` Datasource URL (overrides schema configuration)
+- `--studioAuthKey <key>` Authentication key from ZenStack Studio. When set, the proxy will only accept requests signed by your Studio project.
 - `-l, --log <level...>` Query log levels (e.g., query, info, warn, error)
+- `--signature-tolerance-secs <number>` Time tolerance in seconds for signed requests (default: `60`)
 
 ### Examples
 
@@ -46,6 +48,20 @@ zenstack-proxy -s ./schema/schema.zmodel -z ./generated/zenstack
 zenstack-proxy -p 8888
 ```
 
+#### Enable signed requests
+
+```bash
+zenstack-proxy --studioAuthKey "MCowBQYDK2VwAyEAFSJV7wjdFuDz2CqYX7hGnITQvcmJYy7OJQq2Cy2Eiqs="
+```
+
+When `--studioAuthKey` is provided, every incoming request must include an `X-ZenStack-Signature` header in the format `t=<unix timestamp>,v1=<base64url signature>`.
+The signed message format matches ZenStack Studio: `payload + timestamp [+ authorizationToken]`.
+
+- For `GET` and `DELETE` requests, `payload` is the raw query string without the leading `?`.
+- For body-based requests, `payload` is the exact JSON request body string.
+- For requests without query params or a request body, `payload` is an empty string.
+- If an `Authorization: Bearer <token>` header is present, append `<token>` to the signed message.
+
 ## Server Endpoints
 
 The server provides the following endpoints:

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zenstackhq/proxy",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "A CLI tool to run an Express server that proxies CRUD requests to a ZenStack backend",
   "main": "index.js",
   "publishConfig": {
@@ -18,7 +18,8 @@
   },
   "scripts": {
     "clean": "rimraf dist",
-    "build": "pnpm clean && tsc && copyfiles -F \"bin/*\" dist && copyfiles ./README.md ./LICENSE ./package.json dist && pnpm pack dist --pack-destination ../build"
+    "build": "pnpm clean && tsc && copyfiles -F \"bin/*\" dist && copyfiles ./README.md ./LICENSE ./package.json dist && pnpm pack dist --pack-destination ../build",
+    "test": "node --require tsx/cjs --test test/*.test.ts "
   },
   "keywords": [
     "zenstack",
@@ -49,8 +50,10 @@
     "@types/express": "^5.0.0",
     "@types/node": "^20.0.0",
     "@types/semver": "^7.7.1",
+    "@types/supertest": "^6.0.2",
     "copyfiles": "^2.4.1",
     "rimraf": "^4.0.0",
+    "supertest": "^7.0.0",
     "typescript": "^5.0.0"
   },
   "exports": {