@agenticprimitives/connect-auth 0.1.0-alpha.3 → 1.0.0-alpha.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/csrf.d.ts +72 -8
- package/dist/csrf.d.ts.map +1 -1
- package/dist/csrf.js +108 -17
- package/dist/csrf.js.map +1 -1
- package/dist/index.d.ts +2 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -2
- package/dist/index.js.map +1 -1
- package/dist/sessions.d.ts +64 -6
- package/dist/sessions.d.ts.map +1 -1
- package/dist/sessions.js +115 -7
- package/dist/sessions.js.map +1 -1
- package/dist/types.d.ts +26 -0
- package/dist/types.d.ts.map +1 -1
- package/package.json +2 -2
package/dist/csrf.d.ts
CHANGED
|
@@ -1,13 +1,77 @@
|
|
|
1
1
|
/**
|
|
2
|
-
*
|
|
2
|
+
* R5.11 — Optional bindings stamped into the CSRF token.
|
|
3
|
+
*
|
|
4
|
+
* `method` HTTP method (POST, PUT, ...) the token is bound to.
|
|
5
|
+
* `path` Request path the token is bound to. Use the URL pathname
|
|
6
|
+
* (not the full URL); query string is excluded.
|
|
7
|
+
* `sessionSid` Session id (typically `JwtClaims.sid` from the session
|
|
8
|
+
* cookie) so a CSRF token is unusable with a different
|
|
9
|
+
* session — defends against an attacker stealing the
|
|
10
|
+
* CSRF token alone.
|
|
11
|
+
*
|
|
12
|
+
* Empty/undefined bindings on both sides match (legacy callers see no
|
|
13
|
+
* behavior change at the wire format level). When mint supplies a
|
|
14
|
+
* binding, verify MUST supply the same value or the token is rejected.
|
|
3
15
|
*/
|
|
4
|
-
export
|
|
16
|
+
export interface CsrfBindings {
|
|
17
|
+
method?: string;
|
|
18
|
+
path?: string;
|
|
19
|
+
sessionSid?: string;
|
|
20
|
+
}
|
|
21
|
+
export interface CsrfMintOpts extends CsrfBindings {
|
|
22
|
+
origin: string;
|
|
23
|
+
}
|
|
24
|
+
export interface CsrfVerifyOpts extends CsrfBindings {
|
|
25
|
+
/**
|
|
26
|
+
* The ACTUAL request origin (from the inbound `Origin` header or the
|
|
27
|
+
* verified `Referer`). The verifier rejects unless
|
|
28
|
+
* `stamp.origin === actualOrigin AND actualOrigin ∈ allowedOrigins`.
|
|
29
|
+
* Pass an empty string only when the caller has explicitly chosen
|
|
30
|
+
* not to bind to the request origin (e.g. a server-to-server
|
|
31
|
+
* verifier in a test); in production that path THROWS unless
|
|
32
|
+
* `developmentMode: true` is set.
|
|
33
|
+
*/
|
|
34
|
+
actualOrigin: string;
|
|
35
|
+
/** Exact-match allowlist of acceptable origins (defense in depth). */
|
|
36
|
+
allowedOrigins: string[];
|
|
37
|
+
/** Opt-out for tests / dev paths that intentionally lack an origin. */
|
|
38
|
+
developmentMode?: boolean;
|
|
39
|
+
}
|
|
5
40
|
/**
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
*
|
|
9
|
-
*
|
|
10
|
-
*
|
|
41
|
+
* Mint a CSRF token bound to the supplied origin (and optionally to a
|
|
42
|
+
* method / path / session id). The HMAC covers all stamped fields, so
|
|
43
|
+
* any field tampering invalidates the token.
|
|
44
|
+
*
|
|
45
|
+
* R5.11 breaking change: the function signature now takes an opts
|
|
46
|
+
* object instead of a single `origin` positional arg. Pass
|
|
47
|
+
* `{ origin }` for the legacy origin-only behavior.
|
|
11
48
|
*/
|
|
12
|
-
export declare function
|
|
49
|
+
export declare function csrfTokenFor(opts: CsrfMintOpts): string;
|
|
50
|
+
/**
|
|
51
|
+
* Verify a CSRF token. R5.11 breaking change: signature is now
|
|
52
|
+
* `verifyCsrf(token, opts: CsrfVerifyOpts)`.
|
|
53
|
+
*
|
|
54
|
+
* 1. HMAC must verify under `CSRF_SECRET`.
|
|
55
|
+
* 2. `stamp.ts` must be within the last `CSRF_VALIDITY_SECONDS` window
|
|
56
|
+
* (with a small skew for future-ts).
|
|
57
|
+
* 3. `stamp.origin === opts.actualOrigin` (R5.11 / P1-2).
|
|
58
|
+
* 4. `opts.actualOrigin ∈ opts.allowedOrigins` (defense in depth).
|
|
59
|
+
* 5. When the mint side stamped a binding, the verify side MUST
|
|
60
|
+
* supply the same value:
|
|
61
|
+
* - `stamp.method === opts.method`
|
|
62
|
+
* - `stamp.path === opts.path`
|
|
63
|
+
* - `stamp.sessionSid === opts.sessionSid`
|
|
64
|
+
* Empty / undefined matches empty / undefined. A token minted
|
|
65
|
+
* WITHOUT bindings cannot be verified WITH bindings (and vice
|
|
66
|
+
* versa) — the comparison is exact.
|
|
67
|
+
*
|
|
68
|
+
* Returns true iff all checks pass.
|
|
69
|
+
*
|
|
70
|
+
* **Production guard:** when `NODE_ENV=production` AND
|
|
71
|
+
* `developmentMode !== true`, the function THROWS if `actualOrigin`
|
|
72
|
+
* is an empty string. A silently-permissive `''` would re-open the
|
|
73
|
+
* audit finding; failing fast keeps production deploys honest. Tests
|
|
74
|
+
* / dev opt out via `developmentMode: true`.
|
|
75
|
+
*/
|
|
76
|
+
export declare function verifyCsrf(token: string, opts: CsrfVerifyOpts): boolean;
|
|
13
77
|
//# sourceMappingURL=csrf.d.ts.map
|
package/dist/csrf.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AA2EA;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAa,SAAQ,YAAY;IAChD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAe,SAAQ,YAAY;IAClD;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uEAAuE;IACvE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAUD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAavD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAkDvE"}
|
package/dist/csrf.js
CHANGED
|
@@ -1,7 +1,31 @@
|
|
|
1
|
-
// CSRF tokens: HMAC-stamped origin +
|
|
2
|
-
//
|
|
3
|
-
//
|
|
4
|
-
//
|
|
1
|
+
// CSRF tokens: HMAC-stamped origin (+ optional method / path / session) +
|
|
2
|
+
// timestamp.
|
|
3
|
+
//
|
|
4
|
+
// R5.11 / PKG-CONNECT-AUTH-004 (external audit P1-2):
|
|
5
|
+
//
|
|
6
|
+
// Pre-R5.11 the verifier only checked the token's SIGNED origin
|
|
7
|
+
// against an allowlist. It never compared to the request's ACTUAL
|
|
8
|
+
// origin — so a token legitimately minted for `https://app.com`
|
|
9
|
+
// (signed, in allowlist) would pass even when the request itself
|
|
10
|
+
// came from `https://evil.com`. The double-submit cookie pattern
|
|
11
|
+
// helps but doesn't bind the verifier to the request origin.
|
|
12
|
+
//
|
|
13
|
+
// Post-R5.11 `verifyCsrf` takes an explicit `actualOrigin` opt and
|
|
14
|
+
// rejects unless `stamp.origin === actualOrigin AND actualOrigin
|
|
15
|
+
// ∈ allowedOrigins`. The actual request origin is the load-bearing
|
|
16
|
+
// check; the allowlist is defense in depth.
|
|
17
|
+
//
|
|
18
|
+
// Additionally, the audit row PKG-CONNECT-AUTH-004 also flagged
|
|
19
|
+
// that a token usable on `POST /transfer` is also usable on
|
|
20
|
+
// `POST /grant-admin` — no method/path/session binding. R5.11 adds
|
|
21
|
+
// optional `method` / `path` / `sessionSid` bindings: both mint
|
|
22
|
+
// and verify must agree on them, and when supplied they're stamped
|
|
23
|
+
// into the HMAC. Empty matches empty so legacy "origin only"
|
|
24
|
+
// callers keep working at the wire level.
|
|
25
|
+
//
|
|
26
|
+
// Token format (unchanged shape; new fields nullable):
|
|
27
|
+
// base64url(JSON.stringify({origin, ts, method?, path?, sessionSid?}))
|
|
28
|
+
// . base64url(hmac)
|
|
5
29
|
import { hmac } from '@noble/hashes/hmac';
|
|
6
30
|
import { sha256 } from '@noble/hashes/sha256';
|
|
7
31
|
import { hexToBytes } from 'viem';
|
|
@@ -36,25 +60,76 @@ function constantTimeEqual(a, b) {
|
|
|
36
60
|
diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
|
|
37
61
|
return diff === 0;
|
|
38
62
|
}
|
|
63
|
+
function isProduction(opts) {
|
|
64
|
+
if (opts?.developmentMode === true)
|
|
65
|
+
return false;
|
|
66
|
+
try {
|
|
67
|
+
return typeof process !== 'undefined' && process.env?.NODE_ENV === 'production';
|
|
68
|
+
}
|
|
69
|
+
catch {
|
|
70
|
+
return false;
|
|
71
|
+
}
|
|
72
|
+
}
|
|
39
73
|
/**
|
|
40
|
-
*
|
|
74
|
+
* Mint a CSRF token bound to the supplied origin (and optionally to a
|
|
75
|
+
* method / path / session id). The HMAC covers all stamped fields, so
|
|
76
|
+
* any field tampering invalidates the token.
|
|
77
|
+
*
|
|
78
|
+
* R5.11 breaking change: the function signature now takes an opts
|
|
79
|
+
* object instead of a single `origin` positional arg. Pass
|
|
80
|
+
* `{ origin }` for the legacy origin-only behavior.
|
|
41
81
|
*/
|
|
42
|
-
export function csrfTokenFor(
|
|
82
|
+
export function csrfTokenFor(opts) {
|
|
43
83
|
const secret = loadCsrfSecret();
|
|
44
84
|
const ts = Math.floor(Date.now() / 1000);
|
|
45
|
-
const stamp =
|
|
46
|
-
|
|
85
|
+
const stamp = { origin: opts.origin, ts };
|
|
86
|
+
// Only include binding fields when supplied — keeps the wire format
|
|
87
|
+
// tight for legacy callers + makes intent visible in audit logs.
|
|
88
|
+
if (opts.method !== undefined)
|
|
89
|
+
stamp.method = opts.method;
|
|
90
|
+
if (opts.path !== undefined)
|
|
91
|
+
stamp.path = opts.path;
|
|
92
|
+
if (opts.sessionSid !== undefined)
|
|
93
|
+
stamp.sessionSid = opts.sessionSid;
|
|
94
|
+
const stampEnc = base64urlEncode(JSON.stringify(stamp));
|
|
47
95
|
const sig = hmac(sha256, secret, new TextEncoder().encode(stampEnc));
|
|
48
96
|
return `${stampEnc}.${base64urlEncode(sig)}`;
|
|
49
97
|
}
|
|
50
98
|
/**
|
|
51
|
-
* Verify a CSRF token.
|
|
52
|
-
*
|
|
53
|
-
*
|
|
54
|
-
*
|
|
55
|
-
*
|
|
99
|
+
* Verify a CSRF token. R5.11 breaking change: signature is now
|
|
100
|
+
* `verifyCsrf(token, opts: CsrfVerifyOpts)`.
|
|
101
|
+
*
|
|
102
|
+
* 1. HMAC must verify under `CSRF_SECRET`.
|
|
103
|
+
* 2. `stamp.ts` must be within the last `CSRF_VALIDITY_SECONDS` window
|
|
104
|
+
* (with a small skew for future-ts).
|
|
105
|
+
* 3. `stamp.origin === opts.actualOrigin` (R5.11 / P1-2).
|
|
106
|
+
* 4. `opts.actualOrigin ∈ opts.allowedOrigins` (defense in depth).
|
|
107
|
+
* 5. When the mint side stamped a binding, the verify side MUST
|
|
108
|
+
* supply the same value:
|
|
109
|
+
* - `stamp.method === opts.method`
|
|
110
|
+
* - `stamp.path === opts.path`
|
|
111
|
+
* - `stamp.sessionSid === opts.sessionSid`
|
|
112
|
+
* Empty / undefined matches empty / undefined. A token minted
|
|
113
|
+
* WITHOUT bindings cannot be verified WITH bindings (and vice
|
|
114
|
+
* versa) — the comparison is exact.
|
|
115
|
+
*
|
|
116
|
+
* Returns true iff all checks pass.
|
|
117
|
+
*
|
|
118
|
+
* **Production guard:** when `NODE_ENV=production` AND
|
|
119
|
+
* `developmentMode !== true`, the function THROWS if `actualOrigin`
|
|
120
|
+
* is an empty string. A silently-permissive `''` would re-open the
|
|
121
|
+
* audit finding; failing fast keeps production deploys honest. Tests
|
|
122
|
+
* / dev opt out via `developmentMode: true`.
|
|
56
123
|
*/
|
|
57
|
-
export function verifyCsrf(token,
|
|
124
|
+
export function verifyCsrf(token, opts) {
|
|
125
|
+
if (isProduction(opts)) {
|
|
126
|
+
if (!opts.actualOrigin || opts.actualOrigin.length === 0) {
|
|
127
|
+
throw new Error('[connect-auth] verifyCsrf requires a non-empty `actualOrigin` in production. ' +
|
|
128
|
+
'Without it the request-origin binding is bypassed, re-opening the R5.11 / P1-2 ' +
|
|
129
|
+
'finding. Pass the inbound `Origin` header (or parsed `Referer`) as ' +
|
|
130
|
+
'opts.actualOrigin; for tests, pass `developmentMode: true`.');
|
|
131
|
+
}
|
|
132
|
+
}
|
|
58
133
|
if (!token)
|
|
59
134
|
return false;
|
|
60
135
|
const parts = token.split('.');
|
|
@@ -70,9 +145,25 @@ export function verifyCsrf(token, allowedOrigins) {
|
|
|
70
145
|
}
|
|
71
146
|
if (typeof stamp.origin !== 'string' || typeof stamp.ts !== 'number')
|
|
72
147
|
return false;
|
|
73
|
-
//
|
|
74
|
-
//
|
|
75
|
-
|
|
148
|
+
// R5.11 / P1-2: bind the verifier to the ACTUAL request origin.
|
|
149
|
+
// The verifier MUST be told the actual origin (we don't reach into
|
|
150
|
+
// an HTTP request here — that's the caller's concern). If actualOrigin
|
|
151
|
+
// is empty / missing, the check rejects (production gate above throws).
|
|
152
|
+
if (!opts.actualOrigin || stamp.origin !== opts.actualOrigin)
|
|
153
|
+
return false;
|
|
154
|
+
// Defense in depth: even when actualOrigin matches, it must be in
|
|
155
|
+
// the operator-curated allowlist. Catches a misconfigured caller
|
|
156
|
+
// that wires the wrong header into `actualOrigin`.
|
|
157
|
+
if (!opts.allowedOrigins.includes(opts.actualOrigin))
|
|
158
|
+
return false;
|
|
159
|
+
// R5.11: method / path / sessionSid bindings. Empty matches empty.
|
|
160
|
+
// The stamp has the value iff mint supplied it; the same applies to
|
|
161
|
+
// opts. A mismatched declaration on either side rejects.
|
|
162
|
+
if ((stamp.method ?? undefined) !== (opts.method ?? undefined))
|
|
163
|
+
return false;
|
|
164
|
+
if ((stamp.path ?? undefined) !== (opts.path ?? undefined))
|
|
165
|
+
return false;
|
|
166
|
+
if ((stamp.sessionSid ?? undefined) !== (opts.sessionSid ?? undefined))
|
|
76
167
|
return false;
|
|
77
168
|
const now = Math.floor(Date.now() / 1000);
|
|
78
169
|
if (now - stamp.ts > CSRF_VALIDITY_SECONDS || now < stamp.ts)
|
package/dist/csrf.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA,
|
|
1
|
+
{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,aAAa;AACb,EAAE;AACF,sDAAsD;AACtD,EAAE;AACF,kEAAkE;AAClE,oEAAoE;AACpE,kEAAkE;AAClE,mEAAmE;AACnE,mEAAmE;AACnE,+DAA+D;AAC/D,EAAE;AACF,qEAAqE;AACrE,mEAAmE;AACnE,qEAAqE;AACrE,8CAA8C;AAC9C,EAAE;AACF,kEAAkE;AAClE,8DAA8D;AAC9D,qEAAqE;AACrE,kEAAkE;AAClE,qEAAqE;AACrE,+DAA+D;AAC/D,4CAA4C;AAC5C,EAAE;AACF,uDAAuD;AACvD,yEAAyE;AACzE,wBAAwB;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAElC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;AAEhD,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAE,KAAK,GAAG,EAAoB,CAAC,CAAC;IACxG,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,CAAsB;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,GAAG,CAAC;IACxC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAa,EAAE,CAAa;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,IAAoC;IACxD,IAAI,IAAI,EAAE,eAAe,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAoDD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,IAAkB;IAC7C,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;IACjD,oEAAoE;IACpE,iEAAiE;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACpD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAEtE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,OAAO,GAAG,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,IAAoB;IAC5D,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,+EAA+E;gBAC7E,iFAAiF;gBACjF,qEAAqE;gBACrE,6DAA6D,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,KAAyB,CAAC;IAErD,IAAI,KAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEnF,gEAAgE;IAChE,mEAAmE;IACnE,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAE3E,kEAAkE;IAClE,iEAAiE;IACjE,mDAAmD;IACnD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnE,mEAAmE;IACnE,oEAAoE;IACpE,yDAAyD;IACzD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAErF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,qBAAqB,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAE3E,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
export { mintSession, verifySession, SESSION_COOKIE, SESSION_TTL_SECONDS } from './sessions';
|
|
2
|
-
export { csrfTokenFor, verifyCsrf } from './csrf';
|
|
1
|
+
export { mintSession, verifySession, SESSION_COOKIE, SESSION_TTL_SECONDS, DEFAULT_SESSION_CLOCK_SKEW_SEC, type VerifySessionOpts, } from './sessions';
|
|
2
|
+
export { csrfTokenFor, verifyCsrf, type CsrfBindings, type CsrfMintOpts, type CsrfVerifyOpts, } from './csrf';
|
|
3
3
|
export { deriveSaltFromLabel, deriveSaltFromEmail, type DeriveSaltFromEmailOpts } from './salt';
|
|
4
4
|
export { ERC1271_MAGIC, ERC6492_MAGIC, universalSignatureValidatorAbi, verifyUserSignature, verifyUserSignatureView, isErc6492Wrapped, } from './verify-signature';
|
|
5
5
|
export type { SignatureVerifyResult, VerifyUserSignatureArgs, UniversalValidatorClient, } from './verify-signature';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,8BAA8B,EAC9B,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EACZ,UAAU,EACV,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,cAAc,GACpB,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,KAAK,uBAAuB,EAAE,MAAM,QAAQ,CAAC;AAChG,OAAO,EACL,aAAa,EACb,aAAa,EACb,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,MAAM,EACN,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,YAAY,EACV,OAAO,EACP,GAAG,EACH,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,MAAM,EACN,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,SAAS,GACV,MAAM,SAAS,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
// @agenticprimitives/connect-auth — public API
|
|
2
2
|
//
|
|
3
3
|
// See ../../specs/200-connect-auth.md for the full contract.
|
|
4
|
-
export { mintSession, verifySession, SESSION_COOKIE, SESSION_TTL_SECONDS } from './sessions';
|
|
5
|
-
export { csrfTokenFor, verifyCsrf } from './csrf';
|
|
4
|
+
export { mintSession, verifySession, SESSION_COOKIE, SESSION_TTL_SECONDS, DEFAULT_SESSION_CLOCK_SKEW_SEC, } from './sessions';
|
|
5
|
+
export { csrfTokenFor, verifyCsrf, } from './csrf';
|
|
6
6
|
export { deriveSaltFromLabel, deriveSaltFromEmail } from './salt';
|
|
7
7
|
export { ERC1271_MAGIC, ERC6492_MAGIC, universalSignatureValidatorAbi, verifyUserSignature, verifyUserSignatureView, isErc6492Wrapped, } from './verify-signature';
|
|
8
8
|
// WebAuthn ceremony helpers (preferred deep import:
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,6DAA6D;AAE7D,OAAO,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,6DAA6D;AAE7D,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,8BAA8B,GAE/B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EACZ,UAAU,GAIX,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAgC,MAAM,QAAQ,CAAC;AAChG,OAAO,EACL,aAAa,EACb,aAAa,EACb,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAO5B,oDAAoD;AACpD,2EAA2E;AAC3E,6BAA6B;AAC7B,OAAO,EACL,MAAM,EACN,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,GACd,MAAM,mBAAmB,CAAC"}
|
package/dist/sessions.d.ts
CHANGED
|
@@ -2,14 +2,72 @@ import type { JwtClaims } from './types';
|
|
|
2
2
|
export declare const SESSION_COOKIE = "agentic-session";
|
|
3
3
|
export declare const SESSION_TTL_SECONDS = 86400;
|
|
4
4
|
/**
|
|
5
|
-
*
|
|
6
|
-
*
|
|
5
|
+
* R5.10 / PKG-CONNECT-AUTH-003 (external audit P1-1).
|
|
6
|
+
*
|
|
7
|
+
* Default clock-skew tolerance applied to `exp` (expiration) and `iat`
|
|
8
|
+
* (issued-at) checks. 30 s matches the OIDC reference + tolerates the
|
|
9
|
+
* typical cross-host NTP drift without opening a meaningful replay
|
|
10
|
+
* window. Override via `verifySession(..., { clockSkewSec })` when
|
|
11
|
+
* a deployment needs tighter or looser bounds.
|
|
7
12
|
*/
|
|
8
|
-
export declare
|
|
13
|
+
export declare const DEFAULT_SESSION_CLOCK_SKEW_SEC = 30;
|
|
14
|
+
export interface VerifySessionOpts {
|
|
15
|
+
/**
|
|
16
|
+
* Required for production deploys (R5.10 / P1-1). When provided,
|
|
17
|
+
* `claims.iss` MUST exactly match or the cookie is rejected. Prevents
|
|
18
|
+
* a sibling broker (same shape, different origin) from authenticating
|
|
19
|
+
* here. The production gate below throws if this is missing when
|
|
20
|
+
* `NODE_ENV=production` AND `developmentMode !== true`.
|
|
21
|
+
*/
|
|
22
|
+
expectedIss?: string;
|
|
23
|
+
/**
|
|
24
|
+
* Required for production deploys (R5.10 / P1-1). When provided,
|
|
25
|
+
* verifies `expectedAud` appears in `claims.aud` (which may be a
|
|
26
|
+
* string or string[] per RFC 7519 §4.1.3). Stops a session minted
|
|
27
|
+
* for relying app A from being replayed at relying app B even when
|
|
28
|
+
* they share the broker.
|
|
29
|
+
*/
|
|
30
|
+
expectedAud?: string;
|
|
31
|
+
/** Override default clock-skew tolerance (seconds). */
|
|
32
|
+
clockSkewSec?: number;
|
|
33
|
+
/**
|
|
34
|
+
* Opt out of the production gate (test code, dev-only flows). When
|
|
35
|
+
* unset, NODE_ENV=production triggers a throw if expectedIss/Aud are
|
|
36
|
+
* missing.
|
|
37
|
+
*/
|
|
38
|
+
developmentMode?: boolean;
|
|
39
|
+
}
|
|
9
40
|
/**
|
|
10
|
-
*
|
|
11
|
-
*
|
|
41
|
+
* Mint a JWT session cookie value from claims. Adds iat/exp + (if
|
|
42
|
+
* missing) sid automatically. Signs with the leftmost key in
|
|
43
|
+
* SESSION_JWT_SECRETS.
|
|
44
|
+
*
|
|
45
|
+
* R5.10 / PKG-CONNECT-AUTH-003 — `iss` + `aud` are required (no default).
|
|
46
|
+
* Pass the canonical broker URI as `iss` and the relying app's
|
|
47
|
+
* audience identifier(s) as `aud`. Without them the resulting session
|
|
48
|
+
* is unverifiable in production (see {@link verifySession}).
|
|
49
|
+
*/
|
|
50
|
+
export declare function mintSession(claims: Omit<JwtClaims, 'iat' | 'exp' | 'sid'> & {
|
|
51
|
+
sid?: string;
|
|
52
|
+
}): string;
|
|
53
|
+
/**
|
|
54
|
+
* Verify a JWT cookie value. Returns claims if valid, else null.
|
|
12
55
|
* Constant-time comparison; no info-leak on which key matched.
|
|
56
|
+
*
|
|
57
|
+
* R5.10 / PKG-CONNECT-AUTH-003 (external audit P1-1) — verifies:
|
|
58
|
+
* - HMAC signature against every kid in SESSION_JWT_SECRETS (rotation
|
|
59
|
+
* tolerant; constant-time)
|
|
60
|
+
* - `claims.exp + clockSkewSec >= now` (not expired)
|
|
61
|
+
* - `claims.iat - clockSkewSec <= now` (rejects future-iat tokens
|
|
62
|
+
* that could carry a wider replay window if a malicious mint server
|
|
63
|
+
* issued one)
|
|
64
|
+
* - `claims.iss === opts.expectedIss` when provided
|
|
65
|
+
* - `opts.expectedAud` ∈ `claims.aud` when provided (claims.aud may
|
|
66
|
+
* be a string or string[] per RFC 7519 §4.1.3)
|
|
67
|
+
*
|
|
68
|
+
* In `NODE_ENV=production` the helper THROWS if `expectedIss` /
|
|
69
|
+
* `expectedAud` are missing — they're required for any meaningful
|
|
70
|
+
* security boundary. Tests/dev opt out with `developmentMode: true`.
|
|
13
71
|
*/
|
|
14
|
-
export declare function verifySession(cookieValue: string): JwtClaims | null;
|
|
72
|
+
export declare function verifySession(cookieValue: string, opts?: VerifySessionOpts): JwtClaims | null;
|
|
15
73
|
//# sourceMappingURL=sessions.d.ts.map
|
package/dist/sessions.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAChD,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAyE1C
|
|
1
|
+
{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAChD,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAyE1C;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAEjD,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AA8BD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAChE,MAAM,CAgBR;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,iBAAiB,GACvB,SAAS,GAAG,IAAI,CAwFlB"}
|
package/dist/sessions.js
CHANGED
|
@@ -76,14 +76,66 @@ function constantTimeEqual(a, b) {
|
|
|
76
76
|
return diff === 0;
|
|
77
77
|
}
|
|
78
78
|
/**
|
|
79
|
-
*
|
|
80
|
-
*
|
|
79
|
+
* R5.10 / PKG-CONNECT-AUTH-003 (external audit P1-1).
|
|
80
|
+
*
|
|
81
|
+
* Default clock-skew tolerance applied to `exp` (expiration) and `iat`
|
|
82
|
+
* (issued-at) checks. 30 s matches the OIDC reference + tolerates the
|
|
83
|
+
* typical cross-host NTP drift without opening a meaningful replay
|
|
84
|
+
* window. Override via `verifySession(..., { clockSkewSec })` when
|
|
85
|
+
* a deployment needs tighter or looser bounds.
|
|
86
|
+
*/
|
|
87
|
+
export const DEFAULT_SESSION_CLOCK_SKEW_SEC = 30;
|
|
88
|
+
function isProduction(opts) {
|
|
89
|
+
if (opts?.developmentMode === true)
|
|
90
|
+
return false;
|
|
91
|
+
try {
|
|
92
|
+
return typeof process !== 'undefined' && process.env?.NODE_ENV === 'production';
|
|
93
|
+
}
|
|
94
|
+
catch {
|
|
95
|
+
/* SES / browsers may throw on process access */
|
|
96
|
+
return false;
|
|
97
|
+
}
|
|
98
|
+
}
|
|
99
|
+
function randomSid() {
|
|
100
|
+
// 128 bits is the canonical OAuth `state` / OIDC `nonce` size.
|
|
101
|
+
// Worker / Node 18+ / browsers all expose `crypto.getRandomValues`.
|
|
102
|
+
const bytes = new Uint8Array(16);
|
|
103
|
+
try {
|
|
104
|
+
crypto.getRandomValues(bytes);
|
|
105
|
+
}
|
|
106
|
+
catch {
|
|
107
|
+
// Fallback for environments without WebCrypto (vanishingly rare on
|
|
108
|
+
// the runtimes we support; Math.random is NOT a security boundary
|
|
109
|
+
// but the sid is one of multiple defense layers, so this is
|
|
110
|
+
// documentation-grade rather than load-bearing).
|
|
111
|
+
for (let i = 0; i < bytes.length; i++)
|
|
112
|
+
bytes[i] = Math.floor(Math.random() * 256);
|
|
113
|
+
}
|
|
114
|
+
let s = '';
|
|
115
|
+
for (const b of bytes)
|
|
116
|
+
s += b.toString(16).padStart(2, '0');
|
|
117
|
+
return s;
|
|
118
|
+
}
|
|
119
|
+
/**
|
|
120
|
+
* Mint a JWT session cookie value from claims. Adds iat/exp + (if
|
|
121
|
+
* missing) sid automatically. Signs with the leftmost key in
|
|
122
|
+
* SESSION_JWT_SECRETS.
|
|
123
|
+
*
|
|
124
|
+
* R5.10 / PKG-CONNECT-AUTH-003 — `iss` + `aud` are required (no default).
|
|
125
|
+
* Pass the canonical broker URI as `iss` and the relying app's
|
|
126
|
+
* audience identifier(s) as `aud`. Without them the resulting session
|
|
127
|
+
* is unverifiable in production (see {@link verifySession}).
|
|
81
128
|
*/
|
|
82
129
|
export function mintSession(claims) {
|
|
83
130
|
const keys = loadKeys();
|
|
84
131
|
const signer = keys[0];
|
|
85
132
|
const now = Math.floor(Date.now() / 1000);
|
|
86
|
-
const payload = {
|
|
133
|
+
const payload = {
|
|
134
|
+
...claims,
|
|
135
|
+
sid: claims.sid ?? randomSid(),
|
|
136
|
+
iat: now,
|
|
137
|
+
exp: now + SESSION_TTL_SECONDS,
|
|
138
|
+
};
|
|
87
139
|
const header = { ...JWT_HEADER, kid: signer.kid };
|
|
88
140
|
const headerEnc = base64urlEncode(JSON.stringify(header));
|
|
89
141
|
const payloadEnc = base64urlEncode(JSON.stringify(payload));
|
|
@@ -92,11 +144,39 @@ export function mintSession(claims) {
|
|
|
92
144
|
return `${signingInput}.${base64urlEncode(sig)}`;
|
|
93
145
|
}
|
|
94
146
|
/**
|
|
95
|
-
* Verify a JWT cookie value. Returns claims if valid
|
|
96
|
-
* Tries every kid in SESSION_JWT_SECRETS — rotation-safe.
|
|
147
|
+
* Verify a JWT cookie value. Returns claims if valid, else null.
|
|
97
148
|
* Constant-time comparison; no info-leak on which key matched.
|
|
149
|
+
*
|
|
150
|
+
* R5.10 / PKG-CONNECT-AUTH-003 (external audit P1-1) — verifies:
|
|
151
|
+
* - HMAC signature against every kid in SESSION_JWT_SECRETS (rotation
|
|
152
|
+
* tolerant; constant-time)
|
|
153
|
+
* - `claims.exp + clockSkewSec >= now` (not expired)
|
|
154
|
+
* - `claims.iat - clockSkewSec <= now` (rejects future-iat tokens
|
|
155
|
+
* that could carry a wider replay window if a malicious mint server
|
|
156
|
+
* issued one)
|
|
157
|
+
* - `claims.iss === opts.expectedIss` when provided
|
|
158
|
+
* - `opts.expectedAud` ∈ `claims.aud` when provided (claims.aud may
|
|
159
|
+
* be a string or string[] per RFC 7519 §4.1.3)
|
|
160
|
+
*
|
|
161
|
+
* In `NODE_ENV=production` the helper THROWS if `expectedIss` /
|
|
162
|
+
* `expectedAud` are missing — they're required for any meaningful
|
|
163
|
+
* security boundary. Tests/dev opt out with `developmentMode: true`.
|
|
98
164
|
*/
|
|
99
|
-
export function verifySession(cookieValue) {
|
|
165
|
+
export function verifySession(cookieValue, opts) {
|
|
166
|
+
if (isProduction(opts)) {
|
|
167
|
+
if (!opts?.expectedIss) {
|
|
168
|
+
throw new Error('[connect-auth] verifySession requires `expectedIss` in production. ' +
|
|
169
|
+
'Without it any session cookie minted by any broker passes the iss check, ' +
|
|
170
|
+
'defeating the R5.10 / P1-1 closure. Pass the canonical broker URI as ' +
|
|
171
|
+
'opts.expectedIss; for tests, pass `developmentMode: true`.');
|
|
172
|
+
}
|
|
173
|
+
if (!opts?.expectedAud) {
|
|
174
|
+
throw new Error('[connect-auth] verifySession requires `expectedAud` in production. ' +
|
|
175
|
+
'Without it a session minted for relying app A can be replayed at ' +
|
|
176
|
+
'relying app B even when they share the broker. Pass the relying app ' +
|
|
177
|
+
'audience id as opts.expectedAud; for tests, pass `developmentMode: true`.');
|
|
178
|
+
}
|
|
179
|
+
}
|
|
100
180
|
if (!cookieValue)
|
|
101
181
|
return null;
|
|
102
182
|
const parts = cookieValue.split('.');
|
|
@@ -136,8 +216,36 @@ export function verifySession(cookieValue) {
|
|
|
136
216
|
if (!ok)
|
|
137
217
|
return null;
|
|
138
218
|
const now = Math.floor(Date.now() / 1000);
|
|
139
|
-
|
|
219
|
+
const skew = opts?.clockSkewSec ?? DEFAULT_SESSION_CLOCK_SKEW_SEC;
|
|
220
|
+
// Expiration check with skew (canonical RFC 7519 §4.1.4).
|
|
221
|
+
if (typeof claims.exp !== 'number' || claims.exp + skew < now)
|
|
140
222
|
return null;
|
|
223
|
+
// R5.10: future-iat reject (defends against a misconfigured /
|
|
224
|
+
// malicious mint server emitting tokens with iat well in the future,
|
|
225
|
+
// which would otherwise outlive the TTL window).
|
|
226
|
+
if (typeof claims.iat !== 'number' || claims.iat - skew > now)
|
|
227
|
+
return null;
|
|
228
|
+
// R5.10: iss binding (when expected).
|
|
229
|
+
if (opts?.expectedIss !== undefined) {
|
|
230
|
+
if (typeof claims.iss !== 'string' || claims.iss !== opts.expectedIss)
|
|
231
|
+
return null;
|
|
232
|
+
}
|
|
233
|
+
// R5.10: aud binding (when expected). claims.aud may be a string or
|
|
234
|
+
// a string[]; expectedAud must appear (RFC 7519 §4.1.3).
|
|
235
|
+
if (opts?.expectedAud !== undefined) {
|
|
236
|
+
const aud = claims.aud;
|
|
237
|
+
if (typeof aud === 'string') {
|
|
238
|
+
if (aud !== opts.expectedAud)
|
|
239
|
+
return null;
|
|
240
|
+
}
|
|
241
|
+
else if (Array.isArray(aud)) {
|
|
242
|
+
if (!aud.includes(opts.expectedAud))
|
|
243
|
+
return null;
|
|
244
|
+
}
|
|
245
|
+
else {
|
|
246
|
+
return null;
|
|
247
|
+
}
|
|
248
|
+
}
|
|
141
249
|
return claims;
|
|
142
250
|
}
|
|
143
251
|
//# sourceMappingURL=sessions.js.map
|
package/dist/sessions.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,+EAA+E;AAC/E,kFAAkF;AAClF,0DAA0D;AAE1D,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAGlC,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,CAAC,MAAM;AAEjD,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAOhD,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sDAAsD,OAAO,wBAAwB,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAoB,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,+BAA+B,CAAC,CAAC;QAChG,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,KAA0B;IACjD,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,sCAAsC;IACtC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,0DAA0D;QAC1D,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,GAAG,CAAC;IACxC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAa,EAAE,CAAa;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,+EAA+E;AAC/E,kFAAkF;AAClF,0DAA0D;AAE1D,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAGlC,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,CAAC,MAAM;AAEjD,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAOhD,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sDAAsD,OAAO,wBAAwB,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAoB,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,+BAA+B,CAAC,CAAC;QAChG,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,KAA0B;IACjD,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,sCAAsC;IACtC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,0DAA0D;QAC1D,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,GAAG,CAAC;IACxC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAa,EAAE,CAAa;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AA6BjD,SAAS,YAAY,CAAC,IAAwB;IAC5C,IAAI,IAAI,EAAE,eAAe,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,+DAA+D;IAC/D,oEAAoE;IACpE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,kEAAkE;QAClE,4DAA4D;QAC5D,iDAAiD;QACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,MAAiE;IAEjE,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAc;QACzB,GAAG,MAAM;QACT,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE;QAC9B,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,mBAAmB;KAC/B,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAChF,OAAO,GAAG,YAAY,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAC3B,WAAmB,EACnB,IAAwB;IAExB,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,qEAAqE;gBACnE,2EAA2E;gBAC3E,uEAAuE;gBACvE,4DAA4D,CAC/D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,qEAAqE;gBACnE,mEAAmE;gBACnE,sEAAsE;gBACtE,2EAA2E,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAiC,CAAC;IAE1E,IAAI,MAAsC,CAAC;IAC3C,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAElD,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE/H,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QAChF,IAAI,iBAAiB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAC9C,EAAE,GAAG,IAAI,CAAC;YACV,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAErB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,EAAE,YAAY,IAAI,8BAA8B,CAAC;IAElE,0DAA0D;IAC1D,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAE3E,8DAA8D;IAC9D,qEAAqE;IACrE,iDAAiD;IACjD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAE3E,sCAAsC;IACtC,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;IACrF,CAAC;IAED,oEAAoE;IACpE,yDAAyD;IACzD,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,GAAG,KAAK,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC;QAC5C,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -11,6 +11,32 @@ export interface JwtClaims {
|
|
|
11
11
|
kind: 'session' | 'session-grant';
|
|
12
12
|
iat: number;
|
|
13
13
|
exp: number;
|
|
14
|
+
/**
|
|
15
|
+
* R5.10 / PKG-CONNECT-AUTH-003 (external audit P1-1).
|
|
16
|
+
*
|
|
17
|
+
* `iss` (issuer) — the origin / canonical URI of the Connect broker
|
|
18
|
+
* that minted this session. Verifiers MUST cross-check
|
|
19
|
+
* `claims.iss === expectedIss` to prevent a cookie minted by a
|
|
20
|
+
* different broker (or a malicious broker on a sibling origin) from
|
|
21
|
+
* authenticating against this app.
|
|
22
|
+
*
|
|
23
|
+
* `aud` (audience) — the relying app(s) this cookie is valid for.
|
|
24
|
+
* May be a single origin/URI or an array. Verifiers MUST cross-check
|
|
25
|
+
* `expectedAud` is in `claims.aud` so a session minted for app A
|
|
26
|
+
* cannot be replayed at app B even when both share the broker.
|
|
27
|
+
*
|
|
28
|
+
* `sid` (session id) — a high-entropy id for this specific session.
|
|
29
|
+
* Lets the broker revoke a single session (by adding `sid` to a
|
|
30
|
+
* revocation list) without invalidating all sessions for `sub`.
|
|
31
|
+
* Auto-generated by `mintSession` when not supplied by the caller.
|
|
32
|
+
*
|
|
33
|
+
* `nonce` — optional OIDC-style replay nonce, threaded through from
|
|
34
|
+
* an upstream authorize request when this cookie carries one.
|
|
35
|
+
*/
|
|
36
|
+
iss: string;
|
|
37
|
+
aud: string | string[];
|
|
38
|
+
sid: string;
|
|
39
|
+
nonce?: string;
|
|
14
40
|
}
|
|
15
41
|
export interface AuthenticatedUser {
|
|
16
42
|
id: string;
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAE7B,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,UAAU,CAAC;IAChB,IAAI,EAAE,SAAS,GAAG,eAAe,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAE7B,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,UAAU,CAAC;IAChB,IAAI,EAAE,SAAS,GAAG,eAAe,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,OAAO,GAAG,IAAI,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAAC;AAEnF,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,aAAa,CAAC,IAAI,EAAE;QAClB,MAAM,EAAE,eAAe,CAAC;QACxB,KAAK,EAAE,cAAc,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,GAAG,CAAC;IACvB,cAAc,EAAE,GAAG,CAAC;IACpB,SAAS,EAAE,GAAG,CAAC;CAChB;AAED,MAAM,WAAW,aAAc,SAAQ,MAAM;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,MAAM,CAAC,SAAS,EAAE,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,SAAU,SAAQ,MAAM;CAExC;AAED,MAAM,WAAW,SAAU,SAAQ,MAAM;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;CACxD"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@agenticprimitives/connect-auth",
|
|
3
|
-
"version": "
|
|
3
|
+
"version": "1.0.0-alpha.4",
|
|
4
4
|
"description": "User authentication (passkey + SIWE + Google OAuth), JWT sessions, and pluggable signer interfaces.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"repository": {
|
|
@@ -48,7 +48,7 @@
|
|
|
48
48
|
},
|
|
49
49
|
"peerDependencies": {
|
|
50
50
|
"viem": "^2.50.0",
|
|
51
|
-
"@agenticprimitives/types": "
|
|
51
|
+
"@agenticprimitives/types": "1.0.0-alpha.4"
|
|
52
52
|
},
|
|
53
53
|
"devDependencies": {
|
|
54
54
|
"vitest": "^2.1.0"
|