@agentunion/fastaun 0.5.26 → 0.5.27

package/dist/auth.js

@@ -112,13 +112,13 @@ function _extractPublicKey(cert) {
 }
 const CERT_CLOCK_SKEW_MS = 300_000;
 /** 检查证书时间有效性，允许测试环境和容器之间存在短暂时钟偏差 */
-function _ensureCertTimeValid(cert, label, nowMs) {
+function _ensureCertTimeValid(cert, label, nowMs, clockSkewMs = CERT_CLOCK_SKEW_MS) {
     const notBefore = new Date(cert.validFrom).getTime();
     const notAfter = new Date(cert.validTo).getTime();
-    if (nowMs + CERT_CLOCK_SKEW_MS < notBefore) {
+    if (nowMs + clockSkewMs < notBefore) {
         throw new AuthError(`${label} is not yet valid`);
     }
-    if (nowMs - CERT_CLOCK_SKEW_MS > notAfter) {
+    if (nowMs - clockSkewMs > notAfter) {
         throw new AuthError(`${label} has expired`);
     }
 }
@@ -338,7 +338,7 @@ function _strictCrlRevokedSerials(pem, issuer, now) {
     };
     const thisUpdate = crlTime(tbs[offset + 2]);
     const nextUpdate = crlTime(tbs[offset + 3]);
-    if (thisUpdate > now + 5 || nextUpdate <= now || nextUpdate <= thisUpdate)
+    if (thisUpdate > now + 300 || now > nextUpdate + 300 || nextUpdate <= thisUpdate)
         throw new AuthError('service event CRL is not current');
     const revoked = new Set();
     if (tbs[offset + 4]?.tag === 0x30)
@@ -401,7 +401,7 @@ function _verifyOwnershipOcsp(der, certificate, issuer, now) {
     if (!responderValid)
         throw new ValidationError('OCSP responder is not the verified issuer', { stringCode: 'invalid' });
     const producedAt = _ownershipOcspTime(tbs[offset++]);
-    if (producedAt > now + 5 || producedAt < now - 90)
+    if (producedAt > now + 300 || producedAt < now - 390)
         throw new StateError('OCSP response is not current', { stringCode: 'unavailable', retryable: true });
     const responses = _ownershipDerChildren(tbs[offset++], 0x30);
     let status;
@@ -429,7 +429,7 @@ function _verifyOwnershipOcsp(der, certificate, issuer, now) {
         const nextUpdate = _ownershipOcspTime(_ownershipDerChildren(single[3])[0]);
         nextRefreshAt = nextUpdate * 1000;
         currentUntil = Math.min(currentUntil, (thisUpdate + 30) * 1000);
-        if (thisUpdate > now + 5 || thisUpdate < now - 30 || nextUpdate <= now || nextUpdate <= thisUpdate)
+        if (thisUpdate > now + 300 || thisUpdate < now - 330 || now > nextUpdate + 300 || nextUpdate <= thisUpdate)
             throw new StateError('OCSP validity window is not current', { stringCode: 'unavailable', retryable: true });
         if (single[1].tag === 0x80 && single[1].content.length === 0)
             status = 'good';
@@ -941,7 +941,7 @@ export class AuthFlow {
         try {
             const cert = _loadX509(certPem);
             if (signedAt !== undefined) {
-                _ensureCertTimeValid(cert, 'peer certificate', signedAt * 1000);
+                _ensureCertTimeValid(cert, 'peer certificate', signedAt * 1000, 0);
                 await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid, signedAt);
                 if (_certSubjectCN(cert) !== expectedAid)
                     throw new AuthError(`peer cert CN mismatch: expected ${expectedAid}`);
@@ -960,7 +960,7 @@ export class AuthFlow {
                 if (!chain.length)
                     throw new AuthError('service event certificate chain is unavailable');
                 const current = Math.trunc(Date.now() / 1000);
-                if ([cert, ...chain].some((item) => current < Math.trunc(Date.parse(item.validFrom) / 1000) || current > Math.trunc(Date.parse(item.validTo) / 1000)))
+                if ([cert, ...chain].some((item) => current < Math.trunc(Date.parse(item.validFrom) / 1000) - 300 || current > Math.trunc(Date.parse(item.validTo) / 1000) + 300))
                     throw new AuthError('service event certificate is outside its validity window');
                 await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid, undefined, true, chain);
                 const crl = await this._fetchGatewayCrl(gatewayUrl, chain[0], true);
@@ -1116,7 +1116,7 @@ export class AuthFlow {
             const observedText = headers['x-aun-cert-observed-at'] ?? '';
             const observed = Date.parse(observedText) / 1000;
             const now = Date.now() / 1000;
-            if (headers['x-aun-cert-consistency'] !== 'authoritative' || typeof state !== 'string' || !state || !headers['x-aun-cert-fingerprint'] || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/.test(observedText) || !Number.isFinite(observed) || observed > now + 5 || observed < now - 30)
+            if (headers['x-aun-cert-consistency'] !== 'authoritative' || typeof state !== 'string' || !state || !headers['x-aun-cert-fingerprint'] || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/.test(observedText) || !Number.isFinite(observed) || observed > now + 300 || observed < now - 330)
                 throw unavailable('ownership certificate authoritative current metadata is unavailable');
             if (state !== 'active_signing' || headers['x-aun-cert-fingerprint'] !== fingerprint)
                 throw new ValidationError('ownership certificate lifecycle or fingerprint is invalid', { stringCode: 'invalid' });
@@ -1132,7 +1132,7 @@ export class AuthFlow {
             if (cert.subject.match(/(?:^|\n)CN=([^\n]+)/)?.[1] !== aid)
                 throw new ValidationError('ownership certificate AID mismatch', { stringCode: 'invalid' });
             _ownershipCertConstraints(cert);
-            validateAgentMdCertificate(response.body, aid, Math.trunc(now), { now: Math.trunc(now), requireCurrentValidity: true });
+            validateAgentMdCertificate(response.body, aid, Math.trunc(Math.min(Math.max(now, Date.parse(cert.validFrom) / 1000), Date.parse(cert.validTo) / 1000)), { now: Math.trunc(now), requireCurrentValidity: true });
             if (certFingerprint(response.body) !== fingerprint)
                 throw new ValidationError('ownership certificate DER fingerprint mismatch', { stringCode: 'invalid' });
             const epoch = this._strictPkiEpoch;
@@ -1156,7 +1156,7 @@ export class AuthFlow {
                     const constraints = _ownershipCertConstraints(issuer);
                     if (constraints.pathLen !== undefined && index > constraints.pathLen)
                         throw new ValidationError('ownership certificate path length is invalid', { stringCode: 'invalid' });
-                    if (!constraints.basicPresent || !issuer.ca || !constraints.keyUsagePresent || !constraints.keyCertSign || Date.now() < Date.parse(issuer.validFrom) || Date.now() > Date.parse(issuer.validTo) || !current.checkIssued(issuer) || !current.verify(issuer.publicKey))
+                    if (!constraints.basicPresent || !issuer.ca || !constraints.keyUsagePresent || !constraints.keyCertSign || Date.now() < Date.parse(issuer.validFrom) - 300_000 || Date.now() > Date.parse(issuer.validTo) + 300_000 || !current.checkIssued(issuer) || !current.verify(issuer.publicKey))
                         throw new ValidationError('ownership certificate chain is invalid', { stringCode: 'invalid' });
                     current = issuer;
                 }
@@ -1200,9 +1200,9 @@ export class AuthFlow {
             if (status !== 'good')
                 throw unavailable('ownership certificate revocation status is unknown');
             const finalNow = Date.now();
-            if ([cert, ...chain].some((item) => finalNow < Date.parse(item.validFrom) || finalNow > Date.parse(item.validTo)))
+            if ([cert, ...chain].some((item) => finalNow < Date.parse(item.validFrom) - 300_000 || finalNow > Date.parse(item.validTo) + 300_000))
                 throw new ValidationError('ownership certificate chain is invalid', { stringCode: 'invalid' });
-            if (finalNow - began > 30_000 || finalNow / 1000 - observed > 30)
+            if (finalNow - began > 30_000 || finalNow / 1000 - observed > 330)
                 throw unavailable('ownership certificate verification window elapsed');
             return { certificate: { cert_pem: response.body, chain_valid: true, state, revoked: false, revocation_checked: true, observed_at: Math.trunc(observed) }, expiresAt: Math.min(began + 3600_000, (Math.trunc(observed) + 30) * 1000, evidence.currentUntil, evidence.nextRefreshAt, Date.parse(cert.validTo), ...chain.map((item) => Date.parse(item.validTo))) };
         }
@@ -1522,6 +1522,7 @@ export class AuthFlow {
             inline_realtime_payload_v1: true,
             agent_md_validation_v1: true,
             p2p_peer_pull_v1: true,
+            gateway_migrate_v1: true,
         };
         const request = {
             nonce,
@@ -1636,7 +1637,8 @@ export class AuthFlow {
     async _verifyAuthCertChain(gatewayUrl, authCert, chainAid = '', signedAt, _fresh = false, suppliedChain) {
         const epoch = this._strictPkiEpoch;
         const nowMs = signedAt === undefined ? Date.now() : signedAt * 1000;
-        _ensureCertTimeValid(authCert, 'auth certificate', nowMs);
+        const clockSkewMs = signedAt === undefined ? CERT_CLOCK_SKEW_MS : 0;
+        _ensureCertTimeValid(authCert, 'auth certificate', nowMs, clockSkewMs);
         const chain = suppliedChain ?? await this._loadGatewayCaChain(gatewayUrl, chainAid);
         if (!chain.length) {
             throw new AuthError('unable to verify auth certificate chain: missing CA chain');
@@ -1648,14 +1650,14 @@ export class AuthFlow {
         const expiresAt = Math.min(now + this._chainCacheTtl, Date.parse(authCert.validTo), ...chain.map((cert) => Date.parse(cert.validTo)));
         const chainExpiresAt = Math.min(now + this._chainCacheTtl, ...chain.map((cert) => Date.parse(cert.validTo)));
         for (const caCert of chain)
-            _ensureCertTimeValid(caCert, 'CA certificate', nowMs);
+            _ensureCertTimeValid(caCert, 'CA certificate', nowMs, clockSkewMs);
         // 检查缓存
         if ((this._chainVerifiedCache.get(certKey) ?? 0) > now)
             return;
         // 快速路径：CA 链已通过完整验证
         if ((this._gatewayCaVerified.get(cacheKey) ?? 0) > now) {
             const issuer = chain[0];
-            _ensureCertTimeValid(issuer, 'Issuer CA', nowMs);
+            _ensureCertTimeValid(issuer, 'Issuer CA', nowMs, clockSkewMs);
             if (!_isCaCert(issuer)) {
                 throw new AuthError('Issuer CA is not marked as CA (fast path)');
             }
@@ -1673,7 +1675,7 @@ export class AuthFlow {
         let current = authCert;
         for (let i = 0; i < chain.length; i++) {
             const caCert = chain[i];
-            _ensureCertTimeValid(caCert, `CA certificate[${i}]`, nowMs);
+            _ensureCertTimeValid(caCert, `CA certificate[${i}]`, nowMs, clockSkewMs);
             if (!_checkIssuedBy(current, caCert)) {
                 throw new AuthError(`auth certificate issuer mismatch at chain level ${i}`);
             }
@@ -2301,9 +2303,9 @@ export class AuthFlow {
             const now = Date.now();
             const validFrom = new Date(cert.validFrom).getTime();
             const validTo = new Date(cert.validTo).getTime();
-            if (now < validFrom)
+            if (now < validFrom - 300_000)
                 return 'cert not yet valid';
-            if (now > validTo)
+            if (now > validTo + 300_000)
                 return 'cert expired';
             return '';
         }