@agentunion/fastaun 0.5.26 → 0.5.28

package/dist/auth.d.ts

@@ -48,6 +48,14 @@ export declare class AuthFlow {
     private _gatewayCaVerified;
     private _memIdentity;
     private _identityPkiContext;
+    private _requestAdmission;
+    private _riskCapabilityEnabled;
+    private _httpHandler;
+    setRequestAdmission(admission: ((request: string) => () => void) | null): void;
+    setRiskSupport(enabled: () => boolean): void;
+    setHttpHandler(handler: (url: string, init: RequestInit, perform: (url: string, init: RequestInit) => Promise<Response>) => Promise<Response>): void;
+    _fetchRiskText(url: string): Promise<string>;
+    private _fetchRiskJson;
     constructor(opts: {
         tokenStore: TokenStore;
         crypto: CryptoProvider;
@@ -130,6 +138,7 @@ export declare class AuthFlow {
     resolveOwnershipCertificate(gatewayUrl: string, aid: string, fingerprint: string, purpose?: 'signing' | 'group_identity'): Promise<OwnershipCertificate>;
     private _verifyOwnershipCertificate;
     private _fetchOwnershipPki;
+    private _fetchOwnershipPkiDirect;
     /** 预置 Gateway CA 链材料，但不标记为已验证。 */
     cacheGatewayCaChain(gatewayUrl: string, caChainPems: string[], chainAid?: string): void;
     /** 丢弃预置或缓存的 Gateway CA 链材料。 */
@@ -139,6 +148,7 @@ export declare class AuthFlow {
      * 流程：连接 → 接收 challenge → 发送请求 → 接收响应 → 关闭。
      */
     protected _shortRpc(gatewayUrl: string, method: string, params: RpcParams): Promise<JsonObject>;
+    private _shortRpcAdmitted;
     /** 两阶段登录 */
     private _login;
     /** 刷新 access_token */

package/dist/auth.js

@@ -112,13 +112,13 @@ function _extractPublicKey(cert) {
 }
 const CERT_CLOCK_SKEW_MS = 300_000;
 /** 检查证书时间有效性，允许测试环境和容器之间存在短暂时钟偏差 */
-function _ensureCertTimeValid(cert, label, nowMs) {
+function _ensureCertTimeValid(cert, label, nowMs, clockSkewMs = CERT_CLOCK_SKEW_MS) {
     const notBefore = new Date(cert.validFrom).getTime();
     const notAfter = new Date(cert.validTo).getTime();
-    if (nowMs + CERT_CLOCK_SKEW_MS < notBefore) {
+    if (nowMs + clockSkewMs < notBefore) {
         throw new AuthError(`${label} is not yet valid`);
     }
-    if (nowMs - CERT_CLOCK_SKEW_MS > notAfter) {
+    if (nowMs - clockSkewMs > notAfter) {
         throw new AuthError(`${label} has expired`);
     }
 }
@@ -338,7 +338,7 @@ function _strictCrlRevokedSerials(pem, issuer, now) {
     };
     const thisUpdate = crlTime(tbs[offset + 2]);
     const nextUpdate = crlTime(tbs[offset + 3]);
-    if (thisUpdate > now + 5 || nextUpdate <= now || nextUpdate <= thisUpdate)
+    if (thisUpdate > now + 300 || now > nextUpdate + 300 || nextUpdate <= thisUpdate)
         throw new AuthError('service event CRL is not current');
     const revoked = new Set();
     if (tbs[offset + 4]?.tag === 0x30)
@@ -401,7 +401,7 @@ function _verifyOwnershipOcsp(der, certificate, issuer, now) {
     if (!responderValid)
         throw new ValidationError('OCSP responder is not the verified issuer', { stringCode: 'invalid' });
     const producedAt = _ownershipOcspTime(tbs[offset++]);
-    if (producedAt > now + 5 || producedAt < now - 90)
+    if (producedAt > now + 300 || producedAt < now - 390)
         throw new StateError('OCSP response is not current', { stringCode: 'unavailable', retryable: true });
     const responses = _ownershipDerChildren(tbs[offset++], 0x30);
     let status;
@@ -429,7 +429,7 @@ function _verifyOwnershipOcsp(der, certificate, issuer, now) {
         const nextUpdate = _ownershipOcspTime(_ownershipDerChildren(single[3])[0]);
         nextRefreshAt = nextUpdate * 1000;
         currentUntil = Math.min(currentUntil, (thisUpdate + 30) * 1000);
-        if (thisUpdate > now + 5 || thisUpdate < now - 30 || nextUpdate <= now || nextUpdate <= thisUpdate)
+        if (thisUpdate > now + 300 || thisUpdate < now - 330 || now > nextUpdate + 300 || nextUpdate <= thisUpdate)
             throw new StateError('OCSP validity window is not current', { stringCode: 'unavailable', retryable: true });
         if (single[1].tag === 0x80 && single[1].content.length === 0)
             status = 'good';
@@ -551,6 +551,26 @@ export class AuthFlow {
     // 调用方注入的内存私钥（由 AUNClient.loadIdentity 传入，不走 tokenStore 解密）
     _memIdentity = null;
     _identityPkiContext = '';
+    _requestAdmission = null;
+    _riskCapabilityEnabled = null;
+    _httpHandler = null;
+    setRequestAdmission(admission) { this._requestAdmission = admission; }
+    setRiskSupport(enabled) { this._riskCapabilityEnabled = enabled; }
+    setHttpHandler(handler) { this._httpHandler = handler; }
+    async _fetchRiskText(url) {
+        if (!this._httpHandler)
+            return _fetchText(url, this._verifySsl, this._net);
+        const response = await this._fetchOwnershipPki(url);
+        if (response.status < 200 || response.status >= 300)
+            throw new AuthError(`HTTP ${response.status} from ${url}`);
+        return response.body;
+    }
+    async _fetchRiskJson(url) {
+        const result = JSON.parse(await this._fetchRiskText(url));
+        if (!isJsonObject(result))
+            throw new ValidationError(`invalid JSON response from ${url}`);
+        return result;
+    }
     constructor(opts) {
         this._logger = opts.logger ?? _noopLogger;
         this._tokenStore = opts.tokenStore;
@@ -941,7 +961,7 @@ export class AuthFlow {
         try {
             const cert = _loadX509(certPem);
             if (signedAt !== undefined) {
-                _ensureCertTimeValid(cert, 'peer certificate', signedAt * 1000);
+                _ensureCertTimeValid(cert, 'peer certificate', signedAt * 1000, 0);
                 await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid, signedAt);
                 if (_certSubjectCN(cert) !== expectedAid)
                     throw new AuthError(`peer cert CN mismatch: expected ${expectedAid}`);
@@ -960,7 +980,7 @@ export class AuthFlow {
                 if (!chain.length)
                     throw new AuthError('service event certificate chain is unavailable');
                 const current = Math.trunc(Date.now() / 1000);
-                if ([cert, ...chain].some((item) => current < Math.trunc(Date.parse(item.validFrom) / 1000) || current > Math.trunc(Date.parse(item.validTo) / 1000)))
+                if ([cert, ...chain].some((item) => current < Math.trunc(Date.parse(item.validFrom) / 1000) - 300 || current > Math.trunc(Date.parse(item.validTo) / 1000) + 300))
                     throw new AuthError('service event certificate is outside its validity window');
                 await this._verifyAuthCertChain(gatewayUrl, cert, expectedAid, undefined, true, chain);
                 const crl = await this._fetchGatewayCrl(gatewayUrl, chain[0], true);
@@ -1116,7 +1136,7 @@ export class AuthFlow {
             const observedText = headers['x-aun-cert-observed-at'] ?? '';
             const observed = Date.parse(observedText) / 1000;
             const now = Date.now() / 1000;
-            if (headers['x-aun-cert-consistency'] !== 'authoritative' || typeof state !== 'string' || !state || !headers['x-aun-cert-fingerprint'] || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/.test(observedText) || !Number.isFinite(observed) || observed > now + 5 || observed < now - 30)
+            if (headers['x-aun-cert-consistency'] !== 'authoritative' || typeof state !== 'string' || !state || !headers['x-aun-cert-fingerprint'] || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/.test(observedText) || !Number.isFinite(observed) || observed > now + 300 || observed < now - 330)
                 throw unavailable('ownership certificate authoritative current metadata is unavailable');
             if (state !== 'active_signing' || headers['x-aun-cert-fingerprint'] !== fingerprint)
                 throw new ValidationError('ownership certificate lifecycle or fingerprint is invalid', { stringCode: 'invalid' });
@@ -1132,7 +1152,7 @@ export class AuthFlow {
             if (cert.subject.match(/(?:^|\n)CN=([^\n]+)/)?.[1] !== aid)
                 throw new ValidationError('ownership certificate AID mismatch', { stringCode: 'invalid' });
             _ownershipCertConstraints(cert);
-            validateAgentMdCertificate(response.body, aid, Math.trunc(now), { now: Math.trunc(now), requireCurrentValidity: true });
+            validateAgentMdCertificate(response.body, aid, Math.trunc(Math.min(Math.max(now, Date.parse(cert.validFrom) / 1000), Date.parse(cert.validTo) / 1000)), { now: Math.trunc(now), requireCurrentValidity: true });
             if (certFingerprint(response.body) !== fingerprint)
                 throw new ValidationError('ownership certificate DER fingerprint mismatch', { stringCode: 'invalid' });
             const epoch = this._strictPkiEpoch;
@@ -1156,7 +1176,7 @@ export class AuthFlow {
                     const constraints = _ownershipCertConstraints(issuer);
                     if (constraints.pathLen !== undefined && index > constraints.pathLen)
                         throw new ValidationError('ownership certificate path length is invalid', { stringCode: 'invalid' });
-                    if (!constraints.basicPresent || !issuer.ca || !constraints.keyUsagePresent || !constraints.keyCertSign || Date.now() < Date.parse(issuer.validFrom) || Date.now() > Date.parse(issuer.validTo) || !current.checkIssued(issuer) || !current.verify(issuer.publicKey))
+                    if (!constraints.basicPresent || !issuer.ca || !constraints.keyUsagePresent || !constraints.keyCertSign || Date.now() < Date.parse(issuer.validFrom) - 300_000 || Date.now() > Date.parse(issuer.validTo) + 300_000 || !current.checkIssued(issuer) || !current.verify(issuer.publicKey))
                         throw new ValidationError('ownership certificate chain is invalid', { stringCode: 'invalid' });
                     current = issuer;
                 }
@@ -1200,9 +1220,9 @@ export class AuthFlow {
             if (status !== 'good')
                 throw unavailable('ownership certificate revocation status is unknown');
             const finalNow = Date.now();
-            if ([cert, ...chain].some((item) => finalNow < Date.parse(item.validFrom) || finalNow > Date.parse(item.validTo)))
+            if ([cert, ...chain].some((item) => finalNow < Date.parse(item.validFrom) - 300_000 || finalNow > Date.parse(item.validTo) + 300_000))
                 throw new ValidationError('ownership certificate chain is invalid', { stringCode: 'invalid' });
-            if (finalNow - began > 30_000 || finalNow / 1000 - observed > 30)
+            if (finalNow - began > 30_000 || finalNow / 1000 - observed > 330)
                 throw unavailable('ownership certificate verification window elapsed');
             return { certificate: { cert_pem: response.body, chain_valid: true, state, revoked: false, revocation_checked: true, observed_at: Math.trunc(observed) }, expiresAt: Math.min(began + 3600_000, (Math.trunc(observed) + 30) * 1000, evidence.currentUntil, evidence.nextRefreshAt, Date.parse(cert.validTo), ...chain.map((item) => Date.parse(item.validTo))) };
         }
@@ -1215,6 +1235,16 @@ export class AuthFlow {
         }
     }
     async _fetchOwnershipPki(url) {
+        if (!this._httpHandler)
+            return this._fetchOwnershipPkiDirect(url);
+        const perform = async () => {
+            const result = await this._fetchOwnershipPkiDirect(url);
+            return new Response([204, 205, 304].includes(result.status) ? null : result.body, { status: result.status, headers: result.headers });
+        };
+        const response = await this._httpHandler(url, { method: 'GET' }, perform);
+        return { status: response.status, headers: Object.fromEntries(response.headers), body: await response.text() };
+    }
+    async _fetchOwnershipPkiDirect(url) {
         const fetch = (target, originalHost) => new Promise((resolve, reject) => {
             const parsed = new URL(target);
             const module = parsed.protocol === 'https:' ? https : http;
@@ -1279,6 +1309,15 @@ export class AuthFlow {
      * 流程：连接 → 接收 challenge → 发送请求 → 接收响应 → 关闭。
      */
     async _shortRpc(gatewayUrl, method, params) {
+        const release = this._requestAdmission?.(`rpc:${method}`);
+        try {
+            return await this._shortRpcAdmitted(gatewayUrl, method, params);
+        }
+        finally {
+            release?.();
+        }
+    }
+    async _shortRpcAdmitted(gatewayUrl, method, params) {
         this._logger.debug(`_shortRpc enter: method=${method}, gateway=${gatewayUrl}`);
         if (this._connectionFactory === null) {
             const call = shortRpcViaNetworkActor(gatewayUrl, method, params);
@@ -1522,6 +1561,8 @@ export class AuthFlow {
             inline_realtime_payload_v1: true,
             agent_md_validation_v1: true,
             p2p_peer_pull_v1: true,
+            gateway_migrate_v1: true,
+            ...(this._requestAdmission && this._verifySsl && this._riskCapabilityEnabled?.() ? { risk_test_v1: true } : {}),
         };
         const request = {
             nonce,
@@ -1636,7 +1677,8 @@ export class AuthFlow {
     async _verifyAuthCertChain(gatewayUrl, authCert, chainAid = '', signedAt, _fresh = false, suppliedChain) {
         const epoch = this._strictPkiEpoch;
         const nowMs = signedAt === undefined ? Date.now() : signedAt * 1000;
-        _ensureCertTimeValid(authCert, 'auth certificate', nowMs);
+        const clockSkewMs = signedAt === undefined ? CERT_CLOCK_SKEW_MS : 0;
+        _ensureCertTimeValid(authCert, 'auth certificate', nowMs, clockSkewMs);
         const chain = suppliedChain ?? await this._loadGatewayCaChain(gatewayUrl, chainAid);
         if (!chain.length) {
             throw new AuthError('unable to verify auth certificate chain: missing CA chain');
@@ -1648,14 +1690,14 @@ export class AuthFlow {
         const expiresAt = Math.min(now + this._chainCacheTtl, Date.parse(authCert.validTo), ...chain.map((cert) => Date.parse(cert.validTo)));
         const chainExpiresAt = Math.min(now + this._chainCacheTtl, ...chain.map((cert) => Date.parse(cert.validTo)));
         for (const caCert of chain)
-            _ensureCertTimeValid(caCert, 'CA certificate', nowMs);
+            _ensureCertTimeValid(caCert, 'CA certificate', nowMs, clockSkewMs);
         // 检查缓存
         if ((this._chainVerifiedCache.get(certKey) ?? 0) > now)
             return;
         // 快速路径：CA 链已通过完整验证
         if ((this._gatewayCaVerified.get(cacheKey) ?? 0) > now) {
             const issuer = chain[0];
-            _ensureCertTimeValid(issuer, 'Issuer CA', nowMs);
+            _ensureCertTimeValid(issuer, 'Issuer CA', nowMs, clockSkewMs);
             if (!_isCaCert(issuer)) {
                 throw new AuthError('Issuer CA is not marked as CA (fast path)');
             }
@@ -1673,7 +1715,7 @@ export class AuthFlow {
         let current = authCert;
         for (let i = 0; i < chain.length; i++) {
             const caCert = chain[i];
-            _ensureCertTimeValid(caCert, `CA certificate[${i}]`, nowMs);
+            _ensureCertTimeValid(caCert, `CA certificate[${i}]`, nowMs, clockSkewMs);
             if (!_checkIssuedBy(current, caCert)) {
                 throw new AuthError(`auth certificate issuer mismatch at chain level ${i}`);
             }
@@ -1764,7 +1806,7 @@ export class AuthFlow {
         const response = fresh ? await this._fetchOwnershipPki(url) : undefined;
         if (response && response.status !== 200)
             throw new AuthError('service event certificate chain is unavailable');
-        const text = response ? response.body : await _fetchText(url, this._verifySsl, this._net);
+        const text = response ? response.body : await this._fetchRiskText(url);
         return _splitPemBundle(text);
     }
     /**
@@ -1819,7 +1861,7 @@ export class AuthFlow {
      */
     async _fetchGatewayCrl(gatewayUrl, _issuerCert, fresh = false) {
         const url = _gatewayHttpUrl(gatewayUrl, '/pki/crl.json');
-        const payload = fresh ? await this._fetchFreshPkiJson(url) : await _fetchJson(url, this._verifySsl, this._net);
+        const payload = fresh ? await this._fetchFreshPkiJson(url) : await this._fetchRiskJson(url);
         const crlPem = String(payload.crl_pem || '');
         if (!crlPem) {
             throw new AuthError('gateway CRL endpoint returned no signed CRL');
@@ -2010,7 +2052,7 @@ export class AuthFlow {
     async _fetchGatewayOcspStatus(gatewayUrl, authCert, issuerCert, strictCurrent = false) {
         const serialHex = _certSerialHex(authCert);
         const url = _gatewayHttpUrl(gatewayUrl, `/pki/ocsp/${serialHex}`);
-        const payload = strictCurrent ? await this._fetchFreshPkiJson(url) : await _fetchJson(url, this._verifySsl, this._net);
+        const payload = strictCurrent ? await this._fetchFreshPkiJson(url) : await this._fetchRiskJson(url);
         const status = String(payload.status || '');
         const ocspB64 = String(payload.ocsp_response || '');
         if (strictCurrent) {
@@ -2301,9 +2343,9 @@ export class AuthFlow {
             const now = Date.now();
             const validFrom = new Date(cert.validFrom).getTime();
             const validTo = new Date(cert.validTo).getTime();
-            if (now < validFrom)
+            if (now < validFrom - 300_000)
                 return 'cert not yet valid';
-            if (now > validTo)
+            if (now > validTo + 300_000)
                 return 'cert expired';
             return '';
         }
@@ -2367,7 +2409,7 @@ export class AuthFlow {
     async _downloadRegisteredCert(gatewayUrl, aid) {
         const certUrl = _gatewayHttpUrl(gatewayUrl, `/pki/cert/${aid}`);
         try {
-            const certPem = await _fetchText(certUrl, this._verifySsl);
+            const certPem = await this._fetchRiskText(certUrl);
             if (!certPem || !certPem.includes('BEGIN CERTIFICATE')) {
                 return null;
             }