@aiwg/cockpit 2026.9.15 → 2026.9.17

package/bridge/src/desktop-identity-keycloak.mjs

@@ -9,8 +9,9 @@
 // use and never logged or returned. Section9 realm defaults come from itops
 // (`config/matric-user-secrets.yaml`, `configs/keycloak/realms/section9.json`).
 
-import { createPublicKey, verify as cryptoVerify } from 'node:crypto';
+import { createHash, createPublicKey, verify as cryptoVerify } from 'node:crypto';
 import { readFile, stat } from 'node:fs/promises';
+import { createDesktopIssuerTransport } from './desktop-issuer-transport.mjs';
 
 export const SECTION9_ISSUER = 'https://auth.s9.internal/realms/section9';
 export const DESKTOP_ACTIONS = Object.freeze(['view', 'create', 'close', 'attach', 'control', 'observe']);
@@ -28,6 +29,14 @@ const denied = (code = 'denied') => Object.assign(new Error(code), { code });
 const text = (value) => typeof value === 'string' && value.length > 0 && value.length <= 4096;
 const b64url = (value) => Buffer.from(value, 'base64url');
 
+/** Input comes only from the authenticated backend browser binding. */
+export function desktopBrowserAudience({ browserSessionId, audience, workspaceId }) {
+  if (![browserSessionId, audience, workspaceId].every(text)) throw denied();
+  return `desktop-browser-v1:${createHash('sha256').update(JSON.stringify([
+    'desktop-browser-v1', browserSessionId, audience, workspaceId,
+  ])).digest('hex')}`;
+}
+
 function decodeJwt(token) {
   if (!text(token)) throw denied();
   const parts = token.split('.');
@@ -117,7 +126,9 @@ export function createKeycloakDesktopVerifier({
   clientId,
   clientSecretFile,
   delegationAudience,
-  fetch: fetchImpl = globalThis.fetch,
+  fetch: suppliedFetch,
+  issuerTls,
+  workloadCertificateThumbprint,
   now = Date.now,
   timeoutMs = 5000,
   jwksTtlMs = 300_000,
@@ -129,10 +140,12 @@ export function createKeycloakDesktopVerifier({
 } = {}) {
   let base;
   try { base = new URL(issuer); } catch { throw new TypeError('Keycloak issuer must be an HTTPS realm URL'); }
-  if (base.protocol !== 'https:' || base.search || base.hash || !/\/realms\/[^/]+$/.test(base.pathname)) throw new TypeError('Keycloak issuer must be an HTTPS realm URL');
+  if (base.protocol !== 'https:' || base.username || base.password || base.search || base.hash || !/\/realms\/[^/]+$/.test(base.pathname)) throw new TypeError('Keycloak issuer must be an HTTPS realm URL');
   for (const [name, value] of Object.entries({ audience, clientId, clientSecretFile, delegationAudience })) {
     if (!text(value)) throw new TypeError(`Keycloak desktop verifier requires ${name}`);
   }
+  if (!/^[A-Za-z0-9_-]{43}$/.test(workloadCertificateThumbprint)) throw new TypeError('Workload certificate thumbprint required');
+  const fetchImpl = suppliedFetch ?? createDesktopIssuerTransport({ ...issuerTls, issuer, thumbprint: workloadCertificateThumbprint, timeoutMs });
   if (typeof fetchImpl !== 'function') throw new TypeError('fetch implementation required');
   if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 30000) throw new TypeError('Invalid Keycloak deadline');
   const realm = issuer.replace(/\/$/, '');
@@ -224,16 +237,26 @@ export function createKeycloakDesktopVerifier({
     return claims;
   }
 
-  async function delegation(entry, signal) {
+  async function delegation(entry, claims, expected, signal) {
+    const browserAudience = desktopBrowserAudience(expected);
     const skew = clockSkewMs;
     if (entry.delegation && entry.delegationExpiresAt - skew > now()) return { delegation: entry.delegation, delegationExpiresAt: entry.delegationExpiresAt };
     const exchanged = await grant({
       grant_type: TOKEN_EXCHANGE, subject_token: entry.accessToken, subject_token_type: ACCESS_TOKEN_TYPE,
       requested_token_type: ACCESS_TOKEN_TYPE, audience: delegationAudience,
+      desktop_browser_session_audience: browserAudience,
     }, signal);
     if (!text(exchanged?.access_token) || !Number.isFinite(exchanged.expires_in) || exchanged.expires_in <= 0) throw denied('identity_unavailable');
+    const payload = verifyJws(exchanged.access_token, await keys(signal));
+    const aud = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+    if (payload.iss !== realm || aud.length !== 1 || aud[0] !== delegationAudience ||
+        payload.azp !== clientId || payload.sub !== claims.sub || payload.sid !== (claims.sid ?? claims.session_state) ||
+        payload.workspace_id !== expected.workspaceId || payload.desktop_browser_session_audience !== browserAudience ||
+        payload.cnf?.['x5t#S256'] !== workloadCertificateThumbprint ||
+        !Number.isFinite(payload.exp) || payload.exp * 1000 <= now() ||
+        payload.nbf !== undefined && (!Number.isFinite(payload.nbf) || payload.nbf * 1000 > now())) throw denied();
     entry.delegation = exchanged.access_token;
-    entry.delegationExpiresAt = now() + exchanged.expires_in * 1000;
+    entry.delegationExpiresAt = Math.min(now() + exchanged.expires_in * 1000, payload.exp * 1000);
     return { delegation: entry.delegation, delegationExpiresAt: entry.delegationExpiresAt };
   }
 
@@ -245,11 +268,16 @@ export function createKeycloakDesktopVerifier({
       const payload = verifyJws(evidence.accessToken, await keys(signal));
       if (payload.iss !== realm || !audienceMatches(payload.aud, audience)) throw denied();
       entry = { accessToken: evidence.accessToken, refreshToken: text(evidence.refreshToken) ? evidence.refreshToken : undefined,
+        subject: payload.sub, userSessionId: payload.sid ?? payload.session_state, browserAudience: desktopBrowserAudience(expected),
         authTime: Number.isFinite(payload.auth_time) ? payload.auth_time * 1000 : now() };
-    } else if (!entry) throw denied();
+    } else if (!entry || entry.browserAudience !== desktopBrowserAudience(expected)) throw denied();
     let claims;
     try { claims = await freshClaims(entry, signal); }
     catch (error) { sessions.delete(expected.browserSessionId); throw error; }
+    if (claims.sub !== entry.subject || (claims.sid ?? claims.session_state) !== entry.userSessionId) {
+      sessions.delete(expected.browserSessionId);
+      throw denied();
+    }
     const checkedAt = now();
     const mapped = mapClaims(claims) ?? {};
     const instanceIds = typeof resolveInstances === 'function'
@@ -262,7 +290,7 @@ export function createKeycloakDesktopVerifier({
       sessions.delete(expected.browserSessionId);
       throw denied();
     }
-    const { delegation: token, delegationExpiresAt } = await delegation(entry, signal);
+    const { delegation: token, delegationExpiresAt } = await delegation(entry, claims, expected, signal);
     const expiresAt = Math.min(entry.authTime + sessionMaxMs, checkedAt + sessionMaxMs);
     if (operation === 'bind') sessions.set(expected.browserSessionId, entry);
     return {

package/bridge/src/desktop-issuer-transport.mjs

@@ -0,0 +1,62 @@
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { X509Certificate } from 'node:crypto';
+import { request } from 'node:https';
+
+const unavailable = () => Object.assign(new Error('identity_unavailable'), { code: 'identity_unavailable' });
+
+async function credential(file, secret = false) {
+  const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  try {
+    const info = await handle.stat();
+    if (!info.isFile() || info.nlink !== 1 || ![0, process.getuid()].includes(info.uid) ||
+        (info.mode & (secret ? 0o077 : 0o022)) || info.size < 1 || info.size > 65536) throw unavailable();
+    const buffer = Buffer.alloc(65537);
+    const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+    if (bytesRead > 65536) throw unavailable();
+    return buffer.subarray(0, bytesRead);
+  } finally { await handle.close(); }
+}
+
+/** Backend-only HTTPS transport, pinned to one realm and one workload leaf. */
+export function createDesktopIssuerTransport({ issuer, certificateFile, keyFile, caFile, thumbprint, timeoutMs = 5000 }) {
+  const realm = new URL(issuer);
+  if (realm.protocol !== 'https:' || realm.username || realm.password || realm.search || realm.hash ||
+      !/\/realms\/[^/]+$/.test(realm.pathname) || !certificateFile || !keyFile ||
+      !/^[A-Za-z0-9_-]{43}$/.test(thumbprint) || !Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 30000) {
+    throw new TypeError('Explicit desktop issuer TLS configuration required');
+  }
+  return async (url, init = {}) => {
+    try {
+      const target = new URL(url);
+      if (target.origin !== realm.origin || !target.pathname.startsWith(`${realm.pathname}/protocol/openid-connect/`) ||
+          target.username || target.password || target.search || target.hash || init.signal?.aborted) throw unavailable();
+      const [cert, key, ca] = await Promise.all([
+        credential(certificateFile), credential(keyFile, true), caFile ? credential(caFile) : undefined,
+      ]);
+      const leaf = new X509Certificate(cert);
+      const pin = Buffer.from(leaf.fingerprint256.replaceAll(':', ''), 'hex').toString('base64url');
+      if (pin !== thumbprint || Date.parse(leaf.validFrom) > Date.now() || Date.parse(leaf.validTo) <= Date.now()) throw unavailable();
+      return await new Promise((resolve, reject) => {
+        const req = request(target, { method: init.method ?? 'GET', headers: init.headers, cert, key, ca,
+          rejectUnauthorized: true, minVersion: 'TLSv1.2', agent: false, signal: init.signal }, (res) => {
+          const chunks = []; let size = 0;
+          res.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > 65536) req.destroy(unavailable());
+            else chunks.push(chunk);
+          });
+          res.on('error', () => reject(unavailable()));
+          res.on('end', () => {
+            if (size > 65536 || res.statusCode >= 300 && res.statusCode < 400) return reject(unavailable());
+            resolve(new Response(res.statusCode === 204 ? null : Buffer.concat(chunks), { status: res.statusCode }));
+          });
+        });
+        const timer = setTimeout(() => req.destroy(unavailable()), timeoutMs);
+        req.on('close', () => clearTimeout(timer));
+        req.on('error', () => reject(unavailable()));
+        req.end(init.body);
+      });
+    } catch { throw unavailable(); }
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cockpit",
-  "version": "2026.9.15",
+  "version": "2026.9.17",
   "description": "AIWG Cockpit — UX-first control plane over AIWG + multi-stack agentic sessions. Opt-in, separately published; NOT shipped in the base aiwg npm package (guarded by test/smoke/cockpit-base-footprint.test.js).",
   "type": "module",
   "license": "MIT",