@amalgm/core 0.4.3 → 0.4.4

package/PURPOSE.md

@@ -127,6 +127,8 @@ that composes an exact Core release with the other product releases.
    credential may mint an audience- and scope-exact access token, but every
    resource request also proves possession of that machine's key; Core owns
    the claims and renewal law while hosts own keys, storage, signing, and HTTP.
+   Behind a proxy, the configured public origin is authority for the DPoP URL;
+   caller-controlled forwarding headers are not.
 23. **Machine key replacement is an explicit recovery, never startup repair.**
     Ordinary registration may pin an absent key or reuse the same key; replacing
     it requires fresh user approval, proof of the candidate private key, and a

package/dist/identity/authorization/dpop.d.ts

@@ -17,4 +17,10 @@ export interface DpopSignerPort {
 /** RFC 9449 htu excludes query and fragment and uses an absolute URI. */
 export declare function normalizeDpopHtu(value: string): string;
 export declare function normalizeDpopMethod(value: string): string;
+/**
+ * Reconstruct the public resource URL behind a reverse proxy without trusting
+ * caller-controlled forwarding headers. Deployment config owns the origin;
+ * the HTTP request contributes only its origin-form path and query.
+ */
+export declare function publicResourceRequestUrl(publicOrigin: string, requestTarget: string): string;
 //# sourceMappingURL=dpop.d.ts.map

package/dist/identity/authorization/dpop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../../../src/identity/authorization/dpop.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUtD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIzD"}
+{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../../../src/identity/authorization/dpop.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUtD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIzD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAe5F"}

package/dist/identity/authorization/dpop.js

@@ -16,4 +16,24 @@ export function normalizeDpopMethod(value) {
         throw new TypeError('DPoP method is invalid');
     return method;
 }
+/**
+ * Reconstruct the public resource URL behind a reverse proxy without trusting
+ * caller-controlled forwarding headers. Deployment config owns the origin;
+ * the HTTP request contributes only its origin-form path and query.
+ */
+export function publicResourceRequestUrl(publicOrigin, requestTarget) {
+    const origin = new URL(publicOrigin);
+    const loopback = origin.hostname === 'localhost' || origin.hostname === '127.0.0.1';
+    if ((origin.protocol !== 'https:' && !(loopback && origin.protocol === 'http:'))
+        || origin.username
+        || origin.password
+        || origin.pathname !== '/'
+        || origin.search
+        || origin.hash)
+        throw new TypeError('Public resource origin must be an HTTPS origin');
+    if (!requestTarget.startsWith('/') || requestTarget.startsWith('//')) {
+        throw new TypeError('Resource request target must use origin form');
+    }
+    return new URL(requestTarget, origin).toString();
+}
 //# sourceMappingURL=dpop.js.map

package/dist/identity/authorization/dpop.js.map

@@ -1 +1 @@
-{"version":3,"file":"dpop.js","sourceRoot":"","sources":["../../../src/identity/authorization/dpop.ts"],"names":[],"mappings":"AAmBA,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"dpop.js","sourceRoot":"","sources":["../../../src/identity/authorization/dpop.ts"],"names":[],"mappings":"AAmBA,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,YAAoB,EAAE,aAAqB;IAClF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;IACpF,IACE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;WACzE,MAAM,CAAC,QAAQ;WACf,MAAM,CAAC,QAAQ;WACf,MAAM,CAAC,QAAQ,KAAK,GAAG;WACvB,MAAM,CAAC,MAAM;WACb,MAAM,CAAC,IAAI;QACd,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;AACnD,CAAC"}

package/docs/authorization.md

@@ -16,14 +16,16 @@ needs.
    set, expiry, token id, signing key, and device-key thumbprint.
 3. Every resource request has a fresh DPoP proof bound to its method, URL,
    access token, and machine key.
-4. The broker caches an exact grant, refreshes before expiry with jitter,
+4. A proxied resource reconstructs that URL from its configured public origin
+   and the origin-form request target; forwarding headers are not authority.
+5. The broker caches an exact grant, refreshes before expiry with jitter,
    single-flights concurrent renewal, and performs no silent auth fallback.
-5. Audiences and scopes are closed sets. Adding a consumer changes this module
+6. Audiences and scopes are closed sets. Adding a consumer changes this module
    and its tests before any issuer or verifier accepts it.
-6. A machine key is pinned once. Replacement requires an explicit, browser-
+7. A machine key is pinned once. Replacement requires an explicit, browser-
    approved recovery bound to the expected old thumbprint and a different
    candidate key; retrying an already completed replacement is idempotent.
-7. Provider access is memory-only. Registration and machine resume never
+8. Provider access is memory-only. Registration and machine resume never
    persist an access token, DPoP proof, or provider proxy credential; resume
    removes retired proxy and HMAC fields left by older installations.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/core",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "The Amalgm kernel SDK — identity, transport, supervision, and host capability contracts behind host-injected adapters.",
   "type": "module",
   "license": "UNLICENSED",