@appstrate/afps-shared 0.5.0 → 0.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appstrate/afps-shared",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Zero-dependency AFPS helpers shared by @appstrate/core and @appstrate/afps-runtime (companion-file checks, semver resolution, SRI integrity, credential templates, delivery.http projection)",
   "license": "Apache-2.0",
   "type": "module",

package/src/delivery-http.ts

@@ -96,3 +96,35 @@ export function projectHttpDeliveryConfig(
   }
   return cfg;
 }
+
+/**
+ * Header names whose value is an RFC 9110 `credentials` production — an auth
+ * scheme token, one SP, then the credentials. Only in these positions is a
+ * bare token prefix a defect; anywhere else (`Cookie: session=`) it is an
+ * ordinary literal.
+ */
+const AUTH_SCHEME_HEADERS = new Set(["authorization", "proxy-authorization"]);
+
+/** RFC 9110 `token` grammar — matches a prefix that is nothing but a scheme. */
+const BARE_AUTH_SCHEME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+
+/**
+ * True when `prefix` is nothing but an auth-scheme token AND `headerName` is a
+ * position whose value is an RFC 9110 `credentials` production.
+ *
+ * `prefix` is a LITERAL prepended to the rendered credential (AFPS §7.6), so a
+ * bare `"Bearer"` renders `Authorization: BearerTOKEN` — a malformed credential
+ * every upstream answers with a 401 that names nothing. The injector
+ * (`@appstrate/afps-runtime`'s `planHttpDeliveryInjection`) concatenates
+ * verbatim and repairs nothing, so every path that accepts an author-written
+ * prefix must refuse the bare form up front instead. This is the one grammar
+ * those gates share: the integration manifest validator
+ * (`@appstrate/core/integration`, install time) and the portable runtime's
+ * local creds file (`resolvers/integration-api-call.ts`, load time).
+ *
+ * Callers pass the EFFECTIVE header name — the one that will actually be sent,
+ * after their own defaulting has been applied.
+ */
+export function isBareAuthSchemePrefix(headerName: string, prefix: string): boolean {
+  return AUTH_SCHEME_HEADERS.has(headerName.toLowerCase()) && BARE_AUTH_SCHEME.test(prefix);
+}

package/src/guarded-fetch.ts

@@ -80,7 +80,7 @@ export interface GuardedFetchOptions {
   fetchImpl?: typeof fetch;
   /**
    * Opt-in predicate for hosts the OPERATOR has explicitly trusted (e.g. an
-   * internal IdP on a private address via `OAUTH_ALLOWED_INTERNAL_IDP_HOSTS`).
+   * internal IdP on a private address via `EGRESS_ALLOW_INTERNAL_HOSTS`).
    * When it returns true the host blocklist is skipped for that hop, but the
    * manual-redirect discipline (cross-origin body/credential stripping) still
    * applies — so a trusted host that open-redirects cannot forward the secret.