@astrale-os/kernel-client 0.6.0-beta.75 → 0.6.0-beta.76

package/dist/session/exchange/issuer.d.ts

@@ -11,8 +11,8 @@ type IssuerDependencies = Pick<ExchangeDependencies, 'kernel' | 'fetch' | 'polic
 export declare function tokenEndpoint(dependencies: IssuerDependencies, domain: IssuerId, operation: SessionOperation): Promise<string>;
 /**
  * Present a delegation at a Domain's token endpoint and admit the returned credential as provider
- * evidence: its issuer must be that Domain, its audience the source Kernel, and its signed expiry
- * the reported one.
+ * evidence: it must be the exchange representation served with `Cache-Control: no-store`, its
+ * issuer that Domain, its audience the source Kernel, and its signed expiry the reported one.
  */
 export declare function redeem(dependencies: IssuerDependencies, domain: IssuerId, endpoint: string, delegation: MintedCredential, operation: SessionOperation): Promise<SessionCredential>;
 export {};

package/dist/session/exchange/issuer.js

@@ -23,11 +23,14 @@ export async function tokenEndpoint(dependencies, domain, operation) {
 }
 /**
  * Present a delegation at a Domain's token endpoint and admit the returned credential as provider
- * evidence: its issuer must be that Domain, its audience the source Kernel, and its signed expiry
- * the reported one.
+ * evidence: it must be the exchange representation served with `Cache-Control: no-store`, its
+ * issuer that Domain, its audience the source Kernel, and its signed expiry the reported one.
  */
 export async function redeem(dependencies, domain, endpoint, delegation, operation) {
-    const exchanged = await fetchAdmitted(dependencies, TOKEN_EXCHANGE, endpoint, operation, (body) => issuer.exchange.acceptResponse(body), delegation);
+    const exchanged = await fetchAdmitted(dependencies, TOKEN_EXCHANGE, endpoint, operation, (body, headers) => {
+        requireCredentialHeaders(headers);
+        return issuer.exchange.acceptResponse(body);
+    }, delegation);
     let claims;
     try {
         claims = inspect(exchanged.token);
@@ -78,7 +81,7 @@ async function fetchAdmitted(dependencies, leg, url, operation, admit, credentia
             requireExactResponse(response, url, 'Domain token exchange');
             if (!response.ok)
                 throw await refusal(response, leg, signal);
-            return admit(codecs.json.decode(await boundedResponse(response, dependencies.maximumResponseBytes, signal)));
+            return admit(codecs.json.decode(await boundedResponse(response, dependencies.maximumResponseBytes, signal)), response.headers);
         }
         catch (cause) {
             throw signal.aborted ? cause : unadmitted(cause, leg);
@@ -124,6 +127,20 @@ function unadmitted(cause, leg) {
     }
     return cause;
 }
+/** A credential is served as the exchange representation and never stored by an HTTP cache. */
+function requireCredentialHeaders(headers) {
+    const mediaType = headers.get('content-type')?.split(';', 1)[0].trim().toLowerCase();
+    if (mediaType !== issuer.exchange.MEDIA_TYPE) {
+        throw invalidResponse('Domain token exchange returned an unsupported Content-Type.');
+    }
+    const directives = headers
+        .get('cache-control')
+        ?.split(',')
+        .map((directive) => directive.trim().toLowerCase()) ?? [];
+    if (!directives.includes('no-store')) {
+        throw invalidResponse('Domain token exchange response is missing Cache-Control: no-store.');
+    }
+}
 function invalidResponse(message, cause) {
     return new ExchangeError(message, {
         failure: 'invalid-response',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-client",
-  "version": "0.6.0-beta.75",
+  "version": "0.6.0-beta.76",
   "description": "Universal Client — protocol-first, transport-agnostic",
   "keywords": [
     "astrale",