@atlasauth/backend 0.2.0 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/client/api-keys.d.ts +50 -1
- package/dist/client/api-keys.js +14 -0
- package/dist/client/api-keys.js.map +1 -1
- package/dist/client/index.d.ts +40 -2
- package/dist/client/index.js +4 -0
- package/dist/client/index.js.map +1 -1
- package/dist/client/machines.d.ts +183 -0
- package/dist/client/machines.js +73 -0
- package/dist/client/machines.js.map +1 -0
- package/dist/client/messaging.d.ts +287 -21
- package/dist/client/messaging.js +18 -6
- package/dist/client/messaging.js.map +1 -1
- package/dist/discovery.d.ts +49 -0
- package/dist/discovery.js +143 -0
- package/dist/discovery.js.map +1 -0
- package/dist/index.d.ts +5 -0
- package/dist/index.js +15 -1
- package/dist/index.js.map +1 -1
- package/dist/jwks-cache.d.ts +8 -0
- package/dist/jwks-cache.js +20 -3
- package/dist/jwks-cache.js.map +1 -1
- package/dist/pca/require-pca.d.ts +47 -0
- package/dist/pca/require-pca.js +121 -0
- package/dist/pca/require-pca.js.map +1 -0
- package/dist/pca/verify.d.ts +36 -0
- package/dist/pca/verify.js +136 -0
- package/dist/pca/verify.js.map +1 -0
- package/dist/verify.d.ts +19 -3
- package/dist/verify.js +27 -5
- package/dist/verify.js.map +1 -1
- package/package.json +3 -2
package/dist/jwks-cache.js
CHANGED
|
@@ -29,6 +29,8 @@ class JwksCache {
|
|
|
29
29
|
lastAttemptAt = 0;
|
|
30
30
|
/** Exposed so a caller can assert the rate limit actually bit. */
|
|
31
31
|
lastOutcome = 'fresh';
|
|
32
|
+
/** Why the last attempt produced no keys (e.g. a discovery failure), for diagnostics. */
|
|
33
|
+
lastError = null;
|
|
32
34
|
constructor(deps) {
|
|
33
35
|
this.deps = deps;
|
|
34
36
|
}
|
|
@@ -62,13 +64,12 @@ class JwksCache {
|
|
|
62
64
|
this.lastOutcome = 'cached';
|
|
63
65
|
return this.deps.staticJwks;
|
|
64
66
|
}
|
|
65
|
-
if (this.deps.url === undefined) {
|
|
67
|
+
if (this.deps.url === undefined && this.deps.resolveUrl === undefined) {
|
|
66
68
|
// Neither a URL nor a static set: nothing to verify against. Report
|
|
67
69
|
// "no keys" rather than attempting `fetch(undefined)`.
|
|
68
70
|
this.lastOutcome = 'failed';
|
|
69
71
|
return null;
|
|
70
72
|
}
|
|
71
|
-
const url = this.deps.url;
|
|
72
73
|
const now = this.now;
|
|
73
74
|
const ttl = this.deps.ttlMs ?? exports.DEFAULT_TTL_MS;
|
|
74
75
|
const interval = this.deps.refetchIntervalMs ?? exports.REFETCH_INTERVAL_MS;
|
|
@@ -88,6 +89,20 @@ class JwksCache {
|
|
|
88
89
|
return this.cached;
|
|
89
90
|
}
|
|
90
91
|
this.lastAttemptAt = now;
|
|
92
|
+
let url;
|
|
93
|
+
if (this.deps.url !== undefined) {
|
|
94
|
+
url = this.deps.url;
|
|
95
|
+
}
|
|
96
|
+
else {
|
|
97
|
+
try {
|
|
98
|
+
url = await this.deps.resolveUrl();
|
|
99
|
+
}
|
|
100
|
+
catch (error) {
|
|
101
|
+
this.lastOutcome = 'failed';
|
|
102
|
+
this.lastError = error instanceof Error ? error.message : String(error);
|
|
103
|
+
return this.cached;
|
|
104
|
+
}
|
|
105
|
+
}
|
|
91
106
|
try {
|
|
92
107
|
const response = await (this.deps.fetchImpl ?? fetch)(url, {
|
|
93
108
|
headers: { accept: 'application/json' },
|
|
@@ -99,13 +114,15 @@ class JwksCache {
|
|
|
99
114
|
throw new Error('JWKS is malformed');
|
|
100
115
|
this.cached = body;
|
|
101
116
|
this.fetchedAt = now;
|
|
117
|
+
this.lastError = null;
|
|
102
118
|
this.lastOutcome = kidMiss ? 'refetched' : 'fresh';
|
|
103
119
|
return this.cached;
|
|
104
120
|
}
|
|
105
|
-
catch {
|
|
121
|
+
catch (error) {
|
|
106
122
|
// Keep serving what we have. A JWKS outage should degrade to "new keys
|
|
107
123
|
// do not work yet", not "nobody can authenticate".
|
|
108
124
|
this.lastOutcome = 'failed';
|
|
125
|
+
this.lastError = `JWKS fetch from ${url} failed: ${error instanceof Error ? error.message : String(error)}`;
|
|
109
126
|
return this.cached;
|
|
110
127
|
}
|
|
111
128
|
}
|
package/dist/jwks-cache.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwks-cache.js","sourceRoot":"","sources":["../src/jwks-cache.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;
|
|
1
|
+
{"version":3,"file":"jwks-cache.js","sourceRoot":"","sources":["../src/jwks-cache.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAwJH,0BAWC;AAjKD,wEAAwE;AAC3D,QAAA,mBAAmB,GAAG,MAAM,CAAC;AAE1C,+EAA+E;AAClE,QAAA,cAAc,GAAG,SAAS,CAAC;AA8BxC,MAAa,SAAS;IASS;IARrB,MAAM,GAAgB,IAAI,CAAC;IAC3B,SAAS,GAAG,CAAC,CAAC;IACd,aAAa,GAAG,CAAC,CAAC;IAC1B,kEAAkE;IAClE,WAAW,GAAiB,OAAO,CAAC;IACpC,yFAAyF;IACzF,SAAS,GAAkB,IAAI,CAAC;IAEhC,YAA6B,IAAmB;QAAnB,SAAI,GAAJ,IAAI,CAAe;IAAG,CAAC;IAEpD,IAAY,GAAG;QACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAEO,GAAG,CAAC,GAAuB;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CAAC,GAAY;QACpB;;;;;WAKG;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAC9B,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACtE,oEAAoE;YACpE,uDAAuD;YACvD,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,sBAAc,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,2BAAmB,CAAC;QAEpE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC;QAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED;;;;WAIG;QACH,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,QAAQ,EAAE,CAAC;YAC/D,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;YAC/B,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;QAEzB,IAAI,GAAW,CAAC;QAChB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAChC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAW,EAAE,CAAC;YACtC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;gBAC5B,IAAI,CAAC,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC,MAAM,CAAC;YACrB,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE;gBACzD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAE5E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAS,CAAC;YAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAE7E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;YACrB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YACnD,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,mDAAmD;YACnD,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,IAAI,CAAC,SAAS,GAAG,mBAAmB,GAAG,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5G,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,QAAQ;QACN,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC5E,CAAC;CACF;AAjHD,8BAiHC;AAED,mEAAmE;AACnE,SAAgB,OAAO,CAAC,GAAW;IACjC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjE,CAAC;QACtB,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
import { type Capability, type PCActn, type TrustBudget, type VerifyHooks } from '@atlasauth/pca';
|
|
2
|
+
import { type PcaContext, type PcaVerdict } from './verify';
|
|
3
|
+
/** Framework-agnostic request shape: anything with headers and (optionally) a parsed/raw body. */
|
|
4
|
+
export interface PcaRequestLike {
|
|
5
|
+
headers: Record<string, string | string[] | undefined> | {
|
|
6
|
+
get(name: string): string | null;
|
|
7
|
+
};
|
|
8
|
+
body?: unknown;
|
|
9
|
+
}
|
|
10
|
+
/** Per-holder replay + budget state. Implement over Redis/DB; the in-memory one is for tests/single node. */
|
|
11
|
+
export interface PcaStateStore {
|
|
12
|
+
get(key: string): Promise<{
|
|
13
|
+
budget?: TrustBudget;
|
|
14
|
+
lastCounter?: number;
|
|
15
|
+
} | undefined>;
|
|
16
|
+
put(key: string, state: {
|
|
17
|
+
budget?: TrustBudget;
|
|
18
|
+
lastCounter?: number;
|
|
19
|
+
}): Promise<void>;
|
|
20
|
+
}
|
|
21
|
+
export declare function memoryPcaStore(): PcaStateStore;
|
|
22
|
+
export interface RequirePcaOptions {
|
|
23
|
+
/** Resolve the Root Intent Grant from the PCActn's `grant_ref`. null = unknown grant. */
|
|
24
|
+
resolveGrant: (grantRef: string, pcactn: PCActn) => Promise<Capability | null>;
|
|
25
|
+
hooks?: VerifyHooks;
|
|
26
|
+
extract?: (req: PcaRequestLike) => PCActn | string | null;
|
|
27
|
+
/** Anti-replay counter + budget persistence. Without it counters are not checked (surfaced in checks). */
|
|
28
|
+
budgetStore?: PcaStateStore;
|
|
29
|
+
/** Build verification context (params, plan, risk) per request. */
|
|
30
|
+
context?: (req: PcaRequestLike, pcactn: PCActn) => PcaContext | Promise<PcaContext>;
|
|
31
|
+
now?: () => number;
|
|
32
|
+
/** WWW-Authenticate realm (default "pca"). */
|
|
33
|
+
realm?: string;
|
|
34
|
+
}
|
|
35
|
+
export type PcaGuardResult = {
|
|
36
|
+
ok: true;
|
|
37
|
+
verdict: PcaVerdict;
|
|
38
|
+
pcactn: PCActn;
|
|
39
|
+
} | {
|
|
40
|
+
ok: false;
|
|
41
|
+
status: 401 | 403;
|
|
42
|
+
verdict: PcaVerdict;
|
|
43
|
+
wwwAuthenticate?: string;
|
|
44
|
+
};
|
|
45
|
+
/** Default extraction: `PCA-Action: <base64url PCActn JSON>` header, else JSON body `{ pcactn }`. */
|
|
46
|
+
export declare function defaultExtract(req: PcaRequestLike): PCActn | string | null;
|
|
47
|
+
export declare function requirePCA(opts: RequirePcaOptions): (req: PcaRequestLike) => Promise<PcaGuardResult>;
|
|
@@ -0,0 +1,121 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.memoryPcaStore = memoryPcaStore;
|
|
4
|
+
exports.defaultExtract = defaultExtract;
|
|
5
|
+
exports.requirePCA = requirePCA;
|
|
6
|
+
const pca_1 = require("@atlasauth/pca");
|
|
7
|
+
const verify_1 = require("./verify");
|
|
8
|
+
function memoryPcaStore() {
|
|
9
|
+
const m = new Map();
|
|
10
|
+
return { get: async (k) => m.get(k), put: async (k, v) => void m.set(k, v) };
|
|
11
|
+
}
|
|
12
|
+
function header(req, name) {
|
|
13
|
+
const h = req.headers;
|
|
14
|
+
if (typeof h.get === 'function')
|
|
15
|
+
return h.get(name) ?? undefined;
|
|
16
|
+
const v = h[name] ?? h[name.toLowerCase()];
|
|
17
|
+
return Array.isArray(v) ? v[0] : v;
|
|
18
|
+
}
|
|
19
|
+
function fromB64u(s) {
|
|
20
|
+
const b = s.replace(/-/g, '+').replace(/_/g, '/');
|
|
21
|
+
return Buffer.from(b, 'base64').toString('utf8');
|
|
22
|
+
}
|
|
23
|
+
/** Default extraction: `PCA-Action: <base64url PCActn JSON>` header, else JSON body `{ pcactn }`. */
|
|
24
|
+
function defaultExtract(req) {
|
|
25
|
+
const h = header(req, 'pca-action');
|
|
26
|
+
if (h)
|
|
27
|
+
return fromB64u(h.trim());
|
|
28
|
+
let b = req.body;
|
|
29
|
+
if (typeof b === 'string') {
|
|
30
|
+
try {
|
|
31
|
+
b = JSON.parse(b);
|
|
32
|
+
}
|
|
33
|
+
catch {
|
|
34
|
+
return null;
|
|
35
|
+
}
|
|
36
|
+
}
|
|
37
|
+
const x = b?.pcactn;
|
|
38
|
+
if (typeof x === 'string' || (x !== null && typeof x === 'object'))
|
|
39
|
+
return x;
|
|
40
|
+
return null;
|
|
41
|
+
}
|
|
42
|
+
const denyVerdict = (reason) => ({
|
|
43
|
+
allow: false,
|
|
44
|
+
r: 1,
|
|
45
|
+
requiredThreshold: { t: 3, proof: 'strong', optimisticAllowed: false },
|
|
46
|
+
checks: { pcactn: 'fail' },
|
|
47
|
+
reasons: [reason],
|
|
48
|
+
});
|
|
49
|
+
function requirePCA(opts) {
|
|
50
|
+
const realm = opts.realm ?? 'pca';
|
|
51
|
+
const challenge = (error) => `PCA realm="${realm}"${error ? `, error="${error}"` : ''}, hint="send PCA-Action: <base64url PCActn> or JSON body {pcactn}"`;
|
|
52
|
+
const unauth = (reason, error = 'invalid_request') => ({
|
|
53
|
+
ok: false,
|
|
54
|
+
status: 401,
|
|
55
|
+
verdict: denyVerdict(reason),
|
|
56
|
+
wwwAuthenticate: challenge(error),
|
|
57
|
+
});
|
|
58
|
+
return async (req) => {
|
|
59
|
+
try {
|
|
60
|
+
let raw;
|
|
61
|
+
try {
|
|
62
|
+
raw = (opts.extract ?? defaultExtract)(req);
|
|
63
|
+
}
|
|
64
|
+
catch (e) {
|
|
65
|
+
return unauth(`unreadable PCActn: ${e.message}`);
|
|
66
|
+
}
|
|
67
|
+
if (raw === null || raw === undefined)
|
|
68
|
+
return unauth('no PCActn presented', 'missing_pcactn');
|
|
69
|
+
let p;
|
|
70
|
+
try {
|
|
71
|
+
p = typeof raw === 'string' ? (0, pca_1.decodePCActn)(raw) : raw;
|
|
72
|
+
}
|
|
73
|
+
catch (e) {
|
|
74
|
+
return unauth(`undecodable PCActn: ${e.message}`, 'invalid_pcactn');
|
|
75
|
+
}
|
|
76
|
+
if (p === null || typeof p !== 'object' || typeof p.grant_ref !== 'string') {
|
|
77
|
+
return unauth('malformed PCActn', 'invalid_pcactn');
|
|
78
|
+
}
|
|
79
|
+
const grant = await opts.resolveGrant(p.grant_ref, p);
|
|
80
|
+
if (!grant)
|
|
81
|
+
return unauth('unknown grant_ref', 'unknown_grant');
|
|
82
|
+
const now = opts.now?.() ?? Date.now();
|
|
83
|
+
const leafHolder = p.cap_chain?.[p.cap_chain.length - 1]?.holder;
|
|
84
|
+
const key = `${grant.id}:${leafHolder ?? ''}`;
|
|
85
|
+
const state = opts.budgetStore && leafHolder ? await opts.budgetStore.get(key) : undefined;
|
|
86
|
+
const ctx = { ...(await opts.context?.(req, p)) };
|
|
87
|
+
if (state?.budget && ctx.budget === undefined)
|
|
88
|
+
ctx.budget = state.budget;
|
|
89
|
+
const verdict = await (0, verify_1.verifyPCActn)(p, { grant, hooks: opts.hooks, now, context: ctx });
|
|
90
|
+
// Anti-replay (Appendix A step 5): strictly increasing per holder.
|
|
91
|
+
if (opts.budgetStore) {
|
|
92
|
+
if (state?.lastCounter !== undefined && !(p.counter > state.lastCounter)) {
|
|
93
|
+
verdict.allow = false;
|
|
94
|
+
verdict.checks.counter = 'fail';
|
|
95
|
+
verdict.reasons.push(`counter: ${String(p.counter)} is not greater than last seen ${state.lastCounter} (replay)`);
|
|
96
|
+
}
|
|
97
|
+
else if (verdict.checks.counter === 'pass') {
|
|
98
|
+
verdict.checks.counter = 'pass';
|
|
99
|
+
}
|
|
100
|
+
}
|
|
101
|
+
else if (verdict.checks.counter === 'pass') {
|
|
102
|
+
verdict.checks.counter = 'not-enforced';
|
|
103
|
+
}
|
|
104
|
+
if (!verdict.allow) {
|
|
105
|
+
// A bad signature / chain is an authentication failure; policy denial is authorization.
|
|
106
|
+
const authnFailed = ['version', 'cap_chain', 'leaf_signature', 'malformed', 'grant_ref'].some((c) => verdict.checks[c] === 'fail');
|
|
107
|
+
return authnFailed
|
|
108
|
+
? { ok: false, status: 401, verdict, wwwAuthenticate: challenge('invalid_pcactn') }
|
|
109
|
+
: { ok: false, status: 403, verdict };
|
|
110
|
+
}
|
|
111
|
+
if (opts.budgetStore && leafHolder) {
|
|
112
|
+
await opts.budgetStore.put(key, { budget: verdict.budget ?? state?.budget, lastCounter: p.counter });
|
|
113
|
+
}
|
|
114
|
+
return { ok: true, verdict, pcactn: p };
|
|
115
|
+
}
|
|
116
|
+
catch (e) {
|
|
117
|
+
return { ok: false, status: 403, verdict: denyVerdict(`guard error (fail closed): ${e instanceof Error ? e.message : 'unknown'}`) };
|
|
118
|
+
}
|
|
119
|
+
};
|
|
120
|
+
}
|
|
121
|
+
//# sourceMappingURL=require-pca.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"require-pca.js","sourceRoot":"","sources":["../../src/pca/require-pca.ts"],"names":[],"mappings":";;AAeA,wCAGC;AAiCD,wCAcC;AAUD,gCAuEC;AAlJD,wCAAgH;AAChH,qCAA0E;AAc1E,SAAgB,cAAc;IAC5B,MAAM,CAAC,GAAG,IAAI,GAAG,EAA0D,CAAC;IAC5E,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AAoBD,SAAS,MAAM,CAAC,GAAmB,EAAE,IAAY;IAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAiG,CAAC;IAChH,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACjE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,qGAAqG;AACrG,SAAgB,cAAc,CAAC,GAAmB;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACpC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;IACjB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAI,CAA6C,EAAE,MAAM,CAAC;IACjE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,CAAoB,CAAC;IAChG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,MAAc,EAAc,EAAE,CAAC,CAAC;IACnD,KAAK,EAAE,KAAK;IACZ,CAAC,EAAE,CAAC;IACJ,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACtE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;IAC1B,OAAO,EAAE,CAAC,MAAM,CAAC;CAClB,CAAC,CAAC;AAEH,SAAgB,UAAU,CAAC,IAAuB;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAClC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,EAAE,CACnC,cAAc,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,oEAAoE,CAAC;IAC/H,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAK,GAAG,iBAAiB,EAAkB,EAAE,CAAC,CAAC;QAC7E,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC;QAC5B,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC;KAClC,CAAC,CAAC;IAEH,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,CAAC;YACH,IAAI,GAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC,sBAAuB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC;YAC9F,IAAI,CAAS,CAAC;YACd,IAAI,CAAC;gBACH,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,kBAAY,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC,uBAAwB,CAAW,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3E,OAAO,MAAM,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,KAAK;gBAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;YAEhE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC;YACjE,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3F,MAAM,GAAG,GAAe,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,IAAI,KAAK,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAEzE,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAY,EAAC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAEvF,mEAAmE;YACnE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,IAAI,KAAK,EAAE,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;oBACzE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;oBACtB,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;oBAChC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,kCAAkC,KAAK,CAAC,WAAW,WAAW,CAAC,CAAC;gBACpH,CAAC;qBAAM,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;oBAC7C,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;gBAClC,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC7C,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,cAAc,CAAC;YAC1C,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,wFAAwF;gBACxF,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,IAAI,CAC3F,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CACpC,CAAC;gBACF,OAAO,WAAW;oBAChB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,CAAC,gBAAgB,CAAC,EAAE;oBACnF,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC1C,CAAC;YACD,IAAI,IAAI,CAAC,WAAW,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;QACtI,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
import { type Capability, type CheckStatus, type PCActn, type PlanNode, type RequiredThreshold, type RiskInputs, type TrustBudget, type VerifyHooks } from '@atlasauth/pca';
|
|
2
|
+
/**
|
|
3
|
+
* Resource-server side Proof-Carrying Authority verifier (spec §4, §7, Appendix A).
|
|
4
|
+
* Deterministic and offline; never throws (any internal error becomes a fail-closed verdict).
|
|
5
|
+
*/
|
|
6
|
+
export interface PcaContext {
|
|
7
|
+
/** Plaintext action params. If given they MUST hash to `action.params_digest`; needed by predicates. */
|
|
8
|
+
params?: Record<string, unknown>;
|
|
9
|
+
subject?: Record<string, unknown>;
|
|
10
|
+
env?: Record<string, unknown>;
|
|
11
|
+
/** The committed plan, if the RS knows it. Its Merkle root must equal `plan.root`. */
|
|
12
|
+
plan?: PlanNode[];
|
|
13
|
+
/** Risk inputs the RS can vouch for. Missing ones fail closed (worst case) except `taint`, see below. */
|
|
14
|
+
risk?: Partial<RiskInputs>;
|
|
15
|
+
/** Current trust budget for the leaf holder. Absent = a full budget (`budget` check reports not-enforced). */
|
|
16
|
+
budget?: TrustBudget;
|
|
17
|
+
recentActionTimes?: number[];
|
|
18
|
+
}
|
|
19
|
+
export interface VerifyPCActnOptions {
|
|
20
|
+
grant: Capability;
|
|
21
|
+
hooks?: VerifyHooks;
|
|
22
|
+
/** epoch ms (default Date.now()) */
|
|
23
|
+
now?: number;
|
|
24
|
+
context?: PcaContext;
|
|
25
|
+
}
|
|
26
|
+
export interface PcaVerdict {
|
|
27
|
+
allow: boolean;
|
|
28
|
+
/** Recomputed risk score in [0,1]. */
|
|
29
|
+
r: number;
|
|
30
|
+
requiredThreshold: RequiredThreshold;
|
|
31
|
+
checks: Record<string, CheckStatus>;
|
|
32
|
+
reasons: string[];
|
|
33
|
+
/** Budget after the decision (leaked, and debited when auto-admitted). Persist it on allow. */
|
|
34
|
+
budget?: TrustBudget;
|
|
35
|
+
}
|
|
36
|
+
export declare function verifyPCActn(pcactn: PCActn | string, opts: VerifyPCActnOptions): Promise<PcaVerdict>;
|
|
@@ -0,0 +1,136 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.verifyPCActn = verifyPCActn;
|
|
4
|
+
const pca_1 = require("@atlasauth/pca");
|
|
5
|
+
const WORST_THRESHOLD = { t: 3, proof: 'strong', optimisticAllowed: false };
|
|
6
|
+
function failClosed(reason, checks = {}) {
|
|
7
|
+
return {
|
|
8
|
+
allow: false,
|
|
9
|
+
r: 1,
|
|
10
|
+
requiredThreshold: WORST_THRESHOLD,
|
|
11
|
+
checks: { ...checks, malformed: 'fail' },
|
|
12
|
+
reasons: [reason],
|
|
13
|
+
};
|
|
14
|
+
}
|
|
15
|
+
async function verifyPCActn(pcactn, opts) {
|
|
16
|
+
try {
|
|
17
|
+
let p;
|
|
18
|
+
try {
|
|
19
|
+
p = typeof pcactn === 'string' ? (0, pca_1.decodePCActn)(pcactn) : pcactn;
|
|
20
|
+
}
|
|
21
|
+
catch (e) {
|
|
22
|
+
return failClosed(`undecodable PCActn: ${e.message}`);
|
|
23
|
+
}
|
|
24
|
+
if (p === null || typeof p !== 'object')
|
|
25
|
+
return failClosed('PCActn is not an object');
|
|
26
|
+
const now = opts.now ?? Date.now();
|
|
27
|
+
const ctx = opts.context ?? {};
|
|
28
|
+
const core = await (0, pca_1.verifyPCActnCore)(p, { grant: opts.grant, nowEpoch: now, hooks: opts.hooks });
|
|
29
|
+
const checks = { ...core.checks };
|
|
30
|
+
const reasons = [];
|
|
31
|
+
if (!core.allow && core.reason)
|
|
32
|
+
reasons.push(core.reason);
|
|
33
|
+
const fail = (name, why) => {
|
|
34
|
+
checks[name] = 'fail';
|
|
35
|
+
reasons.push(`${name}: ${why}`);
|
|
36
|
+
};
|
|
37
|
+
// grant_ref binds the object to this grant
|
|
38
|
+
if (p.grant_ref === opts.grant.id)
|
|
39
|
+
checks.grant_ref = 'pass';
|
|
40
|
+
else
|
|
41
|
+
fail('grant_ref', 'does not reference the supplied grant');
|
|
42
|
+
// params plaintext must open the committed digest
|
|
43
|
+
if (ctx.params !== undefined) {
|
|
44
|
+
if ((0, pca_1.hashCanonical)(ctx.params) === p.action?.params_digest)
|
|
45
|
+
checks.params_digest = 'pass';
|
|
46
|
+
else
|
|
47
|
+
fail('params_digest', 'supplied params do not hash to action.params_digest');
|
|
48
|
+
}
|
|
49
|
+
else
|
|
50
|
+
checks.params_digest = 'not-enforced';
|
|
51
|
+
// the RS's own copy of the plan must be the committed one
|
|
52
|
+
if (ctx.plan) {
|
|
53
|
+
if ((0, pca_1.merkleRoot)(ctx.plan.map(pca_1.planNodeLeaf)) === p.plan?.root)
|
|
54
|
+
checks.plan_root_authorized = 'pass';
|
|
55
|
+
else
|
|
56
|
+
fail('plan_root_authorized', 'known plan does not match plan.root');
|
|
57
|
+
}
|
|
58
|
+
const chain = Array.isArray(p.cap_chain) ? p.cap_chain : [];
|
|
59
|
+
const leaf = chain[chain.length - 1];
|
|
60
|
+
const depth = Math.max(0, chain.length - 1);
|
|
61
|
+
const now0 = now;
|
|
62
|
+
const budgetIn = ctx.budget ?? { B: Number.POSITIVE_INFINITY, tau: now0, asOf: now0 };
|
|
63
|
+
checks.budget = ctx.budget ? 'pass' : 'not-enforced';
|
|
64
|
+
// Taint: the agent's claim, used only as a default input (RS-supplied risk.taint wins).
|
|
65
|
+
const claimedTaint = p.provenance?.taint_level;
|
|
66
|
+
const risk = { ...ctx.risk };
|
|
67
|
+
if (risk.taint === undefined && typeof claimedTaint === 'number')
|
|
68
|
+
risk.taint = claimedTaint;
|
|
69
|
+
const reversibility = p.action?.reversibility_class;
|
|
70
|
+
const bMaxProbe = decideBudget(opts.grant, budgetIn, ctx.budget === undefined);
|
|
71
|
+
const d = (0, pca_1.decide)({
|
|
72
|
+
grant: opts.grant,
|
|
73
|
+
action: {
|
|
74
|
+
action: { verb: p.action?.verb, resource: p.action?.resource, params: ctx.params, reversibility_class: reversibility },
|
|
75
|
+
subject: ctx.subject,
|
|
76
|
+
env: ctx.env,
|
|
77
|
+
},
|
|
78
|
+
plan: ctx.plan,
|
|
79
|
+
nodeId: p.plan?.node_id,
|
|
80
|
+
risk,
|
|
81
|
+
budget: bMaxProbe,
|
|
82
|
+
now,
|
|
83
|
+
caveatContext: { delegationDepth: depth, recentActionTimes: ctx.recentActionTimes },
|
|
84
|
+
});
|
|
85
|
+
// Caveats added by delegation hops (beyond the root's) are conjunctive too.
|
|
86
|
+
if (leaf) {
|
|
87
|
+
const extra = leaf.caveats.slice(opts.grant.caveats.length);
|
|
88
|
+
const cv = (0, pca_1.evaluateCaveats)(extra, {
|
|
89
|
+
now,
|
|
90
|
+
blastRadius: risk.blastRadius,
|
|
91
|
+
reversibilityClass: reversibility,
|
|
92
|
+
delegationDepth: depth,
|
|
93
|
+
recentActionTimes: ctx.recentActionTimes,
|
|
94
|
+
});
|
|
95
|
+
if (cv.ok)
|
|
96
|
+
checks.delegated_caveats = 'pass';
|
|
97
|
+
else
|
|
98
|
+
fail('delegated_caveats', `delegation caveat(s) not satisfied: ${cv.failed.join(', ')}`);
|
|
99
|
+
}
|
|
100
|
+
if (d.releaseGuardianShare)
|
|
101
|
+
checks.policy = 'pass';
|
|
102
|
+
else {
|
|
103
|
+
checks.policy = 'fail';
|
|
104
|
+
reasons.push(...d.reasons.map((x) => `policy: ${x}`));
|
|
105
|
+
}
|
|
106
|
+
if (d.releaseGuardianShare) {
|
|
107
|
+
// informational reasons (step-up, assumed worst case) are kept even when released
|
|
108
|
+
reasons.push(...d.reasons.map((x) => `policy: ${x}`));
|
|
109
|
+
}
|
|
110
|
+
// Threshold: t > 1 needs a proof we can only get from an enforced threshold hook.
|
|
111
|
+
const th = checks.threshold;
|
|
112
|
+
if (d.requiredThreshold.t > 1 && d.releaseGuardianShare && th !== 'pass') {
|
|
113
|
+
fail('threshold', th === 'fail'
|
|
114
|
+
? `t=${d.requiredThreshold.t} required and the threshold proof was rejected`
|
|
115
|
+
: `t=${d.requiredThreshold.t} (${d.requiredThreshold.proof}) required but no threshold verifier is enforced`);
|
|
116
|
+
}
|
|
117
|
+
const allow = !Object.values(checks).includes('fail') && d.releaseGuardianShare && core.allow;
|
|
118
|
+
if (allow) {
|
|
119
|
+
return { allow, r: d.r, requiredThreshold: d.requiredThreshold, checks, reasons, budget: ctx.budget ? d.budget : undefined };
|
|
120
|
+
}
|
|
121
|
+
if (reasons.length === 0)
|
|
122
|
+
reasons.push('denied');
|
|
123
|
+
return { allow: false, r: d.r, requiredThreshold: d.requiredThreshold, checks, reasons };
|
|
124
|
+
}
|
|
125
|
+
catch (e) {
|
|
126
|
+
return failClosed(`verifier error (fail closed): ${e instanceof Error ? e.message : 'unknown'}`);
|
|
127
|
+
}
|
|
128
|
+
}
|
|
129
|
+
/** Without a caller-supplied budget, use a full budget (grant's bMax) so absence does not itself deny. */
|
|
130
|
+
function decideBudget(grant, b, absent) {
|
|
131
|
+
if (!absent)
|
|
132
|
+
return b;
|
|
133
|
+
const bMax = (0, pca_1.readEnvelope)(grant)?.risk_policy.bMax;
|
|
134
|
+
return { ...b, B: typeof bMax === 'number' && Number.isFinite(bMax) ? bMax : 0 };
|
|
135
|
+
}
|
|
136
|
+
//# sourceMappingURL=verify.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/pca/verify.ts"],"names":[],"mappings":";;AAsEA,oCA+GC;AArLD,wCAiBwB;AAyCxB,MAAM,eAAe,GAAsB,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;AAE/F,SAAS,UAAU,CAAC,MAAc,EAAE,SAAsC,EAAE;IAC1E,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,CAAC,EAAE,CAAC;QACJ,iBAAiB,EAAE,eAAe;QAClC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE;QACxC,OAAO,EAAE,CAAC,MAAM,CAAC;KAClB,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,MAAuB,EAAE,IAAyB;IACnF,IAAI,CAAC;QACH,IAAI,CAAS,CAAC;QACd,IAAI,CAAC;YACH,CAAC,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,kBAAY,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,UAAU,CAAC,uBAAwB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC,yBAAyB,CAAC,CAAC;QAEtF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAA,sBAAgB,EAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAChG,MAAM,MAAM,GAAgC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,EAAE;YACzC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC;QAEF,2CAA2C;QAC3C,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;;YACxD,IAAI,CAAC,WAAW,EAAE,uCAAuC,CAAC,CAAC;QAEhE,kDAAkD;QAClD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,IAAA,mBAAa,EAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,aAAa;gBAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC;;gBACpF,IAAI,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;QACpF,CAAC;;YAAM,MAAM,CAAC,aAAa,GAAG,cAAc,CAAC;QAE7C,0DAA0D;QAC1D,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,IAAI,IAAA,gBAAU,EAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAY,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI;gBAAE,MAAM,CAAC,oBAAoB,GAAG,MAAM,CAAC;;gBAC7F,IAAI,CAAC,sBAAsB,EAAE,qCAAqC,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,GAAG,CAAC;QACjB,MAAM,QAAQ,GAAgB,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,iBAAiB,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACnG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;QAErD,wFAAwF;QACxF,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC;QAC/C,MAAM,IAAI,GAAwB,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,YAAY,KAAK,QAAQ;YAAE,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;QAE5F,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC;QACpD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,IAAA,YAAM,EAAC;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE;gBACN,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,aAAa,EAAE;gBACtH,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,GAAG,EAAE,GAAG,CAAC,GAAG;aACb;YACD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO;YACvB,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,GAAG;YACH,aAAa,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE;SACpF,CAAC,CAAC;QAEH,4EAA4E;QAC5E,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5D,MAAM,EAAE,GAAG,IAAA,qBAAe,EAAC,KAAK,EAAE;gBAChC,GAAG;gBACH,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,aAAa;gBACjC,eAAe,EAAE,KAAK;gBACtB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;aACzC,CAAC,CAAC;YACH,IAAI,EAAE,CAAC,EAAE;gBAAE,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC;;gBACxC,IAAI,CAAC,mBAAmB,EAAE,uCAAuC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,CAAC,CAAC,oBAAoB;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;aAC9C,CAAC;YACJ,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAC;YAC3B,kFAAkF;YAClF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,kFAAkF;QAClF,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;QAC5B,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,oBAAoB,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YACzE,IAAI,CACF,WAAW,EACX,EAAE,KAAK,MAAM;gBACX,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,gDAAgD;gBAC5E,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,kDAAkD,CAC/G,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GACT,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,IAAI,IAAI,CAAC,KAAK,CAAC;QAClF,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC/H,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,iCAAiC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,SAAS,YAAY,CAAC,KAAiB,EAAE,CAAc,EAAE,MAAe;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,IAAA,kBAAY,EAAC,KAAK,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC;IACnD,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC"}
|
package/dist/verify.d.ts
CHANGED
|
@@ -98,14 +98,30 @@ export interface AuthorizedSession {
|
|
|
98
98
|
export type VerifyResult = AuthorizedSession | {
|
|
99
99
|
ok: false;
|
|
100
100
|
reason: 'malformed' | 'invalid' | 'no_keys' | 'unauthorized_party';
|
|
101
|
+
/**
|
|
102
|
+
* Set with `no_keys` when the key set could not be obtained — e.g. OIDC
|
|
103
|
+
* discovery failed — saying why. A configuration diagnostic, never a
|
|
104
|
+
* statement about the token.
|
|
105
|
+
*/
|
|
106
|
+
detail?: string;
|
|
101
107
|
};
|
|
102
108
|
export interface AtlasBackendOptions {
|
|
103
109
|
/**
|
|
104
|
-
* The instance's JWKS URL.
|
|
105
|
-
*
|
|
106
|
-
* `jwks`, verification is fully
|
|
110
|
+
* The instance's JWKS URL. Optional: when neither `jwksUrl` nor `jwks` is
|
|
111
|
+
* given, the URL is discovered from `${issuer}/.well-known/openid-configuration`
|
|
112
|
+
* (cached like the JWKS itself). With a static `jwks`, verification is fully
|
|
113
|
+
* offline. `jwksUrl` and `jwks` are mutually exclusive.
|
|
107
114
|
*/
|
|
108
115
|
jwksUrl?: string;
|
|
116
|
+
/**
|
|
117
|
+
* Only for discovery on an instance WITHOUT its own frontend API domain (the
|
|
118
|
+
* shared host): its tokens carry the shared issuer, so discovery must use the
|
|
119
|
+
* per-instance document. Pass the instance id (`ins_…`), or `publishableKey`.
|
|
120
|
+
* Ignored when `jwksUrl` or `jwks` is set.
|
|
121
|
+
*/
|
|
122
|
+
instanceId?: string;
|
|
123
|
+
/** Alternative to `instanceId`: the instance id is read from the publishable key. */
|
|
124
|
+
publishableKey?: string;
|
|
109
125
|
/**
|
|
110
126
|
* A static JSON Web Key Set to verify against, INSTEAD of fetching from a URL.
|
|
111
127
|
* When set, verification makes NO network call — the hermetic path a
|
package/dist/verify.js
CHANGED
|
@@ -8,6 +8,7 @@ exports.protect = protect;
|
|
|
8
8
|
const jose_1 = require("jose");
|
|
9
9
|
const authz_1 = require("@atlasauth/authz");
|
|
10
10
|
const jwks_cache_1 = require("./jwks-cache");
|
|
11
|
+
const discovery_1 = require("./discovery");
|
|
11
12
|
// Re-export the shared authorization primitive so a backend customer imports
|
|
12
13
|
// `has`, `protect`, `ProtectCondition`, etc. from `@atlasauth/backend` directly —
|
|
13
14
|
// the same contract `@atlasauth/react` and `@atlasauth/nextjs` evaluate.
|
|
@@ -65,12 +66,30 @@ class AtlasBackend {
|
|
|
65
66
|
// failing loudly on rather than silently accepting or rejecting every token.
|
|
66
67
|
const hasUrl = typeof options.jwksUrl === 'string' && options.jwksUrl.length > 0;
|
|
67
68
|
const hasStatic = options.jwks !== undefined;
|
|
68
|
-
if (hasUrl
|
|
69
|
-
throw new Error('AtlasBackend
|
|
69
|
+
if (hasUrl && hasStatic) {
|
|
70
|
+
throw new Error('AtlasBackend takes one key source: `jwksUrl` (fetch from the instance) OR `jwks` (a static key set for offline verification), not both. Omit both to discover the JWKS URL from the issuer.');
|
|
71
|
+
}
|
|
72
|
+
if (typeof options.issuer !== 'string' || !options.issuer) {
|
|
73
|
+
throw new Error('AtlasBackend needs `issuer` (your instance\'s frontend API origin, the `iss` of its tokens).');
|
|
74
|
+
}
|
|
75
|
+
let discovery;
|
|
76
|
+
if (!hasUrl && !hasStatic) {
|
|
77
|
+
const instanceId = options.instanceId ??
|
|
78
|
+
(options.publishableKey ? (0, discovery_1.instanceIdFromPublishableKey)(options.publishableKey) : undefined);
|
|
79
|
+
if (options.publishableKey && !options.instanceId && !instanceId) {
|
|
80
|
+
throw new Error('AtlasBackend: `publishableKey` does not carry an instance id; pass `instanceId` or `jwksUrl` instead.');
|
|
81
|
+
}
|
|
82
|
+
discovery = new discovery_1.JwksDiscovery({
|
|
83
|
+
issuer: options.issuer,
|
|
84
|
+
instanceId,
|
|
85
|
+
fetchImpl: options.fetchImpl,
|
|
86
|
+
now: options.now,
|
|
87
|
+
});
|
|
70
88
|
}
|
|
71
89
|
this.jwks = new jwks_cache_1.JwksCache({
|
|
72
|
-
url: options.jwksUrl,
|
|
90
|
+
url: hasUrl ? options.jwksUrl : undefined,
|
|
73
91
|
staticJwks: options.jwks,
|
|
92
|
+
resolveUrl: discovery ? () => discovery.jwksUri() : undefined,
|
|
74
93
|
fetchImpl: options.fetchImpl,
|
|
75
94
|
now: options.now,
|
|
76
95
|
});
|
|
@@ -83,8 +102,11 @@ class AtlasBackend {
|
|
|
83
102
|
if (!token || token.split('.').length !== 3)
|
|
84
103
|
return { ok: false, reason: 'malformed' };
|
|
85
104
|
const keys = await this.jwks.get((0, jwks_cache_1.readKid)(token));
|
|
86
|
-
if (!keys || keys.keys.length === 0)
|
|
87
|
-
return
|
|
105
|
+
if (!keys || keys.keys.length === 0) {
|
|
106
|
+
return this.jwks.lastError
|
|
107
|
+
? { ok: false, reason: 'no_keys', detail: this.jwks.lastError }
|
|
108
|
+
: { ok: false, reason: 'no_keys' };
|
|
109
|
+
}
|
|
88
110
|
let claims;
|
|
89
111
|
try {
|
|
90
112
|
const { payload } = await (0, jose_1.jwtVerify)(token, (0, jose_1.createLocalJWKSet)(keys), {
|
package/dist/verify.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";;;AAkeA,sCAEC;AAED,0BAEC;AAOD,kBAEC;AAMD,0BAIC;AA3fD,+BAAoD;AACpD,4CAK0B;AAC1B,6CAA6D;AAC7D,2CAA0E;AAE1E,6EAA6E;AAC7E,kFAAkF;AAClF,yEAAyE;AACzE,0CAW0B;AANxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA;AAGjB;;;;;;;;;;;;;;;GAeG;AAEH,+EAA+E;AAClE,QAAA,kBAAkB,GAAG,CAAC,CAAC;AAyFpC,kFAAkF;AAClF,SAAS,UAAU,CAAC,MAAqB;IACvC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM;QACN,wEAAwE;QACxE,oEAAoE;QACpE,KAAK,EACH,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG;YAChE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;YACzB,CAAC,CAAC,IAAI;QACV,GAAG,EAAE,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,MAAM,EAAE,SAAS,CAAC;QACzD,OAAO,EAAE,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE;YAC1B,MAAM,OAAO,GAAG,IAAA,gBAAQ,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,MAAM,IAAI,sBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC1E,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAsDD,MAAa,YAAY;IAGM;IAFZ,IAAI,CAAY;IAEjC,YAA6B,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;QACvD,yEAAyE;QACzE,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;QAC7C,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,6LAA6L,CAC9L,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAClH,CAAC;QAED,IAAI,SAAoC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,UAAU,GACd,OAAO,CAAC,UAAU;gBAClB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAA,wCAA4B,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9F,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,uGAAuG,CAAC,CAAC;YAC3H,CAAC;YACD,SAAS,GAAG,IAAI,yBAAa,CAAC;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,sBAAS,CAAC;YACxB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACzC,UAAU,EAAE,OAAO,CAAC,IAAI;YACxB,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEvF,MAAM,IAAI,GAAgB,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS;gBACxB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBAC/D,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;gBAC3E,uEAAuE;gBACvE,6DAA6D;gBAC7D,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,0EAA0E;gBAC1E,gEAAgE;gBAChE,8DAA8D;gBAC9D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAA6B,EAAE;oBAC1D,CAAC,CAAC,EAAE,CAAC;gBACP,cAAc,EAAE,0BAAkB;gBAClC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;aACzE,CAAC,CAAC;YACH,MAAM,GAAG,OAAmC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP;;;;eAIG;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QAED;;;;;;;;WAQG;QACH,MAAM,QAAQ,GAAI,MAAkC,CAAC,SAAS,CAAC;QAC/D,MAAM,eAAe,GAAG,QAAQ,KAAK,SAAS,CAAC;QAC/C,2EAA2E;QAC3E,kEAAkE;QAClE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,kCAAkC;QAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YACrD,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,4EAA4E;QAC5E,sCAAsC;QACtC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAE5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,mKAAmK,CACpK,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CACtD,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,mBAAmB,EAC9C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;oBACjD,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;aAChC,CACF,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;YAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP;;;;eAIG;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAEzB;QACC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAExE,MAAM,KAAK,GAAG,MAAM,IAAI,UAAU,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEtD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,uBAAuB,CACrB,QAAgB,EAChB,QAAkF;QAElF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;YACtF,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,IAAI,sBAAsB,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACtE,CAAC;CACF;AA7ND,oCA6NC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,QAAkF;IAElF,IAAI,QAAQ,YAAY,eAAe;QAAE,OAAO,QAAQ,CAAC;IACzD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;oBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;iBAAM,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,yEAAyE;IACzE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CACjB,OAAkF,EAClF,IAAY;IAEZ,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC7D,OAAQ,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,OAA6C,CAAC;IAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,IAAY;IAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,MAAqB,EAAE,UAAkB;IACrE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,SAAgB,OAAO,CAAC,MAAqB,EAAE,IAAY;IACzD,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAgB,GAAG,CAAC,MAAqB,EAAE,YAA8B,EAAE;IACzE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAgB,OAAO,CAAC,MAAqB,EAAE,YAA8B,EAAE;IAC7E,MAAM,OAAO,GAAG,IAAA,gBAAQ,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,sBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,11 +1,12 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@atlasauth/backend",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.5.0",
|
|
4
4
|
"main": "./dist/index.js",
|
|
5
5
|
"types": "./dist/index.d.ts",
|
|
6
6
|
"dependencies": {
|
|
7
7
|
"jose": "^5.9.6",
|
|
8
|
-
"@atlasauth/authz": "0.1.1"
|
|
8
|
+
"@atlasauth/authz": "0.1.1",
|
|
9
|
+
"@atlasauth/pca": "0.1.0"
|
|
9
10
|
},
|
|
10
11
|
"devDependencies": {
|
|
11
12
|
"typescript": "^5.6.3",
|