@atlasauth/emulator-core 0.1.0 → 0.3.0

package/dist/handlers/emu4-oauth-delivery.js

@@ -0,0 +1,207 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_ATTEMPTS = exports.RETRY_SCHEDULE_MS = void 0;
+exports.enqueueBackchannelLogout = enqueueBackchannelLogout;
+exports.enqueueCiba = enqueueCiba;
+exports.runDueDeliveries = runDueDeliveries;
+exports.emu4DeliveryHandlers = emu4DeliveryHandlers;
+const errors_1 = require("../errors");
+const store_1 = require("../store");
+const emu4_oauth_audit_1 = require("./emu4-oauth-audit");
+const emu4_oauth_auth_1 = require("./emu4-oauth-auth");
+const oauth_flows_1 = require("./oauth-flows");
+const support_1 = require("./support");
+/**
+ * Queued, retried delivery of back-channel logout tokens and CIBA ping/push notifications, on the engine clock.
+ *
+ * The first attempt is made at once (the request that caused the delivery waits for it); a failure is retried on the
+ * real schedule (5 s, 5 min, 30 min, 2 h, 5 h, 10 h: six attempts in all) when the clock reaches it. Time moves with
+ * `POST /__emulator/time/advance` (which runs everything that came due) or `POST /__emulator/oauth/deliveries/run`;
+ * every attempt is kept so a test can read what the receiver saw. An OIDC relying party that answers and refuses
+ * (4xx other than 408 and 429) is not retried (back-channel logout section 2.5), nor is a test send.
+ */
+exports.RETRY_SCHEDULE_MS = [5_000, 5 * 60_000, 30 * 60_000, 2 * 3_600_000, 5 * 3_600_000, 10 * 3_600_000];
+exports.MAX_ATTEMPTS = exports.RETRY_SCHEDULE_MS.length;
+const LOGOUT_EVENT = 'http://schemas.openid.net/event/backchannel-logout';
+const SNIPPET_CHARS = 512;
+const queue = (0, support_1.engineState)(() => []);
+const ids = (0, support_1.engineState)(() => ({ n: 0 }));
+const isSuccess = (s) => s >= 200 && s < 300;
+const recoverable = (s) => s >= 500 || s === 408 || s === 429;
+async function body(e, d) {
+    if (d.kind === 'backchannel_logout') {
+        const client = e.db.oauthClients.get(d.client_id);
+        // The token is minted again for every attempt (a fresh jti), like the real dispatcher.
+        const sub = d.is_test || !d.user_id ? (d.user_id ?? `sub_test_${(0, store_1.randomToken)(9)}`) : await (0, emu4_oauth_auth_1.subjectFor)(e, client, d.user_id);
+        const token = await e.tokens.signClaims({ aud: d.client_id, jti: e.db.newId('ologout'), events: { [LOGOUT_EVENT]: {} }, sub, sid: d.sid ?? undefined, ...(d.is_test ? { atlas_test: true } : {}) }, 120);
+        return { headers: { 'content-type': 'application/x-www-form-urlencoded' }, text: `logout_token=${encodeURIComponent(token)}` };
+    }
+    return { headers: { 'content-type': 'application/json', authorization: `Bearer ${d.bearer}` }, text: JSON.stringify(d.payload) };
+}
+/** One HTTP attempt; records it and schedules the next on the real schedule. */
+async function attempt(e, d) {
+    const started = e.clock.now();
+    const { headers, text } = await body(e, d);
+    let status = null;
+    let snippet = null;
+    let location = null;
+    let error = null;
+    try {
+        const res = await (e.options.fetch ?? fetch)(d.endpoint, { method: 'POST', headers, body: text, redirect: 'manual' });
+        status = res.status;
+        snippet = ((await res.text().catch(() => '')) || '').slice(0, SNIPPET_CHARS) || null;
+        if (status >= 300 && status < 400)
+            location = res.headers.get('location');
+        if (!isSuccess(status))
+            error = d.kind === 'backchannel_logout' ? (location !== null || (status >= 300 && status < 400) ? 'backchannel_redirect_not_followed' : 'backchannel_http_error') : `http_${status}`;
+    }
+    catch (err) {
+        error = d.kind === 'backchannel_logout' ? (err?.name === 'TimeoutError' || err?.name === 'AbortError' ? 'backchannel_timeout' : 'backchannel_network_error') : (err instanceof Error ? err.message : String(err));
+    }
+    const now = e.clock.now();
+    const n = d.attempt_number + 1;
+    const ok = status !== null && isSuccess(status);
+    d.attempt_number = n;
+    d.attempted_at = now;
+    d.http_status = status;
+    d.latency_ms = Math.max(0, now - started);
+    d.error = error;
+    d.location = location;
+    d.response_snippet = snippet;
+    d.attempts.push({ attempt: n, at: now, http_status: status, error, success: ok, location });
+    if (ok) {
+        d.status = 'success';
+        d.delivered_at = now;
+        d.next_retry_at = null;
+        return;
+    }
+    d.status = 'failed';
+    // An OIDC relying party that answered and refused is final (section 2.5); a test is never retried.
+    const refused = d.kind === 'backchannel_logout' && status !== null && !recoverable(status);
+    d.next_retry_at = refused || d.is_test || n >= exports.MAX_ATTEMPTS ? null : now + exports.RETRY_SCHEDULE_MS[n - 1];
+}
+function enqueue(e, row) {
+    const d = { id: `bld_${String(++ids(e).n).padStart(6, '0')}_${(0, store_1.randomToken)(6)}`, user_id: null, sid: null, request_id: null, bearer: null, payload: null, is_test: false, status: 'pending', attempt_number: 0, http_status: null, latency_ms: null, error: null, location: null, response_snippet: null, next_retry_at: null, attempted_at: null, delivered_at: null, created_at: e.clock.now(), attempts: [], ...row };
+    queue(e).push(d);
+    return d;
+}
+/** Queue a back-channel logout for a client's session and make the first attempt. */
+async function enqueueBackchannelLogout(e, client, input) {
+    const d = enqueue(e, { kind: 'backchannel_logout', client_id: client.id, endpoint: client.backchannel_logout_uri, user_id: input.userId, sid: input.sid });
+    await attempt(e, d);
+    return d;
+}
+/** Queue a CIBA ping (only the `auth_req_id`) or push (the token response or the refusal) and make the first attempt. */
+async function enqueueCiba(e, input) {
+    const d = enqueue(e, { kind: input.kind, client_id: input.clientId, endpoint: input.endpoint, request_id: input.requestId, bearer: input.token, payload: input.payload });
+    await attempt(e, d);
+    return d;
+}
+/**
+ * Everything the clock made due: push requests that expired undecided are announced (`expired_token`), then every
+ * delivery whose retry time has come is attempted, oldest first. Returns how many attempts ran.
+ */
+async function runDueDeliveries(e) {
+    const now = e.clock.now();
+    for (const rec of (0, oauth_flows_1.cibaRecords)(e).values()) {
+        if (rec.mode !== 'push' || rec.status !== 'pending' || rec.expiresAt > now || rec.expiredNotified)
+            continue;
+        const client = e.db.oauthClients.get(rec.clientId);
+        rec.expiredNotified = true;
+        if (!client || client.deleted || !client.backchannel_client_notification_endpoint || !rec.notificationToken)
+            continue;
+        await enqueueCiba(e, { kind: 'ciba_push', clientId: client.id, requestId: rec.id, endpoint: client.backchannel_client_notification_endpoint, token: rec.notificationToken, payload: { auth_req_id: rec.id, error: 'expired_token', error_description: 'The authentication request expired.' } });
+    }
+    let ran = 0;
+    for (const d of queue(e)) {
+        if (d.status !== 'failed' || d.next_retry_at === null || d.next_retry_at > e.clock.now())
+            continue;
+        // The target may be gone since the delivery was queued: nothing to deliver to, so it leaves the queue.
+        const client = e.db.oauthClients.get(d.client_id);
+        if (!client || client.deleted || (d.kind === 'backchannel_logout' && !client.backchannel_logout_uri)) {
+            d.next_retry_at = null;
+            d.error = d.kind === 'backchannel_logout' ? 'client_missing' : 'client_missing';
+            continue;
+        }
+        if (d.kind === 'backchannel_logout')
+            d.endpoint = client.backchannel_logout_uri;
+        await attempt(e, d);
+        ran++;
+    }
+    return ran;
+}
+const present = (d) => ({
+    object: 'backchannel_logout_delivery',
+    id: d.id,
+    oauth_client_id: d.client_id,
+    sid: d.sid,
+    trace_id: null,
+    test: d.is_test,
+    status: d.status,
+    attempt_number: d.attempt_number,
+    max_attempts: d.is_test ? 1 : exports.MAX_ATTEMPTS,
+    http_status: d.http_status,
+    latency_ms: d.latency_ms,
+    error: d.error,
+    location: d.location,
+    response_snippet: d.response_snippet,
+    next_retry_at: d.next_retry_at,
+    attempted_at: d.attempted_at,
+    delivered_at: d.delivered_at,
+    created_at: d.created_at,
+});
+const rawView = (d) => ({ ...present(d), object: 'oauth_delivery', kind: d.kind, endpoint: d.endpoint, request_id: d.request_id, user_id: d.user_id, attempts: d.attempts });
+function emu4DeliveryHandlers() {
+    const clientOf = (e, id) => {
+        const c = e.db.oauthClients.get(id);
+        if (!c || c.deleted)
+            throw new errors_1.EmulatorError('NOT_FOUND', 'Unknown OAuth client.');
+        return c;
+    };
+    return [
+        {
+            method: 'GET',
+            pattern: '/v1/oauth_clients/:id/backchannel_deliveries',
+            scope: 'oauth_clients:read',
+            handler: async (c) => {
+                const e = c.engine;
+                const client = clientOf(e, c.params.id);
+                await runDueDeliveries(e);
+                const limit = Math.min(Math.max(Math.floor(Number(c.query.get('limit') ?? 20)) || 20, 1), 100);
+                const rows = queue(e).filter((d) => d.kind === 'backchannel_logout' && d.client_id === client.id).reverse();
+                const page = (0, store_1.paginate)(rows, { limit, startingAfter: c.query.get('starting_after') ?? undefined });
+                return { body: { object: 'list', data: page.data.map(present), has_more: page.has_more, next_cursor: page.has_more ? (page.data[page.data.length - 1]?.id ?? null) : null } };
+            },
+        },
+        {
+            method: 'POST',
+            pattern: '/v1/oauth_clients/:id/backchannel_logout/test',
+            scope: 'oauth_clients:write',
+            handler: async (c) => {
+                const e = c.engine;
+                const client = clientOf(e, c.params.id);
+                if (!client.backchannel_logout_uri)
+                    throw new errors_1.EmulatorError('CONFLICT', 'This client has no backchannel_logout_uri. Set one first, then send a test.');
+                const sid = `sid_test_${(0, store_1.randomToken)(9)}`;
+                const d = enqueue(e, { kind: 'backchannel_logout', client_id: client.id, endpoint: client.backchannel_logout_uri, user_id: `sub_test_${(0, store_1.randomToken)(9)}`, sid, is_test: true });
+                await attempt(e, d);
+                (0, emu4_oauth_audit_1.recordAudit)(e, 'oauth_client.backchannel_logout_test_sent', 'api_key', 'oauth_client', client.id, { client_id: client.id, delivery_id: d.id, ok: d.status === 'success' });
+                return { body: { object: 'backchannel_logout_test', delivery_id: d.id, ok: d.status === 'success', sid, status: d.http_status, latency_ms: d.latency_ms, error: d.error, location: d.location, blocked_reason: null, body_excerpt: d.response_snippet } };
+            },
+        },
+        {
+            // Every queued delivery with its attempts: `kind` (backchannel_logout, ciba_ping, ciba_push) and `client_id` narrow it.
+            method: 'GET',
+            pattern: '/__emulator/oauth/deliveries',
+            public: true,
+            handler: async (c) => {
+                await runDueDeliveries(c.engine);
+                const kind = c.query.get('kind');
+                const client = c.query.get('client_id');
+                return { body: { object: 'list', data: queue(c.engine).filter((d) => (!kind || d.kind === kind) && (!client || d.client_id === client)).map(rawView) } };
+            },
+        },
+        { method: 'POST', pattern: '/__emulator/oauth/deliveries/run', public: true, handler: async (c) => ({ body: { object: 'delivery_sweep', attempted: await runDueDeliveries(c.engine) } }) },
+    ];
+}
+//# sourceMappingURL=emu4-oauth-delivery.js.map

package/dist/handlers/emu4-oauth-delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emu4-oauth-delivery.js","sourceRoot":"","sources":["../../src/handlers/emu4-oauth-delivery.ts"],"names":[],"mappings":";;;AA0HA,4DAIC;AAGD,kCAIC;AAMD,4CAwBC;AAyBD,oDAkDC;AA5OD,sCAA0C;AAE1C,oCAAiD;AACjD,yDAAiD;AACjD,uDAA+C;AAC/C,+CAA4C;AAC5C,uCAAwC;AAExC;;;;;;;;GAQG;AACU,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,SAAS,EAAE,EAAE,GAAG,SAAS,CAAC,CAAC;AACnG,QAAA,YAAY,GAAG,yBAAiB,CAAC,MAAM,CAAC;AACrD,MAAM,YAAY,GAAG,oDAAoD,CAAC;AAC1E,MAAM,aAAa,GAAG,GAAG,CAAC;AAoC1B,MAAM,KAAK,GAAG,IAAA,qBAAW,EAAC,GAAe,EAAE,CAAC,EAAE,CAAC,CAAC;AAChD,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAE1C,MAAM,SAAS,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;AAC9D,MAAM,WAAW,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;AAE/E,KAAK,UAAU,IAAI,CAAC,CAAS,EAAE,CAAW;IACxC,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClD,uFAAuF;QACvF,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,YAAY,IAAA,mBAAW,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAA,4BAAU,EAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3H,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACzM,OAAO,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,EAAE,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACjI,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACnI,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,OAAO,CAAC,CAAS,EAAE,CAAW;IAC3C,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC9B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtH,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACpB,OAAO,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC;QACrF,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;YAAE,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,KAAK,GAAG,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;IAC/M,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,GAAG,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,CAAE,GAAa,EAAE,IAAI,KAAK,cAAc,IAAK,GAAa,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1O,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,KAAK,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC,YAAY,GAAG,GAAG,CAAC;IACrB,CAAC,CAAC,WAAW,GAAG,MAAM,CAAC;IACvB,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC;IAChB,CAAC,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACtB,CAAC,CAAC,gBAAgB,GAAG,OAAO,CAAC;IAC7B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5F,IAAI,EAAE,EAAE,CAAC;QACP,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC,CAAC,YAAY,GAAG,GAAG,CAAC;QACrB,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC;QACvB,OAAO;IACT,CAAC;IACD,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC;IACpB,mGAAmG;IACnG,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3F,CAAC,CAAC,aAAa,GAAG,OAAO,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,oBAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,yBAAiB,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;AACvG,CAAC;AAED,SAAS,OAAO,CAAC,CAAS,EAAE,GAA0E;IACpG,MAAM,CAAC,GAAa,EAAE,EAAE,EAAE,OAAO,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAA,mBAAW,EAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC;IACla,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,wBAAwB,CAAC,CAAS,EAAE,MAAW,EAAE,KAAsC;IAC3G,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,sBAAsB,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3J,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,yHAAyH;AAClH,KAAK,UAAU,WAAW,CAAC,CAAS,EAAE,KAA8H;IACzK,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1K,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpB,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CAAC,CAAS;IAC9C,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe;YAAE,SAAS;QAC5G,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,wCAAwC,IAAI,CAAC,GAAG,CAAC,iBAAiB;YAAE,SAAS;QACtH,MAAM,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,wCAAwC,EAAE,KAAK,EAAE,GAAG,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,qCAAqC,EAAE,EAAE,CAAC,CAAC;IACnS,CAAC;IACD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAAE,SAAS;QACnG,uGAAuG;QACvG,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC;YACrG,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAChF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB;YAAE,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC,sBAAsB,CAAC;QAChF,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpB,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAW,EAAO,EAAE,CAAC,CAAC;IACrC,MAAM,EAAE,6BAA6B;IACrC,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,eAAe,EAAE,CAAC,CAAC,SAAS;IAC5B,GAAG,EAAE,CAAC,CAAC,GAAG;IACV,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,CAAC,CAAC,OAAO;IACf,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,cAAc,EAAE,CAAC,CAAC,cAAc;IAChC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAY;IAC1C,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;IACpC,aAAa,EAAE,CAAC,CAAC,aAAa;IAC9B,YAAY,EAAE,CAAC,CAAC,YAAY;IAC5B,YAAY,EAAE,CAAC,CAAC,YAAY;IAC5B,UAAU,EAAE,CAAC,CAAC,UAAU;CACzB,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,CAAC,CAAW,EAAO,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AAE5L,SAAgB,oBAAoB;IAClC,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAsB,EAAO,EAAE;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,8CAA8C;YACvD,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxC,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC;gBAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC/F,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC5G,MAAM,IAAI,GAAG,IAAA,gBAAQ,EAAC,IAAI,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;gBAClG,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAChL,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,+CAA+C;YACxD,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,sBAAsB;oBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,6EAA6E,CAAC,CAAC;gBACvJ,MAAM,GAAG,GAAG,YAAY,IAAA,mBAAW,EAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,sBAAsB,EAAE,OAAO,EAAE,YAAY,IAAA,mBAAW,EAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/K,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACpB,IAAA,8BAAW,EAAC,CAAC,EAAE,2CAA2C,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;gBAC3K,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC5P,CAAC;SACF;QACD;YACE,wHAAwH;YACxH,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,8BAA8B;YACvC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACjC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACxC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAC3J,CAAC;SACF;QACD,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE;KAC3L,CAAC;AACJ,CAAC"}

package/dist/handlers/emu4-oauth-keys.d.ts

@@ -0,0 +1,11 @@
+import type { Engine, RouteDef } from '../engine';
+import { SIGNING_ALGS } from '../tokens';
+/** The shortest the previous key may stay published: the longest token lifetime plus the key set cache. */
+export declare const minimumGraceSeconds: () => number;
+/**
+ * The worker's rotation sweep, on the engine clock: when the schedule is due it STAGES a new key (published
+ * `prepublish_hours` before it signs); it waits while a previous key is still published or another key is staged.
+ */
+export declare function runSigningSchedule(e: Engine): Promise<'idle' | 'staged' | 'waiting' | 'failed'>;
+export declare function signingKeyHandlers(): RouteDef[];
+export { SIGNING_ALGS };

package/dist/handlers/emu4-oauth-keys.js

@@ -0,0 +1,268 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SIGNING_ALGS = exports.minimumGraceSeconds = void 0;
+exports.runSigningSchedule = runSigningSchedule;
+exports.signingKeyHandlers = signingKeyHandlers;
+const errors_1 = require("../errors");
+const tokens_1 = require("../tokens");
+Object.defineProperty(exports, "SIGNING_ALGS", { enumerable: true, get: function () { return tokens_1.SIGNING_ALGS; } });
+const emu4_oauth_audit_1 = require("./emu4-oauth-audit");
+const support_1 = require("./support");
+/**
+ * Signing algorithm choice, staged rotation and the rotation schedule of the instance key, with the real routes and
+ * rules: `GET /v1/instance/signing_keys`, `POST .../rotate`, `DELETE .../next`, `GET|PATCH .../signing_key_policy` and
+ * `GET|PUT|DELETE /v1/instance/signing_key_schedule`. The JWKS reflects every change; the engine clock drives staging,
+ * activation, retirement and the schedule (`runSigningSchedule` runs on every clock advance and on every schedule read).
+ */
+const DAY_MS = 86_400_000;
+const MIN_STAGE_LEAD_MS = 3_600_000;
+const MAX_STAGE_LEAD_MS = 90 * DAY_MS;
+const DEFAULT_STAGE_DAYS = 14;
+const MAX_GRACE_S = 30 * 86_400;
+const DEFAULT_SCHEDULE_GRACE_S = 86_400;
+/** Verifiers cache a key set for up to an hour; it is added to the longest token lifetime. */
+const JWKS_CACHE_MARGIN_S = 3600;
+/** The longest token the emulator signs lives an hour (access and ID tokens). */
+const LONGEST_TOKEN_S = 3600;
+const ALGS_LABEL = 'RS256, ES256, ES384, PS256 or EdDSA';
+const ks = (0, support_1.engineState)(() => ({ policyDays: null, schedule: null }));
+const bad = (message, param) => new errors_1.EmulatorError('VALIDATION_FAILED', message, param);
+const conflict = (message) => new errors_1.EmulatorError('CONFLICT', message);
+/** The shortest the previous key may stay published: the longest token lifetime plus the key set cache. */
+const minimumGraceSeconds = () => LONGEST_TOKEN_S + JWKS_CACHE_MARGIN_S;
+exports.minimumGraceSeconds = minimumGraceSeconds;
+function scheduleView(e, s) {
+    return {
+        object: 'signing_key_schedule',
+        enabled: s?.enabled ?? false,
+        interval_days: s?.interval_days ?? null,
+        alg: s?.alg ?? null,
+        grace_period_seconds: s?.grace_period_seconds ?? null,
+        prepublish_hours: s?.prepublish_hours ?? null,
+        effective_grace_seconds: Math.max(s?.grace_period_seconds ?? 0, (0, exports.minimumGraceSeconds)(), DEFAULT_SCHEDULE_GRACE_S),
+        next_rotation_at: s?.next_rotation_at ?? null,
+        last_rotated_at: s?.last_rotated_at ?? null,
+        last_error: s?.last_error ?? null,
+        last_error_at: s?.last_error_at ?? null,
+    };
+}
+function parseSchedule(body) {
+    const days = body.interval_days;
+    if (typeof days !== 'number' || !Number.isInteger(days) || days < 1 || days > 365)
+        throw bad('interval_days must be a whole number of days from 1 to 365.', 'interval_days');
+    if (body.enabled !== undefined && typeof body.enabled !== 'boolean')
+        throw bad('enabled must be true or false.', 'enabled');
+    let alg = null;
+    if (body.alg !== undefined && body.alg !== null) {
+        if (!(0, tokens_1.isSigningAlg)(body.alg))
+            throw bad(`alg must be ${ALGS_LABEL}.`, 'alg');
+        alg = body.alg;
+    }
+    const g = body.grace_period_seconds;
+    let grace = null;
+    if (g !== undefined && g !== null) {
+        if (typeof g !== 'number' || !Number.isInteger(g) || g < 0 || g > MAX_GRACE_S)
+            throw bad('grace_period_seconds must be a whole number of seconds from 0 to 2592000.', 'grace_period_seconds');
+        if (g < (0, exports.minimumGraceSeconds)())
+            throw bad(`grace_period_seconds must be at least ${(0, exports.minimumGraceSeconds)()}: the longest token this instance signs lives that long (plus the key set cache), and the previous key must stay published until it has expired.`, 'grace_period_seconds');
+        grace = g;
+    }
+    const p = body.prepublish_hours;
+    if (p !== undefined && (typeof p !== 'number' || !Number.isInteger(p) || p < 2 || p > 720))
+        throw bad('prepublish_hours must be a whole number of hours from 2 to 720.', 'prepublish_hours');
+    const prepublish = p ?? 24;
+    const effective = Math.max(grace ?? 0, (0, exports.minimumGraceSeconds)(), DEFAULT_SCHEDULE_GRACE_S);
+    if (days * 86_400 <= prepublish * 3600 + effective)
+        throw bad('interval_days is too short: one rotation (the new key published prepublish_hours before it signs, the old key kept for the grace period) must finish before the next starts.', 'interval_days');
+    return { enabled: body.enabled !== false, interval_days: days, alg, grace_period_seconds: grace, prepublish_hours: prepublish };
+}
+/**
+ * The worker's rotation sweep, on the engine clock: when the schedule is due it STAGES a new key (published
+ * `prepublish_hours` before it signs); it waits while a previous key is still published or another key is staged.
+ */
+async function runSigningSchedule(e) {
+    const s = ks(e).schedule;
+    // No key is made just to look at the clock: an engine that never signed has nothing to activate or retire.
+    if (!s)
+        return (await e.tokens.settleIfStarted(), 'idle');
+    await e.tokens.ready();
+    const now = e.clock.now();
+    if (!s.enabled || now < s.next_rotation_at)
+        return 'idle';
+    const st = await e.tokens.keyState();
+    const blockedUntil = Math.max(st.previousRetiresAt !== null && st.previousRetiresAt > now ? st.previousRetiresAt : 0, st.staged ? st.staged.activatesAt + 60_000 : 0);
+    if (blockedUntil > now) {
+        s.next_rotation_at = blockedUntil + 60_000;
+        return 'waiting';
+    }
+    const grace = Math.max(s.grace_period_seconds ?? 0, (0, exports.minimumGraceSeconds)(), DEFAULT_SCHEDULE_GRACE_S);
+    try {
+        const r = await e.tokens.rotate(s.alg ?? undefined, { staged: true, activatesAt: now + s.prepublish_hours * 3_600_000, graceSeconds: grace, trigger: 'schedule' });
+        const data = { object: 'signing_key', kid: r.kid, alg: r.alg, activates_at: r.activates_at, trigger: 'schedule' };
+        e.webhooks.emit('signing_key.staged', data);
+        (0, emu4_oauth_audit_1.recordAudit)(e, 'signing_key.staged', 'system', 'instance', e.instanceId, { ...data, grace_period_seconds: grace });
+        s.last_rotated_at = now;
+        s.next_rotation_at = now + s.interval_days * DAY_MS;
+        s.last_error = null;
+        s.last_error_at = null;
+        return 'staged';
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        s.last_error = message.slice(0, 300);
+        s.last_error_at = now;
+        s.next_rotation_at = now + 3_600_000;
+        e.webhooks.emit('signing_key.rotation_failed', { object: 'signing_key_schedule', error: message.slice(0, 300), retry_at: s.next_rotation_at });
+        (0, emu4_oauth_audit_1.recordAudit)(e, 'signing_key.rotation_failed', 'system', 'instance', e.instanceId, { error: message.slice(0, 300) });
+        return 'failed';
+    }
+}
+function parseStaging(body, now) {
+    if (body.staged !== undefined && typeof body.staged !== 'boolean')
+        throw bad('staged must be true or false.', 'staged');
+    let activatesAt;
+    if (body.activates_at !== undefined) {
+        const raw = body.activates_at;
+        const at = typeof raw === 'number' && Number.isFinite(raw) ? raw : typeof raw === 'string' && raw.trim() ? Date.parse(raw) : NaN;
+        if (Number.isNaN(at))
+            throw bad('activates_at must be an ISO 8601 date-time or epoch milliseconds.', 'activates_at');
+        const lead = at - now;
+        if (lead < MIN_STAGE_LEAD_MS || lead > MAX_STAGE_LEAD_MS)
+            throw bad('activates_at must be at least 1 hour and at most 90 days from now.', 'activates_at');
+        if (body.staged === false)
+            throw bad('activates_at applies to a staged rotation (staged: true).', 'activates_at');
+        activatesAt = at;
+    }
+    return { ...(body.staged !== undefined ? { staged: body.staged } : {}), ...(activatesAt !== undefined ? { activatesAt } : {}) };
+}
+function signingKeyHandlers() {
+    return [
+        { method: 'GET', pattern: '/v1/instance/signing_keys', scope: 'instance:read', handler: async (c) => ({ body: { object: 'list', data: await c.engine.tokens.signingKeys() } }) },
+        {
+            method: 'POST',
+            pattern: '/v1/instance/signing_keys/rotate',
+            scope: 'instance:write',
+            handler: async (c) => {
+                const e = c.engine;
+                const b = c.body;
+                if (b.key !== undefined && b.key !== 'main' && b.key !== 'secondary')
+                    throw bad('key must be "main" or "secondary".', 'key');
+                if (b.alg !== undefined && !(0, tokens_1.isSigningAlg)(b.alg))
+                    throw bad(`alg must be ${ALGS_LABEL}.`, 'alg');
+                if (b.emergency !== undefined && typeof b.emergency !== 'boolean')
+                    throw bad('emergency must be true or false.', 'emergency');
+                let grace = 86_400;
+                if (b.grace_period_seconds !== undefined) {
+                    const g = b.grace_period_seconds;
+                    if (typeof g !== 'number' || !Number.isInteger(g) || g < 0 || g > MAX_GRACE_S)
+                        throw bad(`grace_period_seconds must be a whole number of seconds from 0 to ${MAX_GRACE_S}.`, 'grace_period_seconds');
+                    grace = g;
+                }
+                // The emulator holds its keys locally: `key` only applies to keys in a key management service.
+                if (b.key !== undefined)
+                    throw bad('key applies to keys held in a key management service.', 'key');
+                const emergency = b.emergency === true;
+                const now = e.clock.now();
+                const staging = parseStaging(b, now);
+                if (staging.staged === true && emergency)
+                    throw bad('An emergency rotation cannot be staged: it replaces the key now.', 'staged');
+                const st = await e.tokens.keyState();
+                const staged = !emergency && (staging.staged ?? Boolean(ks(e).policyDays));
+                if (!staged) {
+                    if (!emergency && st.staged)
+                        throw conflict(`Key ${st.staged.kid} is staged to start signing at ${new Date(st.staged.activatesAt).toISOString()}. Only one key can be staged: cancel it first (DELETE /v1/instance/signing_keys/next), or pass emergency: true to discard it and rotate now.`);
+                    if (!emergency && st.previousRetiresAt !== null && st.previousRetiresAt > now)
+                        throw conflict(`The previous key is still published until ${new Date(st.previousRetiresAt).toISOString()}. Rotate again after that, or pass emergency: true to revoke it now.`);
+                }
+                if (staged) {
+                    if (b.grace_period_seconds !== undefined)
+                        throw bad('grace_period_seconds does not apply to a staged rotation: the previous key stays published for 24 hours after the new key activates.', 'grace_period_seconds');
+                    if (st.staged)
+                        throw conflict(`Key ${st.staged.kid} is already staged to start signing at ${new Date(st.staged.activatesAt).toISOString()}. Only one key can be staged: cancel it first (DELETE /v1/instance/signing_keys/next).`);
+                    const at = staging.activatesAt ?? now + (ks(e).policyDays || DEFAULT_STAGE_DAYS) * DAY_MS;
+                    if (st.previousRetiresAt !== null && st.previousRetiresAt > now && st.previousRetiresAt > at)
+                        throw conflict(`The previous key is still published until ${new Date(st.previousRetiresAt).toISOString()}. Stage the next key to activate after that (activates_at), or rotate again once it is retired.`);
+                    const r = await e.tokens.rotate(b.alg, { staged: true, activatesAt: at, trigger: 'request' });
+                    const data = { object: 'signing_key', kid: r.kid, alg: r.alg, activates_at: r.activates_at };
+                    e.webhooks.emit('signing_key.staged', data);
+                    (0, emu4_oauth_audit_1.recordAudit)(e, 'signing_key.staged', 'api_key', 'instance', e.instanceId, { kid: r.kid, alg: r.alg, current_kid: st.currentKid, activates_at: r.activates_at, staged: true, provider: 'local' });
+                    return { status: 201, body: { object: 'signing_key_rotation', kid: r.kid, alg: r.alg, previous_kid: r.previous_kid, previous_retires_at: r.previous_retires_at, emergency: false, provider: 'local', staged: true, activates_at: r.activates_at } };
+                }
+                const discarded = emergency ? (st.staged?.kid ?? null) : null;
+                const r = await e.tokens.rotate(b.alg, { graceSeconds: grace, emergency });
+                e.webhooks.emit('signing_key.rotated', { object: 'signing_key', kid: r.kid, alg: r.alg, previous_kid: r.previous_kid, emergency, retires_at: emergency ? null : r.previous_retires_at, provider: 'local' });
+                (0, emu4_oauth_audit_1.recordAudit)(e, 'signing_key.rotated', 'api_key', 'instance', e.instanceId, { kid: r.kid, alg: r.alg, previous_kid: r.previous_kid, grace_period_seconds: emergency ? 0 : grace, emergency, provider: 'local', ...(discarded ? { discarded_staged_kid: discarded } : {}) });
+                return { status: 201, body: { object: 'signing_key_rotation', kid: r.kid, alg: r.alg, previous_kid: r.previous_kid, previous_retires_at: r.previous_retires_at, emergency, provider: 'local' } };
+            },
+        },
+        {
+            method: 'DELETE',
+            pattern: '/v1/instance/signing_keys/next',
+            scope: 'instance:write',
+            handler: async (c) => {
+                const kid = await c.engine.tokens.cancelStaged();
+                if (!kid)
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'No signing key is staged.');
+                (0, emu4_oauth_audit_1.recordAudit)(c.engine, 'signing_key.staged_canceled', 'api_key', 'instance', c.engine.instanceId, { kid });
+                return { body: { object: 'signing_key', kid, status: 'next', deleted: true } };
+            },
+        },
+        { method: 'GET', pattern: '/v1/instance/signing_key_policy', scope: 'instance:read', handler: (c) => ({ body: { object: 'signing_key_policy', prepublish_days: ks(c.engine).policyDays || null } }) },
+        {
+            method: 'PATCH',
+            pattern: '/v1/instance/signing_key_policy',
+            scope: 'instance:write',
+            handler: (c) => {
+                const d = c.body.prepublish_days;
+                if (d === undefined)
+                    throw bad('prepublish_days is required (null or 0 turns it off).', 'prepublish_days');
+                if (d !== null && (typeof d !== 'number' || !Number.isInteger(d) || d < 0 || d > 90))
+                    throw bad('prepublish_days must be a whole number of days from 1 to 90, or null / 0 to turn it off.', 'prepublish_days');
+                const state = ks(c.engine);
+                const before = state.policyDays || null;
+                state.policyDays = d ? d : null;
+                (0, emu4_oauth_audit_1.recordAudit)(c.engine, 'signing_key.policy_updated', 'api_key', 'instance', c.engine.instanceId, { before, after: state.policyDays });
+                return { body: { object: 'signing_key_policy', prepublish_days: state.policyDays } };
+            },
+        },
+        {
+            method: 'GET',
+            pattern: '/v1/instance/signing_key_schedule',
+            scope: 'instance:read',
+            handler: async (c) => {
+                await runSigningSchedule(c.engine);
+                return { body: scheduleView(c.engine, ks(c.engine).schedule) };
+            },
+        },
+        {
+            method: 'PUT',
+            pattern: '/v1/instance/signing_key_schedule',
+            scope: 'instance:write',
+            handler: (c) => {
+                const e = c.engine;
+                // The real route also asks for a recent MFA check; the emulator has no step-up state for the key.
+                const p = parseSchedule(c.body);
+                const state = ks(e);
+                const before = state.schedule;
+                state.schedule = { ...p, next_rotation_at: e.clock.now() + p.interval_days * DAY_MS, last_rotated_at: before?.last_rotated_at ?? null, last_error: null, last_error_at: null };
+                (0, emu4_oauth_audit_1.recordAudit)(e, 'signing_key_schedule.set', 'api_key', 'instance', e.instanceId, { interval_days: p.interval_days, alg: p.alg, grace_period_seconds: p.grace_period_seconds, prepublish_hours: p.prepublish_hours, enabled: p.enabled, previous_interval_days: before?.interval_days ?? null });
+                return { body: scheduleView(e, state.schedule) };
+            },
+        },
+        {
+            method: 'DELETE',
+            pattern: '/v1/instance/signing_key_schedule',
+            scope: 'instance:write',
+            handler: (c) => {
+                const state = ks(c.engine);
+                if (!state.schedule)
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'No rotation schedule is set.');
+                state.schedule = null;
+                (0, emu4_oauth_audit_1.recordAudit)(c.engine, 'signing_key_schedule.removed', 'api_key', 'instance', c.engine.instanceId);
+                return { body: { object: 'signing_key_schedule', enabled: false, deleted: true } };
+            },
+        },
+        { method: 'POST', pattern: '/__emulator/oauth/signing/run', public: true, handler: async (c) => ({ body: { object: 'signing_key_sweep', result: await runSigningSchedule(c.engine) } }) },
+    ];
+}
+//# sourceMappingURL=emu4-oauth-keys.js.map

package/dist/handlers/emu4-oauth-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emu4-oauth-keys.js","sourceRoot":"","sources":["../../src/handlers/emu4-oauth-keys.ts"],"names":[],"mappings":";;;AA6FA,gDAiCC;AAiBD,gDAkHC;AA/PD,sCAA0C;AAE1C,sCAAwE;AA+P/D,6FA/PA,qBAAY,OA+PA;AA9PrB,yDAAiD;AACjD,uCAAwC;AAExC;;;;;GAKG;AACH,MAAM,MAAM,GAAG,UAAU,CAAC;AAC1B,MAAM,iBAAiB,GAAG,SAAS,CAAC;AACpC,MAAM,iBAAiB,GAAG,EAAE,GAAG,MAAM,CAAC;AACtC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAChC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,8FAA8F;AAC9F,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,iFAAiF;AACjF,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,UAAU,GAAG,qCAAqC,CAAC;AAiBzD,MAAM,EAAE,GAAG,IAAA,qBAAW,EAAC,GAAa,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAE/E,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,KAAc,EAAiB,EAAE,CAAC,IAAI,sBAAa,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACvH,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,IAAI,sBAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAE5F,2GAA2G;AACpG,MAAM,mBAAmB,GAAG,GAAW,EAAE,CAAC,eAAe,GAAG,mBAAmB,CAAC;AAA1E,QAAA,mBAAmB,uBAAuD;AAEvF,SAAS,YAAY,CAAC,CAAS,EAAE,CAAkB;IACjD,OAAO;QACL,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EAAE,CAAC,EAAE,OAAO,IAAI,KAAK;QAC5B,aAAa,EAAE,CAAC,EAAE,aAAa,IAAI,IAAI;QACvC,GAAG,EAAE,CAAC,EAAE,GAAG,IAAI,IAAI;QACnB,oBAAoB,EAAE,CAAC,EAAE,oBAAoB,IAAI,IAAI;QACrD,gBAAgB,EAAE,CAAC,EAAE,gBAAgB,IAAI,IAAI;QAC7C,uBAAuB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,IAAI,CAAC,EAAE,IAAA,2BAAmB,GAAE,EAAE,wBAAwB,CAAC;QAChH,gBAAgB,EAAE,CAAC,EAAE,gBAAgB,IAAI,IAAI;QAC7C,eAAe,EAAE,CAAC,EAAE,eAAe,IAAI,IAAI;QAC3C,UAAU,EAAE,CAAC,EAAE,UAAU,IAAI,IAAI;QACjC,aAAa,EAAE,CAAC,EAAE,aAAa,IAAI,IAAI;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAS;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC;IAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG;QAAE,MAAM,GAAG,CAAC,6DAA6D,EAAE,eAAe,CAAC,CAAC;IAC7K,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,GAAG,CAAC,gCAAgC,EAAE,SAAS,CAAC,CAAC;IAC5H,IAAI,GAAG,GAAsB,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,IAAA,qBAAY,EAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC,eAAe,UAAU,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5E,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACjB,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC;IACpC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW;YAAE,MAAM,GAAG,CAAC,2EAA2E,EAAE,sBAAsB,CAAC,CAAC;QAC9L,IAAI,CAAC,GAAG,IAAA,2BAAmB,GAAE;YAAE,MAAM,GAAG,CAAC,yCAAyC,IAAA,2BAAmB,GAAE,kJAAkJ,EAAE,sBAAsB,CAAC,CAAC;QACnR,KAAK,GAAG,CAAC,CAAC;IACZ,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,MAAM,GAAG,CAAC,iEAAiE,EAAE,kBAAkB,CAAC,CAAC;IAC7L,MAAM,UAAU,GAAI,CAAwB,IAAI,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,EAAE,IAAA,2BAAmB,GAAE,EAAE,wBAAwB,CAAC,CAAC;IACxF,IAAI,IAAI,GAAG,MAAM,IAAI,UAAU,GAAG,IAAI,GAAG,SAAS;QAAE,MAAM,GAAG,CAAC,8KAA8K,EAAE,eAAe,CAAC,CAAC;IAC/P,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;AAClI,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,kBAAkB,CAAC,CAAS;IAChD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzB,2GAA2G;IAC3G,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1B,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,GAAG,CAAC,CAAC,gBAAgB;QAAE,OAAO,MAAM,CAAC;IAC1D,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,KAAK,IAAI,IAAI,EAAE,CAAC,iBAAiB,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtK,IAAI,YAAY,GAAG,GAAG,EAAE,CAAC;QACvB,CAAC,CAAC,gBAAgB,GAAG,YAAY,GAAG,MAAM,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,EAAE,IAAA,2BAAmB,GAAE,EAAE,wBAAwB,CAAC,CAAC;IACrG,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC,gBAAgB,GAAG,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QACnK,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAClH,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAA,8BAAW,EAAC,CAAC,EAAE,oBAAoB,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC;QACnH,CAAC,CAAC,eAAe,GAAG,GAAG,CAAC;QACxB,CAAC,CAAC,gBAAgB,GAAG,GAAG,GAAG,CAAC,CAAC,aAAa,GAAG,MAAM,CAAC;QACpD,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC;QACvB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC;QACtB,CAAC,CAAC,gBAAgB,GAAG,GAAG,GAAG,SAAS,CAAC;QACrC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC/I,IAAA,8BAAW,EAAC,CAAC,EAAE,6BAA6B,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACpH,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAS,EAAE,GAAW;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,GAAG,CAAC,+BAA+B,EAAE,QAAQ,CAAC,CAAC;IACxH,IAAI,WAA+B,CAAC;IACpC,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACjI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,MAAM,GAAG,CAAC,mEAAmE,EAAE,cAAc,CAAC,CAAC;QACrH,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC;QACtB,IAAI,IAAI,GAAG,iBAAiB,IAAI,IAAI,GAAG,iBAAiB;YAAE,MAAM,GAAG,CAAC,oEAAoE,EAAE,cAAc,CAAC,CAAC;QAC1J,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;YAAE,MAAM,GAAG,CAAC,2DAA2D,EAAE,cAAc,CAAC,CAAC;QAClH,WAAW,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAClI,CAAC;AAED,SAAgB,kBAAkB;IAChC,OAAO;QACL,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,2BAA2B,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,EAAE;QAChL;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kCAAkC;YAC3C,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,WAAW;oBAAE,MAAM,GAAG,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;gBAC7H,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,IAAA,qBAAY,EAAC,CAAC,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC,eAAe,UAAU,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChG,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS;oBAAE,MAAM,GAAG,CAAC,kCAAkC,EAAE,WAAW,CAAC,CAAC;gBAC9H,IAAI,KAAK,GAAG,MAAM,CAAC;gBACnB,IAAI,CAAC,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;oBACzC,MAAM,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC;oBACjC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW;wBAAE,MAAM,GAAG,CAAC,oEAAoE,WAAW,GAAG,EAAE,sBAAsB,CAAC,CAAC;oBACrM,KAAK,GAAG,CAAC,CAAC;gBACZ,CAAC;gBACD,+FAA+F;gBAC/F,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;oBAAE,MAAM,GAAG,CAAC,uDAAuD,EAAE,KAAK,CAAC,CAAC;gBACnG,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC;gBACvC,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACrC,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,SAAS;oBAAE,MAAM,GAAG,CAAC,kEAAkE,EAAE,QAAQ,CAAC,CAAC;gBAClI,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrC,MAAM,MAAM,GAAG,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC3E,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,MAAM;wBAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,GAAG,kCAAkC,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,8IAA8I,CAAC,CAAC;oBAC/R,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,iBAAiB,KAAK,IAAI,IAAI,EAAE,CAAC,iBAAiB,GAAG,GAAG;wBAAE,MAAM,QAAQ,CAAC,6CAA6C,IAAI,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,sEAAsE,CAAC,CAAC;gBACjQ,CAAC;gBACD,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC,CAAC,oBAAoB,KAAK,SAAS;wBAAE,MAAM,GAAG,CAAC,sIAAsI,EAAE,sBAAsB,CAAC,CAAC;oBACpN,IAAI,EAAE,CAAC,MAAM;wBAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,GAAG,0CAA0C,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,wFAAwF,CAAC,CAAC;oBACnO,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,kBAAkB,CAAC,GAAG,MAAM,CAAC;oBAC1F,IAAI,EAAE,CAAC,iBAAiB,KAAK,IAAI,IAAI,EAAE,CAAC,iBAAiB,GAAG,GAAG,IAAI,EAAE,CAAC,iBAAiB,GAAG,EAAE;wBAAE,MAAM,QAAQ,CAAC,6CAA6C,IAAI,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,iGAAiG,CAAC,CAAC;oBACzS,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAA6B,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;oBACxH,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;oBAC7F,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;oBAC5C,IAAA,8BAAW,EAAC,CAAC,EAAE,oBAAoB,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;oBACjM,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC;gBACtP,CAAC;gBACD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAA6B,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBACrG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC5M,IAAA,8BAAW,EAAC,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC3Q,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YACnM,CAAC;SACF;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,gCAAgC;YACzC,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBACjD,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,2BAA2B,CAAC,CAAC;gBAC5E,IAAA,8BAAW,EAAC,CAAC,CAAC,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1G,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACjF,CAAC;SACF;QACD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,EAAE,CAAC,EAAE;QACrM;YACE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,iCAAiC;YAC1C,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;gBACjC,IAAI,CAAC,KAAK,SAAS;oBAAE,MAAM,GAAG,CAAC,uDAAuD,EAAE,iBAAiB,CAAC,CAAC;gBAC3G,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;oBAAE,MAAM,GAAG,CAAC,0FAA0F,EAAE,iBAAiB,CAAC,CAAC;gBAC/M,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;gBACxC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAE,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC5C,IAAA,8BAAW,EAAC,CAAC,CAAC,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;gBACrI,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,eAAe,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;YACvF,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,mCAAmC;YAC5C,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACnC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,mCAAmC;YAC5C,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,kGAAkG;gBAClG,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAChC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpB,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC;gBAC9B,KAAK,CAAC,QAAQ,GAAG,EAAE,GAAG,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,aAAa,GAAG,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,IAAI,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;gBAC/K,IAAA,8BAAW,EAAC,CAAC,EAAE,0BAA0B,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,aAAa,IAAI,IAAI,EAAE,CAAC,CAAC;gBAC/R,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,CAAC;SACF;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,mCAAmC;YAC5C,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,QAAQ;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;gBAC1F,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACtB,IAAA,8BAAW,EAAC,CAAC,CAAC,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAClG,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACrF,CAAC;SACF;QACD,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE;KAC1L,CAAC;AACJ,CAAC"}

package/dist/handlers/emu4-oauth-pub.d.ts

@@ -0,0 +1,36 @@
+import type { Engine, Reply, RouteContext, RouteDef } from '../engine';
+import type { Obj } from '../openapi';
+/**
+ * Verified OAuth publishers (`/v1/oauth_publishers`) and the Google access-token exchange, with the real rules.
+ *
+ * Publishers: a DNS TXT record (`_atlas-publisher.<domain>`, value `atlas-publisher-verification=...`) proves the
+ * domain; the emulator has no DNS, so `POST /__emulator/oauth/dns` plays the zone (a TXT record, or a transient
+ * lookup failure). Verified status is only ever set by `POST /v1/oauth_publishers/{id}/verify`.
+ *
+ * Google exchange: a first-party client trades a Google access token for an Atlas session at the token endpoint
+ * (`subject_token_type=urn:atlas:token-type:google_access_token`). The emulator has no Google; `POST
+ * /__emulator/google/tokens` registers the token Google would vouch for, and the checks Atlas makes against Google's
+ * tokeninfo and userinfo answers are the real ones.
+ */
+export declare const MAX_PUBLISHERS = 50;
+export declare const MAX_PUBLISHER_APPS = 200;
+export declare const PUBLISHER_SKIP_SCOPES: Set<string>;
+export declare const GOOGLE_ACCESS_TOKEN_TYPE = "urn:atlas:token-type:google_access_token";
+/** Does an https homepage live on `domain` (or a subdomain of it)? */
+export declare function homepageOnDomain(url: unknown, domain: string): boolean;
+/** The verified publisher an app belongs to, or undefined. */
+export declare function publisherOf(e: Engine, client: Obj): Obj | undefined;
+/** The shared sector of the publisher an app belongs to (its subject settings are then the publisher's). */
+export declare const publisherSectorOf: (e: Engine, client: Obj) => string | null;
+/**
+ * The consent step for an app of a verified publisher: the name to show, and whether one consent covers the publisher's
+ * other apps (the publisher opted in, only openid/email/profile asked, and the user already consented to another
+ * enabled app of the publisher for at least those scopes).
+ */
+export declare function publisherDecision(e: Engine, client: Obj, userId: string, requested: string[]): {
+    publisherName: string | null;
+    skipConsent: boolean;
+};
+/** The `urn:atlas:token-type:google_access_token` branch of the token-exchange grant. */
+export declare function googleTokenExchange(c: RouteContext, client: Obj): Promise<Reply>;
+export declare function emu4PublisherHandlers(): RouteDef[];