@atlasauth/pca-ciba 0.1.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +40 -20
- package/dist/index.d.ts +8 -1
- package/dist/index.js +60 -9
- package/dist/index.js.map +1 -1
- package/package.json +28 -3
package/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 Atlas Authorization
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
CHANGED
|
@@ -1,46 +1,66 @@
|
|
|
1
1
|
# @atlasauth/pca-ciba
|
|
2
2
|
|
|
3
|
-
A CIBA (OpenID Connect Client-Initiated Backchannel Authentication) on-ramp for PCA
|
|
3
|
+
A CIBA (OpenID Connect Client-Initiated Backchannel Authentication) on-ramp for Proof-Carrying Authority (PCA) step-up. It turns a risk-gated step-up into a standard asynchronous human-approval flow, interrupting a person only for the actions that actually need it.
|
|
4
4
|
|
|
5
|
-
CIBA
|
|
5
|
+
In CIBA a backend opens an `auth_req_id`, the human is notified out of band, and the decision comes back by poll or ping/push. The `binding_message` carries the human-readable approval context, so the thing approved on the phone is the thing the agent is about to do ("Approve stripe.refund $480 on charge:ch_1 - because you asked support-bot to 'reconcile October refunds'").
|
|
6
6
|
|
|
7
|
-
This is a
|
|
7
|
+
This is a bridge, not a replacement. PCA's cryptographic step-up (a FROST threshold cosign, in `@atlasauth/pca`) stays the enforcement; CIBA is the notification and decision envelope around it.
|
|
8
8
|
|
|
9
|
-
|
|
9
|
+
Gating is risk-adaptive: only a tier-3 step-up (human required, typically irreversible) is routed through CIBA. Tier-2 (guardian auto-cosign) and tier-1 (`auto`) never interrupt a person.
|
|
10
10
|
|
|
11
11
|
## Install
|
|
12
12
|
|
|
13
13
|
```sh
|
|
14
|
-
npm i @atlasauth/pca-ciba
|
|
14
|
+
npm i @atlasauth/pca-ciba @atlasauth/pca
|
|
15
15
|
```
|
|
16
16
|
|
|
17
|
-
Depends on the core `@atlasauth/pca` (installed transitively).
|
|
18
|
-
|
|
19
17
|
## Usage
|
|
20
18
|
|
|
21
19
|
```ts
|
|
22
|
-
import { reviewAction } from '@atlasauth/pca';
|
|
20
|
+
import { agent, generateKeyPair, reviewAction } from '@atlasauth/pca';
|
|
23
21
|
import { requiresCiba, createCibaBroker, cibaDecisionToCosign } from '@atlasauth/pca-ciba';
|
|
24
22
|
|
|
25
|
-
const
|
|
23
|
+
const a = agent({
|
|
24
|
+
principal: generateKeyPair(),
|
|
25
|
+
goal: 'reconcile October refunds',
|
|
26
|
+
permissions: { stripe: ['payout'] },
|
|
27
|
+
limits: { payout: '$100' },
|
|
28
|
+
aud: 'rs_demo',
|
|
29
|
+
riskPolicy: { theta1: 0.3, theta2: 0.6 },
|
|
30
|
+
});
|
|
31
|
+
|
|
32
|
+
const review = reviewAction(a, 'stripe.payout', 'acct:1', { amount: 80 }, { goal: 'reconcile October refunds' });
|
|
26
33
|
|
|
27
|
-
if (
|
|
28
|
-
const broker = createCibaBroker({ onComplete: (
|
|
34
|
+
if (review.kind === 'step_up' && requiresCiba(review)) {
|
|
35
|
+
const broker = createCibaBroker({ onComplete: (session) => console.log(session.status) }); // omit onComplete for POLL
|
|
29
36
|
const ciba = broker.start(review.request, { actsFor: 'support-bot', loginHint: 'owner@acme' });
|
|
30
|
-
// ciba.binding_message
|
|
31
|
-
// "Approve stripe.refund $480 on charge:ch_1 — because you asked support-bot to 'reconcile October refunds'"
|
|
37
|
+
// ciba.auth_req_id, ciba.binding_message, ciba.requested_expiry, ...
|
|
32
38
|
|
|
33
|
-
|
|
34
|
-
|
|
39
|
+
broker.poll(ciba.auth_req_id).status; // 'pending' | 'approved' | 'denied' | 'expired'
|
|
40
|
+
|
|
41
|
+
// The human decides out of band:
|
|
35
42
|
const session = broker.resolve(ciba.auth_req_id, 'approve', 'owner@acme');
|
|
36
43
|
|
|
37
|
-
// Fold the decision back into the trust budget
|
|
38
|
-
const { budget } = cibaDecisionToCosign(
|
|
44
|
+
// Fold the decision back into the trust budget:
|
|
45
|
+
const { budget, cosigned } = cibaDecisionToCosign(
|
|
46
|
+
session.status === 'approved' ? 'approve' : 'deny',
|
|
47
|
+
a.budget,
|
|
48
|
+
a.policy.riskPolicy,
|
|
49
|
+
Date.now(),
|
|
50
|
+
);
|
|
39
51
|
}
|
|
40
52
|
```
|
|
41
53
|
|
|
42
|
-
`toCibaAuthRequest(stepUp, opts?)` is the pure mapping
|
|
54
|
+
`toCibaAuthRequest(stepUp, opts?)` is the pure mapping from a step-up to a CIBA request, if you want to drive your own broker or a real OpenID provider.
|
|
55
|
+
|
|
56
|
+
## Status
|
|
57
|
+
|
|
58
|
+
Experimental. The broker is in-memory and models the CIBA lifecycle without any network; a production deployment would swap in a real OpenID provider. The package computes approval envelopes and the derived trust budget and authorises nothing on its own: `cibaDecisionToCosign` is only the budget-level effect. The cryptographic cosign (FROST) is produced and verified separately, and the resource server's verifier remains the authority. Cryptography in PCA is unaudited.
|
|
59
|
+
|
|
60
|
+
What has been checked against OpenID Connect CIBA Core 1.0 (Final): the specification's own examples (committed with source URL and sha256) are replayed through the independent `openid-client` library (6.8.2), which also drives the broker end to end through a small HTTP provider written for the tests (initiate, poll through `authorization_pending`, approve, deny, expiry). The values the package emits are asserted against the specification's requirements: `auth_req_id` is unguessable (160 random bits, restricted character set), `requested_expiry` is a positive integer, `scope` carries `openid` and only valid scope-token characters, and `binding_message` is a single short line of plain text.
|
|
61
|
+
|
|
62
|
+
Not validated: interoperability with a production OpenID provider, `slow_down` and `interval` enforcement (the broker reports the interval but does not rate-limit polls), signed authentication requests, and the ping/push callback handlers (the specification's callback examples are not exercised).
|
|
43
63
|
|
|
44
|
-
|
|
64
|
+
## License
|
|
45
65
|
|
|
46
|
-
|
|
66
|
+
MIT - see LICENSE
|
package/dist/index.d.ts
CHANGED
|
@@ -53,8 +53,15 @@ export interface CibaAuthRequest {
|
|
|
53
53
|
}
|
|
54
54
|
/** Options shared by `toCibaAuthRequest` and the broker's `start`. */
|
|
55
55
|
export interface CibaRequestOptions {
|
|
56
|
-
/** Override the `requested_expiry` (seconds). Default 300. */
|
|
56
|
+
/** Override the `requested_expiry` (seconds). Must be a positive integer (CIBA Core 7.1). Default 300. */
|
|
57
57
|
expiresInSec?: number;
|
|
58
|
+
/**
|
|
59
|
+
* Use this `auth_req_id` instead of the deterministic derivation. CIBA Core 7.3 requires an
|
|
60
|
+
* `auth_req_id` to carry at least 128 bits of entropy and use only `A-Za-z0-9.-_`; the default
|
|
61
|
+
* derivation hashes PUBLIC step-up fields and is therefore NOT secret. {@link createCibaBroker}
|
|
62
|
+
* always supplies a fresh random value here.
|
|
63
|
+
*/
|
|
64
|
+
authReqId?: string;
|
|
58
65
|
/** CIBA `login_hint` for the OP: the identifier of the human to notify. */
|
|
59
66
|
loginHint?: string;
|
|
60
67
|
/**
|
package/dist/index.js
CHANGED
|
@@ -31,9 +31,33 @@ exports.toCibaAuthRequest = toCibaAuthRequest;
|
|
|
31
31
|
exports.createCibaBroker = createCibaBroker;
|
|
32
32
|
exports.requiresCiba = requiresCiba;
|
|
33
33
|
exports.cibaDecisionToCosign = cibaDecisionToCosign;
|
|
34
|
+
const node_crypto_1 = require("node:crypto");
|
|
34
35
|
const pca_1 = require("@atlasauth/pca");
|
|
35
36
|
const DEFAULT_EXPIRY_SEC = 300;
|
|
36
37
|
const DEFAULT_INTERVAL_SEC = 5;
|
|
38
|
+
/** CIBA Core 7.3: `auth_req_id` characters are restricted to A-Z a-z 0-9 . - _ . */
|
|
39
|
+
const AUTH_REQ_ID_RE = /^[A-Za-z0-9._-]+$/;
|
|
40
|
+
/** 128 bits of base64url is 22 characters; reject anything shorter (CIBA Core 7.3). */
|
|
41
|
+
const MIN_AUTH_REQ_ID_LEN = 22;
|
|
42
|
+
/** RFC 6749 3.3 `scope-token`: %x21 / %x23-5B / %x5D-7E. */
|
|
43
|
+
const SCOPE_TOKEN_RE = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
|
|
44
|
+
/** The goal text is free-form (agent / user supplied); cap what is shown to a person on a small screen. */
|
|
45
|
+
const MAX_GOAL_CHARS = 100;
|
|
46
|
+
/**
|
|
47
|
+
* Make untrusted text safe for a one-line, plain-text approval prompt (CIBA Core 7.1: `binding_message`
|
|
48
|
+
* SHOULD be short and use a limited set of plain-text characters): control characters, line breaks and
|
|
49
|
+
* bidi / zero-width formatting characters become spaces, runs of whitespace collapse.
|
|
50
|
+
*/
|
|
51
|
+
function plainText(value) {
|
|
52
|
+
return value
|
|
53
|
+
.replace(/[\p{Cc}\p{Cf}\u2028\u2029]/gu, ' ')
|
|
54
|
+
.replace(/\s+/gu, ' ')
|
|
55
|
+
.trim();
|
|
56
|
+
}
|
|
57
|
+
function clip(value, max) {
|
|
58
|
+
const chars = Array.from(value);
|
|
59
|
+
return chars.length <= max ? value : `${chars.slice(0, max - 1).join('')}…`;
|
|
60
|
+
}
|
|
37
61
|
/** A short "$480" / "480 EUR" fragment from a step-up's params, or "" when there's no amount. */
|
|
38
62
|
function amountFragment(params) {
|
|
39
63
|
if (!params)
|
|
@@ -54,9 +78,10 @@ function amountFragment(params) {
|
|
|
54
78
|
* lineage is always present.
|
|
55
79
|
*/
|
|
56
80
|
function bindingMessage(stepUp, actsFor) {
|
|
57
|
-
const head = `Approve ${stepUp.verb}${amountFragment(stepUp.params)} on ${stepUp.resource}
|
|
58
|
-
const
|
|
59
|
-
|
|
81
|
+
const head = plainText(`Approve ${stepUp.verb}${amountFragment(stepUp.params)} on ${stepUp.resource}`);
|
|
82
|
+
const plainGoal = stepUp.goal !== undefined ? plainText(stepUp.goal) : '';
|
|
83
|
+
const goalText = plainGoal.length > 0
|
|
84
|
+
? clip(plainGoal, MAX_GOAL_CHARS)
|
|
60
85
|
: stepUp.goalCommit.length > 0
|
|
61
86
|
? `goal ${stepUp.goalCommit.slice(0, 10)}…`
|
|
62
87
|
: undefined;
|
|
@@ -68,13 +93,26 @@ function bindingMessage(stepUp, actsFor) {
|
|
|
68
93
|
* Does not start a flow or notify anyone — that's the broker.
|
|
69
94
|
*/
|
|
70
95
|
function toCibaAuthRequest(stepUp, opts = {}) {
|
|
71
|
-
const actsFor = opts.actsFor !== undefined && opts.actsFor.length > 0 ? opts.actsFor : 'your agent';
|
|
72
|
-
const
|
|
96
|
+
const actsFor = opts.actsFor !== undefined && plainText(opts.actsFor).length > 0 ? clip(plainText(opts.actsFor), 40) : 'your agent';
|
|
97
|
+
const requestedExpiry = opts.expiresInSec !== undefined ? opts.expiresInSec : DEFAULT_EXPIRY_SEC;
|
|
98
|
+
if (!Number.isSafeInteger(requestedExpiry) || requestedExpiry <= 0) {
|
|
99
|
+
throw new RangeError(`ciba: requested_expiry must be a positive integer number of seconds, got ${String(requestedExpiry)}`);
|
|
100
|
+
}
|
|
101
|
+
// The verb is spliced into ONE scope-token. A space in it would otherwise smuggle in extra scope tokens.
|
|
102
|
+
const stepUpScope = `urn:atlas:pca:stepup:${stepUp.verb}`;
|
|
103
|
+
if (!SCOPE_TOKEN_RE.test(stepUpScope)) {
|
|
104
|
+
throw new RangeError('ciba: the step-up verb cannot be carried as an OAuth scope-token (RFC 6749 3.3)');
|
|
105
|
+
}
|
|
106
|
+
const scope = `openid ${stepUpScope}`;
|
|
107
|
+
const auth_req_id = opts.authReqId ?? (0, pca_1.hashCanonical)({ d: 'atlas-pca/ciba/auth_req_id/v1', stepUp: stepUp.id });
|
|
108
|
+
if (!AUTH_REQ_ID_RE.test(auth_req_id) || auth_req_id.length < MIN_AUTH_REQ_ID_LEN || auth_req_id.length > 1024) {
|
|
109
|
+
throw new RangeError('ciba: auth_req_id must use only A-Za-z0-9.-_ and be 22..1024 characters (CIBA Core 7.3)');
|
|
110
|
+
}
|
|
73
111
|
return {
|
|
74
112
|
auth_req_id,
|
|
75
113
|
binding_message: bindingMessage(stepUp, actsFor),
|
|
76
|
-
scope
|
|
77
|
-
requested_expiry:
|
|
114
|
+
scope,
|
|
115
|
+
requested_expiry: requestedExpiry,
|
|
78
116
|
interval: DEFAULT_INTERVAL_SEC,
|
|
79
117
|
...(opts.loginHint !== undefined ? { login_hint: opts.loginHint } : {}),
|
|
80
118
|
stepUpId: stepUp.id,
|
|
@@ -112,16 +150,29 @@ function snapshot(s, now) {
|
|
|
112
150
|
function createCibaBroker(opts = {}) {
|
|
113
151
|
const clock = opts.now ?? Date.now;
|
|
114
152
|
const sessions = new Map();
|
|
153
|
+
/** step-up id -> the auth_req_id of its live (pending or approved) flow, so a repeated `start` is idempotent. */
|
|
154
|
+
const liveByStepUp = new Map();
|
|
115
155
|
return {
|
|
116
156
|
start(stepUp, reqOpts) {
|
|
117
|
-
const
|
|
118
|
-
const
|
|
157
|
+
const now = clock();
|
|
158
|
+
const existingId = liveByStepUp.get(stepUp.id);
|
|
159
|
+
const existing = existingId !== undefined ? sessions.get(existingId) : undefined;
|
|
160
|
+
if (existing !== undefined) {
|
|
161
|
+
const st = effectiveStatus(existing, now);
|
|
162
|
+
// Never reset a flow that is still waiting or already approved: that would silently discard a decision.
|
|
163
|
+
if (st === 'pending' || st === 'approved')
|
|
164
|
+
return existing.request;
|
|
165
|
+
}
|
|
166
|
+
// CIBA Core 7.3: an unguessable auth_req_id (160 random bits, base64url) per flow.
|
|
167
|
+
const request = toCibaAuthRequest(stepUp, { ...reqOpts, authReqId: (0, node_crypto_1.randomBytes)(20).toString('base64url') });
|
|
168
|
+
const createdAt = now;
|
|
119
169
|
const stored = {
|
|
120
170
|
request,
|
|
121
171
|
createdAt,
|
|
122
172
|
expiresAt: createdAt + request.requested_expiry * 1000,
|
|
123
173
|
};
|
|
124
174
|
sessions.set(request.auth_req_id, stored);
|
|
175
|
+
liveByStepUp.set(stepUp.id, request.auth_req_id);
|
|
125
176
|
return request;
|
|
126
177
|
},
|
|
127
178
|
poll(auth_req_id) {
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;AA2HH,8CA0BC;AAmFD,4CAqDC;AAUD,oCAEC;AAoBD,oDASC;AApUD,6CAA0C;AAC1C,wCAOwB;AAkDxB,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,oFAAoF;AACpF,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAC3C,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,4DAA4D;AAC5D,MAAM,cAAc,GAAG,6BAA6B,CAAC;AACrD,2GAA2G;AAC3G,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,OAAO,CAAC,8BAA8B,EAAE,GAAG,CAAC;SAC5C,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,GAAW;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;AAC9E,CAAC;AAED,iGAAiG;AACjG,SAAS,cAAc,CAAC,MAA+B;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QAC7E,OAAO,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,GAAG,EAAE,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,MAAqB,EAAE,OAAe;IAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,MAAM,CAAC,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvG,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,QAAQ,GACZ,SAAS,CAAC,MAAM,GAAG,CAAC;QAClB,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC;QACjC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YAC5B,CAAC,CAAC,QAAQ,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;YAC3C,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,wBAAwB,OAAO,QAAQ,QAAQ,GAAG,CAAC;AACnG,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,MAAqB,EAAE,OAA2B,EAAE;IACpF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IACpI,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACjG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,UAAU,CAAC,4EAA4E,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC9H,CAAC;IACD,yGAAyG;IACzG,MAAM,WAAW,GAAG,wBAAwB,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,UAAU,CAAC,iFAAiF,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,WAAW,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,IAAI,IAAA,mBAAa,EAAC,EAAE,CAAC,EAAE,+BAA+B,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/G,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,mBAAmB,IAAI,WAAW,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QAC/G,MAAM,IAAI,UAAU,CAAC,yFAAyF,CAAC,CAAC;IAClH,CAAC;IACD,OAAO;QACL,WAAW;QACX,eAAe,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC;QAChD,KAAK;QACL,gBAAgB,EAAE,eAAe;QACjC,QAAQ,EAAE,oBAAoB;QAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;AACJ,CAAC;AAwDD,uGAAuG;AACvG,SAAS,eAAe,CAAC,CAAgB,EAAE,GAAW;IACpD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAChD,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC3C,IAAI,GAAG,IAAI,CAAC,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB,EAAE,GAAW;IAC7C,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW;QAClC,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC;QAC/B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,OAA0B,EAAE;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAClD,iHAAiH;IACjH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE/C,OAAO;QACL,KAAK,CAAC,MAAM,EAAE,OAAO;YACnB,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACjF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC1C,wGAAwG;gBACxG,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,UAAU;oBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;YACrE,CAAC;YACD,mFAAmF;YACnF,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC5G,MAAM,SAAS,GAAG,GAAG,CAAC;YACtB,MAAM,MAAM,GAAkB;gBAC5B,OAAO;gBACP,SAAS;gBACT,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI;aACvD,CAAC;YACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC1C,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YACjD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,WAAW;YACd,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,EAAE,CAAC,CAAC;YACpE,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE;YAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,EAAE,CAAC,CAAC;YACpE,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,WAAW,cAAc,OAAO,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,CAAC,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACtB,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC;YACjB,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;YAClB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,UAAU;gBAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,WAAW;YACb,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sGAAsG;AAEtG;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,MAAc;IACzC,OAAO,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;AAChE,CAAC;AAUD;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAClC,QAA4B,EAC5B,MAAmB,EACnB,MAAkB,EAClB,GAAW,EACX,OAA2B,EAAE;IAE7B,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,IAAA,iBAAW,EAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,27 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@atlasauth/pca-ciba",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.3.0",
|
|
4
4
|
"description": "CIBA (Client-Initiated Backchannel Authentication) bridge for PCA FROST step-up: turn a step-up request into a backchannel human-approval flow with risk-adaptive gating.",
|
|
5
|
+
"keywords": [
|
|
6
|
+
"ciba",
|
|
7
|
+
"backchannel",
|
|
8
|
+
"human approval",
|
|
9
|
+
"step-up",
|
|
10
|
+
"agent authorization",
|
|
11
|
+
"proof-carrying authority",
|
|
12
|
+
"pca",
|
|
13
|
+
"ai agents"
|
|
14
|
+
],
|
|
15
|
+
"license": "MIT",
|
|
16
|
+
"homepage": "https://github.com/Atlas-Authorization/pca#readme",
|
|
17
|
+
"bugs": {
|
|
18
|
+
"url": "https://github.com/Atlas-Authorization/pca/issues"
|
|
19
|
+
},
|
|
20
|
+
"repository": {
|
|
21
|
+
"type": "git",
|
|
22
|
+
"url": "git+https://github.com/Atlas-Authorization/pca.git",
|
|
23
|
+
"directory": "packages/pca-ciba"
|
|
24
|
+
},
|
|
5
25
|
"main": "./dist/index.js",
|
|
6
26
|
"types": "./dist/index.d.ts",
|
|
7
27
|
"exports": {
|
|
@@ -12,16 +32,21 @@
|
|
|
12
32
|
"./package.json": "./package.json"
|
|
13
33
|
},
|
|
14
34
|
"dependencies": {
|
|
15
|
-
"@atlasauth/pca": "0.
|
|
35
|
+
"@atlasauth/pca": "0.3.0"
|
|
16
36
|
},
|
|
17
37
|
"devDependencies": {
|
|
38
|
+
"openid-client": "6.8.2",
|
|
18
39
|
"typescript": "^5.6.3",
|
|
19
40
|
"vitest": "^2.1.4"
|
|
20
41
|
},
|
|
21
42
|
"files": [
|
|
22
43
|
"dist",
|
|
23
|
-
"README.md"
|
|
44
|
+
"README.md",
|
|
45
|
+
"LICENSE"
|
|
24
46
|
],
|
|
47
|
+
"engines": {
|
|
48
|
+
"node": ">=20"
|
|
49
|
+
},
|
|
25
50
|
"publishConfig": {
|
|
26
51
|
"access": "public"
|
|
27
52
|
},
|