@atlasauth/pca-ciba 0.2.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -2
- package/dist/index.d.ts +8 -1
- package/dist/index.js +60 -9
- package/dist/index.js.map +1 -1
- package/package.json +3 -2
package/README.md
CHANGED
|
@@ -55,9 +55,11 @@ if (review.kind === 'step_up' && requiresCiba(review)) {
|
|
|
55
55
|
|
|
56
56
|
## Status
|
|
57
57
|
|
|
58
|
-
The broker is in-memory and models the CIBA lifecycle without any network; a production deployment would swap in a real OpenID provider. The package computes approval envelopes and the derived trust budget and authorises nothing on its own: `cibaDecisionToCosign` is only the budget-level effect. The cryptographic cosign (FROST) is produced and verified separately, and the resource server's verifier remains the authority. Cryptography in PCA is unaudited.
|
|
58
|
+
Experimental. The broker is in-memory and models the CIBA lifecycle without any network; a production deployment would swap in a real OpenID provider. The package computes approval envelopes and the derived trust budget and authorises nothing on its own: `cibaDecisionToCosign` is only the budget-level effect. The cryptographic cosign (FROST) is produced and verified separately, and the resource server's verifier remains the authority. Cryptography in PCA is unaudited.
|
|
59
59
|
|
|
60
|
-
|
|
60
|
+
What has been checked against OpenID Connect CIBA Core 1.0 (Final): the specification's own examples (committed with source URL and sha256) are replayed through the independent `openid-client` library (6.8.2), which also drives the broker end to end through a small HTTP provider written for the tests (initiate, poll through `authorization_pending`, approve, deny, expiry). The values the package emits are asserted against the specification's requirements: `auth_req_id` is unguessable (160 random bits, restricted character set), `requested_expiry` is a positive integer, `scope` carries `openid` and only valid scope-token characters, and `binding_message` is a single short line of plain text.
|
|
61
|
+
|
|
62
|
+
Not validated: interoperability with a production OpenID provider, `slow_down` and `interval` enforcement (the broker reports the interval but does not rate-limit polls), signed authentication requests, and the ping/push callback handlers (the specification's callback examples are not exercised).
|
|
61
63
|
|
|
62
64
|
## License
|
|
63
65
|
|
package/dist/index.d.ts
CHANGED
|
@@ -53,8 +53,15 @@ export interface CibaAuthRequest {
|
|
|
53
53
|
}
|
|
54
54
|
/** Options shared by `toCibaAuthRequest` and the broker's `start`. */
|
|
55
55
|
export interface CibaRequestOptions {
|
|
56
|
-
/** Override the `requested_expiry` (seconds). Default 300. */
|
|
56
|
+
/** Override the `requested_expiry` (seconds). Must be a positive integer (CIBA Core 7.1). Default 300. */
|
|
57
57
|
expiresInSec?: number;
|
|
58
|
+
/**
|
|
59
|
+
* Use this `auth_req_id` instead of the deterministic derivation. CIBA Core 7.3 requires an
|
|
60
|
+
* `auth_req_id` to carry at least 128 bits of entropy and use only `A-Za-z0-9.-_`; the default
|
|
61
|
+
* derivation hashes PUBLIC step-up fields and is therefore NOT secret. {@link createCibaBroker}
|
|
62
|
+
* always supplies a fresh random value here.
|
|
63
|
+
*/
|
|
64
|
+
authReqId?: string;
|
|
58
65
|
/** CIBA `login_hint` for the OP: the identifier of the human to notify. */
|
|
59
66
|
loginHint?: string;
|
|
60
67
|
/**
|
package/dist/index.js
CHANGED
|
@@ -31,9 +31,33 @@ exports.toCibaAuthRequest = toCibaAuthRequest;
|
|
|
31
31
|
exports.createCibaBroker = createCibaBroker;
|
|
32
32
|
exports.requiresCiba = requiresCiba;
|
|
33
33
|
exports.cibaDecisionToCosign = cibaDecisionToCosign;
|
|
34
|
+
const node_crypto_1 = require("node:crypto");
|
|
34
35
|
const pca_1 = require("@atlasauth/pca");
|
|
35
36
|
const DEFAULT_EXPIRY_SEC = 300;
|
|
36
37
|
const DEFAULT_INTERVAL_SEC = 5;
|
|
38
|
+
/** CIBA Core 7.3: `auth_req_id` characters are restricted to A-Z a-z 0-9 . - _ . */
|
|
39
|
+
const AUTH_REQ_ID_RE = /^[A-Za-z0-9._-]+$/;
|
|
40
|
+
/** 128 bits of base64url is 22 characters; reject anything shorter (CIBA Core 7.3). */
|
|
41
|
+
const MIN_AUTH_REQ_ID_LEN = 22;
|
|
42
|
+
/** RFC 6749 3.3 `scope-token`: %x21 / %x23-5B / %x5D-7E. */
|
|
43
|
+
const SCOPE_TOKEN_RE = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
|
|
44
|
+
/** The goal text is free-form (agent / user supplied); cap what is shown to a person on a small screen. */
|
|
45
|
+
const MAX_GOAL_CHARS = 100;
|
|
46
|
+
/**
|
|
47
|
+
* Make untrusted text safe for a one-line, plain-text approval prompt (CIBA Core 7.1: `binding_message`
|
|
48
|
+
* SHOULD be short and use a limited set of plain-text characters): control characters, line breaks and
|
|
49
|
+
* bidi / zero-width formatting characters become spaces, runs of whitespace collapse.
|
|
50
|
+
*/
|
|
51
|
+
function plainText(value) {
|
|
52
|
+
return value
|
|
53
|
+
.replace(/[\p{Cc}\p{Cf}\u2028\u2029]/gu, ' ')
|
|
54
|
+
.replace(/\s+/gu, ' ')
|
|
55
|
+
.trim();
|
|
56
|
+
}
|
|
57
|
+
function clip(value, max) {
|
|
58
|
+
const chars = Array.from(value);
|
|
59
|
+
return chars.length <= max ? value : `${chars.slice(0, max - 1).join('')}…`;
|
|
60
|
+
}
|
|
37
61
|
/** A short "$480" / "480 EUR" fragment from a step-up's params, or "" when there's no amount. */
|
|
38
62
|
function amountFragment(params) {
|
|
39
63
|
if (!params)
|
|
@@ -54,9 +78,10 @@ function amountFragment(params) {
|
|
|
54
78
|
* lineage is always present.
|
|
55
79
|
*/
|
|
56
80
|
function bindingMessage(stepUp, actsFor) {
|
|
57
|
-
const head = `Approve ${stepUp.verb}${amountFragment(stepUp.params)} on ${stepUp.resource}
|
|
58
|
-
const
|
|
59
|
-
|
|
81
|
+
const head = plainText(`Approve ${stepUp.verb}${amountFragment(stepUp.params)} on ${stepUp.resource}`);
|
|
82
|
+
const plainGoal = stepUp.goal !== undefined ? plainText(stepUp.goal) : '';
|
|
83
|
+
const goalText = plainGoal.length > 0
|
|
84
|
+
? clip(plainGoal, MAX_GOAL_CHARS)
|
|
60
85
|
: stepUp.goalCommit.length > 0
|
|
61
86
|
? `goal ${stepUp.goalCommit.slice(0, 10)}…`
|
|
62
87
|
: undefined;
|
|
@@ -68,13 +93,26 @@ function bindingMessage(stepUp, actsFor) {
|
|
|
68
93
|
* Does not start a flow or notify anyone — that's the broker.
|
|
69
94
|
*/
|
|
70
95
|
function toCibaAuthRequest(stepUp, opts = {}) {
|
|
71
|
-
const actsFor = opts.actsFor !== undefined && opts.actsFor.length > 0 ? opts.actsFor : 'your agent';
|
|
72
|
-
const
|
|
96
|
+
const actsFor = opts.actsFor !== undefined && plainText(opts.actsFor).length > 0 ? clip(plainText(opts.actsFor), 40) : 'your agent';
|
|
97
|
+
const requestedExpiry = opts.expiresInSec !== undefined ? opts.expiresInSec : DEFAULT_EXPIRY_SEC;
|
|
98
|
+
if (!Number.isSafeInteger(requestedExpiry) || requestedExpiry <= 0) {
|
|
99
|
+
throw new RangeError(`ciba: requested_expiry must be a positive integer number of seconds, got ${String(requestedExpiry)}`);
|
|
100
|
+
}
|
|
101
|
+
// The verb is spliced into ONE scope-token. A space in it would otherwise smuggle in extra scope tokens.
|
|
102
|
+
const stepUpScope = `urn:atlas:pca:stepup:${stepUp.verb}`;
|
|
103
|
+
if (!SCOPE_TOKEN_RE.test(stepUpScope)) {
|
|
104
|
+
throw new RangeError('ciba: the step-up verb cannot be carried as an OAuth scope-token (RFC 6749 3.3)');
|
|
105
|
+
}
|
|
106
|
+
const scope = `openid ${stepUpScope}`;
|
|
107
|
+
const auth_req_id = opts.authReqId ?? (0, pca_1.hashCanonical)({ d: 'atlas-pca/ciba/auth_req_id/v1', stepUp: stepUp.id });
|
|
108
|
+
if (!AUTH_REQ_ID_RE.test(auth_req_id) || auth_req_id.length < MIN_AUTH_REQ_ID_LEN || auth_req_id.length > 1024) {
|
|
109
|
+
throw new RangeError('ciba: auth_req_id must use only A-Za-z0-9.-_ and be 22..1024 characters (CIBA Core 7.3)');
|
|
110
|
+
}
|
|
73
111
|
return {
|
|
74
112
|
auth_req_id,
|
|
75
113
|
binding_message: bindingMessage(stepUp, actsFor),
|
|
76
|
-
scope
|
|
77
|
-
requested_expiry:
|
|
114
|
+
scope,
|
|
115
|
+
requested_expiry: requestedExpiry,
|
|
78
116
|
interval: DEFAULT_INTERVAL_SEC,
|
|
79
117
|
...(opts.loginHint !== undefined ? { login_hint: opts.loginHint } : {}),
|
|
80
118
|
stepUpId: stepUp.id,
|
|
@@ -112,16 +150,29 @@ function snapshot(s, now) {
|
|
|
112
150
|
function createCibaBroker(opts = {}) {
|
|
113
151
|
const clock = opts.now ?? Date.now;
|
|
114
152
|
const sessions = new Map();
|
|
153
|
+
/** step-up id -> the auth_req_id of its live (pending or approved) flow, so a repeated `start` is idempotent. */
|
|
154
|
+
const liveByStepUp = new Map();
|
|
115
155
|
return {
|
|
116
156
|
start(stepUp, reqOpts) {
|
|
117
|
-
const
|
|
118
|
-
const
|
|
157
|
+
const now = clock();
|
|
158
|
+
const existingId = liveByStepUp.get(stepUp.id);
|
|
159
|
+
const existing = existingId !== undefined ? sessions.get(existingId) : undefined;
|
|
160
|
+
if (existing !== undefined) {
|
|
161
|
+
const st = effectiveStatus(existing, now);
|
|
162
|
+
// Never reset a flow that is still waiting or already approved: that would silently discard a decision.
|
|
163
|
+
if (st === 'pending' || st === 'approved')
|
|
164
|
+
return existing.request;
|
|
165
|
+
}
|
|
166
|
+
// CIBA Core 7.3: an unguessable auth_req_id (160 random bits, base64url) per flow.
|
|
167
|
+
const request = toCibaAuthRequest(stepUp, { ...reqOpts, authReqId: (0, node_crypto_1.randomBytes)(20).toString('base64url') });
|
|
168
|
+
const createdAt = now;
|
|
119
169
|
const stored = {
|
|
120
170
|
request,
|
|
121
171
|
createdAt,
|
|
122
172
|
expiresAt: createdAt + request.requested_expiry * 1000,
|
|
123
173
|
};
|
|
124
174
|
sessions.set(request.auth_req_id, stored);
|
|
175
|
+
liveByStepUp.set(stepUp.id, request.auth_req_id);
|
|
125
176
|
return request;
|
|
126
177
|
},
|
|
127
178
|
poll(auth_req_id) {
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;AA2HH,8CA0BC;AAmFD,4CAqDC;AAUD,oCAEC;AAoBD,oDASC;AApUD,6CAA0C;AAC1C,wCAOwB;AAkDxB,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,oFAAoF;AACpF,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAC3C,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,4DAA4D;AAC5D,MAAM,cAAc,GAAG,6BAA6B,CAAC;AACrD,2GAA2G;AAC3G,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,OAAO,CAAC,8BAA8B,EAAE,GAAG,CAAC;SAC5C,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,GAAW;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;AAC9E,CAAC;AAED,iGAAiG;AACjG,SAAS,cAAc,CAAC,MAA+B;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QAC7E,OAAO,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,GAAG,EAAE,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,MAAqB,EAAE,OAAe;IAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,MAAM,CAAC,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvG,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,QAAQ,GACZ,SAAS,CAAC,MAAM,GAAG,CAAC;QAClB,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC;QACjC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YAC5B,CAAC,CAAC,QAAQ,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;YAC3C,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,wBAAwB,OAAO,QAAQ,QAAQ,GAAG,CAAC;AACnG,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,MAAqB,EAAE,OAA2B,EAAE;IACpF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IACpI,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACjG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,UAAU,CAAC,4EAA4E,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC9H,CAAC;IACD,yGAAyG;IACzG,MAAM,WAAW,GAAG,wBAAwB,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,UAAU,CAAC,iFAAiF,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,WAAW,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,IAAI,IAAA,mBAAa,EAAC,EAAE,CAAC,EAAE,+BAA+B,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/G,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,mBAAmB,IAAI,WAAW,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QAC/G,MAAM,IAAI,UAAU,CAAC,yFAAyF,CAAC,CAAC;IAClH,CAAC;IACD,OAAO;QACL,WAAW;QACX,eAAe,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC;QAChD,KAAK;QACL,gBAAgB,EAAE,eAAe;QACjC,QAAQ,EAAE,oBAAoB;QAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;AACJ,CAAC;AAwDD,uGAAuG;AACvG,SAAS,eAAe,CAAC,CAAgB,EAAE,GAAW;IACpD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAChD,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC3C,IAAI,GAAG,IAAI,CAAC,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB,EAAE,GAAW;IAC7C,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW;QAClC,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC;QAC/B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,OAA0B,EAAE;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAClD,iHAAiH;IACjH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE/C,OAAO;QACL,KAAK,CAAC,MAAM,EAAE,OAAO;YACnB,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACjF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC1C,wGAAwG;gBACxG,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,UAAU;oBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;YACrE,CAAC;YACD,mFAAmF;YACnF,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC5G,MAAM,SAAS,GAAG,GAAG,CAAC;YACtB,MAAM,MAAM,GAAkB;gBAC5B,OAAO;gBACP,SAAS;gBACT,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI;aACvD,CAAC;YACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC1C,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YACjD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,WAAW;YACd,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,EAAE,CAAC,CAAC;YACpE,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,EAAE;YAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,EAAE,CAAC,CAAC;YACpE,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,WAAW,cAAc,OAAO,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,CAAC,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACtB,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC;YACjB,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;YAClB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,UAAU;gBAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,WAAW;YACb,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sGAAsG;AAEtG;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,MAAc;IACzC,OAAO,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;AAChE,CAAC;AAUD;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAClC,QAA4B,EAC5B,MAAmB,EACnB,MAAkB,EAClB,GAAW,EACX,OAA2B,EAAE;IAE7B,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,IAAA,iBAAW,EAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@atlasauth/pca-ciba",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.3.0",
|
|
4
4
|
"description": "CIBA (Client-Initiated Backchannel Authentication) bridge for PCA FROST step-up: turn a step-up request into a backchannel human-approval flow with risk-adaptive gating.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"ciba",
|
|
@@ -32,9 +32,10 @@
|
|
|
32
32
|
"./package.json": "./package.json"
|
|
33
33
|
},
|
|
34
34
|
"dependencies": {
|
|
35
|
-
"@atlasauth/pca": "0.
|
|
35
|
+
"@atlasauth/pca": "0.3.0"
|
|
36
36
|
},
|
|
37
37
|
"devDependencies": {
|
|
38
|
+
"openid-client": "6.8.2",
|
|
38
39
|
"typescript": "^5.6.3",
|
|
39
40
|
"vitest": "^2.1.4"
|
|
40
41
|
},
|