@blamejs/blamejs-shop 0.5.5 → 0.5.6

package/lib/vendor/blamejs/lib/auth/aal.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * NIST SP 800-63-4 Authentication Assurance Levels.

package/lib/vendor/blamejs/lib/auth/access-lock.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.auth.accessLock — three-mode access-lock primitive for stop-the-

package/lib/vendor/blamejs/lib/auth/acr-vocabulary.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * ACR (Authentication Context Class Reference) vocabulary.

package/lib/vendor/blamejs/lib/auth/ato-kill-switch.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.auth.atoKillSwitch — composite primitive for account-takeover
@@ -10,17 +12,22 @@
  * cleanup path once the trigger fires:
  *
  *   1. destroy every session for the user across the cluster
- *   2. lock the user out of new logins (b.auth.lockout)
+ *   2. lock the user out of new logins via the supplied lockout instance
  *   3. emit an audit row with reason / actor for downstream forensics
  *
  *   await b.auth.atoKillSwitch.trigger({
  *     userId:    "u_42",
  *     reason:    "fraud-signal: 14 failed MFA from new geo",
  *     actor:     { id: req.user && req.user.id, role: req.user && req.user.role },
- *     lockout:   true,                  // default true
+ *     lockout:   appLockout,            // a b.auth.lockout instance (or false to skip)
  *     accessLock: "locked",             // optional — flip the global access-lock mode
  *   });
  *
+ * The lockout step needs the operator's configured b.auth.lockout instance
+ * (there is no module-level lockout store); pass it as `opts.lockout`. When it
+ * is omitted, the lockout step is skipped and the returned `lockoutApplied` is
+ * false (with an audit row) — the account is NOT locked.
+ *
  * Returns `{ sessionsDestroyed, lockoutApplied, accessLockMode }`.
  */
 
@@ -29,7 +36,6 @@ var validateOpts = require("../validate-opts");
 var { defineClass } = require("../framework-error");
 
 var session = lazyRequire(function () { return require("../session"); });
-var lockout = lazyRequire(function () { return require("./lockout"); });
 var accessLock = lazyRequire(function () { return require("./access-lock"); });
 var audit = lazyRequire(function () { return require("../audit"); });
 
@@ -43,8 +49,15 @@ async function trigger(opts) {
 
   validateOpts.requireNonEmptyString(opts.userId, "userId", AtoKillSwitchError, "auth-ato-kill-switch/missing-user-id");
   validateOpts.requireNonEmptyString(opts.reason, "reason", AtoKillSwitchError, "auth-ato-kill-switch/missing-reason");
-  var doLockout       = opts.lockout !== false;
-  var accessLockMode  = typeof opts.accessLock === "string" ? opts.accessLock : null;
+  // opts.lockout is the operator's configured b.auth.lockout INSTANCE to lock
+  // the account in (or false to skip the lockout step). The kill-switch needs
+  // that instance's store to engage the lock — there is no module-level lockout
+  // singleton — so without an instance the lockout step cannot run and is
+  // reported (rather than silently claiming success while never locking).
+  var skipLockout    = opts.lockout === false;
+  var lockoutInst    = (opts.lockout && typeof opts.lockout === "object" &&
+                        typeof opts.lockout.lock === "function") ? opts.lockout : null;
+  var accessLockMode = typeof opts.accessLock === "string" ? opts.accessLock : null;
 
   var sessionsDestroyed = 0;
   try {
@@ -63,13 +76,37 @@ async function trigger(opts) {
   }
 
   var lockoutApplied = false;
-  if (doLockout) {
-    try {
-      await lockout().lock(opts.userId, {
-        reason: "ato-kill-switch:" + opts.reason,
+  if (!skipLockout) {
+    if (lockoutInst) {
+      try {
+        await lockoutInst.lock(opts.userId, {
+          reason: "ato-kill-switch:" + opts.reason,
+        });
+        lockoutApplied = true;
+      } catch (e) {
+        // The lockout step failed (e.g. a cache outage) AFTER sessions were
+        // destroyed. Don't fail the whole kill-switch — but surface it so the
+        // operator knows the account was NOT locked, rather than swallowing.
+        audit().safeEmit({
+          action: "auth.ato_kill_switch.partial",
+          outcome: "failure",
+          metadata: { userId: opts.userId, step: "lockout", reason: e && e.message },
+        });
+      }
+    } else {
+      // No lockout instance supplied: the kill-switch cannot lock the account.
+      // Report it (the result's lockoutApplied stays false) so the operator
+      // doesn't believe the user was locked out of new logins.
+      audit().safeEmit({
+        action: "auth.ato_kill_switch.partial",
+        outcome: "failure",
+        metadata: {
+          userId: opts.userId,
+          step:   "lockout",
+          reason: "no lockout instance supplied (pass opts.lockout = b.auth.lockout.create({ cache, namespace }))",
+        },
       });
-      lockoutApplied = true;
-    } catch (_e) { /* lockout is best-effort; sessions already destroyed */ }
+    }
   }
 
   var modeApplied = null;

package/lib/vendor/blamejs/lib/auth/auth-time-tracker.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * auth_time enforcement helpers per RFC 9470 §3 + OIDC Core 1.0 §2.

package/lib/vendor/blamejs/lib/auth/bot-challenge.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.auth.botChallenge

package/lib/vendor/blamejs/lib/auth/ciba.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.auth.ciba

package/lib/vendor/blamejs/lib/auth/dpop.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * DPoP — Demonstrating Proof of Possession (RFC 9449).

package/lib/vendor/blamejs/lib/auth/elevation-grant.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Step-up elevation grant — short-lived signed tokens that record a

package/lib/vendor/blamejs/lib/auth/fal.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.auth.fal

package/lib/vendor/blamejs/lib/auth/fido-mds3.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * FIDO Metadata Service v3 (MDS3) — authenticator metadata BLOB
@@ -234,14 +236,16 @@ function _validateChain(x5c, rootPems) {
     }
   }
   for (var c = 0; c < chain.length - 1; c++) {
-    if (!chain[c].checkIssued(chain[c + 1])) {
+    // issuerValidlyIssued enforces basicConstraints cA:TRUE on the issuing cert
+    // (chain[c+1]) in addition to the issuance + signature linkage — a non-CA
+    // cert spliced in as an intermediate cannot issue the next link (the classic
+    // basicConstraints bypass, CVE-2002-0862 class). Mirrors mdoc / tsa / bimi /
+    // content-credentials, which enforce cA:TRUE on every hop; only the
+    // tail-to-root anchor below previously did so.
+    if (!x509Chain.issuerValidlyIssued(chain[c + 1], chain[c])) {
       throw new FidoMds3Error("fido-mds3/chain-broken",
-        "x5c[" + c + "] not issued by x5c[" + (c + 1) + "]");
-    }
-    var issuerKey = chain[c + 1].publicKey;
-    if (!chain[c].verify(issuerKey)) {
-      throw new FidoMds3Error("fido-mds3/chain-bad-signature",
-        "x5c[" + c + "] signature does not verify against x5c[" + (c + 1) + "] public key");
+        "x5c[" + c + "] not validly issued by x5c[" + (c + 1) +
+        "] (issuer must be a CA whose signature over the subject verifies)");
     }
   }
   var tail = chain[chain.length - 1];

package/lib/vendor/blamejs/lib/auth/jar.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.auth.jar
@@ -139,7 +141,7 @@ async function parse(jar, opts) {
   }
   validateOpts.requireObject(opts, "jar.parse", AuthJarError);
   validateOpts(opts, [
-    "clientId", "audience", "algorithms", "jwks", "jwksUri", "keyResolver", "clockSkewMs",
+    "clientId", "audience", "algorithms", "jwks", "jwksUri", "keyResolver", "clockSkewMs", "now",
   ], "jar.parse");
   validateOpts.requireNonEmptyString(opts.clientId, "jar.parse: clientId", AuthJarError, "auth-jar/bad-client-id");
   validateOpts.requireNonEmptyString(opts.audience, "jar.parse: audience", AuthJarError, "auth-jar/bad-audience");
@@ -156,6 +158,7 @@ async function parse(jar, opts) {
     issuer:      opts.clientId,
     audience:    opts.audience,
     clockSkewMs: opts.clockSkewMs,
+    now:         opts.now,
   });
   // RFC 9101 §10.8 — the request object MUST be explicitly typed so a JWT
   // minted for another purpose (id_token / access-token / logout-token)

package/lib/vendor/blamejs/lib/auth/jwt-external.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * jwt-external — verify JWTs signed by an external IdP using classical
@@ -56,6 +58,7 @@ var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
 var C = require("../constants");
 var bCrypto = require("../crypto");
+var numericBounds = require("../numeric-bounds");
 var { AuthError } = require("../framework-error");
 
 var httpClient = lazyRequire(function () { return require("../http-client"); });
@@ -421,7 +424,7 @@ async function verifyExternal(token, opts) {
   opts = opts || {};
   validateOpts(opts, [
     "algorithms", "jwks", "jwksUri", "jwksCacheMs", "keyResolver",
-    "audience", "issuer", "subject", "clockSkewMs",
+    "audience", "issuer", "subject", "clockSkewMs", "now",
     // v0.9.4 — opt-out for the kid-less-token JWKS-of-one refusal
     // (default refuses; non-conforming IdPs that emit kid-less tokens
     // set this true).
@@ -564,9 +567,19 @@ async function verifyExternal(token, opts) {
       "signature verification failed");
   }
 
-  // Claim validation.
+  // Claim validation. A present clockSkewMs must be a non-negative finite
+  // integer: a bare `typeof === "number"` lets Infinity / NaN through, and
+  // `exp + Infinity < now` (or NaN) is always false — silently disabling the
+  // expiry/nbf/iat gates so an expired or not-yet-valid token verifies. Reject
+  // a malformed skew loudly (it is operator config, not token-controlled).
+  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.clockSkewMs,
+    "verifyExternal: opts.clockSkewMs", AuthError, "auth-jwt-external/bad-clock-skew");
   var clockSkewMs = typeof opts.clockSkewMs === "number" ? opts.clockSkewMs : DEFAULT_CLOCK_SKEW_MS;
-  var nowSec   = Math.floor(Date.now() / C.TIME.seconds(1));
+  // opts.now (finite ms) overrides the wall clock for the time checks —
+  // consistent with sdJwtVc.verify; lets a caller evaluate the token as of a
+  // specific instant without abusing a (now-rejected) negative skew.
+  var nowMs    = (typeof opts.now === "number" && isFinite(opts.now)) ? opts.now : Date.now();
+  var nowSec   = Math.floor(nowMs / C.TIME.seconds(1));
   var skewSec  = Math.floor(clockSkewMs / C.TIME.seconds(1));
 
   if (typeof payload.exp !== "number") {

package/lib/vendor/blamejs/lib/auth/jwt.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * JWT (RFC 7519) — PQC-signed JSON Web Tokens.