@blamejs/core 0.15.62 → 0.15.63

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.63 (2026-06-29) — **OID4VCI now enforces single-use of a pre-authorized code and of a single-use access token under concurrency, so two simultaneous requests can no longer mint two credentials from one.** On the OID4VCI credential issuer, two single-use values were consumed by a delete whose result was ignored, so concurrent requests could each act on the same value. exchangePreAuthorizedCode read the pre-authorized code's entry, validated the transaction code, then deleted the code and minted an access token without checking that its own call had removed the entry — two simultaneous /token requests with the same code each saw the entry, each deleted it, and each minted a distinct access token, issuing two access tokens (and ultimately two credentials) from a code OID4VCI requires to be single-use. issueCredential had the same shape: with single-use access tokens (the default), it minted the credential first and deleted the access token afterward as best-effort cleanup, so two concurrent requests bearing the same token both read it and the same not-yet-rotated c_nonce, both proofs verified, and both minted a credential. Both paths now claim the value with an atomic delete and proceed only when that delete succeeded; the losing request is refused. The transaction-code and proof checks still run first, so a bad transaction code or proof does not consume the value (a wallet can retry). **Security:** *OID4VCI pre-authorized code and access token are single-use under concurrency* — exchangePreAuthorizedCode and issueCredential consumed their single-use value (the pre-authorized code, and the single-use access token) with a delete whose return was discarded, and in issueCredential's case after the credential was already minted. Two concurrent requests carrying the same value therefore each succeeded — minting two access tokens from one pre-authorized code, or two credentials from one single-use access token — defeating the single-use guarantee OID4VCI §3.5 requires (an authorization intended for one credential could yield two). Both paths now delete the value atomically and issue only if that delete removed it, refusing the request that lost the race; the transaction-code and proof verifications run before the claim, so an invalid attempt does not burn the value. If the operator's credential issuer throws after the access token has been claimed (a transient signer outage), the token is restored so the wallet can retry rather than being permanently consumed without a credential.
+
 - v0.15.62 (2026-06-29) — **ARC evaluation now reads each hop's instance with the same strict parser the signature checks use, so a crafted ARC-Authentication-Results header can no longer forge the upstream auth-results surfaced to downstream policy.** b.mail.arc.evaluate returns finalAr — the most recent hop's ARC-Authentication-Results, the receiver's view of the upstream authentication results — which operators may key downstream decisions on. The instance tag (i=) on each ARC header was parsed by three different regexes: the indexing pass that drives the AMS/AS signature checks required i= with no surrounding space and at most three digits, while the finalAr extraction and the AMS header-retention test accepted a looser form (a space around =, unbounded digits). When a sealer signs without covering ARC-Authentication-Results in its AMS h= (permitted by RFC 8617 and supported by the verifier), an attacker holding no key could append a second ARC-Authentication-Results written so the strict pass ignored it while the loose pass consumed it — forging finalAr on a chain that still verified as pass. All ARC instance reads now route through one strict parser, so the evaluation surfaces the same hop the signatures validated. The release also repairs the b.mail.arc.sign excludeAarFromAms option (it was read but rejected by option validation, so the documented opt-out was unreachable) and routes the ARC-Seal signature's b= stripping through the shared tag-aware helper. **Fixed:** *ARC finalAr is read from the strictly-indexed hop, not a looser rescan* — b.mail.arc.evaluate extracted finalAr (and validated the per-hop AMS header retention) with a regex that accepted ARC instance tags the signature-indexing pass rejected — a space around i= or more than three digits. A sealer that omits ARC-Authentication-Results from its AMS h= leaves the AAR outside signature coverage; an attacker could then inject a second ARC-Authentication-Results whose instance the strict crypto pass skipped but the finalAr pass accepted, presenting attacker-chosen upstream auth-results on a chain that still reported pass. Every ARC instance read now goes through a single strict parser, so finalAr is always the AAR the chain's signatures actually covered. · *b.mail.arc.sign accepts excludeAarFromAms again* — The excludeAarFromAms option was read when building the AMS h= list but was missing from the function's option allow-list, so passing it raised an unknown-option error — the documented opt-out could not be used. It is now accepted. · *ARC-Seal b= stripping uses the shared tag-aware helper* — The ARC-Seal verification stripped the signature's b= value with a regex that could mis-zero a value containing b= inside another tag; it now uses the same tag-aware stripper as DKIM, so canonicalization matches the signer in every case. **Detectors:** *ARC instance parsing must use the shared strict reader* — A check fails the build if any ARC instance (i=) parsing regex is added outside the single shared reader, preventing a future divergence between the signature-indexing pass and the finalAr / header-retention passes.
 
 - v0.15.61 (2026-06-29) — **The local and Redis job queues fence completion, failure, and lease extension on the lease the caller actually holds, so a worker finishing after its lease expired can no longer disturb a job another worker has since taken over.** On the local and Redis queue backends, complete(), fail(), and extendLease() identified a job only by its id. When a worker's lease expired, the sweep returned the job to the ready set and another worker leased and began running it; if the original worker then finished late, its complete() could mark the new worker's in-progress job done (and double-fire a cron repeat or re-release flow children), and its fail() could re-queue or dead-letter a job the new worker was still executing. Each lease now carries the job's attempts value (incremented once per lease), and complete(), fail(), and extendLease() act only when that value still matches — so a call from a worker that no longer holds the lease changes nothing. The generic consumer threads this automatically; the SQS backend already bound these actions to the message's receipt handle and is unchanged. **Fixed:** *Local and Redis queues bind complete/fail/extendLease to the held lease* — A long-running handler whose lease expired and was swept could have its job re-leased to a second worker; when the first worker finished, complete() marked the second worker's in-progress job done — double-firing a cron-recurring job's next enqueue and re-releasing its flow dependents — while fail() re-queued or dead-lettered the job the second worker was still running (re-executing or discarding in-flight work). The backends now fence each of these calls on the leased attempts value, which is bumped once per lease; only the worker that holds the current lease can complete, fail, or extend it. A stale call returns without mutating the queue. This brings the local and Redis backends to parity with the SQS backend, which already bound these actions to the message receipt handle.

package/lib/auth/oid4vci.js

@@ -665,7 +665,21 @@ function create(opts) {
           "exchangePreAuthorizedCode: tx_code does not match");
       }
     }
-    await codeStore.del(eopts.preAuthCode);
+    // Single-use enforcement under concurrency: claim the code by deleting it
+    // and gate issuance on having WON that delete. codeStore.del returns true
+    // only for the caller that removed the entry (a single DELETE ... WHERE /
+    // redis DEL is atomic — exactly one of two racing redemptions gets a true
+    // return, the other false). Without gating on the return, two concurrent
+    // /token requests with the same pre-authorized_code (and matching tx_code)
+    // both read the entry, both delete, and both mint an access token — issuing
+    // two credentials from a code RFC OID4VCI §3.5 mandates be single-use. The
+    // tx_code check above runs first and throws without consuming, so a wrong
+    // tx_code does not burn the code (a retrying wallet is unaffected).
+    var claimed = await codeStore.del(eopts.preAuthCode);
+    if (!claimed) {
+      throw new AuthError("auth-oid4vci/invalid-pre-auth-code",
+        "exchangePreAuthorizedCode: pre-authorized_code already redeemed");
+    }
     var accessToken = generateToken(32);                                                         // 256-bit access token
     var cNonce = generateToken(16);                                                              // 128-bit c_nonce
     var record = {
@@ -760,30 +774,55 @@ function create(opts) {
       throw new AuthError("auth-oid4vci/no-claims",
         "issueCredential: claims required (operator looks up the subject's data and supplies them)");
     }
-    var sdJwtToken = await opts.sdJwtIssuer.issue({
-      vct:                  spec.vct,
-      subject:              record.subject,
-      claims:               iopts.claims,
-      selectivelyDisclosed: iopts.selectivelyDisclosed || Object.keys(iopts.claims),
-      holderKey:            verified.jwk,
-      ttlMs:                iopts.ttlMs,
-    });
+    // Single-use access token: CLAIM it (atomic, gated delete) BEFORE minting,
+    // so two concurrent issueCredential calls bearing the same token can't both
+    // produce a credential. atStore.del returns true only for the caller that
+    // removed the entry; the loser is refused. The proof and claims checks above
+    // run first, so a bad proof does not burn the token (a wallet can retry).
+    // Done before the mint because deleting it only as post-mint cleanup let two
+    // racing requests both read the token and both mint (re-minting from a
+    // single-use token). c_nonce rotation alone does not stop this — both
+    // requests read the same un-rotated c_nonce.
+    if (accessTokenSingleUse) {
+      var atClaimed = await atStore.del(iopts.accessToken);
+      if (!atClaimed) {
+        throw new AuthError("auth-oid4vci/access-token-consumed",
+          "issueCredential: access token already used (single-use)");
+      }
+    }
+    var sdJwtToken;
+    try {
+      sdJwtToken = await opts.sdJwtIssuer.issue({
+        vct:                  spec.vct,
+        subject:              record.subject,
+        claims:               iopts.claims,
+        selectivelyDisclosed: iopts.selectivelyDisclosed || Object.keys(iopts.claims),
+        holderKey:            verified.jwk,
+        ttlMs:                iopts.ttlMs,
+      });
+    } catch (e) {
+      // Issuance failed AFTER the single-use access token was claimed (the
+      // operator's issuer threw — a transient signer/KMS outage or a validation
+      // error). Restore the token so the wallet can retry: the claim exists
+      // only to stop a concurrent double-mint, not to burn the token when no
+      // credential was returned. The next attempt re-claims atomically, so this
+      // opens no double-mint window.
+      if (accessTokenSingleUse) {
+        try { await atStore.set(iopts.accessToken, record); } catch (_e) { /* best-effort restore */ }
+      }
+      throw e;
+    }
 
     // Rotate c_nonce so a replayed proof-JWT for a follow-up
     // batch_credential request is rejected.
     var newCNonce = generateToken(16);                                                           // 128-bit c_nonce
     await cNonceStore.set(iopts.accessToken, newCNonce);
 
-    // When single-use is on (default), DELETE the access token
-    // after successful credential mint. A stolen access token paired
-    // with a fresh proof would otherwise re-mint credentials; the
-    // c_nonce rotation alone defends against proof replay but not
-    // against an attacker who exfiltrated the access token. The
-    // accompanying c_nonce entry expires with its TTL; deleting it
-    // explicitly tightens cleanup.
+    // The single-use access token was already claimed (atomically) before the
+    // mint above. Here we only clean up its now-orphaned c_nonce entry (it would
+    // otherwise expire with its TTL). Best-effort.
     if (accessTokenSingleUse) {
       try {
-        await atStore.del(iopts.accessToken);
         await cNonceStore.del(iopts.accessToken);
       } catch (_e) { /* drop-silent — cleanup is best-effort */ }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.62",
+  "version": "0.15.63",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:5422e8bb-3202-439f-86f2-ed91f656a2ba",
+  "serialNumber": "urn:uuid:c128c8b9-913b-4784-824b-3955b67b7bda",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-29T19:28:45.676Z",
+    "timestamp": "2026-06-29T20:57:16.088Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.62",
+      "bom-ref": "@blamejs/core@0.15.63",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.62",
+      "version": "0.15.63",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.62",
+      "purl": "pkg:npm/%40blamejs/core@0.15.63",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.62",
+      "ref": "@blamejs/core@0.15.63",
       "dependsOn": []
     }
   ]