@blamejs/core 0.15.63 → 0.15.64

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.64 (2026-06-29) — **Token and HTTP-message-signature verifiers now reject a non-finite clock-skew or tolerance value instead of letting it disable the expiry, not-before, and future-dating checks.** Several verifiers read an operator-supplied clock-skew or tolerance value with a bare type check that accepted Infinity and NaN. Because the resulting comparison (for example exp + skew < now, or age > tolerance) is always false when the skew or tolerance is Infinity, a misconfigured non-finite value silently disabled the time-window check — so an expired token, a not-yet-valid token, a future-dated signature, or a replayed (too-old) signature would verify. The affected paths are the shared external-JWT verifier b.auth.jwt.verifyExternal (which the JAR / signed-request-object path also uses), the SD-JWT-VC credential verifier, the OAuth ID-token and client-attestation verifiers, and the HTTP message signature verifier's freshness and clock-skew windows. Each now requires a present skew or tolerance to be a non-negative finite number: the throw-based JWT, SD-JWT-VC, and OAuth verifiers reject a malformed value, and the verdict-returning HTTP-message-signature verifier falls back to its safe default rather than disabling the window. A build check now fails if any verifier reads one of these options without a finiteness guard. **Added:** *verifyExternal and jar.parse accept an `now` clock override* — b.auth.jwt.verifyExternal and b.auth.jar.parse now accept an optional `now` (a finite epoch-milliseconds value) to evaluate a token's exp / nbf / iat as of a specific instant instead of the wall clock — consistent with b.auth.sdJwtVc.verify. A negative clockSkewMs is no longer accepted as a way to shift the evaluation time; use `now`. **Security:** *Non-finite clock-skew / tolerance no longer disables a verifier's time-window check* — b.auth.jwt.verifyExternal, b.auth.sdJwtVc.verify, b.auth.oauth (ID-token and client-attestation verification), and the HTTP message signature verifier read their clock-skew, max-clock-skew, max-PoP-age, and tolerance options with a bare `typeof === "number"` check that let Infinity and NaN through. With such a value the expiry / not-before / future-dating comparison is always false, so the check was silently skipped and an expired or not-yet-valid token — or a future-dated or replayed signature — would verify. The JWT, SD-JWT-VC, and OAuth verifiers now reject a non-finite or negative skew (the option is operator configuration, not attacker-controlled), and the HTTP message signature verifier falls back to its default tolerance and skew. The CWT, DPoP, SAML, and OpenID Federation verifiers already enforced this and are unchanged. **Detectors:** *Verifier clock-skew / tolerance options must be finite-guarded* — A build check fails if a verifier reads a clock-skew or tolerance option with a bare `typeof === "number"` without a finiteness guard (a non-negative-finite check, an inline isFinite fallback, or a create-time non-negative-finite schema), preventing a future verifier from reintroducing the disable-the-window class.
+
 - v0.15.63 (2026-06-29) — **OID4VCI now enforces single-use of a pre-authorized code and of a single-use access token under concurrency, so two simultaneous requests can no longer mint two credentials from one.** On the OID4VCI credential issuer, two single-use values were consumed by a delete whose result was ignored, so concurrent requests could each act on the same value. exchangePreAuthorizedCode read the pre-authorized code's entry, validated the transaction code, then deleted the code and minted an access token without checking that its own call had removed the entry — two simultaneous /token requests with the same code each saw the entry, each deleted it, and each minted a distinct access token, issuing two access tokens (and ultimately two credentials) from a code OID4VCI requires to be single-use. issueCredential had the same shape: with single-use access tokens (the default), it minted the credential first and deleted the access token afterward as best-effort cleanup, so two concurrent requests bearing the same token both read it and the same not-yet-rotated c_nonce, both proofs verified, and both minted a credential. Both paths now claim the value with an atomic delete and proceed only when that delete succeeded; the losing request is refused. The transaction-code and proof checks still run first, so a bad transaction code or proof does not consume the value (a wallet can retry). **Security:** *OID4VCI pre-authorized code and access token are single-use under concurrency* — exchangePreAuthorizedCode and issueCredential consumed their single-use value (the pre-authorized code, and the single-use access token) with a delete whose return was discarded, and in issueCredential's case after the credential was already minted. Two concurrent requests carrying the same value therefore each succeeded — minting two access tokens from one pre-authorized code, or two credentials from one single-use access token — defeating the single-use guarantee OID4VCI §3.5 requires (an authorization intended for one credential could yield two). Both paths now delete the value atomically and issue only if that delete removed it, refusing the request that lost the race; the transaction-code and proof verifications run before the claim, so an invalid attempt does not burn the value. If the operator's credential issuer throws after the access token has been claimed (a transient signer outage), the token is restored so the wallet can retry rather than being permanently consumed without a credential.
 
 - v0.15.62 (2026-06-29) — **ARC evaluation now reads each hop's instance with the same strict parser the signature checks use, so a crafted ARC-Authentication-Results header can no longer forge the upstream auth-results surfaced to downstream policy.** b.mail.arc.evaluate returns finalAr — the most recent hop's ARC-Authentication-Results, the receiver's view of the upstream authentication results — which operators may key downstream decisions on. The instance tag (i=) on each ARC header was parsed by three different regexes: the indexing pass that drives the AMS/AS signature checks required i= with no surrounding space and at most three digits, while the finalAr extraction and the AMS header-retention test accepted a looser form (a space around =, unbounded digits). When a sealer signs without covering ARC-Authentication-Results in its AMS h= (permitted by RFC 8617 and supported by the verifier), an attacker holding no key could append a second ARC-Authentication-Results written so the strict pass ignored it while the loose pass consumed it — forging finalAr on a chain that still verified as pass. All ARC instance reads now route through one strict parser, so the evaluation surfaces the same hop the signatures validated. The release also repairs the b.mail.arc.sign excludeAarFromAms option (it was read but rejected by option validation, so the documented opt-out was unreachable) and routes the ARC-Seal signature's b= stripping through the shared tag-aware helper. **Fixed:** *ARC finalAr is read from the strictly-indexed hop, not a looser rescan* — b.mail.arc.evaluate extracted finalAr (and validated the per-hop AMS header retention) with a regex that accepted ARC instance tags the signature-indexing pass rejected — a space around i= or more than three digits. A sealer that omits ARC-Authentication-Results from its AMS h= leaves the AAR outside signature coverage; an attacker could then inject a second ARC-Authentication-Results whose instance the strict crypto pass skipped but the finalAr pass accepted, presenting attacker-chosen upstream auth-results on a chain that still reported pass. Every ARC instance read now goes through a single strict parser, so finalAr is always the AAR the chain's signatures actually covered. · *b.mail.arc.sign accepts excludeAarFromAms again* — The excludeAarFromAms option was read when building the AMS h= list but was missing from the function's option allow-list, so passing it raised an unknown-option error — the documented opt-out could not be used. It is now accepted. · *ARC-Seal b= stripping uses the shared tag-aware helper* — The ARC-Seal verification stripped the signature's b= value with a regex that could mis-zero a value containing b= inside another tag; it now uses the same tag-aware stripper as DKIM, so canonicalization matches the signer in every case. **Detectors:** *ARC instance parsing must use the shared strict reader* — A check fails the build if any ARC instance (i=) parsing regex is added outside the single shared reader, preventing a future divergence between the signature-indexing pass and the finalAr / header-retention passes.

package/lib/auth/jar.js

@@ -139,7 +139,7 @@ async function parse(jar, opts) {
   }
   validateOpts.requireObject(opts, "jar.parse", AuthJarError);
   validateOpts(opts, [
-    "clientId", "audience", "algorithms", "jwks", "jwksUri", "keyResolver", "clockSkewMs",
+    "clientId", "audience", "algorithms", "jwks", "jwksUri", "keyResolver", "clockSkewMs", "now",
   ], "jar.parse");
   validateOpts.requireNonEmptyString(opts.clientId, "jar.parse: clientId", AuthJarError, "auth-jar/bad-client-id");
   validateOpts.requireNonEmptyString(opts.audience, "jar.parse: audience", AuthJarError, "auth-jar/bad-audience");
@@ -156,6 +156,7 @@ async function parse(jar, opts) {
     issuer:      opts.clientId,
     audience:    opts.audience,
     clockSkewMs: opts.clockSkewMs,
+    now:         opts.now,
   });
   // RFC 9101 §10.8 — the request object MUST be explicitly typed so a JWT
   // minted for another purpose (id_token / access-token / logout-token)

package/lib/auth/jwt-external.js

@@ -56,6 +56,7 @@ var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
 var C = require("../constants");
 var bCrypto = require("../crypto");
+var numericBounds = require("../numeric-bounds");
 var { AuthError } = require("../framework-error");
 
 var httpClient = lazyRequire(function () { return require("../http-client"); });
@@ -421,7 +422,7 @@ async function verifyExternal(token, opts) {
   opts = opts || {};
   validateOpts(opts, [
     "algorithms", "jwks", "jwksUri", "jwksCacheMs", "keyResolver",
-    "audience", "issuer", "subject", "clockSkewMs",
+    "audience", "issuer", "subject", "clockSkewMs", "now",
     // v0.9.4 — opt-out for the kid-less-token JWKS-of-one refusal
     // (default refuses; non-conforming IdPs that emit kid-less tokens
     // set this true).
@@ -564,9 +565,19 @@ async function verifyExternal(token, opts) {
       "signature verification failed");
   }
 
-  // Claim validation.
+  // Claim validation. A present clockSkewMs must be a non-negative finite
+  // integer: a bare `typeof === "number"` lets Infinity / NaN through, and
+  // `exp + Infinity < now` (or NaN) is always false — silently disabling the
+  // expiry/nbf/iat gates so an expired or not-yet-valid token verifies. Reject
+  // a malformed skew loudly (it is operator config, not token-controlled).
+  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.clockSkewMs,
+    "verifyExternal: opts.clockSkewMs", AuthError, "auth-jwt-external/bad-clock-skew");
   var clockSkewMs = typeof opts.clockSkewMs === "number" ? opts.clockSkewMs : DEFAULT_CLOCK_SKEW_MS;
-  var nowSec   = Math.floor(Date.now() / C.TIME.seconds(1));
+  // opts.now (finite ms) overrides the wall clock for the time checks —
+  // consistent with sdJwtVc.verify; lets a caller evaluate the token as of a
+  // specific instant without abusing a (now-rejected) negative skew.
+  var nowMs    = (typeof opts.now === "number" && isFinite(opts.now)) ? opts.now : Date.now();
+  var nowSec   = Math.floor(nowMs / C.TIME.seconds(1));
   var skewSec  = Math.floor(clockSkewMs / C.TIME.seconds(1));
 
   if (typeof payload.exp !== "number") {

package/lib/auth/oauth.js

@@ -107,6 +107,7 @@
 var nodeCrypto = require("node:crypto");
 var cache = require("../cache");
 var C = require("../constants");
+var numericBounds = require("../numeric-bounds");
 var safeAsync = require("../safe-async");
 var bCrypto = require("../crypto");
 var { generateBytes, timingSafeEqual: cryptoTimingSafeEqual } = bCrypto;
@@ -886,6 +887,11 @@ async function verifyClientAttestation(attestationJwt, popJwt, vopts) {
       "client-attestation: missing 'cnf.jwk' confirmation key (RFC 7800)");
   }
   var nowSec  = Math.floor(Date.now() / C.TIME.seconds(1));
+  // A present skew/maxAge must be a non-negative finite integer; a bare typeof
+  // check lets Infinity/NaN through, and `exp + Infinity < now` (or NaN) is
+  // always false — disabling the attestation/PoP expiry gates.
+  numericBounds.requireNonNegativeFiniteIntIfPresent(vopts.clockSkewSec,
+    "verifyClientAttestation: opts.clockSkewSec", OAuthError, "auth-oauth/bad-clock-skew");
   var skewSec = typeof vopts.clockSkewSec === "number" ? vopts.clockSkewSec : (C.TIME.minutes(1) / C.TIME.seconds(1));
   if (typeof ap.exp !== "number" || ap.exp + skewSec < nowSec) {
     throw new OAuthError("auth-oauth/attestation-expired",
@@ -918,6 +924,8 @@ async function verifyClientAttestation(attestationJwt, popJwt, vopts) {
   if (typeof pp.iat !== "number") {
     throw new OAuthError("auth-oauth/attestation-pop-no-iat", "client-attestation-pop: missing 'iat'");
   }
+  numericBounds.requireNonNegativeFiniteIntIfPresent(vopts.maxPopAgeSec,
+    "verifyClientAttestation: opts.maxPopAgeSec", OAuthError, "auth-oauth/bad-pop-max-age");
   var maxAge = typeof vopts.maxPopAgeSec === "number" ? vopts.maxPopAgeSec : DEFAULT_POP_MAX_AGE_SEC;
   if (pp.iat - skewSec > nowSec) {
     throw new OAuthError("auth-oauth/attestation-pop-iat-future", "client-attestation-pop: iat in the future");
@@ -992,6 +1000,12 @@ function create(opts) {
       "requires PKCE for all clients. Remove the opt or upgrade the IdP.");
   }
   var pkce = true;
+  // A present clockSkewMs must be a non-negative finite integer; Infinity/NaN
+  // would disable verifyIdToken's exp gate (`exp + Infinity < now` is always
+  // false → an expired ID token verifies). Reject a malformed skew at config
+  // time so the operator catches it.
+  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.clockSkewMs,
+    "oauth.create: opts.clockSkewMs", OAuthError, "auth-oauth/bad-clock-skew");
   var clockSkewMs  = typeof opts.clockSkewMs === "number" ? opts.clockSkewMs : DEFAULT_CLOCK_SKEW_MS;
   var discoveryCacheMs = typeof opts.discoveryCacheMs === "number"
                            ? opts.discoveryCacheMs : DEFAULT_DISCOVERY_CACHE_MS;

package/lib/auth/sd-jwt-vc.js

@@ -62,6 +62,7 @@
 
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("../crypto");
+var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var safeJson = require("../safe-json");
 var validateOpts = require("../validate-opts");
@@ -523,6 +524,12 @@ async function verify(presentation, opts) {
   // 2. Validate iss / iat / exp / vct
   var nowSec = (typeof opts.now === "number" && isFinite(opts.now))
     ? Math.floor(opts.now / 1000) : Math.floor(Date.now() / 1000);                  // ms→s conversion factor
+  // A present maxClockSkewSec must be a non-negative finite integer; a bare
+  // typeof check lets Infinity/NaN through, and `exp < nowSec - Infinity` (or
+  // NaN) is always false — silently accepting an expired credential. Reject a
+  // malformed skew (operator config).
+  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.maxClockSkewSec,
+    "verify: opts.maxClockSkewSec", AuthError, "auth-sd-jwt-vc/bad-clock-skew");
   var skew = (typeof opts.maxClockSkewSec === "number") ? opts.maxClockSkewSec : 60; // allow:raw-time-literal — default 60s clock-skew tolerance
   if (typeof jwtParsed.payload.iat === "number" && jwtParsed.payload.iat > nowSec + skew) {
     throw new AuthError("auth-sd-jwt-vc/iat-future",

package/lib/http-message-signature.js

@@ -561,8 +561,16 @@ function verify(msg, opts) {
   // itself still has to verify — only the floor is waived).
   validateOpts.optionalNonEmptyStringArray(opts.requiredComponents,
     "httpSig.verify: requiredComponents", HttpSigError, "BAD_OPT");
-  var toleranceMs = typeof opts.toleranceMs === "number" ? opts.toleranceMs : DEFAULT_TOLERANCE_MS;
-  var clockSkewMs = typeof opts.clockSkewMs === "number" ? opts.clockSkewMs : DEFAULT_CLOCK_SKEW_MS;
+  // A present toleranceMs / clockSkewMs must be a non-negative finite number;
+  // a bare typeof check lets Infinity/NaN through, and `ageMs > Infinity` (the
+  // expiry gate) or `-ageMs > Infinity` (the future-dating gate) is always
+  // false — silently accepting a stale (replayed) or future-dated signature.
+  // verify() returns verdicts rather than throwing, so a malformed value falls
+  // back to the safe default instead of disabling the window.
+  var toleranceMs = (typeof opts.toleranceMs === "number" && isFinite(opts.toleranceMs) && opts.toleranceMs >= 0)
+    ? opts.toleranceMs : DEFAULT_TOLERANCE_MS;
+  var clockSkewMs = (typeof opts.clockSkewMs === "number" && isFinite(opts.clockSkewMs) && opts.clockSkewMs >= 0)
+    ? opts.clockSkewMs : DEFAULT_CLOCK_SKEW_MS;
   var nowMs = opts.now ? opts.now() : Date.now();
 
   var sigInput = _resolveHeader(m.headers, "signature-input");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.63",
+  "version": "0.15.64",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c128c8b9-913b-4784-824b-3955b67b7bda",
+  "serialNumber": "urn:uuid:f9782178-0584-49aa-8fd6-3029b774391a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-29T20:57:16.088Z",
+    "timestamp": "2026-06-29T22:06:28.985Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.63",
+      "bom-ref": "@blamejs/core@0.15.64",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.63",
+      "version": "0.15.64",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.63",
+      "purl": "pkg:npm/%40blamejs/core@0.15.64",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.63",
+      "ref": "@blamejs/core@0.15.64",
       "dependsOn": []
     }
   ]