@blamejs/core 0.15.64 → 0.15.65

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.65 (2026-06-29) — **The account-takeover kill-switch now actually locks the account: b.auth.lockout gains a lock() method and the kill-switch engages it through the operator's lockout instance.** b.auth.atoKillSwitch.trigger is the incident-response path for a compromised account: it destroys the user's sessions and then locks them out of new logins. The lockout step called b.auth.lockout.lock(), but no such method existed (and the kill-switch invoked it on the lockout module, which has no store), so the call threw and was swallowed — the kill-switch reported success while never locking the account, leaving an attacker who still held the credentials free to log straight back in. b.auth.lockout instances now expose lock(key, { durationMs?, untilMs?, reason? }) to force an account into lockout immediately, atomically, independent of the failure counter, and atoKillSwitch.trigger engages it through the lockout instance the operator passes as opts.lockout. When no lockout instance is supplied the step is skipped and the result's lockoutApplied is false (with an audit row), rather than silently claiming the account was locked. The release also closes a lock-clear race in lockout and refuses a self-disabling window. **Added:** *b.auth.lockout instances expose lock()* — lock(key, { durationMs?, untilMs?, reason? }) forces an account into lockout immediately — the operator action behind an ATO kill-switch or incident response — independent of the failure counter, defaulting to a long admin lock. A forced lock is released only by an explicit unlock(): recordSuccess() does not clear it, so a successful login by someone who still holds the compromised password cannot release a kill-switch lock. It uses the same atomic compare-and-set as the failure counter and throws if the lock cannot be committed (the caller must know it did not lock). **Security:** *Account-takeover kill-switch engages the lockout instead of silently doing nothing* — b.auth.atoKillSwitch.trigger invoked b.auth.lockout.lock(), which did not exist; the call threw and was caught by a best-effort guard, so the kill-switch destroyed sessions but never locked the account — an attacker still holding valid credentials could immediately re-authenticate. b.auth.lockout instances now provide lock() (an atomic, compare-and-set forced lockout), and the kill-switch calls it on the lockout instance supplied as opts.lockout. Without a lockout instance the lockout step cannot run; the result's lockoutApplied is false and an audit row records that the account was not locked, so an operator is not misled into believing a compromised account was secured. opts.lockout is now the lockout instance (or false to skip), not a boolean toggle. · *lockout clears the failure counter atomically and refuses a zero window* — b.auth.lockout.recordSuccess and unlock cleared state with a read-then-delete, which could erase a lock a concurrent recordFailure had just engaged; they now clear under the same compare-and-set the failure path uses. create() also refuses windowMs: 0, which previously disabled lockout entirely (every failure decayed immediately and the zero-TTL state never persisted).
+
 - v0.15.64 (2026-06-29) — **Token and HTTP-message-signature verifiers now reject a non-finite clock-skew or tolerance value instead of letting it disable the expiry, not-before, and future-dating checks.** Several verifiers read an operator-supplied clock-skew or tolerance value with a bare type check that accepted Infinity and NaN. Because the resulting comparison (for example exp + skew < now, or age > tolerance) is always false when the skew or tolerance is Infinity, a misconfigured non-finite value silently disabled the time-window check — so an expired token, a not-yet-valid token, a future-dated signature, or a replayed (too-old) signature would verify. The affected paths are the shared external-JWT verifier b.auth.jwt.verifyExternal (which the JAR / signed-request-object path also uses), the SD-JWT-VC credential verifier, the OAuth ID-token and client-attestation verifiers, and the HTTP message signature verifier's freshness and clock-skew windows. Each now requires a present skew or tolerance to be a non-negative finite number: the throw-based JWT, SD-JWT-VC, and OAuth verifiers reject a malformed value, and the verdict-returning HTTP-message-signature verifier falls back to its safe default rather than disabling the window. A build check now fails if any verifier reads one of these options without a finiteness guard. **Added:** *verifyExternal and jar.parse accept an `now` clock override* — b.auth.jwt.verifyExternal and b.auth.jar.parse now accept an optional `now` (a finite epoch-milliseconds value) to evaluate a token's exp / nbf / iat as of a specific instant instead of the wall clock — consistent with b.auth.sdJwtVc.verify. A negative clockSkewMs is no longer accepted as a way to shift the evaluation time; use `now`. **Security:** *Non-finite clock-skew / tolerance no longer disables a verifier's time-window check* — b.auth.jwt.verifyExternal, b.auth.sdJwtVc.verify, b.auth.oauth (ID-token and client-attestation verification), and the HTTP message signature verifier read their clock-skew, max-clock-skew, max-PoP-age, and tolerance options with a bare `typeof === "number"` check that let Infinity and NaN through. With such a value the expiry / not-before / future-dating comparison is always false, so the check was silently skipped and an expired or not-yet-valid token — or a future-dated or replayed signature — would verify. The JWT, SD-JWT-VC, and OAuth verifiers now reject a non-finite or negative skew (the option is operator configuration, not attacker-controlled), and the HTTP message signature verifier falls back to its default tolerance and skew. The CWT, DPoP, SAML, and OpenID Federation verifiers already enforced this and are unchanged. **Detectors:** *Verifier clock-skew / tolerance options must be finite-guarded* — A build check fails if a verifier reads a clock-skew or tolerance option with a bare `typeof === "number"` without a finiteness guard (a non-negative-finite check, an inline isFinite fallback, or a create-time non-negative-finite schema), preventing a future verifier from reintroducing the disable-the-window class.
 
 - v0.15.63 (2026-06-29) — **OID4VCI now enforces single-use of a pre-authorized code and of a single-use access token under concurrency, so two simultaneous requests can no longer mint two credentials from one.** On the OID4VCI credential issuer, two single-use values were consumed by a delete whose result was ignored, so concurrent requests could each act on the same value. exchangePreAuthorizedCode read the pre-authorized code's entry, validated the transaction code, then deleted the code and minted an access token without checking that its own call had removed the entry — two simultaneous /token requests with the same code each saw the entry, each deleted it, and each minted a distinct access token, issuing two access tokens (and ultimately two credentials) from a code OID4VCI requires to be single-use. issueCredential had the same shape: with single-use access tokens (the default), it minted the credential first and deleted the access token afterward as best-effort cleanup, so two concurrent requests bearing the same token both read it and the same not-yet-rotated c_nonce, both proofs verified, and both minted a credential. Both paths now claim the value with an atomic delete and proceed only when that delete succeeded; the losing request is refused. The transaction-code and proof checks still run first, so a bad transaction code or proof does not consume the value (a wallet can retry). **Security:** *OID4VCI pre-authorized code and access token are single-use under concurrency* — exchangePreAuthorizedCode and issueCredential consumed their single-use value (the pre-authorized code, and the single-use access token) with a delete whose return was discarded, and in issueCredential's case after the credential was already minted. Two concurrent requests carrying the same value therefore each succeeded — minting two access tokens from one pre-authorized code, or two credentials from one single-use access token — defeating the single-use guarantee OID4VCI §3.5 requires (an authorization intended for one credential could yield two). Both paths now delete the value atomically and issue only if that delete removed it, refusing the request that lost the race; the transaction-code and proof verifications run before the claim, so an invalid attempt does not burn the value. If the operator's credential issuer throws after the access token has been claimed (a transient signer outage), the token is restored so the wallet can retry rather than being permanently consumed without a credential.

package/lib/auth/ato-kill-switch.js

@@ -10,17 +10,22 @@
  * cleanup path once the trigger fires:
  *
  *   1. destroy every session for the user across the cluster
- *   2. lock the user out of new logins (b.auth.lockout)
+ *   2. lock the user out of new logins via the supplied lockout instance
  *   3. emit an audit row with reason / actor for downstream forensics
  *
  *   await b.auth.atoKillSwitch.trigger({
  *     userId:    "u_42",
  *     reason:    "fraud-signal: 14 failed MFA from new geo",
  *     actor:     { id: req.user && req.user.id, role: req.user && req.user.role },
- *     lockout:   true,                  // default true
+ *     lockout:   appLockout,            // a b.auth.lockout instance (or false to skip)
  *     accessLock: "locked",             // optional — flip the global access-lock mode
  *   });
  *
+ * The lockout step needs the operator's configured b.auth.lockout instance
+ * (there is no module-level lockout store); pass it as `opts.lockout`. When it
+ * is omitted, the lockout step is skipped and the returned `lockoutApplied` is
+ * false (with an audit row) — the account is NOT locked.
+ *
  * Returns `{ sessionsDestroyed, lockoutApplied, accessLockMode }`.
  */
 
@@ -29,7 +34,6 @@ var validateOpts = require("../validate-opts");
 var { defineClass } = require("../framework-error");
 
 var session = lazyRequire(function () { return require("../session"); });
-var lockout = lazyRequire(function () { return require("./lockout"); });
 var accessLock = lazyRequire(function () { return require("./access-lock"); });
 var audit = lazyRequire(function () { return require("../audit"); });
 
@@ -43,8 +47,15 @@ async function trigger(opts) {
 
   validateOpts.requireNonEmptyString(opts.userId, "userId", AtoKillSwitchError, "auth-ato-kill-switch/missing-user-id");
   validateOpts.requireNonEmptyString(opts.reason, "reason", AtoKillSwitchError, "auth-ato-kill-switch/missing-reason");
-  var doLockout       = opts.lockout !== false;
-  var accessLockMode  = typeof opts.accessLock === "string" ? opts.accessLock : null;
+  // opts.lockout is the operator's configured b.auth.lockout INSTANCE to lock
+  // the account in (or false to skip the lockout step). The kill-switch needs
+  // that instance's store to engage the lock — there is no module-level lockout
+  // singleton — so without an instance the lockout step cannot run and is
+  // reported (rather than silently claiming success while never locking).
+  var skipLockout    = opts.lockout === false;
+  var lockoutInst    = (opts.lockout && typeof opts.lockout === "object" &&
+                        typeof opts.lockout.lock === "function") ? opts.lockout : null;
+  var accessLockMode = typeof opts.accessLock === "string" ? opts.accessLock : null;
 
   var sessionsDestroyed = 0;
   try {
@@ -63,13 +74,37 @@ async function trigger(opts) {
   }
 
   var lockoutApplied = false;
-  if (doLockout) {
-    try {
-      await lockout().lock(opts.userId, {
-        reason: "ato-kill-switch:" + opts.reason,
+  if (!skipLockout) {
+    if (lockoutInst) {
+      try {
+        await lockoutInst.lock(opts.userId, {
+          reason: "ato-kill-switch:" + opts.reason,
+        });
+        lockoutApplied = true;
+      } catch (e) {
+        // The lockout step failed (e.g. a cache outage) AFTER sessions were
+        // destroyed. Don't fail the whole kill-switch — but surface it so the
+        // operator knows the account was NOT locked, rather than swallowing.
+        audit().safeEmit({
+          action: "auth.ato_kill_switch.partial",
+          outcome: "failure",
+          metadata: { userId: opts.userId, step: "lockout", reason: e && e.message },
+        });
+      }
+    } else {
+      // No lockout instance supplied: the kill-switch cannot lock the account.
+      // Report it (the result's lockoutApplied stays false) so the operator
+      // doesn't believe the user was locked out of new logins.
+      audit().safeEmit({
+        action: "auth.ato_kill_switch.partial",
+        outcome: "failure",
+        metadata: {
+          userId: opts.userId,
+          step:   "lockout",
+          reason: "no lockout instance supplied (pass opts.lockout = b.auth.lockout.create({ cache, namespace }))",
+        },
       });
-      lockoutApplied = true;
-    } catch (_e) { /* lockout is best-effort; sessions already destroyed */ }
+    }
   }
 
   var modeApplied = null;

package/lib/auth/lockout.js

@@ -90,6 +90,11 @@ var observability = lazyRequire(function () { return require("../observability")
 
 var _err = LockoutError.factory;
 
+// Default duration for an operator-forced lock() (ATO kill-switch / incident
+// response) when neither untilMs nor durationMs is supplied — long enough to
+// require an explicit admin unlock() during an active incident.
+var DEFAULT_ADMIN_LOCK_MS = C.TIME.hours(24);
+
 var DEFAULTS = Object.freeze({
   maxAttempts:     5,
   windowMs:        C.TIME.minutes(15),
@@ -173,7 +178,11 @@ function create(opts) {
   _requirePositiveInt("maxAttempts", maxAttempts);
 
   var windowMs = opts.windowMs !== undefined ? opts.windowMs : DEFAULTS.windowMs;
-  _requireNonNegFinite("windowMs", windowMs);
+  // windowMs must be POSITIVE: a 0 window makes every failure "decay" on the
+  // next request (the `now - lastFailureAt > windowMs` reset fires for any
+  // elapsed time) so the counter never reaches maxAttempts, AND the cache TTL
+  // of 0 makes the state non-persistent — together silently disabling lockout.
+  _requirePositiveInt("windowMs", windowMs);
 
   var lockoutDurations = opts.lockoutDurations !== undefined
                             ? opts.lockoutDurations : DEFAULTS.lockoutDurations;
@@ -242,6 +251,49 @@ function create(opts) {
     }
   }
 
+  // Atomically clear the lockout state under a compare-and-set, so a clear
+  // (recordSuccess / unlock) cannot race a concurrent recordFailure that just
+  // engaged a lock — a read-then-del would erase that fresh lock. onState is
+  // invoked with the pre-clear state inside the CAS mutator (it may re-run on a
+  // retry; the last invocation reflects the committed state) to capture audit
+  // detail. On a backend that can't do an atomic update at runtime it falls
+  // back to read-then-del (a lost clear leaves a lock in place — fail-safe).
+  // preserveIf(state) → true to KEEP the state (abort the clear) rather than
+  // delete it. recordSuccess passes a predicate that preserves an active forced
+  // (admin / ATO kill-switch) lock, so a successful login by someone who still
+  // holds the compromised password cannot clear it — only an explicit unlock()
+  // releases a forced lock.
+  async function _atomicClear(key, onState, preserveIf) {
+    try {
+      await cache.update(_scopedKey(key), function (state) {
+        state = state || null;
+        onState(state);
+        if (!state) return { abort: true };
+        if (preserveIf && preserveIf(state)) return { abort: true };
+        return { delete: true };
+      }, { ttlMs: windowMs });
+    } catch (e) {
+      if (e && e.code === "UNSUPPORTED") {
+        var st = await _readState(key);
+        onState(st);
+        if (st && !(preserveIf && preserveIf(st))) await _deleteState(key);
+        return;
+      }
+      _signalCacheError("update");
+      // Best-effort fallback so a transient cache error doesn't leave the
+      // counter un-cleared on the happy path.
+      var st2 = await _readState(key);
+      onState(st2);
+      if (st2 && !(preserveIf && preserveIf(st2))) await _deleteState(key);
+    }
+  }
+
+  // An active forced/admin lock (set by lock()) must survive recordSuccess.
+  function _isActiveForcedLock(state) {
+    return !!(state && state.forced === true &&
+              typeof state.lockedUntil === "number" && state.lockedUntil > clock());
+  }
+
   function _verdictFromState(state, now) {
     if (!state) return { locked: false, attempts: 0 };
     if (state.lockedUntil && state.lockedUntil > now) {
@@ -380,13 +432,19 @@ function create(opts) {
   async function recordSuccess(key, callOpts) {
     _requireKey(key);
     callOpts = callOpts || {};
-    var state = await _readState(key);
-    var hadCounter = !!(state && (state.attempts > 0 || state.lockedUntil));
-    if (state) await _deleteState(key);
+    var hadCounter = false;
+    var clearedAttempts = 0;
+    // Preserve an active forced (admin / ATO) lock: a successful credential
+    // verification must not release a kill-switch lock — the password may still
+    // be the compromised one. A forced lock yields only to unlock().
+    await _atomicClear(key, function (state) {
+      hadCounter = !!(state && (state.attempts > 0 || state.lockedUntil));
+      clearedAttempts = (state && state.attempts) || 0;
+    }, _isActiveForcedLock);
     _emitObs("auth.lockout.success", { namespace: namespace });
     if (auditSuccess) {
       _emitAudit("auth.lockout.success", key, "success",
-        { attemptsCleared: (state && state.attempts) || 0,
+        { attemptsCleared: clearedAttempts,
           hadCounter:      hadCounter },
         callOpts.req);
     }
@@ -401,26 +459,93 @@ function create(opts) {
   async function unlock(key, callOpts) {
     _requireKey(key);
     callOpts = callOpts || {};
-    var state = await _readState(key);
     var now = clock();
-    var hadLock = !!(state && (
-      (state.lockedUntil && state.lockedUntil > now) ||
-      (state.attempts || 0) > 0
-    ));
-    if (state) await _deleteState(key);
+    var hadLock = false;
+    var prior = { attempts: 0, lockedUntil: null, lockNumber: 0 };
+    await _atomicClear(key, function (state) {
+      hadLock = !!(state && (
+        (state.lockedUntil && state.lockedUntil > now) ||
+        (state.attempts || 0) > 0
+      ));
+      prior = {
+        attempts:    (state && state.attempts) || 0,
+        lockedUntil: (state && state.lockedUntil) || null,
+        lockNumber:  (state && state.lockNumber) || 0,
+      };
+    });
     _emitObs("auth.lockout.unlock", { namespace: namespace });
     if (auditUnlock) {
       _emitAudit("auth.lockout.unlock", key, "success",
         { hadLock:           hadLock,
-          priorAttempts:    (state && state.attempts) || 0,
-          priorLockedUntil: (state && state.lockedUntil) || null,
-          priorLockNumber:  (state && state.lockNumber) || 0,
+          priorAttempts:    prior.attempts,
+          priorLockedUntil: prior.lockedUntil,
+          priorLockNumber:  prior.lockNumber,
           reason:           callOpts.reason || null },
         callOpts.req);
     }
     return hadLock;
   }
 
+  // Force an account into lockout immediately — the operator action behind an
+  // ATO kill-switch / incident response, independent of the failure counter.
+  // Sets lockedUntil to `untilMs` (absolute) or now+`durationMs`, defaulting to
+  // a long admin lock; bumps lockNumber so a subsequent failure ladders from
+  // here. Uses the same compare-and-set as recordFailure (atomic, retried). An
+  // admin lock that cannot be committed THROWS (the caller — e.g. the kill-
+  // switch — must know it did not lock), rather than the hot-path fail-open.
+  async function lock(key, callOpts) {
+    _requireKey(key);
+    callOpts = callOpts || {};
+    var now = clock();
+    var lockedUntil;
+    if (typeof callOpts.untilMs === "number" && isFinite(callOpts.untilMs)) {
+      lockedUntil = callOpts.untilMs;
+    } else if (typeof callOpts.durationMs === "number" && isFinite(callOpts.durationMs) && callOpts.durationMs > 0) {
+      lockedUntil = now + callOpts.durationMs;
+    } else {
+      lockedUntil = now + DEFAULT_ADMIN_LOCK_MS;
+    }
+    if (lockedUntil <= now) {
+      throw _err("BAD_OPT", "lock: resolved lockedUntil is not in the future " +
+        "(untilMs/durationMs) — use unlock() to clear a lock");
+    }
+    var ttl = lockedUntil - now + windowMs;
+    var lockNumber = 0;
+    try {
+      await cache.update(_scopedKey(key), function (state) {
+        lockNumber = ((state && state.lockNumber) || 0) + 1;
+        return {
+          value: {
+            attempts:       0,
+            lockNumber:     lockNumber,
+            firstFailureAt: (state && state.firstFailureAt) || now,
+            lastFailureAt:  now,
+            lockedUntil:    lockedUntil,
+            // Marks this as an operator-forced lock so recordSuccess won't clear
+            // it — it is released only by an explicit unlock().
+            forced:         true,
+          },
+          ttlMs: ttl,
+        };
+      }, { ttlMs: ttl });
+    } catch (e) {
+      if (e && e.code === "UNSUPPORTED") {
+        throw _err("CACHE_NO_ATOMIC_UPDATE",
+          "auth.lockout: the cache backend does not support atomic update() — " +
+          "lock() cannot enforce the lockout across nodes on a get/set-only backend.");
+      }
+      throw e;
+    }
+    _emitObs("auth.lockout.engaged", { namespace: namespace, lockNumber: String(lockNumber) });
+    if (auditEngaged) {
+      _emitAudit("auth.lockout.engaged", key, "denied",
+        { lockNumber: lockNumber, lockedUntil: lockedUntil, durationMs: lockedUntil - now,
+          forced: true, reason: callOpts.reason || null },
+        callOpts.req);
+    }
+    return { locked: true, lockedUntil: lockedUntil, lockNumber: lockNumber };
+  }
+
   async function attempts(key) {
     _requireKey(key);
     var state = await _readState(key);
@@ -437,6 +562,7 @@ function create(opts) {
     recordFailure: recordFailure,
     recordSuccess: recordSuccess,
     check:         check,
+    lock:          lock,
     unlock:        unlock,
     attempts:      attempts,
     close:         close,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.64",
+  "version": "0.15.65",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f9782178-0584-49aa-8fd6-3029b774391a",
+  "serialNumber": "urn:uuid:107d84f4-f93e-4798-846a-d948f93d854d",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-29T22:06:28.985Z",
+    "timestamp": "2026-06-29T23:25:12.730Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.64",
+      "bom-ref": "@blamejs/core@0.15.65",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.64",
+      "version": "0.15.65",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.64",
+      "purl": "pkg:npm/%40blamejs/core@0.15.65",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.64",
+      "ref": "@blamejs/core@0.15.65",
       "dependsOn": []
     }
   ]