@blamejs/core 0.6.12 → 0.6.20

package/lib/permissions.js

@@ -117,7 +117,8 @@ function _validateScopePattern(scope, ctx) {
 
 function _normalizeRoleEntry(name, entry) {
   if (Array.isArray(entry)) {
-    return { extends: [], permissions: entry.slice(), dbRole: null };
+    return { extends: [], permissions: entry.slice(), dbRole: null,
+      requireMfa: false, mfaWindowMs: null };
   }
   if (entry && typeof entry === "object") {
     var ext = entry.extends || [];
@@ -146,9 +147,19 @@ function _normalizeRoleEntry(name, entry) {
       }
       dbRole = entry.dbRole;
     }
-    return { extends: ext.slice(), permissions: perms.slice(), dbRole: dbRole };
+    var requireMfa = entry.requireMfa === true;
+    var mfaWindowMs = null;
+    if (entry.mfaWindowMs !== undefined && entry.mfaWindowMs !== null) {
+      if (typeof entry.mfaWindowMs !== "number" || !isFinite(entry.mfaWindowMs) || entry.mfaWindowMs <= 0) {
+        throw _err("BAD_ROLE",
+          "role '" + name + "': mfaWindowMs must be a positive finite number");
+      }
+      mfaWindowMs = entry.mfaWindowMs;
+    }
+    return { extends: ext.slice(), permissions: perms.slice(), dbRole: dbRole,
+      requireMfa: requireMfa, mfaWindowMs: mfaWindowMs };
   }
-  throw _err("BAD_ROLE", "role '" + name + "' must be an array of scopes or { extends?, permissions, dbRole? }");
+  throw _err("BAD_ROLE", "role '" + name + "' must be an array of scopes or { extends?, permissions, dbRole?, requireMfa?, mfaWindowMs? }");
 }
 
 function _validateRoles(roles) {
@@ -279,6 +290,33 @@ function create(opts) {
   var missingActorStatus = opts.missingActorStatus || DEFAULTS.missingActorStatus;
   var responder = opts.responder || _defaultResponder;
 
+  // ABAC predicate registry. Each entry: scope-string → async predicate
+  // function (actor, context) → boolean. The middleware evaluates the
+  // predicate AFTER the RBAC scope check passes — so a route protected
+  // by `perms.require("orders.read")` first checks the actor has the
+  // orders:read scope, then (if the scope has a policy registered)
+  // evaluates the predicate with the actor + a per-request context
+  // built by the route's `context` middleware opt. ABAC + RBAC stack
+  // — a route needs to pass BOTH layers when both are configured.
+  var policies = {};
+
+  function policy(scope, predicate) {
+    _validateScopePattern(scope, "permissions.policy");
+    if (typeof predicate !== "function") {
+      throw _err("BAD_OPT", "permissions.policy: predicate must be a function (actor, context) -> bool");
+    }
+    if (policies[scope]) {
+      throw _err("DUPLICATE_POLICY", "permissions.policy: '" + scope + "' is already registered");
+    }
+    policies[scope] = predicate;
+  }
+
+  function _findPolicy(requestedScope) {
+    // Exact match wins; no wildcard expansion (a wildcard policy
+    // gating arbitrary scopes is too easy to misconfigure).
+    return policies[requestedScope] || null;
+  }
+
   function _auditEmit(action, info) {
     if (!audit) return;
     if (info && info.outcome === "success" && !auditSuccess) return;
@@ -332,7 +370,7 @@ function create(opts) {
 
   // Middleware factory. `mode` is "single" | "all" | "any"; `requested`
   // is the scope or scope list. Throw at registration time on bad shape.
-  function _middleware(mode, requested) {
+  function _middleware(mode, requested, mwOpts) {
     if (mode === "single") {
       _validateScopePattern(requested, "permissions.require");
     } else {
@@ -345,7 +383,31 @@ function create(opts) {
       }
     }
 
-    return function permissionsMiddleware(req, res, next) {
+    // Per-route MFA enforcement opts: { requireMfa, mfaWindowMs }.
+    // When set, the middleware blocks unless the actor's mfaAuthenticated
+    // flag is truthy AND (when mfaWindowMs is set) actor.mfaAt is fresher
+    // than (now - mfaWindowMs). The actor signal is operator-set: after
+    // a successful TOTP / passkey step-up, the route handler stamps
+    // req.user.mfaAuthenticated = true and req.user.mfaAt = Date.now().
+    mwOpts = mwOpts || {};
+    var routeRequireMfa  = mwOpts.requireMfa === true;
+    var routeMfaWindowMs = null;
+    if (mwOpts.mfaWindowMs !== undefined && mwOpts.mfaWindowMs !== null) {
+      if (typeof mwOpts.mfaWindowMs !== "number" || !isFinite(mwOpts.mfaWindowMs) || mwOpts.mfaWindowMs <= 0) {
+        throw _err("BAD_OPT", "permissions middleware: mfaWindowMs must be a positive finite number");
+      }
+      routeMfaWindowMs = mwOpts.mfaWindowMs;
+    }
+    // ABAC context provider — operator-supplied function (req)→object.
+    // The function runs once per request, AFTER scope/MFA pass, BEFORE
+    // the policy predicate. Whatever it returns is passed to the
+    // policy as `context`. Async functions are awaited.
+    var contextProvider = mwOpts.context;
+    if (contextProvider !== undefined && typeof contextProvider !== "function") {
+      throw _err("BAD_OPT", "permissions middleware: context must be a function (req) -> object");
+    }
+
+    return async function permissionsMiddleware(req, res, next) {
       var actor = resolver(req);
       if (!actor) {
         // Diagnostic: the most common cause of a null actor is that
@@ -392,13 +454,164 @@ function create(opts) {
         });
       }
 
+      // MFA enforcement gate. Two sources of "this needs MFA":
+      //   1. Per-route opt: perms.require("scope", { requireMfa: true })
+      //   2. Per-role flag: a role spec with requireMfa:true that
+      //      contributes to satisfying the requested scope
+      // Either source enabling MFA forces the gate. mfaWindowMs (per-route
+      // OR per-role, route wins on conflict) bounds freshness — without
+      // it, ANY past MFA stamp counts (which is too permissive for high-
+      // value routes; operators set a window like C.TIME.minutes(15)).
+      var enforceMfa = routeRequireMfa;
+      var enforceWindowMs = routeMfaWindowMs;
+      if (!enforceMfa) {
+        // Walk the actor's roles and check whether any role with
+        // requireMfa=true contributes a permission that matches the
+        // requested scope. If so, MFA is required regardless of the
+        // route-level opt.
+        var actorRoles = Array.isArray(actor.roles) ? actor.roles : [];
+        for (var ri = 0; ri < actorRoles.length; ri++) {
+          var rname = actorRoles[ri];
+          if (typeof rname !== "string") continue;
+          var rspec = roleTable[rname];
+          if (!rspec || !rspec.requireMfa) continue;
+          // Cheap match: if the role grants any scope that satisfies the
+          // requested scope (single mode) or any of the requested
+          // (all/any modes), MFA is required for this route.
+          var visited = new Set();
+          var roleScopes = [];
+          _expandOne(rname, roleTable, visited, roleScopes);
+          var roleMatches = false;
+          var requestedList = mode === "single" ? [requested] : requested;
+          outer: for (var rj = 0; rj < roleScopes.length; rj++) {
+            for (var rk = 0; rk < requestedList.length; rk++) {
+              if (match(roleScopes[rj], requestedList[rk])) {
+                roleMatches = true; break outer;
+              }
+            }
+          }
+          if (roleMatches) {
+            enforceMfa = true;
+            if (enforceWindowMs === null && rspec.mfaWindowMs !== null) {
+              enforceWindowMs = rspec.mfaWindowMs;
+            }
+          }
+        }
+      }
+
+      if (enforceMfa) {
+        var mfaOk = actor.mfaAuthenticated === true;
+        if (mfaOk && enforceWindowMs !== null) {
+          var mfaAt = typeof actor.mfaAt === "number" ? actor.mfaAt : 0;
+          if (Date.now() - mfaAt > enforceWindowMs) {
+            mfaOk = false;
+          }
+        }
+        if (!mfaOk) {
+          _emitEvent("permissions.mfa_required", 1,
+            { requested: _labelize(requested), mode: mode });
+          _auditEmit("permissions.mfa.required", {
+            actor:    _actorAuditShape(actor, req),
+            resource: { kind: "permission", id: _labelize(requested) },
+            outcome:  "denied",
+            reason:   "mfa-required",
+            metadata: { mode: mode, windowMs: enforceWindowMs },
+          });
+          return responder(req, res, denyStatus, {
+            error:     "mfa_required",
+            status:    denyStatus,
+            requested: _labelize(requested),
+          });
+        }
+      }
+
+      // ABAC layer fires for every requested scope that has a
+      // registered policy predicate. Single-mode evaluates the one
+      // scope; requireAll evaluates each scope's policy (every must
+      // pass); requireAny evaluates only the policies on scopes the
+      // actor's RBAC layer satisfied (so a failing policy on a scope
+      // the actor doesn't even hold doesn't leak the policy's
+      // existence). Each predicate failure short-circuits with a
+      // policy.deny audit row naming the failing scope.
+      var policyTargets = [];
+      if (mode === "single" && _findPolicy(requested)) {
+        policyTargets.push(requested);
+      } else if (mode === "all" || mode === "any") {
+        for (var pi = 0; pi < requested.length; pi++) {
+          if (_findPolicy(requested[pi])) {
+            if (mode === "any" && !check(actor, requested[pi])) continue;
+            policyTargets.push(requested[pi]);
+          }
+        }
+      }
+      if (policyTargets.length > 0) {
+        var policyContext = null;
+        if (contextProvider) {
+          try {
+            policyContext = await contextProvider(req);
+          } catch (e) {
+            _emitEvent("permissions.policy_context_error", 1,
+              { requested: _labelize(requested) });
+            _auditEmit("permissions.policy.error", {
+              actor:    _actorAuditShape(actor, req),
+              resource: { kind: "permission", id: _labelize(requested) },
+              outcome:  "failure",
+              reason:   "context-provider-threw",
+              metadata: { error: (e && e.message) || String(e), mode: mode },
+            });
+            return responder(req, res, denyStatus, {
+              error:     "policy_context_error",
+              status:    denyStatus,
+              requested: _labelize(requested),
+            });
+          }
+        }
+        for (var pti = 0; pti < policyTargets.length; pti++) {
+          var thisScope = policyTargets[pti];
+          var pred = _findPolicy(thisScope);
+          var verdict;
+          try {
+            verdict = await pred(actor, policyContext);
+          } catch (e2) {
+            _emitEvent("permissions.policy_error", 1, { requested: thisScope });
+            _auditEmit("permissions.policy.error", {
+              actor:    _actorAuditShape(actor, req),
+              resource: { kind: "permission", id: thisScope },
+              outcome:  "failure",
+              reason:   "predicate-threw",
+              metadata: { error: (e2 && e2.message) || String(e2), mode: mode },
+            });
+            return responder(req, res, denyStatus, {
+              error:     "policy_error",
+              status:    denyStatus,
+              requested: thisScope,
+            });
+          }
+          if (verdict !== true) {
+            _emitEvent("permissions.policy_denied", 1, { requested: thisScope });
+            _auditEmit("permissions.policy.deny", {
+              actor:    _actorAuditShape(actor, req),
+              resource: { kind: "permission", id: thisScope },
+              outcome:  "failure",
+              reason:   "policy-predicate-returned-falsy",
+              metadata: { mode: mode, scopeIndex: pti },
+            });
+            return responder(req, res, denyStatus, {
+              error:     "policy_denied",
+              status:    denyStatus,
+              requested: thisScope,
+            });
+          }
+        }
+      }
+
       _emitEvent("permissions.check", 1,
         { outcome: "success", mode: mode });
       _auditEmit("permissions.check.success", {
         actor:    _actorAuditShape(actor, req),
         resource: { kind: "permission", id: _labelize(requested) },
         outcome:  "success",
-        metadata: { mode: mode },
+        metadata: { mode: mode, mfaEnforced: enforceMfa },
       });
       next();
     };
@@ -443,9 +656,10 @@ function create(opts) {
   }
 
   return {
-    require:    function (scope)  { return _middleware("single", scope); },
-    requireAll: function (scopes) { return _middleware("all",    scopes); },
-    requireAny: function (scopes) { return _middleware("any",    scopes); },
+    require:    function (scope, mwOpts)  { return _middleware("single", scope,  mwOpts); },
+    requireAll: function (scopes, mwOpts) { return _middleware("all",    scopes, mwOpts); },
+    requireAny: function (scopes, mwOpts) { return _middleware("any",    scopes, mwOpts); },
+    policy:     policy,
     check:      check,
     checkAll:   checkAll,
     checkAny:   checkAny,

package/lib/pqc-agent.js

@@ -31,6 +31,7 @@
 var https = require("node:https");
 var http  = require("node:http");
 var C = require("./constants");
+var networkTls = require("./network-tls");
 
 // Defaults for connection pooling. These ARE overridable via opts —
 // only the cryptographic posture (ecdhCurve / minVersion) is locked.
@@ -45,12 +46,11 @@ var DEFAULT_OPTS = {
 function _buildAgentOpts(opts) {
   opts = opts || {};
   var merged = Object.assign({}, DEFAULT_OPTS, opts);
-  // Cryptographic posture cannot be relaxed via opts. Even if the
-  // operator passes ecdhCurve: 'P-256' or minVersion: 'TLSv1.2', the
-  // framework defaults win. This is deliberate: the primitive's whole
-  // value is that you can't accidentally ship a downgraded agent.
   merged.ecdhCurve  = C.TLS_GROUP_CURVE_STR;
   merged.minVersion = "TLSv1.3";
+  if (networkTls && typeof networkTls.applyToContext === "function") {
+    merged = networkTls.applyToContext({ base: merged });
+  }
   return merged;
 }
 

package/lib/queue.js

@@ -34,6 +34,7 @@ var C = require("./constants");
 var clusterStorage = require("./cluster-storage");
 var crypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
+var numericChecks = require("./numeric-checks");
 var observability = require("./observability");
 var protocolDispatcher = require("./protocol-dispatcher");
 var localProto = require("./queue-local");
@@ -190,11 +191,10 @@ function consume(queueName, handler, opts) {
   if (opts.rateLimit) {
     var rlMax = opts.rateLimit.max;
     var rlPer = opts.rateLimit.perSeconds;
-    // Strict positive-finite on both: NaN, Infinity, 0, and negatives
-    // all produce undefined throttling math (NaN deque comparisons,
-    // perma-locked queues, perma-open windows). Reject at config time.
-    if (typeof rlMax !== "number" || !isFinite(rlMax) || rlMax <= 0 || Math.floor(rlMax) !== rlMax ||
-        typeof rlPer !== "number" || !isFinite(rlPer) || rlPer <= 0) {
+    // NaN, Infinity, 0, negatives, fractional max all produce undefined
+    // throttling math (NaN deque comparisons, perma-locked queues,
+    // perma-open windows). Reject at config time.
+    if (!numericChecks.isPositiveInt(rlMax) || !numericChecks.isPositiveFinite(rlPer)) {
       throw _err("BAD_RATE_LIMIT",
         "consume({ rateLimit }): expected { max: positive integer, perSeconds: positive finite number }, got " +
         JSON.stringify(opts.rateLimit), true);

package/lib/restore.js

@@ -54,7 +54,9 @@
 var fs = require("fs");
 var os = require("os");
 var path = require("path");
+var C = require("./constants");
 var crypto = require("./crypto");
+var numericChecks = require("./numeric-checks");
 var restoreBundle = require("./restore-bundle");
 var restoreRollback = require("./restore-rollback");
 var lazyRequire = require("./lazy-require");
@@ -113,9 +115,9 @@ function create(opts) {
   // (defense-in-depth in case the backend lied). Default 4 GiB / 100K
   // files keeps the small-bundle path uncapped while bounding the
   // pathological case.
-  var maxPulledBytes = typeof opts.maxPulledBytes === "number" && isFinite(opts.maxPulledBytes) && opts.maxPulledBytes > 0
-    ? opts.maxPulledBytes : 4 * 1024 * 1024 * 1024;
-  var maxPulledFiles = typeof opts.maxPulledFiles === "number" && isFinite(opts.maxPulledFiles) && opts.maxPulledFiles > 0
+  var maxPulledBytes = numericChecks.isPositiveFinite(opts.maxPulledBytes)
+    ? opts.maxPulledBytes : C.BYTES.gib(4);
+  var maxPulledFiles = numericChecks.isPositiveInt(opts.maxPulledFiles)
     ? opts.maxPulledFiles : 100000;
 
   function _walkPullDirFootprint(dir) {