@cboxdk/id-js 0.19.0 → 0.20.0

package/dist/index.cjs

@@ -675,11 +675,11 @@ function parseActor(claim, depth) {
   if (typeof claim !== "object" || Array.isArray(claim)) {
     return { sub: null, actor: null };
   }
-  const record = claim;
-  const sub = record["sub"];
+  const record2 = claim;
+  const sub = record2["sub"];
   return {
     sub: typeof sub === "string" && sub !== "" ? sub : null,
-    actor: depth + 1 < MAX_ACTOR_DEPTH ? parseActor(record["act"], depth + 1) : null
+    actor: depth + 1 < MAX_ACTOR_DEPTH ? parseActor(record2["act"], depth + 1) : null
   };
 }
 function stringList(claim) {
@@ -944,9 +944,9 @@ function header(headers, name) {
   if (typeof Headers !== "undefined" && headers instanceof Headers) {
     return headers.get(name) ?? void 0;
   }
-  const record = headers;
-  const key = Object.keys(record).find((k) => k.toLowerCase() === name);
-  const value = key === void 0 ? void 0 : record[key];
+  const record2 = headers;
+  const key = Object.keys(record2).find((k) => k.toLowerCase() === name);
+  const value = key === void 0 ? void 0 : record2[key];
   return Array.isArray(value) ? value.join(" ") : value;
 }
 function base64ToBytes(value) {
@@ -1644,11 +1644,11 @@ function parseOrganizations(claim) {
     if (typeof entry !== "object" || entry === null) {
       continue;
     }
-    const record = entry;
-    const id = record["id"];
-    const name = record["name"];
+    const record2 = entry;
+    const id = record2["id"];
+    const name = record2["name"];
     if (typeof id === "string" && id !== "" && typeof name === "string" && name !== "") {
-      orgs.push({ id, name, role: typeof record["role"] === "string" ? record["role"] : null });
+      orgs.push({ id, name, role: typeof record2["role"] === "string" ? record2["role"] : null });
     }
   }
   return orgs;
@@ -1702,6 +1702,11 @@ async function publishManifest(config, declaration) {
     throw new ConfigurationError("Publishing a manifest needs issuer, clientId and clientSecret.");
   }
   const timeoutMs = config.timeoutMs ?? 1e4;
+  assertSecureIssuer(config.issuer);
+  const issuer = new URL(config.issuer);
+  if (issuer.username || issuer.password || issuer.search || issuer.hash) {
+    throw new ConfigurationError("The manifest issuer must not contain credentials, a query or a fragment.");
+  }
   const manifest = await buildManifest(declaration);
   const discovery = new Discovery(config.issuer, timeoutMs, 36e5);
   const token = await mintToken(config, discovery, timeoutMs);
@@ -1709,6 +1714,7 @@ async function publishManifest(config, declaration) {
     `${config.issuer.replace(/\/$/, "")}/api/v1/apps/manifest`,
     {
       method: "POST",
+      redirect: "error",
       headers: {
         authorization: `Bearer ${token}`,
         accept: "application/json",
@@ -1719,10 +1725,20 @@ async function publishManifest(config, declaration) {
     timeoutMs
   );
   if (!response.ok) {
-    throw new AuthenticationError(`Manifest push failed: HTTP ${response.status} ${await response.text()}`);
+    throw new AuthenticationError(`Manifest push failed: HTTP ${response.status}`);
+  }
+  const json2 = await response.json().catch(() => {
+    throw new AuthenticationError("Cbox ID returned an invalid manifest acknowledgement.");
+  });
+  const checksum = await sha256Hex(canonicalManifestJson(declaration.permissions ?? [], declaration.roles ?? []));
+  if (json2 === null || typeof json2 !== "object" || Array.isArray(json2)) {
+    throw new AuthenticationError("Cbox ID did not acknowledge the authorization manifest.");
   }
-  const json2 = await response.json();
-  return json2 !== null && typeof json2 === "object" ? json2 : {};
+  const summary = json2;
+  if (summary.client_id !== config.clientId || summary.version !== manifest.version || summary.checksum !== checksum || typeof summary.unchanged !== "boolean" || !Number.isInteger(summary.roles_declared) || !Number.isInteger(summary.permissions_declared) || (summary.roles_declared ?? -1) < 0 || (summary.permissions_declared ?? -1) < 0 || !summary.unchanged && (summary.roles_declared !== manifest.roles.length || summary.permissions_declared !== manifest.permissions.length)) {
+    throw new AuthenticationError("Cbox ID did not acknowledge this app and its complete authorization manifest.");
+  }
+  return summary;
 }
 async function mintToken(config, discovery, timeoutMs) {
   const response = await fetchWithTimeout(
@@ -1730,6 +1746,7 @@ async function mintToken(config, discovery, timeoutMs) {
     {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded" },
+      redirect: "error",
       body: new URLSearchParams({
         grant_type: "client_credentials",
         client_id: config.clientId,
@@ -1740,7 +1757,7 @@ async function mintToken(config, discovery, timeoutMs) {
     timeoutMs
   );
   const json2 = await response.json().catch(() => ({}));
-  if (typeof json2.access_token !== "string" || json2.access_token === "") {
+  if (!response.ok || typeof json2.access_token !== "string" || json2.access_token === "") {
     throw new AuthenticationError(
       "Could not obtain an apps.manifest access token \u2014 check the client credentials and that the client holds the apps.manifest scope."
     );
@@ -1862,6 +1879,8 @@ async function fetchWithTimeout(url, init, timeoutMs) {
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
     return await fetch(url, { ...init, signal: controller.signal });
+  } catch {
+    throw new AuthenticationError("Cbox ID manifest publication could not be verified.");
   } finally {
     clearTimeout(timer);
   }
@@ -1875,6 +1894,98 @@ function assertLegacyLogin(legacy) {
   }
 }
 
+// src/decisions.ts
+var PermissionDecision = class {
+  constructor(subject, organization2, clientId, organizationRole, organizationActive, permissions2) {
+    this.subject = subject;
+    this.organization = organization2;
+    this.clientId = clientId;
+    this.organizationRole = organizationRole;
+    this.organizationActive = organizationActive;
+    this.permissions = permissions2;
+  }
+  subject;
+  organization;
+  clientId;
+  organizationRole;
+  organizationActive;
+  permissions;
+  allows(permission) {
+    return this.organizationActive && this.permissions[permission] === true;
+  }
+  allowed() {
+    const values = Object.values(this.permissions);
+    return this.organizationActive && values.length > 0 && values.every((value) => value === true);
+  }
+};
+async function checkPermissions(config, accessToken, subject, organization2, permissions2) {
+  assertSecureIssuer(config.issuer);
+  const issuer = new URL(config.issuer);
+  if (issuer.username || issuer.password || issuer.search || issuer.hash || !config.clientId || !subject || organization2 === "" || !accessToken || accessToken.length > 32768 || /[\x00-\x20\x7f]/.test(accessToken) || !permissions2.length || permissions2.length > 50 || permissions2.some((permission) => !permission.trim() || new TextEncoder().encode(permission).length > 255)) {
+    throw new ConfigurationError("Permission decision request is not configured or valid.");
+  }
+  const requested = [...new Set(permissions2)];
+  try {
+    const response = await fetch(`${config.issuer.replace(/\/$/, "")}/oauth/decisions`, {
+      method: "POST",
+      redirect: "error",
+      cache: "no-store",
+      signal: AbortSignal.timeout(Math.max(1, config.timeoutMs ?? 1e4)),
+      headers: { authorization: `Bearer ${accessToken}`, accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({ subject, org: organization2, permission: requested })
+    });
+    if (response.status !== 200) {
+      await response.body?.cancel();
+      throw new AuthenticationError("Permission decision could not be verified.", void 0, void 0, response.status);
+    }
+    const reader = response.body?.getReader();
+    if (!reader) throw new AuthenticationError("Permission decision response is invalid.");
+    let size = 0;
+    let raw = "";
+    const decoder = new TextDecoder();
+    try {
+      for (; ; ) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > 65536) throw new AuthenticationError("Permission decision response exceeded its limit.");
+        raw += decoder.decode(value, { stream: true });
+      }
+      raw += decoder.decode();
+    } finally {
+      await reader.cancel();
+      reader.releaseLock();
+    }
+    const data = JSON.parse(raw);
+    if (!record(data) || !record(data.subject) || data.mode !== "rbac" || data.subject.type !== "user" || data.subject.id !== subject || data.organization !== organization2 || data.client_id !== config.clientId || typeof data.organization_active !== "boolean" || typeof data.allowed !== "boolean" || !(data.org_role === null || typeof data.org_role === "string" && ["owner", "admin", "developer", "member", "viewer"].includes(data.org_role)) || !Array.isArray(data.results) || data.results.length !== requested.length) {
+      throw new AuthenticationError("Permission decision response binding is invalid.");
+    }
+    const checks = /* @__PURE__ */ Object.create(null);
+    for (const result of data.results) {
+      if (!record(result) || typeof result.permission !== "string" || typeof result.allowed !== "boolean" || !requested.includes(result.permission) || Object.hasOwn(checks, result.permission)) {
+        throw new AuthenticationError("Permission decision result is invalid.");
+      }
+      checks[result.permission] = result.allowed;
+    }
+    const decision = new PermissionDecision(
+      subject,
+      organization2,
+      config.clientId,
+      data.org_role,
+      data.organization_active,
+      Object.freeze(checks)
+    );
+    if (data.allowed !== decision.allowed()) throw new AuthenticationError("Permission decision result is inconsistent.");
+    return decision;
+  } catch (error) {
+    if (error instanceof AuthenticationError) throw error;
+    throw new AuthenticationError("Permission decision could not be verified.");
+  }
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
 exports.AuthenticationError = AuthenticationError;
 exports.CboxIdClient = CboxIdClient;
 exports.CboxIdError = CboxIdError;
@@ -1883,6 +1994,7 @@ exports.ConfigurationError = ConfigurationError;
 exports.FEATURE_FLAGS_SCOPE = FEATURE_FLAGS_SCOPE;
 exports.FrontendApiError = FrontendApiError;
 exports.InvalidStateError = InvalidStateError;
+exports.PermissionDecision = PermissionDecision;
 exports.PipeLeaseDeniedError = PipeLeaseDeniedError;
 exports.PipeLeaseError = PipeLeaseError;
 exports.PipeNotConnectedError = PipeNotConnectedError;
@@ -1892,6 +2004,7 @@ exports.VaultClient = VaultClient;
 exports.actor = actor;
 exports.buildManifest = buildManifest;
 exports.challenge = challenge;
+exports.checkPermissions = checkPermissions;
 exports.createLegacyVerifier = createLegacyVerifier;
 exports.createVerifier = createVerifier;
 exports.defineAuthz = defineAuthz;