@cotal-ai/auth 0.76.0 → 0.77.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/idp.d.ts +0 -2
- package/dist/idp.d.ts.map +1 -1
- package/dist/idp.js +3 -4
- package/dist/idp.js.map +1 -1
- package/dist/token.d.ts +3 -2
- package/dist/token.d.ts.map +1 -1
- package/dist/token.js +6 -4
- package/dist/token.js.map +1 -1
- package/package.json +4 -4
package/dist/idp.d.ts
CHANGED
|
@@ -11,8 +11,6 @@ export interface IdpConfig {
|
|
|
11
11
|
/** The pinned verification key path over the IdP's JWKS — a {@link pinnedJwksResolver} on the
|
|
12
12
|
* IdP's JWKS URL, or a local public key. The token never influences key resolution. */
|
|
13
13
|
key: JWTVerifyGetKey | CryptoKey;
|
|
14
|
-
/** Clock skew tolerance in seconds (default 5). */
|
|
15
|
-
clockToleranceSec?: number;
|
|
16
14
|
}
|
|
17
15
|
/** What the operator's ledger grants a (owner, actor) pair — the ONLY source of `scope`/`parent`
|
|
18
16
|
* in the minted bearer. Returned by {@link CreateIdpBridgeOpts.authorizeActor}; the hook throws
|
package/dist/idp.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../src/idp.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,
|
|
1
|
+
{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../src/idp.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAA6E,KAAK,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhL;wCACwC;AACxC,MAAM,WAAW,SAAS;IACxB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;CAClC;AAED;;eAEe;AACf,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;qFAIiF;IACjF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;kGAC8F;IAC9F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,sCAAsC;IACtC,GAAG,EAAE,SAAS,CAAC;IACf,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,sDAAsD;IACtD,MAAM,EAAE,eAAe,CAAC;IACxB;;mFAE+E;IAC/E,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnF;;;;;;;;;;2FAUuF;IACvF,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1G;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,SAAS;IACxB;;;;yCAIqC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,aAAa,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACjF;mGAC2F;QAC3F,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACzG,yFAAyF;QACzF,cAAc,CAAC,EAAE,uBAAuB,CAAC;KAC1C,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7B;AAED;;;qGAGqG;AACrG,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBzG;AAwCD;gFACgF;AAChF,wBAAgB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,CAuFpE"}
|
package/dist/idp.js
CHANGED
|
@@ -27,7 +27,7 @@
|
|
|
27
27
|
import { decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
|
|
28
28
|
import { assertValidOwnerToken } from "@cotal-ai/core";
|
|
29
29
|
import { deriveOwnerForIdpSubject } from "./derive.js";
|
|
30
|
-
import { USER_TOKEN_VIEWS, VIEW_REQUIRED_SCOPE, viewTtlCapSec } from "./token.js";
|
|
30
|
+
import { CLOCK_TOLERANCE_SEC, USER_TOKEN_VIEWS, VIEW_REQUIRED_SCOPE, viewTtlCapSec } from "./token.js";
|
|
31
31
|
import { grantCommandLine } from "./grant-command.js";
|
|
32
32
|
/** Verify an external IdP JWT against the pinned config and return its `sub` AND `exp`. Same pinning
|
|
33
33
|
* posture as `validateUserToken`, minus the Cotal claim shape (an IdP token has no `ver`/`act`; its
|
|
@@ -39,12 +39,11 @@ export async function verifyIdpToken(token, idp) {
|
|
|
39
39
|
throw new Error("idp token: embedded key material (jku/jwk/x5u/x5c) is rejected - keys resolve only via the pinned JWKS");
|
|
40
40
|
if (header.alg !== "EdDSA")
|
|
41
41
|
throw new Error(`idp token: alg must be EdDSA (got ${String(header.alg)})`);
|
|
42
|
-
const tol = idp.clockToleranceSec ?? 5;
|
|
43
42
|
const { payload } = await jwtVerify(token, idp.key, {
|
|
44
43
|
algorithms: ["EdDSA"],
|
|
45
44
|
issuer: idp.issuer,
|
|
46
45
|
audience: idp.audience,
|
|
47
|
-
clockTolerance:
|
|
46
|
+
clockTolerance: CLOCK_TOLERANCE_SEC,
|
|
48
47
|
});
|
|
49
48
|
// jose's `audience` option is SET-MEMBERSHIP (an aud array containing the expected value
|
|
50
49
|
// passes) — exact means the token's audience set is exactly {configured}: the plain string, or
|
|
@@ -56,7 +55,7 @@ export async function verifyIdpToken(token, idp) {
|
|
|
56
55
|
throw new Error("idp token: exp is required - an IdP session proof must expire");
|
|
57
56
|
if (typeof payload.iat !== "number")
|
|
58
57
|
throw new Error("idp token: iat is required");
|
|
59
|
-
if (payload.iat > Math.floor(Date.now() / 1000) +
|
|
58
|
+
if (payload.iat > Math.floor(Date.now() / 1000) + CLOCK_TOLERANCE_SEC)
|
|
60
59
|
throw new Error("idp token: iat is in the future");
|
|
61
60
|
if (typeof payload.sub !== "string" || !payload.sub)
|
|
62
61
|
throw new Error("idp token: sub must be a non-empty string user id - no coercion at a trust boundary");
|
package/dist/idp.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"idp.js","sourceRoot":"","sources":["../src/idp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,EAA2E,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"idp.js","sourceRoot":"","sources":["../src/idp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,EAA2E,MAAM,YAAY,CAAC;AAChL,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAyFtD;;;qGAGqG;AACrG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,GAAc;IAChE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAC9G,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;IAC5H,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAExG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,GAAsB,EAAE;QACrE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,cAAc,EAAE,mBAAmB;KACpC,CAAC,CAAC;IAEH,yFAAyF;IACzF,+FAA+F;IAC/F,6FAA6F;IAC7F,4BAA4B;IAC5B,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC;QAC9H,MAAM,IAAI,KAAK,CAAC,qGAAqG,CAAC,CAAC;IACzH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACtH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC1H,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;QACjD,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa,EAAE,KAAiB,EAAE,IAAY;IAClF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QACxE,OAAO,CACL,qGAAqG;YACrG,4FAA4F;YAC5F,qFAAqF;YACrF,kFAAkF;YAClF,IAAI,IAAI,wFAAwF,CACjG,CAAC;IACJ,OAAO,CACL,2FAA2F;QAC3F,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE;YAC7B,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;QACF,gGAAgG;QAChG,6EAA6E,CAC9E,CAAC;AACJ,CAAC;AAED;gFACgF;AAChF,MAAM,UAAU,eAAe,CAAC,IAAyB;IACvD,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpE,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM;QAC1D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;QAC7D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC9G,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,UAAU;QAC3C,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC1G,IAAI,OAAO,IAAI,CAAC,qBAAqB,KAAK,UAAU;QAClD,MAAM,IAAI,KAAK,CAAC,2OAA2O,CAAC,CAAC;IAC/P,OAAO;QACL,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;YAChC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACtE,+FAA+F;YAC/F,+FAA+F;YAC/F,+DAA+D;YAC/D,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACrE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;YACrG,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB;gBAChC,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;YACtH,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,oFAAoF;gBACpF,yFAAyF;gBACzF,mFAAmF;gBACnF,mBAAmB;gBACnB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBACtC,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrG,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC3D,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,CAAC,IAAI,uBAAuB,IAAI,oFAAoF,IAAI,kDAAkD;wBACnL,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAC/C,CAAC;YACN,CAAC;YACD,0FAA0F;YAC1F,0FAA0F;YAC1F,oFAAoF;YACpF,0FAA0F;YAC1F,sFAAsF;YACtF,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY;gBAC/D,MAAM,IAAI,KAAK,CACb,oCAAoC,GAAG,CAAC,KAAK,iFAAiF,CAC/H,CAAC;YACJ,gGAAgG;YAChG,iGAAiG;YACjG,mGAAmG;YACnG,kGAAkG;YAClG,0CAA0C;YAC1C,MAAM,YAAY,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC5D,IAAI,YAAY,IAAI,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAC1F,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;YAC3E,IAAI,OAAqC,CAAC;YAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAClC,IAAI,CAAC,GAAG,CAAC,aAAa;oBAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;gBACjI,OAAO,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBACjG,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACtF,CAAC;YACD,wFAAwF;YACxF,sFAAsF;YACtF,qFAAqF;YACrF,uFAAuF;YACvF,oEAAoE;YACpE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;YACrH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACpC,KAAK;gBACL,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,YAAY;gBACZ,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;gBACxC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/B,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,MAAM;aACP,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACpH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/G,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/token.d.ts
CHANGED
|
@@ -5,6 +5,9 @@ export declare const USER_TOKEN_VER = 1;
|
|
|
5
5
|
/** Default cap on `exp - iat`. 15 minutes: long enough for connect + retries, short enough that
|
|
6
6
|
* re-mint is the working revocation path. */
|
|
7
7
|
export declare const MAX_TOKEN_TTL_SEC = 900;
|
|
8
|
+
/** Clock skew both verifiers allow on `exp`, `nbf` and `iat`. A constant because a caller-supplied
|
|
9
|
+
* `NaN` tolerance made each of those comparisons false and switched expiry off. */
|
|
10
|
+
export declare const CLOCK_TOLERANCE_SEC = 5;
|
|
8
11
|
/** The elevated per-connection profiles a bearer may request at exchange time (the "views"):
|
|
9
12
|
* read-only god view, space-history purge, channel delete, channel-registry writes, and the
|
|
10
13
|
* manifest-deploy preflight. The narrowing manager-caller view is also available to an actor-secret
|
|
@@ -106,8 +109,6 @@ export interface ValidateUserTokenOpts {
|
|
|
106
109
|
issuer: string;
|
|
107
110
|
/** Exact expected audience — the space name. */
|
|
108
111
|
audience: string;
|
|
109
|
-
/** Clock skew tolerance in seconds (default 5). */
|
|
110
|
-
clockToleranceSec?: number;
|
|
111
112
|
}
|
|
112
113
|
/** Validate a user bearer token. Returns the reduced, validated claims or THROWS — there is no
|
|
113
114
|
* partially-valid result and no fallback (a validation failure at the callout is a denied
|
package/dist/token.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAGvD;4EAC4E;AAC5E,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC;8CAC8C;AAC9C,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;;;;;;;+FAO+F;AAC/F,eAAO,MAAM,gBAAgB,wJAAyJ,CAAC;AACvL,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;yFAEyF;AACzF,eAAO,MAAM,qBAAqB,sGAA0I,CAAC;AAE7K;;;;+FAI+F;AAC/F,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAclG,CAAC;AAEF;;kEAEkE;AAClE,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,CAErE;AAED;2FAC2F;AAC3F,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;kGACkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;iFAEiF;AACjF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mGAAmG;IACnG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;2EAEuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;kFAI8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gEAAgE;IAChE,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,kEAAkE;IAClE,cAAc,CAAC,EAAE,uBAAuB,CAAC;CAC1C;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iCAAiC;IACjC,GAAG,EAAE,cAAc,CAAC;IACpB;6FACyF;IACzF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ;iGAC6F;IAC7F,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;mGAEmG;AACnG,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,MAAM,CAGvE;AAED;yEACyE;AACzE,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,gBAAgB,CAQ5E;AAED,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,uBAAuB,CAO1F;AAED,MAAM,WAAW,qBAAqB;IACpC;6FACyF;IACzF,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;IACjC,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAGvD;4EAC4E;AAC5E,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC;8CAC8C;AAC9C,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;oFACoF;AACpF,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;;;;;+FAO+F;AAC/F,eAAO,MAAM,gBAAgB,wJAAyJ,CAAC;AACvL,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;yFAEyF;AACzF,eAAO,MAAM,qBAAqB,sGAA0I,CAAC;AAE7K;;;;+FAI+F;AAC/F,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAclG,CAAC;AAEF;;kEAEkE;AAClE,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,CAErE;AAED;2FAC2F;AAC3F,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;kGACkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;iFAEiF;AACjF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mGAAmG;IACnG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;2EAEuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;kFAI8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gEAAgE;IAChE,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,kEAAkE;IAClE,cAAc,CAAC,EAAE,uBAAuB,CAAC;CAC1C;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iCAAiC;IACjC,GAAG,EAAE,cAAc,CAAC;IACpB;6FACyF;IACzF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ;iGAC6F;IAC7F,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;mGAEmG;AACnG,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,MAAM,CAGvE;AAED;yEACyE;AACzE,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,gBAAgB,CAQ5E;AAED,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,uBAAuB,CAO1F;AAED,MAAM,WAAW,qBAAqB;IACpC;6FACyF;IACzF,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;IACjC,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;mBAEmB;AACnB,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8G/G"}
|
package/dist/token.js
CHANGED
|
@@ -25,6 +25,9 @@ export const USER_TOKEN_VER = 1;
|
|
|
25
25
|
/** Default cap on `exp - iat`. 15 minutes: long enough for connect + retries, short enough that
|
|
26
26
|
* re-mint is the working revocation path. */
|
|
27
27
|
export const MAX_TOKEN_TTL_SEC = 900;
|
|
28
|
+
/** Clock skew both verifiers allow on `exp`, `nbf` and `iat`. A constant because a caller-supplied
|
|
29
|
+
* `NaN` tolerance made each of those comparisons false and switched expiry off. */
|
|
30
|
+
export const CLOCK_TOLERANCE_SEC = 5;
|
|
28
31
|
/** The elevated per-connection profiles a bearer may request at exchange time (the "views"):
|
|
29
32
|
* read-only god view, space-history purge, channel delete, channel-registry writes, and the
|
|
30
33
|
* manifest-deploy preflight. The narrowing manager-caller view is also available to an actor-secret
|
|
@@ -117,7 +120,7 @@ export async function validateUserToken(token, opts) {
|
|
|
117
120
|
algorithms: ["EdDSA"],
|
|
118
121
|
issuer: opts.issuer,
|
|
119
122
|
audience: opts.audience,
|
|
120
|
-
clockTolerance:
|
|
123
|
+
clockTolerance: CLOCK_TOLERANCE_SEC,
|
|
121
124
|
});
|
|
122
125
|
// jose's `audience` option is SET-MEMBERSHIP (an aud array containing the space passes) — the
|
|
123
126
|
// bearer must be scoped to EXACTLY this space: the plain string, or a singleton array of it. A
|
|
@@ -136,11 +139,10 @@ export async function validateUserToken(token, opts) {
|
|
|
136
139
|
// defeating the short-lived-token revocation lever. So: iat may not be in the future, and exp
|
|
137
140
|
// may not sit further than the cap from now.
|
|
138
141
|
const maxTtl = viewTtlCapSec(payload.act?.view);
|
|
139
|
-
const tol = opts.clockToleranceSec ?? 5;
|
|
140
142
|
const now = Math.floor(Date.now() / 1000);
|
|
141
|
-
if (payload.iat > now +
|
|
143
|
+
if (payload.iat > now + CLOCK_TOLERANCE_SEC)
|
|
142
144
|
throw new Error("user token: iat is in the future");
|
|
143
|
-
if (payload.exp > now + maxTtl +
|
|
145
|
+
if (payload.exp > now + maxTtl + CLOCK_TOLERANCE_SEC)
|
|
144
146
|
throw new Error(`user token: exp is more than the ${maxTtl}s cap past now - short-lived tokens are the revocation lever`);
|
|
145
147
|
if (payload.exp - payload.iat > maxTtl)
|
|
146
148
|
throw new Error(`user token: lifetime ${payload.exp - payload.iat}s exceeds the ${maxTtl}s cap - short-lived tokens are the revocation lever`);
|
package/dist/token.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE1H;4EAC4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC;8CAC8C;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;;;;;+FAO+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,CAAU,CAAC;AAGvL;;yFAEyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,CAA6C,CAAC;AAE7K;;;;+FAI+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAuE;IACrG,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,OAAO;IACf,gBAAgB,EAAE,OAAO;IACzB,gBAAgB,EAAE,OAAO;IACzB,QAAQ,EAAE,OAAO;IACjB,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,SAAS,EAAE,0EAA0E;IACvG,kGAAkG;IAClG,oGAAoG;IACpG,gBAAgB,EAAE,SAAS;IAC3B,qFAAqF;IACrF,6DAA6D;IAC7D,iBAAiB,EAAE,OAAO;CAC3B,CAAC;AAEF;;kEAEkE;AAClE,MAAM,UAAU,aAAa,CAAC,IAA+B;IAC3D,OAAO,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,iBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC;AACnH,CAAC;AAmED;2FAC2F;AAC3F,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAEjD;;mGAEmG;AACnG,MAAM,UAAU,uBAAuB,CAAC,CAAU;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxH,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC;AACvH,CAAC;AAED;yEACyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,GAAG,CAAC,CAAC;IACxK,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC9J,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC9J,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAU;QACvC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAC,CAAY,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,6BAA6B,CAAC,CAAC;AACpK,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,CAAU;IAClD,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACzH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,GAAG,CAAC,CAAC;IAC3J,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAC1H,oBAAoB,CAAC,CAAC,CAAC,UAAU,EAAE,0CAA0C,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;AACnJ,CAAC;
|
|
1
|
+
{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE1H;4EAC4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC;8CAC8C;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;oFACoF;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;;;+FAO+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,CAAU,CAAC;AAGvL;;yFAEyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,CAA6C,CAAC;AAE7K;;;;+FAI+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAuE;IACrG,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,OAAO;IACf,gBAAgB,EAAE,OAAO;IACzB,gBAAgB,EAAE,OAAO;IACzB,QAAQ,EAAE,OAAO;IACjB,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,SAAS,EAAE,0EAA0E;IACvG,kGAAkG;IAClG,oGAAoG;IACpG,gBAAgB,EAAE,SAAS;IAC3B,qFAAqF;IACrF,6DAA6D;IAC7D,iBAAiB,EAAE,OAAO;CAC3B,CAAC;AAEF;;kEAEkE;AAClE,MAAM,UAAU,aAAa,CAAC,IAA+B;IAC3D,OAAO,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,iBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC;AACnH,CAAC;AAmED;2FAC2F;AAC3F,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAEjD;;mGAEmG;AACnG,MAAM,UAAU,uBAAuB,CAAC,CAAU;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxH,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC;AACvH,CAAC;AAED;yEACyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,GAAG,CAAC,CAAC;IACxK,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC9J,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC9J,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAU;QACvC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAC,CAAY,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,6BAA6B,CAAC,CAAC;AACpK,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,CAAU;IAClD,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACzH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,GAAG,CAAC,CAAC;IAC3J,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAC1H,oBAAoB,CAAC,CAAC,CAAC,UAAU,EAAE,0CAA0C,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;AACnJ,CAAC;AAYD;;mBAEmB;AACnB,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAA2B;IAChF,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAC9G,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7H,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEzG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,GAAsB,EAAE;QACtE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,mBAAmB;KACpC,CAAC,CAAC;IAEH,8FAA8F;IAC9F,+FAA+F;IAC/F,2DAA2D;IAC3D,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC;QAChI,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACjH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,+FAA+F;IAC/F,2FAA2F;IAC3F,+FAA+F;IAC/F,8FAA8F;IAC9F,6CAA6C;IAC7C,MAAM,MAAM,GAAG,aAAa,CAAE,OAAO,CAAC,GAAkC,EAAE,IAAI,CAAC,CAAC;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACjG,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,MAAM,GAAG,mBAAmB;QAClD,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,8DAA8D,CAAC,CAAC;IAC5H,IAAI,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,MAAM;QACpC,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,iBAAiB,MAAM,qDAAqD,CAAC,CAAC;IAEjJ,IAAI,OAAO,CAAC,GAAG,KAAK,cAAc;QAChC,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,cAAc,qDAAqD,CAAC,CAAC;IAEpI,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACjI,MAAM,KAAK,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAiC,CAAC;IACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACxH,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,4BAA4B,CAAC,CAAC;IACpI,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACrI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,6FAA6F;QAC7F,yFAAyF;QACzF,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAChC,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,iDAAiD,CAAC,CAAC;QAC1G,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,yBAAyB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAC9H,CAAC;IACJ,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;YAC3C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,oBAAoB,CAAC,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;QACtE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;QACtE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAC5D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACvH,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3G,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS;QAAE,yBAAyB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACpF,mGAAmG;IACnG,gGAAgG;IAChG,mGAAmG;IACnG,+FAA+F;IAC/F,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;YACtC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,oBAAoB,CAAC,GAAG,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;IACxE,CAAC;IACD,iGAAiG;IACjG,gGAAgG;IAChG,yFAAyF;IACzF,6FAA6F;IAC7F,0FAA0F;IAC1F,kFAAkF;IAClF,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;QAAE,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE9E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/D,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAE1E,OAAO;QACL,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,QAAQ;QACpB,KAAK;QACL,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACpU,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cotal-ai/auth",
|
|
3
3
|
"description": "Cotal per-user auth bridge: opaque owner-token derivation and strict user-token validation for the NATS auth-callout cutover (Plane 1 ↔ Plane 2).",
|
|
4
|
-
"version": "0.
|
|
4
|
+
"version": "0.77.0",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
7
7
|
"type": "git",
|
|
@@ -18,9 +18,9 @@
|
|
|
18
18
|
}
|
|
19
19
|
},
|
|
20
20
|
"dependencies": {
|
|
21
|
-
"@cotal-ai/core": "0.
|
|
22
|
-
"@cotal-ai/lang": "0.
|
|
23
|
-
"@cotal-ai/workspace": "0.
|
|
21
|
+
"@cotal-ai/core": "0.77.0",
|
|
22
|
+
"@cotal-ai/lang": "0.77.0",
|
|
23
|
+
"@cotal-ai/workspace": "0.77.0",
|
|
24
24
|
"@nats-io/jwt": "0.0.10-5",
|
|
25
25
|
"@nats-io/nkeys": "^2.0.3",
|
|
26
26
|
"@nats-io/transport-node": "^3.4.0",
|