@cotal-ai/auth 0.86.0 → 0.87.0

package/dist/service.js

@@ -68,7 +68,7 @@ import { makePlatformControlAuthority, makePlatformControlReadiness, requireMana
 import { OwnedConnections } from "./owned-connections.js";
 import { makePlatformSupervisorAuthority, makePlatformSupervisorEnd, platformSupervisorEnded, requirePlatformSupervisorAdmin } from "./platform-supervisor.js";
 import { startAuthCallout } from "./callout.js";
-import { createIdpBridge, verifyIdpToken } from "./idp.js";
+import { createIdpBridge, verifyIdpToken, verifyToolResultHumanProof } from "./idp.js";
 import { PUBLIC_EXCHANGE_VIEWS, assertTransferWriterClaim } from "./token.js";
 import { grantCoordinates, verifySessionRedemption } from "./session-redemption.js";
 import { pinnedJwksResolver } from "./issuer.js";
@@ -112,6 +112,8 @@ export const MANAGED_RETIRE_PATH = "/managed-lifecycle/retire";
  *  remote manager (#1972 §2.2). The platform owns the writers; this door owns the decision. It
  *  derives the caller's scope from the local ledger and never accepts one from the caller. */
 export const VERIFY_ENROLLMENT_PATH = "/manager-service-authority/verify-enrollment";
+/** Host-only, capability-gated proof decision. It neither signs consent nor serves results. */
+export const TOOL_RESULT_HUMAN_PROOF_PATH = "/tool-result-human-proof/verify";
 /** Failed-exchange rate limit: at most this many REFUSED exchanges per rolling minute; further
  *  attempts get 429 until the window drains. Successes are unthrottled (the CLI's normal path). */
 const FAILED_EXCHANGE_PER_MIN = 30;
@@ -519,18 +521,9 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
             return "not registered";
         return "candidate";
     };
-    const selectManagerInstance = async (owner, requested, caller) => {
+    const listManagerInstances = async (owner) => {
         refuseIfFenced();
-        if (requested !== undefined) {
-            const instanceId = assertLifecycleToken(requested, "managerInstanceId");
-            const verdict = await managerGate(owner, instanceId);
-            if (verdict !== "candidate")
-                throw new Error(`manager instance ${instanceId} is ${verdict}`);
-            return instanceId;
-        }
-        const remoteInstances = [];
-        const remoteLive = [];
-        let localCandidate;
+        const instances = [];
         const localManager = loadLocalManager();
         for (const raw of await scanner.scanManagerGates()) {
             if (raw.op !== undefined)
@@ -542,16 +535,26 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
             const row = parseEndpointGate(raw.data, raw.key);
             if (row.authorityFamily === "environment-manager")
                 continue;
-            if (row.principal === `${owner}.${remoteManagerActors(instanceId).serve}`) {
-                remoteInstances.push(instanceId);
-                if (await managerGate(owner, instanceId) === "candidate")
-                    remoteLive.push(instanceId);
-            }
-            else if (localManager?.instanceId === instanceId && row.principal === `local.${localManager.serveIdentity.id}`) {
-                if (await managerGate(owner, instanceId) === "candidate")
-                    localCandidate = instanceId;
-            }
+            if (row.principal === `${owner}.${remoteManagerActors(instanceId).serve}`)
+                instances.push({ instanceId, placement: "remote", state: await managerGate(owner, instanceId) });
+            else if (localManager?.instanceId === instanceId && row.principal === `local.${localManager.serveIdentity.id}`)
+                instances.push({ instanceId, placement: "local", state: await managerGate(owner, instanceId) });
         }
+        return { v: 1, owner, complete: true, instances };
+    };
+    const selectManagerInstance = async (owner, requested, caller) => {
+        refuseIfFenced();
+        if (requested !== undefined) {
+            const instanceId = assertLifecycleToken(requested, "managerInstanceId");
+            const verdict = await managerGate(owner, instanceId);
+            if (verdict !== "candidate")
+                throw new Error(`manager instance ${instanceId} is ${verdict}`);
+            return instanceId;
+        }
+        const { instances } = await listManagerInstances(owner);
+        const remoteInstances = instances.filter((i) => i.placement === "remote").map((i) => i.instanceId);
+        const remoteLive = instances.filter((i) => i.placement === "remote" && i.state === "candidate").map((i) => i.instanceId);
+        const localCandidate = instances.findLast((i) => i.placement === "local" && i.state === "candidate")?.instanceId;
         remoteLive.sort();
         if (remoteLive.length === 1)
             return remoteLive[0];
@@ -628,6 +631,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
             return ensureRootCredential(registry, { ...args, managerInstance: `auth-service:${space}` });
         },
         selectManagerInstance,
+        listManagerInstances,
         authorizeManagerCaller: async (owner, instanceId) => {
             refuseIfFenced();
             const verdict = await managerGate(owner, assertLifecycleToken(instanceId, "managerInstanceId"));
@@ -1878,6 +1882,7 @@ async function startAuthContext(o) {
             dir,
             mintConnectCredential: plane.mintConnectCredential,
             selectManagerInstance: plane.selectManagerInstance,
+            listManagerInstances: plane.listManagerInstances,
             verifySession: plane.verifySession,
         };
         const loopback = createServer((req, res) => void handle(req, res, ctx));
@@ -2279,16 +2284,18 @@ const ROUTES = new Map([
     ],
     ["/exchange", (req, res, ctx) => handleExchange(req, res, ctx, LOOPBACK_POLICY)],
     ["/manager-service-authority", (req, res, ctx) => handleManagerServiceAuthority(req, res, ctx, LOOPBACK_POLICY)],
+    ["/manager-instances", (req, res, ctx) => handleManagerInstances(req, res, ctx, LOOPBACK_POLICY)],
     [INTERACTIVE_RETIRE_PATH, handleInteractiveLifecycleRetirement],
     [MANAGED_RETIRE_PATH, handleManagedLifecycleRetirement],
     [VERIFY_ENROLLMENT_PATH, handleVerifyManagedAgentEnrollment],
+    [TOOL_RESULT_HUMAN_PROOF_PATH, handleToolResultHumanProof],
 ]);
 /** Route one HTTP request against the loopback route table. Errors are JSON `{ error }`. */
 async function handle(req, res, ctx) {
     try {
         const route = ROUTES.get(req.url ?? "");
         if (!route)
-            return send(res, 404, { error: "unknown path - /health, /jwks, /exchange, /manager-service-authority, /manager-service-authority/verify-enrollment, /interactive-lifecycle/retire, /managed-lifecycle/retire" });
+            return send(res, 404, { error: "unknown path - /health, /jwks, /exchange, /manager-service-authority, /manager-instances, /manager-service-authority/verify-enrollment, /interactive-lifecycle/retire, /managed-lifecycle/retire" });
         await route(req, res, ctx);
     }
     catch (e) {
@@ -2613,6 +2620,45 @@ async function handleExchange(req, res, ctx, policy) {
         return send(res, 401, { error: reason });
     }
 }
+/** The signed-in person's own Manager instances, read-only, on both faces. The proof is the IdP JWT
+ *  the human exchange verifies, and the owner is derived from it the same way, so a caller lists only
+ *  its own owner's gates. A browser-origin request is refused as on every exchange route; an
+ *  embedding's server-side bridge forwards the person's proof. Issuance still re-checks the chosen
+ *  instance. */
+async function handleManagerInstances(req, res, ctx, policy) {
+    if (req.method !== "POST")
+        return send(res, 405, { error: "POST only" });
+    if (req.headers.origin !== undefined)
+        return send(res, 403, { error: "browser-origin requests are not served here" });
+    if (!/^application\/json\b/.test(req.headers["content-type"] ?? ""))
+        return send(res, 415, { error: "content-type must be application/json" });
+    if (policy.requireCapability && req.headers.authorization !== `Bearer ${ctx.cap}`)
+        return refuseCapability(res, ctx, "missing/invalid exchange capability - read it from the space's auth-service.json");
+    const peer = policy.peerKey(req);
+    const peerThrottled = policy.throttled(ctx, peer);
+    const body = await readJsonBody(req);
+    if (typeof body?.idpToken !== "string" || !body.idpToken)
+        return send(res, 400, { error: "the manager instance list needs { idpToken: string }" });
+    let owner;
+    try {
+        owner = deriveOwnerForIdpSubject(ctx.ownerSecret, ctx.bridgeIdp.issuer, (await verifyIdpToken(body.idpToken, ctx.bridgeIdp)).sub);
+    }
+    catch (e) {
+        policy.recordFailure(ctx, peer);
+        const reason = e instanceof Error ? e.message : String(e);
+        console.error(`auth-service: refused a manager instance list: ${reason}`);
+        if (peerThrottled)
+            return send(res, 429, { error: "too many refused exchanges - wait a minute and retry" });
+        return send(res, 401, { error: reason });
+    }
+    try {
+        return send(res, 200, await ctx.listManagerInstances(owner));
+    }
+    catch (e) {
+        // The proof was good and the gate read was not: unavailable, never an empty list.
+        return send(res, 503, { error: `the manager instance list is unavailable: ${e instanceof Error ? e.message : String(e)}` });
+    }
+}
 /** The typed manager authority exchange, served on both faces. The face's policy decides whether the
  *  loopback capability is demanded; on the public face the verified IdP JWT is the proof, and the
  *  dispatcher reads the caller's scope from the ledger either way. */
@@ -2654,6 +2700,40 @@ export async function handleManagerServiceAuthority(req, res, ctx, policy) {
         return send(res, 403, { error: reason });
     }
 }
+/** Decide one signed password proof against the host's authenticated session subject.
+ * The subject is an equality constraint, never the source of the derived owner. */
+export async function handleToolResultHumanProof(req, res, ctx) {
+    if (req.method !== "POST")
+        return send(res, 405, { error: "POST only" });
+    if (req.headers.origin !== undefined)
+        return send(res, 403, { error: "browser-origin requests are not served here" });
+    if (!/^application\/json\b/.test(req.headers["content-type"] ?? ""))
+        return send(res, 415, { error: "content-type must be application/json" });
+    if (req.headers.authorization !== `Bearer ${ctx.cap}`)
+        return refuseCapability(res, ctx, "missing/invalid exchange capability - human proof verification is a loopback host action");
+    let body;
+    try {
+        body = await readJsonBody(req);
+    }
+    catch (error) {
+        return send(res, error instanceof RequestBodyError ? error.status : 400, { error: "invalid human proof request" });
+    }
+    if (!body || typeof body !== "object" || Array.isArray(body) ||
+        Object.keys(body).some(key => key !== "idpToken" && key !== "subject") ||
+        !("idpToken" in body) || typeof body.idpToken !== "string" || !body.idpToken ||
+        !("subject" in body) || typeof body.subject !== "string" || !body.subject)
+        return send(res, 400, { error: "human proof verification needs only { idpToken, subject }" });
+    try {
+        const proof = await verifyToolResultHumanProof(body.idpToken, ctx.bridgeIdp);
+        if (proof.sub !== body.subject)
+            return send(res, 403, { error: "human proof subject does not match the session" });
+        const owner = deriveOwnerForIdpSubject(ctx.ownerSecret, ctx.bridgeIdp.issuer, proof.sub);
+        return send(res, 200, { authorized: true, owner, ...proof });
+    }
+    catch {
+        return send(res, 403, { error: "fresh signed password proof required" });
+    }
+}
 /** The advertised broker address the public bundle carries — the URL participants will dial, so
  *  the same scheme family `cotal meshes add` accepts. Exported for the producer/consumer contract
  *  smoke; returns the refusal sentence, or undefined when the address is usable. */
@@ -2756,6 +2836,7 @@ function makePublicHandler(ctx, policy, bundle) {
         ],
         ["/exchange", (req, res, c) => handleExchange(req, res, c, policy)],
         ["/manager-service-authority", (req, res, c) => handleManagerServiceAuthority(req, res, c, policy)],
+        ["/manager-instances", (req, res, c) => handleManagerInstances(req, res, c, policy)],
         [
             "/.well-known/cotal-mesh",
             (req, res) => {
@@ -2788,7 +2869,7 @@ function makePublicHandler(ctx, policy, bundle) {
             try {
                 const route = routes.get(req.url ?? "");
                 if (!route)
-                    return send(res, 404, { error: "unknown path - /health, /jwks, /exchange, /manager-service-authority, /.well-known/cotal-mesh" });
+                    return send(res, 404, { error: "unknown path - /health, /jwks, /exchange, /manager-service-authority, /manager-instances, /.well-known/cotal-mesh" });
                 await route(req, res, ctx);
             }
             catch (e) {