@crouter/identity 0.3.392 → 0.3.393

package/README.md

@@ -45,7 +45,7 @@ export async function authorize(request: Request) {
 
 | Function | Checks | Returns |
 |---|---|---|
-| `verifyAccessToken` | `typ: at+jwt`, ES256, signature, `iss`, `aud`, `exp`; `sub` is `user:<id>`, `grantee` is `app:<id>` | `AccessTokenClaims` (`sub`, `grantee`, `client_id`, `grant`, `exp`) |
+| `verifyAccessToken` | `typ: at+jwt`, ES256, signature, `iss`, `aud`, `exp`; `sub` is `user:<id>`, `grantee` is `app:<id>`; `rev` is a positive integer (a token without `rev` throws `MissingRevClaimError`) | `AccessTokenClaims` (`sub`, `grantee`, `client_id`, `grant`, `rev`, `exp`) |
 | `verifyOutboundToken` | `typ: at+jwt`, ES256 or RS256 with a `kid`, signature, `iss`, `aud`, `exp`; claim presence and types, including `scope`, `initiating_app`, `act`, `jti` | `OutboundTokenClaims` |
 | `verifyIdToken` | ES256, signature, `iss`, `aud`, `exp`; `sub` is `user:<id>` | `IdTokenClaims` (`email*` when `email` was granted; `name`, `given_name`, `family_name` when `profile` was) |
 | `verifySyncNotice` | ES256 with a `kid`, `purpose: grant_sync`, lifetime of at most five minutes, 30 s clock tolerance | `SyncNoticeClaims` (`jti`, `iat`, `exp`) |

package/dist/index.d.ts

@@ -4,8 +4,14 @@ export interface AccessTokenClaims extends JWTPayload {
     grantee: string;
     client_id: string;
     grant: string;
+    /** The grant revision the directory minted against: a freshness floor, never authorization (contract 1). */
+    rev: number;
     exp: number;
 }
+/** Thrown by `verifyAccessToken` for a signed token with no `rev` claim: the directory predates the claim. */
+export declare class MissingRevClaimError extends Error {
+    constructor();
+}
 /** `email*` appear when `email` was granted; `name`, `given_name`, `family_name` when `profile` was granted and the person has a name. A person with no name has none of the three: never the phone number. `picture` (an https URL of the person's Google photo) when `profile` was granted and the account has one. */
 export interface IdTokenClaims extends JWTPayload {
     sub: string;

package/dist/index.js

@@ -1,4 +1,8 @@
 import { createLocalJWKSet, decodeProtectedHeader, jwtVerify } from 'jose';
+/** Thrown by `verifyAccessToken` for a signed token with no `rev` claim: the directory predates the claim. */
+export class MissingRevClaimError extends Error {
+    constructor() { super('access token has no rev claim: the directory is older than this runtime'); this.name = 'MissingRevClaimError'; }
+}
 /** App-memory form keys omit the app id. */
 export const ENFORCED = new Set(['crtr:llm', 'crtr:act', 'crtr:schedule', 'crtr:memory:read:user', 'crtr:memory:read:app', 'crtr:memory:rw:app', 'crtr:files:read:user:.', 'crtr:files:rw:user:.']);
 const id = /^[A-Za-z0-9_-]{1,64}$/;
@@ -147,6 +151,10 @@ export async function verifyAccessToken(options) {
         typeof payload.exp !== 'number') {
         throw new Error('Invalid access token claims');
     }
+    if (payload.rev === undefined)
+        throw new MissingRevClaimError();
+    if (typeof payload.rev !== 'number' || !Number.isInteger(payload.rev) || payload.rev < 1)
+        throw new Error('Invalid access token claims');
     return payload;
 }
 function nonEmptyString(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crouter/identity",
-  "version": "0.3.392",
+  "version": "0.3.393",
   "description": "crouter cloud access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",