@datalayer/personal-agent-protocol 0.3.1 → 0.3.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +248 -94
- package/lib/browser-server.d.ts +26 -0
- package/lib/browser-server.d.ts.map +1 -0
- package/lib/browser-server.js +61 -0
- package/lib/browser-server.js.map +1 -0
- package/lib/browser.d.ts +43 -0
- package/lib/browser.d.ts.map +1 -0
- package/lib/browser.js +103 -0
- package/lib/browser.js.map +1 -0
- package/lib/chunk-JIMKKTDT.js +5194 -0
- package/lib/chunk-JIMKKTDT.js.map +7 -0
- package/lib/conversations.d.ts +48 -0
- package/lib/conversations.d.ts.map +1 -0
- package/lib/conversations.js +240 -0
- package/lib/conversations.js.map +1 -0
- package/lib/crypto.js +1 -1
- package/lib/crypto.js.map +1 -1
- package/lib/device.d.ts +44 -0
- package/lib/device.d.ts.map +1 -0
- package/lib/device.js +327 -0
- package/lib/device.js.map +1 -0
- package/lib/errors.d.ts +16 -0
- package/lib/errors.d.ts.map +1 -1
- package/lib/errors.js +18 -0
- package/lib/errors.js.map +1 -1
- package/lib/index.d.ts +6 -2
- package/lib/index.d.ts.map +1 -1
- package/lib/index.js +75 -3737
- package/lib/index.js.map +4 -4
- package/lib/reactor.d.ts +4 -0
- package/lib/reactor.d.ts.map +1 -1
- package/lib/reactor.js +3 -1
- package/lib/reactor.js.map +1 -1
- package/lib/server.d.ts +1 -0
- package/lib/server.d.ts.map +1 -1
- package/lib/server.js +125 -63
- package/lib/server.js.map +7 -1
- package/lib/transport.d.ts +24 -0
- package/lib/transport.d.ts.map +1 -0
- package/lib/transport.js +112 -0
- package/lib/transport.js.map +1 -0
- package/package.json +4 -3
package/lib/reactor.js
CHANGED
|
@@ -13,6 +13,7 @@ export const PairwiseUserIdStores = defineContributionPoint("pap.pairwiseUserIdS
|
|
|
13
13
|
export const AuthorizationStateStores = defineContributionPoint("pap.authorizationStateStore");
|
|
14
14
|
export const Caches = defineContributionPoint("pap.cache");
|
|
15
15
|
export const BrowserHandoffs = defineContributionPoint("pap.browserHandoff");
|
|
16
|
+
export const BrowserFormPosts = defineContributionPoint("pap.browserFormPost");
|
|
16
17
|
export const DpopProofProviders = defineContributionPoint("pap.dpopProofProvider");
|
|
17
18
|
const systemClock = { now: () => new Date() };
|
|
18
19
|
const systemRandom = {
|
|
@@ -49,7 +50,7 @@ export function createPapCorePlugin(options = {}) {
|
|
|
49
50
|
}
|
|
50
51
|
return definePlugin({
|
|
51
52
|
name: "@datalayer/personal-agent-protocol-core",
|
|
52
|
-
version: "0.3.
|
|
53
|
+
version: "0.3.3",
|
|
53
54
|
contributionPoints: [
|
|
54
55
|
DiscoveryTransports,
|
|
55
56
|
UrlSafetyPolicies,
|
|
@@ -64,6 +65,7 @@ export function createPapCorePlugin(options = {}) {
|
|
|
64
65
|
AuthorizationStateStores,
|
|
65
66
|
Caches,
|
|
66
67
|
BrowserHandoffs,
|
|
68
|
+
BrowserFormPosts,
|
|
67
69
|
DpopProofProviders,
|
|
68
70
|
],
|
|
69
71
|
contributes: [
|
package/lib/reactor.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"reactor.js","sourceRoot":"","sources":["../src/reactor.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,uBAAuB,EACvB,YAAY,GAKb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"reactor.js","sourceRoot":"","sources":["../src/reactor.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,uBAAuB,EACvB,YAAY,GAKb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA+F7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CACxD,wBAAwB,CACzB,CAAC;AACF,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CACtD,qBAAqB,CACtB,CAAC;AACF,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CACrD,qBAAqB,CACtB,CAAC;AACF,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CACtD,sBAAsB,CACvB,CAAC;AACF,MAAM,CAAC,MAAM,MAAM,GAAG,uBAAuB,CAAQ,WAAW,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG,uBAAuB,CAAe,kBAAkB,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,OAAO,GAAG,uBAAuB,CAAS,YAAY,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAW,cAAc,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,WAAW,GAAG,uBAAuB,CAAa,gBAAgB,CAAC,CAAC;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CACzD,yBAAyB,CAC1B,CAAC;AACF,MAAM,CAAC,MAAM,wBAAwB,GAAG,uBAAuB,CAC7D,6BAA6B,CAC9B,CAAC;AACF,MAAM,CAAC,MAAM,MAAM,GAAG,uBAAuB,CAAgB,WAAW,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,uBAAuB,CACpD,oBAAoB,CACrB,CAAC;AACF,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CACrD,qBAAqB,CACtB,CAAC;AACF,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CACvD,uBAAuB,CACxB,CAAC;AAOF,MAAM,WAAW,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AACrD,MAAM,YAAY,GAAiB;IACjC,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,UAAU,CAAC,+CAA+C,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,CAAC;CACF,CAAC;AAEF,SAAS,qBAAqB,CAAC,GAAQ;IACrC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,cAAc,CAAC,YAAY,EAAE,4CAA4C,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC/D,IACE,IAAI,KAAK,WAAW;QACpB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3B,IAAI,KAAK,KAAK;QACd,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAClB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAA0B,EAAE;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,YAAY,CAAC;QAClB,IAAI,EAAE,yCAAyC;QAC/C,OAAO,EAAE,OAAO;QAChB,kBAAkB,EAAE;YAClB,mBAAmB;YACnB,iBAAiB;YACjB,gBAAgB;YAChB,iBAAiB;YACjB,MAAM;YACN,aAAa;YACb,OAAO;YACP,SAAS;YACT,WAAW;YACX,oBAAoB;YACpB,wBAAwB;YACxB,MAAM;YACN,eAAe;YACf,gBAAgB;YAChB,kBAAkB;SACnB;QACD,WAAW,EAAE;YACX,YAAY,CACV,mBAAmB,EACnB,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAChD,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAC5B;YACD,YAAY,CACV,iBAAiB,EACjB;gBACE,KAAK,CAAC,UAAU,CAAC,GAAG;oBAClB,qBAAqB,CAAC,GAAG,CAAC,CAAC;oBAC3B,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC;gBACrC,CAAC;aACF,EACD,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAC7B;YACD,YAAY,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YAC7E,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YAC/D,YAAY,CAAC,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;SACxE;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,UAA0B,EAAE,EAC5B,UAA2B,EAAE;IAE7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAA4B,EAC5B,KAA2B,EAC3B,KAAa;IAEb,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,eAAe,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,gBAAgB,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC"}
|
package/lib/server.d.ts
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import type { UrlSafetyPolicy } from "./reactor.js";
|
|
2
2
|
export { JoseSigner, verifyDpopProof, type DpopReplayCache, type JoseSignerOptions, type VerifiedDpopProof, type VerifyDpopProofOptions, } from "./crypto.js";
|
|
3
|
+
export { verifyBrowserAssertion, type BrowserAssertionReplayCache, type VerifiedBrowserAssertion, type VerifyBrowserAssertionOptions, } from "./browser-server.js";
|
|
3
4
|
export type NodeAddressResolver = (hostname: string) => Promise<readonly string[]>;
|
|
4
5
|
export declare function isPublicIpAddress(address: string): boolean;
|
|
5
6
|
export interface NodeUrlSafetyPolicyOptions {
|
package/lib/server.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EACL,UAAU,EACV,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EACL,UAAU,EACV,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,GACnC,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AA6CnF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAK1D;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,6EAA6E;AAC7E,qBAAa,mBAAoB,YAAW,eAAe;;gBAI7C,OAAO,GAAE,0BAA+B;IAK9C,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;CAmB1C"}
|
package/lib/server.js
CHANGED
|
@@ -1,74 +1,136 @@
|
|
|
1
|
+
import {
|
|
2
|
+
BROWSER_ASSERTION_TYPE,
|
|
3
|
+
BrowserSessionError,
|
|
4
|
+
DiscoveryError,
|
|
5
|
+
JoseSigner,
|
|
6
|
+
SecretValue,
|
|
7
|
+
assertCompanyReturnTo,
|
|
8
|
+
browserAssertionError,
|
|
9
|
+
decodeProtectedHeader,
|
|
10
|
+
jwtVerify,
|
|
11
|
+
validateBrowserClaimIdentity,
|
|
12
|
+
verifyDpopProof
|
|
13
|
+
} from "./chunk-JIMKKTDT.js";
|
|
14
|
+
|
|
15
|
+
// src/server.ts
|
|
1
16
|
import { lookup } from "node:dns/promises";
|
|
2
17
|
import { isIP } from "node:net";
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
async function
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
18
|
+
|
|
19
|
+
// src/browser-server.ts
|
|
20
|
+
async function verifyBrowserAssertion(assertion, options) {
|
|
21
|
+
const compact = assertion instanceof SecretValue ? assertion.reveal() : assertion;
|
|
22
|
+
let claims;
|
|
23
|
+
try {
|
|
24
|
+
const header = decodeProtectedHeader(compact);
|
|
25
|
+
if (header.typ !== BROWSER_ASSERTION_TYPE || header.alg !== "ES256" && header.alg !== "RS256") {
|
|
26
|
+
throw browserAssertionError();
|
|
12
27
|
}
|
|
28
|
+
const verified = await jwtVerify(compact, options.publicKey, {
|
|
29
|
+
algorithms: [header.alg],
|
|
30
|
+
typ: BROWSER_ASSERTION_TYPE,
|
|
31
|
+
requiredClaims: ["iss", "sub", "aud", "session_id", "return_to", "iat", "exp", "jti"],
|
|
32
|
+
...options.now === void 0 ? {} : { currentDate: options.now }
|
|
33
|
+
});
|
|
34
|
+
const payload = verified.payload;
|
|
35
|
+
claims = {
|
|
36
|
+
iss: validateBrowserClaimIdentity(payload.iss, "iss"),
|
|
37
|
+
sub: validateBrowserClaimIdentity(payload.sub, "sub"),
|
|
38
|
+
aud: validateBrowserClaimIdentity(payload.aud, "aud"),
|
|
39
|
+
session_id: validateBrowserClaimIdentity(payload.session_id, "session_id"),
|
|
40
|
+
return_to: validateBrowserClaimIdentity(payload.return_to, "return_to"),
|
|
41
|
+
iat: Number(payload.iat),
|
|
42
|
+
exp: Number(payload.exp),
|
|
43
|
+
jti: validateBrowserClaimIdentity(payload.jti, "jti")
|
|
44
|
+
};
|
|
45
|
+
} catch (cause) {
|
|
46
|
+
if (cause instanceof BrowserSessionError) throw cause;
|
|
47
|
+
throw browserAssertionError(cause);
|
|
48
|
+
}
|
|
49
|
+
const now = options.now ?? /* @__PURE__ */ new Date();
|
|
50
|
+
const nowSeconds = Math.floor(now.getTime() / 1e3);
|
|
51
|
+
if (!Number.isInteger(claims.iat) || !Number.isInteger(claims.exp) || claims.exp <= claims.iat || claims.exp - claims.iat > 60 || claims.iat > nowSeconds || claims.exp <= nowSeconds) {
|
|
52
|
+
throw browserAssertionError();
|
|
53
|
+
}
|
|
54
|
+
const endpoint = new URL(options.expectedEndpoint).toString();
|
|
55
|
+
const returnTo = assertCompanyReturnTo(claims.return_to, options.companyDomain);
|
|
56
|
+
if (claims.aud !== endpoint || claims.iss !== options.expectedClientId || claims.sub !== options.expectedPairwiseUserId || claims.session_id !== options.expectedSessionId) {
|
|
57
|
+
throw browserAssertionError();
|
|
58
|
+
}
|
|
59
|
+
const expiresAt = new Date(claims.exp * 1e3);
|
|
60
|
+
if (!await options.replayCache.markOnce(`browser:${claims.iss}:${claims.jti}`, { expiresAt })) {
|
|
61
|
+
throw new BrowserSessionError("invalid_browser_assertion", "Browser assertion has already been used");
|
|
62
|
+
}
|
|
63
|
+
return {
|
|
64
|
+
clientId: claims.iss,
|
|
65
|
+
pairwiseUserId: claims.sub,
|
|
66
|
+
sessionId: claims.session_id,
|
|
67
|
+
returnTo,
|
|
68
|
+
expiresAt
|
|
69
|
+
};
|
|
70
|
+
}
|
|
71
|
+
|
|
72
|
+
// src/server.ts
|
|
73
|
+
async function resolveAddresses(hostname) {
|
|
74
|
+
try {
|
|
75
|
+
const records = await lookup(hostname, { all: true, verbatim: true });
|
|
76
|
+
return [...new Set(records.map((record) => record.address))];
|
|
77
|
+
} catch (cause) {
|
|
78
|
+
throw new DiscoveryError("dns_failed", "Could not resolve metadata host", { cause });
|
|
79
|
+
}
|
|
13
80
|
}
|
|
14
81
|
function isPublicIpv4(address) {
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
return !(a === 0 ||
|
|
22
|
-
a === 10 ||
|
|
23
|
-
a === 127 ||
|
|
24
|
-
(a === 100 && b >= 64 && b <= 127) ||
|
|
25
|
-
(a === 169 && b === 254) ||
|
|
26
|
-
(a === 172 && b >= 16 && b <= 31) ||
|
|
27
|
-
(a === 192 && b === 0) ||
|
|
28
|
-
(a === 192 && b === 168) ||
|
|
29
|
-
(a === 192 && b === 0 && parts[2] === 2) ||
|
|
30
|
-
(a === 198 && (b === 18 || b === 19)) ||
|
|
31
|
-
(a === 198 && b === 51 && parts[2] === 100) ||
|
|
32
|
-
(a === 203 && b === 0 && parts[2] === 113) ||
|
|
33
|
-
a >= 224);
|
|
82
|
+
const parts = address.split(".").map(Number);
|
|
83
|
+
if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
|
|
84
|
+
return false;
|
|
85
|
+
}
|
|
86
|
+
const [a = 0, b = 0] = parts;
|
|
87
|
+
return !(a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 0 || a === 192 && b === 168 || a === 192 && b === 0 && parts[2] === 2 || a === 198 && (b === 18 || b === 19) || a === 198 && b === 51 && parts[2] === 100 || a === 203 && b === 0 && parts[2] === 113 || a >= 224);
|
|
34
88
|
}
|
|
35
89
|
function isPublicIpv6(address) {
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
const first = Number.parseInt(normalized.split(":", 1)[0] ?? "", 16);
|
|
42
|
-
return first >= 0x2000 && first <= 0x3fff;
|
|
90
|
+
const normalized = address.toLowerCase();
|
|
91
|
+
if (normalized.includes("%") || normalized.startsWith("2001:db8:")) return false;
|
|
92
|
+
if (normalized.startsWith("2001:0:") || normalized.startsWith("2002:")) return false;
|
|
93
|
+
const first = Number.parseInt(normalized.split(":", 1)[0] ?? "", 16);
|
|
94
|
+
return first >= 8192 && first <= 16383;
|
|
43
95
|
}
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
return isPublicIpv6(address);
|
|
50
|
-
return false;
|
|
96
|
+
function isPublicIpAddress(address) {
|
|
97
|
+
const version = isIP(address);
|
|
98
|
+
if (version === 4) return isPublicIpv4(address);
|
|
99
|
+
if (version === 6) return isPublicIpv6(address);
|
|
100
|
+
return false;
|
|
51
101
|
}
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
102
|
+
var NodeUrlSafetyPolicy = class {
|
|
103
|
+
#resolver;
|
|
104
|
+
#allowPrivateNetworks;
|
|
105
|
+
constructor(options = {}) {
|
|
106
|
+
this.#resolver = options.resolver ?? resolveAddresses;
|
|
107
|
+
this.#allowPrivateNetworks = options.allowPrivateNetworks ?? false;
|
|
108
|
+
}
|
|
109
|
+
async assertSafe(url) {
|
|
110
|
+
if (url.protocol !== "https:" || url.username || url.password) {
|
|
111
|
+
throw new DiscoveryError(
|
|
112
|
+
"unsafe_url",
|
|
113
|
+
"Discovery and metadata URLs must use HTTPS without user information"
|
|
114
|
+
);
|
|
59
115
|
}
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
const hostname = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
|
|
65
|
-
const addresses = isIP(hostname) ? [hostname] : await this.#resolver(hostname);
|
|
66
|
-
if (addresses.length === 0) {
|
|
67
|
-
throw new DiscoveryError("dns_failed", "Metadata host has no addresses");
|
|
68
|
-
}
|
|
69
|
-
if (!this.#allowPrivateNetworks && addresses.some((address) => !isPublicIpAddress(address))) {
|
|
70
|
-
throw new DiscoveryError("unsafe_address", "Metadata host resolves to a non-public address");
|
|
71
|
-
}
|
|
116
|
+
const hostname = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
|
|
117
|
+
const addresses = isIP(hostname) ? [hostname] : await this.#resolver(hostname);
|
|
118
|
+
if (addresses.length === 0) {
|
|
119
|
+
throw new DiscoveryError("dns_failed", "Metadata host has no addresses");
|
|
72
120
|
}
|
|
73
|
-
|
|
74
|
-
|
|
121
|
+
if (!this.#allowPrivateNetworks && addresses.some((address) => !isPublicIpAddress(address))) {
|
|
122
|
+
throw new DiscoveryError(
|
|
123
|
+
"unsafe_address",
|
|
124
|
+
"Metadata host resolves to a non-public address"
|
|
125
|
+
);
|
|
126
|
+
}
|
|
127
|
+
}
|
|
128
|
+
};
|
|
129
|
+
export {
|
|
130
|
+
JoseSigner,
|
|
131
|
+
NodeUrlSafetyPolicy,
|
|
132
|
+
isPublicIpAddress,
|
|
133
|
+
verifyBrowserAssertion,
|
|
134
|
+
verifyDpopProof
|
|
135
|
+
};
|
|
136
|
+
//# sourceMappingURL=server.js.map
|
package/lib/server.js.map
CHANGED
|
@@ -1 +1,7 @@
|
|
|
1
|
-
{
|
|
1
|
+
{
|
|
2
|
+
"version": 3,
|
|
3
|
+
"sources": ["../src/server.ts", "../src/browser-server.ts"],
|
|
4
|
+
"sourcesContent": ["import { lookup } from \"node:dns/promises\";\nimport { isIP } from \"node:net\";\n\nimport { DiscoveryError } from \"./index.js\";\nimport type { UrlSafetyPolicy } from \"./reactor.js\";\n\nexport {\n JoseSigner,\n verifyDpopProof,\n type DpopReplayCache,\n type JoseSignerOptions,\n type VerifiedDpopProof,\n type VerifyDpopProofOptions,\n} from \"./crypto.js\";\nexport {\n verifyBrowserAssertion,\n type BrowserAssertionReplayCache,\n type VerifiedBrowserAssertion,\n type VerifyBrowserAssertionOptions,\n} from \"./browser-server.js\";\n\nexport type NodeAddressResolver = (hostname: string) => Promise<readonly string[]>;\n\nasync function resolveAddresses(hostname: string): Promise<readonly string[]> {\n try {\n const records = await lookup(hostname, { all: true, verbatim: true });\n return [...new Set(records.map((record) => record.address))];\n } catch (cause) {\n throw new DiscoveryError(\"dns_failed\", \"Could not resolve metadata host\", { cause });\n }\n}\n\nfunction isPublicIpv4(address: string): boolean {\n const parts = address.split(\".\").map(Number);\n if (\n parts.length !== 4 ||\n parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)\n ) {\n return false;\n }\n const [a = 0, b = 0] = parts;\n return !(\n a === 0 ||\n a === 10 ||\n a === 127 ||\n (a === 100 && b >= 64 && b <= 127) ||\n (a === 169 && b === 254) ||\n (a === 172 && b >= 16 && b <= 31) ||\n (a === 192 && b === 0) ||\n (a === 192 && b === 168) ||\n (a === 192 && b === 0 && parts[2] === 2) ||\n (a === 198 && (b === 18 || b === 19)) ||\n (a === 198 && b === 51 && parts[2] === 100) ||\n (a === 203 && b === 0 && parts[2] === 113) ||\n a >= 224\n );\n}\n\nfunction isPublicIpv6(address: string): boolean {\n const normalized = address.toLowerCase();\n if (normalized.includes(\"%\") || normalized.startsWith(\"2001:db8:\")) return false;\n if (normalized.startsWith(\"2001:0:\") || normalized.startsWith(\"2002:\")) return false;\n const first = Number.parseInt(normalized.split(\":\", 1)[0] ?? \"\", 16);\n return first >= 0x2000 && first <= 0x3fff;\n}\n\nexport function isPublicIpAddress(address: string): boolean {\n const version = isIP(address);\n if (version === 4) return isPublicIpv4(address);\n if (version === 6) return isPublicIpv6(address);\n return false;\n}\n\nexport interface NodeUrlSafetyPolicyOptions {\n readonly resolver?: NodeAddressResolver;\n readonly allowPrivateNetworks?: boolean;\n}\n\n/** DNS-aware server policy for untrusted PAP discovery and metadata URLs. */\nexport class NodeUrlSafetyPolicy implements UrlSafetyPolicy {\n readonly #resolver: NodeAddressResolver;\n readonly #allowPrivateNetworks: boolean;\n\n constructor(options: NodeUrlSafetyPolicyOptions = {}) {\n this.#resolver = options.resolver ?? resolveAddresses;\n this.#allowPrivateNetworks = options.allowPrivateNetworks ?? false;\n }\n\n async assertSafe(url: URL): Promise<void> {\n if (url.protocol !== \"https:\" || url.username || url.password) {\n throw new DiscoveryError(\n \"unsafe_url\",\n \"Discovery and metadata URLs must use HTTPS without user information\",\n );\n }\n const hostname = url.hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n const addresses = isIP(hostname) ? [hostname] : await this.#resolver(hostname);\n if (addresses.length === 0) {\n throw new DiscoveryError(\"dns_failed\", \"Metadata host has no addresses\");\n }\n if (!this.#allowPrivateNetworks && addresses.some((address) => !isPublicIpAddress(address))) {\n throw new DiscoveryError(\n \"unsafe_address\",\n \"Metadata host resolves to a non-public address\",\n );\n }\n }\n}\n", "import { decodeProtectedHeader, jwtVerify, type KeyInput } from \"jose\";\n\nimport {\n BROWSER_ASSERTION_TYPE,\n assertCompanyReturnTo,\n browserAssertionError,\n validateBrowserClaimIdentity,\n type BrowserAssertionClaims,\n} from \"./browser.js\";\nimport { BrowserSessionError } from \"./errors.js\";\nimport { SecretValue } from \"./secret.js\";\n\nexport interface BrowserAssertionReplayCache {\n markOnce(key: string, options: { readonly expiresAt: Date }): Promise<boolean>;\n}\n\nexport interface VerifyBrowserAssertionOptions {\n readonly publicKey: KeyInput | Uint8Array;\n readonly expectedEndpoint: string;\n readonly companyDomain: string;\n readonly expectedClientId: string;\n readonly expectedPairwiseUserId: string;\n readonly expectedSessionId: string;\n readonly replayCache: BrowserAssertionReplayCache;\n readonly now?: Date;\n}\n\nexport interface VerifiedBrowserAssertion {\n readonly clientId: string;\n readonly pairwiseUserId: string;\n readonly sessionId: string;\n readonly returnTo: string;\n readonly expiresAt: Date;\n}\n\nexport async function verifyBrowserAssertion(\n assertion: SecretValue | string,\n options: VerifyBrowserAssertionOptions,\n): Promise<VerifiedBrowserAssertion> {\n const compact = assertion instanceof SecretValue ? assertion.reveal() : assertion;\n let claims: BrowserAssertionClaims;\n try {\n const header = decodeProtectedHeader(compact);\n if (header.typ !== BROWSER_ASSERTION_TYPE || (header.alg !== \"ES256\" && header.alg !== \"RS256\")) {\n throw browserAssertionError();\n }\n const verified = await jwtVerify(compact, options.publicKey, {\n algorithms: [header.alg],\n typ: BROWSER_ASSERTION_TYPE,\n requiredClaims: [\"iss\", \"sub\", \"aud\", \"session_id\", \"return_to\", \"iat\", \"exp\", \"jti\"],\n ...(options.now === undefined ? {} : { currentDate: options.now }),\n });\n const payload = verified.payload;\n claims = {\n iss: validateBrowserClaimIdentity(payload.iss, \"iss\"),\n sub: validateBrowserClaimIdentity(payload.sub, \"sub\"),\n aud: validateBrowserClaimIdentity(payload.aud, \"aud\"),\n session_id: validateBrowserClaimIdentity(payload.session_id, \"session_id\"),\n return_to: validateBrowserClaimIdentity(payload.return_to, \"return_to\"),\n iat: Number(payload.iat),\n exp: Number(payload.exp),\n jti: validateBrowserClaimIdentity(payload.jti, \"jti\"),\n };\n } catch (cause) {\n if (cause instanceof BrowserSessionError) throw cause;\n throw browserAssertionError(cause);\n }\n const now = options.now ?? new Date();\n const nowSeconds = Math.floor(now.getTime() / 1000);\n if (!Number.isInteger(claims.iat) || !Number.isInteger(claims.exp) ||\n claims.exp <= claims.iat || claims.exp - claims.iat > 60 ||\n claims.iat > nowSeconds || claims.exp <= nowSeconds) {\n throw browserAssertionError();\n }\n const endpoint = new URL(options.expectedEndpoint).toString();\n const returnTo = assertCompanyReturnTo(claims.return_to, options.companyDomain);\n if (claims.aud !== endpoint || claims.iss !== options.expectedClientId ||\n claims.sub !== options.expectedPairwiseUserId || claims.session_id !== options.expectedSessionId) {\n throw browserAssertionError();\n }\n const expiresAt = new Date(claims.exp * 1000);\n if (!(await options.replayCache.markOnce(`browser:${claims.iss}:${claims.jti}`, { expiresAt }))) {\n throw new BrowserSessionError(\"invalid_browser_assertion\", \"Browser assertion has already been used\");\n }\n return {\n clientId: claims.iss,\n pairwiseUserId: claims.sub,\n sessionId: claims.session_id,\n returnTo,\n expiresAt,\n };\n}\n"],
|
|
5
|
+
"mappings": ";;;;;;;;;;;;;;;AAAA,SAAS,cAAc;AACvB,SAAS,YAAY;;;ACkCrB,eAAsB,uBACpB,WACA,SACmC;AACnC,QAAM,UAAU,qBAAqB,cAAc,UAAU,OAAO,IAAI;AACxE,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,sBAAsB,OAAO;AAC5C,QAAI,OAAO,QAAQ,0BAA2B,OAAO,QAAQ,WAAW,OAAO,QAAQ,SAAU;AAC/F,YAAM,sBAAsB;AAAA,IAC9B;AACA,UAAM,WAAW,MAAM,UAAU,SAAS,QAAQ,WAAW;AAAA,MAC3D,YAAY,CAAC,OAAO,GAAG;AAAA,MACvB,KAAK;AAAA,MACL,gBAAgB,CAAC,OAAO,OAAO,OAAO,cAAc,aAAa,OAAO,OAAO,KAAK;AAAA,MACpF,GAAI,QAAQ,QAAQ,SAAY,CAAC,IAAI,EAAE,aAAa,QAAQ,IAAI;AAAA,IAClE,CAAC;AACD,UAAM,UAAU,SAAS;AACzB,aAAS;AAAA,MACP,KAAK,6BAA6B,QAAQ,KAAK,KAAK;AAAA,MACpD,KAAK,6BAA6B,QAAQ,KAAK,KAAK;AAAA,MACpD,KAAK,6BAA6B,QAAQ,KAAK,KAAK;AAAA,MACpD,YAAY,6BAA6B,QAAQ,YAAY,YAAY;AAAA,MACzE,WAAW,6BAA6B,QAAQ,WAAW,WAAW;AAAA,MACtE,KAAK,OAAO,QAAQ,GAAG;AAAA,MACvB,KAAK,OAAO,QAAQ,GAAG;AAAA,MACvB,KAAK,6BAA6B,QAAQ,KAAK,KAAK;AAAA,IACtD;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,oBAAqB,OAAM;AAChD,UAAM,sBAAsB,KAAK;AAAA,EACnC;AACA,QAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,QAAM,aAAa,KAAK,MAAM,IAAI,QAAQ,IAAI,GAAI;AAClD,MAAI,CAAC,OAAO,UAAU,OAAO,GAAG,KAAK,CAAC,OAAO,UAAU,OAAO,GAAG,KAC7D,OAAO,OAAO,OAAO,OAAO,OAAO,MAAM,OAAO,MAAM,MACtD,OAAO,MAAM,cAAc,OAAO,OAAO,YAAY;AACvD,UAAM,sBAAsB;AAAA,EAC9B;AACA,QAAM,WAAW,IAAI,IAAI,QAAQ,gBAAgB,EAAE,SAAS;AAC5D,QAAM,WAAW,sBAAsB,OAAO,WAAW,QAAQ,aAAa;AAC9E,MAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,QAAQ,oBAClD,OAAO,QAAQ,QAAQ,0BAA0B,OAAO,eAAe,QAAQ,mBAAmB;AACpG,UAAM,sBAAsB;AAAA,EAC9B;AACA,QAAM,YAAY,IAAI,KAAK,OAAO,MAAM,GAAI;AAC5C,MAAI,CAAE,MAAM,QAAQ,YAAY,SAAS,WAAW,OAAO,GAAG,IAAI,OAAO,GAAG,IAAI,EAAE,UAAU,CAAC,GAAI;AAC/F,UAAM,IAAI,oBAAoB,6BAA6B,yCAAyC;AAAA,EACtG;AACA,SAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,gBAAgB,OAAO;AAAA,IACvB,WAAW,OAAO;AAAA,IAClB;AAAA,IACA;AAAA,EACF;AACF;;;ADpEA,eAAe,iBAAiB,UAA8C;AAC5E,MAAI;AACF,UAAM,UAAU,MAAM,OAAO,UAAU,EAAE,KAAK,MAAM,UAAU,KAAK,CAAC;AACpE,WAAO,CAAC,GAAG,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,OAAO,CAAC,CAAC;AAAA,EAC7D,SAAS,OAAO;AACd,UAAM,IAAI,eAAe,cAAc,mCAAmC,EAAE,MAAM,CAAC;AAAA,EACrF;AACF;AAEA,SAAS,aAAa,SAA0B;AAC9C,QAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,IAAI,MAAM;AAC3C,MACE,MAAM,WAAW,KACjB,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,GAAG,GACtE;AACA,WAAO;AAAA,EACT;AACA,QAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI;AACvB,SAAO,EACL,MAAM,KACN,MAAM,MACN,MAAM,OACL,MAAM,OAAO,KAAK,MAAM,KAAK,OAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,KAAK,MAAM,KAAK,MAC7B,MAAM,OAAO,MAAM,KACnB,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,MAAM,KAAK,MAAM,CAAC,MAAM,KACrC,MAAM,QAAQ,MAAM,MAAM,MAAM,OAChC,MAAM,OAAO,MAAM,MAAM,MAAM,CAAC,MAAM,OACtC,MAAM,OAAO,MAAM,KAAK,MAAM,CAAC,MAAM,OACtC,KAAK;AAET;AAEA,SAAS,aAAa,SAA0B;AAC9C,QAAM,aAAa,QAAQ,YAAY;AACvC,MAAI,WAAW,SAAS,GAAG,KAAK,WAAW,WAAW,WAAW,EAAG,QAAO;AAC3E,MAAI,WAAW,WAAW,SAAS,KAAK,WAAW,WAAW,OAAO,EAAG,QAAO;AAC/E,QAAM,QAAQ,OAAO,SAAS,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;AACnE,SAAO,SAAS,QAAU,SAAS;AACrC;AAEO,SAAS,kBAAkB,SAA0B;AAC1D,QAAM,UAAU,KAAK,OAAO;AAC5B,MAAI,YAAY,EAAG,QAAO,aAAa,OAAO;AAC9C,MAAI,YAAY,EAAG,QAAO,aAAa,OAAO;AAC9C,SAAO;AACT;AAQO,IAAM,sBAAN,MAAqD;AAAA,EACjD;AAAA,EACA;AAAA,EAET,YAAY,UAAsC,CAAC,GAAG;AACpD,SAAK,YAAY,QAAQ,YAAY;AACrC,SAAK,wBAAwB,QAAQ,wBAAwB;AAAA,EAC/D;AAAA,EAEA,MAAM,WAAW,KAAyB;AACxC,QAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,UAAU;AAC7D,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,IAAI,SAAS,YAAY,EAAE,QAAQ,YAAY,EAAE;AAClE,UAAM,YAAY,KAAK,QAAQ,IAAI,CAAC,QAAQ,IAAI,MAAM,KAAK,UAAU,QAAQ;AAC7E,QAAI,UAAU,WAAW,GAAG;AAC1B,YAAM,IAAI,eAAe,cAAc,gCAAgC;AAAA,IACzE;AACA,QAAI,CAAC,KAAK,yBAAyB,UAAU,KAAK,CAAC,YAAY,CAAC,kBAAkB,OAAO,CAAC,GAAG;AAC3F,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
|
|
6
|
+
"names": []
|
|
7
|
+
}
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
import type { ReactorPlatformView } from "@datalayer/reactor";
|
|
2
|
+
import type { SessionToken } from "./sessions.js";
|
|
3
|
+
export interface DpopFetchClientOptions {
|
|
4
|
+
readonly reactor: ReactorPlatformView;
|
|
5
|
+
readonly fetch?: typeof globalThis.fetch;
|
|
6
|
+
readonly maxRedirects?: number;
|
|
7
|
+
}
|
|
8
|
+
export interface DpopFetchRequestOptions {
|
|
9
|
+
readonly token: SessionToken;
|
|
10
|
+
readonly tenantId: string;
|
|
11
|
+
readonly pairwiseUserId: string;
|
|
12
|
+
readonly issuer: string;
|
|
13
|
+
readonly headers?: Readonly<Record<string, string>>;
|
|
14
|
+
/** Replayable request body. Streaming bodies are intentionally unsupported. */
|
|
15
|
+
readonly body?: string;
|
|
16
|
+
readonly signal?: AbortSignal;
|
|
17
|
+
}
|
|
18
|
+
/** Send proof-bound PAP requests with fresh proofs and safe redirect handling. */
|
|
19
|
+
export declare class DpopFetchClient {
|
|
20
|
+
#private;
|
|
21
|
+
constructor(options: DpopFetchClientOptions);
|
|
22
|
+
request(method: string, url: string, options: DpopFetchRequestOptions): Promise<Response>;
|
|
23
|
+
}
|
|
24
|
+
//# sourceMappingURL=transport.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAI9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAmBlD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,kFAAkF;AAClF,qBAAa,eAAe;;gBAKd,OAAO,EAAE,sBAAsB;IAgBrC,OAAO,CACX,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,QAAQ,CAAC;CAwGrB"}
|
package/lib/transport.js
ADDED
|
@@ -0,0 +1,112 @@
|
|
|
1
|
+
import { TransportError } from "./errors.js";
|
|
2
|
+
import { DpopProofProviders, firstContribution } from "./reactor.js";
|
|
3
|
+
const redirects = new Set([301, 302, 303, 307, 308]);
|
|
4
|
+
function httpsUrl(value) {
|
|
5
|
+
let url;
|
|
6
|
+
try {
|
|
7
|
+
url = new URL(value);
|
|
8
|
+
}
|
|
9
|
+
catch (cause) {
|
|
10
|
+
throw new TransportError("invalid_url", "PAP resource URL must use HTTPS", {
|
|
11
|
+
cause,
|
|
12
|
+
});
|
|
13
|
+
}
|
|
14
|
+
if (url.protocol !== "https:" || url.username || url.password) {
|
|
15
|
+
throw new TransportError("invalid_url", "PAP resource URL must use HTTPS");
|
|
16
|
+
}
|
|
17
|
+
return url;
|
|
18
|
+
}
|
|
19
|
+
/** Send proof-bound PAP requests with fresh proofs and safe redirect handling. */
|
|
20
|
+
export class DpopFetchClient {
|
|
21
|
+
#reactor;
|
|
22
|
+
#fetch;
|
|
23
|
+
#maxRedirects;
|
|
24
|
+
constructor(options) {
|
|
25
|
+
const fetcher = options.fetch ?? globalThis.fetch;
|
|
26
|
+
if (!fetcher)
|
|
27
|
+
throw new TransportError("fetch_unavailable", "A fetch implementation is required");
|
|
28
|
+
const maxRedirects = options.maxRedirects ?? 3;
|
|
29
|
+
if (!Number.isInteger(maxRedirects) || maxRedirects < 0) {
|
|
30
|
+
throw new RangeError("maxRedirects must not be negative");
|
|
31
|
+
}
|
|
32
|
+
this.#reactor = options.reactor;
|
|
33
|
+
this.#fetch = fetcher;
|
|
34
|
+
this.#maxRedirects = maxRedirects;
|
|
35
|
+
}
|
|
36
|
+
async request(method, url, options) {
|
|
37
|
+
if (options.token.tokenType !== "DPoP") {
|
|
38
|
+
throw new TransportError("unexpected_token_type", "PAP resource requests require a DPoP token");
|
|
39
|
+
}
|
|
40
|
+
const supplied = { ...(options.headers ?? {}) };
|
|
41
|
+
if (Object.keys(supplied).some((name) => ["authorization", "dpop"].includes(name.toLowerCase()))) {
|
|
42
|
+
throw new TransportError("protected_header", "Authorization and DPoP headers are host-owned");
|
|
43
|
+
}
|
|
44
|
+
const dpop = firstContribution(this.#reactor, DpopProofProviders, "DPoP proof provider");
|
|
45
|
+
let currentUrl = httpsUrl(url);
|
|
46
|
+
let currentMethod = method.toUpperCase();
|
|
47
|
+
let currentBody = options.body;
|
|
48
|
+
let redirectCount = 0;
|
|
49
|
+
let nonce;
|
|
50
|
+
let nonceRetried = false;
|
|
51
|
+
while (true) {
|
|
52
|
+
const proof = await dpop.create({
|
|
53
|
+
method: currentMethod,
|
|
54
|
+
url: currentUrl.toString(),
|
|
55
|
+
tenantId: options.tenantId,
|
|
56
|
+
subject: options.pairwiseUserId,
|
|
57
|
+
issuer: options.issuer,
|
|
58
|
+
accessToken: options.token.accessToken,
|
|
59
|
+
...(nonce === undefined ? {} : { nonce }),
|
|
60
|
+
});
|
|
61
|
+
let response;
|
|
62
|
+
try {
|
|
63
|
+
response = await this.#fetch(currentUrl, {
|
|
64
|
+
method: currentMethod,
|
|
65
|
+
headers: {
|
|
66
|
+
...supplied,
|
|
67
|
+
Authorization: `DPoP ${options.token.accessToken.reveal()}`,
|
|
68
|
+
DPoP: proof.reveal(),
|
|
69
|
+
},
|
|
70
|
+
...(currentBody === undefined ? {} : { body: currentBody }),
|
|
71
|
+
credentials: "omit",
|
|
72
|
+
redirect: "manual",
|
|
73
|
+
...(options.signal === undefined ? {} : { signal: options.signal }),
|
|
74
|
+
});
|
|
75
|
+
}
|
|
76
|
+
catch (cause) {
|
|
77
|
+
throw new TransportError("request_failed", "PAP resource request failed", { cause });
|
|
78
|
+
}
|
|
79
|
+
const challenge = response.headers.get("www-authenticate")?.toLowerCase() ?? "";
|
|
80
|
+
const requestedNonce = response.headers.get("dpop-nonce") ?? undefined;
|
|
81
|
+
if (challenge.includes("use_dpop_nonce") && !nonceRetried) {
|
|
82
|
+
if (!requestedNonce) {
|
|
83
|
+
throw new TransportError("missing_dpop_nonce", "DPoP nonce challenge omitted its nonce");
|
|
84
|
+
}
|
|
85
|
+
nonce = requestedNonce;
|
|
86
|
+
nonceRetried = true;
|
|
87
|
+
continue;
|
|
88
|
+
}
|
|
89
|
+
if (!redirects.has(response.status))
|
|
90
|
+
return response;
|
|
91
|
+
if (redirectCount >= this.#maxRedirects) {
|
|
92
|
+
throw new TransportError("too_many_redirects", "PAP resource request exceeded redirect limit");
|
|
93
|
+
}
|
|
94
|
+
const location = response.headers.get("location");
|
|
95
|
+
if (!location)
|
|
96
|
+
throw new TransportError("invalid_redirect", "PAP resource redirect has no location");
|
|
97
|
+
const target = httpsUrl(new URL(location, currentUrl).toString());
|
|
98
|
+
if (target.origin !== currentUrl.origin) {
|
|
99
|
+
throw new TransportError("cross_origin_redirect", "PAP credentials are never forwarded to another origin");
|
|
100
|
+
}
|
|
101
|
+
redirectCount += 1;
|
|
102
|
+
currentUrl = target;
|
|
103
|
+
nonce = undefined;
|
|
104
|
+
nonceRetried = false;
|
|
105
|
+
if (response.status === 303) {
|
|
106
|
+
currentMethod = "GET";
|
|
107
|
+
currentBody = undefined;
|
|
108
|
+
}
|
|
109
|
+
}
|
|
110
|
+
}
|
|
111
|
+
}
|
|
112
|
+
//# sourceMappingURL=transport.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"transport.js","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGrE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAErD,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,cAAc,CAAC,aAAa,EAAE,iCAAiC,EAAE;YACzE,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,cAAc,CAAC,aAAa,EAAE,iCAAiC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAmBD,kFAAkF;AAClF,MAAM,OAAO,eAAe;IACjB,QAAQ,CAAsB;IAC9B,MAAM,CAA0B;IAChC,aAAa,CAAS;IAE/B,YAAY,OAA+B;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QAClD,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,cAAc,CACtB,mBAAmB,EACnB,oCAAoC,CACrC,CAAC;QACJ,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAc,EACd,GAAW,EACX,OAAgC;QAEhC,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YACvC,MAAM,IAAI,cAAc,CACtB,uBAAuB,EACvB,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAChD,IACE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CACvD,EACD,CAAC;YACD,MAAM,IAAI,cAAc,CACtB,kBAAkB,EAClB,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,iBAAiB,CAC5B,IAAI,CAAC,QAAQ,EACb,kBAAkB,EAClB,qBAAqB,CACtB,CAAC;QACF,IAAI,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,aAAa,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;QAC/B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,KAAyB,CAAC;QAC9B,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;gBAC9B,MAAM,EAAE,aAAa;gBACrB,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,cAAc;gBAC/B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;gBACtC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;aAC1C,CAAC,CAAC;YACH,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE;oBACvC,MAAM,EAAE,aAAa;oBACrB,OAAO,EAAE;wBACP,GAAG,QAAQ;wBACX,aAAa,EAAE,QAAQ,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE;wBAC3D,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE;qBACrB;oBACD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;oBAC3D,WAAW,EAAE,MAAM;oBACnB,QAAQ,EAAE,QAAQ;oBAClB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;iBACpE,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,cAAc,CACtB,gBAAgB,EAChB,6BAA6B,EAC7B,EAAE,KAAK,EAAE,CACV,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GACb,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YAChE,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;YACvE,IAAI,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1D,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,IAAI,cAAc,CACtB,oBAAoB,EACpB,wCAAwC,CACzC,CAAC;gBACJ,CAAC;gBACD,KAAK,GAAG,cAAc,CAAC;gBACvB,YAAY,GAAG,IAAI,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,QAAQ,CAAC;YACrD,IAAI,aAAa,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxC,MAAM,IAAI,cAAc,CACtB,oBAAoB,EACpB,8CAA8C,CAC/C,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBACX,MAAM,IAAI,cAAc,CACtB,kBAAkB,EAClB,uCAAuC,CACxC,CAAC;YACJ,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBACxC,MAAM,IAAI,cAAc,CACtB,uBAAuB,EACvB,uDAAuD,CACxD,CAAC;YACJ,CAAC;YACD,aAAa,IAAI,CAAC,CAAC;YACnB,UAAU,GAAG,MAAM,CAAC;YACpB,KAAK,GAAG,SAAS,CAAC;YAClB,YAAY,GAAG,KAAK,CAAC;YACrB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,aAAa,GAAG,KAAK,CAAC;gBACtB,WAAW,GAAG,SAAS,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@datalayer/personal-agent-protocol",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.3",
|
|
4
4
|
"description": "TypeScript SDK for Personal Agent Protocol",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -23,10 +23,11 @@
|
|
|
23
23
|
},
|
|
24
24
|
"files": ["lib", "README.md"],
|
|
25
25
|
"scripts": {
|
|
26
|
-
"build": "tsc -p tsconfig.json && esbuild src/index.ts --bundle --platform=neutral --format=esm --sourcemap --
|
|
26
|
+
"build": "tsc -p tsconfig.json && esbuild src/index.ts src/server.ts --bundle --splitting --platform=neutral --format=esm --sourcemap --outdir=lib --outbase=src --external:node:*",
|
|
27
27
|
"build:lib": "tsc -p tsconfig.json",
|
|
28
28
|
"typecheck": "tsc -p tsconfig.json --noEmit",
|
|
29
|
-
"test": "npm run build && node --test
|
|
29
|
+
"test": "npm run build && node --test src/__tests__/*.test.mjs",
|
|
30
|
+
"watch:lib": "tsc -w -p tsconfig.json"
|
|
30
31
|
},
|
|
31
32
|
"publishConfig": {
|
|
32
33
|
"access": "public",
|