@dotrino/vault 0.36.0 → 0.37.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotrino/vault",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "description": "Usa ESTE dispositivo (navegador) como bóveda/CA del ecosistema Dotrino: atiende enrolamientos por el proxy y firma certificados de delegación a tus máquinas. Incluye el cliente de SERVICIO (Node): un proyecto se enrola una vez y jala sus credenciales del vault en vez del .env (`import '@dotrino/vault/config'`).",
   "type": "module",
   "main": "src/index.js",
@@ -47,7 +47,7 @@
     "pairing"
   ],
   "peerDependencies": {
-    "@dotrino/identity": ">=0.63.0",
+    "@dotrino/identity": ">=0.64.0",
     "@dotrino/proxy-client": ">=0.13.0"
   },
   "license": "MIT",

package/src/enroll.js

@@ -359,7 +359,7 @@ export function createEnrollDesk ({
     pend.state = 'DONE'
     pending.delete(pend.token)
     fire(onPendingChange)
-    log('[vault] device approved: %s', pend.deviceId)
+    log(`[vault] device approved: ${pend.deviceId}`)
     return { ok: true, deviceId: pend.deviceId, cert }
   }
 

package/src/service.js

@@ -23,8 +23,7 @@ import path from 'node:path'
 import { createHash } from 'node:crypto'
 import {
   makeDeviceKey, makeDeviceEncKey, importDeviceEncKey, signWithDevice, verifyDelegation,
-  verifyDeviceSig, makePairingCode, commitCode, pubkeyId
-} from '@dotrino/identity/capabilities'
+  verifyDeviceSig, makePairingCode, commitCode, pubkeyId, PEER_SKEW_MS } from '@dotrino/identity/capabilities'
 import { openWrap, wrapForMember, decryptWithCek } from '@dotrino/identity/content'
 import { verifyActa, sealKeyAt } from '@dotrino/identity/acta'
 import { MSG, secretsScope, isValidSecretsNs } from './protocol.js'
@@ -298,7 +297,7 @@ export async function enrollWithVault ({ qr, label = 'agent', expectedScope = nu
     const res = await enrolled
 
     if (res.code !== code) throw new Error('the vault echoed a code other than the one shown (possible malicious relay)')
-    const v = await verifyDelegation({ cert: res.cert, expectedSub: device.publickey, ...(expectedScope ? { expectedScope } : {}) })
+    const v = await verifyDelegation({ cert: res.cert, expectedSub: device.publickey, skewMs: PEER_SKEW_MS, ...(expectedScope ? { expectedScope } : {}) })
     if (!v.ok) throw new Error('invalid cert: ' + v.reason)
     if (res.cert.iss !== qr.iss) throw new Error('cert signed by a master other than the one in the QR')
 
@@ -440,7 +439,7 @@ export async function fetchSecrets ({ dir, ns, proxyUrl, masterPubkey, device, c
         client.sendByPubkey(masterPubkey, { type: MSG.RENEW, data, signature, cert })
         const res = await pending
         if (res.type === MSG.RENEWED && res.cert?.sub === device.publickey) {
-          const v = await verifyDelegation({ cert: res.cert, expectedSub: device.publickey, expectedScope: secretsScope(ns) })
+          const v = await verifyDelegation({ cert: res.cert, expectedSub: device.publickey, skewMs: PEER_SKEW_MS, expectedScope: secretsScope(ns) })
           if (v.ok) { cert = res.cert; if (dir && saved) writeServiceIdentity(dir, { ...saved, cert }) }
         }
       } catch (_) { /* la renovación no bloquea el fetch */ }