@harperfast/harper 5.2.10 → 5.3.0-alpha.1

package/dist/security/authn/oidc/claims.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Issuer-agnostic claim matching and constraint validation (#2171).
+ *
+ * Pure — no network, no storage, and nothing that knows which issuer a token came from. Rules that
+ * depend on the issuer live in providers/.
+ */
+import type { ClaimConstraint, TokenClaims } from './types.ts';
+/**
+ * Returns undefined on a match, or the first failure's reason — for the log, never the caller.
+ *
+ * A constrained claim absent from the token fails rather than passes, so a policy cannot be weakened
+ * by an issuer that stops emitting a claim.
+ */
+export declare function matchTrustPolicyClaims(claims: TokenClaims, policyClaims: Record<string, ClaimConstraint>): string | undefined;
+/**
+ * Validates the *shape* of a policy's constraints — that each is a usable set of comparable values.
+ * Whether the set is specific enough to be safe depends on the issuer; that is the provider profile's
+ * assertPolicyIsSpecific.
+ *
+ * Throws ClientError naming the first problem; the reader is an administrator writing a policy.
+ */
+export declare function validateClaimConstraintShape(policyClaims: unknown): asserts policyClaims is Record<string, ClaimConstraint>;

package/dist/security/authn/oidc/claims.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * Issuer-agnostic claim matching and constraint validation (#2171).
+ *
+ * Pure — no network, no storage, and nothing that knows which issuer a token came from. Rules that
+ * depend on the issuer live in providers/.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.matchTrustPolicyClaims = matchTrustPolicyClaims;
+exports.validateClaimConstraintShape = validateClaimConstraintShape;
+const hdbError_ts_1 = require("../../../utility/errors/hdbError.js");
+/** Issuers may encode a numeric id as a JSON number; anything non-scalar is not comparable. */
+function claimToString(value) {
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number' && Number.isFinite(value))
+        return String(value);
+    return undefined;
+}
+/**
+ * Returns undefined on a match, or the first failure's reason — for the log, never the caller.
+ *
+ * A constrained claim absent from the token fails rather than passes, so a policy cannot be weakened
+ * by an issuer that stops emitting a claim.
+ */
+function matchTrustPolicyClaims(claims, policyClaims) {
+    const constraints = Object.entries(policyClaims);
+    // validateClaimConstraintShape rejects this at write time; this backstops a row that reached the
+    // table another way, such as replication from a peer.
+    if (constraints.length === 0)
+        return 'policy constrains no claims';
+    for (const [claimName, constraint] of constraints) {
+        const actual = claimToString(claims[claimName]);
+        if (actual === undefined || actual === '')
+            return `token has no usable ${claimName} claim`;
+        const accepted = Array.isArray(constraint) ? constraint : [constraint];
+        // Exact membership, deliberately — never a prefix, wildcard, or regex. Relaxing this to
+        // something like `startsWith` is the classic trusted-publishing escalation: a policy pinning
+        // `HarperFast/my-app` would then also admit `HarperFast/my-app-evil`, a repository anyone can
+        // create. unitTests/security/authn/oidc/claims.test.js pins both argument orders.
+        if (!accepted.includes(actual))
+            return `${claimName} does not match the policy`;
+    }
+    return undefined;
+}
+/**
+ * Validates the *shape* of a policy's constraints — that each is a usable set of comparable values.
+ * Whether the set is specific enough to be safe depends on the issuer; that is the provider profile's
+ * assertPolicyIsSpecific.
+ *
+ * Throws ClientError naming the first problem; the reader is an administrator writing a policy.
+ */
+function validateClaimConstraintShape(policyClaims) {
+    if (!policyClaims || typeof policyClaims !== 'object' || Array.isArray(policyClaims)) {
+        throw new hdbError_ts_1.ClientError('claims must be an object of claim constraints');
+    }
+    const entries = Object.entries(policyClaims);
+    if (entries.length === 0)
+        throw new hdbError_ts_1.ClientError('claims must constrain at least one claim');
+    for (const [claimName, constraint] of entries) {
+        const values = Array.isArray(constraint) ? constraint : [constraint];
+        if (values.length === 0)
+            throw new hdbError_ts_1.ClientError(`claims.${claimName} must accept at least one value`);
+        for (const value of values) {
+            if (typeof value !== 'string' || value === '') {
+                throw new hdbError_ts_1.ClientError(`claims.${claimName} must be a non-empty string or an array of non-empty strings`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=claims.js.map

package/dist/security/authn/oidc/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../../../security/authn/oidc/claims.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAkBH,wDAoBC;AASD,oEAmBC;AAhED,qEAAkE;AAGlE,+FAA+F;AAC/F,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACrC,MAAmB,EACnB,YAA6C;IAE7C,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACjD,iGAAiG;IACjG,sDAAsD;IACtD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,6BAA6B,CAAC;IAEnE,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;YAAE,OAAO,uBAAuB,SAAS,QAAQ,CAAC;QAC3F,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvE,wFAAwF;QACxF,6FAA6F;QAC7F,8FAA8F;QAC9F,kFAAkF;QAClF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,SAAS,4BAA4B,CAAC;IACjF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,4BAA4B,CAC3C,YAAqB;IAErB,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,yBAAW,CAAC,+CAA+C,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,YAAuC,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAW,CAAC,0CAA0C,CAAC,CAAC;IAE5F,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,yBAAW,CAAC,UAAU,SAAS,iCAAiC,CAAC,CAAC;QACrG,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAC/C,MAAM,IAAI,yBAAW,CAAC,UAAU,SAAS,8DAA8D,CAAC,CAAC;YAC1G,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/security/authn/oidc/identityToken.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Identity-token verification for OIDC trusted publishing (#2171).
+ *
+ * Verifies that a token was signed by the configured issuer and is addressed to this instance.
+ * Matching it against a policy's claim constraints is separate (claims.ts), because one verification
+ * serves every policy sharing an issuer and audience.
+ */
+import type { KeyObject } from 'node:crypto';
+import type { TokenClaims } from './types.ts';
+export interface VerifyTokenTarget {
+    issuer: string;
+    audience: string;
+}
+export interface VerifyTokenOptions {
+    /** Overridable for tests; defaults to the network-backed JWKS lookup. */
+    getSigningKey?: (issuer: string, kid: unknown) => Promise<KeyObject>;
+    /** Seconds since the epoch to evaluate expiry against; defaults to the real clock. */
+    clockTimestamp?: number;
+}
+/**
+ * Refuses a token. Shared with the exchange so both halves fail identically: the endpoint is
+ * unauthenticated, and a caller told exactly which check failed can probe a policy one claim at a
+ * time. The reason goes to the log instead.
+ */
+export declare function rejectToken(detail: string): never;
+/** Verifies a CI identity token against one issuer/audience pair and returns its normalized claims. */
+export declare function verifyIdentityToken(token: unknown, target: VerifyTokenTarget, options?: VerifyTokenOptions): Promise<TokenClaims>;

package/dist/security/authn/oidc/identityToken.js

@@ -0,0 +1,111 @@
+"use strict";
+/**
+ * Identity-token verification for OIDC trusted publishing (#2171).
+ *
+ * Verifies that a token was signed by the configured issuer and is addressed to this instance.
+ * Matching it against a policy's claim constraints is separate (claims.ts), because one verification
+ * serves every policy sharing an issuer and audience.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rejectToken = rejectToken;
+exports.verifyIdentityToken = verifyIdentityToken;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const hdbError_ts_1 = require("../../../utility/errors/hdbError.js");
+const logger_ts_1 = require("../../../utility/logging/logger.js");
+const jwks_ts_1 = require("./jwks.js");
+const index_ts_1 = require("./providers/index.js");
+const logger = (0, logger_ts_1.loggerWithTag)('oidc-trust');
+/**
+ * Asymmetric signatures only. Passing this to jwt.verify is what prevents algorithm confusion: an
+ * `alg: none` token, or one HMAC-signed with a public key as the secret, is rejected before the
+ * signature is considered.
+ */
+const ALLOWED_ALGORITHMS = [
+    'RS256',
+    'RS384',
+    'RS512',
+    'ES256',
+    'ES384',
+    'ES512',
+    'PS256',
+    'PS384',
+    'PS512',
+];
+const CLOCK_TOLERANCE_SECONDS = 60;
+/** CI identity tokens are minted per job and live minutes; a far-future expiry is not one to honor. */
+const MAX_TOKEN_LIFETIME_SECONDS = 3_600;
+/**
+ * Refuses a token. Shared with the exchange so both halves fail identically: the endpoint is
+ * unauthenticated, and a caller told exactly which check failed can probe a policy one claim at a
+ * time. The reason goes to the log instead.
+ */
+function rejectToken(detail) {
+    logger.warn?.(`Rejecting identity token: ${detail}`);
+    throw new hdbError_ts_1.ClientError('Identity token was rejected', 401);
+}
+/** Verifies a CI identity token against one issuer/audience pair and returns its normalized claims. */
+async function verifyIdentityToken(token, target, options = {}) {
+    if (typeof token !== 'string' || token === '')
+        throw new hdbError_ts_1.ClientError('token is required');
+    const issuer = (0, jwks_ts_1.normalizeIssuer)(target.issuer);
+    if (typeof target.audience !== 'string' || target.audience === '') {
+        throw new hdbError_ts_1.ClientError('audience is required');
+    }
+    const decoded = jsonwebtoken_1.default.decode(token, { complete: true });
+    if (!decoded)
+        rejectToken('token is not a well-formed JWT');
+    // Checked before resolving a key so a garbage header costs no outbound request.
+    if (!ALLOWED_ALGORITHMS.includes(decoded.header.alg)) {
+        rejectToken(`unsupported algorithm ${decoded.header.alg}`);
+    }
+    const getSigningKey = options.getSigningKey ?? jwks_ts_1.getSigningKey;
+    const key = await getSigningKey(issuer, decoded.header.kid);
+    let payload;
+    try {
+        payload = jsonwebtoken_1.default.verify(token, key, {
+            algorithms: ALLOWED_ALGORITHMS,
+            // Both spellings, because `issuer` here is normalized (trailing slash stripped) while
+            // jsonwebtoken compares it byte-for-byte against the raw `iss`. Azure AD v1 emits
+            // `https://sts.windows.net/<tenant>/`, which would otherwise never authenticate — and the
+            // generic profile exists precisely to serve issuers like it with no provider code. This
+            // cannot widen trust: normalizeIssuer already maps the two forms to one value, which is
+            // what keys the JWKS cache, the discovery check, and the policy lookup.
+            issuer: [issuer, `${issuer}/`],
+            audience: target.audience,
+            clockTolerance: CLOCK_TOLERANCE_SECONDS,
+            ...(options.clockTimestamp === undefined ? {} : { clockTimestamp: options.clockTimestamp }),
+        });
+    }
+    catch (error) {
+        rejectToken(error.message);
+    }
+    // jsonwebtoken only enforces `exp` when present, so a token without one never expires.
+    if (typeof payload.exp !== 'number')
+        rejectToken('token has no exp claim');
+    // `iat` is REQUIRED by OIDC, and required here rather than treated as optional: skipping the
+    // ceiling when it is absent means a token carrying a distant `exp` and no `iat` is unbounded —
+    // the ceiling would silently not apply to exactly the token that most needs it.
+    if (typeof payload.iat !== 'number')
+        rejectToken('token has no iat claim');
+    // Bounded against the verification clock, not only as `exp - iat`. jsonwebtoken validates `exp`
+    // and `nbf` but never rejects a future `iat`, so an issuer that shifts the whole pair forward
+    // keeps a small delta and still hands out a token valid far longer than the ceiling. Both the
+    // delta and the absolute distance to `exp` are checked; the tolerance mirrors the one given to
+    // jwt.verify so genuine clock skew is not treated as an attack.
+    const now = options.clockTimestamp ?? Math.floor(Date.now() / 1000);
+    if (payload.iat > now + CLOCK_TOLERANCE_SECONDS)
+        rejectToken('token iat is in the future');
+    if (payload.exp - payload.iat > MAX_TOKEN_LIFETIME_SECONDS) {
+        rejectToken(`token lifetime exceeds ${MAX_TOKEN_LIFETIME_SECONDS}s`);
+    }
+    if (payload.exp - now > MAX_TOKEN_LIFETIME_SECONDS + CLOCK_TOLERANCE_SECONDS) {
+        rejectToken(`token expires more than ${MAX_TOKEN_LIFETIME_SECONDS}s from now`);
+    }
+    // No `jti` requirement: not every issuer emits one (Azure uses `uti`, others omit it), and the
+    // exchange keys replay on a hash of the token itself, which is universal.
+    return (0, index_ts_1.profileForIssuer)(issuer).normalizeClaims(payload);
+}
+//# sourceMappingURL=identityToken.js.map

package/dist/security/authn/oidc/identityToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identityToken.js","sourceRoot":"","sources":["../../../../security/authn/oidc/identityToken.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;AAmDH,kCAGC;AAGD,kDAiEC;AAxHD,gEAAoE;AAEpE,qEAAkE;AAClE,kEAAmE;AACnE,uCAAmF;AACnF,mDAAwD;AAGxD,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,YAAY,CAAC,CAAC;AAE3C;;;;GAIG;AACH,MAAM,kBAAkB,GAAgB;IACvC,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACP,CAAC;AAEF,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,uGAAuG;AACvG,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAczC;;;;GAIG;AACH,SAAgB,WAAW,CAAC,MAAc;IACzC,MAAM,CAAC,IAAI,EAAE,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,yBAAW,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,uGAAuG;AAChG,KAAK,UAAU,mBAAmB,CACxC,KAAc,EACd,MAAyB,EACzB,UAA8B,EAAE;IAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,MAAM,IAAI,yBAAW,CAAC,mBAAmB,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACnE,MAAM,IAAI,yBAAW,CAAC,sBAAsB,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO;QAAE,WAAW,CAAC,gCAAgC,CAAC,CAAC;IAE5D,gFAAgF;IAChF,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAgB,CAAC,EAAE,CAAC;QACnE,WAAW,CAAC,yBAAyB,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAoB,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAE5D,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACJ,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE;YAChC,UAAU,EAAE,kBAAkB;YAC9B,sFAAsF;YACtF,kFAAkF;YAClF,0FAA0F;YAC1F,wFAAwF;YACxF,wFAAwF;YACxF,wEAAwE;YACxE,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,uBAAuB;YACvC,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;SAC3F,CAAe,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,WAAW,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,uFAAuF;IACvF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAC3E,6FAA6F;IAC7F,+FAA+F;IAC/F,gFAAgF;IAChF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAE3E,gGAAgG;IAChG,8FAA8F;IAC9F,8FAA8F;IAC9F,+FAA+F;IAC/F,gEAAgE;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,uBAAuB;QAAE,WAAW,CAAC,4BAA4B,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,0BAA0B,EAAE,CAAC;QAC5D,WAAW,CAAC,0BAA0B,0BAA0B,GAAG,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,0BAA0B,GAAG,uBAAuB,EAAE,CAAC;QAC9E,WAAW,CAAC,2BAA2B,0BAA0B,YAAY,CAAC,CAAC;IAChF,CAAC;IACD,+FAA+F;IAC/F,0EAA0E;IAE1E,OAAO,IAAA,2BAAgB,EAAC,MAAM,CAAC,CAAC,eAAe,CAAC,OAAsB,CAAC,CAAC;AACzE,CAAC"}

package/dist/security/authn/oidc/jwks.d.ts

@@ -0,0 +1,25 @@
+/**
+ * OIDC discovery and JWKS retrieval for trusted publishing (#2171).
+ *
+ * The issuer's signing keys are the root of trust for an exchanged token, and the endpoint that
+ * reaches them is unauthenticated — hence HTTPS only, bounded body, bounded time, and a rate limit
+ * on the refetch an unrecognized `kid` triggers, without which forged `kid`s become one outbound
+ * fetch per request.
+ */
+import { type KeyObject } from 'node:crypto';
+/** Drops all cached key sets. Exported for tests and for an operator forcing a re-read. */
+export declare function clearJwksCache(): void;
+/**
+ * Canonicalizes an issuer URL. The result is both the cache key and the discovery base, so a policy
+ * stored with a trailing slash and one without must not become two entries for the same issuer.
+ */
+export declare function normalizeIssuer(issuer: unknown): string;
+/** Resolves the public key an issuer used to sign a token, by `kid`. */
+/**
+ * `now` exists so the two time-based bounds below can be tested — the cache TTL and, more
+ * importantly, the STALE_KEY_GRACE_MS ceiling that stops a pulled key being honored forever through
+ * a prolonged outage. Reaching either otherwise needs a cache aged past an hour, and this repo bars
+ * new fake timers. Mirrors the `clockTimestamp` seam verifyIdentityToken already takes, rather than
+ * inventing a second convention. Callers in production pass nothing.
+ */
+export declare function getSigningKey(issuer: string, kid: unknown, now?: number): Promise<KeyObject>;

package/dist/security/authn/oidc/jwks.js

@@ -0,0 +1,261 @@
+"use strict";
+/**
+ * OIDC discovery and JWKS retrieval for trusted publishing (#2171).
+ *
+ * The issuer's signing keys are the root of trust for an exchanged token, and the endpoint that
+ * reaches them is unauthenticated — hence HTTPS only, bounded body, bounded time, and a rate limit
+ * on the refetch an unrecognized `kid` triggers, without which forged `kid`s become one outbound
+ * fetch per request.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearJwksCache = clearJwksCache;
+exports.normalizeIssuer = normalizeIssuer;
+exports.getSigningKey = getSigningKey;
+const node_crypto_1 = require("node:crypto");
+const logger_ts_1 = require("../../../utility/logging/logger.js");
+const hdbError_ts_1 = require("../../../utility/errors/hdbError.js");
+const logger = (0, logger_ts_1.loggerWithTag)('oidc-trust');
+const DISCOVERY_PATH = '/.well-known/openid-configuration';
+/** How long a fetched key set is served without revalidation. */
+const JWKS_CACHE_TTL_MS = 3_600_000;
+/** Floor between refetches triggered by an unrecognized `kid`. */
+const MIN_REFETCH_INTERVAL_MS = 60_000;
+/**
+ * How long a cached key set survives a failed refetch. Bounded, so a network blip does not break
+ * deploys but a pulled key does not stay honored forever.
+ */
+const STALE_KEY_GRACE_MS = 86_400_000;
+const FETCH_TIMEOUT_MS = 5_000;
+const MAX_RESPONSE_BYTES = 1_048_576;
+/** Asymmetric only: an `oct` key in a JWKS is the setup for algorithm confusion. */
+const SUPPORTED_KEY_TYPES = ['RSA', 'EC'];
+const issuerKeyCache = new Map();
+const inFlightLoads = new Map();
+/**
+ * When an unrecognized `kid` last drove a refetch, per issuer. Outside the cache entry on purpose:
+ * every successful fetch replaces that entry, and a rate limit that resets whenever it fires is not
+ * a rate limit. Separating them also lets a genuine key rotation be picked up on first use.
+ */
+const unknownKidRefetchAt = new Map();
+/**
+ * When a refresh for an issuer last FAILED, per issuer. Tracked separately from `fetchedAt`, which a
+ * failed fetch does not advance — so without this, every request wave arriving after the cache went
+ * stale starts discovery again and rides the same timeout before falling back to the same stale key.
+ * The exchange is unauthenticated and picks its issuer from an unverified JWT, and issuer key ids are
+ * public, so an anonymous caller could keep that cycle running for the length of an issuer outage:
+ * exactly when the stale-key grace is supposed to be absorbing load, not generating it.
+ */
+const failedRefreshAt = new Map();
+/** How long a failed refresh suppresses the next one, while a usable stale key is still on hand. */
+const FAILED_REFRESH_BACKOFF_MS = 30_000;
+/**
+ * Bumped by every clear. A fetch that was already in flight when the cache was cleared must not
+ * write its now-stale result back: clearing drops `inFlightLoads`, but the orphaned fetch still
+ * holds a reference and would repopulate the entry an operator just discarded — which for a clear
+ * issued precisely because the cached key is wrong means the re-read silently does nothing.
+ */
+let cacheGeneration = 0;
+/** Drops all cached key sets. Exported for tests and for an operator forcing a re-read. */
+function clearJwksCache() {
+    cacheGeneration++;
+    issuerKeyCache.clear();
+    inFlightLoads.clear();
+    unknownKidRefetchAt.clear();
+    failedRefreshAt.clear();
+}
+/**
+ * Canonicalizes an issuer URL. The result is both the cache key and the discovery base, so a policy
+ * stored with a trailing slash and one without must not become two entries for the same issuer.
+ */
+function normalizeIssuer(issuer) {
+    if (typeof issuer !== 'string' || issuer === '')
+        throw new hdbError_ts_1.ClientError('issuer is required');
+    let url;
+    try {
+        url = new URL(issuer);
+    }
+    catch {
+        throw new hdbError_ts_1.ClientError(`issuer is not a valid URL: ${issuer}`);
+    }
+    if (url.protocol !== 'https:')
+        throw new hdbError_ts_1.ClientError('issuer must be an https URL');
+    if (url.search !== '' || url.hash !== '')
+        throw new hdbError_ts_1.ClientError('issuer must not carry a query or fragment');
+    return url.origin + (url.pathname === '/' ? '' : url.pathname.replace(/\/$/, ''));
+}
+/**
+ * `content-length` is checked first as a cheap rejection, then the body is counted as it streams —
+ * the header is advisory, and a hostile endpoint can simply omit it.
+ */
+async function readBoundedJson(response, url) {
+    const declaredLength = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declaredLength) && declaredLength > MAX_RESPONSE_BYTES) {
+        throw new hdbError_ts_1.ServerError(`Response from ${url} exceeds ${MAX_RESPONSE_BYTES} bytes`);
+    }
+    const chunks = [];
+    let total = 0;
+    if (response.body) {
+        for await (const chunk of response.body) {
+            total += chunk.length;
+            if (total > MAX_RESPONSE_BYTES) {
+                throw new hdbError_ts_1.ServerError(`Response from ${url} exceeds ${MAX_RESPONSE_BYTES} bytes`);
+            }
+            chunks.push(Buffer.from(chunk));
+        }
+    }
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch (error) {
+        throw new hdbError_ts_1.ServerError(`Response from ${url} is not valid JSON: ${error.message}`);
+    }
+}
+async function fetchJson(url) {
+    let response;
+    try {
+        response = await fetch(url, {
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+            headers: { accept: 'application/json' },
+            redirect: 'error',
+        });
+    }
+    catch (error) {
+        throw new hdbError_ts_1.ServerError(`Could not reach ${url}: ${error.message}`);
+    }
+    if (!response.ok)
+        throw new hdbError_ts_1.ServerError(`${url} responded ${response.status}`);
+    return readBoundedJson(response, url);
+}
+/**
+ * The discovery document's own `issuer` must equal the one we asked about — the spec requires it,
+ * and it stops a misdirected document from quietly re-pointing an issuer we trust.
+ */
+async function discoverJwksUri(issuer) {
+    const document = await fetchJson(issuer + DISCOVERY_PATH);
+    // Swallowed rather than propagated: normalizeIssuer raises ClientError, the wrong shape for a
+    // malformed *server* response.
+    let declaredIssuer;
+    try {
+        declaredIssuer = normalizeIssuer(document?.issuer);
+    }
+    catch {
+        declaredIssuer = undefined;
+    }
+    if (declaredIssuer !== issuer) {
+        throw new hdbError_ts_1.ServerError(`Discovery document at ${issuer} declares a different issuer`);
+    }
+    const jwksUri = document?.jwks_uri;
+    if (typeof jwksUri !== 'string' || !jwksUri.startsWith('https://')) {
+        throw new hdbError_ts_1.ServerError(`Discovery document at ${issuer} has no https jwks_uri`);
+    }
+    return jwksUri;
+}
+/**
+ * Undefined for a key we will not honor. One unusable entry must not poison the set: issuers publish
+ * keys for other purposes, and an unknown future type should degrade rather than fail the fetch.
+ */
+function toSigningKey(jwk) {
+    if (!jwk || typeof jwk !== 'object')
+        return undefined;
+    if (typeof jwk.kid !== 'string' || jwk.kid === '')
+        return undefined;
+    if (jwk.use !== undefined && jwk.use !== 'sig')
+        return undefined;
+    if (!SUPPORTED_KEY_TYPES.includes(jwk.kty))
+        return undefined;
+    try {
+        return (0, node_crypto_1.createPublicKey)({ key: jwk, format: 'jwk' });
+    }
+    catch (error) {
+        logger.warn?.(`Skipping unusable JWK ${jwk.kid}: ${error.message}`);
+        return undefined;
+    }
+}
+async function fetchIssuerKeys(issuer) {
+    // Sampled before the first await, so any clear during the fetch is detectable at the end.
+    const generation = cacheGeneration;
+    const jwksUri = await discoverJwksUri(issuer);
+    const jwks = await fetchJson(jwksUri);
+    if (!Array.isArray(jwks?.keys))
+        throw new hdbError_ts_1.ServerError(`JWKS at ${jwksUri} has no keys array`);
+    const keys = new Map();
+    for (const jwk of jwks.keys) {
+        const key = toSigningKey(jwk);
+        if (key)
+            keys.set(jwk.kid, key);
+    }
+    if (keys.size === 0)
+        throw new hdbError_ts_1.ServerError(`JWKS at ${jwksUri} contains no usable signing keys`);
+    const entry = { keys, fetchedAt: Date.now() };
+    // Still returned to the caller that asked for it — it is freshly fetched and valid — but only
+    // cached if no clear happened while this was in flight.
+    if (generation === cacheGeneration)
+        issuerKeyCache.set(issuer, entry);
+    logger.debug?.(`Loaded ${keys.size} signing key(s) for ${issuer}`);
+    return entry;
+}
+/** Loads an issuer's keys, collapsing concurrent callers onto one fetch. */
+function loadIssuerKeys(issuer) {
+    const existing = inFlightLoads.get(issuer);
+    if (existing)
+        return existing;
+    const load = fetchIssuerKeys(issuer).finally(() => inFlightLoads.delete(issuer));
+    inFlightLoads.set(issuer, load);
+    return load;
+}
+/** Resolves the public key an issuer used to sign a token, by `kid`. */
+/**
+ * `now` exists so the two time-based bounds below can be tested — the cache TTL and, more
+ * importantly, the STALE_KEY_GRACE_MS ceiling that stops a pulled key being honored forever through
+ * a prolonged outage. Reaching either otherwise needs a cache aged past an hour, and this repo bars
+ * new fake timers. Mirrors the `clockTimestamp` seam verifyIdentityToken already takes, rather than
+ * inventing a second convention. Callers in production pass nothing.
+ */
+async function getSigningKey(issuer, kid, now = Date.now()) {
+    if (typeof kid !== 'string' || kid === '')
+        throw new hdbError_ts_1.ClientError('Token has no key id', 401);
+    const normalizedIssuer = normalizeIssuer(issuer);
+    const cached = issuerKeyCache.get(normalizedIssuer);
+    if (cached && now - cached.fetchedAt < JWKS_CACHE_TTL_MS) {
+        const key = cached.keys.get(kid);
+        if (key)
+            return key;
+        // Unknown kid against a still-fresh set: refetch once, then hold the line for the window. The
+        // timestamp is recorded before the fetch so a failing issuer is rate-limited like a succeeding one.
+        if (now - (unknownKidRefetchAt.get(normalizedIssuer) ?? 0) < MIN_REFETCH_INTERVAL_MS) {
+            throw new hdbError_ts_1.ClientError('Token signing key is not recognized', 401);
+        }
+        unknownKidRefetchAt.set(normalizedIssuer, now);
+    }
+    // A usable stale key, if the cache is expired but still inside the grace window.
+    const staleKey = cached && now - cached.fetchedAt < STALE_KEY_GRACE_MS ? cached.keys.get(kid) : undefined;
+    // Skip the fetch entirely while a recent one is known to have failed. Not gated on having a stale
+    // key: the fetch is the expensive part, and the issuer we have NEVER cached is the worse case —
+    // there is nothing to fall back to, so without this every request rides the full discovery and
+    // timeout. Refusing for the backoff interval bounds what an anonymous caller can drive, at the
+    // cost of a legitimate first exchange waiting out that interval after a blip. Fails closed.
+    if (now - (failedRefreshAt.get(normalizedIssuer) ?? 0) < FAILED_REFRESH_BACKOFF_MS) {
+        if (staleKey)
+            return staleKey;
+        throw new hdbError_ts_1.ServerError(`Signing keys for ${normalizedIssuer} are temporarily unavailable; a recent refresh failed`);
+    }
+    let refreshed;
+    try {
+        refreshed = await loadIssuerKeys(normalizedIssuer);
+    }
+    catch (error) {
+        // Recorded whether or not a stale key rescues this request, so the backoff also covers the
+        // issuer whose keys we have never held.
+        failedRefreshAt.set(normalizedIssuer, now);
+        if (!staleKey)
+            throw error;
+        logger.warn?.(`Using cached signing key for ${normalizedIssuer}; refresh failed: ${error.message}`);
+        return staleKey;
+    }
+    failedRefreshAt.delete(normalizedIssuer);
+    const key = refreshed.keys.get(kid);
+    if (!key)
+        throw new hdbError_ts_1.ClientError('Token signing key is not recognized', 401);
+    return key;
+}
+//# sourceMappingURL=jwks.js.map

package/dist/security/authn/oidc/jwks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../../../../security/authn/oidc/jwks.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AA2DH,wCAMC;AAMD,0CAWC;AA6HD,sCA6CC;AA1PD,6CAA8D;AAC9D,kEAAmE;AACnE,qEAA+E;AAE/E,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,YAAY,CAAC,CAAC;AAE3C,MAAM,cAAc,GAAG,mCAAmC,CAAC;AAC3D,iEAAiE;AACjE,MAAM,iBAAiB,GAAG,SAAS,CAAC;AACpC,kEAAkE;AAClE,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC;;;GAGG;AACH,MAAM,kBAAkB,GAAG,UAAU,CAAC;AACtC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,kBAAkB,GAAG,SAAS,CAAC;AACrC,oFAAoF;AACpF,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAO1C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAsB,CAAC;AACrD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA+B,CAAC;AAC7D;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;AAElD,oGAAoG;AACpG,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC;;;;;GAKG;AACH,IAAI,eAAe,GAAG,CAAC,CAAC;AAExB,2FAA2F;AAC3F,SAAgB,cAAc;IAC7B,eAAe,EAAE,CAAC;IAClB,cAAc,CAAC,KAAK,EAAE,CAAC;IACvB,aAAa,CAAC,KAAK,EAAE,CAAC;IACtB,mBAAmB,CAAC,KAAK,EAAE,CAAC;IAC5B,eAAe,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,MAAe;IAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,yBAAW,CAAC,oBAAoB,CAAC,CAAC;IAC7F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,yBAAW,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,yBAAW,CAAC,6BAA6B,CAAC,CAAC;IACpF,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,yBAAW,CAAC,2CAA2C,CAAC,CAAC;IAC7G,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,GAAW;IAC7D,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,kBAAkB,EAAE,CAAC;QAC5E,MAAM,IAAI,yBAAW,CAAC,iBAAiB,GAAG,YAAY,kBAAkB,QAAQ,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,QAAQ,CAAC,IAA4C,EAAE,CAAC;YACjF,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;gBAChC,MAAM,IAAI,yBAAW,CAAC,iBAAiB,GAAG,YAAY,kBAAkB,QAAQ,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,CAAC;IACF,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAW,CAAC,iBAAiB,GAAG,uBAAwB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,CAAC;AACF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IACnC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC7C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,QAAQ,EAAE,OAAO;SACjB,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,yBAAW,CAAC,mBAAmB,GAAG,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,yBAAW,CAAC,GAAG,GAAG,cAAc,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;IAC1D,8FAA8F;IAC9F,+BAA+B;IAC/B,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC;QACJ,cAAc,GAAG,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACR,cAAc,GAAG,SAAS,CAAC;IAC5B,CAAC;IACD,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,yBAAW,CAAC,yBAAyB,MAAM,8BAA8B,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,EAAE,QAAQ,CAAC;IACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,yBAAW,CAAC,yBAAyB,MAAM,wBAAwB,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAQ;IAC7B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACpE,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACjE,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,CAAC;QACJ,OAAO,IAAA,6BAAe,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,EAAE,CAAC,yBAAyB,GAAG,CAAC,GAAG,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc;IAC5C,0FAA0F;IAC1F,MAAM,UAAU,GAAG,eAAe,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,MAAM,IAAI,yBAAW,CAAC,WAAW,OAAO,oBAAoB,CAAC,CAAC;IAE9F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAW,CAAC,WAAW,OAAO,kCAAkC,CAAC,CAAC;IAEjG,MAAM,KAAK,GAAe,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC1D,8FAA8F;IAC9F,wDAAwD;IACxD,IAAI,UAAU,KAAK,eAAe;QAAE,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,EAAE,CAAC,UAAU,IAAI,CAAC,IAAI,uBAAuB,MAAM,EAAE,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,SAAS,cAAc,CAAC,MAAc;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE;;;;;;GAMG;AACI,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,GAAY,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACzF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,yBAAW,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC7F,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAEpD,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,iBAAiB,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,8FAA8F;QAC9F,oGAAoG;QACpG,IAAI,GAAG,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,uBAAuB,EAAE,CAAC;YACtF,MAAM,IAAI,yBAAW,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QACnE,CAAC;QACD,mBAAmB,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,iFAAiF;IACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1G,kGAAkG;IAClG,gGAAgG;IAChG,+FAA+F;IAC/F,+FAA+F;IAC/F,4FAA4F;IAC5F,IAAI,GAAG,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,yBAAyB,EAAE,CAAC;QACpF,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,yBAAW,CAAC,oBAAoB,gBAAgB,uDAAuD,CAAC,CAAC;IACpH,CAAC;IAED,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,SAAS,GAAG,MAAM,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,2FAA2F;QAC3F,wCAAwC;QACxC,eAAe,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,MAAM,KAAK,CAAC;QAC3B,MAAM,CAAC,IAAI,EAAE,CAAC,gCAAgC,gBAAgB,qBAAsB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/G,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,eAAe,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAEzC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,yBAAW,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/security/authn/oidc/providers/generic.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Fallback profile for issuers with no registered provider profile (#2171).
+ *
+ * Strict rather than permissive: the policy must pin `sub`. That is what makes workload identity work
+ * with zero provider code — a Kubernetes service-account token
+ * (`system:serviceaccount:<namespace>:<name>`), a GCP service account, and a SPIFFE SVID all carry a
+ * stable canonical subject, so pinning it identifies exactly one principal.
+ *
+ * GitHub Actions needs its own profile precisely because its `sub` is the one claim you should not
+ * pin: it varies by trigger, and its format changed for repositories created after 2026-07-15.
+ */
+import type { IdentityProviderProfile } from './index.ts';
+export declare const genericProfile: IdentityProviderProfile;

package/dist/security/authn/oidc/providers/generic.js

@@ -0,0 +1,34 @@
+"use strict";
+/**
+ * Fallback profile for issuers with no registered provider profile (#2171).
+ *
+ * Strict rather than permissive: the policy must pin `sub`. That is what makes workload identity work
+ * with zero provider code — a Kubernetes service-account token
+ * (`system:serviceaccount:<namespace>:<name>`), a GCP service account, and a SPIFFE SVID all carry a
+ * stable canonical subject, so pinning it identifies exactly one principal.
+ *
+ * GitHub Actions needs its own profile precisely because its `sub` is the one claim you should not
+ * pin: it varies by trigger, and its format changed for repositories created after 2026-07-15.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.genericProfile = void 0;
+const hdbError_ts_1 = require("../../../../utility/errors/hdbError.js");
+exports.genericProfile = {
+    name: 'generic OIDC',
+    assertPolicyIsSpecific(policyClaims) {
+        if (policyClaims.sub === undefined) {
+            throw new hdbError_ts_1.ClientError('claims must pin `sub` for an issuer with no registered provider profile — it is the only ' +
+                'claim every OIDC issuer defines as identifying a single principal. Register a provider ' +
+                'profile if this issuer needs richer rules.');
+        }
+    },
+    // No known shared default audience; the required `sub` pin already binds the policy to one principal.
+    assertAudienceIsSpecific() { },
+    normalizeClaims(payload) {
+        return { ...payload };
+    },
+    describePrincipal(claims) {
+        return typeof claims.sub === 'string' ? claims.sub : 'unknown principal';
+    },
+};
+//# sourceMappingURL=generic.js.map

package/dist/security/authn/oidc/providers/generic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic.js","sourceRoot":"","sources":["../../../../../security/authn/oidc/providers/generic.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAEH,wEAAqE;AAIxD,QAAA,cAAc,GAA4B;IACtD,IAAI,EAAE,cAAc;IAEpB,sBAAsB,CAAC,YAA6C;QACnE,IAAI,YAAY,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,yBAAW,CACpB,2FAA2F;gBAC1F,yFAAyF;gBACzF,4CAA4C,CAC7C,CAAC;QACH,CAAC;IACF,CAAC;IAED,sGAAsG;IACtG,wBAAwB,KAAU,CAAC;IAEnC,eAAe,CAAC,OAAoB;QACnC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IACvB,CAAC;IAED,iBAAiB,CAAC,MAAmB;QACpC,OAAO,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAC1E,CAAC;CACD,CAAC"}

package/dist/security/authn/oidc/providers/githubActions.d.ts

@@ -0,0 +1,11 @@
+/**
+ * GitHub Actions provider profile (#2171).
+ *
+ * The only module that should know anything about GitHub. Its rules are deliberately stricter than
+ * npm's trusted-publishing model, and scoping them here means that strictness never constrains
+ * another issuer.
+ */
+import type { IdentityProviderProfile } from './index.ts';
+/** Returns undefined rather than guessing when the value is not a ref-qualified reference. */
+export declare function splitWorkflowPath(workflowRef: unknown): string | undefined;
+export declare const githubActionsProfile: IdentityProviderProfile;