@harperfast/harper 5.2.9 → 5.3.0-alpha.1

package/server/serverHelpers/Headers.ts

@@ -159,3 +159,134 @@ export function toWriteHeadHeaders(headers: any): any {
 	}
 	return result;
 }
+
+// RFC 9111 cache-scope directives; boundaries on both sides so a token like `public-foo` doesn't match.
+export const SHARED_CACHE_OPTIN = /(^|[,\s])(public|s-maxage)($|[\s,;=])/i;
+export const PRIVATE_SCOPE = /(^|[,\s])(private|no-store)($|[\s,;=])/i;
+
+function headerValueString(value: unknown): string {
+	if (value == null) return '';
+	return Array.isArray(value) ? value.join(', ') : String(value);
+}
+
+/**
+ * Folds the middleware chain's response headers into the headers a fallback server produced for the
+ * same request.
+ *
+ * Bun and uWS construct a new response from legacy Fastify when the chain declines a request, so the
+ * chain's credential-dependent cache policy must be merged explicitly. Fastify wins headers it set,
+ * `Vary` is unioned, and private cache scope is re-applied unless the final response explicitly opts
+ * into RFC 9111 shared caching with `public` or `s-maxage`.
+ */
+export function mergeChainHeadersIntoFallback<
+	T extends {
+		get(name: string): any;
+		set(name: string, value: any): any;
+		has(name: string): boolean;
+		append?(name: string, value: any): any;
+	},
+>(chainHeaders: any, finalHeaders: T): T {
+	if (!chainHeaders?.[Symbol.iterator]) return finalHeaders;
+	const chainVary = headerValueString(chainHeaders.get('Vary'));
+	const chainCacheControl = headerValueString(chainHeaders.get('Cache-Control'));
+	for (const [name, value] of chainHeaders) {
+		const lowerName = String(name).toLowerCase();
+		if (lowerName === 'vary' || lowerName === 'cache-control') continue;
+		if (finalHeaders.has(name)) {
+			if (lowerName === 'set-cookie') {
+				const existing = (finalHeaders as any).getSetCookie?.() ?? finalHeaders.get(name);
+				const existingValues = new Set((Array.isArray(existing) ? existing : [existing]).map(String));
+				const values = Array.isArray(value) ? value : [value];
+				for (const single of values) {
+					if (!existingValues.has(String(single))) appendHeader(finalHeaders, name, single, false);
+				}
+			}
+			continue;
+		}
+		if (Array.isArray(value)) {
+			for (const single of value) appendHeader(finalHeaders, name, single, lowerName !== 'set-cookie');
+		} else finalHeaders.set(name, value);
+	}
+	for (const token of chainVary.split(',')) {
+		const trimmed = token.trim();
+		if (trimmed) addVaryHeader(finalHeaders as any, trimmed);
+	}
+	if (chainCacheControl) {
+		const finalCacheControl = headerValueString(finalHeaders.get('Cache-Control'));
+		if (!finalCacheControl) finalHeaders.set('Cache-Control', chainCacheControl);
+		else if (
+			PRIVATE_SCOPE.test(chainCacheControl) &&
+			!PRIVATE_SCOPE.test(finalCacheControl) &&
+			!SHARED_CACHE_OPTIN.test(finalCacheControl)
+		)
+			finalHeaders.set('Cache-Control', finalCacheControl + ', private');
+	}
+	return finalHeaders;
+}
+
+function nodeResponseHeaders(nodeResponse: any) {
+	return {
+		get: (name: string) => nodeResponse.getHeader(name),
+		set: (name: string, value: any) => nodeResponse.setHeader(name, value),
+		has: (name: string) => nodeResponse.hasHeader(name),
+		append: (name: string, value: any, commaDelimited?: boolean) => {
+			const existing = nodeResponse.getHeader(name);
+			if (existing == null) return nodeResponse.setHeader(name, value);
+			if (commaDelimited)
+				return nodeResponse.setHeader(name, (Array.isArray(existing) ? existing.join(', ') : existing) + ', ' + value);
+			return nodeResponse.setHeader(name, Array.isArray(existing) ? [...existing, value] : [existing, value]);
+		},
+	};
+}
+
+function applyWriteHeadHeaders(nodeResponse: any, headers: any): void {
+	const suppliedHeaders = new Map<string, { name: string; value: any }>();
+	const addHeader = (name: string, value: any) => {
+		const key = String(name).toLowerCase();
+		const supplied = suppliedHeaders.get(key);
+		if (!supplied) {
+			suppliedHeaders.set(key, { name, value });
+			return;
+		}
+		const values = Array.isArray(supplied.value) ? supplied.value : [supplied.value];
+		supplied.value = Array.isArray(value) ? values.concat(value) : values.concat([value]);
+	};
+	if (Array.isArray(headers)) {
+		if (Array.isArray(headers[0])) {
+			for (const [name, value] of headers) addHeader(name, value);
+		} else {
+			for (let i = 0; i + 1 < headers.length; i += 2) addHeader(headers[i], headers[i + 1]);
+		}
+	} else {
+		for (const name of Object.keys(headers)) {
+			const value = headers[name];
+			if (value != null) addHeader(name, value);
+		}
+	}
+	for (const { name, value } of suppliedHeaders.values()) nodeResponse.setHeader(name, value);
+}
+
+/**
+ * Node's counterpart to the Bun and uWS fallback bridges: the chain's headers go onto the
+ * `ServerResponse` before legacy Fastify runs, so a Fastify route that sets `Cache-Control` or `Vary`
+ * replaces them outright and can make a credential-dependent response shared-cacheable (#1565).
+ * Reconciliation therefore runs at `writeHead` — the last point the header set is still mutable, and
+ * the one Node also routes implicit headers through — using the same policy as the other two bridges.
+ */
+export function bridgeChainHeadersToNodeResponse(chainHeaders: any, nodeResponse: any): void {
+	if (!chainHeaders?.[Symbol.iterator]) return;
+	for (const [name, value] of chainHeaders) nodeResponse.setHeader(name, value);
+	const originalWriteHead = nodeResponse.writeHead;
+	nodeResponse.writeHead = function (statusCode: number, statusMessage?: any, headers?: any) {
+		if (this.headersSent) return originalWriteHead.apply(this, arguments as any);
+		if (statusMessage != null && typeof statusMessage !== 'string') {
+			headers = statusMessage;
+			statusMessage = undefined;
+		}
+		if (headers) applyWriteHeadHeaders(this, headers);
+		mergeChainHeadersIntoFallback(chainHeaders, nodeResponseHeaders(this));
+		return statusMessage === undefined
+			? originalWriteHead.call(this, statusCode)
+			: originalWriteHead.call(this, statusCode, statusMessage);
+	};
+}

package/server/serverHelpers/contentTypes.ts

@@ -125,6 +125,11 @@ const ndjsonHandler = {
 mediaTypes.set('application/x-ndjson', ndjsonHandler);
 mediaTypes.set('application/ndjson', ndjsonHandler);
 
+function serializeSSEData(data: any) {
+	if (typeof data === 'object') return 'data: ' + JSONStringify(data) + '\n';
+	return 'data: ' + String(data).replace(/\r\n|\r|\n/g, '\ndata: ') + '\n';
+}
+
 mediaTypes.set('text/event-stream', {
 	// Server-Sent Events (SSE)
 	serializeStream: function (iterable) {
@@ -141,20 +146,20 @@ mediaTypes.set('text/event-stream', {
 				id: message.timestamp,
 			};
 		}
-		if (message.data || message.event) {
+		// A non-null top-level `data` or truthy `event` is an SSE envelope, even with sibling fields.
+		// `id`/`retry` alone do not open it: `id` is too common a literal-payload field name (e.g. a
+		// database record) to safely treat as an SSE-envelope signal.
+		if (message.data != null || message.event) {
 			let serialized = '';
 			if (message.event) serialized += 'event: ' + message.event + '\n';
-			if (message.data) {
-				let data = message.data;
-				if (typeof data === 'object') data = JSONStringify(data);
-				serialized += 'data: ' + data + '\n';
+			if (message.data != null) {
+				serialized += serializeSSEData(message.data);
 			}
-			if (message.id) serialized += 'id: ' + message.id + '\n';
-			if (message.retry) serialized += 'retry: ' + message.retry + '\n';
+			if (message.id != null) serialized += 'id: ' + message.id + '\n';
+			if (message.retry != null) serialized += 'retry: ' + message.retry + '\n';
 			return serialized + '\n';
 		} else {
-			if (typeof message === 'object') return `data: ${JSONStringify(message)}\n\n`;
-			return `data: ${message}\n\n`;
+			return serializeSSEData(message) + '\n';
 		}
 	},
 	compressible: false,
@@ -436,6 +441,20 @@ export function serialize(responseData, request, responseObject) {
 }
 
 let asyncSerializations: Promise<void>[];
+/**
+ * Get the message serializer for a request's negotiated content type, memoized on the request.
+ * The returned function is the registered per-content-type serializer, so its identity keys the
+ * content type. Caching serialized output across requests under that key is only valid because the
+ * built-in serializers are pure functions of their argument — a component registering a serializer
+ * into `server.contentTypes` whose output depends on anything else would not be shareable.
+ * @param request
+ */
+export function getMessageSerializer(request?: Request): (message: any) => Buffer | string {
+	if (!request) return JSONStringify;
+	let serialize = (request as any).serialize;
+	if (!serialize) serialize = (request as any).serialize = findBestSerializer(request).serializer.serialize;
+	return serialize;
+}
 /**
  * Serialize a message, may be use multiple times (like with WebSockets)
  * @param message
@@ -450,18 +469,7 @@ export function serializeMessage(
 	if (message?.contentType != null && message.data != null) return message.data;
 	asyncSerializations = inAsyncContinuation ? undefined : [];
 	try {
-		let serialized: Buffer | string;
-		if (request) {
-			let serialize = (request as any).serialize;
-			if (serialize) serialized = serialize(message);
-			else {
-				const serializer = findBestSerializer(request);
-				serialize = (request as any).serialize = serializer.serializer.serialize;
-				serialized = serialize(message);
-			}
-		} else {
-			serialized = JSONStringify(message);
-		}
+		const serialized: Buffer | string = getMessageSerializer(request)(message);
 		if (asyncSerializations?.length > 0)
 			// if there were any serialization attempts that must wait for async work to be done, we wait now and then retry the serialization
 			return (asyncSerializations.length === 1 ? asyncSerializations[0] : Promise.all(asyncSerializations)).then(() =>

package/server/serverHelpers/deployValidationState.ts

@@ -1,25 +1,36 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+
+import type { ComponentStatus } from '../../components/status/ComponentStatus.ts';
+
 // Deploy pre-flight validation loads throwaway candidate component code purely to surface load-time
 // errors — its top-level `server.registerOperation` / `server.setMcpQuotaHandler` calls mutate
 // process-wide state (the operation map, its cross-thread announcement, the quota handler) that is
 // NOT owned by a Scope, so a failed/rolled-back deploy would otherwise leak the candidate's
-// registrations onto the live worker. Those registration methods no-op while this guard is active.
+// registrations onto the live worker. Those registration methods no-op while this guard is active,
+// and the candidate's component-status writes are diverted into the throwaway sink below.
 //
-// Depth-counted so overlapping validations both keep the guard raised until the last one finishes.
-// Caveat: while a validation is in flight, a legitimate registration from an interleaving real load
-// is also skipped (it re-registers on its next load); that window is narrow, and the alternative —
-// leaking a candidate's registration live — is worse.
-let validationDepth = 0;
+// Context-scoped rather than a process-wide depth counter, because the live component KEEPS SERVING on
+// this worker throughout the window and writes to both of those same places: it registers on its own
+// reload, and `statusForComponent()` is a public API its runtime code may call at any time. A counter
+// cannot tell the two writers apart, so it suppressed the live component's registration and reverted its
+// status report. An async context can: only work descending from the validation load itself is diverted.
+interface DeployValidationContext {
+	// Where the candidate's own status writes land instead of the live registry. Discarded with the context.
+	statusSink: Map<string, ComponentStatus>;
+}
+
+const deployValidation = new AsyncLocalStorage<DeployValidationContext>();
 
 export function isDeployValidating(): boolean {
-	return validationDepth > 0;
+	return deployValidation.getStore() !== undefined;
+}
+
+/** The throwaway map a candidate's status writes belong in, or `undefined` outside a validation load. */
+export function deployValidationStatusSink(): Map<string, ComponentStatus> | undefined {
+	return deployValidation.getStore()?.statusSink;
 }
 
 /** Run `fn` (the throwaway validation load) with the guard raised, lowering it even if `fn` throws. */
 export async function runWithDeployValidationGuard<T>(fn: () => Promise<T>): Promise<T> {
-	validationDepth++;
-	try {
-		return await fn();
-	} finally {
-		validationDepth--;
-	}
+	return deployValidation.run({ statusSink: new Map() }, fn);
 }

package/server/serverHelpers/operationAuthorizationState.ts

@@ -1,11 +1,42 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 
-const operationAuthorizationState = new AsyncLocalStorage<boolean>();
+interface OperationAuthorizationState {
+	bypassAuth: boolean;
+	apiOperation?: string;
+}
+
+const operationAuthorizationState = new AsyncLocalStorage<OperationAuthorizationState>();
+
+// Shared, for the common case of no carrier to preserve.
+const BYPASSED: OperationAuthorizationState = Object.freeze({ bypassAuth: true });
+const ENFORCED: OperationAuthorizationState = Object.freeze({ bypassAuth: false });
 
 export function runWithOperationAuthorizationBypass<T>(bypassAuth: boolean, callback: () => T): T {
-	return operationAuthorizationState.run(bypassAuth === true, callback);
+	// An existing carrier survives: the enforced branch is not a bypass, and a job handler dispatching
+	// a nested authorized operation must not lose its own operation identity.
+	const apiOperation = operationAuthorizationState.getStore()?.apiOperation;
+	if (apiOperation === undefined) {
+		return operationAuthorizationState.run(bypassAuth === true ? BYPASSED : ENFORCED, callback);
+	}
+	return operationAuthorizationState.run(Object.freeze({ bypassAuth: bypassAuth === true, apiOperation }), callback);
+}
+
+/**
+ * `apiOperation` MUST come from the same value that selected the code now running, so it cannot name
+ * an operation other than the one executing. That is the entire basis for trusting it: a request
+ * property would be forgeable, and on the direct-SQL path this check is the only gate.
+ */
+export function runWithDispatchedOperation<T>(apiOperation: string, callback: () => T): T {
+	return operationAuthorizationState.run(
+		Object.freeze({ bypassAuth: operationAuthorizationState.getStore()?.bypassAuth === true, apiOperation }),
+		callback
+	);
+}
+
+export function getOperationAuthorizationState(): OperationAuthorizationState | undefined {
+	return operationAuthorizationState.getStore();
 }
 
 export function isOperationAuthorizationBypassed(): boolean {
-	return operationAuthorizationState.getStore() === true;
+	return operationAuthorizationState.getStore()?.bypassAuth === true;
 }

package/server/serverHelpers/registeredOperations.ts

@@ -11,7 +11,7 @@
  * so a request is sent to exactly ONE registering worker (never broadcast-first-wins).
  *
  *  - Worker: `registerOperation()` announces the name (OPERATION_REGISTERED) to all threads;
- *    only the main thread records it, as name -> Set<threadId>.
+ *    only the main thread records it, as name -> Set<threadId>, plus `grantable`.
  *  - Main: on an OPERATION_FUNCTION_MAP miss, `getRemoteOperationFunction()` supplies a forwarding
  *    function that sends the request body (OPERATION_EXECUTE_REQUEST) to one live registering
  *    worker and awaits the correlated OPERATION_EXECUTE_RESPONSE.
@@ -26,7 +26,11 @@ import * as env from '../../utility/environment/environmentManager.ts';
 import harperLogger from '../../utility/logging/harper_logger.ts';
 import { ServerError } from '../../utility/errors/hdbError.ts';
 import { sendItcEvent } from '../threads/itc.js';
-import { onMessageByType, onThreadExit } from '../threads/manageThreads.js';
+import { hasThreadExited, onMessageByType, onThreadExit } from '../threads/manageThreads.js';
+import {
+	registerWorkerGrantableOperation,
+	unregisterWorkerGrantableOperation,
+} from '../../utility/operationPermissions.ts';
 import { runWithOperationAuthorizationBypass } from './operationAuthorizationState.ts';
 
 const operationLog = harperLogger.loggerWithTag('operation');
@@ -59,6 +63,9 @@ export function setLocalOperationDispatch(dispatch: typeof localDispatch) {
 
 /** name -> threadIds of workers that registered it (main thread only) */
 const registeredByWorker = new Map<string, Set<number>>();
+// Per originator, not per name: a rolling deploy whose new generation drops `requiresSuperUser`
+// must keep routing the name while retracting grantability, which a name-level flag cannot express.
+const grantableByWorker = new Map<string, Set<number>>();
 const pendingExecutions = new Map<
 	number,
 	{ targetThreadId: number; resolve: (result: any) => void; reject: (error: Error) => void }
@@ -71,27 +78,82 @@ let mainListenersAttached = false;
  * a lost announcement just means the op stays unreachable (the pre-#1736 status quo), and the
  * broadcast has its own ack timeout.
  */
-export function announceRegisteredOperation(name: string) {
+export function announceRegisteredOperation(name: string, grantable = false) {
 	if (isMainThread) return;
 	sendItcEvent({
 		type: terms.ITC_EVENT_TYPES.OPERATION_REGISTERED,
-		message: { name },
+		message: { name, grantable },
 	}).catch((error) => operationLog.error(`Failed to announce registered operation '${name}'`, error));
 }
 
 /**
  * ITC handler (all threads receive the broadcast; only main records it).
  */
-export function operationRegisteredHandler(event: { message: { name: string; originator: number } }) {
+export function operationRegisteredHandler(event: {
+	message?: { name?: string; grantable?: boolean; originator?: number };
+}) {
 	if (!isMainThread) return;
-	const { name, originator } = event.message;
+	const { name, grantable, originator } = event?.message ?? {};
 	if (typeof name !== 'string' || typeof originator !== 'number') return;
+	// An announcement can lose the race with its own thread's exit, and exit notification fires once
+	// per thread, so without this the entry would never be cleaned up. Reads manageThreads' tombstone
+	// rather than keeping a second one: job threads are one-shot workers, so a duplicate here would
+	// grow per completed job, not per worker restart.
+	if (hasThreadExited(originator)) {
+		operationLog.debug(`Ignoring operation '${name}' announced by exited worker thread ${originator}`);
+		return;
+	}
 	let workerIds = registeredByWorker.get(name);
 	if (!workerIds) registeredByWorker.set(name, (workerIds = new Set()));
 	workerIds.add(originator);
+	// Mirroring only widens what an allowlist may name; enforcement stays on the worker's
+	// chooseOperation. A re-announcement that drops the permission retracts this thread's claim.
+	setWorkerGrantable(name, originator, grantable === true);
 	operationLog.debug(`Registered operation '${name}' announced by worker thread ${originator}`);
 }
 
+/**
+ * A worker that dies mid-execution can never respond, so fail its in-flight forwards rather than
+ * waiting out the timeout, and forget its registrations (a replacement re-registers on load).
+ */
+function handleThreadExit(deadThreadId: number) {
+	for (const [name, workerIds] of registeredByWorker) {
+		if (!workerIds.delete(deadThreadId)) continue;
+		// A surviving worker that never declared a permission must not keep the name admissible.
+		if (workerIds.size === 0) dropRegistration(name);
+		else setWorkerGrantable(name, deadThreadId, false);
+	}
+	for (const [requestId, pending] of pendingExecutions) {
+		if (pending.targetThreadId === deadThreadId) {
+			pendingExecutions.delete(requestId);
+			pending.reject(new ServerError('The worker thread executing this operation exited', 503));
+		}
+	}
+}
+
+function setWorkerGrantable(name: string, threadId: number, grantable: boolean) {
+	let grantableIds = grantableByWorker.get(name);
+	if (grantable) {
+		if (!grantableIds) grantableByWorker.set(name, (grantableIds = new Set()));
+		grantableIds.add(threadId);
+		registerWorkerGrantableOperation(name);
+	} else if (grantableIds?.delete(threadId) && grantableIds.size === 0) {
+		grantableByWorker.delete(name);
+		unregisterWorkerGrantableOperation(name);
+	}
+}
+
+/**
+ * Forget an operation no live worker offers any more. Both prune paths — thread exit, and a failed
+ * send discovering a dead port — route through here so a name can never keep a route without an
+ * owner. Grantability is dropped per owner instead, in `setWorkerGrantable`.
+ */
+function dropRegistration(name: string) {
+	registeredByWorker.delete(name);
+	grantableByWorker.delete(name);
+	unregisterWorkerGrantableOperation(name);
+}
+
 let rotation = 0;
 /**
  * Main-thread dispatch fallback: if a worker registered `name`, return a forwarding operation
@@ -122,23 +184,15 @@ function attachMainListeners() {
 		if (error) pending.reject(new ServerError(error.message, error.statusCode || 500));
 		else pending.resolve(result);
 	});
-	// A worker that dies mid-execution can never respond; fail its in-flight forwards rather
-	// than waiting out the timeout, and forget its registrations (a replacement worker
-	// re-registers on component load).
-	onThreadExit((deadThreadId: number) => {
-		for (const [name, workerIds] of registeredByWorker) {
-			workerIds.delete(deadThreadId);
-			if (workerIds.size === 0) registeredByWorker.delete(name);
-		}
-		for (const [requestId, pending] of pendingExecutions) {
-			if (pending.targetThreadId === deadThreadId) {
-				pendingExecutions.delete(requestId);
-				pending.reject(new ServerError('The worker thread executing this operation exited', 503));
-			}
-		}
-	});
+	onThreadExit(handleThreadExit);
 }
 
+// Armed at load rather than on first use: serverUtilities imports this module during its own load,
+// before any worker exists. Thread-exit notification fires once per thread and is dropped outright
+// if no listener is attached yet, so a worker dying before its first announcement is processed
+// would otherwise leave a registration nothing could ever clean up.
+if (isMainThread) attachMainListeners();
+
 async function executeRemoteOperation(name: string, body: any, bypassAuth: boolean): Promise<any> {
 	attachMainListeners();
 	const workerIds = registeredByWorker.get(name);
@@ -168,7 +222,10 @@ async function executeRemoteOperation(name: string, body: any, bypassAuth: boole
 			);
 		}
 		if (!sent) {
+			// The port is gone, so this thread's claims go with it — grantability included, which
+			// handleThreadExit would otherwise not retract while other workers still route the name.
 			workerIds.delete(targetThreadId);
+			setWorkerGrantable(name, targetThreadId, false);
 			continue;
 		}
 		return new Promise((promiseResolve, promiseReject) => {
@@ -190,7 +247,7 @@ async function executeRemoteOperation(name: string, body: any, bypassAuth: boole
 			});
 		});
 	}
-	if (registeredByWorker.get(name)?.size === 0) registeredByWorker.delete(name);
+	if (registeredByWorker.get(name)?.size === 0) dropRegistration(name);
 	throw new ServerError(
 		`Operation '${name}' is registered by a component but no worker thread is available to run it`,
 		503

package/server/serverHelpers/requestSanitization.ts

@@ -0,0 +1,15 @@
+/**
+ * `evaluateSQL` honors a supplied `parsed_sql_object` verbatim and skips parsing, so one carrying
+ * `permissions_checked: true` executes an AST that no authorization check ever saw. Neither position
+ * is ever legitimately client-supplied: dispatch parses the statement itself, and the job worker
+ * re-parses from the `sql` string dispatch authorized.
+ *
+ * Both positions, because the two entry points differ: `chooseOperation` overwrites the top-level
+ * object with its own parse, but only inside its SQL branch, so a non-SQL job (`export_local` with a
+ * `search_by_value` search) can still carry a client-supplied one through to the persisted row.
+ */
+export function stripSuppliedParsedSqlObject(request: any): void {
+	if (!request) return;
+	delete request.parsed_sql_object;
+	delete request.search_operation?.parsed_sql_object;
+}

package/server/serverHelpers/serverHandlers.js

@@ -41,6 +41,9 @@ const NO_AUTH_OPERATIONS = [
 	terms.OPERATIONS_ENUM.CREATE_AUTHENTICATION_TOKENS,
 	terms.OPERATIONS_ENUM.LOGIN,
 	terms.OPERATIONS_ENUM.LOGOUT,
+	// The OIDC exchange *is* the authentication (#2171): the caller proves identity with a token
+	// from a trusted issuer, not with Harper credentials it does not have.
+	terms.OPERATIONS_ENUM.EXCHANGE_OIDC_TOKEN,
 ];
 
 const UNSAFE_REQUEST_BODY_PROPERTIES = ['__proto__', 'constructor', 'prototype'];
@@ -111,10 +114,10 @@ function authHandler(req, resp, done) {
 	const isAuthOperation = !NO_AUTH_OPERATIONS.includes(req.body.operation);
 	if (
 		isAuthOperation ||
-		// If create token is called without username/password in the body it needs to be authorized
+		// Create token needs to be authorized when called without username/password in the body, or
+		// with an inline role object (scoped-token minting is gated on the authenticated requester)
 		(req.body.operation === terms.OPERATIONS_ENUM.CREATE_AUTHENTICATION_TOKENS &&
-			!req.body.username &&
-			!req.body.password)
+			((!req.body.username && !req.body.password) || (req.body.role && typeof req.body.role === 'object')))
 	) {
 		pAuthorize(req, resp)
 			.then(async (userData) => {