@lensmcp/cluster 1.16.6 → 1.16.8

package/executors/gateway/runtime/auth.d.ts

@@ -1,8 +1,9 @@
 import type { AuthVerdict, GatewayRuntime, GwTrace, Route } from './types';
 import type { Observability } from './observability';
+import type { JwtVerifier } from '../jwks-verify';
 export interface EdgeAuth {
     internal(req: import('node:http').IncomingMessage, route: Route, trace: GwTrace | undefined): AuthVerdict;
     public(req: import('node:http').IncomingMessage, route: Route, trace: GwTrace | undefined): AuthVerdict;
 }
-export declare function createEdgeAuth(rt: GatewayRuntime, obs: Observability): EdgeAuth;
+export declare function createEdgeAuth(rt: GatewayRuntime, obs: Observability, verifier?: JwtVerifier): EdgeAuth;
 //# sourceMappingURL=auth.d.ts.map

package/executors/gateway/runtime/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/auth.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IAC1G,MAAM,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;CACzG;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,QAAQ,CA8C/E"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/auth.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IAC1G,MAAM,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;CACzG;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,QAAQ,CA8CvG"}

package/executors/gateway/runtime/auth.js

@@ -14,7 +14,7 @@ exports.createEdgeAuth = createEdgeAuth;
  */
 const manifest_1 = require("../manifest");
 const dev_auth_1 = require("./dev-auth");
-function createEdgeAuth(rt, obs) {
+function createEdgeAuth(rt, obs, verifier) {
     const { traceStep } = obs;
     const internal = (req, _route, trace) => {
         // service-to-service: validate the CALLER's api key at the boundary
@@ -37,7 +37,7 @@ function createEdgeAuth(rt, obs) {
             const method = (req.method ?? 'GET').toUpperCase();
             const resolved = (0, manifest_1.authRuleFor)(policy, url0, method);
             if (resolved.mode === 'jwt') {
-                const claims = (0, dev_auth_1.verifyDevJwt)(req);
+                const claims = (0, dev_auth_1.verifyDevJwt)(req, verifier);
                 if (!claims) {
                     traceStep(trace, 'auth', { mode: 'jwt', ok: false });
                     return { ok: false, status: 401, reason: 'unauthorized', detail: 'Unauthorized: invalid or missing token' };

package/executors/gateway/runtime/dev-auth.d.ts

@@ -1,7 +1,14 @@
 import type * as http from 'node:http';
 import type { Attrs } from './types';
-/** Verify the end-user JWT and return its claims, or undefined. */
-export declare function verifyDevJwt(req: http.IncomingMessage): Record<string, unknown> | undefined;
+import type { JwtVerifier } from '../jwks-verify';
+/**
+ * Verify the end-user JWT and return its claims, or undefined.
+ *
+ * @param verifier when provided (the RS256/JWKS verifier wired by the composition root), it is the ONLY
+ *   acceptor — the token is verified against the issuer's published keys by `kid`, so a rogue key / unknown
+ *   kid / bad signature / `alg:none` / HS256-confusion / expired token all return undefined (fail closed).
+ */
+export declare function verifyDevJwt(req: http.IncomingMessage, verifier?: JwtVerifier): Record<string, unknown> | undefined;
 /** Stamp verified identity onto the forwarded request — tenant from the `tid` CLAIM, never a client header. */
 export declare function stampIdentity(req: http.IncomingMessage, claims: Record<string, unknown>): void;
 /** Build the ABAC attribute bag from the verified claims + request envelope. */

package/executors/gateway/runtime/dev-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-auth.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/dev-auth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAiC3F;AAED,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAQ9F;AAED,gFAAgF;AAChF,eAAO,MAAM,QAAQ,GAAI,KAAK,IAAI,CAAC,eAAe,EAAE,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAKpF,CAAC"}
+{"version":3,"file":"dev-auth.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/dev-auth.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AASlD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAyCnH;AAED,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAQ9F;AAED,gFAAgF;AAChF,eAAO,MAAM,QAAQ,GAAI,KAAK,IAAI,CAAC,eAAe,EAAE,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAKpF,CAAC"}

package/executors/gateway/runtime/dev-auth.js

@@ -4,25 +4,45 @@ exports.devAttrs = void 0;
 exports.verifyDevJwt = verifyDevJwt;
 exports.stampIdentity = stampIdentity;
 /**
- * Dev edge auth (HS256), mirroring the prod gateway: verify the end-user token, then stamp the
- * trusted identity headers the services read (via GatewayTrustGuard). RS256/JWKS is prod's job;
- * dev shares the `AUTH_JWT_SECRET` the auth host signs with. Pure functions.
+ * Dev edge auth: verify the end-user token, then stamp the trusted identity headers the services read
+ * (via GatewayTrustGuard). It MIRRORS the prod gateway's posture — a real JWKS/RS256 verifier when one is
+ * wired (see `../jwks-verify` + the composition in `server.ts`), an HS256 shared-secret path as the legacy
+ * fallback. Pure functions (the verifier is injected, so unit tests supply their own JWKS).
+ *
+ * SECURITY (the invariant this file must hold): a `jwt` route MUST NOT accept a token whose signature the
+ * edge cannot verify. When a JWKS verifier is wired it is the SOLE acceptor — every alg goes through it, so
+ * an unknown `kid`, a bad signature, `alg:none`, an HS256-confusion token, and an expired token ALL fail
+ * closed (rejected). Without a verifier, an asymmetric (RS256/ES*) token cannot be checked (we don't hold
+ * the issuer's public keys), so it also fails closed — unless an operator EXPLICITLY opts into the old
+ * insecure decode-only path (`LENSMCP_GW_DEV_JWT_INSECURE_DECODE=1`) for local bring-up. The HS256
+ * shared-secret path stays for services using that convention (and is itself bypassed once JWKS is wired).
  */
 const node_crypto_1 = require("node:crypto");
-/** Verify the end-user JWT and return its claims, or undefined. */
-function verifyDevJwt(req) {
-    const secret = process.env['AUTH_JWT_SECRET'] ?? 'tetros-dev-secret';
-    const auth = String((Array.isArray(req.headers['authorization']) ? req.headers['authorization'][0] : req.headers['authorization']) ?? '');
-    if (!auth.startsWith('Bearer '))
+/** The compact JWS from the `Authorization: Bearer …` header, or undefined. */
+function bearerToken(req) {
+    const raw = Array.isArray(req.headers['authorization']) ? req.headers['authorization'][0] : req.headers['authorization'];
+    const auth = String(raw ?? '');
+    return auth.startsWith('Bearer ') ? auth.slice(7) : undefined;
+}
+/**
+ * Verify the end-user JWT and return its claims, or undefined.
+ *
+ * @param verifier when provided (the RS256/JWKS verifier wired by the composition root), it is the ONLY
+ *   acceptor — the token is verified against the issuer's published keys by `kid`, so a rogue key / unknown
+ *   kid / bad signature / `alg:none` / HS256-confusion / expired token all return undefined (fail closed).
+ */
+function verifyDevJwt(req, verifier) {
+    const token = bearerToken(req);
+    if (!token)
         return undefined;
-    const [h, p, s] = auth.slice(7).split('.');
+    const [h, p, s] = token.split('.');
     if (!h || !p || !s)
         return undefined;
-    // An IdP that signs ASYMMETRIC (RS256 + JWKS — e.g. tetros's auth host) does NOT use the HS256 dev
-    // shared-secret this dev edge assumed. The PROD gateway verifies RS256 via jwks-verify; in dev we
-    // DECODE + exp-check the claims (no signature check) — the gateway is the only local ingress, the token
-    // came from the trusted local IdP, and a dev IdP's ephemeral per-pod keys make in-cluster JWKS
-    // verification unreliable. (The HS256 path below stays for services using the shared-secret convention.)
+    // Preferred: a real JWKS/RS256 verifier (mirrors the prod gateway's `jwks ? jwks.verify(tok) : hs256`).
+    // When wired it is the SOLE acceptor, so every forgery vector below is closed at once.
+    if (verifier)
+        return verifier.verify(token);
+    // ── No verifier wired (legacy dev) ──────────────────────────────────────────────────────────────────
     let alg;
     try {
         alg = JSON.parse(Buffer.from(h, 'base64url').toString())['alg'];
@@ -31,6 +51,13 @@ function verifyDevJwt(req) {
         return undefined;
     }
     if (typeof alg === 'string' && alg !== 'HS256') {
+        // An asymmetric IdP (RS256 + JWKS) does NOT use the HS256 dev shared secret. Without the issuer's public
+        // keys we CANNOT verify the signature, so — unlike the old code, which decode-accepted any RS256 token
+        // (a full edge auth bypass: a rogue key or a forged `alg:none` sailed through) — we FAIL CLOSED. Wire a
+        // JWKS verifier (LENSMCP_GW_JWKS_URL, or the auto-derived auth-host JWKS) to accept RS256 tokens.
+        if (process.env['LENSMCP_GW_DEV_JWT_INSECURE_DECODE'] !== '1')
+            return undefined; // fail closed
+        // Explicit, dev-only opt-in to the legacy decode + exp-check (NO signature check) — bring-up escape hatch.
         try {
             const rsClaims = JSON.parse(Buffer.from(p, 'base64url').toString());
             if (typeof rsClaims['exp'] === 'number' && Date.now() / 1000 > rsClaims['exp'])
@@ -41,6 +68,8 @@ function verifyDevJwt(req) {
             return undefined;
         }
     }
+    // HS256 shared-secret convention (only reachable when NO JWKS verifier is wired).
+    const secret = process.env['AUTH_JWT_SECRET'] ?? 'tetros-dev-secret';
     const expected = (0, node_crypto_1.createHmac)('sha256', secret).update(`${h}.${p}`).digest('base64url');
     const a = Buffer.from(s);
     const b = Buffer.from(expected);

package/executors/gateway/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAe,MAAM,SAAS,CAAC;AAEjH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAkKxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAsB,MAAM,SAAS,CAAC;AAkDxH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA0KxB"}

package/executors/gateway/runtime/server.js

@@ -24,6 +24,57 @@ const auth_1 = require("./auth");
 const hooks_1 = require("./hooks");
 const handler_1 = require("./handler");
 const upgrade_1 = require("./upgrade");
+const jwks_verify_1 = require("../jwks-verify");
+/**
+ * A `fetch`-shaped shim for the JWKS pull that accepts the dev gateway's OWN self-signed cert. The dev
+ * IdP's JWKS is served behind the same local HTTPS front door (e.g. `https://auth.tetros.ai.local`), whose
+ * cert chains to the local basic-ssl CA — global `fetch` would reject it. Read-only GET of a public,
+ * gateway-served JWKS document; the SIGNATURE trust comes from verifying tokens against those keys, not
+ * from the transport. Falls back to plain `http` for an http URL. Dev-only (only the dev executor uses it).
+ */
+function insecureLocalFetch(url, init) {
+    return new Promise((resolve, reject) => {
+        const mod = url.startsWith('https:') ? require('node:https') : require('node:http');
+        const req = mod.request(url, { method: 'GET', headers: init?.headers, rejectUnauthorized: false }, (res) => {
+            const chunks = [];
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => {
+                const status = res.statusCode ?? 0;
+                const text = Buffer.concat(chunks).toString('utf8');
+                resolve({ ok: status >= 200 && status < 300, status, json: async () => JSON.parse(text) });
+            });
+        });
+        req.on('error', reject);
+        req.end();
+    });
+}
+/**
+ * The dev edge's JWT verifier — matches the prod gateway's RS256/JWKS posture so the LOCAL edge rejects
+ * forged tokens instead of decode-accepting them. The JWKS URL is `LENSMCP_GW_JWKS_URL` (explicit, same
+ * env as prod) or, absent that, is AUTO-DERIVED from the trusted `auth.*` host in the gateway's own route
+ * table (`https://<auth-host>/jwks.json`) — so a standard `auth.<apex>` IdP needs zero config. The host is
+ * taken from project.json (trusted), never from a token, so there's no SSRF/attacker-chosen JWKS. Returns
+ * undefined when no source is found (→ non-HS256 tokens fail closed unless the insecure opt-in is set).
+ */
+function buildEdgeJwtVerifier(routes) {
+    const explicit = process.env['LENSMCP_GW_JWKS_URL'];
+    let jwksUrl = explicit;
+    let derived = false;
+    if (!jwksUrl) {
+        const authHost = routes
+            .map((r) => r.host)
+            .find((h) => typeof h === 'string' && /^auth\./.test(h) && !h.startsWith('internal.'));
+        if (authHost) {
+            jwksUrl = `https://${authHost}/jwks.json`;
+            derived = true;
+        }
+    }
+    if (!jwksUrl)
+        return undefined;
+    const issuer = process.env['LENSMCP_GW_JWT_ISS'];
+    console.log(`[gateway] edge JWT: verifying via JWKS ${jwksUrl}${derived ? ' (auto-derived from the auth route)' : ''}`);
+    return (0, jwks_verify_1.createJwksVerifier)({ jwksUrl, ...(issuer ? { issuer } : {}), fetchImpl: insecureLocalFetch });
+}
 async function startGateway(options, context) {
     // NB: this local `https` (TLS-on flag) deliberately SHADOWS the `node:https`
     // module — which is why TLS/agents are reached via `require('node:https')`.
@@ -65,7 +116,15 @@ async function startGateway(options, context) {
     const svcLayer = (0, lifecycle_1.createServiceLayer)(rt, obs);
     const lens = (0, lens_children_1.createLensChildren)(rt, obs, options);
     const proxyLayer = (0, proxy_1.createProxy)(rt, obs, svcLayer);
-    const edgeAuth = (0, auth_1.createEdgeAuth)(rt, obs);
+    // Edge JWT verification (mirrors the prod gateway): when a JWKS source is configured/derivable, the dev
+    // edge verifies RS256 tokens by `kid` against the IdP's published keys and REJECTS anything it can't
+    // verify (rogue kid / bad sig / alg:none / HS256-confusion / expired) — closing the dev decode-only bypass.
+    const jwtVerifier = buildEdgeJwtVerifier(routes);
+    const edgeAuth = (0, auth_1.createEdgeAuth)(rt, obs, jwtVerifier);
+    // Warm the key cache (non-fatal, non-blocking): the IdP pod may still be booting, so a failure here just
+    // means the first tokens fail closed until the on-miss/periodic refresh lands the keys (matches prod).
+    if (jwtVerifier)
+        void jwtVerifier.refresh().catch((e) => console.warn('[gateway] edge JWKS warm failed (will retry):', e.message));
     // Custom user middleware (the JWT seam; internal.* routes skip it) is wired as
     // the BUILT-IN FIRST `afterAuth` hook — so "custom middleware runs AFTER core
     // auth" and the `{ mode:'middleware' }` trace step are preserved.
@@ -167,6 +226,7 @@ async function startGateway(options, context) {
         clearInterval(edgeFlusher);
         clearInterval(sweeper);
         obs.emit('info', 'gateway down', 'cluster-gateway', { kind: 'gateway-down' });
+        jwtVerifier?.stop(); // clear the JWKS periodic-refresh timer
         for (const svc of services)
             svcLayer.killSpawned(svc, 'gateway shutdown');
         // Reap the lens-mode managed children (dashboard + MCP singletons + each

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.16.6",
+  "version": "1.16.8",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/node-instrumentation": "1.16.6",
-    "@lensmcp/nx-plugin": "1.16.6",
+    "@lensmcp/node-instrumentation": "1.16.8",
+    "@lensmcp/nx-plugin": "1.16.8",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "glob": "^11.0.0",
     "http-proxy": "^1.18.0",