@naylence/agent-sdk 0.3.13 → 0.3.14

package/dist/browser/index.js

@@ -15667,12 +15667,12 @@
     }
 
     // This file is auto-generated during build - do not edit manually
-    // Generated from package.json version: 0.3.16
+    // Generated from package.json version: 0.3.20
     /**
      * The package version, injected at build time.
      * @internal
      */
-    const VERSION$2 = '0.3.16';
+    const VERSION$2 = '0.3.20';
 
     let initialized$1 = false;
     const runtimePlugin = {
@@ -39791,9 +39791,15 @@
                         hasNodeAttachValidation(authorizer)) {
                         try {
                             const validated = await authorizer.validateNodeAttachRequest(_node, envelope.frame, authResult);
-                            if (validated) {
-                                finalAuthResult = validated;
+                            if (validated === undefined) {
+                                logger$z.warning('node_attach_validation_rejected', {
+                                    envp_id: envelope.id,
+                                    frame_type: envelope.frame.type,
+                                    origin_type: context.originType ?? 'unknown',
+                                });
+                                return null;
                             }
+                            finalAuthResult = validated;
                         }
                         catch (error) {
                             logger$z.error('node_attach_authorization_validation_failed', {
@@ -41889,6 +41895,7 @@
     const ENV_VAR_HMAC_SECRET = 'FAME_HMAC_SECRET';
     const ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER = 'FAME_JWT_REVERSE_AUTH_TRUSTED_ISSUER';
     const ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE = 'FAME_JWT_REVERSE_AUTH_AUDIENCE';
+    const ENV_VAR_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY = 'FAME_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY';
     const PROFILE_NAME_STRICT_OVERLAY = 'strict-overlay';
     const PROFILE_NAME_OVERLAY = 'overlay';
     const PROFILE_NAME_OVERLAY_CALLBACK = 'overlay-callback';
@@ -42124,6 +42131,7 @@
             max_ttl_sec: 86400,
             algorithm: Expressions.env(ENV_VAR_JWT_ALGORITHM, 'RS256'),
             audience: Expressions.env(ENV_VAR_JWT_AUDIENCE$1),
+            enforce_token_subject_node_identity: Expressions.env(ENV_VAR_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY, 'false'),
         },
     };
     const GATED_CALLBACK_PROFILE = {
@@ -42330,6 +42338,7 @@
     var nodeSecurityProfileFactory = /*#__PURE__*/Object.freeze({
         __proto__: null,
         ENV_VAR_DEFAULT_ENCRYPTION_LEVEL: ENV_VAR_DEFAULT_ENCRYPTION_LEVEL,
+        ENV_VAR_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY: ENV_VAR_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY,
         ENV_VAR_HMAC_SECRET: ENV_VAR_HMAC_SECRET,
         ENV_VAR_JWKS_URL: ENV_VAR_JWKS_URL,
         ENV_VAR_JWT_ALGORITHM: ENV_VAR_JWT_ALGORITHM,
@@ -48244,6 +48253,7 @@
                 defaultTtlSec: normalized.defaultTtlSec,
                 maxTtlSec: normalized.maxTtlSec,
                 reverseAuthTtlSec: normalized.reverseAuthTtlSec,
+                enforceTokenSubjectNodeIdentity: normalized.enforceTokenSubjectNodeIdentity,
             };
             if (tokenIssuer) {
                 authorizerOptions.tokenIssuer = tokenIssuer;
@@ -48311,6 +48321,8 @@
             : typeof source.reverse_auth_ttl_sec === 'number'
                 ? source.reverse_auth_ttl_sec
                 : DEFAULT_REVERSE_AUTH_TTL_SEC;
+        const enforceTokenSubjectNodeIdentity = normalizeBooleanOption(source.enforceTokenSubjectNodeIdentity ??
+            source.enforce_token_subject_node_identity, false);
         const tokenVerifierConfigInput = source.tokenVerifierConfig ?? source.token_verifier_config ?? null;
         const tokenVerifierConfig = normalizeTokenVerifierConfig({
             config: tokenVerifierConfigInput,
@@ -48329,6 +48341,7 @@
             maxTtlSec,
             tokenVerifierConfig,
             reverseAuthTtlSec: reverseAuthCandidate,
+            enforceTokenSubjectNodeIdentity,
             ...(audience ? { audience } : {}),
         };
         if (tokenIssuerConfig) {
@@ -48349,6 +48362,21 @@
         };
         return defaultConfig;
     }
+    function normalizeBooleanOption(value, defaultValue) {
+        if (typeof value === 'boolean') {
+            return value;
+        }
+        if (typeof value === 'string') {
+            const lower = value.toLowerCase().trim();
+            if (lower === 'true' || lower === '1' || lower === 'yes') {
+                return true;
+            }
+            if (lower === 'false' || lower === '0' || lower === 'no') {
+                return false;
+            }
+        }
+        return defaultValue;
+    }
 
     var oauth2AuthorizerFactory = /*#__PURE__*/Object.freeze({
         __proto__: null,
@@ -53366,6 +53394,10 @@
                 : typeof snake.aud === 'string'
                     ? snake.aud
                     : undefined);
+        const enforceTokenSubjectNodeIdentity = camel.enforceTokenSubjectNodeIdentity ??
+            (typeof snake.enforce_token_subject_node_identity === 'boolean'
+                ? snake.enforce_token_subject_node_identity
+                : undefined);
         return {
             tokenVerifier,
             tokenIssuer,
@@ -53375,6 +53407,7 @@
             defaultTtlSec,
             maxTtlSec,
             reverseAuthTtlSec,
+            enforceTokenSubjectNodeIdentity,
         };
     }
     class OAuth2Authorizer {
@@ -53388,6 +53421,8 @@
             this.requireScope = options.requireScope ?? true;
             this.reverseAuthTtlSec =
                 options.reverseAuthTtlSec ?? DEFAULT_REVERSE_AUTH_TTL_SEC;
+            this.enforceTokenSubjectNodeIdentity =
+                options.enforceTokenSubjectNodeIdentity ?? false;
         }
         get tokenVerifier() {
             return this.tokenVerifierImpl;
@@ -53517,6 +53552,13 @@
                 });
                 return undefined;
             }
+            // Enforce token subject node identity if enabled
+            if (this.enforceTokenSubjectNodeIdentity) {
+                const validationResult = await this.validateTokenSubjectNodeIdentity(frame.systemId, claims);
+                if (!validationResult) {
+                    return undefined;
+                }
+            }
             claims.instance_id = claims.instance_id ?? frame.instanceId;
             claims.assigned_path = claims.assigned_path ?? frame.assignedPath;
             claims.accepted_capabilities =
@@ -53594,6 +53636,33 @@
             }
             return false;
         }
+        async validateTokenSubjectNodeIdentity(systemId, claims) {
+            const sub = claims.sub;
+            if (typeof sub !== 'string' || sub.trim().length === 0) {
+                logger$3.warning('oauth2_attach_missing_subject_claim', {
+                    system_id: systemId,
+                });
+                return false;
+            }
+            const expectedPrefix = await generateIdAsync({
+                mode: 'fingerprint',
+                material: sub,
+                length: 8,
+            });
+            if (!systemId.startsWith(`${expectedPrefix}-`)) {
+                logger$3.warning('oauth2_attach_node_identity_mismatch', {
+                    system_id: systemId,
+                    expected_prefix: expectedPrefix,
+                    subject: sub,
+                });
+                return false;
+            }
+            logger$3.debug('oauth2_attach_node_identity_verified', {
+                system_id: systemId,
+                expected_prefix: expectedPrefix,
+            });
+            return true;
+        }
     }
 
     var oauth2Authorizer = /*#__PURE__*/Object.freeze({
@@ -53750,6 +53819,51 @@
             }
             return DEFAULT_EXPIRY_SECONDS;
         }
+        async getIdentity() {
+            const token = await this.getToken();
+            const tokenValue = token.value;
+            const parts = tokenValue.split('.');
+            if (parts.length !== 3) {
+                return undefined;
+            }
+            try {
+                const payloadSegment = parts[1];
+                // Fix padding for base64url
+                const padding = '='.repeat((4 - (payloadSegment.length % 4)) % 4);
+                const base64 = (payloadSegment + padding)
+                    .replace(/-/g, '+')
+                    .replace(/_/g, '/');
+                let jsonString;
+                if (typeof Buffer !== 'undefined') {
+                    jsonString = Buffer.from(base64, 'base64').toString('utf-8');
+                }
+                else if (typeof atob === 'function') {
+                    jsonString = atob(base64);
+                    try {
+                        jsonString = decodeURIComponent(jsonString
+                            .split('')
+                            .map(function (c) {
+                            return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2);
+                        })
+                            .join(''));
+                    }
+                    catch {
+                        // ignore
+                    }
+                }
+                else {
+                    return undefined;
+                }
+                const payload = JSON.parse(jsonString);
+                if (payload && typeof payload.sub === 'string') {
+                    return { subject: payload.sub, claims: payload };
+                }
+            }
+            catch {
+                // ignore decoding errors
+            }
+            return undefined;
+        }
     }
 
     var oauth2ClientCredentialsTokenProvider = /*#__PURE__*/Object.freeze({
@@ -55223,12 +55337,12 @@
     });
 
     // This file is auto-generated during build - do not edit manually
-    // Generated from package.json version: 0.3.13
+    // Generated from package.json version: 0.3.14
     /**
      * The package version, injected at build time.
      * @internal
      */
-    const VERSION$1 = '0.3.13';
+    const VERSION$1 = '0.3.14';
 
     let initialized = false;
     const agentSdkPlugin = {