@naylence/runtime 0.4.0 → 0.4.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (25) hide show
  1. package/dist/browser/index.cjs +516 -407
  2. package/dist/browser/index.mjs +501 -408
  3. package/dist/cjs/naylence/fame/factory-manifest.js +2 -0
  4. package/dist/cjs/naylence/fame/node/default-node-identity-policy.js +9 -41
  5. package/dist/cjs/naylence/fame/security/auth/authorization-profile-factory.js +165 -0
  6. package/dist/cjs/naylence/fame/security/index.js +19 -1
  7. package/dist/cjs/naylence/fame/security/node-security-profile-factory.js +14 -74
  8. package/dist/cjs/version.js +2 -2
  9. package/dist/esm/naylence/fame/factory-manifest.js +2 -0
  10. package/dist/esm/naylence/fame/node/default-node-identity-policy.js +9 -41
  11. package/dist/esm/naylence/fame/security/auth/authorization-profile-factory.js +161 -0
  12. package/dist/esm/naylence/fame/security/index.js +2 -1
  13. package/dist/esm/naylence/fame/security/node-security-profile-factory.js +13 -73
  14. package/dist/esm/version.js +2 -2
  15. package/dist/node/index.cjs +516 -407
  16. package/dist/node/index.mjs +501 -408
  17. package/dist/node/node.cjs +508 -399
  18. package/dist/node/node.mjs +493 -400
  19. package/dist/types/naylence/fame/factory-manifest.d.ts +1 -1
  20. package/dist/types/naylence/fame/node/default-node-identity-policy.d.ts +6 -0
  21. package/dist/types/naylence/fame/security/auth/authorization-profile-factory.d.ts +29 -0
  22. package/dist/types/naylence/fame/security/index.d.ts +3 -1
  23. package/dist/types/naylence/fame/security/node-security-profile-factory.d.ts +1 -0
  24. package/dist/types/version.d.ts +1 -1
  25. package/package.json +1 -1
package/dist/cjs/naylence/fame/factory-manifest.js CHANGED
@@ -63,6 +63,7 @@ exports.MODULES = [
63
63
  "./node/node-identity-policy-profile-factory.js",
64
64
  "./node/token-subject-node-identity-policy-factory.js",
65
65
  "./placement/static-node-placement-strategy-factory.js",
66
+ "./security/auth/authorization-profile-factory.js",
66
67
  "./security/auth/bearer-token-header-auth-injection-strategy-factory.js",
67
68
  "./security/auth/default-authorizer-factory.js",
68
69
  "./security/auth/default-policy-authorizer-factory.js",
@@ -145,6 +146,7 @@ exports.MODULE_LOADERS = {
145
146
  "./node/node-identity-policy-profile-factory.js": () => Promise.resolve().then(() => __importStar(require("./node/node-identity-policy-profile-factory.js"))),
146
147
  "./node/token-subject-node-identity-policy-factory.js": () => Promise.resolve().then(() => __importStar(require("./node/token-subject-node-identity-policy-factory.js"))),
147
148
  "./placement/static-node-placement-strategy-factory.js": () => Promise.resolve().then(() => __importStar(require("./placement/static-node-placement-strategy-factory.js"))),
149
+ "./security/auth/authorization-profile-factory.js": () => Promise.resolve().then(() => __importStar(require("./security/auth/authorization-profile-factory.js"))),
148
150
  "./security/auth/bearer-token-header-auth-injection-strategy-factory.js": () => Promise.resolve().then(() => __importStar(require("./security/auth/bearer-token-header-auth-injection-strategy-factory.js"))),
149
151
  "./security/auth/default-authorizer-factory.js": () => Promise.resolve().then(() => __importStar(require("./security/auth/default-authorizer-factory.js"))),
150
152
  "./security/auth/default-policy-authorizer-factory.js": () => Promise.resolve().then(() => __importStar(require(/* webpackIgnore: true */ /* @vite-ignore */ "./security/auth/default-policy-authorizer-factory.js"))),
package/dist/cjs/naylence/fame/node/default-node-identity-policy.js CHANGED
@@ -2,10 +2,12 @@
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
3
  exports.DefaultNodeIdentityPolicy = void 0;
4
4
  const core_1 = require("@naylence/core");
5
- const token_provider_factory_js_1 = require("../security/auth/token-provider-factory.js");
6
- const token_provider_js_1 = require("../security/auth/token-provider.js");
7
- const logging_js_1 = require("../util/logging.js");
8
- const logger = (0, logging_js_1.getLogger)('naylence.fame.node.default_node_identity_policy');
5
+ /**
6
+ * Default node identity policy that preserves the current node ID.
7
+ *
8
+ * This policy does NOT derive identity from tokens or grants.
9
+ * For token-subject-based identity, use TokenSubjectNodeIdentityPolicy.
10
+ */
9
11
  class DefaultNodeIdentityPolicy {
10
12
  async resolveInitialNodeId(context) {
11
13
  if (context.configuredId) {
@@ -17,44 +19,10 @@ class DefaultNodeIdentityPolicy {
17
19
  return await (0, core_1.generateIdAsync)({ mode: 'fingerprint' });
18
20
  }
19
21
  async resolveAdmissionNodeId(context) {
20
- // Try to extract identity from grants first
21
- if (context.grants && context.grants.length > 0) {
22
- for (const grant of context.grants) {
23
- try {
24
- const auth = grant.auth;
25
- if (!auth) {
26
- continue;
27
- }
28
- const tokenProviderConfig = (auth.tokenProvider ??
29
- auth.token_provider);
30
- if (!tokenProviderConfig ||
31
- typeof tokenProviderConfig.type !== 'string') {
32
- continue;
33
- }
34
- const provider = await token_provider_factory_js_1.TokenProviderFactory.createTokenProvider(tokenProviderConfig);
35
- if ((0, token_provider_js_1.isIdentityExposingTokenProvider)(provider)) {
36
- const identity = await provider.getIdentity();
37
- if (identity && identity.subject) {
38
- logger.debug('identity_extracted_from_grant', {
39
- identity_id: identity.subject,
40
- grant_type: grant.type,
41
- });
42
- return identity.subject;
43
- }
44
- }
45
- }
46
- catch (error) {
47
- logger.warning('identity_extraction_failed', {
48
- error: error instanceof Error ? error.message : String(error),
49
- grant_type: grant.type,
50
- });
51
- }
52
- }
22
+ if (context.currentNodeId) {
23
+ return context.currentNodeId;
53
24
  }
54
- if (!context.currentNodeId) {
55
- return await (0, core_1.generateIdAsync)({ mode: 'fingerprint' });
56
- }
57
- return context.currentNodeId;
25
+ return await (0, core_1.generateIdAsync)({ mode: 'fingerprint' });
58
26
  }
59
27
  }
60
28
  exports.DefaultNodeIdentityPolicy = DefaultNodeIdentityPolicy;
package/dist/cjs/naylence/fame/security/auth/authorization-profile-factory.js ADDED
@@ -0,0 +1,165 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.AuthorizationProfileFactory = exports.FACTORY_META = exports.ENV_VAR_HMAC_SECRET = exports.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE = exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER = exports.ENV_VAR_TRUSTED_CLIENT_SCOPE = exports.ENV_VAR_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY = exports.ENV_VAR_JWKS_URL = exports.ENV_VAR_JWT_AUDIENCE = exports.ENV_VAR_JWT_ALGORITHM = exports.ENV_VAR_JWT_TRUSTED_ISSUER = exports.PROFILE_NAME_NOOP = exports.PROFILE_NAME_OAUTH2_CALLBACK = exports.PROFILE_NAME_OAUTH2_GATED = exports.PROFILE_NAME_OAUTH2 = exports.PROFILE_NAME_DEFAULT = void 0;
4
+ const factory_1 = require("@naylence/factory");
5
+ const logging_js_1 = require("../../util/logging.js");
6
+ const authorizer_factory_js_1 = require("./authorizer-factory.js");
7
+ const logger = (0, logging_js_1.getLogger)('naylence.fame.security.auth.authorization_profile_factory');
8
+ exports.PROFILE_NAME_DEFAULT = 'jwt';
9
+ exports.PROFILE_NAME_OAUTH2 = 'oauth2';
10
+ exports.PROFILE_NAME_OAUTH2_GATED = 'oauth2-gated';
11
+ exports.PROFILE_NAME_OAUTH2_CALLBACK = 'oauth2-callback';
12
+ exports.PROFILE_NAME_NOOP = 'noop';
13
+ exports.ENV_VAR_JWT_TRUSTED_ISSUER = 'FAME_JWT_TRUSTED_ISSUER';
14
+ exports.ENV_VAR_JWT_ALGORITHM = 'FAME_JWT_ALGORITHM';
15
+ exports.ENV_VAR_JWT_AUDIENCE = 'FAME_JWT_AUDIENCE';
16
+ exports.ENV_VAR_JWKS_URL = 'FAME_JWKS_URL';
17
+ exports.ENV_VAR_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY = 'FAME_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY';
18
+ exports.ENV_VAR_TRUSTED_CLIENT_SCOPE = 'FAME_TRUSTED_CLIENT_SCOPE';
19
+ exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER = 'FAME_JWT_REVERSE_AUTH_TRUSTED_ISSUER';
20
+ exports.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE = 'FAME_JWT_REVERSE_AUTH_AUDIENCE';
21
+ exports.ENV_VAR_HMAC_SECRET = 'FAME_HMAC_SECRET';
22
+ const DEFAULT_REVERSE_AUTH_ISSUER = 'reverse-auth.naylence.ai';
23
+ const DEFAULT_REVERSE_AUTH_AUDIENCE = 'dev.naylence.ai';
24
+ const DEFAULT_PROFILE = {
25
+ type: 'DefaultAuthorizer',
26
+ verifier: {
27
+ type: 'JWKSJWTTokenVerifier',
28
+ jwks_url: factory_1.Expressions.env(exports.ENV_VAR_JWKS_URL),
29
+ issuer: factory_1.Expressions.env(exports.ENV_VAR_JWT_TRUSTED_ISSUER),
30
+ },
31
+ };
32
+ const OAUTH2_PROFILE = {
33
+ type: 'OAuth2Authorizer',
34
+ issuer: factory_1.Expressions.env(exports.ENV_VAR_JWT_TRUSTED_ISSUER),
35
+ required_scopes: ['node.connect'],
36
+ require_scope: true,
37
+ default_ttl_sec: 3600,
38
+ max_ttl_sec: 86400,
39
+ algorithm: factory_1.Expressions.env(exports.ENV_VAR_JWT_ALGORITHM, 'RS256'),
40
+ audience: factory_1.Expressions.env(exports.ENV_VAR_JWT_AUDIENCE),
41
+ };
42
+ const OAUTH2_GATED_PROFILE = {
43
+ ...OAUTH2_PROFILE,
44
+ enforce_token_subject_node_identity: factory_1.Expressions.env(exports.ENV_VAR_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY, 'false'),
45
+ trusted_client_scope: factory_1.Expressions.env(exports.ENV_VAR_TRUSTED_CLIENT_SCOPE, 'node.trusted'),
46
+ };
47
+ const OAUTH2_CALLBACK_PROFILE = {
48
+ type: 'OAuth2Authorizer',
49
+ issuer: factory_1.Expressions.env(exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER, DEFAULT_REVERSE_AUTH_ISSUER),
50
+ audience: factory_1.Expressions.env(exports.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE),
51
+ require_scope: true,
52
+ default_ttl_sec: 3600,
53
+ max_ttl_sec: 86400,
54
+ reverse_auth_ttl_sec: 86400,
55
+ token_verifier_config: {
56
+ type: 'JWTTokenVerifier',
57
+ algorithm: 'HS256',
58
+ hmac_secret: factory_1.Expressions.env(exports.ENV_VAR_HMAC_SECRET),
59
+ issuer: factory_1.Expressions.env(exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER, DEFAULT_REVERSE_AUTH_ISSUER),
60
+ ttl_sec: 86400,
61
+ },
62
+ token_issuer_config: {
63
+ type: 'JWTTokenIssuer',
64
+ algorithm: 'HS256',
65
+ hmac_secret: factory_1.Expressions.env(exports.ENV_VAR_HMAC_SECRET),
66
+ kid: 'hmac-reverse-auth-key',
67
+ issuer: factory_1.Expressions.env(exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER, DEFAULT_REVERSE_AUTH_ISSUER),
68
+ ttl_sec: 86400,
69
+ audience: factory_1.Expressions.env(exports.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE, DEFAULT_REVERSE_AUTH_AUDIENCE),
70
+ },
71
+ };
72
+ const NOOP_PROFILE = {
73
+ type: 'NoopAuthorizer',
74
+ };
75
+ const PROFILE_MAP = {
76
+ [exports.PROFILE_NAME_DEFAULT]: DEFAULT_PROFILE,
77
+ [exports.PROFILE_NAME_OAUTH2]: OAUTH2_PROFILE,
78
+ [exports.PROFILE_NAME_OAUTH2_GATED]: OAUTH2_GATED_PROFILE,
79
+ [exports.PROFILE_NAME_OAUTH2_CALLBACK]: OAUTH2_CALLBACK_PROFILE,
80
+ [exports.PROFILE_NAME_NOOP]: NOOP_PROFILE,
81
+ };
82
+ const PROFILE_ALIASES = {
83
+ jwt: exports.PROFILE_NAME_DEFAULT,
84
+ jwks: exports.PROFILE_NAME_DEFAULT,
85
+ default: exports.PROFILE_NAME_DEFAULT,
86
+ oauth2: exports.PROFILE_NAME_OAUTH2,
87
+ oidc: exports.PROFILE_NAME_OAUTH2,
88
+ 'oauth2-gated': exports.PROFILE_NAME_OAUTH2_GATED,
89
+ oauth2_gated: exports.PROFILE_NAME_OAUTH2_GATED,
90
+ 'oauth2-callback': exports.PROFILE_NAME_OAUTH2_CALLBACK,
91
+ oauth2_callback: exports.PROFILE_NAME_OAUTH2_CALLBACK,
92
+ 'reverse-auth': exports.PROFILE_NAME_OAUTH2_CALLBACK,
93
+ noop: exports.PROFILE_NAME_NOOP,
94
+ 'no-op': exports.PROFILE_NAME_NOOP,
95
+ no_op: exports.PROFILE_NAME_NOOP,
96
+ };
97
+ exports.FACTORY_META = {
98
+ base: authorizer_factory_js_1.AUTHORIZER_FACTORY_BASE_TYPE,
99
+ key: 'AuthorizationProfile',
100
+ };
101
+ class AuthorizationProfileFactory extends authorizer_factory_js_1.AuthorizerFactory {
102
+ constructor() {
103
+ super(...arguments);
104
+ this.type = 'AuthorizationProfile';
105
+ }
106
+ async create(config, ...factoryArgs) {
107
+ const normalized = normalizeConfig(config);
108
+ const profileConfig = resolveProfileConfig(normalized.profile);
109
+ logger.debug('enabling_authorization_profile', {
110
+ profile: normalized.profile,
111
+ });
112
+ const authorizer = await authorizer_factory_js_1.AuthorizerFactory.createAuthorizer(profileConfig, { factoryArgs });
113
+ if (!authorizer) {
114
+ throw new Error(`Failed to create authorizer for profile: ${normalized.profile}`);
115
+ }
116
+ return authorizer;
117
+ }
118
+ }
119
+ exports.AuthorizationProfileFactory = AuthorizationProfileFactory;
120
+ function normalizeConfig(config) {
121
+ if (!config) {
122
+ return { profile: exports.PROFILE_NAME_OAUTH2 };
123
+ }
124
+ const candidate = config;
125
+ const profileValue = resolveProfileName(candidate);
126
+ const canonicalProfile = canonicalizeProfileName(profileValue);
127
+ candidate.profile = canonicalProfile;
128
+ return { profile: canonicalProfile };
129
+ }
130
+ function resolveProfileName(candidate) {
131
+ const direct = coerceProfileString(candidate.profile);
132
+ if (direct) {
133
+ return direct;
134
+ }
135
+ const legacyKeys = ['profile_name', 'profileName'];
136
+ for (const legacyKey of legacyKeys) {
137
+ const legacyValue = coerceProfileString(candidate[legacyKey]);
138
+ if (legacyValue) {
139
+ return legacyValue;
140
+ }
141
+ }
142
+ return exports.PROFILE_NAME_OAUTH2;
143
+ }
144
+ function coerceProfileString(value) {
145
+ if (typeof value !== 'string') {
146
+ return null;
147
+ }
148
+ const trimmed = value.trim();
149
+ return trimmed.length > 0 ? trimmed : null;
150
+ }
151
+ function canonicalizeProfileName(value) {
152
+ const normalized = value.replace(/[\s_]+/g, '-').toLowerCase();
153
+ return PROFILE_ALIASES[normalized] ?? normalized;
154
+ }
155
+ function resolveProfileConfig(profileName) {
156
+ const profile = PROFILE_MAP[profileName];
157
+ if (!profile) {
158
+ throw new Error(`Unknown authorization profile: ${profileName}`);
159
+ }
160
+ return deepClone(profile);
161
+ }
162
+ function deepClone(value) {
163
+ return JSON.parse(JSON.stringify(value));
164
+ }
165
+ exports.default = AuthorizationProfileFactory;
package/dist/cjs/naylence/fame/security/index.js CHANGED
@@ -1,6 +1,7 @@
1
1
  "use strict";
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
- exports.PROFILE_NAME_OPEN = exports.PROFILE_NAME_GATED_CALLBACK = exports.PROFILE_NAME_GATED = exports.PROFILE_NAME_OVERLAY_CALLBACK = exports.PROFILE_NAME_OVERLAY = exports.PROFILE_NAME_STRICT_OVERLAY = exports.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE = exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER = exports.ENV_VAR_HMAC_SECRET = exports.ENV_VAR_DEFAULT_ENCRYPTION_LEVEL = exports.ENV_VAR_JWKS_URL = exports.ENV_VAR_JWT_AUDIENCE = exports.ENV_VAR_JWT_ALGORITHM = exports.ENV_VAR_JWT_TRUSTED_ISSUER = exports.CREDENTIAL_PROVIDER_FACTORY_BASE_TYPE = exports.EdDSAEnvelopeSigner = exports.encodeUtf8 = exports.immutableHeaders = exports.frameDigest = exports.decodeBase64Url = exports.canonicalJson = exports.SigningConfigClass = exports.SECURITY_MANAGER_FACTORY_BASE_TYPE = exports.SECURITY_POLICY_FACTORY_BASE_TYPE = exports.KEY_STORE_FACTORY_BASE_TYPE = exports.ATTACHMENT_KEY_VALIDATOR_FACTORY_BASE_TYPE = exports.KEY_MANAGER_FACTORY_BASE_TYPE = exports.SecureChannelManagerFactory = exports.SECURE_CHANNEL_MANAGER_FACTORY_BASE_TYPE = exports.ENCRYPTION_MANAGER_FACTORY_BASE_TYPE = exports.NoopTrustStoreProvider = exports.TrustStoreProviderFactory = exports.TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE = exports.CertificateManagerFactory = exports.CERTIFICATE_MANAGER_FACTORY_BASE_TYPE = exports.TokenProviderFactory = exports.TOKEN_PROVIDER_FACTORY_BASE_TYPE = exports.TokenVerifierFactory = exports.TOKEN_VERIFIER_FACTORY_BASE_TYPE = exports.TokenIssuerFactory = exports.TOKEN_ISSUER_FACTORY_BASE_TYPE = exports.AuthInjectionStrategyFactory = exports.AUTH_INJECTION_STRATEGY_FACTORY_BASE_TYPE = exports.AuthorizerFactory = exports.AUTHORIZER_FACTORY_BASE_TYPE = void 0;
3
+ exports.ENV_VAR_JWKS_URL = exports.ENV_VAR_JWT_AUDIENCE = exports.ENV_VAR_JWT_ALGORITHM = exports.ENV_VAR_JWT_TRUSTED_ISSUER = exports.CREDENTIAL_PROVIDER_FACTORY_BASE_TYPE = exports.EdDSAEnvelopeSigner = exports.encodeUtf8 = exports.immutableHeaders = exports.frameDigest = exports.decodeBase64Url = exports.canonicalJson = exports.SigningConfigClass = exports.SECURITY_MANAGER_FACTORY_BASE_TYPE = exports.SECURITY_POLICY_FACTORY_BASE_TYPE = exports.KEY_STORE_FACTORY_BASE_TYPE = exports.ATTACHMENT_KEY_VALIDATOR_FACTORY_BASE_TYPE = exports.KEY_MANAGER_FACTORY_BASE_TYPE = exports.SecureChannelManagerFactory = exports.SECURE_CHANNEL_MANAGER_FACTORY_BASE_TYPE = exports.ENCRYPTION_MANAGER_FACTORY_BASE_TYPE = exports.NoopTrustStoreProvider = exports.TrustStoreProviderFactory = exports.TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE = exports.CertificateManagerFactory = exports.CERTIFICATE_MANAGER_FACTORY_BASE_TYPE = exports.TokenProviderFactory = exports.TOKEN_PROVIDER_FACTORY_BASE_TYPE = exports.TokenVerifierFactory = exports.TOKEN_VERIFIER_FACTORY_BASE_TYPE = exports.TokenIssuerFactory = exports.TOKEN_ISSUER_FACTORY_BASE_TYPE = exports.AuthInjectionStrategyFactory = exports.AUTH_INJECTION_STRATEGY_FACTORY_BASE_TYPE = exports.AUTH_PROFILE_ENV_VAR_HMAC_SECRET = exports.AUTH_PROFILE_ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE = exports.AUTH_PROFILE_ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER = exports.AUTH_PROFILE_ENV_VAR_TRUSTED_CLIENT_SCOPE = exports.AUTH_PROFILE_ENV_VAR_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY = exports.AUTH_PROFILE_ENV_VAR_JWKS_URL = exports.AUTH_PROFILE_ENV_VAR_JWT_AUDIENCE = exports.AUTH_PROFILE_ENV_VAR_JWT_ALGORITHM = exports.AUTH_PROFILE_ENV_VAR_JWT_TRUSTED_ISSUER = exports.AUTH_PROFILE_NAME_NOOP = exports.AUTH_PROFILE_NAME_OAUTH2_CALLBACK = exports.AUTH_PROFILE_NAME_OAUTH2_GATED = exports.AUTH_PROFILE_NAME_OAUTH2 = exports.AUTH_PROFILE_NAME_DEFAULT = exports.AuthorizationProfileFactory = exports.AuthorizerFactory = exports.AUTHORIZER_FACTORY_BASE_TYPE = void 0;
4
+ exports.PROFILE_NAME_OPEN = exports.PROFILE_NAME_GATED_CALLBACK = exports.PROFILE_NAME_GATED = exports.PROFILE_NAME_OVERLAY_CALLBACK = exports.PROFILE_NAME_OVERLAY = exports.PROFILE_NAME_STRICT_OVERLAY = exports.ENV_VAR_AUTHORIZATION_PROFILE = exports.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE = exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER = exports.ENV_VAR_HMAC_SECRET = exports.ENV_VAR_DEFAULT_ENCRYPTION_LEVEL = void 0;
4
5
  const tslib_1 = require("tslib");
5
6
  tslib_1.__exportStar(require("./auth/authorizer.js"), exports);
6
7
  tslib_1.__exportStar(require("./auth/auth-identity.js"), exports);
@@ -8,6 +9,22 @@ tslib_1.__exportStar(require("./auth/policy-authorizer.js"), exports);
8
9
  var authorizer_factory_js_1 = require("./auth/authorizer-factory.js");
9
10
  Object.defineProperty(exports, "AUTHORIZER_FACTORY_BASE_TYPE", { enumerable: true, get: function () { return authorizer_factory_js_1.AUTHORIZER_FACTORY_BASE_TYPE; } });
10
11
  Object.defineProperty(exports, "AuthorizerFactory", { enumerable: true, get: function () { return authorizer_factory_js_1.AuthorizerFactory; } });
12
+ var authorization_profile_factory_js_1 = require("./auth/authorization-profile-factory.js");
13
+ Object.defineProperty(exports, "AuthorizationProfileFactory", { enumerable: true, get: function () { return authorization_profile_factory_js_1.AuthorizationProfileFactory; } });
14
+ Object.defineProperty(exports, "AUTH_PROFILE_NAME_DEFAULT", { enumerable: true, get: function () { return authorization_profile_factory_js_1.PROFILE_NAME_DEFAULT; } });
15
+ Object.defineProperty(exports, "AUTH_PROFILE_NAME_OAUTH2", { enumerable: true, get: function () { return authorization_profile_factory_js_1.PROFILE_NAME_OAUTH2; } });
16
+ Object.defineProperty(exports, "AUTH_PROFILE_NAME_OAUTH2_GATED", { enumerable: true, get: function () { return authorization_profile_factory_js_1.PROFILE_NAME_OAUTH2_GATED; } });
17
+ Object.defineProperty(exports, "AUTH_PROFILE_NAME_OAUTH2_CALLBACK", { enumerable: true, get: function () { return authorization_profile_factory_js_1.PROFILE_NAME_OAUTH2_CALLBACK; } });
18
+ Object.defineProperty(exports, "AUTH_PROFILE_NAME_NOOP", { enumerable: true, get: function () { return authorization_profile_factory_js_1.PROFILE_NAME_NOOP; } });
19
+ Object.defineProperty(exports, "AUTH_PROFILE_ENV_VAR_JWT_TRUSTED_ISSUER", { enumerable: true, get: function () { return authorization_profile_factory_js_1.ENV_VAR_JWT_TRUSTED_ISSUER; } });
20
+ Object.defineProperty(exports, "AUTH_PROFILE_ENV_VAR_JWT_ALGORITHM", { enumerable: true, get: function () { return authorization_profile_factory_js_1.ENV_VAR_JWT_ALGORITHM; } });
21
+ Object.defineProperty(exports, "AUTH_PROFILE_ENV_VAR_JWT_AUDIENCE", { enumerable: true, get: function () { return authorization_profile_factory_js_1.ENV_VAR_JWT_AUDIENCE; } });
22
+ Object.defineProperty(exports, "AUTH_PROFILE_ENV_VAR_JWKS_URL", { enumerable: true, get: function () { return authorization_profile_factory_js_1.ENV_VAR_JWKS_URL; } });
23
+ Object.defineProperty(exports, "AUTH_PROFILE_ENV_VAR_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY", { enumerable: true, get: function () { return authorization_profile_factory_js_1.ENV_VAR_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY; } });
24
+ Object.defineProperty(exports, "AUTH_PROFILE_ENV_VAR_TRUSTED_CLIENT_SCOPE", { enumerable: true, get: function () { return authorization_profile_factory_js_1.ENV_VAR_TRUSTED_CLIENT_SCOPE; } });
25
+ Object.defineProperty(exports, "AUTH_PROFILE_ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER", { enumerable: true, get: function () { return authorization_profile_factory_js_1.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER; } });
26
+ Object.defineProperty(exports, "AUTH_PROFILE_ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE", { enumerable: true, get: function () { return authorization_profile_factory_js_1.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE; } });
27
+ Object.defineProperty(exports, "AUTH_PROFILE_ENV_VAR_HMAC_SECRET", { enumerable: true, get: function () { return authorization_profile_factory_js_1.ENV_VAR_HMAC_SECRET; } });
11
28
  tslib_1.__exportStar(require("./auth/auth-injection-strategy.js"), exports);
12
29
  // Authorization policy exports
13
30
  tslib_1.__exportStar(require("./auth/policy/index.js"), exports);
@@ -112,6 +129,7 @@ Object.defineProperty(exports, "ENV_VAR_DEFAULT_ENCRYPTION_LEVEL", { enumerable:
112
129
  Object.defineProperty(exports, "ENV_VAR_HMAC_SECRET", { enumerable: true, get: function () { return node_security_profile_factory_js_1.ENV_VAR_HMAC_SECRET; } });
113
130
  Object.defineProperty(exports, "ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER", { enumerable: true, get: function () { return node_security_profile_factory_js_1.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER; } });
114
131
  Object.defineProperty(exports, "ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE", { enumerable: true, get: function () { return node_security_profile_factory_js_1.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE; } });
132
+ Object.defineProperty(exports, "ENV_VAR_AUTHORIZATION_PROFILE", { enumerable: true, get: function () { return node_security_profile_factory_js_1.ENV_VAR_AUTHORIZATION_PROFILE; } });
115
133
  Object.defineProperty(exports, "PROFILE_NAME_STRICT_OVERLAY", { enumerable: true, get: function () { return node_security_profile_factory_js_1.PROFILE_NAME_STRICT_OVERLAY; } });
116
134
  Object.defineProperty(exports, "PROFILE_NAME_OVERLAY", { enumerable: true, get: function () { return node_security_profile_factory_js_1.PROFILE_NAME_OVERLAY; } });
117
135
  Object.defineProperty(exports, "PROFILE_NAME_OVERLAY_CALLBACK", { enumerable: true, get: function () { return node_security_profile_factory_js_1.PROFILE_NAME_OVERLAY_CALLBACK; } });
package/dist/cjs/naylence/fame/security/node-security-profile-factory.js CHANGED
@@ -1,6 +1,6 @@
1
1
  "use strict";
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
- exports.NodeSecurityProfileFactory = exports.FACTORY_META = exports.PROFILE_NAME_OPEN = exports.PROFILE_NAME_GATED_CALLBACK = exports.PROFILE_NAME_GATED = exports.PROFILE_NAME_OVERLAY_CALLBACK = exports.PROFILE_NAME_OVERLAY = exports.PROFILE_NAME_STRICT_OVERLAY = exports.ENV_VAR_TRUSTED_CLIENT_SCOPE = exports.ENV_VAR_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY = exports.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE = exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER = exports.ENV_VAR_HMAC_SECRET = exports.ENV_VAR_DEFAULT_ENCRYPTION_LEVEL = exports.ENV_VAR_JWKS_URL = exports.ENV_VAR_JWT_AUDIENCE = exports.ENV_VAR_JWT_ALGORITHM = exports.ENV_VAR_JWT_TRUSTED_ISSUER = void 0;
3
+ exports.NodeSecurityProfileFactory = exports.FACTORY_META = exports.PROFILE_NAME_OPEN = exports.PROFILE_NAME_GATED_CALLBACK = exports.PROFILE_NAME_GATED = exports.PROFILE_NAME_OVERLAY_CALLBACK = exports.PROFILE_NAME_OVERLAY = exports.PROFILE_NAME_STRICT_OVERLAY = exports.ENV_VAR_AUTHORIZATION_PROFILE = exports.ENV_VAR_TRUSTED_CLIENT_SCOPE = exports.ENV_VAR_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY = exports.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE = exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER = exports.ENV_VAR_HMAC_SECRET = exports.ENV_VAR_DEFAULT_ENCRYPTION_LEVEL = exports.ENV_VAR_JWKS_URL = exports.ENV_VAR_JWT_AUDIENCE = exports.ENV_VAR_JWT_ALGORITHM = exports.ENV_VAR_JWT_TRUSTED_ISSUER = void 0;
4
4
  const factory_1 = require("@naylence/factory");
5
5
  const security_manager_factory_js_1 = require("./security-manager-factory.js");
6
6
  const logging_js_1 = require("../util/logging.js");
@@ -15,14 +15,13 @@ exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER = 'FAME_JWT_REVERSE_AUTH_TRUSTED
15
15
  exports.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE = 'FAME_JWT_REVERSE_AUTH_AUDIENCE';
16
16
  exports.ENV_VAR_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY = 'FAME_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY';
17
17
  exports.ENV_VAR_TRUSTED_CLIENT_SCOPE = 'FAME_TRUSTED_CLIENT_SCOPE';
18
+ exports.ENV_VAR_AUTHORIZATION_PROFILE = 'FAME_AUTHORIZATION_PROFILE';
18
19
  exports.PROFILE_NAME_STRICT_OVERLAY = 'strict-overlay';
19
20
  exports.PROFILE_NAME_OVERLAY = 'overlay';
20
21
  exports.PROFILE_NAME_OVERLAY_CALLBACK = 'overlay-callback';
21
22
  exports.PROFILE_NAME_GATED = 'gated';
22
23
  exports.PROFILE_NAME_GATED_CALLBACK = 'gated-callback';
23
24
  exports.PROFILE_NAME_OPEN = 'open';
24
- const DEFAULT_REVERSE_AUTH_ISSUER = 'reverse-auth.naylence.ai';
25
- const DEFAULT_REVERSE_AUTH_AUDIENCE = 'dev.naylence.ai';
26
25
  const STRICT_OVERLAY_PROFILE = {
27
26
  type: 'DefaultSecurityManager',
28
27
  security_policy: {
@@ -68,12 +67,8 @@ const STRICT_OVERLAY_PROFILE = {
68
67
  },
69
68
  },
70
69
  authorizer: {
71
- type: 'DefaultAuthorizer',
72
- verifier: {
73
- type: 'JWKSJWTTokenVerifier',
74
- jwks_url: factory_1.Expressions.env(exports.ENV_VAR_JWKS_URL),
75
- issuer: factory_1.Expressions.env(exports.ENV_VAR_JWT_TRUSTED_ISSUER),
76
- },
70
+ type: 'AuthorizationProfile',
71
+ profile: factory_1.Expressions.env(exports.ENV_VAR_AUTHORIZATION_PROFILE, 'jwt'),
77
72
  },
78
73
  };
79
74
  const OVERLAY_PROFILE = {
@@ -120,14 +115,8 @@ const OVERLAY_PROFILE = {
120
115
  },
121
116
  },
122
117
  authorizer: {
123
- type: 'OAuth2Authorizer',
124
- issuer: factory_1.Expressions.env(exports.ENV_VAR_JWT_TRUSTED_ISSUER),
125
- required_scopes: ['node.connect'],
126
- require_scope: true,
127
- default_ttl_sec: 3600,
128
- max_ttl_sec: 86400,
129
- algorithm: factory_1.Expressions.env(exports.ENV_VAR_JWT_ALGORITHM, 'RS256'),
130
- audience: factory_1.Expressions.env(exports.ENV_VAR_JWT_AUDIENCE),
118
+ type: 'AuthorizationProfile',
119
+ profile: factory_1.Expressions.env(exports.ENV_VAR_AUTHORIZATION_PROFILE, 'oauth2'),
131
120
  },
132
121
  };
133
122
  const OVERLAY_CALLBACK_PROFILE = {
@@ -174,29 +163,8 @@ const OVERLAY_CALLBACK_PROFILE = {
174
163
  },
175
164
  },
176
165
  authorizer: {
177
- type: 'OAuth2Authorizer',
178
- issuer: factory_1.Expressions.env(exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER, DEFAULT_REVERSE_AUTH_ISSUER),
179
- audience: factory_1.Expressions.env(exports.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE),
180
- require_scope: true,
181
- default_ttl_sec: 3600,
182
- max_ttl_sec: 86400,
183
- reverse_auth_ttl_sec: 86400,
184
- token_verifier_config: {
185
- type: 'JWTTokenVerifier',
186
- algorithm: 'HS256',
187
- hmac_secret: factory_1.Expressions.env(exports.ENV_VAR_HMAC_SECRET),
188
- issuer: factory_1.Expressions.env(exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER, DEFAULT_REVERSE_AUTH_ISSUER),
189
- ttl_sec: 86400,
190
- },
191
- token_issuer_config: {
192
- type: 'JWTTokenIssuer',
193
- algorithm: 'HS256',
194
- hmac_secret: factory_1.Expressions.env(exports.ENV_VAR_HMAC_SECRET),
195
- kid: 'hmac-reverse-auth-key',
196
- issuer: factory_1.Expressions.env(exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER, DEFAULT_REVERSE_AUTH_ISSUER),
197
- ttl_sec: 86400,
198
- audience: factory_1.Expressions.env(exports.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE, DEFAULT_REVERSE_AUTH_AUDIENCE),
199
- },
166
+ type: 'AuthorizationProfile',
167
+ profile: factory_1.Expressions.env(exports.ENV_VAR_AUTHORIZATION_PROFILE, 'oauth2-callback'),
200
168
  },
201
169
  };
202
170
  const GATED_PROFILE = {
@@ -242,16 +210,8 @@ const GATED_PROFILE = {
242
210
  },
243
211
  },
244
212
  authorizer: {
245
- type: 'OAuth2Authorizer',
246
- issuer: factory_1.Expressions.env(exports.ENV_VAR_JWT_TRUSTED_ISSUER),
247
- required_scopes: ['node.connect'],
248
- require_scope: true,
249
- default_ttl_sec: 3600,
250
- max_ttl_sec: 86400,
251
- algorithm: factory_1.Expressions.env(exports.ENV_VAR_JWT_ALGORITHM, 'RS256'),
252
- audience: factory_1.Expressions.env(exports.ENV_VAR_JWT_AUDIENCE),
253
- enforce_token_subject_node_identity: factory_1.Expressions.env(exports.ENV_VAR_ENFORCE_TOKEN_SUBJECT_NODE_IDENTITY, 'false'),
254
- trusted_client_scope: factory_1.Expressions.env(exports.ENV_VAR_TRUSTED_CLIENT_SCOPE, 'node.trusted'),
213
+ type: 'AuthorizationProfile',
214
+ profile: factory_1.Expressions.env(exports.ENV_VAR_AUTHORIZATION_PROFILE, 'oauth2-gated'),
255
215
  },
256
216
  };
257
217
  const GATED_CALLBACK_PROFILE = {
@@ -297,29 +257,8 @@ const GATED_CALLBACK_PROFILE = {
297
257
  },
298
258
  },
299
259
  authorizer: {
300
- type: 'OAuth2Authorizer',
301
- issuer: factory_1.Expressions.env(exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER, DEFAULT_REVERSE_AUTH_ISSUER),
302
- audience: factory_1.Expressions.env(exports.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE),
303
- require_scope: true,
304
- default_ttl_sec: 3600,
305
- max_ttl_sec: 86400,
306
- reverse_auth_ttl_sec: 86400,
307
- token_verifier_config: {
308
- type: 'JWTTokenVerifier',
309
- algorithm: 'HS256',
310
- hmac_secret: factory_1.Expressions.env(exports.ENV_VAR_HMAC_SECRET),
311
- issuer: factory_1.Expressions.env(exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER, DEFAULT_REVERSE_AUTH_ISSUER),
312
- ttl_sec: 86400,
313
- },
314
- token_issuer_config: {
315
- type: 'JWTTokenIssuer',
316
- algorithm: 'HS256',
317
- hmac_secret: factory_1.Expressions.env(exports.ENV_VAR_HMAC_SECRET),
318
- kid: 'hmac-reverse-auth-key',
319
- issuer: factory_1.Expressions.env(exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER, DEFAULT_REVERSE_AUTH_ISSUER),
320
- ttl_sec: 86400,
321
- audience: factory_1.Expressions.env(exports.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE, DEFAULT_REVERSE_AUTH_AUDIENCE),
322
- },
260
+ type: 'AuthorizationProfile',
261
+ profile: factory_1.Expressions.env(exports.ENV_VAR_AUTHORIZATION_PROFILE, 'oauth2-callback'),
323
262
  },
324
263
  };
325
264
  const OPEN_PROFILE = {
@@ -328,7 +267,8 @@ const OPEN_PROFILE = {
328
267
  type: 'NoSecurityPolicy',
329
268
  },
330
269
  authorizer: {
331
- type: 'NoopAuthorizer',
270
+ type: 'AuthorizationProfile',
271
+ profile: factory_1.Expressions.env(exports.ENV_VAR_AUTHORIZATION_PROFILE, 'noop'),
332
272
  },
333
273
  };
334
274
  const PROFILE_MAP = {
package/dist/cjs/version.js CHANGED
@@ -1,10 +1,10 @@
1
1
  "use strict";
2
2
  // This file is auto-generated during build - do not edit manually
3
- // Generated from package.json version: 0.4.0
3
+ // Generated from package.json version: 0.4.2
4
4
  Object.defineProperty(exports, "__esModule", { value: true });
5
5
  exports.VERSION = void 0;
6
6
  /**
7
7
  * The package version, injected at build time.
8
8
  * @internal
9
9
  */
10
- exports.VERSION = '0.4.0';
10
+ exports.VERSION = '0.4.2';
package/dist/esm/naylence/fame/factory-manifest.js CHANGED
@@ -27,6 +27,7 @@ export const MODULES = [
27
27
  "./node/node-identity-policy-profile-factory.js",
28
28
  "./node/token-subject-node-identity-policy-factory.js",
29
29
  "./placement/static-node-placement-strategy-factory.js",
30
+ "./security/auth/authorization-profile-factory.js",
30
31
  "./security/auth/bearer-token-header-auth-injection-strategy-factory.js",
31
32
  "./security/auth/default-authorizer-factory.js",
32
33
  "./security/auth/default-policy-authorizer-factory.js",
@@ -109,6 +110,7 @@ export const MODULE_LOADERS = {
109
110
  "./node/node-identity-policy-profile-factory.js": () => import("./node/node-identity-policy-profile-factory.js"),
110
111
  "./node/token-subject-node-identity-policy-factory.js": () => import("./node/token-subject-node-identity-policy-factory.js"),
111
112
  "./placement/static-node-placement-strategy-factory.js": () => import("./placement/static-node-placement-strategy-factory.js"),
113
+ "./security/auth/authorization-profile-factory.js": () => import("./security/auth/authorization-profile-factory.js"),
112
114
  "./security/auth/bearer-token-header-auth-injection-strategy-factory.js": () => import("./security/auth/bearer-token-header-auth-injection-strategy-factory.js"),
113
115
  "./security/auth/default-authorizer-factory.js": () => import("./security/auth/default-authorizer-factory.js"),
114
116
  "./security/auth/default-policy-authorizer-factory.js": () => import(/* webpackIgnore: true */ /* @vite-ignore */ "./security/auth/default-policy-authorizer-factory.js"),
package/dist/esm/naylence/fame/node/default-node-identity-policy.js CHANGED
@@ -1,8 +1,10 @@
1
1
  import { generateIdAsync } from '@naylence/core';
2
- import { TokenProviderFactory } from '../security/auth/token-provider-factory.js';
3
- import { isIdentityExposingTokenProvider } from '../security/auth/token-provider.js';
4
- import { getLogger } from '../util/logging.js';
5
- const logger = getLogger('naylence.fame.node.default_node_identity_policy');
2
+ /**
3
+ * Default node identity policy that preserves the current node ID.
4
+ *
5
+ * This policy does NOT derive identity from tokens or grants.
6
+ * For token-subject-based identity, use TokenSubjectNodeIdentityPolicy.
7
+ */
6
8
  export class DefaultNodeIdentityPolicy {
7
9
  async resolveInitialNodeId(context) {
8
10
  if (context.configuredId) {
@@ -14,43 +16,9 @@ export class DefaultNodeIdentityPolicy {
14
16
  return await generateIdAsync({ mode: 'fingerprint' });
15
17
  }
16
18
  async resolveAdmissionNodeId(context) {
17
- // Try to extract identity from grants first
18
- if (context.grants && context.grants.length > 0) {
19
- for (const grant of context.grants) {
20
- try {
21
- const auth = grant.auth;
22
- if (!auth) {
23
- continue;
24
- }
25
- const tokenProviderConfig = (auth.tokenProvider ??
26
- auth.token_provider);
27
- if (!tokenProviderConfig ||
28
- typeof tokenProviderConfig.type !== 'string') {
29
- continue;
30
- }
31
- const provider = await TokenProviderFactory.createTokenProvider(tokenProviderConfig);
32
- if (isIdentityExposingTokenProvider(provider)) {
33
- const identity = await provider.getIdentity();
34
- if (identity && identity.subject) {
35
- logger.debug('identity_extracted_from_grant', {
36
- identity_id: identity.subject,
37
- grant_type: grant.type,
38
- });
39
- return identity.subject;
40
- }
41
- }
42
- }
43
- catch (error) {
44
- logger.warning('identity_extraction_failed', {
45
- error: error instanceof Error ? error.message : String(error),
46
- grant_type: grant.type,
47
- });
48
- }
49
- }
19
+ if (context.currentNodeId) {
20
+ return context.currentNodeId;
50
21
  }
51
- if (!context.currentNodeId) {
52
- return await generateIdAsync({ mode: 'fingerprint' });
53
- }
54
- return context.currentNodeId;
22
+ return await generateIdAsync({ mode: 'fingerprint' });
55
23
  }
56
24
  }