@nboconnect/connect 0.1.0

package/dist/runtimeTokenShadow.js

@@ -0,0 +1,168 @@
+const MAX_LIFETIME_SECONDS = 600;
+const CLOCK_SKEW_SECONDS = 30;
+const BLOCKED_ACTION_IDS = new Set([
+    'live_value_action',
+    'issue_reward',
+    'reward_issuance',
+    'credit_wallet',
+    'wallet_credit',
+    'execute_redemption',
+    'redemption_execution',
+    'payments',
+    'settlement',
+    'treasury_movement',
+    'qude_mutation',
+    'nbr_unlock',
+    'publish_claim',
+    'public_claim_publishing',
+    'nbo_unit_commit',
+    'scada_control',
+    'hcu_hcus_issuance',
+]);
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+function isFiniteInteger(value) {
+    return typeof value === 'number' && Number.isFinite(value) && Number.isInteger(value);
+}
+function maskOpaqueRef(value) {
+    if (!isNonEmptyString(value))
+        return 'masked:missing';
+    if (value.length <= 8)
+        return 'masked:opaque';
+    return `masked:${value.slice(0, 4)}...${value.slice(-4)}`;
+}
+function addMissingClaimCodes(claims, denialCodes) {
+    const requiredClaims = [
+        'iss', 'aud', 'sub', 'jti', 'tokenType', 'environment', 'organizationId',
+        'nodeId', 'persona', 'capabilityId', 'actionId', 'scope', 'registryVersion',
+        'iat', 'exp', 'authorizationRef',
+    ];
+    if (requiredClaims.some((claim) => !isNonEmptyString(claims[claim]) && !isFiniteInteger(claims[claim]))) {
+        denialCodes.push('REQUIRED_CLAIM_MISSING');
+    }
+}
+function addExactBindingCodes(claims, request, denialCodes) {
+    const bindings = [
+        ['organizationId', request.organizationId, 'ORGANIZATION_MISMATCH'],
+        ['nodeId', request.nodeId, 'NODE_MISMATCH'],
+        ['persona', request.persona, 'PERSONA_MISMATCH'],
+        ['capabilityId', request.capabilityId, 'CAPABILITY_MISMATCH'],
+        ['actionId', request.actionId, 'ACTION_MISMATCH'],
+        ['scope', request.scope, 'SCOPE_MISMATCH'],
+    ];
+    for (const [claim, expected, denialCode] of bindings) {
+        if (claims[claim] !== expected)
+            denialCodes.push(denialCode);
+    }
+    if (claims.registryVersion !== request.catalog.registryVersion) {
+        denialCodes.push('REGISTRY_VERSION_MISMATCH');
+    }
+}
+function addTemporalCodes(claims, nowSeconds, denialCodes) {
+    if (!isFiniteInteger(claims.iat) || !isFiniteInteger(claims.exp))
+        return;
+    if (claims.iat > nowSeconds + CLOCK_SKEW_SECONDS)
+        denialCodes.push('TOKEN_NOT_YET_VALID');
+    if (claims.exp <= nowSeconds)
+        denialCodes.push('TOKEN_EXPIRED');
+    if (claims.exp <= claims.iat || claims.exp - claims.iat > MAX_LIFETIME_SECONDS) {
+        denialCodes.push('TOKEN_LIFETIME_TOO_LONG');
+    }
+}
+function addRegistryCodes(request, denialCodes) {
+    const capability = request.catalog.capabilityRegistry.find((item) => item.capabilityId === request.capabilityId);
+    if (!capability) {
+        denialCodes.push('CAPABILITY_NOT_FOUND');
+        return;
+    }
+    if (!capability.personas.includes(request.persona))
+        denialCodes.push('PERSONA_NOT_ALLOWED');
+    const action = capability.actions.find((item) => item.actionId === request.actionId);
+    if (!action) {
+        denialCodes.push('ACTION_NOT_ALLOWED');
+    }
+    else if (action.mode === 'blocked') {
+        denialCodes.push('LIVE_VALUE_ACTION_BLOCKED');
+    }
+    else if (!action.requiredScopes.includes(request.scope)) {
+        denialCodes.push('SCOPE_NOT_ALLOWED');
+    }
+    if (BLOCKED_ACTION_IDS.has(request.actionId) || request.capabilityId === 'production_value_and_claims') {
+        denialCodes.push('LIVE_VALUE_ACTION_BLOCKED');
+    }
+}
+function uniqueCodes(codes) {
+    return [...new Set(codes)];
+}
+export function evaluateConnectRuntimeTokenShadowV1(request) {
+    const claims = request.claims;
+    const denialCodes = [];
+    if (!claims || typeof claims !== 'object') {
+        denialCodes.push('MALFORMED_CLAIMS');
+    }
+    else {
+        if (claims.iss !== 'nbo-connect')
+            denialCodes.push('ISSUER_MISMATCH');
+        if (claims.aud !== 'nbo-connect-action')
+            denialCodes.push('AUDIENCE_MISMATCH');
+        if (claims.tokenType !== 'connect_action')
+            denialCodes.push('TOKEN_TYPE_MISMATCH');
+        if (claims.environment !== 'sandbox' || request.environment !== 'sandbox') {
+            denialCodes.push('ENVIRONMENT_MISMATCH');
+        }
+        addMissingClaimCodes(claims, denialCodes);
+        addTemporalCodes(claims, request.nowSeconds, denialCodes);
+        addExactBindingCodes(claims, request, denialCodes);
+        if (request.authorizationActive === false)
+            denialCodes.push('AUTHORIZATION_WITHDRAWN');
+        if (request.revokedJtis?.includes(claims.jti ?? ''))
+            denialCodes.push('TOKEN_REVOKED');
+        if (request.consumedJtis?.includes(claims.jti ?? ''))
+            denialCodes.push('TOKEN_REPLAYED');
+    }
+    addRegistryCodes(request, denialCodes);
+    const uniqueDenialCodes = uniqueCodes(denialCodes);
+    const wouldAuthorize = uniqueDenialCodes.length === 0;
+    const tokenRef = maskOpaqueRef(claims?.jti);
+    const auditRef = `runtime-token-shadow:${tokenRef}`;
+    const evaluatedAt = new Date(request.nowSeconds * 1000).toISOString();
+    const audit = {
+        schemaVersion: 'nbo.connect.runtime_token_shadow_audit.v1',
+        auditRef,
+        outcome: wouldAuthorize ? 'RUNTIME_TOKEN_SHADOW_WOULD_ALLOW' : 'RUNTIME_TOKEN_SHADOW_DENIED',
+        tokenRef,
+        organizationId: isNonEmptyString(claims?.organizationId) ? claims.organizationId : null,
+        nodeId: isNonEmptyString(claims?.nodeId) ? claims.nodeId : null,
+        persona: isNonEmptyString(claims?.persona) ? claims.persona : null,
+        capabilityId: isNonEmptyString(claims?.capabilityId) ? claims.capabilityId : null,
+        actionId: isNonEmptyString(claims?.actionId) ? claims.actionId : null,
+        scope: isNonEmptyString(claims?.scope) ? claims.scope : null,
+        denialCodes: uniqueDenialCodes,
+        acceptedForAuthentication: false,
+        liveValueActionAttempted: false,
+        evaluatedAt,
+    };
+    return {
+        mode: 'shadow_only',
+        wouldAuthorize,
+        acceptedForAuthentication: false,
+        denialCodes: uniqueDenialCodes,
+        audit,
+        dashboard: {
+            tokenRef,
+            auditRef,
+            status: wouldAuthorize ? 'would_allow' : 'would_deny',
+            environment: request.environment,
+            organizationId: audit.organizationId,
+            nodeId: audit.nodeId,
+            persona: audit.persona,
+            capabilityId: audit.capabilityId,
+            actionId: audit.actionId,
+            scope: audit.scope,
+            denialCodes: uniqueDenialCodes,
+            acceptedForAuthentication: false,
+        },
+    };
+}
+//# sourceMappingURL=runtimeTokenShadow.js.map

package/dist/runtimeTokenShadow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeTokenShadow.js","sourceRoot":"","sources":["../src/runtimeTokenShadow.ts"],"names":[],"mappings":"AAwGA,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,mBAAmB;IACnB,cAAc;IACd,iBAAiB;IACjB,eAAe;IACf,eAAe;IACf,oBAAoB;IACpB,sBAAsB;IACtB,UAAU;IACV,YAAY;IACZ,mBAAmB;IACnB,eAAe;IACf,YAAY;IACZ,eAAe;IACf,yBAAyB;IACzB,iBAAiB;IACjB,eAAe;IACf,mBAAmB;CACpB,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACtD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC;IAC9C,OAAO,UAAU,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAA4C,EAC5C,WAAoD;IAEpD,MAAM,cAAc,GAA6C;QAC/D,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB;QACxE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB;QAC3E,KAAK,EAAE,KAAK,EAAE,kBAAkB;KACjC,CAAC;IACF,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,WAAW,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAA4C,EAC5C,OAA2C,EAC3C,WAAoD;IAEpD,MAAM,QAAQ,GAA8F;QAC1G,CAAC,gBAAgB,EAAE,OAAO,CAAC,cAAc,EAAE,uBAAuB,CAAC;QACnE,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC;QAC3C,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC;QAChD,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC;QAC7D,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,iBAAiB,CAAC;QACjD,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC;KAC3C,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC;QACrD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QAC/D,WAAW,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,MAA4C,EAC5C,UAAkB,EAClB,WAAoD;IAEpD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO;IACzE,IAAI,MAAM,CAAC,GAAG,GAAG,UAAU,GAAG,kBAAkB;QAAE,WAAW,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,GAAG,IAAI,UAAU;QAAE,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,oBAAoB,EAAE,CAAC;QAC/E,WAAW,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,OAA2C,EAC3C,WAAoD;IAEpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CACxD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,CACrD,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,WAAW,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,WAAW,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,WAAW,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACzC,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrC,WAAW,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAChD,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,YAAY,KAAK,6BAA6B,EAAE,CAAC;QACvG,WAAW,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAA8C;IACjE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,OAA2C;IAE3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,WAAW,GAA4C,EAAE,CAAC;IAEhE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,CAAC,GAAG,KAAK,aAAa;YAAE,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,GAAG,KAAK,oBAAoB;YAAE,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB;YAAE,WAAW,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACnF,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1E,WAAW,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC3C,CAAC;QACD,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC1C,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAC1D,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,mBAAmB,KAAK,KAAK;YAAE,WAAW,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACvF,IAAI,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACvF,IAAI,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3F,CAAC;IAED,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACvC,MAAM,iBAAiB,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,wBAAwB,QAAQ,EAAE,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACtE,MAAM,KAAK,GAAqC;QAC9C,aAAa,EAAE,2CAA2C;QAC1D,QAAQ;QACR,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,6BAA6B;QAC5F,QAAQ;QACR,cAAc,EAAE,gBAAgB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QACvF,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAC/D,OAAO,EAAE,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAClE,YAAY,EAAE,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;QACjF,QAAQ,EAAE,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;QACrE,KAAK,EAAE,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC5D,WAAW,EAAE,iBAAiB;QAC9B,yBAAyB,EAAE,KAAK;QAChC,wBAAwB,EAAE,KAAK;QAC/B,WAAW;KACZ,CAAC;IACF,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,cAAc;QACd,yBAAyB,EAAE,KAAK;QAChC,WAAW,EAAE,iBAAiB;QAC9B,KAAK;QACL,SAAS,EAAE;YACT,QAAQ;YACR,QAAQ;YACR,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY;YACrD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,iBAAiB;YAC9B,yBAAyB,EAAE,KAAK;SACjC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@nboconnect/connect",
+  "version": "0.1.0",
+  "description": "Server-side TypeScript client for the governed NBO Connect API",
+  "private": false,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Planettechnologies/nbo-monorepo.git",
+    "directory": "packages/connect-sdk"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "replay:runtime-token": "node scripts/replay-runtime-token-shadow.mjs",
+    "verify:runtime-token-shadow-release": "node scripts/verify-runtime-token-shadow-release.mjs"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.9"
+  }
+}