@noodleseed/one 0.99.0 → 0.100.0

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-client-auth.js

@@ -0,0 +1,199 @@
+import { decodeJwt, decodeProtectedHeader, importJWK, jwtVerify } from 'jose';
+import { secretDigestMatches } from './service-principal-credentials.js';
+const ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+const PRINCIPAL_ID = /^spn_[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const SECRET = /^[A-Za-z0-9_-]{43}$/;
+const MAX_ASSERTION_BYTES = 16 * 1024;
+const MAX_BASIC_BYTES = 4096;
+const MAX_ASSERTION_SECONDS = 300;
+const MAX_FUTURE_IAT_SECONDS = 60;
+export class ServicePrincipalClientAuthError extends Error {
+    oauthError = 'invalid_client';
+    status = 401;
+    constructor() {
+        super('invalid client authentication');
+        this.name = 'ServicePrincipalClientAuthError';
+    }
+}
+/** Authenticate one bounded machine client without disclosing client or credential existence. */
+export async function authenticateServicePrincipalClient(request, store, tokenEndpoint, nowSeconds) {
+    try {
+        validateClock(nowSeconds);
+        const authorization = oneAuthorization(request.authorization);
+        const hasAssertion = request.body.client_assertion !== undefined ||
+            request.body.client_assertion_type !== undefined;
+        if (request.body.client_secret !== undefined)
+            throw new Error('unsupported secret transport');
+        if (authorization !== undefined) {
+            if (hasAssertion)
+                throw new Error('conflicting authentication');
+            return await authenticateBasic(authorization, request.body, store, nowSeconds);
+        }
+        if (!hasAssertion)
+            throw new Error('missing authentication');
+        return await authenticateAssertion(request.body, store, tokenEndpoint, nowSeconds);
+    }
+    catch {
+        throw new ServicePrincipalClientAuthError();
+    }
+}
+async function authenticateBasic(authorization, body, store, nowSeconds) {
+    if (!authorization.startsWith('Basic ') ||
+        Buffer.byteLength(authorization, 'utf8') > MAX_BASIC_BYTES) {
+        throw new Error('invalid Basic authorization');
+    }
+    const encoded = authorization.slice('Basic '.length);
+    if (!isCanonicalBase64(encoded))
+        throw new Error('invalid Basic encoding');
+    const decoded = Buffer.from(encoded, 'base64').toString('utf8');
+    const separator = decoded.indexOf(':');
+    if (separator < 1 || decoded.indexOf(':', separator + 1) !== -1) {
+        throw new Error('invalid Basic credentials');
+    }
+    const clientId = decoded.slice(0, separator);
+    const secret = decoded.slice(separator + 1);
+    if (!PRINCIPAL_ID.test(clientId) || !SECRET.test(secret))
+        throw new Error('invalid client');
+    const bodyClientId = optionalString(body.client_id);
+    if (bodyClientId !== undefined && bodyClientId !== clientId)
+        throw new Error('client mismatch');
+    const client = await store.loadActiveClient(clientId, nowSeconds * 1000);
+    if (client === undefined)
+        throw new Error('unknown client');
+    let match;
+    for (const credential of client.credentials) {
+        if (credential.kind !== 'client_secret')
+            continue;
+        if (secretDigestMatches(secret, credential.secretDigest))
+            match = credential;
+    }
+    if (match === undefined)
+        throw new Error('invalid secret');
+    return verified(client, match.credentialId);
+}
+async function authenticateAssertion(body, store, tokenEndpoint, nowSeconds) {
+    if (body.client_assertion_type !== ASSERTION_TYPE)
+        throw new Error('invalid assertion type');
+    const assertion = requiredString(body.client_assertion);
+    if (Buffer.byteLength(assertion, 'utf8') > MAX_ASSERTION_BYTES) {
+        throw new Error('assertion too large');
+    }
+    const decoded = decodeJwt(assertion);
+    const clientId = assertionClientId(decoded, body.client_id);
+    const header = decodeProtectedHeader(assertion);
+    if (header.alg !== 'RS256' && header.alg !== 'ES256')
+        throw new Error('unsupported algorithm');
+    if (header.kid !== undefined && (typeof header.kid !== 'string' || header.kid.length > 200)) {
+        throw new Error('invalid kid');
+    }
+    const client = await store.loadActiveClient(clientId, nowSeconds * 1000);
+    if (client === undefined)
+        throw new Error('unknown client');
+    const candidates = client.credentials.filter((credential) => credential.kind === 'public_jwk' &&
+        credential.algorithm === header.alg &&
+        (header.kid === undefined || credential.kid === header.kid));
+    if (candidates.length === 0 || candidates.length > 5)
+        throw new Error('invalid key set');
+    const audiences = acceptedAudiences(tokenEndpoint);
+    for (const credential of candidates) {
+        if (credential.kind !== 'public_jwk')
+            continue;
+        try {
+            const key = await importJWK(credential.publicJwk, credential.algorithm);
+            const verifiedAssertion = await jwtVerify(assertion, key, {
+                algorithms: [credential.algorithm],
+                currentDate: new Date(nowSeconds * 1000),
+            });
+            const replay = validateAssertionClaims(verifiedAssertion.payload, clientId, audiences, nowSeconds);
+            return verified(client, credential.credentialId, replay);
+        }
+        catch {
+            // The active public-key set is bounded to five; try every eligible key without disclosure.
+        }
+    }
+    throw new Error('invalid assertion');
+}
+function validateAssertionClaims(payload, clientId, acceptedAudience, nowSeconds) {
+    if (payload.iss !== clientId || payload.sub !== clientId)
+        throw new Error('invalid subject');
+    if (typeof payload.aud !== 'string' || !acceptedAudience.has(payload.aud)) {
+        throw new Error('invalid audience');
+    }
+    if (!Number.isInteger(payload.iat) || !Number.isInteger(payload.exp)) {
+        throw new Error('invalid assertion clock');
+    }
+    const issuedAt = payload.iat;
+    const expiresAt = payload.exp;
+    if (issuedAt > nowSeconds + MAX_FUTURE_IAT_SECONDS ||
+        expiresAt <= nowSeconds ||
+        expiresAt <= issuedAt ||
+        expiresAt - issuedAt > MAX_ASSERTION_SECONDS) {
+        throw new Error('invalid assertion lifetime');
+    }
+    if (typeof payload.jti !== 'string' || payload.jti.length < 1 || payload.jti.length > 200) {
+        throw new Error('invalid assertion jti');
+    }
+    return { jti: payload.jti, expiresAt };
+}
+function assertionClientId(payload, bodyClientId) {
+    if (typeof payload.iss !== 'string' ||
+        payload.iss !== payload.sub ||
+        !PRINCIPAL_ID.test(payload.iss)) {
+        throw new Error('invalid client identifier');
+    }
+    const explicit = optionalString(bodyClientId);
+    if (explicit !== undefined && explicit !== payload.iss)
+        throw new Error('client mismatch');
+    return payload.iss;
+}
+function verified(client, credentialId, assertion) {
+    return {
+        principalId: client.principal.principalId,
+        org: client.principal.org,
+        credentialId,
+        ...(assertion === undefined ? {} : { assertion }),
+    };
+}
+function oneAuthorization(value) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'string')
+        throw new Error('duplicate authorization');
+    return value;
+}
+function optionalString(value) {
+    if (value === undefined)
+        return undefined;
+    return requiredString(value);
+}
+function requiredString(value) {
+    if (typeof value !== 'string' || value.length === 0)
+        throw new Error('invalid string');
+    return value;
+}
+function isCanonicalBase64(value) {
+    if (value.length === 0 || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(value)) {
+        return false;
+    }
+    try {
+        return Buffer.from(value, 'base64').toString('base64') === value;
+    }
+    catch {
+        return false;
+    }
+}
+function acceptedAudiences(tokenEndpoint) {
+    const endpoint = new URL(tokenEndpoint);
+    if (!endpoint.pathname.endsWith('/token') || endpoint.search || endpoint.hash) {
+        throw new Error('invalid token endpoint');
+    }
+    const issuer = new URL(endpoint.href);
+    issuer.pathname = issuer.pathname.slice(0, -'/token'.length) || '/';
+    const issuerValue = issuer.href.endsWith('/') ? issuer.href.slice(0, -1) : issuer.href;
+    return new Set([endpoint.href, issuerValue]);
+}
+function validateClock(value) {
+    if (!Number.isInteger(value) || value < 0)
+        throw new Error('invalid clock');
+}
+//# sourceMappingURL=service-principal-client-auth.js.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-client-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-client-auth.js","sourceRoot":"","sources":["../../src/oauth/service-principal-client-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAmB,SAAS,EAAE,MAAM,MAAM,CAAC;AAC/F,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAOzE,MAAM,cAAc,GAAG,wDAAwD,CAAC;AAChF,MAAM,YAAY,GAChB,+EAA+E,CAAC;AAClF,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAclC,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,UAAU,GAAG,gBAAgB,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC;IAEtB;QACE,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAA0C,EAC1C,KAA4B,EAC5B,aAAqB,EACrB,UAAkB;IAElB,IAAI,CAAC;QACH,aAAa,CAAC,UAAU,CAAC,CAAC;QAC1B,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC9D,MAAM,YAAY,GAChB,OAAO,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS;YAC3C,OAAO,CAAC,IAAI,CAAC,qBAAqB,KAAK,SAAS,CAAC;QACnD,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9F,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChE,OAAO,MAAM,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC7D,OAAO,MAAM,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,+BAA+B,EAAE,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,aAAqB,EACrB,IAAuC,EACvC,KAA4B,EAC5B,UAAkB;IAElB,IACE,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC;QACnC,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,eAAe,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC5F,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAEhG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC,CAAC;IACzE,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC5D,IAAI,KAAmD,CAAC;IACxD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,UAAU,CAAC,IAAI,KAAK,eAAe;YAAE,SAAS;QAClD,IAAI,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,YAAY,CAAC;YAAE,KAAK,GAAG,UAAU,CAAC;IAC/E,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC3D,OAAO,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAuC,EACvC,KAA4B,EAC5B,aAAqB,EACrB,UAAkB;IAElB,IAAI,IAAI,CAAC,qBAAqB,KAAK,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,mBAAmB,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC/F,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC,CAAC;IACzE,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAC1C,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,IAAI,KAAK,YAAY;QAChC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,GAAG;QACnC,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAC9D,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAEzF,MAAM,SAAS,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IACnD,KAAK,MAAM,UAAU,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY;YAAE,SAAS;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;YACxE,MAAM,iBAAiB,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE;gBACxD,UAAU,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAClC,WAAW,EAAE,IAAI,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;aACzC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,uBAAuB,CACpC,iBAAiB,CAAC,OAAO,EACzB,QAAQ,EACR,SAAS,EACT,UAAU,CACX,CAAC;YACF,OAAO,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,2FAA2F;QAC7F,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAmB,EACnB,QAAgB,EAChB,gBAAqC,EACrC,UAAkB;IAElB,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC7F,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAa,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAa,CAAC;IACxC,IACE,QAAQ,GAAG,UAAU,GAAG,sBAAsB;QAC9C,SAAS,IAAI,UAAU;QACvB,SAAS,IAAI,QAAQ;QACrB,SAAS,GAAG,QAAQ,GAAG,qBAAqB,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAmB,EAAE,YAAqB;IACnE,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAC/B,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;QAC3B,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC3F,OAAO,OAAO,CAAC,GAAG,CAAC;AACrB,CAAC;AAED,SAAS,QAAQ,CACf,MAAoC,EACpC,YAAoB,EACpB,SAAgE;IAEhE,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;QACzC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG;QACzB,YAAY;QACZ,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA6C;IACrE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,aAAqB;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IACpE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IACvF,OAAO,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;AAC9E,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-credentials.d.ts

@@ -0,0 +1,14 @@
+export type ServicePrincipalSigningAlgorithm = 'RS256' | 'ES256';
+export interface ValidatedPublicJwk {
+    readonly algorithm: ServicePrincipalSigningAlgorithm;
+    readonly publicJwk: Readonly<Record<string, unknown>>;
+}
+/** Generate the one-time 256-bit secret returned by the management API. */
+export declare function createClientSecret(): string;
+/** Hash a high-entropy client secret for durable storage. */
+export declare function digestClientSecret(secret: string): string;
+/** Compare a presented secret with one canonical SHA-256 digest in constant time. */
+export declare function secretDigestMatches(secret: string, expectedDigest: string): boolean;
+/** Validate and import-check one public verification JWK before it reaches a store. */
+export declare function validatePublicJwk(value: unknown, algorithm: string): Promise<ValidatedPublicJwk>;
+//# sourceMappingURL=service-principal-credentials.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-credentials.d.ts","sourceRoot":"","sources":["../../src/oauth/service-principal-credentials.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,gCAAgC,GAAG,OAAO,GAAG,OAAO,CAAC;AAEjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,gCAAgC,CAAC;IACrD,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAKD,2EAA2E;AAC3E,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,6DAA6D;AAC7D,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAOnF;AAED,uFAAuF;AACvF,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,CAAC,CA2B7B"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-credentials.js

@@ -0,0 +1,119 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { importJWK } from 'jose';
+const MAX_PUBLIC_JWK_BYTES = 16 * 1024;
+const PRIVATE_JWK_MEMBERS = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k'];
+/** Generate the one-time 256-bit secret returned by the management API. */
+export function createClientSecret() {
+    return randomBytes(32).toString('base64url');
+}
+/** Hash a high-entropy client secret for durable storage. */
+export function digestClientSecret(secret) {
+    return createHash('sha256').update(secret, 'utf8').digest('base64url');
+}
+/** Compare a presented secret with one canonical SHA-256 digest in constant time. */
+export function secretDigestMatches(secret, expectedDigest) {
+    if (!/^[A-Za-z0-9_-]{43}$/.test(expectedDigest))
+        return false;
+    const expected = Buffer.from(expectedDigest, 'base64url');
+    const actual = Buffer.from(digestClientSecret(secret), 'base64url');
+    return (expected.length === 32 && actual.length === expected.length && timingSafeEqual(actual, expected));
+}
+/** Validate and import-check one public verification JWK before it reaches a store. */
+export async function validatePublicJwk(value, algorithm) {
+    if (algorithm !== 'RS256' && algorithm !== 'ES256') {
+        throw new Error('service-principal JWK algorithm must be RS256 or ES256');
+    }
+    if (!isRecord(value))
+        throw new Error('service-principal public JWK must be an object');
+    const serialized = serializeJwk(value);
+    if (Buffer.byteLength(serialized, 'utf8') > MAX_PUBLIC_JWK_BYTES) {
+        throw new Error('service-principal public JWK must be at most 16 KiB');
+    }
+    for (const member of PRIVATE_JWK_MEMBERS) {
+        if (Object.hasOwn(value, member)) {
+            throw new Error(`service-principal public JWK must not contain private member ${member}`);
+        }
+    }
+    validateCommonJwkMetadata(value, algorithm);
+    if (algorithm === 'RS256')
+        validateRsaJwk(value);
+    else
+        validateEcJwk(value);
+    try {
+        await importJWK(value, algorithm);
+    }
+    catch {
+        throw new Error(`service-principal ${algorithm} public JWK is malformed`);
+    }
+    return Object.freeze({
+        algorithm,
+        publicJwk: Object.freeze(structuredClone(value)),
+    });
+}
+function serializeJwk(value) {
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        throw new Error('service-principal public JWK must be JSON serializable');
+    }
+}
+function validateCommonJwkMetadata(jwk, algorithm) {
+    if (jwk.alg !== undefined && jwk.alg !== algorithm) {
+        throw new Error('service-principal JWK declared algorithm does not match its pinned algorithm');
+    }
+    if (jwk.use !== undefined && jwk.use !== 'sig') {
+        throw new Error('service-principal JWK use must be sig');
+    }
+    if (jwk.key_ops !== undefined &&
+        (!Array.isArray(jwk.key_ops) || jwk.key_ops.length !== 1 || jwk.key_ops[0] !== 'verify')) {
+        throw new Error('service-principal JWK key_ops must contain only verify');
+    }
+    if (jwk.kid !== undefined &&
+        (typeof jwk.kid !== 'string' || jwk.kid.length === 0 || jwk.kid.length > 200)) {
+        throw new Error('service-principal JWK kid must be between 1 and 200 characters');
+    }
+}
+function validateRsaJwk(jwk) {
+    if (jwk.kty !== 'RSA' || typeof jwk.n !== 'string' || typeof jwk.e !== 'string') {
+        throw new Error('RS256 requires an RSA public JWK');
+    }
+    const modulus = decodeCanonicalBase64url(jwk.n, 'RSA modulus');
+    const bits = modulusBitLength(modulus);
+    if (bits < 2048 || bits > 4096) {
+        throw new Error('RS256 RSA modulus must be between 2048 and 4096 bits');
+    }
+    decodeCanonicalBase64url(jwk.e, 'RSA exponent');
+}
+function validateEcJwk(jwk) {
+    if (jwk.kty !== 'EC' ||
+        jwk.crv !== 'P-256' ||
+        typeof jwk.x !== 'string' ||
+        typeof jwk.y !== 'string') {
+        throw new Error('ES256 requires a P-256 EC public JWK');
+    }
+    if (decodeCanonicalBase64url(jwk.x, 'EC x coordinate').length !== 32 ||
+        decodeCanonicalBase64url(jwk.y, 'EC y coordinate').length !== 32) {
+        throw new Error('ES256 requires 256-bit EC coordinates');
+    }
+}
+function decodeCanonicalBase64url(value, label) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value))
+        throw new Error(`${label} must be base64url`);
+    const decoded = Buffer.from(value, 'base64url');
+    if (decoded.length === 0 || decoded.toString('base64url') !== value) {
+        throw new Error(`${label} must be canonical base64url`);
+    }
+    return decoded;
+}
+function modulusBitLength(value) {
+    const firstNonZero = value.findIndex((byte) => byte !== 0);
+    if (firstNonZero === -1)
+        return 0;
+    const first = value[firstNonZero];
+    return (value.length - firstNonZero - 1) * 8 + (32 - Math.clz32(first));
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=service-principal-credentials.js.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-credentials.js","sourceRoot":"","sources":["../../src/oauth/service-principal-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AASjC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAU,CAAC;AAEnF,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB;IAChC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACzE,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,cAAsB;IACxE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;IACpE,OAAO,CACL,QAAQ,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CACjG,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAc,EACd,SAAiB;IAEjB,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACxF,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,gEAAgE,MAAM,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,yBAAyB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,OAAO;QAAE,cAAc,CAAC,KAAK,CAAC,CAAC;;QAC5C,aAAa,CAAC,KAAK,CAAC,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qBAAqB,SAAS,0BAA0B,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;KACjD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B;IAClD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,GAA4B,EAC5B,SAA2C;IAE3C,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IACE,GAAG,CAAC,OAAO,KAAK,SAAS;QACzB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,EACxF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IACE,GAAG,CAAC,GAAG,KAAK,SAAS;QACrB,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,EAC7E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B;IAClD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,wBAAwB,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B;IACjD,IACE,GAAG,CAAC,GAAG,KAAK,IAAI;QAChB,GAAG,CAAC,GAAG,KAAK,OAAO;QACnB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;QACzB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EACzB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IACE,wBAAwB,CAAC,GAAG,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,MAAM,KAAK,EAAE;QAChE,wBAAwB,CAAC,GAAG,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,MAAM,KAAK,EAAE,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa,EAAE,KAAa;IAC5D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IAC3D,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAW,CAAC;IAC5C,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-guard.d.ts

@@ -0,0 +1,16 @@
+import type { TokenVerifier, VerifiedTokenEnvelope } from '@noodle-borg/auth';
+import type { OwnerTokenVerification, OwnerTokenVerifier } from '@noodle-borg/module';
+import type { ServicePrincipalStore } from './service-principal-store.js';
+export interface ResolvedServicePrincipalTarget {
+    readonly org: string;
+    readonly app: string;
+    readonly environment: string;
+}
+type ServiceCapableTokenVerifier = (token: string, resource: string) => Promise<VerifiedTokenEnvelope | OwnerTokenVerification | null>;
+/**
+ * Revalidate the private principal/grant/credential binding for every machine-authenticated data-plane
+ * request. The private binding is consumed here and never projected into the protocol caller context.
+ */
+export declare function guardServicePrincipalAccessTokenVerifier(verifier: TokenVerifier | ServiceCapableTokenVerifier, store: ServicePrincipalStore | undefined, resolveResource: (resource: string) => Promise<ResolvedServicePrincipalTarget | undefined>, now?: () => number): OwnerTokenVerifier;
+export {};
+//# sourceMappingURL=service-principal-guard.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-guard.d.ts","sourceRoot":"","sources":["../../src/oauth/service-principal-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAE1E,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,KAAK,2BAA2B,GAAG,CACjC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,qBAAqB,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;AAEpE;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,QAAQ,EAAE,aAAa,GAAG,2BAA2B,EACrD,KAAK,EAAE,qBAAqB,GAAG,SAAS,EACxC,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,8BAA8B,GAAG,SAAS,CAAC,EAC1F,GAAG,GAAE,MAAM,MAAiB,GAC3B,kBAAkB,CAyBpB"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-guard.js

@@ -0,0 +1,34 @@
+/**
+ * Revalidate the private principal/grant/credential binding for every machine-authenticated data-plane
+ * request. The private binding is consumed here and never projected into the protocol caller context.
+ */
+export function guardServicePrincipalAccessTokenVerifier(verifier, store, resolveResource, now = Date.now) {
+    return async (token, resource) => {
+        const verification = await verifier(token, resource);
+        if (verification === null || verification.caller.identityKind !== 'service') {
+            return verification;
+        }
+        const binding = 'servicePrincipal' in verification ? verification.servicePrincipal : undefined;
+        if (binding === undefined || store === undefined)
+            return null;
+        try {
+            const target = await resolveResource(resource);
+            if (target === undefined)
+                return null;
+            const valid = await store.validateAccessBinding({
+                principalId: verification.caller.subject,
+                grantId: binding.grantId,
+                credentialId: binding.credentialId,
+                org: target.org,
+                app: target.app,
+                environment: target.environment,
+                now: now(),
+            });
+            return valid ? { caller: verification.caller } : null;
+        }
+        catch {
+            return null;
+        }
+    };
+}
+//# sourceMappingURL=service-principal-guard.js.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-guard.js","sourceRoot":"","sources":["../../src/oauth/service-principal-guard.ts"],"names":[],"mappings":"AAeA;;;GAGG;AACH,MAAM,UAAU,wCAAwC,CACtD,QAAqD,EACrD,KAAwC,EACxC,eAA0F,EAC1F,MAAoB,IAAI,CAAC,GAAG;IAE5B,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC/B,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC5E,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,IAAI,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC;gBAC9C,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO;gBACxC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,GAAG,EAAE,GAAG,EAAE;aACX,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-resource.d.ts

@@ -0,0 +1,14 @@
+import { type TenantRouteRef } from '@noodle-borg/module';
+import type { ServerRegistry } from '../registry.js';
+export interface ServicePrincipalResourceRouting {
+    readonly legacyOrigin: string;
+    readonly allowedBaseDomains: readonly string[];
+}
+export interface ResolvedServicePrincipalResource {
+    readonly resource: string;
+    readonly tenant: TenantRouteRef;
+    readonly deploymentId?: string;
+}
+/** Resolve only a byte-exact canonical MCP resource that is actively served right now. */
+export declare function resolveServicePrincipalResource(resource: string, registry: ServerRegistry, routing: ServicePrincipalResourceRouting): Promise<ResolvedServicePrincipalResource | undefined>;
+//# sourceMappingURL=service-principal-resource.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-resource.d.ts","sourceRoot":"","sources":["../../src/oauth/service-principal-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGrD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,0FAA0F;AAC1F,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,gCAAgC,GAAG,SAAS,CAAC,CAavD"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-resource.js

@@ -0,0 +1,53 @@
+import { formatTenantMcpUrl, parseLegacyTenantMcpPath, parsePublicTenantMcpUrl, } from '@noodle-borg/module';
+import { tenantMcpUrl } from '../registry-helpers.js';
+/** Resolve only a byte-exact canonical MCP resource that is actively served right now. */
+export async function resolveServicePrincipalResource(resource, registry, routing) {
+    const tenant = exactTenant(resource, routing);
+    if (tenant === undefined)
+        return undefined;
+    const target = tenant.serverVersion === undefined
+        ? await registry.getActiveByTenant(tenant)
+        : await registry.getActiveByTenantVersion(tenant, tenant.serverVersion);
+    if (target === undefined)
+        return undefined;
+    return {
+        resource,
+        tenant,
+        ...(target.deploymentId === undefined ? {} : { deploymentId: target.deploymentId }),
+    };
+}
+function exactTenant(resource, routing) {
+    let url;
+    try {
+        url = new URL(resource);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.search !== '' || url.hash !== '')
+        return undefined;
+    const publicTenant = parsePublicTenantMcpUrl(resource, routing.allowedBaseDomains);
+    if (publicTenant !== undefined) {
+        const exact = routing.allowedBaseDomains.some((baseDomain) => formatTenantMcpUrl(baseDomain, publicTenant) === resource);
+        return exact ? publicTenant : undefined;
+    }
+    let legacyOrigin;
+    try {
+        legacyOrigin = new URL(routing.legacyOrigin);
+    }
+    catch {
+        return undefined;
+    }
+    if (legacyOrigin.pathname !== '/' ||
+        legacyOrigin.search !== '' ||
+        legacyOrigin.hash !== '' ||
+        url.origin !== legacyOrigin.origin) {
+        return undefined;
+    }
+    const legacyTenant = parseLegacyTenantMcpPath(url.pathname);
+    if (legacyTenant === undefined)
+        return undefined;
+    const canonical = tenantMcpUrl(legacyOrigin.origin, legacyTenant, legacyTenant.serverVersion);
+    return canonical === resource ? legacyTenant : undefined;
+}
+//# sourceMappingURL=service-principal-resource.js.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-resource.js","sourceRoot":"","sources":["../../src/oauth/service-principal-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAatD,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,QAAgB,EAChB,QAAwB,EACxB,OAAwC;IAExC,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,MAAM,GACV,MAAM,CAAC,aAAa,KAAK,SAAS;QAChC,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC;QAC1C,CAAC,CAAC,MAAM,QAAQ,CAAC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC5E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO;QACL,QAAQ;QACR,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;KACpF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,QAAgB,EAChB,OAAwC;IAExC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAE3D,MAAM,YAAY,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnF,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAC3C,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,YAAY,CAAC,KAAK,QAAQ,CAC1E,CAAC;QACF,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IAED,IAAI,YAAiB,CAAC;IACtB,IAAI,CAAC;QACH,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,YAAY,CAAC,QAAQ,KAAK,GAAG;QAC7B,YAAY,CAAC,MAAM,KAAK,EAAE;QAC1B,YAAY,CAAC,IAAI,KAAK,EAAE;QACxB,GAAG,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAClC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC;IAC9F,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store-postgres-schema.d.ts

@@ -0,0 +1,4 @@
+import type { Pool } from 'pg';
+/** Additively installs the durable service-principal and assertion-replay tables. */
+export declare function ensureServicePrincipalSchema(pool: Pool): Promise<void>;
+//# sourceMappingURL=service-principal-store-postgres-schema.d.ts.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store-postgres-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-store-postgres-schema.d.ts","sourceRoot":"","sources":["../../src/oauth/service-principal-store-postgres-schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B,qFAAqF;AACrF,wBAAsB,4BAA4B,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA+F5E"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store-postgres-schema.js

@@ -0,0 +1,98 @@
+/** Additively installs the durable service-principal and assertion-replay tables. */
+export async function ensureServicePrincipalSchema(pool) {
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_service_principals (
+      principal_id       text PRIMARY KEY
+        CHECK (principal_id ~ '^spn_[0-9a-f-]{36}$'),
+      org_slug           text NOT NULL,
+      name               text NOT NULL CHECK (char_length(name) BETWEEN 1 AND 80),
+      status             text NOT NULL CHECK (status IN ('active', 'revoked')),
+      created_by_subject text NOT NULL,
+      created_at         timestamptz NOT NULL,
+      updated_at         timestamptz NOT NULL,
+      revoked_at         timestamptz,
+      revoked_by_subject text,
+      UNIQUE (principal_id, org_slug)
+    )
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_service_principal_grants (
+      grant_id           text PRIMARY KEY
+        CHECK (grant_id ~ '^spg_[0-9a-f-]{36}$'),
+      principal_id       text NOT NULL,
+      org_slug           text NOT NULL,
+      app_slug           text NOT NULL,
+      environment        text NOT NULL,
+      scopes             text[] NOT NULL CHECK (cardinality(scopes) <= 64),
+      status             text NOT NULL CHECK (status IN ('active', 'revoked')),
+      created_by_subject text NOT NULL,
+      created_at         timestamptz NOT NULL,
+      updated_at         timestamptz NOT NULL,
+      revoked_at         timestamptz,
+      revoked_by_subject text,
+      FOREIGN KEY (principal_id, org_slug)
+        REFERENCES oauth_service_principals (principal_id, org_slug)
+        ON DELETE RESTRICT
+    )
+  `);
+    await pool.query(`
+    CREATE UNIQUE INDEX IF NOT EXISTS oauth_service_principal_active_grant_target_uq
+      ON oauth_service_principal_grants (principal_id, app_slug, environment)
+      WHERE status = 'active'
+  `);
+    await pool.query(`
+    CREATE INDEX IF NOT EXISTS oauth_service_principal_grants_lookup_idx
+      ON oauth_service_principal_grants (principal_id, status)
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_service_principal_credentials (
+      credential_id      text PRIMARY KEY
+        CHECK (credential_id ~ '^spc_[0-9a-f-]{36}$'),
+      principal_id       text NOT NULL,
+      org_slug           text NOT NULL,
+      kind               text NOT NULL CHECK (kind IN ('public_jwk', 'client_secret')),
+      label              text NOT NULL CHECK (char_length(label) BETWEEN 1 AND 80),
+      algorithm          text CHECK (algorithm IN ('RS256', 'ES256')),
+      kid                text CHECK (kid IS NULL OR char_length(kid) BETWEEN 1 AND 200),
+      public_jwk         jsonb,
+      secret_digest      text,
+      status             text NOT NULL CHECK (status IN ('active', 'revoked')),
+      created_by_subject text NOT NULL,
+      created_at         timestamptz NOT NULL,
+      updated_at         timestamptz NOT NULL,
+      expires_at         timestamptz,
+      revoked_at         timestamptz,
+      revoked_by_subject text,
+      FOREIGN KEY (principal_id, org_slug)
+        REFERENCES oauth_service_principals (principal_id, org_slug)
+        ON DELETE RESTRICT,
+      CHECK (
+        (kind = 'public_jwk' AND algorithm IS NOT NULL AND public_jwk IS NOT NULL
+          AND secret_digest IS NULL)
+        OR
+        (kind = 'client_secret' AND algorithm IS NULL AND kid IS NULL
+          AND public_jwk IS NULL AND secret_digest IS NOT NULL)
+      )
+    )
+  `);
+    await pool.query(`
+    CREATE INDEX IF NOT EXISTS oauth_service_principal_active_credentials_idx
+      ON oauth_service_principal_credentials (principal_id, kind, expires_at)
+      WHERE status = 'active'
+  `);
+    await pool.query(`
+    CREATE TABLE IF NOT EXISTS oauth_client_assertion_nonces (
+      credential_id text NOT NULL
+        REFERENCES oauth_service_principal_credentials (credential_id) ON DELETE CASCADE,
+      jti           text NOT NULL CHECK (char_length(jti) BETWEEN 1 AND 200),
+      expires_at    timestamptz NOT NULL,
+      created_at    timestamptz NOT NULL,
+      PRIMARY KEY (credential_id, jti)
+    )
+  `);
+    await pool.query(`
+    CREATE INDEX IF NOT EXISTS oauth_client_assertion_nonces_expiry_idx
+      ON oauth_client_assertion_nonces (expires_at)
+  `);
+}
+//# sourceMappingURL=service-principal-store-postgres-schema.js.map

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store-postgres-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-principal-store-postgres-schema.js","sourceRoot":"","sources":["../../src/oauth/service-principal-store-postgres-schema.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,IAAU;IAC3D,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;GAchB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;GAmBhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;GAIhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;GAGhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;GAIhB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;;;;;GAShB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;GAGhB,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@noodle-borg/service/dist/oauth/service-principal-store-postgres.d.ts

@@ -0,0 +1,22 @@
+import type { Pool } from 'pg';
+import { type ActiveServicePrincipalClient, type AssertionJtiInput, type CreateServicePrincipalGrantInput, type CreateServicePrincipalInput, type CreateStoredCredentialInput, type CredentialMutation, type GrantMutation, type PrincipalMutation, type PrincipalRef, type ServicePrincipalAccessBinding, type ServicePrincipalCredentialRecord, type ServicePrincipalGrantRecord, type ServicePrincipalRecord, type ServicePrincipalStore, type ServicePrincipalView } from './service-principal-store.js';
+/** Durable, organization-isolated service-principal lifecycle and assertion replay store. */
+export declare class PostgresServicePrincipalStore implements ServicePrincipalStore {
+    #private;
+    constructor(pool: Pool, options?: {
+        readonly now?: () => Date;
+    });
+    ensureSchema(): Promise<void>;
+    createPrincipal(input: CreateServicePrincipalInput): Promise<ServicePrincipalRecord>;
+    listPrincipals(org: string): Promise<readonly ServicePrincipalRecord[]>;
+    getPrincipal(input: PrincipalRef): Promise<ServicePrincipalView | undefined>;
+    revokePrincipal(input: PrincipalMutation): Promise<boolean>;
+    createGrant(input: CreateServicePrincipalGrantInput): Promise<ServicePrincipalGrantRecord>;
+    revokeGrant(input: GrantMutation): Promise<boolean>;
+    createCredential(input: CreateStoredCredentialInput): Promise<ServicePrincipalCredentialRecord>;
+    revokeCredential(input: CredentialMutation): Promise<boolean>;
+    loadActiveClient(clientId: string, now: number): Promise<ActiveServicePrincipalClient | undefined>;
+    validateAccessBinding(input: ServicePrincipalAccessBinding): Promise<boolean>;
+    consumeAssertionJti(input: AssertionJtiInput): Promise<boolean>;
+}
+//# sourceMappingURL=service-principal-store-postgres.d.ts.map