@north-light/cli 0.3.486 → 0.3.487

package/packages/crouter-identity/dist/index.js

@@ -215,6 +215,7 @@ function validatePrincipal(value, kind) {
 function keySet(jwks, kid) {
     return jwks instanceof JwksCache ? jwks.forKid(kid) : Promise.resolve(jwks);
 }
+/** @deprecated Use `verifyCallToken`; removed after the peer-token rollout window (plan I2). */
 export async function verifyAccessToken(options) {
     const header = decodeProtectedHeader(options.token);
     if (header.typ !== 'at+jwt' || header.alg !== 'ES256')
@@ -241,6 +242,7 @@ export async function verifyAccessToken(options) {
  * refused, so an app grant token never verifies here; `verifyAccessToken` requires an `app:` grantee, so a machine
  * token never verifies there.
  */
+/** @deprecated Use `verifyCallToken`; removed after the peer-token rollout window (plan I2). */
 export async function verifyMachineToken(options) {
     const header = decodeProtectedHeader(options.token);
     if (header.typ !== 'at+jwt' || header.alg !== 'ES256')
@@ -273,6 +275,7 @@ function isActor(value) {
  * an `app:` or `user:` principal; the remaining claims are checked for presence and type only; which of them gates a
  * call is the caller's rule (D3-TOK-13 gates on `scope` alone, and nothing gates on `act`).
  */
+/** @deprecated Use `verifyCallToken`; removed after the peer-token rollout window (plan I2). */
 export async function verifyOutboundToken(options) {
     const header = decodeProtectedHeader(options.token);
     if (header.typ !== 'at+jwt' || (header.alg !== 'ES256' && header.alg !== 'RS256'))
@@ -291,6 +294,120 @@ export async function verifyOutboundToken(options) {
     }
     return payload;
 }
+const MAX_CHAIN_DEPTH = 8;
+const DEVELOPER_CREDENTIAL_LINK = /^developer-credential:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function isDeveloperCredential(value) {
+    return typeof value === 'string' && DEVELOPER_CREDENTIAL_LINK.test(value);
+}
+/** The only envelope a `developer-credential:<uuid>` link may sit in: the token the directory's developer login mints for
+ *  `cloud:developer`, whose grantee and initiating app are the person themself and which carries no machine, grant or revision. */
+function isDeveloperCredentialEnvelope(p) {
+    return p.client_id === 'developer-credential' && p.scope === 'cloud:developer' && p.grantee === p.sub && p.initiating_app === p.sub &&
+        p.machine_id === undefined && p.grant === undefined && p.rev === undefined;
+}
+function chainOf(payload) {
+    const p = payload;
+    const bad = () => { throw new Error('Invalid call token claims'); };
+    const appLink = (sub, grant, rev) => {
+        if (grant === undefined)
+            return { sub };
+        if (typeof grant !== 'string' || grant === '')
+            return bad();
+        if (rev === undefined)
+            throw new MissingRevClaimError();
+        if (typeof rev !== 'number' || !Number.isInteger(rev) || rev < 1)
+            return bad();
+        return { sub, grant, rev };
+    };
+    if (p.act === undefined) {
+        if (p.machine_id !== undefined) {
+            if (!validatePrincipal(p.machine_id, 'runtime') || p.grantee !== p.sub ||
+                p.grant !== undefined || p.rev !== undefined || p.scope !== undefined)
+                return bad();
+            return [{ sub: p.machine_id }];
+        }
+        if (validatePrincipal(p.grantee, 'app') && typeof p.grant === 'string')
+            return [appLink(p.grantee, p.grant, p.rev)];
+        return bad();
+    }
+    const chain = [];
+    let node = p.act;
+    while (node !== undefined) {
+        if (chain.length >= MAX_CHAIN_DEPTH)
+            return bad();
+        if (typeof node !== 'object' || node === null || Array.isArray(node))
+            return bad();
+        const link = node;
+        if (isDeveloperCredential(link.sub)) {
+            // The one restricted actor beyond runtime/app/user: the directory's developer-CLI token. It verifies and grants nothing else.
+            if (chain.length !== 0 || Object.keys(node).length !== 1 || !isDeveloperCredentialEnvelope(p))
+                return bad();
+            chain.push({ sub: link.sub });
+            break;
+        }
+        if (!(validatePrincipal(link.sub, 'runtime') || validatePrincipal(link.sub, 'app') || validatePrincipal(link.sub, 'user')))
+            return bad();
+        if (link.sub.startsWith('app:'))
+            chain.push(appLink(link.sub, link.grant, link.rev));
+        else if (link.grant !== undefined || link.rev !== undefined)
+            return bad();
+        else
+            chain.push({ sub: link.sub });
+        node = link.act;
+    }
+    if (p.machine_id !== undefined && p.machine_id !== chain[0].sub)
+        return bad();
+    if (p.grant !== undefined && !chain.some((l) => l.sub.startsWith('app:') && l.grant === p.grant))
+        return bad();
+    // A superset token's other legacy fields must say what its chain says, or the old and new verifiers authorize different
+    // identities from one signed token. Provider tokens (`scope`) are exempt: their `grantee` is the person or app the call
+    // runs for, not a link of the chain.
+    if (p.scope === undefined) {
+        const appLinks = chain.filter((l) => l.sub.startsWith('app:'));
+        const appLink = appLinks.find((l) => l.grant !== undefined && l.grant === p.grant) ?? appLinks[0];
+        if (appLink !== undefined) {
+            if (p.grantee !== undefined && p.grantee !== appLink.sub)
+                return bad();
+            if (p.rev !== undefined && p.rev !== appLink.rev)
+                return bad();
+        }
+        else if (chain[0].sub.startsWith('runtime:')) {
+            if (p.grantee !== undefined && p.grantee !== p.sub)
+                return bad();
+            if (p.rev !== undefined)
+                return bad();
+        }
+    }
+    return chain;
+}
+/**
+ * Verifies a call token of any use (peer, app access, outbound provider, run notice) and returns its actor chain,
+ * presenter first. Checks in order: header `typ` `at+jwt`, `alg` ES256 or RS256, non-empty `kid`; signature; `iss`;
+ * `aud` a string equal to `audience`; `exp` and `iat` numbers; `sub` = `user:<id>`; `client_id` non-empty; `scope`
+ * a string when present; then the chain. Without `act` the legacy machine token (`machine_id`, `grantee` = `sub`)
+ * and the legacy app token (`app:` `grantee` + `grant` + `rev`) are normalized to a one-link chain; with `act` any
+ * `machine_id` must equal the first link, any top-level `grant` an app link's, and, on a token without `scope`, any `grantee`
+ * and `rev` the app link's (or, with no app link, `grantee` = `sub` and no `rev`). It authorizes nothing.
+ * Throws `MissingRevClaimError` for an `app:` link carrying `grant` and no `rev`.
+ */
+export async function verifyCallToken(options) {
+    const header = decodeProtectedHeader(options.token);
+    if (header.typ !== 'at+jwt' || (header.alg !== 'ES256' && header.alg !== 'RS256'))
+        throw new Error('Invalid call token header');
+    if (!nonEmptyString(header.kid))
+        throw new Error('Call token has no key id');
+    const keys = await keySet(options.jwks, header.kid);
+    const { payload } = await jwtVerify(options.token, createLocalJWKSet(keys), {
+        issuer: options.issuer, audience: options.audience, algorithms: ['ES256', 'RS256'], typ: 'at+jwt', requiredClaims: ['exp'],
+    });
+    if (payload.aud !== options.audience || typeof payload.exp !== 'number' || typeof payload.iat !== 'number' ||
+        !validatePrincipal(payload.sub, 'user') || !nonEmptyString(payload.client_id) ||
+        (payload.scope !== undefined && typeof payload.scope !== 'string')) {
+        throw new Error('Invalid call token claims');
+    }
+    const chain = chainOf(payload);
+    return { sub: payload.sub, aud: payload.aud, chain, ...(payload.scope === undefined ? {} : { scope: payload.scope }), claims: payload };
+}
 /** The directory's grant-sync notice: ES256 with the directory signing key named
  *  by `kid`, no `typ`, `aud` = the runtime's registered URL, a lifetime of at most
  *  five minutes, and a `jti` the runtime uses to answer replays without a sync. */

package/packages/crouter-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.486",
+  "version": "0.3.487",
   "description": "Northlight access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.486",
+  "version": "0.3.487",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.486",
+      "version": "0.3.487",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -18,7 +18,7 @@
         "@earendil-works/pi-ai": "1.1.0",
         "@earendil-works/pi-coding-agent": "1.1.0",
         "@earendil-works/pi-tui": "1.1.0",
-        "@north-light/identity": "0.3.486",
+        "@north-light/identity": "0.3.487",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
@@ -12116,17 +12116,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.486",
+      "version": "0.3.487",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.486",
+      "version": "0.3.487",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.486",
+      "version": "0.3.487",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -12134,20 +12134,20 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.486",
+      "version": "0.3.487",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.486",
-        "@north-light/identity": "0.3.486"
+        "@north-light/api": "0.3.487",
+        "@north-light/identity": "0.3.487"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.486",
+      "version": "0.3.487",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.486",
-        "@north-light/identity": "0.3.486",
+        "@north-light/api": "0.3.487",
+        "@north-light/identity": "0.3.487",
         "jose": "^6.2.1"
       },
       "bin": {