@north-light/identity 0.3.438 → 0.3.440

package/dist/index.d.ts

@@ -22,7 +22,7 @@ export interface IdTokenClaims extends JWTPayload {
     family_name?: string;
     picture?: string;
 }
-export type Scope = 'crtr:llm' | 'crtr:act' | 'crtr:schedule' | `crtr:memory:${'read' | 'rw'}:user${'' | `:${string}`}` | 'crtr:memory:manage:user' | `crtr:memory:${'read' | 'rw'}:app:${string}` | `crtr:files:${'read' | 'rw'}:${'user' | `app:${string}`}:${string}` | 'crtr:files:share' | `crtr:${'conversations' | 'objects'}:read:app:${string}` | `crtr:peer:${string}` | `${string}:${string}`;
+export type Scope = 'crtr:llm' | 'crtr:act' | 'crtr:schedule' | `crtr:memory:${'read' | 'rw'}:user${'' | `:${string}`}` | 'crtr:memory:manage:user' | `crtr:memory:${'read' | 'rw'}:app:${string}` | `crtr:files:${'read' | 'rw'}:${'user' | `app:${string}`}:${string}` | 'crtr:files:share' | `crtr:${'conversations' | 'objects'}:read:app:${string}` | `crtr:objects:${'message' | 'spawn'}:app:${string}` | `crtr:peer:${string}` | `${string}:${string}`;
 /** App-memory form keys omit the app id. */
 export declare const ENFORCED: ReadonlySet<string>;
 export declare function parseScope(value: string, grantee?: string): Scope;
@@ -73,6 +73,34 @@ export declare function verifyAccessToken(options: {
     issuer: string;
     audience: string;
 }): Promise<AccessTokenClaims>;
+/** The claims of a machine token: one machine of an account calling another (or the account relay). It names the
+ *  person and the calling machine and carries no grant, so it authorizes nothing on its own. */
+export interface MachineTokenClaims extends JWTPayload {
+    iss: string;
+    /** The single audience: a peer machine URL or the relay origin. */
+    aud: string;
+    /** The account's person, `user:<id>`. */
+    sub: string;
+    /** Always equal to `sub`. */
+    grantee: string;
+    client_id: string;
+    /** The calling machine, `runtime:<id>`. */
+    machine_id: string;
+    exp: number;
+}
+/**
+ * Verifies a machine token: ES256 with typ `at+jwt`, signature against `jwks`, `iss` = `issuer`, `aud` a string equal
+ * to `audience` (the sole audience), and `exp`. `sub` must be `user:<id>`, `grantee` must equal `sub`, `machine_id`
+ * must be `runtime:<id>` and `client_id` a non-empty string. A token carrying a `grant`, `rev` or `scope` claim is
+ * refused, so an app grant token never verifies here; `verifyAccessToken` requires an `app:` grantee, so a machine
+ * token never verifies there.
+ */
+export declare function verifyMachineToken(options: {
+    token: string;
+    jwks: JSONWebKeySet | JwksCache;
+    issuer: string;
+    audience: string;
+}): Promise<MachineTokenClaims>;
 /** One level of the outbound token's RFC 8693 `act` nesting: the actor, and the actor it acted for. */
 export interface OutboundActor {
     sub: string;

package/dist/index.js

@@ -31,9 +31,10 @@ function selector(value) {
     match = /^crtr:files:(read|rw):(user|app:[A-Za-z0-9_-]{1,64}):(.+)$/.exec(value);
     if (match && validPath(match[3], true))
         return { kind: 'files', access: match[1], holder: match[2], path: match[3] };
-    match = /^crtr:(conversations|objects):read:app:([A-Za-z0-9_-]{1,64})$/.exec(value);
+    // read, message and spawn are three unrelated scopes: `covers` is exact equality for them.
+    match = /^crtr:(?:(conversations):read|(objects):(?:read|message|spawn)):app:([A-Za-z0-9_-]{1,64})$/.exec(value);
     if (match)
-        return { kind: match[1], value };
+        return { kind: (match[1] ?? match[2]), value };
     match = /^crtr:peer:([A-Za-z0-9_-]{1,64})$/.exec(value);
     if (match)
         return { kind: 'peer', value };
@@ -226,6 +227,28 @@ export async function verifyAccessToken(options) {
         throw new Error('Invalid access token claims');
     return payload;
 }
+/**
+ * Verifies a machine token: ES256 with typ `at+jwt`, signature against `jwks`, `iss` = `issuer`, `aud` a string equal
+ * to `audience` (the sole audience), and `exp`. `sub` must be `user:<id>`, `grantee` must equal `sub`, `machine_id`
+ * must be `runtime:<id>` and `client_id` a non-empty string. A token carrying a `grant`, `rev` or `scope` claim is
+ * refused, so an app grant token never verifies here; `verifyAccessToken` requires an `app:` grantee, so a machine
+ * token never verifies there.
+ */
+export async function verifyMachineToken(options) {
+    const header = decodeProtectedHeader(options.token);
+    if (header.typ !== 'at+jwt' || header.alg !== 'ES256')
+        throw new Error('Invalid machine token header');
+    const keys = await keySet(options.jwks, header.kid);
+    const { payload } = await jwtVerify(options.token, createLocalJWKSet(keys), {
+        issuer: options.issuer, audience: options.audience, algorithms: ['ES256'], typ: 'at+jwt', requiredClaims: ['exp'],
+    });
+    if (payload.aud !== options.audience || !validatePrincipal(payload.sub, 'user') || payload.grantee !== payload.sub ||
+        !validatePrincipal(payload.machine_id, 'runtime') || !nonEmptyString(payload.client_id) || typeof payload.exp !== 'number' ||
+        payload.grant !== undefined || payload.rev !== undefined || payload.scope !== undefined) {
+        throw new Error('Invalid machine token claims');
+    }
+    return payload;
+}
 function nonEmptyString(value) {
     return typeof value === 'string' && value !== '';
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.438",
+  "version": "0.3.440",
   "description": "Northlight access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",