@oatscenter/trellis 0.100.0-rc.3 → 0.100.0-rc.4

package/auth/authority.js

@@ -2,9 +2,9 @@ import { Kvm } from "@nats-io/kv";
 import { createInbox } from "@nats-io/nats-core";
 import { QueuedIteratorImpl } from "@nats-io/nats-core/internal";
 import { AckPolicy, DeliverPolicy, jetstream, } from "@nats-io/jetstream";
-import { assertSessionAuthorityHandleCurrentWasm, verifyAdmissionContextWasm, authorizeCatalogActionWasm, createSessionAuthorityHandleWasm, verifyAuthorityMetadataWasm, verifySessionEventWasm, verifySessionRequestWasm, verifySessionResponseWasm, } from "./protocol_wasm.js";
+import { assertSessionAuthorityHandleCurrentWasm, verifyAdmissionContextWasm, authenticateCatalogWasm, authenticateProviderCertificateWasm, authorizeCatalogActionWasm, authorizeProviderEventPublicationWasm, createSessionAuthorityHandleWasm, verifyAuthorityMetadataWasm, verifySessionEventWasm, verifySessionRequestWasm, verifySessionResponseWasm, authorizationSessionStatusSchema, signedBytes, } from "./protocol_wasm.js";
+import { payloadSha256 } from "./message_digests.js";
 import {} from "./utils.js";
-import { AuthAuthorityStatusResponseCodec } from "../internal_sdk/generated/types/_internal/p0.js";
 import { requestIssuerMetadata } from "./issuer_metadata.js";
 const authorityLeaseToken = Symbol("verified authority lease");
 /** Short-lived typed identity lease; cannot be constructed from unverified JSON. */
@@ -57,7 +57,6 @@ export class VerifiedAuthority {
             oauthGrantId: authority.oauthGrantId,
             capabilities: authority.capabilities,
             apis: authority.apis,
-            platformPrivileges: authority.platformPrivileges,
         };
     }
     /** Time and observed retirement are checked again immediately before authorized work. */
@@ -624,7 +623,7 @@ export class SessionAuthorityOwner {
             const verified = await verifySessionRequestWasm({
                 authorityHandle: entry.handle,
                 request,
-                payload,
+                payloadSha256: await payloadSha256(payload),
                 proof,
                 policy: this.policy(),
                 knownRevoked: this.#revocations.has(entry.authority.authorizationSessionId),
@@ -649,9 +648,9 @@ export class SessionAuthorityOwner {
             const verified = await verifySessionResponseWasm({
                 providerHandle: provider.entry(authorityLeaseToken).handle,
                 response,
-                payload,
+                payloadSha256: await payloadSha256(payload),
                 proof,
-                certificate: certificate.record,
+                certificate: certificate.handle,
                 certificateIssuer: issuer,
                 pendingRequest: pending.request,
                 pendingRequestDigest: pending.proofDigest,
@@ -700,11 +699,11 @@ export class SessionAuthorityOwner {
                 });
                 if (metadata.result.kind !== "value")
                     throw new Error("historical revocation resolution unavailable");
-                const status = AuthAuthorityStatusResponseCodec.decode(JSON.parse(metadata.result.payload));
+                const status = authorizationSessionStatusSchema.parse(JSON.parse(metadata.result.payload));
                 if (status.authorizationSessionId !== hints.authorizationSessionId)
                     throw new Error("historical status mismatch");
                 if (status.revocation) {
-                    const revocation = await this.#verifyMetadata("revocation", status.revocation);
+                    const revocation = await this.#verifyMetadata("revocation", signedBytes(status.revocation));
                     if (revocation.record.authorizationSessionId !==
                         hints.authorizationSessionId ||
                         typeof revocation.record.effectiveCutoff !== "number")
@@ -734,7 +733,7 @@ export class SessionAuthorityOwner {
             const verified = await verifySessionEventWasm({
                 authorityHandle: entry.handle,
                 event,
-                payload,
+                payloadSha256: await payloadSha256(payload),
                 proof,
                 policy: this.policy(),
                 originalPublication,
@@ -835,7 +834,7 @@ export class SessionAuthorityOwner {
             return false;
         const catalog = await this.#metadata("catalog", api.catalogSnapshotDigest);
         const issuer = await this.#issuer(String(catalog.record.issuerKeyId));
-        let allowed = await authorizeCatalogActionWasm(entry.handle, catalog.bytes, this.#metadataPolicy(issuer), action);
+        let allowed = await authorizeCatalogActionWasm(entry.handle, catalog.handle, this.#metadataPolicy(issuer), action);
         if (!allowed && action.kind === "event" && action.direction === "publish") {
             const binding = entry.authority.providerBindings.find((binding) => binding.apiId === apiId);
             if (binding &&
@@ -844,16 +843,15 @@ export class SessionAuthorityOwner {
                 const at = publication?.at ?? this.#now();
                 const certificate = await this.#metadata("provider", binding.providerCertificateDigest, at);
                 const providerIssuer = await this.#issuer(String(certificate.record.issuerKeyId));
-                allowed = await authorizeCatalogActionWasm(entry.handle, catalog.bytes, {
-                    ...this.#metadataPolicy(issuer),
-                    providerPublication: {
-                        certificate: certificate.record,
-                        issuer: providerIssuer,
-                        at,
-                        ...(publication?.publishedAt !== undefined
-                            ? { publishedAt: publication.publishedAt }
-                            : {}),
-                    },
+                allowed = await authorizeProviderEventPublicationWasm(entry.handle, catalog.handle, certificate.handle, {
+                    catalogIssuer: issuer,
+                    certificateIssuer: providerIssuer,
+                    trellisInstanceId: this.instanceId,
+                    audienceNatsAccount: this.account,
+                    at,
+                    ...(publication?.publishedAt !== undefined
+                        ? { publishedAt: publication.publishedAt }
+                        : {}),
                 }, action);
             }
         }
@@ -994,11 +992,11 @@ export class SessionAuthorityOwner {
             }
             if (query.kind === "authorityStatus" &&
                 response.result.kind === "value") {
-                const status = AuthAuthorityStatusResponseCodec.decode(JSON.parse(response.result.payload));
+                const status = authorizationSessionStatusSchema.parse(JSON.parse(response.result.payload));
                 if (status.authorizationSessionId !== query.authorizationSessionId)
                     throw new Error("issuer metadata status identity mismatch");
                 if (status.revocation)
-                    await this.observeRevocation(status.revocation, query.authorizationSessionId, () => epoch === this.#mirrorEpoch &&
+                    await this.observeRevocation(signedBytes(status.revocation), query.authorizationSessionId, () => epoch === this.#mirrorEpoch &&
                         this.#mirrorCovered &&
                         !this.#stopped);
                 assertCurrent();
@@ -1193,8 +1191,24 @@ export class SessionAuthorityOwner {
             bytes: bytes.slice(),
             digest: verified.digest,
             record: verified.record,
+            handle: undefined,
         };
     }
+    /** Authenticate fetched catalog or certificate bytes once into a handle. */
+    async #authenticateMaterial(kind, bytes, at) {
+        const hints = this.#hints(bytes);
+        if (typeof hints.issuerKeyId !== "string")
+            throw new Error("missing issuer lookup identity");
+        const issuer = await this.#issuer(hints.issuerKeyId);
+        const policy = {
+            ...this.#metadataPolicy(issuer),
+            ...(at !== undefined ? { nowUnixSeconds: at } : {}),
+        };
+        const authenticated = kind === "catalog"
+            ? await authenticateCatalogWasm(bytes, policy)
+            : await authenticateProviderCertificateWasm(bytes, policy);
+        return { bytes: bytes.slice(), ...authenticated };
+    }
     async #metadata(kind, digest, at) {
         const key = `${kind}.${digest}`;
         const cached = this.#materials.get(key);
@@ -1208,7 +1222,7 @@ export class SessionAuthorityOwner {
             if (this.#coldMaterials.size >= 32)
                 throw new Error("metadata resolution budget exceeded");
             pending = (async () => {
-                const verified = await this.#verifyMetadata(kind, await this.#read(kind, digest), at);
+                const verified = await this.#authenticateMaterial(kind, await this.#read(kind, digest), at);
                 if (verified.digest !== digest)
                     throw new Error("metadata digest mismatch");
                 if (this.#stopped)

package/auth/authorization/transport_state.d.ts

@@ -1,84 +1,4 @@
 import { type TransportAuthorizationV1 } from "../protocol_wasm.ts";
-/**
- * Retained transport-authorization status for one logical connection.
- *
- * `unavailable` covers a real disconnect and a socket whose own authority no
- * longer covers its admitted policy; it never means "application authorization
- * is revoked", which is a separate observation.
- */
-export type TransportAuthorizationStatus = "unavailable" | "current" | "upgrade_available";
-/**
- * Parse the signed-context digest out of an authenticated admission name.
- *
- * Returns `undefined` for any name that is not a well-formed Trellis admission
- * marker, so a foreign or malformed name is never mistaken for admitted
- * authority.
- * The complete marker requires nonempty opaque digest and server fields,
- * no whitespace, and a canonical positive decimal u64 client ID.
- */
-export declare function admissionContextDigest(authenticatedUser: string): string | undefined;
-/** Result of one bounded own-user-information read. */
-export type OwnAdmission = {
-    authenticatedUser: string;
-    contextDigest?: string;
-};
-/** Minimal NATS request surface used for the own-user-information read. */
-export type OwnUserInfoRequester = {
-    request(subject: string, payload?: Uint8Array, opts?: {
-        timeout?: number;
-    }): Promise<{
-        json<T>(): T;
-    }>;
-};
-/**
- * Read this attachment's authenticated identity from the broker.
- *
- * Best effort by design: notification is triggered by a hint or a refresh, and
- * a missing or malformed reply must never install authority or lose
- * enforcement, so any failure yields `undefined` instead of throwing.
- */
-export declare function readOwnAdmission(nc: OwnUserInfoRequester, timeoutMs: number): Promise<OwnAdmission | undefined>;
-/**
- * Retained admitted-transport state for one logical connection.
- *
- * Holds the exact signed policy actually admitted on the current physical
- * attachment (`A`) and recomputes the retained upgrade status against the
- * newest valid application policy (`D`). It installs no authority: a change
- * here only records a passive upgrade notice or marks transport unavailable.
- */
-export declare class TransportAuthorizationState {
-    #private;
-    /** Register the retained status observer; it receives semantic changes and the current value. */
-    onStatusChanged(callback: (status: TransportAuthorizationStatus) => void): void;
-    status(): TransportAuthorizationStatus;
-    admittedDigest(): string | undefined;
-    admittedPolicy(): TransportAuthorizationV1 | undefined;
-    /** Newest valid application policy D used for the last comparison. */
-    allowedPolicy(): TransportAuthorizationV1 | undefined;
-    /**
-     * Record the policy actually admitted on the current physical generation and
-     * recompute the status against the newest valid application policy.
-     *
-     * Called only after an actual admission read, never as a side effect of an
-     * ordinary context promotion, so an in-place renewal does not pretend the
-     * socket adopted the newer policy.
-     */
-    recordAdmission(args: {
-        contextDigest: string;
-        policy: TransportAuthorizationV1;
-        allowed?: TransportAuthorizationV1;
-        nowUnixSeconds: number;
-    }): Promise<void>;
-    /**
-     * Recompute against the newest valid application policy without a new read.
-     *
-     * A duplicate renewal that changes only the context digest does not change
-     * the semantic status, so no repeated transition is published.
-     */
-    recompute(allowed: TransportAuthorizationV1 | undefined, nowUnixSeconds: number): Promise<void>;
-    /** Record a real physical loss; the next admission recomputes from scratch. */
-    markDisconnected(): void;
-}
 /**
  * Whether the admitted policy covers the exact subjects an operation needs.
  *

package/auth/authorization/transport_state.js

@@ -1,140 +1,4 @@
 import { classifyTransportAuthorizationWasm, TRANSPORT_AUTHORIZATION_FORMAT_V1, } from "../protocol_wasm.js";
-/**
- * Prefix the runtime sets on every callout-owned attachment's authenticated
- * name: `trellis.auth.v1:<contextDigest>:<serverId>:<clientId>`.
- */
-const ADMISSION_NAME_PREFIX = "trellis.auth.v1:";
-/**
- * Parse the signed-context digest out of an authenticated admission name.
- *
- * Returns `undefined` for any name that is not a well-formed Trellis admission
- * marker, so a foreign or malformed name is never mistaken for admitted
- * authority.
- * The complete marker requires nonempty opaque digest and server fields,
- * no whitespace, and a canonical positive decimal u64 client ID.
- */
-export function admissionContextDigest(authenticatedUser) {
-    if (!authenticatedUser.startsWith(ADMISSION_NAME_PREFIX))
-        return undefined;
-    const remainder = authenticatedUser.slice(ADMISSION_NAME_PREFIX.length);
-    const fields = remainder.split(":");
-    const [digest, serverId, clientId] = fields;
-    if (fields.length !== 3 ||
-        !digest ||
-        !serverId ||
-        /[\p{White_Space}\uFEFF]/u.test(remainder) ||
-        !/^[1-9][0-9]*$/u.test(clientId) ||
-        BigInt(clientId) > 18446744073709551615n)
-        return undefined;
-    return digest;
-}
-/**
- * Read this attachment's authenticated identity from the broker.
- *
- * Best effort by design: notification is triggered by a hint or a refresh, and
- * a missing or malformed reply must never install authority or lose
- * enforcement, so any failure yields `undefined` instead of throwing.
- */
-export async function readOwnAdmission(nc, timeoutMs) {
-    try {
-        const reply = await nc.request("$SYS.REQ.USER.INFO", undefined, {
-            timeout: timeoutMs,
-        });
-        const info = reply.json();
-        const user = info?.data?.user;
-        if (typeof user !== "string" || user.length === 0)
-            return undefined;
-        return {
-            authenticatedUser: user,
-            contextDigest: admissionContextDigest(user),
-        };
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Retained admitted-transport state for one logical connection.
- *
- * Holds the exact signed policy actually admitted on the current physical
- * attachment (`A`) and recomputes the retained upgrade status against the
- * newest valid application policy (`D`). It installs no authority: a change
- * here only records a passive upgrade notice or marks transport unavailable.
- */
-export class TransportAuthorizationState {
-    #admittedDigest;
-    #admitted;
-    #allowed;
-    #status = "unavailable";
-    #onStatusChanged;
-    /** Register the retained status observer; it receives semantic changes and the current value. */
-    onStatusChanged(callback) {
-        this.#onStatusChanged = callback;
-        callback(this.#status);
-    }
-    status() {
-        return this.#status;
-    }
-    admittedDigest() {
-        return this.#admittedDigest;
-    }
-    admittedPolicy() {
-        return this.#admitted;
-    }
-    /** Newest valid application policy D used for the last comparison. */
-    allowedPolicy() {
-        return this.#allowed;
-    }
-    /**
-     * Record the policy actually admitted on the current physical generation and
-     * recompute the status against the newest valid application policy.
-     *
-     * Called only after an actual admission read, never as a side effect of an
-     * ordinary context promotion, so an in-place renewal does not pretend the
-     * socket adopted the newer policy.
-     */
-    async recordAdmission(args) {
-        this.#admittedDigest = args.contextDigest;
-        this.#admitted = args.policy;
-        await this.recompute(args.allowed, args.nowUnixSeconds);
-    }
-    /**
-     * Recompute against the newest valid application policy without a new read.
-     *
-     * A duplicate renewal that changes only the context digest does not change
-     * the semantic status, so no repeated transition is published.
-     */
-    async recompute(allowed, nowUnixSeconds) {
-        this.#allowed = allowed;
-        const admitted = this.#admitted;
-        if (!admitted) {
-            this.#setStatus("unavailable");
-            return;
-        }
-        if (!allowed) {
-            this.#setStatus("current");
-            return;
-        }
-        const relation = await classifyTransportAuthorizationWasm(admitted, allowed, nowUnixSeconds);
-        this.#setStatus(relation === "current"
-            ? "current"
-            : relation === "upgrade_available"
-                ? "upgrade_available"
-                : "unavailable");
-    }
-    /** Record a real physical loss; the next admission recomputes from scratch. */
-    markDisconnected() {
-        this.#admittedDigest = undefined;
-        this.#admitted = undefined;
-        this.#setStatus("unavailable");
-    }
-    #setStatus(next) {
-        if (next === this.#status)
-            return;
-        this.#status = next;
-        this.#onStatusChanged?.(next);
-    }
-}
 /**
  * Whether the admitted policy covers the exact subjects an operation needs.
  *

package/auth/browser/oauth.d.ts

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { AuthError } from "../../errors/AuthError.ts";
 import { type TrellisAuth } from "../session_auth.ts";
 import { BrowserSessionStore, type BrowserOAuthScope } from "./storage.ts";
-import { type PlatformPrivilege, type SignedOAuthAdmission } from "../protocol_wasm.ts";
+import { type SignedOAuthAdmission } from "../protocol_wasm.ts";
 import { SessionAuthorityOwner, type RuntimeAuthorizationTrust } from "../authority.ts";
 declare const metadataSchema: z.ZodObject<{
     issuer: z.ZodString;
@@ -33,29 +33,11 @@ declare const tokenSchema: z.ZodObject<{
     refresh_token: z.ZodString;
     expires_in: z.ZodNumber;
     trellis_admission: z.ZodString;
-    authorization_details: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    authorization_details: z.ZodOptional<z.ZodArray<z.ZodObject<{
         type: z.ZodLiteral<"trellis_capabilities">;
         required: z.ZodArray<z.ZodString>;
         optional: z.ZodArray<z.ZodString>;
-    }, z.core.$strip>, z.ZodObject<{
-        type: z.ZodLiteral<"trellis_platform_privileges">;
-        required: z.ZodArray<z.ZodEnum<{
-            "principals.manage": "principals.manage";
-            "roles.manage": "roles.manage";
-            "apis.accept": "apis.accept";
-            "apis.forceReplace": "apis.forceReplace";
-            "clients.manage": "clients.manage";
-            "privileges.manage": "privileges.manage";
-        }>>;
-        optional: z.ZodArray<z.ZodEnum<{
-            "principals.manage": "principals.manage";
-            "roles.manage": "roles.manage";
-            "apis.accept": "apis.accept";
-            "apis.forceReplace": "apis.forceReplace";
-            "clients.manage": "clients.manage";
-            "privileges.manage": "privileges.manage";
-        }>>;
-    }, z.core.$strip>], "type">>>;
+    }, z.core.$strip>>>;
 }, z.core.$strip>;
 /** HTTPS-authenticated discovery scoped to the user's selected server. */
 export type BrowserOAuthMetadata = z.infer<typeof metadataSchema>;
@@ -75,11 +57,6 @@ export type BrowserOAuthAdmission = {
 export type BrowserCapabilityRequest = {
     readonly required: readonly string[];
     readonly optional: readonly string[];
-    /** Finite RAR requests; the server still enforces client eligibility, administrator authority, and consent. */
-    readonly platformPrivileges?: {
-        readonly required: readonly PlatformPrivilege[];
-        readonly optional: readonly PlatformPrivilege[];
-    };
 };
 /** Registered and CIMD public OAuth clients share this flow and durable custody. */
 export declare class BrowserOAuthClient {
@@ -109,6 +86,4 @@ export declare class BrowserOAuthClient {
     /** Bind the authenticated connection to the retained credential trust root. */
     bindOwner(owner: SessionAuthorityOwner): Promise<void>;
 }
-/** RFC 9449 proof and the authenticated Trellis runtime/NKey extension, signed without exporting the private key. */
-export declare function createBrowserDpopProof(key: Readonly<CryptoKeyPair>, tokenEndpoint: string, runtimeId: string, sessionPublicKey: string, nonce?: string): Promise<string>;
 export {};