@openparachute/vault 0.6.3-rc.4 → 0.6.3-rc.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/vault",
-  "version": "0.6.3-rc.4",
+  "version": "0.6.3-rc.5",
   "description": "Agent-native knowledge graph. Notes, tags, links over MCP.",
   "module": "src/cli.ts",
   "type": "module",
@@ -26,7 +26,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.1",
-    "@openparachute/scope-guard": "^0.4.1",
+    "@openparachute/scope-guard": "^0.5.0",
     "jose": "^6.2.2",
     "otpauth": "^9.5.0",
     "qrcode-terminal": "^0.12.0"

package/src/hub-jwt.test.ts

@@ -21,6 +21,7 @@ import {
   looksLikeJwt,
   getHubOrigin,
   getJwksOrigin,
+  parseHubOrigins,
 } from "./hub-jwt.ts";
 
 interface Keypair {
@@ -121,6 +122,7 @@ let fixture: JwksFixture;
 let kp: Keypair;
 let prevHubOrigin: string | undefined;
 let prevJwksOrigin: string | undefined;
+let prevHubOrigins: string | undefined;
 
 beforeAll(async () => {
   fixture = startJwksFixture();
@@ -134,6 +136,8 @@ afterAll(() => {
   else process.env.PARACHUTE_HUB_ORIGIN = prevHubOrigin;
   if (prevJwksOrigin === undefined) delete process.env.PARACHUTE_HUB_JWKS_ORIGIN;
   else process.env.PARACHUTE_HUB_JWKS_ORIGIN = prevJwksOrigin;
+  if (prevHubOrigins === undefined) delete process.env.PARACHUTE_HUB_ORIGINS;
+  else process.env.PARACHUTE_HUB_ORIGINS = prevHubOrigins;
 });
 
 beforeEach(() => {
@@ -143,8 +147,12 @@ beforeEach(() => {
   // the loopback default (no JWKS server there) and every case would fail.
   prevHubOrigin = process.env.PARACHUTE_HUB_ORIGIN;
   prevJwksOrigin = process.env.PARACHUTE_HUB_JWKS_ORIGIN;
+  prevHubOrigins = process.env.PARACHUTE_HUB_ORIGINS;
   process.env.PARACHUTE_HUB_ORIGIN = fixture.origin;
   process.env.PARACHUTE_HUB_JWKS_ORIGIN = fixture.origin;
+  // Default each case to the single-origin (env-unset) world so the multi-origin
+  // iss-set is opt-in per test — unrelated cases stay byte-identical to before.
+  delete process.env.PARACHUTE_HUB_ORIGINS;
   fixture.setUnreachable(false);
   fixture.setKeys([kp]);
   resetJwksCache();
@@ -168,6 +176,28 @@ describe("looksLikeJwt", () => {
   });
 });
 
+describe("parseHubOrigins — multi-origin iss-set (hub#692)", () => {
+  test("undefined → [] (back-compat: env unset collapses to single hubOrigin)", () => {
+    expect(parseHubOrigins(undefined)).toEqual([]);
+  });
+
+  test("empty string → []", () => {
+    expect(parseHubOrigins("")).toEqual([]);
+  });
+
+  test("splits, trims, strips trailing slash, drops empties, dedupes", () => {
+    // "a,b/, ,a" → [a, b]: trailing slash off b, blank entry dropped, dup a collapsed.
+    expect(parseHubOrigins("https://a.example,https://b.example/, ,https://a.example")).toEqual([
+      "https://a.example",
+      "https://b.example",
+    ]);
+  });
+
+  test("whitespace-only entries are dropped", () => {
+    expect(parseHubOrigins("  ,  ,  ")).toEqual([]);
+  });
+});
+
 describe("origin resolvers — iss/jwks split (vault#464)", () => {
   test("getHubOrigin honors PARACHUTE_HUB_ORIGIN (iss-validation origin)", () => {
     process.env.PARACHUTE_HUB_ORIGIN = "https://vault.example.com/";
@@ -226,6 +256,56 @@ describe("origin resolvers — iss/jwks split (vault#464)", () => {
   });
 });
 
+describe("validateHubJwt — multi-origin iss-set (hub#692)", () => {
+  // A second + third origin that are NOT the canonical PARACHUTE_HUB_ORIGIN.
+  // Every token here is signed by the SAME published key (`kp`), so the
+  // signature always verifies — the ONLY variable under test is whether the
+  // token's `iss` is in the accepted set. JWKS + revocation stay served by the
+  // default `fixture`, reached as both the iss origin and the jwks origin.
+  const SECOND = "https://second.example";
+  const THIRD = "https://third.example";
+
+  test("token issued by a SECOND origin validates when that origin is in PARACHUTE_HUB_ORIGINS", async () => {
+    process.env.PARACHUTE_HUB_ORIGIN = fixture.origin; // canonical (also JWKS host)
+    process.env.PARACHUTE_HUB_ORIGINS = `${fixture.origin},${SECOND}`;
+    resetJwksCache();
+    const token = await signJwt(kp, { iss: SECOND });
+    const claims = await validateHubJwt(token);
+    expect(claims.sub).toBe("user-1");
+  });
+
+  test("the canonical origin still validates when PARACHUTE_HUB_ORIGINS lists a different second origin", async () => {
+    // The resolved hubOrigin is always added to the set, so a token minted under
+    // the canonical origin keeps validating even when the env names only others.
+    process.env.PARACHUTE_HUB_ORIGIN = fixture.origin;
+    process.env.PARACHUTE_HUB_ORIGINS = SECOND; // env need not include the canonical
+    resetJwksCache();
+    const token = await signJwt(kp, { iss: fixture.origin });
+    const claims = await validateHubJwt(token);
+    expect(claims.sub).toBe("user-1");
+  });
+
+  test("token issued by a THIRD, unlisted origin is rejected even with PARACHUTE_HUB_ORIGINS set", async () => {
+    process.env.PARACHUTE_HUB_ORIGIN = fixture.origin;
+    process.env.PARACHUTE_HUB_ORIGINS = `${fixture.origin},${SECOND}`;
+    resetJwksCache();
+    const token = await signJwt(kp, { iss: THIRD });
+    await expect(validateHubJwt(token)).rejects.toThrow(/verification failed/);
+  });
+
+  test("back-compat: with PARACHUTE_HUB_ORIGINS UNSET only the canonical origin validates; a second origin is rejected", async () => {
+    delete process.env.PARACHUTE_HUB_ORIGINS;
+    process.env.PARACHUTE_HUB_ORIGIN = fixture.origin;
+    resetJwksCache();
+    // canonical iss → accepted
+    const ok = await signJwt(kp, { iss: fixture.origin });
+    expect((await validateHubJwt(ok)).sub).toBe("user-1");
+    // the same SECOND origin that WOULD pass when listed → rejected when unset
+    const bad = await signJwt(kp, { iss: SECOND });
+    await expect(validateHubJwt(bad)).rejects.toThrow(/verification failed/);
+  });
+});
+
 describe("validateHubJwt — happy path", () => {
   test("valid JWT with correct iss → claims surface", async () => {
     const token = await signJwt(kp, { iss: fixture.origin, scope: "vault:work:read vault:work:write" });

package/src/hub-jwt.ts

@@ -65,6 +65,37 @@ export function getJwksOrigin(): string {
   return DEFAULT_HUB_LOOPBACK;
 }
 
+/**
+ * Parse the hub's comma-separated legitimate-origin SET from
+ * `PARACHUTE_HUB_ORIGINS` into a clean string array. Mirrors the hub's own
+ * `parseHubOrigins` semantics: split on `,`, trim each, strip a trailing
+ * slash, drop empties, dedupe. We write the ~6-line helper locally rather than
+ * import from a private hub path.
+ *
+ * The multi-origin iss-set (onboarding-streamline 2026-06-25, hub#692): one box
+ * reachable on several URLs at once (loopback + `<ip>.sslip.io` + a custom
+ * domain) mints tokens whose `iss` is whichever origin the request arrived on.
+ * The signing KEY is stable and origin-independent, so a token minted under
+ * URL-A must validate when this resource is reached via URL-B on the SAME box.
+ * The hub publishes its legitimate-origin set here (out-of-band, never from an
+ * unvalidated request Host); scope-guard layers it on top of the signature
+ * verify, never as a substitute for it.
+ *
+ * BACK-COMPAT INVARIANT: when `PARACHUTE_HUB_ORIGINS` is UNSET this returns
+ * `[]`. scope-guard's `resolveAcceptedIssuers` sees an empty set and collapses
+ * to the single canonical `getHubOrigin()` — byte-identical to today. A vault
+ * that never receives the new env var behaves exactly as before.
+ */
+export function parseHubOrigins(raw: string | undefined): string[] {
+  if (!raw) return [];
+  const seen = new Set<string>();
+  for (const part of raw.split(",")) {
+    const origin = part.trim().replace(/\/$/, "");
+    if (origin.length > 0) seen.add(origin);
+  }
+  return Array.from(seen);
+}
+
 // Process-wide guard. The resolver form lets tests flip
 // `PARACHUTE_HUB_ORIGIN` / `PARACHUTE_HUB_JWKS_ORIGIN` between cases — the lib
 // re-resolves on every `validateHubJwt` and `resetJwksCache` call so the
@@ -79,6 +110,12 @@ export function getJwksOrigin(): string {
 const guard = createScopeGuard({
   hubOrigin: () => getHubOrigin(),
   jwksOrigin: () => getJwksOrigin(),
+  // Multi-origin iss-set (hub#692): accept the hub's full legitimate-origin set
+  // (published via PARACHUTE_HUB_ORIGINS), not just the single PARACHUTE_HUB_ORIGIN.
+  // Re-evaluated per call so an operator widening the box's origins is picked up
+  // without a vault restart. When the env var is unset → `[]` → scope-guard
+  // collapses to the single canonical hubOrigin (byte-identical to before).
+  allowedIssuers: () => parseHubOrigins(process.env.PARACHUTE_HUB_ORIGINS),
 });
 
 /**