@opensyber/tokenforge 0.1.2 → 1.1.0

package/dist/server/middleware.d.ts

@@ -13,6 +13,15 @@ export interface TokenForgeOptions {
     allowThreshold?: number;
     /** Trust score threshold for step-up (default: 40). */
     stepUpThreshold?: number;
+    /**
+     * Behavior when the request cannot be positively verified — missing TF
+     * headers on a protected path, or an unreachable/erroring TokenForge API.
+     *
+     * - `'closed'` (default): default-deny. Reject with 401 (missing binding)
+     *   or 503 (backend unavailable). Bulletproof posture.
+     * - `'open'`: legacy fail-open — degrade through. Staged rollout only.
+     */
+    failMode?: 'closed' | 'open';
 }
 /**
  * TokenForge Hono middleware — verifies device-bound sessions via the
@@ -23,6 +32,21 @@ export interface TokenForgeOptions {
  * @returns Hono middleware handler.
  */
 export declare function tokenForgeMiddleware(options: TokenForgeOptions): MiddlewareHandler;
+/**
+ * Per-route step-up gate. Use after `tokenForgeMiddleware` to require a
+ * higher trust score on sensitive routes than the global allow threshold.
+ *
+ * ```ts
+ * app.use(tokenForgeMiddleware({ apiKey }));
+ * app.use('/admin/*', requireFreshSig({ minTrustScore: 90 }));
+ * ```
+ *
+ * Responds with 403 `elevated_trust_required` when the cached `tf` context
+ * is missing or below the threshold.
+ */
+export declare function requireFreshSig(opts?: {
+    minTrustScore?: number;
+}): MiddlewareHandler;
 /** @internal */
 export declare function shouldSkip(path: string, skipPaths?: string[]): boolean;
 /** @internal */

package/dist/server/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/server/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI7D,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAcD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,GACzB,iBAAiB,CAgFnB;AAED,gBAAgB;AAChB,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAMtE;AAED,gBAAgB;AAChB,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,OAAO,CAaT"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/","sources":["server/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI7D,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC9B;AAcD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,GACzB,iBAAiB,CAwGnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,iBAAiB,CAcxF;AAsBD,gBAAgB;AAChB,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAMtE;AAED,gBAAgB;AAChB,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,OAAO,CAaT"}

package/dist/server/middleware.js

@@ -11,6 +11,7 @@ export function tokenForgeMiddleware(options) {
     const apiBase = options.apiBase ?? DEFAULT_API_BASE;
     const allowThreshold = options.allowThreshold ?? 80;
     const stepUpThreshold = options.stepUpThreshold ?? 40;
+    const failMode = options.failMode ?? 'closed';
     return async (c, next) => {
         if (shouldSkip(c.req.path, options.skipPaths))
             return next();
@@ -20,30 +21,52 @@ export function tokenForgeMiddleware(options) {
             timestamp: c.req.header('X-TF-Timestamp') ?? null,
             deviceId: c.req.header('X-TF-Device-ID') ?? null,
         };
+        // Default-deny: a protected path (not in skipPaths) with no TF headers
+        // cannot be verified. Reject locally before spending an API round-trip.
+        if (!headers.signature || !headers.nonce || !headers.timestamp || !headers.deviceId) {
+            if (failMode === 'open') {
+                c.set('tf', { bound: false, trustScore: 0, deviceId: null });
+                return next();
+            }
+            return c.json({
+                error: 'device_binding_required',
+                action: 'bind',
+                message: 'This operation requires device verification',
+            }, 401);
+        }
         // Call TokenForge API for verification
-        const res = await fetch(`${apiBase}/v1/edge/verify`, {
-            method: 'POST',
-            headers: {
-                Authorization: `Bearer ${options.apiKey}`,
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-                path: c.req.path,
-                method: c.req.method,
-                headers,
-                ipAddress: c.req.header('cf-connecting-ip')
-                    ?? c.req.header('x-forwarded-for') ?? '',
-                countryCode: c.req.header('cf-ipcountry') ?? '',
-                userAgent: c.req.header('user-agent') ?? '',
-            }),
-        });
+        let res;
+        try {
+            res = await fetch(`${apiBase}/v1/edge/verify`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${options.apiKey}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    path: c.req.path,
+                    method: c.req.method,
+                    headers,
+                    ipAddress: c.req.header('cf-connecting-ip')
+                        ?? c.req.header('x-forwarded-for') ?? '',
+                    countryCode: c.req.header('cf-ipcountry') ?? '',
+                    userAgent: c.req.header('user-agent') ?? '',
+                }),
+            });
+        }
+        catch (err) {
+            // Network failure reaching the verification backend.
+            return handleUnavailable(c, next, failMode, `fetch: ${String(err)}`);
+        }
         if (!res.ok) {
-            // API unreachable — degrade gracefully
-            console.error('[TokenForge] API error:', res.status);
-            c.set('tf', { bound: false, trustScore: 0, deviceId: null });
-            return next();
+            return handleUnavailable(c, next, failMode, `status ${res.status}`);
         }
         const { data } = (await res.json());
+        // Backend could not complete verification. Under fail-closed this must
+        // NOT pass — an unverifiable session is treated as unavailable.
+        if (data.status === 'degraded') {
+            return handleUnavailable(c, next, failMode, 'edge_degraded');
+        }
         if (data.status === 'block') {
             return c.json({
                 error: 'session_blocked',
@@ -77,6 +100,50 @@ export function tokenForgeMiddleware(options) {
         await next();
     };
 }
+/**
+ * Per-route step-up gate. Use after `tokenForgeMiddleware` to require a
+ * higher trust score on sensitive routes than the global allow threshold.
+ *
+ * ```ts
+ * app.use(tokenForgeMiddleware({ apiKey }));
+ * app.use('/admin/*', requireFreshSig({ minTrustScore: 90 }));
+ * ```
+ *
+ * Responds with 403 `elevated_trust_required` when the cached `tf` context
+ * is missing or below the threshold.
+ */
+export function requireFreshSig(opts = {}) {
+    const min = opts.minTrustScore ?? 90;
+    return async (c, next) => {
+        const tf = c.get('tf');
+        const score = tf?.trustScore ?? 0;
+        if (score < min) {
+            return c.json({
+                error: 'elevated_trust_required',
+                action: 'step_up_required',
+                trustScore: score,
+            }, 403);
+        }
+        await next();
+    };
+}
+/**
+ * Handle an unverifiable request caused by a backend failure (network error,
+ * non-2xx, or `degraded` verdict). Fail-closed → 503; fail-open → proceed.
+ * @internal
+ */
+function handleUnavailable(c, next, failMode, detail) {
+    console.error('[TokenForge] verification unavailable:', detail);
+    if (failMode === 'open') {
+        c.set('tf', { bound: false, trustScore: 0, deviceId: null });
+        return next();
+    }
+    return c.json({
+        error: 'verification_unavailable',
+        action: 'retry',
+        message: 'Session verification is temporarily unavailable',
+    }, 503);
+}
 /** @internal */
 export function shouldSkip(path, skipPaths) {
     if (!skipPaths)

package/dist/server/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/server/middleware.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AA8BlE;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA0B;IAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IAEtD,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAE7D,MAAM,OAAO,GAAG;YACd,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;YACjD,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI;YACzC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;YACjD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;SACjD,CAAC;QAEF,uCAAuC;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;gBACzC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;gBAChB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;gBACpB,OAAO;gBACP,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC;uBACtC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;gBAC1C,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;gBAC/C,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;aAC5C,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,uCAAuC;YACvC,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAE1D,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClE,OAAO,CAAC,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,yBAAyB;oBAChC,MAAM,EAAE,kBAAkB;oBAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,EAAE,GAAG,CAAC,CAAC;YACV,CAAC;YACD,oDAAoD;QACtD,CAAC;QAED,IACE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;eAC1D,IAAI,CAAC,UAAU,GAAG,EAAE,EACvB,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QAEH,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAoB;IAC3D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,KAAK,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,MAAc,EACd,YAAuB;IAEvB,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QAC9B,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YACjD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"../src/","sources":["server/middleware.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAuClE;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA0B;IAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IACpD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAE9C,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAE7D,MAAM,OAAO,GAAG;YACd,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;YACjD,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI;YACzC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;YACjD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI;SACjD,CAAC;QAEF,uEAAuE;QACvE,wEAAwE;QACxE,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACpF,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7D,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,6CAA6C;aACvD,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,uCAAuC;QACvC,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;oBACzC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;oBAChB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;oBACpB,OAAO;oBACP,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC;2BACtC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE;oBAC1C,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;oBAC/C,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;iBAC5C,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qDAAqD;YACrD,OAAO,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAE1D,uEAAuE;QACvE,gEAAgE;QAChE,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClE,OAAO,CAAC,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,yBAAyB;oBAChC,MAAM,EAAE,kBAAkB;oBAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,EAAE,GAAG,CAAC,CAAC;YACV,CAAC;YACD,oDAAoD;QACtD,CAAC;QAED,IACE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;eAC1D,IAAI,CAAC,UAAU,GAAG,EAAE,EACvB,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QAEH,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,OAAmC,EAAE;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACrC,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAwC,CAAC;QAC9D,MAAM,KAAK,GAAG,EAAE,EAAE,UAAU,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,KAAK;aAClB,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,CAAU,EAAE,IAAU,EAAE,QAA2B,EAAE,MAAc;IAEnE,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,KAAK,EAAE,0BAA0B;QACjC,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,iDAAiD;KAC3D,EAAE,GAAG,CAAC,CAAC;AACV,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAoB;IAC3D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,KAAK,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,MAAc,EACd,YAAuB;IAEvB,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QAC9B,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YACjD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/oidc-verify.d.ts

@@ -0,0 +1,71 @@
+/**
+ * OIDC ID-token verifier (Sprint 40 — workforce mode).
+ *
+ * Verifies an OIDC ID token against an IdP's JWKS by `kid`. Supports
+ * RS256 + ES256 — the algorithms that Okta, Entra, Google Workspace,
+ * and Auth0 ship by default. Stateless: the JWKS is passed in, so
+ * caching/HTTP lives one layer up (see jwks-cache.ts).
+ *
+ * Validates signature, `iss`, `aud`, `exp`, `nbf`, `iat`. Returns the
+ * verified claims so the caller can extract `sub` and link it to a
+ * subject row before issuing a DBSC challenge.
+ */
+export interface OidcClaims {
+    iss: string;
+    sub: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+    nbf?: number;
+    email?: string;
+    name?: string;
+    groups?: string[];
+    /** Google Workspace hosted domain. Absent for personal Google accounts. */
+    hd?: string;
+    [key: string]: unknown;
+}
+export interface JwksKey {
+    kid: string;
+    kty: 'RSA' | 'EC';
+    alg?: string;
+    use?: string;
+    n?: string;
+    e?: string;
+    crv?: string;
+    x?: string;
+    y?: string;
+}
+export interface VerifyOidcOptions {
+    /**
+     * Accepted `iss` value(s). A list is required because Google issues ID tokens
+     * with either `https://accounts.google.com` or the bare `accounts.google.com`
+     * — both documented as valid — so strict equality against one form rejects
+     * a large share of legitimate Google tokens.
+     */
+    expectedIssuer: string | string[];
+    expectedAudience: string;
+    /**
+     * Required Google Workspace hosted domain (`hd` claim). When set, a token
+     * without a matching `hd` is rejected: a Workspace app that skips this check
+     * accepts any Google account, including personal gmail.com, as a verified
+     * corporate identity.
+     */
+    expectedHostedDomain?: string;
+    jwks: {
+        keys: JwksKey[];
+    };
+    /** Override for tests. */
+    now?: Date;
+    /** Clock skew tolerance in seconds (default 60). */
+    clockSkewSeconds?: number;
+}
+export type VerifyOidcResult = {
+    ok: true;
+    claims: OidcClaims;
+    protectedHeader: Record<string, unknown>;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function verifyOidcIdToken(jwt: string, opts: VerifyOidcOptions): Promise<VerifyOidcResult>;
+//# sourceMappingURL=oidc-verify.d.ts.map

package/dist/server/oidc-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-verify.d.ts","sourceRoot":"../src/","sources":["server/oidc-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,2EAA2E;IAC3E,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,KAAK,GAAG,IAAI,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAC1B,0BAA0B;IAC1B,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,oDAAoD;IACpD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC1E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAIlC,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAkE3B"}

package/dist/server/oidc-verify.js

@@ -0,0 +1,115 @@
+/**
+ * OIDC ID-token verifier (Sprint 40 — workforce mode).
+ *
+ * Verifies an OIDC ID token against an IdP's JWKS by `kid`. Supports
+ * RS256 + ES256 — the algorithms that Okta, Entra, Google Workspace,
+ * and Auth0 ship by default. Stateless: the JWKS is passed in, so
+ * caching/HTTP lives one layer up (see jwks-cache.ts).
+ *
+ * Validates signature, `iss`, `aud`, `exp`, `nbf`, `iat`. Returns the
+ * verified claims so the caller can extract `sub` and link it to a
+ * subject row before issuing a DBSC challenge.
+ */
+const SUPPORTED_ALGS = new Set(['RS256', 'ES256']);
+export async function verifyOidcIdToken(jwt, opts) {
+    const parts = jwt.split('.');
+    if (parts.length !== 3)
+        return { ok: false, reason: 'jwt_malformed' };
+    const [headerB64, payloadB64, sigB64] = parts;
+    let header;
+    let claims;
+    try {
+        header = JSON.parse(b64UrlDecodeString(headerB64));
+        claims = JSON.parse(b64UrlDecodeString(payloadB64));
+    }
+    catch {
+        return { ok: false, reason: 'jwt_malformed' };
+    }
+    const alg = header.alg;
+    const kid = header.kid;
+    if (typeof alg !== 'string' || !SUPPORTED_ALGS.has(alg)) {
+        return { ok: false, reason: 'jwt_unsupported_alg' };
+    }
+    if (typeof kid !== 'string')
+        return { ok: false, reason: 'jwt_missing_kid' };
+    const key = opts.jwks.keys.find((k) => k.kid === kid);
+    if (!key)
+        return { ok: false, reason: 'jwks_kid_not_found' };
+    const acceptedIssuers = Array.isArray(opts.expectedIssuer)
+        ? opts.expectedIssuer
+        : [opts.expectedIssuer];
+    if (!acceptedIssuers.includes(claims.iss))
+        return { ok: false, reason: 'iss_mismatch' };
+    if (opts.expectedHostedDomain) {
+        if (claims.hd !== opts.expectedHostedDomain) {
+            return { ok: false, reason: 'hosted_domain_mismatch' };
+        }
+    }
+    const audMatch = Array.isArray(claims.aud)
+        ? claims.aud.includes(opts.expectedAudience)
+        : claims.aud === opts.expectedAudience;
+    if (!audMatch)
+        return { ok: false, reason: 'aud_mismatch' };
+    const now = opts.now ?? new Date();
+    const nowSec = Math.floor(now.getTime() / 1000);
+    const skew = opts.clockSkewSeconds ?? 60;
+    if (typeof claims.exp !== 'number' || claims.exp + skew < nowSec) {
+        return { ok: false, reason: 'jwt_expired' };
+    }
+    if (typeof claims.nbf === 'number' && claims.nbf - skew > nowSec) {
+        return { ok: false, reason: 'jwt_not_yet_valid' };
+    }
+    if (typeof claims.iat !== 'number' || claims.iat - skew > nowSec) {
+        return { ok: false, reason: 'jwt_future_iat' };
+    }
+    const cryptoKey = await importJwk(key, alg);
+    if (!cryptoKey)
+        return { ok: false, reason: 'jwks_bad_key' };
+    const signingInput = toAb(new TextEncoder().encode(`${headerB64}.${payloadB64}`));
+    const signatureBytes = base64UrlToBytes(sigB64);
+    if (!signatureBytes)
+        return { ok: false, reason: 'jwt_bad_signature' };
+    const signature = toAb(signatureBytes);
+    const verified = alg === 'RS256'
+        ? await crypto.subtle.verify('RSASSA-PKCS1-v1_5', cryptoKey, signature, signingInput)
+        : await crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, cryptoKey, signature, signingInput);
+    if (!verified)
+        return { ok: false, reason: 'jwt_bad_signature' };
+    return { ok: true, claims, protectedHeader: header };
+}
+async function importJwk(key, alg) {
+    try {
+        if (alg === 'RS256') {
+            return await crypto.subtle.importKey('jwk', { kty: key.kty, n: key.n, e: key.e, alg, ext: true }, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['verify']);
+        }
+        return await crypto.subtle.importKey('jwk', { kty: key.kty, crv: key.crv, x: key.x, y: key.y, ext: true }, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
+    }
+    catch {
+        return null;
+    }
+}
+function b64UrlDecodeString(b64) {
+    const s = b64.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = s + '='.repeat((4 - (s.length % 4)) % 4);
+    return atob(padded);
+}
+function toAb(u8) {
+    const buf = new ArrayBuffer(u8.byteLength);
+    new Uint8Array(buf).set(u8);
+    return buf;
+}
+function base64UrlToBytes(b64) {
+    const s = b64.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = s + '='.repeat((4 - (s.length % 4)) % 4);
+    try {
+        const bin = atob(padded);
+        const out = new Uint8Array(bin.length);
+        for (let i = 0; i < bin.length; i++)
+            out[i] = bin.charCodeAt(i);
+        return out;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=oidc-verify.js.map

package/dist/server/oidc-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-verify.js","sourceRoot":"../src/","sources":["server/oidc-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwDH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,IAAuB;IAEvB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACtE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAiC,CAAC;IAE1E,IAAI,MAA+B,CAAC;IACpC,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAe,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE7E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAE7D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;QACxD,CAAC,CAAC,IAAI,CAAC,cAAc;QACrB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1B,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAExF,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,gBAAgB,CAAC;IACzC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAE5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;IACzC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAE7D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IAEvC,MAAM,QAAQ,GAAG,GAAG,KAAK,OAAO;QAC9B,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC;QACrF,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACvG,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAEjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAY,EAAE,GAAW;IAChD,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAgB,EAClE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAgB,EAC3E,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,IAAI,CAAC,EAAc;IAC1B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/server/policy.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Policy DSL evaluator (Sprint 38).
+ *
+ * Each policy is a JSON object: { if_any?: Rule[]; if_all?: Rule[]; then: Action }.
+ * Rules are predicate atoms over a flat `PolicyContext` describing the
+ * current refresh attempt. The evaluator is pure and synchronous — no
+ * IO, no time, no surprises — so it stays unit-testable and safe to
+ * call inside the request critical path.
+ *
+ * Action precedence: block > revoke_session > step_up > allow.
+ * Multiple policies for the same tenant are folded with `combineActions`
+ * so the most restrictive verdict wins.
+ */
+export type PolicyAction = 'allow' | 'step_up' | 'block' | 'revoke_session';
+export interface PolicyContext {
+    geoCountry: string | null;
+    asn: string | null;
+    bindingClass: 'native_dbsc' | 'webauthn' | 'webcrypto' | null;
+    signals: string[];
+    sensitivePath: boolean;
+    isoHour: number;
+}
+export type Rule = {
+    geo_country_in: string[];
+} | {
+    geo_country_not_in: string[];
+} | {
+    asn_in: string[];
+} | {
+    binding_class: PolicyContext['bindingClass'];
+} | {
+    has_signal: string;
+} | {
+    sensitive_path: boolean;
+} | {
+    hour_between: [number, number];
+};
+export interface Policy {
+    if_any?: Rule[];
+    if_all?: Rule[];
+    then: PolicyAction;
+}
+export declare function evaluatePolicy(policy: Policy, ctx: PolicyContext): PolicyAction;
+export declare function evaluatePolicies(policies: Policy[], ctx: PolicyContext): PolicyAction;
+export declare function combineActions(a: PolicyAction, b: PolicyAction): PolicyAction;
+export declare function parsePolicyRules(raw: string): Policy | null;
+//# sourceMappingURL=policy.d.ts.map

package/dist/server/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"../src/","sources":["server/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,gBAAgB,CAAC;AAE5E,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,YAAY,EAAE,aAAa,GAAG,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC;IAC9D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,IAAI,GACZ;IAAE,cAAc,EAAE,MAAM,EAAE,CAAA;CAAE,GAC5B;IAAE,kBAAkB,EAAE,MAAM,EAAE,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GACpB;IAAE,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,CAAA;CAAE,GAChD;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GACtB;IAAE,cAAc,EAAE,OAAO,CAAA;CAAE,GAC3B;IAAE,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,MAAM;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;CACpB;AASD,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CAU/E;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CAIrF;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,GAAG,YAAY,CAE7E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAc3D"}

package/dist/server/policy.js

@@ -0,0 +1,84 @@
+/**
+ * Policy DSL evaluator (Sprint 38).
+ *
+ * Each policy is a JSON object: { if_any?: Rule[]; if_all?: Rule[]; then: Action }.
+ * Rules are predicate atoms over a flat `PolicyContext` describing the
+ * current refresh attempt. The evaluator is pure and synchronous — no
+ * IO, no time, no surprises — so it stays unit-testable and safe to
+ * call inside the request critical path.
+ *
+ * Action precedence: block > revoke_session > step_up > allow.
+ * Multiple policies for the same tenant are folded with `combineActions`
+ * so the most restrictive verdict wins.
+ */
+const PRECEDENCE = {
+    allow: 0,
+    step_up: 1,
+    revoke_session: 2,
+    block: 3,
+};
+export function evaluatePolicy(policy, ctx) {
+    const anyRules = policy.if_any ?? [];
+    const allRules = policy.if_all ?? [];
+    const anyMatch = anyRules.length > 0 && anyRules.some((r) => evalRule(r, ctx));
+    const allMatch = allRules.length > 0 && allRules.every((r) => evalRule(r, ctx));
+    const conditionTriggered = (anyRules.length > 0 && anyMatch) ||
+        (allRules.length > 0 && allMatch) ||
+        (anyRules.length === 0 && allRules.length === 0);
+    return conditionTriggered ? policy.then : 'allow';
+}
+export function evaluatePolicies(policies, ctx) {
+    return policies
+        .map((p) => evaluatePolicy(p, ctx))
+        .reduce(combineActions, 'allow');
+}
+export function combineActions(a, b) {
+    return PRECEDENCE[a] >= PRECEDENCE[b] ? a : b;
+}
+export function parsePolicyRules(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== 'object')
+            return null;
+        const p = parsed;
+        if (p.then !== 'allow' && p.then !== 'step_up' && p.then !== 'block' && p.then !== 'revoke_session') {
+            return null;
+        }
+        if (p.if_any !== undefined && !Array.isArray(p.if_any))
+            return null;
+        if (p.if_all !== undefined && !Array.isArray(p.if_all))
+            return null;
+        return p;
+    }
+    catch {
+        return null;
+    }
+}
+function evalRule(rule, ctx) {
+    if ('geo_country_in' in rule) {
+        return ctx.geoCountry !== null && rule.geo_country_in.includes(ctx.geoCountry);
+    }
+    if ('geo_country_not_in' in rule) {
+        return ctx.geoCountry !== null && !rule.geo_country_not_in.includes(ctx.geoCountry);
+    }
+    if ('asn_in' in rule) {
+        return ctx.asn !== null && rule.asn_in.includes(ctx.asn);
+    }
+    if ('binding_class' in rule) {
+        return ctx.bindingClass === rule.binding_class;
+    }
+    if ('has_signal' in rule) {
+        return ctx.signals.includes(rule.has_signal);
+    }
+    if ('sensitive_path' in rule) {
+        return ctx.sensitivePath === rule.sensitive_path;
+    }
+    if ('hour_between' in rule) {
+        const [start, end] = rule.hour_between;
+        if (start <= end)
+            return ctx.isoHour >= start && ctx.isoHour < end;
+        return ctx.isoHour >= start || ctx.isoHour < end;
+    }
+    return false;
+}
+//# sourceMappingURL=policy.js.map

package/dist/server/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"../src/","sources":["server/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA4BH,MAAM,UAAU,GAAiC;IAC/C,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,CAAC;IACV,cAAc,EAAE,CAAC;IACjB,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,GAAkB;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAChF,MAAM,kBAAkB,GACtB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC;QACjC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC;QACjC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IACnD,OAAO,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAkB,EAAE,GAAkB;IACrE,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAClC,MAAM,CAAe,cAAc,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAAe,EAAE,CAAe;IAC7D,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,CAAC,GAAG,MAAyB,CAAC;QACpC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACpG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,OAAO,CAAW,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAU,EAAE,GAAkB;IAC9C,IAAI,gBAAgB,IAAI,IAAI,EAAE,CAAC;QAC7B,OAAO,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,oBAAoB,IAAI,IAAI,EAAE,CAAC;QACjC,OAAO,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,aAAa,CAAC;IACjD,CAAC;IACD,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,gBAAgB,IAAI,IAAI,EAAE,CAAC;QAC7B,OAAO,GAAG,CAAC,aAAa,KAAK,IAAI,CAAC,cAAc,CAAC;IACnD,CAAC;IACD,IAAI,cAAc,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;QACvC,IAAI,KAAK,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,OAAO,IAAI,KAAK,IAAI,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;QACnE,OAAO,GAAG,CAAC,OAAO,IAAI,KAAK,IAAI,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/server/step-up-policy.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Per-action step-up policy (Sprint 39).
+ *
+ * Tenant-scoped JSON config describing which routes require fresh PoP
+ * (a recent action-signing JWS) vs WebAuthn re-prompt vs nothing
+ * special. Will eventually live on `tf_tenants.stepUpActions` (per
+ * CISCO-dua spec) — schema migration pending. The pure logic here
+ * is independent of where the actions blob is stored.
+ *
+ * Shape (validated by `parseStepUpActions`):
+ *   [
+ *     { path: '/checkout',  requireFreshSig: true,  freshSigMaxAgeSec: 60 },
+ *     { path: '/admin/*',   requireFreshSig: true,  freshSigMaxAgeSec: 30, requireWebAuthn: true },
+ *     { path: '/health',    requireFreshSig: false, requireWebAuthn: false }
+ *   ]
+ *
+ * Matching rules:
+ *   - exact path match wins over glob-prefix
+ *   - longest glob-prefix wins among prefix-matches
+ *   - no match → default verdict (no step-up, no WebAuthn, default 60s)
+ */
+export interface StepUpAction {
+    path: string;
+    requireFreshSig?: boolean;
+    freshSigMaxAgeSec?: number;
+    requireWebAuthn?: boolean;
+}
+export interface StepUpVerdict {
+    matched: boolean;
+    requireFreshSig: boolean;
+    freshSigMaxAgeSec: number;
+    requireWebAuthn: boolean;
+}
+export declare function parseStepUpActions(raw: string): StepUpAction[] | null;
+export declare function evaluateStepUpPolicy(actions: readonly StepUpAction[], requestPath: string): StepUpVerdict;
+//# sourceMappingURL=step-up-policy.d.ts.map

package/dist/server/step-up-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-policy.d.ts","sourceRoot":"../src/","sources":["server/step-up-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;CAC1B;AAcD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE,GAAG,IAAI,CA4BrE;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,WAAW,EAAE,MAAM,GAClB,aAAa,CAiBf"}