@oxy.so/core 1.5.1 → 1.6.1

package/dist/cjs/mixins/index.js

@@ -38,7 +38,6 @@ const OxyServices_nodes_1 = require("./OxyServices.nodes");
 const OxyServices_followGraph_1 = require("./OxyServices.followGraph");
 const OxyServices_inference_1 = require("./OxyServices.inference");
 const OxyServices_deviceBoot_1 = require("./OxyServices.deviceBoot");
-const OxyServices_deviceTransfer_1 = require("./OxyServices.deviceTransfer");
 /**
  * Mixin pipeline - applied in order from first to last.
  *
@@ -110,7 +109,6 @@ const MIXIN_PIPELINE = [
     OxyServices_deviceBoot_1.OxyServicesDeviceBootMixin,
     // Device-to-device identity transfer ("add a device"): E2E-encrypted key
     // clone over a short-lived relay (b3 Feature 2).
-    OxyServices_deviceTransfer_1.OxyServicesDeviceTransferMixin,
     // Utility (last, can use all above)
     OxyServices_utility_1.OxyServicesUtilityMixin,
 ];

package/dist/cjs/server/index.js

@@ -17,7 +17,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.signOxyRequesterAssertion = exports.readOxyRequesterAssertionKeyId = exports.oxyRequesterAssertionClaimsSchema = exports.OxyRequesterAssertionError = exports.OXY_REQUESTER_ASSERTION_TYPE = exports.OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS = exports.OXY_REQUESTER_ASSERTION_HEADER = exports.OXY_REQUESTER_ASSERTION_DEFAULT_ISSUER = exports.createOxyRequesterAssertionAuth = exports.createOxyJwksKeyResolver = exports.verifyCapabilityTicket = exports.readCapabilityAuthorization = exports.issueCapabilityTicket = exports.inputSatisfiesCapabilityLimits = exports.createCapabilityTicketMiddleware = exports.CapabilityTicketError = exports.OXY_CSP_BASELINE = exports.inlineScriptCspHash = exports.formatOxyCspPolicy = exports.extractInlineScripts = exports.cspSourcesFor = exports.createOxySecurityHeaders = exports.buildOxyPagesHeaders = exports.buildOxyCspDirectives = exports.createOxyCors = exports.UPSTREAM_HEADERS_TIMEOUT_MS = exports.MAX_URL_LENGTH = exports.MAX_REDIRECTS = exports.DEFAULT_USER_AGENT = exports.BLOCKED_HOSTNAMES = exports.ALLOWED_PROTOCOLS = exports.ALLOWED_PORTS = exports.UpstreamError = exports.SsrfRejection = exports.safeFetch = exports.isBlockedIp = exports.assertSafePublicUrl = exports.createOxyRateLimit = exports.OXY_SERVICE_ENVIRONMENTS = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getRequiredOxyBillingPrincipal = exports.getOxyUserId = exports.getOxyRequestAttribution = exports.getOxyDelegatedUserId = exports.getOxyBillingPrincipal = exports.getOxyAuthRefusal = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = void 0;
-exports.withoutNodeHttpObservation = exports.observeNodeHttp = exports.createEcosystemTraffic = exports.isOfficialWebOrigin = exports.registrableApex = exports.OXY_IDENTITY_CACHE_PREFIXES = exports.oxyUserByIdCacheKey = exports.evictOxyIdentityCache = exports.publishOxyUserInvalidation = exports.createOxyUserInvalidationHandler = exports.verifySecret = exports.verifyOxyRequesterAssertion = void 0;
+exports.requestWorkloadServiceToken = exports.canAttestWorkloadIdentity = exports.withoutNodeHttpObservation = exports.observeNodeHttp = exports.createEcosystemTraffic = exports.isOfficialWebOrigin = exports.registrableApex = exports.OXY_IDENTITY_CACHE_PREFIXES = exports.oxyUserByIdCacheKey = exports.evictOxyIdentityCache = exports.publishOxyUserInvalidation = exports.createOxyUserInvalidationHandler = exports.verifySecret = exports.verifyOxyRequesterAssertion = void 0;
 var auth_1 = require("./auth");
 Object.defineProperty(exports, "createOptionalOxyAuth", { enumerable: true, get: function () { return auth_1.createOptionalOxyAuth; } });
 Object.defineProperty(exports, "createOxyAuthMiddleware", { enumerable: true, get: function () { return auth_1.createOxyAuthMiddleware; } });
@@ -116,3 +116,12 @@ Object.defineProperty(exports, "createEcosystemTraffic", { enumerable: true, get
 var trafficNodeHttp_1 = require("./trafficNodeHttp");
 Object.defineProperty(exports, "observeNodeHttp", { enumerable: true, get: function () { return trafficNodeHttp_1.observeNodeHttp; } });
 Object.defineProperty(exports, "withoutNodeHttpObservation", { enumerable: true, get: function () { return trafficNodeHttp_1.withoutNodeHttpObservation; } });
+/**
+ * Workload identity (ADR 0026): a first-party service asks Oxy for a service
+ * token by proving what it IS, with no api key and no secret. Server-only, and
+ * exported from this subpath rather than the root barrel because it reaches the
+ * container credentials endpoint.
+ */
+var workloadIdentity_1 = require("./workloadIdentity");
+Object.defineProperty(exports, "canAttestWorkloadIdentity", { enumerable: true, get: function () { return workloadIdentity_1.canAttestWorkloadIdentity; } });
+Object.defineProperty(exports, "requestWorkloadServiceToken", { enumerable: true, get: function () { return workloadIdentity_1.requestWorkloadServiceToken; } });

package/dist/cjs/server/securityHeaders.js

@@ -333,9 +333,16 @@ function buildOxyPagesHeaders(options = {}) {
     if (hashes.length > MAX_INLINE_SCRIPT_HASHES) {
         throw new RangeError(`Oxy CSP: ${hashes.length} distinct inline scripts in the built HTML exceeds the ${MAX_INLINE_SCRIPT_HASHES}-hash ceiling. A per-route inline data block (e.g. an Expo Router loader) is the likely cause; allow it deliberately rather than by raising this.`);
     }
-    const csp = formatOxyCspPolicy(buildOxyCspDirectives(hashes.length === 0
+    const directives = buildOxyCspDirectives(hashes.length === 0
         ? options.csp
-        : { ...options.csp, scriptSrc: [...(options.csp?.scriptSrc ?? []), ...hashes] }));
+        : { ...options.csp, scriptSrc: [...(options.csp?.scriptSrc ?? []), ...hashes] });
+    if (options.sensitive) {
+        const beacon = new Set([CLOUDFLARE_INSIGHTS_SCRIPT_ORIGIN, CLOUDFLARE_INSIGHTS_REPORT_ORIGIN]);
+        for (const name of ['script-src', 'connect-src']) {
+            directives[name] = (directives[name] ?? []).filter((source) => !beacon.has(source));
+        }
+    }
+    const csp = formatOxyCspPolicy(directives);
     const lines = [
         '/*',
         `  Content-Security-Policy: ${csp}`,

package/dist/cjs/server/traffic.js

@@ -5,6 +5,12 @@ const trafficNodeHttp_1 = require("./trafficNodeHttp");
 const socket_1 = require("@oxy.so/telemetry/socket");
 const node_crypto_1 = require("node:crypto");
 const OxyServices_1 = require("../OxyServices");
+// Static, unlike the lazy import in `mixins/OxyServices.auth.ts`: that module is
+// reachable from the root barrel, which ships to React Native, so pulling
+// `node:crypto` in eagerly there would cost every mobile bundle. This file is
+// server-only and the server barrel already exports `./workloadIdentity`, so
+// there is nothing here for a phone to load.
+const workloadIdentity_1 = require("./workloadIdentity");
 const collector_1 = require("@oxy.so/telemetry/collector");
 /** Install once per service process, before registering HTTP routes. */
 function createEcosystemTraffic(options) {
@@ -17,9 +23,30 @@ function createEcosystemTraffic(options) {
     }
     const apiKey = activityKey || process.env.OXY_SERVICE_API_KEY;
     const apiSecret = activitySecret || process.env.OXY_SERVICE_API_SECRET;
-    if (!options.credential && (!apiKey || !apiSecret))
-        throw new Error('Ecosystem activity requires OXY_SERVICE_API_KEY and OXY_SERVICE_API_SECRET');
+    /**
+     * Having no key pair is a legitimate configuration now — but only where this
+     * process can prove what it IS (ADR 0026).
+     *
+     * This used to throw on a missing pair, full stop. Every service in the fleet
+     * boots with `OXY_ECOSYSTEM_ACTIVITY_ENABLED=true`, so deleting
+     * `OXY_SERVICE_API_KEY` and `OXY_SERVICE_API_SECRET` from a task definition —
+     * which is the entire migration ADR 0026 asks for — killed the process at
+     * boot. The ECS circuit breaker then rolled the deploy back and reported the
+     * service stable, so the operator saw a rollback with nothing naming its
+     * cause. That is what one line cost, multiplied by fourteen services holding
+     * a secret they no longer need.
+     *
+     * What is still refused: nothing to authenticate with AND nothing to attest.
+     * That is a laptop or a CI box, where the container credentials endpoint is
+     * not going to turn up later, and the honest answer is to say so at boot
+     * rather than to fail on the first heartbeat.
+     */
+    if (!options.credential && (!apiKey || !apiSecret) && !(0, workloadIdentity_1.canAttestWorkloadIdentity)()) {
+        throw new Error('Ecosystem activity needs one of: an OXY_ACTIVITY_API_KEY and OXY_ACTIVITY_API_SECRET pair, an OXY_SERVICE_API_KEY and OXY_SERVICE_API_SECRET pair, or a workload identity this process can attest (ADR 0026).');
+    }
     const oxy = new OxyServices_1.OxyServices({ baseURL });
+    // Left unconfigured when there is no pair on purpose: `getServiceToken()`
+    // attests instead of being handed half a credential to fail on.
     if (apiKey && apiSecret)
         oxy.configureServiceAuth(apiKey, apiSecret);
     const credential = options.credential ?? (() => oxy.getServiceToken());

package/dist/cjs/server/workloadIdentity.js

@@ -0,0 +1,170 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canAttestWorkloadIdentity = canAttestWorkloadIdentity;
+exports.requestWorkloadServiceToken = requestWorkloadServiceToken;
+const node_crypto_1 = require("node:crypto");
+/**
+ * Asking Oxy for a service token by proving what this process IS (ADR 0026).
+ *
+ * The other half of the credential-free path: `packages/api` verifies the proof,
+ * this builds one. A first-party service that calls
+ * {@link requestWorkloadServiceToken} needs no api key, no secret and no entry in
+ * a parameter store — only to be running as itself.
+ *
+ * ## Why this signs SigV4 by hand
+ *
+ * The attestation is a signed `GetCallerIdentity` request that is never sent to
+ * AWS by us; Oxy replays it. Producing one needs credentials and a signature,
+ * and the obvious way to get both is the AWS SDK — which this package must not
+ * depend on. `@oxy.so/core` ships to React Native and Expo, where several
+ * megabytes of AWS client for a call that only ever happens on a server is not a
+ * trade worth making, and the package rules keep optional heavyweights out of
+ * the root barrel for exactly this reason.
+ *
+ * So: credentials come from the container credentials endpoint ECS already
+ * exposes to every task, and the signature is ~40 lines of HMAC out of
+ * `node:crypto`. No dependency, and nothing here is AWS-specific above
+ * {@link awsContainerAttestation} — a second provider is another function with
+ * the same shape.
+ *
+ * ## What this never does
+ *
+ * It never sends the signed request to AWS. It never logs a credential, a
+ * signature or a token. It caches the TOKEN (short-lived, from Oxy) and never
+ * the AWS credentials, which the endpoint hands out fresh anyway.
+ */
+/** The header Oxy's verifier requires inside the signature. Must match `ATTESTATION_NONCE_HEADER`. */
+const NONCE_HEADER = 'x-oxy-attestation-nonce';
+const STS_HOST = 'sts.amazonaws.com';
+const STS_REGION = 'us-east-1';
+const STS_BODY = 'Action=GetCallerIdentity&Version=2011-06-15';
+/**
+ * Whether this process can attest at all.
+ *
+ * The relative URI is set by ECS on every task and by nothing else, so its
+ * presence is the honest test for "we can prove what we are here". A local
+ * checkout has no attestation to offer and must fall back to a credential.
+ */
+function canAttestWorkloadIdentity(env = process.env) {
+    return Boolean(env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || env.AWS_CONTAINER_CREDENTIALS_FULL_URI);
+}
+async function containerCredentials(fetchImpl) {
+    const relative = process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI;
+    const url = relative
+        ? `http://169.254.170.2${relative}`
+        : process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI;
+    if (!url) {
+        throw new Error('No container credentials endpoint: this process cannot attest its identity.');
+    }
+    const response = await fetchImpl(url, {
+        headers: process.env.AWS_CONTAINER_AUTHORIZATION_TOKEN
+            ? { authorization: process.env.AWS_CONTAINER_AUTHORIZATION_TOKEN }
+            : {},
+    });
+    if (!response.ok) {
+        throw new Error(`The container credentials endpoint answered ${response.status}.`);
+    }
+    const credentials = (await response.json());
+    if (!credentials.AccessKeyId || !credentials.SecretAccessKey) {
+        throw new Error('The container credentials endpoint answered without credentials.');
+    }
+    return credentials;
+}
+function hmac(key, data) {
+    return (0, node_crypto_1.createHmac)('sha256', key).update(data, 'utf8').digest();
+}
+function sha256Hex(value) {
+    return (0, node_crypto_1.createHash)('sha256').update(value, 'utf8').digest('hex');
+}
+/**
+ * Signs `GetCallerIdentity` with SigV4, binding the nonce into the signature.
+ *
+ * `SignedHeaders` includes the nonce header deliberately: Oxy refuses an
+ * attestation whose signature does not cover it, because a nonce the signature
+ * does not cover can be swapped by whoever captured the attestation.
+ */
+function signGetCallerIdentity(credentials, nonce, now) {
+    const amzDate = now.toISOString().replace(/[-:]/g, '').replace(/\.\d{3}/, '');
+    const dateStamp = amzDate.slice(0, 8);
+    const headers = {
+        host: STS_HOST,
+        'x-amz-date': amzDate,
+        [NONCE_HEADER]: nonce,
+    };
+    if (credentials.Token)
+        headers['x-amz-security-token'] = credentials.Token;
+    const signedHeaderNames = Object.keys(headers).sort();
+    const canonicalHeaders = signedHeaderNames.map((name) => `${name}:${headers[name]}\n`).join('');
+    const signedHeaders = signedHeaderNames.join(';');
+    const canonicalRequest = [
+        'POST',
+        '/',
+        '',
+        canonicalHeaders,
+        signedHeaders,
+        sha256Hex(STS_BODY),
+    ].join('\n');
+    const scope = `${dateStamp}/${STS_REGION}/sts/aws4_request`;
+    const stringToSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256Hex(canonicalRequest)].join('\n');
+    const signingKey = hmac(hmac(hmac(hmac(`AWS4${credentials.SecretAccessKey}`, dateStamp), STS_REGION), 'sts'), 'aws4_request');
+    const signature = (0, node_crypto_1.createHmac)('sha256', signingKey).update(stringToSign, 'utf8').digest('hex');
+    return {
+        ...headers,
+        authorization: `AWS4-HMAC-SHA256 Credential=${credentials.AccessKeyId}/${scope}, ` +
+            `SignedHeaders=${signedHeaders}, Signature=${signature}`,
+    };
+}
+/** The AWS attestation: signed headers, and nothing else. */
+async function awsContainerAttestation(fetchImpl, nonce) {
+    const credentials = await containerCredentials(fetchImpl);
+    return { headers: signGetCallerIdentity(credentials, nonce, new Date()) };
+}
+/**
+ * Exchanges this process's identity for an Oxy service token.
+ *
+ * Two round trips by design (see ADR 0026): a nonce, then an attestation that
+ * signs it. The caller caches the token — it lives an hour — rather than doing
+ * this per request.
+ *
+ * Failures are thrown, never swallowed into an empty token: a caller that
+ * cannot prove what it is must not go on to make an unauthenticated request and
+ * discover the problem as a 401 somewhere else.
+ */
+async function requestWorkloadServiceToken(options) {
+    const fetchImpl = options.fetch ?? fetch;
+    const base = options.baseUrl.replace(/\/+$/, '');
+    const challengeResponse = await fetchImpl(`${base}/auth/service-token/workload/challenge`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+    });
+    if (!challengeResponse.ok) {
+        throw new Error(`Oxy refused to issue a workload challenge (${challengeResponse.status}).`);
+    }
+    const challenge = unwrap(await challengeResponse.json());
+    if (!challenge?.nonce) {
+        throw new Error('Oxy issued a workload challenge with no nonce.');
+    }
+    const attestation = await awsContainerAttestation(fetchImpl, challenge.nonce);
+    const tokenResponse = await fetchImpl(`${base}/auth/service-token/workload`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ provider: 'aws-iam', nonce: challenge.nonce, attestation }),
+    });
+    if (!tokenResponse.ok) {
+        // The body carries a bounded `reason`; the token never travels on a failure,
+        // so there is nothing here that must not be seen.
+        throw new Error(`Oxy refused the workload attestation (${tokenResponse.status}).`);
+    }
+    const granted = unwrap(await tokenResponse.json());
+    if (!granted?.token || typeof granted.expiresIn !== 'number') {
+        throw new Error('Oxy answered the attestation without a usable token.');
+    }
+    return { token: granted.token, expiresIn: granted.expiresIn, appName: granted.appName ?? '' };
+}
+/** Oxy wraps successful bodies in `{ data }`; older routes answer flat. */
+function unwrap(body) {
+    if (typeof body !== 'object' || body === null)
+        return null;
+    const envelope = body;
+    return (typeof envelope.data === 'object' && envelope.data !== null ? envelope.data : body);
+}

package/dist/cjs/session/refresh.js

@@ -80,6 +80,18 @@ async function refreshDeviceSecretArm(deps) {
                 : await oxy.mintFromDeviceSecret(persisted.deviceId, persisted.deviceSecret);
         }
         catch (error) {
+            // 429 keeps the credential like any other transient failure — the secret
+            // was never judged — but it must NOT retry on the transient cadence. The
+            // request-driven lanes (request-time preflight, 401 retry) reattempt every
+            // second once the access token is expired, which is 60 mints/min against a
+            // 30/min server budget: the client's own retries then hold the limiter
+            // tripped and the session cannot recover while the app keeps making
+            // requests. Telling HttpService lengthens the next cooldown to one attempt
+            // per limiter window, which lets the budget drain and the session heal.
+            if ((0, errorUtils_1.extractErrorStatus)(error) === 429) {
+                oxy.httpService.noteRefreshRateLimited();
+                return { status: 'transient' };
+            }
             if ((0, errorUtils_1.extractErrorStatus)(error) === 401) {
                 // Structural read (not `instanceof Error`): the thrown value can be a
                 // plain ApiError-shaped object or come from another realm.