@oxy.so/core 4.1.0 → 4.3.0

package/src/server/auth.ts

@@ -1,5 +1,6 @@
 import type { NextFunction, Request, RequestHandler, Response } from 'express';
 import type { AuthMiddlewareOptions, OxyAuthRefusal, OxyMiddleware } from './middleware';
+import type { AccountActorChain } from '@oxy.so/contracts';
 import { logger } from '../logger';
 import { OXY_SERVICE_ENVIRONMENTS, type OxyServiceEnvironment } from '../utils/oxyServiceEnvironment';
 
@@ -43,6 +44,12 @@ export interface OxyAuthRequest extends Request {
   sessionId?: string | null;
   serviceApp?: OxyServiceAppContext;
   serviceActingAs?: OxyServiceActingAsContext;
+  /**
+   * Who acted, and as whom, on a USER session — read off the session row by the
+   * Oxy API, never off a header. `null`/absent when the request is not a user
+   * session or the API did not report it. Read it with {@link getOxyActor}.
+   */
+  oxyActor?: AccountActorChain | null;
   /**
    * Why the presented credential was refused, when one was and the request
    * still reached the handler (the optional path). Read it with
@@ -95,6 +102,24 @@ export function getOxyUserId(req: Request): string | null {
   );
 }
 
+/**
+ * Who acted, and as whom, on this user session (issue #1520), or `null` when
+ * the session authority did not report it.
+ *
+ * An audit records `actorAccountId` as the actor and `effectiveAccountId`
+ * (equal to {@link getOxyUserId}) as the account spoken as. A bot acting with
+ * nobody operating it is its own actor; a person acting as an organization or
+ * a bot is the actor of a `delegated` chain. Never substitute the effective
+ * account's owner for either: when this is `null`, record the actor as unknown.
+ */
+export function getOxyActor(req: Request): AccountActorChain | null {
+  const actor = (req as OxyAuthRequest).oxyActor;
+  if (!actor) return null;
+  // Defence in depth: a chain that does not describe the authenticated
+  // subject is not this request's chain.
+  return actor.effectiveAccountId === getOxyUserId(req) ? actor : null;
+}
+
 export function isOxyAuthenticated(req: Request): req is OxyAuthenticatedRequest {
   return getOxyUserId(req) !== null;
 }

package/src/server/capabilityTicket.ts

@@ -7,7 +7,6 @@ import {
 import {
   capabilityTicketClaimsSchema,
   type CapabilityTicketClaims,
-  type GrantLimit,
   type PolicyDecision,
 } from '@oxy.so/contracts';
 import type { NextFunction, Request, RequestHandler, Response } from 'express';
@@ -74,47 +73,6 @@ function decodeJsonSegment(segment: string): unknown {
   }
 }
 
-function valuesAtPath(input: Record<string, unknown>, path: string): unknown[] {
-  let current: unknown[] = [input];
-  for (const segment of path.split('.')) {
-    const next: unknown[] = [];
-    for (const value of current) {
-      const records = Array.isArray(value) ? value : [value];
-      for (const record of records) {
-        if (typeof record !== 'object' || record === null || Array.isArray(record)) continue;
-        if (Object.prototype.hasOwnProperty.call(record, segment)) {
-          next.push((record as Record<string, unknown>)[segment]);
-        }
-      }
-    }
-    if (next.length === 0) return [];
-    current = next;
-  }
-  return current.flatMap((value) => Array.isArray(value) ? value : [value]);
-}
-
-/** Enforces the signed per-action bounds before a domain handler runs. */
-export function inputSatisfiesCapabilityLimits(
-  tool: string,
-  input: Record<string, unknown>,
-  limits: readonly GrantLimit[],
-): boolean {
-  for (const limit of limits) {
-    if (limit.tool !== tool) return false;
-    const actualValues = valuesAtPath(input, limit.key);
-    if (actualValues.length === 0) return false;
-    if (typeof limit.value === 'number') {
-      const maximum = limit.value;
-      if (!actualValues.every((actual) => (
-        typeof actual === 'number' && Number.isFinite(actual) && actual <= maximum
-      ))) return false;
-      continue;
-    }
-    if (!actualValues.every((actual) => actual === limit.value)) return false;
-  }
-  return true;
-}
-
 export function issueCapabilityTicket(
   claims: UnsignedCapabilityTicketClaims,
   options: CapabilityTicketSigningOptions,
@@ -256,3 +214,5 @@ export function createCapabilityTicketMiddleware(
     }
   };
 }
+
+export { inputSatisfiesCapabilityLimits } from '@oxy.so/contracts';

package/src/server/index.ts

@@ -26,6 +26,12 @@ export {
   ServerNotificationsApi,
   ServerReputationApi,
 } from './namespaces';
+export type {
+  CapabilityTicketGrant,
+  CapabilityTicketIntrospection,
+  CreateExecutionAuthorizationInput,
+  ServiceCapabilityCatalog,
+} from './namespaces';
 export { OxyAccountEventError, OXY_ACCOUNT_DELETED_EVENT_URI } from './middleware';
 export type {
   AuthMiddlewareOptions,
@@ -40,6 +46,7 @@ export type {
 export {
   createOptionalOxyAuth,
   createOxyAuthMiddleware,
+  getOxyActor,
   getOxyAuthRefusal,
   getOxyBillingPrincipal,
   getOxyDelegatedUserId,
@@ -163,6 +170,8 @@ export type {
 
 // Constant-time secret comparison.
 export { verifySecret } from './verifySecret';
+export { createLiveCapabilityTicketVerifier } from './liveCapabilityTicket';
+export type { LiveCapabilityTicketVerifierOptions } from './liveCapabilityTicket';
 
 // Cross-service user-invalidation signal: oxy-api publishes when identity
 // changes, every consuming backend sweeps its caches instead of waiting out a TTL.
@@ -200,3 +209,7 @@ export { observeNodeHttp, withoutNodeHttpObservation } from './trafficNodeHttp';
  */
 export { canAttestWorkloadIdentity, requestWorkloadServiceToken } from './workloadIdentity';
 export type { WorkloadServiceToken, WorkloadServiceTokenOptions } from './workloadIdentity';
+
+export { OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS, hasBoundedServiceTokenLifetime } from './serviceTokenLifetime';
+export { signInAgentAccount } from './agentAccount';
+export type { AgentAccountSigner } from './agentAccount';

package/src/server/liveCapabilityTicket.ts

@@ -0,0 +1,47 @@
+import { canonicalCapabilityJson, capabilityTicketClaimsSchema, type CapabilityTicketClaims } from '@oxy.so/contracts';
+import { verifyCapabilityTicket, type CapabilityTicketVerificationOptions } from './capabilityTicket';
+import type { CapabilityTicketIntrospection } from './namespaces';
+
+export interface LiveCapabilityTicketVerifierOptions extends CapabilityTicketVerificationOptions {
+  issuer: string;
+  introspect: (ticket: string, options: { signal: AbortSignal }) => Promise<CapabilityTicketIntrospection>;
+  /** Network bound only; does not establish an authority freshness policy. */
+  timeoutMs?: number;
+}
+
+/** Local signature + live receiving-service introspection; no cache or retry. */
+export function createLiveCapabilityTicketVerifier(options: LiveCapabilityTicketVerifierOptions) {
+  if (typeof options.issuer !== 'string' || options.issuer.trim() === '') throw new Error('A trusted Capability issuer is required');
+  const timeoutMs = options.timeoutMs ?? 5000;
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 60000) {
+    throw new Error('Capability introspection timeout must be between 1 and 60000ms');
+  }
+  return async (ticket: string, input: { signal?: AbortSignal } = {}): Promise<CapabilityTicketClaims> => {
+    input.signal?.throwIfAborted();
+    const signed = verifyCapabilityTicket(ticket, options);
+    if (!signed.catalog) throw new Error('Internal MCP requires a signed catalogue binding');
+    const controller = new AbortController();
+    const abort = () => controller.abort(input.signal?.reason);
+    input.signal?.addEventListener('abort', abort, { once: true });
+    const timer = setTimeout(() => controller.abort(new Error('Capability introspection timed out')), timeoutMs);
+    let rejectAbort: (() => void) | undefined;
+    try {
+      const interrupted = new Promise<never>((_resolve, reject) => {
+        rejectAbort = () => reject(controller.signal.reason ?? new Error('Capability introspection aborted'));
+        controller.signal.addEventListener('abort', rejectAbort, { once: true });
+        if (controller.signal.aborted) rejectAbort();
+      });
+      const result = await Promise.race([options.introspect(ticket, { signal: controller.signal }), interrupted]);
+      controller.signal.throwIfAborted();
+      if (result.active !== true) throw new Error('Capability ticket is inactive');
+      const live = capabilityTicketClaimsSchema.parse(result.claims);
+      if (canonicalCapabilityJson(live) !== canonicalCapabilityJson(signed)) throw new Error('Capability introspection claims mismatch');
+      // An authority response delayed past expiry cannot extend the signed grant.
+      return verifyCapabilityTicket(ticket, options);
+    } finally {
+      clearTimeout(timer);
+      input.signal?.removeEventListener('abort', abort);
+      if (rejectAbort) controller.signal.removeEventListener('abort', rejectAbort);
+    }
+  };
+}

package/src/server/middleware.ts

@@ -1,3 +1,4 @@
+import { hasBoundedServiceTokenLifetime } from './serviceTokenLifetime';
 /**
  * The Express and Socket.IO middleware `OxyServer` mounts
  * (`server.middleware.auth()`, `.socket()`, `.service()`, `.requireScope()`),
@@ -6,6 +7,7 @@
  * Node only; reachable solely from `@oxy.so/core/server`.
  */
 import type { OxyRequestUser } from './auth';
+import { accountActorChainSchema, type AccountActorChain } from '@oxy.so/contracts';
 import { jwtDecode } from 'jwt-decode';
 import type { JsonWebKey } from 'node:crypto';
 import type { ApiError, User } from '../models/interfaces';
@@ -54,6 +56,8 @@ interface JwtPayload {
  * authoritative store stays server-side.
  */
 export interface ServiceActingAsVerification {
+  /** Decimal durable generation, never lossy JS number. */
+  epoch?: string;
   authorized: boolean;
   scopes: string[];
 }
@@ -148,11 +152,10 @@ export interface ServiceApp {
   appName: string;
   scopes: string[];
   /**
-   * `internal` when the caller is one of Oxy's own applications: app to app it
-   * is trusted outright — {@link requireScope} passes and it may act for a user
-   * without a delegation grant. `external` keeps every scope and grant rule.
-   * What the USER may do (their accounts, plan, limits) is still for the
-   * receiving service to decide. A token without the claim reads as `external`.
+   * Classification only. Both tiers obey scope ceilings and live offline
+   * delegation; neither a brand nor a header proves a user's authority.
+   * Resource authorization remains with the receiving service. A missing
+   * claim reads as external.
    */
   tier: 'internal' | 'external';
   /** The credentialId of the specific service credential that minted this token. */
@@ -299,8 +302,10 @@ export interface OxyMiddlewareHost {
   validateSession(
     sessionId: string,
     options?: { deviceFingerprint?: string; useHeaderValidation?: boolean },
-  ): Promise<{ valid: boolean; user?: User } | null>;
-  verifyActingAs(appId: string, userId: string): Promise<ServiceActingAsVerification | null>;
+  ): Promise<{ valid: boolean; user?: User; actor?: unknown } | null>;
+  verifyActingAs(appId: string, userId: string, options?: {
+    cache?: boolean; credentialId?: string; ownerAccountId?: string; environment?: string;
+  }): Promise<ServiceActingAsVerification | null>;
 }
 
 /** Build the middleware set for one server. See `OxyServer.middleware`. */
@@ -680,21 +685,18 @@ export function createOxyMiddleware(host: OxyMiddlewareHost) {
             return res.status(401).json(error);
           }
 
-          // One of Oxy's own applications acts for a user without a grant:
-          // inside the ecosystem that is trust, not consent. It still acts
-          // with the USER's authority only — what that user may do is for the
-          // receiving service to check.
-          if (oxyUserId && tier === 'internal') {
-            req.userId = oxyUserId;
-            req.user = { id: oxyUserId };
-            req.serviceActingAs = { userId: oxyUserId, scopes: [] };
-          } else if (oxyUserId) {
-            // C3: an EXTERNAL service may only act as a user when an explicit
+          // A service credential plus a user header is never a present user
+          // session, even for an internal tier. Offline delegation is explicit.
+          if (oxyUserId) {
+            // C3: every service may only act as a user when an explicit
             // ServiceActingAs grant exists for that (appId, userId) pair.
             // Without the grant we MUST refuse — silently attaching
             // `req.userId = oxyUserId` would let any service impersonate
             // any user simply by setting the header.
-            const grant = await host.verifyActingAs(appId, oxyUserId);
+            const grant = await host.verifyActingAs(appId, oxyUserId, {
+              cache: false, credentialId: decoded.credentialId as string,
+              ownerAccountId: decoded.ownerAccountId as string, environment: decoded.environment as string,
+            });
             if (!grant || !grant.authorized) {
               logger.warn('[oxy.auth] Service token rejected — no delegation grant', {
                 component: 'auth',
@@ -925,7 +927,44 @@ export function createOxyMiddleware(host: OxyMiddlewareHost) {
             return res.status(401).json(error);
           }
 
+          // Who acted, and as whom — from the session authority's answer
+          // (#1520), never from a header or this undecoded token. An API that
+          // predates the field answers without it, and that is `null` here:
+          // "not reported", never a guess that the subject acted for itself.
+          // A chain naming a DIFFERENT effective account than the session
+          // resolved to has no benign cause and is refused like a user
+          // mismatch.
+          const actor = readActorChain(validationResult.actor);
+          if (actor === 'invalid' || (actor && actor.effectiveAccountId !== validatedUserId)) {
+            logger.warn('[oxy.auth] Session rejected — actor chain does not describe the session', {
+              component: 'auth',
+              method: 'auth',
+              validatedUserId,
+            });
+            recordRefusal(req, {
+              code: 'SESSION_ACTOR_MISMATCH',
+              stage: 'session',
+              reason: 'Session actor chain does not describe the validated session',
+              status: 401,
+            });
+            if (optional) {
+              req.userId = null;
+              req.user = null;
+              return next();
+            }
+
+            const error = {
+              error: 'SESSION_ACTOR_MISMATCH',
+              message: 'Session actor does not match the session',
+              code: 'SESSION_ACTOR_MISMATCH',
+              status: 401
+            };
+            if (onError) return onError(error);
+            return res.status(401).json(error);
+          }
+
           req.userId = validatedUserId;
+          req.oxyActor = actor;
           req.accessToken = token;
           req.sessionId = sessionId;
           // Session validation already returned the full user, so `loadUser`
@@ -1216,13 +1255,6 @@ export function createOxyMiddleware(host: OxyMiddlewareHost) {
         return;
       }
 
-      // Oxy's own applications are trusted app to app; scopes are the
-      // external lane.
-      if (req.serviceApp.tier === 'internal') {
-        next();
-        return;
-      }
-
       const appHasScope = appScopes.includes(scope);
       const delegationHasScope = delegatedScopes.includes(scope);
       const hasRequiredScope = req.serviceActingAs
@@ -1468,6 +1500,9 @@ function verifyServiceTokenClaims(
   decoded: JwtPayload,
   expected: { audience: string; issuer: string },
 ): void {
+  if (!hasBoundedServiceTokenLifetime(decoded)) {
+    throw new ServiceTokenClaimError('Service token lifetime must be positive and at most 300 seconds');
+  }
   if (decoded.type !== 'service') {
     throw new ServiceTokenClaimError(`Service token has unexpected type '${String(decoded.type)}'`);
   }
@@ -1484,6 +1519,17 @@ function verifyServiceTokenClaims(
   }
 }
 
+/**
+ * Parse the session authority's actor chain. `null` when the API did not send
+ * one; `'invalid'` when it sent something that is not a chain, which the caller
+ * refuses rather than ignores.
+ */
+function readActorChain(raw: unknown): AccountActorChain | null | 'invalid' {
+  if (raw === undefined || raw === null) return null;
+  const parsed = accountActorChainSchema.safeParse(raw);
+  return parsed.success ? parsed.data : 'invalid';
+}
+
 // ---------------------------------------------------------------------------
 // Local request/response/socket typing
 //
@@ -1506,6 +1552,7 @@ interface AuthReq {
   sessionId?: string | null;
   serviceApp?: ServiceApp;
   serviceActingAs?: { userId: string; scopes: string[] };
+  oxyActor?: AccountActorChain | null;
   oxyAuthRefusal?: OxyAuthRefusal;
 }
 

package/src/server/namespaces.ts

@@ -4,7 +4,8 @@
  * `server.assets.metadataByIds(...)` sits beside every client method of
  * `oxy.assets`.
  */
-import type { CreateOxyNotificationRequest, AwardReputationInput, ReputationTransaction, ServiceLinkedAccountListResponse } from '@oxy.so/contracts';
+import { capabilityTicketRequestSchema, foregroundExecutionAuthorizationInputSchema, type ForegroundExecutionAuthorizationInput, type ActorRef, type AppCapabilityCatalog, type AutonomyLevel, type CapabilityTicketClaims, type CapabilityTicketRequest, type GrantLimit, type PolicyDecision, type ResourceRef, type CreateOxyNotificationRequest, type AwardReputationInput, type ReputationTransaction, type ServiceLinkedAccountListResponse } from '@oxy.so/contracts';
+import type { RequestOptions } from '../HttpService';
 import type { OxyContext, ServiceLane } from '../client/context';
 import type {
   Notification,
@@ -15,7 +16,7 @@ import type {
 import { AssetsApi } from '../api/assets';
 import { NotificationsApi } from '../api/notifications';
 import { LinkedAccountsApi } from '../api/linkedAccounts';
-import { AgencyApi, type RequesterAssertionGrant, type RequesterAssertionIntrospection } from '../api/agency';
+import { AgencyApi, type CapabilityExecutionAuthorization, type RequesterAssertionGrant, type RequesterAssertionIntrospection } from '../api/agency';
 import { ReputationApi } from '../api/reputation';
 import { ServiceAssetMetadataError, ServiceLinkedDownloadUrlError } from '../OxyServices.errors';
 import { extractErrorStatus } from '../utils/errorUtils';
@@ -218,7 +219,103 @@ export class ServerLinkedAccountsApi extends LinkedAccountsApi {
   }
 }
 
+/** Projection of the existing service-authenticated registry response. */
+export interface ServiceCapabilityCatalog {
+  id: string;
+  appSlug: string;
+  version: string;
+  digest: string;
+  audience: string;
+  catalog: AppCapabilityCatalog;
+}
+
+export interface CapabilityTicketGrant {
+  decision: PolicyDecision;
+  ticket?: string;
+  claims?: CapabilityTicketClaims;
+}
+
+export interface CapabilityTicketIntrospection {
+  active: boolean;
+  claims?: CapabilityTicketClaims;
+  decision?: PolicyDecision;
+  error?: string;
+}
+
+interface ExecutionAuthorizationTerms {
+  ownerAccountId: string;
+  coordinatorApplicationId: string;
+  coordinatorCredentialId: string;
+  actor: ActorRef;
+  resource: ResourceRef;
+  tool: string;
+  limits?: GrantLimit[];
+  expiresAt: string;
+}
+
+export type CreateExecutionAuthorizationInput = ExecutionAuthorizationTerms & (
+  | { kind: 'direct_request'; runId: string; stepId?: string; automationId?: never; maximumAutonomy: Exclude<AutonomyLevel, 'autonomous'> }
+  | { kind: 'automation'; automationId: string; runId?: never; stepId?: never; maximumAutonomy: AutonomyLevel }
+);
+
+function agencyAuthorityOptions(signal?: AbortSignal): RequestOptions {
+  signal?.throwIfAborted();
+  return { cache: false, deduplicate: false, retry: false, skipAuth: true, timeout: 5000, ...(signal ? { signal } : {}) };
+}
+
 export class ServerAgencyApi extends AgencyApi {
+  /** Live registry discovery with this service's existing capability scopes. */
+  async serviceCatalogs(input: { appId?: string; signal?: AbortSignal } = {}): Promise<ServiceCapabilityCatalog[]> {
+    const path = `/capabilities/catalogs${input.appId === undefined ? '' : `?appId=${encodeURIComponent(input.appId)}`}`;
+    const result = await lane(this.ctx).request<{ registrations: ServiceCapabilityCatalog[] }>('GET', path, undefined, agencyAuthorityOptions(input.signal));
+    return result.registrations;
+  }
+
+  /** Existing Oxy execution authority is required; this call creates none. */
+  async issueCapabilityTicket(input: CapabilityTicketRequest, options: { signal?: AbortSignal } = {}): Promise<CapabilityTicketGrant> {
+    return lane(this.ctx).request<CapabilityTicketGrant>('POST', '/capabilities/tickets', capabilityTicketRequestSchema.parse(input), agencyAuthorityOptions(options.signal));
+  }
+
+  /** Receiving app authenticates live introspection using its own service credential. */
+  async introspectCapabilityTicket(ticket: string, options: { signal?: AbortSignal } = {}): Promise<CapabilityTicketIntrospection> {
+    if (ticket.trim() === '') throw new Error('A capability ticket is required');
+    return lane(this.ctx).request<CapabilityTicketIntrospection>('POST', '/capabilities/tickets/introspect', { ticket }, agencyAuthorityOptions(options.signal));
+  }
+
+  /**
+   * Authenticates the existing user-authority route with the requester's bearer.
+   * The service bearer and attribution headers cannot substitute for that user.
+   * The token goes only to this client's configured Oxy authority; never retry.
+   */
+  async createExecutionAuthorization(input: CreateExecutionAuthorizationInput, options: { requesterToken: string; signal?: AbortSignal }): Promise<CapabilityExecutionAuthorization> {
+    if (options.requesterToken === '' || /\s/.test(options.requesterToken)) throw new Error('A requester bearer is required');
+    const result = await this.ctx.request<{ authorization: CapabilityExecutionAuthorization }>('POST', '/capabilities/execution-authorizations', input, {
+      ...agencyAuthorityOptions(options.signal),
+      headers: { Authorization: `Bearer ${options.requesterToken}` },
+    });
+    return result.authorization;
+  }
+
+  /** Revoke a direct approval on its canonical requester-authenticated lane. */
+  async revokeExecutionAuthorization(authorizationId: string, options: { requesterToken: string; signal?: AbortSignal }): Promise<void> {
+    options.signal?.throwIfAborted();
+    if (!authorizationId || authorizationId.length > 255 || /\s/.test(authorizationId)) throw new Error('An execution authorization id is required');
+    if (!options.requesterToken || options.requesterToken.length > 16_384 || /\s/.test(options.requesterToken)) throw new Error('A requester bearer is required');
+    await this.ctx.request<void>('DELETE', `/capabilities/execution-authorizations/${encodeURIComponent(authorizationId)}`,
+      undefined, { ...agencyAuthorityOptions(options.signal), headers: { Authorization: `Bearer ${options.requesterToken}` } });
+  }
+
+  /** Independent service proof plus present requester bearer, sent only to Oxy. */
+  async createForegroundExecutionAuthorization(input: ForegroundExecutionAuthorizationInput, options: { requesterToken: string; signal?: AbortSignal }): Promise<CapabilityExecutionAuthorization> {
+    if (options.requesterToken === '' || options.requesterToken.length > 16_384 || /\s/.test(options.requesterToken)) throw new Error('A requester bearer is required');
+    const result = await lane(this.ctx).request<{ authorization: CapabilityExecutionAuthorization }>(
+      'POST', '/capabilities/foreground-execution-authorizations',
+      { ...foregroundExecutionAuthorizationInputSchema.parse(input), subjectToken: options.requesterToken },
+      agencyAuthorityOptions(options.signal),
+    );
+    return result.authorization;
+  }
+
   /**
    * Product backend → Oxy: trade the signed-in requester's access token for a
    * one-use assertion naming `agentId` (ADR 0025), authenticated with this

package/src/server/serviceTokenLifetime.ts

@@ -0,0 +1,13 @@
+/** Approved I03 ceiling shared by issuance and both JWT verifiers. */
+export const OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS = 300;
+
+/** Call only after signature verification; cache checks alone confer no authority. */
+export function hasBoundedServiceTokenLifetime(
+  claims: { iat?: unknown; exp?: unknown },
+  nowSeconds = Math.floor(Date.now() / 1000),
+): boolean {
+  return typeof claims.iat === 'number' && Number.isSafeInteger(claims.iat)
+    && typeof claims.exp === 'number' && Number.isSafeInteger(claims.exp)
+    && claims.iat <= nowSeconds && claims.exp > claims.iat
+    && claims.exp - claims.iat <= OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS;
+}