@oxyhq/core 1.3.0 → 1.4.0

package/dist/cjs/mixins/OxyServices.utility.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OxyServicesUtilityMixin = OxyServicesUtilityMixin;
 /**
@@ -59,7 +92,7 @@ function OxyServicesUtilityMixin(Base) {
          * @returns Express middleware function
          */
         auth(options = {}) {
-            const { debug = false, onError, loadUser = false, optional = false } = options;
+            const { debug = false, onError, loadUser = false, optional = false, jwtSecret } = options;
             // Cast to any for cross-mixin method access (Auth mixin methods available at runtime)
             const oxyInstance = this;
             // Return an async middleware function
@@ -115,8 +148,56 @@ function OxyServicesUtilityMixin(Base) {
                         return res.status(401).json(error);
                     }
                     // Handle service tokens (internal service-to-service auth)
-                    // Service tokens are stateless JWTs with type: 'service' — no session validation needed
+                    // Service tokens are stateless JWTs with type: 'service' — requires signature verification
                     if (decoded.type === 'service') {
+                        // Service tokens MUST be cryptographically verified — reject if no secret provided
+                        if (!jwtSecret) {
+                            if (optional) {
+                                req.userId = null;
+                                req.user = null;
+                                return next();
+                            }
+                            const error = {
+                                message: 'Service token verification not configured',
+                                code: 'SERVICE_TOKEN_NOT_CONFIGURED',
+                                status: 403
+                            };
+                            if (onError)
+                                return onError(error);
+                            return res.status(403).json(error);
+                        }
+                        // Verify JWT signature (not just decode)
+                        try {
+                            const { createHmac } = await Promise.resolve().then(() => __importStar(require('crypto')));
+                            const [headerB64, payloadB64, signatureB64] = token.split('.');
+                            if (!headerB64 || !payloadB64 || !signatureB64) {
+                                throw new Error('Invalid token structure');
+                            }
+                            const expectedSig = createHmac('sha256', jwtSecret)
+                                .update(`${headerB64}.${payloadB64}`)
+                                .digest('base64')
+                                .replace(/\+/g, '-')
+                                .replace(/\//g, '_')
+                                .replace(/=/g, '');
+                            // Timing-safe comparison
+                            const sigBuf = Buffer.from(signatureB64);
+                            const expectedBuf = Buffer.from(expectedSig);
+                            const { timingSafeEqual } = await Promise.resolve().then(() => __importStar(require('crypto')));
+                            if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) {
+                                throw new Error('Invalid signature');
+                            }
+                        }
+                        catch {
+                            if (optional) {
+                                req.userId = null;
+                                req.user = null;
+                                return next();
+                            }
+                            const error = { message: 'Invalid service token signature', code: 'INVALID_SERVICE_TOKEN', status: 401 };
+                            if (onError)
+                                return onError(error);
+                            return res.status(401).json(error);
+                        }
                         // Check expiration
                         if (decoded.exp && decoded.exp < Math.floor(Date.now() / 1000)) {
                             if (optional) {
@@ -129,6 +210,18 @@ function OxyServicesUtilityMixin(Base) {
                                 return onError(error);
                             return res.status(401).json(error);
                         }
+                        // Validate required service token fields
+                        if (!decoded.appId) {
+                            if (optional) {
+                                req.userId = null;
+                                req.user = null;
+                                return next();
+                            }
+                            const error = { message: 'Invalid service token: missing appId', code: 'INVALID_SERVICE_TOKEN', status: 401 };
+                            if (onError)
+                                return onError(error);
+                            return res.status(401).json(error);
+                        }
                         // Read delegated user ID from header
                         const oxyUserId = req.headers['x-oxy-user-id'];
                         req.userId = oxyUserId || null;

package/dist/esm/mixins/OxyServices.utility.js

@@ -56,7 +56,7 @@ export function OxyServicesUtilityMixin(Base) {
          * @returns Express middleware function
          */
         auth(options = {}) {
-            const { debug = false, onError, loadUser = false, optional = false } = options;
+            const { debug = false, onError, loadUser = false, optional = false, jwtSecret } = options;
             // Cast to any for cross-mixin method access (Auth mixin methods available at runtime)
             const oxyInstance = this;
             // Return an async middleware function
@@ -112,8 +112,56 @@ export function OxyServicesUtilityMixin(Base) {
                         return res.status(401).json(error);
                     }
                     // Handle service tokens (internal service-to-service auth)
-                    // Service tokens are stateless JWTs with type: 'service' — no session validation needed
+                    // Service tokens are stateless JWTs with type: 'service' — requires signature verification
                     if (decoded.type === 'service') {
+                        // Service tokens MUST be cryptographically verified — reject if no secret provided
+                        if (!jwtSecret) {
+                            if (optional) {
+                                req.userId = null;
+                                req.user = null;
+                                return next();
+                            }
+                            const error = {
+                                message: 'Service token verification not configured',
+                                code: 'SERVICE_TOKEN_NOT_CONFIGURED',
+                                status: 403
+                            };
+                            if (onError)
+                                return onError(error);
+                            return res.status(403).json(error);
+                        }
+                        // Verify JWT signature (not just decode)
+                        try {
+                            const { createHmac } = await import('crypto');
+                            const [headerB64, payloadB64, signatureB64] = token.split('.');
+                            if (!headerB64 || !payloadB64 || !signatureB64) {
+                                throw new Error('Invalid token structure');
+                            }
+                            const expectedSig = createHmac('sha256', jwtSecret)
+                                .update(`${headerB64}.${payloadB64}`)
+                                .digest('base64')
+                                .replace(/\+/g, '-')
+                                .replace(/\//g, '_')
+                                .replace(/=/g, '');
+                            // Timing-safe comparison
+                            const sigBuf = Buffer.from(signatureB64);
+                            const expectedBuf = Buffer.from(expectedSig);
+                            const { timingSafeEqual } = await import('crypto');
+                            if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) {
+                                throw new Error('Invalid signature');
+                            }
+                        }
+                        catch {
+                            if (optional) {
+                                req.userId = null;
+                                req.user = null;
+                                return next();
+                            }
+                            const error = { message: 'Invalid service token signature', code: 'INVALID_SERVICE_TOKEN', status: 401 };
+                            if (onError)
+                                return onError(error);
+                            return res.status(401).json(error);
+                        }
                         // Check expiration
                         if (decoded.exp && decoded.exp < Math.floor(Date.now() / 1000)) {
                             if (optional) {
@@ -126,6 +174,18 @@ export function OxyServicesUtilityMixin(Base) {
                                 return onError(error);
                             return res.status(401).json(error);
                         }
+                        // Validate required service token fields
+                        if (!decoded.appId) {
+                            if (optional) {
+                                req.userId = null;
+                                req.user = null;
+                                return next();
+                            }
+                            const error = { message: 'Invalid service token: missing appId', code: 'INVALID_SERVICE_TOKEN', status: 401 };
+                            if (onError)
+                                return onError(error);
+                            return res.status(401).json(error);
+                        }
                         // Read delegated user ID from header
                         const oxyUserId = req.headers['x-oxy-user-id'];
                         req.userId = oxyUserId || null;

package/dist/types/mixins/OxyServices.utility.d.ts

@@ -19,6 +19,12 @@ interface AuthMiddlewareOptions {
     loadUser?: boolean;
     /** Optional auth - attach user if token present but don't block (default: false) */
     optional?: boolean;
+    /**
+     * JWT secret for verifying service token signatures locally.
+     * When provided, service tokens will be cryptographically verified.
+     * When omitted, service tokens will be rejected (secure default).
+     */
+    jwtSecret?: string;
 }
 export declare function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base: T): {
     new (...args: any[]): {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/mixins/OxyServices.utility.ts

@@ -40,6 +40,12 @@ interface AuthMiddlewareOptions {
   loadUser?: boolean;
   /** Optional auth - attach user if token present but don't block (default: false) */
   optional?: boolean;
+  /**
+   * JWT secret for verifying service token signatures locally.
+   * When provided, service tokens will be cryptographically verified.
+   * When omitted, service tokens will be rejected (secure default).
+   */
+  jwtSecret?: string;
 }
 
 export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base: T) {
@@ -102,7 +108,7 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
      * @returns Express middleware function
      */
     auth(options: AuthMiddlewareOptions = {}) {
-      const { debug = false, onError, loadUser = false, optional = false } = options;
+      const { debug = false, onError, loadUser = false, optional = false, jwtSecret } = options;
       // Cast to any for cross-mixin method access (Auth mixin methods available at runtime)
       const oxyInstance = this as any;
 
@@ -161,8 +167,56 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
           }
 
           // Handle service tokens (internal service-to-service auth)
-          // Service tokens are stateless JWTs with type: 'service' — no session validation needed
+          // Service tokens are stateless JWTs with type: 'service' — requires signature verification
           if (decoded.type === 'service') {
+            // Service tokens MUST be cryptographically verified — reject if no secret provided
+            if (!jwtSecret) {
+              if (optional) {
+                req.userId = null;
+                req.user = null;
+                return next();
+              }
+              const error = {
+                message: 'Service token verification not configured',
+                code: 'SERVICE_TOKEN_NOT_CONFIGURED',
+                status: 403
+              };
+              if (onError) return onError(error);
+              return res.status(403).json(error);
+            }
+
+            // Verify JWT signature (not just decode)
+            try {
+              const { createHmac } = await import('crypto');
+              const [headerB64, payloadB64, signatureB64] = token.split('.');
+              if (!headerB64 || !payloadB64 || !signatureB64) {
+                throw new Error('Invalid token structure');
+              }
+              const expectedSig = createHmac('sha256', jwtSecret)
+                .update(`${headerB64}.${payloadB64}`)
+                .digest('base64')
+                .replace(/\+/g, '-')
+                .replace(/\//g, '_')
+                .replace(/=/g, '');
+
+              // Timing-safe comparison
+              const sigBuf = Buffer.from(signatureB64);
+              const expectedBuf = Buffer.from(expectedSig);
+              const { timingSafeEqual } = await import('crypto');
+              if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) {
+                throw new Error('Invalid signature');
+              }
+            } catch {
+              if (optional) {
+                req.userId = null;
+                req.user = null;
+                return next();
+              }
+              const error = { message: 'Invalid service token signature', code: 'INVALID_SERVICE_TOKEN', status: 401 };
+              if (onError) return onError(error);
+              return res.status(401).json(error);
+            }
+
             // Check expiration
             if (decoded.exp && decoded.exp < Math.floor(Date.now() / 1000)) {
               if (optional) {
@@ -175,6 +229,18 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
               return res.status(401).json(error);
             }
 
+            // Validate required service token fields
+            if (!decoded.appId) {
+              if (optional) {
+                req.userId = null;
+                req.user = null;
+                return next();
+              }
+              const error = { message: 'Invalid service token: missing appId', code: 'INVALID_SERVICE_TOKEN', status: 401 };
+              if (onError) return onError(error);
+              return res.status(401).json(error);
+            }
+
             // Read delegated user ID from header
             const oxyUserId = req.headers['x-oxy-user-id'] as string;