@palbase/backend 25.0.4 → 25.1.0

package/dist/engine/index.cjs

@@ -2689,6 +2689,182 @@ function matchRoute(table, method, pathname) {
   return null;
 }
 
+// src/engine/attest.ts
+var HEADER_DEVICE_ID = "x-palbase-device-id";
+var HEADER_PAYLOAD = "x-palbase-attest-payload";
+var HEADER_SIGNATURE = "x-palbase-attest-signature";
+var HEADER_CHALLENGE = "x-palbase-attest-challenge";
+var HEADER_CAPABLE = "x-palbase-attest-capable";
+var HEADER_INSTALLATION = "x-palbase-installation";
+var HEADER_ANCHOR = "x-palbase-installation-anchor";
+var DEFAULT_POLICY_TTL_MS = 3e4;
+var DEFAULT_REQUEST_TIMEOUT_MS = 2e3;
+async function bodyDigest(body) {
+  if (!body || body.byteLength === 0) return "";
+  const bytes = new Uint8Array(new ArrayBuffer(body.byteLength));
+  bytes.set(body);
+  const buf = await crypto.subtle.digest("SHA-256", bytes);
+  return btoa(String.fromCharCode(...new Uint8Array(buf)));
+}
+function readCapable(req) {
+  const v = req.headers.get(HEADER_CAPABLE);
+  return v === "yes" || v === "no" ? v : "unknown";
+}
+function createAttestGate(deps) {
+  const doFetch = deps.fetchImpl ?? fetch;
+  const ttl = deps.policyTtlMs ?? DEFAULT_POLICY_TTL_MS;
+  const policyTimeoutMs = deps.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  let cachedMode = "off";
+  let cachedAt = -Infinity;
+  async function mode() {
+    if (Date.now() - cachedAt < ttl) return cachedMode;
+    try {
+      const res = await doFetch(`${deps.moduleBaseUrl}/admin/attest/devices/attest-policy`, {
+        headers: { apikey: deps.serviceRoleKey },
+        signal: AbortSignal.timeout(policyTimeoutMs)
+      });
+      if (!res.ok) throw new Error(`attest-policy ${res.status}`);
+      const body = await res.json();
+      cachedMode = body.mode === "monitor" || body.mode === "enforce" ? body.mode : "off";
+      cachedAt = Date.now();
+    } catch {
+    }
+    return cachedMode;
+  }
+  return async function gate(req, body, _ctx) {
+    const m = await mode();
+    if (m === "off") {
+      return { outcome: "pass", reason: "", device: null, observation: null, nextChallenge: null };
+    }
+    const deviceId = req.headers.get(HEADER_DEVICE_ID) ?? "";
+    const payload = req.headers.get(HEADER_PAYLOAD) ?? "";
+    const signature = req.headers.get(HEADER_SIGNATURE) ?? "";
+    const hasEvidence = deviceId !== "" && payload !== "" && signature !== "";
+    const observation = {
+      capable: readCapable(req),
+      attested: false,
+      installationId: req.headers.get(HEADER_INSTALLATION) || null
+    };
+    if (m === "monitor") {
+      observation.attested = hasEvidence;
+      return { outcome: "pass", reason: "", device: null, observation, nextChallenge: null };
+    }
+    const url = new URL(req.url);
+    let verdict;
+    try {
+      const res = await doFetch(`${deps.moduleBaseUrl}/admin/attest/devices/assert`, {
+        method: "POST",
+        headers: { apikey: deps.serviceRoleKey, "content-type": "application/json" },
+        // A HUNG palauth must not become a hung tenant. Without this, a
+        // process that accepts the connection and never answers holds every
+        // request open until the client gives up — the gate would take the
+        // whole stack down while claiming to protect it.
+        signal: AbortSignal.timeout(policyTimeoutMs),
+        body: JSON.stringify({
+          installation_id: req.headers.get(HEADER_ANCHOR) ?? "",
+          device_id: deviceId,
+          challenge: req.headers.get(HEADER_CHALLENGE) ?? "",
+          payload,
+          signature,
+          method: req.method,
+          // pathname + search, NOT pathname alone.
+          //
+          // The client signs the path string it was given, and that string can
+          // carry a query — the transport splits and reattaches one on purpose.
+          // Recomputing from pathname alone would drop the query from the
+          // signed definition, which breaks it BOTH ways: an attested call
+          // carrying a query would fail to verify, and a captured assertion
+          // could be replayed against the same route with different query
+          // parameters, which is exactly the substitution the binding exists to
+          // prevent.
+          path: url.pathname + url.search,
+          body_sha256: await bodyDigest(body)
+        })
+      });
+      if (!res.ok) throw new Error(`assert ${res.status}`);
+      verdict = await res.json();
+    } catch {
+      return {
+        outcome: "reject",
+        reason: "app_attest_required",
+        device: null,
+        observation,
+        nextChallenge: null
+      };
+    }
+    if (!verdict.ok) {
+      const reason2 = verdict.reason === "assertion_invalid" || verdict.reason === "assertion_stale" ? verdict.reason : "app_attest_required";
+      return {
+        outcome: "reject",
+        reason: reason2,
+        device: null,
+        observation,
+        nextChallenge: verdict.next_challenge || null
+      };
+    }
+    observation.attested = true;
+    return {
+      outcome: "pass",
+      reason: "",
+      device: {
+        installationId: "",
+        authDeviceId: deviceId,
+        platform: "ios",
+        assurance: "attested"
+      },
+      observation,
+      nextChallenge: verdict.next_challenge || null
+    };
+  };
+}
+function createObservationSink(deps) {
+  const doFetch = deps.fetchImpl ?? fetch;
+  const maxBatch = deps.maxBatch ?? 1e3;
+  const intervalMs = deps.intervalMs ?? 1e4;
+  let buffer = [];
+  let inFlight = Promise.resolve();
+  const timer = setInterval(() => {
+    void flush();
+  }, intervalMs);
+  timer.unref?.();
+  function bucketsOf(batch) {
+    const counts = { capable: 0, incapable: 0, unknown: 0, no_sdk: 0 };
+    for (const o of batch) {
+      if (o.attested || o.capable === "yes") counts.capable += 1;
+      else if (o.capable === "no") counts.incapable += 1;
+      else if (o.installationId) counts.unknown += 1;
+      else counts.no_sdk += 1;
+    }
+    return counts;
+  }
+  async function flush() {
+    if (buffer.length === 0) return;
+    const batch = buffer;
+    buffer = [];
+    inFlight = (async () => {
+      try {
+        await doFetch(`${deps.moduleBaseUrl}/admin/attest/devices/observations`, {
+          method: "POST",
+          headers: { apikey: deps.serviceRoleKey, "content-type": "application/json" },
+          body: JSON.stringify(bucketsOf(batch))
+        });
+      } catch {
+      }
+    })();
+    await inFlight;
+  }
+  return {
+    record(o) {
+      buffer.push(o);
+      if (buffer.length >= maxBatch) void flush();
+    },
+    flush,
+    stop() {
+      clearInterval(timer);
+    }
+  };
+}
+
 // src/engine/upload.ts
 var AUTHORIZE_PATH = "/__palbase/upload/authorize";
 var SIGNATURE_HEADER = "x-palbase-upload-signature";
@@ -2842,6 +3018,7 @@ function installEgressFence(policy) {
 }
 
 // src/engine/index.ts
+var MAX_BODY_BYTES = 10 * 1024 * 1024;
 var JSON_HEADERS = { "content-type": "application/json" };
 function fieldErrors(err) {
   return err.issues.map((i) => ({ field: i.path.join("."), message: i.message }));
@@ -2902,6 +3079,14 @@ async function createApp(opts) {
   const sql = opts.sql ?? await defaultSqlDriver(config);
   await sql.unsafe("select 1");
   const auth = new AuthVerifier({ jwksUrl: config.authJwksUrl, issuer: config.authIssuer });
+  const attestGate = createAttestGate({
+    moduleBaseUrl: config.moduleBaseUrl,
+    serviceRoleKey: config.serviceRoleKey
+  });
+  const observations = createObservationSink({
+    moduleBaseUrl: config.moduleBaseUrl,
+    serviceRoleKey: config.serviceRoleKey
+  });
   const limiter = new RateLimiter();
   const cache = opts.cache ?? makeMemoryCache();
   const log = opts.logger ?? console;
@@ -2983,6 +3168,8 @@ async function createApp(opts) {
     const hit = matchRoute(routes, req.method, url.pathname);
     if (!hit) return envelope("not_found", "No route matches this method and path", 404, requestId);
     const { meta } = hit.entry;
+    let attestedDevice = null;
+    let attestChallengeOut = null;
     const spec = effectiveAuth(meta.options?.auth, hit.entry.controllerAuth);
     const claims = await auth.verify(req.headers.get("authorization"));
     if (spec.required && !claims) {
@@ -2995,6 +3182,67 @@ async function createApp(opts) {
     if (claims && spec.verifiedEmail && claims.email_verified !== true) {
       return envelope("email_not_verified", "A verified email address is required", 403, requestId);
     }
+    let parsedBody;
+    let bodyRead = false;
+    let rawBody = null;
+    if (req.method !== "GET" && req.method !== "HEAD") {
+      const declared = Number(req.headers.get("content-length") ?? "");
+      if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+        return new Response(
+          JSON.stringify({
+            error: "payload_too_large",
+            error_description: `Request body exceeds ${MAX_BODY_BYTES} bytes`,
+            status: 413,
+            request_id: requestId
+          }),
+          { status: 413, headers: JSON_HEADERS }
+        );
+      }
+      const buf = await req.arrayBuffer().catch(() => null);
+      if (buf && buf.byteLength > MAX_BODY_BYTES) {
+        return new Response(
+          JSON.stringify({
+            error: "payload_too_large",
+            error_description: `Request body exceeds ${MAX_BODY_BYTES} bytes`,
+            status: 413,
+            request_id: requestId
+          }),
+          { status: 413, headers: JSON_HEADERS }
+        );
+      }
+      if (buf && buf.byteLength > 0) rawBody = new Uint8Array(buf);
+    }
+    const readParsedBody = () => {
+      if (bodyRead) return parsedBody;
+      bodyRead = true;
+      if (!rawBody) {
+        parsedBody = {};
+        return parsedBody;
+      }
+      try {
+        parsedBody = JSON.parse(new TextDecoder().decode(rawBody));
+      } catch {
+        parsedBody = {};
+      }
+      return parsedBody;
+    };
+    const attest = await attestGate(req, rawBody, { userId });
+    if (attest.observation) observations.record(attest.observation);
+    if (attest.outcome === "reject") {
+      const headers = { ...JSON_HEADERS };
+      if (attest.nextChallenge) headers["x-palbase-attest-challenge"] = attest.nextChallenge;
+      return new Response(
+        JSON.stringify({
+          error: attest.reason,
+          error_description: "This endpoint requires a verified app instance",
+          status: 401,
+          request_id: requestId
+        }),
+        { status: 401, headers }
+      );
+    }
+    if (attest.device && claims) attestedDevice = attest.device;
+    attestChallengeOut = attest.nextChallenge;
     const retryAfter = limiter.check(
       meta.options?.rateLimit,
       RateLimiter.key(hit.entry.id, userId, req.headers),
@@ -3014,8 +3262,6 @@ async function createApp(opts) {
     }
     let completionUploadId = null;
     const args = [];
-    let parsedBody;
-    let bodyRead = false;
     let sseEnqueue = null;
     let sseSettle = async () => {
     };
@@ -3026,10 +3272,7 @@ async function createApp(opts) {
     for (const p of meta.params ?? []) {
       switch (p.kind) {
         case "body": {
-          if (!bodyRead) {
-            parsedBody = await req.json().catch(() => ({}));
-            bodyRead = true;
-          }
+          readParsedBody();
           const r = p.schema.safeParse(parsedBody);
           if (!r.success) {
             return envelope("bad_request", "Request body failed validation", 400, requestId, {
@@ -3074,7 +3317,12 @@ async function createApp(opts) {
             email: claims.email,
             role: claims.role,
             emailVerified: claims.email_verified === true,
-            metadata: claims.metadata ?? {}
+            metadata: claims.metadata ?? {},
+            // Server-owned and only ever filled from a verdict palauth
+            // returned. Never from a raw header, never from JWT metadata —
+            // the type has said so since it was written and this is the
+            // first writer.
+            device: attestedDevice
           } : null;
           break;
         case "uploadedObject": {
@@ -3086,10 +3334,7 @@ async function createApp(opts) {
               requestId
             );
           }
-          if (!bodyRead) {
-            parsedBody = await req.json().catch(() => ({}));
-            bodyRead = true;
-          }
+          readParsedBody();
           const envelopeIn = parsedBody;
           if (!envelopeIn?.uploadedObject) {
             return envelope("bad_request", "the completion call carried no uploaded object", 400, requestId);
@@ -3272,7 +3517,10 @@ async function createApp(opts) {
           contentType: JSON_HEADERS["content-type"] ?? "application/json"
         });
       }
-      return new Response(payload, { status: 200, headers: JSON_HEADERS });
+      return new Response(payload, {
+        status: 200,
+        headers: attestChallengeOut ? { ...JSON_HEADERS, "x-palbase-attest-challenge": attestChallengeOut } : JSON_HEADERS
+      });
     } catch (err) {
       await db.rollback(err);
       if (isHttpError(err)) {