@palbase/backend 39.1.0 → 39.1.2

package/dist/bin/palbase-backend.cjs

@@ -1354,6 +1354,11 @@ var DeclarationRefused = class extends Error {
 };
 
 // src/engine/auth.ts
+var KEYSET_RETRY_INTERVAL_MS = 1e3;
+function authUnavailable() {
+  return markEngineRaised(new HttpError(503, "auth_unavailable", "Authentication is temporarily unavailable"));
+}
+__name(authUnavailable, "authUnavailable");
 function b64urlToBytes(s) {
   const pad = s.replace(/-/g, "+").replace(/_/g, "/");
   const full = pad.padEnd(Math.ceil(pad.length / 4) * 4, "=");
@@ -1370,6 +1375,8 @@ var AuthVerifier = class {
   keys = /* @__PURE__ */ new Map();
   fetchedAt = 0;
   inflight = null;
+  nextRefreshAt = 0;
+  refreshFailed = false;
   jwksUrl;
   issuer;
   fetchImpl;
@@ -1380,54 +1387,65 @@ var AuthVerifier = class {
     this.fetchImpl = opts.fetchImpl ?? ((...a) => fetch(...a));
     this.ttl = opts.keysetTtlMs ?? 5 * 6e4;
   }
-  /** Fetch the keyset at most once per TTL, and at most once concurrently. */
-  async refresh() {
+  /** Fetch once concurrently. Known keys use their trust TTL; misses and
+  * failures share a short cooldown so arbitrary kids cannot force a fetch
+  * per request, and recovery does not wait for an entire trust TTL. */
+  refresh() {
     if (this.inflight) return this.inflight;
-    this.inflight = (async () => {
-      try {
-        const res = await this.fetchImpl(this.jwksUrl);
-        if (!res.ok) return;
-        const body = await res.json();
-        const next = /* @__PURE__ */ new Map();
-        for (const jwk of body.keys ?? []) {
-          if (jwk.kty !== "EC" || jwk.crv !== "P-256") continue;
-          try {
-            next.set(jwk.kid, await crypto.subtle.importKey("jwk", {
-              kty: "EC",
-              crv: jwk.crv,
-              x: jwk.x,
-              y: jwk.y,
-              ext: true
-            }, {
-              name: "ECDSA",
-              namedCurve: "P-256"
-            }, true, [
-              "verify"
-            ]));
-          } catch {
-          }
-        }
-        if (next.size > 0) {
-          this.keys = next;
-          this.fetchedAt = Date.now();
+    this.inflight = this.fetchKeyset().finally(() => {
+      this.nextRefreshAt = Date.now() + KEYSET_RETRY_INTERVAL_MS;
+      this.inflight = null;
+    });
+    return this.inflight;
+  }
+  async fetchKeyset() {
+    try {
+      const res = await this.fetchImpl(this.jwksUrl);
+      if (!res.ok) throw authUnavailable();
+      const body = await res.json();
+      if (!body || !Array.isArray(body.keys)) throw authUnavailable();
+      const next = /* @__PURE__ */ new Map();
+      for (const jwk of body.keys) {
+        if (!jwk || jwk.kty !== "EC" || jwk.crv !== "P-256" || typeof jwk.kid !== "string" || !jwk.kid) continue;
+        try {
+          next.set(jwk.kid, await crypto.subtle.importKey("jwk", {
+            kty: "EC",
+            crv: jwk.crv,
+            x: jwk.x,
+            y: jwk.y,
+            ext: true
+          }, {
+            name: "ECDSA",
+            namedCurve: "P-256"
+          }, true, [
+            "verify"
+          ]));
+        } catch {
         }
-      } finally {
-        this.inflight = null;
       }
-    })();
-    return this.inflight;
+      if (next.size === 0) throw authUnavailable();
+      this.keys = next;
+      this.fetchedAt = Date.now();
+      this.refreshFailed = false;
+    } catch {
+      this.refreshFailed = true;
+      throw authUnavailable();
+    }
   }
   async key(kid) {
     const stale = Date.now() - this.fetchedAt > this.ttl;
-    if (!this.keys.has(kid) || stale) await this.refresh();
+    if (this.keys.has(kid) && !stale) return this.keys.get(kid);
+    if (this.inflight || Date.now() >= this.nextRefreshAt) await this.refresh();
+    else if (this.refreshFailed || stale) throw authUnavailable();
     return this.keys.get(kid) ?? null;
   }
   /**
   * Verify an `Authorization` header value.
   *
   * @returns the verified claims, or `null` for absent / malformed / expired /
-  *   wrong-issuer / bad-signature. One `null` for every failure on purpose:
-  *   the caller answers 401 either way, and a detailed reason is an oracle.
+  *   wrong-issuer / bad-signature. Credential refusals deliberately share one
+  *   result. An unavailable keyset throws 503 instead: no authentication
+  *   decision was possible, and the caller's session must not be invalidated.
   */
   async verify(authorization) {
     if (!authorization || !authorization.startsWith("Bearer ")) return null;
@@ -1445,7 +1463,10 @@ var AuthVerifier = class {
     } catch {
       return null;
     }
-    if (header.alg !== "ES256" || !header.kid) return null;
+    if (!header || typeof header !== "object" || header.alg !== "ES256" || typeof header.kid !== "string" || !header.kid) return null;
+    if (!claims || typeof claims !== "object" || Array.isArray(claims)) return null;
+    if (typeof claims.exp === "number" && claims.exp * 1e3 <= Date.now()) return null;
+    if (this.issuer && claims.iss !== this.issuer) return null;
     const key2 = await this.key(header.kid);
     if (!key2) return null;
     let ok = false;
@@ -1459,7 +1480,6 @@ var AuthVerifier = class {
     }
     if (!ok) return null;
     if (typeof claims.exp === "number" && claims.exp * 1e3 <= Date.now()) return null;
-    if (this.issuer && claims.iss !== this.issuer) return null;
     return claims;
   }
 };
@@ -6807,7 +6827,12 @@ async function createApp(opts) {
     }
     const target = matchRoute(routes, body.method ?? "POST", body.path);
     const spec = effectiveAuth(target?.entry.meta.options?.auth, target?.entry.controllerAuth);
-    const callerClaims = await auth.verify(req.headers.get("authorization"));
+    let callerClaims;
+    try {
+      callerClaims = await auth.verify(req.headers.get("authorization"));
+    } catch (err) {
+      return errorResponse(err, "upload authentication", requestId);
+    }
     if (spec.required && !callerClaims) {
       return envelope("unauthorized", "A valid access token is required", 401, requestId);
     }
@@ -6857,7 +6882,12 @@ async function createApp(opts) {
     let attestedDevice = null;
     let attestChallengeOut = null;
     const spec = effectiveAuth(meta.options?.auth, hit.entry.controllerAuth);
-    const claims = await auth.verify(req.headers.get("authorization"));
+    let claims;
+    try {
+      claims = await auth.verify(req.headers.get("authorization"));
+    } catch (err) {
+      return errorResponse(err, "authentication", requestId);
+    }
     if (spec.required && !claims) {
       return envelope("unauthorized", "A valid access token is required", 401, requestId);
     }