@pawmaskrelease/psecure 0.1.0-beta → 1.1.0

package/CHANGELOG.md

@@ -0,0 +1,49 @@
+# Changelog: `@pawmaskrelease/psecure`
+
+## 1.1.0
+
+Integrations in under an hour: framework adapters, a sealing `fetch`, actionable errors and a `doctor` CLI.
+Backward compatible with 1.0.0: nothing was removed or changed in meaning, and every 1.0.0 import keeps working.
+
+### Added
+
+- **Server adapters** on one guard core (`createPSecureGuard`), configured from `PSECURE_*` environment variables:
+  - `@pawmaskrelease/psecure/fastify`: `psecureFastify` plugin. It captures the raw body itself, sets `request.psecure`,
+    and supports route config `{ psecure: true | false }`.
+  - `@pawmaskrelease/psecure/express`: `psecure()` middleware and `psecureRawBody` (for `express.json({ verify })`);
+    sets `req.psecure`.
+  - `@pawmaskrelease/psecure/edge`: `withPSecure(handler)` and `createPSecureEdge()` for Next.js, Hono, Cloudflare
+    Workers, Bun and Deno.
+  - `PSECURE_REQUEST_HEADERS` / `PSECURE_EXPOSED_HEADERS` for CORS, `getPSecureDecision(request)`, `onDecision` hook,
+    `createPSecureAuditThrottle`, pino-compatible logging that never contains the key, envelope, lease or body.
+  - Decision table: Monitor never blocks. Block refuses denied and malformed requests everywhere, and fails closed
+    (missing envelope, authority down) only on `protect` routes (default: all guarded routes). A lease reissue is
+    answered `401` + `x-psecure-reissued-lease`; any other refusal is `403 { error: 'PSECURE_REJECTED' }`.
+- **The console Monitor/Block switch drives enforcement.** The default mode `auto` follows the app's mode, which the
+  authority (>= 1.1) reports on every verdict as `appMode`. The last mode seen is cached for 10 minutes when a request
+  carries no verdict; a cold start behaves as Monitor. `PSECURE_MODE=monitor | enforce | off` overrides the switch.
+  `PSecureVerificationVerdict.appMode` is typed.
+- **App pinning** (`appKey` / `PSECURE_APP_KEY`, recommended): the guard sends it as `expectedAppKey`. The
+  authority then denies a lease of any other application, same organization included, with the new reason
+  `app_mismatch`, and the guard only takes a console mode reported for that app (`verdict.appKey`). This closes the
+  downgrade where a lease of a Monitor app is replayed against a Block app's backend. In `auto` without it, the guard
+  logs a one-time `APP_KEY_NOT_PINNED` warning, and `doctor` warns.
+  `PSecureRequestVerificationContext.expectedAppKey`, `PSecureHttpVerifyInput.expectedAppKey`, `verdict.appKey` and
+  the `app_mismatch` reason are typed and pass through `PSecureRemoteAuthorityClient`.
+- **`createPSecureFetch`** (`@pawmaskrelease/psecure/fetch`, also from the root): a drop-in sealing `fetch`. It falls
+  back gracefully to plain `fetch`, filters origins, never sends a POST twice, provides `setAccount()`, refreshes the
+  lease in the background, defaults to `telemetry: 'minimal'` and lazy-loads the client core.
+- **`PSecureConfigError`** with a stable `code`, an English `hint` and a `docsUrl`, for common misconfigurations
+  (public key missing, invalid or mismatched; keys swapped; non-https authority; CSP or unreachable authority; origins;
+  clock skew; raw body; server key missing or rejected).
+- **`npx @pawmaskrelease/psecure doctor`**: checks that the authority is reachable, the pinned key, the clock, CORS,
+  a test lease with the app key and the server key (from `PSECURE_SERVER_KEY` only, never printed). Optionally checks
+  your API's CORS.
+- `PSECURE_SDK_VERSION`.
+
+### Changed
+
+- The `PSecureClient.connect` lease failure error now carries `status` and the authority's SDK `code`
+  (`INVALID_APP_KEY`, `CROSS_TENANT_APP_KEY`, …), and names the code in its message.
+- The `@pawmaskrelease/psecure/server` barrel also exports the guard and the Express and Edge adapters (the Fastify
+  plugin uses `node:stream` and has its own subpath, so `/server` stays edge-safe).

package/LICENSE

@@ -1,44 +1,44 @@
-Paw Mask PSecure SDK — Proprietary Commercial License
-
-Copyright (c) Paw Mask. All rights reserved.
-
-This software and its accompanying files (the "Software") are the confidential
-and proprietary property of Paw Mask. The Software is licensed, not sold.
-
-1. License grant. Subject to your full and ongoing compliance with this
-   license, Paw Mask grants you a limited, non-exclusive, non-transferable,
-   non-sublicensable, revocable license to install and use the Software solely
-   in connection with a valid, active Paw Mask PSecure subscription, or under
-   the written terms of an authorized Paw Mask evaluation or sandbox agreement.
-
-2. Restrictions. Except to the extent expressly permitted by this license or
-   by mandatory applicable law, you may NOT, and may not permit any third party
-   to:
-   (a) copy, redistribute, publish, sublicense, sell, rent, lease, or otherwise
-       make the Software available to any third party;
-   (b) reverse engineer, decompile, disassemble, deobfuscate, or otherwise
-       attempt to derive the source code, internal design, protocols, or
-       underlying ideas of the Software, or circumvent or disable any of its
-       security, anti-tamper, or licensing mechanisms;
-   (c) modify, adapt, or create derivative works of the Software; or
-   (d) remove, obscure, or alter any proprietary notices.
-
-3. Ownership. Paw Mask retains all right, title, and interest in and to the
-   Software, including all intellectual property rights. No rights are granted
-   except as expressly set out in this license.
-
-4. Termination. This license terminates automatically if your PSecure
-   subscription or evaluation/sandbox agreement lapses or is terminated, or if
-   you breach any term of this license. Upon termination you must cease all use
-   and destroy all copies of the Software.
-
-5. No warranty. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-   EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
-
-6. Limitation of liability. TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT
-   SHALL PAW MASK BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL,
-   CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS OR DATA, ARISING
-   OUT OF OR RELATED TO THE SOFTWARE.
-
-For licensing inquiries: licensing@pawmask.com — https://pawmask.com/docs/psecure
+Paw Mask PSecure SDK — Proprietary Commercial License
+
+Copyright (c) Paw Mask. All rights reserved.
+
+This software and its accompanying files (the "Software") are the confidential
+and proprietary property of Paw Mask. The Software is licensed, not sold.
+
+1. License grant. Subject to your full and ongoing compliance with this
+   license, Paw Mask grants you a limited, non-exclusive, non-transferable,
+   non-sublicensable, revocable license to install and use the Software solely
+   in connection with a valid, active Paw Mask PSecure subscription, or under
+   the written terms of an authorized Paw Mask evaluation or sandbox agreement.
+
+2. Restrictions. Except to the extent expressly permitted by this license or
+   by mandatory applicable law, you may NOT, and may not permit any third party
+   to:
+   (a) copy, redistribute, publish, sublicense, sell, rent, lease, or otherwise
+       make the Software available to any third party;
+   (b) reverse engineer, decompile, disassemble, deobfuscate, or otherwise
+       attempt to derive the source code, internal design, protocols, or
+       underlying ideas of the Software, or circumvent or disable any of its
+       security, anti-tamper, or licensing mechanisms;
+   (c) modify, adapt, or create derivative works of the Software; or
+   (d) remove, obscure, or alter any proprietary notices.
+
+3. Ownership. Paw Mask retains all right, title, and interest in and to the
+   Software, including all intellectual property rights. No rights are granted
+   except as expressly set out in this license.
+
+4. Termination. This license terminates automatically if your PSecure
+   subscription or evaluation/sandbox agreement lapses or is terminated, or if
+   you breach any term of this license. Upon termination you must cease all use
+   and destroy all copies of the Software.
+
+5. No warranty. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+   EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
+
+6. Limitation of liability. TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT
+   SHALL PAW MASK BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL,
+   CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS OR DATA, ARISING
+   OUT OF OR RELATED TO THE SOFTWARE.
+
+For licensing inquiries: licensing@pawmask.com — https://pawmask.com/docs/psecure