@peac/protocol 0.16.4 → 0.16.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/_internal/address-policy.d.ts +28 -0
- package/dist/_internal/address-policy.d.ts.map +1 -0
- package/dist/index.cjs +334 -90
- package/dist/index.cjs.map +1 -1
- package/dist/index.mjs +334 -90
- package/dist/index.mjs.map +1 -1
- package/dist/jwks-resolver.d.ts +1 -1
- package/dist/jwks-resolver.d.ts.map +1 -1
- package/dist/ssrf-safe-fetch.d.ts +18 -11
- package/dist/ssrf-safe-fetch.d.ts.map +1 -1
- package/dist/verifier-core.d.ts.map +1 -1
- package/package.json +5 -5
package/dist/jwks-resolver.d.ts
CHANGED
|
@@ -6,7 +6,7 @@
|
|
|
6
6
|
* 2. Validate issuer config (schema, issuer match)
|
|
7
7
|
* 3. Validate jwks_uri is HTTPS (protocol-level enforcement)
|
|
8
8
|
* 4. Fetch JWKS from jwks_uri (SSRF-safe, 64KB cap)
|
|
9
|
-
* 5. Validate JWKS shape
|
|
9
|
+
* 5. Validate JWKS shape; skip entries that are not Ed25519 public verification keys
|
|
10
10
|
*
|
|
11
11
|
* No fallback paths: peac-issuer.json with jwks_uri is the only
|
|
12
12
|
* supported key discovery mechanism.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwks-resolver.d.ts","sourceRoot":"","sources":["../src/jwks-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAO3D;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,GAAG,EAAE,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,OAAO,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,wDAAwD;IACxD,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,KAAK,CAAC;IACV,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAeD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAEhC,GACL,MAAM,CAMR;AAWD,iFAAiF;AACjF,wBAAgB,sBAAsB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAE9E;AAmGD;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAgCD;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;
|
|
1
|
+
{"version":3,"file":"jwks-resolver.d.ts","sourceRoot":"","sources":["../src/jwks-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAO3D;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,GAAG,EAAE,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,OAAO,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,wDAAwD;IACxD,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,KAAK,CAAC;IACV,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAeD;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAEhC,GACL,MAAM,CAMR;AAWD,iFAAiF;AACjF,wBAAgB,sBAAsB,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAE9E;AAmGD;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAgCD;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAwHD;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAwL5B"}
|
|
@@ -3,9 +3,12 @@
|
|
|
3
3
|
*
|
|
4
4
|
* Implements SSRF protection per VERIFIER-SECURITY-MODEL.md:
|
|
5
5
|
* - HTTPS only
|
|
6
|
-
* -
|
|
7
|
-
*
|
|
8
|
-
* -
|
|
6
|
+
* - Allow only global unicast addresses: every block in the IANA IPv4 and IPv6
|
|
7
|
+
* special-purpose registries is refused, including private, loopback,
|
|
8
|
+
* link-local, shared, multicast and reserved ranges; IPv4-mapped and NAT64
|
|
9
|
+
* forms are judged by the embedded IPv4 address
|
|
10
|
+
* - Fail closed when DNS returns no addresses
|
|
11
|
+
* - Connect only to the vetted addresses (no second resolution)
|
|
9
12
|
* - Redirect limits and scheme downgrade protection
|
|
10
13
|
*
|
|
11
14
|
* ## Security Model: Best-Effort Protection
|
|
@@ -34,9 +37,8 @@
|
|
|
34
37
|
*
|
|
35
38
|
* | Protection | Requires |
|
|
36
39
|
* |------------|----------|
|
|
37
|
-
* |
|
|
38
|
-
* |
|
|
39
|
-
* | Link-local blocking (169.254.0.0/16) | DNS pre-resolution |
|
|
40
|
+
* | Special-purpose address blocking (global unicast only) | DNS pre-resolution |
|
|
41
|
+
* | Connection to the vetted address only | DNS pre-resolution + `https` module |
|
|
40
42
|
*
|
|
41
43
|
* ## Runtime Capability Model
|
|
42
44
|
*
|
|
@@ -44,7 +46,7 @@
|
|
|
44
46
|
*
|
|
45
47
|
* | Runtime | DNS Pre-Resolution | IP Blocking | Notes |
|
|
46
48
|
* |-------------------|-------------------|-------------|-------|
|
|
47
|
-
* | Node.js | YES | YES |
|
|
49
|
+
* | Node.js | YES | YES | Resolve once, vet, connect to the vetted address |
|
|
48
50
|
* | Browser | NO | NO | Relies on server-side validation |
|
|
49
51
|
* | Cloudflare Workers| NO | NO | No DNS access, relies on CF network |
|
|
50
52
|
* | Deno | NO | NO | dns module not available by default |
|
|
@@ -170,7 +172,12 @@ export interface SSRFFetchError {
|
|
|
170
172
|
blockedUrl?: string;
|
|
171
173
|
}
|
|
172
174
|
/**
|
|
173
|
-
* Check if an IP address is
|
|
175
|
+
* Check if an IP address is outside the allowed address space.
|
|
176
|
+
*
|
|
177
|
+
* Only global unicast addresses outside the IANA IPv4 and IPv6 special-purpose
|
|
178
|
+
* blocks are allowed. IPv4-mapped and NAT64 (64:ff9b::/96) IPv6 addresses are
|
|
179
|
+
* judged by the embedded IPv4 address; input that does not parse as an address
|
|
180
|
+
* is blocked.
|
|
174
181
|
*/
|
|
175
182
|
export declare function isBlockedIP(ip: string): {
|
|
176
183
|
blocked: true;
|
|
@@ -183,9 +190,9 @@ export declare function isBlockedIP(ip: string): {
|
|
|
183
190
|
*
|
|
184
191
|
* This function implements the SSRF protection algorithm from VERIFIER-SECURITY-MODEL.md:
|
|
185
192
|
* 1. Parse URL; reject if not https://
|
|
186
|
-
* 2. Resolve hostname to IP(s)
|
|
187
|
-
* 3. For each IP: reject
|
|
188
|
-
* 4. Perform
|
|
193
|
+
* 2. Resolve hostname to IP(s); an empty answer is a failure
|
|
194
|
+
* 3. For each IP: reject unless it is a global unicast address
|
|
195
|
+
* 4. Perform the request with timeout, connecting only to the vetted IPs
|
|
189
196
|
* 5. On redirect: increment counter, reject if > max, apply checks to redirect URL
|
|
190
197
|
* 6. Validate response size
|
|
191
198
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ssrf-safe-fetch.d.ts","sourceRoot":"","sources":["../src/ssrf-safe-fetch.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"ssrf-safe-fetch.d.ts","sourceRoot":"","sources":["../src/ssrf-safe-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAUH;;GAEG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,KAAK,GACL,MAAM,GACN,SAAS,GACT,oBAAoB,GACpB,cAAc,GACd,SAAS,CAAC;AAEd;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mCAAmC;IACnC,OAAO,EAAE,WAAW,CAAC;IACrB,oDAAoD;IACpD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,2DAA2D;IAC3D,UAAU,EAAE,OAAO,CAAC;IACpB,+CAA+C;IAC/C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qDAAqD;IACrD,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;IAChD,mCAAmC;IACnC,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAOD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,IAAI,gBAAgB,CAOtD;AA4GD;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,QAAQ,EAAE,UAAU,CAAC;IACrB,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB;IACnB,EAAE,EAAE,KAAK,CAAC;IACV,wBAAwB;IACxB,MAAM,EACF,aAAa,GACb,WAAW,GACX,YAAY,GACZ,UAAU,GACV,YAAY,GACZ,aAAa,GACb,oBAAoB,GACpB,kBAAkB,GAClB,uBAAuB,GACvB,SAAS,GACT,oBAAoB,GACpB,oBAAoB,GACpB,eAAe,CAAC;IACpB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,MAAM,GACT;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,YAAY,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAG1F;AAgND;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,GAAG,cAAc,CAAC,CAwS3C;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,GAC3C,OAAO,CAAC,eAAe,GAAG,cAAc,CAAC,CAS3C;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,GAC3C,OAAO,CAAC,eAAe,GAAG,cAAc,CAAC,CAS3C"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifier-core.d.ts","sourceRoot":"","sources":["../src/verifier-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAWH,OAAO,EAAE,iBAAiB,EAAiB,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"verifier-core.d.ts","sourceRoot":"","sources":["../src/verifier-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAWH,OAAO,EAAE,iBAAiB,EAAiB,MAAM,cAAc,CAAC;AAKhE,OAAO,KAAK,EAAa,kBAAkB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAqCzF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,0BAA0B;IAC1B,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,0BAA0B;IAC1B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,+BAA+B;IAC/B,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAyGD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgd7F"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@peac/protocol",
|
|
3
|
-
"version": "0.16.
|
|
3
|
+
"version": "0.16.5",
|
|
4
4
|
"description": "PEAC protocol implementation - receipt issuance and verification",
|
|
5
5
|
"main": "dist/index.cjs",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -38,10 +38,10 @@
|
|
|
38
38
|
},
|
|
39
39
|
"dependencies": {
|
|
40
40
|
"uuidv7": "^0.6.3",
|
|
41
|
-
"zod": "^4.
|
|
42
|
-
"@peac/
|
|
43
|
-
"@peac/
|
|
44
|
-
"@peac/
|
|
41
|
+
"zod": "^4.6.6",
|
|
42
|
+
"@peac/schema": "0.16.5",
|
|
43
|
+
"@peac/crypto": "0.16.5",
|
|
44
|
+
"@peac/kernel": "0.16.5"
|
|
45
45
|
},
|
|
46
46
|
"devDependencies": {
|
|
47
47
|
"@types/node": "^22.19.11",
|