@rebasepro/server 0.23.0 → 0.24.1-canary.g56af4a4

package/dist/{jwt-DnQHNFCl.js → jwt-Bqcu7cGt.js}

@@ -3,9 +3,9 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { i as __toESM, n as __exportAll, r as __require, t as __commonJSMin } from "./rolldown-runtime-dW7B1o5h.js";
-import { r as logger } from "./logger-DO2PZc4i.js";
-import { a as canonicalStorageId } from "./keys-CogCQpxG.js";
-import { createPrivateKey, createPublicKey } from "crypto";
+import { r as logger } from "./logger-D-S-hO5e.js";
+import { a as canonicalStorageId } from "./keys-GAVZqbqx.js";
+import { createPrivateKey, createPublicKey, createSecretKey } from "crypto";
 //#region src/utils/portable-crypto.ts
 /**
 * The cryptography the request path needs, on primitives every runtime has.
@@ -2386,7 +2386,7 @@ var require_verify = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var validateAsymmetricKey = require_validateAsymmetricKey();
 	var PS_SUPPORTED = require_psSupported();
 	var jws = require_jws();
-	var { KeyObject: KeyObject$1, createSecretKey: createSecretKey$1, createPublicKey: createPublicKey$1 } = __require("crypto");
+	var { KeyObject: KeyObject$1, createSecretKey: createSecretKey$2, createPublicKey: createPublicKey$1 } = __require("crypto");
 	var PUB_KEY_ALGS = [
 		"RS256",
 		"RS384",
@@ -2457,7 +2457,7 @@ var require_verify = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				secretOrPublicKey = createPublicKey$1(secretOrPublicKey);
 			} catch (_) {
 				try {
-					secretOrPublicKey = createSecretKey$1(typeof secretOrPublicKey === "string" ? Buffer.from(secretOrPublicKey) : secretOrPublicKey);
+					secretOrPublicKey = createSecretKey$2(typeof secretOrPublicKey === "string" ? Buffer.from(secretOrPublicKey) : secretOrPublicKey);
 				} catch (_) {
 					return done(new JsonWebTokenError("secretOrPublicKey is not valid key material"));
 				}
@@ -4015,7 +4015,7 @@ var require_sign = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var isPlainObject = require_lodash_isplainobject();
 	var isString = require_lodash_isstring();
 	var once = require_lodash_once();
-	var { KeyObject, createSecretKey, createPrivateKey: createPrivateKey$1 } = __require("crypto");
+	var { KeyObject, createSecretKey: createSecretKey$1, createPrivateKey: createPrivateKey$1 } = __require("crypto");
 	var SUPPORTED_ALGS = [
 		"RS256",
 		"RS384",
@@ -4159,7 +4159,7 @@ var require_sign = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			secretOrPrivateKey = createPrivateKey$1(secretOrPrivateKey);
 		} catch (_) {
 			try {
-				secretOrPrivateKey = createSecretKey(typeof secretOrPrivateKey === "string" ? Buffer.from(secretOrPrivateKey) : secretOrPrivateKey);
+				secretOrPrivateKey = createSecretKey$1(typeof secretOrPrivateKey === "string" ? Buffer.from(secretOrPrivateKey) : secretOrPrivateKey);
 			} catch (_) {
 				return failure(/* @__PURE__ */ new Error("secretOrPrivateKey is not valid key material"));
 			}
@@ -4258,61 +4258,8 @@ var require_jsonwebtoken = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	};
 }));
 //#endregion
-//#region src/auth/jwt-crypto.ts
-var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
-/** Sign a set of claims. Rejects if the key and algorithm disagree. */
-async function signJwt(payload, key, options) {
-	return import_jsonwebtoken.default.sign(payload, key, {
-		algorithm: options.algorithm,
-		...options.expiresIn === void 0 ? {} : { expiresIn: options.expiresIn },
-		...options.keyid === void 0 ? {} : { keyid: options.keyid }
-	});
-}
-/**
-* Verify a token against one key and an explicit algorithm list, and return its
-* claims. Rejects — never returns null — when the token is not valid.
-*
-* `algorithms` has no default and must not acquire one. Letting the verifier
-* read `alg` out of the token's own header is the canonical JWT vulnerability:
-* an attacker takes a published RSA public key, HMACs a payload of their
-* choosing with it, sets `alg: HS256`, and a verifier holding that same public
-* key as "the secret" agrees. The caller decides the algorithm from the key it
-* chose, and {@link decodeProtectedHeader} exists so it can choose that key
-* without trusting anything the token asserts.
-*/
-async function verifyJwt(token, key, options) {
-	return import_jsonwebtoken.default.verify(token, key, { algorithms: options.algorithms });
-}
-/**
-* The token's unverified header — `kid` and `alg` — or an empty object.
-*
-* Unverified is the point: this is read *in order to* pick the key that will
-* verify it, so it cannot itself be verified first. Nothing but key selection
-* may depend on it, and key selection then pins the algorithm.
-*
-* Implemented here rather than via the JWT library because it is plain
-* base64url and JSON, needs no cryptography, and there is no reason for the
-* portable half of this module to wait on the non-portable half.
-*/
-function decodeProtectedHeader(token) {
-	const encoded = token.split(".")[0];
-	if (!encoded) return {};
-	try {
-		const base64 = encoded.replace(/-/g, "+").replace(/_/g, "/");
-		const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
-		const header = JSON.parse(atob(padded));
-		if (typeof header !== "object" || header === null) return {};
-		const { kid, alg } = header;
-		return {
-			...typeof kid === "string" ? { kid } : {},
-			...typeof alg === "string" ? { alg } : {}
-		};
-	} catch {
-		return {};
-	}
-}
-//#endregion
 //#region src/auth/jwt-keys.ts
+var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
 /**
 * The algorithm a key type implies.
 *
@@ -4416,13 +4363,170 @@ function toJwks(keys) {
 		use: "sig"
 	})) };
 }
+/**
+* Key strings handed to the JWT library, imported once each.
+*
+* `jsonwebtoken` turns every key that is not a `KeyObject` into one on every
+* call: `createPublicKey` (verify) or `createPrivateKey` (sign) first, and
+* when that throws — as it does for every HMAC secret, which is not PEM —
+* `createSecretKey`. The failed parse and its exception were about 15 of the
+* 21 µs of each access-token verify. These are that same conversion, in the
+* same order, done once per string; `jwt-crypto.ts` hands the library the
+* `KeyObject` it produces. Here rather than there because key parsing lives
+* here (see `jwt-crypto.ts`), and so does this module's `node:crypto`.
+*
+* Keyed by the key string itself, so a rotated secret (`configureJwt`) is a
+* new entry and the old one is simply no longer asked for; bounded, oldest
+* first, so a process cycling through secrets does not keep all of them. Only
+* keys live here — never a verification result. Empty strings and anything
+* not a string pass through untouched, so `jsonwebtoken` refuses them exactly
+* as it did ("secret or public key must be provided" and the like), and so
+* does a string no conversion accepts.
+*/
+var IMPORTED_KEY_LIMIT = 16;
+var importedVerificationKeys = /* @__PURE__ */ new Map();
+var importedSigningKeys = /* @__PURE__ */ new Map();
+function importedKey(key, cache, asymmetric) {
+	if (typeof key !== "string" || key === "") return key;
+	const cached = cache.get(key);
+	if (cached) return cached;
+	let keyObject;
+	try {
+		keyObject = asymmetric(key);
+	} catch {
+		try {
+			keyObject = createSecretKey(Buffer.from(key));
+		} catch {
+			return key;
+		}
+	}
+	if (cache.size >= IMPORTED_KEY_LIMIT) {
+		const oldest = cache.keys().next();
+		if (!oldest.done) cache.delete(oldest.value);
+	}
+	cache.set(key, keyObject);
+	return keyObject;
+}
+/** A verification key, as `jsonwebtoken.verify` would import it, once per string. */
+function importedVerificationKey(key) {
+	return importedKey(key, importedVerificationKeys, createPublicKey);
+}
+/** A signing key, as `jsonwebtoken.sign` would import it, once per string. */
+function importedSigningKey(key) {
+	return importedKey(key, importedSigningKeys, createPrivateKey);
+}
+//#endregion
+//#region src/auth/jwt-crypto.ts
+/**
+* The one module in the request path that knows what signs a JWT.
+*
+* `jsonwebtoken` is built on `node:crypto` and is synchronous. Every portable
+* JWT implementation — WebCrypto directly, or `jose` on top of it — is
+* asynchronous, because `crypto.subtle` is. So the shape of the boundary
+* matters more than what is behind it right now: **these functions are async
+* and `jsonwebtoken` is confined to this file.**
+*
+* That is the expensive half of the change, and it is why it was made before
+* anything actually needed it. Swapping the implementation touches one file.
+* Going from synchronous to asynchronous verification touches every caller of
+* every function that verifies a token — which, at the time of writing, is
+* eleven call sites in `src` and about a hundred and eighty in the suite. Doing
+* that as a line item inside a runtime port, on top of everything else moving
+* at once, is how a port stalls.
+*
+* What is **not** here: key parsing. `jwt-keys.ts` turns PEM into
+* `node:crypto` `KeyObject`s, and the portable replacement for that is
+* `jose`'s `importSPKI`/`importPKCS8` — a dependency this package does not
+* carry yet. It stays recorded in `contracts/portable-core.txt` rather than
+* wrapped in something that would imply it had moved.
+*
+* ## Replacing this with jose
+*
+* Add `jose` (a lockfile change, so it happens in the primary checkout), then:
+* `signJwt` becomes `new SignJWT(payload).setProtectedHeader({ alg, kid })
+* .setExpirationTime(...).sign(key)`, `verifyJwt` becomes `jwtVerify(token,
+* key, { algorithms })`, and `decodeProtectedHeader` is already what jose's
+* function of that name does. Nothing outside this file changes — with one
+* exception worth writing down, because nothing would fail loudly:
+* **`jsonwebtoken` stamps `iat` on every token it signs and jose does not**
+* (it wants an explicit `.setIssuedAt()`). `iat` is what the revocation
+* watermark compares against — `logout`, `change-password`, `reset-password`
+* and `DELETE /auth/sessions` all stamp `tokensValidAfter` on the user, and
+* every access token issued before that mark is void. Tokens minted without
+* `iat` would verify perfectly well and simply stop being revocable.
+*
+* @module
+*/
+/** Sign a set of claims. Rejects if the key and algorithm disagree. */
+async function signJwt(payload, key, options) {
+	return import_jsonwebtoken.default.sign(payload, importedSigningKey(key), {
+		algorithm: options.algorithm,
+		...options.expiresIn === void 0 ? {} : { expiresIn: options.expiresIn },
+		...options.keyid === void 0 ? {} : { keyid: options.keyid }
+	});
+}
+/**
+* Verify a token against one key and an explicit algorithm list, and return its
+* claims. Rejects — never returns null — when the token is not valid.
+*
+* `algorithms` has no default and must not acquire one. Letting the verifier
+* read `alg` out of the token's own header is the canonical JWT vulnerability:
+* an attacker takes a published RSA public key, HMACs a payload of their
+* choosing with it, sets `alg: HS256`, and a verifier holding that same public
+* key as "the secret" agrees. The caller decides the algorithm from the key it
+* chose, and {@link decodeProtectedHeader} exists so it can choose that key
+* without trusting anything the token asserts.
+*/
+async function verifyJwt(token, key, options) {
+	return import_jsonwebtoken.default.verify(token, importedVerificationKey(key), { algorithms: options.algorithms });
+}
+/**
+* Whether a {@link verifyJwt} rejection says only that the token's `exp` has
+* passed — the routine refusal that sends a client to refresh — rather than
+* that the token is not one we signed. Here because the library decides how
+* that is spelled.
+*/
+function isExpiredJwtError(error) {
+	return error instanceof import_jsonwebtoken.default.TokenExpiredError;
+}
+/**
+* The token's unverified header — `kid` and `alg` — or an empty object.
+*
+* Unverified is the point: this is read *in order to* pick the key that will
+* verify it, so it cannot itself be verified first. Nothing but key selection
+* may depend on it, and key selection then pins the algorithm.
+*
+* Implemented here rather than via the JWT library because it is plain
+* base64url and JSON, needs no cryptography, and there is no reason for the
+* portable half of this module to wait on the non-portable half.
+*/
+function decodeProtectedHeader(token) {
+	const encoded = token.split(".")[0];
+	if (!encoded) return {};
+	try {
+		const base64 = encoded.replace(/-/g, "+").replace(/_/g, "/");
+		const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
+		const header = JSON.parse(atob(padded));
+		if (typeof header !== "object" || header === null) return {};
+		const { kid, alg } = header;
+		return {
+			...typeof kid === "string" ? { kid } : {},
+			...typeof alg === "string" ? { alg } : {}
+		};
+	} catch {
+		return {};
+	}
+}
 //#endregion
 //#region src/auth/jwt.ts
 var jwt_exports = /* @__PURE__ */ __exportAll({
+	DEFAULT_REFRESH_EXPIRES_IN: () => "30d",
 	MAX_COOKIE_AGE_MS: () => MAX_COOKIE_AGE_MS,
 	MCP_ACCESS_PURPOSE: () => MCP_ACCESS_PURPOSE,
 	MFA_PENDING_PURPOSE: () => MFA_PENDING_PURPOSE,
 	configureJwt: () => configureJwt,
+	configuredJwtSecret: () => configuredJwtSecret,
+	customClaimsOf: () => customClaimsOf,
 	generateAccessToken: () => generateAccessToken,
 	generateDownloadToken: () => generateDownloadToken,
 	generateMcpAccessToken: () => generateMcpAccessToken,
@@ -4459,6 +4563,7 @@ var RESERVED_TOKEN_CLAIMS = /* @__PURE__ */ new Set([
 	"roles",
 	"aal",
 	"isAnonymous",
+	"sid",
 	"purpose",
 	"iat",
 	"exp",
@@ -4467,7 +4572,13 @@ var RESERVED_TOKEN_CLAIMS = /* @__PURE__ */ new Set([
 	"aud",
 	"jti"
 ]);
-/** The custom half of a verified token, or nothing when there is none. */
+/**
+* The custom half of a verified token, or nothing when there is none.
+*
+* Exported for the one other place that builds a request identity's claims
+* without a token to verify — `resolveUser`, which reads what a token minted
+* now would carry — so both drop the same identity claims.
+*/
 function customClaimsOf(decoded) {
 	const claims = {};
 	for (const [key, value] of Object.entries(decoded)) {
@@ -4479,7 +4590,7 @@ function customClaimsOf(decoded) {
 var jwtConfig = {
 	secret: "",
 	accessExpiresIn: "1h",
-	refreshExpiresIn: "400d"
+	refreshExpiresIn: "30d"
 };
 /**
 * The parsed signing keys, and which one mints new access tokens.
@@ -4551,6 +4662,14 @@ function configureJwt(config) {
 function getJwks() {
 	return toJwks(signingKeys);
 }
+/**
+* The secret `configureJwt` was given, or undefined before it is called. For
+* `mfa-crypto.ts`, which falls back to it when no MFA key is set — the secret
+* passed in code, not only the one in `JWT_SECRET`.
+*/
+function configuredJwtSecret() {
+	return jwtConfig.secret || void 0;
+}
 /** Is this backend signing access tokens asymmetrically? */
 function hasAsymmetricSigningKey() {
 	return activeSigningKey !== null;
@@ -4572,14 +4691,15 @@ function isJwtConfigured() {
 /**
 * Generate an access token (short-lived, 1 hour by default)
 */
-async function generateAccessToken(uid, roles, aal = "aal1", customClaims, isAnonymous = false) {
+async function generateAccessToken(uid, roles, aal = "aal1", customClaims, isAnonymous = false, sessionId) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
 	const payload = {
 		...customClaims,
 		uid,
 		roles,
 		aal,
-		...isAnonymous ? { isAnonymous: true } : {}
+		...isAnonymous ? { isAnonymous: true } : {},
+		...sessionId ? { sid: sessionId } : {}
 	};
 	if (activeSigningKey) return signJwt(payload, activeSigningKey.privateKey, {
 		expiresIn: jwtConfig.accessExpiresIn,
@@ -4691,21 +4811,25 @@ async function verifyAccessToken(token) {
 			aal,
 			...decoded.isAnonymous === true ? { isAnonymous: true } : {},
 			iat: decoded.iat,
+			...typeof decoded.exp === "number" ? { exp: decoded.exp } : {},
+			...typeof decoded.sid === "string" && decoded.sid ? { sid: decoded.sid } : {},
 			...(() => {
 				const claims = customClaimsOf(decoded);
 				return claims ? { claims } : {};
 			})()
 		};
 	} catch (error) {
-		logger.error("[JWT] Verification failed", {
-			error,
-			detail: token.substring(0, 15)
-		});
+		if (isExpiredJwtError(error)) {
+			logger.debug("[JWT] Access token expired");
+			return null;
+		}
+		logger.error("[JWT] Verification failed", { error });
 		return null;
 	}
 }
 /**
-* Generate a random refresh token (long-lived, 30 days by default)
+* Generate a random refresh token. Long-lived: 30 days by default, sliding —
+* see {@link getRefreshTokenTtlMs}.
 */
 function generateRefreshToken() {
 	return randomHex(40);
@@ -4724,7 +4848,7 @@ function hashRefreshToken(token) {
 */
 var MAX_COOKIE_AGE_MS = 400 * 24 * 60 * 60 * 1e3;
 /** Fallback when `refreshExpiresIn` is unset. {@link configureJwt} refuses an unparseable one. */
-var DEFAULT_REFRESH_TTL_MS = MAX_COOKIE_AGE_MS;
+var DEFAULT_REFRESH_TTL_MS = 720 * 60 * 60 * 1e3;
 /**
 * How long a refresh token is valid for, in milliseconds.
 *
@@ -4812,17 +4936,22 @@ async function verifyMfaPendingToken(token) {
 * site that forgets to pass a named source produces a default-scoped token,
 * which fails closed at `/file/*` rather than over-granting.
 */
-async function generateDownloadToken(path, expiresInSeconds = 300, storageId) {
+async function generateDownloadToken(path, expiresInSeconds = 300, storageId, principal) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
 	return signJwt({
 		purpose: "file-read",
 		path,
-		storageId: canonicalStorageId(storageId)
+		storageId: canonicalStorageId(storageId),
+		...principal ? { rl: await downloadTokenRateLimitMark(principal) } : {}
 	}, jwtConfig.secret, {
 		expiresIn: expiresInSeconds,
 		algorithm: "HS256"
 	});
 }
+/** See {@link DownloadTokenPayload.rl}. */
+async function downloadTokenRateLimitMark(principal) {
+	return (await sha256Hex(`download-token-rl:${principal}`)).slice(0, 32);
+}
 /**
 * Verify and decode a download token.
 *
@@ -4840,11 +4969,12 @@ async function verifyDownloadToken(token) {
 		if (decoded && decoded.purpose === "file-read" && typeof decoded.path === "string") return {
 			purpose: "file-read",
 			path: decoded.path,
-			storageId: canonicalStorageId(typeof decoded.storageId === "string" ? decoded.storageId : null)
+			storageId: canonicalStorageId(typeof decoded.storageId === "string" ? decoded.storageId : null),
+			...typeof decoded.rl === "string" ? { rl: decoded.rl } : {}
 		};
 		return null;
 	} catch (error) {
-		logger.error("[JWT] Download token verification failed", { error });
+		logger.debug("[JWT] Download token verification failed", { error });
 		return null;
 	}
 }
@@ -4966,6 +5096,6 @@ async function verifyMcpAccessToken(token, expectedAudience) {
 	}
 }
 //#endregion
-export { require_jsonwebtoken as C, sha256Bytes as D, randomInt as E, sha256Hex as O, normalizePemFromEnv as S, randomHex as T, verifyAccessToken as _, generateMcpAccessToken as a, verifyMfaPendingToken as b, getAccessTokenExpiry as c, getRefreshTokenTtlMs as d, hasAsymmetricSigningKey as f, signPurposeToken as g, jwt_exports as h, generateDownloadToken as i, getJwks as l, isJwtConfigured as m, configureJwt as n, generateMfaPendingToken as o, hashRefreshToken as p, generateAccessToken as r, generateRefreshToken as s, MAX_COOKIE_AGE_MS as t, getRefreshTokenExpiry as u, verifyDownloadToken as v, constantTimeEqual as w, verifyPurposeToken as x, verifyMcpAccessToken as y };
+export { sha256Bytes as A, verifyPurposeToken as C, constantTimeEqual as D, require_jsonwebtoken as E, randomHex as O, verifyMfaPendingToken as S, normalizePemFromEnv as T, jwt_exports as _, generateAccessToken as a, verifyDownloadToken as b, generateMfaPendingToken as c, getJwks as d, getRefreshTokenExpiry as f, isJwtConfigured as g, hashRefreshToken as h, customClaimsOf as i, sha256Hex as j, randomInt as k, generateRefreshToken as l, hasAsymmetricSigningKey as m, configureJwt as n, generateDownloadToken as o, getRefreshTokenTtlMs as p, configuredJwtSecret as r, generateMcpAccessToken as s, MAX_COOKIE_AGE_MS as t, getAccessTokenExpiry as u, signPurposeToken as v, verifyJwt as w, verifyMcpAccessToken as x, verifyAccessToken as y };
 
-//# sourceMappingURL=jwt-DnQHNFCl.js.map
+//# sourceMappingURL=jwt-Bqcu7cGt.js.map