@rodit/rodit-auth-be 9.11.20 → 9.13.0

package/index.js

@@ -26,7 +26,11 @@ const {
 
 const {
   validate_jwt_token_be,
-  generate_jwt_token
+  generate_jwt_token,
+  normalizeUrlWithoutPort,
+  isNonEmptyUrlClaim,
+  isFederatedRoditLogin,
+  validateFederatedLoginTarget,
 } = require('./lib/auth/tokenservice');
 
 const validatepermissions = require('./lib/middleware/validatepermissionsmw');
@@ -61,6 +65,10 @@ function sessionFieldsFromJwt(token) {
       sessionId: payload.session_id,
       expiresAt: payload.session_exp,
       createdAt: payload.session_iat,
+      // Identity of the peer (server) that issued this JWT, so the client can
+      // record the session keyed by the server it opened it with.
+      peerRoditId: payload.rodit_id,
+      peerOwnerId: payload.rodit_owner,
     };
   } catch (_error) {
     return {};
@@ -281,32 +289,53 @@ class RoditClient {
    * @param {Object} [req] - Express request (for deriving peer webhook URL and headers)
    * @returns {Promise<Object>} Webhook result
    */
-  async sendWebhookToEndpoint(data, endpoint, req) {
+  async sendWebhookToEndpoint(data, endpoint, req, options = {}) {
     if (webhookHandler.send_webhook) {
-      return webhookHandler.send_webhook(data, req, { endpoint });
+      return webhookHandler.send_webhook(data, req, this._buildWebhookOptions(endpoint, options));
     }
     throw new Error('Webhook functionality not available');
   }
 
+  /**
+   * Build the options passed to the underlying send_webhook. Defaults the
+   * session id to this client's own session (set at login_server) so a peer that
+   * initiated the login stamps the shared session id automatically. Callers can
+   * override with options.sessionId or resolve from storage via
+   * options.sessionRoditId.
+   * @private
+   * @param {string} endpoint
+   * @param {Object} [options]
+   * @returns {Object}
+   */
+  _buildWebhookOptions(endpoint, options = {}) {
+    const merged = { ...options, endpoint };
+    if (merged.sessionId == null && this.sessionId) {
+      merged.sessionId = this.sessionId;
+    }
+    return merged;
+  }
+
   /**
    * Send webhook (backward compatibility alias)
    * @param {Object} data - Webhook payload object
    * @param {Object} [req] - Express request (for deriving peer webhook URL and headers)
+   * @param {Object} [options] - Webhook options (sessionId, sessionRoditId)
    * @returns {Promise<Object>} Webhook result
    */
-  async send_webhook(data, req) {
-    return this.sendWebhook(data, req);
+  async send_webhook(data, req, options = {}) {
+    return this.sendWebhook(data, req, options);
   }
 
   /**
    * Send webhook to default /webhook endpoint
    * @param {Object} data - Webhook payload object
    * @param {Object} [req] - Express request (optional)
+   * @param {Object} [options] - Webhook options (sessionId, sessionRoditId)
    * @returns {Promise<Object>} Webhook result
    */
-  async sendWebhook(data, req) {
+  async sendWebhook(data, req, options = {}) {
     if (webhookHandler.send_webhook) {
-      return webhookHandler.send_webhook(data, req, { endpoint: '/webhook' });
+      return webhookHandler.send_webhook(data, req, this._buildWebhookOptions('/webhook', options));
     }
     throw new Error('Webhook functionality not available');
   }
@@ -316,10 +345,11 @@ class RoditClient {
    * Trigger immediate heartbeat (enqueues system event for main session)
    * @param {Object} data - Webhook payload
    * @param {Object} [req] - Express request
+   * @param {Object} [options] - Webhook options (sessionId, sessionRoditId)
    * @returns {Promise<Object>} Webhook result
    */
-  async sendWakeHook(data, req) {
-    return this.sendWebhookToEndpoint(data, '/hooks/wake', req);
+  async sendWakeHook(data, req, options = {}) {
+    return this.sendWebhookToEndpoint(data, '/hooks/wake', req, options);
   }
 
   /**
@@ -327,10 +357,11 @@ class RoditClient {
    * Run isolated agent task with optional reply to messaging channels
    * @param {Object} data - Webhook payload
    * @param {Object} [req] - Express request
+   * @param {Object} [options] - Webhook options (sessionId, sessionRoditId)
    * @returns {Promise<Object>} Webhook result
    */
-  async sendAgentHook(data, req) {
-    return this.sendWebhookToEndpoint(data, '/hooks/agent', req);
+  async sendAgentHook(data, req, options = {}) {
+    return this.sendWebhookToEndpoint(data, '/hooks/agent', req, options);
   }
 
   /**
@@ -880,15 +911,32 @@ class RoditClient {
       sessionId: this.sessionData?.id
     });
     
+    // Forget the recorded session so it no longer cross-references webhooks.
+    if (this.sessionId) {
+      Promise.resolve(sessionManager.forgetSession(this.sessionId)).catch(() => {});
+    }
+
     // Clear session data
     this.sessionData = null;
     this.jwt_token = null;
+    this.sessionId = null;
     
     // Also clear JWT token from stateManager
     this.stateManager.setJwtToken(null);
     
     return true;
   }
+
+  /**
+   * Check whether a session id refers to a live session this client currently
+   * holds open. Use this to cross-reference the session_id carried by an inbound
+   * webhook against the sessions opened at login.
+   * @param {string} sessionId
+   * @returns {Promise<boolean>}
+   */
+  async isKnownSession(sessionId) {
+    return sessionManager.hasSession(sessionId);
+  }
   
   
   /**
@@ -989,6 +1037,7 @@ class RoditClient {
    *
    * @param {Object} [lsoptions] - Optional settings
    * @param {string} [lsoptions.loginPath] - Login path (default /api/login)
+   * @param {string} [lsoptions.apiEndpoint] - Federated API URL to authenticate against (MITM-checked via JWT rodit_subjectuniqueidentifier_url)
    * @returns {Promise<Object>} Login result with token
    */
   async login_server(lsoptions = {}) {
@@ -999,7 +1048,10 @@ class RoditClient {
       component: 'RoditClient',
       method: 'login_server',
       requestId,
-      lsoptions: { loginPath: lsoptions.loginPath }
+      lsoptions: {
+        loginPath: lsoptions.loginPath,
+        apiEndpoint: lsoptions.apiEndpoint,
+      }
     });
 
     try {
@@ -1124,14 +1176,42 @@ class RoditClient {
         const fromJwt = sessionFieldsFromJwt(loginResult.jwt_token);
         const nowSec = Math.floor(Date.now() / 1000);
         this.sessionId = fromJwt.sessionId || ulid();
+        const sessionCreatedAt = fromJwt.createdAt ?? nowSec;
+        const sessionExpiresAt =
+          fromJwt.expiresAt ?? nowSec + config.getDefaultJwtDurationSeconds();
         this.setSessionData({
           id: this.sessionId,
-          createdAt: fromJwt.createdAt ?? nowSec,
-          expiresAt:
-            fromJwt.expiresAt ??
-            nowSec + config.getDefaultJwtDurationSeconds(),
+          createdAt: sessionCreatedAt,
+          expiresAt: sessionExpiresAt,
           status: 'active'
         });
+
+        // Record the opened session in the shared SessionManager, keyed by the
+        // server we logged into. This mirrors how a server stores sessions for
+        // its client peers, so a client connected to many servers can
+        // cross-reference an inbound webhook's session_id to a live session
+        // (multi-peer safe, unlike the single this.sessionId slot).
+        try {
+          const serverRoditId =
+            fromJwt.peerRoditId || config_own_rodit?.own_rodit?.token_id || null;
+          if (serverRoditId) {
+            await sessionManager.recordSession({
+              id: this.sessionId,
+              roditId: serverRoditId,
+              ownerId: fromJwt.peerOwnerId,
+              createdAt: sessionCreatedAt,
+              expiresAt: sessionExpiresAt,
+              status: 'active'
+            });
+          }
+        } catch (recordErr) {
+          logger.debug('Unable to record client session for webhook correlation', {
+            component: 'RoditClient',
+            method: 'login_server',
+            requestId,
+            error: recordErr.message
+          });
+        }
       }
 
       const duration = Date.now() - startTime;
@@ -1857,8 +1937,16 @@ module.exports = {
   logout_server,
   validate_jwt_token_be,
   generate_jwt_token,
+  normalizeUrlWithoutPort,
+  isNonEmptyUrlClaim,
+  isFederatedRoditLogin,
+  validateFederatedLoginTarget,
   validatepermissions,
   webhookHandler,
+  // Webhook identity + session helpers (key travels with the webhook; trust is
+  // established by binding the verified signer to a session opened at login)
+  extractWebhookSignerKey: webhookHandler.extractWebhookSignerKey,
+  extractWebhookSessionId: webhookHandler.extractWebhookSessionId,
   versioningMiddleware,
   loggingmw,
   ratelimitmw,

package/lib/auth/sessionmanager.js

@@ -532,7 +532,10 @@ class SessionManager {
       const sessionId = this._generateSessionId(sessionData.roditId);
       const now = Math.floor(Date.now() / 1000);
       
-      // Create the session object
+      // Create the session object.
+      // origin distinguishes sessions this peer *issued* as a server ('server')
+      // from sessions a client peer *opened* and recorded ('client', see
+      // recordSession). Both live in the same store.
       const session = {
         id: sessionId,
         roditId: sessionData.roditId,
@@ -541,6 +544,7 @@ class SessionManager {
         expiresAt: sessionData.expiresAt,
         lastAccessedAt: now,
         status: 'active',
+        origin: sessionData.origin || 'server',
         metadata: sessionData.metadata || {},
       };
       
@@ -588,6 +592,125 @@ class SessionManager {
   }
 
 
+  /**
+   * Record an externally-issued session under its own id.
+   *
+   * Unlike createSession (which mints a new id when this peer, acting as a
+   * server, issues a JWT), recordSession stores a session using the id supplied
+   * by the issuer. It lets a *client* peer track the sessions it holds open with
+   * each server — the session_id embedded in every JWT it receives — using the
+   * same storage facility the server uses for its client peers. This makes
+   * multi-peer session tracking robust and lets an inbound webhook's session_id
+   * be cross-referenced to a live session (see hasSession).
+   *
+   * Idempotent upsert: recording an existing id refreshes it.
+   *
+   * @param {Object} sessionData
+   * @param {string} sessionData.id Issuer-provided session id
+   * @param {string} sessionData.roditId Peer (server) roditId this session is with
+   * @param {string} [sessionData.ownerId]
+   * @param {number} [sessionData.createdAt]
+   * @param {number} [sessionData.expiresAt]
+   * @param {string} [sessionData.status]
+   * @returns {Promise<Object|null>} The stored session, or null on error
+   */
+  async recordSession(sessionData) {
+    const requestId = ulid();
+    const baseContext = createLogContext("SessionManager", "recordSession", {
+      requestId,
+      sessionId: sessionData?.id
+    });
+
+    try {
+      if (!sessionData || !sessionData.id) {
+        throw new Error("recordSession requires sessionData.id");
+      }
+      if (!sessionData.roditId) {
+        throw new Error("recordSession requires sessionData.roditId");
+      }
+
+      const now = Math.floor(Date.now() / 1000);
+      const session = {
+        id: sessionData.id,
+        roditId: sessionData.roditId,
+        ownerId: sessionData.ownerId,
+        createdAt: sessionData.createdAt || now,
+        expiresAt: sessionData.expiresAt,
+        lastAccessedAt: now,
+        status: sessionData.status || 'active',
+        origin: 'client',
+        metadata: sessionData.metadata || {},
+      };
+
+      await this.storage.set(session.id, session);
+
+      logger.debugWithContext("Recorded client-side session", {
+        ...baseContext,
+        roditId: session.roditId,
+        expiresAt: session.expiresAt,
+        origin: session.origin
+      });
+
+      return session;
+    } catch (error) {
+      logger.warnWithContext("Failed to record client-side session", {
+        ...baseContext,
+        error: error.message
+      });
+      return null;
+    }
+  }
+
+  /**
+   * Quietly test whether a session id refers to a known, live (active,
+   * non-expired) session. Unlike getSession this does not log warnings or bump
+   * lastAccessedAt, so it is safe to call on every inbound webhook to
+   * cross-reference the carried session_id.
+   *
+   * @param {string} sessionId
+   * @returns {Promise<boolean>}
+   */
+  async hasSession(sessionId) {
+    if (!sessionId) return false;
+    try {
+      const session = await this.storage.get(sessionId);
+      if (!session) return false;
+      const now = Math.floor(Date.now() / 1000);
+      if (session.expiresAt && session.expiresAt <= now) return false;
+      return session.status ? session.status === 'active' : true;
+    } catch (error) {
+      logger.debugWithContext("hasSession lookup failed", {
+        component: "SessionManager",
+        method: "hasSession",
+        sessionId,
+        error: error.message
+      });
+      return false;
+    }
+  }
+
+  /**
+   * Remove a session from storage (e.g. when a client peer logs out). Best
+   * effort; missing sessions are treated as already gone.
+   *
+   * @param {string} sessionId
+   * @returns {Promise<boolean>}
+   */
+  async forgetSession(sessionId) {
+    if (!sessionId) return false;
+    try {
+      return await this.storage.delete(sessionId);
+    } catch (error) {
+      logger.debugWithContext("forgetSession failed", {
+        component: "SessionManager",
+        method: "forgetSession",
+        sessionId,
+        error: error.message
+      });
+      return false;
+    }
+  }
+
   async getSession(sessionId) {
     const requestId = ulid();
     const startTime = Date.now();
@@ -1083,13 +1206,9 @@ class SessionManager {
 
 
   async findSessionsByRoditId(roditId) {
-    const requestId = ulid();
-    const startTime = Date.now();
-    const baseContext = createLogContext("SessionManager", "findSessionsByRoditId", { requestId, roditId });
-    
-    
+    const baseContext = createLogContext("SessionManager", "findSessionsByRoditId", { roditId });
+
     try {
-      let result = [];
       // Get sessions from storage
       let allSessions = [];
       if (typeof this.storage.getAll === 'function') {
@@ -1101,16 +1220,12 @@ class SessionManager {
           if (s) allSessions.push(s);
         }
       }
-      result = allSessions.filter(s => s && s.roditId === roditId);
-      
-      const duration = Date.now() - startTime;
-      
-      
-      return result;
+      return allSessions.filter(s => s && s.roditId === roditId);
     } catch (error) {
-      const duration = Date.now() - startTime;
-          
-      
+      logger.debugWithContext("findSessionsByRoditId lookup failed", {
+        ...baseContext,
+        error: error.message
+      });
       return [];
     }
   }

package/lib/auth/tokenservice.js

@@ -70,6 +70,85 @@ function extractLoginPeerRoditIdFromSub(sub) {
   return subParts.length > 1 ? subParts[1] : "";
 }
 
+function normalizeUrlWithoutPort(url) {
+  if (!url) return "";
+  try {
+    const parsedUrl = new URL(url);
+    parsedUrl.port = "";
+    return parsedUrl.toString();
+  } catch (_e) {
+    return String(url);
+  }
+}
+
+function isNonEmptyUrlClaim(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+
+/** True when login peer and issuing server declare different API URLs (federated login). */
+function isFederatedRoditLogin(peer_rodit, own_rodit) {
+  const peerUrl = peer_rodit?.metadata?.subjectuniqueidentifier_url;
+  const ownUrl = own_rodit?.metadata?.subjectuniqueidentifier_url;
+  if (!peerUrl || !ownUrl) return false;
+  return normalizeUrlWithoutPort(peerUrl) !== normalizeUrlWithoutPort(ownUrl);
+}
+
+/**
+ * Client MITM check after JWT crypto validation.
+ * Federated attempt = intendedApiEndpoint differs from client home URL.
+ *
+ * @param {Object} payload - Verified JWT payload
+ * @param {string} intendedApiEndpoint - URL the client connected to for login
+ * @param {string} clientHomeSubjectUrl - Client RODiT subjectuniqueidentifier_url
+ * @returns {{ ok: boolean, federated?: boolean, errorCode?: string, errorMessage?: string }}
+ */
+function validateFederatedLoginTarget(
+  payload,
+  intendedApiEndpoint,
+  clientHomeSubjectUrl
+) {
+  const normalizedIntended = normalizeUrlWithoutPort(intendedApiEndpoint);
+  const normalizedClientHome = normalizeUrlWithoutPort(clientHomeSubjectUrl);
+  const isFederatedAttempt = normalizedClientHome !== normalizedIntended;
+
+  if (!isFederatedAttempt) {
+    return { ok: true, federated: false };
+  }
+
+  const federatedIssuerUrl = payload?.rodit_subjectuniqueidentifier_url;
+  if (!isNonEmptyUrlClaim(federatedIssuerUrl)) {
+    return {
+      ok: false,
+      federated: true,
+      errorCode: "FEDERATED_ISSUER_MISSING",
+      errorMessage:
+        "Federated login JWT has null/empty rodit_subjectuniqueidentifier_url",
+    };
+  }
+
+  if (normalizeUrlWithoutPort(federatedIssuerUrl) !== normalizedIntended) {
+    return {
+      ok: false,
+      federated: true,
+      errorCode: "FEDERATED_ISSUER_MISMATCH",
+      errorMessage:
+        "rodit_subjectuniqueidentifier_url does not match login apiEndpoint",
+    };
+  }
+
+  if (normalizeUrlWithoutPort(payload?.iss) !== normalizedClientHome) {
+    return {
+      ok: false,
+      federated: true,
+      errorCode: "FEDERATED_ISSUER_MISMATCH",
+      errorMessage:
+        "JWT iss does not match client home subjectuniqueidentifier_url",
+    };
+  }
+
+  return { ok: true, federated: true };
+}
+
 function parseRoditJwtDurationSeconds(metadata) {
   const parsed = parseInt(metadata?.jwt_duration, 10);
   if (Number.isFinite(parsed) && parsed > 0) {
@@ -750,6 +829,7 @@ function resolveCredentialExpirationUnix(now, sessionExpiration, own_rodit) {
       
       const jwtSignStart = Date.now();
       const { SignJWT } = await getJose();
+      const federatedLogin = isFederatedRoditLogin(peer_rodit, own_rodit);
       const token = await new SignJWT({
         iss: peer_rodit.metadata.subjectuniqueidentifier_url,
         sub:
@@ -776,6 +856,10 @@ function resolveCredentialExpirationUnix(now, sessionExpiration, own_rodit) {
         rodit_allowedcidr: peer_rodit.metadata.allowed_cidr,
         rodit_allowediso3166list: peer_rodit.metadata.allowed_iso3166list,
         rodit_webhookurl: peer_rodit.metadata.webhook_url,
+        // Always present (null when same-API); EdDSA covers the claim like any other
+        rodit_subjectuniqueidentifier_url: federatedLogin
+          ? own_rodit.metadata.subjectuniqueidentifier_url
+          : null,
         config_iso639: null,
         config_iso3166: null,
         config_iso15924: null,
@@ -802,6 +886,7 @@ function resolveCredentialExpirationUnix(now, sessionExpiration, own_rodit) {
         jwtId,
         sessionId: session_id,
         sessionStatus: session_status,
+        federatedLogin,
         tokenValidFor: tokenExpiration - now,
         sessionValidFor: sessionExpiration - now
       });
@@ -1060,6 +1145,11 @@ function resolveCredentialExpirationUnix(now, sessionExpiration, own_rodit) {
         rodit_webhookcidr: token.rodit_webhookcidr,
         rodit_allowedcidr: token.rodit_allowedcidr,
         rodit_webhookurl: token.rodit_webhookurl,
+        rodit_subjectuniqueidentifier_url: isNonEmptyUrlClaim(
+          token.rodit_subjectuniqueidentifier_url
+        )
+          ? token.rodit_subjectuniqueidentifier_url
+          : null,
         config_iso639: null,
         config_iso3166: null,
         config_iso15924: null,
@@ -1555,46 +1645,71 @@ function resolveCredentialExpirationUnix(now, sessionExpiration, own_rodit) {
         throw new Error("Error 006: Token is not yet valid");
       }
   
-      // Function to normalize URL by removing port
-      const normalizeUrlWithoutPort = (url) => {
-        if (!url) return '';
-        try {
-          // Use URL constructor to parse the URL
-          const parsedUrl = new URL(url);
-          // Remove the port
-          parsedUrl.port = '';
-          // Return the normalized URL as a string
-          return parsedUrl.toString();
-        } catch (e) {
-          // If URL parsing fails, return the original URL
-          return url;
-        }
-      };
-      
-      // Normalize both URLs for comparison
-      const normalizedTokenIssuer = normalizeUrlWithoutPort(payload.iss);
-      const normalizedExpectedIssuer = normalizeUrlWithoutPort(rodit.metadata.subjectuniqueidentifier_url);
-      
       // Issuer check with enhanced logging
+      const federatedIssuerUrl = payload.rodit_subjectuniqueidentifier_url;
+      const isFederatedJwt = isNonEmptyUrlClaim(federatedIssuerUrl);
+      const normalizedTokenIssuer = normalizeUrlWithoutPort(payload.iss);
+      const normalizedOwnSubjectUrl = normalizeUrlWithoutPort(
+        rodit.metadata.subjectuniqueidentifier_url
+      );
+
       logger.debug("Detailed issuer validation information", {
         component: "JwtAuth",
         method: "validate_jwt_token_be",
         requestId,
         tokenIssuer: payload.iss,
         expectedIssuer: rodit.metadata.subjectuniqueidentifier_url,
+        federatedIssuerUrl,
         normalizedTokenIssuer,
-        normalizedExpectedIssuer,
+        normalizedOwnSubjectUrl,
         roditId: rodit.token_id,
         roditOwnerId: rodit.owner_id,
         hasMetadata: !!rodit.metadata,
         metadataKeys: rodit.metadata ? Object.keys(rodit.metadata) : [],
         payloadKeys: Object.keys(payload),
-        rawIssuerMatch: payload.iss === rodit.metadata.subjectuniqueidentifier_url,
-        normalizedIssuerMatch: normalizedTokenIssuer === normalizedExpectedIssuer
+        isFederatedJwt,
       });
-      
-      // Compare normalized URLs instead of raw URLs
-      if (normalizedTokenIssuer !== normalizedExpectedIssuer) {
+
+      if (isFederatedJwt) {
+        // 1) signed federated API URL must be THIS server
+        if (
+          normalizeUrlWithoutPort(federatedIssuerUrl) !== normalizedOwnSubjectUrl
+        ) {
+          logger.warn("Token validation failed - Invalid federated issuer URL", {
+            component: "JwtAuth",
+            method: "validate_jwt_token_be",
+            requestId,
+            federatedIssuerUrl,
+            expectedFederatedIssuer: rodit.metadata.subjectuniqueidentifier_url,
+          });
+          throw new Error("Error 005: Invalid federated issuer");
+        }
+
+        // 2) iss must be the login client's home API (from on-chain RODiT via sub)
+        const loginClientRoditId = extractLoginPeerRoditIdFromSub(payload.sub);
+        const loginClientRodit = loginClientRoditId
+          ? await nearorg_rpc_tokenfromroditid(loginClientRoditId)
+          : null;
+        const expectedClientIssuer =
+          loginClientRodit?.metadata?.subjectuniqueidentifier_url;
+
+        if (
+          !expectedClientIssuer ||
+          normalizedTokenIssuer !==
+            normalizeUrlWithoutPort(expectedClientIssuer)
+        ) {
+          logger.warn("Token validation failed - Invalid issuer for federated JWT", {
+            component: "JwtAuth",
+            method: "validate_jwt_token_be",
+            requestId,
+            tokenIssuer: payload.iss,
+            expectedClientIssuer,
+            loginClientRoditId,
+          });
+          throw new Error("Error 005: Invalid issuer");
+        }
+      } else if (normalizedTokenIssuer !== normalizedOwnSubjectUrl) {
+        // same-API / 9.12 tokens: iss must equal receiving server URL
         logger.warn("Token validation failed - Invalid issuer", {
           component: "JwtAuth",
           method: "validate_jwt_token_be",
@@ -1602,15 +1717,16 @@ function resolveCredentialExpirationUnix(now, sessionExpiration, own_rodit) {
           tokenIssuer: payload.iss,
           expectedIssuer: rodit.metadata.subjectuniqueidentifier_url,
           normalizedTokenIssuer,
-          normalizedExpectedIssuer,
+          normalizedOwnSubjectUrl,
           roditId: rodit.token_id,
-          // Check for common URL variations that might cause mismatch
-          issuerHasTrailingSlash: payload.iss?.endsWith('/'),
-          expectedHasTrailingSlash: rodit.metadata.subjectuniqueidentifier_url?.endsWith('/'),
-          issuerHasProtocol: payload.iss?.startsWith('http'),
-          expectedHasProtocol: rodit.metadata.subjectuniqueidentifier_url?.startsWith('http')
+          issuerHasTrailingSlash: payload.iss?.endsWith("/"),
+          expectedHasTrailingSlash:
+            rodit.metadata.subjectuniqueidentifier_url?.endsWith("/"),
+          issuerHasProtocol: payload.iss?.startsWith("http"),
+          expectedHasProtocol:
+            rodit.metadata.subjectuniqueidentifier_url?.startsWith("http"),
         });
-        
+
         throw new Error("Error 005: Invalid issuer");
       }
       
@@ -2590,4 +2706,8 @@ module.exports = {
   parseRoditJwtDurationSeconds,
   resolveSessionExpirationUnix,
   resolveCredentialExpirationUnix,
+  normalizeUrlWithoutPort,
+  isNonEmptyUrlClaim,
+  isFederatedRoditLogin,
+  validateFederatedLoginTarget,
 };