@rodit/rodit-auth-be 9.12.0 → 9.13.0

package/index.js

@@ -26,7 +26,11 @@ const {
 
 const {
   validate_jwt_token_be,
-  generate_jwt_token
+  generate_jwt_token,
+  normalizeUrlWithoutPort,
+  isNonEmptyUrlClaim,
+  isFederatedRoditLogin,
+  validateFederatedLoginTarget,
 } = require('./lib/auth/tokenservice');
 
 const validatepermissions = require('./lib/middleware/validatepermissionsmw');
@@ -1033,6 +1037,7 @@ class RoditClient {
    *
    * @param {Object} [lsoptions] - Optional settings
    * @param {string} [lsoptions.loginPath] - Login path (default /api/login)
+   * @param {string} [lsoptions.apiEndpoint] - Federated API URL to authenticate against (MITM-checked via JWT rodit_subjectuniqueidentifier_url)
    * @returns {Promise<Object>} Login result with token
    */
   async login_server(lsoptions = {}) {
@@ -1043,7 +1048,10 @@ class RoditClient {
       component: 'RoditClient',
       method: 'login_server',
       requestId,
-      lsoptions: { loginPath: lsoptions.loginPath }
+      lsoptions: {
+        loginPath: lsoptions.loginPath,
+        apiEndpoint: lsoptions.apiEndpoint,
+      }
     });
 
     try {
@@ -1929,6 +1937,10 @@ module.exports = {
   logout_server,
   validate_jwt_token_be,
   generate_jwt_token,
+  normalizeUrlWithoutPort,
+  isNonEmptyUrlClaim,
+  isFederatedRoditLogin,
+  validateFederatedLoginTarget,
   validatepermissions,
   webhookHandler,
   // Webhook identity + session helpers (key travels with the webhook; trust is

package/lib/auth/tokenservice.js

@@ -70,6 +70,85 @@ function extractLoginPeerRoditIdFromSub(sub) {
   return subParts.length > 1 ? subParts[1] : "";
 }
 
+function normalizeUrlWithoutPort(url) {
+  if (!url) return "";
+  try {
+    const parsedUrl = new URL(url);
+    parsedUrl.port = "";
+    return parsedUrl.toString();
+  } catch (_e) {
+    return String(url);
+  }
+}
+
+function isNonEmptyUrlClaim(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+
+/** True when login peer and issuing server declare different API URLs (federated login). */
+function isFederatedRoditLogin(peer_rodit, own_rodit) {
+  const peerUrl = peer_rodit?.metadata?.subjectuniqueidentifier_url;
+  const ownUrl = own_rodit?.metadata?.subjectuniqueidentifier_url;
+  if (!peerUrl || !ownUrl) return false;
+  return normalizeUrlWithoutPort(peerUrl) !== normalizeUrlWithoutPort(ownUrl);
+}
+
+/**
+ * Client MITM check after JWT crypto validation.
+ * Federated attempt = intendedApiEndpoint differs from client home URL.
+ *
+ * @param {Object} payload - Verified JWT payload
+ * @param {string} intendedApiEndpoint - URL the client connected to for login
+ * @param {string} clientHomeSubjectUrl - Client RODiT subjectuniqueidentifier_url
+ * @returns {{ ok: boolean, federated?: boolean, errorCode?: string, errorMessage?: string }}
+ */
+function validateFederatedLoginTarget(
+  payload,
+  intendedApiEndpoint,
+  clientHomeSubjectUrl
+) {
+  const normalizedIntended = normalizeUrlWithoutPort(intendedApiEndpoint);
+  const normalizedClientHome = normalizeUrlWithoutPort(clientHomeSubjectUrl);
+  const isFederatedAttempt = normalizedClientHome !== normalizedIntended;
+
+  if (!isFederatedAttempt) {
+    return { ok: true, federated: false };
+  }
+
+  const federatedIssuerUrl = payload?.rodit_subjectuniqueidentifier_url;
+  if (!isNonEmptyUrlClaim(federatedIssuerUrl)) {
+    return {
+      ok: false,
+      federated: true,
+      errorCode: "FEDERATED_ISSUER_MISSING",
+      errorMessage:
+        "Federated login JWT has null/empty rodit_subjectuniqueidentifier_url",
+    };
+  }
+
+  if (normalizeUrlWithoutPort(federatedIssuerUrl) !== normalizedIntended) {
+    return {
+      ok: false,
+      federated: true,
+      errorCode: "FEDERATED_ISSUER_MISMATCH",
+      errorMessage:
+        "rodit_subjectuniqueidentifier_url does not match login apiEndpoint",
+    };
+  }
+
+  if (normalizeUrlWithoutPort(payload?.iss) !== normalizedClientHome) {
+    return {
+      ok: false,
+      federated: true,
+      errorCode: "FEDERATED_ISSUER_MISMATCH",
+      errorMessage:
+        "JWT iss does not match client home subjectuniqueidentifier_url",
+    };
+  }
+
+  return { ok: true, federated: true };
+}
+
 function parseRoditJwtDurationSeconds(metadata) {
   const parsed = parseInt(metadata?.jwt_duration, 10);
   if (Number.isFinite(parsed) && parsed > 0) {
@@ -750,6 +829,7 @@ function resolveCredentialExpirationUnix(now, sessionExpiration, own_rodit) {
       
       const jwtSignStart = Date.now();
       const { SignJWT } = await getJose();
+      const federatedLogin = isFederatedRoditLogin(peer_rodit, own_rodit);
       const token = await new SignJWT({
         iss: peer_rodit.metadata.subjectuniqueidentifier_url,
         sub:
@@ -776,6 +856,10 @@ function resolveCredentialExpirationUnix(now, sessionExpiration, own_rodit) {
         rodit_allowedcidr: peer_rodit.metadata.allowed_cidr,
         rodit_allowediso3166list: peer_rodit.metadata.allowed_iso3166list,
         rodit_webhookurl: peer_rodit.metadata.webhook_url,
+        // Always present (null when same-API); EdDSA covers the claim like any other
+        rodit_subjectuniqueidentifier_url: federatedLogin
+          ? own_rodit.metadata.subjectuniqueidentifier_url
+          : null,
         config_iso639: null,
         config_iso3166: null,
         config_iso15924: null,
@@ -802,6 +886,7 @@ function resolveCredentialExpirationUnix(now, sessionExpiration, own_rodit) {
         jwtId,
         sessionId: session_id,
         sessionStatus: session_status,
+        federatedLogin,
         tokenValidFor: tokenExpiration - now,
         sessionValidFor: sessionExpiration - now
       });
@@ -1060,6 +1145,11 @@ function resolveCredentialExpirationUnix(now, sessionExpiration, own_rodit) {
         rodit_webhookcidr: token.rodit_webhookcidr,
         rodit_allowedcidr: token.rodit_allowedcidr,
         rodit_webhookurl: token.rodit_webhookurl,
+        rodit_subjectuniqueidentifier_url: isNonEmptyUrlClaim(
+          token.rodit_subjectuniqueidentifier_url
+        )
+          ? token.rodit_subjectuniqueidentifier_url
+          : null,
         config_iso639: null,
         config_iso3166: null,
         config_iso15924: null,
@@ -1555,46 +1645,71 @@ function resolveCredentialExpirationUnix(now, sessionExpiration, own_rodit) {
         throw new Error("Error 006: Token is not yet valid");
       }
   
-      // Function to normalize URL by removing port
-      const normalizeUrlWithoutPort = (url) => {
-        if (!url) return '';
-        try {
-          // Use URL constructor to parse the URL
-          const parsedUrl = new URL(url);
-          // Remove the port
-          parsedUrl.port = '';
-          // Return the normalized URL as a string
-          return parsedUrl.toString();
-        } catch (e) {
-          // If URL parsing fails, return the original URL
-          return url;
-        }
-      };
-      
-      // Normalize both URLs for comparison
-      const normalizedTokenIssuer = normalizeUrlWithoutPort(payload.iss);
-      const normalizedExpectedIssuer = normalizeUrlWithoutPort(rodit.metadata.subjectuniqueidentifier_url);
-      
       // Issuer check with enhanced logging
+      const federatedIssuerUrl = payload.rodit_subjectuniqueidentifier_url;
+      const isFederatedJwt = isNonEmptyUrlClaim(federatedIssuerUrl);
+      const normalizedTokenIssuer = normalizeUrlWithoutPort(payload.iss);
+      const normalizedOwnSubjectUrl = normalizeUrlWithoutPort(
+        rodit.metadata.subjectuniqueidentifier_url
+      );
+
       logger.debug("Detailed issuer validation information", {
         component: "JwtAuth",
         method: "validate_jwt_token_be",
         requestId,
         tokenIssuer: payload.iss,
         expectedIssuer: rodit.metadata.subjectuniqueidentifier_url,
+        federatedIssuerUrl,
         normalizedTokenIssuer,
-        normalizedExpectedIssuer,
+        normalizedOwnSubjectUrl,
         roditId: rodit.token_id,
         roditOwnerId: rodit.owner_id,
         hasMetadata: !!rodit.metadata,
         metadataKeys: rodit.metadata ? Object.keys(rodit.metadata) : [],
         payloadKeys: Object.keys(payload),
-        rawIssuerMatch: payload.iss === rodit.metadata.subjectuniqueidentifier_url,
-        normalizedIssuerMatch: normalizedTokenIssuer === normalizedExpectedIssuer
+        isFederatedJwt,
       });
-      
-      // Compare normalized URLs instead of raw URLs
-      if (normalizedTokenIssuer !== normalizedExpectedIssuer) {
+
+      if (isFederatedJwt) {
+        // 1) signed federated API URL must be THIS server
+        if (
+          normalizeUrlWithoutPort(federatedIssuerUrl) !== normalizedOwnSubjectUrl
+        ) {
+          logger.warn("Token validation failed - Invalid federated issuer URL", {
+            component: "JwtAuth",
+            method: "validate_jwt_token_be",
+            requestId,
+            federatedIssuerUrl,
+            expectedFederatedIssuer: rodit.metadata.subjectuniqueidentifier_url,
+          });
+          throw new Error("Error 005: Invalid federated issuer");
+        }
+
+        // 2) iss must be the login client's home API (from on-chain RODiT via sub)
+        const loginClientRoditId = extractLoginPeerRoditIdFromSub(payload.sub);
+        const loginClientRodit = loginClientRoditId
+          ? await nearorg_rpc_tokenfromroditid(loginClientRoditId)
+          : null;
+        const expectedClientIssuer =
+          loginClientRodit?.metadata?.subjectuniqueidentifier_url;
+
+        if (
+          !expectedClientIssuer ||
+          normalizedTokenIssuer !==
+            normalizeUrlWithoutPort(expectedClientIssuer)
+        ) {
+          logger.warn("Token validation failed - Invalid issuer for federated JWT", {
+            component: "JwtAuth",
+            method: "validate_jwt_token_be",
+            requestId,
+            tokenIssuer: payload.iss,
+            expectedClientIssuer,
+            loginClientRoditId,
+          });
+          throw new Error("Error 005: Invalid issuer");
+        }
+      } else if (normalizedTokenIssuer !== normalizedOwnSubjectUrl) {
+        // same-API / 9.12 tokens: iss must equal receiving server URL
         logger.warn("Token validation failed - Invalid issuer", {
           component: "JwtAuth",
           method: "validate_jwt_token_be",
@@ -1602,15 +1717,16 @@ function resolveCredentialExpirationUnix(now, sessionExpiration, own_rodit) {
           tokenIssuer: payload.iss,
           expectedIssuer: rodit.metadata.subjectuniqueidentifier_url,
           normalizedTokenIssuer,
-          normalizedExpectedIssuer,
+          normalizedOwnSubjectUrl,
           roditId: rodit.token_id,
-          // Check for common URL variations that might cause mismatch
-          issuerHasTrailingSlash: payload.iss?.endsWith('/'),
-          expectedHasTrailingSlash: rodit.metadata.subjectuniqueidentifier_url?.endsWith('/'),
-          issuerHasProtocol: payload.iss?.startsWith('http'),
-          expectedHasProtocol: rodit.metadata.subjectuniqueidentifier_url?.startsWith('http')
+          issuerHasTrailingSlash: payload.iss?.endsWith("/"),
+          expectedHasTrailingSlash:
+            rodit.metadata.subjectuniqueidentifier_url?.endsWith("/"),
+          issuerHasProtocol: payload.iss?.startsWith("http"),
+          expectedHasProtocol:
+            rodit.metadata.subjectuniqueidentifier_url?.startsWith("http"),
         });
-        
+
         throw new Error("Error 005: Invalid issuer");
       }
       
@@ -2590,4 +2706,8 @@ module.exports = {
   parseRoditJwtDurationSeconds,
   resolveSessionExpirationUnix,
   resolveCredentialExpirationUnix,
+  normalizeUrlWithoutPort,
+  isNonEmptyUrlClaim,
+  isFederatedRoditLogin,
+  validateFederatedLoginTarget,
 };

package/lib/middleware/authenticationmw.js

@@ -14,7 +14,8 @@ const nacl = require("tweetnacl");
 const { 
   validate_jwt_token_be,
   generate_jwt_token,
-  tokenService
+  validateFederatedLoginTarget,
+  normalizeUrlWithoutPort,
 } = require("../auth/tokenservice");
 // Import specific functions from authentication.js to avoid circular dependencies
 // Import specific functions from authentication.js to avoid circular dependencies
@@ -1879,6 +1880,7 @@ async function login_portal(config_own_rodit, port, options = {}) {
    * @param {Object} config_own_rodit - Configuration object containing own_rodit and private key
    * @param {Object} [options] - Optional settings
    * @param {string} [options.loginPath] - HTTP path (default /api/login)
+   * @param {string} [options.apiEndpoint] - Federated API base URL to log into (defaults to own subjectuniqueidentifier_url)
    * @param {number} [options.timestamp] - Unix seconds used for signature generation (if omitted, fetched from peer /api/login/timestamp)
    * @param {string} [options.accountId] - Explicit NEAR account for outbound login when token id absent
    * @param {string} [options.timestampPath] - Timestamp endpoint path (default /api/login/timestamp)
@@ -1931,7 +1933,9 @@ async function login_portal(config_own_rodit, port, options = {}) {
         return { error: "Error 0111: Client configuration not initialized" };
       }
 
-      const apiendpoint = config_own_rodit.own_rodit?.metadata?.subjectuniqueidentifier_url;
+      const apiendpoint =
+        options.apiEndpoint ??
+        config_own_rodit.own_rodit?.metadata?.subjectuniqueidentifier_url;
       const loginPath =
         options.loginPath ??
         config_own_rodit.login_rodit_path ??
@@ -1944,7 +1948,16 @@ async function login_portal(config_own_rodit, port, options = {}) {
         requestId,
         apiEndpoint: apiendpoint,
         loginUrl,
-        source: config_own_rodit.own_rodit?.metadata?.subjectuniqueidentifier_url ? "metadata" : "config",
+        federatedLogin:
+          normalizeUrlWithoutPort(apiendpoint) !==
+          normalizeUrlWithoutPort(
+            config_own_rodit.own_rodit?.metadata?.subjectuniqueidentifier_url
+          ),
+        source: options.apiEndpoint
+          ? "options.apiEndpoint"
+          : config_own_rodit.own_rodit?.metadata?.subjectuniqueidentifier_url
+            ? "metadata"
+            : "config",
       });
 
       const roditid = normalizeOptionalLoginString(own_rodit?.token_id);
@@ -2158,6 +2171,60 @@ async function login_portal(config_own_rodit, port, options = {}) {
           };
         }
 
+        const federatedCheck = validateFederatedLoginTarget(
+          validationResult.payload,
+          apiendpoint,
+          config_own_rodit.own_rodit?.metadata?.subjectuniqueidentifier_url
+        );
+
+        if (!federatedCheck.ok) {
+          const duration = Date.now() - startTime;
+
+          logger.error("Federated login issuer check failed", {
+            component: "AuthenticationService",
+            method,
+            requestId,
+            duration,
+            errorCode: federatedCheck.errorCode,
+            errorMessage: federatedCheck.errorMessage,
+            intendedApiEndpoint: apiendpoint,
+            jwtIss: validationResult.payload?.iss,
+            jwtFederatedIssuer:
+              validationResult.payload?.rodit_subjectuniqueidentifier_url,
+          });
+
+          logger.metric("login_duration_ms", duration, {
+            component: "AuthenticationService",
+            success: false,
+            error: federatedCheck.errorCode,
+          });
+          logger.metric("login_errors_total", 1, {
+            component: "AuthenticationService",
+            error: federatedCheck.errorCode,
+          });
+
+          return {
+            error:
+              federatedCheck.errorMessage ||
+              "Federated login issuer verification failed",
+            errorCode: federatedCheck.errorCode,
+            failureReason: federatedCheck.errorCode,
+            requestId,
+          };
+        }
+
+        if (federatedCheck.federated) {
+          logger.info("Federated login issuer verified", {
+            component: "AuthenticationService",
+            method,
+            requestId,
+            intendedApiEndpoint: apiendpoint,
+            clientHomeIssuer: validationResult.payload?.iss,
+            federatedIssuer:
+              validationResult.payload?.rodit_subjectuniqueidentifier_url,
+          });
+        }
+
         const peer_base64url_jwk_public_key = Buffer.from(peer_rodit.owner_id, "hex").toString("base64url");
         await stateManager.setPeerBase64urlJwkPublicKey(peer_base64url_jwk_public_key);
         // Inbound webhooks are verified against the key each webhook advertises

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rodit/rodit-auth-be",
-  "version": "9.12.0",
+  "version": "9.13.0",
   "description": "RODiT-based authentication system for Express.js applications",
   "main": "index.js",
   "exports": {