@rodit/rodit-auth-be 9.15.0 → 9.16.0

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to `@rodit/rodit-auth-be` are documented here.
 
+## [9.16.0] — 2026-09-14
+
+### Removed
+
+- **`verify_rodit_isactive`** — DNS TXT revocation check
+  (`<token_id>.revoked.<domain>`). The function short-circuited with an
+  unconditional `return true` while debugging, so its body was unreachable and
+  no RODiT could be rejected as revoked. Removed along with its call sites in
+  `verify_peer_rodit` and `thorough_validate_jwt_token_be`, and the
+  `RODIT_REVOKED` / `SERVER_RODIT_REVOKED` failure codes they emitted.
+  No behavior change; the SDK now has no revocation check.
+  `verify_rodit_isactive_fe` in `@rodit/rodit-auth-fe` is unaffected.
+
 ## [9.15.0] — 2026-08-11
 
 ### Added

package/README.md

@@ -1,10 +1,22 @@
-# RODiT Authentication SDK
+# @rodit/rodit-auth-be
 
-A comprehensive Node.js SDK for implementing RODiT-based mutual authentication, authorization, self-configuration, and session management in Express.js applications.
+Node.js / Express SDK for RODiT-based mutual authentication, authorization, session management, and webhooks.
 
-**Version:** 9.15.0  
-**License:** Proprietary  
-**Author:** Discernible IO
+**npm:** [https://www.npmjs.com/package/@rodit/rodit-auth-be](https://www.npmjs.com/package/@rodit/rodit-auth-be)  
+**Monorepo:** [discernible-io/rodit-sdk](https://github.com/discernible-io/rodit-sdk) (this directory)  
+**Version:** 9.15.0 · **License:** Proprietary · **Author:** Discernible IO
+
+## Production deployments
+
+This package is the server runtime behind RODiT-powered APIs, including:
+
+| Deployment | Role |
+|------------|------|
+| [api.identyclaw.com](https://api.identyclaw.com) | IdentyClaw platform API ([source: api-idc](https://github.com/discernible-io/api-idc)) |
+| [api.lastcradle.io](https://api.lastcradle.io) | Last Cradle family API |
+| Custom / federated APIs | Same SDK; sibling APIs in one token family support [federated login](#federated-login-same-family-different-api-url) |
+
+Browser and wallet clients for these APIs use the companion package [`@rodit/rodit-auth-fe`](https://www.npmjs.com/package/@rodit/rodit-auth-fe).
 
 **Login `POST` /api/login:** Use **`accountid`** (or **`roditid`**), **`timestamp`**, and **`base64url_signature`**. Sign UTF-8 bytes of `identifier + timestamp_iso`, and reject deprecated keys such as **`signature`** and **`account_id`**. See [CHANGELOG.md](./CHANGELOG.md).
 

package/index.js

@@ -1145,9 +1145,6 @@ class RoditClient {
           case 'RODIT_NOT_LIVE':
             errorMessage += '\n→ [CLIENT REJECTED] Your RODiT is expired or not yet valid. Check the validity period.';
             break;
-          case 'RODIT_REVOKED':
-            errorMessage += '\n→ [CLIENT REJECTED] Your RODiT has been revoked and is no longer valid.';
-            break;
           case 'SMART_CONTRACT_NOT_TRUSTED':
             errorMessage += '\n→ [CLIENT REJECTED] The smart contract that issued your RODiT is not trusted by this server.';
             break;
@@ -1160,9 +1157,6 @@ class RoditClient {
           case 'SERVER_RODIT_NOT_LIVE':
             errorMessage += '\n→ [SERVER REJECTED] The server\'s RODiT is expired or not yet valid. Contact the server administrator.';
             break;
-          case 'SERVER_RODIT_REVOKED':
-            errorMessage += '\n→ [SERVER REJECTED] The server\'s RODiT has been revoked. Contact the server administrator.';
-            break;
           case 'SERVER_SMART_CONTRACT_NOT_TRUSTED':
             errorMessage += '\n→ [SERVER REJECTED] The server\'s issuing smart contract is not trusted by your client. Update your trust configuration.';
             break;

package/lib/auth/authentication.js

@@ -993,32 +993,6 @@ async function verify_rodit_ownership(
         };
       }
 
-      const activeStart = Date.now();
-      const isActive = await verify_rodit_isactive(
-        peer_rodit.token_id,
-        config_own_rodit.own_rodit.metadata.subjectuniqueidentifier_url
-      );
-      const activeDuration = Date.now() - activeStart;
-
-      logger.debug("Active verification completed", {
-        requestId,
-        activeDuration,
-        isActive,
-      });
-
-      if (!isActive) {
-        logger.warn("RODiT active verification failed", {
-          requestId,
-          roditId: peerroditid,
-        });
-        return {
-          peer_rodit,
-          goodrodit: false,
-          failureReason: "RODIT_REVOKED",
-          failureMessage: "RODiT has been revoked"
-        };
-      }
-
       const trustedStart = Date.now();
       const isTrusted = await verify_rodit_istrusted_issuingsmartcontract(
         config_own_rodit.own_rodit.metadata.subjectuniqueidentifier_url
@@ -1241,119 +1215,6 @@ async function verify_rodit_ownership(
     }
   }
 
-  async function verify_rodit_isactive(tokenId, ownsubjectuniqueidentifier_url) {
-    const requestId = ulid();
-    const startTime = Date.now();
-  
-    // WHILE DEBUGGING TEMPORARY FIX DO NOT REMOVE THIS LINE EVER WITHOUT PERMISSION
-    return true;
-  
-    logger.debug("Checking RODiT activity status", {
-      component: "RoditAuth",
-      method: "verify_rodit_isactive",
-      requestId,
-      tokenId,
-      subjectUrl: ownsubjectuniqueidentifier_url,
-    });
-  
-    const domainandextensionRegex =
-      /(?:https?:\/\/)?(?:www\.)?([a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+)/i;
-  
-    const match = ownsubjectuniqueidentifier_url.match(domainandextensionRegex);
-  
-    if (match) {
-      const domainandextension = match[1];
-      const revokingDnsEntry = `${tokenId}.revoked.${domainandextension}`;
-  
-      logger.debug("Checking DNS revocation entry", {
-        requestId,
-        domain: domainandextension,
-        revokingDnsEntry,
-      });
-  
-      try {
-        const dnsStart = Date.now();
-        const resolver = new Resolver();
-        await resolver.resolveTxt(revokingDnsEntry);
-        const dnsDuration = Date.now() - dnsStart;
-        const totalDuration = Date.now() - startTime;
-  
-        logger.info("RODiT revocation found", {
-          component: "AuthServices",
-          method: "verify_rodit_isactive",
-          requestId,
-          duration: totalDuration,
-          dnsDuration,
-          tokenId,
-          domain: domainandextension,
-          revokingDnsEntry,
-          isActive: false,
-        });
-  
-        // Add metrics for revoked tokens
-        logger.metric &&
-          logger.metric("rodit_revocation_checks", totalDuration, {
-            result: "revoked",
-            token_id: tokenId,
-          });
-  
-        return false;
-      } catch (error) {
-        // DNS error usually means no revocation entry found, which is good
-        const dnsDuration = Date.now() - dnsStart || 0;
-        const totalDuration = Date.now() - startTime;
-  
-        logger.debug("No revocation found for RODiT", {
-          requestId,
-          dnsDuration,
-          tokenId,
-          error: error.code,
-        });
-  
-        logger.info("RODiT is active", {
-          component: "AuthServices",
-          method: "verify_rodit_isactive",
-          requestId,
-          duration: totalDuration,
-          dnsDuration,
-          tokenId,
-          domain: domainandextension,
-          isActive: true,
-        });
-  
-        // Add metrics for active tokens
-        logger.metric &&
-          logger.metric("rodit_revocation_checks", totalDuration, {
-            result: "active",
-            token_id: tokenId,
-          });
-  
-        return true;
-      }
-    } else {
-      const duration = Date.now() - startTime;
-  
-      logger.warn("Unable to parse domain from URL", {
-        component: "AuthServices",
-        method: "verify_rodit_isactive",
-        requestId,
-        duration,
-        tokenId,
-        subjectUrl: ownsubjectuniqueidentifier_url,
-      });
-  
-      // Add metrics for parsing errors
-      logger.metric &&
-        logger.metric("rodit_revocation_checks", duration, {
-          result: "parse_error",
-          token_id: tokenId,
-        });
-  
-      // Default to allowing the token if domain parsing fails
-      return true;
-    }
-  }
-
   async function verify_rodit_istrusted_issuingsmartcontract(
     ownsubjectuniqueidentifier_url
   ) {
@@ -1963,7 +1824,6 @@ module.exports = {
   resolve_peer_rodit_for_login,
   verify_peer_rodit,
   validateTimestamp,
-  verify_rodit_isactive,
   verify_rodit_isamatch,
   verify_rodit_islive,
   verify_rodit_istrusted_issuingsmartcontract,

package/lib/auth/tokenservice.js

@@ -2085,7 +2085,7 @@ async function thorough_validate_jwt_token_be(token, requestId = ulid()) {
     // Starting verification with more detailed logging
     logger.debug("Starting verification checks", {
       requestId,
-      checks: ["match", "live", "active", "trusted"],
+      checks: ["match", "live", "trusted"],
       serviceProviderId: config_own_rodit.own_rodit.metadata.serviceprovider_id,
     });
 
@@ -2093,7 +2093,6 @@ async function thorough_validate_jwt_token_be(token, requestId = ulid()) {
     const { 
       verify_rodit_isamatch,
       verify_rodit_islive,
-      verify_rodit_isactive,
       verify_rodit_istrusted_issuingsmartcontract
     } = require("./authentication");
 
@@ -2188,49 +2187,6 @@ async function thorough_validate_jwt_token_be(token, requestId = ulid()) {
       };
     }
 
-    // Perform active verification
-    const activeStart = performance.now();
-    const isActive = await verify_rodit_isactive(
-      peer_rodit.token_id,
-      config_own_rodit.own_rodit.metadata.subjectuniqueidentifier_url
-    );
-    const activeDuration = performance.now() - activeStart;
-
-    logger.debug("Active verification completed", {
-      requestId,
-      activeDuration,
-      isActive,
-      tokenId: peer_rodit.token_id,
-      url: config_own_rodit.own_rodit.metadata.subjectuniqueidentifier_url,
-    });
-
-    if (!isActive) {
-      logger.warn("RODiT active verification failed", {
-        component: "JwtAuth",
-        method: "thorough_validate_jwt_token_be",
-        requestId,
-        duration: performance.now() - startTime,
-        tokenId: peer_rodit.token_id,
-        url: config_own_rodit.own_rodit.metadata.subjectuniqueidentifier_url,
-      });
-
-      // Add metrics for failed active verification
-      logger.metric &&
-        logger.metric("jwt_thorough_validation", performance.now() - startTime, {
-          result: "active_failed",
-          token_jti: token.jti || "unknown",
-          peer_rodit_id: peer_rodit.token_id,
-        });
-
-      return {
-        isValid: false,
-        notAfter: null,
-        error: "RODiT active verification failed",
-        errorCode: "SERVER_RODIT_REVOKED",
-        errorMessage: "Server's RODiT has been revoked"
-      };
-    }
-
     // Perform trusted verification
     const trustedStart = performance.now();
     const isTrusted = await verify_rodit_istrusted_issuingsmartcontract(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rodit/rodit-auth-be",
-  "version": "9.15.0",
+  "version": "9.16.0",
   "description": "RODiT-based authentication system for Express.js applications",
   "main": "index.js",
   "exports": {
@@ -46,8 +46,13 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/discernible-io/rodit-auth-be.git"
+    "url": "git+https://github.com/discernible-io/rodit-sdk.git",
+    "directory": "rodit-auth-be"
   },
+  "bugs": {
+    "url": "https://github.com/discernible-io/rodit-sdk/issues"
+  },
+  "homepage": "https://github.com/discernible-io/rodit-sdk/tree/main/rodit-auth-be#readme",
   "publishConfig": {
     "access": "public"
   },