@rodit/rodit-auth-be 9.16.0 → 9.17.0

package/lib/middleware/authenticationmw.js

@@ -24,6 +24,11 @@ const {
   verify_peer_rodit,
   verify_rodit_ownership_withnep413
 } = require("../auth/authentication");
+const {
+  normalizeOptionalLoginNonce,
+  buildLoginSigningMessageBytes,
+  createLoginTimestampChallenge,
+} = require("../auth/login-nonce");
 const { 
   nearorg_rpc_tokenfromroditid
 } = require("../blockchain/blockchainservice");
@@ -163,7 +168,16 @@ function buildLoginUrl(apiendpoint, loginPath = "/api/login") {
 async function resolveServerLoginTimestamp(apiendpoint, options = {}) {
   const explicit = parseRequiredServerLoginTimestamp(options.timestamp);
   if (explicit !== null) {
-    return { timestamp: explicit };
+    const nonceResult = normalizeOptionalLoginNonce(options.nonce);
+    if (nonceResult.errorCode) {
+      return {
+        timestamp: null,
+        nonce: null,
+        errorCode: nonceResult.errorCode,
+        error: nonceResult.error,
+      };
+    }
+    return { timestamp: explicit, nonce: nonceResult.nonce };
   }
 
   const timestampPath =
@@ -183,6 +197,7 @@ async function resolveServerLoginTimestamp(apiendpoint, options = {}) {
     if (!response.ok) {
       return {
         timestamp: null,
+        nonce: null,
         errorCode: "LOGIN_TIMESTAMP_FETCH_FAILED",
         error: `Failed to fetch login timestamp challenge: HTTP ${response.status}`,
       };
@@ -193,15 +208,29 @@ async function resolveServerLoginTimestamp(apiendpoint, options = {}) {
     if (parsed === null) {
       return {
         timestamp: null,
+        nonce: null,
         errorCode: "INVALID_LOGIN_TIMESTAMP",
         error: "Login timestamp challenge response is missing a valid timestamp",
       };
     }
 
-    return { timestamp: parsed };
+    const nonceResult = normalizeOptionalLoginNonce(
+      options.nonce !== undefined ? options.nonce : data?.nonce
+    );
+    if (nonceResult.errorCode) {
+      return {
+        timestamp: null,
+        nonce: null,
+        errorCode: nonceResult.errorCode,
+        error: nonceResult.error,
+      };
+    }
+
+    return { timestamp: parsed, nonce: nonceResult.nonce };
   } catch (error) {
     return {
       timestamp: null,
+      nonce: null,
       errorCode: "LOGIN_TIMESTAMP_FETCH_FAILED",
       error: `Failed to fetch login timestamp challenge: ${error.message}`,
     };
@@ -302,6 +331,30 @@ async function login_client(req, res) {
     const hasAccountId = accountid.length > 0;
     const peer_timestamp = parseRequiredLoginTimestamp(body.timestamp);
     const base64url_signature = extractLoginBase64UrlSignature(body);
+    const nonceResult = normalizeOptionalLoginNonce(body.nonce);
+    if (nonceResult.errorCode) {
+      const duration = Date.now() - startTime;
+      logger.metric("login_attempt_duration_ms", duration, {
+        component: "RoditAuth",
+        success: false,
+        result: "failure",
+        reason: "invalid_login_nonce",
+        error: nonceResult.errorCode,
+      });
+      logger.metric("failed_login_attempts_total", 1, {
+        component: "RoditAuth",
+        result: "failure",
+        reason: nonceResult.errorCode,
+      });
+      return respondLoginValidationFailure(res, {
+        silenceLoginFailures,
+        statusCode: 400,
+        requestId,
+        code: nonceResult.errorCode,
+        message: nonceResult.error,
+      });
+    }
+    const peer_nonce = nonceResult.nonce;
 
     logger.infoWithContext("Login request identifiers (sanitized)", {
       ...baseContext,
@@ -309,6 +362,7 @@ async function login_client(req, res) {
       accountid: accountid || undefined,
       login_mode: hasRoditId ? "roditid" : hasAccountId ? "accountid" : "none",
       timestamp: peer_timestamp,
+      has_nonce: !!peer_nonce,
       has_base64url_signature: base64url_signature.length > 0,
     });
 
@@ -449,6 +503,7 @@ async function login_client(req, res) {
       hasRoditId: roditid.length > 0,
       hasAccountId: accountid.length > 0,
       hasTimestamp: peer_timestamp !== undefined && peer_timestamp !== null,
+      hasNonce: !!peer_nonce,
       has_base64url_signature: base64url_signature.length > 0,
     });
 
@@ -503,7 +558,8 @@ async function login_client(req, res) {
       await resolve_peer_rodit_for_login(roditid, accountid),
       peer_roditid,
       peer_timestamp,
-      base64url_signature
+      base64url_signature,
+      peer_nonce
     );
 
     const { peer_rodit, goodrodit: isRoditValid, failureReason, failureMessage } = result;
@@ -1287,6 +1343,191 @@ async function login_client(req, res) {
     }
   }
 
+  /**
+   * Optional client-initiated access-credential refresh.
+   * Not required for default SERVER-INITIATED deployments: the server renews
+   * access JWTs on authenticated API calls and returns them via New-Token.
+   * Mount POST /api/refresh only for idle-client timers or CLIENT-INITIATED mode.
+   *
+   * @param {Object} req - Express request object
+   * @param {Object} res - Express response object
+   * @returns {Object} Response object
+   */
+  async function refresh_client(req, res) {
+    const requestId = ulid();
+    const startTime = Date.now();
+    const baseContext = createLogContext(
+      "AuthenticationService",
+      "refresh_client",
+      {
+        requestId,
+        path: req.path,
+        method: req.method,
+        ip: req.ip,
+      }
+    );
+
+    logger.infoWithContext("Token refresh request received", {
+      ...baseContext,
+      userAgent: req.get("User-Agent"),
+    });
+
+    try {
+      verifySessionManager();
+
+      const jwt_token =
+        req.headers.authorization &&
+        req.headers.authorization.startsWith("Bearer ")
+          ? req.headers.authorization.substring(7)
+          : null;
+
+      if (!jwt_token) {
+        logger.metric &&
+          logger.metric("token_refresh_attempts", 1, {
+            component: "AuthenticationService",
+            result: "no_jwt_token",
+          });
+        return sendError(res, {
+          statusCode: 401,
+          requestId,
+          code: "MISSING_TOKEN",
+          message: "No authentication jwt_token provided",
+        });
+      }
+
+      const isTokenInvalid = await sessionManager.isTokenInvalidated(jwt_token);
+      if (isTokenInvalid) {
+        const invalidationInfo =
+          await sessionManager.getTokenInvalidationInfo(jwt_token);
+        logger.metric &&
+          logger.metric("token_refresh_attempts", 1, {
+            component: "AuthenticationService",
+            result: "invalidated_token",
+          });
+        return sendError(res, {
+          statusCode: 401,
+          requestId,
+          code: "INVALIDATED_TOKEN",
+          message: "Token has been invalidated",
+          details: {
+            reason: invalidationInfo?.reason || "session_inactive",
+            invalidatedAt: invalidationInfo?.timestamp,
+          },
+        });
+      }
+
+      const config_own_rodit = await stateManager.getConfigOwnRodit();
+      if (!config_own_rodit || !config_own_rodit.own_rodit) {
+        return sendError(res, {
+          statusCode: 500,
+          requestId,
+          code: "SERVER_CONFIG_ERROR",
+          message: "Server configuration not initialized",
+        });
+      }
+
+      let validationResult;
+      try {
+        validationResult = await validate_jwt_token_be(
+          jwt_token,
+          config_own_rodit.own_rodit,
+          {
+            allowExpiredToken: true,
+            forceCredentialRenewal: true,
+          }
+        );
+      } catch (validationError) {
+        const message = validationError.message || "Token refresh failed";
+        const sessionClosed =
+          /Error 012/i.test(message) ||
+          /Session is not active/i.test(message) ||
+          validationError.renewalReason === "session_closed";
+        logger.metric &&
+          logger.metric("token_refresh_attempts", 1, {
+            component: "AuthenticationService",
+            result: sessionClosed ? "session_closed" : "validation_failed",
+          });
+        return sendError(res, {
+          statusCode: sessionClosed ? 401 : 403,
+          requestId,
+          code: sessionClosed
+            ? "INVALIDATED_TOKEN"
+            : validationError.code || "REFRESH_FAILED",
+          message,
+        });
+      }
+
+      const newToken = validationResult?.newToken;
+      if (!newToken) {
+        logger.metric &&
+          logger.metric("token_refresh_attempts", 1, {
+            component: "AuthenticationService",
+            result: "no_new_token",
+          });
+        return sendError(res, {
+          statusCode: 403,
+          requestId,
+          code: "REFRESH_FAILED",
+          message: "Token refresh did not produce a new credential",
+        });
+      }
+
+      if (typeof res.setHeader === "function") {
+        res.setHeader("New-Token", newToken);
+      } else if (typeof res.set === "function") {
+        res.set("New-Token", newToken);
+      }
+
+      const duration = Date.now() - startTime;
+      logger.infoWithContext("Token refresh completed", {
+        ...baseContext,
+        duration,
+        success: true,
+      });
+      logger.metric &&
+        logger.metric("token_refresh_attempts", 1, {
+          component: "AuthenticationService",
+          result: "success",
+        });
+      logger.metric &&
+        logger.metric("token_refresh_duration_ms", duration, {
+          component: "AuthenticationService",
+          success: true,
+        });
+
+      return res.json({
+        token: newToken,
+        jwt_token: newToken,
+        message: "Token refreshed",
+        requestId,
+      });
+    } catch (error) {
+      const duration = Date.now() - startTime;
+      logErrorWithMetrics(
+        "Token refresh process failed",
+        {
+          ...baseContext,
+          duration,
+        },
+        error,
+        "refresh_error",
+        { error_type: "general_refresh_error" }
+      );
+      logger.metric &&
+        logger.metric("token_refresh_attempts", 1, {
+          component: "AuthenticationService",
+          result: "error",
+        });
+      return sendError(res, {
+        statusCode: 500,
+        requestId,
+        code: "REFRESH_ERROR",
+        message: "Internal server error during token refresh",
+        details: !isStrictEnvironment() ? { error: error.message } : undefined,
+      });
+    }
+  }
+
   /**
    * Handle client login with NEP-413 standard
    *
@@ -1624,6 +1865,16 @@ async function login_portal(config_own_rodit, port, options = {}) {
           requestId
         };
       }
+      const nonceResult = normalizeOptionalLoginNonce(options.nonce);
+      if (nonceResult.errorCode) {
+        return {
+          error: nonceResult.error,
+          errorCode: nonceResult.errorCode,
+          failureReason: nonceResult.errorCode,
+          requestId
+        };
+      }
+      const nonce = nonceResult.nonce;
 
       const hasRoditId = roditid.length > 0;
       const hasAccountId = accountid.length > 0;
@@ -1638,8 +1889,10 @@ async function login_portal(config_own_rodit, port, options = {}) {
 
       const timeString = await unixTimeToDateString(timestamp);
       const signatureIdentifier = hasRoditId ? roditid : accountid;
-      const signatureIdentifierandtimestamp = new TextEncoder().encode(
-        signatureIdentifier + timeString
+      const signatureIdentifierandtimestamp = buildLoginSigningMessageBytes(
+        signatureIdentifier,
+        timeString,
+        nonce
       );
 
       logger.debug("Generating authentication signature", {
@@ -1649,6 +1902,7 @@ async function login_portal(config_own_rodit, port, options = {}) {
         roditId: roditid,
         accountId: accountid,
         timestamp,
+        hasNonce: !!nonce,
       });
 
       // Create signature
@@ -1674,17 +1928,21 @@ async function login_portal(config_own_rodit, port, options = {}) {
       });
 
       try {
+        const requestBody = {
+          ...(hasRoditId ? { roditid } : {}),
+          ...(hasAccountId ? { accountid } : {}),
+          timestamp,
+          roditid_base64url_signature,
+        };
+        if (nonce) {
+          requestBody.nonce = nonce;
+        }
         const response = await fetch(fetchUrl, {
           method: "POST",
           headers: {
             "Content-Type": "application/json",
           },
-          body: JSON.stringify({
-            ...(hasRoditId ? { roditid } : {}),
-            ...(hasAccountId ? { accountid } : {}),
-            timestamp,
-            roditid_base64url_signature,
-          }),
+          body: JSON.stringify(requestBody),
         });
 
         if (!response.ok) {
@@ -1972,8 +2230,12 @@ async function login_portal(config_own_rodit, port, options = {}) {
       });
 
       const roditid = normalizeOptionalLoginString(own_rodit?.token_id);
-      const { timestamp, error: timestampError, errorCode: timestampErrorCode } =
-        await resolveServerLoginTimestamp(apiendpoint, options);
+      const {
+        timestamp,
+        nonce,
+        error: timestampError,
+        errorCode: timestampErrorCode,
+      } = await resolveServerLoginTimestamp(apiendpoint, options);
       const accountid = normalizeOptionalServerAccountId(options.accountId);
 
       if (timestamp === null) {
@@ -2005,13 +2267,16 @@ async function login_portal(config_own_rodit, port, options = {}) {
         roditId: roditid,
         accountId: accountid,
         timestamp,
+        hasNonce: !!nonce,
       });
 
       const timeString = await unixTimeToDateString(timestamp);
 
       const signatureIdentifier = hasRoditId ? roditid : accountid;
-      const signatureIdentifierandtimestamp = new TextEncoder().encode(
-        signatureIdentifier + timeString
+      const signatureIdentifierandtimestamp = buildLoginSigningMessageBytes(
+        signatureIdentifier,
+        timeString,
+        nonce
       );
 
       logger.debug("Generating signature", {
@@ -2020,6 +2285,7 @@ async function login_portal(config_own_rodit, port, options = {}) {
         requestId,
         hasPrivateKey: !!config_own_rodit.own_rodit_bytes_private_key,
         signatureIdentifier,
+        hasNonce: !!nonce,
       });
 
       const own_rodit_bytes_signature = nacl.sign.detached(
@@ -2044,6 +2310,10 @@ async function login_portal(config_own_rodit, port, options = {}) {
         requestBody.accountid = accountid;
       }
 
+      if (nonce) {
+        requestBody.nonce = nonce;
+      }
+
       logger.debug("Sending login request", {
         component: "AuthenticationService",
         method,
@@ -2051,6 +2321,7 @@ async function login_portal(config_own_rodit, port, options = {}) {
         roditid,
         accountId: accountid,
         timestamp,
+        hasNonce: !!nonce,
         signatureLength: roditid_base64url_signature?.length,
         apiEndpoint: loginUrl,
       });
@@ -2379,4 +2650,15 @@ async function logout_server(jwt_token) {
 
 
 // Export the class directly (will be instantiated in rodit.js)
-module.exports = {authenticate_apicall,authenticate_logout,login_server,login_portal,login_client,login_client_withnep413,logout_client,logout_server};
+module.exports = {
+  authenticate_apicall,
+  authenticate_logout,
+  login_server,
+  login_portal,
+  login_client,
+  login_client_withnep413,
+  logout_client,
+  logout_server,
+  refresh_client,
+  createLoginTimestampChallenge,
+};

package/lib/middleware/webhookhandlermw.js

@@ -121,6 +121,27 @@ function validateOutboundWebhookUrl(raw) {
   return parsed;
 }
 
+/**
+ * Build the absolute outbound webhook URL.
+ * If `webhookUrl` is host-only (`host` or `host:port`), append `endpoint`.
+ * If it already includes a path, use that path as-is (do not append).
+ *
+ * @param {string} webhookUrl Peer `rodit_webhookurl` / `webhook_url` (scheme optional)
+ * @param {string} [endpoint='/webhook'] Path to append when none is present
+ * @returns {string} Absolute https URL
+ */
+function formatOutboundWebhookTargetUrl(webhookUrl, endpoint = "/webhook") {
+  const cleanWebhookUrl = String(webhookUrl || "")
+    .replace(/^(https?:\/\/)/i, "")
+    .replace(/\/+$/, "");
+  const hasPath = cleanWebhookUrl.includes("/");
+  if (hasPath) {
+    return `https://${cleanWebhookUrl}`;
+  }
+  const normalizedEndpoint = `/${String(endpoint || "/webhook").replace(/^\/+/, "")}`;
+  return `https://${cleanWebhookUrl}${normalizedEndpoint}`;
+}
+
 function ipv4ToInt(ip) {
   return ip.split(".").reduce((acc, oct) => ((acc << 8) + Number(oct)) >>> 0, 0) >>> 0;
 }
@@ -1208,13 +1229,9 @@ async function resolveOutboundWebhookSessionId(options = {}, req = null) {
         endpoint
       });
    
-      // Normalize base URL and endpoint so we always produce exactly one slash
-      // between host and path (e.g. https://host/hooks/wake).
-      const cleanWebhookUrl = webhookUrl
-        .replace(/^(https?:\/\/)/, "")
-        .replace(/\/+$/, "");
-      const normalizedEndpoint = `/${String(endpoint || "/webhook").replace(/^\/+/, "")}`;
-      const formattedWebhookUrl = `https://${cleanWebhookUrl}${normalizedEndpoint}`;
+      // Append endpoint only when webhook_url has no path
+      // (e.g. host:7443 → …/hooks/wake; host:7443/hooks/agent stays as-is).
+      const formattedWebhookUrl = formatOutboundWebhookTargetUrl(webhookUrl, endpoint);
 
       // Outbound SSRF controls: reject userinfo / private / metadata destinations,
       // enforce peer webhook_cidr, and pin DNS for the request lifetime.
@@ -2101,6 +2118,7 @@ module.exports = {
 
   // Outbound SSRF / CIDR / DNS-pin helpers
   validateOutboundWebhookUrl,
+  formatOutboundWebhookTargetUrl,
   resolveAndPinWebhookDestination,
   createPinnedDispatcher,
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rodit/rodit-auth-be",
-  "version": "9.16.0",
+  "version": "9.17.0",
   "description": "RODiT-based authentication system for Express.js applications",
   "main": "index.js",
   "exports": {

package/services/configsdk.js

@@ -229,10 +229,12 @@ const FALLBACK_DEFAULTS = {
     LAPSED_LIFETIME_PROPORTION_4RENEWAL_ELIGIBILITY: "0.80",
     THRESHOLD_VALIDATION_TYPE: "0.10",
     DURATIONRAMP: "0.85",
-    // RODiT flow initiator behavior.
+    // Token renewal initiator (default: server handles renewals).
     // Options:
-    // - "SERVER-INITIATED": server starts the flow
-    // - "CLIENT-INITIATED": client starts the flow
+    // - "SERVER-INITIATED" (default): renew access JWT during authenticate and
+    //   return New-Token. Clients normally do not need POST /api/refresh.
+    // - "CLIENT-INITIATED" (optional/advanced): skip piggyback renewal; client
+    //   must call the optional POST /api/refresh endpoint.
     SERVERORCLIENT: "SERVER-INITIATED",
     // Login error behavior.
     // Options: