@shelbyb/daywalker-sdk 0.2.0 → 0.4.0

package/dist/crypto/signatures.js

@@ -1,27 +1,42 @@
-import { base64ToBytes, base64UrlToBytes, bytesToBase64, stringToUtf8, utf8ToString, timingSafeEqualString, } from "./encoding.js";
+import { base64ToBytes, base64UrlToBytesStrict, bytesToBase64, bytesToHex, stringToUtf8, utf8ToString, timingSafeEqualString, } from "./encoding.js";
 import { computeContentDigest } from "./digest.js";
 import { loadPublicKey, loadSigningKey } from "./keys.js";
+import { assertSecureUrl } from "../config.js";
 export const SIGNATURE_VERSION = "rfc9421";
 export const SIGNATURE_LABEL = "sig1";
 export const SIGNATURE_ALG = "ed25519";
 export const MAX_CLOCK_SKEW_SECONDS = 300;
 export const SAFE_IDENTIFIER_PATTERN = /^[a-zA-Z0-9_\-\.]{1,128}$/;
 /**
- * Normalizes HTTP request path per RFC 3986 to prevent path traversal & signature confusion.
+ * Splits a request target into its RFC 9421 "@path" value (§2.2.6; dot segments resolved and repeated
+ * slashes collapsed per RFC 3986, to prevent path traversal & signature confusion) and its "@query" value
+ * (§2.2.7; the query with its leading "?", or "?" alone when there is none). Fragments are dropped.
  */
-export function normalizePath(rawPath) {
-    if (!rawPath || !rawPath.trim())
-        return "/";
-    let p = rawPath.trim();
-    p = p.replace(/\/+/g, "/");
+export function splitRequestTarget(rawTarget) {
+    if (!rawTarget || !rawTarget.trim())
+        return { path: "/", query: "?" };
+    const t = rawTarget.trim().replace(/^[^?#]*/, (p) => p.replace(/\/+/g, "/"));
     try {
-        const parsed = new URL(p, "http://localhost");
-        return parsed.pathname + parsed.search;
+        const parsed = new URL(t, "http://localhost");
+        return { path: parsed.pathname, query: parsed.search || "?" };
     }
     catch {
-        return p.startsWith("/") ? p : `/${p}`;
+        const p = t.replace(/[?#].*$/, "");
+        return { path: p.startsWith("/") ? p : `/${p}`, query: "?" };
     }
 }
+/**
+ * Normalizes an HTTP request path per RFC 3986 into the "@path" component. Path only: the query string is
+ * a separate "@query" component (see `splitRequestTarget`).
+ */
+export function normalizePath(rawPath) {
+    return splitRequestTarget(rawPath).path;
+}
+/** Methods whose requests always cover "content-digest" (of the empty body when there is none). */
+const BODY_METHODS = new Set(["POST", "PUT", "PATCH"]);
+/** Derived components this implementation can compute; header field names must be lowercase. */
+const DERIVED_COMPONENTS = new Set(["@method", "@path", "@query", "@authority"]);
+const COMPONENT_NAME_PATTERN = /^@?[a-z0-9][a-z0-9_.-]*$/;
 /**
  * Validates that an identifier (keyId, serviceSlug, etc.) contains only safe alphanumeric/hyphen characters.
  */
@@ -31,81 +46,184 @@ export function assertSafeIdentifier(name, value) {
     }
 }
 /**
- * In-memory LRU / sliding cache for nonces / signature replay protection.
+ * Upper bound on remembered signatures. Unexpired entries are never evicted: once the cache is full of them,
+ * new signatures are rejected (fail closed) until entries expire. Entries live 2 x maxClockSkewSeconds
+ * (600s by default), so the default sustains ~160 verified requests/s per process.
+ */
+export const REPLAY_CACHE_MAX_ENTRIES = 100_000;
+/**
+ * In-memory replay cache, keyed on keyid + decoded signature bytes (so re-encodings of the
+ * same signature collide). Per process only: multi-instance deployments need a shared `ReplayStore`.
  */
-class SignatureReplayCache {
+export class SignatureReplayCache {
+    maxEntries;
     seen = new Map();
-    ttlMs;
-    constructor(ttlSeconds = 360) {
-        this.ttlMs = ttlSeconds * 1000;
-    }
-    checkAndRecord(signatureId) {
-        const now = Date.now();
-        if (this.seen.size > 5000) {
-            for (const [k, exp] of this.seen.entries()) {
+    constructor(maxEntries = REPLAY_CACHE_MAX_ENTRIES) {
+        this.maxEntries = maxEntries;
+    }
+    get size() {
+        return this.seen.size;
+    }
+    /** True when the key was recorded and has not expired yet (a replay). */
+    has(key, now = Date.now()) {
+        const expiresAt = this.seen.get(key);
+        return expiresAt !== undefined && expiresAt > now;
+    }
+    /**
+     * Records `key` until `now + ttlMs`. Returns false, recording nothing, when the key is already present
+     * or the cache is full of unexpired entries (a still-valid signature is never forgotten early).
+     */
+    record(key, ttlMs, now = Date.now()) {
+        if (this.has(key, now))
+            return false;
+        this.seen.delete(key);
+        if (this.seen.size >= this.maxEntries) {
+            for (const [k, exp] of this.seen) {
                 if (exp <= now)
                     this.seen.delete(k);
             }
+            if (this.seen.size >= this.maxEntries)
+                return false;
         }
-        const expiresAt = this.seen.get(signatureId);
-        if (expiresAt && expiresAt > now) {
-            return false; // Replay detected
-        }
-        this.seen.set(signatureId, now + this.ttlMs);
+        this.seen.set(key, now + ttlMs);
         return true;
     }
+    clear() {
+        this.seen.clear();
+    }
 }
 export const globalReplayCache = new SignatureReplayCache();
 /**
  * Format the RFC 9421 Signature-Input parameters string.
  * Example: `("@method" "@path" "@authority" "content-digest");created=1791561600;keyid="...";alg="ed25519";nonce="..."`
+ * Every value is validated, so none can close its quoted string and inject parameters.
  */
 export function formatSignatureParams(params) {
     const components = params.components ?? ["@method", "@path", "@authority", "content-digest"];
+    for (const c of components) {
+        if (!COMPONENT_NAME_PATTERN.test(c) || c === "@signature-params") {
+            throw new Error(`Invalid covered component: ${JSON.stringify(c)}`);
+        }
+    }
+    if (!Number.isSafeInteger(params.created) || params.created < 0) {
+        throw new Error("Invalid created: must be a non-negative integer of unix seconds");
+    }
+    const alg = params.alg ?? SIGNATURE_ALG;
+    assertSafeIdentifier("keyid", params.keyid);
+    assertSafeIdentifier("alg", alg);
     const componentsStr = components.map((c) => `"${c}"`).join(" ");
-    let out = `(${componentsStr});created=${params.created};keyid="${params.keyid}";alg="${params.alg ?? SIGNATURE_ALG}"`;
+    let out = `(${componentsStr});created=${params.created};keyid="${params.keyid}";alg="${alg}"`;
     if (params.nonce) {
+        assertSafeIdentifier("nonce", params.nonce);
         out += `;nonce="${params.nonce}"`;
     }
     return out;
 }
 /**
- * Construct canonical RFC 9421 signature base string.
+ * Parses a Signature-Input member value (RFC 8941 inner list of plain quoted component names, then
+ * `;key=value` parameters with integer or string values). Returns an error string when malformed.
+ */
+function parseSignatureParams(input) {
+    const listMatch = input.match(/^\(([^()]*)\)(.*)$/);
+    if (!listMatch)
+        return "Signature-Input missing covered components list";
+    const inner = listMatch[1].trim();
+    const components = [];
+    for (const item of inner ? inner.split(/ +/) : []) {
+        const m = item.match(/^"([^"\\]*)"$/);
+        if (!m || !COMPONENT_NAME_PATTERN.test(m[1])) {
+            return `Unsupported covered component in Signature-Input: ${item}`;
+        }
+        components.push(m[1]);
+    }
+    const params = {};
+    const paramPattern = /;([a-z*][a-z0-9_.*-]*)=(\d{1,15}|"[^"\\]*")/y;
+    let rest = listMatch[2];
+    while (rest.length > 0) {
+        paramPattern.lastIndex = 0;
+        const m = paramPattern.exec(rest);
+        if (!m)
+            return "Malformed Signature-Input parameters";
+        if (Object.prototype.hasOwnProperty.call(params, m[1]))
+            return `Duplicate Signature-Input parameter: ${m[1]}`;
+        params[m[1]] = m[2].startsWith('"') ? m[2].slice(1, -1) : parseInt(m[2], 10);
+        rest = rest.slice(m[0].length);
+    }
+    return { components, params };
+}
+/**
+ * Construct canonical RFC 9421 signature base string from the covered components, in order. They are
+ * `components` when given, else the list declared in `signatureParams`. "@path" and "@query" come from
+ * `path` (which may carry a query string); "content-digest" from `contentDigest`; any other header field
+ * from `additionalComponents`. Throws when a covered component has no value.
  */
 export function createSignatureBase(params) {
-    const method = params.method.toUpperCase();
-    const path = normalizePath(params.path);
-    const authority = params.authority.toLowerCase();
-    const lines = [
-        `"@method": ${method}`,
-        `"@path": ${path}`,
-        `"@authority": ${authority}`,
-    ];
-    if (params.contentDigest !== undefined && params.contentDigest !== null) {
-        lines.push(`"content-digest": ${params.contentDigest}`);
+    const target = splitRequestTarget(params.path);
+    let components = params.components;
+    if (!components) {
+        const parsed = parseSignatureParams(params.signatureParams);
+        components =
+            typeof parsed !== "string"
+                ? parsed.components
+                : [
+                    "@method",
+                    "@path",
+                    "@authority",
+                    ...(params.contentDigest !== undefined && params.contentDigest !== null ? ["content-digest"] : []),
+                    ...Object.keys(params.additionalComponents ?? {}),
+                ];
     }
-    if (params.additionalComponents) {
-        for (const [k, v] of Object.entries(params.additionalComponents)) {
-            lines.push(`"${k.toLowerCase()}": ${v}`);
+    const additional = {};
+    for (const [k, v] of Object.entries(params.additionalComponents ?? {}))
+        additional[k.toLowerCase()] = v;
+    const lines = [];
+    for (const raw of components) {
+        const name = raw.toLowerCase();
+        let value;
+        if (name === "@method")
+            value = params.method.toUpperCase();
+        else if (name === "@path")
+            value = target.path;
+        else if (name === "@query")
+            value = target.query;
+        else if (name === "@authority")
+            value = params.authority.toLowerCase();
+        else if (name.startsWith("@"))
+            throw new Error(`Unsupported derived component: ${name}`);
+        else if (name === "content-digest")
+            value = params.contentDigest ?? additional[name];
+        else
+            value = additional[name];
+        if (value === undefined || value === null) {
+            throw new Error(`Covered component ${name} has no value`);
         }
+        value = value.trim();
+        if (/[\r\n]/.test(value)) {
+            throw new Error(`Covered component ${name} contains a line break`);
+        }
+        lines.push(`"${name}": ${value}`);
     }
     lines.push(`"@signature-params": ${params.signatureParams}`);
     return lines.join("\n");
 }
 /**
  * Sign an outgoing HTTP request according to RFC 9421 + RFC 9530.
+ * Covers "@method", "@path", "@query" (only when `path` has a query string), "@authority" and
+ * "content-digest" (whenever there is a body, and always for POST / PUT / PATCH).
  */
 export async function signRequest(params) {
     const signingKey = await loadSigningKey(params.key);
     const created = params.created ?? Math.floor(Date.now() / 1000);
     const keyid = params.keyid ?? signingKey.publicJwk.kid;
     const alg = params.alg ?? SIGNATURE_ALG;
-    if (keyid) {
-        assertSafeIdentifier("keyid", keyid);
+    const method = params.method.toUpperCase();
+    const body = params.body ?? (BODY_METHODS.has(method) ? "" : null);
+    const contentDigest = body !== null ? await computeContentDigest(body) : null;
+    const components = ["@method", "@path"];
+    if (splitRequestTarget(params.path).query !== "?") {
+        components.push("@query");
     }
-    const hasBody = params.body !== undefined && params.body !== null;
-    const contentDigest = hasBody ? await computeContentDigest(params.body) : null;
-    const components = ["@method", "@path", "@authority"];
+    components.push("@authority");
     if (contentDigest !== null) {
         components.push("content-digest");
     }
@@ -117,11 +235,12 @@ export async function signRequest(params) {
         nonce: params.nonce,
     });
     const signatureBase = createSignatureBase({
-        method: params.method,
+        method,
         path: params.path,
         authority: params.authority,
         contentDigest,
         signatureParams,
+        components,
     });
     const signatureBuffer = await globalThis.crypto.subtle.sign("Ed25519", signingKey.privateKey, stringToUtf8(signatureBase));
     const signatureBase64 = bytesToBase64(new Uint8Array(signatureBuffer));
@@ -138,7 +257,10 @@ export async function signRequest(params) {
     return headers;
 }
 /**
- * Verify an incoming RFC 9421 HTTP Message Signature.
+ * Verify an incoming RFC 9421 HTTP Message Signature. The signature base is built from the components the
+ * signature declares, which must include "@method", "@path" and "@authority", plus "@query" when the request
+ * has a query string and "content-digest" when it has a body or is a POST / PUT / PATCH.
+ * Replay protection uses `replayStore` (default: per-process memory; use a shared store across instances).
  */
 export async function verifyRequestSignature(params) {
     const getHeader = (name) => {
@@ -164,41 +286,55 @@ export async function verifyRequestSignature(params) {
     }
     const signatureParams = sigInputMatch[1].trim();
     // Validate parameters and check for component duplicates
-    const coveredComponentsMatch = signatureParams.match(/^\(([^)]*)\)/);
-    if (!coveredComponentsMatch) {
-        return { valid: false, error: "Signature-Input missing covered components list" };
+    const parsed = parseSignatureParams(signatureParams);
+    if (typeof parsed === "string") {
+        return { valid: false, error: parsed };
     }
-    const rawComponents = coveredComponentsMatch[1].trim().split(/\s+/).filter(Boolean);
+    const components = parsed.components;
     const seenComponents = new Set();
-    for (const c of rawComponents) {
+    for (const c of components) {
         if (seenComponents.has(c)) {
             return { valid: false, error: `Duplicate covered component in Signature-Input: ${c}` };
         }
         seenComponents.add(c);
     }
-    const sigMatch = signatureHeader.match(new RegExp(`(?:^|,\\s*)${SIGNATURE_LABEL}=:([A-Za-z0-9+/=_-]+):`));
-    if (!sigMatch) {
+    for (const required of ["@method", "@path", "@authority"]) {
+        if (!seenComponents.has(required)) {
+            return { valid: false, error: `Signature does not cover ${required}` };
+        }
+    }
+    if (splitRequestTarget(params.path).query !== "?" && !seenComponents.has("@query")) {
+        return { valid: false, error: "Request has a query string but the signature does not cover @query" };
+    }
+    const body = params.body;
+    const hasBody = body !== undefined && body !== null && (typeof body === "string" ? body.length > 0 : body.byteLength > 0);
+    if ((hasBody || BODY_METHODS.has(params.method.toUpperCase())) && !seenComponents.has("content-digest")) {
+        return { valid: false, error: "Request has a body but the signature does not cover content-digest" };
+    }
+    // RFC 8941 byte sequence (`:base64:`), standard alphabet with padding only, so each signature
+    // has exactly one accepted encoding.
+    const sigMatch = signatureHeader.match(new RegExp(`(?:^|,\\s*)${SIGNATURE_LABEL}=:([A-Za-z0-9+/]*={0,2}):(?=\\s*(?:,|$))`));
+    if (!sigMatch || sigMatch[1].length % 4 !== 0) {
+        return { valid: false, error: `Signature header does not contain valid ${SIGNATURE_LABEL} byte sequence` };
+    }
+    const signatureBytes = base64ToBytes(sigMatch[1]);
+    if (bytesToBase64(signatureBytes) !== sigMatch[1]) {
         return { valid: false, error: `Signature header does not contain valid ${SIGNATURE_LABEL} byte sequence` };
     }
-    const signatureBase64 = sigMatch[1].trim();
-    const createdMatch = signatureParams.match(/created=(\d+)/);
-    if (!createdMatch) {
+    const created = parsed.params.created;
+    if (typeof created !== "number") {
         return { valid: false, error: "Signature-Input missing created timestamp" };
     }
-    const created = parseInt(createdMatch[1], 10);
     const now = params.currentTime ?? Math.floor(Date.now() / 1000);
     const maxSkew = params.maxClockSkewSeconds ?? MAX_CLOCK_SKEW_SECONDS;
     if (Math.abs(now - created) > maxSkew) {
         return { valid: false, error: `Signature timestamp expired or clock skew too large (created=${created}, now=${now})` };
     }
-    if (params.replayCheck !== false) {
-        const replayKey = `${signatureBase64}:${created}`;
-        if (!globalReplayCache.checkAndRecord(replayKey)) {
-            return { valid: false, error: "Replay detected: request signature was already presented" };
-        }
+    const keyidParam = parsed.params.keyid;
+    if (keyidParam !== undefined && typeof keyidParam !== "string") {
+        return { valid: false, error: "Signature-Input keyid must be a string" };
     }
-    const keyidMatch = signatureParams.match(/keyid="([^"]+)"/);
-    const keyid = keyidMatch ? keyidMatch[1] : undefined;
+    const keyid = keyidParam || undefined;
     if (keyid) {
         try {
             assertSafeIdentifier("keyid", keyid);
@@ -207,12 +343,18 @@ export async function verifyRequestSignature(params) {
             return { valid: false, error: e.message };
         }
     }
-    const algMatch = signatureParams.match(/alg="([^"]+)"/);
-    const alg = algMatch ? algMatch[1] : undefined;
-    if (alg && alg.toLowerCase() !== "ed25519" && alg.toLowerCase() !== "eddsa") {
+    // Entries must outlive the whole acceptance window (created ± maxSkew).
+    const replayStore = params.replayStore ?? globalReplayCache;
+    const replayKey = `${keyid ?? ""}:${bytesToHex(signatureBytes)}`;
+    const replayTtlMs = 2 * Math.max(maxSkew, 1) * 1000;
+    if (params.replayCheck !== false && (await replayStore.has(replayKey))) {
+        return { valid: false, error: "Replay detected: request signature was already presented" };
+    }
+    const alg = parsed.params.alg;
+    if (alg !== undefined && (typeof alg !== "string" || (alg.toLowerCase() !== "ed25519" && alg.toLowerCase() !== "eddsa"))) {
         return { valid: false, error: `Unsupported signature algorithm: ${alg}` };
     }
-    if (signatureParams.includes('"content-digest"')) {
+    if (seenComponents.has("content-digest")) {
         if (!contentDigestHeader) {
             return { valid: false, error: "Signature covers content-digest but Content-Digest header is missing" };
         }
@@ -221,30 +363,56 @@ export async function verifyRequestSignature(params) {
             return { valid: false, error: `Content-Digest mismatch: expected ${computedDigest}, got ${contentDigestHeader}` };
         }
     }
-    const signatureBase = createSignatureBase({
-        method: params.method,
-        path: params.path,
-        authority: params.authority,
-        contentDigest: signatureParams.includes('"content-digest"') ? contentDigestHeader?.trim() : null,
-        signatureParams,
-    });
     try {
-        const { publicKey } = await loadPublicKey(params.publicKey);
-        const signatureBytes = signatureBase64.includes("-") || signatureBase64.includes("_")
-            ? base64UrlToBytes(signatureBase64)
-            : base64ToBytes(signatureBase64);
+        const additionalComponents = {};
+        for (const c of components) {
+            if (c.startsWith("@") || c === "content-digest")
+                continue;
+            const value = getHeader(c);
+            if (value === undefined) {
+                return { valid: false, error: `Signature covers ${c} but the request has no such header` };
+            }
+            additionalComponents[c] = value;
+        }
+        const signatureBase = createSignatureBase({
+            method: params.method,
+            path: params.path,
+            authority: params.authority,
+            contentDigest: contentDigestHeader?.trim() ?? null,
+            signatureParams,
+            additionalComponents,
+            components,
+        });
+        const { publicKey } = await loadPublicKey(params.publicKey, keyid);
         const isValid = await globalThis.crypto.subtle.verify("Ed25519", publicKey, signatureBytes, stringToUtf8(signatureBase));
         if (!isValid) {
             return { valid: false, error: "Cryptographic signature verification failed" };
         }
+        // Record only verified signatures. `record` is set-if-absent, so a concurrent copy that won the race,
+        // or a store too full to remember this signature, makes it fail closed.
+        if (params.replayCheck !== false && !(await replayStore.record(replayKey, replayTtlMs))) {
+            const full = !(await replayStore.has(replayKey));
+            return {
+                valid: false,
+                error: full
+                    ? "Replay cache is full: refusing a signature that could not be remembered"
+                    : "Replay detected: request signature was already presented",
+            };
+        }
         return { valid: true, keyid };
     }
     catch (err) {
         return { valid: false, error: `Verification error: ${err.message}` };
     }
 }
+/** Clock skew tolerated on JWT lease `exp` / `nbf`. */
+export const JWT_CLOCK_SKEW_SECONDS = 60;
 /**
  * Zero-egress offline verification for asymmetric JWT token leases.
+ * Requires a numeric `exp` and an audience (`aud` or `serviceSlug`) equal to `expectedServiceSlug`;
+ * a verifier without an expected slug rejects every lease. `iss` is checked when `expectedIssuer` is set
+ * (Daywalker documents no fixed issuer, so there is no default). Segments must be canonical unpadded
+ * base64url, a `crit` header is rejected, and a JWKS `publicKey` is searched by the header's `kid`.
  */
 export async function verifyJwtLease(params) {
     try {
@@ -253,35 +421,77 @@ export async function verifyJwtLease(params) {
             return { valid: false, error: "Token is not a valid 3-part JWT" };
         }
         const [headerB64, payloadB64, signatureB64] = parts;
-        const headerJson = utf8ToString(base64UrlToBytes(headerB64));
-        const payloadJson = utf8ToString(base64UrlToBytes(payloadB64));
+        let headerJson;
+        let payloadJson;
+        let signatureBytes;
+        try {
+            headerJson = utf8ToString(base64UrlToBytesStrict(headerB64));
+            payloadJson = utf8ToString(base64UrlToBytesStrict(payloadB64));
+            signatureBytes = base64UrlToBytesStrict(signatureB64);
+        }
+        catch {
+            return { valid: false, error: "JWT segments must be canonical unpadded base64url" };
+        }
         const header = JSON.parse(headerJson);
         const payload = JSON.parse(payloadJson);
+        if (!header || typeof header !== "object" || !payload || typeof payload !== "object" || Array.isArray(payload)) {
+            return { valid: false, error: "JWT header and payload must be JSON objects" };
+        }
         if (header.alg !== "EdDSA" && header.alg !== "ed25519") {
             return { valid: false, error: `Unsupported JWT alg: ${header.alg}` };
         }
-        const { publicKey } = await loadPublicKey(params.publicKey);
+        if (header.typ !== undefined && String(header.typ).toUpperCase() !== "JWT") {
+            return { valid: false, error: `Unsupported JWT typ: ${header.typ}` };
+        }
+        // RFC 7515 §4.1.11: extensions we don't understand must be rejected; we implement none.
+        if (header.crit !== undefined) {
+            return { valid: false, error: "Unsupported JWT crit header" };
+        }
+        if (header.kid !== undefined && typeof header.kid !== "string") {
+            return { valid: false, error: "JWT kid must be a string" };
+        }
+        const { publicKey } = await loadPublicKey(params.publicKey, header.kid);
         const signedData = stringToUtf8(`${headerB64}.${payloadB64}`);
-        const signatureBytes = base64UrlToBytes(signatureB64);
         const isValid = await globalThis.crypto.subtle.verify("Ed25519", publicKey, signatureBytes, signedData);
         if (!isValid) {
             return { valid: false, error: "JWT signature verification failed" };
         }
         const now = params.currentTime ?? Math.floor(Date.now() / 1000);
-        if (payload.exp && typeof payload.exp === "number" && payload.exp < now) {
+        const skew = Math.max(0, Math.min(params.clockSkewSeconds ?? JWT_CLOCK_SKEW_SECONDS, 300));
+        if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) {
+            return { valid: false, error: "JWT token lease has no numeric exp claim" };
+        }
+        if (payload.exp + skew <= now) {
             return { valid: false, error: "JWT token lease has expired" };
         }
-        if (payload.nbf && typeof payload.nbf === "number" && payload.nbf > now + 60) {
+        if (payload.nbf !== undefined && (typeof payload.nbf !== "number" || payload.nbf > now + skew)) {
             return { valid: false, error: "JWT token lease not active yet" };
         }
-        if (params.expectedServiceSlug) {
-            const tokenSlug = (payload.serviceSlug || payload.aud || "").toLowerCase();
-            if (tokenSlug && tokenSlug !== params.expectedServiceSlug.toLowerCase()) {
-                return {
-                    valid: false,
-                    error: `JWT audience mismatch: expected ${params.expectedServiceSlug}, got ${tokenSlug}`,
-                };
-            }
+        const expected = params.expectedServiceSlug?.trim().toLowerCase();
+        if (!expected) {
+            return { valid: false, error: "JWT audience cannot be checked: no expected service slug is configured" };
+        }
+        const audiences = [];
+        if (payload.serviceSlug !== undefined)
+            audiences.push(String(payload.serviceSlug));
+        if (Array.isArray(payload.aud))
+            audiences.push(...payload.aud.map(String));
+        else if (payload.aud !== undefined)
+            audiences.push(String(payload.aud));
+        if (audiences.length === 0) {
+            return { valid: false, error: "JWT token lease has no aud or serviceSlug claim" };
+        }
+        const serviceSlugOk = payload.serviceSlug === undefined || String(payload.serviceSlug).toLowerCase() === expected;
+        const audOk = payload.aud === undefined ||
+            (Array.isArray(payload.aud) ? payload.aud : [payload.aud]).some((a) => String(a).toLowerCase() === expected);
+        if (!serviceSlugOk || !audOk) {
+            return {
+                valid: false,
+                error: `JWT audience mismatch: expected ${expected}, got ${audiences.join(", ").toLowerCase()}`,
+            };
+        }
+        if (params.expectedIssuer && payload.iss !== params.expectedIssuer) {
+            return { valid: false, error: `JWT issuer mismatch: expected ${params.expectedIssuer}, got ${payload.iss ?? "(none)"}` };
         }
         return { valid: true, payload };
     }
@@ -294,6 +504,12 @@ export async function verifyJwtLease(params) {
  */
 export async function registerPublicKey(params) {
     const authUrl = (params.authUrl ?? "https://auth.daywalker.dev").replace(/\/+$/, "");
+    try {
+        assertSecureUrl("authUrl", authUrl);
+    }
+    catch (err) {
+        return { ok: false, status: 0, error: err.message };
+    }
     const registerUrl = `${authUrl}/api/v1/keys/register`;
     const doFetch = params.fetchFn ?? globalThis.fetch;
     if (!params.domain) {

package/dist/express.d.ts

@@ -20,6 +20,7 @@ interface Res {
  */
 export declare function daywalkerAuth(options?: {
     client?: Daywalker;
+    serviceSlug?: string;
 }): (req: Req, res: Res, next?: (err?: unknown) => void) => Promise<void>;
 export declare function daywalkerKeys(client?: Daywalker): (req: Req, res: Res, next?: () => void) => Promise<void>;
 export {};

package/dist/express.js

@@ -1,9 +1,11 @@
 import { daywalker } from "./client.js";
+import { toAuthFailureResponse } from "./middleware.js";
 /**
  * Express / Connect / Node http middleware that validates incoming Daywalker tokens.
  */
 export function daywalkerAuth(options = {}) {
     const client = options.client ?? daywalker;
+    const serviceSlug = options.serviceSlug;
     return async (req, res, next) => {
         const getHeader = (name) => {
             if (typeof req.get === "function")
@@ -33,19 +35,19 @@ export function daywalkerAuth(options = {}) {
             res.end(JSON.stringify({ error: "INVALID_TOKEN", message: "Missing Authorization header or x-api-token" }));
             return;
         }
-        const result = await client.validateToken(token);
+        const result = await client.validateToken(token, { serviceSlug });
         if (!result.ok) {
-            const status = result.status === 429 ? 429 : 401;
-            if (result.retryAfter) {
-                res.setHeader("Retry-After", String(result.retryAfter));
+            const { status, ...body } = toAuthFailureResponse(result);
+            if (body.retryAfter) {
+                res.setHeader("Retry-After", String(body.retryAfter));
             }
             if (typeof res.status === "function" && typeof res.json === "function") {
-                res.status(status).json({ error: result.error, message: result.message, retryAfter: result.retryAfter });
+                res.status(status).json(body);
                 return;
             }
             res.statusCode = status;
             res.setHeader("Content-Type", "application/json");
-            res.end(JSON.stringify({ error: result.error, message: result.message, retryAfter: result.retryAfter }));
+            res.end(JSON.stringify(body));
             return;
         }
         req.auth = result.data;