@substrat-run/kernel 0.142.0 → 0.144.0

package/dist/connect-state.js

@@ -1,128 +0,0 @@
-/**
- * The signed state of a PLATFORM-MINTED provider consent round (connections.md §3.5.3).
- *
- * §3.5.1 settled how an OAuth connection is authorized: the act originates in-scope, a
- * signed state token carries the proof, and the host-side callback effects the write
- * stamped with the principal from that state. The dashboard's connect link is one
- * instance of it. This is the second: a tenant admin working inside a VERTICAL — a
- * bookkeeping bureau connecting a client company, with no dashboard account and no
- * reason to have one — presses Connect on the vertical's own screen, and the vertical's
- * operation is the permission-checked act.
- *
- * **Why an in-session claim carries no link row.** The dashboard's connect link is minted,
- * mailed, and clicked days later by someone else, so it is a row: single-use, revocable, and
- * dead when the minting admin loses access. A vertical-minted round is clicked in-session by
- * the person who just pressed the button, so the row would be state nobody reads. What
- * replaces it is the expiry — minutes, not a week — and the account leg of the connection
- * key: a replayed round re-consents the SAME company, which the store rotates in place
- * rather than duplicating (#1267). The consent code itself is single-use at the provider.
- * A vertical's MAILED link is the other case again, and carries a row: `linkId`, below.
- *
- * **Why the kernel.** Two workers hold the halves — the control plane mints (it owns the
- * directory the vertical is re-derived from), the dashboard verifies (it owns the one
- * `redirect_uri` registered with the provider) — and a MAC that two deployments must agree
- * on is exactly the thing that must not be written twice. It sits beside `platform-call.ts`
- * for the same reason that does: both answer "did this really come from the platform".
- *
- * Web Crypto only, so this file is testable in Node and runs unchanged in workerd.
- */
-/** Thrown when a claim cannot be minted — never when one fails to verify (that is `null`). */
-export class ConnectStateError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'ConnectStateError';
-    }
-}
-/**
- * The purpose label, and the `:v1` is the key-derivation version. Signing key is
- * HKDF(PLATFORM_SECRET, info = this), so a token minted here can never verify anywhere
- * else the platform secret is presented — `/internal/provision` and the two relays
- * compare the secret raw, and a MAC family shared with them would let a signature minted
- * for one be replayed as the other wherever the shapes overlap (the same trap #968 fixed
- * inside the dashboard).
- */
-export const CONNECT_STATE_PURPOSE = 'substrat-platform:connect-state:v1';
-const enc = (s) => new TextEncoder().encode(s);
-const b64url = (bytes) => {
-    let s = '';
-    for (const b of bytes)
-        s += String.fromCharCode(b);
-    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-};
-const b64urlToBytes = (s) => {
-    const padded = s.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (s.length % 4)) % 4);
-    const raw = atob(padded);
-    const out = new Uint8Array(raw.length);
-    for (let i = 0; i < raw.length; i++)
-        out[i] = raw.charCodeAt(i);
-    return out;
-};
-/** HKDF-SHA-256(ikm = the platform secret, info = the purpose) → an HMAC-SHA-256 key. */
-async function stateKey(platformSecret) {
-    const ikm = await crypto.subtle.importKey('raw', enc(platformSecret), 'HKDF', false, ['deriveKey']);
-    return crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt: enc('substrat-platform'), info: enc(CONNECT_STATE_PURPOSE) }, ikm, { name: 'HMAC', hash: 'SHA-256', length: 256 }, false, ['sign', 'verify']);
-}
-/**
- * `<base64url(JSON claim)>.<base64url(HMAC)>`.
- *
- * Refuses an unset secret rather than signing with `''` — the same law
- * `assertPlatformCall` states: an unset secret is a failure, not a bypass. A token
- * signed under the empty string would verify for anyone who guessed that it was.
- */
-export async function signConnectState(platformSecret, claim) {
-    if (!platformSecret) {
-        throw new ConnectStateError('cannot mint a connect state: PLATFORM_SECRET is unset on this deployment');
-    }
-    const body = b64url(enc(JSON.stringify(claim)));
-    const sig = new Uint8Array(await crypto.subtle.sign('HMAC', await stateKey(platformSecret), enc(body)));
-    return `${body}.${b64url(sig)}`;
-}
-/**
- * The claim if the signature verifies under this deployment's platform secret and `exp`
- * is still ahead of `now`; `null` for everything else — a forgery, a token minted with
- * the raw secret, an expired round, a malformed string. One `null` for every failure on
- * purpose: the caller renders one refusal, and a distinguishable error is an oracle.
- *
- * An unset secret verifies nothing (never throws): a deployment holding no platform
- * secret has no platform-minted rounds to accept.
- */
-export async function verifyConnectState(platformSecret, token, now) {
-    if (!platformSecret || !token)
-        return null;
-    const parts = token.split('.');
-    if (parts.length !== 2)
-        return null;
-    const [body, sig] = parts;
-    if (!body || !sig)
-        return null;
-    let ok = false;
-    try {
-        ok = await crypto.subtle.verify('HMAC', await stateKey(platformSecret), b64urlToBytes(sig), enc(body));
-    }
-    catch {
-        return null;
-    }
-    if (!ok)
-        return null;
-    try {
-        const claim = JSON.parse(new TextDecoder().decode(b64urlToBytes(body)));
-        if (typeof claim.exp !== 'number' || claim.exp <= now)
-            return null;
-        // A verified signature proves the platform minted it; it does not prove the shape,
-        // and a claim missing one of these would reach the store as `undefined` — which is
-        // how a credential lands under the wrong key rather than not at all.
-        for (const field of ['tenantId', 'scopeId', 'vertical', 'provider', 'principal']) {
-            if (typeof claim[field] !== 'string' || !claim[field])
-                return null;
-        }
-        // A link round with a malformed row reference would read as an in-session round — the
-        // one kind the callback spends nothing for — so it is refused, never downgraded.
-        if (claim.linkId !== undefined && (typeof claim.linkId !== 'string' || !claim.linkId))
-            return null;
-        return claim;
-    }
-    catch {
-        return null;
-    }
-}
-//# sourceMappingURL=connect-state.js.map

package/dist/connect-state.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-state.js","sourceRoot":"","sources":["../src/connect-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,8FAA8F;AAC9F,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AA6E1E,MAAM,GAAG,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAEnE,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,CAAS,EAAc,EAAE;IAC9C,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,yFAAyF;AACzF,KAAK,UAAU,QAAQ,CAAC,cAAsB;IAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,qBAAqB,CAAC,EAAE,EACnG,GAAG,EACH,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,cAAsB,EAAE,KAAwB;IACrF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CAAC,0EAA0E,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,cAAkC,EAClC,KAAa,EACb,GAAW;IAEX,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAsB,CAAC;QAC7F,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QACnE,mFAAmF;QACnF,mFAAmF;QACnF,qEAAqE;QACrE,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAU,EAAE,CAAC;YAC1F,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACrE,CAAC;QACD,sFAAsF;QACtF,iFAAiF;QACjF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACnG,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}