@suveren/gateway 0.9.0 → 0.10.0

package/lib/config.mjs

@@ -31,6 +31,8 @@ export function readConfig(dataDir) {
     const out = {};
     if (typeof data.asUrl === 'string') out.asUrl = data.asUrl;
     if (typeof data.caFile === 'string') out.caFile = data.caFile;
+    if (typeof data.pinTls === 'boolean') out.pinTls = data.pinTls;
+    if (typeof data.pinTlsExpectedFingerprint === 'string') out.pinTlsExpectedFingerprint = data.pinTlsExpectedFingerprint;
     return out;
   } catch {
     return {};
@@ -55,6 +57,8 @@ function readConfigStrict(dataDir) {
   const out = {};
   if (typeof data.asUrl === 'string') out.asUrl = data.asUrl;
   if (typeof data.caFile === 'string') out.caFile = data.caFile;
+  if (typeof data.pinTls === 'boolean') out.pinTls = data.pinTls;
+  if (typeof data.pinTlsExpectedFingerprint === 'string') out.pinTlsExpectedFingerprint = data.pinTlsExpectedFingerprint;
   return out;
 }
 
@@ -148,3 +152,47 @@ export function resolveAsUrl(dataDir) {
 export function resolveCaFile(dataDir) {
   return readConfig(dataDir).caFile;
 }
+
+/**
+ * Validate a candidate --pin-tls value against the EFFECTIVE Authority
+ * Server URL: TLS pinning on an http:// AS (only ever localhost/127.0.0.1 —
+ * see validateAsUrl) has nothing to pin, so enabling it there is refused
+ * rather than silently accepted and then doing nothing.
+ */
+export function validatePinTls(effectiveAsUrl) {
+  let parsed;
+  try {
+    parsed = new URL(effectiveAsUrl);
+  } catch {
+    return { ok: false, error: `"${effectiveAsUrl}" is not a valid URL.` };
+  }
+  if (parsed.protocol !== 'https:') {
+    return {
+      ok: false,
+      error: `--pin-tls requires an https:// Authority Server URL (currently "${effectiveAsUrl}") — there is no TLS certificate to pin.`,
+    };
+  }
+  return { ok: true };
+}
+
+/** The saved pin-tls setting. No env/flag tier — only ever set through
+ *  `--pin-tls` / `config set pin-tls on|off`. Default false: opt-in,
+ *  never silently on. */
+export function resolvePinTls(dataDir) {
+  return readConfig(dataDir).pinTls === true;
+}
+
+/**
+ * A fingerprint confirmed via `--expect-fingerprint` BEFORE any signing-key
+ * pairing exists yet (so there is no as-pairing.json to attach a TLS pin
+ * to — see as-pairing.mjs's `recordTlsPin`, which needs an existing record).
+ * Staged here until the first verified sign-in challenge: that challenge
+ * MUST match this value (enforced exactly like an already-stored pin — see
+ * the control plane's checkAsKeyBeforeLogin), and once it does, the value
+ * moves into as-pairing.json and this staging field is cleared. Absent in
+ * every other case — once a real pairing with a TLS pin exists, that record
+ * is authoritative and this is never consulted again.
+ */
+export function resolvePinTlsExpectedFingerprint(dataDir) {
+  return readConfig(dataDir).pinTlsExpectedFingerprint;
+}

package/node_modules/undici/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Matteo Collina and Undici contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.