@travelclw/proof-protocol 0.1.0 → 0.1.2

package/README.md

@@ -36,7 +36,6 @@ pnpm add jose@^5
 - `AUTH_PROOF_DEVICE_SESSION_SECRET`
 - `AUTH_PROOF_DEVICE_SESSION_TTL_SECONDS`
 - `AUTH_PROOF_TIME_TOLERANCE_SECONDS`
-- `AUTH_PROOF_SHADOW_BLOCK_MISSING_PROOF=0|1`
 
 服务端应在启动阶段调用 `resolveProofServerConfig()`：
 
@@ -50,11 +49,15 @@ const proofConfig = resolveProofServerConfig()
 
 环境变量中的非空值优先于调用方代码配置。缺少 TTL、时间窗口或 shadow 开关时使用协议默认值；显式配置非法值会直接报错，不会静默回退。
 
+`verifyRequestProof()` 只负责验签、请求绑定和时间计算，过期/未来时间通过 `timeWarning` 返回；是否在 `enforce` 模式拦截、如何在 `shadow` 模式审计，以及如何用 Redis `SET NX EX` 原子消费 `jti`，由服务端适配层负责。
+
 ## 安全边界
 
 - 不要把 `.env`、真实密钥、Token、Cookie、私钥或生产配置提交到源码或发布到 npm。
 - `AUTH_PROOF_DEVICE_SESSION_SECRET` 只用于服务端设备会话摘要，不得暴露给浏览器。
 - 浏览器 P-256 私钥由 WebCrypto 创建并以不可导出 `CryptoKey` 保存到 IndexedDB。
+- 同一浏览器应用的多个标签页共享同一个 IndexedDB 记录；`reset()` 会通过 `BroadcastChannel` 通知其它标签页清空内存中的进行中操作，并在每次读取/签名前重新核对 IndexedDB 当前 `kid`。不支持 `BroadcastChannel` 时仍以 IndexedDB 核对为准。
+- `proofKeyPromise` 只缓存进行中的密钥创建操作，不缓存已完成的密钥 Promise；标签页休眠或漏收广播时，下一次签名仍会从 IndexedDB 发现 Key 已轮换。
 - 包只提供协议能力；会话存储、Redis 原子操作、Guard 策略和业务路由由使用方负责。
 
 ## 发布内容

package/browser.js

@@ -59,6 +59,8 @@ const createBrowserProofClient = options => {
   const recordId = String(options?.recordId || 'request-proof-key').trim()
   const required = () => isRequestProofRequired(options?.required?.())
   let proofKeyPromise = null
+  let resetPromise = null
+  let resetChannel = null
 
   if (!databaseName || !storeName || !recordId) {
     throw new Error('request_proof_storage_failed')
@@ -148,42 +150,91 @@ const createBrowserProofClient = options => {
     }
   }
 
+  const getResetChannelName = () =>
+    `@travelclw/proof-protocol/reset/${databaseName}/${storeName}/${recordId}`
+
+  const invalidateLocalKey = () => {
+    proofKeyPromise = null
+  }
+
+  if (typeof globalThis.BroadcastChannel === 'function') {
+    try {
+      resetChannel = new globalThis.BroadcastChannel(getResetChannelName())
+      resetChannel.onmessage = event => {
+        if (event?.data?.type === 'request-proof-reset') invalidateLocalKey()
+      }
+      if (typeof resetChannel.unref === 'function') resetChannel.unref()
+    } catch {
+      resetChannel = null
+    }
+  }
+
+  const broadcastReset = () => {
+    try {
+      resetChannel?.postMessage({ type: 'request-proof-reset' })
+    } catch {
+      // IndexedDB verification below remains authoritative when the channel is unavailable.
+    }
+  }
+
   const getOrCreateKey = () => {
     if (!proofKeyPromise) {
-      proofKeyPromise = (async () => {
+      const pendingReset = resetPromise
+      const operation = (async () => {
+        await pendingReset
         const storedKey = await readStoredKey()
         if (isStoredKeyValid(storedKey)) return storedKey
         return storeIfAbsent(await generateCandidate())
-      })().catch(error => {
-        proofKeyPromise = null
-        throw error
+      })()
+      const pendingKey = operation.finally(() => {
+        if (proofKeyPromise === pendingKey) proofKeyPromise = null
       })
+      proofKeyPromise = pendingKey
     }
     return proofKeyPromise
   }
 
-  const reset = async () => {
-    const pendingKey = proofKeyPromise
-    proofKeyPromise = null
-    await pendingKey?.catch(() => undefined)
-    if (!globalThis.indexedDB) return
-
-    const database = await openDatabase()
-    try {
-      await new Promise((resolve, reject) => {
-        const transaction = database.transaction(storeName, 'readwrite')
-        transaction.objectStore(storeName).delete(recordId)
-        transaction.oncomplete = () => resolve()
-        transaction.onerror = () => reject(new Error('request_proof_reset_failed'))
-        transaction.onabort = () => reject(new Error('request_proof_reset_failed'))
-      })
-    } finally {
-      database.close()
+  const getCurrentKey = async () => {
+    while (true) {
+      const key = await getOrCreateKey()
+      const storedKey = await readStoredKey()
+      if (isStoredKeyValid(storedKey) && storedKey.keyId === key.keyId) return storedKey
+      invalidateLocalKey()
     }
   }
 
+  const reset = () => {
+    const pendingReset = resetPromise
+    const operation = (async () => {
+      broadcastReset()
+      const pendingKey = proofKeyPromise
+      invalidateLocalKey()
+      await pendingReset?.catch(() => undefined)
+      await pendingKey?.catch(() => undefined)
+      if (!globalThis.indexedDB) return
+
+      const database = await openDatabase()
+      try {
+        await new Promise((resolve, reject) => {
+          const transaction = database.transaction(storeName, 'readwrite')
+          transaction.objectStore(storeName).delete(recordId)
+          transaction.oncomplete = () => resolve()
+          transaction.onerror = () => reject(new Error('request_proof_reset_failed'))
+          transaction.onabort = () => reject(new Error('request_proof_reset_failed'))
+        })
+      } finally {
+        database.close()
+      }
+    })()
+
+    resetPromise = operation
+    return operation.finally(() => {
+      if (resetPromise === operation) resetPromise = null
+    })
+  }
+
   const getRegistration = async () => {
-    const key = await getOrCreateKey()
+    const key = await getCurrentKey()
     return { keyId: key.keyId, publicKey: key.publicKey }
   }
 
@@ -205,13 +256,13 @@ const createBrowserProofClient = options => {
   const createProof = async input => {
     const token = String(input?.token || '').trim()
     if (!token) return ''
-    const key = await getOrCreateKey()
     const requestId = String(input?.requestId || '').trim()
     const [ath, qsh, bth] = await Promise.all([
       sha256Base64Url(token),
       sha256Base64Url(canonicalizeQuery(input?.requestUri)),
       sha256Base64Url(canonicalizeBody(input?.body, input?.contentType, input?.hasBody)),
     ])
+    const key = await getCurrentKey()
     const header = { alg: 'ES256', kid: key.keyId, typ: 'dpop+jwt' }
     const payload = {
       ath,

package/node.d.ts

@@ -41,7 +41,6 @@ export type ProofServerConfig = {
   deviceSessionSecret: string
   deviceSessionTtlSeconds: number
   timeToleranceSeconds: number
-  shadowBlockMissingProof: boolean
 }
 
 export const REQUEST_PROOF_REASON_TEXT: Readonly<Record<string, string>>
@@ -72,7 +71,6 @@ export function resolveProofServerConfig(options?: {
   deviceSessionSecret?: string
   deviceSessionTtlSeconds?: number
   timeToleranceSeconds?: number
-  shadowBlockMissingProof?: boolean
 }): ProofServerConfig
 
 export { RequestProofValidationError } from './core'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@travelclw/proof-protocol",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Framework-independent browser and Node.js request Proof protocol",
   "license": "MIT",
   "author": "travelclw",

package/server.js

@@ -54,8 +54,8 @@ const getRequestProofReasonText = reason =>
   REQUEST_PROOF_REASON_TEXT[String(reason || '')] || '未知请求 Proof 校验失败原因'
 
 const safeEqual = (left, right) => {
-  const leftBuffer = Buffer.from(left)
-  const rightBuffer = Buffer.from(right)
+  const leftBuffer = Buffer.from(String(left ?? ''))
+  const rightBuffer = Buffer.from(String(right ?? ''))
   return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer)
 }
 
@@ -238,15 +238,6 @@ const integerSetting = (value, fallback, name, minimum, maximum) => {
   return parsed
 }
 
-const booleanSetting = (value, fallback, name) => {
-  if (value === undefined || String(value).trim() === '') return fallback
-  const normalized = String(value).trim()
-  if (normalized !== '0' && normalized !== '1') {
-    throw new Error(`${name} must be 0 or 1`)
-  }
-  return normalized === '1'
-}
-
 const resolveProofServerConfig = options => {
   const env = options?.env ?? (typeof process !== 'undefined' ? process.env : {})
   const mode = normalizeProofMode(readOverride(env, 'AUTH_PROOF_MODE', options?.mode))
@@ -270,16 +261,6 @@ const resolveProofServerConfig = options => {
     30,
     DEFAULT_REQUEST_PROOF_TIME_TOLERANCE_SECONDS,
   )
-  const shadowBlockMissingProof = booleanSetting(
-    readOverride(
-      env,
-      'AUTH_PROOF_SHADOW_BLOCK_MISSING_PROOF',
-      options?.shadowBlockMissingProof ? '1' : '0',
-    ),
-    false,
-    'AUTH_PROOF_SHADOW_BLOCK_MISSING_PROOF',
-  )
-
   if (mode !== 'off' && deviceSessionSecret.length < 32) {
     throw new Error(
       'AUTH_PROOF_DEVICE_SESSION_SECRET is required when AUTH_PROOF_MODE is shadow or enforce and must contain at least 32 characters',
@@ -290,7 +271,6 @@ const resolveProofServerConfig = options => {
     deviceSessionSecret,
     deviceSessionTtlSeconds,
     timeToleranceSeconds,
-    shadowBlockMissingProof,
   }
 }