@travelclw/proof-protocol 0.1.1 → 0.1.2

package/README.md

@@ -49,11 +49,15 @@ const proofConfig = resolveProofServerConfig()
 
 环境变量中的非空值优先于调用方代码配置。缺少 TTL、时间窗口或 shadow 开关时使用协议默认值；显式配置非法值会直接报错，不会静默回退。
 
+`verifyRequestProof()` 只负责验签、请求绑定和时间计算，过期/未来时间通过 `timeWarning` 返回；是否在 `enforce` 模式拦截、如何在 `shadow` 模式审计，以及如何用 Redis `SET NX EX` 原子消费 `jti`，由服务端适配层负责。
+
 ## 安全边界
 
 - 不要把 `.env`、真实密钥、Token、Cookie、私钥或生产配置提交到源码或发布到 npm。
 - `AUTH_PROOF_DEVICE_SESSION_SECRET` 只用于服务端设备会话摘要，不得暴露给浏览器。
 - 浏览器 P-256 私钥由 WebCrypto 创建并以不可导出 `CryptoKey` 保存到 IndexedDB。
+- 同一浏览器应用的多个标签页共享同一个 IndexedDB 记录；`reset()` 会通过 `BroadcastChannel` 通知其它标签页清空内存中的进行中操作，并在每次读取/签名前重新核对 IndexedDB 当前 `kid`。不支持 `BroadcastChannel` 时仍以 IndexedDB 核对为准。
+- `proofKeyPromise` 只缓存进行中的密钥创建操作，不缓存已完成的密钥 Promise；标签页休眠或漏收广播时，下一次签名仍会从 IndexedDB 发现 Key 已轮换。
 - 包只提供协议能力；会话存储、Redis 原子操作、Guard 策略和业务路由由使用方负责。
 
 ## 发布内容

package/browser.js

@@ -60,6 +60,7 @@ const createBrowserProofClient = options => {
   const required = () => isRequestProofRequired(options?.required?.())
   let proofKeyPromise = null
   let resetPromise = null
+  let resetChannel = null
 
   if (!databaseName || !storeName || !recordId) {
     throw new Error('request_proof_storage_failed')
@@ -149,27 +150,65 @@ const createBrowserProofClient = options => {
     }
   }
 
+  const getResetChannelName = () =>
+    `@travelclw/proof-protocol/reset/${databaseName}/${storeName}/${recordId}`
+
+  const invalidateLocalKey = () => {
+    proofKeyPromise = null
+  }
+
+  if (typeof globalThis.BroadcastChannel === 'function') {
+    try {
+      resetChannel = new globalThis.BroadcastChannel(getResetChannelName())
+      resetChannel.onmessage = event => {
+        if (event?.data?.type === 'request-proof-reset') invalidateLocalKey()
+      }
+      if (typeof resetChannel.unref === 'function') resetChannel.unref()
+    } catch {
+      resetChannel = null
+    }
+  }
+
+  const broadcastReset = () => {
+    try {
+      resetChannel?.postMessage({ type: 'request-proof-reset' })
+    } catch {
+      // IndexedDB verification below remains authoritative when the channel is unavailable.
+    }
+  }
+
   const getOrCreateKey = () => {
     if (!proofKeyPromise) {
       const pendingReset = resetPromise
-      proofKeyPromise = (async () => {
+      const operation = (async () => {
         await pendingReset
         const storedKey = await readStoredKey()
         if (isStoredKeyValid(storedKey)) return storedKey
         return storeIfAbsent(await generateCandidate())
-      })().catch(error => {
-        proofKeyPromise = null
-        throw error
+      })()
+      const pendingKey = operation.finally(() => {
+        if (proofKeyPromise === pendingKey) proofKeyPromise = null
       })
+      proofKeyPromise = pendingKey
     }
     return proofKeyPromise
   }
 
+  const getCurrentKey = async () => {
+    while (true) {
+      const key = await getOrCreateKey()
+      const storedKey = await readStoredKey()
+      if (isStoredKeyValid(storedKey) && storedKey.keyId === key.keyId) return storedKey
+      invalidateLocalKey()
+    }
+  }
+
   const reset = () => {
     const pendingReset = resetPromise
     const operation = (async () => {
+      broadcastReset()
       const pendingKey = proofKeyPromise
-      proofKeyPromise = null
+      invalidateLocalKey()
       await pendingReset?.catch(() => undefined)
       await pendingKey?.catch(() => undefined)
       if (!globalThis.indexedDB) return
@@ -195,7 +234,7 @@ const createBrowserProofClient = options => {
   }
 
   const getRegistration = async () => {
-    const key = await getOrCreateKey()
+    const key = await getCurrentKey()
     return { keyId: key.keyId, publicKey: key.publicKey }
   }
 
@@ -217,13 +256,13 @@ const createBrowserProofClient = options => {
   const createProof = async input => {
     const token = String(input?.token || '').trim()
     if (!token) return ''
-    const key = await getOrCreateKey()
     const requestId = String(input?.requestId || '').trim()
     const [ath, qsh, bth] = await Promise.all([
       sha256Base64Url(token),
       sha256Base64Url(canonicalizeQuery(input?.requestUri)),
       sha256Base64Url(canonicalizeBody(input?.body, input?.contentType, input?.hasBody)),
     ])
+    const key = await getCurrentKey()
     const header = { alg: 'ES256', kid: key.keyId, typ: 'dpop+jwt' }
     const payload = {
       ath,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@travelclw/proof-protocol",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Framework-independent browser and Node.js request Proof protocol",
   "license": "MIT",
   "author": "travelclw",

package/server.js

@@ -54,8 +54,8 @@ const getRequestProofReasonText = reason =>
   REQUEST_PROOF_REASON_TEXT[String(reason || '')] || '未知请求 Proof 校验失败原因'
 
 const safeEqual = (left, right) => {
-  const leftBuffer = Buffer.from(left)
-  const rightBuffer = Buffer.from(right)
+  const leftBuffer = Buffer.from(String(left ?? ''))
+  const rightBuffer = Buffer.from(String(right ?? ''))
   return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer)
 }