@ultimat3/auth 1.2.0 → 3.0.0

package/src/index.ts

@@ -35,11 +35,13 @@ export type {
   AuthMfaPolicy,
   LoginInput,
   LoginResult,
+  OAuthLinkPolicy,
   RegisterInput,
 } from './auth';
 export {
   AccountSchema,
   authenticate,
+  DEFAULT_MFA_ISSUER,
   defineAuth,
   login,
   logout,
@@ -50,6 +52,11 @@ export {
 } from './auth';
 
 export { BuiltinAdapter } from './builtin-adapter';
+export type { AuthUserSummary } from './directory';
+export { describeUser, findUserByExternalId, listOrgUsers } from './directory';
+// The one normalisation an address gets before it is an identity key. Public because an app
+// writing its own `AuthAdapter`, or its own login route, has to key exactly the way this does.
+export { normaliseEmail } from './email';
 export type { AuthErrorCode, AuthThrowCode, OAuthExchangeFailure } from './errors';
 export {
   AUTH_BORROWED_ERROR_CODES,
@@ -58,22 +65,31 @@ export {
   AuthError,
   accountLocked,
   apiKeyInvalid,
+  authLimiterNotShared,
+  authLimiterPolicyMismatch,
   authNotImplemented,
   authWriteFailed,
   emailVerifiedNotStored,
   forbidden,
+  kdfOverloaded,
   mfaRequired,
+  mfaRequiredUnenforceable,
   oauthAccountNotLinked,
+  oauthDenied,
   oauthExchangeFailed,
+  oauthLinkingDisabled,
+  oauthProviderDuplicate,
+  oauthProviderUnknown,
   oauthStateInvalid,
   oauthTokenInvalid,
   passwordWeak,
+  restartAt,
   sessionExpired,
   sessionUnknown,
   unauthenticated,
 } from './errors';
 
-export { currentActor, requireActor, requireRole, requireScope } from './guards';
+export { currentActor, requireActor } from './guards';
 export type { IdTokenClaims, VerifyIdTokenInput } from './id-token';
 export {
   decodeIdToken,
@@ -81,10 +97,32 @@ export {
   idTokenEmailVerified,
   verifyIdToken,
 } from './id-token';
-
+export type {
+  IdTokenKeys,
+  JwksClientOptions,
+  JwksKeySource,
+  JwtAlgorithm,
+  JwtHeader,
+} from './jwks';
+export {
+  createJwksClient,
+  DEFAULT_JWKS_TTL_MS,
+  decodeJwtHeader,
+  providerJwks,
+  verifyJwtSignature,
+} from './jwks';
+export type { KdfGate, KdfLimits } from './kdf-gate';
+export {
+  configureKdfGate,
+  createKdfGate,
+  DEFAULT_KDF_LIMITS,
+  kdfGate,
+  resetKdfGate,
+} from './kdf-gate';
 export { MemoryAdapter } from './memory-adapter';
 export type {
   EnrolTotpInput,
+  MemoryTotpReplayGuard,
   RecoveryCodeSet,
   TotpEnrolment,
   TotpReplayGuard,
@@ -95,6 +133,7 @@ export {
   base32Decode,
   base32Encode,
   createTotpReplayGuard,
+  DEFAULT_MAX_TOTP_SUBJECTS,
   enrolTotp,
   generateRecoveryCodes,
   generateTotpSecret,
@@ -114,14 +153,14 @@ export type {
   OAuthProviderId,
   PkcePair,
 } from './oauth';
+export { assertOAuthCallback, beginOAuth, createPkce, pkceChallenge } from './oauth';
 export {
-  assertOAuthCallback,
-  beginOAuth,
-  createPkce,
-  OAUTH_PROVIDER_IDS,
-  OAUTH_PROVIDERS,
-  pkceChallenge,
-} from './oauth';
+  APPLE_PROVIDER,
+  BUILTIN_OAUTH_PROVIDER_IDS,
+  BUILTIN_OAUTH_PROVIDERS,
+  GITHUB_PROVIDER,
+  GOOGLE_PROVIDER,
+} from './oauth-builtins';
 export type { HandshakeCookieOptions, HandshakeSealOptions } from './oauth-cookie';
 export {
   clearHandshakeCookie,
@@ -134,6 +173,8 @@ export {
   readHandshakeCookie,
   sealHandshake,
 } from './oauth-cookie';
+export type { DiscoverOAuthProviderInput } from './oauth-discovery';
+export { discoverOAuthProvider, discoveryUrl } from './oauth-discovery';
 export type {
   OAuthClientCredentials,
   OAuthExchangeOptions,
@@ -141,10 +182,30 @@ export type {
   OAuthTokens,
 } from './oauth-exchange';
 export { exchangeOAuthCode, oauthCredentials } from './oauth-exchange';
-export type { CompleteOAuthLoginInput, OAuthSignInInput } from './oauth-login';
+export type {
+  CompleteOAuthLoginInput,
+  OAuthGrants,
+  OAuthSignInInput,
+  ResolveOAuthGrants,
+} from './oauth-login';
 export { completeOAuthLogin, signInWithOAuth } from './oauth-login';
+export {
+  OAUTH_BASE_PATH,
+  OAUTH_CALLBACK_ROUTE_PATH,
+  OAUTH_START_ROUTE_PATH,
+  oauthCallbackPath,
+  oauthStartPath,
+} from './oauth-paths';
 export type { OAuthProfile, OAuthProfileOptions } from './oauth-profile';
 export { oauthProfile } from './oauth-profile';
+export {
+  hasOAuthProvider,
+  oauthProviderIds,
+  providerFor,
+  registerOAuthProvider,
+} from './oauth-registry';
+export type { AuthRouteDescriptor, OAuthLoginOptions, OAuthLoginRoutes } from './oauth-route';
+export { OAUTH_ROUTE_STATUS, oauthLogin } from './oauth-route';
 export type {
   PasswordParams,
   PasswordPolicy,
@@ -173,14 +234,34 @@ export {
   actorFromUser,
   resolveActor,
 } from './policy-bridge';
-export type { AuthLimiter, AuthRateLimitPolicy } from './rate-limit';
+export type { UpdatePrivilegesResult } from './privileges';
+export { updatePrivileges } from './privileges';
+export type {
+  AuthLimiter,
+  AuthLimiterScope,
+  AuthRateLimitPolicy,
+  MemoryAuthLimiter,
+} from './rate-limit';
 export {
   accountKey,
+  assertAuthLimiterPolicy,
   createAuthLimiter,
   DEFAULT_AUTH_RATE_LIMIT,
+  DEFAULT_MAX_AUTH_LIMIT_KEYS,
   ipKey,
   loginFailed,
+  ORG_ATTEMPT_FACTOR,
+  orgKey,
+  orgRateLimit,
 } from './rate-limit';
+export type { DisabledUser } from './revocation';
+export {
+  disableUser,
+  enableUser,
+  revokeOrgSessions,
+  revokeSessionsCreatedBefore,
+  revokeUserSessions,
+} from './revocation';
 export type {
   CookieJar,
   CreateSessionInput,
@@ -196,6 +277,8 @@ export {
   clearSessionCookie,
   createSession,
   DEFAULT_SESSION_POLICY,
+  IDLE_SLIDE_DIVISOR,
+  idleSlideMs,
   listDevices,
   parseSessionToken,
   readCookie,
@@ -214,11 +297,18 @@ export {
   X_ACCOUNTS_TABLE,
   X_API_KEYS_TABLE,
   X_SESSIONS_TABLE,
+  X_USERS_MIGRATION_1_3,
   X_USERS_TABLE,
   X_VERIFICATIONS_TABLE,
 } from './tables';
-
-export { base64Url, matchesHash, randomToken, sha256Hex, timingSafeEqual } from './tokens';
+export {
+  base64Url,
+  base64UrlBytes,
+  matchesHash,
+  randomToken,
+  sha256Hex,
+  timingSafeEqual,
+} from './tokens';
 export type {
   ConsumeVerificationInput,
   IssuedVerification,
@@ -234,3 +324,9 @@ export {
   VERIFICATION_PURPOSES,
   VERIFICATION_TEMPLATES,
 } from './verify';
+export type {
+  VerifyWorkloadTokenInput,
+  WorkloadClaims,
+  WorkloadToken,
+} from './workload';
+export { verifyWorkloadToken } from './workload';

package/src/json.ts

@@ -0,0 +1,33 @@
+// Single responsibility: reading untrusted JSON — a provider's response body, or a JWT payload the
+// caller presented. Both questions were answered six and three times over in this package, and on a
+// JWT payload "is this an object" is what gates every claim read after it, so two copies quietly
+// disagreeing about (say) an array would be two different answers to a security question.
+
+import { base64UrlBytes } from './tokens';
+
+/**
+ * An ARRAY IS NOT A RECORD. That is the whole of the disagreement between the two variants of this
+ * predicate in the wild, and it matters here: `JSON.parse('[1,2]')` is an object with numeric keys,
+ * so without the array check a JWT payload of `[]` narrows to `Record<string, unknown>` and every
+ * `parsed['iss']` below it reads `undefined` from a shape no issuer ever sends.
+ */
+export const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value);
+
+/**
+ * A base64url JWT segment as a JSON object, or `null` for every way it can fail to be one: not
+ * base64url, not JSON, not an object. `null` rather than a throw because every caller is holding an
+ * attacker-supplied string and each has its own coded refusal to raise — the same reason
+ * `base64UrlBytes` and `readCookie` never throw.
+ */
+export function decodeJwtSegment(segment: string): Record<string, unknown> | null {
+  const bytes = base64UrlBytes(segment);
+  if (bytes === null) return null;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    return null;
+  }
+  return isRecord(parsed) ? parsed : null;
+}

package/src/jwks.ts

@@ -0,0 +1,246 @@
+// Single responsibility: verifying a JWT's signature against a provider's published JWKS.
+// `crypto.subtle` covers RS256 and ES256, so this costs no dependency. It exists because the OIDC
+// Core 3.1.3.7 exemption — "a token fetched over TLS straight from the token endpoint needs no
+// signature check" — holds for exactly one channel, and IdP-initiated login, `response_mode=
+// form_post`, back-channel logout and token exchange are all not it. On any of those, an
+// unverified JWT with the right `iss`, `aud` and a victim's `sub` is a full account takeover with
+// no credential, so a signature check has to exist before those doors are opened.
+
+import type { Clock } from '@ultimat3/core';
+import { systemClock } from '@ultimat3/core';
+import { oauthExchangeFailed, oauthTokenInvalid } from './errors';
+import { decodeJwtSegment, isRecord } from './json';
+import type { OAuthProvider } from './oauth';
+import type { OAuthFetch } from './oauth-exchange';
+import { base64UrlBytes } from './tokens';
+
+/**
+ * The two asymmetric algorithms every OP in practice signs with. `HS256` is deliberately absent
+ * and so is `none`: a symmetric algorithm verified against a *public* key set is the classic
+ * algorithm-confusion forgery, and refusing the header value is how it stays unreachable.
+ */
+export type JwtAlgorithm = 'RS256' | 'ES256';
+
+const SUPPORTED_ALGORITHMS: readonly string[] = ['RS256', 'ES256'];
+
+export interface JwtHeader {
+  readonly alg: JwtAlgorithm;
+  readonly kid: string | null;
+}
+
+/** What a signature check needs: one key, for one `kid`, for one algorithm. */
+export interface JwksKeySource {
+  keyFor(kid: string | null, alg: JwtAlgorithm): Promise<CryptoKey>;
+}
+
+/**
+ * How a caller declares where its trust comes from. `'token-endpoint-tls'` is the OIDC exemption,
+ * spelled out rather than defaulted: a call site that never names its channel is a call site that
+ * silently inherited "unverified" when somebody added a second way in.
+ */
+export type IdTokenKeys = 'token-endpoint-tls' | JwksKeySource;
+
+/** Short enough that a rotated key set is picked up on its own; a new `kid` refreshes early. */
+export const DEFAULT_JWKS_TTL_MS = 10 * 60 * 1000;
+
+const DEFAULT_TIMEOUT_MS = 10_000;
+
+export interface JwksClientOptions {
+  /** Named in every refusal this client throws. */
+  readonly provider: string;
+  readonly jwksUri: string;
+  /** Injected in tests; production uses the global. */
+  readonly fetch?: OAuthFetch | undefined;
+  /** No `Date.now()` in this package: the cache's age is measured against this. */
+  readonly clock?: Clock | undefined;
+  readonly ttlMs?: number | undefined;
+  readonly timeoutMs?: number | undefined;
+}
+
+const importParams = (alg: JwtAlgorithm): RsaHashedImportParams | EcKeyImportParams =>
+  alg === 'RS256'
+    ? { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }
+    : { name: 'ECDSA', namedCurve: 'P-256' };
+
+const verifyParams = (alg: JwtAlgorithm): AlgorithmIdentifier | EcdsaParams =>
+  alg === 'RS256' ? { name: 'RSASSA-PKCS1-v1_5' } : { name: 'ECDSA', hash: 'SHA-256' };
+
+/** A JWT header is attacker-supplied, so an unreadable one is `null` and never an exception. */
+export function decodeJwtHeader(segment: string): JwtHeader | null {
+  const parsed = decodeJwtSegment(segment);
+  if (parsed === null) return null;
+  const alg = parsed['alg'];
+  if (typeof alg !== 'string' || !SUPPORTED_ALGORITHMS.includes(alg)) return null;
+  const kid = parsed['kid'];
+  return { alg: alg as JwtAlgorithm, kid: typeof kid === 'string' && kid !== '' ? kid : null };
+}
+
+/** A key set entry the import understood. `kty` decides which algorithm it can ever verify. */
+const algorithmOf = (jwk: Record<string, unknown>): JwtAlgorithm | null => {
+  const alg = jwk['alg'];
+  if (alg === 'RS256' || alg === 'ES256') return alg;
+  if (jwk['kty'] === 'RSA') return 'RS256';
+  if (jwk['kty'] === 'EC' && jwk['crv'] === 'P-256') return 'ES256';
+  return null;
+};
+
+/**
+ * Caches by `kid` with a TTL, and refetches once when a token names a `kid` the cache has never
+ * seen — which is what makes a key rotation heal itself instead of failing every login until the
+ * TTL runs out. One refetch, not one per token: an unknown `kid` an attacker invents must not
+ * become an unbounded outbound request per attempt, so the refresh is rate-limited by the same
+ * TTL as the ordinary one.
+ */
+export function createJwksClient(options: JwksClientOptions): JwksKeySource {
+  const clock = options.clock ?? systemClock;
+  const ttlMs = options.ttlMs ?? DEFAULT_JWKS_TTL_MS;
+  let keys = new Map<string, CryptoKey>();
+  let fetchedAtMs = Number.NEGATIVE_INFINITY;
+  // When the last UNKNOWN-`kid` refresh ran, tracked apart from `fetchedAtMs` because that field
+  // is reset by every fetch, ordinary ones included — so gating the early refresh on it would let
+  // an attacker's own refresh authorise the next one.
+  let lastMissRefreshMs = Number.NEGATIVE_INFINITY;
+  let inflight: Promise<Map<string, CryptoKey>> | null = null;
+
+  const fetchKeys = async (): Promise<Map<string, CryptoKey>> => {
+    const doFetch: OAuthFetch = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+    let response: Response;
+    try {
+      response = await doFetch(options.jwksUri, {
+        method: 'GET',
+        headers: { Accept: 'application/json' },
+        signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+      });
+    } catch (error) {
+      throw oauthExchangeFailed({
+        provider: options.provider,
+        stage: 'jwks',
+        detail:
+          error instanceof Error ? error.message : 'the request failed before a response arrived',
+        fix: `curl -sS -m 5 ${options.jwksUri}`,
+      });
+    }
+    if (!response.ok) {
+      throw oauthExchangeFailed({
+        provider: options.provider,
+        stage: 'jwks',
+        detail: 'the key set could not be read, so no signature can be checked',
+        status: response.status,
+        fix: `curl -sS -m 5 ${options.jwksUri}`,
+      });
+    }
+    const body: unknown = await response.json().catch(() => undefined);
+    const entries = isRecord(body) && Array.isArray(body['keys']) ? body['keys'] : [];
+    const next = new Map<string, CryptoKey>();
+    for (const entry of entries) {
+      if (!isRecord(entry)) continue;
+      const alg = algorithmOf(entry);
+      const kid = entry['kid'];
+      if (alg === null || typeof kid !== 'string' || kid === '') continue;
+      // A key the runtime cannot import is skipped rather than fatal: one malformed entry in a
+      // published set must not take down every login the other keys would still have verified.
+      const key = await crypto.subtle
+        .importKey('jwk', entry as JsonWebKey, importParams(alg), false, ['verify'])
+        .catch(() => null);
+      if (key !== null) next.set(`${kid}:${alg}`, key);
+    }
+    keys = next;
+    fetchedAtMs = clock.now().getTime();
+    return next;
+  };
+
+  // One in-flight refresh shared by every concurrent caller: a cold cache under load is otherwise
+  // one outbound request per request in flight, against the IdP, at exactly the worst moment.
+  const load = async (): Promise<Map<string, CryptoKey>> => {
+    inflight ??= fetchKeys().finally(() => {
+      inflight = null;
+    });
+    return await inflight;
+  };
+
+  const lookup = (current: Map<string, CryptoKey>, kid: string | null, alg: JwtAlgorithm) => {
+    if (kid !== null) return current.get(`${kid}:${alg}`) ?? null;
+    // No `kid`: unambiguous only when the set holds exactly one key for this algorithm.
+    const matches = [...current.entries()].filter(([id]) => id.endsWith(`:${alg}`));
+    return matches.length === 1 ? (matches[0]?.[1] ?? null) : null;
+  };
+
+  return {
+    async keyFor(kid, alg) {
+      const nowMs = clock.now().getTime();
+      let current = keys;
+      const known = lookup(current, kid, alg) !== null;
+      const stale = nowMs >= fetchedAtMs + ttlMs;
+      // A `kid` is read out of the attacker-supplied JWT header BEFORE any signature check
+      // (`verifyJwtSignature`), and `hooks.authenticate` funnels a bearer token through it — so an
+      // unauthenticated caller picks this branch. Unrated, one forged token was one outbound
+      // request to the IdP, which then blocks this app's egress and takes every real login with
+      // it, on the IdP's unblock timeline rather than a restart; and the framework's own limiter
+      // cannot shed it, because `auth` is pipeline stage 6 and `rate-limit` is stage 7. So the
+      // early refresh is rate-limited by the same TTL as the ordinary one — which is what the
+      // docstring above always promised. Set BEFORE the await so concurrent callers that pass the
+      // gate together still coalesce into the one `inflight` fetch.
+      const earlyRefresh = !known && !stale && nowMs >= lastMissRefreshMs + ttlMs;
+      if (earlyRefresh) lastMissRefreshMs = nowMs;
+      if (stale || earlyRefresh) current = await load();
+      const key = lookup(current, kid, alg);
+      if (key === null) {
+        throw oauthTokenInvalid(
+          options.provider,
+          `no ${alg} key in the published set matches this token's kid`,
+          `curl -sS -m 5 ${options.jwksUri}   # then confirm the token was signed by this issuer`,
+        );
+      }
+      return key;
+    },
+  };
+}
+
+const clients = new Map<string, JwksKeySource>();
+
+/**
+ * The provider's own key set, built once per provider id. Memoised because the cache is the point:
+ * a client rebuilt per request refetches the key set per request.
+ */
+export function providerJwks(
+  provider: OAuthProvider,
+  options?: Omit<JwksClientOptions, 'provider' | 'jwksUri'>,
+): JwksKeySource {
+  if (provider.jwksUri === null) {
+    throw oauthTokenInvalid(
+      provider.id,
+      'this provider publishes no jwks_uri, so an id token from it can only be trusted on the token endpoint',
+      `register ${provider.id} with an explicit jwksUri, or read its id token only through exchangeOAuthCode()`,
+    );
+  }
+  const existing = clients.get(provider.id);
+  if (existing !== undefined) return existing;
+  const client = createJwksClient({ ...options, provider: provider.id, jwksUri: provider.jwksUri });
+  clients.set(provider.id, client);
+  return client;
+}
+
+/**
+ * `false` for every way a token can fail to be this key set's: a malformed header, an algorithm
+ * that is not one of the two asymmetric ones, an unreadable signature, a signature that does not
+ * verify. A missing key throws — that is a configuration answer, not a verdict on the token.
+ */
+export async function verifyJwtSignature(token: string, keys: JwksKeySource): Promise<boolean> {
+  const segments = token.split('.');
+  const [headerSegment, payloadSegment, signatureSegment] = segments;
+  if (
+    segments.length !== 3 ||
+    headerSegment === undefined ||
+    payloadSegment === undefined ||
+    signatureSegment === undefined
+  ) {
+    return false;
+  }
+  const header = decodeJwtHeader(headerSegment);
+  if (header === null) return false;
+  const signature = base64UrlBytes(signatureSegment);
+  if (signature === null || signature.length === 0) return false;
+  const key = await keys.keyFor(header.kid, header.alg);
+  const signed = new TextEncoder().encode(`${headerSegment}.${payloadSegment}`);
+  return await crypto.subtle.verify(verifyParams(header.alg), key, signature, signed);
+}

package/src/kdf-gate.ts

@@ -0,0 +1,86 @@
+// Single responsibility: bounding how many argon2 hashes this process runs at once.
+//
+// WHY it is not covered by the limiters that already exist: `rate-limit.ts`'s `ipKey(ip)` and
+// `@ultimat3/http`'s `auth` bucket are both keyed by SOURCE, so an attacker rotating an IPv6 /64
+// mints a fresh key per attempt and is never throttled by either; and both cap ATTEMPTS, while
+// what argon2id costs is MEMORY — 19 MiB per hash at the OWASP floor. The only remaining backstop
+// was `http.maxInflight` (1000), i.e. roughly 19 GB of arenas queued on one box.
+
+import { kdfOverloaded } from './errors';
+
+export interface KdfLimits {
+  /** Hashes running at once. Multiply by `memoryCost` for the resident ceiling this buys. */
+  readonly maxConcurrent: number;
+  /** Callers allowed to WAIT for a slot. Past this the answer is a refusal, not a longer queue. */
+  readonly maxQueued: number;
+}
+
+/**
+ * 8 x 19 MiB is ~152 MiB resident, which fits the smallest box anyone runs a web role on, and 64
+ * waiters is about two seconds of backlog at that width — long enough to absorb a burst of real
+ * logins, short enough that a spray is refused while the process is still answering.
+ */
+export const DEFAULT_KDF_LIMITS: KdfLimits = Object.freeze({ maxConcurrent: 8, maxQueued: 64 });
+
+export interface KdfGate {
+  run<T>(work: () => Promise<T>): Promise<T>;
+}
+
+/**
+ * A slot is HANDED OVER on release rather than released and re-acquired: decrementing first would
+ * let a caller arriving in the same tick past the ceiling while a waiter's continuation is still
+ * a queued microtask, which is how a "bounded" pool goes over its bound under exactly the load it
+ * exists for.
+ */
+export function createKdfGate(limits: KdfLimits = DEFAULT_KDF_LIMITS): KdfGate {
+  let active = 0;
+  const waiters: Array<() => void> = [];
+
+  const acquire = async (): Promise<void> => {
+    if (active < limits.maxConcurrent) {
+      active += 1;
+      return;
+    }
+    if (waiters.length >= limits.maxQueued) throw kdfOverloaded(active, waiters.length);
+    await new Promise<void>((resolve) => {
+      waiters.push(resolve);
+    });
+  };
+
+  const release = (): void => {
+    const next = waiters.shift();
+    if (next === undefined) active -= 1;
+    else next();
+  };
+
+  return {
+    async run<T>(work: () => Promise<T>): Promise<T> {
+      await acquire();
+      try {
+        return await work();
+      } finally {
+        release();
+      }
+    },
+  };
+}
+
+let gate = createKdfGate();
+
+/** The process-wide gate every `hashPassword`/`verifyPassword` passes through. */
+export const kdfGate = (): KdfGate => gate;
+
+/**
+ * The ONE install point, the same shape as `configureCursorSigning` in `@ultimat3/core`: a box
+ * with more memory may widen the ceiling, and a test needs a narrow one. Not a `defineAuth` key,
+ * because this is a property of the MACHINE, not of the app's auth policy — the same app config
+ * runs on a 512 MiB PaaS dyno and a 64 GiB node.
+ */
+export function configureKdfGate(limits: KdfLimits): void {
+  gate = createKdfGate(limits);
+}
+
+/** Back to the shipped defaults. Tests that call `configureKdfGate` must call this in cleanup. */
+export function resetKdfGate(): void {
+  gate = createKdfGate();
+}