@valbuild/next 0.119.0 → 0.120.2

package/server/dist/valbuild-next-server.esm.js

@@ -150,6 +150,10 @@ function initValServer(valModules, config, nextConfig) {
  * - **Nothing is read from the payload before the signature verifies.** Claims
  *   from an unverified token are attacker input.
  * - **Keys come only from the configured issuer's JWKS**, never from the token.
+ *   The key set is cached, but a token naming a `kid` the cache does not hold
+ *   provokes one rate-limited refetch rather than a refusal — see
+ *   {@link UNKNOWN_KID_REFETCH_INTERVAL_MS}. Without that, this server's own
+ *   cache turns any key rotation into an outage lasting the rest of the TTL.
  * - **ECDSA JWS signatures are raw `r||s`** (RFC 7518), not DER, which is what
  *   `dsaEncoding: "ieee-p1363"` below is for. Omit it and every valid signature
  *   is rejected — or worse, a future change makes it accept the wrong thing.
@@ -166,6 +170,21 @@ var JWKS_TTL_MS = 5 * 60 * 1000;
  * it.
  */
 var JWKS_ERROR_TTL_MS = 30 * 1000;
+/**
+ * The floor between two refetches provoked by an unknown `kid`.
+ *
+ * A token naming a key this process has not seen is the one case where the TTL
+ * is the wrong answer: the issuer may have just rotated, and refusing for the
+ * rest of the five minutes turns a rotation into an outage. So an unknown `kid`
+ * bypasses the TTL — but only this often, because the `kid` comes from the
+ * token and the token comes from whoever is calling. Without a floor, a stream
+ * of random `kid`s would be a way to make this server hammer its own issuer.
+ *
+ * Note what the floor costs when it bites: a refusal, for a token that would
+ * have verified, for at most this long. That is the same failure the TTL used
+ * to guarantee for five minutes, so the trade only ever improves.
+ */
+var UNKNOWN_KID_REFETCH_INTERVAL_MS = 30 * 1000;
 /**
  * One cache per issuer, and it has to outlive the request or it is not a cache:
  * a fetch per tool call would put a network round trip in front of every read.
@@ -173,6 +192,15 @@ var JWKS_ERROR_TTL_MS = 30 * 1000;
 var jwksCache = new Map();
 /** Concurrent misses share one fetch rather than starting several. */
 var inFlight = new Map();
+/**
+ * When an unknown `kid` last made us go back to the issuer, per issuer.
+ *
+ * Separate from the cache because it is a rate limit rather than a cache: it
+ * records an *attempt*, so a refetch that found nothing new still spends the
+ * window. Keyed by issuer, not by `kid`, or an attacker would simply use a new
+ * one each time.
+ */
+var unknownKidRefetchAtMs = new Map();
 function jwksUrl(issuer) {
   // Not discovered from the issuer's metadata document, deliberately:
   // discovery would mean one more request on the hot path and one more thing
@@ -183,105 +211,211 @@ function jwksUrl(issuer) {
 function loadJwks(_x, _x2) {
   return _loadJwks.apply(this, arguments);
 }
+/**
+ * Go back to the issuer because the token named a key we do not have.
+ *
+ * Rate-limited, and the limit is the whole reason this is not just a call to
+ * {@link fetchJwks}: the `kid` that triggers it is attacker-controlled. Returns
+ * `null` when the window has not elapsed, which the caller reads as "nothing
+ * new to try" rather than as a failure.
+ *
+ * The limit is on *starting* a fetch, not on benefiting from one. A fetch
+ * already in flight is joined whatever the window says, because joining it
+ * costs the issuer nothing — and the case that matters is precisely a burst:
+ * at a rotation, many requests arrive at once carrying the same new `kid`, and
+ * refusing all but the first would be the outage this whole path exists to
+ * prevent, merely shortened from five minutes to thirty seconds.
+ *
+ * Only ever called with a successfully-fetched key set in hand. An error entry
+ * has its own, shorter TTL and its own recovery, and letting an unknown `kid`
+ * shortcut it would hand an unreachable issuer a retry storm.
+ */
 function _loadJwks() {
-  _loadJwks = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(config, nowMs) {
-    var _config$fetchImpl;
-    var url, cached, age, ttl, existing, fetchImpl, pending, entry;
-    return _regenerator().w(function (_context2) {
-      while (1) switch (_context2.p = _context2.n) {
+  _loadJwks = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(config, nowMs) {
+    var url, cached, age, ttl, _t;
+    return _regenerator().w(function (_context) {
+      while (1) switch (_context.n) {
         case 0:
           url = jwksUrl(config.issuer);
           cached = jwksCache.get(url);
           if (!cached) {
-            _context2.n = 1;
+            _context.n = 1;
             break;
           }
           age = cached.status === "keys" ? nowMs - cached.fetchedAtMs : nowMs - cached.failedAtMs;
           ttl = cached.status === "keys" ? JWKS_TTL_MS : JWKS_ERROR_TTL_MS;
           if (!(age < ttl)) {
-            _context2.n = 1;
+            _context.n = 1;
             break;
           }
-          return _context2.a(2, cached);
+          return _context.a(2, {
+            entry: cached,
+            fromCache: true
+          });
         case 1:
+          _context.n = 2;
+          return fetchJwks(config, nowMs);
+        case 2:
+          _t = _context.v;
+          return _context.a(2, {
+            entry: _t,
+            fromCache: false
+          });
+      }
+    }, _callee);
+  }));
+  return _loadJwks.apply(this, arguments);
+}
+function refetchForUnknownKid(_x3, _x4) {
+  return _refetchForUnknownKid.apply(this, arguments);
+}
+/**
+ * Fetch the key set, ignoring whatever is cached, and cache the result.
+ *
+ * Shares {@link inFlight} with every other caller, so a forced refetch that
+ * lands during an ordinary miss joins it rather than opening a second request.
+ * Only the caller that *starts* a fetch writes the cache — a joiner returns the
+ * shared promise above — so `keepCacheOnError` is a property of the fetch, not a
+ * race between callers.
+ */
+function _refetchForUnknownKid() {
+  _refetchForUnknownKid = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(config, nowMs) {
+    var url, existing, lastAttemptMs;
+    return _regenerator().w(function (_context2) {
+      while (1) switch (_context2.n) {
+        case 0:
+          url = jwksUrl(config.issuer);
           existing = inFlight.get(url);
           if (!existing) {
-            _context2.n = 2;
+            _context2.n = 1;
             break;
           }
           return _context2.a(2, existing);
+        case 1:
+          lastAttemptMs = unknownKidRefetchAtMs.get(url);
+          if (!(lastAttemptMs !== undefined && nowMs - lastAttemptMs < UNKNOWN_KID_REFETCH_INTERVAL_MS)) {
+            _context2.n = 2;
+            break;
+          }
+          return _context2.a(2, null);
         case 2:
+          // Recorded before the await, so that once this fetch has finished the window
+          // is already closed against the next unknown `kid`.
+          unknownKidRefetchAtMs.set(url, nowMs);
+          return _context2.a(2, fetchJwks(config, nowMs, {
+            keepCacheOnError: true
+          }));
+      }
+    }, _callee2);
+  }));
+  return _refetchForUnknownKid.apply(this, arguments);
+}
+function fetchJwks(_x5, _x6) {
+  return _fetchJwks.apply(this, arguments);
+}
+function _fetchJwks() {
+  _fetchJwks = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(config, nowMs) {
+    var _config$fetchImpl;
+    var _ref,
+      _ref$keepCacheOnError,
+      keepCacheOnError,
+      url,
+      existing,
+      fetchImpl,
+      pending,
+      entry,
+      cached,
+      _args4 = arguments;
+    return _regenerator().w(function (_context4) {
+      while (1) switch (_context4.p = _context4.n) {
+        case 0:
+          _ref = _args4.length > 2 && _args4[2] !== undefined ? _args4[2] : {}, _ref$keepCacheOnError = _ref.keepCacheOnError, keepCacheOnError = _ref$keepCacheOnError === void 0 ? false : _ref$keepCacheOnError;
+          url = jwksUrl(config.issuer);
+          existing = inFlight.get(url);
+          if (!existing) {
+            _context4.n = 1;
+            break;
+          }
+          return _context4.a(2, existing);
+        case 1:
           fetchImpl = (_config$fetchImpl = config.fetchImpl) !== null && _config$fetchImpl !== void 0 ? _config$fetchImpl : fetch;
-          pending = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee() {
+          pending = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3() {
             var res, body, keys;
-            return _regenerator().w(function (_context) {
-              while (1) switch (_context.p = _context.n) {
+            return _regenerator().w(function (_context3) {
+              while (1) switch (_context3.p = _context3.n) {
                 case 0:
-                  _context.p = 0;
-                  _context.n = 1;
+                  _context3.p = 0;
+                  _context3.n = 1;
                   return fetchImpl(url, {
                     headers: {
                       accept: "application/json"
                     }
                   });
                 case 1:
-                  res = _context.v;
+                  res = _context3.v;
                   if (res.ok) {
-                    _context.n = 2;
+                    _context3.n = 2;
                     break;
                   }
-                  return _context.a(2, {
+                  return _context3.a(2, {
                     status: "error",
                     failedAtMs: nowMs
                   });
                 case 2:
-                  _context.n = 3;
+                  _context3.n = 3;
                   return res.json();
                 case 3:
-                  body = _context.v;
+                  body = _context3.v;
                   keys = readKeys(body);
                   if (!(keys === null)) {
-                    _context.n = 4;
+                    _context3.n = 4;
                     break;
                   }
-                  return _context.a(2, {
+                  return _context3.a(2, {
                     status: "error",
                     failedAtMs: nowMs
                   });
                 case 4:
-                  return _context.a(2, {
+                  return _context3.a(2, {
                     status: "keys",
                     keys: keys,
                     fetchedAtMs: nowMs
                   });
                 case 5:
-                  _context.p = 5;
-                  _context.v;
-                  return _context.a(2, {
+                  _context3.p = 5;
+                  _context3.v;
+                  return _context3.a(2, {
                     status: "error",
                     failedAtMs: nowMs
                   });
               }
-            }, _callee, null, [[0, 5]]);
+            }, _callee3, null, [[0, 5]]);
           }))();
           inFlight.set(url, pending);
-          _context2.p = 3;
-          _context2.n = 4;
+          _context4.p = 2;
+          _context4.n = 3;
           return pending;
+        case 3:
+          entry = _context4.v;
+          cached = jwksCache.get(url);
+          if (!(entry.status === "error" && keepCacheOnError && (cached === null || cached === void 0 ? void 0 : cached.status) === "keys")) {
+            _context4.n = 4;
+            break;
+          }
+          return _context4.a(2, entry);
         case 4:
-          entry = _context2.v;
           jwksCache.set(url, entry);
-          return _context2.a(2, entry);
+          return _context4.a(2, entry);
         case 5:
-          _context2.p = 5;
+          _context4.p = 5;
           inFlight["delete"](url);
-          return _context2.f(5);
+          return _context4.f(5);
         case 6:
-          return _context2.a(2);
+          return _context4.a(2);
       }
-    }, _callee2, null, [[3,, 5, 6]]);
+    }, _callee4, null, [[2,, 5, 6]]);
   }));
-  return _loadJwks.apply(this, arguments);
+  return _fetchJwks.apply(this, arguments);
 }
 function readKeys(body) {
   if (_typeof(body) !== "object" || body === null || !("keys" in body)) {
@@ -316,22 +450,22 @@ function readBearerToken(request) {
   var token = match === null || match === void 0 || (_match$ = match[1]) === null || _match$ === void 0 ? void 0 : _match$.trim();
   return token ? token : null;
 }
-function verifyValAccessToken(_x3, _x4) {
+function verifyValAccessToken(_x7, _x8) {
   return _verifyValAccessToken.apply(this, arguments);
 }
 function _verifyValAccessToken() {
-  _verifyValAccessToken = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(request, config) {
+  _verifyValAccessToken = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee5(request, config) {
     var _config$clockToleranc;
-    var token, parts, _parts, encodedHeader, encodedPayload, encodedSignature, header, kid, nowMs, jwks, candidates, signature, signedData, verified, payload, tolerance, nowSeconds, subject, scopes;
-    return _regenerator().w(function (_context3) {
-      while (1) switch (_context3.n) {
+    var token, parts, _parts, encodedHeader, encodedPayload, encodedSignature, header, kid, nowMs, loaded, candidates, refetched, signature, signedData, verified, payload, tolerance, nowSeconds, subject, scopes;
+    return _regenerator().w(function (_context5) {
+      while (1) switch (_context5.n) {
         case 0:
           token = readBearerToken(request);
           if (!(token === null)) {
-            _context3.n = 1;
+            _context5.n = 1;
             break;
           }
-          return _context3.a(2, {
+          return _context5.a(2, {
             status: "refused",
             error: "invalid_request",
             description: "This Val MCP endpoint needs an access token. Authorize with the Val authorization server and present it as `Authorization: Bearer`."
@@ -339,125 +473,148 @@ function _verifyValAccessToken() {
         case 1:
           parts = token.split(".");
           if (!(parts.length !== 3)) {
-            _context3.n = 2;
+            _context5.n = 2;
             break;
           }
-          return _context3.a(2, invalidToken("The access token is not a JWS."));
+          return _context5.a(2, invalidToken("The access token is not a JWS."));
         case 2:
           _parts = _slicedToArray(parts, 3), encodedHeader = _parts[0], encodedPayload = _parts[1], encodedSignature = _parts[2];
           header = decodeJsonSegment(encodedHeader);
           if (!(header === null)) {
-            _context3.n = 3;
+            _context5.n = 3;
             break;
           }
-          return _context3.a(2, invalidToken("The access token's header could not be read."));
+          return _context5.a(2, invalidToken("The access token's header could not be read."));
         case 3:
           if (!(header.alg !== "ES256")) {
-            _context3.n = 4;
+            _context5.n = 4;
             break;
           }
-          return _context3.a(2, invalidToken("The access token is not signed with ES256, which is the only algorithm this server accepts."));
+          return _context5.a(2, invalidToken("The access token is not signed with ES256, which is the only algorithm this server accepts."));
         case 4:
           kid = typeof header.kid === "string" ? header.kid : null;
           nowMs = Date.now();
-          _context3.n = 5;
+          _context5.n = 5;
           return loadJwks(config, nowMs);
         case 5:
-          jwks = _context3.v;
-          if (!(jwks.status === "error")) {
-            _context3.n = 6;
+          loaded = _context5.v;
+          if (!(loaded.entry.status === "error")) {
+            _context5.n = 6;
             break;
           }
-          return _context3.a(2, invalidToken("The access token could not be verified because the Val authorization server's keys could not be fetched. This may be temporary."));
+          return _context5.a(2, invalidToken("The access token could not be verified because the Val authorization server's keys could not be fetched. This may be temporary."));
         case 6:
-          candidates = jwks.keys.filter(function (key) {
+          candidates = loaded.entry.keys.filter(function (key) {
             return isVerifyingP256Key(key, kid);
           });
-          if (!(candidates.length === 0)) {
-            _context3.n = 7;
+          if (!(candidates.length === 0 && kid !== null && loaded.fromCache)) {
+            _context5.n = 9;
             break;
           }
-          return _context3.a(2, invalidToken("The access token was signed with a key the Val authorization server does not publish."));
+          _context5.n = 7;
+          return refetchForUnknownKid(config, nowMs);
         case 7:
+          refetched = _context5.v;
+          if (!(refetched !== null)) {
+            _context5.n = 9;
+            break;
+          }
+          if (!(refetched.status === "error")) {
+            _context5.n = 8;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token could not be verified because the Val authorization server's keys could not be fetched. This may be temporary."));
+        case 8:
+          candidates = refetched.keys.filter(function (key) {
+            return isVerifyingP256Key(key, kid);
+          });
+        case 9:
+          if (!(candidates.length === 0)) {
+            _context5.n = 10;
+            break;
+          }
+          return _context5.a(2, invalidToken("The access token was signed with a key the Val authorization server does not publish."));
+        case 10:
           signature = decodeBase64Url(encodedSignature);
           if (!(signature === null)) {
-            _context3.n = 8;
+            _context5.n = 11;
             break;
           }
-          return _context3.a(2, invalidToken("The access token's signature could not be read."));
-        case 8:
+          return _context5.a(2, invalidToken("The access token's signature could not be read."));
+        case 11:
           signedData = Buffer.from("".concat(encodedHeader, ".").concat(encodedPayload), "ascii"); // Every published key is tried when the token names no `kid`, so a rotation
           // that has not yet propagated to clients still verifies. With a `kid` the
-          // filter above leaves one.
+          // filter above leaves one — or, if this process had not yet seen that key,
+          // the one the refetch just found.
           verified = candidates.some(function (key) {
             return verifyWithJwk(key, signedData, signature);
           });
           if (verified) {
-            _context3.n = 9;
+            _context5.n = 12;
             break;
           }
-          return _context3.a(2, invalidToken("The access token's signature could not be verified."));
-        case 9:
+          return _context5.a(2, invalidToken("The access token's signature could not be verified."));
+        case 12:
           // Only now: everything below reads the payload, and before this line it was
           // attacker input.
           payload = decodeJsonSegment(encodedPayload);
           if (!(payload === null)) {
-            _context3.n = 10;
+            _context5.n = 13;
             break;
           }
-          return _context3.a(2, invalidToken("The access token's payload could not be read."));
-        case 10:
+          return _context5.a(2, invalidToken("The access token's payload could not be read."));
+        case 13:
           tolerance = (_config$clockToleranc = config.clockToleranceSeconds) !== null && _config$clockToleranc !== void 0 ? _config$clockToleranc : DEFAULT_CLOCK_TOLERANCE_SECONDS;
           nowSeconds = Math.floor(nowMs / 1000);
           if (!(typeof payload.exp !== "number")) {
-            _context3.n = 11;
+            _context5.n = 14;
             break;
           }
-          return _context3.a(2, invalidToken("The access token has no expiry."));
-        case 11:
+          return _context5.a(2, invalidToken("The access token has no expiry."));
+        case 14:
           if (!(payload.exp + tolerance <= nowSeconds)) {
-            _context3.n = 12;
+            _context5.n = 15;
             break;
           }
-          return _context3.a(2, invalidToken("The access token has expired. Refresh it and try again."));
-        case 12:
+          return _context5.a(2, invalidToken("The access token has expired. Refresh it and try again."));
+        case 15:
           if (!(typeof payload.nbf === "number" && payload.nbf - tolerance > nowSeconds)) {
-            _context3.n = 13;
+            _context5.n = 16;
             break;
           }
-          return _context3.a(2, invalidToken("The access token is not valid yet."));
-        case 13:
+          return _context5.a(2, invalidToken("The access token is not valid yet."));
+        case 16:
           if (!(payload.iss !== config.issuer)) {
-            _context3.n = 14;
+            _context5.n = 17;
             break;
           }
-          return _context3.a(2, invalidToken("The access token was not issued by this server's authorization server (iss claim)."));
-        case 14:
+          return _context5.a(2, invalidToken("The access token was not issued by this server's authorization server (iss claim)."));
+        case 17:
           if (audienceMatches(payload.aud, config.resource)) {
-            _context3.n = 15;
+            _context5.n = 18;
             break;
           }
-          return _context3.a(2, invalidToken("The access token is not valid for this server (aud claim)."));
-        case 15:
+          return _context5.a(2, invalidToken("The access token is not valid for this server (aud claim)."));
+        case 18:
           subject = payload.sub;
           if (!(typeof subject !== "string" || subject.length === 0)) {
-            _context3.n = 16;
+            _context5.n = 19;
             break;
           }
-          return _context3.a(2, invalidToken("The access token has no subject."));
-        case 16:
+          return _context5.a(2, invalidToken("The access token has no subject."));
+        case 19:
           scopes = readScopes(payload.scope);
           if (scopes.includes(VAL_SCOPE_READ)) {
-            _context3.n = 17;
+            _context5.n = 20;
             break;
           }
-          return _context3.a(2, {
+          return _context5.a(2, {
             status: "refused",
             error: "insufficient_scope",
             description: "The access token does not have the ".concat(VAL_SCOPE_READ, " scope, so it cannot read any content.")
           });
-        case 17:
-          return _context3.a(2, {
+        case 20:
+          return _context5.a(2, {
             status: "ok",
             auth: {
               type: "verified-profile",
@@ -466,7 +623,7 @@ function _verifyValAccessToken() {
             }
           });
       }
-    }, _callee3);
+    }, _callee5);
   }));
   return _verifyValAccessToken.apply(this, arguments);
 }