@vantageos/mcp-boilerplate 0.6.3 → 0.8.0

package/dist/oauth/clientAssertion.d.ts

@@ -1,28 +0,0 @@
-import { type CimdOptions } from "./clientRegistry.js";
-export declare const JWT_BEARER_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
-export declare const ASSERTION_SIGNING_ALGS: readonly ["RS256"];
-export type AssertionResult = {
-    ok: true;
-    clientId: string;
-} | {
-    ok: false;
-    reason: string;
-};
-/** Bounded set of accepted jti values, each held until its assertion expires. */
-export declare function createJtiStore(maxEntries?: number): {
-    /** True when the jti is new (and is now recorded); false on a replay or when full. */
-    accept(clientId: string, jti: string, exp: number, nowSeconds: number): boolean;
-};
-export interface AssertionVerifierOptions extends CimdOptions {
-    now?: () => number;
-    jtiStore?: ReturnType<typeof createJtiStore>;
-}
-export declare function createClientAssertionVerifier(options?: AssertionVerifierOptions): {
-    verify(input: {
-        assertionType: string | undefined;
-        assertion: string | undefined;
-        /** The `client_id` request parameter, when sent. */
-        clientId: string | undefined;
-        audiences: string[];
-    }): Promise<AssertionResult>;
-};

package/dist/oauth/clientAssertion.js

@@ -1,106 +0,0 @@
-/**
- * private_key_jwt client authentication at `/token` (RFC 7523 / OIDC Core 9).
- *
- * A presented assertion is VERIFIED, never ignored and never trusted unverified:
- *  - the key set comes from the `jwks_uri` of the client's CIMD document, fetched through the
- *    same SSRF guard as the document itself;
- *  - alg is pinned to RS256 (a document declaring another signing alg is refused), so `none`
- *    and HMAC assertions cannot verify;
- *  - `iss` and `sub` equal the client_id; `aud` is this token endpoint or this issuer; `exp`
- *    is required (30 s skew); `jti` is required and accepted ONCE.
- */
-import { createLocalJWKSet, decodeJwt, jwtVerify } from "jose";
-import { fetchGuardedJson, isUrlShapedClientId, resolveCimdDocument, } from "./clientRegistry.js";
-export const JWT_BEARER_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
-export const ASSERTION_SIGNING_ALGS = ["RS256"];
-const SKEW_SECONDS = 30;
-const MAX_JWKS_BYTES = 64 * 1024;
-/** Bounded set of accepted jti values, each held until its assertion expires. */
-export function createJtiStore(maxEntries = 10_000) {
-    const seen = new Map(); // `${clientId}\n${jti}` -> exp (epoch seconds)
-    return {
-        /** True when the jti is new (and is now recorded); false on a replay or when full. */
-        accept(clientId, jti, exp, nowSeconds) {
-            for (const [k, e] of seen)
-                if (e + SKEW_SECONDS <= nowSeconds)
-                    seen.delete(k);
-            const key = `${clientId}\n${jti}`;
-            if (seen.has(key))
-                return false;
-            if (seen.size >= maxEntries)
-                return false; // fail closed: never evict a live jti
-            seen.set(key, exp);
-            return true;
-        },
-    };
-}
-export function createClientAssertionVerifier(options = {}) {
-    const now = options.now ?? (() => Date.now());
-    const jtiStore = options.jtiStore ?? createJtiStore();
-    const fetchOpts = {
-        fetchImpl: options.fetchImpl,
-        resolveHost: options.resolveHost,
-        maxBytes: MAX_JWKS_BYTES,
-        ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
-    };
-    return {
-        async verify(input) {
-            const fail = (reason) => ({ ok: false, reason });
-            if (input.assertionType !== JWT_BEARER_ASSERTION_TYPE || !input.assertion) {
-                return fail("unsupported client assertion");
-            }
-            // The unverified iss only LOCATES the key set; it is re-checked against the verified claims.
-            let claimedIss;
-            try {
-                claimedIss = decodeJwt(input.assertion).iss;
-            }
-            catch {
-                return fail("malformed client assertion");
-            }
-            if (!claimedIss || !isUrlShapedClientId(claimedIss))
-                return fail("unknown client");
-            if (input.clientId !== undefined && input.clientId !== claimedIss) {
-                return fail("client_id does not match the assertion issuer");
-            }
-            const clientId = claimedIss;
-            const cimd = await resolveCimdDocument(clientId, options);
-            if (!cimd?.jwksUri)
-                return fail("client has no verifiable key set");
-            if (cimd.signingAlg !== undefined &&
-                !ASSERTION_SIGNING_ALGS.includes(cimd.signingAlg)) {
-                return fail("unsupported signing algorithm");
-            }
-            let jwksUrl;
-            try {
-                jwksUrl = new URL(cimd.jwksUri);
-            }
-            catch {
-                return fail("invalid jwks_uri");
-            }
-            const jwks = (await fetchGuardedJson(jwksUrl, fetchOpts));
-            if (!jwks || !Array.isArray(jwks.keys))
-                return fail("key set unavailable");
-            let payload;
-            try {
-                const verified = await jwtVerify(input.assertion, createLocalJWKSet(jwks), {
-                    algorithms: [...ASSERTION_SIGNING_ALGS],
-                    issuer: clientId,
-                    subject: clientId,
-                    audience: input.audiences,
-                    clockTolerance: SKEW_SECONDS,
-                    currentDate: new Date(now()),
-                    requiredClaims: ["iss", "sub", "aud", "exp", "jti"],
-                });
-                payload = verified.payload;
-            }
-            catch {
-                return fail("client assertion rejected");
-            }
-            const exp = payload.exp;
-            if (!payload.jti || !jtiStore.accept(clientId, payload.jti, exp, Math.floor(now() / 1000))) {
-                return fail("client assertion replayed");
-            }
-            return { ok: true, clientId };
-        },
-    };
-}