@volter/teams 0.1.59 → 0.1.60

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.1.59",
+  "version": "0.1.60",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/core.mjs

@@ -14,20 +14,22 @@ const productionIds={next(kind){return `${prefix[kind]??kind}_${randomBytes(16).
 const productionClock={nowMs:()=>Date.now()};
 export { productionIds, productionClock };
 
-export function createTeamsApi({clock=productionClock,ids=productionIds,publicOrigin=null,identityIssuer=null,identityOrganizations=null,delegatedIssuer=null,uploadLimitBytes=256*1024*1024}={}) {
+export function createTeamsApi({clock=productionClock,ids=productionIds,publicOrigin=null,identityIssuer=null,identityOrganizations=null,delegatedIssuer=null,delegatedIssuers=[],uploadLimitBytes=256*1024*1024}={}) {
   // An identity service people may sign in with (protocol P02 federation); its tokens name this server's public origin.
   identityIssuer=normalizePublicOrigin(identityIssuer);
   if(identityIssuer&&!publicOrigin)throw new TypeError('an identity issuer needs the public origin its tokens name');
   // A workplace whose delegated tokens admit a caller to one pane or folder (server/delegated.mjs); they name this origin too.
   delegatedIssuer=normalizePublicOrigin(delegatedIssuer);
-  if(delegatedIssuer&&!publicOrigin)throw new TypeError('a delegated issuer needs the public origin its tokens name');
+  if(!Array.isArray(delegatedIssuers)||delegatedIssuers.some(origin=>typeof origin!=='string'||!origin.trim()))throw new TypeError('delegatedIssuers must be an array of origins');
+  delegatedIssuers=Object.freeze([...new Set([delegatedIssuer,...delegatedIssuers.map(normalizePublicOrigin)].filter(Boolean))]);
+  if(delegatedIssuers.length&&!publicOrigin)throw new TypeError('a delegated issuer needs the public origin its tokens name');
   if(typeof clock?.nowMs!=='function'||typeof ids?.next!=='function')throw new TypeError('clock.nowMs and ids.next are required');
   if(!Number.isSafeInteger(uploadLimitBytes)||uploadLimitBytes<1||uploadLimitBytes>256*1024*1024)throw new TypeError('uploadLimitBytes must be between 1 and 268435456');
   let store=null,serverId=null,localOrigin=null,harnessRoutes=null;
   const events=new TeamEvents();
   // Teams linked to organizations the identity service keeps for this server (identity-orgs.mjs).
   if(identityOrganizations&&!identityIssuer)throw new TypeError('organizations need the identity issuer that keeps them');
-  return {clock,ids,events,publicOrigin,identityIssuer,identityOrganizations,delegatedIssuer,uploadLimitBytes,rateState:new Map(),openStreams:new Map(),securityEvents:[],
+  return {clock,ids,events,publicOrigin,identityIssuer,identityOrganizations,delegatedIssuer,delegatedIssuers,uploadLimitBytes,rateState:new Map(),openStreams:new Map(),securityEvents:[],
     get store(){return store;},get serverId(){return serverId;},get localOrigin(){return localOrigin;},get harnessRoutes(){return harnessRoutes;},
     attach(next){store=next.store??store;if(next.serverId!==undefined)serverId=next.serverId;if(next.localOrigin!==undefined)localOrigin=next.localOrigin;if(next.harnessRoutes!==undefined)harnessRoutes=next.harnessRoutes;},
   };

package/server/delegated.mjs

@@ -1,6 +1,6 @@
 // Delegated access (RH2 RFC 0013, panes and folders): a workplace that decides who may see or drive a pane or a
 // folder signs a short-lived token saying so, and this server admits exactly that, as it admits a machine grant.
-// The workplace is an issuer this server is configured to trust (`delegatedIssuer`, its origin); its keys are at
+// The workplace is an issuer this server is configured to trust (`delegatedIssuers`, exact origins); its keys are at
 // `<issuer>/.well-known/jwks.json` (Ed25519, EdDSA). A token names the principal, the Surface (its kind, and in its
 // config this server's team, the machine and the target) and `view` or `control`; its audience is this server's
 // public origin. Verified with WebCrypto, so the same code runs in Node and in a Worker.
@@ -38,13 +38,15 @@ export function looksDelegated(token) {
   return typeof token === 'string' && /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token);
 }
 
-async function issuerKey(api, kid) {
-  const cache = api.delegatedKeys ??= { at: -Infinity, keys: new Map() };
+async function issuerKey(api, issuer, kid) {
+  const caches = api.delegatedKeys ??= new Map();
+  let cache = caches.get(issuer);
+  if (!cache) caches.set(issuer, cache = { at: -Infinity, keys: new Map() });
   const age = api.clock.nowMs() - cache.at;
   // The set is re-read when it is old, or when it lacks the kid and was last read over a minute ago (a key rotated
   // in); so a forged kid drives at most one fetch a minute.
   if (age >= KEYS_TTL_MS || (!cache.keys.has(kid) && age > 60 * 1000)) {
-    const response = await fetch(`${api.delegatedIssuer}/.well-known/jwks.json`, { headers: { accept: 'application/json' } });
+    const response = await fetch(`${issuer}/.well-known/jwks.json`, { headers: { accept: 'application/json' } });
     if (!response.ok) throw new Error(`the issuer's keys did not load (${response.status})`);
     const { keys } = await response.json();
     const loaded = new Map();
@@ -124,18 +126,20 @@ export async function delegatedRoomNoticeOf(api, token) {
 
 /** A token's claims when it is one this server trusts: signed by the issuer's key, for this server, in its lifetime. */
 async function verifiedClaims(api, token) {
-  if (!api.delegatedIssuer || !api.publicOrigin || !looksDelegated(token)) return null;
+  if (!api.delegatedIssuers.length || !api.publicOrigin || !looksDelegated(token)) return null;
   try {
     const [head, body, signature] = token.split('.');
     const header = json(head);
     if (header.alg !== 'EdDSA' || typeof header.kid !== 'string') return null;
-    const key = await issuerKey(api, header.kid);
+    // Only configured origins may select keys; an untrusted claim never triggers a fetch.
+    // Cache by issuer as well as kid so staging cannot reuse a production key identifier.
+    const claims = json(body);
+    if (!api.delegatedIssuers.includes(claims.iss) || claims.aud !== api.publicOrigin) return null;
+    const key = await issuerKey(api, claims.iss, header.kid);
     if (!key) return null;
     const signed = new TextEncoder().encode(`${head}.${body}`);
     if (!await crypto.subtle.verify({ name: 'Ed25519' }, key, fromBase64Url(signature), signed)) return null;
-    const claims = json(body);
     const now = Math.floor(api.clock.nowMs() / 1000);
-    if (claims.iss !== api.delegatedIssuer || claims.aud !== api.publicOrigin) return null;
     if (typeof claims.exp !== 'number' || claims.exp <= now - SKEW_S || (typeof claims.nbf === 'number' && claims.nbf > now + SKEW_S)) return null;
     if (typeof claims.sub !== 'string' || !claims.sub) return null;
     return claims;

package/server/machine-link.mjs

@@ -157,11 +157,11 @@ export async function authorizeMachineUpgrade(api, { authenticate, url, headers
   const presented = bearerFrom(headers);
   // A Room member typing into a session bound to their Room: the session names the machine, the server finds it.
   const session = /^\/api\/v1\/teams\/([^/]+)\/sessions\/([^/]+)\/channel$/.exec(pathname);
-  if (session) return api.delegatedIssuer && looksDelegated(presented) ? await delegatedSessionChannel(api, session[1], decodeURIComponent(session[2]), presented) : { status: 404, code: 'not_found', message: 'not found' };
+  if (session) return api.delegatedIssuers.length && looksDelegated(presented) ? await delegatedSessionChannel(api, session[1], decodeURIComponent(session[2]), presented) : { status: 404, code: 'not_found', message: 'not found' };
   const match = /^\/api\/v1\/teams\/([^/]+)\/machines\/([^/]+)\/(link|channel)$/.exec(pathname);
   if (!match) return { status: 404, code: 'not_found', message: 'not found' };
   const [, teamId, machineId, door] = match;
-  if (door === 'channel' && api.delegatedIssuer && looksDelegated(presented)) return await delegatedChannel(api, teamId, machineId, presented);
+  if (door === 'channel' && api.delegatedIssuers.length && looksDelegated(presented)) return await delegatedChannel(api, teamId, machineId, presented);
   const auth = await authenticate(api, presented);
   if (!auth) return { status: 401, code: 'authentication_required', message: 'authentication required' };
   if (door === 'link') {

package/server/publications.mjs

@@ -80,7 +80,7 @@ export async function publicationRoute({ api, req, res, auth, machineId, publica
     if (!publishableTarget(body.kind, body.target)) fail(400, 'invalid_request', body.kind === 'pane' ? 'target must be one pane, pane:<key> (no wildcard)' : 'target must be one absolute folder, root:/path (not root:/, no wildcard, normalized)');
     const workplace = typeof body.workplace === 'string' ? originOf(body.workplace) : null;
     if (!workplace) fail(400, 'invalid_request', 'workplace must be an origin (https://host)');
-    if (workplace !== api.delegatedIssuer) fail(400, 'invalid_request', `this server does not trust ${workplace} as a delegated issuer`);
+    if (!api.delegatedIssuers.includes(workplace)) fail(400, 'invalid_request', `this server does not trust ${workplace} as a delegated issuer`);
     if (typeof body.room !== 'string' || !body.room || body.room.length > 256) fail(400, 'invalid_request', 'room must name the workplace Room');
     if (body.surface_key !== undefined && (typeof body.surface_key !== 'string' || !body.surface_key || body.surface_key.length > 256)) fail(400, 'invalid_request', 'surface_key must be a non-empty string');
     const existing = await api.store.one('SELECT * FROM machine_publications WHERE team_id=? AND machine_id=? AND target=? AND workplace=? AND room=?', [auth.team_id, machineId, body.target, workplace, body.room]);