dbsc-toolkit 2.14.0 → 2.15.0

package/dist/core/protocol/native-proof-guard.d.ts

@@ -1,58 +0,0 @@
-import type { CookieScope, CookieScopeOptions } from "../cookies/options.js";
-import type { StorageAdapter } from "../types.js";
-/** Shared TTL for the `__Host-dbsc-challenge` cookie the handshake round-trips. */
-export declare const FRESH_PROOF_CHALLENGE_TTL_MS: number;
-export interface FreshProofScope {
-    secure: boolean;
-    cookieScope?: CookieScope;
-    cookieDomain?: string;
-}
-/**
- * Resolve whether the native fresh-proof handshake should run for this request.
- * Default on when the polyfill is off (no bound key to verify per request);
- * the explicit `freshProof` option overrides; an explicit `allowDbscWithoutProof:
- * true` forces relax. Adapters call this so the policy is identical everywhere.
- */
-export declare function freshProofActive(args: {
-    tier: string;
-    boundEnabled: boolean | undefined;
-    freshProof: boolean | undefined;
-    allowDbscWithoutProof: boolean | undefined;
-}): boolean;
-/** The challenge cookie name for a given scope (`__Host-dbsc-challenge` / `dbsc-challenge`). */
-export declare function challengeCookieName(scope: CookieScopeOptions): string;
-export interface NativeProofGuardRequest {
-    sessionId: string;
-    /** The `Secure-Session-Response` JWS the browser sent on retry, if any. */
-    secSessionResponseHeader: string | undefined;
-    /** The challenge JTI the browser was previously handed (from the challenge cookie). */
-    expectedJti: string | undefined;
-}
-export type NativeProofGuardResult = 
-/** Proof verified against the native key; let the request through. */
-{
-    kind: "pass";
-}
-/** No proof yet (or no prior challenge). Send 403 + this challenge so Chrome refreshes and retries. */
- | {
-    kind: "challenge";
-    jti: string;
-}
-/** A proof was sent but failed verification. Reject; do not re-challenge (avoids loops). */
- | {
-    kind: "reject";
-    error: string;
-    code: string;
-};
-/**
- * Framework-agnostic core of `requireProof({ freshProof: true })` on a native
- * `dbsc` session. Drives the W3C 403-challenge handshake: when no proof is
- * present it issues a challenge for the adapter to return as 403 +
- * `Secure-Session-Challenge`; when a proof is present it verifies it against the
- * stored native key by reusing `handleRefresh` (single source of truth for
- * native-proof verification — including challenge single-use and demoting the
- * session to `none` on a bad signature). A stolen cookie cannot produce a valid
- * proof, so it ends up rejected per request.
- */
-export declare function guardNativeProof(req: NativeProofGuardRequest, storage: StorageAdapter): Promise<NativeProofGuardResult>;
-//# sourceMappingURL=native-proof-guard.d.ts.map

package/dist/core/protocol/native-proof-guard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"native-proof-guard.d.ts","sourceRoot":"","sources":["../../../src/core/protocol/native-proof-guard.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,mFAAmF;AACnF,eAAO,MAAM,4BAA4B,QAAgB,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,UAAU,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC,qBAAqB,EAAE,OAAO,GAAG,SAAS,CAAC;CAC5C,GAAG,OAAO,CAIV;AAED,gGAAgG;AAChG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAErE;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,uFAAuF;IACvF,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,MAAM,sBAAsB;AAChC,sEAAsE;AACpE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;AAClB,uGAAuG;GACrG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACpC,4FAA4F;GAC1F;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,uBAAuB,EAC5B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,sBAAsB,CAAC,CA4BjC"}

package/dist/core/protocol/native-proof-guard.js

@@ -1,60 +0,0 @@
-import { handleRefresh } from "./refresh.js";
-import { issueChallenge } from "./challenge.js";
-import { cookieNames } from "../cookies/options.js";
-import { DbscVerificationError } from "../errors.js";
-/** Shared TTL for the `__Host-dbsc-challenge` cookie the handshake round-trips. */
-export const FRESH_PROOF_CHALLENGE_TTL_MS = 5 * 60 * 1000;
-/**
- * Resolve whether the native fresh-proof handshake should run for this request.
- * Default on when the polyfill is off (no bound key to verify per request);
- * the explicit `freshProof` option overrides; an explicit `allowDbscWithoutProof:
- * true` forces relax. Adapters call this so the policy is identical everywhere.
- */
-export function freshProofActive(args) {
-    if (args.tier !== "dbsc")
-        return false;
-    if (args.allowDbscWithoutProof === true)
-        return false;
-    return args.freshProof ?? args.boundEnabled === false;
-}
-/** The challenge cookie name for a given scope (`__Host-dbsc-challenge` / `dbsc-challenge`). */
-export function challengeCookieName(scope) {
-    return cookieNames(scope).challenge;
-}
-/**
- * Framework-agnostic core of `requireProof({ freshProof: true })` on a native
- * `dbsc` session. Drives the W3C 403-challenge handshake: when no proof is
- * present it issues a challenge for the adapter to return as 403 +
- * `Secure-Session-Challenge`; when a proof is present it verifies it against the
- * stored native key by reusing `handleRefresh` (single source of truth for
- * native-proof verification — including challenge single-use and demoting the
- * session to `none` on a bad signature). A stolen cookie cannot produce a valid
- * proof, so it ends up rejected per request.
- */
-export async function guardNativeProof(req, storage) {
-    // No proof header, or no prior challenge to verify against → issue one and ask
-    // the browser to refresh. Chrome signs it with the hardware key and retries.
-    if (!req.secSessionResponseHeader || !req.expectedJti) {
-        const challenge = await issueChallenge(req.sessionId, storage);
-        return { kind: "challenge", jti: challenge.jti };
-    }
-    try {
-        await handleRefresh({
-            sessionId: req.sessionId,
-            secSessionResponseHeader: req.secSessionResponseHeader,
-            expectedJti: req.expectedJti,
-        }, storage);
-        return { kind: "pass" };
-    }
-    catch (err) {
-        // Proof present but invalid (forged/expired/replayed). handleRefresh already
-        // consumed the challenge and, on a bad signature, demoted the session to
-        // `none`. Reject without re-challenging so a broken or hostile client can't
-        // loop; the next request sees `none` and 403s at the tier check.
-        if (err instanceof DbscVerificationError) {
-            return { kind: "reject", error: err.message, code: err.code };
-        }
-        throw err;
-    }
-}
-//# sourceMappingURL=native-proof-guard.js.map

package/dist/core/protocol/native-proof-guard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"native-proof-guard.js","sourceRoot":"","sources":["../../../src/core/protocol/native-proof-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAGrD,mFAAmF;AACnF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAQ1D;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAKhC;IACC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,IAAI,CAAC,qBAAqB,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC;AACxD,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAkBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAA4B,EAC5B,OAAuB;IAEvB,+EAA+E;IAC/E,6EAA6E;IAC7E,IAAI,CAAC,GAAG,CAAC,wBAAwB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,CACjB;YACE,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,wBAAwB,EAAE,GAAG,CAAC,wBAAwB;YACtD,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B,EACD,OAAO,CACR,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,yEAAyE;QACzE,4EAA4E;QAC5E,iEAAiE;QACjE,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QAChE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}