dsh-mobile 0.6.10 → 0.6.12

package/lib/index.d.mts

@@ -124,6 +124,8 @@ export declare class BoundedRateLimiter {
   constructor(limit: number, windowMs: number, maximumKeys: number);
   /** Consume one attempt; unknown keys fail closed when the bounded table is full. */
   take(key: string, now: number): boolean;
+  /** Discard entries that no longer identify an eligible key in a trusted, finite key set. */
+  retainKeys(eligible: ReadonlySet<string>): void;
   /** Current table size, exposed for bounded-state assertions. */
   get size(): number;
 }
@@ -135,6 +137,7 @@ export declare class AccessController {
   private readonly pairLimiter;
   private devices;
   private pairingWindow;
+  private pairPending;
   private readonly sessions;
   private readonly sessionEndedListeners;
   private mutation;
@@ -157,6 +160,8 @@ export declare class AccessController {
     token: string;
     expiresAt: number;
   }>;
+  /** Limit invalid guesses by peer without letting them consume a valid one-time secret's admission. */
+  private rejectPairingAttempt;
   /** Consume the pairing window exactly once and persist only the device-token digest. */
   pair(sourceKey: string, token: string, label?: string): Promise<PairingResult>;
   /** Exchange a valid persistent device credential for a new short Session. */
@@ -516,6 +521,25 @@ export declare class MobileAccessGatewayController {
   private enqueue;
 }
 //#endregion
+//#region src/auth-failure-log.d.ts
+/** One rejected HTTP request, with presence/count fields instead of credential values. */
+interface AuthFailureEntry {
+  readonly kind: 'authorize' | 'csrf';
+  readonly status: number;
+  readonly method: string;
+  /** A fixed public endpoint or route category; never an arbitrary request pathname. */
+  readonly path: string;
+  readonly sessionCookie: boolean;
+  readonly csrfHeader: boolean;
+  /** Number of occurrences of the two actual CSRF cookie names, including empty values. */
+  readonly csrfCookies: number;
+  readonly origin?: string;
+  readonly site?: 'same-origin' | 'same-site' | 'cross-site' | 'none';
+  readonly device?: string;
+  /** Earlier failures of this kind suppressed since its preceding recorded request. */
+  readonly suppressed?: number;
+}
+//#endregion
 //#region src/http-security.d.ts
 export declare const DEVICE_COOKIE = "dsh_ma_device";
 export declare const SESSION_COOKIE = "dsh_ma_session";
@@ -967,15 +991,20 @@ export declare class MobileAccessGateway {
   private closeTask;
   private readonly removeSessionListener;
   private readonly removeExtensionContentListener;
-  private readonly renewLimiter;
-  private readonly probeLimiter;
+  private readonly renewFailureLimiter;
+  private readonly renewDeviceLimiter;
+  private readonly renewInFlight;
+  private readonly probeFailureLimiter;
+  private readonly probeDeviceLimiter;
+  private readonly probeInFlight;
   private readonly clientModulePreferences;
   private readonly clientModuleOperations;
   private readonly clientModuleTasks;
   private readonly clientModuleRevocations;
+  private readonly authFailures;
   constructor(config: ResolvedGatewayConfig, store: DeviceStore, extensions?: MobileAccessService | undefined, upstreamAuthenticatedUrl?: string | undefined, extraWebSocketPaths?: {
     has(pathname: string): boolean;
-  } | undefined, blockedUpgradeLog?: BlockedUpgradePathLog | undefined, onDiscoveryDegraded?: ((source: 'broadcast' | 'mdns', code: string) => void) | undefined, clientModulePreferences?: ClientModulePreferenceStore);
+  } | undefined, blockedUpgradeLog?: BlockedUpgradePathLog | undefined, onDiscoveryDegraded?: ((source: 'broadcast' | 'mdns', code: string) => void) | undefined, clientModulePreferences?: ClientModulePreferenceStore, authFailureLog?: (entry: AuthFailureEntry) => void);
   /** Initialize durable state, validate TLS, and bind the externally reachable listener. */
   start(): Promise<void>;
   /** Install a newly signed provided leaf for future TLS handshakes without dropping sessions. */
@@ -1012,6 +1041,8 @@ export declare class MobileAccessGateway {
   private requireCsrf;
   private setSessionCookies;
   private setBrowserDeviceBinding;
+  /** Separate malformed or invalid requests from device-authenticated work without trusting forwarded addresses. */
+  private withDeviceRequest;
   private handlePair;
   private handleRenew;
   /** CA-backed entries retain their pin; public entries project the authenticated credential's identity. */