mikser-io-auth 0.7.0 → 0.9.0

package/README.md

@@ -227,6 +227,44 @@ keeps them: a registered client and its refresh token exist only because a
 human completed a sign-in once, and they are not something the working folder
 can rebuild.
 
+### Minted tokens
+
+`auth()` publishes a minting surface at `runtime.options.auth`, so another
+plugin can hand out a credential **narrower than the caller's own** without
+importing this package:
+
+```js
+runtime.options.auth.mint({
+    subject:      principal.subject,
+    capabilities: principal.capabilities,   // what they already hold
+    request:      ['webdav:media', 'webdav:media:write'],
+    ttlSec:       300,
+    purpose:      'webdav:media (write)',
+})
+```
+
+The scopes are the **intersection** of `request` and `capabilities`. This can
+only ever narrow: there is no argument that widens anyone's reach, and asking
+for a scope the caller does not hold is refused with the missing one named
+rather than trimmed silently. A caller whose `capabilities` are `null` — a
+static token, not capability-scoped — is refused outright, because it cannot
+delegate what it cannot enumerate.
+
+A minted token carries a **`jti`** and is recorded in `mikser_auth_minted`, which
+makes it revokable before it expires — the one thing an ordinary JWT is not, and
+the thing that matters for a credential handed to a machine that logs its own
+output. `revokeMinted(jti)` kills one; `listMinted(subject)` is the audit view.
+Every mint is logged with subject, purpose, scopes and ttl.
+
+Verification **fails closed**: a token with a `jti` whose row is missing, or
+whose checker was never wired, is rejected. Losing the record must revoke, never
+un-revoke. Session tokens carry no `jti`, so they never touch this table and
+gain no new failure mode.
+
+Minted tokens are **not refreshable**. Expiry is the revocation mechanism, so
+they are deliberately short and a caller mints again rather than renewing one
+that has been sitting in a transcript.
+
 ### When an access token expires
 
 Access tokens are short (`ttl`, default `1h`) and refresh tokens are long, so

package/lib/tokens.js

@@ -13,7 +13,7 @@ export async function issueToken({ key, issuer, audience, subject, capabilities
     // list, and a client library will parse it as one. The row filter travels
     // as a private claim so the two never collide. It is signed, so a client
     // cannot widen its own reach by editing it.
-    return new SignJWT({
+    const signer = new SignJWT({
         scope: capabilities.join(' '),
         ...(scope ? { mks_scope: scope } : {}),
     })
@@ -23,7 +23,7 @@ export async function issueToken({ key, issuer, audience, subject, capabilities
         .setAudience(audience)
         .setSubject(subject)
         .setExpirationTime(ttl)
-        .sign(key.privateKey)
+    return signer.sign(key.privateKey)
 }
 
 // Verify a token minted by this server. `audience` is checked because a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikser-io-auth",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Authentication for mikser-io: an OAuth 2.1 authorization server (self-registering clients, authorization code + PKCE, refresh rotation) and HTTP Basic / JWT verifiers over Apache-format htpasswd and htgroup files in the working folder. Implements the ADR-0012 verifier contract, so it plugs in wherever a static token does — api, mcp, forms.",
   "main": "index.js",
   "type": "module",