permdock 0.0.0 → 0.1.0

package/dist/ssf/index.js

@@ -0,0 +1,622 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { t as cancelApprovals } from "../helpers-DnSOrhB9.js";
+import { i as issuerFromDiscovery, t as joseTokenVerifier } from "../verifier-B90agnhl.js";
+import { t as timeoutSignal } from "../timeout-D51niuQP.js";
+//#region src/ssf/wire.ts
+const SET_TYP = "secevent+jwt";
+const LOGOUT_TYP = "logout+jwt";
+function jsonResponse(status, body) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: { "content-type": "application/json" }
+	});
+}
+function rfc8935(status, err, description) {
+	return jsonResponse(status, {
+		err,
+		description
+	});
+}
+function errForCause(cause) {
+	switch (cause) {
+		case "invalid-signature":
+		case "unknown-kid":
+		case "alg-not-allowed":
+		case "alg-none": return "invalid_key";
+		case "wrong-issuer": return "invalid_issuer";
+		case "wrong-audience": return "invalid_audience";
+		case "expired":
+		case "not-yet-valid":
+		case "wrong-token-type":
+		case "malformed":
+		case "encrypted-token":
+		case "dpop-proof-invalid":
+		case "mtls-binding-mismatch":
+		case "sender-constraint-required":
+		case "token-in-query":
+		case "invalid-claims":
+		case "invalid-chain":
+		case "jwks-unavailable":
+		case "discovery-unavailable":
+		case "discovery-mismatch": return "invalid_request";
+		default: return cause;
+	}
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function contentType(request) {
+	return (request.headers.get("content-type") ?? "").split(";", 1)[0]?.trim().toLowerCase() ?? "";
+}
+function parseEvery(every) {
+	if (typeof every === "number") {
+		if (!Number.isFinite(every) || every <= 0) throw new TypeError("PermDock: poll every must be a positive interval.");
+		return every;
+	}
+	const match = /^(\d+)(ms|s|m)$/u.exec(every);
+	if (match?.[2] === void 0) throw new TypeError(`PermDock: invalid poll interval '${every}'.`);
+	const unit = match[2];
+	const scale = unit === "ms" ? 1 : unit === "s" ? 1e3 : 6e4;
+	return Number(match[1]) * scale;
+}
+//#endregion
+//#region src/ssf/claims.ts
+function asSubject(mapped, session, issuer) {
+	if (typeof mapped === "string") return compact({
+		id: mapped,
+		session,
+		issuer
+	});
+	return compact({
+		id: mapped.id,
+		session: mapped.session ?? session,
+		issuer: mapped.issuer ?? issuer
+	});
+}
+function setSubjectFromClaims(claims) {
+	const subId = claims["sub_id"];
+	if (isRecord(subId) && typeof subId["format"] === "string") return subId;
+	if (typeof claims.sub === "string" && claims.sub.length > 0) return compact({
+		format: "iss_sub",
+		iss: typeof claims.iss === "string" ? claims.iss : void 0,
+		sub: claims.sub
+	});
+}
+function eventTimestamp(payload) {
+	const value = payload["event_timestamp"];
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function eventSession(payload) {
+	if (typeof payload["session"] === "string" && payload["session"].length > 0) return payload["session"];
+	if (typeof payload["sid"] === "string" && payload["sid"].length > 0) return payload["sid"];
+}
+/** CAEP drafts before SSF 1.0 put the subject in the event instead of `sub_id`. */
+function eventSubject(payload) {
+	const subject = payload["subject"];
+	return isRecord(subject) && typeof subject["format"] === "string" ? subject : void 0;
+}
+function subjectSession(subject) {
+	if (subject.format !== "complex" || !isRecord(subject["session"])) return;
+	const { id } = subject["session"];
+	return typeof id === "string" && id.length > 0 ? id : void 0;
+}
+//#endregion
+//#region src/ssf/events.ts
+const BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+const CAEP_PREFIX = "https://schemas.openid.net/secevent/caep/event-type/";
+const CAEP_NAMES = /* @__PURE__ */ new Set([
+	"session-revoked",
+	"credential-change",
+	"assurance-level-change",
+	"token-claims-change",
+	"device-compliance-change"
+]);
+function caepName(uri) {
+	if (!uri.startsWith(CAEP_PREFIX)) return;
+	const name = uri.slice(52);
+	if (CAEP_NAMES.has(name)) return name;
+}
+//#endregion
+//#region src/ssf/poll.ts
+/** Milliseconds a poll or acknowledgement request may take. */
+const POLL_TIMEOUT_MS = 3e4;
+/**
+* One RFC 8936 poll round: fetch the pending SETs, ingest them and acknowledge
+* the ones that were accepted. Returns the acknowledged `jti` values.
+*/
+async function pollOnce(input) {
+	const { options, acks, ingest, emit } = input;
+	const fetchFn = options.fetch ?? globalThis.fetch;
+	const headers = { "content-type": "application/json" };
+	if (options.token !== void 0) headers["authorization"] = `Bearer ${options.token}`;
+	const body = {
+		maxEvents: 100,
+		returnImmediately: true
+	};
+	if (acks.length > 0) body["acks"] = acks;
+	const requestInit = compact({
+		method: "POST",
+		headers,
+		body: JSON.stringify(body),
+		signal: timeoutSignal(POLL_TIMEOUT_MS, options.signal)
+	});
+	const response = await fetchFn(options.endpoint, requestInit);
+	if (!response.ok) {
+		emit({
+			type: "poll-failed",
+			err: "connection_failed"
+		});
+		return [];
+	}
+	const parsed = await response.json();
+	if (!isRecord(parsed) || !isRecord(parsed["sets"])) return [];
+	const tokens = Object.entries(parsed["sets"]).flatMap(([jti, jwt]) => typeof jwt === "string" ? [{
+		jti,
+		jwt
+	}] : []);
+	const outcomes = await Promise.all(tokens.map(async ({ jti, jwt }) => ({
+		jti,
+		result: await ingest(jwt)
+	})));
+	const processed = outcomes.flatMap((row) => row.result.ok ? [row.jti] : []);
+	const setErrs = {};
+	for (const { jti, result } of outcomes) if (!result.ok && result.cause !== void 0) setErrs[jti] = {
+		err: result.err,
+		description: result.description
+	};
+	const failed = Object.keys(setErrs).length;
+	if (processed.length > 0 || failed > 0) await fetchFn(options.endpoint, compact({
+		method: "POST",
+		headers,
+		body: JSON.stringify(compact({
+			acks: processed,
+			setErrs: failed > 0 ? setErrs : void 0,
+			maxEvents: 0,
+			returnImmediately: true
+		})),
+		signal: timeoutSignal(POLL_TIMEOUT_MS, options.signal)
+	}));
+	return processed;
+}
+//#endregion
+//#region src/ssf/receiver.ts
+const CHANGED_EVENTS = /* @__PURE__ */ new Set([
+	"credential-change",
+	"assurance-level-change",
+	"token-claims-change"
+]);
+function replayExpiresAt(claims, clockTolerance = 0) {
+	if (typeof claims["exp"] === "number") return claims["exp"];
+	if (typeof claims["iat"] === "number") {
+		const until = claims["iat"] + clockTolerance;
+		return until > Date.now() / 1e3 ? until : void 0;
+	}
+}
+function replayKey(issuer, jti, event) {
+	return JSON.stringify(event === void 0 ? [issuer ?? null, jti] : [
+		issuer ?? null,
+		jti,
+		event
+	]);
+}
+function createReceiver(config) {
+	const listeners = /* @__PURE__ */ new Set();
+	function emit(event) {
+		const next = compact(event);
+		for (const listener of listeners) listener(next);
+	}
+	async function verify(token, typ) {
+		const result = await config.verifier.verify(token, compact({
+			typ,
+			issuer: config.issuer,
+			audience: config.audience,
+			clockTolerance: config.clockTolerance
+		}));
+		if (!result.ok) return {
+			ok: false,
+			err: errForCause(result.cause),
+			description: result.cause,
+			cause: result.cause
+		};
+		if (typeof result.claims["jti"] !== "string" || result.claims["jti"].length === 0) return {
+			ok: false,
+			err: "invalid_request",
+			description: "missing jti",
+			cause: "invalid-claims"
+		};
+		if (typeof result.claims.iat !== "number") return {
+			ok: false,
+			err: "invalid_request",
+			description: "missing iat",
+			cause: "invalid-claims"
+		};
+		return result;
+	}
+	async function resolveSubject(setSubject, session, issuer) {
+		const mapped = await config.subject(setSubject, compact({
+			session,
+			issuer
+		}));
+		if (mapped === null || mapped === void 0) return;
+		if (typeof mapped === "string" && mapped.length === 0) return;
+		if (typeof mapped !== "string" && mapped.id.length === 0) return;
+		return asSubject(mapped, session, issuer);
+	}
+	const atomic = typeof config.replay.claim === "function" && typeof config.replay.release === "function";
+	/** `true` when this delivery owns the SET and should dispatch it. */
+	async function claimDelivery(key, expiresAt) {
+		if (atomic) return await config.replay.claim?.(key, expiresAt) === true;
+		return !await config.replay.seen(key);
+	}
+	async function settleDelivery(key, expiresAt, ok) {
+		if (atomic) {
+			if (!ok) await config.replay.release?.(key);
+			return;
+		}
+		if (ok) await config.replay.remember(key, expiresAt);
+	}
+	async function publishRevocation(input) {
+		const feed = config.revocations;
+		if (feed === void 0) return;
+		const kind = input.type === "session-revoked" ? "session-revoked" : CHANGED_EVENTS.has(input.type) ? "changed" : void 0;
+		if (kind === void 0) return;
+		try {
+			await feed.revoke(compact({
+				principal: input.subject.id,
+				session: kind === "session-revoked" ? input.subject.session : void 0,
+				kind
+			}));
+		} catch {}
+	}
+	async function cancelSessionApprovals(input) {
+		if (config.approvals === void 0 || input.type !== "session-revoked") return;
+		const count = await cancelApprovals(config.approvals, compact({
+			principalId: input.subject.id,
+			session: input.subject.session
+		}), {
+			by: "ssf",
+			note: input.jti
+		});
+		emit({
+			type: "approvals-cancelled",
+			subject: input.subject,
+			jti: input.jti,
+			cancelled: count
+		});
+	}
+	async function dispatch(type, input) {
+		const named = Object.hasOwn(config.onEvent, type) ? config.onEvent[type] : void 0;
+		const wildcard = config.onEvent["*"];
+		const handler = named ?? wildcard;
+		if (handler === void 0) {
+			emit({
+				type,
+				subject: input.subject,
+				transmitter: input.subject.issuer,
+				jti: input.jti,
+				unknown: "event"
+			});
+			await publishRevocation(input);
+			await cancelSessionApprovals(input);
+			return { ok: true };
+		}
+		try {
+			await handler(input);
+		} catch {
+			return {
+				ok: false,
+				err: "invalid_request",
+				description: "handler failed"
+			};
+		}
+		emit({
+			type,
+			subject: input.subject,
+			transmitter: input.subject.issuer,
+			jti: input.jti
+		});
+		await publishRevocation(input);
+		await cancelSessionApprovals(input);
+		return { ok: true };
+	}
+	async function dispatchEvents(entries, run) {
+		const [head, ...tail] = entries;
+		if (head === void 0) return { ok: true };
+		const { issuer, jti, baseSubject } = run;
+		const [uri, raw] = head;
+		const eventKey = replayKey(issuer, jti, uri);
+		if (run.perEvent && await config.replay.seen(eventKey)) return dispatchEvents(tail, run);
+		const payload = isRecord(raw) ? raw : {};
+		const type = caepName(uri) ?? uri;
+		if (caepName(uri) === void 0 && config.onEvent["*"] === void 0) {
+			emit({
+				type,
+				transmitter: issuer,
+				jti,
+				unknown: "event"
+			});
+			return dispatchEvents(tail, run);
+		}
+		const identifier = baseSubject ?? eventSubject(payload) ?? {
+			format: "opaque",
+			id: eventSession(payload) ?? jti
+		};
+		const subject = await resolveSubject(identifier, eventSession(payload) ?? subjectSession(identifier), issuer);
+		if (subject === void 0) {
+			emit({
+				type,
+				transmitter: issuer,
+				jti,
+				unknown: "subject"
+			});
+			return dispatchEvents(tail, run);
+		}
+		const result = await dispatch(type, compact({
+			subject,
+			event: payload,
+			event_timestamp: eventTimestamp(payload),
+			jti,
+			type
+		}));
+		if (!result.ok) return result;
+		if (run.perEvent) await config.replay.remember(eventKey, run.expiresAt);
+		return dispatchEvents(tail, run);
+	}
+	async function ingestSet(token) {
+		const verified = await verify(token, SET_TYP);
+		if (!verified.ok) {
+			emit({
+				type: "verification-failed",
+				err: verified.err,
+				cause: verified.cause
+			});
+			return verified;
+		}
+		const jti = verified.claims["jti"];
+		const issuer = typeof verified.claims.iss === "string" ? verified.claims.iss : void 0;
+		const events = verified.claims["events"];
+		if (!isRecord(events)) return {
+			ok: false,
+			err: "invalid_request",
+			description: "missing events",
+			cause: "invalid-claims"
+		};
+		const key = replayKey(issuer, jti);
+		const expiresAt = replayExpiresAt(verified.claims, config.clockTolerance);
+		if (!await claimDelivery(key, expiresAt)) {
+			emit({
+				type: "replay",
+				transmitter: issuer,
+				jti,
+				replayed: true
+			});
+			return { ok: true };
+		}
+		const entries = Object.entries(events);
+		let dispatched = {
+			ok: false,
+			err: "invalid_request",
+			description: "handler failed"
+		};
+		try {
+			dispatched = await dispatchEvents(entries, {
+				issuer,
+				jti,
+				baseSubject: setSubjectFromClaims(verified.claims),
+				expiresAt,
+				perEvent: entries.length > 1
+			});
+		} finally {
+			await settleDelivery(key, expiresAt, dispatched.ok);
+		}
+		return dispatched;
+	}
+	async function ingestLogout(token) {
+		const verified = await verify(token, LOGOUT_TYP);
+		if (!verified.ok) {
+			emit({
+				type: "verification-failed",
+				err: verified.err,
+				cause: verified.cause
+			});
+			return {
+				ok: false,
+				err: "invalid_request",
+				description: verified.description
+			};
+		}
+		if (verified.claims["nonce"] !== void 0) return {
+			ok: false,
+			err: "invalid_request",
+			description: "nonce must be absent",
+			cause: "invalid-claims"
+		};
+		const events = verified.claims["events"];
+		if (!isRecord(events) || !("http://schemas.openid.net/event/backchannel-logout" in events)) return {
+			ok: false,
+			err: "invalid_request",
+			description: "missing backchannel-logout event",
+			cause: "invalid-claims"
+		};
+		const sub = typeof verified.claims.sub === "string" ? verified.claims.sub : void 0;
+		const sid = typeof verified.claims["sid"] === "string" ? verified.claims["sid"] : void 0;
+		if ((sub === void 0 || sub.length === 0) && (sid === void 0 || sid.length === 0)) return {
+			ok: false,
+			err: "invalid_request",
+			description: "sub or sid required",
+			cause: "invalid-claims"
+		};
+		const jti = verified.claims["jti"];
+		const issuer = typeof verified.claims.iss === "string" ? verified.claims.iss : void 0;
+		const key = replayKey(issuer, jti);
+		const expiresAt = replayExpiresAt(verified.claims, config.clockTolerance);
+		if (!await claimDelivery(key, expiresAt)) {
+			emit({
+				type: "replay",
+				transmitter: issuer,
+				jti,
+				replayed: true
+			});
+			return { ok: true };
+		}
+		let dispatched = {
+			ok: false,
+			err: "invalid_request",
+			description: "handler failed"
+		};
+		try {
+			dispatched = await dispatchLogout(verified.claims, {
+				issuer,
+				jti,
+				sub,
+				sid
+			});
+		} finally {
+			await settleDelivery(key, expiresAt, dispatched.ok);
+		}
+		return dispatched;
+	}
+	async function dispatchLogout(claims, ids) {
+		const { issuer, jti, sub, sid } = ids;
+		const events = claims["events"];
+		const subject = await resolveSubject(sub === void 0 || sub.length === 0 ? compact({
+			format: "opaque",
+			id: sid
+		}) : compact({
+			format: "iss_sub",
+			iss: issuer,
+			sub
+		}), sid, issuer);
+		if (subject === void 0) {
+			emit({
+				type: "session-revoked",
+				transmitter: issuer,
+				jti,
+				unknown: "subject"
+			});
+			return { ok: true };
+		}
+		const payload = isRecord(events["http://schemas.openid.net/event/backchannel-logout"]) ? events[BACKCHANNEL_LOGOUT_EVENT] : {};
+		return dispatch("session-revoked", compact({
+			subject,
+			event: payload,
+			event_timestamp: eventTimestamp(payload),
+			jti,
+			type: "session-revoked"
+		}));
+	}
+	return {
+		async push(request) {
+			if (request.method !== "POST") return rfc8935(400, "invalid_request", "POST required");
+			if (contentType(request) !== "application/secevent+jwt") return rfc8935(400, "invalid_request", "application/secevent+jwt required");
+			const token = (await request.text()).trim();
+			if (token.length === 0) return rfc8935(400, "invalid_request", "empty body");
+			const result = await ingestSet(token);
+			if (!result.ok) return rfc8935(400, result.err, result.description);
+			return new Response(null, { status: 202 });
+		},
+		async logout(request) {
+			if (request.method !== "POST") return jsonResponse(400, { error: "invalid_request" });
+			if (contentType(request) !== "application/x-www-form-urlencoded") return jsonResponse(400, { error: "invalid_request" });
+			const token = new URLSearchParams(await request.text()).get("logout_token");
+			if (token === null || token.length === 0) return jsonResponse(400, { error: "invalid_request" });
+			if (!(await ingestLogout(token)).ok) return jsonResponse(400, { error: "invalid_request" });
+			return new Response(null, { status: 200 });
+		},
+		poll(options) {
+			if (options.every === void 0) return pollOnce({
+				options,
+				acks: [],
+				ingest: ingestSet,
+				emit
+			}).then((acked) => ({ acked }));
+			const ms = parseEvery(options.every);
+			let timer;
+			const tick = () => {
+				pollOnce({
+					options,
+					acks: [],
+					ingest: ingestSet,
+					emit
+				}).catch(() => {
+					emit({
+						type: "poll-failed",
+						err: "connection_failed"
+					});
+				});
+			};
+			tick();
+			timer = setInterval(tick, ms);
+			return { stop() {
+				if (timer !== void 0) {
+					clearInterval(timer);
+					timer = void 0;
+				}
+			} };
+		},
+		on(event, handler) {
+			if (event !== "event") return event;
+			listeners.add(handler);
+			return () => {
+				listeners.delete(handler);
+			};
+		}
+	};
+}
+//#endregion
+//#region src/ssf/replay.ts
+function memoryReplayStore() {
+	const seen = /* @__PURE__ */ new Map();
+	function evict(now = Date.now() / 1e3) {
+		for (const [jti, expiresAt] of seen) if (expiresAt !== void 0 && expiresAt <= now) seen.delete(jti);
+	}
+	return {
+		seen(jti) {
+			evict();
+			return seen.has(jti);
+		},
+		remember(jti, expiresAt) {
+			evict();
+			seen.set(jti, expiresAt);
+		},
+		claim(key, expiresAt) {
+			evict();
+			if (seen.has(key)) return false;
+			seen.set(key, expiresAt);
+			return true;
+		},
+		release(key) {
+			seen.delete(key);
+		}
+	};
+}
+//#endregion
+//#region src/ssf/create.ts
+function createPermDock(policy, options) {
+	if (typeof options.subject !== "function") throw new TypeError("PermDock: permdock/ssf requires subject.");
+	if (options.audience === void 0) throw new TypeError("PermDock: permdock/ssf requires audience.");
+	if (options.verifier === void 0 && options.jwks === void 0 && options.discovery === void 0) throw new TypeError("PermDock: permdock/ssf requires verifier, jwks, or discovery.");
+	if (options.issuer === void 0 && options.discovery === void 0) throw new TypeError("PermDock: permdock/ssf requires issuer or discovery.");
+	const issuer = options.issuer ?? (options.discovery === void 0 ? void 0 : issuerFromDiscovery(options.discovery));
+	const jwks = typeof options.jwks === "string" ? new URL(options.jwks) : options.jwks;
+	const verifier = options.verifier ?? joseTokenVerifier(compact({
+		jwks,
+		discovery: options.discovery,
+		issuer,
+		audience: options.audience,
+		clockTolerance: options.clockTolerance
+	}));
+	return { receiver: createReceiver(compact({
+		verifier,
+		issuer,
+		audience: options.audience,
+		subject: options.subject,
+		onEvent: options.onEvent ?? {},
+		replay: options.replay ?? memoryReplayStore(),
+		approvals: options.approvals,
+		revocations: options.revocations,
+		clockTolerance: options.clockTolerance
+	})) };
+}
+//#endregion
+export { createPermDock, memoryReplayStore };

package/dist/store-Bq90395i.d.ts

@@ -0,0 +1,27 @@
+import { Mn as Decision, gt as Snapshot } from "./policy-CInmNGkM.js";
+import { d as Permission } from "./permissions-B4apnahQ.js";
+import { c as PermissionState, n as ApprovalState, r as ClientPermDock } from "./types-DbWdEfcm.js";
+//#region src/react/store.d.ts
+type ClientStore = {
+  get(): ClientPermDock;
+  subscribe(listener: () => void): () => void;
+  permissionState(permission: Permission, data?: unknown): PermissionState;
+  requestApproval(decision: Decision, note?: string): Promise<void>;
+  /** Hydrate from a pushed snapshot; a compact JWS goes through the verifier. */
+  replace(value: unknown): void;
+  /** Stay `pending` until `value` settles, then hydrate; a rejection fails closed. */
+  follow(value: PromiseLike<Snapshot | string>): void;
+  /**
+   * The approval state for a decision. While something subscribes, an
+   * `approval-required` decision is polled at `<approvals>/<token>`.
+   */
+  approvalState(decision: Decision): ApprovalState;
+  /**
+   * Hydrate from a resolved `snapshotPromise` during render. Idempotent per `source`;
+   * subscribers are notified in a microtask, never synchronously inside render.
+   */
+  adopt(value: Snapshot | string, source: object): void;
+  snapshot(): Snapshot;
+};
+//#endregion
+export { ClientStore as t };