permdock 0.0.0 → 0.2.0

package/dist/jwt/index.js

@@ -0,0 +1,590 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
+import { n as sha256, t as bytesToBase64Url } from "../sha256-BO0swRXL.js";
+import { t as anonymousSubject } from "../subject-C6dLxqHU.js";
+import { i as linkPolicyViolation, o as parseCapability, s as redeemerAllows, t as capabilitySubject } from "../capability-4qPdO9gk.js";
+import { a as decodeHeader, i as issuerFromDiscovery, n as assertSubjectConfig, o as normalizeTyp, r as fail, t as joseTokenVerifier } from "../verifier-BxBo6I44.js";
+import { t as loadJose } from "../load-jose-BL6LH4bL.js";
+import { n as mapClaimsToSubject, r as validateCustomClaims, t as acceptMismatch } from "../map-claims-Z4QZOiFF.js";
+import { t as memoryReplayStore } from "../replay-BsOyTrdV.js";
+//#region src/jwt/capability.ts
+function emit(options, reason, cause, token) {
+	if (options.onAuth === void 0) return;
+	const header = decodeHeader(token);
+	options.onAuth(compact({
+		reason,
+		cause,
+		source: "capability",
+		kid: header?.kid,
+		alg: header?.alg,
+		typ: header?.typ,
+		issuer: options.issuer,
+		requestId: options.requestId
+	}));
+}
+async function claimOnce(replay, key, expiresAt) {
+	if (replay.claim !== void 0) return replay.claim(key, expiresAt);
+	if (await replay.seen(key)) return false;
+	await replay.remember(key, expiresAt);
+	return true;
+}
+async function stores(options, capability, issuedAt, once) {
+	try {
+		const policy = await options.linkPolicy?.(capability);
+		if (policy !== void 0 && linkPolicyViolation(capability, policy, issuedAt) !== void 0) return "link-policy";
+		if (options.revoked !== void 0 && await options.revoked(capability.id)) return "capability-revoked";
+		const replay = options.replay;
+		if (once !== void 0 && (replay === void 0 || !await claimOnce(replay, once.key, once.expiresAt))) return "capability-replayed";
+		return { ok: true };
+	} catch {
+		return {
+			ok: false,
+			reason: "source-threw"
+		};
+	}
+}
+/**
+* Resolves a `permdock-capability+jwt` into the `link` subject it acts as.
+* Every failure (signature, `typ`, `iss`, `aud`, expiry, a malformed claim,
+* a revoked link, a replayed one-time token, a redeemer the viewer does not
+* satisfy, a throwing store) is the anonymous subject, never a throw.
+*/
+async function subjectFromCapability(token, options) {
+	if (token === void 0 || token === null || token.length === 0) return anonymousSubject();
+	const deny = (cause, reason = "invalid-token") => {
+		emit(options, reason, cause, token);
+		return anonymousSubject();
+	};
+	if (typeof options.issuer !== "string" || options.issuer.length === 0) return deny("wrong-issuer");
+	if (options.audience === void 0 || options.audience.length === 0) return deny("wrong-audience");
+	let verifier;
+	try {
+		verifier = options.verifier ?? joseTokenVerifier({
+			...options,
+			typ: "permdock-capability+jwt"
+		});
+	} catch {
+		return deny("malformed");
+	}
+	let verified;
+	try {
+		verified = await verifier.verify(token, compact({
+			typ: "permdock-capability+jwt",
+			issuer: options.issuer,
+			audience: options.audience,
+			clockTolerance: options.clockTolerance
+		}));
+	} catch {
+		return deny("malformed");
+	}
+	if (!verified.ok) return deny(verified.cause);
+	if (normalizeTyp(verified.header.typ) !== "permdock-capability+jwt") return deny("wrong-token-type");
+	const parsed = parseCapability(verified.claims["capability"]);
+	const exp = verified.claims.exp;
+	if (parsed?.holder !== "link" || verified.claims.sub !== parsed.id || typeof exp !== "number") return deny("invalid-claims");
+	const capability = {
+		...parsed,
+		expiresAt: Math.min(parsed.expiresAt, exp)
+	};
+	const now = Date.now() / 1e3;
+	if (capability.expiresAt <= now) return deny("expired");
+	if (!redeemerAllows(capability.redeemer, options.viewer, now)) return deny("redeemer-mismatch");
+	const jti = verified.claims["jti"];
+	if (capability.once === true && (options.replay === void 0 || typeof jti !== "string" || jti === "")) return deny("invalid-claims");
+	const iat = verified.claims.iat;
+	const checked = await stores(options, capability, typeof iat === "number" ? iat : void 0, capability.once === true ? {
+		key: `capability\u0000${options.issuer}\u0000${String(jti)}`,
+		expiresAt: capability.expiresAt
+	} : void 0);
+	if (typeof checked === "string") return deny(checked);
+	if (!checked.ok) return deny(void 0, checked.reason);
+	return capabilitySubject(capability, { issuer: options.issuer });
+}
+//#endregion
+//#region src/jwt/ci-oidc.ts
+const PROVIDERS = {
+	github: {
+		issuer: "https://token.actions.githubusercontent.com",
+		jwks: "https://token.actions.githubusercontent.com/.well-known/jwks"
+	},
+	gitlab: {
+		issuer: "https://gitlab.com",
+		jwks: "https://gitlab.com/oauth/discovery/keys"
+	},
+	buildkite: {
+		issuer: "https://agent.buildkite.com",
+		jwks: "https://agent.buildkite.com/.well-known/jwks"
+	}
+};
+function text(claims, key) {
+	const value = Object.hasOwn(claims, key) ? claims[key] : void 0;
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
+function fullRef(name, type) {
+	if (name === void 0) return;
+	if (name.startsWith("refs/")) return name;
+	return type === "tag" ? `refs/tags/${name}` : `refs/heads/${name}`;
+}
+function jobClaims(provider, claims) {
+	switch (provider) {
+		case "github": return compact({
+			repository: text(claims, "repository"),
+			ref: text(claims, "ref"),
+			environment: text(claims, "environment")
+		});
+		case "gitlab": return compact({
+			repository: text(claims, "project_path"),
+			ref: fullRef(text(claims, "ref"), text(claims, "ref_type") === "tag" ? "tag" : "branch"),
+			environment: text(claims, "environment")
+		});
+		case "buildkite": {
+			const organization = text(claims, "organization_slug");
+			const pipeline = text(claims, "pipeline_slug");
+			const tag = text(claims, "build_tag");
+			return compact({
+				repository: organization === void 0 || pipeline === void 0 ? void 0 : `${organization}/${pipeline}`,
+				ref: tag === void 0 ? fullRef(text(claims, "build_branch"), "branch") : fullRef(tag, "tag")
+			});
+		}
+		default: return provider;
+	}
+}
+/**
+* Resolves a CI provider's OIDC token (GitHub Actions, GitLab CI, Buildkite)
+* into a `workload` principal whose id is `sub`. Every failure (signature,
+* issuer, audience, expiry, a missing `sub`, the `schema`) is the anonymous
+* subject, never a throw and never a user.
+*/
+async function subjectFromCiOidc(token, options) {
+	if (token === void 0 || token === null || token.length === 0) return anonymousSubject();
+	const known = Object.hasOwn(PROVIDERS, options.provider) ? PROVIDERS[options.provider] : void 0;
+	const issuer = options.issuer ?? known?.issuer;
+	const deny = (cause) => {
+		const header = decodeHeader(token);
+		options.onAuth?.(compact({
+			reason: "invalid-token",
+			cause,
+			source: "ci-oidc",
+			kid: header?.kid,
+			alg: header?.alg,
+			typ: header?.typ,
+			issuer,
+			requestId: options.requestId
+		}));
+		return anonymousSubject();
+	};
+	if (known === void 0 || issuer === void 0) return deny("wrong-issuer");
+	if (options.audience === void 0 || options.audience.length === 0) return deny("wrong-audience");
+	let verifier;
+	try {
+		verifier = options.verifier ?? joseTokenVerifier(options.issuer === void 0 || options.jwks !== void 0 ? {
+			...options,
+			issuer,
+			jwks: options.jwks ?? known.jwks
+		} : {
+			...options,
+			issuer,
+			discovery: issuer
+		});
+	} catch {
+		return deny("malformed");
+	}
+	let verified;
+	try {
+		verified = await verifier.verify(token, compact({
+			typ: ["JWT"],
+			issuer,
+			audience: options.audience,
+			clockTolerance: options.clockTolerance
+		}));
+	} catch {
+		return deny("malformed");
+	}
+	if (!verified.ok) return deny(verified.cause);
+	const sub = text(verified.claims, "sub");
+	if (sub === void 0) return deny("invalid-claims");
+	if (options.schema !== void 0 && !validateCustomClaims(verified.claims, options.schema).ok) return deny("invalid-claims");
+	const principal = {
+		id: sub,
+		kind: "workload",
+		issuer,
+		provider: options.provider,
+		...jobClaims(options.provider, verified.claims)
+	};
+	return freezeDeep({
+		principal,
+		context: {}
+	});
+}
+//#endregion
+//#region src/jwt/dpop.ts
+const DPOP_WINDOW_SECONDS = 60;
+const PROOF_ALGS = /* @__PURE__ */ new Set([
+	"ES256",
+	"PS256",
+	"Ed25519",
+	"EdDSA",
+	"RS256"
+]);
+const PRIVATE_MEMBERS = [
+	"d",
+	"p",
+	"q",
+	"dp",
+	"dq",
+	"qi",
+	"k"
+];
+function headerOf(request) {
+	return request.headers.get("DPoP") ?? request.headers.get("dpop");
+}
+function withoutQuery(value) {
+	if (typeof value !== "string" || !URL.canParse(value)) return null;
+	const url = new URL(value);
+	url.search = "";
+	url.hash = "";
+	return url.href;
+}
+async function claimJti(replay, key, expiresAt) {
+	if (replay.claim !== void 0) return replay.claim(key, expiresAt);
+	if (await replay.seen(key)) return false;
+	await replay.remember(key, expiresAt);
+	return true;
+}
+function verifyDpopProof(request, claims, accessToken, options = {}) {
+	return verify(request, claims, accessToken, options);
+}
+async function verify(request, claims, accessToken, options) {
+	const proof = headerOf(request);
+	if (proof === null || proof.length === 0) return {
+		ok: false,
+		cause: "dpop-proof-invalid"
+	};
+	const expectedJkt = claims["cnf"] !== null && typeof claims["cnf"] === "object" && !Array.isArray(claims["cnf"]) && typeof claims["cnf"].jkt === "string" ? claims["cnf"].jkt : void 0;
+	if (expectedJkt === void 0) return {
+		ok: false,
+		cause: "dpop-proof-invalid"
+	};
+	const header = decodeHeader(proof);
+	if (header?.typ?.toLowerCase() !== "dpop+jwt") return {
+		ok: false,
+		cause: "dpop-proof-invalid"
+	};
+	const jwk = header["jwk"];
+	if (!PROOF_ALGS.has(header.alg ?? "") || jwk === null || typeof jwk !== "object" || Array.isArray(jwk) || PRIVATE_MEMBERS.some((member) => member in jwk)) return {
+		ok: false,
+		cause: "dpop-proof-invalid"
+	};
+	try {
+		const jose = await loadJose();
+		const key = await jose.importJWK(jwk, header.alg);
+		const result = await jose.jwtVerify(proof, key, {
+			typ: "dpop+jwt",
+			maxTokenAge: DPOP_WINDOW_SECONDS
+		});
+		const jkt = await jose.calculateJwkThumbprint(jwk, "sha256");
+		if (jkt !== expectedJkt) return {
+			ok: false,
+			cause: "dpop-proof-invalid"
+		};
+		const htm = result.payload["htm"];
+		const htu = result.payload["htu"];
+		const expectedHtu = withoutQuery(request.url);
+		if (htm !== request.method || expectedHtu === null || withoutQuery(htu) !== expectedHtu) return {
+			ok: false,
+			cause: "dpop-proof-invalid"
+		};
+		if (accessToken !== void 0) {
+			const ath = bytesToBase64Url(sha256(accessToken));
+			if (result.payload["ath"] !== ath) return {
+				ok: false,
+				cause: "dpop-proof-invalid"
+			};
+		}
+		if (options.replay !== void 0) {
+			const jti = result.payload.jti;
+			const iat = result.payload.iat;
+			if (typeof jti !== "string" || jti === "" || typeof iat !== "number" || !await claimJti(options.replay, `dpop\u0000${jkt}\u0000${jti}`, iat + DPOP_WINDOW_SECONDS)) return {
+				ok: false,
+				cause: "dpop-proof-invalid"
+			};
+		}
+		return { ok: true };
+	} catch {
+		return {
+			ok: false,
+			cause: "dpop-proof-invalid"
+		};
+	}
+}
+//#endregion
+//#region src/jwt/introspection.ts
+function emitAuth$1(options, cause) {
+	if (options.onAuth === void 0) return;
+	options.onAuth(compact({
+		reason: "invalid-token",
+		cause,
+		source: "jwt",
+		issuer: options.issuer,
+		requestId: options.requestId
+	}));
+}
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function keyToCnf(key) {
+	if (!isRecord$1(key)) return;
+	if (isRecord$1(key["jwk"])) return { jwk: key["jwk"] };
+	return { jwk: key };
+}
+function introspectionToClaims(body) {
+	const cnf = keyToCnf(body["key"]);
+	return compact({
+		sub: typeof body["sub"] === "string" ? body["sub"] : void 0,
+		iss: typeof body["iss"] === "string" ? body["iss"] : void 0,
+		aud: body["aud"],
+		exp: typeof body["exp"] === "number" ? body["exp"] : void 0,
+		iat: typeof body["iat"] === "number" ? body["iat"] : void 0,
+		nbf: typeof body["nbf"] === "number" ? body["nbf"] : void 0,
+		jti: typeof body["jti"] === "string" ? body["jti"] : void 0,
+		scope: typeof body["scope"] === "string" ? body["scope"] : void 0,
+		authorization_details: body["authorization_details"],
+		access: body["access"],
+		client_id: typeof body["client_id"] === "string" ? body["client_id"] : void 0,
+		roles: body["roles"],
+		groups: body["groups"],
+		entitlements: body["entitlements"],
+		sid: typeof body["sid"] === "string" ? body["sid"] : void 0,
+		acr: typeof body["acr"] === "string" ? body["acr"] : void 0,
+		amr: body["amr"],
+		auth_time: body["auth_time"],
+		act: body["act"],
+		cnf
+	});
+}
+function instanceActor(body) {
+	const id = typeof body["instance_id"] === "string" ? body["instance_id"] : typeof body["client_id"] === "string" ? body["client_id"] : void 0;
+	if (id === void 0) return;
+	return {
+		id,
+		kind: "oauth-client"
+	};
+}
+function attachActor(subject, body, binding) {
+	if (subject.actor !== void 0) return subject;
+	const actor = instanceActor(body);
+	if (actor === void 0) return subject;
+	const principal = subject.principal;
+	if (principal === null) return subject;
+	return freezeDeep({
+		...subject,
+		principal: freezeDeep(compact({
+			...principal,
+			binding: void 0
+		})),
+		actor: freezeDeep(compact({
+			...actor,
+			binding
+		}))
+	});
+}
+/**
+* RFC 7662 leaves `aud` and `iss` optional; a response that names another
+* resource server or issuer than the one configured is not for this API.
+*/
+function boundToConfig(body, options) {
+	if (options.issuer !== void 0 && body["iss"] !== void 0 && body["iss"] !== options.issuer) return false;
+	if (options.audience === void 0) return true;
+	const expected = Array.isArray(options.audience) ? options.audience : [options.audience];
+	const aud = body["aud"];
+	return (typeof aud === "string" ? [aud] : Array.isArray(aud) ? aud : []).some((item) => expected.includes(item));
+}
+function subjectFromIntrospection(response, options = {}) {
+	try {
+		if (!isRecord$1(response) || response["active"] !== true || !boundToConfig(response, options)) return anonymousSubject();
+		const mapped = mapClaimsToSubject(introspectionToClaims(response), options);
+		if (mapped.invalidChain) {
+			emitAuth$1(options, "invalid-chain");
+			return anonymousSubject();
+		}
+		if (mapped.subject.principal === null) return anonymousSubject();
+		return attachActor(mapped.subject, response, mapped.subject.principal.binding);
+	} catch {
+		return anonymousSubject();
+	}
+}
+//#endregion
+//#region src/jwt/signer.ts
+const SIGNING_ALGS = /* @__PURE__ */ new Set([
+	"ES256",
+	"PS256",
+	"Ed25519",
+	"RS256"
+]);
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function publicJwk(key) {
+	const { d: _d, p: _p, q: _q, dp: _dp, dq: _dq, qi: _qi, k: _k, ...pub } = key;
+	return pub;
+}
+function joseTokenSigner(options) {
+	if (options.alg === "HS256" || options.alg === "EdDSA") throw new Error("PermDock: joseTokenSigner refuses HS* and polymorphic EdDSA on outputs.");
+	if (!SIGNING_ALGS.has(options.alg)) throw new Error(`PermDock: unsupported signing alg '${options.alg}'.`);
+	if (options.kid.length === 0) throw new Error("PermDock: joseTokenSigner requires kid.");
+	const importKey = async () => {
+		if (options.key instanceof Uint8Array) throw new TypeError("PermDock: HMAC keys cannot sign PermDock outputs.");
+		return (await loadJose()).importJWK(options.key, options.alg);
+	};
+	return {
+		kid: options.kid,
+		sign(payload, signOptions) {
+			return signJwt(payload, signOptions);
+		},
+		jwks() {
+			if (isRecord(options.key)) return Promise.resolve({ keys: [publicJwk(options.key)] });
+			return Promise.resolve({ keys: [] });
+		}
+	};
+	async function signJwt(payload, signOptions) {
+		const jose = await loadJose();
+		const key = await importKey();
+		const now = Math.floor(Date.now() / 1e3);
+		const jwt = new jose.SignJWT({ ...payload });
+		jwt.setProtectedHeader({
+			alg: options.alg,
+			kid: options.kid,
+			typ: signOptions.typ
+		});
+		jwt.setIssuedAt(now);
+		jwt.setJti(globalThis.crypto.randomUUID());
+		if (options.issuer !== void 0) jwt.setIssuer(options.issuer);
+		if (signOptions.audience !== void 0) jwt.setAudience(signOptions.audience);
+		jwt.setExpirationTime(signOptions.expiresAt ?? now + 3600);
+		return jwt.sign(key);
+	}
+}
+//#endregion
+//#region src/jwt/subject.ts
+function emitAuth(options, cause, token) {
+	if (options.onAuth === void 0) return;
+	const header = token === void 0 ? void 0 : decodeHeader(token);
+	options.onAuth(compact({
+		reason: "invalid-token",
+		cause,
+		source: "jwt",
+		kid: header?.kid,
+		alg: header?.alg,
+		typ: header?.typ,
+		issuer: options.issuer,
+		requestId: options.requestId
+	}));
+}
+function tokenInQuery(request) {
+	if (request === void 0) return false;
+	return new URL(request.url, "https://permdock.invalid").searchParams.has("access_token");
+}
+function mtlsThumbprint(claims) {
+	const cnf = claims["cnf"];
+	if (cnf === null || typeof cnf !== "object" || Array.isArray(cnf)) return;
+	const value = cnf["x5t#S256"];
+	return typeof value === "string" ? value : void 0;
+}
+async function extraMemberships(options, subject, tenant) {
+	if (options.memberships === void 0 || subject.principal === null) return subject;
+	try {
+		const extra = await options.memberships.membershipsFor(compact({
+			id: subject.principal.id,
+			kind: subject.principal.kind
+		}), compact({ tenant }));
+		if (extra.length === 0) return subject;
+		const merged = [...subject.principal.memberships ?? [], ...extra];
+		return freezeDeep({
+			...subject,
+			principal: {
+				...subject.principal,
+				memberships: merged
+			}
+		});
+	} catch {
+		return subject;
+	}
+}
+function subjectFromJwt(token, options, request) {
+	return resolveSubject(token, options, request);
+}
+function createJwtSubjectResolver(options) {
+	assertSubjectConfig(options);
+	const verifier = options.verifier ?? joseTokenVerifier(options);
+	return (token, request) => resolveSubject(token, {
+		...options,
+		verifier
+	}, request);
+}
+async function resolveSubject(token, options, request) {
+	if (options.verifier === void 0) assertSubjectConfig(options);
+	if (token === void 0 || token === null || token.length === 0) return anonymousSubject();
+	if (options.profile === "fapi2" && tokenInQuery(request)) {
+		emitAuth(options, "token-in-query", token);
+		return anonymousSubject();
+	}
+	const verifier = options.verifier ?? joseTokenVerifier(options);
+	const issuer = options.issuer ?? (options.discovery === void 0 ? void 0 : issuerFromDiscovery(options.discovery));
+	let verified;
+	try {
+		verified = await verifier.verify(token, compact({
+			audience: options.audience,
+			issuer,
+			clockTolerance: options.clockTolerance,
+			typ: options.accept === "id-token" ? ["JWT"] : options.profile === "fapi2" ? "at+jwt" : ["at+jwt", "JWT"]
+		}));
+	} catch {
+		verified = fail("malformed");
+	}
+	if (!verified.ok) {
+		emitAuth(options, verified.cause, token);
+		return anonymousSubject();
+	}
+	if (acceptMismatch(verified.claims, verified.header.typ, options, options.audience)) {
+		emitAuth(options, "wrong-token-type", token);
+		return anonymousSubject();
+	}
+	const sender = options.sender ?? (options.profile === "fapi2" ? "dpop" : "none");
+	const cnf = verified.claims["cnf"];
+	const hasCnf = cnf !== null && typeof cnf === "object";
+	if (options.profile === "fapi2" && !hasCnf) {
+		emitAuth(options, "sender-constraint-required", token);
+		return anonymousSubject();
+	}
+	if (sender === "dpop") {
+		const proof = request === void 0 ? {
+			ok: false,
+			cause: "dpop-proof-invalid"
+		} : await verifyDpopProof(request, verified.claims, token, compact({ replay: options.replay }));
+		if (!proof.ok) {
+			emitAuth(options, proof.cause, token);
+			return anonymousSubject();
+		}
+	}
+	if (sender === "mtls") {
+		const expected = options.certificateThumbprint;
+		const seen = mtlsThumbprint(verified.claims);
+		if (expected === void 0 || seen !== expected) {
+			emitAuth(options, "mtls-binding-mismatch", token);
+			return anonymousSubject();
+		}
+	}
+	const mapped = mapClaimsToSubject(verified.claims, options);
+	if (mapped.invalidChain) {
+		emitAuth(options, "invalid-chain", token);
+		return anonymousSubject();
+	}
+	if (mapped.subject.principal === null) {
+		emitAuth(options, "invalid-claims", token);
+		return anonymousSubject();
+	}
+	if (mapped.invalidClaims) emitAuth(options, "invalid-claims", token);
+	return extraMemberships(options, mapped.subject, mapped.subject.principal.tenant);
+}
+//#endregion
+export { createJwtSubjectResolver, joseTokenSigner, joseTokenVerifier, memoryReplayStore, subjectFromCapability, subjectFromCiOidc, subjectFromIntrospection, subjectFromJwt, verifyDpopProof };