permdock 0.3.1 → 0.4.0

package/dist/validity-dVrUEPJt.js

@@ -0,0 +1,62 @@
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { c as ownKeys, o as isForbiddenKey, s as ownGet } from "./thenable-QSmvt-vZ.js";
+//#region src/core/fields.ts
+function sanitizeFields(fields) {
+	if (fields === void 0) return;
+	return fields.filter((field) => field.length > 0 && !isForbiddenKey(field));
+}
+function grantCoversField(fields, field, effect) {
+	if (fields === void 0) return true;
+	if (fields.length === 0) return false;
+	if (field === void 0) return effect === "allow";
+	return fields.includes(field);
+}
+function pickVisible(row, canField) {
+	const out = {};
+	for (const key of ownKeys(row)) if (canField(key)) out[key] = ownGet(row, key);
+	return freezeDeep(out);
+}
+function sanitizeContext(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return {};
+	const out = {};
+	for (const key of ownKeys(value)) out[key] = ownGet(value, key);
+	return out;
+}
+//#endregion
+//#region src/core/validity.ts
+/**
+* An instant as Unix seconds: a finite number is taken as seconds already, a
+* string must parse as RFC 3339. Anything else is `undefined`, and the caller
+* decides whether that is "absent" or an error.
+*/
+function instantOf(input) {
+	if (typeof input === "number") return Number.isFinite(input) ? Math.floor(input) : void 0;
+	if (typeof input !== "string" || input.trim() === "") return;
+	const millis = Date.parse(input);
+	return Number.isFinite(millis) ? Math.floor(millis / 1e3) : void 0;
+}
+/**
+* The normalised validity of a grant, or `undefined` when neither bound is
+* set. Fail-closed at definition time: a bound that does not parse, or a
+* window that ends before it starts, throws so a typo never widens a grant.
+*/
+function normalizeValidity(options, permissionKey) {
+	const from = options.validFrom === void 0 ? void 0 : instantOf(options.validFrom);
+	const until = options.validUntil === void 0 ? void 0 : instantOf(options.validUntil);
+	if (options.validFrom !== void 0 && from === void 0) throw new Error(`PermDock: validFrom on '${permissionKey}' must be an RFC 3339 string or Unix seconds`);
+	if (options.validUntil !== void 0 && until === void 0) throw new Error(`PermDock: validUntil on '${permissionKey}' must be an RFC 3339 string or Unix seconds`);
+	if (from !== void 0 && until !== void 0 && until <= from) throw new Error(`PermDock: validUntil on '${permissionKey}' must be after validFrom`);
+	if (from === void 0 && until === void 0) return;
+	return Object.freeze({
+		...from === void 0 ? {} : { from },
+		...until === void 0 ? {} : { until }
+	});
+}
+/** Whether a grant with this validity applies at `now` (Unix seconds); no validity always applies. */
+function isActive(validity, now) {
+	if (validity === void 0) return true;
+	if (validity.from !== void 0 && now < validity.from) return false;
+	return validity.until === void 0 || now < validity.until;
+}
+//#endregion
+export { sanitizeContext as a, pickVisible as i, normalizeValidity as n, sanitizeFields as o, grantCoversField as r, isActive as t };

package/dist/{verifier-BxBo6I44.js → verifier-DMr_Zmb_.js}

@@ -1,5 +1,5 @@
-import { n as isReadonlyArray, t as compact } from "./compact-y6vfu2_f.js";
-import { T as isForbiddenKey, k as splitPath } from "./permissions-DVoF6dMt.js";
+import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
+import { o as isForbiddenKey, u as splitPath } from "./thenable-QSmvt-vZ.js";
 import { t as loadJose } from "./load-jose-BL6LH4bL.js";
 //#region src/jwt/header.ts
 function compactParts(token) {
@@ -325,6 +325,50 @@ function createKeyCache(options) {
 	};
 }
 //#endregion
+//#region src/jwt/decrypt.ts
+const CONTENT_ENCRYPTION = [
+	"A128GCM",
+	"A192GCM",
+	"A256GCM"
+];
+function configuredKeys(listed) {
+	return "keys" in listed && Array.isArray(listed.keys) ? listed.keys : [listed];
+}
+function isObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** Whether `key` may decrypt a token with this header: encryption use, matching `alg` and `kid`, and private material. */
+function mayDecrypt(key, header) {
+	if (!isObject(key)) return false;
+	if (key["use"] !== void 0 && key["use"] !== "enc") return false;
+	if (key["alg"] !== void 0 && key["alg"] !== header.alg) return false;
+	if (header.kid !== void 0 && key["kid"] !== header.kid) return false;
+	if (key["kty"] === "oct") return typeof key["k"] === "string";
+	return typeof key["d"] === "string";
+}
+/**
+* The inner JWS of a nested JWE, decrypted with the first configured private
+* key that opens it, or `undefined`. Never throws; the caller has already
+* refused `zip`, `RSA1_5` and a missing `cty: JWT`.
+*/
+async function decryptWithKeys(jose, token, header, options) {
+	if (options.decryptionKeys === void 0 || header.alg === void 0) return;
+	const keyManagementAlgorithms = [...options.decryptionAlgorithms ?? DEFAULT_DECRYPTION_ALGS].filter((alg) => alg !== "RSA1_5");
+	for (const jwk of configuredKeys(options.decryptionKeys)) {
+		if (!mayDecrypt(jwk, header)) continue;
+		try {
+			const key = await jose.importJWK(jwk, header.alg);
+			const { plaintext } = await jose.compactDecrypt(token, key, {
+				keyManagementAlgorithms,
+				contentEncryptionAlgorithms: [...CONTENT_ENCRYPTION]
+			});
+			return new TextDecoder().decode(plaintext);
+		} catch {
+			continue;
+		}
+	}
+}
+//#endregion
 //#region src/jwt/verifier.ts
 const ACCESS_TYPS = /* @__PURE__ */ new Set(["at+jwt", "jwt"]);
 const FAPI2_TYPS = /* @__PURE__ */ new Set(["at+jwt"]);
@@ -412,19 +456,11 @@ function joseTokenVerifier(options) {
 		if (options.decryptionKeys === void 0) return fail("encrypted-token");
 		const header = decodeHeader(token);
 		if (header?.zip !== void 0 || header?.alg === "RSA1_5" || header?.cty === void 0 || normalizeTyp(header.cty) !== "jwt") return fail("encrypted-token");
-		const jose = await loadJose();
-		try {
-			const listed = options.decryptionKeys;
-			const first = ("keys" in listed && Array.isArray(listed.keys) ? listed.keys : [listed])[0];
-			if (first === void 0 || first["kty"] !== "oct" || typeof first["k"] !== "string") return fail("encrypted-token");
-			const { plaintext } = await jose.compactDecrypt(token, jose.base64url.decode(first["k"]), { keyManagementAlgorithms: [...options.decryptionAlgorithms ?? DEFAULT_DECRYPTION_ALGS].filter((alg) => alg !== "RSA1_5") });
-			return {
-				ok: true,
-				jwt: new TextDecoder().decode(plaintext)
-			};
-		} catch {
-			return fail("encrypted-token");
-		}
+		const jwt = await decryptWithKeys(await loadJose(), token, header, options);
+		return jwt === void 0 ? fail("encrypted-token") : {
+			ok: true,
+			jwt
+		};
 	};
 	return { verify(token, expectations = {}) {
 		return verifyToken(token, expectations);