48e50f27b3
H1: Replace HS256/HMAC signing with real JWK signing (ES256/RS256/ES384)
via jose SignJWT. Algorithm derived from JWK kty/crv. Provisioner
password dropped as signing input; kept only as optional env var for
PBES2-decrypt path at startup.
H2: Clamp cert TTL to 900s (15 min) in both DTO validator and issueCert().
Default changed to 300s (5 min). @Max reduced to 15*60.
H3: Real CSR validation via @peculiar/x509: parse PEM, verify self-
signature, reject weak keys (RSA<2048, bad EC curves), reject MD5/SHA-1.
New validateCsr() throws CaServiceError code INVALID_CSR on failure.
H4: Replace hardcoded \x24 DER length in federation.tpl with dynamic
printf "%c" (len ...) encoding. Add UUID-shape validation for grantId
and subjectUserId in buildOtt() with code INVALID_GRANT_ID.
H5: Load JWK into KeyObject once (lazy, cached). provisionerKeyJson raw
string not stored as class field. provisionerPassword not stored.
M1: Set JWT sub to CSR CN (extracted via @peculiar/x509) instead of URL.
M2: Add jti: crypto.randomUUID() to OTT claims.
M3: Drop top-level sha claim; keep only step.sha.
M4: extractSerial() throws CaServiceError code CERT_PARSE instead of
returning 'unknown' on failure.
M5: Set timeout: 5000 on https.RequestOptions + req.setTimeout(5000).
M6: OTT signature verified with jose.jwtVerify in tests. Added real P-256
CSR test via @peculiar/x509 generator. Added provisionerPassword
leak-check test.
M7: Constructor validates STEP_CA_URL must be https://.
Verification: typecheck ✓, 385 tests pass (16 new), lint ✓, format ✓.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
93 lines
2.8 KiB
JSON
93 lines
2.8 KiB
JSON
{
|
|
"name": "@mosaicstack/gateway",
|
|
"version": "0.0.6",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://git.mosaicstack.dev/mosaicstack/stack.git",
|
|
"directory": "apps/gateway"
|
|
},
|
|
"type": "module",
|
|
"main": "dist/main.js",
|
|
"bin": {
|
|
"mosaic-gateway": "dist/main.js"
|
|
},
|
|
"files": [
|
|
"dist"
|
|
],
|
|
"publishConfig": {
|
|
"registry": "https://git.mosaicstack.dev/api/packages/mosaicstack/npm/",
|
|
"access": "public"
|
|
},
|
|
"scripts": {
|
|
"build": "tsc",
|
|
"dev": "tsx watch src/main.ts",
|
|
"lint": "eslint src",
|
|
"typecheck": "tsc --noEmit -p tsconfig.typecheck.json",
|
|
"test": "vitest run --passWithNoTests"
|
|
},
|
|
"dependencies": {
|
|
"@anthropic-ai/sdk": "^0.80.0",
|
|
"@fastify/helmet": "^13.0.2",
|
|
"@mariozechner/pi-ai": "^0.65.0",
|
|
"@mariozechner/pi-coding-agent": "^0.65.0",
|
|
"@modelcontextprotocol/sdk": "^1.27.1",
|
|
"@mosaicstack/auth": "workspace:^",
|
|
"@mosaicstack/brain": "workspace:^",
|
|
"@mosaicstack/config": "workspace:^",
|
|
"@mosaicstack/coord": "workspace:^",
|
|
"@mosaicstack/db": "workspace:^",
|
|
"@mosaicstack/discord-plugin": "workspace:^",
|
|
"@mosaicstack/log": "workspace:^",
|
|
"@mosaicstack/memory": "workspace:^",
|
|
"@mosaicstack/queue": "workspace:^",
|
|
"@mosaicstack/storage": "workspace:^",
|
|
"@mosaicstack/telegram-plugin": "workspace:^",
|
|
"@mosaicstack/types": "workspace:^",
|
|
"@nestjs/common": "^11.0.0",
|
|
"@nestjs/core": "^11.0.0",
|
|
"@nestjs/platform-fastify": "^11.0.0",
|
|
"@nestjs/platform-socket.io": "^11.0.0",
|
|
"@nestjs/throttler": "^6.5.0",
|
|
"@nestjs/websockets": "^11.0.0",
|
|
"@opentelemetry/auto-instrumentations-node": "^0.72.0",
|
|
"@opentelemetry/exporter-metrics-otlp-http": "^0.213.0",
|
|
"@opentelemetry/exporter-trace-otlp-http": "^0.213.0",
|
|
"@opentelemetry/resources": "^2.6.0",
|
|
"@opentelemetry/sdk-metrics": "^2.6.0",
|
|
"@opentelemetry/sdk-node": "^0.213.0",
|
|
"@opentelemetry/semantic-conventions": "^1.40.0",
|
|
"@peculiar/x509": "^2.0.0",
|
|
"@sinclair/typebox": "^0.34.48",
|
|
"better-auth": "^1.5.5",
|
|
"bullmq": "^5.71.0",
|
|
"class-transformer": "^0.5.1",
|
|
"class-validator": "^0.15.1",
|
|
"dotenv": "^17.3.1",
|
|
"fastify": "^5.0.0",
|
|
"ioredis": "^5.10.0",
|
|
"jose": "^6.2.2",
|
|
"node-cron": "^4.2.1",
|
|
"openai": "^6.32.0",
|
|
"postgres": "^3.4.8",
|
|
"reflect-metadata": "^0.2.0",
|
|
"rxjs": "^7.8.0",
|
|
"socket.io": "^4.8.0",
|
|
"uuid": "^11.0.0",
|
|
"zod": "^4.3.6"
|
|
},
|
|
"devDependencies": {
|
|
"@nestjs/testing": "^11.1.18",
|
|
"@swc/core": "^1.15.24",
|
|
"@swc/helpers": "^0.5.21",
|
|
"@types/node": "^22.0.0",
|
|
"@types/node-cron": "^3.0.11",
|
|
"@types/supertest": "^7.2.0",
|
|
"@types/uuid": "^10.0.0",
|
|
"supertest": "^7.2.2",
|
|
"tsx": "^4.0.0",
|
|
"typescript": "^5.8.0",
|
|
"unplugin-swc": "^1.5.9",
|
|
"vitest": "^2.0.0"
|
|
}
|
|
}
|