agentfootprint/dist/esm/adapters/identity/strategies/proxyChoice.d.ts

The explainable agent framework — backtrack a wrong answer to the exact context that caused it (evidence, not guesses). Built on footprintjs.

/**
 * strategies/proxyChoice — `proxy-token`: an authenticating reverse proxy
 * (oauth2-proxy, mod_auth_openidc, Pomerium) signs the person in and forwards
 * a signed token on every request; the library still VERIFIES it (design §4.4).
 *
 * It is `oidc-token` token-only with three differences:
 *  - **No discovery.** Many proxies publish a JWKS but no OpenID discovery
 *    document, so `IDENTITY_JWKS_URL` is required (https; plain http only on
 *    this machine outside production) and fetched without following a
 *    redirect, and `IDENTITY_ISSUER` is a literal compared exactly.
 *  - **A configurable header** (`IDENTITY_PROXY_HEADER`, default
 *    `authorization`, read as `Bearer …`; any other header is the raw token).
 *  - **Only an ACCESS token for this API** (`IDENTITY_PROXY_TOKEN=access-token`,
 *    required). An ID token's audience is the proxy's own client and it carries
 *    no scope, so the person test could not run on it; forwarding one is refused
 *    at boot. The whole person test and the client check apply —
 *    `IDENTITY_ALLOWED_CLIENTS` names the proxy's client.
 *
 * **Every door is hardened (design §3, H1).** The browser's credential here is
 * the PROXY's cookie (or a Windows login), which the proxy turns into a valid
 * header on every request it forwards — forged cross-site ones included. So
 * `proxy-token` refuses to start without the host's door guard lists
 * (`boot.crossSite`): `allowedHosts` set (unless the public URL is this
 * machine), never `'any'`, the JSON rule on, and the public URL passing them.
 *
 * What the library cannot check: that the proxy was on the path. A person who
 * reaches the app port directly with their OWN valid token skips whatever the
 * proxy enforces beyond identity (MFA step-up, device posture, per-route
 * rules). So the app port must be reachable only from the proxy, and any
 * authorization that must hold is repeated in the library.
 */
import { type IdentityConfig } from './config.js';
import { type IdentityBootOptions, type IdentityChoice } from './choose.js';
export declare function proxyTokenChoice(config: IdentityConfig, boot: IdentityBootOptions, production: boolean): IdentityChoice;