agentfootprint
Version:
The explainable agent framework — backtrack a wrong answer to the exact context that caused it (evidence, not guesses). Built on footprintjs.
35 lines • 2.25 kB
TypeScript
/**
* strategies/proxyChoice — `proxy-token`: an authenticating reverse proxy
* (oauth2-proxy, mod_auth_openidc, Pomerium) signs the person in and forwards
* a signed token on every request; the library still VERIFIES it (design §4.4).
*
* It is `oidc-token` token-only with three differences:
* - **No discovery.** Many proxies publish a JWKS but no OpenID discovery
* document, so `IDENTITY_JWKS_URL` is required (https; plain http only on
* this machine outside production) and fetched without following a
* redirect, and `IDENTITY_ISSUER` is a literal compared exactly.
* - **A configurable header** (`IDENTITY_PROXY_HEADER`, default
* `authorization`, read as `Bearer …`; any other header is the raw token).
* - **Only an ACCESS token for this API** (`IDENTITY_PROXY_TOKEN=access-token`,
* required). An ID token's audience is the proxy's own client and it carries
* no scope, so the person test could not run on it; forwarding one is refused
* at boot. The whole person test and the client check apply —
* `IDENTITY_ALLOWED_CLIENTS` names the proxy's client.
*
* **Every door is hardened (design §3, H1).** The browser's credential here is
* the PROXY's cookie (or a Windows login), which the proxy turns into a valid
* header on every request it forwards — forged cross-site ones included. So
* `proxy-token` refuses to start without the host's door guard lists
* (`boot.crossSite`): `allowedHosts` set (unless the public URL is this
* machine), never `'any'`, the JSON rule on, and the public URL passing them.
*
* What the library cannot check: that the proxy was on the path. A person who
* reaches the app port directly with their OWN valid token skips whatever the
* proxy enforces beyond identity (MFA step-up, device posture, per-route
* rules). So the app port must be reachable only from the proxy, and any
* authorization that must hold is repeated in the library.
*/
import { type IdentityConfig } from './config.js';
import { type IdentityBootOptions, type IdentityChoice } from './choose.js';
export declare function proxyTokenChoice(config: IdentityConfig, boot: IdentityBootOptions, production: boolean): IdentityChoice;
//# sourceMappingURL=proxyChoice.d.ts.map