@arbiter/oauth-s2s (0.1.3)
Published 2026-08-05 22:43:39 +00:00 by Dvorak
Installation
@arbiter:registry=https://hub.kl1.tenere.ai/api/packages/Arbiter/npm/npm install @arbiter/oauth-s2s@0.1.3"@arbiter/oauth-s2s": "0.1.3"About this package
@arbiter/oauth-s2s
OAuth server-to-server / workload-identity / WIMSE / SPIFFE spec cluster. Pure protocol logic, independent of the HTTP layer.
Specs covered
- draft-ietf-wimse-s2s-protocol — WIT issuance, WPT verification, HTTP-signature proof, mTLS workload binding
- draft-ietf-wimse-arch
- draft-mw-spice-actor-chain
- draft-klrc-aiagent-auth
- spiffe-spire — node attestation, workload SVID, federation bundles
- draft-ietf-oauth-transaction-tokens, RFC 8693 (token exchange), RFC 9396 (RAR)
- OAuth 2.1 profile (via the oauthService port)
Conformance matrices and full spec text live in docs/standards/wimse-oauth/.
The port
The single external dependency is an oauthService exposing exactly three
methods:
{
generateToken(payload) -> signed token
isTokenActive(jti) -> boolean
resolveTokenRecord(jti) -> token record
}
Persistence backends (ReplayStore, FileBackedMapStore) are injectable and
default to in-memory.
Usage
import { WorkloadSecurityService } from '@arbiter/oauth-s2s';
const svc = new WorkloadSecurityService({
oauthService,
trustDomain: 'prod.example.com',
enforceSecureTrustAnchor: true,
closedEnvironment: true
});
const wit = svc.issueWorkloadIdentityToken({
workload_id: 'spiffe://prod.example.com/tenant/t1/app/a1/ns/sa/svc',
audience: 'https://service.example.com'
});
Layout
src/services/WorkloadSecurityService.js— facade over the three domain servicessrc/services/s2s/— compact token, replay store, HTTP-signature header/input, proof policysrc/services/workload/— identity, proof, and federation domain services (+functional/pure models)src/services/FileBackedMapStore.js— durable map backenddocs/standards/wimse-oauth/— spec matrices + full text
Test
npm test # unit tests + rigor property campaigns
npm run test:rigor # rigor campaigns only
Property-test coverage (js-rigor)
The tests/rigor/ directory holds deterministic, seeded property campaigns that
probe the security-critical invariants of every spec surface:
| File | Campaigns |
|---|---|
wimse-workload-identity.rigor.test.js |
SPIFFE workload-id parse/validate, WIT reserved-claim override, WIT registered-claim enforcement (open env), mTLS workload binding |
wimse-wpt-http-signature.rigor.test.js |
WPT claim/TTL/wth/ath/tth/oth/audience/replay, Signature-Input keyid/alg/tag/temporal/nonce, HTTP-signature mandatory components, content-digest, compact-token tamper integrity |
wimse-bootstrap-spiffe.rigor.test.js |
HTTPS bootstrap start/consume single-use, ttl bounds, key-rotation expected-version + lineage, trust-anchor https/integrity, federation endpoint validation, SPIFFE/SPIRE attestation→registration→SVID |
wimse-replay-x509-read.rigor.test.js |
ReplayStore single-use/expiry/eviction, X509-SVID SAN/ca/usages/chain/expiry, workload-identity read allowlist, hash + token structure |
wimse-s2s-txn-jwtsvid-bootstrap.rigor.test.js |
txn-token chain propagation + no-authz-fallback (S2S-005/007, TXN-008), signature label binding (S2S-013), unknown WIT claims ignored (S2S-014), bootstrap context binding (S2S-029), rotation version semantics (S2S-030), JWT-SVID alg/claims (SS-008/009), bundle-by-trust-domain (SS-014), watch cursor semantics (SS-024), one-TTS-per-domain (TXN-010) |
wimse-crypto-bundle.rigor.test.js |
real EC detached-signature vs cnf.jwk (S2S-027), jwt-svid-only bundle (SS-015), bundle redaction fails closed (SS-013), unauthorized identity read (SS-016) |
wimse-lineage-proofkey.rigor.test.js |
single-outstanding bootstrap lineage guard (S2S-028), WIT proof-key EC/x/y policy, detached-signature real-vs-tampered (S2S-004) |
Dependencies
Development Dependencies
| ID | Version |
|---|---|
| @rigor/core | ^3.1.2 |
Keywords
oauth
s2s
wimse
workload-identity
spiffe
spire
transaction-token
http-signature
authorization