Arbiter
Repositories
3
 Projects Packages

@arbiter/oauth-s2s (0.1.9)

Published 2026-08-06 23:24:12 +00:00 by Dvorak

Installation

@arbiter:registry=https://hub.kl1.tenere.ai/api/packages/Arbiter/npm/
npm install @arbiter/oauth-s2s@0.1.9
"@arbiter/oauth-s2s": "0.1.9"

About this package

@arbiter/oauth-s2s

OAuth server-to-server / workload-identity / WIMSE / SPIFFE spec cluster. Pure protocol logic, independent of the HTTP layer.

Specs covered

  • draft-ietf-wimse-s2s-protocol — WIT issuance, WPT verification, HTTP-signature proof, mTLS workload binding
  • draft-ietf-wimse-arch
  • draft-mw-spice-actor-chain
  • draft-klrc-aiagent-auth
  • spiffe-spire — node attestation, workload SVID, federation bundles
  • draft-ietf-oauth-transaction-tokens, RFC 8693 (token exchange), RFC 9396 (RAR)
  • OAuth 2.1 profile (via the oauthService port)

Conformance matrices and full spec text live in docs/standards/wimse-oauth/.

The port

The single external dependency is an oauthService exposing exactly three methods:

{
  generateToken(payload) -> signed token
  isTokenActive(jti) -> boolean
  resolveTokenRecord(jti) -> token record
}

Persistence backends (ReplayStore, FileBackedMapStore) are injectable and default to in-memory.

Usage

import { WorkloadSecurityService } from '@arbiter/oauth-s2s';

const svc = new WorkloadSecurityService({
  oauthService,
  trustDomain: 'prod.example.com',
  enforceSecureTrustAnchor: true,
  closedEnvironment: true
});

const wit = svc.issueWorkloadIdentityToken({
  workload_id: 'spiffe://prod.example.com/tenant/t1/app/a1/ns/sa/svc',
  audience: 'https://service.example.com'
});

Layout

  • src/services/WorkloadSecurityService.js — facade over the three domain services
  • src/services/s2s/ — compact token, replay store, HTTP-signature header/input, proof policy
  • src/services/workload/ — identity, proof, and federation domain services (+ functional/ pure models)
  • src/services/FileBackedMapStore.js — durable map backend
  • docs/standards/wimse-oauth/ — spec matrices + full text

Test

npm test          # unit tests + rigor property campaigns
npm run test:rigor # rigor campaigns only

Property-test coverage (js-rigor)

The tests/rigor/ directory holds deterministic, seeded property campaigns that probe the security-critical invariants of every spec surface:

File Campaigns
wimse-workload-identity.rigor.test.js SPIFFE workload-id parse/validate + round-trip (combined), WIT reserved-claim override + open-env registered-claim enforcement (combined), mTLS workload binding
wimse-wpt-http-signature.rigor.test.js WPT claim/TTL/wth/ath/tth/oth/audience/replay, Signature-Input keyid/alg/tag/temporal/nonce, HTTP-signature mandatory components + Content-Digest-signed-when-present, content-digest, compact-token tamper integrity, documented created/expires/nonce leniency
wimse-bootstrap-spiffe.rigor.test.js HTTPS bootstrap start/consume single-use, ttl bounds, key-rotation expected-version + lineage, key-overlap allowlist: active+previous accepted, unknown denied (S2S-024), trust-anchor https/integrity, federation endpoint validation, SPIFFE/SPIRE attestation→registration→SVID
wimse-replay-x509-read.rigor.test.js ReplayStore single-use/expiry/eviction, durable replay across restart via file-backed store (S2S-018/022/025), X509-SVID SAN/ca/usages/chain/expiry, workload-identity read allowlist, hash + token structure
wimse-s2s-txn-jwtsvid-bootstrap.rigor.test.js txn-token chain propagation + no-authz-fallback (S2S-005/007, TXN-008), signature label binding (S2S-013), unknown WIT claims ignored (S2S-014), bootstrap context binding (S2S-029), rotation version semantics (S2S-030), JWT-SVID alg/claims (SS-008/009), bundle-by-trust-domain (SS-014), watch cursor semantics (SS-024), one-TTS-per-domain (TXN-010)
wimse-crypto-bundle.rigor.test.js real EC detached-signature vs cnf.jwk (S2S-027), WPT header alg MUST equal WIT cnf.jwk.alg (draft §3.1.1), jwt-svid-only bundle (SS-015), bundle redaction fails closed (SS-013), unauthorized identity read (SS-016)
wimse-lineage-proofkey.rigor.test.js single-outstanding bootstrap lineage guard (S2S-028), WIT proof-key EC/x/y policy, detached-signature real-vs-tampered (S2S-004)
wimse-workloadapi-txn-lifecycle.rigor.test.js Workload API full-state + advancing stream sequence (SS-011), x509-svid-only bundle (SS-015), txn-token active/inactive lifecycle (TXN-002) + stable fingerprint, issued-WIT claim contract (iss/sub/cnf/wit+jwt typ/bounded exp) + record-live-before-exp gate
wimse-interactions.rigor.test.js combined stateful cross-method campaigns: I1 issue WIT → real detached-signature proof → strict replay rejection (S2S-004/010); I2 rotate → bootstrap with overlap key → consume-bound key (S2S-024/029); I3 attest → register → issue SVID → selector rotation invalidation (SS-020); I4 txn-chain start/continue/stale (S2S-005); I5 delegated-subject binding (KLRC-09); I6 verify-lenient vs authorize-strict contrast + policy/keyring/remove read surfaces

Dependencies

Development Dependencies

ID Version
@rigor/core ^3.1.2

Keywords

oauth s2s wimse workload-identity spiffe spire transaction-token http-signature authorization
Details
npm
2026-08-06 23:24:12 +00:00
5
ISC
36 KiB
Assets (1)
oauth-s2s-0.1.9.tgz 36 KiB
Versions (11) View all
0.1.10 2026-08-06
0.1.9 2026-08-06
0.1.8 2026-08-06
0.1.7 2026-08-06
0.1.6 2026-08-06