AAuth -11 issue #152: presented_token on the auth token endpoint - #10
Merged
Conversation
The agent's auth token request now carries `presented_token` (REQUIRED): the token it presented to the resource — the person token, or on a step-up the auth token — whose jti the resource token's `presented_jti` names. Step 6 of §Resource Token Verification verifies that token under the PS's own key (aud = the resource, cnf.jwk = agent_jkt) and matches ps / sub / mission_s256 / tenant against the resource token, instead of resolving a retained person-token record. The issued auth token never outlives the presented token. - new src/aauth/verify-presented-token.js; verify-resource-token.js keeps only the presence checks and returns presented_jti + agent_jkt - token.js requires presented_token (invalid_request when absent); new error codes invalid_presented_token / expired_presented_token / revoked_presented_token - issue-auth-token.js caps exp at presented_exp - person-token-store.js is retention for revocation only (jti, aud, exp) - tests: mintResourceToken copies from any presented token (person or auth), dual-emits presented_jti by default; step-up, reuse, forged, expired, aud and cnf cases added Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEeAq61zr1oVg5FAFf3JTH
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements dickhardt/AAuth#152 (spec PR dickhardt/AAuth#153) in the mock PS.
presented_token(REQUIRED): the token the agent presented to the resource — the person token, or on a step-up the auth token — named by the resource token'spresented_jti.aud= the resource,cnf.jwkthumbprint =agent_jkt) and matchesps/sub/mission_s256/tenantagainst the resource token. No retained record is consulted; the person-token store is retention only.invalid_presented_token,expired_presented_token,revoked_presented_token. A missingpresented_tokenisinvalid_request.Breaking for agents that do not send
presented_token(@aauth/agent ≤3.0.2). Release as a major when publishing.🤖 Generated with Claude Code
https://claude.ai/code/session_01FEeAq61zr1oVg5FAFf3JTH