fix: throttle sponsor proof verification

Author: kjgbot

packages/server/src/__tests__/sponsor-oidc-binding.test.ts

@@ -5,6 +5,7 @@ import type { AddressInfo } from "node:net";
 import test from "node:test";
 import type { AgentIdentity, SponsorProof } from "@relayauth/types";
 import { observerBus, type ObserverEvent } from "../lib/events.js";
+import { FixedWindowRateLimiter } from "../lib/rate-limit.js";
 import {
   assertJsonResponse,
   createTestApp,
@@ -31,8 +32,8 @@ type CreatedIdentity = AgentIdentity & {
   sponsorChain: string[];
 };
 
-function signIdToken(claims: Record<string, unknown>): string {
-  const header = Buffer.from(JSON.stringify({ alg: "RS256", typ: "JWT", kid: OIDC_KID }))
+function signIdToken(claims: Record<string, unknown>, kid = OIDC_KID): string {
+  const header = Buffer.from(JSON.stringify({ alg: "RS256", typ: "JWT", kid }))
     .toString("base64url");
   const payload = Buffer.from(JSON.stringify(claims)).toString("base64url");
   const signingInput = `${header}.${payload}`;
@@ -41,11 +42,17 @@ function signIdToken(claims: Record<string, unknown>): string {
   return `${signingInput}.${signature}`;
 }
 
-async function startOidcFixture(t: test.TestContext): Promise<{ issuer: string }> {
+async function startOidcFixture(
+  t: test.TestContext,
+  cacheControl = "public, max-age=60",
+): Promise<{ issuer: string; requestCount(path: string): number }> {
   let issuer = "";
+  const requestCounts = new Map<string, number>();
   const server = createServer((request, response) => {
+    const path = request.url ?? "";
+    requestCounts.set(path, (requestCounts.get(path) ?? 0) + 1);
     response.setHeader("content-type", "application/json");
-    response.setHeader("cache-control", "public, max-age=60");
+    response.setHeader("cache-control", cacheControl);
     if (request.url === "/.well-known/openid-configuration") {
       response.end(JSON.stringify({ issuer, jwks_uri: `${issuer}/jwks` }));
       return;
@@ -67,7 +74,10 @@ async function startOidcFixture(t: test.TestContext): Promise<{ issuer: string }
   t.after(() => new Promise<void>((resolve, reject) => {
     server.close((error) => error ? reject(error) : resolve());
   }));
-  return { issuer };
+  return {
+    issuer,
+    requestCount: (path: string) => requestCounts.get(path) ?? 0,
+  };
 }
 
 function adminAuthorization(org: string): HeadersInit {
@@ -404,6 +414,83 @@ test("sponsor proof requires a valid intent", async (t) => {
   }
 });
 
+test("sponsor proof is rate limited per organization and API key", async (t) => {
+  const { issuer } = await startOidcFixture(t);
+  const org = "org_oidc_proof_rate_limit";
+  const app = createTestApp(
+    {
+      RELAYAUTH_SPONSOR_FEDERATIONS: JSON.stringify({
+        [org]: { sponsorBinding: "oidc", issuer, clientId: "chief-fixture" },
+      }),
+    },
+    { identityCreateRateLimiter: new FixedWindowRateLimiter(1, 60_000) },
+  );
+  const apiKey = await createWorkspaceApiKey(app, org);
+  const now = Math.floor(Date.now() / 1000);
+  const request = () => app.request(
+    createTestRequest(
+      "POST",
+      "/v1/sponsors/proof",
+      {
+        idToken: signIdToken({
+          iss: issuer,
+          sub: "alice",
+          aud: "chief-fixture",
+          iat: now,
+          exp: now + 300,
+        }),
+        intent: "approval",
+      },
+      { "x-api-key": apiKey },
+    ),
+    undefined,
+    app.bindings,
+  );
+
+  await assertJsonResponse<SponsorProof>(await request(), 201);
+  const refused = await request();
+  const body = await assertJsonResponse<{ code: string }>(refused, 429);
+  assert.equal(body.code, "rate_limited");
+  assert.equal(refused.headers.get("retry-after"), "60");
+});
+
+test("unknown OIDC kids cannot bypass JWKS cache or forced-refresh cooldown", async (t) => {
+  const { issuer, requestCount } = await startOidcFixture(t, "public, max-age=0");
+  const org = "org_oidc_jwks_refresh_limit";
+  const app = createTestApp({
+    RELAYAUTH_SPONSOR_FEDERATIONS: JSON.stringify({
+      [org]: { sponsorBinding: "oidc", issuer, clientId: "chief-fixture" },
+    }),
+  });
+  const apiKey = await createWorkspaceApiKey(app, org);
+  const now = Math.floor(Date.now() / 1000);
+  const proofRequest = (kid: string) => app.request(
+    createTestRequest(
+      "POST",
+      "/v1/sponsors/proof",
+      {
+        idToken: signIdToken({
+          iss: issuer,
+          sub: "alice",
+          aud: "chief-fixture",
+          iat: now,
+          exp: now + 300,
+        }, kid),
+        intent: "approval",
+      },
+      { "x-api-key": apiKey },
+    ),
+    undefined,
+    app.bindings,
+  );
+
+  await assertJsonResponse<SponsorProof>(await proofRequest(OIDC_KID), 201);
+  await assertJsonResponse<{ code: string }>(await proofRequest("attacker-kid-1"), 403);
+  await assertJsonResponse<{ code: string }>(await proofRequest("attacker-kid-2"), 403);
+  assert.equal(requestCount("/.well-known/openid-configuration"), 1);
+  assert.equal(requestCount("/jwks"), 2);
+});
+
 test("OIDC subject mapping is collision-free for raw and encoded-looking values", async (t) => {
   const { issuer } = await startOidcFixture(t);
   const org = "org_oidc_subject_encoding";

packages/server/src/__tests__/storage-sqlite.test.ts

@@ -567,6 +567,35 @@ test("TestSqliteIdentityCRUD", async (t) => {
   assert.deepEqual(afterDelete, []);
 });
 
+test("TestSqliteIdentityRejectsMalformedOidcSponsorBinding", async (t) => {
+  const { storage } = createTempStorage(t);
+
+  await assert.rejects(
+    storage.identities.create({
+      id: "agent_invalid_oidc_binding",
+      name: "Invalid OIDC Binding",
+      type: "agent",
+      orgId: "org_invalid_oidc_binding",
+      status: "active",
+      createdAt: "2026-08-08T20:00:00.000Z",
+      updatedAt: "2026-08-08T20:00:00.000Z",
+      workspaceId: "ws_invalid_oidc_binding",
+      sponsorId: "user_invalid",
+      sponsorChain: ["user_invalid", "agent_invalid_oidc_binding"],
+      sponsorBinding: {
+        mode: "oidc",
+        issuer: "",
+        subject: "subject",
+        iat: 1,
+      },
+      scopes: [],
+      roles: [],
+      metadata: {},
+    }),
+    (error: unknown) => error instanceof StorageError && error.code === "invalid_sponsor_binding",
+  );
+});
+
 test("TestSqliteIdentitySuspendRetire", async (t) => {
   const { storage } = createTempStorage(t);
 

packages/server/src/lib/sponsor-binding.ts

@@ -19,7 +19,9 @@ const MAX_GRANT_TTL_SECONDS = 900;
 const DEFAULT_ID_TOKEN_MAX_AGE_SECONDS = 300;
 const DEFAULT_CLOCK_SKEW_SECONDS = 60;
 const DEFAULT_JWKS_CACHE_SECONDS = 300;
+const MIN_JWKS_CACHE_SECONDS = 30;
 const MAX_JWKS_CACHE_SECONDS = 3600;
+const JWKS_FORCED_REFRESH_COOLDOWN_MS = 30_000;
 const FETCH_TIMEOUT_MS = 5_000;
 const SPONSOR_ID_PATTERN = /^user_[A-Za-z0-9_-]+$/u;
 const SPONSOR_INTENT_PATTERN = /^[a-z][a-z0-9]*(?:[._:-][a-z0-9]+)*$/u;
@@ -145,6 +147,7 @@ export class SponsorBindingError extends Error {
 export class SponsorOidcService {
   readonly #jwksCache = new Map<string, CachedJwks>();
   readonly #discoveryCache = new Map<string, { expiresAt: number; jwksUri: string }>();
+  readonly #jwksForcedRefreshAt = new Map<string, number>();
 
   resolveConfig(env: SponsorBindingEnv, orgId: string): SponsorFederationConfig {
     const raw = env.RELAYAUTH_SPONSOR_FEDERATIONS?.trim();
@@ -197,7 +200,7 @@ export class SponsorOidcService {
 
     let jwks = await this.#resolveJwks(config, false);
     let key = selectVerificationKey(jwks, header.kid);
-    if (!key && !config.jwks) {
+    if (!key && !config.jwks && this.#canForceRefresh(config.issuer)) {
       jwks = await this.#resolveJwks(config, true);
       key = selectVerificationKey(jwks, header.kid);
     }
@@ -410,7 +413,9 @@ export class SponsorOidcService {
       return validateJwks(config.jwks);
     }
 
-    const jwksUri = config.jwksUri ?? await this.#resolveJwksUri(config, forceRefresh);
+    // Key rotation refreshes the JWKS itself; the separately cached discovery
+    // document must not be refetched for every attacker-controlled unknown kid.
+    const jwksUri = config.jwksUri ?? await this.#resolveJwksUri(config, false);
     assertSecureProviderUrl(jwksUri, "jwksUri");
     const cached = this.#jwksCache.get(jwksUri);
     if (!forceRefresh && cached && cached.expiresAt > Date.now()) {
@@ -426,6 +431,17 @@ export class SponsorOidcService {
     return jwks;
   }
 
+  #canForceRefresh(issuer: string): boolean {
+    const now = Date.now();
+    const previous = this.#jwksForcedRefreshAt.get(issuer);
+    if (previous !== undefined && now - previous < JWKS_FORCED_REFRESH_COOLDOWN_MS) {
+      return false;
+    }
+    // Record the attempt before performing I/O so failures are throttled too.
+    this.#jwksForcedRefreshAt.set(issuer, now);
+    return true;
+  }
+
   async #resolveJwksUri(
     config: Extract<SponsorFederationConfig, { sponsorBinding: "oidc" }>,
     forceRefresh: boolean,
@@ -614,7 +630,10 @@ function parseCacheSeconds(cacheControl: string | null): number {
   if (!match) {
     return DEFAULT_JWKS_CACHE_SECONDS;
   }
-  return Math.min(Number(match[1]), MAX_JWKS_CACHE_SECONDS);
+  return Math.max(
+    MIN_JWKS_CACHE_SECONDS,
+    Math.min(Number(match[1]), MAX_JWKS_CACHE_SECONDS),
+  );
 }
 
 function validateJwks(value: unknown): JsonWebKeySet {

packages/server/src/routes/identities.ts

@@ -563,7 +563,7 @@ identities.post("/", async (c) => {
         org: createdIdentity.orgId,
         name: createdIdentity.name,
         sponsorId: createdIdentity.sponsorId,
-        sponsorBinding: createdIdentity.sponsorBinding ?? { mode: "legacy" },
+        sponsorBinding,
       },
     });
     return c.json(createdIdentity, 201);

packages/server/src/routes/sponsors.ts

@@ -26,6 +26,25 @@ sponsors.post("/proof", async (c) => {
     return c.json({ error: auth.error, code: auth.code }, auth.status);
   }
 
+  const apiKeyId = typeof auth.claims.meta?.apiKeyId === "string"
+    ? auth.claims.meta.apiKeyId.trim()
+    : "";
+  const rateLimit = c.get("identityCreateRateLimiter").consume([
+    `sponsor-proof:org:${auth.claims.org}`,
+    ...(apiKeyId ? [`sponsor-proof:api-key:${apiKeyId}`] : []),
+  ]);
+  c.header("RateLimit-Limit", String(rateLimit.limit));
+  c.header("RateLimit-Remaining", String(rateLimit.remaining));
+  c.header("RateLimit-Reset", String(rateLimit.retryAfterSeconds));
+  if (!rateLimit.allowed) {
+    c.header("Retry-After", String(rateLimit.retryAfterSeconds));
+    return c.json({
+      error: "Sponsor proof rate limit exceeded",
+      code: "rate_limited",
+      retryable: true,
+    }, 429);
+  }
+
   const body = await c.req.json<SponsorProofRequest>().catch(() => null);
   if (!body || typeof body !== "object" || Array.isArray(body)) {
     return c.json({ error: "Invalid JSON body", code: "invalid_request" }, 400);

packages/server/src/storage/sqlite.ts

@@ -4541,14 +4541,16 @@ function normalizeIdentityStatus(value: unknown): IdentityStatus | undefined {
 }
 
 function normalizeSponsorBinding(value: SponsorBinding | undefined): SponsorBinding {
-  if (
-    value?.mode === "oidc"
-    && typeof value.issuer === "string"
-    && value.issuer.trim()
-    && typeof value.subject === "string"
-    && value.subject.trim()
-    && Number.isInteger(value.iat)
-  ) {
+  if (value?.mode === "oidc") {
+    if (
+      typeof value.issuer !== "string"
+      || !value.issuer.trim()
+      || typeof value.subject !== "string"
+      || !value.subject.trim()
+      || !Number.isInteger(value.iat)
+    ) {
+      throw new StorageError("invalid sponsor binding", 400, "invalid_sponsor_binding");
+    }
     return {
       mode: "oidc",
       issuer: value.issuer.trim(),