Zero Trust and Continuous Authorization

// Per-route assurance requirements, expressed declaratively.
const requireAssurance = ({ acr, maxAgeS }) => (req, res, next) => {
  const claims = req.tokenClaims;

  const methods = claims.amr ?? [];
  const strong = methods.includes('otp') || methods.includes('hwk') ||
                 methods.includes('mfa');

  const authAge = Math.floor(Date.now() / 1000) - Number(claims.auth_time ?? 0);

  if ((acr && claims.acr !== acr) || !strong || authAge > maxAgeS) {
    // Tell the client exactly what is missing and how to obtain it — otherwise
    // it can only guess, and it will guess "log the user out".
    res.set('WWW-Authenticate',
      `Bearer realm="api", error="insufficient_user_authentication", ` +
      `acr_values="${acr}", max_age="${maxAgeS}"`);
    return res.status(401).json({
      error: 'insufficient_user_authentication',
      required: { acr, maxAgeSeconds: maxAgeS },
      current: { acr: claims.acr ?? null, authAgeSeconds: authAge },
    });
  }
  next();
};

// Reading is cheap.
app.get('/api/payouts', bearerAuth, listPayouts);

// Changing where money goes is not.
app.put('/api/payouts/bank-account',
  bearerAuth,
  requireAssurance({ acr: 'urn:acme:mfa', maxAgeS: 300 }),
  updateBankAccount,
);

// This is the control that survives a stolen session: the attacker holds a
// valid credential and still cannot pass a five-minute-old second factor.

// The IdP pushes a signed Security Event Token (SET) when something changes.
// Reacting in seconds is what closes the gap short token lifetimes only narrow.
app.post('/events/caep',
  express.text({ type: 'application/secevent+jwt' }),
  async (req, res) => {
    let payload;
    try {
      ({ payload } = await jwtVerify(req.body, IDP_JWKS, {
        issuer: 'https://idp.example.com',
        audience: 'https://dfg.com',
      }));
    } catch {
      return res.status(400).json({ error: 'invalid_set' });
    }

    for (const [type, event] of Object.entries(payload.events ?? {})) {
      const subject = event.subject?.sub ?? payload.sub;

      switch (type) {
        case 'https://schemas.openid.net/secevent/caep/event-type/session-revoked':
          await destroyAllSessionsFor(subject);
          await revokeAllRefreshTokensFor(subject);
          await db.users.increment(subject, 'tokenVersion');   // kills live JWTs
          break;

        case 'https://schemas.openid.net/secevent/caep/event-type/credential-change':
          // Password or MFA changed at the IdP — treat like our own reset.
          await destroyAllSessionsFor(subject);
          break;

        case 'https://schemas.openid.net/secevent/caep/event-type/device-compliance-change':
          if (event.current_status === 'not-compliant') {
            await restrictSessionsToReadOnly(subject);   // step down, not out
          }
          break;

        case 'https://schemas.openid.net/secevent/caep/event-type/assurance-level-change':
          if (event.current_level === 'low') {
            await requireStepUpOnNextSensitiveAction(subject);
          }
          break;
      }
    }

    res.sendStatus(202);   // acknowledge fast; process async if it is slow
  });

// Without this, 'we disabled them in Okta' means 'they lose access when their
// current token expires' — which is exactly the window an insider needs.

// Behavioural scoring gets complicated fast. A small, explainable rule set
// beats an opaque model you cannot debug at 2am.
export async function evaluateRisk(req, session) {
  const signals = [];

  // Impossible travel: two locations too far apart for the elapsed time.
  const last = session.lastGeo;
  if (last) {
    const km = haversine(last, geoFor(req.ip));
    const hours = (Date.now() - session.lastSeen) / 3_600_000;
    if (km / Math.max(hours, 0.01) > 900) signals.push('impossible_travel');
  }

  if (session.ua && session.ua !== req.get('user-agent')) signals.push('device_change');
  if (await isTorExit(req.ip)) signals.push('anonymising_network');
  if (await isNewAsn(session.userId, req.ip)) signals.push('new_network');

  // Volume anomaly: 20x the user's own baseline, not a global threshold.
  const rate = await requestRateFor(session.userId);
  if (rate > (await baselineRateFor(session.userId)) * 20) signals.push('volume_spike');

  return signals;
}

export async function continuousAuthorization(req, res, next) {
  const signals = await evaluateRisk(req, req.sessionData);
  if (!signals.length) return next();

  await audit.record({ event: 'risk.detected', userId: req.user.id, signals });

  // Graduated response — terminating on every anomaly trains users to distrust
  // the product, and support absorbs the cost.
  if (signals.includes('impossible_travel') || signals.length >= 3) {
    await destroySession(req.sid);
    return res.status(401).json({ error: 'reauthentication_required', signals });
  }

  if (isSensitive(req.path)) {
    return res.status(401).json({ error: 'insufficient_user_authentication' });
  }

  req.degraded = true;      // read-only for this request; log it and continue
  next();
}