feat(php): signed-in users through the dewee identity session exchange (parity with the TypeScript handler)

Aperta
  • Qualcosa non va?
#5 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github, php, typescript
Ambito
api, authentication, backend

Direzione di ricerca

Read php/dewee-webchat.php, the TypeScript handler, docs/http-contract.md, and test/php-parity.test.ts; then compare the signed-in user sections in packages/dewee-webchat/README.md and the isolation tests in packages/dewee-webchat/test/. Implementing this scope spans signing, session exchange, chat/history binding, links, and error handling. Done means PHP lint passes and parity and isolation checks match the stated acceptance criteria.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

ai-handle enhancement

Context

The Node/Workers handler can sign users in through a Dewee identity session exchange (identity option, see the "Signed-in users" sections of packages/dewee-webchat/README.md and docs/http-contract.md). The single-file PHP backend (php/dewee-webchat.php) does not support it yet: the exchange needs a signed partner assertion (a compact JWS, HS256 for hmac applications and RS256/ES256/EdDSA for jwks ones), and the PHP adapter has no JWS signing.

Surface parity: php/dewee-webchat.php N/A in the first PR because identity exchange needs JWS signing not yet in the PHP adapter.

Parent: nextlevelbuilder/dewee#1450 (Trusted User Context + Dewee Connect).

Scope

Bring the PHP backend to parity with the TypeScript handler for signed-in users, without new Composer dependencies:

  1. An identity option: authenticate callable, appId, issuer, audience (optional check, dewee:<appId>), and exactly one of assertionSecret or privateKeyJwk (+ algorithm), agent, required, sessionTtlSeconds.
  2. Assertion signing: HS256 with hash_hmac over the UTF-8 secret exactly as issued; ES256/RS256 with openssl_sign (ES256 converted from DER to the 64-byte JOSE form). Header typ: dewee-session+jwt, claims iss, aud, sub, iat, exp (at most 300 s), fresh jti. Refuse a sub containing @.
  3. POST /session: POST {gateway}/v1/identity/sessions/exchange, visitor token claims ids and ida, exp = min(session expiry, visitor expiry), verified: true, visitor id derived from the principal (HMAC of the visitor secret over dewee-webchat:visitor:principal:<id>, first 16 bytes, base64url).
  4. /chat and /history: connect with identity_session and no user_id; bind the request to ida; forward the seven identity codes as {error:{message, code, remediation}} with the statuses in docs/http-contract.md.
  5. POST /link: POST {gateway}/v1/identity/links with X-Dewee-Identity-Session, answer {proofCode, expiresAt, deepLinks}.
  6. Fail closed exactly like the TypeScript handler: no anonymous fallback for a signed-in user whose exchange fails; anonymous only when not required; refuse identity combined with client credentials; never echo the gateway token, assertion secret or private key.

Acceptance

  • php -l php/dewee-webchat.php passes.
  • A parity test (like test/php-parity.test.ts) shows the PHP and TypeScript backends produce the same visitor-id derivation, claim shape and error envelopes, and that a PHP-signed assertion verifies with the same checks the gateway applies.
  • The isolation cases of packages/dewee-webchat/test/identity.test.ts hold for the PHP backend (different users get different sessions, a replayed token keeps its user, a tampered token is 401, secrets never appear in a response).
Lingua principale
TypeScript
Stelle
7
Fork
1
Merge medio
1g 3h
PR unite (30g)
8

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di nextlevelbuilder/dewee-webchat

Tutte le issue di nextlevelbuilder/dewee-webchat

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.