fix(auth): only accept PPA certificates from trusted issuers

[coodos]

Problem

PP-Auth's accreditation link (link 6 of verifyDeploymentChain) verified the certificate against evidence.issuerJwksUri. That key-set URL is supplied by the deployment being checked, so any deployment could host its own JWKS, sign itself a certificate at any level for any domains, and pass the chain.

Fix

Only certificates from trusted certifying authorities count:

• Allowlist. The new ChainOptions.trustedPpaIssuers (hosts or origins) defaults to DEFAULT_TRUSTED_PPA_ISSUERS = ["https://ppa.w3ds.metastate.foundation"].
• Issuer checked first. The certificate's iss must be on the list. This is checked before any key is fetched, so the evidence can't steer the verifier to a key set of its choosing.
• Keys from the issuer only. Keys always come from <issuer>/.well-known/jwks.json, never from evidence.issuerJwksUri, and jwtVerify also enforces iss.
• Exports. normalizePpaIssuers and ppaJwksUri are exported for other verifiers.
• Test scenario. Certificates minted in the scenario now carry iss, like the real PPA's (setIssuer(publicUrl())).
• pp-auth-demo. It accepts PP_AUTH_TRUSTED_PPA_ISSUERS (comma-separated) so a local PPA can be trusted during development. Unset keeps the default.
• Docs. The Platform Authentication doc describes the accreditation link and the trusted-authority rule.

Tests

packages/auth passes 62/62, and tsc --noEmit is clean. New cases:

• A validly signed certificate from an untrusted issuer is refused.
• A certificate that claims the trusted issuer but is signed with the attacker's key, with issuerJwksUri pointing at the attacker's key set, is refused.
• With no configuration, only the MetaState PPA is trusted.
• normalizePpaIssuers handles bare hosts, trailing slashes, http for dev, and junk entries.

GitW3 applies the same rule to the PPA decisions it reads from platform eVaults.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 0ab65600-bce0-4383-8c84-d0d3d260e934

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}