Ship APIs with verifiable controls from design to production

import 'node:dotenv/config';
    import assert from 'node:assert/strict';
    import crypto from 'node:crypto';

    const issuerUrl = process.env.OIDC_ISSUER?.trim();
    const clientId = process.env.OIDC_CLIENT_ID?.trim();
    const clientSecret = process.env.OIDC_CLIENT_SECRET?.trim();
    const redirectUri = process.env.OIDC_REDIRECT_URI?.trim();

    assert(issuerUrl && clientId && clientSecret && redirectUri, 'Missing OIDC configuration');

    function base64UrlEncode(buffer) {
      return Buffer.from(buffer)
        .toString('base64')
        .replace(/=/g, '')
        .replace(/\+/g, '-')
        .replace(/\//g, '_');
    }

    function createPkcePair() {
      const verifier = base64UrlEncode(crypto.randomBytes(64));
      const challenge = base64UrlEncode(
        crypto.createHash('sha256').update(verifier, 'utf8').digest()
      );
      return { verifier, challenge };
    }

    export async function buildAuthorizationUrl({ state, nonce }) {
      const { verifier, challenge } = createPkcePair();
      const url = new URL('/oauth2/v2.0/authorize', issuerUrl);
      url.searchParams.set('client_id', clientId);
      url.searchParams.set('redirect_uri', redirectUri);
      url.searchParams.set('response_type', 'code');
      url.searchParams.set('scope', 'api://default/.default offline_access openid profile');
      url.searchParams.set('code_challenge_method', 'S256');
      url.searchParams.set('code_challenge', challenge);
      url.searchParams.set('state', state);
      url.searchParams.set('nonce', nonce);

      return { url: url.toString(), pkceVerifier: verifier };
    }

    export async function exchangeCodeForTokens({ authorizationCode, pkceVerifier, abortSignal }) {
      assert(authorizationCode && pkceVerifier, 'Authorization code and PKCE verifier required');

      const tokenEndpoint = new URL('/oauth2/v2.0/token', issuerUrl);
      const body = new URLSearchParams({
        grant_type: 'authorization_code',
        client_id: clientId,
        client_secret: clientSecret,
        redirect_uri: redirectUri,
        code: authorizationCode,
        code_verifier: pkceVerifier
      });

      const response = await fetch(tokenEndpoint, {
        method: 'POST',
        headers: {
          'Content-Type': 'application/x-www-form-urlencoded',
          'Accept': 'application/json'
        },
        body,
        signal: abortSignal,
        cache: 'no-store'
      });

      if (!response.ok) {
        const detail = await response.text();
        throw new Error(`OIDC token exchange failed: ${response.status} ${detail}`);
      }

      const tokens = await response.json();
      assert(typeof tokens.id_token === 'string', 'ID token missing');
      assert(typeof tokens.refresh_token === 'string', 'Refresh token missing');
      assert(typeof tokens.access_token === 'string', 'Access token missing');

      return tokens;
    }

    export async function revokeToken({ token, hint = 'refresh_token', abortSignal }) {
      assert(token, 'Token required for revocation');

      const revocationEndpoint = new URL('/oauth2/v2.0/logout', issuerUrl);
      const form = new URLSearchParams({
        token,
        token_type_hint: hint,
        client_id: clientId,
        client_secret: clientSecret
      });

      const response = await fetch(revocationEndpoint, {
        method: 'POST',
        headers: {
          'Content-Type': 'application/x-www-form-urlencoded'
        },
        body: form,
        signal: abortSignal,
        cache: 'no-store'
      });

      if (!response.ok) {
        throw new Error(`Token revocation failed: ${response.status}`);
      }
    }

name: build-sign-and-attest

    on:
      push:
        branches: [ main ]
      pull_request:
        branches: [ main ]
      workflow_dispatch:

    permissions:
      contents: read
      id-token: write
      packages: write
      attestations: write

    jobs:
      build:
        runs-on: ubuntu-24.04
        env:
          NODE_OPTIONS: "--openssl-legacy-provider=0"
        permissions:
          contents: read
          packages: write
          id-token: write
          attestations: write
        steps:
          - name: Harden runner
            uses: step-security/harden-runner@v2
            with:
              egress-policy: audit
          - name: Checkout
            uses: actions/checkout@v4
            with:
              persist-credentials: false
              fetch-depth: 1
          - name: Setup Node.js 22 LTS
            uses: actions/setup-node@v4
            with:
              node-version: '22'
              cache: 'npm'
          - name: Install dependencies
            run: npm ci --ignore-scripts
          - name: Run security tests
            run: npm run lint && npm test
          - name: Build distributable
            run: npm run build
          - name: Generate CycloneDX SBOM
            uses: anchore/sbom-action@v0
            with:
              path: dist
              format: cyclonedx-json
              output-file: dist/app-sbom.json
          - name: Upload SBOM artifact
            uses: actions/upload-artifact@v4
            with:
              name: app-sbom
              path: dist/app-sbom.json
              if-no-files-found: error
          - name: Create SLSA Level 3 provenance
            uses: slsa-framework/slsa-github-generator@v2
            with:
              build-artifact-path: dist
              slsa-version: v1.5
          - name: Attest build with GitHub provenance
            uses: actions/attest-build-provenance@v1
            with:
              subject-path: dist/**
          - name: Publish package
            run: npm publish --provenance --access public
            env:
              NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

apiVersion: kyverno.io/v1
    kind: ClusterPolicy
    metadata:
      name: enforce-api-ingress-security
      annotations:
        policies.kyverno.io/title: Enforce TLS and mTLS guardrails for edge APIs
        policies.kyverno.io/category: API Governance
        policies.kyverno.io/severity: medium
    spec:
      validationFailureAction: enforce
      background: true
      failurePolicy: Fail
      rules:
        - name: require-nginx-tls-version
          match:
            any:
              - resources:
                  kinds: [Ingress]
          preconditions:
            all:
              - key: "{{ request.object.metadata.annotations['kubernetes.io/ingress.class'] || '' }}"
                operator: Equals
                value: nginx
          validate:
            message: "Public ingress endpoints must restrict TLS protocols to 1.2 and 1.3"
            pattern:
              metadata:
                annotations:
                  nginx.ingress.kubernetes.io/ssl-protocols: "TLSv1.2 TLSv1.3"
        - name: require-mtls-authentication
          match:
            any:
              - resources:
                  kinds: [Ingress]
          preconditions:
            all:
              - key: "{{ request.object.metadata.annotations['kubernetes.io/ingress.class'] || '' }}"
                operator: Equals
                value: nginx
          validate:
            message: "Mutual TLS is required for partner API ingress"
            pattern:
              metadata:
                annotations:
                  nginx.ingress.kubernetes.io/auth-tls-secret: "platform/edge-mtls"
                  nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
        - name: block-privileged-backends
          match:
            any:
              - resources:
                  kinds: [HTTPRoute]
                  apiGroups: [gateway.networking.k8s.io]
          validate:
            message: "HTTPRoute backends serving APIs must not target privileged namespaces"
            foreach:
              - list: "request.object.spec.rules[].backendRefs[]"
                deny:
                  conditions:
                    all:
                      - key: "{{ element.namespace || request.namespace }}"
                        operator: AnyIn
                        value: ["kube-system", "istio-system", "cert-manager"]