Inicio de sesión e identidad

import { SignJWT, importPKCS8 } from "jose";
import { randomUUID } from "node:crypto";
const key = await importPKCS8(process.env.BMAI_ES256_PRIVATE_KEY, "ES256");

app.post("/api/bmai/identity", requireYourSession, async (req, res) => {
  const { nonce } = req.body ?? {};
  if (typeof nonce !== "string" || nonce.length < 16) return res.status(400).end();
  const token = await new SignJWT({ tenant_id: "acme", nonce })
    .setProtectedHeader({ alg: "ES256", kid: process.env.BMAI_KID })
    .setIssuer("https://api.acme.com").setAudience("busymate-ai")
    .setSubject(String(req.user.id))
    .setJti(randomUUID()).setIssuedAt().setExpirationTime("120s")
    .sign(key);
  res.set("Cache-Control", "no-store").status(201).json({ token, nonce, expiresIn: 120 });
});

<script>
  window.BusymateAI = {
    getIdentity: async ({ nonce }) => {
      const r = await fetch("https://api.acme.com/api/bmai/identity", {
        method: "POST", credentials: "include", cache: "no-store",
        headers: { "content-type": "application/json" },
        body: JSON.stringify({ nonce }),
      });
      if (r.status === 401 || r.status === 403) return null;   // signed out
      if (!r.ok) throw new Error("identity mint failed " + r.status);
      const id = await r.json();
      if (id.nonce !== nonce) throw new Error("nonce mismatch");
      return { token: id.token, nonce: id.nonce };             // never cache
    },
  };
  // after YOUR login or account switch: window.BusymateAI.identityChanged();
  // after YOUR logout:                  window.BusymateAI.signedOut("signed_out");
</script>
<script src="https://acme.busymate.ai/embed/v1.js" data-assistant="acme" async></script>

Content-Security-Policy: frame-ancestors https://assistant.acme.com https://acme.busymate.ai
Set-Cookie: <your session>; Secure; SameSite=None

BusymateBridge.install(on: webView, config: .init(
  assistant: "acme", origins: ["https://acme.busymate.ai"],
  account: { Auth.shared.userId },                                          // nil when signed out
  mint: { request in try await API.mintBmaiIdentity(nonce: request.nonce) } // never cached
))
webView.load(URLRequest(url: URL(string: "https://acme.busymate.ai/?channel=ios")!))

BusymateBridge.install(webView, BusymateBridge.Config(
  assistant = "acme", origins = listOf("https://acme.busymate.ai"),
  account = { auth.userId },
  mint = { request, done -> api.mintBmaiIdentity(request["nonce"] as String) { done(it) } }
))
webView.loadUrl("https://acme.busymate.ai/?channel=android")

npm install @busymate/ai-verify    # Node 18+ and Deno. Python, PHP, Go: same repository

import { verifyBusymateActor, requireConfirmed, BusymateActorError } from "@busymate/ai-verify";

try {
  const actor = await verifyBusymateActor(req, {
    audience: "https://mcp.acme.com",              // EXACT origin of your connector URL
    tenantId: "acme",
    connectorId: process.env.BMAI_CONNECTOR_ID!,  // Console › Connections
    idp: process.env.BMAI_IDP,                    // Console › Identity
    tool: toolName,                               // the tools/call name
  });
  const user = await users.findByBusymateIdentity(actor.idp, actor.sub);   // (idp, sub) only
  requireConfirmed(actor, WRITE_TOOLS.has(toolName));                      // money and writes
  // run the tool as `user`. Never read an account id from tool arguments.
} catch (e) {
  if (e instanceof BusymateActorError) return reply(401, { "WWW-Authenticate": 'Bearer error="invalid_token"' });
  throw e;
}

npx @busymate/identity-check --issuer https://api.acme.com --mint https://api.acme.com/api/bmai/identity \
  --login-url https://acme.com/login --chat-origin https://acme.busymate.ai \
  --mcp https://mcp.acme.com --probe-url https://mcp.acme.com/mcp --tenant-id acme

GOAL: The Busymate AI chat must recognise the signed-in user and call our MCP/API as that user, with no extra login and no Authorize card.
CONTRACT: bmai-identity 2.0.0 (@busymate/identity-contract 2.0.0-beta.2). Manifest: https://busymate.ai/.well-known/bmai-integration.json

1. BACKEND (language of this repo)
   - ES256 key pair. Serve the public key as a JWKS at <issuer>/.well-known/jwks.json (kid, alg ES256, use sig).
   - POST <mint path>, body {nonce, returnTo?}, needs OUR existing session. Signed out: 401. Else 201 {token, nonce, expiresIn:120}, header Cache-Control: no-store.
   - JWT claims: iss=<issuer>, aud=<audience>, sub=<immutable per-person user id>, <tenant claim>=<tenant>, nonce=<request nonce unchanged>, jti=<uuid>, iat=now, exp=now+120.
   - Never an e-mail or phone in sub. Never a shared organization id. Never cache or store a token. Never make your own nonce.
2. FRONTEND (pick what this repo is)
   - Plain site: define window.BusymateAI.getIdentity({nonce}) BEFORE loading <chat origin>/embed/v1.js (data-assistant=<slug>). Call window.BusymateAI.identityChanged() after login, rotation and account switch, and window.BusymateAI.signedOut("signed_out") after logout.
   - Bundler: npm install @busymate/ai-web. createBusymateChat({assistant, origin, getIdentity: mintFromEndpoint(<mint url>)}); chat.mount(); identityChanged() / switchAccount() / logout() on our auth events.
   - iOS, Android, desktop: BusymateBridge.install(... account, mint ...) BEFORE the first load; accountChanged() on every auth change. Desktop uses channel=desktop_sdk, never channel=desktop. React Native and Flutter use the frozen bridge files.
   - Hosted chat page or custom domain: our login page reads return_to, bmai_nonce and bmai_prompt, mints with that nonce and redirects to return_to#bmai_token=<token>&bmai_nonce=<nonce>. On bmai_prompt=none it never renders UI: no session means redirect to return_to#error=login_required. Send Content-Security-Policy frame-ancestors <chat origins> and a SameSite=None; Secure session cookie.
3. MCP SERVER / API
   - npm install @busymate/ai-verify (Python, PHP, Go files: github.com/serebano/busymate-ai-sdk-verify).
   - Before our own auth middleware call verifyBusymateActor(req, {audience: <exact connector origin>, tenantId, connectorId: BMAI_CONNECTOR_ID, idp: BMAI_IDP, tool: <tools/call name>}).
   - Token v3: ES256, typ bmai-actor+jwt, header X-Bmai-Actor (or Authorization: Bearer when GET /api/bmai/status returns {"actorVerifier":true,"actor":3}); keys at https://busymate.ai/.well-known/bmai-actor-jwks.json; iss https://busymate.ai; exp-iat <= 120; clock skew <= 10 s.
   - Map the user by (idp, sub) ONLY. Never from a tool argument. Require confirmed === true (requireConfirmed) for money and write tools. Reject a repeated jti.
   - On a BusymateActorError answer 401 with WWW-Authenticate: Bearer error="invalid_token"; log e.reason; never fall through to another user.
   - Serve GET /api/bmai/status -> {"actorVerifier": true, "actor": 3}.
   - Compat v2 (HS256, kid bmai-support-v2, header Authorization: Bearer, exp-iat <= 300, secret set in the Console): check actor_kind === "identified"; anonymous means public data only.
4. DO NOT: make your own nonce; cache or store tokens; use channel=desktop; use OAuth mode for our own MCP; put an account id in tool arguments; ask the human for private keys.
5. TELL THE HUMAN to: register the provider and publish (Console > Identity), set the connector to Signed actor token (or ask for token v3 on the workspace), keep "Ask customers before using their account" OFF unless they want the confirm, then run: npx @busymate/identity-check --issuer <issuer> --mint <mint url> --login-url <login url> --chat-origin <chat origin> --mcp <connector origin> --tenant-id <tenant>.