@_mustachio/openauth 0.11.0 → 0.12.0

package/dist/esm/domain/callback.js

@@ -7,21 +7,42 @@ import { dispatchMethod } from "./method-dispatch";
 import { saveEncryptedCode } from "./token";
 import { verifyStateEnvelope } from "./state-envelope";
 import { AUTH_CODE_TTL_MS } from "./authorize";
+async function extractCallbackState(req) {
+  const fromQuery = new URL(req.url).searchParams.get("state");
+  if (fromQuery)
+    return fromQuery;
+  if (req.method !== "POST")
+    return null;
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.includes("application/x-www-form-urlencoded"))
+    return null;
+  try {
+    const body = await req.clone().text();
+    const form = new URLSearchParams(body);
+    const v = form.get("state") ?? form.get("RelayState");
+    return v && v.length > 0 ? v : null;
+  } catch {
+    return null;
+  }
+}
 async function handleCallback(input, deps) {
   const url = new URL(input.rawRequest.url);
-  const state = url.searchParams.get("state");
-  if (!state) {
-    return err(authError.invalidRequest("missing state parameter", "state"));
-  }
-  const envelopeRes = await verifyStateEnvelope(state, deps.stateKeys);
-  if (isErr(envelopeRes)) {
+  const state = await extractCallbackState(input.rawRequest);
+  const envelopeRes = state ? await verifyStateEnvelope(state, deps.stateKeys) : null;
+  if (envelopeRes === null || isErr(envelopeRes)) {
+    const idp = await tryIdpInitiated(input, deps, url);
+    if (idp)
+      return idp;
+    if (!state) {
+      return err(authError.invalidRequest("missing state parameter", "state"));
+    }
     await safeAudit(deps, {
       kind: "flow_replay_attempt",
       tenantId: null,
       flowId: "unknown",
       timestamp: deps.clock()
     });
-    return err(authError.invalidRequest(envelopeRes.error.description, "state"));
+    return err(authError.invalidRequest(envelopeRes && isErr(envelopeRes) ? envelopeRes.error.description : "invalid state", "state"));
   }
   const envelope = envelopeRes.value;
   const flowRes = await deps.sessionStore.consumeFlow(envelope.flowId);
@@ -168,6 +189,99 @@ async function translate(result, flow, deps) {
       return err(result.error);
   }
 }
+async function tryIdpInitiated(input, deps, url) {
+  if (input.rawRequest.method !== "POST")
+    return null;
+  if (!input.tenant || !input.issuerUrl)
+    return null;
+  const segments = url.pathname.split("/").filter(Boolean);
+  if (segments.length < 2 || segments[0] !== "cb")
+    return null;
+  const methodId = segments[1];
+  const methodRes = await deps.methodCache.resolve(input.tenant.config, methodId);
+  if (isErr(methodRes))
+    return null;
+  const method = methodRes.value;
+  if (method.unsolicitedCallback !== true)
+    return null;
+  const callbackUrl = `${url.protocol}//${url.host}/cb/${methodId}`;
+  const dispatched = await dispatchMethod({
+    method,
+    route: "GET /callback",
+    tenant: input.tenant,
+    request: input.rawRequest,
+    subPath: "/callback",
+    flow: null,
+    cookies: input.cookies,
+    sessionStore: deps.sessionStore,
+    dispatch: { state: "", callbackUrl, issuerUrl: input.issuerUrl }
+  });
+  if (isErr(dispatched))
+    return err(dispatched.error);
+  const result = dispatched.value;
+  if (result.kind === "challenge") {
+    return ok({
+      kind: "challenge",
+      response: result.response,
+      setCookies: result.setCookies ?? [],
+      ...result.cache !== undefined ? { cache: result.cache } : {}
+    });
+  }
+  if (result.kind === "denied") {
+    await safeAudit(deps, {
+      kind: "authorize_failed",
+      tenantId: input.tenant.id,
+      clientId: "idp-initiated",
+      methodId,
+      methodKind: method.kind,
+      flowId: "idp-initiated",
+      reason: result.reason,
+      timestamp: deps.clock()
+    });
+    return ok({
+      kind: "denied",
+      reason: result.reason,
+      setCookies: result.setCookies ?? []
+    });
+  }
+  if (result.kind === "error")
+    return err(result.error);
+  const binding = result.unsolicitedBinding;
+  if (!binding) {
+    return err(authError.internalError(`method "${methodId}" handled an unsolicited callback but returned ` + `no unsolicitedBinding`));
+  }
+  const client = input.tenant.config.clients.find((c) => c.id === binding.clientId);
+  if (!client) {
+    return err(authError.invalidRequest(`IdP-initiated binding references unknown client "${binding.clientId}"`));
+  }
+  if (!client.redirectUris.includes(binding.redirectUri)) {
+    return err(authError.invalidRequest(`IdP-initiated redirect_uri "${binding.redirectUri}" is not ` + `registered for client "${binding.clientId}"`));
+  }
+  const code = (deps.newCodeId ?? randomToken)();
+  const now = deps.clock();
+  const saved = await saveEncryptedCode(code, {
+    tenantId: input.tenant.id,
+    clientId: binding.clientId,
+    appRedirectUri: binding.redirectUri,
+    appState: null,
+    scopes: binding.scopes,
+    methodId,
+    methodKind: method.kind,
+    context: input.tenant.request.custom ?? null,
+    providerSubject: result.providerSubject,
+    properties: result.properties,
+    authTime: Math.floor(now / 1000),
+    expiresAt: now + AUTH_CODE_TTL_MS
+  }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
+  if (isErr(saved))
+    return err(saved.error);
+  return ok({
+    kind: "issue-code",
+    code,
+    appRedirectUri: binding.redirectUri,
+    appState: null
+  });
+}
 function normalizePath(p) {
   return p.replace(/\/+$/, "");
 }

package/dist/esm/domain/client-auth.js

@@ -55,7 +55,7 @@ function resolveClientCredentials(input) {
   };
 }
 export {
-  verifyClientCredentials,
+  parseBasicAuth,
   resolveClientCredentials,
-  parseBasicAuth
+  verifyClientCredentials
 };

package/dist/esm/domain/crypto.js

@@ -79,19 +79,19 @@ function generateSymmetricKey() {
   return buf;
 }
 export {
-  utf8,
-  timingSafeEqualStr,
-  timingSafeEqual,
-  sha256,
-  randomToken,
-  randomId,
-  randomHex,
-  randomBytes,
-  importHmacKey,
-  hmacVerify,
-  hmacSign,
-  generateSymmetricKey,
-  encryptPayload,
+  base64url,
   decryptPayload,
-  base64url
+  encryptPayload,
+  generateSymmetricKey,
+  hmacSign,
+  hmacVerify,
+  importHmacKey,
+  randomBytes,
+  randomHex,
+  randomId,
+  randomToken,
+  sha256,
+  timingSafeEqual,
+  timingSafeEqualStr,
+  utf8
 };

package/dist/esm/domain/discovery.js

@@ -78,6 +78,6 @@ async function buildJwks(keyStore) {
   return ok(buildJwksDocument(res.value));
 }
 export {
-  buildJwks,
-  buildDiscoveryDocument
+  buildDiscoveryDocument,
+  buildJwks
 };

package/dist/esm/domain/dpop.js

@@ -114,9 +114,9 @@ function stringifyError(e) {
   return e instanceof Error ? e.message : String(e);
 }
 export {
-  verifyDpopProof,
-  computeAth,
-  canonicalHtu,
+  DEFAULT_DPOP_IAT_TOLERANCE_SEC,
   DEFAULT_DPOP_JTI_TTL_MS,
-  DEFAULT_DPOP_IAT_TOLERANCE_SEC
+  canonicalHtu,
+  computeAth,
+  verifyDpopProof
 };

package/dist/esm/domain/id-token.js

@@ -85,10 +85,10 @@ function shouldIssueIdToken(scopes) {
   return scopes.includes("openid");
 }
 export {
-  shouldIssueIdToken,
-  pickScopedClaims,
-  deriveAmr,
-  computeAtHash,
+  DEFAULT_ID_TOKEN_TTL_MS,
   buildIdTokenClaims,
-  DEFAULT_ID_TOKEN_TTL_MS
+  computeAtHash,
+  deriveAmr,
+  pickScopedClaims,
+  shouldIssueIdToken
 };

package/dist/esm/domain/jwt.js

@@ -63,9 +63,9 @@ function buildJwksDocument(keys) {
   };
 }
 export {
-  verifyIdToken,
-  verifyAccessToken,
-  signIdToken,
+  buildJwksDocument,
   signAccessToken,
-  buildJwksDocument
+  signIdToken,
+  verifyAccessToken,
+  verifyIdToken
 };

package/dist/esm/domain/method-dispatch.js

@@ -13,7 +13,8 @@ async function dispatchMethod(input) {
     flow: input.flow,
     methodState: input.flow?.methodState ?? null,
     cookies: input.cookies,
-    dispatch: input.dispatch
+    dispatch: input.dispatch,
+    methodScratch: buildMethodScratch(input.sessionStore, input.tenant.id, input.method.id)
   };
   let result;
   try {
@@ -31,6 +32,31 @@ async function dispatchMethod(input) {
   }
   return ok(result);
 }
+function buildMethodScratch(store, tenantId, methodId) {
+  const prefix = `scratch:${tenantId}:${methodId}:`;
+  const scope = (key) => `${prefix}${key}`;
+  const unsupported = (op) => authError.internalError(`SessionStore does not implement ${op}; methodScratch is unavailable on this adapter`);
+  return {
+    put: async (key, value, ttlMs) => {
+      if (!store.saveScratch)
+        return err(unsupported("saveScratch"));
+      if (ttlMs <= 0) {
+        return err(authError.internalError(`methodScratch.put: ttlMs must be positive, got ${ttlMs}`));
+      }
+      return store.saveScratch(scope(key), value, ttlMs);
+    },
+    get: async (key) => {
+      if (!store.readScratch)
+        return err(unsupported("readScratch"));
+      return store.readScratch(scope(key));
+    },
+    delete: async (key) => {
+      if (!store.deleteScratch)
+        return err(unsupported("deleteScratch"));
+      return store.deleteScratch(scope(key));
+    }
+  };
+}
 export {
   dispatchMethod
 };

package/dist/esm/domain/method-route.js

@@ -5,6 +5,7 @@ import { safeAudit } from "./audit";
 import { AUTH_CODE_TTL_MS } from "./authorize";
 import { randomToken } from "./crypto";
 import { dispatchMethod } from "./method-dispatch";
+import { revokeAllForSubject } from "./revoke";
 import { saveEncryptedCode } from "./token";
 async function handleMethodRoute(input, deps) {
   const flowRes = await deps.sessionStore.readFlow(input.flowId);
@@ -106,6 +107,84 @@ async function translate(result, flow, deps) {
       return err(result.error);
   }
 }
+async function handlePublicMethodRoute(input, deps) {
+  if (!input.method.publicRoutes?.includes(input.route)) {
+    return err(authError.invalidRequest(`route "${input.route}" is not public on method "${input.method.id}"`, "path"));
+  }
+  const dispatched = await dispatchMethod({
+    method: input.method,
+    route: input.route,
+    tenant: input.tenant,
+    request: input.rawRequest,
+    subPath: input.subPath,
+    flow: null,
+    cookies: new Map,
+    sessionStore: deps.sessionStore,
+    dispatch: input.dispatch
+  });
+  if (isErr(dispatched))
+    return err(dispatched.error);
+  const r = dispatched.value;
+  switch (r.kind) {
+    case "challenge": {
+      if (r.logout) {
+        const sideEffect = await runUpstreamLogout(input, deps, r.logout);
+        if (isErr(sideEffect))
+          return err(sideEffect.error);
+      }
+      return ok({
+        kind: "challenge",
+        response: r.response,
+        ...r.cache !== undefined ? { cache: r.cache } : {}
+      });
+    }
+    case "denied":
+      return ok({ kind: "denied", reason: r.reason });
+    case "success":
+      return err(authError.internalError(`public route "${input.route}" on method "${input.method.id}" ` + `returned success — a flowless route cannot authenticate`));
+    case "error":
+      return err(r.error);
+  }
+}
+async function runUpstreamLogout(input, deps, logout) {
+  let hookResult = undefined;
+  if (deps.onLogout) {
+    const evt = {
+      tenant: input.tenant,
+      methodId: input.method.id,
+      methodKind: input.method.kind,
+      reason: "upstream_slo",
+      ...logout.nameId !== undefined ? { nameId: logout.nameId } : {},
+      ...logout.sessionIndex !== undefined ? { sessionIndex: logout.sessionIndex } : {}
+    };
+    try {
+      hookResult = await deps.onLogout(evt);
+    } catch (e) {
+      return err(authError.internalError(`onLogout hook threw during upstream Single Logout for method ` + `"${input.method.id}"`, e));
+    }
+  }
+  const revokeSubject = hookResult && typeof hookResult === "object" ? hookResult.revokeSubject : undefined;
+  if (revokeSubject) {
+    const revoked = await revokeAllForSubject(input.tenant.id, revokeSubject, {
+      tokenStore: deps.tokenStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      clock: deps.clock
+    });
+    if (isErr(revoked))
+      return err(revoked.error);
+  }
+  await safeAudit(deps, {
+    kind: "session_logout",
+    tenantId: input.tenant.id,
+    via: "upstream_slo",
+    methodId: input.method.id,
+    methodKind: input.method.kind,
+    ...revokeSubject ? { subjectId: revokeSubject } : {},
+    timestamp: deps.clock()
+  });
+  return ok(undefined);
+}
 export {
-  handleMethodRoute
+  handleMethodRoute,
+  handlePublicMethodRoute
 };

package/dist/esm/domain/par.js

@@ -45,7 +45,7 @@ async function pushAuthorizationRequest(req, tenant, deps) {
   });
 }
 export {
-  pushAuthorizationRequest,
+  DEFAULT_PAR_TTL_MS,
   PAR_URI_PREFIX,
-  DEFAULT_PAR_TTL_MS
+  pushAuthorizationRequest
 };

package/dist/esm/domain/pkce.js

@@ -11,6 +11,6 @@ async function validatePkce(verifier, challenge) {
   return timingSafeEqualStr(computed, challenge);
 }
 export {
-  validatePkce,
-  s256Challenge
+  s256Challenge,
+  validatePkce
 };

package/dist/esm/domain/revoke.js

@@ -76,6 +76,6 @@ async function revokeAllForSubject(tenantId, subjectId, deps) {
   return ok(undefined);
 }
 export {
-  revokeToken,
-  revokeAllForSubject
+  revokeAllForSubject,
+  revokeToken
 };

package/dist/esm/domain/state-envelope.js

@@ -75,6 +75,6 @@ function isEnvelopeShape(value) {
   return typeof v.tenantId === "string" && typeof v.flowId === "string" && typeof v.nonce === "string" && typeof v.kid === "string";
 }
 export {
-  verifyStateEnvelope,
-  mintStateEnvelope
+  mintStateEnvelope,
+  verifyStateEnvelope
 };

package/dist/esm/domain/token.js

@@ -237,10 +237,10 @@ async function hashTokenForAudit(token) {
   return base64url.encode(await sha256(utf8.encode(token))).slice(0, 16);
 }
 export {
-  saveEncryptedCode,
-  mintTokens,
-  hashClientSecret,
-  exchangeCode,
+  DEFAULT_ACCESS_TTL_MS,
   DEFAULT_REFRESH_TTL_MS,
-  DEFAULT_ACCESS_TTL_MS
+  exchangeCode,
+  hashClientSecret,
+  mintTokens,
+  saveEncryptedCode
 };

package/dist/esm/error.js

@@ -61,13 +61,13 @@ class InvalidAuthorizationCodeError extends Error {
   }
 }
 export {
-  UnknownStateError,
-  UnauthorizedClientError,
-  OauthError,
-  MissingProviderError,
-  MissingParameterError,
-  InvalidSubjectError,
-  InvalidRefreshTokenError,
+  InvalidAccessTokenError,
   InvalidAuthorizationCodeError,
-  InvalidAccessTokenError
+  InvalidRefreshTokenError,
+  InvalidSubjectError,
+  MissingParameterError,
+  MissingProviderError,
+  OauthError,
+  UnauthorizedClientError,
+  UnknownStateError
 };

package/dist/esm/http/cookies.js

@@ -67,6 +67,22 @@ var STRIPPED_HEADERS = [
   "permissions-policy",
   "cache-control"
 ];
+function cacheControlHeader(cache) {
+  if (!cache)
+    return "no-store";
+  if ((cache.maxAge ?? -1) === 0)
+    return "no-store";
+  const parts = [];
+  if (cache.isPrivate)
+    parts.push("private");
+  if (cache.maxAge !== undefined)
+    parts.push(`max-age=${cache.maxAge}`);
+  if (cache.sMaxAge !== undefined)
+    parts.push(`s-maxage=${cache.sMaxAge}`);
+  if (cache.immutable)
+    parts.push("immutable");
+  return parts.length ? parts.join(", ") : "no-store";
+}
 function applyResponsePolicy(response, opts = {}) {
   const headers = new Headers(response.headers);
   const stripped = [];
@@ -92,7 +108,8 @@ function applyResponsePolicy(response, opts = {}) {
   });
 }
 export {
-  serializeSetCookie,
+  applyResponsePolicy,
+  cacheControlHeader,
   parseCookieHeader,
-  applyResponsePolicy
+  serializeSetCookie
 };

package/dist/esm/http/errors.js

@@ -63,9 +63,9 @@ function isNonRecoverable(error) {
   return false;
 }
 export {
-  tokenEndpointErrorResponse,
-  publicErrorCode,
-  isNonRecoverable,
+  authorizeDirectErrorResponse,
   authorizeRedirectErrorResponse,
-  authorizeDirectErrorResponse
+  isNonRecoverable,
+  publicErrorCode,
+  tokenEndpointErrorResponse
 };

package/dist/esm/http/handlers/authorize.js

@@ -4,7 +4,7 @@ import { startAuthorize } from "../../domain/authorize";
 import { asTenantId } from "../../types/tenant";
 import { authError } from "../../types/error";
 import { renderPicker as renderDefaultPicker } from "../../ui/picker";
-import { applyResponsePolicy } from "../cookies";
+import { applyResponsePolicy, cacheControlHeader } from "../cookies";
 import {
   authorizeDirectErrorResponse,
   authorizeRedirectErrorResponse,
@@ -48,7 +48,7 @@ function makeAuthorizeHandler(deps) {
     }
     const q = parsed.data;
     if (raw.request_uri === undefined) {
-      const client = tenant.config.clients.find((c2) => c2.id === q.client_id);
+      const client = tenant.config.clients.find((c) => c.id === q.client_id);
       if (client?.requirePushedAuthorizationRequests) {
         return authorizeDirectErrorResponse(authError.invalidRequest("this client requires Pushed Authorization Requests (RFC 9126)", "request_uri"));
       }
@@ -123,7 +123,7 @@ function makeAuthorizeHandler(deps) {
         return applyResponsePolicy(out.response, {
           setCookies: [flowCookie, ...out.setCookies],
           cookieDefaults: deps.cookieDefaults,
-          cacheControl: cacheControlFor(out.cache)
+          cacheControl: cacheControlHeader(out.cache)
         });
       }
       case "issue-code": {
@@ -229,22 +229,6 @@ function clearFlowCookie() {
     maxAge: 0
   };
 }
-function cacheControlFor(cache) {
-  if (!cache)
-    return "no-store";
-  if ((cache.maxAge ?? -1) === 0)
-    return "no-store";
-  const parts = [];
-  if (cache.isPrivate)
-    parts.push("private");
-  if (cache.maxAge !== undefined)
-    parts.push(`max-age=${cache.maxAge}`);
-  if (cache.sMaxAge !== undefined)
-    parts.push(`s-maxage=${cache.sMaxAge}`);
-  if (cache.immutable)
-    parts.push("immutable");
-  return parts.length ? parts.join(", ") : "no-store";
-}
 export {
   makeAuthorizeHandler
 };

package/dist/esm/http/handlers/callback.js

@@ -5,7 +5,13 @@ import { applyResponsePolicy } from "../cookies";
 import { authorizeDirectErrorResponse } from "../errors";
 function makeCallbackHandler(deps) {
   return async (c) => {
-    const result = await handleCallback({ rawRequest: c.req.raw, cookies: c.get("cookies") }, {
+    const tenant = c.get("tenant");
+    const result = await handleCallback({
+      rawRequest: c.req.raw,
+      cookies: c.get("cookies"),
+      ...tenant ? { tenant } : {},
+      issuerUrl: c.get("issuerUrl")
+    }, {
       configStore: deps.configStore,
       sessionStore: deps.sessionStore,
       tokenStore: deps.tokenStore,

package/dist/esm/http/handlers/metadata.js

@@ -32,6 +32,6 @@ function makeJwksHandler(deps) {
   };
 }
 export {
-  makeJwksHandler,
-  makeDiscoveryHandler
+  makeDiscoveryHandler,
+  makeJwksHandler
 };

package/dist/esm/http/handlers/method-route.js

@@ -1,8 +1,11 @@
 // src/http/handlers/method-route.ts
-import { handleMethodRoute } from "../../domain/method-route";
+import {
+  handleMethodRoute,
+  handlePublicMethodRoute
+} from "../../domain/method-route";
 import { authError } from "../../types/error";
 import { isErr } from "../../types/result";
-import { applyResponsePolicy } from "../cookies";
+import { applyResponsePolicy, cacheControlHeader } from "../cookies";
 import { authorizeDirectErrorResponse } from "../errors";
 function makeMethodRouteHandler(deps) {
   return async (c) => {
@@ -10,6 +13,48 @@ function makeMethodRouteHandler(deps) {
     if (!tenant) {
       return authorizeDirectErrorResponse(authError.invalidRequest("tenant unresolved"));
     }
+    {
+      const u = new URL(c.req.url);
+      const segs = u.pathname.split("/").filter(Boolean);
+      if (segs.length >= 3 && segs[0] === "m") {
+        const methodId = segs[1];
+        const subPath = "/" + segs.slice(2).join("/");
+        const httpMethod = c.req.method.toUpperCase() === "POST" ? "POST" : "GET";
+        const routeKey = `${httpMethod} ${subPath}`;
+        const resolved = await deps.methodCache.resolve(tenant.config, methodId);
+        if (!isErr(resolved) && resolved.value.publicRoutes?.includes(routeKey)) {
+          const issuerUrl = c.get("issuerUrl");
+          const callbackHost = deps.callbackHostFor?.(tenant.id) ?? new URL(issuerUrl).host;
+          const callbackUrl = `${new URL(issuerUrl).protocol}//${callbackHost}/cb/${methodId}`;
+          const pub = await handlePublicMethodRoute({
+            rawRequest: c.req.raw,
+            tenant,
+            method: resolved.value,
+            route: routeKey,
+            subPath,
+            dispatch: { state: "", callbackUrl, issuerUrl }
+          }, {
+            sessionStore: deps.sessionStore,
+            tokenStore: deps.tokenStore,
+            clock: deps.clock,
+            ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+            ...deps.onLogout ? { onLogout: deps.onLogout } : {}
+          });
+          if (isErr(pub))
+            return authorizeDirectErrorResponse(pub.error);
+          if (pub.value.kind === "denied") {
+            return applyResponsePolicy(new Response(`access_denied: ${pub.value.reason}`, {
+              status: 403,
+              headers: { "content-type": "text/plain" }
+            }), { cookieDefaults: deps.cookieDefaults });
+          }
+          return applyResponsePolicy(pub.value.response, {
+            cacheControl: cacheControlHeader(pub.value.cache),
+            cookieDefaults: deps.cookieDefaults
+          });
+        }
+      }
+    }
     const cookies = c.get("cookies");
     const flowId = cookies.get("idp.flow");
     if (!flowId) {

package/dist/esm/http/handlers/revocation.js

@@ -93,6 +93,6 @@ async function readForm(req) {
   return new URLSearchParams(await req.text());
 }
 export {
-  makeRevokeHandler,
-  makeIntrospectHandler
+  makeIntrospectHandler,
+  makeRevokeHandler
 };