@_mustachio/openauth 0.11.0 → 0.13.0

package/dist/esm/domain/callback.js

@@ -7,21 +7,42 @@ import { dispatchMethod } from "./method-dispatch";
 import { saveEncryptedCode } from "./token";
 import { verifyStateEnvelope } from "./state-envelope";
 import { AUTH_CODE_TTL_MS } from "./authorize";
+async function extractCallbackState(req) {
+  const fromQuery = new URL(req.url).searchParams.get("state");
+  if (fromQuery)
+    return fromQuery;
+  if (req.method !== "POST")
+    return null;
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.includes("application/x-www-form-urlencoded"))
+    return null;
+  try {
+    const body = await req.clone().text();
+    const form = new URLSearchParams(body);
+    const v = form.get("state") ?? form.get("RelayState");
+    return v && v.length > 0 ? v : null;
+  } catch {
+    return null;
+  }
+}
 async function handleCallback(input, deps) {
   const url = new URL(input.rawRequest.url);
-  const state = url.searchParams.get("state");
-  if (!state) {
-    return err(authError.invalidRequest("missing state parameter", "state"));
-  }
-  const envelopeRes = await verifyStateEnvelope(state, deps.stateKeys);
-  if (isErr(envelopeRes)) {
+  const state = await extractCallbackState(input.rawRequest);
+  const envelopeRes = state ? await verifyStateEnvelope(state, deps.stateKeys) : null;
+  if (envelopeRes === null || isErr(envelopeRes)) {
+    const idp = await tryIdpInitiated(input, deps, url);
+    if (idp)
+      return idp;
+    if (!state) {
+      return err(authError.invalidRequest("missing state parameter", "state"));
+    }
     await safeAudit(deps, {
       kind: "flow_replay_attempt",
       tenantId: null,
       flowId: "unknown",
       timestamp: deps.clock()
     });
-    return err(authError.invalidRequest(envelopeRes.error.description, "state"));
+    return err(authError.invalidRequest(envelopeRes && isErr(envelopeRes) ? envelopeRes.error.description : "invalid state", "state"));
   }
   const envelope = envelopeRes.value;
   const flowRes = await deps.sessionStore.consumeFlow(envelope.flowId);
@@ -168,6 +189,99 @@ async function translate(result, flow, deps) {
       return err(result.error);
   }
 }
+async function tryIdpInitiated(input, deps, url) {
+  if (input.rawRequest.method !== "POST")
+    return null;
+  if (!input.tenant || !input.issuerUrl)
+    return null;
+  const segments = url.pathname.split("/").filter(Boolean);
+  if (segments.length < 2 || segments[0] !== "cb")
+    return null;
+  const methodId = segments[1];
+  const methodRes = await deps.methodCache.resolve(input.tenant.config, methodId);
+  if (isErr(methodRes))
+    return null;
+  const method = methodRes.value;
+  if (method.unsolicitedCallback !== true)
+    return null;
+  const callbackUrl = `${url.protocol}//${url.host}/cb/${methodId}`;
+  const dispatched = await dispatchMethod({
+    method,
+    route: "GET /callback",
+    tenant: input.tenant,
+    request: input.rawRequest,
+    subPath: "/callback",
+    flow: null,
+    cookies: input.cookies,
+    sessionStore: deps.sessionStore,
+    dispatch: { state: "", callbackUrl, issuerUrl: input.issuerUrl }
+  });
+  if (isErr(dispatched))
+    return err(dispatched.error);
+  const result = dispatched.value;
+  if (result.kind === "challenge") {
+    return ok({
+      kind: "challenge",
+      response: result.response,
+      setCookies: result.setCookies ?? [],
+      ...result.cache !== undefined ? { cache: result.cache } : {}
+    });
+  }
+  if (result.kind === "denied") {
+    await safeAudit(deps, {
+      kind: "authorize_failed",
+      tenantId: input.tenant.id,
+      clientId: "idp-initiated",
+      methodId,
+      methodKind: method.kind,
+      flowId: "idp-initiated",
+      reason: result.reason,
+      timestamp: deps.clock()
+    });
+    return ok({
+      kind: "denied",
+      reason: result.reason,
+      setCookies: result.setCookies ?? []
+    });
+  }
+  if (result.kind === "error")
+    return err(result.error);
+  const binding = result.unsolicitedBinding;
+  if (!binding) {
+    return err(authError.internalError(`method "${methodId}" handled an unsolicited callback but returned ` + `no unsolicitedBinding`));
+  }
+  const client = input.tenant.config.clients.find((c) => c.id === binding.clientId);
+  if (!client) {
+    return err(authError.invalidRequest(`IdP-initiated binding references unknown client "${binding.clientId}"`));
+  }
+  if (!client.redirectUris.includes(binding.redirectUri)) {
+    return err(authError.invalidRequest(`IdP-initiated redirect_uri "${binding.redirectUri}" is not ` + `registered for client "${binding.clientId}"`));
+  }
+  const code = (deps.newCodeId ?? randomToken)();
+  const now = deps.clock();
+  const saved = await saveEncryptedCode(code, {
+    tenantId: input.tenant.id,
+    clientId: binding.clientId,
+    appRedirectUri: binding.redirectUri,
+    appState: null,
+    scopes: binding.scopes,
+    methodId,
+    methodKind: method.kind,
+    context: input.tenant.request.custom ?? null,
+    providerSubject: result.providerSubject,
+    properties: result.properties,
+    authTime: Math.floor(now / 1000),
+    expiresAt: now + AUTH_CODE_TTL_MS
+  }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
+  if (isErr(saved))
+    return err(saved.error);
+  return ok({
+    kind: "issue-code",
+    code,
+    appRedirectUri: binding.redirectUri,
+    appState: null
+  });
+}
 function normalizePath(p) {
   return p.replace(/\/+$/, "");
 }

package/dist/esm/domain/client-auth.js

@@ -55,7 +55,7 @@ function resolveClientCredentials(input) {
   };
 }
 export {
-  verifyClientCredentials,
+  parseBasicAuth,
   resolveClientCredentials,
-  parseBasicAuth
+  verifyClientCredentials
 };

package/dist/esm/domain/crypto.js

@@ -79,19 +79,19 @@ function generateSymmetricKey() {
   return buf;
 }
 export {
-  utf8,
-  timingSafeEqualStr,
-  timingSafeEqual,
-  sha256,
-  randomToken,
-  randomId,
-  randomHex,
-  randomBytes,
-  importHmacKey,
-  hmacVerify,
-  hmacSign,
-  generateSymmetricKey,
-  encryptPayload,
+  base64url,
   decryptPayload,
-  base64url
+  encryptPayload,
+  generateSymmetricKey,
+  hmacSign,
+  hmacVerify,
+  importHmacKey,
+  randomBytes,
+  randomHex,
+  randomId,
+  randomToken,
+  sha256,
+  timingSafeEqual,
+  timingSafeEqualStr,
+  utf8
 };

package/dist/esm/domain/discovery.js

@@ -78,6 +78,6 @@ async function buildJwks(keyStore) {
   return ok(buildJwksDocument(res.value));
 }
 export {
-  buildJwks,
-  buildDiscoveryDocument
+  buildDiscoveryDocument,
+  buildJwks
 };

package/dist/esm/domain/dpop.js

@@ -114,9 +114,9 @@ function stringifyError(e) {
   return e instanceof Error ? e.message : String(e);
 }
 export {
-  verifyDpopProof,
-  computeAth,
-  canonicalHtu,
+  DEFAULT_DPOP_IAT_TOLERANCE_SEC,
   DEFAULT_DPOP_JTI_TTL_MS,
-  DEFAULT_DPOP_IAT_TOLERANCE_SEC
+  canonicalHtu,
+  computeAth,
+  verifyDpopProof
 };

package/dist/esm/domain/id-token.js

@@ -85,10 +85,10 @@ function shouldIssueIdToken(scopes) {
   return scopes.includes("openid");
 }
 export {
-  shouldIssueIdToken,
-  pickScopedClaims,
-  deriveAmr,
-  computeAtHash,
+  DEFAULT_ID_TOKEN_TTL_MS,
   buildIdTokenClaims,
-  DEFAULT_ID_TOKEN_TTL_MS
+  computeAtHash,
+  deriveAmr,
+  pickScopedClaims,
+  shouldIssueIdToken
 };

package/dist/esm/domain/jwt.js

@@ -63,9 +63,9 @@ function buildJwksDocument(keys) {
   };
 }
 export {
-  verifyIdToken,
-  verifyAccessToken,
-  signIdToken,
+  buildJwksDocument,
   signAccessToken,
-  buildJwksDocument
+  signIdToken,
+  verifyAccessToken,
+  verifyIdToken
 };

package/dist/esm/domain/method-dispatch.js

@@ -13,7 +13,8 @@ async function dispatchMethod(input) {
     flow: input.flow,
     methodState: input.flow?.methodState ?? null,
     cookies: input.cookies,
-    dispatch: input.dispatch
+    dispatch: input.dispatch,
+    methodScratch: buildMethodScratch(input.sessionStore, input.tenant.id, input.method.id)
   };
   let result;
   try {
@@ -31,6 +32,31 @@ async function dispatchMethod(input) {
   }
   return ok(result);
 }
+function buildMethodScratch(store, tenantId, methodId) {
+  const prefix = `scratch:${tenantId}:${methodId}:`;
+  const scope = (key) => `${prefix}${key}`;
+  const unsupported = (op) => authError.internalError(`SessionStore does not implement ${op}; methodScratch is unavailable on this adapter`);
+  return {
+    put: async (key, value, ttlMs) => {
+      if (!store.saveScratch)
+        return err(unsupported("saveScratch"));
+      if (ttlMs <= 0) {
+        return err(authError.internalError(`methodScratch.put: ttlMs must be positive, got ${ttlMs}`));
+      }
+      return store.saveScratch(scope(key), value, ttlMs);
+    },
+    get: async (key) => {
+      if (!store.readScratch)
+        return err(unsupported("readScratch"));
+      return store.readScratch(scope(key));
+    },
+    delete: async (key) => {
+      if (!store.deleteScratch)
+        return err(unsupported("deleteScratch"));
+      return store.deleteScratch(scope(key));
+    }
+  };
+}
 export {
   dispatchMethod
 };

package/dist/esm/domain/method-route.js

@@ -5,6 +5,7 @@ import { safeAudit } from "./audit";
 import { AUTH_CODE_TTL_MS } from "./authorize";
 import { randomToken } from "./crypto";
 import { dispatchMethod } from "./method-dispatch";
+import { revokeAllForSubject } from "./revoke";
 import { saveEncryptedCode } from "./token";
 async function handleMethodRoute(input, deps) {
   const flowRes = await deps.sessionStore.readFlow(input.flowId);
@@ -106,6 +107,84 @@ async function translate(result, flow, deps) {
       return err(result.error);
   }
 }
+async function handlePublicMethodRoute(input, deps) {
+  if (!input.method.publicRoutes?.includes(input.route)) {
+    return err(authError.invalidRequest(`route "${input.route}" is not public on method "${input.method.id}"`, "path"));
+  }
+  const dispatched = await dispatchMethod({
+    method: input.method,
+    route: input.route,
+    tenant: input.tenant,
+    request: input.rawRequest,
+    subPath: input.subPath,
+    flow: null,
+    cookies: new Map,
+    sessionStore: deps.sessionStore,
+    dispatch: input.dispatch
+  });
+  if (isErr(dispatched))
+    return err(dispatched.error);
+  const r = dispatched.value;
+  switch (r.kind) {
+    case "challenge": {
+      if (r.logout) {
+        const sideEffect = await runUpstreamLogout(input, deps, r.logout);
+        if (isErr(sideEffect))
+          return err(sideEffect.error);
+      }
+      return ok({
+        kind: "challenge",
+        response: r.response,
+        ...r.cache !== undefined ? { cache: r.cache } : {}
+      });
+    }
+    case "denied":
+      return ok({ kind: "denied", reason: r.reason });
+    case "success":
+      return err(authError.internalError(`public route "${input.route}" on method "${input.method.id}" ` + `returned success — a flowless route cannot authenticate`));
+    case "error":
+      return err(r.error);
+  }
+}
+async function runUpstreamLogout(input, deps, logout) {
+  let hookResult = undefined;
+  if (deps.onLogout) {
+    const evt = {
+      tenant: input.tenant,
+      methodId: input.method.id,
+      methodKind: input.method.kind,
+      reason: "upstream_slo",
+      ...logout.nameId !== undefined ? { nameId: logout.nameId } : {},
+      ...logout.sessionIndex !== undefined ? { sessionIndex: logout.sessionIndex } : {}
+    };
+    try {
+      hookResult = await deps.onLogout(evt);
+    } catch (e) {
+      return err(authError.internalError(`onLogout hook threw during upstream Single Logout for method ` + `"${input.method.id}"`, e));
+    }
+  }
+  const revokeSubject = hookResult && typeof hookResult === "object" ? hookResult.revokeSubject : undefined;
+  if (revokeSubject) {
+    const revoked = await revokeAllForSubject(input.tenant.id, revokeSubject, {
+      tokenStore: deps.tokenStore,
+      ...deps.auditLog ? { auditLog: deps.auditLog } : {},
+      clock: deps.clock
+    });
+    if (isErr(revoked))
+      return err(revoked.error);
+  }
+  await safeAudit(deps, {
+    kind: "session_logout",
+    tenantId: input.tenant.id,
+    via: "upstream_slo",
+    methodId: input.method.id,
+    methodKind: input.method.kind,
+    ...revokeSubject ? { subjectId: revokeSubject } : {},
+    timestamp: deps.clock()
+  });
+  return ok(undefined);
+}
 export {
-  handleMethodRoute
+  handleMethodRoute,
+  handlePublicMethodRoute
 };

package/dist/esm/domain/par.js

@@ -45,7 +45,7 @@ async function pushAuthorizationRequest(req, tenant, deps) {
   });
 }
 export {
-  pushAuthorizationRequest,
+  DEFAULT_PAR_TTL_MS,
   PAR_URI_PREFIX,
-  DEFAULT_PAR_TTL_MS
+  pushAuthorizationRequest
 };

package/dist/esm/domain/pkce.js

@@ -11,6 +11,6 @@ async function validatePkce(verifier, challenge) {
   return timingSafeEqualStr(computed, challenge);
 }
 export {
-  validatePkce,
-  s256Challenge
+  s256Challenge,
+  validatePkce
 };

package/dist/esm/domain/revoke.js

@@ -76,6 +76,6 @@ async function revokeAllForSubject(tenantId, subjectId, deps) {
   return ok(undefined);
 }
 export {
-  revokeToken,
-  revokeAllForSubject
+  revokeAllForSubject,
+  revokeToken
 };

package/dist/esm/domain/scim/discovery.js

@@ -0,0 +1,206 @@
+// src/domain/scim/discovery.ts
+import {
+  SCIM_ENTERPRISE_SCHEMA,
+  SCIM_GROUP_SCHEMA,
+  SCIM_LIST_SCHEMA,
+  SCIM_USER_SCHEMA
+} from "./resource";
+function serviceProviderConfig(baseUrl, maxResults) {
+  return {
+    schemas: ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"],
+    documentationUri: "https://datatracker.ietf.org/doc/html/rfc7644",
+    patch: { supported: true },
+    bulk: { supported: false, maxOperations: 0, maxPayloadSize: 0 },
+    filter: { supported: true, maxResults },
+    changePassword: { supported: false },
+    sort: { supported: false },
+    etag: { supported: false },
+    authenticationSchemes: [
+      {
+        type: "oauthbearertoken",
+        name: "OAuth Bearer Token",
+        description: "Authentication via the bearer token issued for this SCIM connection",
+        specUri: "https://datatracker.ietf.org/doc/html/rfc6750",
+        primary: true
+      }
+    ],
+    meta: {
+      resourceType: "ServiceProviderConfig",
+      location: `${baseUrl}/ServiceProviderConfig`
+    }
+  };
+}
+function resourceTypes(baseUrl, groups) {
+  const user = {
+    schemas: ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
+    id: "User",
+    name: "User",
+    endpoint: "/Users",
+    description: "User Account",
+    schema: SCIM_USER_SCHEMA,
+    schemaExtensions: [{ schema: SCIM_ENTERPRISE_SCHEMA, required: false }],
+    meta: {
+      resourceType: "ResourceType",
+      location: `${baseUrl}/ResourceTypes/User`
+    }
+  };
+  const group = {
+    schemas: ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"],
+    id: "Group",
+    name: "Group",
+    endpoint: "/Groups",
+    description: "Group",
+    schema: SCIM_GROUP_SCHEMA,
+    meta: {
+      resourceType: "ResourceType",
+      location: `${baseUrl}/ResourceTypes/Group`
+    }
+  };
+  const resources = groups ? [user, group] : [user];
+  return {
+    schemas: [SCIM_LIST_SCHEMA],
+    totalResults: resources.length,
+    startIndex: 1,
+    itemsPerPage: resources.length,
+    Resources: resources
+  };
+}
+var str = (name, extra = {}) => ({
+  name,
+  type: "string",
+  multiValued: false,
+  required: false,
+  caseExact: false,
+  mutability: "readWrite",
+  returned: "default",
+  uniqueness: "none",
+  ...extra
+});
+var multiValueSub = [
+  str("value"),
+  str("type"),
+  {
+    name: "primary",
+    type: "boolean",
+    multiValued: false,
+    required: false,
+    mutability: "readWrite",
+    returned: "default"
+  }
+];
+function schemas(baseUrl, groups) {
+  const userSchema = {
+    id: SCIM_USER_SCHEMA,
+    name: "User",
+    description: "User Account",
+    attributes: [
+      str("userName", { required: true, uniqueness: "server" }),
+      {
+        name: "name",
+        type: "complex",
+        multiValued: false,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+        subAttributes: [
+          str("formatted"),
+          str("familyName"),
+          str("givenName"),
+          str("middleName"),
+          str("honorificPrefix"),
+          str("honorificSuffix")
+        ]
+      },
+      str("displayName"),
+      {
+        name: "active",
+        type: "boolean",
+        multiValued: false,
+        required: false,
+        mutability: "readWrite",
+        returned: "default"
+      },
+      {
+        name: "emails",
+        type: "complex",
+        multiValued: true,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+        subAttributes: multiValueSub
+      },
+      {
+        name: "phoneNumbers",
+        type: "complex",
+        multiValued: true,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+        subAttributes: multiValueSub
+      }
+    ],
+    meta: {
+      resourceType: "Schema",
+      location: `${baseUrl}/Schemas/${SCIM_USER_SCHEMA}`
+    }
+  };
+  const enterpriseSchema = {
+    id: SCIM_ENTERPRISE_SCHEMA,
+    name: "EnterpriseUser",
+    description: "Enterprise User Extension",
+    attributes: [
+      str("employeeNumber"),
+      str("costCenter"),
+      str("organization"),
+      str("division"),
+      str("department"),
+      {
+        name: "manager",
+        type: "complex",
+        multiValued: false,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+        subAttributes: [str("value"), str("displayName")]
+      }
+    ],
+    meta: {
+      resourceType: "Schema",
+      location: `${baseUrl}/Schemas/${SCIM_ENTERPRISE_SCHEMA}`
+    }
+  };
+  const groupSchema = {
+    id: SCIM_GROUP_SCHEMA,
+    name: "Group",
+    description: "Group",
+    attributes: [
+      str("displayName", { required: true }),
+      {
+        name: "members",
+        type: "complex",
+        multiValued: true,
+        required: false,
+        mutability: "readWrite",
+        returned: "default",
+        subAttributes: [str("value"), str("display"), str("type")]
+      }
+    ],
+    meta: {
+      resourceType: "Schema",
+      location: `${baseUrl}/Schemas/${SCIM_GROUP_SCHEMA}`
+    }
+  };
+  const resources = groups ? [userSchema, enterpriseSchema, groupSchema] : [userSchema, enterpriseSchema];
+  return {
+    schemas: [SCIM_LIST_SCHEMA],
+    totalResults: resources.length,
+    startIndex: 1,
+    itemsPerPage: resources.length,
+    Resources: resources
+  };
+}
+export {
+  resourceTypes,
+  schemas,
+  serviceProviderConfig
+};