@_mustachio/openauth 0.13.2 → 0.13.3

package/src/methods/password.ts

@@ -26,6 +26,7 @@ import type {
   MethodContext,
   MethodResult,
 } from "../types/method"
+import { mountedPath } from "../domain/mount"
 import { renderForm } from "../ui/forms"
 
 export type PasswordProperties = {
@@ -140,7 +141,7 @@ async function renderLogin(
 ): Promise<MethodResult<PasswordProperties, PasswordState>> {
   const body = renderForm({
     title,
-    action: `/m/${methodId}/login`,
+    action: mountedPath(ctx.issuerUrl, `/m/${methodId}/login`),
     fields: [
       {
         name: "email",
@@ -180,6 +181,7 @@ async function handleLogin(
   const parsed = loginBodySchema.safeParse(form)
   if (!parsed.success) {
     return reLoginWithError(
+      ctx.issuerUrl,
       methodId,
       title,
       "Please enter your email and password.",
@@ -188,12 +190,22 @@ async function handleLogin(
 
   const user = await users.findByEmail(parsed.data.email, ctx.tenant.id)
   if (!user) {
-    return reLoginWithError(methodId, title, "Invalid email or password.")
+    return reLoginWithError(
+      ctx.issuerUrl,
+      methodId,
+      title,
+      "Invalid email or password.",
+    )
   }
 
   const verified = await hasher.verify(parsed.data.password, user.passwordHash)
   if (!verified) {
-    return reLoginWithError(methodId, title, "Invalid email or password.")
+    return reLoginWithError(
+      ctx.issuerUrl,
+      methodId,
+      title,
+      "Invalid email or password.",
+    )
   }
 
   return {
@@ -218,6 +230,7 @@ async function handleRegister(
   const parsed = registerBodySchema.safeParse(form)
   if (!parsed.success) {
     return reLoginWithError(
+      ctx.issuerUrl,
       methodId,
       title,
       "Password must be at least 8 characters and email must be valid.",
@@ -227,6 +240,7 @@ async function handleRegister(
   const existing = await users.findByEmail(parsed.data.email, ctx.tenant.id)
   if (existing) {
     return reLoginWithError(
+      ctx.issuerUrl,
       methodId,
       title,
       "An account with that email already exists.",
@@ -250,6 +264,7 @@ async function handleRegister(
 }
 
 function reLoginWithError(
+  issuerUrl: string,
   methodId: string,
   title: string,
   error: string,
@@ -259,7 +274,7 @@ function reLoginWithError(
     response: new Response(
       renderForm({
         title,
-        action: `/m/${methodId}/login`,
+        action: mountedPath(issuerUrl, `/m/${methodId}/login`),
         fields: [
           {
             name: "email",

package/src/methods/saml-sp/metadata.ts

@@ -22,6 +22,7 @@
  * `WantAssertionsSigned` are both read from config, so they state
  * actual runtime behaviour rather than a hardcoded assumption.
  */
+import { mountedPath } from "../../domain/mount"
 import { authError } from "../../types/error"
 import type { MethodContext, MethodResult } from "../../types/method"
 
@@ -184,7 +185,10 @@ export async function buildSpMetadata(
   // served (idp.sloUrl set ⇒ /sls is in publicRoutes). Derived from the
   // same dispatch input as the ACS so it cannot drift.
   const cb = new URL(ctx.dispatch.callbackUrl)
-  const slsUrl = `${cb.protocol}//${cb.host}/m/${methodId}/sls`
+  const slsUrl = `${cb.protocol}//${cb.host}${mountedPath(
+    ctx.dispatch.issuerUrl,
+    `/m/${methodId}/sls`,
+  )}`
   const xml = buildSpMetadataXml({
     spEntityId,
     acsUrl: ctx.dispatch.callbackUrl,

package/src/types/idp.ts

@@ -255,7 +255,22 @@ export type IdPOptions = {
    */
   resolveTenant: (req: Request) => Promise<Result<TenantId, AuthError>>
 
-  /** Opt-in for partitioned callback hosts (recovery mechanism #2). */
+  /**
+   * Opt-in for partitioned callback hosts (recovery mechanism #2).
+   *
+   * Returns the hostname a given tenant's callbacks arrive on, so the
+   * tenant is recoverable from the `Host` header before the state
+   * envelope is verified.
+   *
+   * **The issuer's mount prefix still applies to the returned host.** If
+   * `issuerUrl` is `https://example.com/idp`, a tenant host of
+   * `acme.example.com` produces `https://acme.example.com/idp/cb/<id>`.
+   * This option varies the *authority* of one deployment — those hosts
+   * are served by this same service behind the same proxy, so they share
+   * its mount. A deployment needing partitioned hosts mounted differently
+   * from the issuer is describing two mounts, which one `issuerUrl`
+   * cannot express; a second option must not be added to paper over it.
+   */
   callbackHostFor?: (tenantId: TenantId) => string
 
   /**

package/src/types/method.ts

@@ -113,6 +113,17 @@ export type MethodHandler<P, S> = (
 export type MethodContext<S = unknown> = {
   /** The raw Web Fetch `Request`. Web standard, not Hono `Context`. */
   request: Request
+  /**
+   * The issuer URL of this IdP, always present.
+   *
+   * Distinct from `dispatch.issuerUrl`, which is only populated for
+   * `GET /authorize`. Methods that render their own URLs — a form action
+   * re-rendered on a validation error, say — need it on every route, and
+   * must build those URLs with `mountedPath` so they carry the
+   * deployment's mount prefix. `ctx.request.url` is not a substitute: a
+   * proxy-stripped inbound URL has already lost that prefix.
+   */
+  issuerUrl: string
   /** Path within the method's mount, e.g. `"/callback"` (without the `/<id>` prefix). */
   subPath: string
   tenant: TenantContext