@_mustachio/openauth 0.13.3 → 0.15.0

package/dist/esm/client.js

@@ -37,59 +37,59 @@ function createClient(input) {
     jwksCache.set(issuer, result);
     return result;
   }
+  function applyClientAuth(headers, body) {
+    const secret = input.clientSecret;
+    if (secret === undefined)
+      return;
+    if ((input.tokenEndpointAuthMethod ?? "client_secret_basic") === "client_secret_post") {
+      body.set("client_secret", secret);
+      return;
+    }
+    const cred = `${encodeURIComponent(input.clientID)}:${encodeURIComponent(secret)}`;
+    headers["authorization"] = `Basic ${btoa(cred)}`;
+  }
   const result = {
-    async authorize(redirectURI, response, opts) {
-      const result = new URL(issuer + "/authorize");
+    async authorize(redirectURI, opts) {
+      const wk = await getIssuer();
+      const url = new URL(wk.authorization_endpoint);
+      const pkce = await generatePKCE();
       const challenge = {
-        state: crypto.randomUUID()
+        state: crypto.randomUUID(),
+        verifier: pkce.verifier
       };
-      result.searchParams.set("client_id", input.clientID);
-      result.searchParams.set("redirect_uri", redirectURI);
-      result.searchParams.set("response_type", response);
-      result.searchParams.set("state", challenge.state);
+      url.searchParams.set("client_id", input.clientID);
+      url.searchParams.set("redirect_uri", redirectURI);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("state", challenge.state);
+      url.searchParams.set("code_challenge_method", "S256");
+      url.searchParams.set("code_challenge", pkce.challenge);
       if (opts?.provider)
-        result.searchParams.set("provider", opts.provider);
+        url.searchParams.set("provider", opts.provider);
       if (opts?.scope !== undefined) {
         const scope = Array.isArray(opts.scope) ? opts.scope.join(" ") : opts.scope;
         if (scope)
-          result.searchParams.set("scope", scope);
-      }
-      if (opts?.pkce && response === "code") {
-        const pkce = await generatePKCE();
-        result.searchParams.set("code_challenge_method", "S256");
-        result.searchParams.set("code_challenge", pkce.challenge);
-        challenge.verifier = pkce.verifier;
+          url.searchParams.set("scope", scope);
       }
-      return {
-        challenge,
-        url: result.toString()
-      };
-    },
-    async pkce(redirectURI, opts) {
-      const result = new URL(issuer + "/authorize");
-      if (opts?.provider)
-        result.searchParams.set("provider", opts.provider);
-      result.searchParams.set("client_id", input.clientID);
-      result.searchParams.set("redirect_uri", redirectURI);
-      result.searchParams.set("response_type", "code");
-      const pkce = await generatePKCE();
-      result.searchParams.set("code_challenge_method", "S256");
-      result.searchParams.set("code_challenge", pkce.challenge);
-      return [pkce.verifier, result.toString()];
+      return { challenge, url: url.toString() };
     },
     async exchange(code, redirectURI, verifier) {
-      const tokens = await f(issuer + "/token", {
+      const wk = await getIssuer();
+      const body = new URLSearchParams({
+        code,
+        redirect_uri: redirectURI,
+        grant_type: "authorization_code",
+        client_id: input.clientID
+      });
+      if (verifier)
+        body.set("code_verifier", verifier);
+      const headers = {
+        "Content-Type": "application/x-www-form-urlencoded"
+      };
+      applyClientAuth(headers, body);
+      const tokens = await f(wk.token_endpoint, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: new URLSearchParams({
-          code,
-          redirect_uri: redirectURI,
-          grant_type: "authorization_code",
-          client_id: input.clientID,
-          code_verifier: verifier || ""
-        }).toString()
+        headers,
+        body: body.toString()
       });
       const json = await tokens.json();
       if (!tokens.ok) {
@@ -121,15 +121,20 @@ function createClient(input) {
           };
         }
       }
-      const tokens = await f(issuer + "/token", {
+      const wk = await getIssuer();
+      const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refresh,
+        client_id: input.clientID
+      });
+      const headers = {
+        "Content-Type": "application/x-www-form-urlencoded"
+      };
+      applyClientAuth(headers, body);
+      const tokens = await f(wk.token_endpoint, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: new URLSearchParams({
-          grant_type: "refresh_token",
-          refresh_token: refresh
-        }).toString()
+        headers,
+        body: body.toString()
       });
       const json = await tokens.json();
       if (!tokens.ok) {
@@ -151,30 +156,24 @@ function createClient(input) {
       const jwks = await getJWKS();
       try {
         const result = await jwtVerify(token, jwks, {
-          issuer
+          issuer,
+          audience: options?.audience ?? input.clientID
         });
         const claim = result.payload.claim;
-        let subjectType;
-        let subjectProperties;
-        if (claim && typeof claim.type === "string") {
-          subjectType = claim.type;
-          subjectProperties = claim.properties;
-        } else if (result.payload.mode === "access" && typeof result.payload.type === "string") {
-          subjectType = result.payload.type;
-          subjectProperties = result.payload.properties;
-        }
-        if (subjectType === undefined) {
+        if (!claim || typeof claim.type !== "string") {
           return { err: new InvalidSubjectError };
         }
+        const subjectType = claim.type;
         const schema = subjects[subjectType];
         if (!schema) {
           return { err: new InvalidSubjectError };
         }
-        const validated = await schema["~standard"].validate(subjectProperties);
+        const validated = await schema["~standard"].validate(claim.properties);
         if (validated.issues) {
           return { err: new InvalidSubjectError };
         }
         return {
+          err: false,
           aud: result.payload.aud,
           subject: {
             type: subjectType,

package/dist/esm/domain/authorize.js

@@ -211,6 +211,16 @@ async function issueCodeFromInlineSuccess(result, record, deps) {
   }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
   if (isErr(saved))
     return err(saved.error);
+  await safeAudit(deps, {
+    kind: "authorize_succeeded",
+    tenantId: flow.tenantId,
+    clientId: flow.clientId,
+    methodId: flow.methodId,
+    methodKind: flow.methodKind,
+    flowId: flow.flowId,
+    providerSubject: result.providerSubject,
+    timestamp: now
+  });
   return ok({
     kind: "issue-code",
     code,

package/dist/esm/domain/callback.js

@@ -6,26 +6,8 @@ import { randomToken } from "./crypto";
 import { dispatchMethod } from "./method-dispatch";
 import { callbackTarget } from "./mount";
 import { saveEncryptedCode } from "./token";
-import { verifyStateEnvelope } from "./state-envelope";
+import { extractCallbackState, verifyStateEnvelope } from "./state-envelope";
 import { AUTH_CODE_TTL_MS } from "./authorize";
-async function extractCallbackState(req) {
-  const fromQuery = new URL(req.url).searchParams.get("state");
-  if (fromQuery)
-    return fromQuery;
-  if (req.method !== "POST")
-    return null;
-  const ct = req.headers.get("content-type") ?? "";
-  if (!ct.includes("application/x-www-form-urlencoded"))
-    return null;
-  try {
-    const body = await req.clone().text();
-    const form = new URLSearchParams(body);
-    const v = form.get("state") ?? form.get("RelayState");
-    return v && v.length > 0 ? v : null;
-  } catch {
-    return null;
-  }
-}
 async function handleCallback(input, deps) {
   const url = new URL(input.rawRequest.url);
   const state = await extractCallbackState(input.rawRequest);
@@ -147,6 +129,16 @@ async function translate(result, flow, deps) {
       }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
       if (isErr(saved))
         return err(saved.error);
+      await safeAudit(deps, {
+        kind: "authorize_succeeded",
+        tenantId: flow.tenantId,
+        clientId: flow.clientId,
+        methodId: flow.methodId,
+        methodKind: flow.methodKind,
+        flowId: flow.flowId,
+        providerSubject: result.providerSubject,
+        timestamp: now
+      });
       return ok({
         kind: "issue-code",
         code,
@@ -282,6 +274,16 @@ async function tryIdpInitiated(input, deps, url) {
   }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
   if (isErr(saved))
     return err(saved.error);
+  await safeAudit(deps, {
+    kind: "authorize_succeeded",
+    tenantId: input.tenant.id,
+    clientId: binding.clientId,
+    methodId,
+    methodKind: method.kind,
+    flowId: "",
+    providerSubject: result.providerSubject,
+    timestamp: now
+  });
   return ok({
     kind: "issue-code",
     code,

package/dist/esm/domain/client-credentials.js

@@ -4,6 +4,8 @@ import { err, isErr, ok } from "../types/result";
 import { verifyClientCredentials } from "./client-auth";
 import { randomId } from "./crypto";
 import { mintTokens } from "./token";
+import { safeAudit } from "./audit";
+import { validateSubjectClaim } from "./subject";
 async function clientCredentialsGrant(req, deps, tenantId) {
   const tenantCfg = await deps.configStore.getTenantConfig(tenantId);
   if (isErr(tenantCfg))
@@ -67,6 +69,20 @@ async function clientCredentialsGrant(req, deps, tenantId) {
   } catch (e) {
     return err(authError.serverError("success callback threw", e));
   }
+  const checked = await validateSubjectClaim(deps.subjects, claim);
+  if (isErr(checked)) {
+    await safeAudit(deps, {
+      kind: "invalid_subject_claim",
+      tenantId: tenant.id,
+      clientId: client.id,
+      subjectType: checked.error.rejection.subjectType,
+      reason: checked.error.rejection.reason,
+      detail: checked.error.rejection.detail,
+      timestamp: deps.clock()
+    });
+    return err(checked.error);
+  }
+  claim = checked.value;
   const minted = await mintTokens({
     tenant,
     claim,

package/dist/esm/domain/method-route.js

@@ -74,6 +74,16 @@ async function translate(result, flow, deps) {
       }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
       if (isErr(saved))
         return err(saved.error);
+      await safeAudit(deps, {
+        kind: "authorize_succeeded",
+        tenantId: final.tenantId,
+        clientId: final.clientId,
+        methodId: final.methodId,
+        methodKind: final.methodKind,
+        flowId: final.flowId,
+        providerSubject: result.providerSubject,
+        timestamp: now
+      });
       return ok({
         kind: "issue-code",
         code,

package/dist/esm/domain/refresh.js

@@ -4,6 +4,16 @@ import { err, isErr } from "../types/result";
 import { safeAudit } from "./audit";
 import { verifyClientCredentials } from "./client-auth";
 import { mintTokens } from "./token";
+function validateRequestedScopes(requested, granted) {
+  if (!requested)
+    return null;
+  for (const s of requested.split(" ").filter(Boolean)) {
+    if (!granted.includes(s)) {
+      return authError.invalidScope(`requested scope "${s}" not granted by original refresh token`);
+    }
+  }
+  return null;
+}
 async function refreshTokens(req, deps) {
   const peek = await deps.tokenStore.peekRefresh(req.refreshToken);
   if (isErr(peek))
@@ -39,6 +49,9 @@ async function refreshTokens(req, deps) {
       return err(authError.invalidDpopProof("refresh token DPoP jkt does not match the original binding"));
     }
   }
+  const scopeErr = validateRequestedScopes(req.scope, peekedPayload.scopes);
+  if (scopeErr)
+    return err(scopeErr);
   const consumed = await deps.tokenStore.consumeRefresh(req.refreshToken, {
     reuseWindowMs: deps.reuseWindowMs
   });
@@ -56,12 +69,10 @@ async function refreshTokens(req, deps) {
     return err(consumed.error);
   }
   const payload = consumed.value;
+  const authoritativeScopeErr = validateRequestedScopes(req.scope, payload.scopes);
+  if (authoritativeScopeErr)
+    return err(authoritativeScopeErr);
   const requestedScopes = req.scope ? req.scope.split(" ").filter(Boolean) : payload.scopes;
-  for (const s of requestedScopes) {
-    if (!payload.scopes.includes(s)) {
-      return err(authError.invalidScope(`requested scope "${s}" not granted by original refresh token`));
-    }
-  }
   const tenant = {
     id: payload.tenantId,
     config: tenantCfg.value,

package/dist/esm/domain/register.js

@@ -50,12 +50,18 @@ async function registerNewClient(request, tenant, deps) {
   };
   const hookResult = await deps.registerClient({
     tenant,
-    request
+    request,
+    client: clientConfig,
+    ...secret !== undefined ? { secret } : {}
   });
   if (isErr(hookResult))
     return err(hookResult.error);
   const persisted = hookResult.value.client;
-  const persistedSecret = hookResult.value.secret;
+  const keptOurSecret = persisted.type === "confidential" && clientConfig.type === "confidential" && persisted.secretHash === clientConfig.secretHash;
+  const persistedSecret = hookResult.value.secret ?? (keptOurSecret ? secret : undefined);
+  if (persisted.type === "confidential" && persistedSecret === undefined) {
+    return err(authError.serverError("registerClient persisted a confidential client with a substituted " + "secretHash but returned no matching plaintext secret"));
+  }
   const issuedAt = Math.floor(deps.clock() / 1000);
   return ok({
     client_id: persisted.id,

package/dist/esm/domain/state-envelope.js

@@ -74,7 +74,26 @@ function isEnvelopeShape(value) {
   const v = value;
   return typeof v.tenantId === "string" && typeof v.flowId === "string" && typeof v.nonce === "string" && typeof v.kid === "string";
 }
+async function extractCallbackState(req) {
+  const fromQuery = new URL(req.url).searchParams.get("state");
+  if (fromQuery)
+    return fromQuery;
+  if (req.method !== "POST")
+    return null;
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.toLowerCase().includes("application/x-www-form-urlencoded")) {
+    return null;
+  }
+  try {
+    const form = new URLSearchParams(await req.clone().text());
+    const v = form.get("state") ?? form.get("RelayState");
+    return v && v.length > 0 ? v : null;
+  } catch {
+    return null;
+  }
+}
 export {
+  extractCallbackState,
   mintStateEnvelope,
   verifyStateEnvelope
 };

package/dist/esm/domain/subject.js

@@ -0,0 +1,35 @@
+// src/domain/subject.ts
+import { authError } from "../types/error";
+import { err, ok } from "../types/result";
+async function validateSubjectClaim(subjects, claim) {
+  const declared = Object.keys(subjects);
+  const subjectType = typeof claim?.type === "string" ? claim.type : "";
+  const schema = subjectType ? subjects[subjectType] : undefined;
+  if (!schema) {
+    return err(Object.assign(authError.serverError(`success() returned subject type "${subjectType}", which is not declared in \`subjects\``), {
+      rejection: {
+        reason: "unknown-type",
+        subjectType,
+        detail: `declared: ${declared.join(", ") || "(none)"}`
+      }
+    }));
+  }
+  const validated = await schema["~standard"].validate(claim.properties);
+  if (validated.issues) {
+    const detail = validated.issues.map((i) => (i.path ?? []).map(String).join(".") || "(root)").join(", ") || "(root)";
+    return err(Object.assign(authError.serverError(`success() returned properties that violate the "${subjectType}" schema`), {
+      rejection: {
+        reason: "invalid-properties",
+        subjectType,
+        detail
+      }
+    }));
+  }
+  return ok({
+    type: subjectType,
+    properties: validated.value
+  });
+}
+export {
+  validateSubjectClaim
+};

package/dist/esm/domain/token.js

@@ -15,6 +15,7 @@ import {
 import { buildIdTokenClaims, shouldIssueIdToken } from "./id-token";
 import { signAccessToken, signIdToken } from "./jwt";
 import { validatePkce } from "./pkce";
+import { validateSubjectClaim } from "./subject";
 async function saveEncryptedCode(code, payload, ttl, deps) {
   const keyResult = await deps.keyStore.currentEncryptionKey();
   if (isErr(keyResult))
@@ -91,6 +92,20 @@ async function exchangeCode(req, deps) {
   } catch (e) {
     return err(authError.serverError("success callback threw", e));
   }
+  const checked = await validateSubjectClaim(deps.subjects, claim);
+  if (isErr(checked)) {
+    await safeAudit(deps, {
+      kind: "invalid_subject_claim",
+      tenantId: payload.tenantId,
+      clientId: payload.clientId,
+      subjectType: checked.error.rejection.subjectType,
+      reason: checked.error.rejection.reason,
+      detail: checked.error.rejection.detail,
+      timestamp: deps.clock()
+    });
+    return err(checked.error);
+  }
+  claim = checked.value;
   if (deps.persistUpstreamTokens) {
     try {
       await deps.persistUpstreamTokens({
@@ -124,6 +139,19 @@ async function mintTokens(args) {
   const now = deps.clock();
   const receivingClient = tenant.config.clients.find((c) => c.id === payload.clientId);
   const subjectId = await deriveSubjectId(claim, receivingClient?.sectorIdentifier);
+  if (deps.onTokenIssued) {
+    try {
+      await deps.onTokenIssued({
+        tenant,
+        clientId: payload.clientId,
+        subjectId,
+        claim,
+        ...skipRefresh ? {} : { family }
+      });
+    } catch (e) {
+      return err(authError.serverError("onTokenIssued hook threw", e));
+    }
+  }
   const keyRes = await deps.keyStore.currentSigningKey();
   if (isErr(keyRes))
     return err(keyRes.error);

package/dist/esm/http/handlers/token.js

@@ -67,9 +67,11 @@ function makeTokenHandler(deps) {
         keyStore: deps.keyStore,
         ...deps.auditLog ? { auditLog: deps.auditLog } : {},
         success: deps.success,
+        subjects: deps.subjects,
         ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
         issuerUrl: c.get("issuerUrl"),
         clock: deps.clock,
+        ...deps.onTokenIssued ? { onTokenIssued: deps.onTokenIssued } : {},
         ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
       });
       if (isErr(result))
@@ -99,9 +101,11 @@ function makeTokenHandler(deps) {
         ...deps.auditLog ? { auditLog: deps.auditLog } : {},
         methodCache: deps.methodCache,
         success: deps.success,
+        subjects: deps.subjects,
         ...deps.persistUpstreamTokens ? { persistUpstreamTokens: deps.persistUpstreamTokens } : {},
         issuerUrl: c.get("issuerUrl"),
         clock: deps.clock,
+        ...deps.onTokenIssued ? { onTokenIssued: deps.onTokenIssued } : {},
         ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
       }, tenantRes.value);
       if (isErr(result))
@@ -123,6 +127,7 @@ function makeTokenHandler(deps) {
         ...deps.auditLog ? { auditLog: deps.auditLog } : {},
         issuerUrl: c.get("issuerUrl"),
         clock: deps.clock,
+        ...deps.onTokenIssued ? { onTokenIssued: deps.onTokenIssued } : {},
         ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
       });
       if (isErr(refreshResult))
@@ -147,6 +152,7 @@ function makeTokenHandler(deps) {
       ...deps.exchangeAudience ? { exchangeAudience: deps.exchangeAudience } : {},
       issuerUrl: c.get("issuerUrl"),
       clock: deps.clock,
+      ...deps.onTokenIssued ? { onTokenIssued: deps.onTokenIssued } : {},
       ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
     });
     if (isErr(exchangeResult)) {

package/dist/esm/http/middleware/tenant.js

@@ -1,5 +1,8 @@
 // src/http/middleware/tenant.ts
-import { verifyStateEnvelope } from "../../domain/state-envelope";
+import {
+  extractCallbackState,
+  verifyStateEnvelope
+} from "../../domain/state-envelope";
 import { isErr } from "../../types/result";
 import { parseCookieHeader } from "../cookies";
 import {
@@ -90,7 +93,7 @@ function buildTenantContext(req, id, config, custom) {
   };
 }
 async function runCallbackRecovery(req, deps) {
-  const state = await extractStateParam(req);
+  const state = await extractCallbackState(req);
   if (state) {
     const env = await verifyStateEnvelope(state, deps.stateKeys);
     if (env.ok) {
@@ -103,24 +106,6 @@ async function runCallbackRecovery(req, deps) {
   }
   return { kind: "fresh-request" };
 }
-async function extractStateParam(req) {
-  const url = new URL(req.url);
-  const fromQuery = url.searchParams.get("state");
-  if (fromQuery)
-    return fromQuery;
-  if (req.method !== "POST")
-    return null;
-  const ct = req.headers.get("content-type") ?? "";
-  if (!ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
-    return null;
-  }
-  try {
-    const text = await req.clone().text();
-    return new URLSearchParams(text).get("state");
-  } catch {
-    return null;
-  }
-}
 export {
   bootstrapMiddleware,
   tenantMiddleware

package/dist/esm/index.js

@@ -67,6 +67,8 @@ function createIdP(opts) {
     ...opts.callbackHostFor ? { callbackHostFor: opts.callbackHostFor } : {},
     resolveTenant: opts.resolveTenant,
     success: opts.success,
+    subjects: opts.subjects,
+    ...opts.onTokenIssued ? { onTokenIssued: opts.onTokenIssued } : {},
     ...opts.onLogout ? { onLogout: opts.onLogout } : {},
     ...opts.persistUpstreamTokens ? { persistUpstreamTokens: opts.persistUpstreamTokens } : {},
     ...opts.exchangeAudience ? { exchangeAudience: opts.exchangeAudience } : {},