@_mustachio/openauth 0.9.1 → 0.10.0

package/dist/esm/http/handlers/userinfo.js

@@ -0,0 +1,54 @@
+// src/http/handlers/userinfo.ts
+import { userinfo } from "../../domain/userinfo";
+import { isErr } from "../../types/result";
+function makeUserinfoHandler(deps) {
+  return async (c) => {
+    const bearer = extractBearer(c.req.header("authorization") ?? null);
+    if (!bearer) {
+      const r = new Response(JSON.stringify({
+        error: "invalid_token",
+        error_description: "missing bearer token"
+      }), {
+        status: 401,
+        headers: {
+          "content-type": "application/json",
+          "www-authenticate": 'Bearer realm="userinfo"'
+        }
+      });
+      return r;
+    }
+    const res = await userinfo(bearer, {
+      keyStore: deps.keyStore,
+      issuerUrl: c.get("issuerUrl")
+    });
+    if (isErr(res)) {
+      const err = res.error;
+      return new Response(JSON.stringify({
+        error: "invalid_token",
+        error_description: err.description
+      }), {
+        status: 401,
+        headers: {
+          "content-type": "application/json",
+          "www-authenticate": `Bearer error="invalid_token"`
+        }
+      });
+    }
+    return new Response(JSON.stringify(res.value), {
+      status: 200,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store"
+      }
+    });
+  };
+}
+function extractBearer(header) {
+  if (!header)
+    return null;
+  const m = /^Bearer\s+(.+)$/i.exec(header);
+  return m?.[1] ?? null;
+}
+export {
+  makeUserinfoHandler
+};

package/dist/esm/http/middleware/error.js

@@ -0,0 +1,15 @@
+// src/http/middleware/error.ts
+import { authError } from "../../types/error";
+import { tokenEndpointErrorResponse } from "../errors";
+function errorMiddleware(_deps) {
+  return async (_c, next) => {
+    try {
+      await next();
+    } catch (e) {
+      return tokenEndpointErrorResponse(authError.serverError(e instanceof Error ? e.message : "unexpected error", e));
+    }
+  };
+}
+export {
+  errorMiddleware
+};

package/dist/esm/http/middleware/tenant.js

@@ -0,0 +1,102 @@
+// src/http/middleware/tenant.ts
+import { verifyStateEnvelope } from "../../domain/state-envelope";
+import { isErr } from "../../types/result";
+import { parseCookieHeader } from "../cookies";
+import {
+  authorizeDirectErrorResponse,
+  tokenEndpointErrorResponse
+} from "../errors";
+import { authError } from "../../types/error";
+function isCallbackPath(pathname) {
+  return pathname.startsWith("/cb/");
+}
+function bootstrapMiddleware(deps) {
+  return async (c, next) => {
+    const cookies = parseCookieHeader(c.req.header("cookie") ?? null);
+    c.set("cookies", cookies);
+    c.set("issuerUrl", deps.resolveIssuer(c.req.raw));
+    c.set("tenant", null);
+    c.set("recovery", null);
+    await next();
+  };
+}
+function tenantMiddleware(deps) {
+  return async (c, next) => {
+    const url = new URL(c.req.url);
+    if (isCallbackPath(url.pathname)) {
+      const recovery = await runCallbackRecovery(c.req.raw, deps);
+      c.set("recovery", recovery);
+      if (recovery.kind !== "fresh-request") {
+        const cfg2 = await deps.configStore.getTenantConfig(recovery.tenantId);
+        if (isErr(cfg2)) {
+          return tokenEndpointErrorResponse(cfg2.error);
+        }
+        const customCb = deps.buildCustomContext ? await deps.buildCustomContext(c.req.raw) : {};
+        c.set("tenant", buildTenantContext(c.req.raw, recovery.tenantId, cfg2.value, customCb));
+        return next();
+      }
+    }
+    const resolved = await deps.resolveTenant(c.req.raw);
+    if (isErr(resolved)) {
+      if (url.pathname === "/authorize") {
+        return authorizeDirectErrorResponse(resolved.error);
+      }
+      return tokenEndpointErrorResponse(resolved.error);
+    }
+    const tenantId = resolved.value;
+    const cfg = await deps.configStore.getTenantConfig(tenantId);
+    if (isErr(cfg)) {
+      const err = cfg.error.code === "tenant_not_found" ? authError.invalidRequest(cfg.error.description, "tenant") : cfg.error;
+      if (url.pathname === "/authorize") {
+        return authorizeDirectErrorResponse(err);
+      }
+      return tokenEndpointErrorResponse(err);
+    }
+    const custom = deps.buildCustomContext ? await deps.buildCustomContext(c.req.raw) : {};
+    c.set("tenant", buildTenantContext(c.req.raw, tenantId, cfg.value, custom));
+    await next();
+  };
+}
+function buildTenantContext(req, id, config, custom) {
+  return {
+    id,
+    config,
+    request: { raw: req, custom }
+  };
+}
+async function runCallbackRecovery(req, deps) {
+  const state = await extractStateParam(req);
+  if (state) {
+    const env = await verifyStateEnvelope(state, deps.stateKeys);
+    if (env.ok) {
+      return {
+        kind: "mac-state",
+        tenantId: env.value.tenantId,
+        flowId: env.value.flowId
+      };
+    }
+  }
+  return { kind: "fresh-request" };
+}
+async function extractStateParam(req) {
+  const url = new URL(req.url);
+  const fromQuery = url.searchParams.get("state");
+  if (fromQuery)
+    return fromQuery;
+  if (req.method !== "POST")
+    return null;
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
+    return null;
+  }
+  try {
+    const text = await req.clone().text();
+    return new URLSearchParams(text).get("state");
+  } catch {
+    return null;
+  }
+}
+export {
+  tenantMiddleware,
+  bootstrapMiddleware
+};

package/dist/esm/http/resolver.js

@@ -0,0 +1,15 @@
+// src/http/resolver.ts
+function injectResolverHints(original, hints) {
+  const url = new URL(original.url);
+  for (const [k, v] of Object.entries(hints)) {
+    if (!url.searchParams.has(k))
+      url.searchParams.set(k, v);
+  }
+  return new Request(url.toString(), {
+    method: original.method,
+    headers: original.headers
+  });
+}
+export {
+  injectResolverHints
+};

package/dist/esm/http/router.js

@@ -0,0 +1,35 @@
+// src/http/router.ts
+import { Hono } from "hono";
+import { makeAuthorizeHandler } from "./handlers/authorize";
+import { makeCallbackHandler } from "./handlers/callback";
+import { makeDiscoveryHandler, makeJwksHandler } from "./handlers/metadata";
+import { makeMethodRouteHandler } from "./handlers/method-route";
+import { makeIntrospectHandler, makeRevokeHandler } from "./handlers/revocation";
+import { makeTokenHandler } from "./handlers/token";
+import { makeUserinfoHandler } from "./handlers/userinfo";
+import { errorMiddleware } from "./middleware/error";
+import { bootstrapMiddleware, tenantMiddleware } from "./middleware/tenant";
+function buildRouter(deps) {
+  const app = new Hono;
+  app.use("*", errorMiddleware(deps));
+  app.use("*", bootstrapMiddleware(deps));
+  app.get("/.well-known/openid-configuration", makeDiscoveryHandler(deps));
+  app.get("/.well-known/oauth-authorization-server", makeDiscoveryHandler(deps));
+  app.get("/.well-known/jwks.json", makeJwksHandler(deps));
+  app.use("/authorize", tenantMiddleware(deps));
+  app.get("/authorize", makeAuthorizeHandler(deps));
+  app.use("/cb/*", tenantMiddleware(deps));
+  app.get("/cb/*", makeCallbackHandler(deps));
+  app.post("/cb/*", makeCallbackHandler(deps));
+  app.use("/m/*", tenantMiddleware(deps));
+  app.all("/m/*", makeMethodRouteHandler(deps));
+  app.post("/token", makeTokenHandler(deps));
+  app.get("/userinfo", makeUserinfoHandler(deps));
+  app.post("/userinfo", makeUserinfoHandler(deps));
+  app.post("/revoke", makeRevokeHandler(deps));
+  app.post("/introspect", makeIntrospectHandler(deps));
+  return app;
+}
+export {
+  buildRouter
+};

package/dist/esm/http/schemas/authorize.js

@@ -0,0 +1,24 @@
+// src/http/schemas/authorize.ts
+import { z } from "zod";
+var SCOPE_TOKEN = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
+var csv = z.string().min(1).transform((s) => s.split(/\s+/).map((part) => part.trim()).filter((part) => part.length > 0));
+var scopeParam = z.string().transform((s) => s.split(/\s+/).map((part) => part.trim()).filter((part) => part.length > 0)).pipe(z.array(z.string().regex(SCOPE_TOKEN, "invalid scope token")));
+var authorizeQuerySchema = z.object({
+  response_type: z.string({
+    required_error: "missing response_type"
+  }),
+  client_id: z.string({ required_error: "missing client_id" }).min(1, "empty client_id"),
+  redirect_uri: z.string({ required_error: "missing redirect_uri" }).url("redirect_uri must be a valid URL"),
+  scope: scopeParam.optional(),
+  state: z.string().optional(),
+  audience: z.string().optional(),
+  method_id: z.string().optional(),
+  code_challenge: z.string().optional(),
+  code_challenge_method: z.literal("S256").optional(),
+  prompt: csv.optional(),
+  ui_locales: csv.optional(),
+  nonce: z.string().optional()
+}).passthrough();
+export {
+  authorizeQuerySchema
+};

package/dist/esm/http/schemas/revocation.js

@@ -0,0 +1,18 @@
+// src/http/schemas/revocation.ts
+import { z } from "zod";
+var revokeBodySchema = z.object({
+  token: z.string().min(1, "missing token"),
+  token_type_hint: z.enum(["access_token", "refresh_token"]).optional(),
+  client_id: z.string().optional(),
+  client_secret: z.string().optional()
+});
+var introspectBodySchema = z.object({
+  token: z.string().min(1, "missing token"),
+  token_type_hint: z.enum(["access_token", "refresh_token"]).optional(),
+  client_id: z.string().optional(),
+  client_secret: z.string().optional()
+});
+export {
+  revokeBodySchema,
+  introspectBodySchema
+};

package/dist/esm/http/schemas/token.js

@@ -0,0 +1,57 @@
+// src/http/schemas/token.ts
+import { z } from "zod";
+var TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
+var ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token";
+var REFRESH_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:refresh_token";
+var authorizationCodeGrantSchema = z.object({
+  grant_type: z.literal("authorization_code"),
+  code: z.string().min(1, "missing code"),
+  redirect_uri: z.string().url("invalid redirect_uri"),
+  client_id: z.string().min(1, "missing client_id"),
+  client_secret: z.string().optional(),
+  code_verifier: z.string().optional()
+});
+var refreshTokenGrantSchema = z.object({
+  grant_type: z.literal("refresh_token"),
+  refresh_token: z.string().min(1, "missing refresh_token"),
+  scope: z.string().optional(),
+  client_id: z.string().optional(),
+  client_secret: z.string().optional()
+});
+var clientCredentialsGrantSchema = z.object({
+  grant_type: z.literal("client_credentials"),
+  client_id: z.string().min(1, "missing client_id"),
+  client_secret: z.string().min(1, "missing client_secret"),
+  scope: z.string().optional(),
+  audience: z.string().optional(),
+  resource: z.string().optional()
+}).passthrough();
+var tokenExchangeGrantSchema = z.object({
+  grant_type: z.literal(TOKEN_EXCHANGE_GRANT_TYPE),
+  subject_token: z.string().min(1, "missing subject_token"),
+  subject_token_type: z.literal(ACCESS_TOKEN_TYPE),
+  audience: z.string().min(1, "missing audience"),
+  requested_token_type: z.literal(ACCESS_TOKEN_TYPE).optional(),
+  scope: z.string().optional(),
+  client_id: z.string().optional(),
+  client_secret: z.string().optional(),
+  actor_token: z.string().optional(),
+  actor_token_type: z.string().optional(),
+  resource: z.string().optional()
+}).passthrough();
+var tokenRequestSchema = z.discriminatedUnion("grant_type", [
+  authorizationCodeGrantSchema,
+  refreshTokenGrantSchema,
+  clientCredentialsGrantSchema,
+  tokenExchangeGrantSchema
+]);
+export {
+  tokenRequestSchema,
+  tokenExchangeGrantSchema,
+  refreshTokenGrantSchema,
+  clientCredentialsGrantSchema,
+  authorizationCodeGrantSchema,
+  TOKEN_EXCHANGE_GRANT_TYPE,
+  REFRESH_TOKEN_TYPE,
+  ACCESS_TOKEN_TYPE
+};

package/dist/esm/index.js

@@ -1,14 +1,126 @@
 // src/index.ts
+import { err, isErr, isOk, ok } from "./types/result";
+import { authError } from "./types/error";
+import { asTenantId } from "./types/tenant";
+import { revokeAllForSubject } from "./domain/revoke";
+import { passwordMethod } from "./methods/password";
+import { codeMethod } from "./methods/code";
+import { m2mMethod } from "./methods/m2m";
+import { passkeyMethod } from "./methods/passkey";
 import {
-  createClient
-} from "./client.js";
+  argon2idHasher,
+  DEFAULT_ARGON2ID_PARAMS
+} from "./methods/password-hash";
+import { buildOauth2Method } from "./methods/oauth2-generic";
+import { buildOidcMethod } from "./methods/oidc-generic";
 import {
-  createSubjects
-} from "./subject.js";
-import { issuer } from "./issuer.js";
+  oauth2Factory,
+  oidcFactory
+} from "./methods/oauth2-factory";
+import {
+  appleFactory,
+  cognitoFactory,
+  discordFactory,
+  facebookFactory,
+  githubFactory,
+  googleFactory,
+  jumpcloudFactory,
+  keycloakFactory,
+  linkedinFactory,
+  microsoftFactory,
+  slackFactory,
+  spotifyFactory,
+  twitchFactory,
+  xFactory,
+  yahooFactory
+} from "./methods/providers";
+import { MethodCache } from "./domain/method-cache";
+import { buildRouter } from "./http/router";
+function createIdP(opts) {
+  const mismatched = Object.entries(opts.methods).filter(([key, factory]) => key !== factory.kind).map(([key, factory]) => `${key}!=${factory.kind}`);
+  if (mismatched.length > 0) {
+    throw new Error(`createIdP: methods map keys must equal factory.kind. Offenders: ${mismatched.join(", ")}`);
+  }
+  const clock = () => Date.now();
+  const auditLog = opts.auditLog;
+  const methodCache = new MethodCache({
+    factories: opts.methods,
+    ...auditLog ? { auditLog } : {},
+    now: clock
+  });
+  opts.configStore.onInvalidate?.((tenantId) => {
+    methodCache.invalidate(tenantId);
+  });
+  const resolveIssuer = (req) => typeof opts.issuerUrl === "string" ? opts.issuerUrl : opts.issuerUrl(req);
+  const deps = {
+    configStore: opts.configStore,
+    tokenStore: opts.tokenStore,
+    sessionStore: opts.sessionStore,
+    keyStore: opts.keyStore,
+    ...opts.methodStore ? { methodStore: opts.methodStore } : {},
+    ...auditLog ? { auditLog } : {},
+    methodCache,
+    stateKeys: opts.stateKeys,
+    resolveIssuer,
+    ...opts.callbackHostFor ? { callbackHostFor: opts.callbackHostFor } : {},
+    resolveTenant: opts.resolveTenant,
+    success: opts.success,
+    ...opts.persistUpstreamTokens ? { persistUpstreamTokens: opts.persistUpstreamTokens } : {},
+    ...opts.exchangeAudience ? { exchangeAudience: opts.exchangeAudience } : {},
+    ...opts.renderPicker ? { renderPicker: opts.renderPicker } : {},
+    ...opts.buildCustomContext ? { buildCustomContext: opts.buildCustomContext } : {},
+    clock,
+    cookieDefaults: {
+      secure: opts.cookies?.secure ?? true,
+      ...opts.cookies?.domain !== undefined ? { domain: opts.cookies.domain } : {},
+      ...opts.cookies?.path !== undefined ? { path: opts.cookies.path } : {}
+    }
+  };
+  const app = buildRouter(deps);
+  const fetch = async (req) => await app.fetch(req);
+  return {
+    handle: fetch,
+    authorize: fetch,
+    token: fetch,
+    userinfo: fetch,
+    jwks: fetch,
+    discovery: fetch,
+    revoke: fetch,
+    introspect: fetch
+  };
+}
 export {
-  issuer,
-  createSubjects,
-  createClient,
-  issuer as authorizer
+  yahooFactory,
+  xFactory,
+  twitchFactory,
+  spotifyFactory,
+  slackFactory,
+  revokeAllForSubject,
+  passwordMethod,
+  passkeyMethod,
+  ok,
+  oidcFactory,
+  oauth2Factory,
+  microsoftFactory,
+  m2mMethod,
+  linkedinFactory,
+  keycloakFactory,
+  jumpcloudFactory,
+  isOk,
+  isErr,
+  googleFactory,
+  githubFactory,
+  facebookFactory,
+  err,
+  discordFactory,
+  createIdP,
+  cognitoFactory,
+  codeMethod,
+  buildOidcMethod,
+  buildOauth2Method,
+  authError,
+  asTenantId,
+  argon2idHasher,
+  appleFactory,
+  DEFAULT_ARGON2ID_PARAMS
 };

package/dist/esm/methods/code.js

@@ -0,0 +1,221 @@
+// src/methods/code.ts
+import { z } from "zod";
+import {
+  base64url,
+  randomBytes,
+  sha256,
+  timingSafeEqualStr,
+  utf8
+} from "../domain/crypto";
+import { renderForm } from "../ui/forms";
+var configSchema = z.object({
+  codeLength: z.number().int().min(4).max(10).optional(),
+  maxAttempts: z.number().int().min(1).max(20).optional(),
+  destinationKind: z.enum(["email", "tel", "any"]).optional(),
+  titles: z.object({
+    request: z.string().optional(),
+    verify: z.string().optional()
+  }).optional()
+});
+var sendBody = z.object({
+  destination: z.string().min(1)
+});
+var verifyBody = z.object({
+  code: z.string().min(1)
+});
+function codeMethod(opts) {
+  const customGenerator = opts.generateCode;
+  return {
+    kind: "code",
+    configSchema,
+    build: async ({
+      id,
+      kind,
+      config
+    }) => {
+      const titleRequest = config.titles?.request ?? "Sign in";
+      const titleVerify = config.titles?.verify ?? "Enter your code";
+      const maxAttempts = config.maxAttempts ?? 5;
+      const destinationKind = config.destinationKind ?? "email";
+      const codeLength = config.codeLength ?? 6;
+      const generateCode = customGenerator ?? (() => defaultCode(codeLength));
+      return {
+        id,
+        kind,
+        type: "code",
+        routes: {
+          "GET /authorize": async (_ctx) => ({
+            kind: "challenge",
+            response: htmlResponse(renderForm({
+              title: titleRequest,
+              action: `/m/${id}/send`,
+              fields: destinationField(destinationKind),
+              submit: "Send code"
+            }))
+          }),
+          "POST /send": async (ctx) => handleSend(ctx, id, titleRequest, titleVerify, destinationKind, generateCode, opts.sendCode),
+          "POST /verify": async (ctx) => handleVerify(ctx, id, titleVerify, maxAttempts)
+        }
+      };
+    }
+  };
+}
+async function handleSend(ctx, methodId, titleRequest, titleVerify, destinationKind, generateCode, sendCode) {
+  const form = await safeForm(ctx.request);
+  const parsed = sendBody.safeParse(form);
+  if (!parsed.success || !validateDestination(parsed.data?.destination, destinationKind)) {
+    return {
+      kind: "challenge",
+      response: htmlResponse(renderForm({
+        title: titleRequest,
+        action: `/m/${methodId}/send`,
+        fields: destinationField(destinationKind),
+        submit: "Send code",
+        error: "Please enter a valid destination."
+      }), 400)
+    };
+  }
+  const destination = parsed.data.destination;
+  const code = generateCode();
+  try {
+    await sendCode({ destination, code, tenantId: ctx.tenant.id });
+  } catch {}
+  const hash = base64url.encode(await sha256(utf8.encode(code)));
+  return {
+    kind: "challenge",
+    response: htmlResponse(renderForm({
+      title: titleVerify,
+      action: `/m/${methodId}/verify`,
+      fields: [
+        {
+          name: "code",
+          label: "Code",
+          required: true,
+          inputmode: "numeric",
+          autocomplete: "one-time-code"
+        }
+      ],
+      submit: "Verify",
+      hidden: { destination }
+    })),
+    saveMethodState: {
+      destination,
+      codeHash: hash,
+      attempts: 0
+    }
+  };
+}
+async function handleVerify(ctx, methodId, titleVerify, maxAttempts) {
+  if (!ctx.methodState) {
+    return {
+      kind: "error",
+      error: {
+        code: "invalid_request",
+        description: "verify without prior /send"
+      }
+    };
+  }
+  const state = ctx.methodState;
+  if (state.attempts >= maxAttempts) {
+    return { kind: "denied", reason: "too_many_attempts" };
+  }
+  const form = await safeForm(ctx.request);
+  const parsed = verifyBody.safeParse(form);
+  if (!parsed.success) {
+    return verifyError(methodId, state, titleVerify, "Please enter the code.");
+  }
+  const submittedHash = base64url.encode(await sha256(utf8.encode(parsed.data.code)));
+  if (!timingSafeEqualStr(submittedHash, state.codeHash)) {
+    return verifyError(methodId, { ...state, attempts: state.attempts + 1 }, titleVerify, "Incorrect code. Please try again.");
+  }
+  return {
+    kind: "success",
+    providerSubject: state.destination,
+    properties: { destination: state.destination }
+  };
+}
+function verifyError(methodId, next, titleVerify, error) {
+  return {
+    kind: "challenge",
+    response: htmlResponse(renderForm({
+      title: titleVerify,
+      action: `/m/${methodId}/verify`,
+      fields: [
+        {
+          name: "code",
+          label: "Code",
+          required: true,
+          inputmode: "numeric",
+          autocomplete: "one-time-code"
+        }
+      ],
+      submit: "Verify",
+      error
+    }), 400),
+    saveMethodState: { ...next, error }
+  };
+}
+function destinationField(kind) {
+  if (kind === "email") {
+    return [
+      {
+        name: "destination",
+        label: "Email",
+        type: "email",
+        required: true,
+        autocomplete: "email"
+      }
+    ];
+  }
+  if (kind === "tel") {
+    return [
+      {
+        name: "destination",
+        label: "Phone",
+        type: "tel",
+        required: true,
+        autocomplete: "tel"
+      }
+    ];
+  }
+  return [
+    {
+      name: "destination",
+      label: "Destination",
+      type: "text",
+      required: true
+    }
+  ];
+}
+function validateDestination(destination, kind) {
+  if (!destination)
+    return false;
+  if (kind === "email")
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(destination);
+  if (kind === "tel")
+    return /^[+\d][\d\s\-()]{6,}$/.test(destination);
+  return destination.length > 0;
+}
+function defaultCode(length) {
+  const buf = randomBytes(4);
+  const view = new DataView(buf.buffer, buf.byteOffset, 4);
+  const max = 10 ** length;
+  const n = view.getUint32(0) % max;
+  return n.toString().padStart(length, "0");
+}
+async function safeForm(req) {
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
+    return {};
+  }
+  return Object.fromEntries(new URLSearchParams(await req.text()).entries());
+}
+function htmlResponse(body, status = 200) {
+  return new Response(body, {
+    status,
+    headers: { "content-type": "text/html; charset=utf-8" }
+  });
+}
+export {
+  codeMethod
+};