@_mustachio/openauth 0.9.1 → 0.10.0

package/dist/esm/adapters/postgres/token-store.js

@@ -0,0 +1,151 @@
+// src/adapters/postgres/token-store.ts
+import { AUTH_CODE_TTL_MS } from "../../domain/authorize";
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+
+class PostgresTokenStore {
+  #exec;
+  #clock;
+  constructor(opts) {
+    this.#exec = opts.exec;
+    this.#clock = opts.clock ?? (() => Date.now());
+  }
+  async saveCode(code, ciphertext, ttl) {
+    if (ttl <= 0 || ttl > AUTH_CODE_TTL_MS) {
+      return err(authError.internalError(`saveCode: ttl ${ttl} outside (0, ${AUTH_CODE_TTL_MS}] (auth-code TTL is fixed at 60s by OAuth 2.1 BCP)`));
+    }
+    const expiresAt = this.#clock() + ttl;
+    try {
+      await this.#exec.query(`INSERT INTO openauth_codes (code, ciphertext, expires_at) VALUES ($1, $2, $3)`, [code, ciphertext, expiresAt]);
+    } catch (e) {
+      return err(authError.internalError("saveCode: insert failed", e));
+    }
+    return ok(undefined);
+  }
+  async consumeCode(code) {
+    let row;
+    try {
+      const result = await this.#exec.query(`DELETE FROM openauth_codes WHERE code = $1 RETURNING ciphertext, expires_at`, [code]);
+      row = result.rows[0];
+    } catch (e) {
+      return err(authError.internalError("consumeCode: query failed", e));
+    }
+    if (!row) {
+      return err(authError.invalidGrant("auth code unknown or already consumed"));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      return err(authError.invalidGrant("auth code expired"));
+    }
+    return ok(row.ciphertext);
+  }
+  async saveRefresh(refresh, payload) {
+    try {
+      await this.#exec.query(`INSERT INTO openauth_refresh_tokens
+           (token, tenant_id, client_id, subject_id, family, expires_at, payload)
+         VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb)`, [
+        refresh,
+        payload.tenantId,
+        payload.clientId,
+        payload.subjectId,
+        payload.family,
+        payload.expiresAt,
+        JSON.stringify(payload)
+      ]);
+    } catch (e) {
+      return err(authError.internalError("saveRefresh: insert failed", e));
+    }
+    return ok(undefined);
+  }
+  async consumeRefresh(refresh, options = {}) {
+    const reuseWindow = options.reuseWindowMs ?? 60000;
+    const now = this.#clock();
+    let claimed;
+    try {
+      const result = await this.#exec.query(`UPDATE openauth_refresh_tokens
+           SET consumed_at = $1
+         WHERE token = $2
+           AND consumed_at IS NULL
+           AND expires_at > $1
+         RETURNING payload`, [now, refresh]);
+      claimed = result.rows[0];
+    } catch (e) {
+      return err(authError.internalError("consumeRefresh: claim failed", e));
+    }
+    if (claimed) {
+      return ok(parseRefreshPayload(claimed.payload));
+    }
+    let existing;
+    try {
+      const result = await this.#exec.query(`SELECT consumed_at, expires_at, payload
+           FROM openauth_refresh_tokens
+          WHERE token = $1`, [refresh]);
+      existing = result.rows[0];
+    } catch (e) {
+      return err(authError.internalError("consumeRefresh: lookup failed", e));
+    }
+    if (!existing) {
+      return err(authError.invalidGrant("refresh token unknown"));
+    }
+    if (existing.consumed_at !== null && existing.consumed_at !== undefined) {
+      const consumedAt = Number(existing.consumed_at);
+      const withinWindow = now - consumedAt <= reuseWindow;
+      if (withinWindow) {
+        const payload = parseRefreshPayload(existing.payload);
+        await this.revokeFamily(payload.family);
+        return err(authError.invalidGrant(`refresh token reuse detected (family=${payload.family})`, {
+          family: payload.family,
+          tenantId: payload.tenantId,
+          subjectId: payload.subjectId
+        }));
+      }
+      return err(authError.invalidGrant("refresh token already consumed"));
+    }
+    if (now >= Number(existing.expires_at)) {
+      return err(authError.invalidGrant("refresh token expired"));
+    }
+    return err(authError.internalError("consumeRefresh: unexplained miss"));
+  }
+  async peekRefresh(refresh) {
+    let row;
+    try {
+      const result = await this.#exec.query(`SELECT expires_at, payload
+           FROM openauth_refresh_tokens
+          WHERE token = $1`, [refresh]);
+      row = result.rows[0];
+    } catch (e) {
+      return err(authError.internalError("peekRefresh: lookup failed", e));
+    }
+    if (!row) {
+      return err(authError.invalidGrant("refresh token unknown"));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      return err(authError.invalidGrant("refresh token expired"));
+    }
+    return ok(parseRefreshPayload(row.payload));
+  }
+  async revokeFamily(family) {
+    try {
+      await this.#exec.query(`DELETE FROM openauth_refresh_tokens WHERE family = $1`, [family]);
+    } catch (e) {
+      return err(authError.internalError("revokeFamily: delete failed", e));
+    }
+    return ok(undefined);
+  }
+  async revokeBySubject(tenantId, subjectId) {
+    try {
+      await this.#exec.query(`DELETE FROM openauth_refresh_tokens
+          WHERE tenant_id = $1 AND subject_id = $2`, [tenantId, subjectId]);
+    } catch (e) {
+      return err(authError.internalError("revokeBySubject: delete failed", e));
+    }
+    return ok(undefined);
+  }
+}
+function parseRefreshPayload(raw) {
+  if (typeof raw === "string")
+    return JSON.parse(raw);
+  return raw;
+}
+export {
+  PostgresTokenStore
+};

package/dist/esm/client.js

@@ -146,17 +146,33 @@ function createClient(input) {
         const result2 = await jwtVerify(token, jwks, {
           issuer
         });
-        const validated = await subjects[result2.payload.type]["~standard"].validate(result2.payload.properties);
-        if (!validated.issues && result2.payload.mode === "access")
-          return {
-            aud: result2.payload.aud,
-            subject: {
-              type: result2.payload.type,
-              properties: validated.value
-            }
-          };
+        const claim = result2.payload.claim;
+        let subjectType;
+        let subjectProperties;
+        if (claim && typeof claim.type === "string") {
+          subjectType = claim.type;
+          subjectProperties = claim.properties;
+        } else if (result2.payload.mode === "access" && typeof result2.payload.type === "string") {
+          subjectType = result2.payload.type;
+          subjectProperties = result2.payload.properties;
+        }
+        if (subjectType === undefined) {
+          return { err: new InvalidSubjectError };
+        }
+        const schema = subjects[subjectType];
+        if (!schema) {
+          return { err: new InvalidSubjectError };
+        }
+        const validated = await schema["~standard"].validate(subjectProperties);
+        if (validated.issues) {
+          return { err: new InvalidSubjectError };
+        }
         return {
-          err: new InvalidSubjectError
+          aud: result2.payload.aud,
+          subject: {
+            type: subjectType,
+            properties: validated.value
+          }
         };
       } catch (e) {
         if (e instanceof errors.JWTExpired && options?.refresh) {

package/dist/esm/domain/audit.js

@@ -0,0 +1,13 @@
+// src/domain/audit.ts
+async function safeAudit(deps, event) {
+  if (!deps.auditLog)
+    return;
+  try {
+    await deps.auditLog.log(event);
+  } catch (e) {
+    console.error(`[openauth] auditLog.log failed for kind=${event.kind} — audit gap; check your AuditLog adapter health`, e);
+  }
+}
+export {
+  safeAudit
+};

package/dist/esm/domain/authorize.js

@@ -0,0 +1,212 @@
+// src/domain/authorize.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { safeAudit } from "./audit";
+import { randomId, randomToken } from "./crypto";
+import { dispatchMethod } from "./method-dispatch";
+import { mintStateEnvelope } from "./state-envelope";
+import { saveEncryptedCode } from "./token";
+var DEFAULT_FLOW_TTL_MS = 10 * 60 * 1000;
+var AUTH_CODE_TTL_MS = 60 * 1000;
+async function startAuthorize(input, deps) {
+  const tenant = input.tenant;
+  const req = input.request;
+  const client = tenant.config.clients.find((c) => c.id === req.clientId);
+  if (!client) {
+    return err(authError.invalidClient(`unknown client "${req.clientId}"`));
+  }
+  if (!client.redirectUris.includes(req.redirectUri)) {
+    return err(authError.invalidRequest(`redirect_uri "${req.redirectUri}" not registered for client "${client.id}"`, "redirect_uri"));
+  }
+  if (req.responseType !== "code") {
+    return err(authError.invalidRequest(`unsupported response_type "${req.responseType}" — OAuth 2.1 is code-only`, "response_type"));
+  }
+  const grantOk = client.grantTypes.includes("authorization_code");
+  if (!grantOk) {
+    return err(authError.unauthorizedClient(`client "${client.id}" is not authorized for authorization_code grant`));
+  }
+  const scopeError = validateScopes(req.scopes, client.scopes);
+  if (scopeError)
+    return err(scopeError);
+  const pkceError = validatePkceRequirement(req, client);
+  if (pkceError)
+    return err(pkceError);
+  const enabled = tenant.config.methods.filter((m) => m.enabled);
+  if (enabled.length === 0) {
+    return err(authError.methodNotFound("no auth methods enabled for tenant", {}));
+  }
+  let methodId = req.methodId;
+  if (!methodId) {
+    if (enabled.length === 1) {
+      methodId = enabled[0].id;
+    } else {
+      return ok({
+        kind: "select-method",
+        methods: enabled.map((m) => ({ id: m.id, kind: m.kind, type: m.type }))
+      });
+    }
+  }
+  const methodResult = await deps.methodCache.resolve(tenant.config, methodId);
+  if (isErr(methodResult))
+    return err(methodResult.error);
+  const method = methodResult.value;
+  const flowId = (deps.newFlowId ?? randomId)();
+  const nonce = (deps.newNonce ?? randomToken)();
+  const flowTtl = deps.flowTtlMs ?? DEFAULT_FLOW_TTL_MS;
+  const now = deps.clock();
+  const callbackHost = deps.callbackHostFor?.(tenant.id) ?? new URL(deps.issuerUrl).host;
+  const callbackPath = `/cb/${methodId}`;
+  const callbackUrl = `${new URL(deps.issuerUrl).protocol}//${callbackHost}${callbackPath}`;
+  const record = {
+    flowId,
+    tenantId: tenant.id,
+    methodId,
+    methodKind: method.kind,
+    clientId: client.id,
+    appRedirectUri: req.redirectUri,
+    callbackPath,
+    callbackHost,
+    appState: req.state,
+    scopes: req.scopes,
+    responseType: "code",
+    audience: req.audience,
+    prompt: req.prompt,
+    uiLocales: req.uiLocales,
+    nonce,
+    clientPkce: req.codeChallenge ? { challenge: req.codeChallenge, method: "S256" } : undefined,
+    methodState: null,
+    context: tenant.request.custom,
+    createdAt: now,
+    expiresAt: now + flowTtl
+  };
+  const saved = await deps.sessionStore.saveFlow(flowId, record, flowTtl);
+  if (isErr(saved))
+    return err(saved.error);
+  const stateEnvelope = await mintStateEnvelope({ tenantId: tenant.id, flowId, nonce }, deps.stateKeys);
+  await safeAudit(deps, {
+    kind: "authorize_started",
+    tenantId: tenant.id,
+    clientId: client.id,
+    methodId,
+    methodKind: method.kind,
+    flowId,
+    timestamp: now
+  });
+  const dispatched = await dispatchMethod({
+    method,
+    route: "GET /authorize",
+    tenant,
+    request: input.rawRequest,
+    subPath: "/authorize",
+    flow: record,
+    cookies: input.cookies,
+    sessionStore: deps.sessionStore,
+    dispatch: {
+      state: stateEnvelope,
+      callbackUrl,
+      issuerUrl: deps.issuerUrl
+    }
+  });
+  if (isErr(dispatched))
+    return err(dispatched.error);
+  return translateMethodResult(dispatched.value, record, method, deps);
+}
+function validateScopes(requested, allowed) {
+  for (const s of requested) {
+    if (!allowed.includes(s)) {
+      return authError.invalidScope(`scope "${s}" not allowed for client`);
+    }
+  }
+  return null;
+}
+function validatePkceRequirement(req, client) {
+  if (!client.pkceRequired)
+    return null;
+  if (!req.codeChallenge) {
+    return authError.invalidRequest(`client "${client.id}" requires PKCE — missing code_challenge`, "code_challenge");
+  }
+  if (req.codeChallengeMethod && req.codeChallengeMethod !== "S256") {
+    return authError.invalidRequest(`unsupported code_challenge_method "${req.codeChallengeMethod}" — S256 required`, "code_challenge_method");
+  }
+  return null;
+}
+async function translateMethodResult(result, record, _method, deps) {
+  switch (result.kind) {
+    case "challenge":
+      return ok({
+        kind: "challenge",
+        response: result.response,
+        setCookies: result.setCookies ?? [],
+        flowId: record.flowId,
+        ...result.cache !== undefined ? { cache: result.cache } : {}
+      });
+    case "success": {
+      const issued = await issueCodeFromInlineSuccess(result, record, deps);
+      return issued;
+    }
+    case "denied":
+      await safeAudit(deps, {
+        kind: "authorize_failed",
+        tenantId: record.tenantId,
+        clientId: record.clientId,
+        methodId: record.methodId,
+        methodKind: record.methodKind,
+        flowId: record.flowId,
+        reason: result.reason,
+        timestamp: deps.clock()
+      });
+      return ok({
+        kind: "denied",
+        reason: result.reason,
+        setCookies: result.setCookies ?? []
+      });
+    case "error":
+      await safeAudit(deps, {
+        kind: "authorize_failed",
+        tenantId: record.tenantId,
+        clientId: record.clientId,
+        methodId: record.methodId,
+        methodKind: record.methodKind,
+        flowId: record.flowId,
+        reason: result.error.code,
+        timestamp: deps.clock()
+      });
+      return err(result.error);
+  }
+}
+async function issueCodeFromInlineSuccess(result, record, deps) {
+  const code = (deps.newCodeId ?? randomToken)();
+  const consumed = await deps.sessionStore.consumeFlow(record.flowId);
+  if (isErr(consumed))
+    return err(consumed.error);
+  const flow = consumed.value;
+  const now = deps.clock();
+  const saved = await saveEncryptedCode(code, {
+    tenantId: flow.tenantId,
+    clientId: flow.clientId,
+    appRedirectUri: flow.appRedirectUri,
+    appState: flow.appState,
+    scopes: flow.scopes,
+    audience: flow.audience,
+    clientPkce: flow.clientPkce,
+    methodId: flow.methodId,
+    methodKind: flow.methodKind,
+    context: flow.context ?? null,
+    providerSubject: result.providerSubject,
+    properties: result.properties,
+    expiresAt: now + AUTH_CODE_TTL_MS
+  }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
+  if (isErr(saved))
+    return err(saved.error);
+  return ok({
+    kind: "issue-code",
+    code,
+    appRedirectUri: flow.appRedirectUri,
+    appState: flow.appState
+  });
+}
+export {
+  startAuthorize,
+  DEFAULT_FLOW_TTL_MS,
+  AUTH_CODE_TTL_MS
+};

package/dist/esm/domain/callback.js

@@ -0,0 +1,173 @@
+// src/domain/callback.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { safeAudit } from "./audit";
+import { randomToken } from "./crypto";
+import { dispatchMethod } from "./method-dispatch";
+import { saveEncryptedCode } from "./token";
+import { verifyStateEnvelope } from "./state-envelope";
+import { AUTH_CODE_TTL_MS } from "./authorize";
+async function handleCallback(input, deps) {
+  const url = new URL(input.rawRequest.url);
+  const state = url.searchParams.get("state");
+  if (!state) {
+    return err(authError.invalidRequest("missing state parameter", "state"));
+  }
+  const envelopeRes = await verifyStateEnvelope(state, deps.stateKeys);
+  if (isErr(envelopeRes)) {
+    await safeAudit(deps, {
+      kind: "flow_replay_attempt",
+      tenantId: null,
+      flowId: "unknown",
+      timestamp: deps.clock()
+    });
+    return err(authError.invalidRequest(envelopeRes.error.description, "state"));
+  }
+  const envelope = envelopeRes.value;
+  const flowRes = await deps.sessionStore.consumeFlow(envelope.flowId);
+  if (isErr(flowRes)) {
+    await safeAudit(deps, {
+      kind: "flow_replay_attempt",
+      tenantId: envelope.tenantId,
+      flowId: envelope.flowId,
+      timestamp: deps.clock()
+    });
+    return err(authError.invalidRequest(flowRes.error.description, "state"));
+  }
+  const flow = flowRes.value;
+  if (envelope.tenantId !== flow.tenantId) {
+    await safeAudit(deps, {
+      kind: "flow_tenant_mismatch",
+      stateTenantId: envelope.tenantId,
+      flowTenantId: flow.tenantId,
+      flowId: flow.flowId,
+      timestamp: deps.clock()
+    });
+    return err(authError.invalidRequest("tenant mismatch", "state"));
+  }
+  if (envelope.nonce !== flow.nonce) {
+    return err(authError.invalidRequest("nonce mismatch", "state"));
+  }
+  if (url.host !== flow.callbackHost) {
+    await safeAudit(deps, {
+      kind: "flow_callback_mismatch",
+      tenantId: flow.tenantId,
+      flowId: flow.flowId,
+      expected: { host: flow.callbackHost, path: flow.callbackPath },
+      actual: { host: url.host, path: url.pathname },
+      timestamp: deps.clock()
+    });
+    return err(authError.invalidRequest("host mismatch", "state"));
+  }
+  if (normalizePath(url.pathname) !== normalizePath(flow.callbackPath)) {
+    await safeAudit(deps, {
+      kind: "flow_callback_mismatch",
+      tenantId: flow.tenantId,
+      flowId: flow.flowId,
+      expected: { host: flow.callbackHost, path: flow.callbackPath },
+      actual: { host: url.host, path: url.pathname },
+      timestamp: deps.clock()
+    });
+    return err(authError.invalidRequest("path mismatch", "state"));
+  }
+  const cfgRes = await deps.configStore.getTenantConfig(flow.tenantId);
+  if (isErr(cfgRes))
+    return err(cfgRes.error);
+  const tenant = {
+    id: flow.tenantId,
+    config: cfgRes.value,
+    request: {
+      raw: input.rawRequest,
+      custom: deps.buildCustomContext ? await deps.buildCustomContext(input.rawRequest) : {}
+    }
+  };
+  const methodRes = await deps.methodCache.resolve(cfgRes.value, flow.methodId);
+  if (isErr(methodRes))
+    return err(methodRes.error);
+  const dispatched = await dispatchMethod({
+    method: methodRes.value,
+    route: "GET /callback",
+    tenant,
+    request: input.rawRequest,
+    subPath: "/callback",
+    flow,
+    cookies: input.cookies,
+    sessionStore: deps.sessionStore,
+    dispatch: null
+  });
+  if (isErr(dispatched))
+    return err(dispatched.error);
+  return translate(dispatched.value, flow, deps);
+}
+async function translate(result, flow, deps) {
+  switch (result.kind) {
+    case "success": {
+      const code = (deps.newCodeId ?? randomToken)();
+      const now = deps.clock();
+      const saved = await saveEncryptedCode(code, {
+        tenantId: flow.tenantId,
+        clientId: flow.clientId,
+        appRedirectUri: flow.appRedirectUri,
+        appState: flow.appState,
+        scopes: flow.scopes,
+        audience: flow.audience,
+        clientPkce: flow.clientPkce,
+        methodId: flow.methodId,
+        methodKind: flow.methodKind,
+        context: flow.context ?? null,
+        providerSubject: result.providerSubject,
+        properties: result.properties,
+        expiresAt: now + AUTH_CODE_TTL_MS
+      }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
+      if (isErr(saved))
+        return err(saved.error);
+      return ok({
+        kind: "issue-code",
+        code,
+        appRedirectUri: flow.appRedirectUri,
+        appState: flow.appState
+      });
+    }
+    case "challenge":
+      return ok({
+        kind: "challenge",
+        response: result.response,
+        setCookies: result.setCookies ?? [],
+        ...result.cache !== undefined ? { cache: result.cache } : {}
+      });
+    case "denied":
+      await safeAudit(deps, {
+        kind: "authorize_failed",
+        tenantId: flow.tenantId,
+        clientId: flow.clientId,
+        methodId: flow.methodId,
+        methodKind: flow.methodKind,
+        flowId: flow.flowId,
+        reason: result.reason,
+        timestamp: deps.clock()
+      });
+      return ok({
+        kind: "denied",
+        reason: result.reason,
+        setCookies: result.setCookies ?? []
+      });
+    case "error":
+      await safeAudit(deps, {
+        kind: "authorize_failed",
+        tenantId: flow.tenantId,
+        clientId: flow.clientId,
+        methodId: flow.methodId,
+        methodKind: flow.methodKind,
+        flowId: flow.flowId,
+        reason: result.error.code,
+        timestamp: deps.clock()
+      });
+      return err(result.error);
+  }
+}
+function normalizePath(p) {
+  return p.replace(/\/+$/, "");
+}
+export {
+  handleCallback
+};

package/dist/esm/domain/client-auth.js

@@ -0,0 +1,61 @@
+// src/domain/client-auth.ts
+import { authError } from "../types/error";
+import { timingSafeEqualStr } from "./crypto";
+import { hashClientSecret } from "./token";
+async function verifyClientCredentials(client, presentedSecret) {
+  if (client.type === "public") {
+    if (presentedSecret) {
+      return authError.invalidClient("public clients must not present a client_secret");
+    }
+    return null;
+  }
+  if (!presentedSecret) {
+    return authError.invalidClient("confidential client requires client_secret");
+  }
+  const supplied = await hashClientSecret(presentedSecret);
+  if (!timingSafeEqualStr(supplied, client.secretHash)) {
+    return authError.invalidClient("client_secret mismatch");
+  }
+  return null;
+}
+function parseBasicAuth(header) {
+  if (!header)
+    return null;
+  const match = /^Basic\s+(.+)$/i.exec(header);
+  if (!match || !match[1])
+    return null;
+  let decoded;
+  try {
+    decoded = atob(match[1]);
+  } catch {
+    return null;
+  }
+  const colon = decoded.indexOf(":");
+  if (colon === -1)
+    return null;
+  let clientId;
+  let clientSecret;
+  try {
+    clientId = decodeURIComponent(decoded.slice(0, colon));
+    clientSecret = decodeURIComponent(decoded.slice(colon + 1));
+  } catch {
+    return null;
+  }
+  return { clientId, clientSecret };
+}
+function resolveClientCredentials(input) {
+  const basic = parseBasicAuth(input.authorizationHeader);
+  if (basic)
+    return basic;
+  if (!input.bodyClientId)
+    return null;
+  return {
+    clientId: input.bodyClientId,
+    ...input.bodyClientSecret !== undefined ? { clientSecret: input.bodyClientSecret } : {}
+  };
+}
+export {
+  verifyClientCredentials,
+  resolveClientCredentials,
+  parseBasicAuth
+};