@_mustachio/openauth 0.9.2 → 0.10.0

package/dist/esm/methods/m2m.js

@@ -0,0 +1,41 @@
+// src/methods/m2m.ts
+import { z } from "zod";
+import { authError } from "../types/error";
+import { err, ok } from "../types/result";
+var configSchema = z.object({}).strict();
+function m2mMethod(opts) {
+  return {
+    kind: "m2m",
+    configSchema,
+    build: async ({
+      id,
+      kind,
+      tenantId
+    }) => {
+      const clientFn = async (input) => {
+        const verified = await opts.verify({
+          clientID: input.clientID,
+          params: input.params,
+          tenantId
+        });
+        if (!verified) {
+          return err(authError.invalidClient("client not authorized for m2m"));
+        }
+        return ok({
+          clientId: input.clientID,
+          ...verified.claims ? { claims: verified.claims } : {}
+        });
+      };
+      return {
+        id,
+        kind,
+        type: "m2m",
+        routes: {},
+        client: clientFn
+      };
+    }
+  };
+}
+export {
+  m2mMethod
+};

package/dist/esm/methods/oauth2-factory.js

@@ -0,0 +1,84 @@
+// src/methods/oauth2-factory.ts
+import { z } from "zod";
+import { buildOauth2Method } from "./oauth2-generic";
+import { buildOidcMethod } from "./oidc-generic";
+var oauth2ConfigSchema = z.object({
+  clientId: z.string().min(1),
+  clientSecret: z.string().min(1).optional(),
+  scopes: z.array(z.string()).min(1),
+  authorizationUrl: z.string().url(),
+  tokenUrl: z.string().url(),
+  jwksUri: z.string().url().optional(),
+  expectedIssuer: z.string().optional(),
+  extraAuthorizeParams: z.record(z.string()).optional(),
+  pkce: z.enum(["S256", "none"]).optional(),
+  responseMode: z.enum(["query", "form_post"]).optional()
+});
+var oauth2Factory = {
+  kind: "oauth2",
+  configSchema: oauth2ConfigSchema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    clientId: config.clientId,
+    ...config.clientSecret !== undefined ? { clientSecret: config.clientSecret } : {},
+    scopes: config.scopes,
+    authorizationUrl: config.authorizationUrl,
+    tokenUrl: config.tokenUrl,
+    ...config.jwksUri ? { jwksUri: config.jwksUri } : {},
+    ...config.expectedIssuer ? { expectedIssuer: config.expectedIssuer } : {},
+    ...config.extraAuthorizeParams ? { extraAuthorizeParams: config.extraAuthorizeParams } : {},
+    ...config.pkce ? { pkce: config.pkce } : {},
+    ...config.responseMode ? { responseMode: config.responseMode } : {}
+  })
+};
+var oidcConfigSchema = z.object({
+  issuer: z.string().url(),
+  clientId: z.string().min(1),
+  clientSecret: z.string().min(1).optional(),
+  scopes: z.array(z.string()).optional(),
+  extraAuthorizeParams: z.record(z.string()).optional(),
+  pkce: z.enum(["S256", "none"]).optional(),
+  responseMode: z.enum(["query", "form_post"]).optional(),
+  endpoints: z.object({
+    authorization_endpoint: z.string().url(),
+    token_endpoint: z.string().url(),
+    jwks_uri: z.string().url(),
+    issuer: z.string()
+  }).optional()
+});
+var oidcFactory = {
+  kind: "oidc",
+  configSchema: oidcConfigSchema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOidcMethod({
+    id,
+    kind,
+    issuer: config.issuer,
+    clientId: config.clientId,
+    ...config.clientSecret !== undefined ? { clientSecret: config.clientSecret } : {},
+    scopes: config.scopes ?? ["openid", "email", "profile"],
+    ...config.extraAuthorizeParams ? { extraAuthorizeParams: config.extraAuthorizeParams } : {},
+    ...config.pkce ? { pkce: config.pkce } : {},
+    ...config.responseMode ? { responseMode: config.responseMode } : {},
+    ...config.endpoints ? {
+      endpoints: {
+        authorization_endpoint: config.endpoints.authorization_endpoint,
+        token_endpoint: config.endpoints.token_endpoint,
+        jwks_uri: config.endpoints.jwks_uri,
+        issuer: config.endpoints.issuer
+      }
+    } : {}
+  })
+};
+export {
+  oidcFactory,
+  oauth2Factory
+};

package/dist/esm/methods/oauth2-generic.js

@@ -0,0 +1,196 @@
+// src/methods/oauth2-generic.ts
+import * as oauth from "oauth4webapi";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { authError } from "../types/error";
+async function buildOauth2Method(opts) {
+  const pkceMode = opts.pkce ?? "S256";
+  const deriveSubject = opts.deriveSubject ?? defaultDeriveSubject;
+  const responseMode = opts.responseMode ?? "query";
+  const jwks = opts.jwksUri ? createRemoteJWKSet(new URL(opts.jwksUri)) : undefined;
+  return {
+    id: opts.id,
+    kind: opts.kind,
+    type: opts.type ?? "oauth2",
+    routes: {
+      "GET /authorize": async (ctx) => buildAuthorizeRedirect(ctx, opts, pkceMode),
+      "GET /callback": async (ctx) => exchangeAndSucceed(ctx, opts, jwks, deriveSubject),
+      ...responseMode === "form_post" ? {
+        "POST /callback": async (ctx) => exchangeAndSucceed(ctx, opts, jwks, deriveSubject)
+      } : {}
+    }
+  };
+}
+async function buildAuthorizeRedirect(ctx, opts, pkceMode) {
+  if (!ctx.dispatch) {
+    return {
+      kind: "error",
+      error: authError.internalError("dispatch missing on /authorize")
+    };
+  }
+  const url = new URL(opts.authorizationUrl);
+  url.searchParams.set("client_id", opts.clientId);
+  url.searchParams.set("redirect_uri", ctx.dispatch.callbackUrl);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("state", ctx.dispatch.state);
+  url.searchParams.set("scope", opts.scopes.join(" "));
+  if (opts.responseMode === "form_post") {
+    url.searchParams.set("response_mode", "form_post");
+  }
+  for (const [k, v] of Object.entries(opts.extraAuthorizeParams ?? {})) {
+    url.searchParams.set(k, v);
+  }
+  let saveMethodState;
+  if (pkceMode === "S256") {
+    const verifier = oauth.generateRandomCodeVerifier();
+    const challenge = await oauth.calculatePKCECodeChallenge(verifier);
+    url.searchParams.set("code_challenge", challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    saveMethodState = { pkceVerifier: verifier };
+  }
+  return {
+    kind: "challenge",
+    response: new Response(null, {
+      status: 302,
+      headers: { location: url.toString() }
+    }),
+    ...saveMethodState ? { saveMethodState } : {}
+  };
+}
+async function exchangeAndSucceed(ctx, opts, jwks, deriveSubject) {
+  const { code, error } = await readCallbackParams(ctx.request);
+  if (error) {
+    return {
+      kind: "error",
+      error: authError.accessDenied(error)
+    };
+  }
+  if (!code) {
+    return {
+      kind: "error",
+      error: authError.invalidRequest("missing authorization code", "code")
+    };
+  }
+  if (!ctx.flow) {
+    return {
+      kind: "error",
+      error: authError.internalError("flow missing on callback")
+    };
+  }
+  const callbackUrl = `${new URL(ctx.request.url).protocol}//${ctx.flow.callbackHost}${ctx.flow.callbackPath}`;
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: callbackUrl,
+    client_id: opts.clientId
+  });
+  if (opts.clientSecret)
+    body.set("client_secret", opts.clientSecret);
+  const verifier = ctx.methodState?.pkceVerifier;
+  if (verifier)
+    body.set("code_verifier", verifier);
+  let tokenResponse;
+  try {
+    const res = await fetch(opts.tokenUrl, {
+      method: "POST",
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "application/json"
+      },
+      body: body.toString()
+    });
+    tokenResponse = await res.json();
+  } catch (e) {
+    return {
+      kind: "error",
+      error: authError.serverError("token endpoint fetch failed", e)
+    };
+  }
+  if (typeof tokenResponse.error === "string") {
+    return {
+      kind: "error",
+      error: authError.invalidGrant(`upstream error: ${tokenResponse.error}${typeof tokenResponse.error_description === "string" ? ` — ${tokenResponse.error_description}` : ""}`)
+    };
+  }
+  const access = tokenResponse.access_token;
+  if (!access) {
+    return {
+      kind: "error",
+      error: authError.invalidGrant("token response missing access_token")
+    };
+  }
+  const idToken = tokenResponse.id_token;
+  let idTokenClaims;
+  if (idToken && jwks) {
+    try {
+      const { payload } = await jwtVerify(idToken, jwks, {
+        audience: opts.clientId,
+        ...opts.expectedIssuer ? { issuer: opts.expectedIssuer } : {}
+      });
+      idTokenClaims = payload;
+    } catch (e) {
+      return {
+        kind: "error",
+        error: authError.invalidGrant(`id_token verification failed: ${e instanceof Error ? e.message : "unknown"}`)
+      };
+    }
+  }
+  const properties = {
+    tokens: {
+      access,
+      ...typeof tokenResponse.refresh_token === "string" ? { refresh: tokenResponse.refresh_token } : {},
+      ...typeof tokenResponse.expires_in === "number" ? { expiresIn: tokenResponse.expires_in } : {},
+      ...idToken ? { idToken } : {}
+    },
+    ...idTokenClaims ? { idTokenClaims } : {},
+    raw: tokenResponse
+  };
+  const providerSubject = deriveSubject({
+    raw: tokenResponse,
+    ...idTokenClaims ? { idTokenClaims } : {}
+  });
+  if (!providerSubject) {
+    return {
+      kind: "error",
+      error: authError.invalidGrant("could not derive provider subject from upstream response")
+    };
+  }
+  return {
+    kind: "success",
+    providerSubject,
+    properties
+  };
+}
+async function readCallbackParams(req) {
+  if (req.method === "POST") {
+    const ct = req.headers.get("content-type") ?? "";
+    if (ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
+      const params = new URLSearchParams(await req.clone().text());
+      return {
+        code: params.get("code"),
+        error: params.get("error_description") ?? params.get("error") ?? null
+      };
+    }
+  }
+  const url = new URL(req.url);
+  return {
+    code: url.searchParams.get("code"),
+    error: url.searchParams.get("error_description") ?? url.searchParams.get("error") ?? null
+  };
+}
+function defaultDeriveSubject(input) {
+  if (input.idTokenClaims && typeof input.idTokenClaims.sub === "string") {
+    return input.idTokenClaims.sub;
+  }
+  const raw = input.raw;
+  for (const k of ["sub", "user_id", "id"]) {
+    const v = raw[k];
+    if (typeof v === "string")
+      return v;
+    if (typeof v === "number")
+      return v.toString();
+  }
+  return "";
+}
+export {
+  buildOauth2Method
+};

package/dist/esm/methods/oidc-generic.js

@@ -0,0 +1,53 @@
+// src/methods/oidc-generic.ts
+import { buildOauth2Method } from "./oauth2-generic";
+import { authError } from "../types/error";
+async function buildOidcMethod(opts) {
+  const endpoints = opts.endpoints ?? await fetchDiscovery(opts.issuer);
+  const scopes = opts.scopes.includes("openid") ? opts.scopes : ["openid", ...opts.scopes];
+  return buildOauth2Method({
+    ...opts,
+    type: "oidc",
+    scopes,
+    authorizationUrl: endpoints.authorization_endpoint,
+    tokenUrl: endpoints.token_endpoint,
+    jwksUri: endpoints.jwks_uri,
+    expectedIssuer: endpoints.issuer
+  });
+}
+async function fetchDiscovery(issuer) {
+  const url = issuer.replace(/\/+$/, "") + "/.well-known/openid-configuration";
+  let json;
+  try {
+    const res = await fetch(url);
+    if (!res.ok) {
+      throw new Error(`HTTP ${res.status}`);
+    }
+    json = await res.json();
+  } catch (e) {
+    throw oidcConfigError(`failed to fetch OIDC discovery from ${url}: ${e instanceof Error ? e.message : "unknown"}`);
+  }
+  for (const k of [
+    "authorization_endpoint",
+    "token_endpoint",
+    "jwks_uri",
+    "issuer"
+  ]) {
+    if (typeof json[k] !== "string") {
+      throw oidcConfigError(`OIDC discovery doc missing "${k}" (issuer=${issuer})`);
+    }
+  }
+  return {
+    authorization_endpoint: json.authorization_endpoint,
+    token_endpoint: json.token_endpoint,
+    jwks_uri: json.jwks_uri,
+    issuer: json.issuer
+  };
+}
+function oidcConfigError(description) {
+  const err = new Error(description);
+  err.cause = authError.serverError(description);
+  return err;
+}
+export {
+  buildOidcMethod
+};

package/dist/esm/methods/passkey.js

@@ -0,0 +1,275 @@
+// src/methods/passkey.ts
+import { z } from "zod";
+import {
+  generateAuthenticationOptions,
+  generateRegistrationOptions,
+  verifyAuthenticationResponse,
+  verifyRegistrationResponse
+} from "@simplewebauthn/server";
+import { renderForm } from "../ui/forms";
+var configSchema = z.object({
+  rpName: z.string().min(1),
+  rpID: z.string().min(1),
+  origins: z.union([z.string().min(1), z.array(z.string().min(1)).min(1)]),
+  title: z.string().optional()
+});
+var usernameBody = z.object({ username: z.string().min(1) });
+var verifyBody = z.object({ response: z.string().min(1) });
+function passkeyMethod(opts) {
+  return {
+    kind: "passkey",
+    configSchema,
+    build: async ({
+      id,
+      kind,
+      config
+    }) => {
+      const settings = {
+        rpName: config.rpName,
+        rpID: config.rpID,
+        origin: config.origins,
+        title: config.title ?? "Sign in with passkey",
+        credentials: opts.credentials
+      };
+      return {
+        id,
+        kind,
+        type: "passkey",
+        routes: {
+          "GET /authorize": async () => ({
+            kind: "challenge",
+            response: htmlResponse(renderForm({
+              title: settings.title,
+              action: `/m/${id}/authenticate-options`,
+              fields: [
+                {
+                  name: "username",
+                  label: "Username",
+                  required: true,
+                  autocomplete: "username webauthn"
+                }
+              ],
+              submit: "Continue"
+            }))
+          }),
+          "POST /authenticate-options": async (ctx) => authOptions(ctx, settings),
+          "POST /authenticate-verify": async (ctx) => authVerify(ctx, settings),
+          "POST /register-options": async (ctx) => registerOptions(ctx, id, settings),
+          "POST /register-verify": async (ctx) => registerVerify(ctx, settings)
+        }
+      };
+    }
+  };
+}
+async function authOptions(ctx, settings) {
+  const form = await safeForm(ctx.request);
+  const parsed = usernameBody.safeParse(form);
+  if (!parsed.success) {
+    return errorResult("missing username");
+  }
+  const found = await settings.credentials.findByUsername(parsed.data.username, ctx.tenant.id);
+  if (!found) {
+    return errorResult("unknown user");
+  }
+  const options = await generateAuthenticationOptions({
+    rpID: settings.rpID,
+    allowCredentials: found.credentials.map((c) => ({
+      id: c.credentialId,
+      ...c.transports ? { transports: c.transports } : {}
+    })),
+    userVerification: "preferred"
+  });
+  return {
+    kind: "challenge",
+    response: jsonResponse(options),
+    saveMethodState: {
+      phase: "auth",
+      challenge: options.challenge,
+      username: parsed.data.username
+    }
+  };
+}
+async function authVerify(ctx, settings) {
+  if (!ctx.methodState || ctx.methodState.phase !== "auth") {
+    return errorResult("verify without prior /authenticate-options");
+  }
+  const state = ctx.methodState;
+  const form = await safeForm(ctx.request);
+  const parsed = verifyBody.safeParse(form);
+  if (!parsed.success)
+    return errorResult("missing response");
+  let assertion;
+  try {
+    assertion = JSON.parse(parsed.data.response);
+  } catch {
+    return errorResult("malformed WebAuthn response");
+  }
+  const credentialId = assertion?.id;
+  if (!credentialId)
+    return errorResult("missing credential id");
+  const stored = await settings.credentials.findById(credentialId, ctx.tenant.id);
+  if (!stored)
+    return errorResult("unknown credential");
+  let verification;
+  try {
+    verification = await verifyAuthenticationResponse({
+      response: assertion,
+      expectedChallenge: state.challenge,
+      expectedOrigin: settings.origin,
+      expectedRPID: settings.rpID,
+      credential: {
+        id: stored.credentialId,
+        publicKey: base64urlDecode(stored.publicKey),
+        counter: stored.counter,
+        ...stored.transports ? { transports: stored.transports } : {}
+      }
+    });
+  } catch (e) {
+    return errorResult(e instanceof Error ? e.message : "verification threw");
+  }
+  if (!verification.verified) {
+    return errorResult("verification rejected");
+  }
+  await settings.credentials.updateCounter({
+    credentialId: stored.credentialId,
+    counter: verification.authenticationInfo.newCounter,
+    tenantId: ctx.tenant.id
+  });
+  return {
+    kind: "success",
+    providerSubject: stored.userId,
+    properties: { userId: stored.userId, credentialId: stored.credentialId }
+  };
+}
+async function registerOptions(ctx, _methodId, settings) {
+  if (!settings.credentials.create) {
+    return errorResult("registration not enabled");
+  }
+  const form = await safeForm(ctx.request);
+  const parsed = usernameBody.safeParse(form);
+  if (!parsed.success)
+    return errorResult("missing username");
+  const userId = parsed.data.username;
+  const options = await generateRegistrationOptions({
+    rpName: settings.rpName,
+    rpID: settings.rpID,
+    userName: parsed.data.username,
+    userID: new TextEncoder().encode(userId),
+    attestationType: "none",
+    authenticatorSelection: {
+      residentKey: "preferred",
+      userVerification: "preferred"
+    }
+  });
+  return {
+    kind: "challenge",
+    response: jsonResponse(options),
+    saveMethodState: {
+      phase: "register",
+      challenge: options.challenge,
+      userId,
+      username: parsed.data.username
+    }
+  };
+}
+async function registerVerify(ctx, settings) {
+  if (!settings.credentials.create) {
+    return errorResult("registration not enabled");
+  }
+  if (!ctx.methodState || ctx.methodState.phase !== "register") {
+    return errorResult("verify without prior /register-options");
+  }
+  const state = ctx.methodState;
+  const form = await safeForm(ctx.request);
+  const parsed = verifyBody.safeParse(form);
+  if (!parsed.success)
+    return errorResult("missing response");
+  let attestation;
+  try {
+    attestation = JSON.parse(parsed.data.response);
+  } catch {
+    return errorResult("malformed WebAuthn attestation");
+  }
+  let verification;
+  try {
+    verification = await verifyRegistrationResponse({
+      response: attestation,
+      expectedChallenge: state.challenge,
+      expectedOrigin: settings.origin,
+      expectedRPID: settings.rpID,
+      requireUserVerification: false
+    });
+  } catch (e) {
+    return errorResult(e instanceof Error ? e.message : "verification threw");
+  }
+  if (!verification.verified || !verification.registrationInfo) {
+    return errorResult("registration rejected");
+  }
+  const reg = verification.registrationInfo;
+  await settings.credentials.create({
+    userId: state.userId,
+    credential: {
+      credentialId: reg.credential.id,
+      publicKey: base64urlEncode(reg.credential.publicKey),
+      counter: reg.credential.counter,
+      ...reg.credential.transports ? { transports: reg.credential.transports } : {},
+      userId: state.userId
+    },
+    tenantId: ctx.tenant.id
+  });
+  return {
+    kind: "success",
+    providerSubject: state.userId,
+    properties: { userId: state.userId, credentialId: reg.credential.id }
+  };
+}
+function errorResult(description) {
+  return {
+    kind: "error",
+    error: { code: "invalid_request", description }
+  };
+}
+async function safeForm(req) {
+  const ct = req.headers.get("content-type") ?? "";
+  if (ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
+    return Object.fromEntries(new URLSearchParams(await req.text()).entries());
+  }
+  if (ct.toLowerCase().startsWith("application/json")) {
+    try {
+      return await req.json();
+    } catch {
+      return {};
+    }
+  }
+  return {};
+}
+function htmlResponse(body, status = 200) {
+  return new Response(body, {
+    status,
+    headers: { "content-type": "text/html; charset=utf-8" }
+  });
+}
+function jsonResponse(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" }
+  });
+}
+function base64urlEncode(bytes) {
+  let s = "";
+  for (let i = 0;i < bytes.length; i++)
+    s += String.fromCharCode(bytes[i]);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlDecode(s) {
+  const pad = s.length % 4 === 0 ? 0 : 4 - s.length % 4;
+  const b64 = (s + "=".repeat(pad)).replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0;i < bin.length; i++)
+    out[i] = bin.charCodeAt(i);
+  return out;
+}
+export {
+  passkeyMethod
+};