@_mustachio/openauth 0.9.2 → 0.10.0

package/dist/esm/adapters/durable-object/session-store.js

@@ -0,0 +1,139 @@
+// src/adapters/durable-object/session-store.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+
+class DurableObjectSessionStore {
+  #storage;
+  #clock;
+  constructor(opts) {
+    this.#storage = opts.storage;
+    this.#clock = opts.clock ?? (() => Date.now());
+  }
+  async saveFlow(flowId, payload, ttl) {
+    if (ttl <= 0) {
+      return err(authError.internalError(`saveFlow: ttl must be positive, got ${ttl}`));
+    }
+    const stored = {
+      record: payload,
+      expiresAt: this.#clock() + ttl
+    };
+    try {
+      await this.#storage.put(flowKey(flowId), stored);
+    } catch (e) {
+      return err(authError.internalError("saveFlow: put failed", e));
+    }
+    return ok(undefined);
+  }
+  async updateFlowMethodState(flowId, methodState) {
+    const now = this.#clock();
+    try {
+      const outcome = await this.#storage.transaction(async (txn) => {
+        const existing = await txn.get(flowKey(flowId));
+        if (!existing)
+          return "unknown";
+        if (now >= existing.expiresAt)
+          return "expired";
+        await txn.put(flowKey(flowId), {
+          record: { ...existing.record, methodState },
+          expiresAt: existing.expiresAt
+        });
+        return "ok";
+      });
+      if (outcome === "unknown")
+        return err(authError.unknownState(`flow "${flowId}" unknown`));
+      if (outcome === "expired")
+        return err(authError.unknownState(`flow "${flowId}" expired`));
+    } catch (e) {
+      return err(authError.internalError("updateFlowMethodState: transaction failed", e));
+    }
+    return ok(undefined);
+  }
+  async readFlow(flowId) {
+    let stored;
+    try {
+      stored = await this.#storage.get(flowKey(flowId));
+    } catch (e) {
+      return err(authError.internalError("readFlow: get failed", e));
+    }
+    if (!stored) {
+      return err(authError.unknownState(`flow "${flowId}" unknown`));
+    }
+    if (this.#clock() >= stored.expiresAt) {
+      try {
+        await this.#storage.delete(flowKey(flowId));
+      } catch {}
+      return err(authError.unknownState(`flow "${flowId}" expired`));
+    }
+    return ok(stored.record);
+  }
+  async consumeFlow(flowId) {
+    let result;
+    try {
+      result = await this.#storage.transaction(async (txn) => {
+        const stored = await txn.get(flowKey(flowId));
+        if (!stored)
+          return { kind: "miss" };
+        await txn.delete(flowKey(flowId));
+        if (this.#clock() >= stored.expiresAt) {
+          return { kind: "expired" };
+        }
+        return { kind: "hit", record: stored.record };
+      });
+    } catch (e) {
+      return err(authError.internalError("consumeFlow: transaction failed", e));
+    }
+    if (result.kind === "miss") {
+      return err(authError.unknownState(`flow "${flowId}" unknown or already consumed`));
+    }
+    if (result.kind === "expired") {
+      return err(authError.unknownState(`flow "${flowId}" expired`));
+    }
+    return ok(result.record);
+  }
+  async createSession(sessionId, payload, ttl) {
+    if (ttl <= 0) {
+      return err(authError.internalError(`createSession: ttl must be positive, got ${ttl}`));
+    }
+    const stored = {
+      record: payload,
+      expiresAt: this.#clock() + ttl
+    };
+    try {
+      await this.#storage.put(sessionKey(sessionId), stored);
+    } catch (e) {
+      return err(authError.internalError("createSession: put failed", e));
+    }
+    return ok(undefined);
+  }
+  async readSession(sessionId) {
+    let stored;
+    try {
+      stored = await this.#storage.get(sessionKey(sessionId));
+    } catch (e) {
+      return err(authError.internalError("readSession: get failed", e));
+    }
+    if (!stored) {
+      return err(authError.invalidRequest(`session "${sessionId}" unknown`));
+    }
+    if (this.#clock() >= stored.expiresAt) {
+      try {
+        await this.#storage.delete(sessionKey(sessionId));
+      } catch {}
+      return err(authError.invalidRequest(`session "${sessionId}" expired`));
+    }
+    return ok(stored.record);
+  }
+  async revokeSession(sessionId) {
+    try {
+      await this.#storage.delete(sessionKey(sessionId));
+    } catch (e) {
+      return err(authError.internalError("revokeSession: delete failed", e));
+    }
+    return ok(undefined);
+  }
+}
+var flowKey = (flowId) => `flow:${flowId}`;
+var sessionKey = (sessionId) => `session:${sessionId}`;
+export {
+  DurableObjectSessionStore
+};

package/dist/esm/adapters/dynamo/audit-log.js

@@ -0,0 +1,23 @@
+// src/adapters/dynamo/audit-log.ts
+class DynamoAuditLog {
+  #exec;
+  constructor(opts) {
+    this.#exec = opts.exec;
+  }
+  async log(event) {
+    const padded = String(event.timestamp).padStart(16, "0");
+    const suffix = Math.random().toString(36).slice(2, 10);
+    try {
+      await this.#exec.put({
+        item: {
+          pk: "audit",
+          sk: `${padded}:${suffix}`,
+          payload: JSON.stringify(event)
+        }
+      });
+    } catch {}
+  }
+}
+export {
+  DynamoAuditLog
+};

package/dist/esm/adapters/dynamo/config-store.js

@@ -0,0 +1,57 @@
+// src/adapters/dynamo/config-store.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+
+class DynamoConfigStore {
+  #exec;
+  #listeners = new Set;
+  constructor(opts) {
+    this.#exec = opts.exec;
+  }
+  async getTenantConfig(id) {
+    let row;
+    try {
+      row = await this.#exec.get({
+        key: { pk: "tenant", sk: id },
+        consistentRead: false
+      });
+    } catch (e) {
+      return err(authError.internalError("getTenantConfig: get failed", e));
+    }
+    if (!row) {
+      return err(authError.tenantNotFound(`tenant "${id}" not found`, id));
+    }
+    return ok(parseConfig(row.config));
+  }
+  async putTenantConfig(config) {
+    try {
+      await this.#exec.put({
+        item: {
+          pk: "tenant",
+          sk: config.id,
+          config: JSON.stringify(config),
+          updated_at: Date.now()
+        }
+      });
+    } catch (e) {
+      return err(authError.internalError("putTenantConfig: put failed", e));
+    }
+    for (const fn of this.#listeners) {
+      try {
+        fn(config.id);
+      } catch {}
+    }
+    return ok(undefined);
+  }
+  onInvalidate(handler) {
+    this.#listeners.add(handler);
+  }
+}
+function parseConfig(raw) {
+  if (typeof raw === "string")
+    return JSON.parse(raw);
+  return raw;
+}
+export {
+  DynamoConfigStore
+};

package/dist/esm/adapters/dynamo/index.js

@@ -0,0 +1,10 @@
+export {
+  fromDynamoDBClient,
+  DynamoTokenStore,
+  DynamoSessionStore,
+  DynamoPasskeyCredentialStore,
+  DynamoMethodStore,
+  DynamoKeyStore,
+  DynamoConfigStore,
+  DynamoAuditLog
+};

package/dist/esm/adapters/dynamo/key-store.js

@@ -0,0 +1,188 @@
+// src/adapters/dynamo/key-store.ts
+import { exportJWK, generateKeyPair, importJWK } from "jose";
+import {
+  base64url,
+  generateSymmetricKey,
+  randomId,
+  utf8
+} from "../../domain/crypto";
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+
+class DynamoKeyStore {
+  #exec;
+  #clock;
+  #signingAlg;
+  #wrapper;
+  #privateKeyCache = new Map;
+  constructor(opts) {
+    this.#exec = opts.exec;
+    this.#clock = opts.clock ?? (() => Date.now());
+    this.#signingAlg = opts.signingAlg ?? "ES256";
+    this.#wrapper = opts.wrapper;
+  }
+  async currentSigningKey() {
+    await this.#ensureSigningKey();
+    const items = await this.#exec.query({
+      pk: "signing-key",
+      consistentRead: true,
+      filter: { attribute: "status", equals: "active" }
+    });
+    const row = items[0];
+    if (!row) {
+      return err(authError.internalError("no active signing key (should be unreachable)"));
+    }
+    return ok(await this.#hydrateSigning(row));
+  }
+  async signingKeys() {
+    await this.#ensureSigningKey();
+    const items = await this.#exec.query({
+      pk: "signing-key",
+      consistentRead: false
+    });
+    const keys = await Promise.all(items.map((r) => this.#hydrateSigning(r)));
+    return ok(keys);
+  }
+  async currentEncryptionKey() {
+    await this.#ensureEncryptionKey();
+    const items = await this.#exec.query({
+      pk: "encryption-key",
+      consistentRead: true,
+      filter: { attribute: "status", equals: "active" }
+    });
+    const row = items[0];
+    if (!row) {
+      return err(authError.internalError("no active encryption key (should be unreachable)"));
+    }
+    return ok(await this.#hydrateEncryption(row));
+  }
+  async getEncryptionKey(kid) {
+    const row = await this.#exec.get({
+      key: { pk: "encryption-key", sk: kid },
+      consistentRead: true
+    });
+    if (!row) {
+      return err(authError.internalError(`encryption key "${kid}" not found`));
+    }
+    return ok(await this.#hydrateEncryption(row));
+  }
+  async#ensureSigningKey() {
+    const items = await this.#exec.query({
+      pk: "signing-key",
+      consistentRead: true,
+      filter: { attribute: "status", equals: "active" }
+    });
+    if (items.length > 0)
+      return;
+    const { publicKey, privateKey } = await generateKeyPair(this.#signingAlg, {
+      extractable: true
+    });
+    const publicJwk = await exportJWK(publicKey);
+    const privateJwk = await exportJWK(privateKey);
+    const kid = randomId();
+    const privateJwkStored = await this.#encodePrivateJwk(privateJwk);
+    try {
+      await this.#exec.put({
+        item: {
+          pk: "signing-key",
+          sk: kid,
+          alg: this.#signingAlg,
+          crv: publicJwk.crv ?? null,
+          public_jwk: JSON.stringify(publicJwk),
+          private_jwk: privateJwkStored,
+          private_jwk_wrapped: this.#wrapper !== undefined,
+          status: "active",
+          created_at: this.#clock()
+        },
+        condition: "not-exists"
+      });
+    } catch {}
+  }
+  async#ensureEncryptionKey() {
+    const items = await this.#exec.query({
+      pk: "encryption-key",
+      consistentRead: true,
+      filter: { attribute: "status", equals: "active" }
+    });
+    if (items.length > 0)
+      return;
+    const kid = randomId();
+    const raw = generateSymmetricKey();
+    const stored = this.#wrapper ? base64url.encode(await this.#wrapper.wrap(raw)) : base64url.encode(raw);
+    try {
+      await this.#exec.put({
+        item: {
+          pk: "encryption-key",
+          sk: kid,
+          alg: "A256GCM",
+          key_material: stored,
+          key_material_wrapped: this.#wrapper !== undefined,
+          status: "active",
+          created_at: this.#clock()
+        },
+        condition: "not-exists"
+      });
+    } catch {}
+  }
+  async#hydrateSigning(row) {
+    const kid = String(row.sk);
+    let imported = this.#privateKeyCache.get(kid);
+    if (!imported) {
+      const privateJwk = await this.#decodePrivateJwk(String(row.private_jwk), row.private_jwk_wrapped === true);
+      imported = await importJWK(privateJwk, String(row.alg));
+      this.#privateKeyCache.set(kid, imported);
+    }
+    const publicJwk = JSON.parse(String(row.public_jwk));
+    return {
+      kid,
+      alg: String(row.alg),
+      ...row.crv ? { crv: String(row.crv) } : {},
+      publicJwk,
+      privateKeyRef: imported,
+      status: String(row.status),
+      createdAt: Number(row.created_at),
+      ...row.rotated_at !== undefined && row.rotated_at !== null ? { rotatedAt: Number(row.rotated_at) } : {}
+    };
+  }
+  async#hydrateEncryption(row) {
+    const stored = base64url.decode(String(row.key_material));
+    let keyRef = stored;
+    if (row.key_material_wrapped === true) {
+      if (!this.#wrapper) {
+        throw new Error("DynamoKeyStore: encryption key item is wrapped but no `wrapper` was supplied — refusing to read");
+      }
+      keyRef = await this.#wrapper.unwrap(stored);
+    }
+    return {
+      kid: String(row.sk),
+      alg: String(row.alg),
+      keyRef,
+      status: String(row.status),
+      createdAt: Number(row.created_at),
+      ...row.rotated_at !== undefined && row.rotated_at !== null ? { rotatedAt: Number(row.rotated_at) } : {}
+    };
+  }
+  async#encodePrivateJwk(jwk) {
+    if (!this.#wrapper)
+      return JSON.stringify(jwk);
+    const ciphertext = await this.#wrapper.wrap(utf8.encode(JSON.stringify(jwk)));
+    return JSON.stringify({ ct: base64url.encode(ciphertext) });
+  }
+  async#decodePrivateJwk(raw, wrapped) {
+    const parsed = JSON.parse(raw);
+    if (!wrapped)
+      return parsed;
+    if (!this.#wrapper) {
+      throw new Error("DynamoKeyStore: signing key item is wrapped but no `wrapper` was supplied — refusing to read");
+    }
+    const ct = typeof parsed.ct === "string" ? parsed.ct : "";
+    if (!ct) {
+      throw new Error("DynamoKeyStore: wrapped signing key item missing `ct`");
+    }
+    const plaintext = await this.#wrapper.unwrap(base64url.decode(ct));
+    return JSON.parse(utf8.decode(plaintext));
+  }
+}
+export {
+  DynamoKeyStore
+};

package/dist/esm/adapters/dynamo/method-store.js

@@ -0,0 +1,72 @@
+// src/adapters/dynamo/method-store.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+var partitionKey = (tenantId) => `tenant-methods:${tenantId}`;
+
+class DynamoMethodStore {
+  #exec;
+  constructor(opts) {
+    this.#exec = opts.exec;
+  }
+  async listMethods(tenantId) {
+    let items;
+    try {
+      items = await this.#exec.query({
+        pk: partitionKey(tenantId),
+        consistentRead: false
+      });
+    } catch (e) {
+      return err(authError.internalError("listMethods: query failed", e));
+    }
+    const methods = items.map((r) => parseMethod(r.config)).sort((a, b) => a.id.localeCompare(b.id));
+    return ok(methods);
+  }
+  async getMethodConfig(tenantId, methodId) {
+    let row;
+    try {
+      row = await this.#exec.get({
+        key: { pk: partitionKey(tenantId), sk: methodId },
+        consistentRead: false
+      });
+    } catch (e) {
+      return err(authError.internalError("getMethodConfig: get failed", e));
+    }
+    if (!row) {
+      return err(authError.methodNotFound(`method "${methodId}" not found for tenant "${tenantId}"`, { methodId }));
+    }
+    return ok(parseMethod(row.config));
+  }
+  async putMethodConfig(tenantId, method) {
+    try {
+      await this.#exec.put({
+        item: {
+          pk: partitionKey(tenantId),
+          sk: method.id,
+          config: JSON.stringify(method),
+          updated_at: Date.now()
+        }
+      });
+    } catch (e) {
+      return err(authError.internalError("putMethodConfig: put failed", e));
+    }
+    return ok(undefined);
+  }
+  async deleteMethodConfig(tenantId, methodId) {
+    try {
+      await this.#exec.delete({
+        key: { pk: partitionKey(tenantId), sk: methodId }
+      });
+    } catch (e) {
+      return err(authError.internalError("deleteMethodConfig: delete failed", e));
+    }
+    return ok(undefined);
+  }
+}
+function parseMethod(raw) {
+  if (typeof raw === "string")
+    return JSON.parse(raw);
+  return raw;
+}
+export {
+  DynamoMethodStore
+};

package/dist/esm/adapters/dynamo/passkey-credential-store.js

@@ -0,0 +1,83 @@
+// src/adapters/dynamo/passkey-credential-store.ts
+class DynamoPasskeyCredentialStore {
+  #exec;
+  #clock;
+  constructor(opts) {
+    this.#exec = opts.exec;
+    this.#clock = opts.clock ?? (() => Date.now());
+  }
+  async findByUsername(username, tenantId) {
+    let items;
+    try {
+      items = await this.#exec.queryByGsi({
+        indexName: "passkey-user-index",
+        hashKey: userKey(tenantId, username)
+      });
+    } catch {
+      return null;
+    }
+    if (items.length === 0)
+      return null;
+    return {
+      userId: username,
+      credentials: items.map(itemToCredential)
+    };
+  }
+  async findById(credentialId, tenantId) {
+    const item = await this.#exec.get({
+      key: { pk: "passkey-cred", sk: sortKey(tenantId, credentialId) },
+      consistentRead: true
+    });
+    if (!item)
+      return null;
+    return itemToCredential(item);
+  }
+  async updateCounter(input) {
+    await this.#exec.updateItem({
+      key: {
+        pk: "passkey-cred",
+        sk: sortKey(input.tenantId, input.credentialId)
+      },
+      set: { counter: input.counter }
+    });
+  }
+  async create(input) {
+    const item = {
+      pk: "passkey-cred",
+      sk: sortKey(input.tenantId, input.credential.credentialId),
+      tenant_id: input.tenantId,
+      credential_id: input.credential.credentialId,
+      user_id: input.userId,
+      user_key: userKey(input.tenantId, input.userId),
+      public_key: input.credential.publicKey,
+      counter: input.credential.counter,
+      created_at: this.#clock()
+    };
+    if (input.credential.transports) {
+      item.transports = input.credential.transports;
+    }
+    await this.#exec.put({ item });
+  }
+}
+function sortKey(tenantId, credentialId) {
+  return `${tenantId}#${credentialId}`;
+}
+function userKey(tenantId, userId) {
+  return `${tenantId}#${userId}`;
+}
+function itemToCredential(item) {
+  const credential = {
+    credentialId: String(item.credential_id ?? ""),
+    publicKey: String(item.public_key ?? ""),
+    counter: Number(item.counter ?? 0),
+    userId: String(item.user_id ?? "")
+  };
+  const transports = item.transports;
+  if (Array.isArray(transports)) {
+    credential.transports = transports.map(String);
+  }
+  return credential;
+}
+export {
+  DynamoPasskeyCredentialStore
+};