@_mustachio/openauth 0.9.2 → 0.10.0

package/dist/esm/domain/client-credentials.js

@@ -0,0 +1,91 @@
+// src/domain/client-credentials.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { verifyClientCredentials } from "./client-auth";
+import { randomId } from "./crypto";
+import { mintTokens } from "./token";
+async function clientCredentialsGrant(req, deps, tenantId) {
+  const tenantCfg = await deps.configStore.getTenantConfig(tenantId);
+  if (isErr(tenantCfg))
+    return err(tenantCfg.error);
+  const client = tenantCfg.value.clients.find((c) => c.id === req.clientId);
+  if (!client) {
+    return err(authError.invalidClient(`unknown client "${req.clientId}"`));
+  }
+  if (client.type !== "confidential") {
+    return err(authError.invalidClient("client_credentials requires confidential client"));
+  }
+  if (!client.grantTypes.includes("client_credentials")) {
+    return err(authError.unauthorizedClient(`client "${client.id}" is not authorized for client_credentials`));
+  }
+  const authErr = await verifyClientCredentials(client, req.clientSecret);
+  if (authErr)
+    return err(authErr);
+  const requestedScopes = req.scope ? req.scope.split(" ").filter(Boolean) : client.scopes;
+  for (const s of requestedScopes) {
+    if (!client.scopes.includes(s)) {
+      return err(authError.invalidScope(`scope "${s}" not allowed for client`));
+    }
+  }
+  const m2mCfgs = tenantCfg.value.methods.filter((m) => m.type === "m2m" && m.enabled);
+  if (m2mCfgs.length === 0) {
+    return err(authError.methodNotFound("no enabled m2m method on tenant", {}));
+  }
+  if (m2mCfgs.length > 1) {
+    return err(authError.methodNotFound("multiple m2m methods configured — only one supported", {}));
+  }
+  const methodCfg = m2mCfgs[0];
+  const methodRes = await deps.methodCache.resolve(tenantCfg.value, methodCfg.id);
+  if (isErr(methodRes))
+    return err(methodRes.error);
+  const method = methodRes.value;
+  if (!method.client) {
+    return err(authError.methodNotFound(`m2m method "${methodCfg.id}" did not register a client fn`, { methodId: methodCfg.id, methodKind: method.kind }));
+  }
+  const clientResult = await method.client({
+    clientID: req.clientId,
+    clientSecret: req.clientSecret,
+    params: req.params ?? {}
+  });
+  if (isErr(clientResult))
+    return err(clientResult.error);
+  const tenant = {
+    id: tenantCfg.value.id,
+    config: tenantCfg.value,
+    request: { raw: new Request("about:blank"), custom: {} }
+  };
+  let claim;
+  try {
+    claim = await deps.success({
+      tenant,
+      methodId: method.id,
+      methodKind: method.kind,
+      providerSubject: req.clientId,
+      properties: clientResult.value,
+      context: null
+    });
+  } catch (e) {
+    return err(authError.serverError("success callback threw", e));
+  }
+  const minted = await mintTokens({
+    tenant,
+    claim,
+    payload: {
+      tenantId: tenant.id,
+      clientId: client.id,
+      methodId: method.id,
+      methodKind: method.kind,
+      scopes: requestedScopes,
+      ...client.scopes.includes("audience") ? {} : {}
+    },
+    family: (deps.newRefreshFamily ?? randomId)(),
+    skipRefresh: true,
+    deps
+  });
+  if (isErr(minted))
+    return err(minted.error);
+  return ok(minted.value);
+}
+export {
+  clientCredentialsGrant
+};

package/dist/esm/domain/crypto.js

@@ -0,0 +1,97 @@
+// src/domain/crypto.ts
+import { base64url as joseB64u, CompactEncrypt, compactDecrypt } from "jose";
+function randomToken() {
+  const buf = new Uint8Array(32);
+  crypto.getRandomValues(buf);
+  return joseB64u.encode(buf);
+}
+function randomId() {
+  const buf = new Uint8Array(16);
+  crypto.getRandomValues(buf);
+  return joseB64u.encode(buf);
+}
+function randomHex(bytes) {
+  const buf = new Uint8Array(bytes);
+  crypto.getRandomValues(buf);
+  return Array.from(buf, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function randomBytes(bytes) {
+  const buf = new Uint8Array(bytes);
+  crypto.getRandomValues(buf);
+  return buf;
+}
+var base64url = {
+  encode: (data) => joseB64u.encode(data),
+  decode: (s) => joseB64u.decode(s)
+};
+var utf8 = {
+  encode: (s) => new TextEncoder().encode(s),
+  decode: (b) => new TextDecoder().decode(b)
+};
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0;i < a.length; i++)
+    diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function timingSafeEqualStr(a, b) {
+  return timingSafeEqual(utf8.encode(a), utf8.encode(b));
+}
+async function sha256(data) {
+  const bytes = typeof data === "string" ? utf8.encode(data) : data;
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return new Uint8Array(digest);
+}
+async function importHmacKey(raw, usage = ["sign", "verify"]) {
+  return crypto.subtle.importKey("raw", raw, { name: "HMAC", hash: "SHA-256" }, false, [...usage]);
+}
+async function hmacSign(key, message) {
+  const sig = await crypto.subtle.sign("HMAC", key, message);
+  return new Uint8Array(sig);
+}
+async function hmacVerify(key, signature, message) {
+  return crypto.subtle.verify("HMAC", key, signature, message);
+}
+async function encryptPayload(payload, kid, keyBytes) {
+  if (keyBytes.byteLength !== 32) {
+    throw new Error(`encryptPayload: keyBytes must be 32 bytes (A256GCM); got ${keyBytes.byteLength}`);
+  }
+  const cek = await crypto.subtle.importKey("raw", keyBytes, { name: "AES-GCM", length: 256 }, false, ["encrypt"]);
+  const json = utf8.encode(JSON.stringify(payload));
+  return new CompactEncrypt(json).setProtectedHeader({ alg: "dir", enc: "A256GCM", kid }).encrypt(cek);
+}
+async function decryptPayload(jwe, resolveKey) {
+  const { plaintext } = await compactDecrypt(jwe, async (header) => {
+    const kid = header.kid;
+    if (typeof kid !== "string") {
+      throw new Error("decryptPayload: missing kid in JWE header");
+    }
+    const raw = await resolveKey(kid);
+    return crypto.subtle.importKey("raw", raw, { name: "AES-GCM", length: 256 }, false, ["decrypt"]);
+  });
+  return JSON.parse(utf8.decode(plaintext));
+}
+function generateSymmetricKey() {
+  const buf = new Uint8Array(32);
+  crypto.getRandomValues(buf);
+  return buf;
+}
+export {
+  utf8,
+  timingSafeEqualStr,
+  timingSafeEqual,
+  sha256,
+  randomToken,
+  randomId,
+  randomHex,
+  randomBytes,
+  importHmacKey,
+  hmacVerify,
+  hmacSign,
+  generateSymmetricKey,
+  encryptPayload,
+  decryptPayload,
+  base64url
+};

package/dist/esm/domain/discovery.js

@@ -0,0 +1,41 @@
+// src/domain/discovery.ts
+import { err, isErr, ok } from "../types/result";
+import { buildJwksDocument } from "./jwt";
+function buildDiscoveryDocument(deps) {
+  const base = deps.issuerUrl.replace(/\/+$/, "");
+  const p = deps.paths ?? {};
+  return {
+    issuer: deps.issuerUrl,
+    authorization_endpoint: `${base}${p.authorize ?? "/authorize"}`,
+    token_endpoint: `${base}${p.token ?? "/token"}`,
+    userinfo_endpoint: `${base}${p.userinfo ?? "/userinfo"}`,
+    jwks_uri: `${base}${p.jwks ?? "/.well-known/jwks.json"}`,
+    revocation_endpoint: `${base}${p.revoke ?? "/revoke"}`,
+    introspection_endpoint: `${base}${p.introspect ?? "/introspect"}`,
+    response_types_supported: ["code"],
+    grant_types_supported: [
+      "authorization_code",
+      "refresh_token",
+      "client_credentials"
+    ],
+    subject_types_supported: ["public"],
+    id_token_signing_alg_values_supported: ["ES256", "EdDSA"],
+    scopes_supported: deps.scopes ?? ["openid", "email", "profile"],
+    token_endpoint_auth_methods_supported: [
+      "client_secret_basic",
+      "client_secret_post",
+      "none"
+    ],
+    code_challenge_methods_supported: ["S256"]
+  };
+}
+async function buildJwks(keyStore) {
+  const res = await keyStore.signingKeys();
+  if (isErr(res))
+    return err(res.error);
+  return ok(buildJwksDocument(res.value));
+}
+export {
+  buildJwks,
+  buildDiscoveryDocument
+};

package/dist/esm/domain/introspect.js

@@ -0,0 +1,51 @@
+// src/domain/introspect.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { verifyClientCredentials } from "./client-auth";
+import { verifyAccessToken } from "./jwt";
+async function introspect(req, deps) {
+  const presenterTenantCfg = await deps.configStore.getTenantConfig(req.presenterTenantId);
+  if (isErr(presenterTenantCfg)) {
+    return err(authError.invalidClient(`unknown client "${req.clientId}"`));
+  }
+  const presenter = presenterTenantCfg.value.clients.find((c) => c.id === req.clientId);
+  if (!presenter) {
+    return err(authError.invalidClient(`unknown client "${req.clientId}"`));
+  }
+  const authErr = await verifyClientCredentials(presenter, req.clientSecret);
+  if (authErr)
+    return err(authErr);
+  const keysRes = await deps.keyStore.signingKeys();
+  if (isErr(keysRes))
+    return err(keysRes.error);
+  let claims;
+  try {
+    claims = await verifyAccessToken(req.token, keysRes.value, {
+      ...deps.issuerUrl ? { issuer: deps.issuerUrl } : {}
+    });
+  } catch {
+    return ok({ active: false });
+  }
+  if (claims.tid !== req.presenterTenantId) {
+    return ok({ active: false });
+  }
+  if (claims.aud !== req.clientId) {
+    return ok({ active: false });
+  }
+  return ok({
+    active: true,
+    sub: claims.sub,
+    aud: claims.aud,
+    iss: claims.iss,
+    exp: claims.exp,
+    iat: claims.iat,
+    scope: claims.scope,
+    client_id: claims.aud,
+    tid: claims.tid,
+    mid: claims.mid,
+    mkind: claims.mkind
+  });
+}
+export {
+  introspect
+};

package/dist/esm/domain/jwt.js

@@ -0,0 +1,43 @@
+// src/domain/jwt.ts
+import { importJWK, jwtVerify, SignJWT } from "jose";
+async function signAccessToken(claims, privateKey, alg, kid) {
+  return new SignJWT(claims).setProtectedHeader({ alg, typ: "JWT", kid }).sign(privateKey);
+}
+var ASYMMETRIC_ALGS = new Set(["ES256", "EdDSA"]);
+async function verifyAccessToken(token, keys, options = {}) {
+  const algorithms = Array.from(new Set(keys.map((k) => k.alg).filter((a) => ASYMMETRIC_ALGS.has(a))));
+  const { payload } = await jwtVerify(token, async (header) => {
+    if (!header.alg || header.alg === "none") {
+      throw new Error(`verifyAccessToken: refusing alg "${header.alg ?? ""}"`);
+    }
+    const match = keys.find((k) => k.kid === header.kid);
+    if (!match) {
+      throw new Error(`verifyAccessToken: unknown kid "${header.kid}"`);
+    }
+    if (match.alg !== header.alg) {
+      throw new Error(`verifyAccessToken: header.alg "${header.alg}" does not match key alg "${match.alg}"`);
+    }
+    const imported = await importJWK(match.publicJwk, match.alg);
+    return imported;
+  }, {
+    algorithms,
+    ...options.issuer ? { issuer: options.issuer } : {},
+    ...options.audience ? { audience: options.audience } : {}
+  });
+  return payload;
+}
+function buildJwksDocument(keys) {
+  return {
+    keys: keys.map((k) => ({
+      ...k.publicJwk,
+      kid: k.kid,
+      alg: k.alg,
+      use: "sig"
+    }))
+  };
+}
+export {
+  verifyAccessToken,
+  signAccessToken,
+  buildJwksDocument
+};

package/dist/esm/domain/method-cache.js

@@ -0,0 +1,136 @@
+// src/domain/method-cache.ts
+import { authError } from "../types/error";
+import { err, ok } from "../types/result";
+
+class MethodCache {
+  #factories;
+  #auditLog;
+  #now;
+  #cache = new Map;
+  #disabled = new Set;
+  constructor(opts) {
+    this.#factories = opts.factories;
+    this.#auditLog = opts.auditLog;
+    this.#now = opts.now;
+  }
+  async resolve(tenant, methodId) {
+    const cacheKey = this.#key(tenant.id, methodId);
+    const hit = this.#cache.get(cacheKey);
+    if (hit)
+      return ok(hit);
+    if (this.#disabled.has(cacheKey)) {
+      return err(authError.methodNotFound(`method "${methodId}" is disabled or has invalid config`, { methodId }));
+    }
+    const cfg = tenant.methods.find((m) => m.id === methodId);
+    if (!cfg) {
+      return err(authError.methodNotFound(`method "${methodId}" not configured`, {
+        methodId
+      }));
+    }
+    if (!cfg.enabled) {
+      return err(authError.methodNotFound(`method "${methodId}" is disabled`, {
+        methodId
+      }));
+    }
+    const built = await this.#build(tenant.id, cfg);
+    if (built.ok) {
+      this.#cache.set(cacheKey, built.value);
+    } else {
+      this.#disabled.add(cacheKey);
+    }
+    return built;
+  }
+  invalidate(tenantId, methodId) {
+    if (methodId !== undefined) {
+      const key = this.#key(tenantId, methodId);
+      this.#cache.delete(key);
+      this.#disabled.delete(key);
+      return;
+    }
+    for (const k of [...this.#cache.keys()]) {
+      if (k.startsWith(`${tenantId}\x00`))
+        this.#cache.delete(k);
+    }
+    for (const k of [...this.#disabled]) {
+      if (k.startsWith(`${tenantId}\x00`))
+        this.#disabled.delete(k);
+    }
+  }
+  async listAvailable(tenant) {
+    const results = [];
+    for (const cfg of tenant.methods) {
+      if (!cfg.enabled)
+        continue;
+      const m = await this.resolve(tenant, cfg.id);
+      if (m.ok)
+        results.push(m.value);
+    }
+    return results;
+  }
+  async#build(tenantId, cfg) {
+    const factory = this.#factories[cfg.kind];
+    if (!factory) {
+      await this.#audit({
+        kind: "unknown_method_kind",
+        tenantId,
+        methodId: cfg.id,
+        methodKind: cfg.kind,
+        timestamp: this.#now()
+      });
+      return err(authError.methodNotFound(`no factory registered for kind "${cfg.kind}"`, {
+        methodId: cfg.id,
+        methodKind: cfg.kind
+      }));
+    }
+    let parsed = factory.configSchema["~standard"].validate(cfg.config);
+    if (parsed instanceof Promise)
+      parsed = await parsed;
+    if ("issues" in parsed && parsed.issues) {
+      await this.#audit({
+        kind: "invalid_method_config",
+        tenantId,
+        methodId: cfg.id,
+        methodKind: cfg.kind,
+        errorPath: parsed.issues.map((issue) => (issue.path ?? []).map((segment) => typeof segment === "object" ? String(segment.key) : String(segment)).join(".")).join(","),
+        timestamp: this.#now()
+      });
+      return err(authError.methodNotFound(`invalid method config for "${cfg.id}" (kind "${cfg.kind}")`, { methodId: cfg.id, methodKind: cfg.kind }));
+    }
+    let method;
+    try {
+      method = await factory.build({
+        id: cfg.id,
+        kind: cfg.kind,
+        tenantId,
+        config: parsed.value
+      });
+    } catch (e) {
+      return err(authError.internalError(`factory "${cfg.kind}" build threw for instance "${cfg.id}"`, e));
+    }
+    if (method.id !== cfg.id || method.kind !== cfg.kind) {
+      await this.#audit({
+        kind: "factory_id_mismatch",
+        tenantId,
+        methodId: cfg.id,
+        expectedKind: cfg.kind,
+        actualKind: method.kind,
+        timestamp: this.#now()
+      });
+      return err(authError.internalError(`factory "${cfg.kind}" returned AuthMethod with id/kind ${method.id}/${method.kind}; expected ${cfg.id}/${cfg.kind}`));
+    }
+    return ok(method);
+  }
+  #key(tenantId, methodId) {
+    return `${tenantId}\x00${methodId}`;
+  }
+  async#audit(event) {
+    if (!this.#auditLog)
+      return;
+    try {
+      await this.#auditLog.log(event);
+    } catch {}
+  }
+}
+export {
+  MethodCache
+};

package/dist/esm/domain/method-dispatch.js

@@ -0,0 +1,36 @@
+// src/domain/method-dispatch.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+async function dispatchMethod(input) {
+  const handler = input.method.routes[input.route];
+  if (!handler) {
+    return err(authError.invalidRequest(`method "${input.method.id}" has no handler for route "${input.route}"`));
+  }
+  const ctx = {
+    request: input.request,
+    subPath: input.subPath,
+    tenant: input.tenant,
+    flow: input.flow,
+    methodState: input.flow?.methodState ?? null,
+    cookies: input.cookies,
+    dispatch: input.dispatch
+  };
+  let result;
+  try {
+    result = await handler(ctx);
+  } catch (e) {
+    return err(authError.serverError(`method "${input.method.id}" handler threw on route "${input.route}"`, e));
+  }
+  if (result.kind === "challenge" && result.saveMethodState !== undefined) {
+    if (!input.flow) {
+      return err(authError.internalError(`method "${input.method.id}" returned saveMethodState without an active flow`));
+    }
+    const persisted = await input.sessionStore.updateFlowMethodState(input.flow.flowId, result.saveMethodState);
+    if (isErr(persisted))
+      return err(persisted.error);
+  }
+  return ok(result);
+}
+export {
+  dispatchMethod
+};

package/dist/esm/domain/method-route.js

@@ -0,0 +1,108 @@
+// src/domain/method-route.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { safeAudit } from "./audit";
+import { AUTH_CODE_TTL_MS } from "./authorize";
+import { randomToken } from "./crypto";
+import { dispatchMethod } from "./method-dispatch";
+import { saveEncryptedCode } from "./token";
+async function handleMethodRoute(input, deps) {
+  const flowRes = await deps.sessionStore.readFlow(input.flowId);
+  if (isErr(flowRes))
+    return err(flowRes.error);
+  const flow = flowRes.value;
+  if (flow.tenantId !== input.tenant.id) {
+    await safeAudit(deps, {
+      kind: "flow_tenant_mismatch",
+      stateTenantId: input.tenant.id,
+      flowTenantId: flow.tenantId,
+      flowId: flow.flowId,
+      timestamp: deps.clock()
+    });
+    return err(authError.invalidRequest("tenant mismatch", "flow"));
+  }
+  if (flow.methodId !== input.methodId) {
+    return err(authError.invalidRequest(`method "${input.methodId}" does not own flow "${flow.flowId}" (expected "${flow.methodId}")`, "methodId"));
+  }
+  const methodRes = await deps.methodCache.resolve(input.tenant.config, input.methodId);
+  if (isErr(methodRes))
+    return err(methodRes.error);
+  const route = `${input.httpMethod} ${input.subPath}`;
+  const dispatched = await dispatchMethod({
+    method: methodRes.value,
+    route,
+    tenant: input.tenant,
+    request: input.rawRequest,
+    subPath: input.subPath,
+    flow,
+    cookies: input.cookies,
+    sessionStore: deps.sessionStore,
+    dispatch: null
+  });
+  if (isErr(dispatched))
+    return err(dispatched.error);
+  return translate(dispatched.value, flow, deps);
+}
+async function translate(result, flow, deps) {
+  switch (result.kind) {
+    case "success": {
+      const consumed = await deps.sessionStore.consumeFlow(flow.flowId);
+      if (isErr(consumed))
+        return err(consumed.error);
+      const final = consumed.value;
+      const code = (deps.newCodeId ?? randomToken)();
+      const now = deps.clock();
+      const saved = await saveEncryptedCode(code, {
+        tenantId: final.tenantId,
+        clientId: final.clientId,
+        appRedirectUri: final.appRedirectUri,
+        appState: final.appState,
+        scopes: final.scopes,
+        audience: final.audience,
+        clientPkce: final.clientPkce,
+        methodId: final.methodId,
+        methodKind: final.methodKind,
+        context: final.context ?? null,
+        providerSubject: result.providerSubject,
+        properties: result.properties,
+        expiresAt: now + AUTH_CODE_TTL_MS
+      }, AUTH_CODE_TTL_MS, { keyStore: deps.keyStore, tokenStore: deps.tokenStore });
+      if (isErr(saved))
+        return err(saved.error);
+      return ok({
+        kind: "issue-code",
+        code,
+        appRedirectUri: final.appRedirectUri,
+        appState: final.appState
+      });
+    }
+    case "challenge":
+      return ok({
+        kind: "challenge",
+        response: result.response,
+        setCookies: result.setCookies ?? [],
+        ...result.cache !== undefined ? { cache: result.cache } : {}
+      });
+    case "denied":
+      await safeAudit(deps, {
+        kind: "authorize_failed",
+        tenantId: flow.tenantId,
+        clientId: flow.clientId,
+        methodId: flow.methodId,
+        methodKind: flow.methodKind,
+        flowId: flow.flowId,
+        reason: result.reason,
+        timestamp: deps.clock()
+      });
+      return ok({
+        kind: "denied",
+        reason: result.reason,
+        setCookies: result.setCookies ?? []
+      });
+    case "error":
+      return err(result.error);
+  }
+}
+export {
+  handleMethodRoute
+};

package/dist/esm/domain/pkce.js

@@ -0,0 +1,16 @@
+// src/domain/pkce.ts
+import { base64url, sha256, timingSafeEqualStr, utf8 } from "./crypto";
+async function s256Challenge(verifier) {
+  return base64url.encode(await sha256(utf8.encode(verifier)));
+}
+async function validatePkce(verifier, challenge) {
+  if (typeof verifier !== "string" || typeof challenge !== "string" || verifier.length < 43 || verifier.length > 128) {
+    return false;
+  }
+  const computed = await s256Challenge(verifier);
+  return timingSafeEqualStr(computed, challenge);
+}
+export {
+  validatePkce,
+  s256Challenge
+};