@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/esm/index.js

@@ -1,14 +1,131 @@
 // src/index.ts
+import { err, isErr, isOk, ok } from "./types/result";
+import { authError } from "./types/error";
+import { asTenantId } from "./types/tenant";
+import { revokeAllForSubject } from "./domain/revoke";
+import { passwordMethod } from "./methods/password";
+import { codeMethod } from "./methods/code";
+import { m2mMethod } from "./methods/m2m";
+import { passkeyMethod } from "./methods/passkey";
 import {
-  createClient
-} from "./client.js";
+  argon2idHasher,
+  DEFAULT_ARGON2ID_PARAMS
+} from "./methods/password-hash";
+import { buildOauth2Method } from "./methods/oauth2-generic";
+import { buildOidcMethod } from "./methods/oidc-generic";
 import {
-  createSubjects
-} from "./subject.js";
-import { issuer } from "./issuer.js";
+  oauth2Factory,
+  oidcFactory
+} from "./methods/oauth2-factory";
+import {
+  appleFactory,
+  cognitoFactory,
+  discordFactory,
+  facebookFactory,
+  githubFactory,
+  googleFactory,
+  jumpcloudFactory,
+  keycloakFactory,
+  linkedinFactory,
+  microsoftFactory,
+  slackFactory,
+  spotifyFactory,
+  twitchFactory,
+  xFactory,
+  yahooFactory
+} from "./methods/providers";
+import { MethodCache } from "./domain/method-cache";
+import { buildRouter } from "./http/router";
+function createIdP(opts) {
+  const mismatched = Object.entries(opts.methods).filter(([key, factory]) => key !== factory.kind).map(([key, factory]) => `${key}!=${factory.kind}`);
+  if (mismatched.length > 0) {
+    throw new Error(`createIdP: methods map keys must equal factory.kind. Offenders: ${mismatched.join(", ")}`);
+  }
+  const clock = () => Date.now();
+  const auditLog = opts.auditLog;
+  const methodCache = new MethodCache({
+    factories: opts.methods,
+    ...auditLog ? { auditLog } : {},
+    now: clock
+  });
+  opts.configStore.onInvalidate?.((tenantId) => {
+    methodCache.invalidate(tenantId);
+  });
+  const resolveIssuer = (req) => typeof opts.issuerUrl === "string" ? opts.issuerUrl : opts.issuerUrl(req);
+  const deps = {
+    configStore: opts.configStore,
+    tokenStore: opts.tokenStore,
+    sessionStore: opts.sessionStore,
+    keyStore: opts.keyStore,
+    ...opts.methodStore ? { methodStore: opts.methodStore } : {},
+    ...auditLog ? { auditLog } : {},
+    methodCache,
+    stateKeys: opts.stateKeys,
+    resolveIssuer,
+    ...opts.callbackHostFor ? { callbackHostFor: opts.callbackHostFor } : {},
+    resolveTenant: opts.resolveTenant,
+    success: opts.success,
+    ...opts.persistUpstreamTokens ? { persistUpstreamTokens: opts.persistUpstreamTokens } : {},
+    ...opts.exchangeAudience ? { exchangeAudience: opts.exchangeAudience } : {},
+    ...opts.renderPicker ? { renderPicker: opts.renderPicker } : {},
+    ...opts.registerClient ? { registerClient: opts.registerClient } : {},
+    ...opts.buildCustomContext ? { buildCustomContext: opts.buildCustomContext } : {},
+    clock,
+    cookieDefaults: {
+      secure: opts.cookies?.secure ?? true,
+      ...opts.cookies?.domain !== undefined ? { domain: opts.cookies.domain } : {},
+      ...opts.cookies?.path !== undefined ? { path: opts.cookies.path } : {}
+    },
+    ...opts.customScopeClaims !== undefined ? { customScopeClaims: opts.customScopeClaims } : {}
+  };
+  const app = buildRouter(deps);
+  const fetch = async (req) => await app.fetch(req);
+  return {
+    handle: fetch,
+    authorize: fetch,
+    token: fetch,
+    userinfo: fetch,
+    jwks: fetch,
+    discovery: fetch,
+    revoke: fetch,
+    introspect: fetch,
+    endSession: fetch,
+    par: fetch,
+    register: fetch
+  };
+}
 export {
-  issuer,
-  createSubjects,
-  createClient,
-  issuer as authorizer
+  yahooFactory,
+  xFactory,
+  twitchFactory,
+  spotifyFactory,
+  slackFactory,
+  revokeAllForSubject,
+  passwordMethod,
+  passkeyMethod,
+  ok,
+  oidcFactory,
+  oauth2Factory,
+  microsoftFactory,
+  m2mMethod,
+  linkedinFactory,
+  keycloakFactory,
+  jumpcloudFactory,
+  isOk,
+  isErr,
+  googleFactory,
+  githubFactory,
+  facebookFactory,
+  err,
+  discordFactory,
+  createIdP,
+  cognitoFactory,
+  codeMethod,
+  buildOidcMethod,
+  buildOauth2Method,
+  authError,
+  asTenantId,
+  argon2idHasher,
+  appleFactory,
+  DEFAULT_ARGON2ID_PARAMS
 };

package/dist/esm/methods/code.js

@@ -0,0 +1,221 @@
+// src/methods/code.ts
+import { z } from "zod";
+import {
+  base64url,
+  randomBytes,
+  sha256,
+  timingSafeEqualStr,
+  utf8
+} from "../domain/crypto";
+import { renderForm } from "../ui/forms";
+var configSchema = z.object({
+  codeLength: z.number().int().min(4).max(10).optional(),
+  maxAttempts: z.number().int().min(1).max(20).optional(),
+  destinationKind: z.enum(["email", "tel", "any"]).optional(),
+  titles: z.object({
+    request: z.string().optional(),
+    verify: z.string().optional()
+  }).optional()
+});
+var sendBody = z.object({
+  destination: z.string().min(1)
+});
+var verifyBody = z.object({
+  code: z.string().min(1)
+});
+function codeMethod(opts) {
+  const customGenerator = opts.generateCode;
+  return {
+    kind: "code",
+    configSchema,
+    build: async ({
+      id,
+      kind,
+      config
+    }) => {
+      const titleRequest = config.titles?.request ?? "Sign in";
+      const titleVerify = config.titles?.verify ?? "Enter your code";
+      const maxAttempts = config.maxAttempts ?? 5;
+      const destinationKind = config.destinationKind ?? "email";
+      const codeLength = config.codeLength ?? 6;
+      const generateCode = customGenerator ?? (() => defaultCode(codeLength));
+      return {
+        id,
+        kind,
+        type: "code",
+        routes: {
+          "GET /authorize": async (_ctx) => ({
+            kind: "challenge",
+            response: htmlResponse(renderForm({
+              title: titleRequest,
+              action: `/m/${id}/send`,
+              fields: destinationField(destinationKind),
+              submit: "Send code"
+            }))
+          }),
+          "POST /send": async (ctx) => handleSend(ctx, id, titleRequest, titleVerify, destinationKind, generateCode, opts.sendCode),
+          "POST /verify": async (ctx) => handleVerify(ctx, id, titleVerify, maxAttempts)
+        }
+      };
+    }
+  };
+}
+async function handleSend(ctx, methodId, titleRequest, titleVerify, destinationKind, generateCode, sendCode) {
+  const form = await safeForm(ctx.request);
+  const parsed = sendBody.safeParse(form);
+  if (!parsed.success || !validateDestination(parsed.data?.destination, destinationKind)) {
+    return {
+      kind: "challenge",
+      response: htmlResponse(renderForm({
+        title: titleRequest,
+        action: `/m/${methodId}/send`,
+        fields: destinationField(destinationKind),
+        submit: "Send code",
+        error: "Please enter a valid destination."
+      }), 400)
+    };
+  }
+  const destination = parsed.data.destination;
+  const code = generateCode();
+  try {
+    await sendCode({ destination, code, tenantId: ctx.tenant.id });
+  } catch {}
+  const hash = base64url.encode(await sha256(utf8.encode(code)));
+  return {
+    kind: "challenge",
+    response: htmlResponse(renderForm({
+      title: titleVerify,
+      action: `/m/${methodId}/verify`,
+      fields: [
+        {
+          name: "code",
+          label: "Code",
+          required: true,
+          inputmode: "numeric",
+          autocomplete: "one-time-code"
+        }
+      ],
+      submit: "Verify",
+      hidden: { destination }
+    })),
+    saveMethodState: {
+      destination,
+      codeHash: hash,
+      attempts: 0
+    }
+  };
+}
+async function handleVerify(ctx, methodId, titleVerify, maxAttempts) {
+  if (!ctx.methodState) {
+    return {
+      kind: "error",
+      error: {
+        code: "invalid_request",
+        description: "verify without prior /send"
+      }
+    };
+  }
+  const state = ctx.methodState;
+  if (state.attempts >= maxAttempts) {
+    return { kind: "denied", reason: "too_many_attempts" };
+  }
+  const form = await safeForm(ctx.request);
+  const parsed = verifyBody.safeParse(form);
+  if (!parsed.success) {
+    return verifyError(methodId, state, titleVerify, "Please enter the code.");
+  }
+  const submittedHash = base64url.encode(await sha256(utf8.encode(parsed.data.code)));
+  if (!timingSafeEqualStr(submittedHash, state.codeHash)) {
+    return verifyError(methodId, { ...state, attempts: state.attempts + 1 }, titleVerify, "Incorrect code. Please try again.");
+  }
+  return {
+    kind: "success",
+    providerSubject: state.destination,
+    properties: { destination: state.destination }
+  };
+}
+function verifyError(methodId, next, titleVerify, error) {
+  return {
+    kind: "challenge",
+    response: htmlResponse(renderForm({
+      title: titleVerify,
+      action: `/m/${methodId}/verify`,
+      fields: [
+        {
+          name: "code",
+          label: "Code",
+          required: true,
+          inputmode: "numeric",
+          autocomplete: "one-time-code"
+        }
+      ],
+      submit: "Verify",
+      error
+    }), 400),
+    saveMethodState: { ...next, error }
+  };
+}
+function destinationField(kind) {
+  if (kind === "email") {
+    return [
+      {
+        name: "destination",
+        label: "Email",
+        type: "email",
+        required: true,
+        autocomplete: "email"
+      }
+    ];
+  }
+  if (kind === "tel") {
+    return [
+      {
+        name: "destination",
+        label: "Phone",
+        type: "tel",
+        required: true,
+        autocomplete: "tel"
+      }
+    ];
+  }
+  return [
+    {
+      name: "destination",
+      label: "Destination",
+      type: "text",
+      required: true
+    }
+  ];
+}
+function validateDestination(destination, kind) {
+  if (!destination)
+    return false;
+  if (kind === "email")
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(destination);
+  if (kind === "tel")
+    return /^[+\d][\d\s\-()]{6,}$/.test(destination);
+  return destination.length > 0;
+}
+function defaultCode(length) {
+  const buf = randomBytes(4);
+  const view = new DataView(buf.buffer, buf.byteOffset, 4);
+  const max = 10 ** length;
+  const n = view.getUint32(0) % max;
+  return n.toString().padStart(length, "0");
+}
+async function safeForm(req) {
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
+    return {};
+  }
+  return Object.fromEntries(new URLSearchParams(await req.text()).entries());
+}
+function htmlResponse(body, status = 200) {
+  return new Response(body, {
+    status,
+    headers: { "content-type": "text/html; charset=utf-8" }
+  });
+}
+export {
+  codeMethod
+};

package/dist/esm/methods/m2m.js

@@ -0,0 +1,41 @@
+// src/methods/m2m.ts
+import { z } from "zod";
+import { authError } from "../types/error";
+import { err, ok } from "../types/result";
+var configSchema = z.object({}).strict();
+function m2mMethod(opts) {
+  return {
+    kind: "m2m",
+    configSchema,
+    build: async ({
+      id,
+      kind,
+      tenantId
+    }) => {
+      const clientFn = async (input) => {
+        const verified = await opts.verify({
+          clientID: input.clientID,
+          params: input.params,
+          tenantId
+        });
+        if (!verified) {
+          return err(authError.invalidClient("client not authorized for m2m"));
+        }
+        return ok({
+          clientId: input.clientID,
+          ...verified.claims ? { claims: verified.claims } : {}
+        });
+      };
+      return {
+        id,
+        kind,
+        type: "m2m",
+        routes: {},
+        client: clientFn
+      };
+    }
+  };
+}
+export {
+  m2mMethod
+};

package/dist/esm/methods/oauth2-factory.js

@@ -0,0 +1,84 @@
+// src/methods/oauth2-factory.ts
+import { z } from "zod";
+import { buildOauth2Method } from "./oauth2-generic";
+import { buildOidcMethod } from "./oidc-generic";
+var oauth2ConfigSchema = z.object({
+  clientId: z.string().min(1),
+  clientSecret: z.string().min(1).optional(),
+  scopes: z.array(z.string()).min(1),
+  authorizationUrl: z.string().url(),
+  tokenUrl: z.string().url(),
+  jwksUri: z.string().url().optional(),
+  expectedIssuer: z.string().optional(),
+  extraAuthorizeParams: z.record(z.string()).optional(),
+  pkce: z.enum(["S256", "none"]).optional(),
+  responseMode: z.enum(["query", "form_post"]).optional()
+});
+var oauth2Factory = {
+  kind: "oauth2",
+  configSchema: oauth2ConfigSchema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    clientId: config.clientId,
+    ...config.clientSecret !== undefined ? { clientSecret: config.clientSecret } : {},
+    scopes: config.scopes,
+    authorizationUrl: config.authorizationUrl,
+    tokenUrl: config.tokenUrl,
+    ...config.jwksUri ? { jwksUri: config.jwksUri } : {},
+    ...config.expectedIssuer ? { expectedIssuer: config.expectedIssuer } : {},
+    ...config.extraAuthorizeParams ? { extraAuthorizeParams: config.extraAuthorizeParams } : {},
+    ...config.pkce ? { pkce: config.pkce } : {},
+    ...config.responseMode ? { responseMode: config.responseMode } : {}
+  })
+};
+var oidcConfigSchema = z.object({
+  issuer: z.string().url(),
+  clientId: z.string().min(1),
+  clientSecret: z.string().min(1).optional(),
+  scopes: z.array(z.string()).optional(),
+  extraAuthorizeParams: z.record(z.string()).optional(),
+  pkce: z.enum(["S256", "none"]).optional(),
+  responseMode: z.enum(["query", "form_post"]).optional(),
+  endpoints: z.object({
+    authorization_endpoint: z.string().url(),
+    token_endpoint: z.string().url(),
+    jwks_uri: z.string().url(),
+    issuer: z.string()
+  }).optional()
+});
+var oidcFactory = {
+  kind: "oidc",
+  configSchema: oidcConfigSchema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOidcMethod({
+    id,
+    kind,
+    issuer: config.issuer,
+    clientId: config.clientId,
+    ...config.clientSecret !== undefined ? { clientSecret: config.clientSecret } : {},
+    scopes: config.scopes ?? ["openid", "email", "profile"],
+    ...config.extraAuthorizeParams ? { extraAuthorizeParams: config.extraAuthorizeParams } : {},
+    ...config.pkce ? { pkce: config.pkce } : {},
+    ...config.responseMode ? { responseMode: config.responseMode } : {},
+    ...config.endpoints ? {
+      endpoints: {
+        authorization_endpoint: config.endpoints.authorization_endpoint,
+        token_endpoint: config.endpoints.token_endpoint,
+        jwks_uri: config.endpoints.jwks_uri,
+        issuer: config.endpoints.issuer
+      }
+    } : {}
+  })
+};
+export {
+  oidcFactory,
+  oauth2Factory
+};

package/dist/esm/methods/oauth2-generic.js

@@ -0,0 +1,196 @@
+// src/methods/oauth2-generic.ts
+import * as oauth from "oauth4webapi";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { authError } from "../types/error";
+async function buildOauth2Method(opts) {
+  const pkceMode = opts.pkce ?? "S256";
+  const deriveSubject = opts.deriveSubject ?? defaultDeriveSubject;
+  const responseMode = opts.responseMode ?? "query";
+  const jwks = opts.jwksUri ? createRemoteJWKSet(new URL(opts.jwksUri)) : undefined;
+  return {
+    id: opts.id,
+    kind: opts.kind,
+    type: opts.type ?? "oauth2",
+    routes: {
+      "GET /authorize": async (ctx) => buildAuthorizeRedirect(ctx, opts, pkceMode),
+      "GET /callback": async (ctx) => exchangeAndSucceed(ctx, opts, jwks, deriveSubject),
+      ...responseMode === "form_post" ? {
+        "POST /callback": async (ctx) => exchangeAndSucceed(ctx, opts, jwks, deriveSubject)
+      } : {}
+    }
+  };
+}
+async function buildAuthorizeRedirect(ctx, opts, pkceMode) {
+  if (!ctx.dispatch) {
+    return {
+      kind: "error",
+      error: authError.internalError("dispatch missing on /authorize")
+    };
+  }
+  const url = new URL(opts.authorizationUrl);
+  url.searchParams.set("client_id", opts.clientId);
+  url.searchParams.set("redirect_uri", ctx.dispatch.callbackUrl);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("state", ctx.dispatch.state);
+  url.searchParams.set("scope", opts.scopes.join(" "));
+  if (opts.responseMode === "form_post") {
+    url.searchParams.set("response_mode", "form_post");
+  }
+  for (const [k, v] of Object.entries(opts.extraAuthorizeParams ?? {})) {
+    url.searchParams.set(k, v);
+  }
+  let saveMethodState;
+  if (pkceMode === "S256") {
+    const verifier = oauth.generateRandomCodeVerifier();
+    const challenge = await oauth.calculatePKCECodeChallenge(verifier);
+    url.searchParams.set("code_challenge", challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    saveMethodState = { pkceVerifier: verifier };
+  }
+  return {
+    kind: "challenge",
+    response: new Response(null, {
+      status: 302,
+      headers: { location: url.toString() }
+    }),
+    ...saveMethodState ? { saveMethodState } : {}
+  };
+}
+async function exchangeAndSucceed(ctx, opts, jwks, deriveSubject) {
+  const { code, error } = await readCallbackParams(ctx.request);
+  if (error) {
+    return {
+      kind: "error",
+      error: authError.accessDenied(error)
+    };
+  }
+  if (!code) {
+    return {
+      kind: "error",
+      error: authError.invalidRequest("missing authorization code", "code")
+    };
+  }
+  if (!ctx.flow) {
+    return {
+      kind: "error",
+      error: authError.internalError("flow missing on callback")
+    };
+  }
+  const callbackUrl = `${new URL(ctx.request.url).protocol}//${ctx.flow.callbackHost}${ctx.flow.callbackPath}`;
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: callbackUrl,
+    client_id: opts.clientId
+  });
+  if (opts.clientSecret)
+    body.set("client_secret", opts.clientSecret);
+  const verifier = ctx.methodState?.pkceVerifier;
+  if (verifier)
+    body.set("code_verifier", verifier);
+  let tokenResponse;
+  try {
+    const res = await fetch(opts.tokenUrl, {
+      method: "POST",
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "application/json"
+      },
+      body: body.toString()
+    });
+    tokenResponse = await res.json();
+  } catch (e) {
+    return {
+      kind: "error",
+      error: authError.serverError("token endpoint fetch failed", e)
+    };
+  }
+  if (typeof tokenResponse.error === "string") {
+    return {
+      kind: "error",
+      error: authError.invalidGrant(`upstream error: ${tokenResponse.error}${typeof tokenResponse.error_description === "string" ? ` — ${tokenResponse.error_description}` : ""}`)
+    };
+  }
+  const access = tokenResponse.access_token;
+  if (!access) {
+    return {
+      kind: "error",
+      error: authError.invalidGrant("token response missing access_token")
+    };
+  }
+  const idToken = tokenResponse.id_token;
+  let idTokenClaims;
+  if (idToken && jwks) {
+    try {
+      const { payload } = await jwtVerify(idToken, jwks, {
+        audience: opts.clientId,
+        ...opts.expectedIssuer ? { issuer: opts.expectedIssuer } : {}
+      });
+      idTokenClaims = payload;
+    } catch (e) {
+      return {
+        kind: "error",
+        error: authError.invalidGrant(`id_token verification failed: ${e instanceof Error ? e.message : "unknown"}`)
+      };
+    }
+  }
+  const properties = {
+    tokens: {
+      access,
+      ...typeof tokenResponse.refresh_token === "string" ? { refresh: tokenResponse.refresh_token } : {},
+      ...typeof tokenResponse.expires_in === "number" ? { expiresIn: tokenResponse.expires_in } : {},
+      ...idToken ? { idToken } : {}
+    },
+    ...idTokenClaims ? { idTokenClaims } : {},
+    raw: tokenResponse
+  };
+  const providerSubject = deriveSubject({
+    raw: tokenResponse,
+    ...idTokenClaims ? { idTokenClaims } : {}
+  });
+  if (!providerSubject) {
+    return {
+      kind: "error",
+      error: authError.invalidGrant("could not derive provider subject from upstream response")
+    };
+  }
+  return {
+    kind: "success",
+    providerSubject,
+    properties
+  };
+}
+async function readCallbackParams(req) {
+  if (req.method === "POST") {
+    const ct = req.headers.get("content-type") ?? "";
+    if (ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
+      const params = new URLSearchParams(await req.clone().text());
+      return {
+        code: params.get("code"),
+        error: params.get("error_description") ?? params.get("error") ?? null
+      };
+    }
+  }
+  const url = new URL(req.url);
+  return {
+    code: url.searchParams.get("code"),
+    error: url.searchParams.get("error_description") ?? url.searchParams.get("error") ?? null
+  };
+}
+function defaultDeriveSubject(input) {
+  if (input.idTokenClaims && typeof input.idTokenClaims.sub === "string") {
+    return input.idTokenClaims.sub;
+  }
+  const raw = input.raw;
+  for (const k of ["sub", "user_id", "id"]) {
+    const v = raw[k];
+    if (typeof v === "string")
+      return v;
+    if (typeof v === "number")
+      return v.toString();
+  }
+  return "";
+}
+export {
+  buildOauth2Method
+};