@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/esm/methods/oidc-generic.js

@@ -0,0 +1,53 @@
+// src/methods/oidc-generic.ts
+import { buildOauth2Method } from "./oauth2-generic";
+import { authError } from "../types/error";
+async function buildOidcMethod(opts) {
+  const endpoints = opts.endpoints ?? await fetchDiscovery(opts.issuer);
+  const scopes = opts.scopes.includes("openid") ? opts.scopes : ["openid", ...opts.scopes];
+  return buildOauth2Method({
+    ...opts,
+    type: "oidc",
+    scopes,
+    authorizationUrl: endpoints.authorization_endpoint,
+    tokenUrl: endpoints.token_endpoint,
+    jwksUri: endpoints.jwks_uri,
+    expectedIssuer: endpoints.issuer
+  });
+}
+async function fetchDiscovery(issuer) {
+  const url = issuer.replace(/\/+$/, "") + "/.well-known/openid-configuration";
+  let json;
+  try {
+    const res = await fetch(url);
+    if (!res.ok) {
+      throw new Error(`HTTP ${res.status}`);
+    }
+    json = await res.json();
+  } catch (e) {
+    throw oidcConfigError(`failed to fetch OIDC discovery from ${url}: ${e instanceof Error ? e.message : "unknown"}`);
+  }
+  for (const k of [
+    "authorization_endpoint",
+    "token_endpoint",
+    "jwks_uri",
+    "issuer"
+  ]) {
+    if (typeof json[k] !== "string") {
+      throw oidcConfigError(`OIDC discovery doc missing "${k}" (issuer=${issuer})`);
+    }
+  }
+  return {
+    authorization_endpoint: json.authorization_endpoint,
+    token_endpoint: json.token_endpoint,
+    jwks_uri: json.jwks_uri,
+    issuer: json.issuer
+  };
+}
+function oidcConfigError(description) {
+  const err = new Error(description);
+  err.cause = authError.serverError(description);
+  return err;
+}
+export {
+  buildOidcMethod
+};

package/dist/esm/methods/passkey.js

@@ -0,0 +1,275 @@
+// src/methods/passkey.ts
+import { z } from "zod";
+import {
+  generateAuthenticationOptions,
+  generateRegistrationOptions,
+  verifyAuthenticationResponse,
+  verifyRegistrationResponse
+} from "@simplewebauthn/server";
+import { renderForm } from "../ui/forms";
+var configSchema = z.object({
+  rpName: z.string().min(1),
+  rpID: z.string().min(1),
+  origins: z.union([z.string().min(1), z.array(z.string().min(1)).min(1)]),
+  title: z.string().optional()
+});
+var usernameBody = z.object({ username: z.string().min(1) });
+var verifyBody = z.object({ response: z.string().min(1) });
+function passkeyMethod(opts) {
+  return {
+    kind: "passkey",
+    configSchema,
+    build: async ({
+      id,
+      kind,
+      config
+    }) => {
+      const settings = {
+        rpName: config.rpName,
+        rpID: config.rpID,
+        origin: config.origins,
+        title: config.title ?? "Sign in with passkey",
+        credentials: opts.credentials
+      };
+      return {
+        id,
+        kind,
+        type: "passkey",
+        routes: {
+          "GET /authorize": async () => ({
+            kind: "challenge",
+            response: htmlResponse(renderForm({
+              title: settings.title,
+              action: `/m/${id}/authenticate-options`,
+              fields: [
+                {
+                  name: "username",
+                  label: "Username",
+                  required: true,
+                  autocomplete: "username webauthn"
+                }
+              ],
+              submit: "Continue"
+            }))
+          }),
+          "POST /authenticate-options": async (ctx) => authOptions(ctx, settings),
+          "POST /authenticate-verify": async (ctx) => authVerify(ctx, settings),
+          "POST /register-options": async (ctx) => registerOptions(ctx, id, settings),
+          "POST /register-verify": async (ctx) => registerVerify(ctx, settings)
+        }
+      };
+    }
+  };
+}
+async function authOptions(ctx, settings) {
+  const form = await safeForm(ctx.request);
+  const parsed = usernameBody.safeParse(form);
+  if (!parsed.success) {
+    return errorResult("missing username");
+  }
+  const found = await settings.credentials.findByUsername(parsed.data.username, ctx.tenant.id);
+  if (!found) {
+    return errorResult("unknown user");
+  }
+  const options = await generateAuthenticationOptions({
+    rpID: settings.rpID,
+    allowCredentials: found.credentials.map((c) => ({
+      id: c.credentialId,
+      ...c.transports ? { transports: c.transports } : {}
+    })),
+    userVerification: "preferred"
+  });
+  return {
+    kind: "challenge",
+    response: jsonResponse(options),
+    saveMethodState: {
+      phase: "auth",
+      challenge: options.challenge,
+      username: parsed.data.username
+    }
+  };
+}
+async function authVerify(ctx, settings) {
+  if (!ctx.methodState || ctx.methodState.phase !== "auth") {
+    return errorResult("verify without prior /authenticate-options");
+  }
+  const state = ctx.methodState;
+  const form = await safeForm(ctx.request);
+  const parsed = verifyBody.safeParse(form);
+  if (!parsed.success)
+    return errorResult("missing response");
+  let assertion;
+  try {
+    assertion = JSON.parse(parsed.data.response);
+  } catch {
+    return errorResult("malformed WebAuthn response");
+  }
+  const credentialId = assertion?.id;
+  if (!credentialId)
+    return errorResult("missing credential id");
+  const stored = await settings.credentials.findById(credentialId, ctx.tenant.id);
+  if (!stored)
+    return errorResult("unknown credential");
+  let verification;
+  try {
+    verification = await verifyAuthenticationResponse({
+      response: assertion,
+      expectedChallenge: state.challenge,
+      expectedOrigin: settings.origin,
+      expectedRPID: settings.rpID,
+      credential: {
+        id: stored.credentialId,
+        publicKey: base64urlDecode(stored.publicKey),
+        counter: stored.counter,
+        ...stored.transports ? { transports: stored.transports } : {}
+      }
+    });
+  } catch (e) {
+    return errorResult(e instanceof Error ? e.message : "verification threw");
+  }
+  if (!verification.verified) {
+    return errorResult("verification rejected");
+  }
+  await settings.credentials.updateCounter({
+    credentialId: stored.credentialId,
+    counter: verification.authenticationInfo.newCounter,
+    tenantId: ctx.tenant.id
+  });
+  return {
+    kind: "success",
+    providerSubject: stored.userId,
+    properties: { userId: stored.userId, credentialId: stored.credentialId }
+  };
+}
+async function registerOptions(ctx, _methodId, settings) {
+  if (!settings.credentials.create) {
+    return errorResult("registration not enabled");
+  }
+  const form = await safeForm(ctx.request);
+  const parsed = usernameBody.safeParse(form);
+  if (!parsed.success)
+    return errorResult("missing username");
+  const userId = parsed.data.username;
+  const options = await generateRegistrationOptions({
+    rpName: settings.rpName,
+    rpID: settings.rpID,
+    userName: parsed.data.username,
+    userID: new TextEncoder().encode(userId),
+    attestationType: "none",
+    authenticatorSelection: {
+      residentKey: "preferred",
+      userVerification: "preferred"
+    }
+  });
+  return {
+    kind: "challenge",
+    response: jsonResponse(options),
+    saveMethodState: {
+      phase: "register",
+      challenge: options.challenge,
+      userId,
+      username: parsed.data.username
+    }
+  };
+}
+async function registerVerify(ctx, settings) {
+  if (!settings.credentials.create) {
+    return errorResult("registration not enabled");
+  }
+  if (!ctx.methodState || ctx.methodState.phase !== "register") {
+    return errorResult("verify without prior /register-options");
+  }
+  const state = ctx.methodState;
+  const form = await safeForm(ctx.request);
+  const parsed = verifyBody.safeParse(form);
+  if (!parsed.success)
+    return errorResult("missing response");
+  let attestation;
+  try {
+    attestation = JSON.parse(parsed.data.response);
+  } catch {
+    return errorResult("malformed WebAuthn attestation");
+  }
+  let verification;
+  try {
+    verification = await verifyRegistrationResponse({
+      response: attestation,
+      expectedChallenge: state.challenge,
+      expectedOrigin: settings.origin,
+      expectedRPID: settings.rpID,
+      requireUserVerification: false
+    });
+  } catch (e) {
+    return errorResult(e instanceof Error ? e.message : "verification threw");
+  }
+  if (!verification.verified || !verification.registrationInfo) {
+    return errorResult("registration rejected");
+  }
+  const reg = verification.registrationInfo;
+  await settings.credentials.create({
+    userId: state.userId,
+    credential: {
+      credentialId: reg.credential.id,
+      publicKey: base64urlEncode(reg.credential.publicKey),
+      counter: reg.credential.counter,
+      ...reg.credential.transports ? { transports: reg.credential.transports } : {},
+      userId: state.userId
+    },
+    tenantId: ctx.tenant.id
+  });
+  return {
+    kind: "success",
+    providerSubject: state.userId,
+    properties: { userId: state.userId, credentialId: reg.credential.id }
+  };
+}
+function errorResult(description) {
+  return {
+    kind: "error",
+    error: { code: "invalid_request", description }
+  };
+}
+async function safeForm(req) {
+  const ct = req.headers.get("content-type") ?? "";
+  if (ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
+    return Object.fromEntries(new URLSearchParams(await req.text()).entries());
+  }
+  if (ct.toLowerCase().startsWith("application/json")) {
+    try {
+      return await req.json();
+    } catch {
+      return {};
+    }
+  }
+  return {};
+}
+function htmlResponse(body, status = 200) {
+  return new Response(body, {
+    status,
+    headers: { "content-type": "text/html; charset=utf-8" }
+  });
+}
+function jsonResponse(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" }
+  });
+}
+function base64urlEncode(bytes) {
+  let s = "";
+  for (let i = 0;i < bytes.length; i++)
+    s += String.fromCharCode(bytes[i]);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlDecode(s) {
+  const pad = s.length % 4 === 0 ? 0 : 4 - s.length % 4;
+  const b64 = (s + "=".repeat(pad)).replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0;i < bin.length; i++)
+    out[i] = bin.charCodeAt(i);
+  return out;
+}
+export {
+  passkeyMethod
+};

package/dist/esm/methods/password-hash.js

@@ -0,0 +1,79 @@
+// src/methods/password-hash.ts
+import { argon2idAsync } from "@noble/hashes/argon2.js";
+import {
+  base64url,
+  randomBytes,
+  timingSafeEqualStr,
+  utf8
+} from "../domain/crypto";
+var DEFAULT_ARGON2ID_PARAMS = {
+  t: 3,
+  m: 65536,
+  p: 4,
+  dkLen: 32,
+  saltLen: 16
+};
+function argon2idHasher(params = {}) {
+  const cfg = { ...DEFAULT_ARGON2ID_PARAMS, ...params };
+  return {
+    async hash(plain) {
+      const salt = randomBytes(cfg.saltLen);
+      const out = await argon2idAsync(utf8.encode(plain), salt, {
+        t: cfg.t,
+        m: cfg.m,
+        p: cfg.p,
+        dkLen: cfg.dkLen
+      });
+      return `$argon2id$v=19$m=${cfg.m},t=${cfg.t},p=${cfg.p}$${base64url.encode(salt)}$${base64url.encode(out)}`;
+    },
+    async verify(plain, stored) {
+      const parsed = parsePhc(stored);
+      if (!parsed)
+        return false;
+      if (parsed.algo !== "argon2id")
+        return false;
+      try {
+        const out = await argon2idAsync(utf8.encode(plain), parsed.salt, {
+          t: parsed.t,
+          m: parsed.m,
+          p: parsed.p,
+          dkLen: parsed.hash.length
+        });
+        return timingSafeEqualStr(base64url.encode(out), base64url.encode(parsed.hash));
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+function parsePhc(stored) {
+  const parts = stored.split("$");
+  if (parts.length !== 6)
+    return null;
+  const [, algo, _version, params, saltStr, hashStr] = parts;
+  if (!algo || !params || !saltStr || !hashStr)
+    return null;
+  const kv = Object.fromEntries(params.split(",").map((p) => {
+    const [k, v] = p.split("=");
+    return [k ?? "", Number.parseInt(v ?? "0", 10)];
+  }));
+  if (typeof kv.m !== "number" || typeof kv.t !== "number" || typeof kv.p !== "number") {
+    return null;
+  }
+  try {
+    return {
+      algo,
+      t: kv.t,
+      m: kv.m,
+      p: kv.p,
+      salt: base64url.decode(saltStr),
+      hash: base64url.decode(hashStr)
+    };
+  } catch {
+    return null;
+  }
+}
+export {
+  argon2idHasher,
+  DEFAULT_ARGON2ID_PARAMS
+};

package/dist/esm/methods/password.js

@@ -0,0 +1,166 @@
+// src/methods/password.ts
+import { z } from "zod";
+import { argon2idHasher } from "./password-hash";
+import { renderForm } from "../ui/forms";
+var configSchema = z.object({}).strict();
+var loginBodySchema = z.object({
+  email: z.string().email(),
+  password: z.string().min(1)
+});
+var registerBodySchema = z.object({
+  email: z.string().email(),
+  password: z.string().min(8)
+});
+function passwordMethod(opts) {
+  const hasher = opts.hasher ?? argon2idHasher();
+  const title = opts.title ?? "Sign in";
+  return {
+    kind: "password",
+    configSchema,
+    build: async ({
+      id,
+      kind
+    }) => ({
+      id,
+      kind,
+      type: "password",
+      routes: {
+        "GET /authorize": async (ctx) => renderLogin(ctx, id, title),
+        "POST /login": async (ctx) => handleLogin(ctx, id, title, opts.users, hasher),
+        "POST /register": async (ctx) => {
+          if (!opts.enableRegistration || !opts.users.create) {
+            return {
+              kind: "error",
+              error: {
+                code: "invalid_request",
+                description: "registration disabled"
+              }
+            };
+          }
+          return handleRegister(ctx, id, title, opts.users.create, opts.users, hasher);
+        }
+      }
+    })
+  };
+}
+async function renderLogin(ctx, methodId, title) {
+  const body = renderForm({
+    title,
+    action: `/m/${methodId}/login`,
+    fields: [
+      {
+        name: "email",
+        label: "Email",
+        type: "email",
+        required: true,
+        autocomplete: "username"
+      },
+      {
+        name: "password",
+        label: "Password",
+        type: "password",
+        required: true,
+        autocomplete: "current-password"
+      }
+    ],
+    submit: "Sign in",
+    ...ctx.methodState?.error ? { error: ctx.methodState.error } : {}
+  });
+  return {
+    kind: "challenge",
+    response: new Response(body, {
+      status: 200,
+      headers: { "content-type": "text/html; charset=utf-8" }
+    })
+  };
+}
+async function handleLogin(ctx, methodId, title, users, hasher) {
+  const form = await safeForm(ctx.request);
+  const parsed = loginBodySchema.safeParse(form);
+  if (!parsed.success) {
+    return reLoginWithError(methodId, title, "Please enter your email and password.");
+  }
+  const user = await users.findByEmail(parsed.data.email, ctx.tenant.id);
+  if (!user) {
+    return reLoginWithError(methodId, title, "Invalid email or password.");
+  }
+  const verified = await hasher.verify(parsed.data.password, user.passwordHash);
+  if (!verified) {
+    return reLoginWithError(methodId, title, "Invalid email or password.");
+  }
+  return {
+    kind: "success",
+    providerSubject: user.id,
+    properties: {
+      email: parsed.data.email,
+      ...user.claims ? { claims: user.claims } : {}
+    }
+  };
+}
+async function handleRegister(ctx, methodId, title, create, users, hasher) {
+  const form = await safeForm(ctx.request);
+  const parsed = registerBodySchema.safeParse(form);
+  if (!parsed.success) {
+    return reLoginWithError(methodId, title, "Password must be at least 8 characters and email must be valid.");
+  }
+  const existing = await users.findByEmail(parsed.data.email, ctx.tenant.id);
+  if (existing) {
+    return reLoginWithError(methodId, title, "An account with that email already exists.");
+  }
+  const passwordHash = await hasher.hash(parsed.data.password);
+  const user = await create({
+    email: parsed.data.email,
+    passwordHash,
+    tenantId: ctx.tenant.id
+  });
+  return {
+    kind: "success",
+    providerSubject: user.id,
+    properties: {
+      email: parsed.data.email,
+      ...user.claims ? { claims: user.claims } : {}
+    }
+  };
+}
+function reLoginWithError(methodId, title, error) {
+  return {
+    kind: "challenge",
+    response: new Response(renderForm({
+      title,
+      action: `/m/${methodId}/login`,
+      fields: [
+        {
+          name: "email",
+          label: "Email",
+          type: "email",
+          required: true,
+          autocomplete: "username"
+        },
+        {
+          name: "password",
+          label: "Password",
+          type: "password",
+          required: true,
+          autocomplete: "current-password"
+        }
+      ],
+      submit: "Sign in",
+      error
+    }), {
+      status: 400,
+      headers: { "content-type": "text/html; charset=utf-8" }
+    }),
+    saveMethodState: { error }
+  };
+}
+async function safeForm(req) {
+  const ct = req.headers.get("content-type") ?? "";
+  if (!ct.toLowerCase().startsWith("application/x-www-form-urlencoded")) {
+    return {};
+  }
+  const params = new URLSearchParams(await req.text());
+  return Object.fromEntries(params.entries());
+}
+export {
+  passwordMethod
+};

package/dist/esm/methods/providers/apple.js

@@ -0,0 +1,29 @@
+// src/methods/providers/apple.ts
+import { z } from "zod";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional(),
+  responseMode: z.enum(["query", "form_post"]).optional()
+});
+var appleFactory = {
+  kind: "apple",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOidcMethod({
+    id,
+    kind,
+    issuer: "https://appleid.apple.com",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["openid", "name", "email"],
+    ...config.responseMode ? { responseMode: config.responseMode } : {}
+  })
+};
+export {
+  appleFactory
+};

package/dist/esm/methods/providers/cognito.js

@@ -0,0 +1,37 @@
+// src/methods/providers/cognito.ts
+import { z } from "zod";
+import { buildOidcMethod } from "../oidc-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string().optional(),
+  domain: z.string(),
+  issuer: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var cognitoFactory = {
+  kind: "cognito",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => {
+    return buildOidcMethod({
+      id,
+      kind,
+      issuer: config.issuer,
+      endpoints: {
+        authorization_endpoint: `https://${config.domain}/oauth2/authorize`,
+        token_endpoint: `https://${config.domain}/oauth2/token`,
+        jwks_uri: `${config.issuer.replace(/\/+$/, "")}/.well-known/jwks.json`,
+        issuer: config.issuer
+      },
+      clientId: config.clientId,
+      ...config.clientSecret ? { clientSecret: config.clientSecret } : {},
+      scopes: config.scopes ?? ["openid", "email", "profile"]
+    });
+  }
+};
+export {
+  cognitoFactory
+};

package/dist/esm/methods/providers/discord.js

@@ -0,0 +1,28 @@
+// src/methods/providers/discord.ts
+import { z } from "zod";
+import { buildOauth2Method } from "../oauth2-generic";
+var schema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string(),
+  scopes: z.array(z.string()).optional()
+});
+var discordFactory = {
+  kind: "discord",
+  configSchema: schema,
+  build: async ({
+    id,
+    kind,
+    config
+  }) => buildOauth2Method({
+    id,
+    kind,
+    authorizationUrl: "https://discord.com/oauth2/authorize",
+    tokenUrl: "https://discord.com/api/oauth2/token",
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    scopes: config.scopes ?? ["identify", "email"]
+  })
+};
+export {
+  discordFactory
+};