@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/esm/adapters/dynamo/sdk.js

@@ -0,0 +1,128 @@
+// src/adapters/dynamo/sdk.ts
+import {
+  DeleteCommand,
+  GetCommand,
+  PutCommand,
+  QueryCommand,
+  UpdateCommand
+} from "@aws-sdk/lib-dynamodb";
+function fromDynamoDBClient(client, tableName) {
+  return {
+    async get(input) {
+      const result = await client.send(new GetCommand({
+        TableName: tableName,
+        Key: input.key,
+        ConsistentRead: input.consistentRead
+      }));
+      return result.Item ?? undefined;
+    },
+    async put(input) {
+      const condition = input.condition === "not-exists" ? "attribute_not_exists(pk) AND attribute_not_exists(sk)" : input.condition === "exists" ? "attribute_exists(pk) AND attribute_exists(sk)" : undefined;
+      await client.send(new PutCommand({
+        TableName: tableName,
+        Item: input.item,
+        ...condition ? { ConditionExpression: condition } : {}
+      }));
+    },
+    async delete(input) {
+      const result = await client.send(new DeleteCommand({
+        TableName: tableName,
+        Key: input.key,
+        ReturnValues: "ALL_OLD"
+      }));
+      return result.Attributes ?? undefined;
+    },
+    async consumeRefresh(input) {
+      try {
+        const result = await client.send(new UpdateCommand({
+          TableName: tableName,
+          Key: input.key,
+          UpdateExpression: "SET consumed_at = :now",
+          ConditionExpression: "attribute_exists(pk) AND attribute_not_exists(consumed_at) AND expires_at > :now",
+          ExpressionAttributeValues: { ":now": input.now },
+          ReturnValues: "ALL_NEW"
+        }));
+        return result.Attributes ?? null;
+      } catch (e) {
+        if (isConditionalCheckFailed(e))
+          return null;
+        throw e;
+      }
+    },
+    async query(input) {
+      const exprAttrValues = { ":pk": input.pk };
+      let keyExpr = "pk = :pk";
+      if (input.skBeginsWith) {
+        keyExpr += " AND begins_with(sk, :skp)";
+        exprAttrValues[":skp"] = input.skBeginsWith;
+      }
+      let filterExpr;
+      if (input.filter) {
+        const k = ":fv";
+        filterExpr = `#attr = ${k}`;
+        exprAttrValues[k] = input.filter.equals;
+      }
+      const result = await client.send(new QueryCommand({
+        TableName: tableName,
+        KeyConditionExpression: keyExpr,
+        ConsistentRead: input.consistentRead,
+        ExpressionAttributeValues: exprAttrValues,
+        ...filterExpr ? {
+          FilterExpression: filterExpr,
+          ExpressionAttributeNames: { "#attr": input.filter.attribute }
+        } : {}
+      }));
+      return result.Items ?? [];
+    },
+    async queryByGsi(input) {
+      const result = await client.send(new QueryCommand({
+        TableName: tableName,
+        IndexName: input.indexName,
+        KeyConditionExpression: "#hk = :v",
+        ExpressionAttributeNames: {
+          "#hk": input.indexName === "family-index" ? "family" : input.indexName === "subject-index" ? "subject_key" : "user_key"
+        },
+        ExpressionAttributeValues: { ":v": input.hashKey }
+      }));
+      return result.Items ?? [];
+    },
+    async updateItem(input) {
+      const names = {};
+      const values = {};
+      const sets = [];
+      let i = 0;
+      for (const [attr, value] of Object.entries(input.set)) {
+        const nameRef = `#a${i}`;
+        const valueRef = `:v${i}`;
+        names[nameRef] = attr;
+        values[valueRef] = value;
+        sets.push(`${nameRef} = ${valueRef}`);
+        i += 1;
+      }
+      if (sets.length === 0)
+        return;
+      try {
+        await client.send(new UpdateCommand({
+          TableName: tableName,
+          Key: input.key,
+          UpdateExpression: `SET ${sets.join(", ")}`,
+          ConditionExpression: "attribute_exists(pk) AND attribute_exists(sk)",
+          ExpressionAttributeNames: names,
+          ExpressionAttributeValues: values
+        }));
+      } catch (e) {
+        if (!isConditionalCheckFailed(e))
+          throw e;
+      }
+    }
+  };
+}
+function isConditionalCheckFailed(e) {
+  if (typeof e !== "object" || e === null)
+    return false;
+  const name = e.name;
+  return name === "ConditionalCheckFailedException";
+}
+export {
+  fromDynamoDBClient
+};

package/dist/esm/adapters/dynamo/session-store.js

@@ -0,0 +1,173 @@
+// src/adapters/dynamo/session-store.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+
+class DynamoSessionStore {
+  #exec;
+  #clock;
+  constructor(opts) {
+    this.#exec = opts.exec;
+    this.#clock = opts.clock ?? (() => Date.now());
+  }
+  async saveFlow(flowId, payload, ttl) {
+    if (ttl <= 0) {
+      return err(authError.internalError(`saveFlow: ttl must be positive, got ${ttl}`));
+    }
+    const expiresAtMs = this.#clock() + ttl;
+    try {
+      await this.#exec.put({
+        item: {
+          pk: "flow",
+          sk: flowId,
+          payload: JSON.stringify(payload),
+          expires_at: expiresAtMs,
+          ttl: Math.floor(expiresAtMs / 1000)
+        }
+      });
+    } catch (e) {
+      return err(authError.internalError("saveFlow: put failed", e));
+    }
+    return ok(undefined);
+  }
+  async updateFlowMethodState(flowId, methodState) {
+    const now = this.#clock();
+    let row;
+    try {
+      row = await this.#exec.get({
+        key: { pk: "flow", sk: flowId },
+        consistentRead: true
+      });
+    } catch (e) {
+      return err(authError.internalError("updateFlowMethodState: get failed", e));
+    }
+    if (!row) {
+      return err(authError.unknownState(`flow "${flowId}" unknown`));
+    }
+    if (now >= Number(row.expires_at)) {
+      return err(authError.unknownState(`flow "${flowId}" expired`));
+    }
+    const parsed = parseFlowPayload(row.payload);
+    const next = { ...parsed, methodState };
+    try {
+      await this.#exec.put({
+        item: {
+          pk: "flow",
+          sk: flowId,
+          payload: JSON.stringify(next),
+          expires_at: row.expires_at,
+          ttl: row.ttl
+        },
+        condition: "exists"
+      });
+    } catch (e) {
+      if (isConditionalCheckFailed(e)) {
+        return err(authError.unknownState(`flow "${flowId}" was consumed between read and update`));
+      }
+      return err(authError.internalError("updateFlowMethodState: put failed", e));
+    }
+    return ok(undefined);
+  }
+  async readFlow(flowId) {
+    let row;
+    try {
+      row = await this.#exec.get({
+        key: { pk: "flow", sk: flowId },
+        consistentRead: true
+      });
+    } catch (e) {
+      return err(authError.internalError("readFlow: get failed", e));
+    }
+    if (!row) {
+      return err(authError.unknownState(`flow "${flowId}" unknown`));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      try {
+        await this.#exec.delete({ key: { pk: "flow", sk: flowId } });
+      } catch {}
+      return err(authError.unknownState(`flow "${flowId}" expired`));
+    }
+    return ok(parseFlowPayload(row.payload));
+  }
+  async consumeFlow(flowId) {
+    let row;
+    try {
+      row = await this.#exec.delete({ key: { pk: "flow", sk: flowId } });
+    } catch (e) {
+      return err(authError.internalError("consumeFlow: delete failed", e));
+    }
+    if (!row) {
+      return err(authError.unknownState(`flow "${flowId}" unknown or already consumed`));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      return err(authError.unknownState(`flow "${flowId}" expired`));
+    }
+    return ok(parseFlowPayload(row.payload));
+  }
+  async createSession(sessionId, payload, ttl) {
+    if (ttl <= 0) {
+      return err(authError.internalError(`createSession: ttl must be positive, got ${ttl}`));
+    }
+    const expiresAtMs = this.#clock() + ttl;
+    try {
+      await this.#exec.put({
+        item: {
+          pk: "session",
+          sk: sessionId,
+          payload: JSON.stringify(payload),
+          expires_at: expiresAtMs,
+          ttl: Math.floor(expiresAtMs / 1000)
+        }
+      });
+    } catch (e) {
+      return err(authError.internalError("createSession: put failed", e));
+    }
+    return ok(undefined);
+  }
+  async readSession(sessionId) {
+    let row;
+    try {
+      row = await this.#exec.get({
+        key: { pk: "session", sk: sessionId },
+        consistentRead: true
+      });
+    } catch (e) {
+      return err(authError.internalError("readSession: get failed", e));
+    }
+    if (!row) {
+      return err(authError.invalidRequest(`session "${sessionId}" unknown`));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      try {
+        await this.#exec.delete({ key: { pk: "session", sk: sessionId } });
+      } catch {}
+      return err(authError.invalidRequest(`session "${sessionId}" expired`));
+    }
+    return ok(parseSessionPayload(row.payload));
+  }
+  async revokeSession(sessionId) {
+    try {
+      await this.#exec.delete({ key: { pk: "session", sk: sessionId } });
+    } catch (e) {
+      return err(authError.internalError("revokeSession: delete failed", e));
+    }
+    return ok(undefined);
+  }
+}
+function parseFlowPayload(raw) {
+  if (typeof raw === "string")
+    return JSON.parse(raw);
+  return raw;
+}
+function isConditionalCheckFailed(e) {
+  if (typeof e !== "object" || e === null)
+    return false;
+  return e.name === "ConditionalCheckFailedException";
+}
+function parseSessionPayload(raw) {
+  if (typeof raw === "string")
+    return JSON.parse(raw);
+  return raw;
+}
+export {
+  DynamoSessionStore
+};

package/dist/esm/adapters/dynamo/token-store.js

@@ -0,0 +1,178 @@
+// src/adapters/dynamo/token-store.ts
+import { AUTH_CODE_TTL_MS } from "../../domain/authorize";
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+
+class DynamoTokenStore {
+  #exec;
+  #clock;
+  constructor(opts) {
+    this.#exec = opts.exec;
+    this.#clock = opts.clock ?? (() => Date.now());
+  }
+  async saveCode(code, ciphertext, ttl) {
+    if (ttl <= 0 || ttl > AUTH_CODE_TTL_MS) {
+      return err(authError.internalError(`saveCode: ttl ${ttl} outside (0, ${AUTH_CODE_TTL_MS}] (auth-code TTL is fixed at 60s by OAuth 2.1 BCP)`));
+    }
+    const expiresAtMs = this.#clock() + ttl;
+    try {
+      await this.#exec.put({
+        item: {
+          pk: "code",
+          sk: code,
+          ciphertext,
+          expires_at: expiresAtMs,
+          ttl: Math.floor(expiresAtMs / 1000)
+        }
+      });
+    } catch (e) {
+      return err(authError.internalError("saveCode: put failed", e));
+    }
+    return ok(undefined);
+  }
+  async consumeCode(code) {
+    let row;
+    try {
+      row = await this.#exec.delete({ key: { pk: "code", sk: code } });
+    } catch (e) {
+      return err(authError.internalError("consumeCode: delete failed", e));
+    }
+    if (!row) {
+      return err(authError.invalidGrant("auth code unknown or already consumed"));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      return err(authError.invalidGrant("auth code expired"));
+    }
+    return ok(String(row.ciphertext));
+  }
+  async saveRefresh(refresh, payload) {
+    try {
+      await this.#exec.put({
+        item: {
+          pk: "refresh",
+          sk: refresh,
+          payload: JSON.stringify(payload),
+          family: payload.family,
+          subject_key: `${payload.tenantId}#${payload.subjectId}`,
+          tenant_id: payload.tenantId,
+          subject_id: payload.subjectId,
+          expires_at: payload.expiresAt,
+          ttl: Math.floor(payload.expiresAt / 1000)
+        }
+      });
+    } catch (e) {
+      return err(authError.internalError("saveRefresh: put failed", e));
+    }
+    return ok(undefined);
+  }
+  async consumeRefresh(refresh, options = {}) {
+    const reuseWindow = options.reuseWindowMs ?? 60000;
+    const now = this.#clock();
+    let claimed;
+    try {
+      claimed = await this.#exec.consumeRefresh({
+        key: { pk: "refresh", sk: refresh },
+        now
+      });
+    } catch (e) {
+      return err(authError.internalError("consumeRefresh: claim failed", e));
+    }
+    if (claimed) {
+      return ok(parseRefresh(claimed.payload));
+    }
+    let existing;
+    try {
+      existing = await this.#exec.get({
+        key: { pk: "refresh", sk: refresh },
+        consistentRead: true
+      });
+    } catch (e) {
+      return err(authError.internalError("consumeRefresh: lookup failed", e));
+    }
+    if (!existing) {
+      return err(authError.invalidGrant("refresh token unknown"));
+    }
+    if (existing.consumed_at !== undefined && existing.consumed_at !== null) {
+      const consumedAt = Number(existing.consumed_at);
+      const withinWindow = now - consumedAt <= reuseWindow;
+      if (withinWindow) {
+        const payload = parseRefresh(existing.payload);
+        await this.revokeFamily(payload.family);
+        return err(authError.invalidGrant(`refresh token reuse detected (family=${payload.family})`, {
+          family: payload.family,
+          tenantId: payload.tenantId,
+          subjectId: payload.subjectId
+        }));
+      }
+      return err(authError.invalidGrant("refresh token already consumed"));
+    }
+    if (now >= Number(existing.expires_at)) {
+      return err(authError.invalidGrant("refresh token expired"));
+    }
+    return err(authError.internalError("consumeRefresh: unexplained miss"));
+  }
+  async peekRefresh(refresh) {
+    let existing;
+    try {
+      existing = await this.#exec.get({
+        key: { pk: "refresh", sk: refresh },
+        consistentRead: true
+      });
+    } catch (e) {
+      return err(authError.internalError("peekRefresh: lookup failed", e));
+    }
+    if (!existing) {
+      return err(authError.invalidGrant("refresh token unknown"));
+    }
+    if (this.#clock() >= Number(existing.expires_at)) {
+      return err(authError.invalidGrant("refresh token expired"));
+    }
+    return ok(parseRefresh(existing.payload));
+  }
+  async revokeFamily(family) {
+    let items;
+    try {
+      items = await this.#exec.queryByGsi({
+        indexName: "family-index",
+        hashKey: family
+      });
+    } catch (e) {
+      return err(authError.internalError("revokeFamily: query failed", e));
+    }
+    for (const item of items) {
+      try {
+        await this.#exec.delete({
+          key: { pk: String(item.pk), sk: String(item.sk) }
+        });
+      } catch {}
+    }
+    return ok(undefined);
+  }
+  async revokeBySubject(tenantId, subjectId) {
+    let items;
+    try {
+      items = await this.#exec.queryByGsi({
+        indexName: "subject-index",
+        hashKey: `${tenantId}#${subjectId}`
+      });
+    } catch (e) {
+      return err(authError.internalError("revokeBySubject: query failed", e));
+    }
+    for (const item of items) {
+      try {
+        await this.#exec.delete({
+          key: { pk: String(item.pk), sk: String(item.sk) }
+        });
+      } catch {}
+    }
+    return ok(undefined);
+  }
+}
+function parseRefresh(raw) {
+  if (typeof raw === "string")
+    return JSON.parse(raw);
+  return raw;
+}
+export {
+  DynamoTokenStore
+};

package/dist/esm/adapters/kms/in-memory-backing.js

@@ -0,0 +1,28 @@
+// src/adapters/kms/in-memory-backing.ts
+function inMemoryKmsBackingStore() {
+  const signing = new Map;
+  const encryption = new Map;
+  return {
+    async putSigningKey(row) {
+      signing.set(row.kid, row);
+    },
+    async getSigningKey(kid) {
+      return signing.get(kid);
+    },
+    async listSigningKeys() {
+      return Array.from(signing.values());
+    },
+    async putEncryptionKey(row) {
+      encryption.set(row.kid, row);
+    },
+    async getEncryptionKey(kid) {
+      return encryption.get(kid);
+    },
+    async listEncryptionKeys() {
+      return Array.from(encryption.values());
+    }
+  };
+}
+export {
+  inMemoryKmsBackingStore
+};

package/dist/esm/adapters/kms/index.js

@@ -0,0 +1,5 @@
+export {
+  inMemoryKmsBackingStore,
+  fromKmsClient,
+  KmsKeyStore
+};

package/dist/esm/adapters/kms/key-store.js

@@ -0,0 +1,129 @@
+// src/adapters/kms/key-store.ts
+import { exportJWK, generateKeyPair, importJWK } from "jose";
+import { generateSymmetricKey, randomId, utf8 } from "../../domain/crypto";
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+
+class KmsKeyStore {
+  #kms;
+  #backing;
+  #clock;
+  #signingAlg;
+  #cacheUnwrapped;
+  #signingCache = new Map;
+  #encryptionCache = new Map;
+  constructor(opts) {
+    this.#kms = opts.kms;
+    this.#backing = opts.backing;
+    this.#clock = opts.clock ?? (() => Date.now());
+    this.#signingAlg = opts.signingAlg ?? "ES256";
+    this.#cacheUnwrapped = opts.cacheUnwrappedKeys ?? true;
+  }
+  async currentSigningKey() {
+    await this.#ensureSigningKey();
+    const all = await this.#backing.listSigningKeys();
+    const active = all.find((k) => k.status === "active");
+    if (!active) {
+      return err(authError.internalError("no active signing key (should be unreachable)"));
+    }
+    return ok(await this.#hydrateSigning(active));
+  }
+  async signingKeys() {
+    await this.#ensureSigningKey();
+    const all = await this.#backing.listSigningKeys();
+    const keys = await Promise.all(all.map((row) => this.#hydrateSigning(row)));
+    return ok(keys);
+  }
+  async currentEncryptionKey() {
+    await this.#ensureEncryptionKey();
+    const all = await this.#backing.listEncryptionKeys();
+    const active = all.find((k) => k.status === "active");
+    if (!active) {
+      return err(authError.internalError("no active encryption key (should be unreachable)"));
+    }
+    return ok(await this.#hydrateEncryption(active));
+  }
+  async getEncryptionKey(kid) {
+    const row = await this.#backing.getEncryptionKey(kid);
+    if (!row) {
+      return err(authError.internalError(`encryption key "${kid}" not found`));
+    }
+    return ok(await this.#hydrateEncryption(row));
+  }
+  async#ensureSigningKey() {
+    const all = await this.#backing.listSigningKeys();
+    if (all.some((k) => k.status === "active"))
+      return;
+    const { publicKey, privateKey } = await generateKeyPair(this.#signingAlg, {
+      extractable: true
+    });
+    const publicJwk = await exportJWK(publicKey);
+    const privateJwk = await exportJWK(privateKey);
+    const plaintext = utf8.encode(JSON.stringify(privateJwk));
+    const wrapped = await this.#kms.encrypt(plaintext);
+    const row = {
+      kid: randomId(),
+      alg: this.#signingAlg,
+      ...publicJwk.crv ? { crv: publicJwk.crv } : {},
+      publicJwk,
+      wrappedPrivate: wrapped,
+      status: "active",
+      createdAt: this.#clock()
+    };
+    await this.#backing.putSigningKey(row);
+  }
+  async#ensureEncryptionKey() {
+    const all = await this.#backing.listEncryptionKeys();
+    if (all.some((k) => k.status === "active"))
+      return;
+    const raw = generateSymmetricKey();
+    const wrapped = await this.#kms.encrypt(raw);
+    const row = {
+      kid: randomId(),
+      alg: "A256GCM",
+      wrappedKey: wrapped,
+      status: "active",
+      createdAt: this.#clock()
+    };
+    await this.#backing.putEncryptionKey(row);
+  }
+  async#hydrateSigning(row) {
+    let imported = this.#signingCache.get(row.kid);
+    if (!imported) {
+      const plaintext = await this.#kms.decrypt(row.wrappedPrivate);
+      const jwk = JSON.parse(utf8.decode(plaintext));
+      imported = await importJWK(jwk, row.alg);
+      if (this.#cacheUnwrapped)
+        this.#signingCache.set(row.kid, imported);
+    }
+    return {
+      kid: row.kid,
+      alg: row.alg,
+      ...row.crv ? { crv: row.crv } : {},
+      publicJwk: row.publicJwk,
+      privateKeyRef: imported,
+      status: row.status,
+      createdAt: row.createdAt,
+      ...row.rotatedAt !== undefined ? { rotatedAt: row.rotatedAt } : {}
+    };
+  }
+  async#hydrateEncryption(row) {
+    let bytes = this.#encryptionCache.get(row.kid);
+    if (!bytes) {
+      bytes = await this.#kms.decrypt(row.wrappedKey);
+      if (this.#cacheUnwrapped)
+        this.#encryptionCache.set(row.kid, bytes);
+    }
+    return {
+      kid: row.kid,
+      alg: row.alg,
+      keyRef: bytes,
+      status: row.status,
+      createdAt: row.createdAt,
+      ...row.rotatedAt !== undefined ? { rotatedAt: row.rotatedAt } : {}
+    };
+  }
+}
+export {
+  KmsKeyStore
+};

package/dist/esm/adapters/kms/sdk.js

@@ -0,0 +1,23 @@
+// src/adapters/kms/sdk.ts
+import { DecryptCommand, EncryptCommand } from "@aws-sdk/client-kms";
+function fromKmsClient(client, keyId) {
+  return {
+    async encrypt(plaintext) {
+      const result = await client.send(new EncryptCommand({ KeyId: keyId, Plaintext: plaintext }));
+      if (!result.CiphertextBlob) {
+        throw new Error("KMS Encrypt returned no ciphertext");
+      }
+      return new Uint8Array(result.CiphertextBlob);
+    },
+    async decrypt(ciphertext) {
+      const result = await client.send(new DecryptCommand({ KeyId: keyId, CiphertextBlob: ciphertext }));
+      if (!result.Plaintext) {
+        throw new Error("KMS Decrypt returned no plaintext");
+      }
+      return new Uint8Array(result.Plaintext);
+    }
+  };
+}
+export {
+  fromKmsClient
+};

package/dist/esm/adapters/kv/audit-log.js

@@ -0,0 +1,21 @@
+// src/adapters/kv/audit-log.ts
+var PREFIX = "audit:";
+
+class KvAuditLog {
+  #kv;
+  #ttl;
+  constructor(opts) {
+    this.#kv = opts.kv;
+    this.#ttl = opts.expirationTtl;
+  }
+  async log(event) {
+    const padded = String(event.timestamp).padStart(16, "0");
+    const suffix = Math.random().toString(36).slice(2, 10);
+    try {
+      await this.#kv.put(`${PREFIX}${padded}:${suffix}`, JSON.stringify(event), this.#ttl ? { expirationTtl: this.#ttl } : undefined);
+    } catch {}
+  }
+}
+export {
+  KvAuditLog
+};