@_mustachio/openauth 0.9.2 → 0.11.0

package/src/adapters/memory/key-store.ts

@@ -0,0 +1,102 @@
+/**
+ * In-memory `KeyStore`. Auto-generates ES256 signing keys and A256GCM
+ * encryption keys on first read. Suitable for tests and single-instance
+ * dev.
+ */
+import { exportJWK, generateKeyPair } from "jose"
+
+import type { EncryptionKey, KeyStore, SigningKey } from "../../ports/key-store"
+import { authError } from "../../types/error"
+import type { Result } from "../../types/result"
+import { err, ok } from "../../types/result"
+import { generateSymmetricKey, randomId } from "../../domain/crypto"
+import type { Clock } from "./clock"
+import { realClock } from "./clock"
+
+export type MemoryKeyStoreOptions = {
+  clock?: Clock
+  /** Override default `"ES256"` (other supported: `"EdDSA"` per AD11). */
+  signingAlg?: "ES256" | "EdDSA"
+}
+
+export class MemoryKeyStore implements KeyStore {
+  #clock: Clock
+  #signingAlg: "ES256" | "EdDSA"
+  #signing: SigningKey[] = []
+  #encryption: EncryptionKey[] = []
+
+  constructor(opts: MemoryKeyStoreOptions = {}) {
+    this.#clock = opts.clock ?? realClock
+    this.#signingAlg = opts.signingAlg ?? "ES256"
+  }
+
+  async currentSigningKey(): Promise<Result<SigningKey>> {
+    await this.#ensureSigningKey()
+    const active = this.#signing.find((k) => k.status === "active")
+    if (!active) {
+      return err(
+        authError.internalError(
+          "no active signing key (should be unreachable)",
+        ),
+      )
+    }
+    return ok(active)
+  }
+
+  async signingKeys(): Promise<Result<SigningKey[]>> {
+    await this.#ensureSigningKey()
+    return ok([...this.#signing])
+  }
+
+  async currentEncryptionKey(): Promise<Result<EncryptionKey>> {
+    this.#ensureEncryptionKey()
+    const active = this.#encryption.find((k) => k.status === "active")
+    if (!active) {
+      return err(
+        authError.internalError(
+          "no active encryption key (should be unreachable)",
+        ),
+      )
+    }
+    return ok(active)
+  }
+
+  async getEncryptionKey(kid: string): Promise<Result<EncryptionKey>> {
+    this.#ensureEncryptionKey()
+    const match = this.#encryption.find((k) => k.kid === kid)
+    if (!match) {
+      return err(authError.internalError(`encryption key "${kid}" not found`))
+    }
+    return ok(match)
+  }
+
+  async #ensureSigningKey(): Promise<void> {
+    if (this.#signing.some((k) => k.status === "active")) return
+    const { publicKey, privateKey } = await generateKeyPair(this.#signingAlg, {
+      extractable: true,
+    })
+    const jwk = await exportJWK(publicKey)
+    const key: SigningKey = {
+      kid: randomId(),
+      alg: this.#signingAlg,
+      crv: jwk.crv ?? undefined,
+      publicJwk: jwk as unknown as Record<string, unknown>,
+      privateKeyRef: privateKey,
+      status: "active",
+      createdAt: this.#clock(),
+    }
+    this.#signing.push(key)
+  }
+
+  #ensureEncryptionKey(): void {
+    if (this.#encryption.some((k) => k.status === "active")) return
+    const key: EncryptionKey = {
+      kid: randomId(),
+      alg: "A256GCM",
+      keyRef: generateSymmetricKey(),
+      status: "active",
+      createdAt: this.#clock(),
+    }
+    this.#encryption.push(key)
+  }
+}

package/src/adapters/memory/method-store.ts

@@ -0,0 +1,75 @@
+/**
+ * In-memory `MethodStore`. Per-tenant `Map<methodId, MethodConfig>`. Single
+ * process so the eventual + bounded-staleness contract is trivially satisfied.
+ *
+ * `MethodStore` is optional in the IdP — when omitted, the framework falls
+ * back to slicing `MethodConfig[]` out of `ConfigStore.getTenantConfig`. The
+ * memory adapter still ships so the conformance suite has a baseline.
+ */
+import type { MethodStore } from "../../ports/method-store"
+import { authError } from "../../types/error"
+import type { Result } from "../../types/result"
+import { err, ok } from "../../types/result"
+import type { MethodConfig, TenantId } from "../../types/tenant"
+
+export type MemoryMethodStoreOptions = {
+  seed?: ReadonlyArray<{
+    tenantId: TenantId
+    methods: ReadonlyArray<MethodConfig>
+  }>
+}
+
+export class MemoryMethodStore implements MethodStore {
+  #byTenant = new Map<TenantId, Map<string, MethodConfig>>()
+
+  constructor(opts: MemoryMethodStoreOptions = {}) {
+    for (const seed of opts.seed ?? []) {
+      const inner = new Map<string, MethodConfig>()
+      for (const m of seed.methods) inner.set(m.id, m)
+      this.#byTenant.set(seed.tenantId, inner)
+    }
+  }
+
+  async listMethods(tenantId: TenantId): Promise<Result<MethodConfig[]>> {
+    const inner = this.#byTenant.get(tenantId)
+    return ok(inner ? Array.from(inner.values()) : [])
+  }
+
+  async getMethodConfig(
+    tenantId: TenantId,
+    methodId: string,
+  ): Promise<Result<MethodConfig>> {
+    const inner = this.#byTenant.get(tenantId)
+    const m = inner?.get(methodId)
+    if (!m) {
+      return err(
+        authError.methodNotFound(
+          `method "${methodId}" not found for tenant "${tenantId}"`,
+          { methodId },
+        ),
+      )
+    }
+    return ok(m)
+  }
+
+  async putMethodConfig(
+    tenantId: TenantId,
+    method: MethodConfig,
+  ): Promise<Result<void>> {
+    let inner = this.#byTenant.get(tenantId)
+    if (!inner) {
+      inner = new Map<string, MethodConfig>()
+      this.#byTenant.set(tenantId, inner)
+    }
+    inner.set(method.id, method)
+    return ok(undefined)
+  }
+
+  async deleteMethodConfig(
+    tenantId: TenantId,
+    methodId: string,
+  ): Promise<Result<void>> {
+    this.#byTenant.get(tenantId)?.delete(methodId)
+    return ok(undefined)
+  }
+}

package/src/adapters/memory/passkey-credential-store.ts

@@ -0,0 +1,97 @@
+/**
+ * In-memory `PasskeyCredentialStore`. Map-backed, single-process —
+ * suitable for tests and single-instance dev.
+ *
+ * Schema simplification (shared by all three reference adapters): the
+ * `userId` field is also the username lookup key. This matches the
+ * bundled `passkeyMethod`, which sets `userId = parsed.data.username`
+ * at registration time. Hosts that need a richer mapping
+ * (username ≠ userId, multi-username-per-user, etc.) implement
+ * `PasskeyCredentialStore` directly against their own data model.
+ */
+import type {
+  PasskeyCredentialStore,
+  StoredCredential,
+} from "../../methods/passkey"
+
+export type MemoryPasskeyCredentialStoreOptions = {
+  /**
+   * Optional seed list for tests / dev. Each entry is the full
+   * `StoredCredential` plus its tenant scope. The store treats the
+   * credential's `userId` as the username lookup key.
+   */
+  seed?: Array<{ tenantId: string; credential: StoredCredential }>
+}
+
+export class MemoryPasskeyCredentialStore implements PasskeyCredentialStore {
+  #items = new Map<string, StoredCredential & { tenantId: string }>()
+
+  constructor(opts: MemoryPasskeyCredentialStoreOptions = {}) {
+    for (const entry of opts.seed ?? []) {
+      this.#items.set(
+        this.#key(entry.tenantId, entry.credential.credentialId),
+        {
+          ...entry.credential,
+          tenantId: entry.tenantId,
+        },
+      )
+    }
+  }
+
+  #key(tenantId: string, credentialId: string): string {
+    return `${tenantId}|${credentialId}`
+  }
+
+  async findByUsername(
+    username: string,
+    tenantId: string,
+  ): Promise<{ userId: string; credentials: StoredCredential[] } | null> {
+    const credentials: StoredCredential[] = []
+    for (const item of this.#items.values()) {
+      if (item.tenantId !== tenantId) continue
+      if (item.userId !== username) continue
+      credentials.push(stripTenant(item))
+    }
+    if (credentials.length === 0) return null
+    return { userId: username, credentials }
+  }
+
+  async findById(
+    credentialId: string,
+    tenantId: string,
+  ): Promise<StoredCredential | null> {
+    const item = this.#items.get(this.#key(tenantId, credentialId))
+    return item ? stripTenant(item) : null
+  }
+
+  async updateCounter(input: {
+    credentialId: string
+    counter: number
+    tenantId: string
+  }): Promise<void> {
+    const k = this.#key(input.tenantId, input.credentialId)
+    const item = this.#items.get(k)
+    if (!item) return
+    this.#items.set(k, { ...item, counter: input.counter })
+  }
+
+  async create(input: {
+    userId: string
+    credential: StoredCredential
+    tenantId: string
+  }): Promise<void> {
+    this.#items.set(this.#key(input.tenantId, input.credential.credentialId), {
+      ...input.credential,
+      userId: input.userId,
+      tenantId: input.tenantId,
+    })
+  }
+}
+
+function stripTenant(
+  item: StoredCredential & { tenantId: string },
+): StoredCredential {
+  const { tenantId: _unused, ...rest } = item
+  void _unused
+  return rest
+}

package/src/adapters/memory/session-store.ts

@@ -0,0 +1,171 @@
+/**
+ * In-memory `SessionStore` — flow records (required) + optional long-lived
+ * sessions. Map-backed; atomic w.r.t. the JS event loop.
+ *
+ * `consumeFlow` is a strict atomic delete-on-read that returns the full
+ * `FlowRecord` — the framework needs every field to snapshot into the
+ * auth-code payload before the record is gone.
+ */
+import { authError } from "../../types/error"
+import type { FlowRecord } from "../../types/flow"
+import type {
+  ParRecord,
+  SessionRecord,
+  SessionStore,
+} from "../../ports/session-store"
+import type { Result } from "../../types/result"
+import { err, ok } from "../../types/result"
+import type { Clock } from "./clock"
+import { realClock } from "./clock"
+
+type StoredFlow = {
+  record: FlowRecord
+  expiresAt: number
+}
+
+type StoredPar = {
+  record: ParRecord
+  expiresAt: number
+}
+
+export type MemorySessionStoreOptions = {
+  clock?: Clock
+}
+
+export class MemorySessionStore implements SessionStore {
+  #clock: Clock
+  #flows = new Map<string, StoredFlow>()
+  #sessions = new Map<string, SessionRecord>()
+  #par = new Map<string, StoredPar>()
+
+  constructor(opts: MemorySessionStoreOptions = {}) {
+    this.#clock = opts.clock ?? realClock
+  }
+
+  async saveFlow(
+    flowId: string,
+    payload: FlowRecord,
+    ttl: number,
+  ): Promise<Result<void>> {
+    if (ttl <= 0) {
+      return err(
+        authError.internalError(`saveFlow: ttl must be positive, got ${ttl}`),
+      )
+    }
+    this.#flows.set(flowId, {
+      record: payload,
+      expiresAt: this.#clock() + ttl,
+    })
+    return ok(undefined)
+  }
+
+  async updateFlowMethodState(
+    flowId: string,
+    methodState: unknown,
+  ): Promise<Result<void>> {
+    const stored = this.#flows.get(flowId)
+    if (!stored) {
+      return err(authError.unknownState(`flow "${flowId}" unknown`))
+    }
+    if (this.#clock() >= stored.expiresAt) {
+      this.#flows.delete(flowId)
+      return err(authError.unknownState(`flow "${flowId}" expired`))
+    }
+    stored.record = { ...stored.record, methodState }
+    return ok(undefined)
+  }
+
+  async readFlow(flowId: string): Promise<Result<FlowRecord>> {
+    const stored = this.#flows.get(flowId)
+    if (!stored) {
+      return err(authError.unknownState(`flow "${flowId}" unknown`))
+    }
+    if (this.#clock() >= stored.expiresAt) {
+      this.#flows.delete(flowId)
+      return err(authError.unknownState(`flow "${flowId}" expired`))
+    }
+    return ok(stored.record)
+  }
+
+  async consumeFlow(flowId: string): Promise<Result<FlowRecord>> {
+    const stored = this.#flows.get(flowId)
+    if (!stored) {
+      return err(
+        authError.unknownState(`flow "${flowId}" unknown or already consumed`),
+      )
+    }
+    // Atomic delete-on-read — remove before observable side effects so a
+    // concurrent caller can't see the same record.
+    this.#flows.delete(flowId)
+    if (this.#clock() >= stored.expiresAt) {
+      return err(authError.unknownState(`flow "${flowId}" expired`))
+    }
+    return ok(stored.record)
+  }
+
+  async createSession(
+    sessionId: string,
+    payload: SessionRecord,
+    ttl: number,
+  ): Promise<Result<void>> {
+    if (ttl <= 0) {
+      return err(
+        authError.internalError(
+          `createSession: ttl must be positive, got ${ttl}`,
+        ),
+      )
+    }
+    this.#sessions.set(sessionId, payload)
+    return ok(undefined)
+  }
+
+  async readSession(sessionId: string): Promise<Result<SessionRecord>> {
+    const s = this.#sessions.get(sessionId)
+    if (!s) {
+      return err(authError.invalidRequest(`session "${sessionId}" unknown`))
+    }
+    if (this.#clock() >= s.expiresAt) {
+      this.#sessions.delete(sessionId)
+      return err(authError.invalidRequest(`session "${sessionId}" expired`))
+    }
+    return ok(s)
+  }
+
+  async revokeSession(sessionId: string): Promise<Result<void>> {
+    this.#sessions.delete(sessionId)
+    return ok(undefined)
+  }
+
+  async savePar(
+    requestUri: string,
+    payload: ParRecord,
+    ttl: number,
+  ): Promise<Result<void>> {
+    if (ttl <= 0) {
+      return err(
+        authError.internalError(`savePar: ttl must be positive, got ${ttl}`),
+      )
+    }
+    this.#par.set(requestUri, {
+      record: payload,
+      expiresAt: this.#clock() + ttl,
+    })
+    return ok(undefined)
+  }
+
+  async consumePar(requestUri: string): Promise<Result<ParRecord>> {
+    const stored = this.#par.get(requestUri)
+    if (!stored) {
+      return err(
+        authError.unknownState(
+          `par "${requestUri}" unknown or already consumed`,
+        ),
+      )
+    }
+    this.#par.delete(requestUri)
+    if (this.#clock() >= stored.expiresAt) {
+      return err(authError.unknownState(`par "${requestUri}" expired`))
+    }
+    return ok(stored.record)
+  }
+}

package/src/adapters/memory/token-store.ts

@@ -0,0 +1,181 @@
+/**
+ * In-memory `TokenStore`. Single-process; the `Map` operations are
+ * atomic with respect to JS event-loop turns, which is enough for the
+ * strong-CAS contract here.
+ *
+ * Auth-code ciphertext is stored verbatim — encryption is the domain's
+ * job (see `domain/authorize.ts` → `encryptPayload`), so the adapter
+ * never sees plaintext. Inspecting the internal map shows whatever
+ * blob the domain saved.
+ */
+import { AUTH_CODE_TTL_MS } from "../../domain/authorize"
+import type { KeyStore } from "../../ports/key-store"
+import type { TokenStore } from "../../ports/token-store"
+import { authError } from "../../types/error"
+import type { Result } from "../../types/result"
+import { err, ok } from "../../types/result"
+import type { TenantId } from "../../types/tenant"
+import type { RefreshTokenPayload } from "../../types/token"
+
+import type { Clock } from "./clock"
+import { realClock } from "./clock"
+
+type StoredCode = {
+  ciphertext: string
+  expiresAt: number
+}
+
+type StoredRefresh = {
+  payload: RefreshTokenPayload
+  consumedAt?: number
+}
+
+export type MemoryTokenStoreOptions = {
+  /**
+   * Optional — retained for API stability after M1 moved code-payload
+   * encryption to the domain layer. The adapter no longer touches it.
+   */
+  keyStore?: KeyStore
+  clock?: Clock
+}
+
+export class MemoryTokenStore implements TokenStore {
+  #clock: Clock
+  #codes = new Map<string, StoredCode>()
+  #refresh = new Map<string, StoredRefresh>()
+  /** DPoP proof `jti` replay-protection map. Value is expiry timestamp. */
+  #dpopJtis = new Map<string, number>()
+
+  constructor(opts: MemoryTokenStoreOptions = {}) {
+    this.#clock = opts.clock ?? realClock
+  }
+
+  async saveCode(
+    code: string,
+    ciphertext: string,
+    ttl: number,
+  ): Promise<Result<void>> {
+    if (ttl <= 0 || ttl > AUTH_CODE_TTL_MS) {
+      return err(
+        authError.internalError(
+          `saveCode: ttl ${ttl} outside (0, ${AUTH_CODE_TTL_MS}] (auth-code TTL is fixed at 60s by OAuth 2.1 BCP)`,
+        ),
+      )
+    }
+    this.#codes.set(code, { ciphertext, expiresAt: this.#clock() + ttl })
+    return ok(undefined)
+  }
+
+  async consumeCode(code: string): Promise<Result<string>> {
+    const stored = this.#codes.get(code)
+    if (!stored) {
+      return err(
+        authError.invalidGrant("auth code unknown or already consumed"),
+      )
+    }
+    // Atomic delete-on-read: remove **before** returning so a concurrent
+    // caller cannot observe the same row.
+    this.#codes.delete(code)
+    if (this.#clock() >= stored.expiresAt) {
+      return err(authError.invalidGrant("auth code expired"))
+    }
+    return ok(stored.ciphertext)
+  }
+
+  async saveRefresh(
+    refresh: string,
+    payload: RefreshTokenPayload,
+  ): Promise<Result<void>> {
+    this.#refresh.set(refresh, { payload })
+    return ok(undefined)
+  }
+
+  async consumeRefresh(
+    refresh: string,
+    options: { reuseWindowMs?: number } = {},
+  ): Promise<Result<RefreshTokenPayload>> {
+    const reuseWindow = options.reuseWindowMs ?? 60_000
+    const now = this.#clock()
+    const stored = this.#refresh.get(refresh)
+    if (!stored) {
+      return err(authError.invalidGrant("refresh token unknown"))
+    }
+    if (stored.consumedAt !== undefined) {
+      const withinWindow = now - stored.consumedAt <= reuseWindow
+      if (withinWindow) {
+        // Reuse detection — auto-revoke the family so every descendant of
+        // the compromised chain is invalidated. The caller still gets
+        // `invalid_grant`; the structured `reuseSignal` carries the
+        // family / tenant / subject for audit-log enrichment (port
+        // contract per `ports/token-store.ts`).
+        const family = stored.payload.family
+        await this.revokeFamily(family)
+        return err(
+          authError.invalidGrant(
+            `refresh token reuse detected (family=${family})`,
+            {
+              family,
+              tenantId: stored.payload.tenantId,
+              subjectId: stored.payload.subjectId,
+            },
+          ),
+        )
+      }
+      return err(authError.invalidGrant("refresh token already consumed"))
+    }
+    if (now >= stored.payload.expiresAt) {
+      return err(authError.invalidGrant("refresh token expired"))
+    }
+    stored.consumedAt = now
+    return ok(stored.payload)
+  }
+
+  async peekRefresh(refresh: string): Promise<Result<RefreshTokenPayload>> {
+    const stored = this.#refresh.get(refresh)
+    if (!stored) {
+      return err(authError.invalidGrant("refresh token unknown"))
+    }
+    if (this.#clock() >= stored.payload.expiresAt) {
+      return err(authError.invalidGrant("refresh token expired"))
+    }
+    return ok(stored.payload)
+  }
+
+  async revokeFamily(family: string): Promise<Result<void>> {
+    for (const [token, stored] of this.#refresh) {
+      if (stored.payload.family === family) {
+        this.#refresh.delete(token)
+      }
+    }
+    return ok(undefined)
+  }
+
+  async revokeBySubject(
+    tenantId: TenantId,
+    subjectId: string,
+  ): Promise<Result<void>> {
+    for (const [token, stored] of this.#refresh) {
+      if (
+        stored.payload.tenantId === tenantId &&
+        stored.payload.subjectId === subjectId
+      ) {
+        this.#refresh.delete(token)
+      }
+    }
+    return ok(undefined)
+  }
+
+  async recordDpopJti(jti: string, ttlMs: number): Promise<Result<void>> {
+    const now = this.#clock()
+    // Sweep expired entries opportunistically — keeps the map bounded
+    // under sustained load without a separate GC pass.
+    for (const [k, exp] of this.#dpopJtis) {
+      if (exp <= now) this.#dpopJtis.delete(k)
+    }
+    if (this.#dpopJtis.has(jti)) {
+      return err(authError.invalidGrant(`dpop jti "${jti}" replayed`))
+    }
+    this.#dpopJtis.set(jti, now + ttlMs)
+    return ok(undefined)
+  }
+}

package/src/adapters/postgres/audit-log.ts

@@ -0,0 +1,34 @@
+/**
+ * Postgres `AuditLog`. Append-only `openauth_audit_events` table; indexed on
+ * `kind` and `ts` for SIEM-style queries. Writes are synchronous — adapters
+ * looking for batching can wrap this with their own buffering layer.
+ */
+import type { AuditEvent, AuditLog } from "../../ports/audit-log"
+
+import type { PostgresExecutor } from "./executor"
+
+export type PostgresAuditLogOptions = {
+  exec: PostgresExecutor
+}
+
+export class PostgresAuditLog implements AuditLog {
+  #exec: PostgresExecutor
+
+  constructor(opts: PostgresAuditLogOptions) {
+    this.#exec = opts.exec
+  }
+
+  async log(event: AuditEvent & { timestamp: number }): Promise<void> {
+    try {
+      await this.#exec.query(
+        `INSERT INTO openauth_audit_events (ts, kind, payload)
+         VALUES ($1, $2, $3::jsonb)`,
+        [event.timestamp, event.kind, JSON.stringify(event)],
+      )
+    } catch {
+      // Per `ports/audit-log.ts` JSDoc: `log` should not throw on durability
+      // failure. The IdP's hot paths must not be gated on the audit log.
+      // Future: add a buffering layer with backoff.
+    }
+  }
+}