@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/esm/adapters/kv/config-store.js

@@ -0,0 +1,43 @@
+// src/adapters/kv/config-store.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+var TENANT_PREFIX = "tenant:";
+
+class KvConfigStore {
+  #kv;
+  #listeners = new Set;
+  constructor(opts) {
+    this.#kv = opts.kv;
+  }
+  async getTenantConfig(id) {
+    let raw;
+    try {
+      raw = await this.#kv.get(TENANT_PREFIX + id);
+    } catch (e) {
+      return err(authError.internalError("getTenantConfig: kv.get failed", e));
+    }
+    if (!raw) {
+      return err(authError.tenantNotFound(`tenant "${id}" not found`, id));
+    }
+    return ok(JSON.parse(raw));
+  }
+  async putTenantConfig(config) {
+    try {
+      await this.#kv.put(TENANT_PREFIX + config.id, JSON.stringify(config));
+    } catch (e) {
+      return err(authError.internalError("putTenantConfig: kv.put failed", e));
+    }
+    for (const fn of this.#listeners) {
+      try {
+        fn(config.id);
+      } catch {}
+    }
+    return ok(undefined);
+  }
+  onInvalidate(handler) {
+    this.#listeners.add(handler);
+  }
+}
+export {
+  KvConfigStore
+};

package/dist/esm/adapters/kv/index.js

@@ -0,0 +1,5 @@
+export {
+  KvMethodStore,
+  KvConfigStore,
+  KvAuditLog
+};

package/dist/esm/adapters/kv/method-store.js

@@ -0,0 +1,63 @@
+// src/adapters/kv/method-store.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+var methodKey = (tenantId, methodId) => `method:${tenantId}:${methodId}`;
+var methodPrefix = (tenantId) => `method:${tenantId}:`;
+
+class KvMethodStore {
+  #kv;
+  constructor(opts) {
+    this.#kv = opts.kv;
+  }
+  async listMethods(tenantId) {
+    const prefix = methodPrefix(tenantId);
+    const methods = [];
+    let cursor;
+    try {
+      do {
+        const page = await this.#kv.list({ prefix, cursor: cursor ?? null });
+        for (const k of page.keys) {
+          const value = await this.#kv.get(k.name);
+          if (value)
+            methods.push(JSON.parse(value));
+        }
+        cursor = page.list_complete ? undefined : page.cursor;
+      } while (cursor);
+    } catch (e) {
+      return err(authError.internalError("listMethods: kv.list failed", e));
+    }
+    methods.sort((a, b) => a.id.localeCompare(b.id));
+    return ok(methods);
+  }
+  async getMethodConfig(tenantId, methodId) {
+    let raw;
+    try {
+      raw = await this.#kv.get(methodKey(tenantId, methodId));
+    } catch (e) {
+      return err(authError.internalError("getMethodConfig: kv.get failed", e));
+    }
+    if (!raw) {
+      return err(authError.methodNotFound(`method "${methodId}" not found for tenant "${tenantId}"`, { methodId }));
+    }
+    return ok(JSON.parse(raw));
+  }
+  async putMethodConfig(tenantId, method) {
+    try {
+      await this.#kv.put(methodKey(tenantId, method.id), JSON.stringify(method));
+    } catch (e) {
+      return err(authError.internalError("putMethodConfig: kv.put failed", e));
+    }
+    return ok(undefined);
+  }
+  async deleteMethodConfig(tenantId, methodId) {
+    try {
+      await this.#kv.delete(methodKey(tenantId, methodId));
+    } catch (e) {
+      return err(authError.internalError("deleteMethodConfig: kv.delete failed", e));
+    }
+    return ok(undefined);
+  }
+}
+export {
+  KvMethodStore
+};

package/dist/esm/adapters/memory/audit-log.js

@@ -0,0 +1,16 @@
+// src/adapters/memory/audit-log.ts
+class MemoryAuditLog {
+  events = [];
+  async log(event) {
+    this.events.push(event);
+  }
+  byKind(kind) {
+    return this.events.filter((e) => e.kind === kind);
+  }
+  clear() {
+    this.events = [];
+  }
+}
+export {
+  MemoryAuditLog
+};

package/dist/esm/adapters/memory/clock.js

@@ -0,0 +1,5 @@
+// src/adapters/memory/clock.ts
+var realClock = () => Date.now();
+export {
+  realClock
+};

package/dist/esm/adapters/memory/config-store.js

@@ -0,0 +1,31 @@
+// src/adapters/memory/config-store.ts
+import { err, ok } from "../../types/result";
+import { authError } from "../../types/error";
+
+class MemoryConfigStore {
+  #tenants = new Map;
+  #listeners = new Set;
+  constructor(opts = {}) {
+    for (const t of opts.seed ?? [])
+      this.#tenants.set(t.id, t);
+  }
+  async getTenantConfig(id) {
+    const t = this.#tenants.get(id);
+    if (!t) {
+      return err(authError.tenantNotFound(`tenant "${id}" not found`, id));
+    }
+    return ok(t);
+  }
+  async putTenantConfig(config) {
+    this.#tenants.set(config.id, config);
+    for (const fn of this.#listeners)
+      fn(config.id);
+    return ok(undefined);
+  }
+  onInvalidate(handler) {
+    this.#listeners.add(handler);
+  }
+}
+export {
+  MemoryConfigStore
+};

package/dist/esm/adapters/memory/index.js

@@ -0,0 +1,10 @@
+export {
+  realClock,
+  MemoryTokenStore,
+  MemorySessionStore,
+  MemoryPasskeyCredentialStore,
+  MemoryMethodStore,
+  MemoryKeyStore,
+  MemoryConfigStore,
+  MemoryAuditLog
+};

package/dist/esm/adapters/memory/key-store.js

@@ -0,0 +1,78 @@
+// src/adapters/memory/key-store.ts
+import { exportJWK, generateKeyPair } from "jose";
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+import { generateSymmetricKey, randomId } from "../../domain/crypto";
+import { realClock } from "./clock";
+
+class MemoryKeyStore {
+  #clock;
+  #signingAlg;
+  #signing = [];
+  #encryption = [];
+  constructor(opts = {}) {
+    this.#clock = opts.clock ?? realClock;
+    this.#signingAlg = opts.signingAlg ?? "ES256";
+  }
+  async currentSigningKey() {
+    await this.#ensureSigningKey();
+    const active = this.#signing.find((k) => k.status === "active");
+    if (!active) {
+      return err(authError.internalError("no active signing key (should be unreachable)"));
+    }
+    return ok(active);
+  }
+  async signingKeys() {
+    await this.#ensureSigningKey();
+    return ok([...this.#signing]);
+  }
+  async currentEncryptionKey() {
+    this.#ensureEncryptionKey();
+    const active = this.#encryption.find((k) => k.status === "active");
+    if (!active) {
+      return err(authError.internalError("no active encryption key (should be unreachable)"));
+    }
+    return ok(active);
+  }
+  async getEncryptionKey(kid) {
+    this.#ensureEncryptionKey();
+    const match = this.#encryption.find((k) => k.kid === kid);
+    if (!match) {
+      return err(authError.internalError(`encryption key "${kid}" not found`));
+    }
+    return ok(match);
+  }
+  async#ensureSigningKey() {
+    if (this.#signing.some((k) => k.status === "active"))
+      return;
+    const { publicKey, privateKey } = await generateKeyPair(this.#signingAlg, {
+      extractable: true
+    });
+    const jwk = await exportJWK(publicKey);
+    const key = {
+      kid: randomId(),
+      alg: this.#signingAlg,
+      crv: jwk.crv ?? undefined,
+      publicJwk: jwk,
+      privateKeyRef: privateKey,
+      status: "active",
+      createdAt: this.#clock()
+    };
+    this.#signing.push(key);
+  }
+  #ensureEncryptionKey() {
+    if (this.#encryption.some((k) => k.status === "active"))
+      return;
+    const key = {
+      kid: randomId(),
+      alg: "A256GCM",
+      keyRef: generateSymmetricKey(),
+      status: "active",
+      createdAt: this.#clock()
+    };
+    this.#encryption.push(key);
+  }
+}
+export {
+  MemoryKeyStore
+};

package/dist/esm/adapters/memory/method-store.js

@@ -0,0 +1,43 @@
+// src/adapters/memory/method-store.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+
+class MemoryMethodStore {
+  #byTenant = new Map;
+  constructor(opts = {}) {
+    for (const seed of opts.seed ?? []) {
+      const inner = new Map;
+      for (const m of seed.methods)
+        inner.set(m.id, m);
+      this.#byTenant.set(seed.tenantId, inner);
+    }
+  }
+  async listMethods(tenantId) {
+    const inner = this.#byTenant.get(tenantId);
+    return ok(inner ? Array.from(inner.values()) : []);
+  }
+  async getMethodConfig(tenantId, methodId) {
+    const inner = this.#byTenant.get(tenantId);
+    const m = inner?.get(methodId);
+    if (!m) {
+      return err(authError.methodNotFound(`method "${methodId}" not found for tenant "${tenantId}"`, { methodId }));
+    }
+    return ok(m);
+  }
+  async putMethodConfig(tenantId, method) {
+    let inner = this.#byTenant.get(tenantId);
+    if (!inner) {
+      inner = new Map;
+      this.#byTenant.set(tenantId, inner);
+    }
+    inner.set(method.id, method);
+    return ok(undefined);
+  }
+  async deleteMethodConfig(tenantId, methodId) {
+    this.#byTenant.get(tenantId)?.delete(methodId);
+    return ok(undefined);
+  }
+}
+export {
+  MemoryMethodStore
+};

package/dist/esm/adapters/memory/passkey-credential-store.js

@@ -0,0 +1,53 @@
+// src/adapters/memory/passkey-credential-store.ts
+class MemoryPasskeyCredentialStore {
+  #items = new Map;
+  constructor(opts = {}) {
+    for (const entry of opts.seed ?? []) {
+      this.#items.set(this.#key(entry.tenantId, entry.credential.credentialId), {
+        ...entry.credential,
+        tenantId: entry.tenantId
+      });
+    }
+  }
+  #key(tenantId, credentialId) {
+    return `${tenantId}|${credentialId}`;
+  }
+  async findByUsername(username, tenantId) {
+    const credentials = [];
+    for (const item of this.#items.values()) {
+      if (item.tenantId !== tenantId)
+        continue;
+      if (item.userId !== username)
+        continue;
+      credentials.push(stripTenant(item));
+    }
+    if (credentials.length === 0)
+      return null;
+    return { userId: username, credentials };
+  }
+  async findById(credentialId, tenantId) {
+    const item = this.#items.get(this.#key(tenantId, credentialId));
+    return item ? stripTenant(item) : null;
+  }
+  async updateCounter(input) {
+    const k = this.#key(input.tenantId, input.credentialId);
+    const item = this.#items.get(k);
+    if (!item)
+      return;
+    this.#items.set(k, { ...item, counter: input.counter });
+  }
+  async create(input) {
+    this.#items.set(this.#key(input.tenantId, input.credential.credentialId), {
+      ...input.credential,
+      userId: input.userId,
+      tenantId: input.tenantId
+    });
+  }
+}
+function stripTenant(item) {
+  const { tenantId: _unused, ...rest } = item;
+  return rest;
+}
+export {
+  MemoryPasskeyCredentialStore
+};

package/dist/esm/adapters/memory/session-store.js

@@ -0,0 +1,104 @@
+// src/adapters/memory/session-store.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+import { realClock } from "./clock";
+
+class MemorySessionStore {
+  #clock;
+  #flows = new Map;
+  #sessions = new Map;
+  #par = new Map;
+  constructor(opts = {}) {
+    this.#clock = opts.clock ?? realClock;
+  }
+  async saveFlow(flowId, payload, ttl) {
+    if (ttl <= 0) {
+      return err(authError.internalError(`saveFlow: ttl must be positive, got ${ttl}`));
+    }
+    this.#flows.set(flowId, {
+      record: payload,
+      expiresAt: this.#clock() + ttl
+    });
+    return ok(undefined);
+  }
+  async updateFlowMethodState(flowId, methodState) {
+    const stored = this.#flows.get(flowId);
+    if (!stored) {
+      return err(authError.unknownState(`flow "${flowId}" unknown`));
+    }
+    if (this.#clock() >= stored.expiresAt) {
+      this.#flows.delete(flowId);
+      return err(authError.unknownState(`flow "${flowId}" expired`));
+    }
+    stored.record = { ...stored.record, methodState };
+    return ok(undefined);
+  }
+  async readFlow(flowId) {
+    const stored = this.#flows.get(flowId);
+    if (!stored) {
+      return err(authError.unknownState(`flow "${flowId}" unknown`));
+    }
+    if (this.#clock() >= stored.expiresAt) {
+      this.#flows.delete(flowId);
+      return err(authError.unknownState(`flow "${flowId}" expired`));
+    }
+    return ok(stored.record);
+  }
+  async consumeFlow(flowId) {
+    const stored = this.#flows.get(flowId);
+    if (!stored) {
+      return err(authError.unknownState(`flow "${flowId}" unknown or already consumed`));
+    }
+    this.#flows.delete(flowId);
+    if (this.#clock() >= stored.expiresAt) {
+      return err(authError.unknownState(`flow "${flowId}" expired`));
+    }
+    return ok(stored.record);
+  }
+  async createSession(sessionId, payload, ttl) {
+    if (ttl <= 0) {
+      return err(authError.internalError(`createSession: ttl must be positive, got ${ttl}`));
+    }
+    this.#sessions.set(sessionId, payload);
+    return ok(undefined);
+  }
+  async readSession(sessionId) {
+    const s = this.#sessions.get(sessionId);
+    if (!s) {
+      return err(authError.invalidRequest(`session "${sessionId}" unknown`));
+    }
+    if (this.#clock() >= s.expiresAt) {
+      this.#sessions.delete(sessionId);
+      return err(authError.invalidRequest(`session "${sessionId}" expired`));
+    }
+    return ok(s);
+  }
+  async revokeSession(sessionId) {
+    this.#sessions.delete(sessionId);
+    return ok(undefined);
+  }
+  async savePar(requestUri, payload, ttl) {
+    if (ttl <= 0) {
+      return err(authError.internalError(`savePar: ttl must be positive, got ${ttl}`));
+    }
+    this.#par.set(requestUri, {
+      record: payload,
+      expiresAt: this.#clock() + ttl
+    });
+    return ok(undefined);
+  }
+  async consumePar(requestUri) {
+    const stored = this.#par.get(requestUri);
+    if (!stored) {
+      return err(authError.unknownState(`par "${requestUri}" unknown or already consumed`));
+    }
+    this.#par.delete(requestUri);
+    if (this.#clock() >= stored.expiresAt) {
+      return err(authError.unknownState(`par "${requestUri}" expired`));
+    }
+    return ok(stored.record);
+  }
+}
+export {
+  MemorySessionStore
+};

package/dist/esm/adapters/memory/token-store.js

@@ -0,0 +1,104 @@
+// src/adapters/memory/token-store.ts
+import { AUTH_CODE_TTL_MS } from "../../domain/authorize";
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+import { realClock } from "./clock";
+
+class MemoryTokenStore {
+  #clock;
+  #codes = new Map;
+  #refresh = new Map;
+  #dpopJtis = new Map;
+  constructor(opts = {}) {
+    this.#clock = opts.clock ?? realClock;
+  }
+  async saveCode(code, ciphertext, ttl) {
+    if (ttl <= 0 || ttl > AUTH_CODE_TTL_MS) {
+      return err(authError.internalError(`saveCode: ttl ${ttl} outside (0, ${AUTH_CODE_TTL_MS}] (auth-code TTL is fixed at 60s by OAuth 2.1 BCP)`));
+    }
+    this.#codes.set(code, { ciphertext, expiresAt: this.#clock() + ttl });
+    return ok(undefined);
+  }
+  async consumeCode(code) {
+    const stored = this.#codes.get(code);
+    if (!stored) {
+      return err(authError.invalidGrant("auth code unknown or already consumed"));
+    }
+    this.#codes.delete(code);
+    if (this.#clock() >= stored.expiresAt) {
+      return err(authError.invalidGrant("auth code expired"));
+    }
+    return ok(stored.ciphertext);
+  }
+  async saveRefresh(refresh, payload) {
+    this.#refresh.set(refresh, { payload });
+    return ok(undefined);
+  }
+  async consumeRefresh(refresh, options = {}) {
+    const reuseWindow = options.reuseWindowMs ?? 60000;
+    const now = this.#clock();
+    const stored = this.#refresh.get(refresh);
+    if (!stored) {
+      return err(authError.invalidGrant("refresh token unknown"));
+    }
+    if (stored.consumedAt !== undefined) {
+      const withinWindow = now - stored.consumedAt <= reuseWindow;
+      if (withinWindow) {
+        const family = stored.payload.family;
+        await this.revokeFamily(family);
+        return err(authError.invalidGrant(`refresh token reuse detected (family=${family})`, {
+          family,
+          tenantId: stored.payload.tenantId,
+          subjectId: stored.payload.subjectId
+        }));
+      }
+      return err(authError.invalidGrant("refresh token already consumed"));
+    }
+    if (now >= stored.payload.expiresAt) {
+      return err(authError.invalidGrant("refresh token expired"));
+    }
+    stored.consumedAt = now;
+    return ok(stored.payload);
+  }
+  async peekRefresh(refresh) {
+    const stored = this.#refresh.get(refresh);
+    if (!stored) {
+      return err(authError.invalidGrant("refresh token unknown"));
+    }
+    if (this.#clock() >= stored.payload.expiresAt) {
+      return err(authError.invalidGrant("refresh token expired"));
+    }
+    return ok(stored.payload);
+  }
+  async revokeFamily(family) {
+    for (const [token, stored] of this.#refresh) {
+      if (stored.payload.family === family) {
+        this.#refresh.delete(token);
+      }
+    }
+    return ok(undefined);
+  }
+  async revokeBySubject(tenantId, subjectId) {
+    for (const [token, stored] of this.#refresh) {
+      if (stored.payload.tenantId === tenantId && stored.payload.subjectId === subjectId) {
+        this.#refresh.delete(token);
+      }
+    }
+    return ok(undefined);
+  }
+  async recordDpopJti(jti, ttlMs) {
+    const now = this.#clock();
+    for (const [k, exp] of this.#dpopJtis) {
+      if (exp <= now)
+        this.#dpopJtis.delete(k);
+    }
+    if (this.#dpopJtis.has(jti)) {
+      return err(authError.invalidGrant(`dpop jti "${jti}" replayed`));
+    }
+    this.#dpopJtis.set(jti, now + ttlMs);
+    return ok(undefined);
+  }
+}
+export {
+  MemoryTokenStore
+};

package/dist/esm/adapters/postgres/audit-log.js

@@ -0,0 +1,16 @@
+// src/adapters/postgres/audit-log.ts
+class PostgresAuditLog {
+  #exec;
+  constructor(opts) {
+    this.#exec = opts.exec;
+  }
+  async log(event) {
+    try {
+      await this.#exec.query(`INSERT INTO openauth_audit_events (ts, kind, payload)
+         VALUES ($1, $2, $3::jsonb)`, [event.timestamp, event.kind, JSON.stringify(event)]);
+    } catch {}
+  }
+}
+export {
+  PostgresAuditLog
+};

package/dist/esm/adapters/postgres/config-store.js

@@ -0,0 +1,48 @@
+// src/adapters/postgres/config-store.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+
+class PostgresConfigStore {
+  #exec;
+  #clock;
+  #listeners = new Set;
+  constructor(opts) {
+    this.#exec = opts.exec;
+    this.#clock = opts.clock ?? (() => Date.now());
+  }
+  async getTenantConfig(id) {
+    let row;
+    try {
+      const result = await this.#exec.query(`SELECT config FROM openauth_tenants WHERE id = $1`, [id]);
+      row = result.rows[0];
+    } catch (e) {
+      return err(authError.internalError("getTenantConfig: query failed", e));
+    }
+    if (!row) {
+      return err(authError.tenantNotFound(`tenant "${id}" not found`, id));
+    }
+    const config = typeof row.config === "string" ? JSON.parse(row.config) : row.config;
+    return ok(config);
+  }
+  async putTenantConfig(config) {
+    try {
+      await this.#exec.query(`INSERT INTO openauth_tenants (id, config, updated_at)
+         VALUES ($1, $2::jsonb, $3)
+         ON CONFLICT (id) DO UPDATE SET config = EXCLUDED.config, updated_at = EXCLUDED.updated_at`, [config.id, JSON.stringify(config), this.#clock()]);
+    } catch (e) {
+      return err(authError.internalError("putTenantConfig: insert failed", e));
+    }
+    for (const fn of this.#listeners) {
+      try {
+        fn(config.id);
+      } catch {}
+    }
+    return ok(undefined);
+  }
+  onInvalidate(handler) {
+    this.#listeners.add(handler);
+  }
+}
+export {
+  PostgresConfigStore
+};

package/dist/esm/adapters/postgres/executor.js

@@ -0,0 +1,21 @@
+// src/adapters/postgres/executor.ts
+function fromPostgresJs(sql) {
+  return {
+    async query(text, params = []) {
+      const result = await sql.unsafe(text, params);
+      return { rows: Array.from(result) };
+    }
+  };
+}
+function fromPGlite(db) {
+  return {
+    async query(text, params = []) {
+      const result = await db.query(text, params);
+      return { rows: result.rows };
+    }
+  };
+}
+export {
+  fromPostgresJs,
+  fromPGlite
+};

package/dist/esm/adapters/postgres/index.js

@@ -0,0 +1,13 @@
+export {
+  migrate,
+  fromPostgresJs,
+  fromPGlite,
+  PostgresTokenStore,
+  PostgresSessionStore,
+  PostgresPasskeyCredentialStore,
+  PostgresMethodStore,
+  PostgresKeyStore,
+  PostgresConfigStore,
+  PostgresAuditLog,
+  INITIAL_SCHEMA_SQL
+};