@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/esm/adapters/postgres/key-store.js

@@ -0,0 +1,191 @@
+// src/adapters/postgres/key-store.ts
+import { exportJWK, generateKeyPair, importJWK } from "jose";
+import {
+  base64url,
+  generateSymmetricKey,
+  randomId,
+  utf8
+} from "../../domain/crypto";
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+
+class PostgresKeyStore {
+  #exec;
+  #clock;
+  #signingAlg;
+  #wrapper;
+  #privateKeyCache = new Map;
+  constructor(opts) {
+    this.#exec = opts.exec;
+    this.#clock = opts.clock ?? (() => Date.now());
+    this.#signingAlg = opts.signingAlg ?? "ES256";
+    this.#wrapper = opts.wrapper;
+  }
+  async currentSigningKey() {
+    await this.#ensureSigningKey();
+    const rows = await this.#selectSigningRows(`status = 'active'`);
+    if (rows.length === 0) {
+      return err(authError.internalError("no active signing key (should be unreachable)"));
+    }
+    const key = await this.#hydrateSigningKey(rows[0]);
+    return ok(key);
+  }
+  async signingKeys() {
+    await this.#ensureSigningKey();
+    const rows = await this.#selectSigningRows(`status IN ('active','next','retired')`);
+    const keys = await Promise.all(rows.map((r) => this.#hydrateSigningKey(r)));
+    return ok(keys);
+  }
+  async currentEncryptionKey() {
+    await this.#ensureEncryptionKey();
+    const rows = await this.#selectEncryptionRows(`status = 'active'`);
+    if (rows.length === 0) {
+      return err(authError.internalError("no active encryption key (should be unreachable)"));
+    }
+    return ok(await this.#hydrateEncryptionKey(rows[0]));
+  }
+  async getEncryptionKey(kid) {
+    let row;
+    try {
+      const result = await this.#exec.query(`SELECT kid, alg, key_material, key_material_wrapped, status, created_at, rotated_at
+           FROM openauth_encryption_keys WHERE kid = $1`, [kid]);
+      row = result.rows[0];
+    } catch (e) {
+      return err(authError.internalError("getEncryptionKey: query failed", e));
+    }
+    if (!row) {
+      return err(authError.internalError(`encryption key "${kid}" not found`));
+    }
+    return ok(await this.#hydrateEncryptionKey(row));
+  }
+  async#ensureSigningKey() {
+    const rows = await this.#selectSigningRows(`status = 'active'`);
+    if (rows.length > 0)
+      return;
+    const { publicKey, privateKey } = await generateKeyPair(this.#signingAlg, {
+      extractable: true
+    });
+    const publicJwk = await exportJWK(publicKey);
+    const privateJwk = await exportJWK(privateKey);
+    const kid = randomId();
+    const { jsonPayload, wrapped } = await this.#encodePrivateJwk(privateJwk);
+    await this.#exec.query(`INSERT INTO openauth_signing_keys
+         (kid, alg, crv, public_jwk, private_jwk, private_jwk_wrapped, status, created_at)
+       VALUES ($1, $2, $3, $4::jsonb, $5::jsonb, $6, 'active', $7)
+       ON CONFLICT (kid) DO NOTHING`, [
+      kid,
+      this.#signingAlg,
+      publicJwk.crv ?? null,
+      JSON.stringify(publicJwk),
+      jsonPayload,
+      wrapped,
+      this.#clock()
+    ]);
+  }
+  async#ensureEncryptionKey() {
+    const rows = await this.#selectEncryptionRows(`status = 'active'`);
+    if (rows.length > 0)
+      return;
+    const kid = randomId();
+    const raw = generateSymmetricKey();
+    const stored = this.#wrapper ? await this.#wrapper.wrap(raw) : raw;
+    await this.#exec.query(`INSERT INTO openauth_encryption_keys
+         (kid, alg, key_material, key_material_wrapped, status, created_at)
+       VALUES ($1, $2, $3, $4, 'active', $5)
+       ON CONFLICT (kid) DO NOTHING`, [kid, "A256GCM", stored, this.#wrapper !== undefined, this.#clock()]);
+  }
+  async#encodePrivateJwk(jwk) {
+    if (!this.#wrapper) {
+      return { jsonPayload: JSON.stringify(jwk), wrapped: false };
+    }
+    const ciphertext = await this.#wrapper.wrap(utf8.encode(JSON.stringify(jwk)));
+    return {
+      jsonPayload: JSON.stringify({ ct: base64url.encode(ciphertext) }),
+      wrapped: true
+    };
+  }
+  async#decodePrivateJwk(raw, wrapped) {
+    const parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
+    if (!wrapped)
+      return parsed;
+    if (!this.#wrapper) {
+      throw new Error("PostgresKeyStore: signing key row is wrapped but no `wrapper` was supplied — refusing to read");
+    }
+    const ct = typeof parsed.ct === "string" ? parsed.ct : "";
+    if (!ct) {
+      throw new Error("PostgresKeyStore: wrapped signing key row missing `ct`");
+    }
+    const plaintext = await this.#wrapper.unwrap(base64url.decode(ct));
+    return JSON.parse(utf8.decode(plaintext));
+  }
+  async#selectSigningRows(where) {
+    const result = await this.#exec.query(`SELECT kid, alg, crv, public_jwk, private_jwk, private_jwk_wrapped,
+              status, created_at, rotated_at
+         FROM openauth_signing_keys WHERE ${where}`);
+    return result.rows;
+  }
+  async#selectEncryptionRows(where) {
+    const result = await this.#exec.query(`SELECT kid, alg, key_material, key_material_wrapped, status, created_at, rotated_at
+         FROM openauth_encryption_keys WHERE ${where}`);
+    return result.rows;
+  }
+  async#hydrateSigningKey(row) {
+    let imported = this.#privateKeyCache.get(row.kid);
+    if (!imported) {
+      const privateJwk = await this.#decodePrivateJwk(row.private_jwk, row.private_jwk_wrapped === true);
+      imported = await importJWK(privateJwk, row.alg);
+      this.#privateKeyCache.set(row.kid, imported);
+    }
+    const publicJwk = typeof row.public_jwk === "string" ? JSON.parse(row.public_jwk) : row.public_jwk;
+    return {
+      kid: row.kid,
+      alg: row.alg,
+      ...row.crv ? { crv: row.crv } : {},
+      publicJwk,
+      privateKeyRef: imported,
+      status: row.status,
+      createdAt: Number(row.created_at),
+      ...row.rotated_at !== null && row.rotated_at !== undefined ? { rotatedAt: Number(row.rotated_at) } : {}
+    };
+  }
+  async#hydrateEncryptionKey(row) {
+    const stored = ensureBytes(row.key_material);
+    let keyRef = stored;
+    if (row.key_material_wrapped === true) {
+      if (!this.#wrapper) {
+        throw new Error("PostgresKeyStore: encryption key row is wrapped but no `wrapper` was supplied — refusing to read");
+      }
+      keyRef = await this.#wrapper.unwrap(stored);
+    }
+    return {
+      kid: row.kid,
+      alg: row.alg,
+      keyRef,
+      status: row.status,
+      createdAt: Number(row.created_at),
+      ...row.rotated_at !== null && row.rotated_at !== undefined ? { rotatedAt: Number(row.rotated_at) } : {}
+    };
+  }
+}
+function ensureBytes(value) {
+  if (value instanceof Uint8Array)
+    return value;
+  if (typeof value === "string") {
+    if (/^\\x[0-9a-fA-F]+$/.test(value)) {
+      const hex = value.slice(2);
+      const out = new Uint8Array(hex.length / 2);
+      for (let i = 0;i < out.length; i++) {
+        out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+      }
+      return out;
+    }
+    return new TextEncoder().encode(value);
+  }
+  if (value && typeof value === "object" && "data" in value) {
+    return new Uint8Array(value.data);
+  }
+  throw new Error("PostgresKeyStore: unsupported bytea representation");
+}
+export {
+  PostgresKeyStore
+};

package/dist/esm/adapters/postgres/method-store.js

@@ -0,0 +1,61 @@
+// src/adapters/postgres/method-store.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+
+class PostgresMethodStore {
+  #exec;
+  #clock;
+  constructor(opts) {
+    this.#exec = opts.exec;
+    this.#clock = opts.clock ?? (() => Date.now());
+  }
+  async listMethods(tenantId) {
+    try {
+      const result = await this.#exec.query(`SELECT config FROM openauth_methods WHERE tenant_id = $1 ORDER BY method_id`, [tenantId]);
+      const methods = result.rows.map((r) => parseConfig(r.config));
+      return ok(methods);
+    } catch (e) {
+      return err(authError.internalError("listMethods: query failed", e));
+    }
+  }
+  async getMethodConfig(tenantId, methodId) {
+    let row;
+    try {
+      const result = await this.#exec.query(`SELECT config FROM openauth_methods WHERE tenant_id = $1 AND method_id = $2`, [tenantId, methodId]);
+      row = result.rows[0];
+    } catch (e) {
+      return err(authError.internalError("getMethodConfig: query failed", e));
+    }
+    if (!row) {
+      return err(authError.methodNotFound(`method "${methodId}" not found for tenant "${tenantId}"`, { methodId }));
+    }
+    return ok(parseConfig(row.config));
+  }
+  async putMethodConfig(tenantId, method) {
+    try {
+      await this.#exec.query(`INSERT INTO openauth_methods (tenant_id, method_id, config, updated_at)
+         VALUES ($1, $2, $3::jsonb, $4)
+         ON CONFLICT (tenant_id, method_id) DO UPDATE
+           SET config = EXCLUDED.config, updated_at = EXCLUDED.updated_at`, [tenantId, method.id, JSON.stringify(method), this.#clock()]);
+    } catch (e) {
+      return err(authError.internalError("putMethodConfig: insert failed", e));
+    }
+    return ok(undefined);
+  }
+  async deleteMethodConfig(tenantId, methodId) {
+    try {
+      await this.#exec.query(`DELETE FROM openauth_methods WHERE tenant_id = $1 AND method_id = $2`, [tenantId, methodId]);
+    } catch (e) {
+      return err(authError.internalError("deleteMethodConfig: delete failed", e));
+    }
+    return ok(undefined);
+  }
+}
+function parseConfig(raw) {
+  if (typeof raw === "string")
+    return JSON.parse(raw);
+  return raw;
+}
+export {
+  PostgresMethodStore
+};

package/dist/esm/adapters/postgres/migrations.js

@@ -0,0 +1,111 @@
+// src/adapters/postgres/migrations.ts
+var INITIAL_SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS openauth_tenants (
+  id text PRIMARY KEY,
+  config jsonb NOT NULL,
+  updated_at bigint NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS openauth_methods (
+  tenant_id text NOT NULL,
+  method_id text NOT NULL,
+  config jsonb NOT NULL,
+  updated_at bigint NOT NULL,
+  PRIMARY KEY (tenant_id, method_id)
+);
+
+CREATE TABLE IF NOT EXISTS openauth_signing_keys (
+  kid text PRIMARY KEY,
+  alg text NOT NULL,
+  crv text,
+  public_jwk jsonb NOT NULL,
+  private_jwk jsonb NOT NULL,
+  private_jwk_wrapped boolean NOT NULL DEFAULT false,
+  status text NOT NULL,
+  created_at bigint NOT NULL,
+  rotated_at bigint
+);
+
+ALTER TABLE openauth_signing_keys
+  ADD COLUMN IF NOT EXISTS private_jwk_wrapped boolean NOT NULL DEFAULT false;
+
+CREATE TABLE IF NOT EXISTS openauth_encryption_keys (
+  kid text PRIMARY KEY,
+  alg text NOT NULL,
+  key_material bytea NOT NULL,
+  key_material_wrapped boolean NOT NULL DEFAULT false,
+  status text NOT NULL,
+  created_at bigint NOT NULL,
+  rotated_at bigint
+);
+
+ALTER TABLE openauth_encryption_keys
+  ADD COLUMN IF NOT EXISTS key_material_wrapped boolean NOT NULL DEFAULT false;
+
+CREATE TABLE IF NOT EXISTS openauth_codes (
+  code text PRIMARY KEY,
+  ciphertext text NOT NULL,
+  expires_at bigint NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS openauth_refresh_tokens (
+  token text PRIMARY KEY,
+  tenant_id text NOT NULL,
+  client_id text NOT NULL,
+  subject_id text NOT NULL,
+  family text NOT NULL,
+  expires_at bigint NOT NULL,
+  consumed_at bigint,
+  payload jsonb NOT NULL
+);
+CREATE INDEX IF NOT EXISTS openauth_refresh_family_idx
+  ON openauth_refresh_tokens (family);
+CREATE INDEX IF NOT EXISTS openauth_refresh_subject_idx
+  ON openauth_refresh_tokens (tenant_id, subject_id);
+
+CREATE TABLE IF NOT EXISTS openauth_flows (
+  flow_id text PRIMARY KEY,
+  payload jsonb NOT NULL,
+  expires_at bigint NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS openauth_sessions (
+  session_id text PRIMARY KEY,
+  payload jsonb NOT NULL,
+  expires_at bigint NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS openauth_audit_events (
+  id bigserial PRIMARY KEY,
+  ts bigint NOT NULL,
+  kind text NOT NULL,
+  payload jsonb NOT NULL
+);
+CREATE INDEX IF NOT EXISTS openauth_audit_kind_idx
+  ON openauth_audit_events (kind);
+CREATE INDEX IF NOT EXISTS openauth_audit_ts_idx
+  ON openauth_audit_events (ts);
+
+CREATE TABLE IF NOT EXISTS openauth_passkey_credentials (
+  tenant_id text NOT NULL,
+  credential_id text NOT NULL,
+  user_id text NOT NULL,
+  public_key text NOT NULL,
+  counter bigint NOT NULL DEFAULT 0,
+  transports jsonb,
+  created_at bigint NOT NULL,
+  PRIMARY KEY (tenant_id, credential_id)
+);
+CREATE INDEX IF NOT EXISTS openauth_passkey_user_idx
+  ON openauth_passkey_credentials (tenant_id, user_id);
+`;
+async function migrate(exec) {
+  const statements = INITIAL_SCHEMA_SQL.split(/;\s*\n/).filter((s) => s.trim().length > 0);
+  for (const stmt of statements) {
+    await exec.query(stmt + ";");
+  }
+}
+export {
+  migrate,
+  INITIAL_SCHEMA_SQL
+};

package/dist/esm/adapters/postgres/passkey-credential-store.js

@@ -0,0 +1,80 @@
+// src/adapters/postgres/passkey-credential-store.ts
+class PostgresPasskeyCredentialStore {
+  #exec;
+  #clock;
+  constructor(opts) {
+    this.#exec = opts.exec;
+    this.#clock = opts.clock ?? (() => Date.now());
+  }
+  async findByUsername(username, tenantId) {
+    const result = await this.#exec.query(`SELECT credential_id, user_id, public_key, counter, transports
+         FROM openauth_passkey_credentials
+        WHERE tenant_id = $1 AND user_id = $2`, [tenantId, username]);
+    if (result.rows.length === 0)
+      return null;
+    return {
+      userId: username,
+      credentials: result.rows.map(rowToCredential)
+    };
+  }
+  async findById(credentialId, tenantId) {
+    const result = await this.#exec.query(`SELECT credential_id, user_id, public_key, counter, transports
+         FROM openauth_passkey_credentials
+        WHERE tenant_id = $1 AND credential_id = $2`, [tenantId, credentialId]);
+    const row = result.rows[0];
+    if (!row)
+      return null;
+    return rowToCredential(row);
+  }
+  async updateCounter(input) {
+    await this.#exec.query(`UPDATE openauth_passkey_credentials
+          SET counter = $1
+        WHERE tenant_id = $2 AND credential_id = $3`, [input.counter, input.tenantId, input.credentialId]);
+  }
+  async create(input) {
+    await this.#exec.query(`INSERT INTO openauth_passkey_credentials
+         (tenant_id, credential_id, user_id, public_key, counter, transports, created_at)
+       VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7)
+       ON CONFLICT (tenant_id, credential_id) DO UPDATE
+         SET public_key = EXCLUDED.public_key,
+             counter = EXCLUDED.counter,
+             transports = EXCLUDED.transports,
+             user_id = EXCLUDED.user_id`, [
+      input.tenantId,
+      input.credential.credentialId,
+      input.userId,
+      input.credential.publicKey,
+      input.credential.counter,
+      input.credential.transports ? JSON.stringify(input.credential.transports) : null,
+      this.#clock()
+    ]);
+  }
+}
+function rowToCredential(row) {
+  const credential = {
+    credentialId: row.credential_id,
+    publicKey: row.public_key,
+    counter: Number(row.counter),
+    userId: row.user_id
+  };
+  if (row.transports != null) {
+    credential.transports = parseTransports(row.transports);
+  }
+  return credential;
+}
+function parseTransports(raw) {
+  if (Array.isArray(raw))
+    return raw.map(String);
+  if (typeof raw === "string") {
+    try {
+      const parsed = JSON.parse(raw);
+      return Array.isArray(parsed) ? parsed.map(String) : [];
+    } catch {
+      return [];
+    }
+  }
+  return [];
+}
+export {
+  PostgresPasskeyCredentialStore
+};

package/dist/esm/adapters/postgres/session-store.js

@@ -0,0 +1,135 @@
+// src/adapters/postgres/session-store.ts
+import { authError } from "../../types/error";
+import { err, ok } from "../../types/result";
+
+class PostgresSessionStore {
+  #exec;
+  #clock;
+  constructor(opts) {
+    this.#exec = opts.exec;
+    this.#clock = opts.clock ?? (() => Date.now());
+  }
+  async saveFlow(flowId, payload, ttl) {
+    if (ttl <= 0) {
+      return err(authError.internalError(`saveFlow: ttl must be positive, got ${ttl}`));
+    }
+    const expiresAt = this.#clock() + ttl;
+    try {
+      await this.#exec.query(`INSERT INTO openauth_flows (flow_id, payload, expires_at)
+         VALUES ($1, $2::jsonb, $3)`, [flowId, JSON.stringify(payload), expiresAt]);
+    } catch (e) {
+      return err(authError.internalError("saveFlow: insert failed", e));
+    }
+    return ok(undefined);
+  }
+  async updateFlowMethodState(flowId, methodState) {
+    const now = this.#clock();
+    let row;
+    try {
+      const result = await this.#exec.query(`UPDATE openauth_flows
+            SET payload = jsonb_set(payload, '{methodState}', $1::jsonb, true)
+          WHERE flow_id = $2 AND expires_at > $3
+          RETURNING true AS exists`, [JSON.stringify(methodState), flowId, now]);
+      row = result.rows[0];
+    } catch (e) {
+      return err(authError.internalError("updateFlowMethodState: update failed", e));
+    }
+    if (!row) {
+      return err(authError.unknownState(`flow "${flowId}" unknown or expired`));
+    }
+    return ok(undefined);
+  }
+  async readFlow(flowId) {
+    let row;
+    try {
+      const result = await this.#exec.query(`SELECT payload, expires_at FROM openauth_flows WHERE flow_id = $1`, [
+        flowId
+      ]);
+      row = result.rows[0];
+    } catch (e) {
+      return err(authError.internalError("readFlow: query failed", e));
+    }
+    if (!row) {
+      return err(authError.unknownState(`flow "${flowId}" unknown`));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      try {
+        await this.#exec.query(`DELETE FROM openauth_flows WHERE flow_id = $1`, [flowId]);
+      } catch {}
+      return err(authError.unknownState(`flow "${flowId}" expired`));
+    }
+    return ok(parseFlowRecord(row.payload));
+  }
+  async consumeFlow(flowId) {
+    let row;
+    try {
+      const result = await this.#exec.query(`DELETE FROM openauth_flows
+          WHERE flow_id = $1
+          RETURNING payload, expires_at`, [flowId]);
+      row = result.rows[0];
+    } catch (e) {
+      return err(authError.internalError("consumeFlow: query failed", e));
+    }
+    if (!row) {
+      return err(authError.unknownState(`flow "${flowId}" unknown or already consumed`));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      return err(authError.unknownState(`flow "${flowId}" expired`));
+    }
+    return ok(parseFlowRecord(row.payload));
+  }
+  async createSession(sessionId, payload, ttl) {
+    if (ttl <= 0) {
+      return err(authError.internalError(`createSession: ttl must be positive, got ${ttl}`));
+    }
+    const expiresAt = this.#clock() + ttl;
+    try {
+      await this.#exec.query(`INSERT INTO openauth_sessions (session_id, payload, expires_at)
+         VALUES ($1, $2::jsonb, $3)
+         ON CONFLICT (session_id) DO UPDATE SET payload = EXCLUDED.payload, expires_at = EXCLUDED.expires_at`, [sessionId, JSON.stringify(payload), expiresAt]);
+    } catch (e) {
+      return err(authError.internalError("createSession: insert failed", e));
+    }
+    return ok(undefined);
+  }
+  async readSession(sessionId) {
+    let row;
+    try {
+      const result = await this.#exec.query(`SELECT payload, expires_at FROM openauth_sessions WHERE session_id = $1`, [sessionId]);
+      row = result.rows[0];
+    } catch (e) {
+      return err(authError.internalError("readSession: query failed", e));
+    }
+    if (!row) {
+      return err(authError.invalidRequest(`session "${sessionId}" unknown`));
+    }
+    if (this.#clock() >= Number(row.expires_at)) {
+      try {
+        await this.#exec.query(`DELETE FROM openauth_sessions WHERE session_id = $1`, [sessionId]);
+      } catch {}
+      return err(authError.invalidRequest(`session "${sessionId}" expired`));
+    }
+    return ok(parseSession(row.payload));
+  }
+  async revokeSession(sessionId) {
+    try {
+      await this.#exec.query(`DELETE FROM openauth_sessions WHERE session_id = $1`, [sessionId]);
+    } catch (e) {
+      return err(authError.internalError("revokeSession: delete failed", e));
+    }
+    return ok(undefined);
+  }
+}
+function parseFlowRecord(raw) {
+  if (typeof raw === "string")
+    return JSON.parse(raw);
+  return raw;
+}
+function parseSession(raw) {
+  if (typeof raw === "string")
+    return JSON.parse(raw);
+  return raw;
+}
+export {
+  PostgresSessionStore
+};