@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/esm/domain/token-exchange.js

@@ -0,0 +1,102 @@
+// src/domain/token-exchange.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { safeAudit } from "./audit";
+import { verifyClientCredentials } from "./client-auth";
+import { randomId } from "./crypto";
+import { verifyAccessToken } from "./jwt";
+import { mintTokens } from "./token";
+async function exchangeToken(req, deps) {
+  if (!deps.exchangeAudience) {
+    return err(authError.unsupportedGrantType("token-exchange is not configured on this IdP"));
+  }
+  const keysRes = await deps.keyStore.signingKeys();
+  if (isErr(keysRes))
+    return err(keysRes.error);
+  let subjectClaims;
+  try {
+    subjectClaims = await verifyAccessToken(req.subjectToken, keysRes.value, {
+      issuer: deps.issuerUrl
+    });
+  } catch (e) {
+    return err(authError.invalidGrant(`subject_token verification failed: ${e instanceof Error ? e.message : "unknown"}`));
+  }
+  if (!subjectClaims.claim) {
+    return err(authError.invalidGrant("subject_token does not carry a SubjectClaim — was it issued by this IdP?"));
+  }
+  const fromTenantId = subjectClaims.tid;
+  const fromTenantCfg = await deps.configStore.getTenantConfig(fromTenantId);
+  if (isErr(fromTenantCfg))
+    return err(fromTenantCfg.error);
+  const callerClientId = req.clientId ?? subjectClaims.aud;
+  const callerClient = fromTenantCfg.value.clients.find((c) => c.id === callerClientId);
+  if (!callerClient) {
+    return err(authError.invalidClient(`unknown client "${callerClientId}"`));
+  }
+  const authErr = await verifyClientCredentials(callerClient, req.clientSecret);
+  if (authErr)
+    return err(authErr);
+  const subjectScopes = (subjectClaims.scope ?? "").split(" ").filter((s) => s.length > 0);
+  const requestedScopes = req.scope ? req.scope.split(" ").filter((s) => s.length > 0) : subjectScopes;
+  for (const s of requestedScopes) {
+    if (!subjectScopes.includes(s)) {
+      return err(authError.invalidScope(`requested scope "${s}" not granted by subject_token`));
+    }
+  }
+  const audienceClaim = await deps.exchangeAudience(subjectClaims.claim, {
+    audience: req.audience,
+    ...req.scope !== undefined ? { requestedScopes } : {},
+    clientId: callerClient.id,
+    fromTenantId
+  });
+  if (typeof audienceClaim.code === "string" && typeof audienceClaim.description === "string") {
+    return err(audienceClaim);
+  }
+  const newClaim = audienceClaim;
+  const targetTenantId = req.audience;
+  const targetTenantCfg = await deps.configStore.getTenantConfig(targetTenantId);
+  if (isErr(targetTenantCfg))
+    return err(targetTenantCfg.error);
+  const targetClient = targetTenantCfg.value.clients.find((c) => c.id === callerClient.id);
+  if (!targetClient) {
+    return err(authError.invalidTarget(`client "${callerClient.id}" is not registered in target tenant "${targetTenantId}"`));
+  }
+  const targetTenant = {
+    id: targetTenantId,
+    config: targetTenantCfg.value,
+    request: { raw: new Request("about:blank"), custom: {} }
+  };
+  const minted = await mintTokens({
+    tenant: targetTenant,
+    claim: newClaim,
+    payload: {
+      tenantId: targetTenantId,
+      clientId: callerClient.id,
+      methodId: subjectClaims.mid ?? "token_exchange",
+      methodKind: subjectClaims.mkind ?? "token_exchange",
+      scopes: requestedScopes,
+      ...subjectClaims.auth_time !== undefined ? { authTime: subjectClaims.auth_time } : {},
+      ...subjectClaims.aud !== undefined && subjectClaims.aud !== callerClient.id ? { audience: subjectClaims.aud } : {}
+    },
+    family: (deps.newRefreshFamily ?? randomId)(),
+    deps
+  });
+  if (isErr(minted))
+    return err(minted.error);
+  await safeAudit(deps, {
+    kind: "token_exchanged",
+    tenantId: targetTenantId,
+    fromTenantId,
+    clientId: callerClient.id,
+    subjectId: subjectClaims.sub,
+    family: "exchanged",
+    timestamp: deps.clock()
+  });
+  return ok({
+    ...minted.value,
+    issued_token_type: "urn:ietf:params:oauth:token-type:access_token"
+  });
+}
+export {
+  exchangeToken
+};

package/dist/esm/domain/token.js

@@ -0,0 +1,246 @@
+// src/domain/token.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { safeAudit } from "./audit";
+import { verifyClientCredentials } from "./client-auth";
+import {
+  base64url,
+  decryptPayload,
+  encryptPayload,
+  randomId,
+  randomToken,
+  sha256,
+  utf8
+} from "./crypto";
+import { buildIdTokenClaims, shouldIssueIdToken } from "./id-token";
+import { signAccessToken, signIdToken } from "./jwt";
+import { validatePkce } from "./pkce";
+async function saveEncryptedCode(code, payload, ttl, deps) {
+  const keyResult = await deps.keyStore.currentEncryptionKey();
+  if (isErr(keyResult))
+    return err(keyResult.error);
+  let ciphertext;
+  try {
+    ciphertext = await encryptPayload(payload, keyResult.value.kid, keyResult.value.keyRef);
+  } catch (e) {
+    return err(authError.internalError("saveEncryptedCode: encrypt failed", e));
+  }
+  return deps.tokenStore.saveCode(code, ciphertext, ttl);
+}
+var DEFAULT_ACCESS_TTL_MS = 15 * 60 * 1000;
+var DEFAULT_REFRESH_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+async function exchangeCode(req, deps) {
+  const consumed = await deps.tokenStore.consumeCode(req.code);
+  if (isErr(consumed))
+    return err(consumed.error);
+  let payload;
+  try {
+    payload = await decryptPayload(consumed.value, async (kid) => {
+      const keyResult = await deps.keyStore.getEncryptionKey(kid);
+      if (isErr(keyResult)) {
+        throw new Error(`unknown encryption kid ${kid}`);
+      }
+      return keyResult.value.keyRef;
+    });
+  } catch (e) {
+    return err(authError.internalError("exchangeCode: decrypt failed", e));
+  }
+  const tenantCfg = await deps.configStore.getTenantConfig(payload.tenantId);
+  if (isErr(tenantCfg))
+    return err(tenantCfg.error);
+  const client = tenantCfg.value.clients.find((c) => c.id === payload.clientId);
+  if (!client) {
+    return err(authError.invalidClient(`unknown client "${payload.clientId}"`));
+  }
+  if (client.id !== req.clientId) {
+    return err(authError.invalidGrant("client_id mismatch with auth code"));
+  }
+  const authResult = await verifyClientCredentials(client, req.clientSecret);
+  if (authResult)
+    return err(authResult);
+  if (client.dpopRequired && req.dpopJkt === undefined) {
+    return err(authError.invalidDpopProof(`client "${client.id}" requires DPoP-bound tokens`));
+  }
+  if (payload.appRedirectUri !== req.redirectUri) {
+    return err(authError.invalidGrant("redirect_uri mismatch with auth code"));
+  }
+  if (payload.clientPkce) {
+    if (!req.codeVerifier) {
+      return err(authError.invalidGrant("missing code_verifier"));
+    }
+    const pkceValid = await validatePkce(req.codeVerifier, payload.clientPkce.challenge);
+    if (!pkceValid) {
+      return err(authError.invalidGrant("PKCE verification failed"));
+    }
+  }
+  const tenant = {
+    id: payload.tenantId,
+    config: tenantCfg.value,
+    request: { raw: new Request("about:blank"), custom: {} }
+  };
+  let claim;
+  try {
+    claim = await deps.success({
+      tenant,
+      methodId: payload.methodId,
+      methodKind: payload.methodKind,
+      providerSubject: payload.providerSubject,
+      properties: payload.properties,
+      context: payload.context ?? null
+    });
+  } catch (e) {
+    return err(authError.serverError("success callback threw", e));
+  }
+  if (deps.persistUpstreamTokens) {
+    try {
+      await deps.persistUpstreamTokens({
+        tenant,
+        methodId: payload.methodId,
+        methodKind: payload.methodKind,
+        providerSubject: payload.providerSubject,
+        properties: payload.properties,
+        subjectClaim: claim
+      });
+    } catch (e) {
+      return err(authError.serverError("persistUpstreamTokens hook threw", e));
+    }
+  }
+  const minted = await mintTokens({
+    tenant,
+    claim,
+    payload: {
+      ...payload,
+      ...req.dpopJkt !== undefined ? { dpopJkt: req.dpopJkt } : {}
+    },
+    deps,
+    family: (deps.newRefreshFamily ?? randomId)()
+  });
+  return minted;
+}
+async function mintTokens(args) {
+  const { tenant, claim, payload, deps, family, skipRefresh } = args;
+  const accessTtl = tenant.config.accessTtl !== undefined ? tenant.config.accessTtl * 1000 : DEFAULT_ACCESS_TTL_MS;
+  const refreshTtl = tenant.config.refreshTtl !== undefined ? tenant.config.refreshTtl * 1000 : DEFAULT_REFRESH_TTL_MS;
+  const now = deps.clock();
+  const receivingClient = tenant.config.clients.find((c) => c.id === payload.clientId);
+  const subjectId = await deriveSubjectId(claim, receivingClient?.sectorIdentifier);
+  const keyRes = await deps.keyStore.currentSigningKey();
+  if (isErr(keyRes))
+    return err(keyRes.error);
+  const signingKey = keyRes.value;
+  const userinfoClaimNames = Object.keys(payload.claimsRequest?.userinfo ?? {});
+  const claims = {
+    iss: deps.issuerUrl,
+    sub: subjectId,
+    aud: payload.audience ?? payload.clientId,
+    exp: Math.floor((now + accessTtl) / 1000),
+    iat: Math.floor(now / 1000),
+    tid: payload.tenantId,
+    mid: payload.methodId,
+    mkind: payload.methodKind,
+    scope: payload.scopes.join(" "),
+    claim,
+    ...payload.authTime !== undefined ? { auth_time: payload.authTime } : {},
+    ...payload.dpopJkt !== undefined ? { cnf: { jkt: payload.dpopJkt } } : {},
+    ...userinfoClaimNames.length > 0 ? { uic: userinfoClaimNames } : {}
+  };
+  let accessToken;
+  try {
+    accessToken = await signAccessToken(claims, signingKey.privateKeyRef, signingKey.alg, signingKey.kid);
+  } catch (e) {
+    return err(authError.serverError("access token sign failed", e));
+  }
+  let refresh;
+  if (!skipRefresh) {
+    refresh = (deps.newRefreshToken ?? randomToken)();
+    const refreshPayload = {
+      tenantId: payload.tenantId,
+      clientId: payload.clientId,
+      subjectId,
+      claim,
+      scopes: payload.scopes,
+      audience: payload.audience,
+      family,
+      methodId: payload.methodId,
+      methodKind: payload.methodKind,
+      authTime: payload.authTime ?? Math.floor(now / 1000),
+      ...payload.dpopJkt !== undefined ? { dpopJkt: payload.dpopJkt } : {},
+      ...payload.claimsRequest !== undefined ? { claimsRequest: payload.claimsRequest } : {},
+      issuedAt: now,
+      expiresAt: now + refreshTtl
+    };
+    const saved = await deps.tokenStore.saveRefresh(refresh, refreshPayload);
+    if (isErr(saved))
+      return err(saved.error);
+  }
+  let idToken;
+  if (payload.authTime !== undefined && shouldIssueIdToken(payload.scopes)) {
+    const idClaims = await buildIdTokenClaims({
+      issuerUrl: deps.issuerUrl,
+      audience: payload.clientId,
+      subjectId,
+      claim,
+      scopes: payload.scopes,
+      authTime: payload.authTime,
+      ...payload.appNonce !== undefined ? { appNonce: payload.appNonce } : {},
+      now,
+      methodKind: payload.methodKind,
+      accessToken,
+      ...payload.claimsRequest !== undefined ? { claimsRequest: payload.claimsRequest } : {},
+      ...deps.customScopeClaims !== undefined ? { customScopeClaims: deps.customScopeClaims } : {}
+    });
+    try {
+      idToken = await signIdToken(idClaims, signingKey.privateKeyRef, signingKey.alg, signingKey.kid);
+    } catch (e) {
+      return err(authError.serverError("id_token sign failed", e));
+    }
+  }
+  await safeAudit(deps, {
+    kind: "token_issued",
+    tenantId: payload.tenantId,
+    clientId: payload.clientId,
+    methodId: payload.methodId,
+    methodKind: payload.methodKind,
+    subjectId,
+    refreshTokenIdHash: refresh ? await hashTokenForAudit(refresh) : "",
+    ...idToken !== undefined ? { idTokenIssued: true } : {},
+    ...payload.dpopJkt !== undefined ? { dpopBound: true } : {},
+    timestamp: now
+  });
+  return ok({
+    access_token: accessToken,
+    token_type: payload.dpopJkt !== undefined ? "DPoP" : "Bearer",
+    expires_in: Math.floor(accessTtl / 1000),
+    ...refresh !== undefined ? { refresh_token: refresh } : {},
+    ...idToken !== undefined ? { id_token: idToken } : {},
+    scope: payload.scopes.join(" ")
+  });
+}
+async function hashClientSecret(plain) {
+  return base64url.encode(await sha256(utf8.encode(plain)));
+}
+async function deriveSubjectId(claim, sectorIdentifier) {
+  const c = claim;
+  const ordered = canonicalize(c.properties);
+  const seed = sectorIdentifier !== undefined ? `${sectorIdentifier}\x00${c.type}\x00${ordered}` : `${c.type}\x00${ordered}`;
+  return base64url.encode(await sha256(seed)).slice(0, 22);
+}
+function canonicalize(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return JSON.stringify(value);
+  }
+  const obj = value;
+  const keys = Object.keys(obj).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalize(obj[k])}`).join(",")}}`;
+}
+async function hashTokenForAudit(token) {
+  return base64url.encode(await sha256(utf8.encode(token))).slice(0, 16);
+}
+export {
+  saveEncryptedCode,
+  mintTokens,
+  hashClientSecret,
+  exchangeCode,
+  DEFAULT_REFRESH_TTL_MS,
+  DEFAULT_ACCESS_TTL_MS
+};

package/dist/esm/domain/userinfo.js

@@ -0,0 +1,62 @@
+// src/domain/userinfo.ts
+import { authError } from "../types/error";
+import { err, isErr, ok } from "../types/result";
+import { computeAth, verifyDpopProof } from "./dpop";
+import { pickScopedClaims } from "./id-token";
+import { verifyAccessToken } from "./jwt";
+async function userinfo(input, deps) {
+  const keysRes = await deps.keyStore.signingKeys();
+  if (isErr(keysRes))
+    return err(keysRes.error);
+  let claims;
+  try {
+    claims = await verifyAccessToken(input.accessToken, keysRes.value, {
+      ...deps.issuerUrl ? { issuer: deps.issuerUrl } : {}
+    });
+  } catch {
+    return err(authError.invalidGrant("access token invalid or expired"));
+  }
+  const boundJkt = claims.cnf?.jkt;
+  if (boundJkt !== undefined) {
+    if (input.scheme !== "DPoP") {
+      return err(authError.invalidDpopProof('access token is DPoP-bound; Authorization scheme must be "DPoP"'));
+    }
+    if (!input.dpopProof) {
+      return err(authError.invalidDpopProof("access token is DPoP-bound; request is missing a DPoP proof"));
+    }
+    if (!input.htu || !input.htm || input.nowSec === undefined) {
+      return err(authError.invalidDpopProof("userinfo dpop verification requires htu, htm, and nowSec"));
+    }
+    if (!deps.tokenStore) {
+      return err(authError.invalidDpopProof("userinfo dpop verification requires a token-store (jti replay protection)"));
+    }
+    const expectedAth = await computeAth(input.accessToken);
+    const dpopRes = await verifyDpopProof({
+      proofJwt: input.dpopProof,
+      htu: input.htu,
+      htm: input.htm,
+      nowSec: input.nowSec,
+      expectedAth
+    }, { tokenStore: deps.tokenStore });
+    if (isErr(dpopRes))
+      return err(dpopRes.error);
+    if (dpopRes.value.jkt !== boundJkt) {
+      return err(authError.invalidDpopProof("dpop proof key does not match access token cnf.jkt"));
+    }
+  } else if (input.scheme === "DPoP") {
+    return err(authError.invalidGrant("access token is not DPoP-bound; use Authorization: Bearer"));
+  }
+  const claim = claims.claim;
+  const scopes = claims.scope ? claims.scope.split(" ").filter(Boolean) : [];
+  const scopedClaims = pickScopedClaims(claim, scopes, claims.uic ?? [], deps.customScopeClaims ?? {});
+  return ok({
+    sub: claims.sub,
+    subject_type: claim.type,
+    properties: claim.properties,
+    scope: claims.scope,
+    ...scopedClaims
+  });
+}
+export {
+  userinfo
+};

package/dist/esm/http/context.js

@@ -0,0 +1,7 @@
+// src/http/context.ts
+function initialVars(issuerUrl, cookies) {
+  return { cookies, tenant: null, recovery: null, issuerUrl };
+}
+export {
+  initialVars
+};

package/dist/esm/http/cookies.js

@@ -0,0 +1,98 @@
+// src/http/cookies.ts
+function parseCookieHeader(header) {
+  const out = new Map;
+  if (!header)
+    return out;
+  for (const part of header.split(";")) {
+    const trimmed = part.trim();
+    if (!trimmed)
+      continue;
+    const eq = trimmed.indexOf("=");
+    if (eq === -1) {
+      out.set(trimmed, "");
+      continue;
+    }
+    const name = trimmed.slice(0, eq).trim();
+    const raw = trimmed.slice(eq + 1).trim();
+    const value = raw.startsWith('"') && raw.endsWith('"') ? raw.slice(1, -1) : raw;
+    try {
+      out.set(name, decodeURIComponent(value));
+    } catch {
+      out.set(name, value);
+    }
+  }
+  return out;
+}
+var RESERVED_PREFIX = /^(auth|idp)\./;
+var INVALID_COOKIE_NAME = /[=;,\s]/;
+function assertValidCookieName(name) {
+  if (!name || INVALID_COOKIE_NAME.test(name)) {
+    throw new TypeError(`invalid cookie name ${JSON.stringify(name)} — must be non-empty and contain no '=', ';', ',' or whitespace`);
+  }
+}
+function serializeSetCookie(cookie, defaults = {}) {
+  assertValidCookieName(cookie.name);
+  const parts = [];
+  const value = cookie.value ?? "";
+  parts.push(`${cookie.name}=${encodeURIComponent(value)}`);
+  const path = cookie.path ?? defaults.path ?? "/";
+  parts.push(`Path=${path}`);
+  const domain = cookie.domain ?? defaults.domain;
+  if (domain)
+    parts.push(`Domain=${domain}`);
+  if (cookie.value === null) {
+    parts.push("Max-Age=0");
+  } else if (cookie.maxAge !== undefined) {
+    parts.push(`Max-Age=${cookie.maxAge}`);
+  }
+  const secure = cookie.secure ?? defaults.secure ?? false;
+  if (secure)
+    parts.push("Secure");
+  const httpOnly = cookie.httpOnly ?? RESERVED_PREFIX.test(cookie.name);
+  if (httpOnly)
+    parts.push("HttpOnly");
+  const sameSite = cookie.sameSite ?? "lax";
+  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase() + sameSite.slice(1)}`);
+  return parts.join("; ");
+}
+var STRIPPED_HEADERS = [
+  "set-cookie",
+  "set-cookie2",
+  "strict-transport-security",
+  "content-security-policy",
+  "content-security-policy-report-only",
+  "x-frame-options",
+  "x-content-type-options",
+  "referrer-policy",
+  "permissions-policy",
+  "cache-control"
+];
+function applyResponsePolicy(response, opts = {}) {
+  const headers = new Headers(response.headers);
+  const stripped = [];
+  for (const h of STRIPPED_HEADERS) {
+    if (headers.has(h)) {
+      stripped.push(h);
+      headers.delete(h);
+    }
+  }
+  if (stripped.length > 0) {
+    console.warn(`[openauth] dropped method-returned header(s) ${stripped.join(", ")} — the framework owns cookie/security/cache headers; methods should return cookies via MethodResult.setCookies.`);
+  }
+  headers.set("Cache-Control", opts.cacheControl ?? "no-store");
+  if (opts.setCookies) {
+    for (const c of opts.setCookies) {
+      headers.append("Set-Cookie", serializeSetCookie(c, opts.cookieDefaults));
+    }
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+export {
+  serializeSetCookie,
+  parseCookieHeader,
+  applyResponsePolicy
+};

package/dist/esm/http/errors.js

@@ -0,0 +1,71 @@
+// src/http/errors.ts
+var TOKEN_STATUS = {
+  invalid_client: 401,
+  server_error: 500,
+  internal_error: 500,
+  tenant_not_found: 400
+};
+function publicErrorCode(code) {
+  if (code === "internal_error")
+    return "server_error";
+  if (code === "tenant_not_found")
+    return "invalid_request";
+  if (code === "method_not_found")
+    return "invalid_request";
+  if (code === "unknown_state")
+    return "invalid_request";
+  return code;
+}
+function tokenEndpointErrorResponse(error) {
+  const status = TOKEN_STATUS[error.code] ?? 400;
+  const body = {
+    error: publicErrorCode(error.code),
+    error_description: error.description
+  };
+  const headers = new Headers({
+    "content-type": "application/json",
+    "cache-control": "no-store",
+    pragma: "no-cache"
+  });
+  if (status === 401) {
+    headers.set("www-authenticate", `Basic realm="oauth"`);
+  }
+  return new Response(JSON.stringify(body), { status, headers });
+}
+function authorizeRedirectErrorResponse(error, appRedirectUri, appState) {
+  const url = new URL(appRedirectUri);
+  url.searchParams.set("error", publicErrorCode(error.code));
+  url.searchParams.set("error_description", error.description);
+  if (appState !== null)
+    url.searchParams.set("state", appState);
+  return new Response(null, {
+    status: 302,
+    headers: { location: url.toString(), "cache-control": "no-store" }
+  });
+}
+function authorizeDirectErrorResponse(error) {
+  const body = `${publicErrorCode(error.code)}: ${error.description}`;
+  return new Response(body, {
+    status: 400,
+    headers: { "content-type": "text/plain", "cache-control": "no-store" }
+  });
+}
+function isNonRecoverable(error) {
+  if (error.code === "invalid_client")
+    return true;
+  if (error.code === "tenant_not_found")
+    return true;
+  if (error.code === "method_not_found")
+    return true;
+  if (error.code === "invalid_request" && error.field === "redirect_uri") {
+    return true;
+  }
+  return false;
+}
+export {
+  tokenEndpointErrorResponse,
+  publicErrorCode,
+  isNonRecoverable,
+  authorizeRedirectErrorResponse,
+  authorizeDirectErrorResponse
+};