@absolutejs/auth 0.36.0-beta.0 → 0.37.0

package/dist/index.js

@@ -1,4 +1,19 @@
 // @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
 // node_modules/citra/dist/index.js
@@ -4492,6 +4507,7 @@ var RESERVED_ACCESS_CLAIMS = new Set([
 var buildAccessClaims = ({
   act,
   audience,
+  clientCertThumbprint,
   clientId,
   dpopJkt,
   extraClaims,
@@ -4516,8 +4532,15 @@ var buildAccessClaims = ({
   };
   if (act !== undefined)
     claims.act = act;
-  if (dpopJkt !== undefined)
-    claims.cnf = { jkt: dpopJkt };
+  if (dpopJkt !== undefined || clientCertThumbprint !== undefined) {
+    const cnf = {};
+    if (dpopJkt !== undefined)
+      cnf.jkt = dpopJkt;
+    if (clientCertThumbprint !== undefined) {
+      cnf["x5t#S256"] = clientCertThumbprint;
+    }
+    claims.cnf = cnf;
+  }
   return claims;
 };
 var exchangeToken = async ({
@@ -4567,6 +4590,7 @@ var exchangeToken = async ({
 var issueTokenSet = async ({
   acr,
   claims,
+  clientCertThumbprint,
   clientId,
   config,
   dpopJkt,
@@ -4584,6 +4608,7 @@ var issueTokenSet = async ({
     sub
   });
   const accessPayload = buildAccessClaims({
+    clientCertThumbprint,
     clientId,
     dpopJkt,
     extraClaims: { ...accessExtra, ...acr === undefined ? {} : { acr } },
@@ -4873,6 +4898,7 @@ var denyBackchannelAuth = async ({
 }) => decideBackchannel(config, authReqId, { status: "denied" });
 var exchangeBackchannelAuth = async ({
   authReqId,
+  clientCertThumbprint,
   clientId,
   config,
   dpopJkt,
@@ -4901,6 +4927,7 @@ var exchangeBackchannelAuth = async ({
   }
   await config.backchannelAuthStore.deleteByAuthReqId(authReqId);
   const tokenSet = await issueTokenSet({
+    clientCertThumbprint,
     clientId,
     config,
     dpopJkt,
@@ -5020,6 +5047,55 @@ var verifyJwtSignedByClient = ({
   client
 }) => verifyJwtSignedByClientImpl(client, jwt);
 
+// src/oidc/mtls.ts
+var RFC9440_HEADER = "client-cert";
+var SF_BINARY_PREFIX = ":";
+var SF_BINARY_SUFFIX = ":";
+var base64Decode2 = (value) => Uint8Array.from(atob(value), (char) => char.charCodeAt(0));
+var base64UrlEncode2 = (bytes) => {
+  const binary = Array.from(bytes, (byte) => String.fromCharCode(byte)).join("");
+  return btoa(binary).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
+};
+var computeCertThumbprint = async (derBytes) => {
+  const digest = await crypto.subtle.digest("SHA-256", derBytes);
+  return base64UrlEncode2(new Uint8Array(digest));
+};
+var extractRfc9440ClientCert = (headers) => {
+  const raw = headers.get(RFC9440_HEADER);
+  if (raw === null)
+    return;
+  const trimmed = raw.trim();
+  if (!trimmed.startsWith(SF_BINARY_PREFIX) || !trimmed.endsWith(SF_BINARY_SUFFIX) || trimmed.length <= 2) {
+    return;
+  }
+  try {
+    return base64Decode2(trimmed.slice(1, -1));
+  } catch {
+    return;
+  }
+};
+var resolveClientCert = async ({
+  extract,
+  headers
+}) => {
+  if (extract !== undefined)
+    return extract(headers);
+  return extractRfc9440ClientCert(headers);
+};
+var verifyCertificateBoundToken = async ({
+  cnfThumbprint,
+  extract,
+  headers
+}) => {
+  if (cnfThumbprint === undefined)
+    return false;
+  const cert = await resolveClientCert({ extract, headers });
+  if (cert === undefined)
+    return false;
+  const presented = await computeCertThumbprint(cert);
+  return presented === cnfThumbprint;
+};
+
 // src/oidc/dpop.ts
 var DEFAULT_MAX_AGE_MS = 60000;
 var SECONDS_TO_MS = 1000;
@@ -5656,27 +5732,57 @@ var oidcProviderRoutes = (config) => {
     const matches = await constantTimeEqual(await hashToken(clientSecret), client.hashedSecret);
     return matches ? client : undefined;
   };
+  const tryMtlsAuth = async ({
+    candidate,
+    extract,
+    requestHeaders
+  }) => {
+    const registered = candidate?.tlsCertificateBoundThumbprints ?? [];
+    if (candidate === undefined || registered.length === 0)
+      return;
+    const cert = await resolveClientCert({
+      extract,
+      headers: requestHeaders
+    });
+    if (cert === undefined)
+      return;
+    const presented = await computeCertThumbprint(cert);
+    if (!registered.includes(presented))
+      return;
+    return { client: candidate, clientCertThumbprint: presented };
+  };
   const authenticateTokenClient = async ({
     basicClientId,
     basicClientSecret,
     bodyClientAssertion,
     bodyClientAssertionType,
     bodyClientId,
-    bodyClientSecret
+    bodyClientSecret,
+    requestHeaders
   }) => {
     if (bodyClientAssertion !== undefined && bodyClientAssertionType === CLIENT_ASSERTION_TYPE) {
-      return verifyClientAssertion({
+      const client2 = await verifyClientAssertion({
         assertion: bodyClientAssertion,
         expectedAudience: tokenUrl,
         jtiStore: config.clientAssertionJtiStore,
         resolveClient: clientStore.findClient
       });
+      return client2 === undefined ? undefined : { client: client2, clientCertThumbprint: undefined };
     }
     const clientId = bodyClientId ?? basicClientId;
-    const clientSecret = bodyClientSecret ?? basicClientSecret;
     if (clientId === undefined)
       return;
-    return authenticateClient(clientId, clientSecret);
+    const candidate = await clientStore.findClient(clientId);
+    const mtlsResult = await tryMtlsAuth({
+      candidate,
+      extract: config.extractTlsClientCert,
+      requestHeaders
+    });
+    if (mtlsResult !== undefined)
+      return mtlsResult;
+    const clientSecret = bodyClientSecret ?? basicClientSecret;
+    const client = await authenticateClient(clientId, clientSecret);
+    return client === undefined ? undefined : { client, clientCertThumbprint: undefined };
   };
   const dpopNonceChallenge = async (proof) => {
     if (proof === undefined || config.dpopNonce === undefined) {
@@ -5701,7 +5807,7 @@ var oidcProviderRoutes = (config) => {
       status: HTTP_UNAUTHORIZED2
     });
   };
-  const grantAuthorizationCode = async (client, body, dpop) => {
+  const grantAuthorizationCode = async (client, body, dpop, clientCertThumbprint) => {
     const {
       code,
       code_verifier: codeVerifier,
@@ -5725,6 +5831,7 @@ var oidcProviderRoutes = (config) => {
     return tokenResponse(await issueTokenSet({
       acr: record.acr,
       claims: record.claims,
+      clientCertThumbprint,
       clientId: client.clientId,
       config,
       dpopJkt: dpopResult?.jkt,
@@ -5733,7 +5840,7 @@ var oidcProviderRoutes = (config) => {
       sub: record.userId
     }));
   };
-  const grantRefreshToken = async (client, body, dpop) => {
+  const grantRefreshToken = async (client, body, dpop, clientCertThumbprint) => {
     const presented = body.refresh_token;
     if (presented === undefined) {
       return oauthError2(HTTP_BAD_REQUEST2, "invalid_request");
@@ -5755,6 +5862,7 @@ var oidcProviderRoutes = (config) => {
     return tokenResponse(await issueTokenSet({
       acr: record.acr,
       claims: record.claims,
+      clientCertThumbprint,
       clientId: client.clientId,
       config,
       dpopJkt: record.dpopJkt,
@@ -5792,7 +5900,7 @@ var oidcProviderRoutes = (config) => {
       token_type: dpopResult === undefined ? "Bearer" : "DPoP"
     }, HTTP_OK2);
   };
-  const grantBackchannel = async (client, body, dpop) => {
+  const grantBackchannel = async (client, body, dpop, clientCertThumbprint) => {
     if (config.backchannelAuthStore === undefined) {
       return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
     }
@@ -5809,6 +5917,7 @@ var oidcProviderRoutes = (config) => {
     }
     const result = await exchangeBackchannelAuth({
       authReqId: body.auth_req_id,
+      clientCertThumbprint,
       clientId: client.clientId,
       config,
       dpopJkt: dpopResult?.jkt
@@ -5885,12 +5994,14 @@ var oidcProviderRoutes = (config) => {
     response_types_supported: ["code"],
     revocation_endpoint: `${issuer}${revokeRoute}`,
     subject_types_supported: ["public"],
+    tls_client_certificate_bound_access_tokens: true,
     token_endpoint: tokenUrl,
     token_endpoint_auth_methods_supported: [
       "client_secret_basic",
       "client_secret_post",
       "none",
-      "private_key_jwt"
+      "private_key_jwt",
+      "self_signed_tls_client_auth"
     ],
     token_endpoint_auth_signing_alg_values_supported: ["ES256"],
     userinfo_endpoint: `${issuer}${userinfoRoute}`
@@ -6097,27 +6208,29 @@ var oidcProviderRoutes = (config) => {
       scope: t12.Optional(t12.String()),
       state: t12.Optional(t12.String())
     })
-  }).post(tokenRoute, async ({ body, headers }) => {
+  }).post(tokenRoute, async ({ body, headers, request }) => {
     const basic = readBasicAuth2(headers.authorization);
-    const client = await authenticateTokenClient({
+    const auth = await authenticateTokenClient({
       basicClientId: basic.clientId,
       basicClientSecret: basic.clientSecret,
       bodyClientAssertion: body.client_assertion,
       bodyClientAssertionType: body.client_assertion_type,
       bodyClientId: body.client_id,
-      bodyClientSecret: body.client_secret
+      bodyClientSecret: body.client_secret,
+      requestHeaders: request.headers
     });
-    if (client === undefined) {
+    if (auth === undefined) {
       return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
     }
+    const { client, clientCertThumbprint } = auth;
     const nonceChallenge = await dpopNonceChallenge(headers.dpop);
     if (nonceChallenge !== undefined)
       return nonceChallenge;
     if (body.grant_type === "authorization_code") {
-      return grantAuthorizationCode(client, body, headers.dpop);
+      return grantAuthorizationCode(client, body, headers.dpop, clientCertThumbprint);
     }
     if (body.grant_type === "refresh_token") {
-      return grantRefreshToken(client, body, headers.dpop);
+      return grantRefreshToken(client, body, headers.dpop, clientCertThumbprint);
     }
     if (body.grant_type === "urn:ietf:params:oauth:grant-type:token-exchange") {
       return grantTokenExchange(client, body, headers.dpop);
@@ -6126,7 +6239,7 @@ var oidcProviderRoutes = (config) => {
       return grantDeviceCode(client, body, headers.dpop);
     }
     if (body.grant_type === CIBA_GRANT_TYPE) {
-      return grantBackchannel(client, body, headers.dpop);
+      return grantBackchannel(client, body, headers.dpop, clientCertThumbprint);
     }
     return oauthError2(HTTP_BAD_REQUEST2, "unsupported_grant_type");
   }, {
@@ -6148,22 +6261,24 @@ var oidcProviderRoutes = (config) => {
       subject_token: t12.Optional(t12.String()),
       subject_token_type: t12.Optional(t12.String())
     })
-  }).post(parRoute, async ({ body, headers }) => {
+  }).post(parRoute, async ({ body, headers, request }) => {
     if (config.pushedAuthorizationRequestStore === undefined) {
       return oauthError2(HTTP_NOT_IMPLEMENTED, "unsupported_response_type");
     }
     const basic = readBasicAuth2(headers.authorization);
-    const client = await authenticateTokenClient({
+    const auth = await authenticateTokenClient({
       basicClientId: basic.clientId,
       basicClientSecret: basic.clientSecret,
       bodyClientAssertion: body.client_assertion,
       bodyClientAssertionType: body.client_assertion_type,
       bodyClientId: body.client_id,
-      bodyClientSecret: body.client_secret
+      bodyClientSecret: body.client_secret,
+      requestHeaders: request.headers
     });
-    if (client === undefined) {
+    if (auth === undefined) {
       return oauthError2(HTTP_UNAUTHORIZED2, "invalid_client");
     }
+    const { client } = auth;
     const isAuthField = (key) => key === "client_assertion" || key === "client_assertion_type" || key === "client_secret";
     const params = Object.fromEntries(Object.entries(body).filter((entry) => typeof entry[1] === "string" && !isAuthField(entry[0])));
     const result = await pushAuthorizationRequest({
@@ -20671,6 +20786,132 @@ var switchActiveSession = ({
 };
 // src/tenancy.ts
 var hasOrganizationScope = (value) => typeof value.organizationId === "string" && value.organizationId.length > 0;
+// src/credentials/backgroundOps.ts
+var HIBP_BREACHED_ACCOUNT_URL = "https://haveibeenpwned.com/api/v3/breachedaccount/";
+var HIBP_USER_AGENT = "@absolutejs/auth breach scanner";
+var DEFAULT_PAUSE_MS = 1700;
+var HIBP_NOT_FOUND = 404;
+var HIBP_RATE_LIMITED = 429;
+var MS_PER_DAY = 86400000;
+var MS_PER_SECOND3 = 1000;
+var sleep = (delayMs) => new Promise((resolve) => {
+  setTimeout(resolve, delayMs);
+});
+var isBreachRecord = (entry) => {
+  if (typeof entry !== "object" || entry === null)
+    return false;
+  if (!("name" in entry))
+    return false;
+  const candidate = entry;
+  return typeof candidate.name === "string";
+};
+var isBreachRecordArray = (value) => Array.isArray(value) && value.every(isBreachRecord);
+var checkEmailBreaches = async (email, apiKey, truncate) => {
+  const url = `${HIBP_BREACHED_ACCOUNT_URL}${encodeURIComponent(email)}?truncateResponse=${truncate ? "true" : "false"}`;
+  const response = await fetch(url, {
+    headers: {
+      "hibp-api-key": apiKey,
+      "user-agent": HIBP_USER_AGENT
+    }
+  });
+  if (response.status === HIBP_NOT_FOUND)
+    return [];
+  if (response.status === HIBP_RATE_LIMITED) {
+    const retryAfter = Number(response.headers.get("retry-after") ?? "0");
+    if (retryAfter > 0)
+      await sleep(retryAfter * MS_PER_SECOND3);
+    return [];
+  }
+  if (!response.ok)
+    return [];
+  const body = await response.json();
+  if (!isBreachRecordArray(body))
+    return [];
+  return body;
+};
+var scanEmail = async (email, apiKey, truncate, onBreachFound) => {
+  const breaches = await checkEmailBreaches(email, apiKey, truncate);
+  if (breaches.length === 0)
+    return false;
+  await onBreachFound({ breaches, email });
+  return true;
+};
+var scanPage = async (options) => {
+  let scanned = 0;
+  let breached = 0;
+  for (const email of options.emails) {
+    scanned += 1;
+    const hit = await scanEmail(email, options.apiKey, options.truncate, options.onBreachFound);
+    if (hit)
+      breached += 1;
+    await sleep(options.pauseMs);
+  }
+  return { breached, scanned };
+};
+var runEmailBreachScan = async (input) => {
+  const pauseMs = input.pauseMs ?? DEFAULT_PAUSE_MS;
+  const truncate = input.truncateResponse ?? true;
+  let scanned = 0;
+  let breached = 0;
+  let cursor;
+  do {
+    const page = await input.iterateEmails(cursor);
+    const tally = await scanPage({
+      apiKey: input.hibpApiKey,
+      emails: page.emails,
+      onBreachFound: input.onBreachFound,
+      pauseMs,
+      truncate
+    });
+    scanned += tally.scanned;
+    breached += tally.breached;
+    cursor = page.nextCursor;
+  } while (cursor !== undefined);
+  const result = { breached, scanned };
+  return result;
+};
+var pruneCandidate = async (candidate, cutoff, dryRun, onDelete) => {
+  const reference = candidate.lastLoginAt ?? candidate.createdAt;
+  if (reference === undefined || reference === null)
+    return false;
+  if (reference >= cutoff)
+    return false;
+  if (!dryRun)
+    await onDelete(candidate.userId);
+  return true;
+};
+var prunePage = async (options) => {
+  const pruned = [];
+  for (const candidate of options.candidates) {
+    const removed = await pruneCandidate(candidate, options.cutoff, options.dryRun, options.onDelete);
+    if (removed)
+      pruned.push(candidate.userId);
+  }
+  return pruned;
+};
+var pruneInactiveUsers = async (input) => {
+  const now = input.now?.() ?? Date.now();
+  const thresholdMs = input.olderThanDays * MS_PER_DAY;
+  const cutoff = now - thresholdMs;
+  const dryRun = input.dryRun ?? false;
+  const prunedUserIds = [];
+  let scanned = 0;
+  let cursor;
+  do {
+    const page = await input.iterateUsers(cursor);
+    scanned += page.users.length;
+    const removed = await prunePage({
+      candidates: page.users,
+      cutoff,
+      dryRun,
+      onDelete: input.onDelete
+    });
+    prunedUserIds.push(...removed);
+    cursor = page.nextCursor;
+  } while (cursor !== undefined);
+  const result = { dryRun, prunedUserIds, scanned };
+  return result;
+};
 // src/credentials/emailValidation.ts
 import { resolveMx } from "dns/promises";
 var EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
@@ -24240,6 +24481,7 @@ export {
   verifyDpopNonce,
   verifyCognitoSha256,
   verifyClientAssertion,
+  verifyCertificateBoundToken,
   verifyAuth0Pbkdf2,
   verifyAuditChain,
   verifyApiKey,
@@ -24272,6 +24514,7 @@ export {
   samlServiceProvidersTable,
   samlIdpRoutes,
   runMigrations,
+  runEmailBreachScan,
   rotateVaultKey,
   rotateMfaEncryptionKey,
   rolesTable,
@@ -24288,6 +24531,7 @@ export {
   resolveOAuthAuthorization,
   resolveCookieSecure,
   resolveClientProviderEntry,
+  resolveClientCert,
   resolveAuthHtmxRenderers,
   resolveApiPrincipal,
   removeFromSessionRing,
@@ -24298,6 +24542,7 @@ export {
   readUserInfoBearer,
   readSessionRing,
   pushAuthorizationRequest,
+  pruneInactiveUsers,
   providers,
   providerOptions,
   protectRoutePlugin,
@@ -24384,6 +24629,7 @@ export {
   fingerprintDevice,
   fetchUserInfo,
   fanOutBackchannelLogout,
+  extractRfc9440ClientCert,
   extractPropFromIdentity,
   extractDpopNonceClaim,
   exportAuditCsv,
@@ -24543,6 +24789,7 @@ export {
   consumePushedRequest,
   consumeBackupCode,
   constantTimeEqual,
+  computeCertThumbprint,
   complianceRoutes,
   check,
   buildClientProviders,
@@ -24599,5 +24846,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=6F90E4F856A11E4B64756E2164756E21
+//# debugId=26C38ACE51F8A69A64756E2164756E21
 //# sourceMappingURL=index.js.map