@absolutejs/auth 0.36.0 → 0.38.0

package/dist/index.js

@@ -1,4 +1,19 @@
 // @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
 // node_modules/citra/dist/index.js
@@ -8300,10 +8315,26 @@ var GROUP_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Group";
 var LIST_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:ListResponse";
 var ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
 var SPC_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig";
+var RESOURCE_TYPE_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:ResourceType";
 var SCIM_CONTENT_TYPE = "application/scim+json";
 var FILTER_MAX_RESULTS = 200;
 var FILTER_PATTERN = /^\s*(\w[\w.]*)\s+eq\s+"([^"]*)"\s*$/u;
-var toUserResource = (user, location) => {
+var mergeCustomSchemas = (resource, custom, map) => {
+  if (custom === undefined || map === undefined)
+    return;
+  const extra = map.toScim(custom);
+  for (const [key, value] of Object.entries(extra)) {
+    resource[key] = value;
+  }
+  const extraSchemas = (map.schemas ?? []).map((schema) => schema.id);
+  if (extraSchemas.length === 0)
+    return;
+  const { schemas } = resource;
+  if (Array.isArray(schemas)) {
+    resource.schemas = [...schemas, ...extraSchemas];
+  }
+};
+var toUserResource = (user, location, map) => {
   const resource = {
     active: user.active,
     id: user.id,
@@ -8324,6 +8355,7 @@ var toUserResource = (user, location) => {
   if (user.email !== undefined) {
     resource.emails = [{ primary: true, value: user.email }];
   }
+  mergeCustomSchemas(resource, user.custom, map);
   return resource;
 };
 var stringField = (source, field) => {
@@ -8338,7 +8370,7 @@ var primaryEmail = (emails) => {
   const flagged = emails.find((entry) => typeof entry === "object" && entry !== null && Reflect.get(entry, "primary") === true);
   return stringField(flagged ?? emails[0], "value");
 };
-var parseUserInput = (body) => {
+var parseUserInput = (body, map) => {
   if (typeof body !== "object" || body === null)
     return;
   const userName = stringField(body, "userName");
@@ -8346,8 +8378,14 @@ var parseUserInput = (body) => {
     return;
   const active = Reflect.get(body, "active");
   const name = Reflect.get(body, "name");
+  const bodyRecord = {};
+  for (const key of Object.keys(body)) {
+    bodyRecord[key] = Reflect.get(body, key);
+  }
+  const custom = map === undefined ? undefined : map.fromScim(bodyRecord);
   return {
     active: typeof active === "boolean" ? active : true,
+    custom,
     displayName: stringField(body, "displayName"),
     email: primaryEmail(Reflect.get(body, "emails")),
     externalId: stringField(body, "externalId"),
@@ -8408,6 +8446,7 @@ var applyOperation = (target, operation) => {
 var applyPatch = (user, body) => {
   const next = {
     active: user.active,
+    custom: user.custom,
     displayName: user.displayName,
     email: user.email,
     externalId: user.externalId,
@@ -8453,6 +8492,15 @@ var scimJson = (resource, httpStatus) => new Response(JSON.stringify(resource),
   status: httpStatus
 });
 var serviceProviderConfig = (location) => ({
+  authenticationSchemes: [
+    {
+      description: "Authentication scheme using the OAuth Bearer Token Standard",
+      name: "OAuth Bearer Token",
+      primary: true,
+      specUri: "https://www.rfc-editor.org/info/rfc6750",
+      type: "oauthbearertoken"
+    }
+  ],
   bulk: { maxOperations: 0, maxPayloadSize: 0, supported: false },
   changePassword: { supported: false },
   etag: { supported: false },
@@ -8462,6 +8510,111 @@ var serviceProviderConfig = (location) => ({
   schemas: [SPC_SCHEMA],
   sort: { supported: false }
 });
+var CORE_USER_ATTRIBUTES = [
+  { multiValued: false, name: "userName", required: true, type: "string" },
+  { multiValued: false, name: "active", required: false, type: "boolean" },
+  { multiValued: false, name: "displayName", required: false, type: "string" },
+  { multiValued: false, name: "externalId", required: false, type: "string" },
+  {
+    multiValued: false,
+    name: "name",
+    required: false,
+    subAttributes: [
+      { multiValued: false, name: "givenName", required: false, type: "string" },
+      { multiValued: false, name: "familyName", required: false, type: "string" }
+    ],
+    type: "complex"
+  },
+  {
+    multiValued: true,
+    name: "emails",
+    required: false,
+    subAttributes: [
+      { multiValued: false, name: "value", required: false, type: "string" },
+      { multiValued: false, name: "primary", required: false, type: "boolean" }
+    ],
+    type: "complex"
+  }
+];
+var CORE_GROUP_ATTRIBUTES = [
+  { multiValued: false, name: "displayName", required: true, type: "string" },
+  { multiValued: false, name: "externalId", required: false, type: "string" },
+  {
+    multiValued: true,
+    name: "members",
+    required: false,
+    subAttributes: [
+      { multiValued: false, name: "value", required: false, type: "string" },
+      { multiValued: false, name: "display", required: false, type: "string" }
+    ],
+    type: "complex"
+  }
+];
+var CORE_USER_SCHEMA = {
+  attributes: CORE_USER_ATTRIBUTES,
+  description: "User Account",
+  id: USER_SCHEMA,
+  name: "User"
+};
+var CORE_GROUP_SCHEMA = {
+  attributes: CORE_GROUP_ATTRIBUTES,
+  description: "Group",
+  id: GROUP_SCHEMA,
+  name: "Group"
+};
+var schemaResource = (schema, location) => ({
+  attributes: schema.attributes,
+  description: schema.description ?? schema.name,
+  id: schema.id,
+  meta: { location, resourceType: "Schema" },
+  name: schema.name
+});
+var schemaList = (location, extras = []) => {
+  const all = [CORE_USER_SCHEMA, CORE_GROUP_SCHEMA, ...extras];
+  const resources = all.map((schema) => schemaResource(schema, `${location}/${schema.id}`));
+  return listResponse(resources);
+};
+var schemaOne = (location, id, extras = []) => {
+  const all = [CORE_USER_SCHEMA, CORE_GROUP_SCHEMA, ...extras];
+  const found = all.find((schema) => schema.id === id);
+  if (found === undefined)
+    return;
+  return schemaResource(found, location);
+};
+var resourceTypeUser = (location, usersEndpoint, extensionSchemaIds) => ({
+  description: "User Account",
+  endpoint: usersEndpoint,
+  id: "User",
+  meta: { location, resourceType: "ResourceType" },
+  name: "User",
+  schema: USER_SCHEMA,
+  schemaExtensions: extensionSchemaIds.map((schema) => ({
+    required: false,
+    schema
+  })),
+  schemas: [RESOURCE_TYPE_SCHEMA]
+});
+var resourceTypeGroup = (location, groupsEndpoint) => ({
+  description: "Group",
+  endpoint: groupsEndpoint,
+  id: "Group",
+  meta: { location, resourceType: "ResourceType" },
+  name: "Group",
+  schema: GROUP_SCHEMA,
+  schemas: [RESOURCE_TYPE_SCHEMA]
+});
+var resourceTypeList = (location, usersEndpoint, groupsEndpoint, extras = []) => listResponse([
+  resourceTypeUser(`${location}/User`, usersEndpoint, extras.map((schema) => schema.id)),
+  resourceTypeGroup(`${location}/Group`, groupsEndpoint)
+]);
+var resourceTypeOne = (location, id, usersEndpoint, groupsEndpoint, extras = []) => {
+  if (id === "User") {
+    return resourceTypeUser(location, usersEndpoint, extras.map((schema) => schema.id));
+  }
+  if (id === "Group")
+    return resourceTypeGroup(location, groupsEndpoint);
+  return;
+};
 var REMOVE_MEMBER_PATTERN = /^members\[\s*value\s+eq\s+"([^"]*)"\s*\]$/iu;
 var parseMembers = (value) => {
   if (!Array.isArray(value))
@@ -8562,6 +8715,7 @@ var SCIM_CONTENT_TYPE2 = "application/scim+json";
 var unauthorized = () => scimError(SCIM_UNAUTHORIZED, "Invalid or missing SCIM bearer token");
 var notImplemented = () => scimError(SCIM_NOT_IMPLEMENTED, "Group provisioning is not configured");
 var scimRoutes = ({
+  customAttributes,
   getScimGroup,
   getScimUser,
   listScimGroups,
@@ -8580,8 +8734,17 @@ var scimRoutes = ({
   const groupsRoute = `${scimRoute}/Groups`;
   const groupRoute = `${scimRoute}/Groups/:id`;
   const spcRoute = `${scimRoute}/ServiceProviderConfig`;
+  const schemasRoute = `${scimRoute}/Schemas`;
+  const schemaRoute = `${scimRoute}/Schemas/:id`;
+  const resourceTypesRoute = `${scimRoute}/ResourceTypes`;
+  const resourceTypeRoute = `${scimRoute}/ResourceTypes/:id`;
+  const extensionSchemas = customAttributes?.schemas ?? [];
   const userLocation = (requestUrl, id) => `${new URL(requestUrl).origin}${scimRoute}/Users/${id}`;
   const groupLocation = (requestUrl, id) => `${new URL(requestUrl).origin}${scimRoute}/Groups/${id}`;
+  const schemasLocation = (requestUrl) => `${new URL(requestUrl).origin}${scimRoute}/Schemas`;
+  const resourceTypesLocation = (requestUrl) => `${new URL(requestUrl).origin}${scimRoute}/ResourceTypes`;
+  const usersEndpoint = `${scimRoute}/Users`;
+  const groupsEndpoint = `${scimRoute}/Groups`;
   return new Elysia29().onParse(({ request }, contentType) => contentType === SCIM_CONTENT_TYPE2 ? request.json() : undefined).get(spcRoute, async ({ headers, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
@@ -8591,12 +8754,12 @@ var scimRoutes = ({
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
-    const input = parseUserInput(body);
+    const input = parseUserInput(body, customAttributes);
     if (input === undefined) {
       return scimError(SCIM_BAD_REQUEST, "Request body is not a valid SCIM User", "invalidValue");
     }
     const user = await onScimUserCreate({ input, organizationId });
-    return scimJson(toUserResource(user, userLocation(request.url, user.id)), SCIM_CREATED);
+    return scimJson(toUserResource(user, userLocation(request.url, user.id), customAttributes), SCIM_CREATED);
   }).get(usersRoute, async ({ headers, query, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
@@ -8605,7 +8768,7 @@ var scimRoutes = ({
       filter: parseFilter(query.filter),
       organizationId
     });
-    const resources = users.map((user) => toUserResource(user, userLocation(request.url, user.id)));
+    const resources = users.map((user) => toUserResource(user, userLocation(request.url, user.id), customAttributes));
     return scimJson(listResponse(resources), SCIM_OK);
   }, { query: t26.Object({ filter: t26.Optional(t26.String()) }) }).get(userRoute, async ({ headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
@@ -8615,12 +8778,12 @@ var scimRoutes = ({
     if (user === undefined) {
       return scimError(SCIM_NOT_FOUND, "User not found");
     }
-    return scimJson(toUserResource(user, userLocation(request.url, id)), SCIM_OK);
+    return scimJson(toUserResource(user, userLocation(request.url, id), customAttributes), SCIM_OK);
   }, { params: t26.Object({ id: t26.String() }) }).put(userRoute, async ({ body, headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
       return unauthorized();
-    const input = parseUserInput(body);
+    const input = parseUserInput(body, customAttributes);
     if (input === undefined) {
       return scimError(SCIM_BAD_REQUEST, "Request body is not a valid SCIM User", "invalidValue");
     }
@@ -8632,7 +8795,7 @@ var scimRoutes = ({
     if (user === undefined) {
       return scimError(SCIM_NOT_FOUND, "User not found");
     }
-    return scimJson(toUserResource(user, userLocation(request.url, id)), SCIM_OK);
+    return scimJson(toUserResource(user, userLocation(request.url, id), customAttributes), SCIM_OK);
   }, { params: t26.Object({ id: t26.String() }) }).patch(userRoute, async ({ body, headers, params: { id }, request }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
@@ -8649,7 +8812,7 @@ var scimRoutes = ({
     if (user === undefined) {
       return scimError(SCIM_NOT_FOUND, "User not found");
     }
-    return scimJson(toUserResource(user, userLocation(request.url, id)), SCIM_OK);
+    return scimJson(toUserResource(user, userLocation(request.url, id), customAttributes), SCIM_OK);
   }, { params: t26.Object({ id: t26.String() }) }).delete(userRoute, async ({ headers, params: { id } }) => {
     const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
     if (organizationId === undefined)
@@ -8741,6 +8904,34 @@ var scimRoutes = ({
       return notImplemented();
     await onScimGroupDelete({ id, organizationId });
     return new Response(null, { status: SCIM_NO_CONTENT });
+  }, { params: t26.Object({ id: t26.String() }) }).get(schemasRoute, async ({ headers, request }) => {
+    const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
+    if (organizationId === undefined)
+      return unauthorized();
+    return scimJson(schemaList(schemasLocation(request.url), extensionSchemas), SCIM_OK);
+  }).get(schemaRoute, async ({ headers, params: { id }, request }) => {
+    const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
+    if (organizationId === undefined)
+      return unauthorized();
+    const schema = schemaOne(`${schemasLocation(request.url)}/${id}`, id, extensionSchemas);
+    if (schema === undefined) {
+      return scimError(SCIM_NOT_FOUND, "Schema not found");
+    }
+    return scimJson(schema, SCIM_OK);
+  }, { params: t26.Object({ id: t26.String() }) }).get(resourceTypesRoute, async ({ headers, request }) => {
+    const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
+    if (organizationId === undefined)
+      return unauthorized();
+    return scimJson(resourceTypeList(resourceTypesLocation(request.url), usersEndpoint, groupsEndpoint, extensionSchemas), SCIM_OK);
+  }).get(resourceTypeRoute, async ({ headers, params: { id }, request }) => {
+    const organizationId = await resolveScimOrganization(scimTokenStore, headers.authorization);
+    if (organizationId === undefined)
+      return unauthorized();
+    const resourceType = resourceTypeOne(`${resourceTypesLocation(request.url)}/${id}`, id, usersEndpoint, groupsEndpoint, extensionSchemas);
+    if (resourceType === undefined) {
+      return scimError(SCIM_NOT_FOUND, "ResourceType not found");
+    }
+    return scimJson(resourceType, SCIM_OK);
   }, { params: t26.Object({ id: t26.String() }) });
 };
 
@@ -20771,6 +20962,132 @@ var switchActiveSession = ({
 };
 // src/tenancy.ts
 var hasOrganizationScope = (value) => typeof value.organizationId === "string" && value.organizationId.length > 0;
+// src/credentials/backgroundOps.ts
+var HIBP_BREACHED_ACCOUNT_URL = "https://haveibeenpwned.com/api/v3/breachedaccount/";
+var HIBP_USER_AGENT = "@absolutejs/auth breach scanner";
+var DEFAULT_PAUSE_MS = 1700;
+var HIBP_NOT_FOUND = 404;
+var HIBP_RATE_LIMITED = 429;
+var MS_PER_DAY = 86400000;
+var MS_PER_SECOND3 = 1000;
+var sleep = (delayMs) => new Promise((resolve) => {
+  setTimeout(resolve, delayMs);
+});
+var isBreachRecord = (entry) => {
+  if (typeof entry !== "object" || entry === null)
+    return false;
+  if (!("name" in entry))
+    return false;
+  const candidate = entry;
+  return typeof candidate.name === "string";
+};
+var isBreachRecordArray = (value) => Array.isArray(value) && value.every(isBreachRecord);
+var checkEmailBreaches = async (email, apiKey, truncate) => {
+  const url = `${HIBP_BREACHED_ACCOUNT_URL}${encodeURIComponent(email)}?truncateResponse=${truncate ? "true" : "false"}`;
+  const response = await fetch(url, {
+    headers: {
+      "hibp-api-key": apiKey,
+      "user-agent": HIBP_USER_AGENT
+    }
+  });
+  if (response.status === HIBP_NOT_FOUND)
+    return [];
+  if (response.status === HIBP_RATE_LIMITED) {
+    const retryAfter = Number(response.headers.get("retry-after") ?? "0");
+    if (retryAfter > 0)
+      await sleep(retryAfter * MS_PER_SECOND3);
+    return [];
+  }
+  if (!response.ok)
+    return [];
+  const body = await response.json();
+  if (!isBreachRecordArray(body))
+    return [];
+  return body;
+};
+var scanEmail = async (email, apiKey, truncate, onBreachFound) => {
+  const breaches = await checkEmailBreaches(email, apiKey, truncate);
+  if (breaches.length === 0)
+    return false;
+  await onBreachFound({ breaches, email });
+  return true;
+};
+var scanPage = async (options) => {
+  let scanned = 0;
+  let breached = 0;
+  for (const email of options.emails) {
+    scanned += 1;
+    const hit = await scanEmail(email, options.apiKey, options.truncate, options.onBreachFound);
+    if (hit)
+      breached += 1;
+    await sleep(options.pauseMs);
+  }
+  return { breached, scanned };
+};
+var runEmailBreachScan = async (input) => {
+  const pauseMs = input.pauseMs ?? DEFAULT_PAUSE_MS;
+  const truncate = input.truncateResponse ?? true;
+  let scanned = 0;
+  let breached = 0;
+  let cursor;
+  do {
+    const page = await input.iterateEmails(cursor);
+    const tally = await scanPage({
+      apiKey: input.hibpApiKey,
+      emails: page.emails,
+      onBreachFound: input.onBreachFound,
+      pauseMs,
+      truncate
+    });
+    scanned += tally.scanned;
+    breached += tally.breached;
+    cursor = page.nextCursor;
+  } while (cursor !== undefined);
+  const result = { breached, scanned };
+  return result;
+};
+var pruneCandidate = async (candidate, cutoff, dryRun, onDelete) => {
+  const reference = candidate.lastLoginAt ?? candidate.createdAt;
+  if (reference === undefined || reference === null)
+    return false;
+  if (reference >= cutoff)
+    return false;
+  if (!dryRun)
+    await onDelete(candidate.userId);
+  return true;
+};
+var prunePage = async (options) => {
+  const pruned = [];
+  for (const candidate of options.candidates) {
+    const removed = await pruneCandidate(candidate, options.cutoff, options.dryRun, options.onDelete);
+    if (removed)
+      pruned.push(candidate.userId);
+  }
+  return pruned;
+};
+var pruneInactiveUsers = async (input) => {
+  const now = input.now?.() ?? Date.now();
+  const thresholdMs = input.olderThanDays * MS_PER_DAY;
+  const cutoff = now - thresholdMs;
+  const dryRun = input.dryRun ?? false;
+  const prunedUserIds = [];
+  let scanned = 0;
+  let cursor;
+  do {
+    const page = await input.iterateUsers(cursor);
+    scanned += page.users.length;
+    const removed = await prunePage({
+      candidates: page.users,
+      cutoff,
+      dryRun,
+      onDelete: input.onDelete
+    });
+    prunedUserIds.push(...removed);
+    cursor = page.nextCursor;
+  } while (cursor !== undefined);
+  const result = { dryRun, prunedUserIds, scanned };
+  return result;
+};
 // src/credentials/emailValidation.ts
 import { resolveMx } from "dns/promises";
 var EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
@@ -21574,6 +21891,15 @@ var createPostgresAuditSink = (db) => ({
     return deleted.length;
   }
 });
+// src/scim/extensions.ts
+var defineScimAttributeMap = (map) => map;
+var diffScimGroupMembers = (current, next) => {
+  const currentValues = new Set(current.map((member) => member.value));
+  const nextValues = new Set(next.map((member) => member.value));
+  const added = next.filter((member) => !currentValues.has(member.value));
+  const removed = current.filter((member) => !nextValues.has(member.value));
+  return { added, removed };
+};
 // src/scim/inMemoryScimTokenStore.ts
 var createInMemoryScimTokenStore = () => {
   const tokens = new Map;
@@ -24373,6 +24699,7 @@ export {
   samlServiceProvidersTable,
   samlIdpRoutes,
   runMigrations,
+  runEmailBreachScan,
   rotateVaultKey,
   rotateMfaEncryptionKey,
   rolesTable,
@@ -24400,6 +24727,7 @@ export {
   readUserInfoBearer,
   readSessionRing,
   pushAuthorizationRequest,
+  pruneInactiveUsers,
   providers,
   providerOptions,
   protectRoutePlugin,
@@ -24498,10 +24826,12 @@ export {
   endImpersonation,
   encryptTotpSecret,
   encryptSecret,
+  diffScimGroupMembers,
   denyDeviceAuthorization,
   denyBackchannelAuth,
   deleteWarrant,
   deleteRegisteredClient,
+  defineScimAttributeMap,
   defineProvidersConfiguration,
   defineAuthSettings,
   defineAuthHtmxConfig,
@@ -24703,5 +25033,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=1069DAAF739CAF9F64756E2164756E21
+//# debugId=5A0B79F67182545764756E2164756E21
 //# sourceMappingURL=index.js.map