@absolutejs/auth 0.49.3 → 0.51.0

package/dist/index.d.ts

@@ -12,7 +12,7 @@ import { AuthConfig } from './types';
  *  `UserType`); the routes are reached by path at runtime / direct fetch. */
 type MergeAuthContext<Base, Extra> = Base extends Elysia<infer Path, infer Singleton, infer Definitions, infer Metadata, infer Routes, infer Ephemeral, infer Volatile> ? Extra extends Elysia<infer ExtraPath, infer ExtraSingleton, infer ExtraDefinitions, infer ExtraMetadata, infer ExtraRoutes, infer ExtraEphemeral, infer ExtraVolatile> ? Elysia<Path & ExtraPath, Singleton & ExtraSingleton, Definitions & ExtraDefinitions, Metadata & ExtraMetadata, Routes & ExtraRoutes, Ephemeral & ExtraEphemeral, Volatile & ExtraVolatile> : never : never;
 export type AuthInstance<UserType> = MergeAuthContext<ReturnType<typeof protectRoutePlugin<UserType>>, ReturnType<typeof stepUpPlugin<UserType>>>;
-export declare const auth: <UserType>({ providersConfiguration, authorizeRoute, cookieSecure, callbackRoute, profileRoute, signoutRoute, statusRoute, refreshRoute, revokeRoute, cleanupIntervalMs, maxSessions, sessionDurationMs, authSessionStore, audit, credentials, mfa, passwordless, lockout, sessions, sso, scim, apikeys, oidc, organizations, roles, portal, authorization, compliance, webauthn, webhooks, htmx, tracing, resolveAuthIntent, onAuthorizeSuccess, onAuthorizeError, onProfileSuccess, onProfileError, onCallbackSuccess, onLinkIdentity, onLinkIdentityConflict, onLinkConnector, onCallbackError, onStatus, onRefreshSuccess, onRefreshError, onSignOut, onRevocationSuccess, onRevocationError, onSessionCleanup }: AuthConfig<UserType>) => Promise<Elysia<"", {
+export declare const auth: <UserType>({ providersConfiguration, authorizeRoute, cookieSecure, callbackRoute, profileRoute, signoutRoute, statusRoute, refreshRoute, revokeRoute, cleanupIntervalMs, maxSessions, sessionDurationMs, authSessionStore, audit, credentials, customProviders, mfa, passwordless, lockout, sessions, sso, scim, apikeys, oidc, organizations, roles, portal, authorization, compliance, webauthn, webhooks, htmx, tracing, resolveAuthIntent, onAuthorizeSuccess, onAuthorizeError, onProfileSuccess, onProfileError, onCallbackSuccess, onLinkIdentity, onLinkIdentityConflict, onLinkConnector, onCallbackError, onStatus, onRefreshSuccess, onRefreshError, onSignOut, onRevocationSuccess, onRevocationError, onSessionCleanup }: AuthConfig<UserType>) => Promise<Elysia<"", {
     decorator: {};
     store: {
         session: import("./types").SessionRecord<UserType>;
@@ -127,8 +127,8 @@ export { resolveAuthHtmxRenderers } from './htmx/renderers';
 export type { AuthHtmxConfig, AuthHtmxConnectorTarget, AuthHtmxProviderData, AuthHtmxProviderInfo, AuthHtmxRenderOverrides, AuthHtmxRenderersConfig, AuthHtmxUser, AuthIdentityPayload, LinkedProviderPayload } from './htmx/types';
 export * from './utils';
 export { buildClientProviders, resolveClientProviderEntry, resolveProviderClientConfiguration } from './providers/clients';
-export type { OAuth2TokenResponse, OAuth2Client, ProviderOption, PKCEProvider, OIDCProvider, RefreshableProvider, RevocableProvider, ScopeRequiredProvider, ProvidersMap, ProviderConfiguration, CredentialsFor } from 'citra';
-export { providers, providerOptions, refreshableProviderOptions, revocableProviderOptions, oidcProviderOptions, pkceProviderOptions, scopeRequiredProviderOptions, decodeJWT, extractPropFromIdentity, isValidProviderOption, isRefreshableOAuth2Client, isRefreshableProviderOption, isOIDCProviderOption, isPKCEProviderOption, isRevocableProviderOption, isRevocableOAuth2Client } from 'citra';
+export type { OAuth2TokenResponse, OAuth2Client, OAuth2ClientForConfig, CustomProviderCredentials, ProviderConfig, ProviderOption, PKCEProvider, OIDCProvider, RefreshableProvider, RevocableProvider, ScopeRequiredProvider, ProvidersMap, ProviderConfiguration, CredentialsFor } from 'citra';
+export { providers, providerOptions, createCustomOAuth2Client, defineProvider, refreshableProviderOptions, revocableProviderOptions, oidcProviderOptions, pkceProviderOptions, scopeRequiredProviderOptions, decodeJWT, extractPropFromIdentity, isValidProviderOption, isRefreshableOAuth2Client, isRefreshableProviderOption, isOIDCProviderOption, isPKCEProviderOption, isRevocableProviderOption, isRevocableOAuth2Client } from 'citra';
 export * from './crypto';
 export * from './tenancy';
 export * from './credentials/config';

package/dist/index.js

@@ -262,6 +262,7 @@ var anilistProfileQuery = `query {
   }
 }`;
 var defineProviders = (providers) => providers;
+var defineProvider = (config) => config;
 var providers = defineProviders({
   "42": {
     authorizationUrl: "https://api.intra.42.fr/oauth/authorize",
@@ -1347,6 +1348,37 @@ var providers = defineProviders({
       url: (config) => `https://${config.domain}/oauth2/default/v1/token`
     }
   },
+  onspark: {
+    authorizationUrl: "https://app.onspark.com/oauth2/authorize",
+    email: ["email"],
+    familyName: ["family_name"],
+    fullName: ["name"],
+    givenName: ["given_name"],
+    isOIDC: true,
+    isRefreshable: true,
+    picture: ["picture"],
+    PKCEMethod: "S256",
+    profileRequest: {
+      authIn: "header",
+      encoding: "application/json",
+      method: "GET",
+      url: "https://app.onspark.com/oauth2/userinfo"
+    },
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      tokenParamName: "token",
+      url: "https://app.onspark.com/oauth2/revoke"
+    },
+    scopeRequired: true,
+    subject: ["sub"],
+    subjectType: "string",
+    tokenRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      url: "https://app.onspark.com/oauth2/token"
+    }
+  },
   osu: {
     authorizationUrl: "https://osu.ppy.sh/oauth/authorize",
     isOIDC: false,
@@ -1898,6 +1930,7 @@ var providers = defineProviders({
       method: "POST",
       url: "https://wbsapi.withings.net/v2/oauth2"
     },
+    scopeDelimiter: ",",
     scopeRequired: true,
     subject: ["userid"],
     subjectType: "string",
@@ -2529,8 +2562,7 @@ var refreshableProviderOptions = Object.keys(providers).filter(isRefreshableProv
 var revocableProviderOptions = Object.keys(providers).filter(isRevocableProviderOption);
 var scopeRequiredProviderOptions = Object.keys(providers).filter(isScopeRequiredProviderOption);
 var readPath = (value, path) => path.reduce((cursor, key) => cursor && typeof cursor === "object" ? Reflect.get(cursor, key) : undefined, value);
-var createOAuth2Client = async (providerName, config) => {
-  const meta = providers[providerName];
+var buildOAuth2Client = async (meta, config) => {
   const isConfigPropertyFunction = (cfgProp) => typeof cfgProp === "function";
   const resolveConfigProp = async (cfgProp) => {
     const result = isConfigPropertyFunction(cfgProp) ? cfgProp(config) : cfgProp;
@@ -2549,8 +2581,7 @@ var createOAuth2Client = async (providerName, config) => {
       if (state)
         url.searchParams.set("state", state);
       if (scope.length !== 0) {
-        const delimeter = providerName === "withings" ? "," : " ";
-        url.searchParams.set(meta.scopeParamName ?? "scope", scope.join(delimeter));
+        url.searchParams.set(meta.scopeParamName ?? "scope", scope.join(meta.scopeDelimiter ?? " "));
       }
       if (meta.PKCEMethod !== undefined) {
         if (!codeVerifier) {
@@ -2732,6 +2763,8 @@ var createOAuth2Client = async (providerName, config) => {
     }
   };
 };
+var createCustomOAuth2Client = (providerConfig, credentials) => buildOAuth2Client(providerConfig, credentials);
+var createOAuth2Client = (providerName, config) => buildOAuth2Client(providers[providerName], config);
 
 // src/index.ts
 import { Elysia as Elysia40 } from "elysia";
@@ -3201,7 +3234,7 @@ var authIntentOption = t2.Optional(t2.Union([
   t2.Literal("link_identity"),
   t2.Literal("link_connector")
 ]));
-var authProviderOption = t2.Enum(Object.fromEntries(Object.keys(providers).filter(isValidProviderOption).map((key) => [key, key])));
+var authProviderOption = t2.String({ minLength: 1 });
 var userSessionIdTypebox = t2.Optional(t2.TemplateLiteral("${string}-${string}-${string}-${string}-${string}"));
 
 // src/authorization/protectPermission.ts
@@ -3273,6 +3306,7 @@ var getStatus = async (session, user_session_id) => {
 };
 var instantiateUserSession = async ({
   authProvider,
+  providerConfiguration,
   cookieSecure,
   session,
   user_session_id,
@@ -3287,6 +3321,7 @@ var instantiateUserSession = async ({
 }) => {
   const authorization = resolvedAuthorization ?? await resolveOAuthAuthorization({
     authProvider,
+    providerConfiguration,
     providerInstance,
     tokenResponse
   });
@@ -3331,23 +3366,28 @@ var instantiateUserSession = async ({
 var resolveCookieSecure = (override) => override ?? false;
 var resolveOAuthAuthorization = async ({
   authProvider,
+  providerConfiguration,
   providerInstance,
   tokenResponse,
   now = Date.now()
 }) => {
+  const meta = providerConfiguration ?? (isValidProviderOption(authProvider) ? providers[authProvider] : undefined);
+  if (!meta) {
+    throw new Error(`No provider configuration for "${authProvider}" \u2014 pass providerConfiguration (custom provider) or resolvedAuthorization`);
+  }
   let userIdentity;
   let accessToken = tokenResponse.access_token;
   let refreshToken = tokenResponse.refresh_token;
   if (tokenResponse.id_token) {
     userIdentity = normalizeProviderIdentity({
       identity: decodeJWT(tokenResponse.id_token),
-      providerConfiguration: providers[authProvider],
+      providerConfiguration: meta,
       source: "idToken"
     });
-  } else if (providers[authProvider].subjectBySource?.tokenResponse) {
+  } else if (meta.subjectBySource?.tokenResponse) {
     userIdentity = normalizeProviderIdentity({
       identity: tokenResponse,
-      providerConfiguration: providers[authProvider],
+      providerConfiguration: meta,
       source: "tokenResponse"
     });
   } else if (authProvider === "withings") {
@@ -3357,7 +3397,7 @@ var resolveOAuthAuthorization = async ({
   } else {
     userIdentity = normalizeProviderIdentity({
       identity: await providerInstance.fetchUserProfile(tokenResponse.access_token),
-      providerConfiguration: providers[authProvider],
+      providerConfiguration: meta,
       source: "profile"
     });
   }
@@ -4354,6 +4394,7 @@ var DEFAULT_SMS_CODE_LENGTH = 6;
 var SMS_CODE_TTL_MINUTES = 5;
 var DEFAULT_SMS_CODE_TTL_MS = SMS_CODE_TTL_MINUTES * SECONDS_IN_A_MINUTE * MILLISECONDS_IN_A_SECOND;
 var DEFAULT_SMS_MAX_ATTEMPTS = 3;
+var DEFAULT_TOTP_MAX_ATTEMPTS = 5;
 
 // src/mfa/secret.ts
 init_crypto();
@@ -4521,7 +4562,8 @@ var mfaChallenge = ({
   sessionDurationMs = DEFAULT_MFA_SESSION_TTL_MS,
   smsCodeLength = DEFAULT_SMS_CODE_LENGTH,
   smsCodeTtlMs = DEFAULT_SMS_CODE_TTL_MS,
-  smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS
+  smsMaxAttempts = DEFAULT_SMS_MAX_ATTEMPTS,
+  totpMaxAttempts = DEFAULT_TOTP_MAX_ATTEMPTS
 }) => new Elysia13().use(sessionStore()).post(challengeRoute, async ({
   body: { action, code, factor },
   cookie: { user_session_id },
@@ -4620,12 +4662,24 @@ var mfaChallenge = ({
   if (code === undefined) {
     return status("Unauthorized", "Invalid MFA code");
   }
+  if ((enrollment.totpFailedAttempts ?? 0) >= totpMaxAttempts) {
+    await onMfaChallengeError?.({
+      error: new Error("mfa_totp_attempts_exceeded"),
+      userId: getUserId(user)
+    });
+    return status("Unauthorized", "Too many attempts");
+  }
   const totpValid = enrollment.totpVerified && enrollment.totpSecretCiphertext ? await verifyTotp({
     secret: await decryptTotpSecret(enrollment.totpSecretCiphertext, encryptionKey),
     token: code
   }) : false;
   const remainingBackupHashes = totpValid ? undefined : await consumeBackupCode(code, enrollment.backupCodeHashes);
   if (!totpValid && remainingBackupHashes === undefined) {
+    await mfaStore.saveEnrollment({
+      ...enrollment,
+      totpFailedAttempts: (enrollment.totpFailedAttempts ?? 0) + 1,
+      updatedAt: Date.now()
+    });
     await onMfaChallengeError?.({
       error: new Error("invalid_mfa_code"),
       userId: getUserId(user)
@@ -4636,6 +4690,7 @@ var mfaChallenge = ({
     ...enrollment,
     backupCodeHashes: remainingBackupHashes ?? enrollment.backupCodeHashes,
     lastUsedAt: Date.now(),
+    totpFailedAttempts: 0,
     updatedAt: Date.now()
   });
   return promote();
@@ -8252,7 +8307,52 @@ var roleRoutes = ({
 // src/providers/clients.ts
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isProviderClientConfig = (value) => isRecord(value) && ("credentials" in value);
-var buildClientProviders = async (providersConfiguration, createOAuth2ClientFn) => {
+var isCustomClientConfig = (value) => isRecord(value) && ("credentials" in value) && ("providerConfig" in value);
+var normalizeCustomClients = (providerName, providerConfig) => {
+  if (isCustomClientConfig(providerConfig))
+    return { "": providerConfig };
+  if (!isRecord(providerConfig) || Object.keys(providerConfig).length === 0) {
+    throw new Error(`Invalid custom provider configuration for ${providerName}`);
+  }
+  Object.entries(providerConfig).forEach(([clientName, clientConfig]) => {
+    if (!isCustomClientConfig(clientConfig)) {
+      throw new Error(`Invalid custom client configuration for ${providerName}.${clientName}`);
+    }
+  });
+  return providerConfig;
+};
+var buildCustomProviderGroups = async (customProviders) => {
+  const groups = await Promise.all(Object.entries(customProviders).map(async ([providerName, config]) => {
+    if (isValidProviderOption(providerName)) {
+      throw new Error(`Custom provider "${providerName}" collides with a built-in provider \u2014 configure it under providersConfiguration instead`);
+    }
+    const clients = normalizeCustomClients(providerName, config);
+    const entries = await Promise.all(Object.entries(clients).map(async ([clientName, clientConfig]) => {
+      const providerInstance = await createCustomOAuth2Client(clientConfig.providerConfig, clientConfig.credentials);
+      return [
+        clientName,
+        {
+          clientName: clientName.length > 0 ? clientName : undefined,
+          providerConfiguration: clientConfig.providerConfig,
+          providerInstance,
+          requiresPKCE: clientConfig.providerConfig.PKCEMethod !== undefined,
+          scope: clientConfig.scope,
+          searchParams: clientConfig.searchParams
+        }
+      ];
+    }));
+    return [
+      providerName,
+      {
+        entries: Object.fromEntries(entries),
+        isSingleClient: entries.length === 1 && entries[0]?.[0] === ""
+      }
+    ];
+  }));
+  return Object.fromEntries(groups);
+};
+var buildClientProviders = async (providersConfiguration, createOAuth2ClientFn, customProviders) => {
+  const customGroups = customProviders ? await buildCustomProviderGroups(customProviders) : {};
   const normalized = normalizeProvidersConfiguration(providersConfiguration);
   const groups = await Promise.all(Object.entries(normalized).map(async ([providerName, clients]) => {
     if (!isValidProviderOption(providerName)) {
@@ -8264,7 +8364,9 @@ var buildClientProviders = async (providersConfiguration, createOAuth2ClientFn)
         clientName,
         {
           clientName: clientName.length > 0 ? clientName : undefined,
+          providerConfiguration: providers[providerName],
           providerInstance,
+          requiresPKCE: providers[providerName].PKCEMethod !== undefined,
           scope: providerConfig.scope,
           searchParams: providerConfig.searchParams
         }
@@ -8278,7 +8380,7 @@ var buildClientProviders = async (providersConfiguration, createOAuth2ClientFn)
       }
     ];
   }));
-  return Object.fromEntries(groups);
+  return { ...customGroups, ...Object.fromEntries(groups) };
 };
 var normalizeClientConfig = (providerName, clientName, clientConfig) => {
   if (!isProviderClientConfig(clientConfig)) {
@@ -8414,7 +8516,13 @@ var authorize = ({
     if ("error" in resolvedProvider) {
       return status("Unauthorized", resolvedProvider.error);
     }
-    const { clientName, providerInstance, scope, searchParams } = resolvedProvider.entry;
+    const {
+      clientName,
+      providerInstance,
+      requiresPKCE,
+      scope,
+      searchParams
+    } = resolvedProvider.entry;
     const referer = parseReferer(headers["referer"]);
     const authIntent = isAuthIntent(intent) ? intent : undefined;
     origin_url.set({
@@ -8462,7 +8570,7 @@ var authorize = ({
       secure,
       value: currentState
     });
-    const codeVerifier = isPKCEProviderOption(provider) ? generateCodeVerifier() : undefined;
+    const codeVerifier = requiresPKCE ? generateCodeVerifier() : undefined;
     if (codeVerifier) {
       code_verifier.set({
         httpOnly: true,
@@ -8574,9 +8682,13 @@ var callback = ({
   if ("error" in resolvedProvider) {
     return status("Unauthorized", resolvedProvider.error);
   }
-  const { clientName, providerInstance } = resolvedProvider.entry;
+  const {
+    clientName,
+    providerConfiguration,
+    providerInstance,
+    requiresPKCE
+  } = resolvedProvider.entry;
   stored_state.remove();
-  const requiresPKCE = isPKCEProviderOption(authProvider);
   const verifier = requiresPKCE ? code_verifier.value : undefined;
   if (requiresPKCE && verifier === undefined) {
     return status("Bad Request", "Code verifier not found and is required");
@@ -8624,6 +8736,7 @@ var callback = ({
     cookie,
     currentUser,
     originUrl,
+    providerConfiguration,
     providerInstance,
     redirect,
     session: callbackSession,
@@ -23203,6 +23316,7 @@ var mfaEnrollmentsTable = pgTable("auth_mfa_enrollments", {
   sms_pending_code_hash: text("sms_pending_code_hash"),
   sms_phone: varchar("sms_phone", { length: PHONE_LENGTH }),
   sms_verified: boolean("sms_verified").notNull().default(false),
+  totp_failed_attempts: smallint("totp_failed_attempts").notNull().default(0),
   totp_secret_ciphertext: text("totp_secret_ciphertext"),
   totp_verified: boolean("totp_verified").notNull().default(false),
   updated_at_ms: bigint("updated_at_ms", { mode: "number" }).notNull(),
@@ -23217,6 +23331,7 @@ var toEnrollment = (row) => ({
   smsPendingCodeHash: row.sms_pending_code_hash ?? undefined,
   smsPhone: row.sms_phone ?? undefined,
   smsVerified: row.sms_verified,
+  totpFailedAttempts: row.totp_failed_attempts,
   totpSecretCiphertext: row.totp_secret_ciphertext ?? undefined,
   totpVerified: row.totp_verified,
   updatedAt: row.updated_at_ms,
@@ -23245,6 +23360,7 @@ var createPostgresMfaStore = (db) => ({
       sms_pending_code_hash: enrollment.smsPendingCodeHash ?? null,
       sms_phone: enrollment.smsPhone ?? null,
       sms_verified: enrollment.smsVerified,
+      totp_failed_attempts: enrollment.totpFailedAttempts ?? 0,
       totp_secret_ciphertext: enrollment.totpSecretCiphertext ?? null,
       totp_verified: enrollment.totpVerified,
       updated_at_ms: enrollment.updatedAt,
@@ -26573,6 +26689,10 @@ var mfaSmsColumnsMigration = {
   ].join(`
 `)
 };
+var mfaTotpLockoutMigration = {
+  id: "0003_totp_lockout",
+  sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "totp_failed_attempts" smallint NOT NULL DEFAULT 0;'
+};
 var blockMigrations = {
   adaptive: initMigration("adaptive", [knownDevicesTable, loginHistoryTable]),
   apikeys: initMigration("apikeys", [
@@ -26596,7 +26716,8 @@ var blockMigrations = {
     block: "mfa",
     migrations: [
       ...initMigration("mfa", [mfaEnrollmentsTable]).migrations,
-      mfaSmsColumnsMigration
+      mfaSmsColumnsMigration,
+      mfaTotpLockoutMigration
     ]
   },
   oidc: initMigration("oidc", [
@@ -27310,6 +27431,7 @@ var auth = async ({
   authSessionStore,
   audit,
   credentials,
+  customProviders,
   mfa,
   passwordless,
   lockout,
@@ -27347,7 +27469,7 @@ var auth = async ({
 }) => {
   if (tracing !== undefined)
     await initTracing(tracing);
-  const clientProviders = await buildClientProviders(providersConfiguration, createOAuth2Client);
+  const clientProviders = await buildClientProviders(providersConfiguration, createOAuth2Client, customProviders);
   const resolvedCookieSecure = resolveCookieSecure(cookieSecure);
   const webhookDispatch = webhooks ? createWebhookDispatcher(webhooks) : undefined;
   const auditEmit = audit || webhookDispatch ? createAuditEmitter({
@@ -27677,6 +27799,7 @@ export {
   deleteRegisteredClient,
   defineScimAttributeMap,
   defineProvidersConfiguration,
+  defineProvider,
   defineAuthSettings,
   defineAuthHtmxConfig,
   defineAuthConfig,
@@ -27822,6 +27945,7 @@ export {
   createInMemoryAccessTokenStore,
   createFgaEngine,
   createFederatedTokenStore,
+  createCustomOAuth2Client,
   createCredentialOffer,
   createAuthHtmxRoutes,
   createAuditRedactor,
@@ -27872,6 +27996,7 @@ export {
   DEFAULT_VP_ROUTE,
   DEFAULT_VERIFICATION_TOKEN_TTL_MS,
   DEFAULT_VCI_ROUTE,
+  DEFAULT_TOTP_MAX_ATTEMPTS,
   DEFAULT_TOKEN_ROUTE,
   DEFAULT_STATUS_ROUTE,
   DEFAULT_SSO_SESSION_TTL_MS,
@@ -27903,5 +28028,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=178CE4DFADBEB75764756E2164756E21
+//# debugId=CF57DC7D601D3EC464756E2164756E21
 //# sourceMappingURL=index.js.map