@absolutejs/auth 0.57.6 → 0.57.8

package/dist/cli/migrate.js

@@ -685,17 +685,23 @@ var providers = defineProviders({
   },
   apple: {
     authorizationUrl: "https://appleid.apple.com/auth/authorize",
+    createAuthorizationURLSearchParams: {
+      response_mode: "form_post"
+    },
+    createClientSecret: (config) => createAppleClientSecret(config),
     isOIDC: true,
     isRefreshable: true,
-    PKCEMethod: "S256",
-    profileRequest: {
-      authIn: "header",
-      encoding: "application/json",
-      method: "GET",
-      url: "https://appleid.apple.com/auth/userinfo"
+    revocationRequest: {
+      authIn: "body",
+      encoding: "application/x-www-form-urlencoded",
+      tokenParamName: "token",
+      url: "https://appleid.apple.com/auth/revoke"
     },
     scopeRequired: false,
-    subject: ["id"],
+    subject: ["sub"],
+    subjectBySource: {
+      idToken: ["sub"]
+    },
     subjectType: "string",
     tokenRequest: {
       authIn: "body",
@@ -764,6 +770,7 @@ var providers = defineProviders({
         token_type_hint: "refresh_token"
       }),
       encoding: "application/json",
+      inputSource: "refreshToken",
       tokenParamName: "token",
       url: (config) => `https://${config.domain}/oauth/revoke`
     },
@@ -1895,6 +1902,7 @@ var providers = defineProviders({
         token_type_hint: "refresh_token"
       }),
       encoding: "application/json",
+      inputSource: "refreshToken",
       url: "https://www.reddit.com/api/v1/revoke_token"
     },
     scopeRequired: true,
@@ -2268,49 +2276,27 @@ var providers = defineProviders({
     authorizationUrl: "https://account.withings.com/oauth2_user/authorize2",
     isOIDC: false,
     isRefreshable: true,
-    profileRequest: {
-      authIn: "header",
-      body: async (config) => {
-        const props = await getWithingsProps(config);
-        if (props === undefined)
-          throw new Error("Failed to get Withings search properties");
-        const { nonce, hashedSignature } = props;
-        return [
-          ["action", "getuser"],
-          ["nonce", nonce],
-          ["client_id", config.clientId],
-          ["signature", hashedSignature]
-        ];
-      },
-      encoding: "application/x-www-form-urlencoded",
-      method: "POST",
-      url: "https://wbsapi.withings.net/v2/oauth2"
-    },
     refreshAccessTokenBody: {
       action: "requesttoken"
     },
     revocationRequest: {
-      authIn: "header",
-      body: async (config) => {
-        const props = await getWithingsProps(config);
-        if (!props)
-          throw new Error("Failed to get Withings props");
-        const { nonce, hashedSignature } = props;
-        return [
-          ["action", "revoke"],
-          ["client_id", config.clientId],
-          ["nonce", nonce],
-          ["signature", hashedSignature]
-        ];
-      },
+      authIn: "body",
+      body: (config) => getWithingsSignatureParams(config, "revoke"),
       encoding: "application/x-www-form-urlencoded",
-      method: "POST",
-      url: "https://wbsapi.withings.net/v2/oauth2"
+      includeClientCredentials: false,
+      inputSource: "subject",
+      inputType: "number",
+      tokenParamName: "userid",
+      url: "https://wbsapi.withings.net/v2/oauth2",
+      validateResponse: (value) => assertWithingsSuccess(value)
     },
     scopeDelimiter: ",",
     scopeRequired: true,
     subject: ["userid"],
-    subjectType: "string",
+    subjectBySource: {
+      tokenResponse: ["body", "userid"]
+    },
+    subjectType: "number",
     tokenRequest: {
       authIn: "body",
       encoding: "application/x-www-form-urlencoded",
@@ -2469,6 +2455,7 @@ var providers = defineProviders({
     }
   }
 });
+var isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value) && Object.prototype.toString.call(value) === "[object Object]";
 var isOIDCProviderOption = (option) => {
   if (!isValidProviderOption(option))
     return false;
@@ -2481,6 +2468,12 @@ var isPKCEProviderOption = (option) => {
   const provider = providers[option];
   return provider.PKCEMethod !== undefined;
 };
+var isProfileProviderOption = (option) => {
+  if (!isValidProviderOption(option))
+    return false;
+  const provider = providers[option];
+  return provider.profileRequest !== undefined;
+};
 var isRefreshableProviderOption = (option) => {
   if (!isValidProviderOption(option))
     return false;
@@ -2500,6 +2493,28 @@ var isScopeRequiredProviderOption = (option) => {
   return provider.scopeRequired;
 };
 var isValidProviderOption = (option) => Object.hasOwn(providers, option);
+var assertWithingsSuccess = (value) => {
+  if (!isObject(value) || value.status !== 0) {
+    const status = isObject(value) ? value.status : "invalid response";
+    const detail = isObject(value) && typeof value.error === "string" ? `: ${value.error}` : "";
+    throw new Error(`Withings request failed (${String(status)})${detail}`);
+  }
+};
+var createOAuth2FetchError = async (response) => {
+  const clone = response.clone();
+  const prefix = `HTTP ${response.status} ${response.statusText} for ${response.url}`;
+  const payload = await response.json().catch(() => null);
+  if (payload && typeof payload === "object" && Object.keys(payload).length) {
+    return new Error(`${prefix}
+${JSON.stringify(payload)}`);
+  }
+  const text3 = await clone.text().catch(() => "");
+  if (text3) {
+    return new Error(`${prefix}
+${text3}`);
+  }
+  return new Error(prefix);
+};
 var encodeBase64 = (input) => {
   let raw;
   if (typeof input === "string") {
@@ -2510,25 +2525,31 @@ var encodeBase64 = (input) => {
   }
   return btoa(raw);
 };
-var getWithingsProps = async (config) => {
+var getWithingsSignatureParams = async (config, action) => {
   const timestamp = Math.floor(Date.now() / 1000);
-  const signature = `getnonce,${config.clientId},${timestamp}`;
-  const hashedSignature = await hmacSha256(signature, config.clientSecret);
+  const nonceSignature = await hmacSha256(`getnonce,${config.clientId},${timestamp}`, config.clientSecret);
   const nonceUrl = new URL("https://wbsapi.withings.net/v2/signature");
   nonceUrl.searchParams.set("action", "getnonce");
   nonceUrl.searchParams.set("client_id", config.clientId);
   nonceUrl.searchParams.set("timestamp", timestamp.toString());
-  nonceUrl.searchParams.set("signature", hashedSignature);
+  nonceUrl.searchParams.set("signature", nonceSignature);
   const nonceTarget = nonceUrl.toString();
   const nonceResponse = await fetch(nonceTarget, { method: "POST" });
+  if (!nonceResponse.ok) {
+    throw await createOAuth2FetchError(nonceResponse);
+  }
   const nonceData = await nonceResponse.json();
-  if (nonceData.status === 0) {
-    return {
-      hashedSignature,
-      nonce: nonceData.body.nonce
-    };
+  if (!isObject(nonceData) || nonceData.status !== 0 || !isObject(nonceData.body) || typeof nonceData.body.nonce !== "string" || nonceData.body.nonce.length === 0) {
+    throw new Error("Withings returned an invalid nonce response");
   }
-  return;
+  const { nonce } = nonceData.body;
+  const signature = await hmacSha256(`${action},${config.clientId},${nonce}`, config.clientSecret);
+  return {
+    action,
+    client_id: config.clientId,
+    nonce,
+    signature
+  };
 };
 var hmacSha256 = async (message, secret) => {
   const encoder = new TextEncoder;
@@ -2536,6 +2557,13 @@ var hmacSha256 = async (message, secret) => {
   const sigBuffer = await crypto.subtle.sign("HMAC", key, encoder.encode(message));
   return Array.from(new Uint8Array(sigBuffer)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
 };
+var DAYS_IN_APPLE_CLIENT_SECRET_LIFETIME = 180;
+var HOURS_PER_DAY = 24;
+var MINUTES_PER_HOUR = 60;
+var SECONDS_PER_MINUTE = 60;
+var APPLE_CLIENT_SECRET_LIFETIME_SECONDS = SECONDS_PER_MINUTE * MINUTES_PER_HOUR * HOURS_PER_DAY * DAYS_IN_APPLE_CLIENT_SECRET_LIFETIME;
+var APPLE_ISSUER = "https://appleid.apple.com";
+var MILLISECONDS_PER_SECOND = 1000;
 var createRandomBase64UrlGenerator = (length) => () => {
   const buffer = crypto.getRandomValues(new Uint8Array(length));
   return base64Url(buffer);
@@ -2543,8 +2571,29 @@ var createRandomBase64UrlGenerator = (length) => () => {
 var generateCodeVerifier = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
 var generateState = createRandomBase64UrlGenerator(NUM_GENERATOR_BYTES);
 var base64Url = (input) => encodeBase64(input).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var encodeJwtPart = (value) => base64Url(new TextEncoder().encode(JSON.stringify(value)));
+var createAppleClientSecret = async (credentials) => {
+  const issuedAt = Math.floor(Date.now() / MILLISECONDS_PER_SECOND);
+  const header = encodeJwtPart({
+    alg: "ES256",
+    kid: credentials.keyId,
+    typ: "JWT"
+  });
+  const payload = encodeJwtPart({
+    aud: APPLE_ISSUER,
+    exp: issuedAt + APPLE_CLIENT_SECRET_LIFETIME_SECONDS,
+    iat: issuedAt,
+    iss: credentials.teamId,
+    sub: credentials.clientId
+  });
+  const signingInput = `${header}.${payload}`;
+  const privateKey = await crypto.subtle.importKey("pkcs8", Uint8Array.from(credentials.pkcs8PrivateKey), { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign({ hash: "SHA-256", name: "ECDSA" }, privateKey, new TextEncoder().encode(signingInput));
+  return `${signingInput}.${base64Url(signature)}`;
+};
 var oidcProviderOptions = Object.keys(providers).filter(isOIDCProviderOption);
 var pkceProviderOptions = Object.keys(providers).filter(isPKCEProviderOption);
+var profileProviderOptions = Object.keys(providers).filter(isProfileProviderOption);
 var providerOptions = Object.keys(providers).filter(isValidProviderOption);
 var refreshableProviderOptions = Object.keys(providers).filter(isRefreshableProviderOption);
 var revocableProviderOptions = Object.keys(providers).filter(isRevocableProviderOption);
@@ -2893,6 +2942,7 @@ var authSessionsTable = pgTable16("auth_sessions", {
   created_at: timestamp2("created_at").notNull().defaultNow(),
   expires_at_ms: bigint14("expires_at_ms", { mode: "number" }).notNull(),
   id: varchar16("id", { length: 255 }).primaryKey(),
+  oauth_subject_json: jsonb8("oauth_subject_json").$type(),
   refresh_token: text6("refresh_token"),
   updated_at: timestamp2("updated_at").notNull().defaultNow(),
   user_json: jsonb8("user_json").$type().notNull()
@@ -2902,6 +2952,7 @@ var authUnregisteredSessionsTable = pgTable16("auth_unregistered_sessions", {
   created_at: timestamp2("created_at").notNull().defaultNow(),
   expires_at_ms: bigint14("expires_at_ms", { mode: "number" }).notNull(),
   id: varchar16("id", { length: 255 }).primaryKey(),
+  oauth_subject_json: jsonb8("oauth_subject_json").$type(),
   refresh_token: text6("refresh_token"),
   session_information_json: jsonb8("session_information_json").$type(),
   updated_at: timestamp2("updated_at").notNull().defaultNow(),
@@ -3100,30 +3151,40 @@ var JOURNAL_DDL = `CREATE TABLE IF NOT EXISTS "auth_migrations" (
 var isJournalRow = (value) => typeof value === "object" && value !== null && typeof Reflect.get(value, "id") === "string";
 var isBlockName = (value) => Object.hasOwn(blockMigrations, value);
 var allBlockNames = () => Object.keys(blockMigrations).filter(isBlockName);
-var applyOne = async (pool, id, sql, log) => {
-  await pool.query(sql);
-  await pool.query(`INSERT INTO "auth_migrations" ("id", "applied_at_ms") VALUES ($1, $2)`, [id, Date.now()]);
+var applyOne = async (client, id, sql, log) => {
+  await client.query(sql);
+  await client.query(`INSERT INTO "auth_migrations" ("id", "applied_at_ms") VALUES ($1, $2)`, [id, Date.now()]);
   log(`apply  ${id}`);
 };
-var runOne = async (pool, id, sql, applied, result, log) => {
+var runOne = async (client, id, sql, applied, result, log) => {
   if (applied.has(id)) {
     result.skipped.push(id);
     log(`skip   ${id}`);
     return;
   }
-  await applyOne(pool, id, sql, log);
+  await applyOne(client, id, sql, log);
   result.applied.push(id);
 };
 var runMigrations = async ({
   blocks,
+  client,
   databaseUrl,
   log = console.log
 }) => {
-  const pool = new Pool({ connectionString: databaseUrl });
+  let ownedPool;
+  let migrationClient;
+  if (client !== undefined) {
+    migrationClient = client;
+  } else {
+    if (databaseUrl === undefined)
+      throw new Error("runMigrations requires databaseUrl or client");
+    ownedPool = new Pool({ connectionString: databaseUrl });
+    migrationClient = ownedPool;
+  }
   const result = { applied: [], skipped: [] };
   try {
-    await pool.query(JOURNAL_DDL);
-    const journal = await pool.query(`SELECT "id" FROM "auth_migrations"`);
+    await migrationClient.query(JOURNAL_DDL);
+    const journal = await migrationClient.query(`SELECT "id" FROM "auth_migrations"`);
     const applied = new Set(journal.rows.filter(isJournalRow).map((row) => row.id));
     const selected = blocks ?? allBlockNames();
     const flat = selected.flatMap((block) => blockMigrations[block].migrations.map((migration) => ({
@@ -3132,10 +3193,10 @@ var runMigrations = async ({
     })));
     await flat.reduce(async (prior, item) => {
       await prior;
-      return runOne(pool, item.id, item.sql, applied, result, log);
+      return runOne(migrationClient, item.id, item.sql, applied, result, log);
     }, Promise.resolve());
   } finally {
-    await pool.end();
+    await ownedPool?.end();
   }
   return result;
 };
@@ -3168,6 +3229,14 @@ var oidcResourceAudienceMigration = {
   ].join(`
 `)
 };
+var sessionOAuthSubjectMigration = {
+  id: "0002_oauth_subject",
+  sql: [
+    'ALTER TABLE "auth_sessions" ADD COLUMN IF NOT EXISTS "oauth_subject_json" jsonb;',
+    'ALTER TABLE "auth_unregistered_sessions" ADD COLUMN IF NOT EXISTS "oauth_subject_json" jsonb;'
+  ].join(`
+`)
+};
 var blockMigrations = {
   adaptive: initMigration("adaptive", [knownDevicesTable, loginHistoryTable]),
   agents: {
@@ -3236,10 +3305,16 @@ var blockMigrations = {
   portal: initMigration("portal", [setupSessionsTable]),
   roles: initMigration("roles", [rolesTable]),
   scim: initMigration("scim", [scimTokensTable]),
-  sessions: initMigration("sessions", [
-    authSessionsTable,
-    authUnregisteredSessionsTable
-  ]),
+  sessions: {
+    block: "sessions",
+    migrations: [
+      ...initMigration("sessions", [
+        authSessionsTable,
+        authUnregisteredSessionsTable
+      ]).migrations,
+      sessionOAuthSubjectMigration
+    ]
+  },
   sso: initMigration("sso", [ssoConnectionsTable, samlServiceProvidersTable]),
   vault: initMigration("vault", [vaultEntriesTable]),
   vc: initMigration("vc", [
@@ -3437,5 +3512,5 @@ var main = async () => {
 };
 await main();
 
-//# debugId=F5FC77C8DEF0189164756E2164756E21
+//# debugId=D9CB4120E36FA20E64756E2164756E21
 //# sourceMappingURL=migrate.js.map