@absolutejs/auth 0.70.0 → 0.72.0

package/dist/server.d.ts

@@ -16,6 +16,8 @@ export { createPostgresSetupSessionStore } from './portal/postgresSetupSessionSt
 export { protectRoutePlugin } from './routes/protectRoute';
 export { readSessionCookie } from './session/cookieReader';
 export { requireAuthPlugin } from './routes/requireAuth';
+export { createAbsoluteAuthSyncBridge, type AbsoluteAuthSyncBridge, type AbsoluteAuthSyncContext } from './syncBridge';
+export { deriveAuthSyncNamespace } from './syncNamespace';
 export type { ScimConfig } from './scim/config';
 export type { ScimFilter, ScimGroup, ScimGroupInput, ScimTokenStore, ScimUser, ScimUserInput } from './scim/types';
 export { createPostgresScimTokenStore } from './scim/postgresScimTokenStore';

package/dist/server.js

@@ -5771,6 +5771,118 @@ var stepUpPlugin = ({
   })
 })).as("global");
 
+// src/oidc/socketTickets.ts
+init_crypto();
+var DEFAULT_SOCKET_TICKET_TTL_MS = 30000;
+var TICKET_BYTES = 32;
+var consumeSocketTicket = async ({
+  audience,
+  getUser,
+  now = Date.now(),
+  store,
+  ticket
+}) => {
+  const record = await store.consumeTicket(await hashToken(ticket), now);
+  if (!record || record.audience !== audience)
+    return;
+  const user = await getUser(record.subject);
+  if (user === null)
+    return;
+  return {
+    audience: record.audience,
+    clientId: record.clientId,
+    kind: "access-token",
+    scopes: [...record.scopes],
+    subject: record.subject,
+    user
+  };
+};
+var issueSocketTicket = async ({
+  audience,
+  clientId,
+  now = Date.now(),
+  scopes,
+  store,
+  subject,
+  ttlMs = DEFAULT_SOCKET_TICKET_TTL_MS
+}) => {
+  if (!Number.isFinite(ttlMs) || ttlMs <= 0)
+    throw new Error("socketTicketTtlMs must be positive");
+  const ticket = `ast_${generateSecureToken(TICKET_BYTES)}`;
+  await store.saveTicket({
+    audience,
+    clientId,
+    expiresAt: now + ttlMs,
+    scopes: [...scopes],
+    subject,
+    ticketHash: await hashToken(ticket)
+  });
+  return { expiresInMs: ttlMs, ticket };
+};
+
+// src/syncNamespace.ts
+var base64Url2 = (value) => {
+  let binary = "";
+  for (const byte of value)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+};
+var deriveAuthSyncNamespace = async ({
+  clientId,
+  issuer,
+  partition,
+  subject
+}) => {
+  if (clientId.length === 0 || issuer.length === 0 || subject.length === 0)
+    throw new TypeError("Auth Sync namespace requires issuer, clientId, and subject.");
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify([issuer, clientId, subject, partition ?? null])));
+  return `auth:v1:${base64Url2(new Uint8Array(digest))}`;
+};
+var readAuthSyncPartition = (user) => {
+  if (typeof user !== "object" || user === null)
+    return;
+  const value = Reflect.get(user, "absolutejs_sync_partition");
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+};
+
+// src/syncBridge.ts
+var PWA_SYNC_CLIENT_ID = "@absolutejs/pwa";
+var toSyncContext = (authPrincipal) => authPrincipal ? { authPrincipal, user: authPrincipal.user } : undefined;
+var isSessionAuthPrincipal = (value) => typeof value === "object" && value !== null && Reflect.get(value, "kind") === "session" && typeof Reflect.get(value, "subject") === "string" && Reflect.get(value, "subject").length > 0 && Reflect.has(value, "user");
+var createAbsoluteAuthSyncBridge = (accessTokens) => ({
+  consumeSocketTicket: async ({ audience, ticket }) => {
+    const store = accessTokens.oidc.socketTicketStore;
+    if (!store)
+      return;
+    return toSyncContext(await consumeSocketTicket({
+      audience: audience ?? accessTokens.oidc.issuer,
+      getUser: accessTokens.getUser,
+      store,
+      ticket
+    }));
+  },
+  resolveBearer: async ({ authorization }) => toSyncContext(await resolveAccessTokenPrincipal({
+    authorization,
+    config: accessTokens
+  })),
+  resolveSession: async ({ authPrincipal }) => {
+    if (!isSessionAuthPrincipal(authPrincipal))
+      return;
+    const context = toSyncContext(authPrincipal);
+    if (!context)
+      return;
+    return {
+      context,
+      namespace: await deriveAuthSyncNamespace({
+        clientId: PWA_SYNC_CLIENT_ID,
+        issuer: accessTokens.oidc.issuer,
+        partition: readAuthSyncPartition(authPrincipal.user),
+        subject: authPrincipal.subject
+      })
+    };
+  }
+});
+
 // src/authContext.ts
 var createAuthContext = ({
   agentAuth,
@@ -5779,19 +5891,27 @@ var createAuthContext = ({
   authorization,
   emit,
   seedSource
-}) => new Elysia8({
-  name: "@absolutejs/auth/context",
-  seed: pluginDependencySeed(seedSource)
-}).use([
-  protectRoutePlugin({ accessTokens, authSessionStore }),
-  stepUpPlugin({ authSessionStore }),
-  authorization ? protectPermissionPlugin({
-    ...authorization,
-    authSessionStore,
-    emit
-  }) : new Elysia8,
-  agentAuthContextPlugin(agentAuth)
-]);
+}) => {
+  const absoluteAuthSync = accessTokens ? createAbsoluteAuthSyncBridge(accessTokens) : undefined;
+  const syncBridge = new Elysia8({
+    name: "@absolutejs/auth/sync-bridge",
+    seed: pluginDependencySeed(seedSource)
+  }).decorate("absoluteAuthSync", absoluteAuthSync).as("global");
+  return new Elysia8({
+    name: "@absolutejs/auth/context",
+    seed: pluginDependencySeed(seedSource)
+  }).use([
+    syncBridge,
+    protectRoutePlugin({ accessTokens, authSessionStore }),
+    stepUpPlugin({ authSessionStore }),
+    authorization ? protectPermissionPlugin({
+      ...authorization,
+      authSessionStore,
+      emit
+    }) : new Elysia8,
+    agentAuthContextPlugin(agentAuth)
+  ]);
+};
 
 // src/compliance/routes.ts
 import { Elysia as Elysia9, t as t6 } from "elysia";
@@ -9406,57 +9526,6 @@ var updateRegisteredClient = async ({
 
 // src/oidc/socketTicketRoutes.ts
 import { Elysia as Elysia22, t as t15 } from "elysia";
-
-// src/oidc/socketTickets.ts
-init_crypto();
-var DEFAULT_SOCKET_TICKET_TTL_MS = 30000;
-var TICKET_BYTES = 32;
-var consumeSocketTicket = async ({
-  audience,
-  getUser,
-  now = Date.now(),
-  store,
-  ticket
-}) => {
-  const record = await store.consumeTicket(await hashToken(ticket), now);
-  if (!record || record.audience !== audience)
-    return;
-  const user = await getUser(record.subject);
-  if (user === null)
-    return;
-  return {
-    audience: record.audience,
-    clientId: record.clientId,
-    kind: "access-token",
-    scopes: [...record.scopes],
-    subject: record.subject,
-    user
-  };
-};
-var issueSocketTicket = async ({
-  audience,
-  clientId,
-  now = Date.now(),
-  scopes,
-  store,
-  subject,
-  ttlMs = DEFAULT_SOCKET_TICKET_TTL_MS
-}) => {
-  if (!Number.isFinite(ttlMs) || ttlMs <= 0)
-    throw new Error("socketTicketTtlMs must be positive");
-  const ticket = `ast_${generateSecureToken(TICKET_BYTES)}`;
-  await store.saveTicket({
-    audience,
-    clientId,
-    expiresAt: now + ttlMs,
-    scopes: [...scopes],
-    subject,
-    ticketHash: await hashToken(ticket)
-  });
-  return { expiresInMs: ttlMs, ticket };
-};
-
-// src/oidc/socketTicketRoutes.ts
 var noStoreJson = (value, status) => new Response(JSON.stringify(value), {
   headers: {
     "cache-control": "no-store",
@@ -41377,15 +41446,17 @@ export {
   isUserSessionId,
   instantiateUserSession,
   extractPropFromIdentity,
+  deriveAuthSyncNamespace,
   createSetupSession,
   createPostgresSsoConnectionStore,
   createPostgresSetupSessionStore,
   createPostgresScimTokenStore,
   createNodeSamlAdapter,
   createAuthContext,
+  createAbsoluteAuthSyncBridge,
   auth2 as auth,
   VerificationProviderError
 };
 
-//# debugId=09854CD88815EF0764756E2164756E21
+//# debugId=34B819C8B800408C64756E2164756E21
 //# sourceMappingURL=server.js.map