@aiquants/auth-react-router 0.1.1

package/src/server/authenticate-in-loader.ts

@@ -0,0 +1,148 @@
+/**
+ * @module authenticate-in-loader
+ * @description Per-request loader authentication guard with photo cache and warmup.
+ * 写真キャッシュとウォームアップ付きの毎リクエストローダー認証ガード。
+ *
+ * 原本 (quants-react-router authenticateInLoader.server.ts) を挙動保存で移植。
+ * DB クエリ (getOpenids) は `getUserPhoto` ポートへ、DB プールウォームアップは `warmup`
+ * ポートへ置き換えた。写真キャッシュ (Map + pending dedup) はファクトリインスタンスごとに
+ * 保持する (module-level mutable state の排除)。
+ */
+import type { AuthenticationPayload, MyGoogleProfile, SessionProfile } from "@aiquants/auth-core"
+import { redirect } from "react-router"
+import type { AuthenticateFns } from "./authenticate"
+import type { AuthServerConfig, LoggerPort } from "./ports"
+import type { AuthSessionStorage } from "./session"
+
+/** createAuthenticateInLoader が返すローダーガード関数。 */
+export type AuthenticateInLoader = ReturnType<typeof createAuthenticateInLoader>
+
+/**
+ * Builds the per-request loader guard wired to injected ports.
+ * 注入ポートに結線した毎リクエストローダーガードを生成する。
+ */
+export const createAuthenticateInLoader = (config: AuthServerConfig, storage: AuthSessionStorage, authFns: AuthenticateFns, logger: LoggerPort) => {
+    // 写真キャッシュ (インスタンススコープ。同時リクエストは pending dedup で 1 クエリに集約)
+    const openidPhotoCache = new Map<string, string>()
+    const pendingOpenidPhotoQueries = new Map<string, Promise<string>>()
+
+    /**
+     * Resolves the user photo with cache + in-flight dedup, delegating the query to the port.
+     * キャッシュ + 実行中 dedup 付きでユーザー写真を解決する (実クエリはポートへ委譲)。
+     */
+    const getCachedOpenidPhoto = async (openid: string): Promise<string> => {
+        const cached = openidPhotoCache.get(openid)
+        if (cached !== undefined) {
+            return cached
+        }
+
+        const pending = pendingOpenidPhotoQueries.get(openid)
+        if (pending !== undefined) {
+            return pending
+        }
+
+        const fetchPromise = (async () => {
+            try {
+                const photo = config.getUserPhoto ? await config.getUserPhoto(openid) : ""
+                openidPhotoCache.set(openid, photo)
+                return photo
+            } catch (error) {
+                openidPhotoCache.delete(openid)
+                throw error
+            } finally {
+                pendingOpenidPhotoQueries.delete(openid)
+            }
+        })()
+
+        pendingOpenidPhotoQueries.set(openid, fetchPromise)
+        return fetchPromise
+    }
+
+    /**
+     * Handles authentication within loader requests by refreshing session tokens when needed.
+     * ローダーリクエスト内で必要に応じてセッショントークンを更新する認証処理。
+     *
+     * @param request - リクエストオブジェクト。
+     * @param options - 認証オプション。`failureRedirect: null` でリダイレクトを明示的にスキップ。
+     * @returns 認証済みユーザープロファイルとオプショナルな Set-Cookie 値。
+     */
+    const authenticateInLoader = async (request: Request, options: { failureRedirect: string } | { failureRedirect: null }): Promise<{ user?: MyGoogleProfile; cookie?: string }> => {
+        // DB 接続プールが確実にオープンするのを待ってから処理を開始する (E2E 等でのコールドスタート競合回避)
+        if (config.warmup) {
+            await config.warmup()
+        }
+
+        const { failureRedirect } = options
+        const session = await storage.getSession(request)
+        const currentUser = await storage.getSessionUser(request)
+
+        if (currentUser === undefined) {
+            if (failureRedirect === null) {
+                return {}
+            }
+            throw redirect(failureRedirect)
+        }
+
+        try {
+            // トークンの有効期限を確認し、必要に応じて更新
+            const authenticatedTokens = await authFns.authenticate(request, session, {
+                failureRedirect: failureRedirect ?? undefined,
+            })
+
+            // 認証ペイロードの構築
+            const authenticationPayload: AuthenticationPayload = {
+                accessToken: authenticatedTokens.accessToken,
+                refreshToken: authenticatedTokens.refreshToken,
+                expirationDateMs: authenticatedTokens.expirationDateMs,
+                provider: currentUser.provider,
+            }
+            // セッション内のユーザ情報
+            const updatedSessionUser: SessionProfile = {
+                id: currentUser.id,
+                displayName: currentUser.displayName,
+                name: currentUser.name,
+                emails: currentUser.emails,
+                ...authenticationPayload,
+                role: currentUser.role,
+            }
+
+            // ユーザー写真をキャッシュまたはポートから取得
+            const photo = await getCachedOpenidPhoto(currentUser.id)
+
+            // ユーザープロファイル情報
+            const updatedUser: MyGoogleProfile = {
+                ...currentUser,
+                ...authenticationPayload,
+                photo,
+            }
+
+            // トークンが更新 (リフレッシュ) された場合のみ、セッションを保存して Cookie ヘッダーを設定する
+            const isRefreshed = authenticatedTokens.accessToken !== currentUser.accessToken
+            const cookie = isRefreshed ? await storage.saveSession(request, updatedSessionUser) : undefined
+
+            return { user: updatedUser, cookie }
+        } catch (error) {
+            if (error instanceof Response && error.headers.get("Location")) {
+                throw error
+            }
+            logger.error("Error in authenticateInLoader:", error)
+            // 認証エラー時はセッションを破棄してリダイレクト
+            if (failureRedirect !== null) {
+                // セッション破棄のみを try で保護する。redirect の throw を try 内に置くと
+                // 同じ catch(destroyError) に捕捉されて Set-Cookie 無しの fallback に差し替わってしまうため、
+                // throw redirect は必ず try の外で行う。
+                let destroyedCookie: string | undefined
+                try {
+                    destroyedCookie = await storage.destroySession(session)
+                } catch (destroyError) {
+                    logger.error("Failed to destroy session during auth error:", destroyError)
+                }
+                // 破棄に成功していれば Set-Cookie を付与し、失敗してもとにかくリダイレクトは試みる
+                throw destroyedCookie !== undefined ? redirect(failureRedirect, { headers: { "Set-Cookie": destroyedCookie } }) : redirect(failureRedirect)
+            }
+            throw error
+        }
+    }
+
+    return authenticateInLoader
+}

package/src/server/authenticate.spec.ts

@@ -0,0 +1,146 @@
+/**
+ * Tests for the token guard and Google refresh rotation.
+ * トークンガードと Google リフレッシュ更新のテスト。
+ */
+import type { SessionProfile } from "@aiquants/auth-core"
+import { afterEach, describe, expect, it, vi } from "vitest"
+import { createAuthenticate } from "./authenticate"
+import type { AuthServerConfig, LoggerPort } from "./ports"
+import { createAuthSessionStorage } from "./session"
+
+const silentLogger: LoggerPort = { info: () => {}, warn: () => {}, error: () => {} }
+
+const baseConfig: AuthServerConfig = {
+    google: { clientId: "cid", clientSecret: "csec", redirectURI: "http://localhost/auth/api/google/callback" },
+    session: { secrets: ["test-secret"] },
+    isEmailAllowed: () => true,
+    logger: silentLogger,
+}
+
+const profile: SessionProfile = {
+    id: "1",
+    displayName: "User",
+    name: { familyName: "F", givenName: "G" },
+    emails: [{ value: "u@example.com" }],
+    accessToken: "at",
+    refreshToken: "rt",
+    expirationDateMs: Date.now() + 3600000,
+    provider: "google",
+}
+
+const setup = async (user?: SessionProfile, config: AuthServerConfig = baseConfig) => {
+    const storage = createAuthSessionStorage(config.session, { mockUser: config.mockUser })
+    const request = new Request("http://localhost/")
+    const session = await storage.getSession(request)
+    if (user) {
+        session.set("user", user)
+    }
+    const fns = createAuthenticate(config, storage, silentLogger)
+    return { storage, request, session, fns }
+}
+
+afterEach(() => {
+    vi.unstubAllGlobals()
+})
+
+describe("authenticate", () => {
+    it("returns tokens unchanged while not expired", async () => {
+        const { fns, request, session } = await setup(profile)
+        const tokens = await fns.authenticate(request, session)
+        expect(tokens).toEqual({ accessToken: "at", refreshToken: "rt", expirationDateMs: profile.expirationDateMs })
+    })
+
+    it("redirects to the login path when the session has no tokens", async () => {
+        const { fns, request, session } = await setup()
+        try {
+            await fns.authenticate(request, session)
+            expect.unreachable("should have thrown a redirect")
+        } catch (error) {
+            expect(error).toBeInstanceOf(Response)
+            expect((error as Response).headers.get("Location")).toBe("/auth/login")
+        }
+    })
+
+    it("honors failureRedirect for missing tokens", async () => {
+        const { fns, request, session } = await setup()
+        try {
+            await fns.authenticate(request, session, { failureRedirect: "/custom" })
+            expect.unreachable("should have thrown a redirect")
+        } catch (error) {
+            expect((error as Response).headers.get("Location")).toBe("/custom")
+        }
+    })
+
+    it("refreshes expired tokens via Google and updates the session", async () => {
+        const expired = { ...profile, expirationDateMs: Date.now() - 1000 }
+        const { fns, request, session } = await setup(expired)
+
+        vi.stubGlobal(
+            "fetch",
+            vi.fn(async () => new Response(JSON.stringify({ access_token: "new-at", expires_in: 3600 }), { status: 200 })),
+        )
+
+        const tokens = await fns.authenticate(request, session)
+        expect(tokens.accessToken).toBe("new-at")
+        expect(tokens.refreshToken).toBe("rt") // Google は通常リフレッシュトークンを再発行しない
+        expect(tokens.expirationDateMs).toBeGreaterThan(Date.now())
+        // セッションも更新されている
+        expect(session.get("user").accessToken).toBe("new-at")
+        // client_id/secret は注入設定から使われる
+        const body = JSON.parse((vi.mocked(fetch).mock.calls[0][1] as RequestInit).body as string)
+        expect(body.client_id).toBe("cid")
+        expect(body.client_secret).toBe("csec")
+        expect(body.refresh_token).toBe("rt")
+    })
+
+    it("destroys the session and redirects on invalid_grant", async () => {
+        const expired = { ...profile, expirationDateMs: Date.now() - 1000 }
+        const { fns, request, session } = await setup(expired)
+
+        vi.stubGlobal(
+            "fetch",
+            vi.fn(async () => new Response(JSON.stringify({ error: "invalid_grant" }), { status: 400 })),
+        )
+
+        try {
+            await fns.authenticate(request, session)
+            expect.unreachable("should have thrown a redirect")
+        } catch (error) {
+            expect(error).toBeInstanceOf(Response)
+            const res = error as Response
+            expect(res.headers.get("Location")).toBe("/auth/login")
+            // セッション破棄の Set-Cookie が付与される
+            expect(res.headers.get("Set-Cookie")).toContain("__session=")
+        }
+    })
+
+    it("returns mock tokens when the mockUser port matches", async () => {
+        const config: AuthServerConfig = {
+            ...baseConfig,
+            mockUser: {
+                enabled: (req) => req.headers.get("Cookie")?.includes("mock_user=true") ?? false,
+                resolve: () => profile,
+            },
+        }
+        const storage = createAuthSessionStorage(config.session)
+        const request = new Request("http://localhost/", { headers: { Cookie: "mock_user=true" } })
+        const session = await storage.getSession(request)
+        const fns = createAuthenticate(config, storage, silentLogger)
+
+        const tokens = await fns.authenticate(request, session)
+        expect(tokens.accessToken).toBe("mock-access-token")
+        expect(tokens.refreshToken).toBe("mock-refresh-token")
+    })
+})
+
+describe("refreshedAccessToken", () => {
+    it("rejects unsupported providers", async () => {
+        const { fns, session } = await setup({ ...profile, provider: "unknown" })
+        await expect(fns.refreshedAccessToken(session)).rejects.toThrow("Provider not supported")
+    })
+
+    it("rejects when the provider is missing", async () => {
+        const { fns, session } = await setup({ ...profile, provider: "" })
+        await expect(fns.refreshedAccessToken(session)).rejects.toThrow("Provider not found in session")
+    })
+})

package/src/server/authenticate.ts

@@ -0,0 +1,187 @@
+/**
+ * @module authenticate
+ * @description Session token guard with Google refresh-token rotation.
+ * Google リフレッシュトークンによるセッショントークンガード。
+ *
+ * 原本 (quants-react-router authenticate.server.ts) を挙動保存で移植。
+ * env (GOOGLE_CLIENT_ID/SECRET) は Google 設定注入に、destroySession はセッションストレージ
+ * 注入に、テストバックドアは mockUser ポート注入に置き換えた。
+ * 期限判定 → リフレッシュ → 失敗時セッション破棄 + ログインへリダイレクトの流れは原本と等価。
+ *
+ * 参考: https://sergiodxa.com/articles/working-with-refresh-tokens-in-remix
+ */
+import type { SessionProfile } from "@aiquants/auth-core"
+import { redirect, type Session } from "react-router"
+import type { AuthServerConfig, LoggerPort } from "./ports"
+import type { AuthSessionStorage } from "./session"
+
+/** トークンリフレッシュ失敗の基底エラー。 */
+export class TokenRefreshError extends Error {
+    constructor(message: string) {
+        super(message)
+        this.name = "TokenRefreshError"
+    }
+}
+
+/** Google の invalid_grant (失効/取り消し済みリフレッシュトークン) エラー。 */
+export class GoogleInvalidGrantError extends TokenRefreshError {
+    constructor() {
+        super("Google refresh token invalid or revoked")
+        this.name = "GoogleInvalidGrantError"
+    }
+}
+
+/** createAuthenticate が返す認証関数束。 */
+export type AuthenticateFns = ReturnType<typeof createAuthenticate>
+
+/**
+ * Builds the `authenticate` / `refreshedAccessToken` pair wired to injected config.
+ * 注入設定に結線した `authenticate` / `refreshedAccessToken` を生成する。
+ */
+export const createAuthenticate = (config: AuthServerConfig, storage: AuthSessionStorage, logger: LoggerPort) => {
+    const loginPath = config.loginPath ?? "/auth/login"
+    const sessionKey = storage.sessionKey
+
+    /**
+     * Refreshes the Google access token using the refresh token in the session.
+     * セッション内のリフレッシュトークンで Google アクセストークンを更新する。
+     */
+    const getRefreshedGoogleAccessToken = async (session: Session) => {
+        const userFromSession = session.get(sessionKey)
+        const refreshTokenFromSession = userFromSession?.refreshToken
+        if (!refreshTokenFromSession) {
+            throw new Error("Refresh token not found in session")
+        }
+        try {
+            const url = "https://www.googleapis.com/oauth2/v4/token"
+            const body = {
+                client_id: config.google.clientId,
+                client_secret: config.google.clientSecret,
+                grant_type: "refresh_token",
+                refresh_token: refreshTokenFromSession,
+            }
+
+            const response = await fetch(url, {
+                headers: {
+                    "Content-Type": "application/json",
+                },
+                method: "POST",
+                body: JSON.stringify(body),
+            })
+
+            if (!response.ok) {
+                // Google API からエラーが返された場合 (JSON パース失敗も考慮)
+                const errorData = await response.json().catch(() => undefined)
+                const isInvalidGrant = response.status === 400 && typeof errorData === "object" && !!errorData && "error" in errorData && errorData.error === "invalid_grant"
+                if (isInvalidGrant) {
+                    throw new GoogleInvalidGrantError()
+                }
+                const errorDescription = typeof errorData === "object" && errorData && "error_description" in errorData ? String(errorData.error_description) : "Unknown error"
+                throw new TokenRefreshError(`Google token refresh failed: ${response.status} ${errorDescription}`)
+            }
+
+            const refreshedTokens = await response.json()
+            const { access_token, expires_in } = refreshedTokens // id_token, scope, token_type は不要
+
+            if (!(access_token && expires_in)) {
+                logger.error("Invalid token response from Google:", refreshedTokens)
+                throw new Error("Invalid token response from Google")
+            }
+
+            return {
+                accessToken: access_token,
+                refreshToken: refreshTokenFromSession, // Google は通常リフレッシュトークンを再発行しない
+                expirationDateMs: Number(Date.now()) + expires_in * 1000,
+            }
+        } catch (error) {
+            if (error instanceof TokenRefreshError) {
+                throw error
+            }
+            const description = error instanceof Error ? error.message : "Unknown error"
+            throw new TokenRefreshError(`Failed to refresh Google access token: ${description}`)
+        }
+    }
+
+    /**
+     * Dispatches the token refresh by session provider (currently Google only).
+     * セッションのプロバイダー別にトークンリフレッシュを振り分ける (現状 Google のみ)。
+     */
+    const refreshedAccessToken = async (session: Session) => {
+        const sessionProfile: SessionProfile = session.get(sessionKey)
+        const provider = sessionProfile.provider
+        if (!provider) {
+            throw new Error("Provider not found in session")
+        }
+        switch (provider) {
+            case "google":
+                return await getRefreshedGoogleAccessToken(session)
+            default:
+                throw new Error("Provider not supported")
+        }
+    }
+
+    /**
+     * Validates session tokens, refreshing them when expired; destroys the session on refresh failure.
+     * セッショントークンを検証し、期限切れならリフレッシュする。失敗時はセッションを破棄する。
+     */
+    const authenticate = async (request: Request, session: Session, options?: { failureRedirect?: string }) => {
+        const { failureRedirect } = options || {}
+        try {
+            // テストバックドア (ポート注入時のみ有効)
+            if (config.mockUser?.enabled(request)) {
+                return {
+                    accessToken: "mock-access-token",
+                    refreshToken: "mock-refresh-token",
+                    expirationDateMs: Date.now() + 3600000,
+                }
+            }
+
+            // セッションから認証データを取得
+            const user = session.get(sessionKey)
+            if (!(user?.accessToken && user.refreshToken && user.expirationDateMs)) {
+                throw redirect(failureRedirect || loginPath)
+            }
+
+            const { accessToken, refreshToken, expirationDateMs } = user
+
+            // 期限切れならエラーを投げてリフレッシュ経路へ
+            if (expirationDateMs < Date.now()) {
+                throw new Error("Expired")
+            }
+
+            // 期限内ならそのまま返す
+            return { accessToken, refreshToken, expirationDateMs }
+        } catch (error) {
+            // 期限切れエラーのみリフレッシュを試みる
+            if (error instanceof Error && error.message === "Expired") {
+                try {
+                    const refreshed = await refreshedAccessToken(session)
+
+                    // セッションを新しいトークンで更新
+                    const user = session.get(sessionKey)
+                    session.set(sessionKey, { ...user, ...refreshed })
+
+                    // アクセストークンを返す (commit は呼び出し側の責務)
+                    return refreshed
+                } catch (refreshError) {
+                    if (refreshError instanceof GoogleInvalidGrantError) {
+                        logger.warn("Google refresh token invalid or revoked")
+                    } else {
+                        const message = refreshError instanceof Error ? refreshError.message : "Unknown error"
+                        logger.error("Failed to refresh token:", message)
+                    }
+                    // リフレッシュに失敗した場合はセッションを破棄してログインページへ
+                    const cookie = await storage.destroySession(session)
+                    throw redirect(failureRedirect || loginPath, {
+                        headers: { "Set-Cookie": cookie },
+                    })
+                }
+            }
+
+            // その他の予期せぬエラーは再 throw
+            throw error
+        }
+    }
+
+    return { authenticate, refreshedAccessToken }
+}

package/src/server/google-strategy-impl.spec.ts

@@ -0,0 +1,108 @@
+/**
+ * Tests for the ported GoogleStrategy (byte-parity with @coji/remix-auth-google).
+ * 移植した GoogleStrategy のテスト (@coji/remix-auth-google との byte 一致)。
+ */
+import { afterEach, describe, expect, it, vi } from "vitest"
+import type { GoogleProfile } from "./google-strategy-impl"
+import { GoogleStrategy, GoogleStrategyDefaultName, GoogleStrategyDefaultScopes } from "./google-strategy-impl"
+
+// authorizationParams / accessType 等は protected/private のため、テスト用サブクラスで公開する
+class ProbeStrategy extends GoogleStrategy<{ id: string }> {
+    exposeAuthorizationParams(params: URLSearchParams, request?: Request): URLSearchParams {
+        return this.authorizationParams(params, request)
+    }
+}
+
+const noopVerify = async () => ({ id: "x" })
+
+const makeProbe = (over?: Partial<ConstructorParameters<typeof GoogleStrategy>[0]>) =>
+    new ProbeStrategy(
+        {
+            clientId: "cid",
+            clientSecret: "csec",
+            redirectURI: "http://localhost/auth/api/google/callback",
+            ...over,
+        },
+        noopVerify,
+    )
+
+afterEach(() => {
+    vi.unstubAllGlobals()
+})
+
+describe("constants", () => {
+    it("keeps the original default scopes (full URL form)", () => {
+        expect(GoogleStrategyDefaultScopes).toEqual(["openid", "https://www.googleapis.com/auth/userinfo.profile", "https://www.googleapis.com/auth/userinfo.email"])
+    })
+
+    it("uses 'google' as the strategy name", () => {
+        expect(GoogleStrategyDefaultName).toBe("google")
+        expect(makeProbe().name).toBe("google")
+    })
+})
+
+describe("authorizationParams", () => {
+    it("applies the original defaults (access_type=online, include_granted_scopes=false, no prompt)", () => {
+        const params = makeProbe().exposeAuthorizationParams(new URLSearchParams())
+        expect(params.get("access_type")).toBe("online")
+        expect(params.get("include_granted_scopes")).toBe("false")
+        expect(params.get("prompt")).toBeNull()
+        expect(params.get("hd")).toBeNull()
+        expect(params.get("login_hint")).toBeNull()
+    })
+
+    it("reflects the quants config (offline / include_granted_scopes=true / prompt=consent)", () => {
+        const params = makeProbe({ accessType: "offline", includeGrantedScopes: true, prompt: "consent" }).exposeAuthorizationParams(new URLSearchParams())
+        expect(params.get("access_type")).toBe("offline")
+        expect(params.get("include_granted_scopes")).toBe("true")
+        expect(params.get("prompt")).toBe("consent")
+    })
+
+    it("sets hd and login_hint only when provided", () => {
+        const params = makeProbe({ hd: "example.com", loginHint: "user@example.com" }).exposeAuthorizationParams(new URLSearchParams())
+        expect(params.get("hd")).toBe("example.com")
+        expect(params.get("login_hint")).toBe("user@example.com")
+    })
+})
+
+describe("userProfile", () => {
+    const rawUserinfo = {
+        sub: "107791905418691074770",
+        name: "宏治 テスト",
+        given_name: "宏治",
+        family_name: "テスト",
+        email: "user@example.com",
+        email_verified: true,
+        picture: "https://example.com/p.png",
+        locale: "ja",
+        hd: "example.com",
+    }
+
+    it("maps the userinfo (v3) response to GoogleProfile (sub→id, picture→photos, _json=raw)", async () => {
+        const fetchMock = vi.fn(async () => new Response(JSON.stringify(rawUserinfo), { status: 200 }))
+        vi.stubGlobal("fetch", fetchMock)
+
+        const profile: GoogleProfile = await GoogleStrategy.userProfile({ accessToken: () => "at" })
+
+        expect(profile.id).toBe("107791905418691074770")
+        expect(profile.displayName).toBe("宏治 テスト")
+        expect(profile.name).toEqual({ familyName: "テスト", givenName: "宏治" })
+        expect(profile.emails).toEqual([{ value: "user@example.com" }])
+        expect(profile.photos).toEqual([{ value: "https://example.com/p.png" }])
+        // _json は生レスポンスをそのまま保持 (email_verified / hd を含む — verify コールバックが依存)
+        expect(profile._json).toEqual(rawUserinfo)
+
+        // Bearer トークンを userinfo v3 へ送っている
+        const [url, init] = fetchMock.mock.calls[0]
+        expect(url).toBe("https://www.googleapis.com/oauth2/v3/userinfo")
+        expect((init as RequestInit).headers).toEqual({ Authorization: "Bearer at" })
+    })
+
+    it("throws when the userinfo response is not ok", async () => {
+        vi.stubGlobal(
+            "fetch",
+            vi.fn(async () => new Response("nope", { status: 401, statusText: "Unauthorized" })),
+        )
+        await expect(GoogleStrategy.userProfile({ accessToken: () => "at" })).rejects.toThrow("Failed to fetch user profile: Unauthorized")
+    })
+})