@aiquants/auth-react-router 0.1.1

package/src/server/google-strategy-impl.ts

@@ -0,0 +1,148 @@
+/**
+ * @module google-strategy-impl
+ * @description Self-contained Google OAuth2 strategy (ported from @coji/remix-auth-google).
+ * 自己完結型の Google OAuth2 ストラテジー (@coji/remix-auth-google から移植)。
+ *
+ * @coji/remix-auth-google@4.2.0 の実装 (68 行) を挙動保存で移植し、外部依存を除去する。
+ * OAuth2 の本体機構 (PKCE / state / トークン交換) は継承元の remix-auth-oauth2 が担うため
+ * 移植対象ではない。ここに置くのは Google 固有の設定 (エンドポイント URL・既定スコープ)、
+ * 認可パラメータの上書き (access_type / include_granted_scopes / prompt / hd / login_hint)、
+ * および userinfo (v3) からプロファイルを取得する静的メソッドのみ。
+ *
+ * 既定スコープ・URL・プロファイル整形 (sub→id、picture→photos、_json=raw) は原本と byte 一致。
+ */
+import { OAuth2Strategy } from "remix-auth-oauth2"
+
+/** Google の既定スコープ (原本と同一。フル URL 形式)。 */
+export const GoogleStrategyDefaultScopes = ["openid", "https://www.googleapis.com/auth/userinfo.profile", "https://www.googleapis.com/auth/userinfo.email"]
+
+/** ストラテジー名 (remix-auth の Authenticator 登録キー)。 */
+export const GoogleStrategyDefaultName = "google"
+
+// userinfo エンドポイント (v3)。プロファイル取得のみに用いる
+const userInfoURL = "https://www.googleapis.com/oauth2/v3/userinfo"
+
+/** @see https://developers.google.com/identity/protocols/oauth2/scopes */
+export type GoogleScope = string
+
+/** GoogleStrategy のコンストラクタオプション (原本 @coji と同一)。 */
+export type GoogleStrategyOptions = {
+    clientId: string
+    clientSecret: string
+    redirectURI: string
+    /** @default "openid profile email" 相当 (GoogleStrategyDefaultScopes)。 */
+    scopes?: GoogleScope[]
+    accessType?: "online" | "offline"
+    includeGrantedScopes?: boolean
+    prompt?: "none" | "consent" | "select_account"
+    hd?: string
+    loginHint?: string
+}
+
+/** userinfo から取得・整形した Google プロファイル (原本 GoogleProfile と同一形状)。 */
+export type GoogleProfile = {
+    id: string
+    displayName: string
+    name: {
+        familyName: string
+        givenName: string
+    }
+    emails: [{ value: string }]
+    photos: [{ value: string }]
+    _json: {
+        sub: string
+        name: string
+        given_name: string
+        family_name: string
+        picture: string
+        locale: string
+        email: string
+        email_verified: boolean
+        hd: string
+    }
+}
+
+// userProfile が必要とする最小のトークン形状 (arctic の OAuth2Tokens の部分集合)。
+// 直接 arctic へ依存しないための構造的型。実際に呼ぶのは accessToken() のみ。
+type OAuth2AccessTokenSource = { accessToken(): string }
+
+/**
+ * Google OAuth2 strategy for remix-auth (extends remix-auth-oauth2's OAuth2Strategy).
+ * remix-auth 用の Google OAuth2 ストラテジー (remix-auth-oauth2 の OAuth2Strategy を継承)。
+ */
+export class GoogleStrategy<User> extends OAuth2Strategy<User> {
+    name = GoogleStrategyDefaultName
+    private readonly accessType: "online" | "offline"
+    private readonly prompt?: "none" | "consent" | "select_account"
+    private readonly includeGrantedScopes: boolean
+    private readonly hd?: string
+    private readonly loginHint?: string
+
+    constructor({ clientId, clientSecret, redirectURI, scopes, accessType, includeGrantedScopes, prompt, hd, loginHint }: GoogleStrategyOptions, verify: OAuth2Strategy<User>["verify"]) {
+        super(
+            {
+                clientId,
+                clientSecret,
+                redirectURI,
+                authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
+                tokenEndpoint: "https://oauth2.googleapis.com/token",
+                scopes: scopes ?? GoogleStrategyDefaultScopes,
+            },
+            verify,
+        )
+        this.accessType = accessType ?? "online"
+        this.includeGrantedScopes = includeGrantedScopes ?? false
+        this.prompt = prompt
+        this.hd = hd
+        this.loginHint = loginHint
+    }
+
+    /**
+     * Adds Google-specific authorization parameters to the redirect URL.
+     * 認可リダイレクト URL へ Google 固有パラメータを付与する。
+     */
+    protected authorizationParams(params: URLSearchParams, _request?: Request): URLSearchParams {
+        params.set("access_type", this.accessType)
+        params.set("include_granted_scopes", String(this.includeGrantedScopes))
+        if (this.prompt) {
+            params.set("prompt", this.prompt)
+        }
+        if (this.hd) {
+            params.set("hd", this.hd)
+        }
+        if (this.loginHint) {
+            params.set("login_hint", this.loginHint)
+        }
+        return params
+    }
+
+    /**
+     * Fetches the Google user profile from the userinfo (v3) endpoint.
+     * userinfo (v3) エンドポイントから Google ユーザープロファイルを取得する。
+     *
+     * @throws プロファイル取得に失敗した場合 (レスポンスが ok でない)。
+     */
+    static async userProfile(tokens: OAuth2AccessTokenSource): Promise<GoogleProfile> {
+        const response = await fetch(userInfoURL, {
+            headers: {
+                Authorization: `Bearer ${tokens.accessToken()}`,
+            },
+        })
+        if (!response.ok) {
+            throw new Error(`Failed to fetch user profile: ${response.statusText}`)
+        }
+        const raw = await response.json()
+        const profile: GoogleProfile = {
+            id: raw.sub,
+            displayName: raw.name,
+            name: {
+                familyName: raw.family_name,
+                givenName: raw.given_name,
+            },
+            emails: [{ value: raw.email }],
+            photos: [{ value: raw.picture }],
+            _json: raw,
+        }
+        return profile
+    }
+}

package/src/server/google-strategy.spec.ts

@@ -0,0 +1,215 @@
+/**
+ * Tests for the Google verify callback (order, error mapping, profile shape).
+ * Google verify コールバックのテスト (検証順序・エラー写像・プロファイル形状)。
+ *
+ * GoogleStrategy をコンストラクタ捕捉でフェイク化し、verify コールバックを直接起動する。
+ */
+import type { MyGoogleProfile } from "@aiquants/auth-core"
+import { defaultAuthMessages } from "@aiquants/auth-core"
+import { beforeEach, describe, expect, it, vi } from "vitest"
+import type { AuthServerConfig, LoggerPort } from "./ports"
+
+type VerifyFn = (args: { request: Request; tokens: { data: Record<string, unknown> } }) => Promise<MyGoogleProfile>
+
+const captured: { options?: Record<string, unknown>; verify?: VerifyFn } = {}
+const userProfileMock = vi.hoisted(() => vi.fn())
+
+vi.mock("./google-strategy-impl", () => {
+    /** コンストラクタ引数を捕捉するフェイク GoogleStrategy。 */
+    class FakeGoogleStrategy {
+        static userProfile = userProfileMock
+        name = "google"
+        constructor(options: Record<string, unknown>, verify: VerifyFn) {
+            captured.options = options
+            captured.verify = verify
+        }
+    }
+    return { GoogleStrategy: FakeGoogleStrategy }
+})
+
+const { createGoogleAuthenticator } = await import("./google-strategy")
+
+const silentLogger: LoggerPort = { info: () => {}, warn: () => {}, error: () => {} }
+
+const googleProfile = () => ({
+    id: "107791905418691074770",
+    displayName: "宏治",
+    name: { familyName: "F", givenName: "G" },
+    emails: [{ value: "user@example.com" }],
+    photos: [{ value: "photo-url" }],
+    _json: {
+        sub: "107791905418691074770",
+        email: "user@example.com",
+        picture: "https://example.com/p.png",
+        email_verified: true,
+        hd: "example.com",
+    },
+})
+
+const tokens = (over?: Record<string, unknown>) => ({
+    data: { access_token: "at", refresh_token: "rt", expires_in: 3600, scope: "openid email profile", id_token: "idt", ...over },
+})
+
+const makeConfig = (over?: Partial<AuthServerConfig>): AuthServerConfig => ({
+    google: { clientId: "cid", clientSecret: "csec", redirectURI: "http://localhost/cb" },
+    session: { secrets: ["s"] },
+    isEmailAllowed: () => true,
+    logger: silentLogger,
+    ...over,
+})
+
+/** verify を起動して throw された Response の Location を返すヘルパー。 */
+const expectLoginRedirect = async (promise: Promise<unknown>): Promise<string> => {
+    try {
+        await promise
+        expect.unreachable("should have thrown a redirect")
+    } catch (error) {
+        expect(error).toBeInstanceOf(Response)
+        const location = (error as Response).headers.get("Location")
+        expect(location).not.toBeNull()
+        return location as string
+    }
+    return ""
+}
+
+beforeEach(() => {
+    userProfileMock.mockReset()
+    userProfileMock.mockResolvedValue(googleProfile())
+})
+
+describe("createGoogleAuthenticator options", () => {
+    it("passes injected google options with original defaults", () => {
+        createGoogleAuthenticator(makeConfig())
+        expect(captured.options).toMatchObject({
+            clientId: "cid",
+            clientSecret: "csec",
+            redirectURI: "http://localhost/cb",
+            accessType: "offline",
+            includeGrantedScopes: true,
+            prompt: "consent",
+        })
+    })
+
+    it("passes custom scopes through (sanledge 差分の吸収)", () => {
+        createGoogleAuthenticator(makeConfig({ google: { clientId: "c", clientSecret: "s", redirectURI: "u", scopes: ["openid", "email", "profile", "directory.readonly"] } }))
+        expect(captured.options?.scopes).toEqual(["openid", "email", "profile", "directory.readonly"])
+    })
+})
+
+describe("verify callback", () => {
+    it("runs backend verify → allowlist → signup in order and returns the profile with photo", async () => {
+        const order: string[] = []
+        const config = makeConfig({
+            backendAuth: {
+                verify: vi.fn(async () => {
+                    order.push("verify")
+                    return true
+                }),
+                signup: vi.fn(async () => {
+                    order.push("signup")
+                    return {}
+                }),
+            },
+            isEmailAllowed: (email) => {
+                order.push(`allowlist:${email}`)
+                return true
+            },
+        })
+        createGoogleAuthenticator(config)
+
+        const before = Date.now()
+        const user = await captured.verify?.({ request: new Request("http://localhost/"), tokens: tokens() })
+
+        // 検証順序: backend verify → allowlist → backend signup (原本と同一)
+        expect(order).toEqual(["verify", "allowlist:user@example.com", "signup"])
+        expect(config.backendAuth?.verify).toHaveBeenCalledWith("google", "at")
+        expect(config.backendAuth?.signup).toHaveBeenCalledWith("google", "at")
+        // プロファイル形状: _json/photos を含まず photo=picture、payload 付き
+        expect(user).toMatchObject({
+            id: "107791905418691074770",
+            displayName: "宏治",
+            emails: [{ value: "user@example.com" }],
+            accessToken: "at",
+            refreshToken: "rt",
+            provider: "google",
+            photo: "https://example.com/p.png",
+        })
+        expect(user && "_json" in user).toBe(false)
+        expect(user && "photos" in user).toBe(false)
+        expect(user?.expirationDateMs).toBeGreaterThanOrEqual(before + 3600 * 1000)
+    })
+
+    it("redirects with emailNotVerified when a field is missing AND email_verified is false (原本セマンティクス)", async () => {
+        // 原本の分岐は「必須フィールド欠落 (undefined) の場合」に限り email_verified===false を
+        // 判別してメッセージを出し分ける (email_verified: false 単独では発火しない) — bug-for-bug 保存
+        userProfileMock.mockResolvedValue({ ...googleProfile(), _json: { ...googleProfile()._json, email: undefined, email_verified: false } })
+        createGoogleAuthenticator(makeConfig())
+        const location = await expectLoginRedirect(captured.verify?.({ request: new Request("http://localhost/"), tokens: tokens() }) as Promise<unknown>)
+        expect(location).toBe(`/auth/login?error=${encodeURIComponent(defaultAuthMessages.emailNotVerified)}`)
+    })
+
+    it("redirects with googleFailed when the refresh token is missing", async () => {
+        createGoogleAuthenticator(makeConfig())
+        const location = await expectLoginRedirect(captured.verify?.({ request: new Request("http://localhost/"), tokens: tokens({ refresh_token: undefined }) }) as Promise<unknown>)
+        expect(location).toBe(`/auth/login?error=${encodeURIComponent(defaultAuthMessages.googleFailed)}`)
+    })
+
+    it("redirects with backendFailed when backend verify returns false", async () => {
+        createGoogleAuthenticator(makeConfig({ backendAuth: { verify: async () => false, signup: async () => ({}) } }))
+        const location = await expectLoginRedirect(captured.verify?.({ request: new Request("http://localhost/"), tokens: tokens() }) as Promise<unknown>)
+        expect(location).toBe(`/auth/login?error=${encodeURIComponent(defaultAuthMessages.backendFailed)}`)
+    })
+
+    it("redirects with backendUnreachable on getaddrinfo ENOTFOUND cause", async () => {
+        createGoogleAuthenticator(
+            makeConfig({
+                backendAuth: {
+                    verify: async () => {
+                        throw new Error("Network or Interface Error", { cause: new Error("getaddrinfo ENOTFOUND api.example.com") })
+                    },
+                    signup: async () => ({}),
+                },
+            }),
+        )
+        const location = await expectLoginRedirect(captured.verify?.({ request: new Request("http://localhost/"), tokens: tokens() }) as Promise<unknown>)
+        expect(location).toBe(`/auth/login?error=${encodeURIComponent(defaultAuthMessages.backendUnreachable)}`)
+    })
+
+    it("redirects with notAllowed when the allowlist rejects the email", async () => {
+        const signup = vi.fn(async () => ({}))
+        createGoogleAuthenticator(makeConfig({ isEmailAllowed: () => false, backendAuth: { verify: async () => true, signup } }))
+        const location = await expectLoginRedirect(captured.verify?.({ request: new Request("http://localhost/"), tokens: tokens() }) as Promise<unknown>)
+        expect(location).toBe(`/auth/login?error=${encodeURIComponent(defaultAuthMessages.notAllowed)}`)
+        // allowlist 拒否時は signup に到達しない (fail-closed)
+        expect(signup).not.toHaveBeenCalled()
+    })
+
+    it("redirects with unexpected on generic signup failure", async () => {
+        createGoogleAuthenticator(
+            makeConfig({
+                backendAuth: {
+                    verify: async () => true,
+                    signup: async () => {
+                        throw new Error("boom")
+                    },
+                },
+            }),
+        )
+        const location = await expectLoginRedirect(captured.verify?.({ request: new Request("http://localhost/"), tokens: tokens() }) as Promise<unknown>)
+        expect(location).toBe(`/auth/login?error=${encodeURIComponent(defaultAuthMessages.unexpected)}`)
+    })
+
+    it("skips backend verify/signup when backendAuth is omitted but still enforces the allowlist", async () => {
+        const allowlist = vi.fn(() => true)
+        createGoogleAuthenticator(makeConfig({ isEmailAllowed: allowlist }))
+        const user = await captured.verify?.({ request: new Request("http://localhost/"), tokens: tokens() })
+        expect(user?.photo).toBe("https://example.com/p.png")
+        expect(allowlist).toHaveBeenCalledWith("user@example.com")
+    })
+
+    it("honors message overrides", async () => {
+        createGoogleAuthenticator(makeConfig({ isEmailAllowed: () => false, messages: { notAllowed: "立入禁止" } }))
+        const location = await expectLoginRedirect(captured.verify?.({ request: new Request("http://localhost/"), tokens: tokens() }) as Promise<unknown>)
+        expect(location).toBe(`/auth/login?error=${encodeURIComponent("立入禁止")}`)
+    })
+})

package/src/server/google-strategy.ts

@@ -0,0 +1,174 @@
+/**
+ * @module google-strategy
+ * @description Google OAuth authenticator factory (remix-auth v4 + local GoogleStrategy).
+ * Google OAuth 認証器ファクトリ (remix-auth v4 + 同梱の GoogleStrategy)。
+ *
+ * 原本 (quants-react-router auth.server.ts) の verify コールバックを挙動保存で移植。
+ * env 読取り・backend HTTP・allowlist・エラーメッセージはすべてポート/設定注入に置き換えた。
+ * 検証順序 (Google プロフィール検証 → backend verify → allowlist → backend signup)、
+ * リダイレクト先 (`<loginPath>?error=<encoded>`)、エラーメッセージ文言は原本と等価。
+ */
+import type { MyGoogleProfile } from "@aiquants/auth-core"
+import { type AuthMessages, resolveAuthMessages } from "@aiquants/auth-core"
+import { redirect } from "react-router"
+import { Authenticator } from "remix-auth"
+import { GoogleStrategy } from "./google-strategy-impl"
+import { defaultLogger } from "./logger"
+import type { AuthServerConfig } from "./ports"
+
+interface GoogleToken {
+    id_token?: string
+    access_token?: string
+    refresh_token?: string
+    expires_in?: number
+    scope?: string
+}
+
+/**
+ * Builds a remix-auth Authenticator with the Google strategy wired to injected ports.
+ * 注入ポートに結線した Google ストラテジー付き Authenticator を生成する。
+ */
+export const createGoogleAuthenticator = (config: AuthServerConfig): Authenticator<MyGoogleProfile> => {
+    const logger = config.logger ?? defaultLogger
+    const messages: AuthMessages = resolveAuthMessages(config.messages)
+    const loginPath = config.loginPath ?? "/auth/login"
+
+    const googleStrategy = new GoogleStrategy<MyGoogleProfile>(
+        {
+            clientId: config.google.clientId,
+            clientSecret: config.google.clientSecret,
+            redirectURI: config.google.redirectURI,
+            scopes: config.google.scopes,
+            accessType: config.google.accessType ?? "offline",
+            includeGrantedScopes: config.google.includeGrantedScopes ?? true,
+            prompt: config.google.prompt ?? "consent",
+        },
+        /**
+         * Google 認証後のコールバック。Google のトークンとプロフィールを検証し、
+         * backend verify → allowlist → backend signup を経て MyGoogleProfile を返す。
+         * 失敗時は `<loginPath>?error=<encoded>` へのリダイレクト Response を throw する。
+         */
+        async ({ request: _request, tokens }) => {
+            const { access_token: accessToken, refresh_token: refreshToken, expires_in: expiresIn, scope, id_token: _idToken } = tokens.data as GoogleToken
+            const {
+                _json: { sub, email, picture, hd: _hd, email_verified },
+                photos: _photos,
+                ...profile
+            } = await GoogleStrategy.userProfile(tokens)
+            const {
+                id,
+                displayName,
+                name: { familyName: _familyName, givenName: _givenName },
+                emails: _emails,
+            } = profile
+            const provider = "google"
+
+            // first verify (トークン/プロフィール欠落は Google 認証失敗として扱う)
+            if (
+                accessToken === undefined ||
+                refreshToken === undefined ||
+                expiresIn === undefined ||
+                scope === undefined ||
+                id === undefined ||
+                displayName === undefined ||
+                sub === undefined ||
+                email === undefined ||
+                email_verified === undefined
+                // hd === undefined // Google Workspace などの組織制限をする場合は有効化
+            ) {
+                if (email_verified === false) {
+                    const errorMessage = encodeURIComponent(messages.emailNotVerified)
+                    throw redirect(`${loginPath}?error=${errorMessage}`)
+                }
+                const errorMessage = encodeURIComponent(messages.googleFailed)
+                throw redirect(`${loginPath}?error=${errorMessage}`)
+            }
+
+            logger.info("Authenticated on Google: ", profile.displayName)
+
+            // Backend Authentication
+            try {
+                // backendAuth ポート未指定時は verify/signup をスキップ (フロント単独運用)
+                if (config.backendAuth) {
+                    const ok = await config.backendAuth.verify(provider, accessToken)
+
+                    if (!ok) {
+                        logger.error("Backend verification returned false for user:", profile.displayName)
+                        const errorMessage = encodeURIComponent(messages.backendFailed)
+                        throw redirect(`${loginPath}?error=${errorMessage}`)
+                    }
+
+                    logger.info("Authenticated on Backend: ", profile.displayName)
+                }
+
+                // メールアドレスまたはドメインベースでのアクセス制限チェック (論理和は allowlist 実装側)
+                const userEmail = profile.emails[0]?.value
+                if (!config.isEmailAllowed(userEmail)) {
+                    const error = new Error("You are not allowed to access this application")
+                    logger.error(error)
+                    throw error
+                }
+
+                // バックエンドでのサインアップ処理 (毎ログイン実行の挙動を保存)
+                if (config.backendAuth) {
+                    await config.backendAuth.signup(provider, accessToken)
+                }
+
+                logger.info("Authenticated complete: ", profile.displayName)
+
+                // 認証ペイロードの構築
+                const expirationDateMs = Date.now() + expiresIn * 1000
+                const authenticationPayload = {
+                    accessToken: accessToken,
+                    refreshToken: refreshToken,
+                    expirationDateMs: expirationDateMs,
+                    provider: provider,
+                }
+                // ユーザープロファイル情報
+                const user: MyGoogleProfile = {
+                    ...profile,
+                    ...authenticationPayload,
+                    photo: picture,
+                }
+                return user
+            } catch (error: unknown) {
+                let loggable = error
+                if (typeof error === "object" && error !== null && "cause" in error) {
+                    // cause があればそれを優先してログに残す (falsy なら元のエラー)
+                    loggable = (error as { cause: unknown }).cause || error
+                }
+                logger.error("Error during backend authentication or subsequent processing:", loggable)
+
+                let friendlyErrorMessage = messages.unexpected
+                let conditionMet = false
+
+                // ネットワーク到達不可 (getaddrinfo ENOTFOUND) の判定
+                if (typeof error === "object" && error !== null && "cause" in error) {
+                    const cause = (error as { cause: unknown }).cause
+                    if (cause && typeof cause === "object" && "message" in cause && typeof (cause as { message: string }).message === "string" && (cause as { message: string }).message.includes("getaddrinfo ENOTFOUND")) {
+                        friendlyErrorMessage = messages.backendUnreachable
+                        conditionMet = true
+                    }
+                }
+
+                // allowlist 拒否の判定
+                if (!conditionMet && error instanceof Error && error.message.includes("You are not allowed to access this application")) {
+                    friendlyErrorMessage = messages.notAllowed
+                    conditionMet = true
+                }
+
+                // 既にリダイレクト Response が throw されている場合はそのまま再 throw
+                if (!conditionMet && error instanceof Response && error.headers.get("Location")?.startsWith(loginPath)) {
+                    throw error
+                }
+
+                const encodedErrorMessage = encodeURIComponent(friendlyErrorMessage)
+                throw redirect(`${loginPath}?error=${encodedErrorMessage}`)
+            }
+        },
+    )
+
+    const authenticator = new Authenticator<MyGoogleProfile>()
+    authenticator.use(googleStrategy)
+    return authenticator
+}