@awesome-lang-auth/node 1.10.1 → 1.10.2

package/dist/router/auth.router.js

@@ -1,9 +1,43 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveApiPrefix = resolveApiPrefix;
 exports.buildUiLink = buildUiLink;
 exports.createAuthRouter = createAuthRouter;
 const express_1 = require("express");
+const crypto = __importStar(require("crypto"));
 const token_service_1 = require("../services/token.service");
 const password_service_1 = require("../services/password.service");
 const mailer_service_1 = require("../services/mailer.service");
@@ -146,6 +180,21 @@ function decodeOAuthStateOrigin(state) {
     catch { /* plain nonce or invalid base64 — ignore */ }
     return null;
 }
+/**
+ * Extracts the random nonce from a structured or plain OAuth state parameter.
+ * Returns `null` when state is undefined or empty.
+ */
+function decodeOAuthStateNonce(state) {
+    if (!state)
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(state, 'base64url').toString());
+        if (isOAuthState(parsed))
+            return parsed.n;
+    }
+    catch { /* plain nonce or invalid base64 */ }
+    return typeof state === 'string' && state.trim() ? state.trim() : null;
+}
 /**
  * Resolves the post-OAuth redirect target from the encoded state.
  * Falls back to `getDefaultSiteUrl` when the state carries no origin or the
@@ -242,9 +291,15 @@ function sendTokens(req, res, tokens, config) {
 async function issueTokens(req, res, user, config, options, userStore, redirectTo, oldSid) {
     const payload = buildPayload(user, config);
     const refreshExpiryMs = parseExpiryMs(config.refreshTokenExpiresIn);
+    let createdSession;
     if (options.sessionStore) {
+        const isSingleSession = config.session?.singleSessionPerUser ?? config.session?.singleSession ?? false;
+        if (isSingleSession && !oldSid) {
+            await options.sessionStore.revokeAllSessionsForUser(user.id, user.tenantId).catch(() => { });
+        }
         const session = await options.sessionStore.createSession({
             userId: user.id,
+            tenantId: user.tenantId,
             userAgent: req.headers['user-agent'],
             ipAddress: req.ip || req.socket.remoteAddress,
             expiresAt: new Date(Date.now() + refreshExpiryMs),
@@ -255,10 +310,24 @@ async function issueTokens(req, res, user, config, options, userStore, redirectT
         if (oldSid) {
             await options.sessionStore.revokeSession(oldSid).catch(() => { });
         }
+        // Save session in local variable for updating hash below
+        createdSession = session;
     }
     const tokens = tokenService.generateTokenPair(payload, config);
     const refreshExpiry = new Date(Date.now() + refreshExpiryMs);
     await userStore.updateRefreshToken(user.id, tokens.refreshToken, refreshExpiry);
+    if (options.sessionStore && payload.sid) {
+        const refreshTokenHash = crypto.createHash('sha256').update(tokens.refreshToken).digest('hex');
+        if (createdSession) {
+            createdSession.refreshTokenHash = refreshTokenHash;
+            if (!createdSession.data)
+                createdSession.data = {};
+            createdSession.data.refreshTokenHash = refreshTokenHash;
+        }
+        if (options.sessionStore.updateSessionRefreshTokenHash) {
+            await options.sessionStore.updateSessionRefreshTokenHash(payload.sid, refreshTokenHash).catch(() => { });
+        }
+    }
     if (redirectTo) {
         tokenService.setTokenCookies(res, tokens, config);
         res.redirect(redirectTo);
@@ -472,13 +541,23 @@ function createAuthRouter(userStore, config, options = {}) {
             if (typeof bodyRefreshToken === 'string' && bodyRefreshToken) {
                 try {
                     const payload = tokenService.verifyRefreshToken(bodyRefreshToken, config);
-                    const user = await userStore.findById(payload.sub);
-                    if (user && user.refreshToken === bodyRefreshToken) {
-                        if (options.sessionStore && payload.sid) {
-                            await options.sessionStore.revokeSession(payload.sid).catch(() => { });
+                    if (options.sessionStore && payload.sid) {
+                        const session = await options.sessionStore.getSession(payload.sid);
+                        if (session) {
+                            const expectedHash = session.refreshTokenHash ?? session.data?.refreshTokenHash;
+                            if (!expectedHash || crypto.createHash('sha256').update(bodyRefreshToken).digest('hex') === expectedHash) {
+                                await options.sessionStore.revokeSession(payload.sid).catch(() => { });
+                                if (!req.user)
+                                    req.user = payload;
+                            }
+                        }
+                    }
+                    else {
+                        const user = await userStore.findById(payload.sub);
+                        if (user && user.refreshToken === bodyRefreshToken) {
+                            if (!req.user)
+                                req.user = payload;
                         }
-                        if (!req.user)
-                            req.user = payload;
                     }
                 }
                 catch {
@@ -491,7 +570,14 @@ function createAuthRouter(userStore, config, options = {}) {
                 const userId = req.user?.sub;
                 const sessionId = req.user?.sid;
                 if (req.user?.sub) {
-                    await userStore.updateRefreshToken(req.user.sub, null, null);
+                    let hasOtherSessions = false;
+                    if (options.sessionStore?.getSessionsForUser) {
+                        const remaining = await options.sessionStore.getSessionsForUser(req.user.sub).catch(() => []);
+                        hasOtherSessions = remaining.length > 0;
+                    }
+                    if (!hasOtherSessions) {
+                        await userStore.updateRefreshToken(req.user.sub, null, null);
+                    }
                 }
                 tokenService.clearTokenCookies(res, config);
                 (0, router_events_1.publishRequestEvent)(eventBus, auth_event_names_1.AuthEventNames.AUTH_LOGOUT, req, {
@@ -520,18 +606,40 @@ function createAuthRouter(userStore, config, options = {}) {
                 const payload = tokenService.verifyRefreshToken(refreshToken, config);
                 // Real-time Session Validation
                 const checkOn = config.session?.checkOn ?? 'refresh';
-                if (options.sessionStore && payload.sid && checkOn !== 'none') {
-                    const session = await options.sessionStore.getSession(payload.sid);
+                let session = null;
+                if (options.sessionStore && payload.sid) {
+                    if (checkOn !== 'none') {
+                        session = await options.sessionStore.getSession(payload.sid);
+                        if (!session) {
+                            res.status(401).json({ error: 'Session has been revoked', code: 'SESSION_REVOKED' });
+                            return;
+                        }
+                    }
                     if (!session) {
-                        res.status(401).json({ error: 'Session has been revoked', code: 'SESSION_REVOKED' });
-                        return;
+                        session = await options.sessionStore.getSession(payload.sid);
+                    }
+                    // Per-session refresh token validation (multi-device support)
+                    const expectedHash = session?.refreshTokenHash ?? session?.data?.refreshTokenHash;
+                    if (expectedHash) {
+                        const presentedHash = crypto.createHash('sha256').update(refreshToken).digest('hex');
+                        if (presentedHash !== expectedHash) {
+                            res.status(401).json({ error: 'Invalid refresh token' });
+                            return;
+                        }
                     }
                 }
                 const user = await userStore.findById(payload.sub);
-                if (!user || user.refreshToken !== refreshToken) {
+                if (!user) {
                     res.status(401).json({ error: 'Invalid refresh token' });
                     return;
                 }
+                // If no session store is used or payload has no sid, validate against user.refreshToken
+                if (!options.sessionStore || !payload.sid) {
+                    if (user.refreshToken !== refreshToken) {
+                        res.status(401).json({ error: 'Invalid refresh token' });
+                        return;
+                    }
+                }
                 const { sessionId } = await issueTokens(req, res, user, config, options, userStore, /* redirectTo */ undefined, payload.sid);
                 (0, router_events_1.publishRequestEvent)(eventBus, auth_event_names_1.AuthEventNames.SESSION_ROTATED, req, {
                     userId: user.id,
@@ -1243,12 +1351,29 @@ function createAuthRouter(userStore, config, options = {}) {
             const resolved = resolveSiteUrl(req, config, allowedOrigins);
             const returnPath = typeof req.query['return_path'] === 'string' ? req.query['return_path'] : undefined;
             const state = resolved ? encodeOAuthState(nonce, resolved, returnPath) : nonce;
+            res.cookie('oauth_nonce_google', nonce, {
+                httpOnly: true,
+                sameSite: 'lax',
+                secure: config.cookieOptions?.secure ?? (req.secure || req.headers['x-forwarded-proto'] === 'https'),
+                maxAge: 10 * 60 * 1000,
+                path: '/',
+            });
             const url = googleStrategy.getAuthorizationUrl(state);
             res.redirect(url);
         });
         router.get('/oauth/google/callback', ...rl, async (req, res) => {
             try {
                 const { code, state } = req.query;
+                const cookieNonce = req.cookies?.['oauth_nonce_google']
+                    ?? tokenService.extractTokenFromCookie(req, 'oauth_nonce_google');
+                res.clearCookie('oauth_nonce_google', { path: '/' });
+                const stateNonce = decodeOAuthStateNonce(state);
+                if (cookieNonce || stateNonce) {
+                    if (!cookieNonce || !stateNonce || cookieNonce !== stateNonce) {
+                        res.status(400).json({ error: 'Invalid or missing OAuth state nonce', code: 'INVALID_OAUTH_STATE' });
+                        return;
+                    }
+                }
                 const redirectTo = resolveOAuthRedirect(state, config, allowedOrigins);
                 const user = await googleStrategy.handleCallback(code, state);
                 // Link the account if linkedAccountsStore is configured
@@ -1268,14 +1393,17 @@ function createAuthRouter(userStore, config, options = {}) {
                     (0, router_events_1.publishRequestEvent)(eventBus, auth_event_names_1.AuthEventNames.AUTH_OAUTH_CONFLICT, req, {
                         data: (0, router_events_1.oauthConflictEventData)('google', err.data),
                     });
-                    const siteUrl = resolveOAuthRedirect(req.query.state, config, allowedOrigins);
+                    const rawOrigin = decodeOAuthStateOrigin(req.query.state);
+                    const conflictOrigin = (rawOrigin && (allowedOrigins.length === 0 || allowedOrigins.includes(rawOrigin)))
+                        ? rawOrigin
+                        : getDefaultSiteUrl(config);
                     const { email, providerAccountId } = (err.data ?? {});
                     if (options.pendingLinkStore && email && providerAccountId) {
                         await options.pendingLinkStore.stash(email, 'google', providerAccountId).catch((e) => { console.error('[node-auth] pendingLinkStore.stash error (google):', e); });
                     }
                     const emailParam = email ? `&email=${encodeURIComponent(email)}` : '';
                     const paramStr = `?provider=google&code=OAUTH_ACCOUNT_CONFLICT${emailParam}`;
-                    res.redirect(buildUiLink(siteUrl, `/account-conflict${paramStr}`, config, options));
+                    res.redirect(buildUiLink(conflictOrigin, `/account-conflict${paramStr}`, config, options));
                     return;
                 }
                 handleError(res, err);
@@ -1294,12 +1422,29 @@ function createAuthRouter(userStore, config, options = {}) {
             const resolved = resolveSiteUrl(req, config, allowedOrigins);
             const returnPath = typeof req.query['return_path'] === 'string' ? req.query['return_path'] : undefined;
             const state = resolved ? encodeOAuthState(nonce, resolved, returnPath) : nonce;
+            res.cookie('oauth_nonce_github', nonce, {
+                httpOnly: true,
+                sameSite: 'lax',
+                secure: config.cookieOptions?.secure ?? (req.secure || req.headers['x-forwarded-proto'] === 'https'),
+                maxAge: 10 * 60 * 1000,
+                path: '/',
+            });
             const url = githubStrategy.getAuthorizationUrl(state);
             res.redirect(url);
         });
         router.get('/oauth/github/callback', ...rl, async (req, res) => {
             try {
                 const { code, state } = req.query;
+                const cookieNonce = req.cookies?.['oauth_nonce_github']
+                    ?? tokenService.extractTokenFromCookie(req, 'oauth_nonce_github');
+                res.clearCookie('oauth_nonce_github', { path: '/' });
+                const stateNonce = decodeOAuthStateNonce(state);
+                if (cookieNonce || stateNonce) {
+                    if (!cookieNonce || !stateNonce || cookieNonce !== stateNonce) {
+                        res.status(400).json({ error: 'Invalid or missing OAuth state nonce', code: 'INVALID_OAUTH_STATE' });
+                        return;
+                    }
+                }
                 const redirectTo = resolveOAuthRedirect(state, config, allowedOrigins);
                 const user = await githubStrategy.handleCallback(code, state);
                 // Link the account if linkedAccountsStore is configured
@@ -1319,14 +1464,17 @@ function createAuthRouter(userStore, config, options = {}) {
                     (0, router_events_1.publishRequestEvent)(eventBus, auth_event_names_1.AuthEventNames.AUTH_OAUTH_CONFLICT, req, {
                         data: (0, router_events_1.oauthConflictEventData)('github', err.data),
                     });
-                    const siteUrl = resolveOAuthRedirect(req.query.state, config, allowedOrigins);
+                    const rawOrigin = decodeOAuthStateOrigin(req.query.state);
+                    const conflictOrigin = (rawOrigin && (allowedOrigins.length === 0 || allowedOrigins.includes(rawOrigin)))
+                        ? rawOrigin
+                        : getDefaultSiteUrl(config);
                     const { email, providerAccountId } = (err.data ?? {});
                     if (options.pendingLinkStore && email && providerAccountId) {
                         await options.pendingLinkStore.stash(email, 'github', providerAccountId).catch((e) => { console.error('[node-auth] pendingLinkStore.stash error (github):', e); });
                     }
                     const emailParam = email ? `&email=${encodeURIComponent(email)}` : '';
                     const paramStr = `?provider=github&code=OAUTH_ACCOUNT_CONFLICT${emailParam}`;
-                    res.redirect(buildUiLink(siteUrl, `/account-conflict${paramStr}`, config, options));
+                    res.redirect(buildUiLink(conflictOrigin, `/account-conflict${paramStr}`, config, options));
                     return;
                 }
                 handleError(res, err);
@@ -1346,11 +1494,27 @@ function createAuthRouter(userStore, config, options = {}) {
                 const resolved = resolveSiteUrl(req, config, allowedOrigins);
                 const returnPath = typeof req.query['return_path'] === 'string' ? req.query['return_path'] : undefined;
                 const state = resolved ? encodeOAuthState(nonce, resolved, returnPath) : nonce;
+                res.cookie(`oauth_nonce_${s.name}`, nonce, {
+                    httpOnly: true,
+                    sameSite: 'lax',
+                    secure: config.cookieOptions?.secure ?? (req.secure || req.headers['x-forwarded-proto'] === 'https'),
+                    maxAge: 10 * 60 * 1000,
+                    path: '/',
+                });
                 res.redirect(s.getAuthorizationUrl(state));
             });
             router.get(`/oauth/${s.name}/callback`, ...rl, async (req, res) => {
                 try {
                     const { code, state } = req.query;
+                    const cookieName = `oauth_nonce_${s.name}`;
+                    const cookieNonce = req.cookies?.[cookieName]
+                        ?? tokenService.extractTokenFromCookie(req, cookieName);
+                    res.clearCookie(cookieName, { path: '/' });
+                    const stateNonce = decodeOAuthStateNonce(state);
+                    if (cookieNonce && (!stateNonce || cookieNonce !== stateNonce)) {
+                        res.status(400).json({ error: 'Invalid or missing OAuth state nonce', code: 'INVALID_OAUTH_STATE' });
+                        return;
+                    }
                     const redirectTo = resolveOAuthRedirect(state, config, allowedOrigins);
                     const user = await s.handleCallback(code, state);
                     // Link the account if linkedAccountsStore is configured
@@ -1370,14 +1534,17 @@ function createAuthRouter(userStore, config, options = {}) {
                         (0, router_events_1.publishRequestEvent)(eventBus, auth_event_names_1.AuthEventNames.AUTH_OAUTH_CONFLICT, req, {
                             data: (0, router_events_1.oauthConflictEventData)(s.name, err.data),
                         });
-                        const siteUrl = resolveOAuthRedirect(req.query.state, config, allowedOrigins);
+                        const rawOrigin = decodeOAuthStateOrigin(req.query.state);
+                        const conflictOrigin = (rawOrigin && (allowedOrigins.length === 0 || allowedOrigins.includes(rawOrigin)))
+                            ? rawOrigin
+                            : getDefaultSiteUrl(config);
                         const { email, providerAccountId } = (err.data ?? {});
                         if (options.pendingLinkStore && email && providerAccountId) {
                             await options.pendingLinkStore.stash(email, s.name, providerAccountId).catch((e) => { console.error(`[node-auth] pendingLinkStore.stash error (${s.name}):`, e); });
                         }
                         const emailParam = email ? `&email=${encodeURIComponent(email)}` : '';
                         const paramStr = `?provider=${encodeURIComponent(s.name)}&code=OAUTH_ACCOUNT_CONFLICT${emailParam}`;
-                        res.redirect(buildUiLink(siteUrl, `/account-conflict${paramStr}`, config, options));
+                        res.redirect(buildUiLink(conflictOrigin, `/account-conflict${paramStr}`, config, options));
                         return;
                     }
                     handleError(res, err);