@awesome-lang-auth/node 1.10.1 → 1.10.3

package/dist/router/auth.router.js

@@ -1,9 +1,43 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveApiPrefix = resolveApiPrefix;
 exports.buildUiLink = buildUiLink;
 exports.createAuthRouter = createAuthRouter;
 const express_1 = require("express");
+const crypto = __importStar(require("crypto"));
 const token_service_1 = require("../services/token.service");
 const password_service_1 = require("../services/password.service");
 const mailer_service_1 = require("../services/mailer.service");
@@ -146,6 +180,55 @@ function decodeOAuthStateOrigin(state) {
     catch { /* plain nonce or invalid base64 — ignore */ }
     return null;
 }
+/**
+ * Extracts the random nonce from a structured or plain OAuth state parameter.
+ * Returns `null` when state is undefined or empty.
+ */
+function decodeOAuthStateNonce(state) {
+    if (!state)
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(state, 'base64url').toString());
+        if (isOAuthState(parsed))
+            return parsed.n;
+    }
+    catch { /* plain nonce or invalid base64 */ }
+    return typeof state === 'string' && state.trim() ? state.trim() : null;
+}
+function oauthCallbackPath(authUrl, fallback) {
+    try {
+        const r = new URL(authUrl).searchParams.get('redirect_uri');
+        if (r)
+            return new URL(r).pathname;
+    }
+    catch { /* custom URL */ }
+    return fallback;
+}
+function oauthStateCookieOpts(path, config, req) {
+    return {
+        httpOnly: true,
+        sameSite: 'lax',
+        secure: config.cookieOptions?.secure ?? (req.secure || req.headers['x-forwarded-proto'] === 'https'),
+        path,
+    };
+}
+function verifyOAuthState(req, res, cookieName, path, config) {
+    const cookieVal = req.cookies?.[cookieName]
+        ?? req.cookies?.['oauth_state']
+        ?? tokenService.extractTokenFromCookie(req, cookieName)
+        ?? tokenService.extractTokenFromCookie(req, 'oauth_state');
+    res.clearCookie(cookieName, oauthStateCookieOpts(path, config, req));
+    res.clearCookie(cookieName, { path: '/' });
+    res.clearCookie('oauth_state', oauthStateCookieOpts(path, config, req));
+    res.clearCookie('oauth_state', { path: '/' });
+    const rawState = req.query['state'];
+    const stateNonce = decodeOAuthStateNonce(typeof rawState === 'string' ? rawState : undefined);
+    const a = Buffer.from(cookieVal ?? '');
+    const b = Buffer.from(stateNonce ?? '');
+    if (!cookieVal || !stateNonce || a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
+        throw new errors_1.AuthError('Invalid OAuth state', 'INVALID_OAUTH_STATE', 400);
+    }
+}
 /**
  * Resolves the post-OAuth redirect target from the encoded state.
  * Falls back to `getDefaultSiteUrl` when the state carries no origin or the
@@ -242,23 +325,47 @@ function sendTokens(req, res, tokens, config) {
 async function issueTokens(req, res, user, config, options, userStore, redirectTo, oldSid) {
     const payload = buildPayload(user, config);
     const refreshExpiryMs = parseExpiryMs(config.refreshTokenExpiresIn);
+    let createdSession;
     if (options.sessionStore) {
+        const isSingleSession = config.session?.singleSessionPerUser ?? config.session?.singleSession ?? false;
+        if (isSingleSession && !oldSid) {
+            await options.sessionStore.revokeAllSessionsForUser(user.id, user.tenantId).catch(() => { });
+        }
+        // Revoke the previous session before creating new one (token rotation)
+        // Store failures during /refresh must reject (500) so old tokens cannot be replayed
+        if (oldSid) {
+            await options.sessionStore.revokeSession(oldSid);
+        }
         const session = await options.sessionStore.createSession({
             userId: user.id,
+            tenantId: user.tenantId,
             userAgent: req.headers['user-agent'],
             ipAddress: req.ip || req.socket.remoteAddress,
             expiresAt: new Date(Date.now() + refreshExpiryMs),
             createdAt: new Date(),
         });
         payload.sid = session.sessionHandle;
-        // Revoke the previous session now that the new one is live (token rotation)
-        if (oldSid) {
-            await options.sessionStore.revokeSession(oldSid).catch(() => { });
-        }
+        // Save session in local variable for updating hash below
+        createdSession = session;
     }
     const tokens = tokenService.generateTokenPair(payload, config);
     const refreshExpiry = new Date(Date.now() + refreshExpiryMs);
-    await userStore.updateRefreshToken(user.id, tokens.refreshToken, refreshExpiry);
+    // Only write refresh token to user record when no session store is configured (single-device fallback)
+    if (!options.sessionStore) {
+        await userStore.updateRefreshToken(user.id, tokens.refreshToken, refreshExpiry);
+    }
+    if (options.sessionStore && payload.sid) {
+        const refreshTokenHash = crypto.createHash('sha256').update(tokens.refreshToken).digest('hex');
+        if (createdSession) {
+            createdSession.refreshTokenHash = refreshTokenHash;
+            if (!createdSession.data)
+                createdSession.data = {};
+            createdSession.data.refreshTokenHash = refreshTokenHash;
+        }
+        if (options.sessionStore.updateSessionRefreshTokenHash) {
+            await options.sessionStore.updateSessionRefreshTokenHash(payload.sid, refreshTokenHash).catch(() => { });
+        }
+    }
     if (redirectTo) {
         tokenService.setTokenCookies(res, tokens, config);
         res.redirect(redirectTo);
@@ -270,6 +377,9 @@ async function issueTokens(req, res, user, config, options, userStore, redirectT
 }
 function createAuthRouter(userStore, config, options = {}) {
     const router = (0, express_1.Router)();
+    if (options.sessionStore && config.refreshTokenSecret === config.accessTokenSecret) {
+        throw new Error('refreshTokenSecret must differ from accessTokenSecret when a sessionStore is configured');
+    }
     // Parameterize refresh token path by default based on apiPrefix
     config.cookieOptions = {
         ...config.cookieOptions,
@@ -472,13 +582,23 @@ function createAuthRouter(userStore, config, options = {}) {
             if (typeof bodyRefreshToken === 'string' && bodyRefreshToken) {
                 try {
                     const payload = tokenService.verifyRefreshToken(bodyRefreshToken, config);
-                    const user = await userStore.findById(payload.sub);
-                    if (user && user.refreshToken === bodyRefreshToken) {
-                        if (options.sessionStore && payload.sid) {
-                            await options.sessionStore.revokeSession(payload.sid).catch(() => { });
+                    if (options.sessionStore && payload.sid) {
+                        const session = await options.sessionStore.getSession(payload.sid);
+                        if (session) {
+                            const expectedHash = session.refreshTokenHash ?? session.data?.refreshTokenHash;
+                            if (!expectedHash || crypto.createHash('sha256').update(bodyRefreshToken).digest('hex') === expectedHash) {
+                                await options.sessionStore.revokeSession(payload.sid).catch(() => { });
+                                if (!req.user)
+                                    req.user = payload;
+                            }
+                        }
+                    }
+                    else {
+                        const user = await userStore.findById(payload.sub);
+                        if (user && user.refreshToken === bodyRefreshToken) {
+                            if (!req.user)
+                                req.user = payload;
                         }
-                        if (!req.user)
-                            req.user = payload;
                     }
                 }
                 catch {
@@ -491,7 +611,7 @@ function createAuthRouter(userStore, config, options = {}) {
                 const userId = req.user?.sub;
                 const sessionId = req.user?.sid;
                 if (req.user?.sub) {
-                    await userStore.updateRefreshToken(req.user.sub, null, null);
+                    await userStore.updateRefreshToken(req.user.sub, null, null).catch(() => { });
                 }
                 tokenService.clearTokenCookies(res, config);
                 (0, router_events_1.publishRequestEvent)(eventBus, auth_event_names_1.AuthEventNames.AUTH_LOGOUT, req, {
@@ -518,20 +638,39 @@ function createAuthRouter(userStore, config, options = {}) {
                     return;
                 }
                 const payload = tokenService.verifyRefreshToken(refreshToken, config);
-                // Real-time Session Validation
-                const checkOn = config.session?.checkOn ?? 'refresh';
-                if (options.sessionStore && payload.sid && checkOn !== 'none') {
+                // Real-time Session Validation (always checked on /refresh, regardless of checkOn)
+                if (options.sessionStore && payload.sid) {
                     const session = await options.sessionStore.getSession(payload.sid);
                     if (!session) {
                         res.status(401).json({ error: 'Session has been revoked', code: 'SESSION_REVOKED' });
                         return;
                     }
+                    if (session.userId !== payload.sub) {
+                        res.status(401).json({ error: 'Invalid refresh token' });
+                        return;
+                    }
+                    // Per-session refresh token validation (multi-device support)
+                    const expectedHash = session.refreshTokenHash ?? session.data?.refreshTokenHash;
+                    if (expectedHash) {
+                        const presentedHash = crypto.createHash('sha256').update(refreshToken).digest('hex');
+                        if (presentedHash !== expectedHash) {
+                            res.status(401).json({ error: 'Invalid refresh token' });
+                            return;
+                        }
+                    }
                 }
                 const user = await userStore.findById(payload.sub);
-                if (!user || user.refreshToken !== refreshToken) {
+                if (!user) {
                     res.status(401).json({ error: 'Invalid refresh token' });
                     return;
                 }
+                // If no session store is used or payload has no sid, validate against user.refreshToken
+                if (!options.sessionStore || !payload.sid) {
+                    if (user.refreshToken !== refreshToken) {
+                        res.status(401).json({ error: 'Invalid refresh token' });
+                        return;
+                    }
+                }
                 const { sessionId } = await issueTokens(req, res, user, config, options, userStore, /* redirectTo */ undefined, payload.sid);
                 (0, router_events_1.publishRequestEvent)(eventBus, auth_event_names_1.AuthEventNames.SESSION_ROTATED, req, {
                     userId: user.id,
@@ -1244,10 +1383,24 @@ function createAuthRouter(userStore, config, options = {}) {
             const returnPath = typeof req.query['return_path'] === 'string' ? req.query['return_path'] : undefined;
             const state = resolved ? encodeOAuthState(nonce, resolved, returnPath) : nonce;
             const url = googleStrategy.getAuthorizationUrl(state);
+            const callbackPath = oauthCallbackPath(url, `${req.baseUrl}/oauth/google/callback`);
+            res.cookie('oauth_nonce_google', nonce, {
+                ...oauthStateCookieOpts(callbackPath, config, req),
+                maxAge: 10 * 60 * 1000,
+            });
+            res.cookie('oauth_nonce_google', nonce, {
+                httpOnly: true,
+                sameSite: 'lax',
+                secure: config.cookieOptions?.secure ?? (req.secure || req.headers['x-forwarded-proto'] === 'https'),
+                maxAge: 10 * 60 * 1000,
+                path: '/',
+            });
             res.redirect(url);
         });
         router.get('/oauth/google/callback', ...rl, async (req, res) => {
             try {
+                const callbackPath = oauthCallbackPath(googleStrategy.getAuthorizationUrl(''), `${req.baseUrl}${req.path}`);
+                verifyOAuthState(req, res, 'oauth_nonce_google', callbackPath, config);
                 const { code, state } = req.query;
                 const redirectTo = resolveOAuthRedirect(state, config, allowedOrigins);
                 const user = await googleStrategy.handleCallback(code, state);
@@ -1268,14 +1421,17 @@ function createAuthRouter(userStore, config, options = {}) {
                     (0, router_events_1.publishRequestEvent)(eventBus, auth_event_names_1.AuthEventNames.AUTH_OAUTH_CONFLICT, req, {
                         data: (0, router_events_1.oauthConflictEventData)('google', err.data),
                     });
-                    const siteUrl = resolveOAuthRedirect(req.query.state, config, allowedOrigins);
+                    const rawOrigin = decodeOAuthStateOrigin(req.query.state);
+                    const conflictOrigin = (rawOrigin && (allowedOrigins.length === 0 || allowedOrigins.includes(rawOrigin)))
+                        ? rawOrigin
+                        : getDefaultSiteUrl(config);
                     const { email, providerAccountId } = (err.data ?? {});
                     if (options.pendingLinkStore && email && providerAccountId) {
                         await options.pendingLinkStore.stash(email, 'google', providerAccountId).catch((e) => { console.error('[node-auth] pendingLinkStore.stash error (google):', e); });
                     }
                     const emailParam = email ? `&email=${encodeURIComponent(email)}` : '';
                     const paramStr = `?provider=google&code=OAUTH_ACCOUNT_CONFLICT${emailParam}`;
-                    res.redirect(buildUiLink(siteUrl, `/account-conflict${paramStr}`, config, options));
+                    res.redirect(buildUiLink(conflictOrigin, `/account-conflict${paramStr}`, config, options));
                     return;
                 }
                 handleError(res, err);
@@ -1295,10 +1451,24 @@ function createAuthRouter(userStore, config, options = {}) {
             const returnPath = typeof req.query['return_path'] === 'string' ? req.query['return_path'] : undefined;
             const state = resolved ? encodeOAuthState(nonce, resolved, returnPath) : nonce;
             const url = githubStrategy.getAuthorizationUrl(state);
+            const callbackPath = oauthCallbackPath(url, `${req.baseUrl}/oauth/github/callback`);
+            res.cookie('oauth_nonce_github', nonce, {
+                ...oauthStateCookieOpts(callbackPath, config, req),
+                maxAge: 10 * 60 * 1000,
+            });
+            res.cookie('oauth_nonce_github', nonce, {
+                httpOnly: true,
+                sameSite: 'lax',
+                secure: config.cookieOptions?.secure ?? (req.secure || req.headers['x-forwarded-proto'] === 'https'),
+                maxAge: 10 * 60 * 1000,
+                path: '/',
+            });
             res.redirect(url);
         });
         router.get('/oauth/github/callback', ...rl, async (req, res) => {
             try {
+                const callbackPath = oauthCallbackPath(githubStrategy.getAuthorizationUrl(''), `${req.baseUrl}${req.path}`);
+                verifyOAuthState(req, res, 'oauth_nonce_github', callbackPath, config);
                 const { code, state } = req.query;
                 const redirectTo = resolveOAuthRedirect(state, config, allowedOrigins);
                 const user = await githubStrategy.handleCallback(code, state);
@@ -1319,14 +1489,17 @@ function createAuthRouter(userStore, config, options = {}) {
                     (0, router_events_1.publishRequestEvent)(eventBus, auth_event_names_1.AuthEventNames.AUTH_OAUTH_CONFLICT, req, {
                         data: (0, router_events_1.oauthConflictEventData)('github', err.data),
                     });
-                    const siteUrl = resolveOAuthRedirect(req.query.state, config, allowedOrigins);
+                    const rawOrigin = decodeOAuthStateOrigin(req.query.state);
+                    const conflictOrigin = (rawOrigin && (allowedOrigins.length === 0 || allowedOrigins.includes(rawOrigin)))
+                        ? rawOrigin
+                        : getDefaultSiteUrl(config);
                     const { email, providerAccountId } = (err.data ?? {});
                     if (options.pendingLinkStore && email && providerAccountId) {
                         await options.pendingLinkStore.stash(email, 'github', providerAccountId).catch((e) => { console.error('[node-auth] pendingLinkStore.stash error (github):', e); });
                     }
                     const emailParam = email ? `&email=${encodeURIComponent(email)}` : '';
                     const paramStr = `?provider=github&code=OAUTH_ACCOUNT_CONFLICT${emailParam}`;
-                    res.redirect(buildUiLink(siteUrl, `/account-conflict${paramStr}`, config, options));
+                    res.redirect(buildUiLink(conflictOrigin, `/account-conflict${paramStr}`, config, options));
                     return;
                 }
                 handleError(res, err);
@@ -1346,10 +1519,26 @@ function createAuthRouter(userStore, config, options = {}) {
                 const resolved = resolveSiteUrl(req, config, allowedOrigins);
                 const returnPath = typeof req.query['return_path'] === 'string' ? req.query['return_path'] : undefined;
                 const state = resolved ? encodeOAuthState(nonce, resolved, returnPath) : nonce;
-                res.redirect(s.getAuthorizationUrl(state));
+                const url = s.getAuthorizationUrl(state);
+                const callbackPath = oauthCallbackPath(url, `${req.baseUrl}/oauth/${s.name}/callback`);
+                res.cookie(`oauth_nonce_${s.name}`, nonce, {
+                    ...oauthStateCookieOpts(callbackPath, config, req),
+                    maxAge: 10 * 60 * 1000,
+                });
+                res.cookie(`oauth_nonce_${s.name}`, nonce, {
+                    httpOnly: true,
+                    sameSite: 'lax',
+                    secure: config.cookieOptions?.secure ?? (req.secure || req.headers['x-forwarded-proto'] === 'https'),
+                    maxAge: 10 * 60 * 1000,
+                    path: '/',
+                });
+                res.redirect(url);
             });
             router.get(`/oauth/${s.name}/callback`, ...rl, async (req, res) => {
                 try {
+                    const cookieName = `oauth_nonce_${s.name}`;
+                    const callbackPath = oauthCallbackPath(s.getAuthorizationUrl(''), `${req.baseUrl}${req.path}`);
+                    verifyOAuthState(req, res, cookieName, callbackPath, config);
                     const { code, state } = req.query;
                     const redirectTo = resolveOAuthRedirect(state, config, allowedOrigins);
                     const user = await s.handleCallback(code, state);
@@ -1370,14 +1559,17 @@ function createAuthRouter(userStore, config, options = {}) {
                         (0, router_events_1.publishRequestEvent)(eventBus, auth_event_names_1.AuthEventNames.AUTH_OAUTH_CONFLICT, req, {
                             data: (0, router_events_1.oauthConflictEventData)(s.name, err.data),
                         });
-                        const siteUrl = resolveOAuthRedirect(req.query.state, config, allowedOrigins);
+                        const rawOrigin = decodeOAuthStateOrigin(req.query.state);
+                        const conflictOrigin = (rawOrigin && (allowedOrigins.length === 0 || allowedOrigins.includes(rawOrigin)))
+                            ? rawOrigin
+                            : getDefaultSiteUrl(config);
                         const { email, providerAccountId } = (err.data ?? {});
                         if (options.pendingLinkStore && email && providerAccountId) {
                             await options.pendingLinkStore.stash(email, s.name, providerAccountId).catch((e) => { console.error(`[node-auth] pendingLinkStore.stash error (${s.name}):`, e); });
                         }
                         const emailParam = email ? `&email=${encodeURIComponent(email)}` : '';
                         const paramStr = `?provider=${encodeURIComponent(s.name)}&code=OAUTH_ACCOUNT_CONFLICT${emailParam}`;
-                        res.redirect(buildUiLink(siteUrl, `/account-conflict${paramStr}`, config, options));
+                        res.redirect(buildUiLink(conflictOrigin, `/account-conflict${paramStr}`, config, options));
                         return;
                     }
                     handleError(res, err);