@bitblit/ratchet-warden-server 5.1.118 → 5.1.122-alpha

package/lib/server/warden-service.js

@@ -1,30 +1,38 @@
-import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
-import { WardenUtils } from '@bitblit/ratchet-warden-common/common/util/warden-utils';
-import { WardenStoreRegistrationResponseType } from '@bitblit/ratchet-warden-common/common/model/warden-store-registration-response-type';
-import { RequireRatchet } from '@bitblit/ratchet-common/lang/require-ratchet';
-import { Logger } from '@bitblit/ratchet-common/logger/logger';
-import { ErrorRatchet } from '@bitblit/ratchet-common/lang/error-ratchet';
-import { StringRatchet } from '@bitblit/ratchet-common/lang/string-ratchet';
-import { Base64Ratchet } from '@bitblit/ratchet-common/lang/base64-ratchet';
-import { WardenDefaultUserDecorationProvider } from './provider/warden-default-user-decoration-provider.js';
-import { WardenNoOpEventProcessingProvider } from './provider/warden-no-op-event-processing-provider.js';
-import { WardenDefaultSendMagicLinkCommandValidator } from './provider/warden-default-send-magic-link-command-validator.js';
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from "@simplewebauthn/server";
+import { WardenUtils } from "@bitblit/ratchet-warden-common/common/util/warden-utils";
+import { WardenStoreRegistrationResponseType } from "@bitblit/ratchet-warden-common/common/model/warden-store-registration-response-type";
+import { RequireRatchet } from "@bitblit/ratchet-common/lang/require-ratchet";
+import { Logger } from "@bitblit/ratchet-common/logger/logger";
+import { ErrorRatchet } from "@bitblit/ratchet-common/lang/error-ratchet";
+import { StringRatchet } from "@bitblit/ratchet-common/lang/string-ratchet";
+import { Base64Ratchet } from "@bitblit/ratchet-common/lang/base64-ratchet";
+import { WardenDefaultUserDecorationProvider } from "./provider/warden-default-user-decoration-provider.js";
+import { WardenNoOpEventProcessingProvider } from "./provider/warden-no-op-event-processing-provider.js";
+import { WardenDefaultSendMagicLinkCommandValidator } from "./provider/warden-default-send-magic-link-command-validator.js";
+import { WardenLoginRequestType } from "@bitblit/ratchet-warden-common/common/model/warden-login-request-type";
+import { WardenEntryBuilder } from "./warden-entry-builder.js";
+import { WardenAuthorizer } from "./warden-authorizer.js";
 export class WardenService {
     inOptions;
     opts;
+    cacheAuthorizer;
     constructor(inOptions) {
         this.inOptions = inOptions;
-        RequireRatchet.notNullOrUndefined(inOptions, 'options');
-        RequireRatchet.notNullOrUndefined(inOptions.relyingPartyName, 'options.relyingPartyName');
-        RequireRatchet.notNullUndefinedOrEmptyArray(inOptions.allowedOrigins, 'options.allowedOrigins');
-        RequireRatchet.notNullOrUndefined(inOptions.storageProvider, 'options.storageProvider');
-        RequireRatchet.notNullOrUndefined(inOptions.jwtRatchet, 'options.jwtRatchet');
-        RequireRatchet.notNullUndefinedOrEmptyArray(inOptions.singleUseCodeProviders, 'options.singleUseCodeProviders');
+        RequireRatchet.notNullOrUndefined(inOptions, "options");
+        RequireRatchet.notNullOrUndefined(inOptions.relyingPartyName, "options.relyingPartyName");
+        RequireRatchet.notNullUndefinedOrEmptyArray(inOptions.allowedOrigins, "options.allowedOrigins");
+        RequireRatchet.notNullOrUndefined(inOptions.storageProvider, "options.storageProvider");
+        RequireRatchet.notNullOrUndefined(inOptions.jwtRatchet, "options.jwtRatchet");
+        RequireRatchet.notNullUndefinedOrEmptyArray(inOptions.singleUseCodeProviders, "options.singleUseCodeProviders");
         this.opts = Object.assign({
             userTokenDataProvider: new WardenDefaultUserDecorationProvider(),
             eventProcessor: new WardenNoOpEventProcessingProvider(),
-            sendMagicLinkCommandValidator: new WardenDefaultSendMagicLinkCommandValidator(),
+            sendMagicLinkCommandValidator: new WardenDefaultSendMagicLinkCommandValidator()
         }, inOptions);
+        this.cacheAuthorizer = new WardenAuthorizer(inOptions);
+    }
+    get authorizer() {
+        return this.cacheAuthorizer;
     }
     get options() {
         return Object.assign({}, this.opts);
@@ -41,7 +49,7 @@ export class WardenService {
             const cmd = JSON.parse(cmdString);
             const resp = await this.processCommandToResponse(cmd, origin, loggedInUserId);
             if (resp === null) {
-                Logger.warn('Response was null for %s %s %s', cmdString, origin, loggedInUserId);
+                Logger.warn("Response was null for %s %s %s", cmdString, origin, loggedInUserId);
             }
             else {
                 rval = JSON.stringify(resp);
@@ -49,7 +57,7 @@ export class WardenService {
         }
         catch (err) {
             const errString = ErrorRatchet.safeStringifyErr(err);
-            Logger.error('Failed %s : %j', errString, cmdString, err);
+            Logger.error("Failed %s : %j", errString, cmdString, err);
             rval = JSON.stringify({ error: errString });
         }
         return rval;
@@ -57,25 +65,26 @@ export class WardenService {
     async processCommandToResponse(cmd, origin, loggedInUserId) {
         let rval = null;
         if (cmd) {
-            Logger.info('Processing command : UserID: %s  Origin: %s Command: %j', loggedInUserId, origin, cmd);
+            Logger.info("Processing command : UserID: %s  Origin: %s Command: %j", loggedInUserId, origin, cmd);
             if (cmd.sendExpiringValidationToken) {
-                rval = { sendExpiringValidationToken: await this.sendExpiringValidationToken(cmd.sendExpiringValidationToken) };
+                rval = { sendExpiringValidationToken: await this.sendExpiringValidationToken(cmd.sendExpiringValidationToken, origin) };
             }
             else if (cmd.generateWebAuthnAuthenticationChallengeForUserId) {
                 const tmp = await this.generateWebAuthnAuthenticationChallengeForUserId(cmd.generateWebAuthnAuthenticationChallengeForUserId, origin);
                 rval = { generateWebAuthnAuthenticationChallengeForUserId: { dataAsJson: JSON.stringify(tmp) } };
             }
             else if (cmd.createAccount) {
+                const newEntry = await this.createAccount(cmd.createAccount.contact, origin, cmd.createAccount.sendCode, cmd.createAccount.label, cmd.createAccount.tags);
                 rval = {
-                    createAccount: await this.createAccount(cmd.createAccount.contact, cmd.createAccount.sendCode, cmd.createAccount.label, cmd.createAccount.tags),
+                    createAccount: newEntry.userId
                 };
             }
             else if (cmd.sendMagicLink) {
                 if (cmd?.sendMagicLink?.contactLookup && cmd?.sendMagicLink?.contact) {
-                    throw ErrorRatchet.fErr('You may not specify both contact and contactLookup');
+                    throw ErrorRatchet.fErr("You may not specify both contact and contactLookup");
                 }
                 if (!cmd?.sendMagicLink?.contactLookup && !cmd?.sendMagicLink?.contact) {
-                    throw ErrorRatchet.fErr('You must not specify either contact and contactLookup');
+                    throw ErrorRatchet.fErr("You must not specify either contact and contactLookup");
                 }
                 if (cmd.sendMagicLink.contactLookup) {
                     const entry = await this.findEntryById(cmd.sendMagicLink.contactLookup.userId);
@@ -90,7 +99,7 @@ export class WardenService {
                     cmd.sendMagicLink.contactLookup = null;
                 }
                 if (!cmd.sendMagicLink.contact) {
-                    throw ErrorRatchet.fErr('Could not find contract entry either directly or by lookup');
+                    throw ErrorRatchet.fErr("Could not find contract entry either directly or by lookup");
                 }
                 const loggedInUser = StringRatchet.trimToNull(loggedInUserId)
                     ? await this.opts.storageProvider.findEntryById(loggedInUserId)
@@ -98,19 +107,19 @@ export class WardenService {
                 await this.opts.sendMagicLinkCommandValidator.allowMagicLinkCommand(cmd.sendMagicLink, origin, loggedInUser);
                 const ttlSeconds = cmd?.sendMagicLink?.ttlSeconds || 300;
                 rval = {
-                    sendMagicLink: await this.sendMagicLink(cmd.sendMagicLink.contact, cmd.sendMagicLink.overrideDestinationContact, this.opts.relyingPartyName, cmd.sendMagicLink.landingUrl, cmd.sendMagicLink.meta, ttlSeconds, cmd.sendMagicLink.customTemplate),
+                    sendMagicLink: await this.sendMagicLink(cmd.sendMagicLink.contact, cmd.sendMagicLink.overrideDestinationContact, this.opts.relyingPartyName, cmd.sendMagicLink.landingUrl, cmd.sendMagicLink.meta, ttlSeconds, cmd.sendMagicLink.customTemplate)
                 };
             }
             else if (cmd.generateWebAuthnRegistrationChallengeForLoggedInUser) {
                 if (!StringRatchet.trimToNull(loggedInUserId)) {
-                    ErrorRatchet.throwFormattedErr('This requires a logged in user');
+                    ErrorRatchet.throwFormattedErr("This requires a logged in user");
                 }
                 const tmp = await this.generateWebAuthnRegistrationChallengeForLoggedInUser(loggedInUserId, origin);
                 rval = { generateWebAuthnRegistrationChallengeForLoggedInUser: { dataAsJson: JSON.stringify(tmp) } };
             }
             else if (cmd.addContactToLoggedInUser) {
                 if (!WardenUtils.validContact(cmd.addContactToLoggedInUser)) {
-                    ErrorRatchet.throwFormattedErr('Cannot add, invalid contact %j', cmd.addContactToLoggedInUser);
+                    ErrorRatchet.throwFormattedErr("Cannot add, invalid contact %j", cmd.addContactToLoggedInUser);
                 }
                 else {
                     const out = await this.addContactMethodToUser(loggedInUserId, cmd.addContactToLoggedInUser);
@@ -119,7 +128,7 @@ export class WardenService {
             }
             else if (cmd.addWebAuthnRegistrationToLoggedInUser) {
                 if (!StringRatchet.trimToNull(loggedInUserId)) {
-                    ErrorRatchet.throwFormattedErr('This requires a logged in user');
+                    ErrorRatchet.throwFormattedErr("This requires a logged in user");
                 }
                 const data = JSON.parse(cmd.addWebAuthnRegistrationToLoggedInUser.webAuthn.dataAsJson);
                 const out = await this.storeAuthnRegistration(loggedInUserId, origin, cmd.addWebAuthnRegistrationToLoggedInUser.applicationName, cmd.addWebAuthnRegistrationToLoggedInUser.deviceLabel, data);
@@ -130,72 +139,130 @@ export class WardenService {
                     rval = { error: out.error };
                 }
                 else {
-                    rval = { error: 'Cannot happen - neither user nor error set' };
+                    rval = { error: "Cannot happen - neither user nor error set" };
                 }
             }
             else if (cmd.removeWebAuthnRegistration) {
                 const modified = await this.removeSingleWebAuthnRegistration(cmd.removeWebAuthnRegistration.userId, cmd.removeWebAuthnRegistration.credentialId);
                 rval = {
-                    removeWebAuthnRegistration: WardenUtils.stripWardenEntryToSummary(modified),
+                    removeWebAuthnRegistration: WardenUtils.stripWardenEntryToSummary(modified)
                 };
             }
             else if (cmd.removeWebAuthnRegistrationFromLoggedInUser) {
                 const modified = await this.removeSingleWebAuthnRegistration(loggedInUserId, cmd.removeWebAuthnRegistrationFromLoggedInUser);
                 rval = {
-                    removeWebAuthnRegistrationFromLoggedInUser: WardenUtils.stripWardenEntryToSummary(modified),
+                    removeWebAuthnRegistrationFromLoggedInUser: WardenUtils.stripWardenEntryToSummary(modified)
                 };
             }
             else if (cmd.removeContactFromLoggedInUser) {
                 const output = await this.removeContactMethodFromUser(loggedInUserId, cmd.removeContactFromLoggedInUser);
                 rval = {
-                    removeContactFromLoggedInUser: WardenUtils.stripWardenEntryToSummary(output),
+                    removeContactFromLoggedInUser: WardenUtils.stripWardenEntryToSummary(output)
                 };
             }
             else if (cmd.performLogin) {
                 const loginData = cmd.performLogin;
-                const loginOk = await this.processLogin(loginData, origin);
-                Logger.info('Performing login - login auth check was : %s', loginOk);
-                if (loginOk) {
-                    const user = StringRatchet.trimToNull(loginData.userId)
-                        ? await this.opts.storageProvider.findEntryById(loginData.userId)
-                        : await this.opts.storageProvider.findEntryByContact(loginData.contact);
+                const user = await this.processLogin(loginData, origin);
+                if (user) {
                     const decoration = await this.opts.userDecorationProvider.fetchDecoration(user);
                     const wardenToken = {
-                        loginData: WardenUtils.stripWardenEntryToSummary(user),
+                        wardenData: WardenUtils.stripWardenEntryToSummary(user),
                         user: decoration.userTokenData,
-                        roles: WardenUtils.teamRolesToRoles(decoration.userTeamRoles),
-                        proxy: null,
+                        proxy: decoration.proxyUserTokenData,
+                        globalRoleIds: decoration.globalRoleIds,
+                        teamRoleMappings: decoration.teamRoleMappings
                     };
                     const jwtToken = await this.opts.jwtRatchet.createTokenString(wardenToken, decoration.userTokenExpirationSeconds);
                     const output = {
                         request: loginData,
                         userId: user.userId,
-                        jwtToken: jwtToken,
+                        jwtToken: jwtToken
                     };
                     rval = { performLogin: output };
                 }
                 else {
-                    rval = { error: 'Login failed' };
+                    rval = { error: "Login failed" };
                 }
             }
             else if (cmd.refreshJwtToken) {
                 const parsed = await this.opts.jwtRatchet.decodeToken(cmd.refreshJwtToken, 1);
-                const user = await this.opts.storageProvider.findEntryById(parsed.loginData.userId);
+                const user = await this.opts.storageProvider.findEntryById(parsed.wardenData.userId);
                 const decoration = await this.opts.userDecorationProvider.fetchDecoration(user);
                 const wardenToken = {
-                    loginData: WardenUtils.stripWardenEntryToSummary(user),
+                    wardenData: WardenUtils.stripWardenEntryToSummary(user),
                     user: decoration.userTokenData,
-                    roles: WardenUtils.teamRolesToRoles(decoration.userTeamRoles),
-                    proxy: null,
+                    proxy: decoration.proxyUserTokenData,
+                    globalRoleIds: decoration.globalRoleIds,
+                    teamRoleMappings: decoration.teamRoleMappings
                 };
                 const newToken = await this.opts.jwtRatchet.createTokenString(wardenToken, decoration.userTokenExpirationSeconds);
                 rval = {
-                    refreshJwtToken: newToken,
+                    refreshJwtToken: newToken
+                };
+            }
+            else if (cmd.exportWebAuthnRegistrationEntryForLoggedInUser) {
+                rval = {
+                    exportWebAuthnRegistrationEntryForLoggedInUser: await this.exportWebAuthnRegistrationEntry(cmd.exportWebAuthnRegistrationEntryForLoggedInUser, loggedInUserId)
+                };
+            }
+            else if (cmd.importWebAuthnRegistrationEntryForLoggedInUser) {
+                rval = {
+                    importWebAuthnRegistrationEntryForLoggedInUser: await this.importWebAuthnRegistrationEntry(cmd.importWebAuthnRegistrationEntryForLoggedInUser, loggedInUserId)
+                };
+            }
+        }
+        else {
+            rval = { error: "No command sent" };
+        }
+        return rval;
+    }
+    async exportWebAuthnRegistrationEntry(origin, userId) {
+        const ent = await this.opts.storageProvider.findEntryById(userId);
+        let rval = null;
+        if (ent) {
+            const webAuth = ent.webAuthnAuthenticators.find(w => w.origin === origin);
+            if (webAuth) {
+                const oUrl = new URL(origin);
+                const rpId = oUrl.hostname;
+                Logger.debug('Finding challenge for origin %s  / RPID %s', origin, rpId);
+                const expectedChallenge = await this.opts.storageProvider.fetchCurrentUserChallenge(userId, rpId);
+                const token = {
+                    entry: webAuth,
+                    challenge: expectedChallenge
                 };
+                const s1 = JSON.stringify(token);
+                rval = Base64Ratchet.encodeStringToBase64String(s1);
+            }
+            else {
+                Logger.warn("Could not export webauthn - no such origin");
+            }
+        }
+        else {
+            Logger.warn("Could not export webauthn - no such user id");
+        }
+        return rval;
+    }
+    async importWebAuthnRegistrationEntry(token, userId) {
+        const ent = await this.opts.storageProvider.findEntryById(userId);
+        let rval = false;
+        if (ent) {
+            const s1 = Base64Ratchet.base64StringToString(token);
+            const newEntry = JSON.parse(s1);
+            const old = ent.webAuthnAuthenticators.find(w => w.origin === newEntry.entry.origin);
+            if (old) {
+                Logger.warn("Removing existing entry %j", old);
+                ent.webAuthnAuthenticators = ent.webAuthnAuthenticators.filter(w => w.origin !== newEntry.entry.origin);
+            }
+            ent.webAuthnAuthenticators.push(newEntry.entry);
+            await this.opts.storageProvider.saveEntry(ent);
+            if (newEntry.challenge) {
+                await this.opts.storageProvider.updateUserChallenge(userId, newEntry.entry.origin, newEntry.challenge);
             }
+            Logger.info("Wrote ok");
+            rval = true;
         }
         else {
-            rval = { error: 'No command sent' };
+            Logger.warn("Could not export webauthn - no such user id");
         }
         return rval;
     }
@@ -213,74 +280,81 @@ export class WardenService {
     singleUseCodeProvider(contact, requireMagicLinkSupport, returnNullIfNoProviders) {
         const rval = this.opts.singleUseCodeProviders.find((s) => s.handlesContactType(contact.type) && (!requireMagicLinkSupport || s.createCodeAndSendMagicLink));
         if (!rval && !returnNullIfNoProviders) {
-            throw ErrorRatchet.fErr('Cannot find a single use code provider for contact type : %s', contact.type);
+            throw ErrorRatchet.fErr("Cannot find a single use code provider for contact type : %s", contact.type);
         }
         return rval;
     }
     async sendMagicLink(contact, overrideDestinationContact, relyingPartyName, landingUrl, metaIn, ttlSeconds, customTemplate) {
         let rval = false;
-        RequireRatchet.notNullOrUndefined(contact, 'contact');
-        RequireRatchet.notNullUndefinedOrOnlyWhitespaceString(landingUrl, 'landingUrl');
-        RequireRatchet.true(this.urlIsOnAllowedOrigin(landingUrl), 'landingUrl is not on an allowed origin for redirect');
+        RequireRatchet.notNullOrUndefined(contact, "contact");
+        RequireRatchet.notNullUndefinedOrOnlyWhitespaceString(landingUrl, "landingUrl");
+        RequireRatchet.true(this.urlIsOnAllowedOrigin(landingUrl), "landingUrl is not on an allowed origin for redirect");
         if (contact?.type && StringRatchet.trimToNull(contact?.value)) {
             const prov = this.singleUseCodeProvider(contact, true);
             rval = await prov.createCodeAndSendMagicLink(contact, relyingPartyName, landingUrl, metaIn, ttlSeconds, overrideDestinationContact, customTemplate);
         }
         else {
-            ErrorRatchet.throwFormattedErr('Cannot send - invalid contact %j', contact);
+            ErrorRatchet.throwFormattedErr("Cannot send - invalid contact %j", contact);
         }
         return rval;
     }
-    async createAccount(contact, sendCode, label, tags) {
+    async createAccountByThirdParty(thirdParty, origin, inLabel) {
+        let rval = null;
+        RequireRatchet.notNullOrUndefined(thirdParty, "thirdParty");
+        RequireRatchet.notNullUndefinedOrOnlyWhitespaceString(thirdParty.thirdParty, "thirdParty");
+        RequireRatchet.notNullUndefinedOrOnlyWhitespaceString(thirdParty.thirdPartyId, "thirdPartyId");
+        const old = await this.opts.storageProvider.findEntryByThirdPartyId(thirdParty.thirdParty, thirdParty.thirdPartyId);
+        if (old) {
+            ErrorRatchet.throwFormattedErr("Cannot create - account already exists for %j", thirdParty);
+        }
+        const label = inLabel || thirdParty.thirdParty + " " + thirdParty.thirdPartyId;
+        const newUser = new WardenEntryBuilder(label).withThirdPartyAuthentication([thirdParty]).entry;
+        rval = await this.opts.storageProvider.saveEntry(newUser);
+        return rval;
+    }
+    async createAccount(contact, origin, sendCode, label, tags) {
         let rval = null;
         if (WardenUtils.validContact(contact)) {
             const old = await this.opts.storageProvider.findEntryByContact(contact);
             if (old) {
-                ErrorRatchet.throwFormattedErr('Cannot create - account already exists for %j', contact);
-            }
-            const guid = StringRatchet.createType4Guid();
-            const now = Date.now();
-            const newUser = {
-                userId: guid,
-                userLabel: label || 'User ' + guid,
-                contactMethods: [contact],
-                tags: tags || [],
-                webAuthnAuthenticators: [],
-                createdEpochMS: now,
-                updatedEpochMS: now,
-            };
-            const next = await this.opts.storageProvider.saveEntry(newUser);
-            rval = next.userId;
-            if (this?.opts?.eventProcessor) {
-                await this.opts.eventProcessor.userCreated(next);
+                ErrorRatchet.throwFormattedErr("Cannot create - account already exists for %j", contact);
             }
+            const newUser = new WardenEntryBuilder(label || contact.value).withContacts([contact]).withTags(tags).entry;
+            rval = await this.opts.storageProvider.saveEntry(newUser);
             if (sendCode) {
-                Logger.info('New user %j created and send requested - sending', next);
-                await this.sendExpiringValidationToken(contact);
+                Logger.info("New user %j created and send requested - sending", rval);
+                await this.sendExpiringValidationToken(contact, origin);
             }
         }
         else {
-            ErrorRatchet.throwFormattedErr('Cannot create - invalid contact (missing or invalid fields)');
+            ErrorRatchet.throwFormattedErr("Cannot create - invalid contact (missing or invalid fields)");
         }
         return rval;
     }
+    async saveNewUser(newUser) {
+        const next = await this.opts.storageProvider.saveEntry(newUser);
+        if (this?.opts?.eventProcessor) {
+            await this.opts.eventProcessor.userCreated(next);
+        }
+        return next;
+    }
     async addContactMethodToUser(userId, contact) {
         let rval = false;
         if (StringRatchet.trimToNull(userId) && WardenUtils.validContact(contact)) {
             const otherUser = await this.opts.storageProvider.findEntryByContact(contact);
             if (otherUser && otherUser.userId !== userId) {
-                ErrorRatchet.throwFormattedErr('Cannot add contact to this user, another user already has that contact');
+                ErrorRatchet.throwFormattedErr("Cannot add contact to this user, another user already has that contact");
             }
             const curUser = await this.opts.storageProvider.findEntryById(userId);
             if (!curUser) {
-                ErrorRatchet.throwFormattedErr('Cannot add contact to this user, user does not exist');
+                ErrorRatchet.throwFormattedErr("Cannot add contact to this user, user does not exist");
             }
             curUser.contactMethods.push(contact);
             await this.opts.storageProvider.saveEntry(curUser);
             rval = true;
         }
         else {
-            ErrorRatchet.throwFormattedErr('Cannot add - invalid config : %s %j', userId, contact);
+            ErrorRatchet.throwFormattedErr("Cannot add - invalid config : %s %j", userId, contact);
         }
         return rval;
     }
@@ -289,32 +363,32 @@ export class WardenService {
         if (StringRatchet.trimToNull(userId) && WardenUtils.validContact(contact)) {
             const curUser = await this.opts.storageProvider.findEntryById(userId);
             if (!curUser) {
-                ErrorRatchet.throwFormattedErr('Cannot remove contact from this user, user does not exist');
+                ErrorRatchet.throwFormattedErr("Cannot remove contact from this user, user does not exist");
             }
             curUser.contactMethods = (curUser.contactMethods || []).filter((s) => s.type !== contact.type || s.value !== contact.value);
             if (curUser.contactMethods.length === 0) {
-                ErrorRatchet.throwFormattedErr('Cannot remove the last contact method from a user');
+                ErrorRatchet.throwFormattedErr("Cannot remove the last contact method from a user");
             }
             await this.opts.storageProvider.saveEntry(curUser);
             rval = await this.opts.storageProvider.findEntryById(userId);
         }
         else {
-            ErrorRatchet.throwFormattedErr('Cannot add - invalid config : %s %j', userId, contact);
+            ErrorRatchet.throwFormattedErr("Cannot add - invalid config : %s %j", userId, contact);
         }
         return rval;
     }
     async generateWebAuthnRegistrationChallengeForLoggedInUser(userId, origin) {
         if (!origin || !this.opts.allowedOrigins.includes(origin)) {
-            throw new Error('Invalid origin : ' + origin);
+            throw new Error("Invalid origin : " + origin);
         }
         const asUrl = new URL(origin);
         const rpID = asUrl.hostname;
         const entry = await this.opts.storageProvider.findEntryById(userId);
         if (!entry) {
-            throw ErrorRatchet.fErr('Cannot generateWebAuthnRegistrationChallengeForLoggedInUser - no user %s / %s', userId, origin);
+            throw ErrorRatchet.fErr("Cannot generateWebAuthnRegistrationChallengeForLoggedInUser - no user %s / %s", userId, origin);
         }
         if (!entry?.webAuthnAuthenticators?.length) {
-            Logger.info('Entry has no webAuthnAuthenticators');
+            Logger.info("Entry has no webAuthnAuthenticators");
             entry.webAuthnAuthenticators = [];
         }
         const options = await generateRegistrationOptions({
@@ -322,67 +396,67 @@ export class WardenService {
             rpID: rpID,
             userID: StringRatchet.stringToUint8Array(entry.userId),
             userName: entry.userLabel,
-            attestationType: 'none',
+            attestationType: "none",
             excludeCredentials: entry.webAuthnAuthenticators.map((authenticator) => ({
                 id: authenticator.credentialPublicKeyBase64,
-                transports: authenticator.transports,
-            })),
+                transports: authenticator.transports
+            }))
         });
         await this.opts.storageProvider.updateUserChallenge(entry.userId, rpID, options.challenge);
         return options;
     }
     async storeAuthnRegistration(userId, origin, applicationName, deviceLabel, data) {
-        Logger.info('Store authn data : %j', data);
+        Logger.info("Store authn data : %j", data);
         let rval = null;
         try {
             if (!origin || !this.opts.allowedOrigins.includes(origin)) {
-                throw new Error('Invalid origin : ' + origin);
+                throw new Error("Invalid origin : " + origin);
             }
             const asUrl = new URL(origin);
             const rpID = asUrl.hostname;
             const user = await this.opts.storageProvider.findEntryById(userId);
             if (!user) {
-                throw ErrorRatchet.fErr('Cannot storeAuthnRegistration - no user %s / %s', userId, origin);
+                throw ErrorRatchet.fErr("Cannot storeAuthnRegistration - no user %s / %s", userId, origin);
             }
             const expectedChallenge = await this.opts.storageProvider.fetchCurrentUserChallenge(user.userId, rpID);
             const vrOpts = {
                 response: data,
                 expectedChallenge: expectedChallenge,
                 expectedOrigin: origin,
-                expectedRPID: rpID,
+                expectedRPID: rpID
             };
-            Logger.info('Calling verifyRegistrationResponse: %j', vrOpts);
+            Logger.info("Calling verifyRegistrationResponse: %j", vrOpts);
             const verification = await verifyRegistrationResponse(vrOpts);
-            Logger.info('verifyRegistrationResponse Result : %j', verification);
+            Logger.info("verifyRegistrationResponse Result : %j", verification);
             rval = {
                 updatedEntry: null,
                 registrationResponseId: data.id,
-                result: verification.verified ? WardenStoreRegistrationResponseType.Verified : WardenStoreRegistrationResponseType.Failed,
+                result: verification.verified ? WardenStoreRegistrationResponseType.Verified : WardenStoreRegistrationResponseType.Failed
             };
             if (rval.result === WardenStoreRegistrationResponseType.Verified) {
-                Logger.info('Storing registration');
+                Logger.info("Storing registration");
                 const newAuth = {
                     origin: origin,
-                    applicationName: applicationName || 'Unknown Application',
-                    deviceLabel: deviceLabel || 'Unknown Device',
+                    applicationName: applicationName || "Unknown Application",
+                    deviceLabel: deviceLabel || "Unknown Device",
                     counter: verification.registrationInfo.credential.counter,
                     credentialBackedUp: verification.registrationInfo.credentialBackedUp,
                     credentialDeviceType: verification.registrationInfo.credentialDeviceType,
                     credentialIdBase64: verification.registrationInfo.credential.id,
-                    credentialPublicKeyBase64: Base64Ratchet.uint8ArrayToBase64UrlString(verification.registrationInfo.credential.publicKey),
+                    credentialPublicKeyBase64: Base64Ratchet.uint8ArrayToBase64UrlString(verification.registrationInfo.credential.publicKey)
                 };
                 user.webAuthnAuthenticators = (user.webAuthnAuthenticators || []).filter((wa) => wa.credentialIdBase64 !== newAuth.credentialIdBase64);
                 user.webAuthnAuthenticators.push(newAuth);
                 const storedUser = await this.opts.storageProvider.saveEntry(user);
                 rval.updatedEntry = storedUser;
-                Logger.info('Stored auth : %j', storedUser);
+                Logger.info("Stored auth : %j", storedUser);
             }
         }
         catch (err) {
             rval = {
                 registrationResponseId: data.id,
                 result: WardenStoreRegistrationResponseType.Error,
-                error: ErrorRatchet.safeStringifyErr(err),
+                error: ErrorRatchet.safeStringifyErr(err)
             };
         }
         return rval;
@@ -395,70 +469,95 @@ export class WardenService {
     async generateWebAuthnAuthenticationChallenge(user, origin) {
         const userAuthenticators = user.webAuthnAuthenticators;
         if (!origin || !this.opts.allowedOrigins.includes(origin)) {
-            throw new Error('Invalid origin : ' + origin);
+            throw new Error("Invalid origin : " + origin);
         }
         const asUrl = new URL(origin);
         const rpID = asUrl.hostname;
         const out = userAuthenticators.map((authenticator) => {
             const next = {
                 id: authenticator.credentialIdBase64,
-                transports: authenticator.transports,
+                transports: authenticator.transports
             };
             return next;
         });
         const opts = {
             rpID: rpID,
             allowCredentials: out,
-            userVerification: 'preferred',
+            userVerification: "preferred"
         };
         const options = await generateAuthenticationOptions(opts);
         await this.opts.storageProvider.updateUserChallenge(user.userId, rpID, options.challenge);
         return options;
     }
-    async sendExpiringValidationToken(request) {
+    async sendExpiringValidationToken(request, origin) {
         let rval = false;
         if (request?.type && StringRatchet.trimToNull(request?.value)) {
             const prov = this.singleUseCodeProvider(request, false);
-            rval = await prov.createAndSendNewCode(request, this.opts.relyingPartyName);
+            rval = await prov.createAndSendNewCode(request, this.opts.relyingPartyName, origin);
         }
         else {
-            ErrorRatchet.throwFormattedErr('Cannot send - invalid request %j', request);
+            ErrorRatchet.throwFormattedErr("Cannot send - invalid request %j", request);
         }
         return rval;
     }
     async processLogin(request, origin) {
-        Logger.info('Processing login : %s : %j', origin, request);
-        let rval = false;
-        RequireRatchet.notNullOrUndefined(request, 'request');
-        RequireRatchet.true(!!StringRatchet.trimToNull(request?.userId) || WardenUtils.validContact(request?.contact), 'Invalid contact and no userId');
-        RequireRatchet.true(!!request?.webAuthn || !!StringRatchet.trimToNull(request?.expiringToken), 'You must provide one of webAuthn or expiringToken');
-        RequireRatchet.true(!request?.webAuthn || !StringRatchet.trimToNull(request?.expiringToken), 'WebAuthn and ExpiringToken may not BOTH be set');
-        let user = StringRatchet.trimToNull(request?.userId)
-            ? await this.opts.storageProvider.findEntryById(request?.userId)
-            : await this.opts.storageProvider.findEntryByContact(request.contact);
-        if (!user) {
-            Logger.info('User not found, and createUserIfMissing=%s / %j', request.createUserIfMissing, request.contact);
-            if (request.createUserIfMissing && request.contact) {
-                const newVal = await this.createAccount(request.contact);
-                Logger.info('Finished create, new id is %s', newVal);
-                user = await this.opts.storageProvider.findEntryById(newVal);
+        Logger.info("Processing login : %s : %j", origin, request);
+        let rval = null;
+        const requestErrors = WardenUtils.loginRequestErrors(request);
+        if (requestErrors.length > 0) {
+            throw ErrorRatchet.fErr("Invalid login request : %j", requestErrors);
+        }
+        if (request.type === WardenLoginRequestType.ThirdParty) {
+            const provider = (this.options.thirdPartyAuthenticationProviders ?? [])
+                .find(s => s.handlesThirdParty(request.thirdPartyToken.thirdParty));
+            if (provider) {
+                const auth = await provider.validateTokenAndReturnThirdPartyUserId(request.thirdPartyToken, origin);
+                if (auth) {
+                    rval = await this.opts.storageProvider.findEntryByThirdPartyId(auth.thirdParty, auth.thirdPartyId);
+                    if (!rval && request.createUserIfMissing) {
+                        Logger.info("Found no existing user for %j, creating", auth);
+                        let label = auth.thirdParty + " " + auth.thirdPartyId;
+                        if (provider.extractUserLabelFromAuthentication) {
+                            label = await provider.extractUserLabelFromAuthentication(auth);
+                        }
+                        rval = await this.createAccountByThirdParty(auth, origin, label);
+                        Logger.info("Finished create, new id is %s", rval.userId);
+                    }
+                }
+                else {
+                    Logger.warn("Authentication failed for %j", request.thirdPartyToken, request.createUserIfMissing);
+                }
             }
-            if (!user) {
-                ErrorRatchet.throwFormattedErr('No user found for %j / %s', request?.contact, request?.userId);
+            else {
+                Logger.warn("Could not find any provider to handle third party token %j", request.thirdPartyToken);
             }
         }
-        if (request.webAuthn) {
-            rval = await this.loginWithWebAuthnRequest(user, origin, request.webAuthn);
-        }
-        else if (StringRatchet.trimToNull(request.expiringToken)) {
-            const prov = this.singleUseCodeProvider(request.contact, false);
-            const lookup = await prov.checkCode(request.contact.value, request.expiringToken);
-            if (lookup) {
-                rval = true;
+        else {
+            let user = StringRatchet.trimToNull(request?.userId)
+                ? await this.opts.storageProvider.findEntryById(request?.userId)
+                : await this.opts.storageProvider.findEntryByContact(request.contact);
+            if (!user) {
+                Logger.info("User not found, and createUserIfMissing=%s / %j", request.createUserIfMissing, request.contact);
+                if (request.createUserIfMissing && request.contact) {
+                    user = await this.createAccount(request.contact, origin);
+                    Logger.info("Finished create, new id is %s", user.userId);
+                }
+                if (!user) {
+                    ErrorRatchet.throwFormattedErr("No user found for %j / %s", request?.contact, request?.userId);
+                }
             }
-            else {
-                ErrorRatchet.throwFormattedErr('Cannot login - token is invalid for this user');
+            let loginSuccess = false;
+            if (request.webAuthn) {
+                loginSuccess = await this.loginWithWebAuthnRequest(user, origin, request.webAuthn);
             }
+            else if (StringRatchet.trimToNull(request.expiringToken)) {
+                const prov = this.singleUseCodeProvider(request.contact, false);
+                loginSuccess = await prov.checkCode(request.contact.value, request.expiringToken);
+                if (!loginSuccess) {
+                    ErrorRatchet.throwFormattedErr("Cannot login - token is invalid for this user");
+                }
+            }
+            rval = loginSuccess ? user : null;
         }
         return rval;
     }
@@ -470,7 +569,7 @@ export class WardenService {
         const auth = (user.webAuthnAuthenticators || []).find((s) => s.credentialIdBase64 === data.id);
         if (!auth) {
             const allIds = (user.webAuthnAuthenticators || []).map((s) => s.credentialIdBase64);
-            throw ErrorRatchet.fErr('Could not find authenticator %s (%s) for user %s (avail were : %j)', data.id, data.id, user.userId, allIds);
+            throw ErrorRatchet.fErr("Could not find authenticator %s (%s) for user %s (avail were : %j)", data.id, data.id, user.userId, allIds);
         }
         const vrOpts = {
             response: data,
@@ -480,8 +579,8 @@ export class WardenService {
             credential: {
                 counter: auth.counter,
                 id: auth.credentialIdBase64,
-                publicKey: Base64Ratchet.base64UrlStringToBytes(auth.credentialPublicKeyBase64),
-            },
+                publicKey: Base64Ratchet.base64UrlStringToBytes(auth.credentialPublicKeyBase64)
+            }
         };
         const verification = await verifyAuthenticationResponse(vrOpts);
         if (verification.verified) {
@@ -496,7 +595,7 @@ export class WardenService {
             ent = await this.opts.storageProvider.saveEntry(ent);
         }
         else {
-            Logger.info('Not removing - no such user as %s', userId);
+            Logger.info("Not removing - no such user as %s", userId);
         }
         return ent;
     }
@@ -512,7 +611,7 @@ export class WardenService {
                 rval = true;
             }
             else {
-                Logger.warn('Cannot remove non-existent user : %s', userId);
+                Logger.warn("Cannot remove non-existent user : %s", userId);
             }
         }
         return rval;