@boxxy/auth-oauth 0.2.5 → 0.2.7

package/src/auth/answer-consent-request.ts

@@ -1,189 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/answer-consent-request.ts at commit 4fe647cf.
-
-import { grantScopes } from '@boxxy/contract';
-import { buildPageResponse } from '../http/build-page-response.ts';
-import { isRecord } from '../utils/is-record.ts';
-import { APPROVAL_WINDOW_SECONDS } from './approval-window-seconds.ts';
-import { buildConsentBinding } from './build-consent-binding.ts';
-import { normalizeClientName } from './normalize-client-name.ts';
-import { readClientName } from './read-client-name.ts';
-import { readOwnerSessionID } from './read-owner-session-id.ts';
-import { removeOwnerSession } from './remove-owner-session.ts';
-import { renderConsentPage } from './render-consent-page.ts';
-import type { HTTPServerContext, Requester, SecurityOutcome } from './types.ts';
-import { verifyOAuthQuery } from './verify-oauth-query.ts';
-
-interface ConsentRequest {
-  readonly method: 'GET' | 'POST';
-  readonly url: URL;
-  readonly cookie: string | null;
-  readonly body: string;
-  readonly requester: Requester;
-}
-
-export async function answerConsentRequest(
-  ctx: HTTPServerContext,
-  request: ConsentRequest,
-): Promise<Response> {
-  const form = new URLSearchParams(request.body);
-
-  const oauthQuery =
-    request.method === 'GET' ? request.url.search.slice(1) : (form.get('oauth_query') ?? '');
-
-  const verified = await verifyConsentRequest(ctx, oauthQuery, request.cookie);
-
-  if (verified === null) {
-    return buildPageResponse(400, {
-      message: 'This approval expired or was already used. Start again from the client.',
-    });
-  }
-
-  if (request.method === 'GET') {
-    const params = new URLSearchParams(oauthQuery);
-
-    const redirectURI = params.get('redirect_uri') ?? '';
-    const requested = (params.get('scope') ?? '').split(' ');
-
-    const storedName = await readClientName(ctx.store.db, params.get('client_id') ?? '');
-
-    const page = renderConsentPage({
-      oauthQuery,
-      clientName: normalizeClientName(storedName),
-      redirectURI,
-      scopes: grantScopes.filter((scope) => requested.includes(scope)),
-    });
-
-    // The form's answer redirects to the client, which the page's form-action
-    // policy has to allow.
-    const formTargets = URL.canParse(redirectURI) ? [new URL(redirectURI).origin] : [];
-
-    return buildPageResponse(200, { page }, formTargets);
-  }
-
-  const sessionID = verified.sessionID;
-
-  // either answer ends the session's binding, so one sign-in approves one request.
-  ctx.approvals.removeApproved(sessionID);
-
-  const ticked = form.getAll('scope');
-  const scopes = grantScopes.filter((scope) => ticked.includes(scope));
-  const allow = form.get('decision') === 'approve';
-  const accept = allow && scopes.length > 0;
-
-  const choice = JSON.stringify({
-    accept,
-    ...(accept ? { scope: [...scopes, 'offline_access'].join(' ') } : {}),
-    oauth_query: oauthQuery,
-  });
-
-  const forwarded = new Request(`${ctx.origin}/oauth2/consent`, {
-    method: 'POST',
-    headers: {
-      'content-type': 'application/json',
-      accept: 'application/json',
-      origin: ctx.origin,
-      ...(request.cookie === null ? {} : { cookie: request.cookie }),
-    },
-    body: choice,
-  });
-
-  const consented = await ctx.store.auth.handler(forwarded);
-  const answer: unknown = await consented.json();
-
-  const next = isRecord(answer) ? (answer['url'] ?? answer['redirect_uri']) : undefined;
-
-  const issuedCode =
-    consented.ok && typeof next === 'string' && new URL(next).searchParams.has('code');
-
-  // the code exchange still needs the session, so it stays until the code expires;
-  // an answer that issued no code deletes it now.
-  await (issuedCode
-    ? ctx.store.db
-        .updateTable('session')
-        .set({
-          expiresAt: new Date(ctx.clock.now() + APPROVAL_WINDOW_SECONDS * 1000).toISOString(),
-        })
-        .where('id', '=', sessionID)
-        .execute()
-    : removeOwnerSession(ctx.store.db, sessionID));
-
-  const params = new URLSearchParams(oauthQuery);
-
-  const clientID = params.get('client_id') ?? '';
-  const redirectURI = params.get('redirect_uri') ?? '';
-
-  const storedName = await readClientName(ctx.store.db, clientID);
-
-  ctx.security.record({
-    ...pickConsentOutcome(issuedCode, allow && !accept),
-    path: request.url.pathname,
-    requester: request.requester,
-    client: { id: clientID, name: normalizeClientName(storedName) },
-    ...(URL.canParse(redirectURI) ? { redirectHost: new URL(redirectURI).host } : {}),
-    correlationID: verified.correlationID,
-  });
-
-  if (!consented.ok || typeof next !== 'string') {
-    return buildPageResponse(400, {
-      message: 'boxxy could not record this choice. Start again from the client.',
-    });
-  }
-
-  const authContext = await ctx.store.auth.$context;
-
-  const sessionCookie = authContext.authCookies.sessionToken;
-  const secure = sessionCookie.attributes.secure === true ? '; Secure' : '';
-
-  return new Response(null, {
-    status: 302,
-    headers: {
-      location: next,
-      'set-cookie': `${sessionCookie.name}=; Max-Age=0; Path=/; HttpOnly; SameSite=Lax${secure}`,
-    },
-  });
-}
-
-async function verifyConsentRequest(
-  ctx: HTTPServerContext,
-  oauthQuery: string,
-  cookie: string | null,
-): Promise<{ sessionID: string; correlationID: string } | null> {
-  const authContext = await ctx.store.auth.$context;
-
-  if (!(await verifyOAuthQuery(oauthQuery, authContext.secret, ctx.clock.now()))) {
-    return null;
-  }
-
-  // a query still asking for a login is one better-auth signed for the login page,
-  // which no passkey sign-in carried past.
-  const prompt = (new URLSearchParams(oauthQuery).get('prompt') ?? '').split(' ');
-
-  if (prompt.includes('login')) {
-    return null;
-  }
-
-  const sessionID = await readOwnerSessionID(ctx, cookie);
-
-  const approved = sessionID === null ? null : ctx.approvals.findApproved(sessionID);
-
-  if (
-    sessionID === null ||
-    approved === null ||
-    approved.binding !== buildConsentBinding(oauthQuery)
-  ) {
-    return null;
-  }
-
-  return { sessionID, correlationID: approved.correlationID };
-}
-
-// `noneTicked` is an allow sent with no scope ticked, which denies.
-function pickConsentOutcome(issuedCode: boolean, noneTicked: boolean): SecurityOutcome {
-  if (issuedCode) {
-    return { kind: 'consent', outcome: 'allowed' };
-  }
-
-  return noneTicked
-    ? { kind: 'consent', outcome: 'denied', reason: 'none_ticked' }
-    : { kind: 'consent', outcome: 'denied' };
-}

package/src/auth/answer-enroll-request.ts

@@ -1,190 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/answer-enroll-request.ts at commit 4fe647cf.
-
-import { buildPageResponse } from '../http/build-page-response.ts';
-import { createPasskey } from './create-passkey.ts';
-import { PASSKEY_SCRIPT } from './passkey-script.ts';
-import { readEnrollmentToken } from './read-enrollment-token.ts';
-import { renderEnrollPage } from './render-enroll-page.ts';
-import type { HTTPServerContext, Requester } from './types.ts';
-import { verifyPasskeyRegistration } from './verify-passkey-registration.ts';
-
-interface EnrollRequest {
-  readonly method: 'GET' | 'POST';
-  readonly url: URL;
-  readonly body: string;
-  readonly requester: Requester;
-}
-
-export async function answerEnrollRequest(
-  ctx: HTTPServerContext,
-  request: EnrollRequest,
-): Promise<Response> {
-  if (request.method === 'GET') {
-    const prefill = request.url.searchParams.get('token');
-
-    return buildPageResponse(200, {
-      page: renderEnrollPage({
-        ceremony: null,
-        error: null,
-        ...(prefill === null ? {} : { prefill }),
-      }),
-    });
-  }
-
-  const form = new URLSearchParams(request.body);
-
-  const token = (form.get('token') ?? '').trim();
-  const context = { path: request.url.pathname, requester: request.requester };
-
-  const tokenHash =
-    token === '' ? null : await readEnrollmentToken(ctx.store.db, token, ctx.clock.now());
-
-  if (tokenHash === null) {
-    ctx.security.record({
-      kind: 'owner_auth',
-      outcome: 'failed',
-      reason: 'invalid_token',
-      ...context,
-    });
-
-    return buildPageResponse(400, {
-      page: renderEnrollPage({
-        ceremony: null,
-        error:
-          'That enrollment token is unknown, used, or expired. Run the enroll command on the host again for a new one.',
-      }),
-    });
-  }
-
-  if (!form.has('credential')) {
-    return answerCeremony(ctx, { status: 200, token, tokenHash, error: null });
-  }
-
-  const taken = ctx.enrollments.claimChallenge(tokenHash);
-
-  const registered =
-    taken.kind === 'taken'
-      ? await verifyPasskeyRegistration({
-          credential: form.get('credential') ?? '',
-          challenge: taken.challenge,
-          origin: ctx.origin,
-          rpID: new URL(ctx.origin).hostname,
-        })
-      : null;
-
-  if (registered === null) {
-    const expired = taken.kind === 'expired';
-
-    ctx.security.record({
-      kind: 'owner_auth',
-      outcome: 'failed',
-      reason: expired ? 'expired' : 'assertion_failed',
-      ...context,
-    });
-
-    const error = expired
-      ? 'The enrollment took too long. Try again.'
-      : 'boxxy could not enroll that passkey. Try again.';
-
-    return answerCeremony(ctx, { status: 400, token, tokenHash, error });
-  }
-
-  let created: boolean;
-
-  try {
-    created = await createPasskey(ctx.store.db, {
-      tokenHash,
-      id: registered.id,
-      publicKey: Buffer.from(registered.publicKey).toString('base64url'),
-      counter: registered.counter,
-      transports: registered.transports,
-      now: ctx.clock.now(),
-    });
-  } catch {
-    ctx.security.record({
-      kind: 'owner_auth',
-      outcome: 'failed',
-      reason: 'assertion_failed',
-      ...context,
-    });
-
-    return answerCeremony(ctx, {
-      status: 400,
-      token,
-      tokenHash,
-      error: 'That passkey is already enrolled. Use another device, or sign in with it.',
-    });
-  }
-
-  if (!created) {
-    ctx.security.record({
-      kind: 'owner_auth',
-      outcome: 'failed',
-      reason: 'invalid_token',
-      ...context,
-    });
-
-    return buildPageResponse(400, {
-      page: renderEnrollPage({
-        ceremony: null,
-        error:
-          'That enrollment token is unknown, used, or expired. Run the enroll command on the host again for a new one.',
-      }),
-    });
-  }
-
-  ctx.security.record({ kind: 'owner_auth', outcome: 'succeeded', ...context });
-
-  return buildPageResponse(200, {
-    message: 'Passkey enrolled. Start the connection again from your client and sign in with it.',
-  });
-}
-
-// How long the browser's passkey prompt waits, in milliseconds.
-const PROMPT_TIMEOUT_MS = 120_000;
-
-// The single owner's WebAuthn user handle, the same for every passkey, so
-// an authenticator files each one under the one boxxy account.
-const OWNER_HANDLE = Buffer.from('boxxy-owner').toString('base64url');
-
-interface AnswerCeremonyParams {
-  readonly status: number;
-  readonly token: string;
-  readonly tokenHash: string;
-  readonly error: string | null;
-}
-
-async function answerCeremony(
-  ctx: HTTPServerContext,
-  params: AnswerCeremonyParams,
-): Promise<Response> {
-  const enrolled = await ctx.store.db.selectFrom('boxxy_passkey').select('id').execute();
-
-  const options = {
-    challenge: ctx.enrollments.mintChallenge(params.tokenHash),
-    rp: { id: new URL(ctx.origin).hostname, name: 'boxxy' },
-    user: { id: OWNER_HANDLE, name: 'owner', displayName: 'boxxy owner' },
-    pubKeyCredParams: [
-      { type: 'public-key', alg: -8 },
-      { type: 'public-key', alg: -7 },
-      { type: 'public-key', alg: -257 },
-    ],
-    timeout: PROMPT_TIMEOUT_MS,
-
-    // an authenticator that already holds an enrolled passkey refuses to make a second.
-    excludeCredentials: enrolled.map((row) => ({ type: 'public-key', id: row.id })),
-    authenticatorSelection: {
-      residentKey: 'required',
-      requireResidentKey: true,
-      userVerification: 'required',
-    },
-    attestation: 'none',
-  };
-
-  return buildPageResponse(
-    params.status,
-    { page: renderEnrollPage({ ceremony: { token: params.token, options }, error: params.error }) },
-    [],
-    [PASSKEY_SCRIPT.policySource],
-  );
-}

package/src/auth/answer-login-request.ts

@@ -1,256 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/answer-login-request.ts at commit 4fe647cf.
-
-import { buildPageResponse } from '../http/build-page-response.ts';
-import { isRecord } from '../utils/is-record.ts';
-import { buildConsentBinding } from './build-consent-binding.ts';
-import { PASSKEY_SCRIPT } from './passkey-script.ts';
-import { readOwnerSessionID } from './read-owner-session-id.ts';
-import { renderLoginPage } from './render-login-page.ts';
-import type { HTTPServerContext, OwnerAuthFailure, Requester } from './types.ts';
-import { verifyPasskeyAssertion } from './verify-passkey-assertion.ts';
-import { verifySessionPasskey } from './verify-session-passkey.ts';
-
-interface LoginRequest {
-  readonly method: 'GET' | 'POST';
-  readonly url: URL;
-  readonly body: string;
-  readonly requester: Requester;
-}
-
-export async function answerLoginRequest(
-  ctx: HTTPServerContext,
-  request: LoginRequest,
-): Promise<Response> {
-  const form = new URLSearchParams(request.body);
-
-  const oauthQuery =
-    request.method === 'GET' ? request.url.search.slice(1) : (form.get('oauth_query') ?? '');
-
-  const approval = ctx.approvals.findPending(oauthQuery);
-
-  if (approval === null) {
-    if (request.method === 'POST') {
-      ctx.security.record({
-        kind: 'owner_auth',
-        outcome: 'failed',
-        reason: 'expired',
-        path: request.url.pathname,
-        requester: request.requester,
-      });
-    }
-
-    return buildPageResponse(400, {
-      message: 'This approval expired or was already used. Start again from the client.',
-    });
-  }
-
-  const view = {
-    oauthQuery,
-    clientName: approval.clientName,
-    redirectURI: approval.redirectURI,
-  };
-
-  const enrolled = await probePasskey(ctx);
-
-  if (request.method === 'GET') {
-    return enrolled
-      ? buildSignInResponse(ctx, 200, view, null)
-      : buildPageResponse(200, { page: renderLoginPage({ ...view, options: null, error: null }) });
-  }
-
-  // Read before the assertion is checked, since a sign-in or the last
-  // failure ends the approval.
-  const context = {
-    path: request.url.pathname,
-    requester: request.requester,
-    client: { id: approval.clientID, name: approval.clientName },
-    correlationID: approval.correlationID,
-  };
-
-  if (!enrolled) {
-    ctx.security.record({
-      kind: 'owner_auth',
-      outcome: 'failed',
-      reason: 'not_enrolled',
-      ...context,
-    });
-
-    return buildPageResponse(400, {
-      page: renderLoginPage({ ...view, options: null, error: null }),
-    });
-  }
-
-  // the challenge is taken whether or not the assertion verifies, so it counts once.
-  const taken = ctx.approvals.claimChallenge(oauthQuery);
-
-  const passkeyID =
-    taken.kind === 'taken'
-      ? await verifyAssertion(ctx, form.get('credential') ?? '', taken.challenge)
-      : null;
-
-  if (passkeyID === null) {
-    const reason: OwnerAuthFailure = taken.kind === 'expired' ? 'expired' : 'assertion_failed';
-
-    if (ctx.approvals.recordFailure(oauthQuery) === 'locked') {
-      ctx.security.record({ kind: 'owner_auth', outcome: 'failed', reason: 'locked', ...context });
-
-      return buildPageResponse(400, {
-        message: 'Too many failed sign-ins. Start again from the client.',
-      });
-    }
-
-    ctx.security.record({ kind: 'owner_auth', outcome: 'failed', reason, ...context });
-
-    const error =
-      reason === 'expired'
-        ? 'The sign-in took too long. Try again.'
-        : 'That passkey did not sign you in. Try again with a passkey enrolled for boxxy.';
-
-    return buildSignInResponse(ctx, 400, view, error);
-  }
-
-  ctx.approvals.removePending(oauthQuery);
-
-  // Resuming the authorization reads the request better-auth was called with.
-  const apiHeaders = new Headers({
-    accept: 'application/json',
-    'content-type': 'application/json',
-  });
-
-  const signedIn = await ctx.store.auth.api.signInOwner({
-    body: { oauth_query: oauthQuery },
-    headers: apiHeaders,
-    request: new Request(`${ctx.origin}/boxxy/sign-in-owner`, {
-      method: 'POST',
-      headers: apiHeaders,
-    }),
-    asResponse: true,
-  });
-
-  const resumed: unknown = await signedIn.json();
-
-  const next = isRecord(resumed) ? resumed['url'] : undefined;
-
-  if (!signedIn.ok || typeof next !== 'string') {
-    ctx.security.record({ kind: 'owner_auth', outcome: 'failed', ...context });
-
-    return buildPageResponse(400, {
-      message: 'boxxy could not continue this approval. Start again from the client.',
-    });
-  }
-
-  const setCookies = signedIn.headers.getSetCookie();
-
-  const sessionID = await readOwnerSessionID(
-    ctx,
-    setCookies.map((line) => line.split(';')[0]).join('; '),
-  );
-
-  if (sessionID === null) {
-    ctx.security.record({ kind: 'owner_auth', outcome: 'failed', ...context });
-
-    return buildPageResponse(400, {
-      message: 'boxxy could not continue this approval. Start again from the client.',
-    });
-  }
-
-  // A passkey removal or reset that committed after the assertion verified
-  // and before the session existed deleted no session, so the session
-  // carries on only while the passkey that signed is still enrolled.
-  if (!(await verifySessionPasskey(ctx.store.db, { sessionID, passkeyID }))) {
-    ctx.security.record({
-      kind: 'owner_auth',
-      outcome: 'failed',
-      reason: 'not_enrolled',
-      ...context,
-    });
-
-    return buildPageResponse(400, {
-      message: 'The passkey that signed you in is no longer enrolled. Start again from the client.',
-    });
-  }
-
-  ctx.approvals.recordApproved(sessionID, {
-    binding: buildConsentBinding(oauthQuery),
-    correlationID: approval.correlationID,
-  });
-
-  ctx.security.record({ kind: 'owner_auth', outcome: 'succeeded', ...context });
-
-  const headers = new Headers({ location: new URL(next, ctx.origin).href });
-
-  for (const cookie of setCookies) {
-    headers.append('set-cookie', cookie);
-  }
-
-  return new Response(null, { status: 302, headers });
-}
-
-async function probePasskey(ctx: HTTPServerContext): Promise<boolean> {
-  const row = await ctx.store.db
-    .selectFrom('boxxy_passkey')
-    .select('id')
-    .limit(1)
-    .executeTakeFirst();
-
-  return row !== undefined;
-}
-
-// How long the browser's passkey prompt waits, in milliseconds.
-const PROMPT_TIMEOUT_MS = 120_000;
-
-// What the sign-in page shows about its request.
-interface LoginView {
-  readonly oauthQuery: string;
-  readonly clientName: string;
-  readonly redirectURI: string;
-}
-
-// The sign-in page with a fresh challenge for its request. The options
-// list no credential, so the authenticator offers the passkeys it holds
-// for boxxy's RP ID, and they require user verification.
-function buildSignInResponse(
-  ctx: HTTPServerContext,
-  status: number,
-  view: LoginView,
-  error: string | null,
-): Response {
-  const challenge = ctx.approvals.mintChallenge(view.oauthQuery);
-
-  if (challenge === null) {
-    return buildPageResponse(400, {
-      message: 'This approval expired or was already used. Start again from the client.',
-    });
-  }
-
-  const options = {
-    challenge,
-    rpId: new URL(ctx.origin).hostname,
-    timeout: PROMPT_TIMEOUT_MS,
-    userVerification: 'required',
-    allowCredentials: [],
-  };
-
-  return buildPageResponse(
-    status,
-    { page: renderLoginPage({ ...view, options, error }) },
-    [],
-    [PASSKEY_SCRIPT.policySource],
-  );
-}
-
-// The enrolled passkey the posted credential is an assertion of, for the
-// challenge the caller claimed, or null.
-function verifyAssertion(
-  ctx: HTTPServerContext,
-  credential: string,
-  challenge: string,
-): Promise<string | null> {
-  return verifyPasskeyAssertion(ctx.store.db, {
-    credential,
-    challenge,
-    origin: ctx.origin,
-    rpID: new URL(ctx.origin).hostname,
-    now: ctx.clock.now(),
-  });
-}

package/src/auth/approval-window-seconds.ts

@@ -1,5 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/approval-window-seconds.ts at commit 4fe647cf.
-
-// an approval page, its signed query, and the authorization code it leads to
-// each stay valid this long.
-export const APPROVAL_WINDOW_SECONDS = 600;

package/src/auth/build-consent-binding.ts

@@ -1,13 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/build-consent-binding.ts at commit 4fe647cf.
-
-export function buildConsentBinding(oauthQuery: string): string {
-  const params = new URLSearchParams(oauthQuery);
-
-  // better-auth signs each page's query afresh, so the binding holds only the
-  // fields that stay the same from the login page to the consent page.
-  return JSON.stringify(
-    ['client_id', 'redirect_uri', 'scope', 'resource', 'state', 'code_challenge'].map(
-      (name) => params.get(name) ?? '',
-    ),
-  );
-}