@boxxy/auth-oauth 0.2.6 → 0.2.7

package/src/http/create-mcp-http-app.ts

@@ -1,340 +0,0 @@
-// Copied from atc: packages/mcp/src/http/create-mcp-http-app.ts at commit 4fe647cf.
-
-import { Elysia } from 'elysia';
-import invariant from 'tiny-invariant';
-import { match } from 'ts-pattern';
-import { answerAuthorizeRequest } from '../auth/answer-authorize-request.ts';
-import { answerConsentRequest } from '../auth/answer-consent-request.ts';
-import { answerEnrollRequest } from '../auth/answer-enroll-request.ts';
-import { answerLoginRequest } from '../auth/answer-login-request.ts';
-import { recordRefusedExchange } from '../auth/record-refused-exchange.ts';
-import type { HTTPServerContext, Requester, SecurityEvent } from '../auth/types.ts';
-import { isRecord } from '../utils/is-record.ts';
-import { answerMCPRequest } from './answer-mcp-request.ts';
-import type { McpServe } from './answer-mcp-request.ts';
-import { buildPageResponse } from './build-page-response.ts';
-import { pickErrorMessage } from './pick-error-message.ts';
-import { PUBLIC_DOOR_PATHS } from './public-door-paths.ts';
-
-interface MCPHTTPAppOptions {
-  // The Host header values the server answers to.
-  readonly hosts: ReadonlySet<string>;
-
-  // The origins a browser form or an MCP request may come from.
-  readonly origins: ReadonlySet<string>;
-
-  // The routes' context once the authorization server's database is open,
-  // and null before.
-  readonly readContext: () => HTTPServerContext | null;
-
-  // Where a request came from, for its security events.
-  readonly readRequester: (request: Request) => Requester;
-
-  // Answers an MCP request whose bearer token verified.
-  readonly serveMCP: McpServe;
-
-  // Receives each refused Host or origin.
-  readonly security: { readonly record: (event: SecurityEvent) => void };
-}
-
-// The browser pages: passkey sign-in, passkey enrollment, and consent.
-// the part of Elysia's context that the routes read
-interface RouteContext {
-  readonly request: Request;
-}
-
-const PAGE_PATHS = [
-  PUBLIC_DOOR_PATHS.browser.login,
-  PUBLIC_DOOR_PATHS.browser.enroll,
-  PUBLIC_DOOR_PATHS.browser.consent,
-] as const;
-
-// Both paths serve the protected resource metadata for `<origin>/mcp`.
-const RESOURCE_METADATA_PATHS = [
-  PUBLIC_DOOR_PATHS.machine.resourceMetadata,
-  PUBLIC_DOOR_PATHS.machine.mcpResourceMetadata,
-] as const;
-
-export function createMCPHTTPApp(options: MCPHTTPAppOptions) {
-  const requireContext = (): HTTPServerContext => {
-    const ctx = options.readContext();
-
-    invariant(ctx, 'a route ran before the authorization server opened');
-
-    return ctx;
-  };
-
-  const app = new Elysia()
-    .onRequest((context: RouteContext) => {
-      const path = new URL(context.request.url).pathname;
-
-      const host = context.request.headers.get('host');
-
-      if (host === null || !options.hosts.has(host)) {
-        options.security.record({
-          kind: 'authorize_invalid',
-          outcome: 'rejected',
-          reason: 'bad_host',
-          path,
-          requester: options.readRequester(context.request),
-        });
-
-        return new Response(null, { status: 403 });
-      }
-
-      // Elysia answers with any value a hook returns but undefined, null included
-      return options.readContext() === null ? new Response(null, { status: 503 }) : undefined;
-    })
-    .onError(() => new Response(null, { status: 503 }))
-    .post(PUBLIC_DOOR_PATHS.machine.revoke, (context: RouteContext) =>
-      requireContext().store.auth.handler(toPublicRequest(requireContext(), context.request)),
-    )
-    .get(PUBLIC_DOOR_PATHS.machine.authorizationServerMetadata, (context: RouteContext) =>
-      answerMetadataRequest(requireContext(), context.request, 'authorization-server'),
-    )
-    .get(PUBLIC_DOOR_PATHS.browser.authorize, (context: RouteContext) =>
-      answerAuthorizeRequest(
-        requireContext(),
-        new URL(context.request.url),
-        options.readRequester(context.request),
-      ),
-    )
-    .post(PUBLIC_DOOR_PATHS.machine.token, (context: RouteContext) =>
-      answerTokenRequest(requireContext(), context.request, options.readRequester(context.request)),
-    )
-    .get(PUBLIC_DOOR_PATHS.browser.error, (context: RouteContext) => {
-      const error = new URL(context.request.url).searchParams.get('error');
-
-      return buildPageResponse(400, { message: pickErrorMessage(error) });
-    });
-
-  for (const path of RESOURCE_METADATA_PATHS) {
-    app.get(path, (context: RouteContext) =>
-      answerMetadataRequest(requireContext(), context.request, 'resource'),
-    );
-  }
-
-  for (const path of PAGE_PATHS) {
-    app.get(path, (context: RouteContext) =>
-      answerPageRequest(requireContext(), {
-        path,
-        request: context.request,
-        body: '',
-        requester: options.readRequester(context.request),
-      }),
-    );
-
-    app.post(
-      path,
-      {
-        // a form posts from the server's own pages, so a post with no origin
-        // or another one is a forged form
-        beforeHandle: (context: RouteContext) => {
-          const origin = context.request.headers.get('origin');
-          const isForged = origin === null || !options.origins.has(origin);
-
-          if (isForged) {
-            recordBadOrigin(options, context.request);
-          }
-
-          return isForged
-            ? buildPageResponse(403, { message: 'The form came from an unexpected origin.' })
-            : undefined;
-        },
-      },
-      async (context: RouteContext) => {
-        const body = await context.request.text();
-
-        return answerPageRequest(requireContext(), {
-          path,
-          request: context.request,
-          body,
-          requester: options.readRequester(context.request),
-        });
-      },
-    );
-  }
-
-  app.all(
-    PUBLIC_DOOR_PATHS.machine.mcp,
-    {
-      beforeHandle: (context: RouteContext) => {
-        const origin = context.request.headers.get('origin');
-        const isForeign = origin !== null && !options.origins.has(origin);
-
-        if (isForeign) {
-          recordBadOrigin(options, context.request);
-        }
-
-        return isForeign ? new Response(null, { status: 403 }) : undefined;
-      },
-    },
-    (context: RouteContext) => {
-      if (context.request.method !== 'POST') {
-        return new Response(null, { status: 405, headers: { allow: 'POST' } });
-      }
-
-      return answerMCPRequest(
-        requireContext(),
-        context.request,
-        options.readRequester(context.request),
-        options.serveMCP,
-      );
-    },
-  );
-
-  // every other path, the RPC route and the health check included, answers 404
-  app.all('*', () => new Response(null, { status: 404 }));
-
-  return app;
-}
-
-// better-auth builds every URL it returns from its base URL, so a request
-// that reached the local address is handed over as if it came to the public
-// origin.
-function toPublicRequest(ctx: HTTPServerContext, request: Request): Request {
-  const url = new URL(request.url);
-
-  return new Request(`${ctx.origin}${url.pathname}${url.search}`, request);
-}
-
-// The metadata advertises only what boxxy's clients can use: public clients
-// with no client authentication, no introspection endpoint, and Bearer
-// tokens alone, so nothing about DPoP.
-async function answerMetadataRequest(
-  ctx: HTTPServerContext,
-  request: Request,
-  kind: 'authorization-server' | 'resource',
-): Promise<Response> {
-  const response = await ctx.store.auth.handler(toPublicRequest(ctx, request));
-  const metadata: unknown = await response.json();
-
-  if (!isRecord(metadata)) {
-    return new Response(null, { status: 503 });
-  }
-
-  const advertised = Object.fromEntries(
-    Object.entries(metadata).filter(
-      ([key]) => !key.startsWith('introspection_') && !key.startsWith('dpop_'),
-    ),
-  );
-
-  if (kind === 'resource') {
-    return Response.json(advertised, { status: response.status });
-  }
-
-  return Response.json({
-    ...advertised,
-    token_endpoint_auth_methods_supported: ['none'],
-    revocation_endpoint_auth_methods_supported: ['none'],
-  });
-}
-
-// better-auth binds a code exchange's tokens to the owner session that approved it.
-async function answerTokenRequest(
-  ctx: HTTPServerContext,
-  request: Request,
-  requester: Requester,
-): Promise<Response> {
-  // the body is read once here, so the refusal's event can name its client.
-  const body = await request.text();
-
-  const sent = new Request(request.url, { method: request.method, headers: request.headers, body });
-
-  const response = await ctx.store.auth.handler(toPublicRequest(ctx, sent));
-
-  if (!response.ok) {
-    await recordRefusedExchange(ctx, {
-      contentType: request.headers.get('content-type'),
-      body,
-      response,
-      path: new URL(request.url).pathname,
-      requester,
-    });
-
-    return response;
-  }
-
-  const attached = await ctx.store.db
-    .selectFrom('oauthAccessToken')
-    .select('sessionId')
-    .where('sessionId', 'is not', null)
-    .union(
-      ctx.store.db
-        .selectFrom('oauthRefreshToken')
-        .select('sessionId')
-        .where('sessionId', 'is not', null),
-    )
-    .execute();
-
-  const sessionIDs = attached.flatMap((row) => (row.sessionId === null ? [] : [row.sessionId]));
-
-  // detached tokens outlive their session, so a session's end never ends a grant.
-  await ctx.store.db
-    .updateTable('oauthAccessToken')
-    .set({ sessionId: null })
-    .where('sessionId', 'is not', null)
-    .execute();
-
-  await ctx.store.db
-    .updateTable('oauthRefreshToken')
-    .set({ sessionId: null })
-    .where('sessionId', 'is not', null)
-    .execute();
-
-  const now = new Date(ctx.clock.now()).toISOString();
-
-  // the session's one authorization is done.
-  await ctx.store.db
-    .deleteFrom('session')
-    .where((eb) =>
-      eb.or([
-        eb('expiresAt', '<', now),
-        ...(sessionIDs.length === 0 ? [] : [eb('id', 'in', sessionIDs)]),
-      ]),
-    )
-    .execute();
-
-  return response;
-}
-
-interface PageRequest {
-  readonly path: (typeof PAGE_PATHS)[number];
-  readonly request: Request;
-  readonly body: string;
-  readonly requester: Requester;
-}
-
-function answerPageRequest(ctx: HTTPServerContext, page: PageRequest): Promise<Response> {
-  const method = page.request.method === 'POST' ? 'POST' : 'GET';
-
-  const url = new URL(page.request.url);
-
-  return match(page.path)
-    .with(PUBLIC_DOOR_PATHS.browser.login, () =>
-      answerLoginRequest(ctx, { method, url, body: page.body, requester: page.requester }),
-    )
-    .with(PUBLIC_DOOR_PATHS.browser.enroll, () =>
-      answerEnrollRequest(ctx, { method, url, body: page.body, requester: page.requester }),
-    )
-    .with(PUBLIC_DOOR_PATHS.browser.consent, () =>
-      answerConsentRequest(ctx, {
-        method,
-        url,
-        cookie: page.request.headers.get('cookie'),
-        body: page.body,
-        requester: page.requester,
-      }),
-    )
-    .exhaustive();
-}
-
-function recordBadOrigin(options: MCPHTTPAppOptions, request: Request): void {
-  options.security.record({
-    kind: 'authorize_invalid',
-    outcome: 'rejected',
-    reason: 'bad_origin',
-    path: new URL(request.url).pathname,
-    requester: options.readRequester(request),
-  });
-}

package/src/http/pick-error-message.ts

@@ -1,21 +0,0 @@
-// Copied from atc: packages/mcp/src/http/pick-error-message.ts at commit 4fe647cf.
-
-// The error codes better-auth sends to the error page, each with the fixed
-// sentence boxxy shows for it.
-const ERROR_MESSAGES: Readonly<Record<string, string>> = {
-  invalid_client: 'the client is not one added to boxxy.',
-  client_disabled: 'the client is disabled.',
-  invalid_redirect: 'the redirect URI is not one the client was added with.',
-  unauthorized_client: 'the client may not use the authorization code grant.',
-  unsupported_response_type: 'boxxy supports only the authorization code response type.',
-  invalid_request: 'the request is malformed.',
-};
-
-export function pickErrorMessage(code: string | null): string {
-  // the page never shows text from the request, so a link to it cannot make
-  // boxxy's origin display words an attacker chose.
-  const reason =
-    code !== null && Object.hasOwn(ERROR_MESSAGES, code) ? ERROR_MESSAGES[code] : undefined;
-
-  return `boxxy refused this authorization request: ${reason ?? 'the request is not valid.'}`;
-}

package/src/http/public-door-paths.ts

@@ -1,21 +0,0 @@
-// Adapted from atc: packages/contract/src/gateway-paths.ts at commit 4fe647cf.
-
-// The routes of the public door: the browser pages a person opens, and the routes a machine
-// client calls. The door serves nothing else.
-export const PUBLIC_DOOR_PATHS = {
-  browser: {
-    authorize: '/oauth2/authorize',
-    login: '/login',
-    enroll: '/enroll',
-    consent: '/consent',
-    error: '/error',
-  },
-  machine: {
-    mcp: '/mcp',
-    token: '/oauth2/token',
-    revoke: '/oauth2/revoke',
-    authorizationServerMetadata: '/.well-known/oauth-authorization-server',
-    resourceMetadata: '/.well-known/oauth-protected-resource',
-    mcpResourceMetadata: '/.well-known/oauth-protected-resource/mcp',
-  },
-} as const;

package/src/http/read-token-access.ts

@@ -1,44 +0,0 @@
-// Copied from atc: packages/mcp/src/http/read-token-access.ts at commit 4fe647cf.
-
-import { grantScopes } from '@boxxy/contract';
-import type { GrantScope } from '@boxxy/contract';
-import { isAPIError } from 'better-auth/api';
-import type { HTTPServerContext } from '../auth/types.ts';
-import { isRecord } from '../utils/is-record.ts';
-
-interface TokenAccess {
-  readonly clientID: string;
-  readonly scopes: readonly GrantScope[];
-}
-
-// An inactive, unknown, expired or revoked token, one bound to another
-// resource, or one without a client id reads as null. Reading records no use.
-export async function readTokenAccess(
-  ctx: HTTPServerContext,
-  token: string,
-): Promise<TokenAccess | null> {
-  let payload: unknown;
-
-  try {
-    payload = await ctx.store.auth.api.verifyMCPAccessToken({ body: { token } });
-  } catch (error) {
-    if (isAPIError(error)) {
-      return null;
-    }
-
-    throw error;
-  }
-
-  if (!isRecord(payload) || ![payload['aud']].flat().includes(ctx.resource)) {
-    return null;
-  }
-
-  const granted = typeof payload['scope'] === 'string' ? payload['scope'].split(' ') : [];
-  const clientID = typeof payload['client_id'] === 'string' ? payload['client_id'] : '';
-
-  if (clientID === '') {
-    return null;
-  }
-
-  return { clientID, scopes: grantScopes.filter((scope) => granted.includes(scope)) };
-}

package/src/http/verify-access-token.ts

@@ -1,46 +0,0 @@
-// Copied from atc: packages/mcp/src/http/verify-access-token.ts at commit 4fe647cf.
-
-import { deriveTokenHash } from '../auth/derive-token-hash.ts';
-import { normalizeClientName } from '../auth/normalize-client-name.ts';
-import { readClientName } from '../auth/read-client-name.ts';
-import type { HTTPServerContext, VerifiedAccess } from '../auth/types.ts';
-import { writeGrantUse } from '../auth/write-grant-use.ts';
-import { readTokenAccess } from './read-token-access.ts';
-
-// Verifying stamps when the token's grant was last used.
-export async function verifyAccessToken(
-  ctx: HTTPServerContext,
-  token: string,
-): Promise<VerifiedAccess | null> {
-  const access = await readTokenAccess(ctx, token);
-
-  if (access === null) {
-    return null;
-  }
-
-  await upsertGrantUse(ctx, token);
-
-  const storedName = await readClientName(ctx.store.db, access.clientID);
-
-  return {
-    clientID: access.clientID,
-    clientName: normalizeClientName(storedName, 'remote'),
-    scopes: access.scopes,
-  };
-}
-
-async function upsertGrantUse(ctx: HTTPServerContext, token: string): Promise<void> {
-  const row = await ctx.store.db
-    .selectFrom('oauthAccessToken')
-    .select('authorizationCodeId')
-    .where('token', '=', deriveTokenHash(token))
-    .executeTakeFirst();
-
-  const grantID = row?.authorizationCodeId ?? null;
-
-  if (grantID === null) {
-    return;
-  }
-
-  await writeGrantUse(ctx.store.db, grantID, ctx.clock.now());
-}

package/src/test-utils/build-mock-new-passkey.ts

@@ -1,15 +0,0 @@
-// Copied from atc: packages/mcp/src/test-utils/build-mock-new-passkey.ts at commit 4fe647cf.
-
-import type { NewPasskey } from '../auth/create-passkey.ts';
-
-export function buildMockNewPasskey(overrides: Partial<NewPasskey> = {}): NewPasskey {
-  return {
-    tokenHash: 'a'.repeat(64),
-    id: 'credential-0001',
-    publicKey: 'AQID',
-    counter: 0,
-    transports: ['internal'],
-    now: Date.parse('2026-01-01T00:00:00Z'),
-    ...overrides,
-  };
-}

package/src/test-utils/build-passkey-seeder.ts

@@ -1,11 +0,0 @@
-// Copied from atc: packages/mcp/src/test-utils/build-passkey-seeder.ts at commit 4fe647cf.
-
-import { seedPasskey } from './seed-passkey.ts';
-import type { PasskeyInput } from './seed-passkey.ts';
-import type { MCPAuthSeedDeps } from './types.ts';
-
-export function buildPasskeySeeder(deps: MCPAuthSeedDeps) {
-  return {
-    passkey: (input?: PasskeyInput) => seedPasskey(deps, input),
-  };
-}

package/src/test-utils/build-seeder.ts

@@ -1,10 +0,0 @@
-// Copied from atc: packages/mcp/src/test-utils/build-seeder.ts at commit 4fe647cf.
-
-import { buildPasskeySeeder } from './build-passkey-seeder.ts';
-import type { MCPAuthSeedDeps } from './types.ts';
-
-export type TestDeps = MCPAuthSeedDeps;
-
-export function buildSeeder(deps: TestDeps) {
-  return buildPasskeySeeder(deps);
-}