@boxxy/auth-oauth 0.2.6 → 0.2.8

package/src/auth/to-script-json.ts

@@ -1,8 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/to-script-json.ts at commit 4fe647cf.
-
-export function toScriptJSON(value: unknown): string {
-  return JSON.stringify(value)
-    .replaceAll('<', String.raw`\u003c`)
-    .replaceAll('>', String.raw`\u003e`)
-    .replaceAll('&', String.raw`\u0026`);
-}

package/src/auth/types.ts

@@ -1,115 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/types.ts at commit 4fe647cf.
-
-import type { GrantScope } from '@boxxy/contract';
-import type { AuthClock } from '../utils/types.ts';
-import type { ApprovalState } from './create-approval-state.ts';
-import type { EnrollmentState } from './create-enrollment-state.ts';
-import type { openMCPAuth } from './open-mcp-auth.ts';
-
-export interface Requester {
-  readonly socketAddress: string | null;
-
-  // the `CF-Connecting-IP` header. Anyone can send it, so it is `trusted`
-  // only when the socket's peer is a proxy the owner listed.
-  readonly connectingIP: {
-    readonly address: string;
-    readonly provenance: 'trusted' | 'unverified';
-  } | null;
-  readonly userAgent: string | null;
-}
-
-export type SecurityOutcome =
-  | { readonly kind: 'authorize_started'; readonly outcome: 'accepted' }
-  | {
-      readonly kind: 'authorize_started';
-      readonly outcome: 'rejected';
-      readonly reason: 'rate_limited';
-    }
-  | {
-      readonly kind: 'authorize_invalid';
-      readonly outcome: 'rejected';
-      readonly reason: AuthorizeInvalidReason;
-    }
-  | { readonly kind: 'owner_auth'; readonly outcome: 'succeeded' }
-  | {
-      readonly kind: 'owner_auth';
-      readonly outcome: 'failed';
-      readonly reason?: OwnerAuthFailure;
-    }
-  | { readonly kind: 'consent'; readonly outcome: 'allowed' }
-  | { readonly kind: 'consent'; readonly outcome: 'denied'; readonly reason?: 'none_ticked' }
-  | {
-      readonly kind: 'token_exchange';
-      readonly outcome: 'rejected';
-      readonly reason: TokenExchangeReason;
-    }
-  | { readonly kind: 'bearer'; readonly outcome: 'rejected'; readonly reason: BearerReason };
-
-export type OwnerAuthFailure =
-  | 'assertion_failed'
-  | 'locked'
-  | 'expired'
-  | 'not_enrolled'
-  | 'invalid_token';
-
-export type AuthorizeInvalidReason =
-  | 'invalid_client'
-  | 'client_disabled'
-  | 'invalid_redirect'
-  | 'unauthorized_client'
-  | 'unsupported_response_type'
-  | 'invalid_request'
-  | 'invalid_scope'
-  | 'invalid_target'
-  | 'bad_host'
-  | 'bad_origin'
-  | 'other';
-
-export type TokenExchangeReason =
-  | 'invalid_request'
-  | 'invalid_client'
-  | 'invalid_grant'
-  | 'unauthorized_client'
-  | 'unsupported_grant_type'
-  | 'invalid_scope'
-  | 'invalid_target'
-  | 'other';
-
-type BearerReason = 'malformed' | 'invalid_token';
-
-export type SecurityEvent = SecurityOutcome & {
-  readonly path: string;
-  readonly requester: Requester;
-  readonly client?: { readonly id: string; readonly name: string };
-  readonly redirectHost?: string;
-  readonly correlationID?: string;
-};
-
-// What a valid bearer token grants: the client it was issued to, and the
-// scopes it holds.
-export interface VerifiedAccess {
-  readonly clientID: string;
-  readonly clientName: string;
-  readonly scopes: readonly GrantScope[];
-}
-
-type MCPAuth = Awaited<ReturnType<typeof openMCPAuth>>;
-
-// What every HTTP route reads: the authorization server, the approvals waiting for the owner, and
-// the passkey enrollments in progress.
-export interface HTTPServerContext {
-  // The public origin: the OAuth issuer.
-  readonly origin: string;
-
-  // `<origin>/mcp`: the one resource every token is bound to.
-  readonly resource: string;
-  readonly store: MCPAuth;
-  readonly approvals: ApprovalState;
-  readonly enrollments: EnrollmentState;
-
-  // Receives each sign-in outcome and each refused token as a security event.
-  readonly security: { readonly record: (event: SecurityEvent) => void };
-
-  // The time the routes stamp and check expiries against.
-  readonly clock: AuthClock;
-}

package/src/auth/update-passkey-use.ts

@@ -1,31 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/update-passkey-use.ts at commit 4fe647cf.
-
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-
-interface PasskeyUse {
-  readonly id: string;
-
-  // The counter the verification read, which the passkey must still hold,
-  // so a passkey removed during the verification, or a concurrent assertion
-  // that stored a newer counter, makes this use fail.
-  readonly counter: number;
-  readonly newCounter: number;
-
-  // Epoch milliseconds, stamped as the passkey's last use.
-  readonly now: number;
-}
-
-export async function updatePasskeyUse(
-  db: Kysely<MCPAuthSchema>,
-  use: PasskeyUse,
-): Promise<boolean> {
-  const stored = await db
-    .updateTable('boxxy_passkey')
-    .set({ counter: use.newCounter, last_used_at: new Date(use.now).toISOString() })
-    .where('id', '=', use.id)
-    .where('counter', '=', use.counter)
-    .executeTakeFirst();
-
-  return stored.numUpdatedRows > 0n;
-}

package/src/auth/verify-oauth-query.ts

@@ -1,41 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/verify-oauth-query.ts at commit 4fe647cf.
-
-import { constantTimeEqual, makeSignature } from 'better-auth/crypto';
-
-export async function verifyOAuthQuery(
-  oauthQuery: string,
-  secret: string,
-  now: number,
-): Promise<boolean> {
-  const params = new URLSearchParams(oauthQuery);
-
-  const signatures = params.getAll('sig');
-  const [signature] = signatures;
-  const expiresAt = Number(params.get('exp')) * 1000;
-
-  if (signatures.length !== 1 || signature === undefined || signature === '') {
-    return false;
-  }
-
-  params.delete('sig');
-
-  // Ordered by name, then by value, comparing code units as better-auth does
-  // when it signs; the NUL separator sorts a name before any longer name it
-  // prefixes.
-  const canonical = new URLSearchParams(
-    [...params].toSorted(([keyA, valueA], [keyB, valueB]) => {
-      const pairA = `${keyA}\u0000${valueA}`;
-      const pairB = `${keyB}\u0000${valueB}`;
-
-      if (pairA === pairB) {
-        return 0;
-      }
-
-      return pairA < pairB ? -1 : 1;
-    }),
-  );
-
-  const expected = await makeSignature(canonical.toString(), secret);
-
-  return constantTimeEqual(signature, expected) && Number.isFinite(expiresAt) && expiresAt >= now;
-}

package/src/auth/verify-passkey-assertion.ts

@@ -1,124 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/verify-passkey-assertion.ts at commit 4fe647cf.
-
-import type {
-  AuthenticationResponseJSON,
-  VerifiedAuthenticationResponse,
-} from '@simplewebauthn/server';
-import type { Kysely } from 'kysely';
-import { z } from 'zod';
-import { parseJSONStrings } from '../utils/parse-json-strings.ts';
-import { loadWebAuthn } from './load-web-authn.ts';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-import { updatePasskeyUse } from './update-passkey-use.ts';
-
-interface AssertionCheck {
-  // The credential JSON the sign-in page posted.
-  readonly credential: string;
-
-  // The challenge the page was given, which the caller has already taken.
-  readonly challenge: string;
-  readonly origin: string;
-  readonly rpID: string;
-
-  // Epoch milliseconds, stamped as the passkey's last use.
-  readonly now: number;
-}
-
-export async function verifyPasskeyAssertion(
-  db: Kysely<MCPAuthSchema>,
-  check: AssertionCheck,
-): Promise<string | null> {
-  const response = parseAssertion(check.credential);
-
-  if (response === null) {
-    return null;
-  }
-
-  const passkey = await db
-    .selectFrom('boxxy_passkey')
-    .select(['id', 'public_key', 'counter', 'transports'])
-    .where('id', '=', response.id)
-    .executeTakeFirst();
-
-  if (passkey === undefined) {
-    return null;
-  }
-
-  const webAuthn = await loadWebAuthn();
-
-  let verified: VerifiedAuthenticationResponse;
-
-  try {
-    verified = await webAuthn.verifyAuthenticationResponse({
-      response,
-      expectedChallenge: check.challenge,
-      expectedOrigin: check.origin,
-      expectedRPID: check.rpID,
-      expectedType: 'webauthn.get',
-      requireUserVerification: true,
-      credential: {
-        id: passkey.id,
-        publicKey: new Uint8Array(Buffer.from(passkey.public_key, 'base64url')),
-        counter: passkey.counter,
-        transports: parseJSONStrings(passkey.transports) ?? [],
-      },
-    });
-  } catch {
-    return null;
-  }
-
-  if (!verified.verified || !verified.authenticationInfo.userVerified) {
-    return null;
-  }
-
-  const stored = await updatePasskeyUse(db, {
-    id: passkey.id,
-    counter: passkey.counter,
-    newCounter: verified.authenticationInfo.newCounter,
-    now: check.now,
-  });
-
-  return stored ? passkey.id : null;
-}
-
-const ASSERTION_REPLY = z.object({
-  clientDataJSON: z.string(),
-  authenticatorData: z.string(),
-  signature: z.string(),
-  userHandle: z.string().optional(),
-});
-
-const ASSERTION = z.object({
-  id: z.string().min(1),
-  rawId: z.string().min(1),
-  type: z.literal('public-key'),
-  response: ASSERTION_REPLY,
-});
-
-// The posted JSON when it has the shape of an authentication response,
-// else null; the verifier checks every value.
-function parseAssertion(credential: string): AuthenticationResponseJSON | null {
-  let parsed: unknown;
-
-  try {
-    parsed = JSON.parse(credential);
-  } catch {
-    return null;
-  }
-
-  const result = ASSERTION.safeParse(parsed);
-
-  if (!result.success) {
-    return null;
-  }
-
-  const { userHandle, ...response } = result.data.response;
-
-  return {
-    id: result.data.id,
-    rawId: result.data.rawId,
-    type: result.data.type,
-    response: userHandle === undefined ? response : { ...response, userHandle },
-    clientExtensionResults: {},
-  };
-}

package/src/auth/verify-passkey-registration.ts

@@ -1,118 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/verify-passkey-registration.ts at commit 4fe647cf.
-
-import type { RegistrationResponseJSON } from '@simplewebauthn/server';
-import { z } from 'zod';
-import { loadWebAuthn } from './load-web-authn.ts';
-
-interface RegistrationCheck {
-  // The credential JSON the enrollment page posted.
-  readonly credential: string;
-
-  // The challenge the page was given, which the caller has already taken.
-  readonly challenge: string;
-  readonly origin: string;
-  readonly rpID: string;
-}
-
-export interface RegisteredPasskey {
-  readonly id: string;
-  readonly publicKey: Uint8Array;
-  readonly counter: number;
-  readonly transports: readonly string[];
-}
-
-export async function verifyPasskeyRegistration(
-  check: RegistrationCheck,
-): Promise<RegisteredPasskey | null> {
-  const response = parseRegistration(check.credential);
-
-  if (response === null) {
-    return null;
-  }
-
-  const webAuthn = await loadWebAuthn();
-
-  try {
-    const verified = await webAuthn.verifyRegistrationResponse({
-      response,
-      expectedChallenge: check.challenge,
-      expectedOrigin: check.origin,
-      expectedRPID: check.rpID,
-      expectedType: 'webauthn.create',
-      requireUserVerification: true,
-    });
-
-    if (!verified.verified || !verified.registrationInfo.userVerified) {
-      return null;
-    }
-
-    const credential = verified.registrationInfo.credential;
-
-    return {
-      id: credential.id,
-      publicKey: credential.publicKey,
-      counter: credential.counter,
-      transports: response.response.transports ?? [],
-    };
-  } catch {
-    return null;
-  }
-}
-
-const TRANSPORTS: ReadonlySet<string> = new Set([
-  'ble',
-  'cable',
-  'hybrid',
-  'internal',
-  'nfc',
-  'smart-card',
-  'usb',
-]);
-
-const REGISTRATION_REPLY = z.object({
-  clientDataJSON: z.string(),
-  attestationObject: z.string(),
-  transports: z.string().array().optional(),
-});
-
-const REGISTRATION = z.object({
-  id: z.string().min(1),
-  rawId: z.string().min(1),
-  type: z.literal('public-key'),
-  response: REGISTRATION_REPLY,
-});
-
-// The posted JSON when it has the shape of a registration response, keeping
-// only the transports WebAuthn defines, else null; the verifier checks
-// every value.
-function parseRegistration(credential: string): RegistrationResponseJSON | null {
-  let parsed: unknown;
-
-  try {
-    parsed = JSON.parse(credential);
-  } catch {
-    return null;
-  }
-
-  const result = REGISTRATION.safeParse(parsed);
-
-  if (!result.success) {
-    return null;
-  }
-
-  const transports = (result.data.response.transports ?? []).filter((transport) =>
-    TRANSPORTS.has(transport),
-  );
-
-  return {
-    id: result.data.id,
-    rawId: result.data.rawId,
-    type: result.data.type,
-    response: {
-      clientDataJSON: result.data.response.clientDataJSON,
-      attestationObject: result.data.response.attestationObject,
-      transports,
-    },
-    clientExtensionResults: {},
-  };
-}

package/src/auth/verify-session-passkey.ts

@@ -1,47 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/verify-session-passkey.ts at commit 4fe647cf.
-
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-
-interface SessionPasskey {
-  // The owner session a passkey sign-in just created.
-  readonly sessionID: string;
-
-  // The passkey whose assertion signed the owner in.
-  readonly passkeyID: string;
-}
-
-export async function verifySessionPasskey(
-  db: Kysely<MCPAuthSchema>,
-  check: SessionPasskey,
-): Promise<boolean> {
-  try {
-    return await db.transaction().execute(async (trx) => {
-      const passkey = await trx
-        .selectFrom('boxxy_passkey')
-        .select('id')
-        .where('id', '=', check.passkeyID)
-        .executeTakeFirst();
-
-      const session = await trx
-        .selectFrom('session')
-        .select('id')
-        .where('id', '=', check.sessionID)
-        .executeTakeFirst();
-
-      if (passkey !== undefined && session !== undefined) {
-        return true;
-      }
-
-      await trx.deleteFrom('session').where('id', '=', check.sessionID).execute();
-
-      return false;
-    });
-  } catch {
-    // a transaction that fails, such as one a concurrent write keeps busy, still
-    // removes the session.
-    await db.deleteFrom('session').where('id', '=', check.sessionID).execute();
-
-    return false;
-  }
-}

package/src/auth/write-grant-use.ts

@@ -1,18 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/write-grant-use.ts at commit 4fe647cf.
-
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-
-export async function writeGrantUse(
-  db: Kysely<MCPAuthSchema>,
-  grantID: string,
-  now: number,
-): Promise<void> {
-  const lastUsedAt = new Date(now).toISOString();
-
-  await db
-    .insertInto('boxxy_grant_use')
-    .values({ grant_id: grantID, last_used_at: lastUsedAt })
-    .onConflict((conflict) => conflict.column('grant_id').doUpdateSet({ last_used_at: lastUsedAt }))
-    .execute();
-}

package/src/http/answer-mcp-request.ts

@@ -1,77 +0,0 @@
-// Copied from atc: packages/mcp/src/http/answer-mcp-request.ts at commit 4fe647cf.
-
-import type { HTTPServerContext, Requester } from '../auth/types.ts';
-import { PUBLIC_DOOR_PATHS } from './public-door-paths.ts';
-import { verifyAccessToken } from './verify-access-token.ts';
-
-// What the MCP transport reads of a verified token: the scopes it holds, and the resource metadata
-// that a scope challenge points at.
-export interface McpAuthInfo {
-  readonly token: string;
-  readonly clientId: string;
-  readonly scopes: string[];
-  readonly resourceMetadataUrl: string;
-}
-
-// Serves one MCP request for a token that verified.
-export type McpServe = (request: Request, authInfo: McpAuthInfo) => Promise<Response>;
-
-// `requester` is where the request came from, for its security events.
-export async function answerMCPRequest(
-  ctx: HTTPServerContext,
-  request: Request,
-  requester: Requester,
-  serve: McpServe,
-): Promise<Response> {
-  const path = new URL(request.url).pathname;
-
-  const metadataURL = `${ctx.origin}${PUBLIC_DOOR_PATHS.machine.mcpResourceMetadata}`;
-  const authorization = request.headers.get('authorization');
-  const token = /^Bearer (?<token>\S+)$/iu.exec(authorization ?? '')?.groups?.['token'];
-
-  if (token === undefined) {
-    // a request with no header at all is a client discovering the
-    // authorization server, so only a header that holds no bearer token is
-    // recorded.
-    if (authorization !== null) {
-      ctx.security.record({
-        kind: 'bearer',
-        outcome: 'rejected',
-        reason: 'malformed',
-        path,
-        requester,
-      });
-    }
-
-    return new Response(null, {
-      status: 401,
-      headers: { 'www-authenticate': `Bearer resource_metadata="${metadataURL}"` },
-    });
-  }
-
-  const access = await verifyAccessToken(ctx, token);
-
-  if (access === null) {
-    ctx.security.record({
-      kind: 'bearer',
-      outcome: 'rejected',
-      reason: 'invalid_token',
-      path,
-      requester,
-    });
-
-    return new Response(null, {
-      status: 401,
-      headers: {
-        'www-authenticate': `Bearer error="invalid_token", resource_metadata="${metadataURL}"`,
-      },
-    });
-  }
-
-  return serve(request, {
-    token,
-    clientId: access.clientID,
-    scopes: [...access.scopes],
-    resourceMetadataUrl: metadataURL,
-  });
-}

package/src/http/build-page-response.ts

@@ -1,26 +0,0 @@
-// Copied from atc: packages/mcp/src/http/build-page-response.ts at commit 4fe647cf.
-
-import { toHTMLText } from '../auth/to-html-text.ts';
-
-export function buildPageResponse(
-  status: number,
-  body: { readonly page: string } | { readonly message: string },
-  formTargets: readonly string[] = [],
-  scriptSources: readonly string[] = [],
-): Response {
-  const html =
-    'page' in body
-      ? body.page
-      : `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>boxxy</title></head><body><p>${toHTMLText(body.message)}</p></body></html>`;
-
-  return new Response(html, {
-    status,
-    headers: {
-      'content-type': 'text/html; charset=utf-8',
-      'content-security-policy': `default-src 'none'; style-src 'unsafe-inline';${scriptSources.length === 0 ? '' : ` script-src ${scriptSources.join(' ')};`} form-action 'self'${formTargets.map((target) => ` ${target}`).join('')}; frame-ancestors 'none'; base-uri 'none'`,
-      'x-frame-options': 'DENY',
-      'cache-control': 'no-store',
-      'referrer-policy': 'same-origin',
-    },
-  });
-}