@breadstone/archipel-platform-authentication 0.0.15 → 0.0.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/package.json +4 -4
  2. package/src/connectors/AppleConnector.js +3 -2
  3. package/src/connectors/GithubConnector.js +3 -2
  4. package/src/connectors/GoogleConnector.js +3 -2
  5. package/src/connectors/MicrosoftConnector.js +3 -2
  6. package/src/connectors/apple/env.js +6 -0
  7. package/src/connectors/github/env.js +6 -0
  8. package/src/connectors/google/env.js +6 -0
  9. package/src/connectors/microsoft/env.js +6 -0
  10. package/src/env.d.ts +24 -0
  11. package/src/env.js +25 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@breadstone/archipel-platform-authentication",
3
- "version": "0.0.15",
3
+ "version": "0.0.17",
4
4
  "description": "JWT and OAuth authentication, MFA, session management, and email verification for NestJS applications.",
5
5
  "type": "commonjs",
6
6
  "main": "./src/index.js",
@@ -81,9 +81,9 @@
81
81
  "README.md"
82
82
  ],
83
83
  "dependencies": {
84
- "@breadstone/archipel-platform-configuration": "0.0.15",
85
- "@breadstone/archipel-platform-core": "0.0.15",
86
- "@breadstone/archipel-platform-cryptography": "0.0.15",
84
+ "@breadstone/archipel-platform-configuration": "0.0.17",
85
+ "@breadstone/archipel-platform-core": "0.0.17",
86
+ "@breadstone/archipel-platform-cryptography": "0.0.17",
87
87
  "passport": "0.7.0",
88
88
  "passport-custom": "1.1.1",
89
89
  "passport-jwt": "4.0.1",
package/src/connectors/AppleConnector.js CHANGED
@@ -32,14 +32,15 @@ let AppleConnector = class AppleConnector extends (0, ConnectorBase_1.ConnectorB
32
32
  .split(',')
33
33
  .map((s) => s.trim())
34
34
  .filter(Boolean);
35
+ const state = configService.tryGet(env_1.AUTH_APPLE_STATE.key, 'true').toLowerCase() !== 'false';
35
36
  super({
36
37
  clientID: configService.get(env_1.AUTH_APPLE_CLIENT_ID.key),
37
38
  teamID: configService.get(env_1.AUTH_APPLE_TEAM_ID.key),
38
39
  keyID: configService.get(env_1.AUTH_APPLE_KEY_ID.key),
39
40
  callbackURL: configService.tryGet(env_1.AUTH_APPLE_CALLBACK_URL.key, '/auth/apple/callback'),
40
41
  privateKeyString: normalizedPrivateKey,
41
- scope,
42
- state: true,
42
+ scope: scope,
43
+ state: state,
43
44
  });
44
45
  this._socialAuth = socialAuth;
45
46
  }
package/src/connectors/GithubConnector.js CHANGED
@@ -26,12 +26,13 @@ let GithubConnector = class GithubConnector extends (0, ConnectorBase_1.Connecto
26
26
  .split(',')
27
27
  .map((s) => s.trim())
28
28
  .filter(Boolean);
29
+ const state = configService.tryGet(env_1.AUTH_GITHUB_STATE.key, 'true').toLowerCase() !== 'false';
29
30
  super({
30
31
  clientID: configService.get(env_1.AUTH_GITHUB_CLIENT_ID.key),
31
32
  clientSecret: configService.get(env_1.AUTH_GITHUB_CLIENT_SECRET.key),
32
33
  callbackURL: configService.tryGet(env_1.AUTH_GITHUB_CALLBACK_URL.key, '/auth/github/callback'),
33
- scope,
34
- state: true,
34
+ scope: scope,
35
+ state: state,
35
36
  });
36
37
  this._socialAuth = socialAuth;
37
38
  }
package/src/connectors/GoogleConnector.js CHANGED
@@ -31,12 +31,13 @@ let GoogleConnector = class GoogleConnector extends (0, ConnectorBase_1.Connecto
31
31
  .split(',')
32
32
  .map((s) => s.trim())
33
33
  .filter(Boolean);
34
+ const state = configService.tryGet(env_1.AUTH_GOOGLE_STATE.key, 'true').toLowerCase() !== 'false';
34
35
  super({
35
36
  clientID: configService.get(env_1.AUTH_GOOGLE_CLIENT_ID.key),
36
37
  clientSecret: configService.get(env_1.AUTH_GOOGLE_CLIENT_SECRET.key),
37
38
  callbackURL: configService.tryGet(env_1.AUTH_GOOGLE_CALLBACK_URL.key, '/auth/google/callback'),
38
- scope,
39
- state: true,
39
+ scope: scope,
40
+ state: state,
40
41
  });
41
42
  this._socialAuth = socialAuth;
42
43
  }
package/src/connectors/MicrosoftConnector.js CHANGED
@@ -31,13 +31,14 @@ let MicrosoftConnector = class MicrosoftConnector extends (0, ConnectorBase_1.Co
31
31
  .split(',')
32
32
  .map((s) => s.trim())
33
33
  .filter(Boolean);
34
+ const state = configService.tryGet(env_1.AUTH_MICROSOFT_STATE.key, 'true').toLowerCase() !== 'false';
34
35
  super({
35
36
  clientID: configService.get(env_1.AUTH_MICROSOFT_CLIENT_ID.key),
36
37
  clientSecret: configService.get(env_1.AUTH_MICROSOFT_CLIENT_SECRET.key),
37
38
  callbackURL: configService.tryGet(env_1.AUTH_MICROSOFT_CALLBACK_URL.key, '/auth/microsoft/callback'),
38
39
  tenant: configService.tryGet(env_1.AUTH_MICROSOFT_TENANT.key, 'common'),
39
- scope,
40
- state: true,
40
+ scope: scope,
41
+ state: state,
41
42
  });
42
43
  this._socialAuth = socialAuth;
43
44
  }
package/src/connectors/apple/env.js CHANGED
@@ -22,5 +22,11 @@ exports.APPLE_AUTH_CONFIG_ENTRIES = [
22
22
  defaultValue: 'name,email',
23
23
  description: 'Comma-separated list of Apple Sign-In scopes.',
24
24
  },
25
+ {
26
+ key: env_1.AUTH_APPLE_STATE,
27
+ required: false,
28
+ defaultValue: 'true',
29
+ description: 'Enable OAuth state parameter for CSRF protection. Requires a persistent session store. Set to "false" for stateless/serverless environments without a shared session store.',
30
+ },
25
31
  ];
26
32
  //# sourceMappingURL=env.js.map
package/src/connectors/github/env.js CHANGED
@@ -20,5 +20,11 @@ exports.GITHUB_AUTH_CONFIG_ENTRIES = [
20
20
  defaultValue: 'user:email',
21
21
  description: 'Comma-separated list of GitHub OAuth scopes.',
22
22
  },
23
+ {
24
+ key: env_1.AUTH_GITHUB_STATE,
25
+ required: false,
26
+ defaultValue: 'true',
27
+ description: 'Enable OAuth state parameter for CSRF protection. Requires a persistent session store. Set to "false" for stateless/serverless environments without a shared session store.',
28
+ },
23
29
  ];
24
30
  //# sourceMappingURL=env.js.map
package/src/connectors/google/env.js CHANGED
@@ -20,5 +20,11 @@ exports.GOOGLE_AUTH_CONFIG_ENTRIES = [
20
20
  defaultValue: 'email,profile',
21
21
  description: 'Comma-separated list of Google OAuth scopes.',
22
22
  },
23
+ {
24
+ key: env_1.AUTH_GOOGLE_STATE,
25
+ required: false,
26
+ defaultValue: 'true',
27
+ description: 'Enable OAuth state parameter for CSRF protection. Requires a persistent session store. Set to "false" for stateless/serverless environments without a shared session store.',
28
+ },
23
29
  ];
24
30
  //# sourceMappingURL=env.js.map
package/src/connectors/microsoft/env.js CHANGED
@@ -21,5 +21,11 @@ exports.MICROSOFT_AUTH_CONFIG_ENTRIES = [
21
21
  defaultValue: 'user.read',
22
22
  description: 'Comma-separated list of Microsoft OAuth scopes.',
23
23
  },
24
+ {
25
+ key: env_1.AUTH_MICROSOFT_STATE,
26
+ required: false,
27
+ defaultValue: 'true',
28
+ description: 'Enable OAuth state parameter for CSRF protection. Requires a persistent session store. Set to "false" for stateless/serverless environments without a shared session store.',
29
+ },
24
30
  ];
25
31
  //# sourceMappingURL=env.js.map
package/src/env.d.ts CHANGED
@@ -33,6 +33,12 @@ export declare const AUTH_GOOGLE_CLIENT_SECRET: import("@breadstone/archipel-pla
33
33
  export declare const AUTH_GOOGLE_CALLBACK_URL: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
34
34
  /** Comma-separated list of Google OAuth scopes (e.g. `'email,profile'`). */
35
35
  export declare const AUTH_GOOGLE_SCOPE: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
36
+ /**
37
+ * Whether to enable the OAuth `state` parameter for CSRF protection on the Google connector.
38
+ * Requires a persistent session store (e.g. Redis) to verify state on callback. Disable
39
+ * (`'false'`) for stateless / serverless environments without a shared session store.
40
+ */
41
+ export declare const AUTH_GOOGLE_STATE: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
36
42
  /** Microsoft OAuth2 client ID. */
37
43
  export declare const AUTH_MICROSOFT_CLIENT_ID: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
38
44
  /** Microsoft OAuth2 client secret. */
@@ -43,6 +49,12 @@ export declare const AUTH_MICROSOFT_CALLBACK_URL: import("@breadstone/archipel-p
43
49
  export declare const AUTH_MICROSOFT_TENANT: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
44
50
  /** Comma-separated list of Microsoft OAuth scopes (e.g. `'user.read,mail.read'`). */
45
51
  export declare const AUTH_MICROSOFT_SCOPE: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
52
+ /**
53
+ * Whether to enable the OAuth `state` parameter for CSRF protection on the Microsoft connector.
54
+ * Requires a persistent session store (e.g. Redis) to verify state on callback. Disable
55
+ * (`'false'`) for stateless / serverless environments without a shared session store.
56
+ */
57
+ export declare const AUTH_MICROSOFT_STATE: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
46
58
  /** Apple Sign-In private key (PEM string). */
47
59
  export declare const AUTH_APPLE_PRIVATE_KEY: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
48
60
  /** Apple Sign-In client (service) ID. */
@@ -55,6 +67,12 @@ export declare const AUTH_APPLE_KEY_ID: import("@breadstone/archipel-platform-co
55
67
  export declare const AUTH_APPLE_CALLBACK_URL: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
56
68
  /** Comma-separated list of Apple Sign-In scopes (e.g. `'name,email'`). */
57
69
  export declare const AUTH_APPLE_SCOPE: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
70
+ /**
71
+ * Whether to enable the OAuth `state` parameter for CSRF protection on the Apple connector.
72
+ * Requires a persistent session store (e.g. Redis) to verify state on callback. Disable
73
+ * (`'false'`) for stateless / serverless environments without a shared session store.
74
+ */
75
+ export declare const AUTH_APPLE_STATE: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
58
76
  /** GitHub OAuth client ID. */
59
77
  export declare const AUTH_GITHUB_CLIENT_ID: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
60
78
  /** GitHub OAuth client secret. */
@@ -63,6 +81,12 @@ export declare const AUTH_GITHUB_CLIENT_SECRET: import("@breadstone/archipel-pla
63
81
  export declare const AUTH_GITHUB_CALLBACK_URL: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
64
82
  /** Comma-separated list of GitHub OAuth scopes (e.g. `'user:email,read:user'`). */
65
83
  export declare const AUTH_GITHUB_SCOPE: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
84
+ /**
85
+ * Whether to enable the OAuth `state` parameter for CSRF protection on the GitHub connector.
86
+ * Requires a persistent session store (e.g. Redis) to verify state on callback. Disable
87
+ * (`'false'`) for stateless / serverless environments without a shared session store.
88
+ */
89
+ export declare const AUTH_GITHUB_STATE: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
66
90
  /** Username used for the anonymous seed user. */
67
91
  export declare const SEED_ANONYMOUS_USERNAME: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
68
92
  /** Core configuration entries required by `platform-authentication`. */
package/src/env.js CHANGED
@@ -1,7 +1,7 @@
1
1
  "use strict";
2
2
  // #region Imports
3
3
  Object.defineProperty(exports, "__esModule", { value: true });
4
- exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = exports.SEED_ANONYMOUS_USERNAME = exports.AUTH_GITHUB_SCOPE = exports.AUTH_GITHUB_CALLBACK_URL = exports.AUTH_GITHUB_CLIENT_SECRET = exports.AUTH_GITHUB_CLIENT_ID = exports.AUTH_APPLE_SCOPE = exports.AUTH_APPLE_CALLBACK_URL = exports.AUTH_APPLE_KEY_ID = exports.AUTH_APPLE_TEAM_ID = exports.AUTH_APPLE_CLIENT_ID = exports.AUTH_APPLE_PRIVATE_KEY = exports.AUTH_MICROSOFT_SCOPE = exports.AUTH_MICROSOFT_TENANT = exports.AUTH_MICROSOFT_CALLBACK_URL = exports.AUTH_MICROSOFT_CLIENT_SECRET = exports.AUTH_MICROSOFT_CLIENT_ID = exports.AUTH_GOOGLE_SCOPE = exports.AUTH_GOOGLE_CALLBACK_URL = exports.AUTH_GOOGLE_CLIENT_SECRET = exports.AUTH_GOOGLE_CLIENT_ID = exports.AUTH_MFA_PUSH_MIN_RESEND = exports.AUTH_MFA_PUSH_CODE_TTL = exports.AUTH_MFA_EMAIL_MIN_RESEND = exports.AUTH_MFA_EMAIL_CODE_TTL = exports.AUTH_MFA_SMS_MIN_RESEND = exports.AUTH_MFA_SMS_CODE_TTL = exports.AUTH_MFA_ISSUER = exports.AUTH_MFA_MAX_ATTEMPTS = exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = exports.AUTH_MFA_ENCRYPTION_KEY = exports.AUTH_VERIFY_JWT_EXPIRES_IN = exports.AUTH_JWT_EXPIRES_IN = exports.AUTH_JWT_SECRET = void 0;
4
+ exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = exports.SEED_ANONYMOUS_USERNAME = exports.AUTH_GITHUB_STATE = exports.AUTH_GITHUB_SCOPE = exports.AUTH_GITHUB_CALLBACK_URL = exports.AUTH_GITHUB_CLIENT_SECRET = exports.AUTH_GITHUB_CLIENT_ID = exports.AUTH_APPLE_STATE = exports.AUTH_APPLE_SCOPE = exports.AUTH_APPLE_CALLBACK_URL = exports.AUTH_APPLE_KEY_ID = exports.AUTH_APPLE_TEAM_ID = exports.AUTH_APPLE_CLIENT_ID = exports.AUTH_APPLE_PRIVATE_KEY = exports.AUTH_MICROSOFT_STATE = exports.AUTH_MICROSOFT_SCOPE = exports.AUTH_MICROSOFT_TENANT = exports.AUTH_MICROSOFT_CALLBACK_URL = exports.AUTH_MICROSOFT_CLIENT_SECRET = exports.AUTH_MICROSOFT_CLIENT_ID = exports.AUTH_GOOGLE_STATE = exports.AUTH_GOOGLE_SCOPE = exports.AUTH_GOOGLE_CALLBACK_URL = exports.AUTH_GOOGLE_CLIENT_SECRET = exports.AUTH_GOOGLE_CLIENT_ID = exports.AUTH_MFA_PUSH_MIN_RESEND = exports.AUTH_MFA_PUSH_CODE_TTL = exports.AUTH_MFA_EMAIL_MIN_RESEND = exports.AUTH_MFA_EMAIL_CODE_TTL = exports.AUTH_MFA_SMS_MIN_RESEND = exports.AUTH_MFA_SMS_CODE_TTL = exports.AUTH_MFA_ISSUER = exports.AUTH_MFA_MAX_ATTEMPTS = exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = exports.AUTH_MFA_ENCRYPTION_KEY = exports.AUTH_VERIFY_JWT_EXPIRES_IN = exports.AUTH_JWT_EXPIRES_IN = exports.AUTH_JWT_SECRET = void 0;
5
5
  const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
6
6
  // #endregion
7
7
  /** Secret used to sign JWTs. */
@@ -38,6 +38,12 @@ exports.AUTH_GOOGLE_CLIENT_SECRET = (0, archipel_platform_configuration_1.create
38
38
  exports.AUTH_GOOGLE_CALLBACK_URL = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_GOOGLE_CALLBACK_URL');
39
39
  /** Comma-separated list of Google OAuth scopes (e.g. `'email,profile'`). */
40
40
  exports.AUTH_GOOGLE_SCOPE = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_GOOGLE_SCOPE');
41
+ /**
42
+ * Whether to enable the OAuth `state` parameter for CSRF protection on the Google connector.
43
+ * Requires a persistent session store (e.g. Redis) to verify state on callback. Disable
44
+ * (`'false'`) for stateless / serverless environments without a shared session store.
45
+ */
46
+ exports.AUTH_GOOGLE_STATE = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_GOOGLE_STATE');
41
47
  /** Microsoft OAuth2 client ID. */
42
48
  exports.AUTH_MICROSOFT_CLIENT_ID = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MICROSOFT_CLIENT_ID');
43
49
  /** Microsoft OAuth2 client secret. */
@@ -48,6 +54,12 @@ exports.AUTH_MICROSOFT_CALLBACK_URL = (0, archipel_platform_configuration_1.crea
48
54
  exports.AUTH_MICROSOFT_TENANT = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MICROSOFT_TENANT');
49
55
  /** Comma-separated list of Microsoft OAuth scopes (e.g. `'user.read,mail.read'`). */
50
56
  exports.AUTH_MICROSOFT_SCOPE = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MICROSOFT_SCOPE');
57
+ /**
58
+ * Whether to enable the OAuth `state` parameter for CSRF protection on the Microsoft connector.
59
+ * Requires a persistent session store (e.g. Redis) to verify state on callback. Disable
60
+ * (`'false'`) for stateless / serverless environments without a shared session store.
61
+ */
62
+ exports.AUTH_MICROSOFT_STATE = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MICROSOFT_STATE');
51
63
  /** Apple Sign-In private key (PEM string). */
52
64
  exports.AUTH_APPLE_PRIVATE_KEY = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_APPLE_PRIVATE_KEY');
53
65
  /** Apple Sign-In client (service) ID. */
@@ -60,6 +72,12 @@ exports.AUTH_APPLE_KEY_ID = (0, archipel_platform_configuration_1.createConfigKe
60
72
  exports.AUTH_APPLE_CALLBACK_URL = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_APPLE_CALLBACK_URL');
61
73
  /** Comma-separated list of Apple Sign-In scopes (e.g. `'name,email'`). */
62
74
  exports.AUTH_APPLE_SCOPE = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_APPLE_SCOPE');
75
+ /**
76
+ * Whether to enable the OAuth `state` parameter for CSRF protection on the Apple connector.
77
+ * Requires a persistent session store (e.g. Redis) to verify state on callback. Disable
78
+ * (`'false'`) for stateless / serverless environments without a shared session store.
79
+ */
80
+ exports.AUTH_APPLE_STATE = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_APPLE_STATE');
63
81
  /** GitHub OAuth client ID. */
64
82
  exports.AUTH_GITHUB_CLIENT_ID = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_GITHUB_CLIENT_ID');
65
83
  /** GitHub OAuth client secret. */
@@ -68,6 +86,12 @@ exports.AUTH_GITHUB_CLIENT_SECRET = (0, archipel_platform_configuration_1.create
68
86
  exports.AUTH_GITHUB_CALLBACK_URL = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_GITHUB_CALLBACK_URL');
69
87
  /** Comma-separated list of GitHub OAuth scopes (e.g. `'user:email,read:user'`). */
70
88
  exports.AUTH_GITHUB_SCOPE = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_GITHUB_SCOPE');
89
+ /**
90
+ * Whether to enable the OAuth `state` parameter for CSRF protection on the GitHub connector.
91
+ * Requires a persistent session store (e.g. Redis) to verify state on callback. Disable
92
+ * (`'false'`) for stateless / serverless environments without a shared session store.
93
+ */
94
+ exports.AUTH_GITHUB_STATE = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_GITHUB_STATE');
71
95
  /** Username used for the anonymous seed user. */
72
96
  exports.SEED_ANONYMOUS_USERNAME = (0, archipel_platform_configuration_1.createConfigKey)('SEED_ANONYMOUS_USERNAME');
73
97
  /** Core configuration entries required by `platform-authentication`. */