@broberg/sso 0.12.1 → 0.14.1

package/dist/index.cjs

@@ -1,6 +1,8 @@
 'use strict';
 
 var jose = require('jose');
+var fs = require('fs');
+var http = require('http');
 
 // src/config.ts
 var SsoConfigError = class extends Error {
@@ -666,6 +668,239 @@ function createSsoClient(config, options = {}) {
     }
   };
 }
+var DEFAULT_ISSUER = "https://id.broberg.ai";
+var FLY_SOCKET = "/.fly/api";
+var NoWorkloadIdentityError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "NoWorkloadIdentityError";
+  }
+};
+var TicketExchangeError = class extends Error {
+  constructor(message, code, status) {
+    super(message);
+    this.code = code;
+    this.status = status;
+    this.name = "TicketExchangeError";
+  }
+  code;
+  status;
+};
+var TicketUnavailableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TicketUnavailableError";
+  }
+};
+function flyOidcOverSocket(aud) {
+  return new Promise((resolve, reject) => {
+    const body = JSON.stringify({ aud });
+    const req = http.request(
+      { socketPath: FLY_SOCKET, path: "/v1/tokens/oidc", method: "POST", headers: { "content-type": "application/json", "content-length": Buffer.byteLength(body) } },
+      (res) => {
+        let data = "";
+        res.setEncoding("utf8");
+        res.on("data", (c) => data += c);
+        res.on("end", () => {
+          if ((res.statusCode ?? 0) >= 200 && (res.statusCode ?? 0) < 300) resolve(data.trim());
+          else reject(new TicketUnavailableError(`Fly OIDC answered ${res.statusCode}`));
+        });
+      }
+    );
+    req.on("error", (e) => reject(new TicketUnavailableError(`Fly OIDC socket: ${e.message}`)));
+    req.end(body);
+  });
+}
+function jwtExp(token) {
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+    return typeof payload.exp === "number" ? payload.exp : null;
+  } catch {
+    return null;
+  }
+}
+function createTicketClient(options = {}) {
+  const issuer = (options.issuer ?? DEFAULT_ISSUER).replace(/\/+$/, "");
+  const renewBeforeSec = options.renewBeforeSec ?? 30;
+  const env = options.env ?? process.env;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const now = options.now ?? (() => Date.now());
+  const flyOidc = options.flyOidc ?? flyOidcOverSocket;
+  const onFly = options.onFly ?? (() => !!env.FLY_APP_NAME && fs.existsSync(FLY_SOCKET));
+  const cache = /* @__PURE__ */ new Map();
+  const inFlight = /* @__PURE__ */ new Map();
+  async function platformToken() {
+    if (onFly()) return flyOidc(issuer);
+    const url = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+    const bearer = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+    if (url && bearer) {
+      let res;
+      try {
+        res = await fetchImpl(`${url}&audience=${encodeURIComponent(issuer)}`, { headers: { authorization: `Bearer ${bearer}` } });
+      } catch (e) {
+        throw new TicketUnavailableError(`GitHub OIDC endpoint unreachable: ${e instanceof Error ? e.message : String(e)}`);
+      }
+      if (!res.ok) throw new TicketUnavailableError(`GitHub OIDC endpoint answered ${res.status}`);
+      const { value } = await res.json();
+      if (!value) throw new TicketUnavailableError("GitHub OIDC endpoint returned no token");
+      return value;
+    }
+    throw new NoWorkloadIdentityError(
+      "No workload identity to exchange for a ticket: not on a Fly machine (FLY_APP_NAME + /.fly/api) and not in a GitHub Actions job (ACTIONS_ID_TOKEN_REQUEST_URL/_TOKEN \u2014 add `permissions: id-token: write`). A Mac session keeps using its session key."
+    );
+  }
+  async function exchange(audience, scope) {
+    const subject = await platformToken();
+    const form = new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+      subject_token: subject,
+      subject_token_type: "urn:ietf:params:oauth:token-type:jwt",
+      audience
+    });
+    if (scope) form.set("scope", scope);
+    let res;
+    try {
+      res = await fetchImpl(`${issuer}/oauth2/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: form
+      });
+    } catch (e) {
+      throw new TicketUnavailableError(`${issuer} unreachable: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    let body = {};
+    try {
+      body = await res.json();
+    } catch {
+    }
+    if (res.status >= 500) throw new TicketUnavailableError(`${issuer} answered ${res.status}`);
+    if (!res.ok || !body.access_token) {
+      const desc = body.error_description ?? "";
+      const code = desc.includes(":") ? desc.slice(0, desc.indexOf(":")).trim() : body.error ?? "exchange_refused";
+      throw new TicketExchangeError(`Broberg ID refused the ticket for ${audience}: ${desc || body.error || res.status}`, code, res.status);
+    }
+    const nowSec = Math.floor(now() / 1e3);
+    const exp = jwtExp(body.access_token) ?? nowSec + (body.expires_in ?? 300);
+    return { token: body.access_token, exp };
+  }
+  return {
+    async get({ audience, scope }) {
+      const key = `${audience} ${scope ?? ""}`;
+      const hit = cache.get(key);
+      if (hit && hit.exp - renewBeforeSec > now() / 1e3) return hit.token;
+      const pending = inFlight.get(key);
+      if (pending) return pending;
+      const p = exchange(audience, scope).then((t) => {
+        cache.set(key, t);
+        return t.token;
+      }).finally(() => inFlight.delete(key));
+      inFlight.set(key, p);
+      return p;
+    }
+  };
+}
+var shared = null;
+function fetchTicket(opts) {
+  shared ??= createTicketClient();
+  return shared.get(opts);
+}
+var PRINCIPAL_TYPES = ["human", "service", "agent"];
+function createTicketVerifier(options) {
+  const {
+    issuer,
+    audience,
+    maxLifetimeSec = 15 * 60,
+    clockToleranceSec = 30,
+    fetchImpl = fetch
+  } = options;
+  if (!issuer) throw new SsoError("createTicketVerifier needs an issuer");
+  if (!audience) throw new SsoError("createTicketVerifier needs this receiver's audience");
+  let cachePromise = null;
+  const cacheFor = (jwksUri) => createJwksCache({
+    jwksUri,
+    fetchImpl,
+    ...options.warmUp ? { warmUp: true } : {},
+    ...options.minRefetchIntervalMs !== void 0 ? { minRefetchIntervalMs: options.minRefetchIntervalMs } : {}
+  });
+  async function keys() {
+    cachePromise ??= (async () => {
+      if (options.jwksUri) return cacheFor(options.jwksUri);
+      const url = `${issuer}/.well-known/openid-configuration`;
+      let doc;
+      try {
+        const res = await fetchImpl(url);
+        if (!res.ok) throw new Error(`answered ${res.status}`);
+        doc = await res.json();
+      } catch (cause) {
+        throw new JwksUnavailableError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`);
+      }
+      if (doc.issuer !== issuer) {
+        throw new SsoError(`issuer is ${issuer} but ${url} says ${doc.issuer} \u2014 they must match exactly`);
+      }
+      if (!doc.jwks_uri) throw new SsoError(`${url} names no jwks_uri`);
+      return cacheFor(doc.jwks_uri);
+    })().catch((err) => {
+      cachePromise = null;
+      throw err;
+    });
+    return cachePromise;
+  }
+  if (options.warmUp) void keys().catch(() => {
+  });
+  return {
+    async verify(token, opts = {}) {
+      let header;
+      try {
+        header = jose.decodeProtectedHeader(token);
+      } catch {
+        throw new SsoError("ticket is not a JWS");
+      }
+      if (!header.kid) throw new SsoError("ticket has no kid \u2014 cannot pick a signing key");
+      if (header.typ === "logout+jwt") throw new SsoError("a logout token is not a ticket");
+      const cache = await keys();
+      let payload;
+      try {
+        ({ payload } = await jose.jwtVerify(token, async () => cache.getKey(header.kid, header.alg ?? "EdDSA"), {
+          issuer,
+          audience,
+          algorithms: ALLOWED_ALGS,
+          clockTolerance: clockToleranceSec,
+          requiredClaims: ["exp", "iat", "jti", "sub"]
+        }));
+      } catch (e) {
+        if (e instanceof JwksUnavailableError) throw e;
+        throw new SsoError(`ticket rejected: ${e instanceof Error ? e.message : String(e)}`);
+      }
+      if ("events" in payload) throw new SsoError("a logout token is not a ticket");
+      if ("nonce" in payload) throw new SsoError("an ID token is not a ticket");
+      const type = payload.principal_type;
+      if (typeof type !== "string" || !PRINCIPAL_TYPES.includes(type)) {
+        throw new SsoError(`ticket has no valid principal_type (got ${JSON.stringify(type)})`);
+      }
+      const lifetime = payload.exp - payload.iat;
+      if (lifetime > maxLifetimeSec) {
+        throw new SsoError(`ticket claims a ${lifetime}s lifetime; at most ${maxLifetimeSec}s is accepted`);
+      }
+      if (typeof payload.sub !== "string" || payload.sub === "") throw new SsoError("ticket has no sub");
+      const scopes = typeof payload.scope === "string" ? payload.scope.split(" ").filter(Boolean) : [];
+      const required2 = opts.scope === void 0 ? [] : Array.isArray(opts.scope) ? opts.scope : [opts.scope];
+      const missing = required2.filter((s) => !scopes.includes(s));
+      if (missing.length) throw new SsoError(`ticket lacks scope ${missing.join(", ")}`);
+      const actRaw = payload.act;
+      const act = actRaw && typeof actRaw.sub === "string" && actRaw.sub ? { sub: actRaw.sub } : null;
+      return {
+        principal: payload.sub,
+        type,
+        clientId: typeof payload.client_id === "string" && payload.client_id ? payload.client_id : payload.sub,
+        org: typeof payload.org === "string" && payload.org ? payload.org : null,
+        act,
+        scopes,
+        exp: payload.exp,
+        jti: String(payload.jti)
+      };
+    }
+  };
+}
 
 // src/session.ts
 var enc = new TextEncoder();
@@ -787,21 +1022,28 @@ function memoryTokenStore(options = {}) {
 }
 
 exports.AVATAR_TYPES = AVATAR_TYPES;
+exports.DEFAULT_ISSUER = DEFAULT_ISSUER;
 exports.DEFAULT_SESSION_MAX_AGE = DEFAULT_SESSION_MAX_AGE;
 exports.JwksError = JwksError;
 exports.JwksUnavailableError = JwksUnavailableError;
 exports.JwksUnknownKeyError = JwksUnknownKeyError;
 exports.MAX_AVATAR_BYTES = MAX_AVATAR_BYTES;
 exports.MAX_INVITATIONS = MAX_INVITATIONS;
+exports.NoWorkloadIdentityError = NoWorkloadIdentityError;
 exports.SsoAppApiError = SsoAppApiError;
 exports.SsoAvatarRejectedError = SsoAvatarRejectedError;
 exports.SsoConfigError = SsoConfigError;
 exports.SsoError = SsoError;
 exports.SsoInsufficientScopeError = SsoInsufficientScopeError;
 exports.SsoReauthError = SsoReauthError;
+exports.TicketExchangeError = TicketExchangeError;
+exports.TicketUnavailableError = TicketUnavailableError;
 exports.cookieHeader = cookieHeader;
 exports.createJwksCache = createJwksCache;
 exports.createSsoClient = createSsoClient;
+exports.createTicketClient = createTicketClient;
+exports.createTicketVerifier = createTicketVerifier;
+exports.fetchTicket = fetchTicket;
 exports.loadSsoConfig = loadSsoConfig;
 exports.memoryTokenStore = memoryTokenStore;
 exports.readCookie = readCookie;