@broberg/sso 0.20.0 → 0.21.1

package/README.md

@@ -696,3 +696,26 @@ const { token, exp } = await exchangeUserToken({
   (the user's BID login has ended — «log ud» means log out), `client_mismatch` (the token belongs to another app),
   `subject_is_ticket`, `session_ended`, `no_rule_for_audience`, `scope_not_allowed`, `client_unauthenticated`.
 - BID issues nothing without a rule for (your app, the receiver). Ask broberg-id for the rule.
+
+## Login without a client secret — `clientAuth: "fly"` (0.21.0, F084.181, BID F084.180)
+
+An app on Fly can prove itself at BID's token endpoint with its Fly identity instead of a
+`client_secret`. Nothing to store, nothing to rotate, nothing to leak.
+
+```ts
+const sso = ssoRoutes({ clientAuth: "fly", tokenStore });   // or SSO_CLIENT_AUTH=fly
+```
+
+- At the code exchange (and at refresh) the app asks Fly's machine API for an OIDC token with
+  `aud` = BID's **token endpoint** (not the issuer, so a ticket token cannot be replayed as a login
+  proof) and sends it as `client_assertion` with
+  `client_assertion_type=urn:broberg:params:oauth:client-assertion-type:fly-oidc`. PKCE is unchanged.
+- **No fallback.** With `"fly"`, `client_secret` is never sent to the token endpoint, even if one is
+  configured. If Fly cannot give a token, the login fails: the browser gets one generic 500, the log
+  gets `fly client assertion unavailable: …`.
+- **BID must be switched first**: the client registered as `token_endpoint_auth_method: fly_oidc`,
+  bound to your Fly org and app. Ask broberg-id. Switch the app, measure one login, then BID deletes
+  the secret.
+- `clientSecret` is still what introspection and the embedded login use — those are not the token
+  endpoint's code exchange.
+- Without the option nothing changes: the 0.20.0 request, byte for byte.

package/dist/{chunk-ZDNBHM2G.js → chunk-GK3QCKXB.js}

@@ -1,4 +1,6 @@
-import { importJWK, decodeProtectedHeader, jwtVerify } from 'jose';
+import { importJWK, generateKeyPair, exportJWK, calculateJwkThumbprint, SignJWT, decodeProtectedHeader, jwtVerify } from 'jose';
+import { existsSync } from 'fs';
+import { request } from 'http';
 
 // src/config.ts
 var SsoConfigError = class extends Error {
@@ -14,6 +16,12 @@ function required(env, name, hint) {
   }
   return raw.trim();
 }
+function parseClientAuth(raw) {
+  const v = raw?.trim();
+  if (!v) return void 0;
+  if (v === "secret" || v === "fly") return v;
+  throw new SsoConfigError(`SSO_CLIENT_AUTH must be "secret" or "fly" (got ${JSON.stringify(raw)}).`);
+}
 var DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 7;
 function loadSsoConfig(env = process.env) {
   const rawIssuer = required(
@@ -68,7 +76,8 @@ function loadSsoConfig(env = process.env) {
     cookieName: env.SSO_COOKIE_NAME?.trim() || "bid_session",
     sessionMaxAge,
     postLogoutRedirectUri: env.SSO_POST_LOGOUT_REDIRECT_URI?.trim() || void 0,
-    clientSecret: env.SSO_CLIENT_SECRET?.trim() || void 0
+    clientSecret: env.SSO_CLIENT_SECRET?.trim() || void 0,
+    clientAuth: parseClientAuth(env.SSO_CLIENT_AUTH)
   };
 }
 
@@ -284,6 +293,184 @@ function createJwksCache(options) {
     }
   };
 }
+var DEFAULT_ISSUER = "https://id.broberg.ai";
+var FLY_SOCKET = "/.fly/api";
+var NoWorkloadIdentityError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "NoWorkloadIdentityError";
+  }
+};
+var TicketExchangeError = class extends Error {
+  constructor(message, code, status) {
+    super(message);
+    this.code = code;
+    this.status = status;
+    this.name = "TicketExchangeError";
+  }
+  code;
+  status;
+};
+var TicketUnavailableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TicketUnavailableError";
+  }
+};
+function flyOidcOverSocket(aud) {
+  return new Promise((resolve, reject) => {
+    const body = JSON.stringify({ aud });
+    const req = request(
+      { socketPath: FLY_SOCKET, path: "/v1/tokens/oidc", method: "POST", headers: { "content-type": "application/json", "content-length": Buffer.byteLength(body) } },
+      (res) => {
+        let data = "";
+        res.setEncoding("utf8");
+        res.on("data", (c) => data += c);
+        res.on("end", () => {
+          if ((res.statusCode ?? 0) >= 200 && (res.statusCode ?? 0) < 300) resolve(data.trim());
+          else reject(new TicketUnavailableError(`Fly OIDC answered ${res.statusCode}`));
+        });
+      }
+    );
+    req.on("error", (e) => reject(new TicketUnavailableError(`Fly OIDC socket: ${e.message}`)));
+    req.end(body);
+  });
+}
+function jwtExp(token) {
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+    return typeof payload.exp === "number" ? payload.exp : null;
+  } catch {
+    return null;
+  }
+}
+async function readTicketResponse(res, issuer, target, now) {
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {
+  }
+  if (res.status >= 500) throw new TicketUnavailableError(`${issuer} answered ${res.status}`);
+  if (!res.ok || !body.access_token) {
+    const desc = body.error_description ?? "";
+    const code = desc.includes(":") ? desc.slice(0, desc.indexOf(":")).trim() : body.error ?? "exchange_refused";
+    throw new TicketExchangeError(`BID refused the ticket for ${target}: ${desc || body.error || res.status}`, code, res.status);
+  }
+  const nowSec = Math.floor(now() / 1e3);
+  const exp = jwtExp(body.access_token) ?? nowSec + (body.expires_in ?? 300);
+  return { token: body.access_token, exp };
+}
+function createTicketClient(options = {}) {
+  const issuer = (options.issuer ?? DEFAULT_ISSUER).replace(/\/+$/, "");
+  const renewBeforeSec = options.renewBeforeSec ?? 30;
+  const env = options.env ?? process.env;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const now = options.now ?? (() => Date.now());
+  const flyOidc = options.flyOidc ?? flyOidcOverSocket;
+  const onFly = options.onFly ?? (() => !!env.FLY_APP_NAME && existsSync(FLY_SOCKET));
+  const cache = /* @__PURE__ */ new Map();
+  const inFlight = /* @__PURE__ */ new Map();
+  let dpopKey = null;
+  const ownKey = () => dpopKey ??= createDpopKey();
+  async function platformToken() {
+    if (onFly()) return flyOidc(issuer);
+    const url = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+    const bearer = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+    if (url && bearer) {
+      let res;
+      try {
+        res = await fetchImpl(`${url}&audience=${encodeURIComponent(issuer)}`, { headers: { authorization: `Bearer ${bearer}` } });
+      } catch (e) {
+        throw new TicketUnavailableError(`GitHub OIDC endpoint unreachable: ${e instanceof Error ? e.message : String(e)}`);
+      }
+      if (!res.ok) throw new TicketUnavailableError(`GitHub OIDC endpoint answered ${res.status}`);
+      const { value } = await res.json();
+      if (!value) throw new TicketUnavailableError("GitHub OIDC endpoint returned no token");
+      return value;
+    }
+    throw new NoWorkloadIdentityError(
+      "No workload identity to exchange for a ticket: not on a Fly machine (FLY_APP_NAME + /.fly/api) and not in a GitHub Actions job (ACTIONS_ID_TOKEN_REQUEST_URL/_TOKEN \u2014 add `permissions: id-token: write`). A Mac session keeps using its session key."
+    );
+  }
+  async function exchange(audience, scope) {
+    const subject = await platformToken();
+    const form = new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+      subject_token: subject,
+      subject_token_type: "urn:ietf:params:oauth:token-type:jwt",
+      audience
+    });
+    if (scope) form.set("scope", scope);
+    let res;
+    try {
+      const tokenUrl = `${issuer}/oauth2/token`;
+      const headers = { "content-type": "application/x-www-form-urlencoded" };
+      if (options.dpop) headers.dpop = await createDpopProof(await ownKey(), { method: "POST", url: tokenUrl, now });
+      res = await fetchImpl(tokenUrl, { method: "POST", headers, body: form });
+    } catch (e) {
+      throw new TicketUnavailableError(`${issuer} unreachable: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    return readTicketResponse(res, issuer, audience, now);
+  }
+  const client = {
+    async authHeaders({ audience, scope, method, url }) {
+      const ticket = await client.get({ audience, scope });
+      if (!options.dpop) return { authorization: `Bearer ${ticket}` };
+      return { authorization: `DPoP ${ticket}`, dpop: await createDpopProof(await ownKey(), { method, url, ticket, now }) };
+    },
+    async get({ audience, scope }) {
+      const key = `${audience} ${scope ?? ""}`;
+      const hit = cache.get(key);
+      if (hit && hit.exp - renewBeforeSec > now() / 1e3) return hit.token;
+      const pending = inFlight.get(key);
+      if (pending) return pending;
+      const p = exchange(audience, scope).then((t) => {
+        cache.set(key, t);
+        return t.token;
+      }).finally(() => inFlight.delete(key));
+      inFlight.set(key, p);
+      return p;
+    }
+  };
+  return client;
+}
+var shared = null;
+function fetchTicket(opts) {
+  shared ??= createTicketClient();
+  return shared.get(opts);
+}
+async function exchangeUserToken(opts) {
+  const issuer = (opts.issuer ?? DEFAULT_ISSUER).replace(/\/+$/, "");
+  const target = opts.resource ?? opts.audience;
+  if (!target) throw new TicketExchangeError("exchangeUserToken needs a receiver: resource (its URL) or audience (BID's name for it)", "malformed_request", 0);
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const now = opts.now ?? (() => Date.now());
+  const form = new URLSearchParams({
+    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+    subject_token: opts.subjectToken,
+    subject_token_type: "urn:ietf:params:oauth:token-type:access_token"
+  });
+  if (opts.resource) form.set("resource", opts.resource);
+  if (opts.audience) form.set("audience", opts.audience);
+  if (opts.scope) form.set("scope", opts.scope);
+  const tokenUrl = `${issuer}/oauth2/token`;
+  const headers = { "content-type": "application/x-www-form-urlencoded" };
+  if (opts.clientSecret) {
+    headers.authorization = `Basic ${btoa(`${encodeURIComponent(opts.clientId)}:${encodeURIComponent(opts.clientSecret)}`)}`;
+  } else {
+    form.set("client_id", opts.clientId);
+  }
+  if (opts.dpopKey) headers.dpop = await createDpopProof(opts.dpopKey, { method: "POST", url: tokenUrl, now });
+  let res;
+  try {
+    res = await fetchImpl(tokenUrl, { method: "POST", headers, body: form });
+  } catch (e) {
+    throw new TicketUnavailableError(`${issuer} unreachable: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  return readTicketResponse(res, issuer, target, now);
+}
+
+// src/client.ts
 var SsoError = class extends Error {
   constructor(message) {
     super(message);
@@ -368,6 +555,7 @@ var INVITATION_OUTCOMES = /* @__PURE__ */ new Set([
 var MIGRATION_STATES = /* @__PURE__ */ new Set(["ready", "invited", "expired", "not_invited"]);
 var BACKCHANNEL_EVENT = "http://schemas.openid.net/event/backchannel-logout";
 var MAX_INVITATIONS = 500;
+var FLY_CLIENT_ASSERTION_TYPE = "urn:broberg:params:oauth:client-assertion-type:fly-oidc";
 function excerptForLog(raw, clientSecret) {
   let text = raw.replace(/\s+/g, " ").trim();
   if (clientSecret) text = text.split(clientSecret).join("[redacted client_secret]");
@@ -403,6 +591,18 @@ var ALLOWED_ALGS = [
 function createSsoClient(config, options = {}) {
   const fetchImpl = options.fetchImpl ?? fetch;
   const timeoutMs = options.timeoutMs ?? 1e4;
+  const flyOidc = options.flyOidc ?? flyOidcOverSocket;
+  async function tokenEndpointAuth(tokenEndpoint) {
+    if (config.clientAuth !== "fly") return config.clientSecret ? { client_secret: config.clientSecret } : {};
+    let assertion;
+    try {
+      assertion = await flyOidc(tokenEndpoint);
+    } catch (e) {
+      throw new SsoError(`fly client assertion unavailable: could not get a Fly OIDC token for ${tokenEndpoint} \u2014 ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (!assertion) throw new SsoError(`fly client assertion unavailable: Fly returned an empty token for ${tokenEndpoint}`);
+    return { client_assertion_type: FLY_CLIENT_ASSERTION_TYPE, client_assertion: assertion };
+  }
   async function appPost(path, bearer, payload, what) {
     const url = new URL(path, config.issuer).toString();
     const ctrl = new AbortController();
@@ -686,7 +886,7 @@ function createSsoClient(config, options = {}) {
         // ALWAYS sent, secret or not. See SsoConfig.clientSecret: the two
         // prove different things, so a confidential client keeps PKCE.
         code_verifier: codeVerifier,
-        ...config.clientSecret ? { client_secret: config.clientSecret } : {}
+        ...await tokenEndpointAuth(token_endpoint)
       })
     });
     const raw = await res.text();
@@ -780,6 +980,11 @@ function createSsoClient(config, options = {}) {
         code_challenge: await challengeFor(codeVerifier),
         code_challenge_method: "S256",
         nonce,
+        // F084.183 — the redirect the code is BOUND to, the same value /oauth2/token sends.
+        // Without it BID bound the code to the client's FIRST registered redirect, and an
+        // app served from another of its registered hosts (Jam on jams.party) got
+        // «invalid_grant — redirect_uri mismatch» at the exchange.
+        redirect_uri: config.redirectUri,
         ...input.intent === "signup" ? { intent: "signup", name: input.name, terms_version: input.termsVersion } : {},
         ...input.endUserIp ? { end_user_ip: input.endUserIp } : {}
       });
@@ -866,7 +1071,7 @@ function createSsoClient(config, options = {}) {
           grant_type: "refresh_token",
           refresh_token: refreshToken,
           client_id: config.clientId,
-          ...config.clientSecret ? { client_secret: config.clientSecret } : {}
+          ...await tokenEndpointAuth(token_endpoint)
         })
       });
       const raw = await res.text();
@@ -972,6 +1177,84 @@ function createSsoClient(config, options = {}) {
   };
 }
 
+// src/dpop.ts
+async function createDpopKey() {
+  const { privateKey, publicKey } = await generateKeyPair("ES256", { extractable: false });
+  const jwk = await exportJWK(publicKey);
+  const publicJwk = { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
+  return { privateKey, publicJwk, jkt: await calculateJwkThumbprint(publicJwk) };
+}
+var enc2 = new TextEncoder();
+var b64url3 = (bytes) => btoa(String.fromCharCode(...new Uint8Array(bytes))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+async function accessTokenHash(ticket) {
+  return b64url3(await crypto.subtle.digest("SHA-256", enc2.encode(ticket)));
+}
+function normalizeHtu(url) {
+  const u = new URL(url);
+  return `${u.protocol}//${u.host}${u.pathname}`;
+}
+async function createDpopProof(key, opts) {
+  const payload = {
+    jti: crypto.randomUUID(),
+    htm: opts.method.toUpperCase(),
+    htu: normalizeHtu(opts.url),
+    iat: Math.floor((opts.now?.() ?? Date.now()) / 1e3)
+  };
+  if (opts.ticket !== void 0) payload.ath = await accessTokenHash(opts.ticket);
+  return new SignJWT(payload).setProtectedHeader({ typ: "dpop+jwt", alg: "ES256", jwk: key.publicJwk }).sign(key.privateKey);
+}
+function createMemoryReplayStore(now = () => Date.now()) {
+  const entries = /* @__PURE__ */ new Map();
+  return {
+    async seen(key, ttlMs) {
+      const t = now();
+      for (const [k, until] of entries) if (until <= t) entries.delete(k);
+      if (entries.has(key)) return true;
+      entries.set(key, t + ttlMs);
+      return false;
+    }
+  };
+}
+var ASYMMETRIC = /* @__PURE__ */ new Set(["ES256", "ES384", "ES512", "EdDSA", "PS256", "PS384", "PS512", "RS256", "RS384", "RS512"]);
+async function verifyDpopProof(proof, o) {
+  let header;
+  try {
+    header = decodeProtectedHeader(proof);
+  } catch {
+    throw new SsoError("DPoP proof is not a JWS");
+  }
+  if (header.typ !== "dpop+jwt") throw new SsoError(`DPoP proof has typ ${JSON.stringify(header.typ)}, not "dpop+jwt"`);
+  if (!header.alg || !ASYMMETRIC.has(header.alg)) throw new SsoError(`DPoP proof alg ${JSON.stringify(header.alg)} is not an accepted asymmetric algorithm`);
+  const jwk = header.jwk;
+  if (!jwk || typeof jwk !== "object") throw new SsoError("DPoP proof carries no jwk");
+  if ("d" in jwk) throw new SsoError("DPoP proof jwk contains a private key");
+  let payload;
+  try {
+    const key = await importJWK(jwk, header.alg);
+    ({ payload } = await jwtVerify(proof, key, { typ: "dpop+jwt", algorithms: [header.alg] }));
+  } catch (e) {
+    throw new SsoError(`DPoP proof signature rejected: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  if (await calculateJwkThumbprint(jwk) !== o.jkt) throw new SsoError("DPoP proof key does not match the ticket's cnf.jkt");
+  if (payload.htm !== o.method.toUpperCase()) throw new SsoError(`DPoP proof is for ${JSON.stringify(payload.htm)}, the request is ${o.method.toUpperCase()}`);
+  let htu;
+  try {
+    htu = normalizeHtu(String(payload.htu));
+  } catch {
+    throw new SsoError("DPoP proof htu is not a URL");
+  }
+  if (htu !== normalizeHtu(o.url)) throw new SsoError(`DPoP proof is for ${htu}, the request is ${normalizeHtu(o.url)}`);
+  const nowSec = Math.floor(o.now() / 1e3);
+  if (typeof payload.iat !== "number" || Math.abs(nowSec - payload.iat) > o.iatWindowSec) {
+    throw new SsoError(`DPoP proof iat is outside \xB1${o.iatWindowSec}s`);
+  }
+  if (payload.ath !== await accessTokenHash(o.ticket)) throw new SsoError("DPoP proof ath does not match this ticket");
+  if (typeof payload.jti !== "string" || payload.jti === "") throw new SsoError("DPoP proof has no jti");
+  if (await o.replay.seen(`${o.jkt}:${payload.jti}`, o.iatWindowSec * 2 * 1e3)) {
+    throw new SsoError("DPoP proof was already used (jti replay)");
+  }
+}
+
 // src/tokens.ts
 var warned = false;
 function memoryTokenStore(options = {}) {
@@ -1019,6 +1302,6 @@ function newSid() {
   return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
-export { ALLOWED_ALGS, AVATAR_TYPES, DEFAULT_SESSION_MAX_AGE, EMBEDDED_FLOW_MAX_AGE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_AVATAR_BYTES, MAX_INVITATIONS, SsoAppApiError, SsoAvatarRejectedError, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoIntrospectionUnavailableError, SsoReauthError, SsoTokenInactiveError, cookieHeader, createJwksCache, createSsoClient, expiresAtFrom, loadSsoConfig, mediaType, memoryTokenStore, newSid, openEmbeddedFlow, readCookie, sealEmbeddedFlow, signSession, signValue, verifySession, verifyValue };
-//# sourceMappingURL=chunk-ZDNBHM2G.js.map
-//# sourceMappingURL=chunk-ZDNBHM2G.js.map
+export { ALLOWED_ALGS, AVATAR_TYPES, DEFAULT_ISSUER, DEFAULT_SESSION_MAX_AGE, EMBEDDED_FLOW_MAX_AGE, FLY_CLIENT_ASSERTION_TYPE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_AVATAR_BYTES, MAX_INVITATIONS, NoWorkloadIdentityError, SsoAppApiError, SsoAvatarRejectedError, SsoConfigError, SsoError, SsoInsufficientScopeError, SsoIntrospectionUnavailableError, SsoReauthError, SsoTokenInactiveError, TicketExchangeError, TicketUnavailableError, accessTokenHash, cookieHeader, createDpopKey, createDpopProof, createJwksCache, createMemoryReplayStore, createSsoClient, createTicketClient, exchangeUserToken, expiresAtFrom, fetchTicket, loadSsoConfig, mediaType, memoryTokenStore, newSid, normalizeHtu, openEmbeddedFlow, readCookie, sealEmbeddedFlow, signSession, signValue, verifyDpopProof, verifySession, verifyValue };
+//# sourceMappingURL=chunk-GK3QCKXB.js.map
+//# sourceMappingURL=chunk-GK3QCKXB.js.map