@broberg/sso 0.8.0 → 0.10.0

package/dist/hono.js

@@ -174,6 +174,45 @@ var SsoError = class extends Error {
     this.name = "SsoError";
   }
 };
+var SsoReauthError = class extends SsoError {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "SsoReauthError";
+  }
+  reason;
+};
+var SsoAppApiError = class extends SsoError {
+  constructor(message, status, code) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "SsoAppApiError";
+  }
+  status;
+  code;
+};
+var SsoInsufficientScopeError = class extends SsoAppApiError {
+  constructor(message, scope) {
+    super(message, 403, "insufficient_scope");
+    this.scope = scope;
+    this.name = "SsoInsufficientScopeError";
+  }
+  scope;
+};
+var SsoAvatarRejectedError = class extends SsoError {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "SsoAvatarRejectedError";
+  }
+  reason;
+};
+var MAX_AVATAR_BYTES = 2 * 1024 * 1024;
+var AVATAR_TYPES = ["image/png", "image/jpeg", "image/webp"];
+function mediaType(contentType) {
+  return (contentType ?? "").split(";")[0].trim().toLowerCase();
+}
 var b64url = (bytes) => {
   const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
   let s = "";
@@ -265,6 +304,68 @@ function createSsoClient(config, options = {}) {
       clearTimeout(timer);
     }
   }
+  async function appRequest(path, bearer, init, what) {
+    const url = new URL(path, config.issuer).toString();
+    const ctrl = new AbortController();
+    let timer;
+    const timedOut = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        reject(new SsoAppApiError(`${url} did not answer within ${timeoutMs} ms \u2014 ${what} is unknown.`, null, void 0));
+        ctrl.abort();
+      }, timeoutMs);
+    });
+    const headers = { authorization: `Bearer ${bearer}` };
+    let body;
+    if (init.json !== void 0) {
+      headers["content-type"] = "application/json";
+      body = JSON.stringify(init.json);
+    } else if (init.bytes !== void 0) {
+      headers["content-type"] = init.contentType ?? "application/octet-stream";
+      body = init.bytes;
+    }
+    try {
+      const res = await Promise.race([
+        fetchImpl(url, { method: init.method, headers, ...body !== void 0 ? { body } : {}, signal: ctrl.signal }),
+        timedOut
+      ]);
+      const raw = await Promise.race([res.text(), timedOut]);
+      let parsed;
+      try {
+        parsed = raw.trim() === "" ? void 0 : JSON.parse(raw);
+      } catch {
+        parsed = void 0;
+      }
+      const fields = parsed && typeof parsed === "object" ? parsed : {};
+      const code = typeof fields.error === "string" ? fields.error : void 0;
+      if (!res.ok) {
+        if (res.status === 403 && code === "insufficient_scope") {
+          const scope = typeof fields.scope === "string" && fields.scope ? fields.scope : init.method === "GET" ? "profile" : "profile:write";
+          throw new SsoInsufficientScopeError(
+            `${url} answered 403 insufficient_scope \u2014 the user's token lacks scope "${scope}"; log in again with it requested.`,
+            scope
+          );
+        }
+        throw new SsoAppApiError(`${url} answered ${res.status}${code ? ` (${code})` : ""} \u2014 ${what} is unknown.`, res.status, code);
+      }
+      if (parsed === void 0) {
+        throw new SsoAppApiError(`${url} answered ${res.status} with a body that is not JSON \u2014 ${what} is unknown.`, res.status, void 0);
+      }
+      return parsed;
+    } catch (e) {
+      if (e instanceof SsoError) throw e;
+      throw new SsoAppApiError(`${url} could not be reached (${e instanceof Error ? e.name : "error"}) \u2014 ${what} is unknown.`, null, void 0);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  function asProfile(body, path) {
+    const b = body ?? {};
+    if (typeof b.sub !== "string" || b.sub === "" || typeof b.account_url !== "string") {
+      throw new SsoAppApiError(`${path} returned no "sub" or "account_url" \u2014 the profile is unknown.`, 200, void 0);
+    }
+    const opt = (v) => typeof v === "string" ? v : null;
+    return { sub: b.sub, name: opt(b.name), picture: opt(b.picture), email: opt(b.email), account_url: b.account_url };
+  }
   let discoveryPromise = null;
   let jwksCache = null;
   async function discovery() {
@@ -448,7 +549,36 @@ function createSsoClient(config, options = {}) {
         unverifiedClaims: merged.unverifiedClaims,
         idToken: body.id_token,
         ...body.access_token ? { accessToken: body.access_token } : {},
-        ...body.refresh_token ? { refreshToken: body.refresh_token } : {}
+        ...body.refresh_token ? { refreshToken: body.refresh_token } : {},
+        ...typeof body.expires_in === "number" ? { expiresIn: body.expires_in } : {}
+      };
+    },
+    async refreshTokens(refreshToken) {
+      const { token_endpoint } = await discovery();
+      const res = await fetchImpl(token_endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: refreshToken,
+          client_id: config.clientId,
+          ...config.clientSecret ? { client_secret: config.clientSecret } : {}
+        })
+      });
+      const raw = await res.text();
+      let body;
+      try {
+        body = raw.trim() === "" ? {} : JSON.parse(raw);
+      } catch {
+        throw new SsoError(`token refresh failed (${res.status}): the response body is not JSON`);
+      }
+      if (!res.ok || typeof body.access_token !== "string" || body.access_token === "") {
+        throw new SsoError(`token refresh failed (${res.status}): ${body.error ?? "no access_token in response"}`);
+      }
+      return {
+        accessToken: body.access_token,
+        ...typeof body.refresh_token === "string" && body.refresh_token ? { refreshToken: body.refresh_token } : {},
+        ...typeof body.expires_in === "number" ? { expiresIn: body.expires_in } : {}
       };
     },
     async logoutUrl(opts = {}) {
@@ -479,6 +609,35 @@ function createSsoClient(config, options = {}) {
       return status;
     },
     verifyLogoutToken,
+    async getProfile(accessToken) {
+      const path = "/api/app/profile";
+      return asProfile(await appRequest(path, accessToken, { method: "GET" }, "the profile"), path);
+    },
+    async updateProfile(accessToken, name) {
+      const path = "/api/app/profile";
+      return asProfile(await appRequest(path, accessToken, { method: "POST", json: { name } }, "the new name"), path);
+    },
+    async uploadAvatar(accessToken, bytes, contentType) {
+      const type = mediaType(contentType);
+      if (!AVATAR_TYPES.includes(type)) {
+        throw new SsoAvatarRejectedError(
+          `uploadAvatar: "${type}" is not accepted \u2014 BID takes ${AVATAR_TYPES.join(", ")}.`,
+          "unsupported_type"
+        );
+      }
+      if (bytes.byteLength > MAX_AVATAR_BYTES) {
+        throw new SsoAvatarRejectedError(
+          `uploadAvatar: ${bytes.byteLength} bytes \u2014 BID takes at most ${MAX_AVATAR_BYTES}.`,
+          "too_large"
+        );
+      }
+      const path = "/api/app/profile/avatar";
+      return asProfile(await appRequest(path, accessToken, { method: "POST", bytes, contentType: type }, "the new picture"), path);
+    },
+    async removeAvatar(accessToken) {
+      const path = "/api/app/profile/avatar/remove";
+      return asProfile(await appRequest(path, accessToken, { method: "POST" }, "the removed picture"), path);
+    },
     async inviteUsers(appKey, input) {
       if (input.users.length > MAX_INVITATIONS) {
         throw new SsoError(`inviteUsers: ${input.users.length} users, BID accepts at most ${MAX_INVITATIONS} per call.`);
@@ -509,6 +668,26 @@ function createSsoClient(config, options = {}) {
   };
 }
 
+// src/tokens.ts
+function expiresAtFrom(expiresIn, accessToken, now) {
+  if (typeof expiresIn === "number" && expiresIn > 0) return now + Math.floor(expiresIn);
+  const parts = accessToken.split(".");
+  if (parts.length === 3) {
+    try {
+      const json = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
+      if (typeof json.exp === "number" && json.exp > now) return json.exp;
+    } catch {
+    }
+  }
+  return now + 300;
+}
+function newSid() {
+  const b = crypto.getRandomValues(new Uint8Array(16));
+  let s = "";
+  for (const x of b) s += String.fromCharCode(x);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
 // src/session.ts
 var enc = new TextEncoder();
 var b64url2 = (bytes) => {
@@ -639,6 +818,7 @@ function ssoRoutes(options = {}) {
     throw new Error("ssoRoutes: backchannel needs a store shared by every instance of the app \u2014 there is no in-memory default.");
   }
   const onStoreError = backchannel?.onStoreError ?? "reject";
+  const tokenStore = options.tokenStore;
   async function liveSession(c) {
     const session = await verifySession(readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
     if (!session || !backchannel) return session;
@@ -671,6 +851,7 @@ function ssoRoutes(options = {}) {
       }
       try {
         await backchannel.store.revokeSubBefore(verified.sub, verified.iat);
+        if (tokenStore) await tokenStore.deleteSub(verified.sub);
         await backchannel.store.useJti(verified.jti, verified.exp);
       } catch {
         return c.json({ error: "store_unavailable" }, 503);
@@ -734,11 +915,23 @@ function ssoRoutes(options = {}) {
       codeVerifier: parsed.tx.codeVerifier,
       nonce: parsed.tx.nonce
     });
-    const exp = Math.floor(Date.now() / 1e3) + config.sessionMaxAge;
+    const nowS = Math.floor(Date.now() / 1e3);
+    const exp = nowS + config.sessionMaxAge;
+    let sid;
+    if (tokenStore && result.accessToken) {
+      sid = newSid();
+      await tokenStore.set(sid, {
+        sub: result.claims.sub,
+        accessToken: result.accessToken,
+        ...result.refreshToken ? { refreshToken: result.refreshToken } : {},
+        expiresAt: expiresAtFrom(result.expiresIn, result.accessToken, nowS)
+      });
+    }
     const session = {
       sub: result.claims.sub,
       exp,
-      iat: Math.floor(Date.now() / 1e3),
+      iat: nowS,
+      ...sid ? { sid } : {},
       ...result.claims.email ? { email: result.claims.email } : {},
       ...result.claims.name ? { name: result.claims.name } : {},
       ...result.claims.picture ? { picture: result.claims.picture } : {},
@@ -772,6 +965,10 @@ function ssoRoutes(options = {}) {
       readCookie(c.req.header("cookie"), idTokenCookie),
       config.cookieSecret
     );
+    if (tokenStore) {
+      const leaving = await verifySession(readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
+      if (leaving?.sid) await tokenStore.delete(leaving.sid);
+    }
     c.header(
       "Set-Cookie",
       cookieHeader(config.cookieName, "", { maxAge: 0, secure: isSecure(c) })
@@ -802,7 +999,54 @@ function ssoRoutes(options = {}) {
     c.set(SESSION_KEY, session);
     await next();
   };
-  return { app, attach, require: require2, client, config };
+  const refreshing = /* @__PURE__ */ new Map();
+  async function getAccessToken(c) {
+    if (!tokenStore) {
+      throw new SsoError("getAccessToken needs ssoRoutes({ tokenStore }) \u2014 without one the login's tokens are not kept.");
+    }
+    const raw = await verifySession(readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
+    const live = await liveSession(c);
+    if (!live) {
+      if (raw?.sid) await tokenStore.delete(raw.sid);
+      throw new SsoReauthError("no live session \u2014 log in again.", "no_session");
+    }
+    const sid = live.sid;
+    if (!sid) throw new SsoReauthError("this session has no stored tokens (it began before tokenStore was configured) \u2014 log in again.", "no_tokens");
+    const tokens = await tokenStore.get(sid);
+    if (!tokens) throw new SsoReauthError("no tokens stored for this session \u2014 log in again.", "no_tokens");
+    const now = Math.floor(Date.now() / 1e3);
+    if (tokens.expiresAt - 30 > now) return tokens.accessToken;
+    if (!tokens.refreshToken) {
+      await tokenStore.delete(sid);
+      throw new SsoReauthError("the access token has expired and there is no refresh token \u2014 log in again.", "expired");
+    }
+    const inFlight = refreshing.get(sid);
+    if (inFlight) return inFlight;
+    const p = (async () => {
+      let next;
+      try {
+        next = await client.refreshTokens(tokens.refreshToken);
+      } catch (e) {
+        await tokenStore.delete(sid);
+        throw new SsoReauthError(e instanceof SsoError ? e.message : "token refresh failed", "refresh_failed");
+      }
+      await tokenStore.set(sid, {
+        sub: tokens.sub,
+        accessToken: next.accessToken,
+        // Rotation: use the new one if BID issued one, else keep the old.
+        ...next.refreshToken ?? tokens.refreshToken ? { refreshToken: next.refreshToken ?? tokens.refreshToken } : {},
+        expiresAt: expiresAtFrom(next.expiresIn, next.accessToken, Math.floor(Date.now() / 1e3))
+      });
+      return next.accessToken;
+    })();
+    refreshing.set(sid, p);
+    try {
+      return await p;
+    } finally {
+      refreshing.delete(sid);
+    }
+  }
+  return { app, attach, require: require2, client, config, getAccessToken };
 }
 async function parseTransaction(raw, secret) {
   if (raw === void 0) return { ok: false, reason: "absent" };
@@ -821,7 +1065,99 @@ async function parseTransaction(raw, secret) {
 function getSession(c) {
   return c.get(SESSION_KEY) ?? null;
 }
+function errName(e) {
+  return e instanceof Error ? e.name : void 0;
+}
+async function readCapped(c, max) {
+  const stream = c.req.raw.body;
+  if (!stream) return new Uint8Array(0);
+  const reader = stream.getReader();
+  const chunks = [];
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > max) {
+      await reader.cancel().catch(() => {
+      });
+      return null;
+    }
+    chunks.push(value);
+  }
+  const out = new Uint8Array(size);
+  let at = 0;
+  for (const ch of chunks) {
+    out.set(ch, at);
+    at += ch.byteLength;
+  }
+  return out;
+}
+function accountRoutes(sso) {
+  const app = new Hono();
+  const { client } = sso;
+  app.use("*", async (c, next) => {
+    c.header("Cache-Control", "no-store");
+    await next();
+  });
+  app.use("*", async (c, next) => {
+    const site = c.req.header("sec-fetch-site");
+    if (c.req.method !== "GET" && site !== void 0 && site !== "same-origin" && site !== "none") {
+      return c.json({ error: "cross_site" }, 403);
+    }
+    await next();
+  });
+  app.get("/profile", async (c) => c.json(await client.getProfile(await sso.getAccessToken(c))));
+  app.post("/profile", async (c) => {
+    const token = await sso.getAccessToken(c);
+    const body = await c.req.json().catch(() => null);
+    if (typeof body?.name !== "string") {
+      return c.json({ error: "invalid_request", error_description: '"name" must be a string' }, 400);
+    }
+    return c.json(await client.updateProfile(token, body.name));
+  });
+  app.post("/profile/avatar", async (c) => {
+    const token = await sso.getAccessToken(c);
+    const type = mediaType(c.req.header("content-type"));
+    if (!AVATAR_TYPES.includes(type)) {
+      return c.json({ error: "unsupported_type", accepted: AVATAR_TYPES }, 415);
+    }
+    const declared = Number(c.req.header("content-length"));
+    if (Number.isFinite(declared) && declared > MAX_AVATAR_BYTES) {
+      return c.json({ error: "too_large", max_bytes: MAX_AVATAR_BYTES }, 413);
+    }
+    const bytes = await readCapped(c, MAX_AVATAR_BYTES);
+    if (!bytes) return c.json({ error: "too_large", max_bytes: MAX_AVATAR_BYTES }, 413);
+    return c.json(await client.uploadAvatar(token, bytes, type));
+  });
+  app.post("/profile/avatar/remove", async (c) => c.json(await client.removeAvatar(await sso.getAccessToken(c))));
+  app.onError((err, c) => {
+    c.header("Cache-Control", "no-store");
+    const e = err;
+    switch (errName(err)) {
+      case "SsoReauthError":
+        return c.json({ error: e.reason === "no_session" ? "unauthenticated" : "reauth" }, 401);
+      case "SsoInsufficientScopeError":
+        return c.json({ error: "insufficient_scope", scope: e.scope }, 403);
+      case "SsoAvatarRejectedError":
+        return e.reason === "too_large" ? c.json({ error: "too_large", max_bytes: MAX_AVATAR_BYTES }, 413) : c.json({ error: "unsupported_type", accepted: AVATAR_TYPES }, 415);
+      case "SsoAppApiError": {
+        if (e.status === 401) return c.json({ error: "reauth" }, 401);
+        if (typeof e.status === "number" && e.status >= 400 && e.status < 500) {
+          return c.json({ error: e.code ?? "bid_refused" }, e.status);
+        }
+        return c.json({ error: "bid_unavailable" }, 502);
+      }
+      // A plain SsoError here is a setup mistake (e.g. ssoRoutes without tokenStore).
+      case "SsoError":
+        return c.json({ error: "sso_misconfigured" }, 500);
+      default:
+        return c.json({ error: "server_error" }, 500);
+    }
+  });
+  return app;
+}
 
-export { getSession, ssoRoutes };
+export { accountRoutes, getSession, ssoRoutes };
 //# sourceMappingURL=hono.js.map
 //# sourceMappingURL=hono.js.map