@byline/host-tanstack-start 6.7.2 → 6.8.0

package/dist/integrations/session-middleware.js

@@ -6,89 +6,97 @@ import { renewAdminSession } from "../server-fns/auth/renew.js";
 import { coordinateAuthAction, flagSessionChanged, observeSession, renewSingleFlight, requireUnchanged, sessionSnapshot } from "./session-coordination.js";
 import { sessionRequestKind } from "./session-request-kind.js";
 const outcomeHeader = 'x-byline-auth-boundary';
-const adminSessionMiddleware = createMiddleware({
-    type: 'function'
-}).client(async ({ next })=>{
-    if ("u" < typeof window) return next({
-        sendContext: {
-            bylineExpectedSessionId: null
-        }
-    });
-    const snapshot = sessionSnapshot();
-    requireUnchanged(snapshot);
-    return next({
-        sendContext: {
-            bylineExpectedSessionId: snapshot.sessionId
-        },
-        fetch: async (input, init)=>{
-            const reusable = !(input instanceof Request) && !(init?.body instanceof ReadableStream);
-            let response = await fetch(input, init);
-            if ('changed' === response.headers.get(outcomeHeader)) {
-                flagSessionChanged();
-                throw ERR_SESSION_CHANGED({
-                    message: 'session changed'
-                });
+function createAdminSessionMiddleware(coordinateCookies) {
+    return createMiddleware({
+        type: 'function'
+    }).client(async ({ next })=>{
+        if ("u" < typeof window) return next({
+            sendContext: {
+                bylineExpectedSessionId: null
             }
-            if ('renew' === response.headers.get(outcomeHeader)) {
-                requireUnchanged(snapshot);
-                await renewSingleFlight(()=>coordinateAuthAction(async ()=>{
-                        const result = await renewAdminSession({
-                            data: {
-                                expectedSessionId: snapshot.sessionId ?? void 0
-                            }
-                        }).catch((error)=>{
-                            if (error?.code === 'ERR_SESSION_CHANGED') flagSessionChanged();
-                            throw error;
-                        });
-                        if (snapshot.sessionId && result.sessionId !== snapshot.sessionId) {
-                            flagSessionChanged();
-                            throw ERR_SESSION_CHANGED({
-                                message: 'session changed during renewal'
+        });
+        const snapshot = sessionSnapshot();
+        requireUnchanged(snapshot);
+        return next({
+            sendContext: {
+                bylineExpectedSessionId: snapshot.sessionId
+            },
+            fetch: async (input, init)=>{
+                const reusable = !(input instanceof Request) && !(init?.body instanceof ReadableStream);
+                const send = ()=>coordinateCookies ? coordinateAuthAction(async ()=>{
+                        requireUnchanged(snapshot);
+                        return fetch(input, init);
+                    }) : fetch(input, init);
+                let response = await send();
+                if ('changed' === response.headers.get(outcomeHeader)) {
+                    flagSessionChanged();
+                    throw ERR_SESSION_CHANGED({
+                        message: 'session changed'
+                    });
+                }
+                if ('renew' === response.headers.get(outcomeHeader)) {
+                    requireUnchanged(snapshot);
+                    await renewSingleFlight(()=>coordinateAuthAction(async ()=>{
+                            const result = await renewAdminSession({
+                                data: {
+                                    expectedSessionId: snapshot.sessionId ?? void 0
+                                }
+                            }).catch((error)=>{
+                                if (error?.code === 'ERR_SESSION_CHANGED') flagSessionChanged();
+                                throw error;
                             });
-                        }
-                        observeSession(result.sessionId);
-                    }));
+                            if (snapshot.sessionId && result.sessionId !== snapshot.sessionId) {
+                                flagSessionChanged();
+                                throw ERR_SESSION_CHANGED({
+                                    message: 'session changed during renewal'
+                                });
+                            }
+                            observeSession(result.sessionId);
+                        }));
+                    requireUnchanged(snapshot);
+                    if (!reusable) throw ERR_ACCESS_EXPIRED({
+                        message: 'Session renewed. Please retry the operation.'
+                    });
+                    response = await send();
+                    if ('changed' === response.headers.get(outcomeHeader)) flagSessionChanged();
+                }
                 requireUnchanged(snapshot);
-                if (!reusable) throw ERR_ACCESS_EXPIRED({
-                    message: 'Session renewed. Please retry the operation.'
-                });
-                response = await fetch(input, init);
-                if ('changed' === response.headers.get(outcomeHeader)) flagSessionChanged();
+                return response;
             }
-            requireUnchanged(snapshot);
-            return response;
+        });
+    }).server(async ({ next, context, method })=>{
+        const kind = sessionRequestKind(getRequest());
+        if (!kind) throw new Error('sessionRequestMiddleware is not configured');
+        let auth;
+        try {
+            auth = await getAdminRequestContext();
+        } catch (error) {
+            if (error instanceof AuthError && 'ERR_ACCESS_EXPIRED' === error.code) setResponseHeader(outcomeHeader, 'renew');
+            throw error;
         }
-    });
-}).server(async ({ next, context, method })=>{
-    const kind = sessionRequestKind(getRequest());
-    if (!kind) throw new Error('sessionRequestMiddleware is not configured');
-    let auth;
-    try {
-        auth = await getAdminRequestContext();
-    } catch (error) {
-        if (error instanceof AuthError && 'ERR_ACCESS_EXPIRED' === error.code) setResponseHeader(outcomeHeader, 'renew');
-        throw error;
-    }
-    const expected = context.bylineExpectedSessionId;
-    if (('serverFn' === kind || 'GET' !== method) && (!expected || expected !== auth.sessionId)) {
-        setResponseHeader(outcomeHeader, 'changed');
-        throw ERR_SESSION_CHANGED({
-            message: 'session changed before operation'
+        const expected = context.bylineExpectedSessionId;
+        if (('serverFn' === kind || 'GET' !== method) && (!expected || expected !== auth.sessionId)) {
+            setResponseHeader(outcomeHeader, 'changed');
+            throw ERR_SESSION_CHANGED({
+                message: 'session changed before operation'
+            });
+        }
+        if (!auth.sessionId) throw ERR_UNAUTHENTICATED({
+            message: 'provider omitted login identity'
         });
-    }
-    if (!auth.sessionId) throw ERR_UNAUTHENTICATED({
-        message: 'provider omitted login identity'
+        try {
+            const result = await next();
+            const response = result.result;
+            if (response instanceof Response) response.headers.delete(outcomeHeader);
+            return result;
+        } catch (error) {
+            if (error instanceof Response) error.headers.delete(outcomeHeader);
+            throw error;
+        } finally{
+            setResponseHeader(outcomeHeader, 'handled');
+        }
     });
-    try {
-        const result = await next();
-        const response = result.result;
-        if (response instanceof Response) response.headers.delete(outcomeHeader);
-        return result;
-    } catch (error) {
-        if (error instanceof Response) error.headers.delete(outcomeHeader);
-        throw error;
-    } finally{
-        setResponseHeader(outcomeHeader, 'handled');
-    }
-});
-export { adminSessionMiddleware };
+}
+const adminSessionMiddleware = createAdminSessionMiddleware(false);
+const adminSessionMutationMiddleware = createAdminSessionMiddleware(true);
+export { adminSessionMiddleware, adminSessionMutationMiddleware };

package/dist/integrations/sign-in-body.d.ts

@@ -7,6 +7,9 @@
  */
 /** Limit the serialized RPC envelope, not just its eventual credential fields. */
 export declare const SIGN_IN_MAX_BODY_BYTES: number;
+export declare const PASSKEY_MAX_BODY_BYTES: number;
 export declare function wasSignInBodyChecked(request: Request): boolean;
 /** Read a bounded clone before Start parses the original. Never await tee cancellation. */
 export declare function checkSignInBody(request: Request): Promise<Response | undefined>;
+export declare function wasPasskeyBodyChecked(request: Request, passwordProof?: boolean): boolean;
+export declare function checkPasskeyBody(request: Request, passwordProof?: boolean): Promise<Response | undefined>;

package/dist/integrations/sign-in-body.js

@@ -1,9 +1,25 @@
 const SIGN_IN_MAX_BODY_BYTES = 16384;
+const PASSKEY_MAX_BODY_BYTES = 65536;
 const checked = new WeakSet();
+const passkeyChecked = new WeakMap();
 function wasSignInBodyChecked(request) {
     return checked.has(request);
 }
 async function checkSignInBody(request) {
+    const rejected = await checkBody(request, SIGN_IN_MAX_BODY_BYTES);
+    if (!rejected) checked.add(request);
+    return rejected;
+}
+function wasPasskeyBodyChecked(request, passwordProof = false) {
+    return passkeyChecked.get(request) === (passwordProof ? SIGN_IN_MAX_BODY_BYTES : PASSKEY_MAX_BODY_BYTES);
+}
+async function checkPasskeyBody(request, passwordProof = false) {
+    const limit = passwordProof ? SIGN_IN_MAX_BODY_BYTES : PASSKEY_MAX_BODY_BYTES;
+    const rejected = await checkBody(request, limit);
+    if (!rejected) passkeyChecked.set(request, limit);
+    return rejected;
+}
+async function checkBody(request, limit) {
     if ('POST' !== request.method) return new Response('Method not allowed', {
         status: 405,
         headers: {
@@ -14,7 +30,7 @@ async function checkSignInBody(request) {
         status: 415
     });
     const declared = request.headers.get('content-length');
-    if (null !== declared && (!/^\d+$/.test(declared) || Number(declared) > SIGN_IN_MAX_BODY_BYTES)) return new Response('Payload too large', {
+    if (null !== declared && (!/^\d+$/.test(declared) || Number(declared) > limit)) return new Response('Payload too large', {
         status: 413
     });
     const reader = request.clone().body?.getReader();
@@ -34,11 +50,10 @@ async function checkSignInBody(request) {
             ]);
             if (done) break;
             size += value.byteLength;
-            if (size > SIGN_IN_MAX_BODY_BYTES) return new Response('Payload too large', {
+            if (size > limit) return new Response('Payload too large', {
                 status: 413
             });
         }
-        checked.add(request);
         return;
     } catch  {
         return new Response('Incomplete request body', {
@@ -49,4 +64,4 @@ async function checkSignInBody(request) {
         reader.cancel().catch(()=>{});
     }
 }
-export { SIGN_IN_MAX_BODY_BYTES, checkSignInBody, wasSignInBodyChecked };
+export { PASSKEY_MAX_BODY_BYTES, SIGN_IN_MAX_BODY_BYTES, checkPasskeyBody, checkSignInBody, wasPasskeyBodyChecked, wasSignInBodyChecked };

package/dist/integrations/sign-in-middleware.js

@@ -1,10 +1,35 @@
 import { createMiddleware } from "@tanstack/react-start";
+import { setResponseHeader } from "@tanstack/react-start/server";
+import { passkeyEnrollment, passkeyEnrollmentOptions, passkeyList, passkeyManagementContext, passkeyPasswordProof, passkeyProof, passkeyProofOptions, passkeyRemove, passkeyRename, passkeySignIn, passkeySignInOptions } from "../server-fns/auth/passkeys.js";
 import { adminSignIn } from "../server-fns/auth/sign-in.js";
-import { checkSignInBody } from "./sign-in-body.js";
+import { checkPasskeyBody, checkSignInBody } from "./sign-in-body.js";
 const passwordSignInMiddleware = createMiddleware().server(async (ctx)=>{
-    const endpoint = new URL(adminSignIn.url, ctx.request.url).pathname.replace(/\/$/, '');
-    if ('serverFn' !== ctx.handlerType || ctx.pathname !== endpoint && !ctx.pathname.startsWith(`${endpoint}/`)) return ctx.next();
-    const rejected = await checkSignInBody(ctx.request);
-    return rejected ?? ctx.next();
+    if ('serverFn' !== ctx.handlerType) return ctx.next();
+    const matches = (url)=>{
+        const endpoint = new URL(url, ctx.request.url).pathname.replace(/\/$/, '');
+        return ctx.pathname === endpoint || ctx.pathname.startsWith(`${endpoint}/`);
+    };
+    if (matches(adminSignIn.url)) return await checkSignInBody(ctx.request) ?? ctx.next();
+    const passkeys = [
+        passkeyManagementContext,
+        passkeySignInOptions,
+        passkeySignIn,
+        passkeyPasswordProof,
+        passkeyProofOptions,
+        passkeyProof,
+        passkeyEnrollmentOptions,
+        passkeyEnrollment,
+        passkeyList,
+        passkeyRename,
+        passkeyRemove
+    ];
+    if (!passkeys.some((fn)=>matches(fn.url))) return ctx.next();
+    setResponseHeader('Cache-Control', 'no-store');
+    const rejected = await checkPasskeyBody(ctx.request, matches(passkeyPasswordProof.url));
+    if (rejected) {
+        rejected.headers.set('Cache-Control', 'no-store');
+        return rejected;
+    }
+    return ctx.next();
 });
 export { passwordSignInMiddleware };

package/dist/server-fns/auth/passkey-admission.d.ts

@@ -0,0 +1,24 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+import type { PasskeyOperation, PasskeyProvider, PasskeyRequestProtection, PasswordSignInProtection } from '@byline/auth';
+/** Host boundary shared by the passkey POST handlers. Body and CSRF guards run first. */
+export declare function withPasskeyAdmission<T>(input: {
+    provider: PasskeyProvider;
+    purpose: PasskeyOperation;
+    request: Request;
+    bodyChecked: boolean;
+    protection: PasskeyRequestProtection | undefined;
+    /** Required only for password proof; lookup must authenticate the expected login. */
+    password?: {
+        protection: PasswordSignInProtection | undefined;
+        resolveActorEmail(): Promise<string>;
+    };
+    work(metadata: {
+        ip: string;
+    }): Promise<T>;
+}): Promise<T>;

package/dist/server-fns/auth/passkey-admission.js

@@ -0,0 +1,88 @@
+import { AuthError, AuthErrorCodes } from "@byline/auth";
+import { normalizeClientIp } from "../../integrations/client-ip.js";
+async function withPasskeyAdmission(input) {
+    const recordDenial = (reason)=>{
+        try {
+            Promise.resolve(input.provider.recordAdmissionDenied?.(input.purpose, reason)).catch(()=>{});
+        } catch  {}
+    };
+    const denied = (reason, status, retry)=>{
+        recordDenial(reason);
+        throw new Response(429 === status ? 'Too many authentication requests' : 'Authentication temporarily unavailable', {
+            status,
+            headers: {
+                'Cache-Control': 'no-store',
+                ...retry ? {
+                    'Retry-After': String(retry)
+                } : {}
+            }
+        });
+    };
+    const available = async (work)=>{
+        try {
+            return await work();
+        } catch  {
+            return denied('unavailable', 503);
+        }
+    };
+    const protection = input.protection;
+    if (!input.bodyChecked || !protection) return denied('unavailable', 503);
+    const ip = await available(async ()=>normalizeClientIp(await protection.resolveClientIp(input.request)));
+    if (!ip) return denied('unavailable', 503);
+    const release = await available(()=>protection.limiter.acquire());
+    if (!release) return denied('capacity', 429, 1);
+    try {
+        const admission = await available(()=>protection.limiter.consume({
+                ip
+            }));
+        if (!admission.allowed) return denied('network', 429, admission.retryAfterSeconds);
+        if ('password-proof' === input.purpose && !input.password) return denied('unavailable', 503);
+        if (!input.password) return await input.work({
+            ip
+        });
+        const password = input.password;
+        const passwordProtection = password.protection;
+        if (!passwordProtection) return denied('unavailable', 503);
+        let email;
+        try {
+            email = await password.resolveActorEmail();
+        } catch (error) {
+            recordDenial('unavailable');
+            throw error;
+        }
+        const passwordIp = await available(async ()=>normalizeClientIp(await passwordProtection.resolveClientIp(input.request)));
+        if (!passwordIp) return denied('unavailable', 503);
+        const releasePassword = await available(()=>passwordProtection.limiter.acquire());
+        if (!releasePassword) return denied('capacity', 429, 1);
+        try {
+            const passwordAdmission = await available(()=>passwordProtection.limiter.consume({
+                    email,
+                    ip: passwordIp
+                }));
+            if (!passwordAdmission.allowed) return denied('network', 429, passwordAdmission.retryAfterSeconds);
+            const record = (outcome)=>{
+                try {
+                    Promise.resolve(passwordProtection.limiter.recordResult?.({
+                        email,
+                        ip: passwordIp
+                    }, outcome)).catch(()=>{});
+                } catch  {}
+            };
+            try {
+                const result = await input.work({
+                    ip
+                });
+                record('success');
+                return result;
+            } catch (error) {
+                if (error instanceof AuthError && error.code === AuthErrorCodes.INVALID_CREDENTIALS) record('failure');
+                throw error;
+            }
+        } finally{
+            releasePassword();
+        }
+    } finally{
+        release();
+    }
+}
+export { withPasskeyAdmission };

package/dist/server-fns/auth/passkeys.d.ts

@@ -0,0 +1,96 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/** Cosmetic capability discovery creates no ceremony and reads no account data. */
+export declare const getPasskeyCapability: import("@tanstack/react-start").OptionalFetcher<undefined, undefined, Promise<{
+    enabled: boolean;
+}>>;
+export declare const passkeySignInOptions: import("@tanstack/react-start").OptionalFetcher<undefined, (input: unknown) => Record<string, never>, Promise<import("@byline/auth").PasskeyCeremony<import("@byline/auth").PasskeyAuthenticationOptions>>>;
+export declare const passkeySignIn: import("@tanstack/react-start").OptionalFetcher<undefined, (input: unknown) => {
+    ceremonyId: string;
+    response: unknown;
+}, Promise<{
+    userId: string;
+    sessionId: string;
+}>>;
+export declare const passkeyPasswordProof: import("@tanstack/react-start").OptionalFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: unknown) => {
+    expectedSessionId: string;
+    password: string;
+    action: {
+        purpose: "enroll";
+    } | {
+        purpose: "remove";
+        targetUserId: string;
+        credentialRecordId: string;
+    };
+}, Promise<import("@byline/auth").PasskeyManagementGrant>>;
+export declare const passkeyProofOptions: import("@tanstack/react-start").OptionalFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: unknown) => {
+    expectedSessionId: string;
+    action: {
+        purpose: "enroll";
+    } | {
+        purpose: "remove";
+        targetUserId: string;
+        credentialRecordId: string;
+    };
+}, Promise<import("@byline/auth").PasskeyCeremony<import("@byline/auth").PasskeyAuthenticationOptions>>>;
+export declare const passkeyProof: import("@tanstack/react-start").OptionalFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: unknown) => {
+    expectedSessionId: string;
+    ceremonyId: string;
+    response: unknown;
+}, Promise<import("@byline/auth").PasskeyManagementGrant>>;
+export declare const passkeyEnrollmentOptions: import("@tanstack/react-start").OptionalFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: unknown) => {
+    expectedSessionId: string;
+    grantId: string;
+}, Promise<import("@byline/auth").PasskeyCeremony<import("@byline/auth").PasskeyRegistrationOptions>>>;
+export declare const passkeyEnrollment: import("@tanstack/react-start").OptionalFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: unknown) => {
+    expectedSessionId: string;
+    ceremonyId: string;
+    response: unknown;
+    name: string;
+}, Promise<import("@byline/auth").PasskeyCredentialSummary>>;
+export declare const passkeyList: import("@tanstack/react-start").OptionalFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: unknown) => {
+    expectedSessionId: string;
+    targetUserId?: string | undefined;
+}, Promise<import("@byline/auth").PasskeyCredentialSummary[]>>;
+export declare const passkeyRename: import("@tanstack/react-start").OptionalFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: unknown) => {
+    expectedSessionId: string;
+    credentialRecordId: string;
+    name: string;
+}, Promise<import("@byline/auth").PasskeyCredentialSummary>>;
+export declare const passkeyRemove: import("@tanstack/react-start").OptionalFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: unknown) => {
+    expectedSessionId: string;
+    grantId: string;
+}, Promise<{
+    signedOut: boolean;
+}>>;
+/** Cosmetic permissions for the manager; every mutation still rechecks authority. */
+export declare const passkeyManagementContext: import("@tanstack/react-start").OptionalFetcher<readonly [import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, {
+    bylineExpectedSessionId: string | null;
+}, undefined, undefined>], (input: unknown) => {
+    expectedSessionId: string;
+}, Promise<{
+    id: string;
+    isSuperAdmin: boolean;
+    canManagePasskeys: boolean;
+}>>;