@c9up/transit 0.1.5 → 0.1.7

package/src/replay.ts

@@ -12,10 +12,13 @@
  */
 
 import { quasarConnection } from "./quasar.js";
+import { hasCommands } from "./vendor/quasarConnection.js";
 
 export interface AssertionReplayStore {
 	/**
-	 * Remember `assertionId` until `expiresAt` (epoch seconds).
+	 * Remember `assertionId` until `expiresAt` (epoch seconds) — the
+	 * `rememberUntil` of a validated assertion, which already counts the clock
+	 * skew it was accepted with.
 	 *
 	 * Answers `true` when this is the first time, `false` when the assertion
 	 * has already been used. Implementations must decide that atomically:
@@ -54,6 +57,10 @@ export interface ReplayRedisClient {
 	set(key: string, value: string, ...args: unknown[]): Promise<unknown>;
 }
 
+function isReplayRedisClient(value: unknown): value is ReplayRedisClient {
+	return hasCommands(value, ["set"]);
+}
+
 export type ReplayRedisResolver =
 	| ReplayRedisClient
 	| (() => ReplayRedisClient | Promise<ReplayRedisClient>);
@@ -82,8 +89,9 @@ export class RedisAssertionReplayStore implements AssertionReplayStore {
 
 	async remember(assertionId: string, expiresAt: number): Promise<boolean> {
 		const client = await this.#client();
-		// The key outlives the assertion by a minute, so an assertion accepted
-		// at the edge of its window cannot be replayed just after it.
+		// `expiresAt` already covers the clock skew the validation allowed. The
+		// extra minute absorbs clock differences between the replica that
+		// stores the key and the one a replay lands on.
 		const ttl = Math.max(
 			1,
 			Math.ceil(expiresAt - Math.floor(Date.now() / 1000)) + 60,
@@ -121,15 +129,17 @@ export const replayStores = {
 		connection: ReplayRedisResolver | string;
 		prefix?: string;
 	}): () => AssertionReplayStore {
+		const { connection } = options;
 		const client: ReplayRedisResolver =
-			typeof options.connection === "string"
+			typeof connection === "string"
 				? () =>
-						quasarConnection<ReplayRedisClient>(
-							options.connection as string,
+						quasarConnection(
+							connection,
 							["set"],
 							"the assertion replay store",
+							isReplayRedisClient,
 						)
-				: options.connection;
+				: connection;
 		return () =>
 			new RedisAssertionReplayStore(client, { prefix: options.prefix });
 	},

package/src/saml.ts

@@ -35,8 +35,16 @@ export interface SamlIdentity {
 	attributes: Record<string, string[]>;
 	/** The assertion's own id, for the replay check. */
 	assertionId: string;
-	/** When the assertion stops being usable, epoch seconds. */
+	/** The `NotOnOrAfter` of the assertion's conditions, epoch seconds. */
 	notOnOrAfter: number;
+	/**
+	 * Until when a replay record has to last, epoch seconds: the later of the
+	 * two expiries the assertion carries (its conditions and its bearer
+	 * confirmation) plus the clock skew this validation allowed. Before that
+	 * instant the same assertion can still pass `validateAssertion`, so a
+	 * record forgotten earlier lets a captured response sign in again.
+	 */
+	rememberUntil: number;
 	/** The provider's session, when it named one. */
 	sessionIndex: string | undefined;
 }
@@ -232,6 +240,7 @@ export function validateAssertion(
 		attributes: readAttributes(assertion),
 		assertionId,
 		notOnOrAfter,
+		rememberUntil: Math.max(notOnOrAfter, confirmationExpiry) + skew,
 		sessionIndex: authn?.attributes.find((a) => a.local === "SessionIndex")
 			?.value,
 	};

package/src/stubs.ts

@@ -0,0 +1,16 @@
+/**
+ * Where this package's stubs live.
+ *
+ * Its own module, as upstream keeps it: a stub root is a path a package
+ * publishes, and a caller importing it should not have to import the
+ * configure hook to get it.
+ *
+ * `import.meta.dirname` rather than a URL — upstream reads it straight off
+ * `import.meta`, and deriving it from `import.meta.url` breaks wherever that
+ * is not a `file://` URL, which is what a test runner serving modules over
+ * HTTP hands you.
+ */
+
+import { join } from "node:path";
+
+export const stubsRoot = join(import.meta.dirname, "..", "stubs");

package/src/vendor/quasarConnection.ts

@@ -31,23 +31,62 @@ interface ConnectionSource {
  * `"connection" in manager` is FALSE while reading it returns the function —
  * gating on `in` rejected the real manager. And a module namespace under a
  * test double RAISES for an export it does not have, rather than answering
- * undefined, so a bare read fails on the mock. Reading through a catch is what
- * satisfies both.
+ * undefined, so a bare read fails on the mock.
+ *
+ * So the read is caught, but what it raised is kept: on quasar's accessor a
+ * throw is not an absence, it is the accessor saying its provider has not
+ * booted, and dropping that turned it into a wrong diagnosis.
  */
-function readMember(value: unknown, name: string): unknown {
-	if (typeof value !== "object" || value === null) return undefined;
+type MemberRead = { value: unknown } | { threw: unknown };
+
+function readMember(value: unknown, name: string): MemberRead {
+	if (typeof value !== "object" || value === null) return { value: undefined };
 	try {
-		return Reflect.get(value, name);
-	} catch {
-		return undefined;
+		return { value: Reflect.get(value, name) };
+	} catch (threw) {
+		return { threw };
 	}
 }
 
+function memberValue(read: MemberRead): unknown {
+	return "value" in read ? read.value : undefined;
+}
+
 function isConnectionSource(value: unknown): value is ConnectionSource {
-	return typeof readMember(value, "connection") === "function";
+	return typeof memberValue(readMember(value, "connection")) === "function";
+}
+
+/**
+ * The commands among `commands` that `value` does not carry as functions.
+ *
+ * Reads go through the same catch as above, so a command whose read throws
+ * counts as missing.
+ */
+export function missingCommands(
+	value: unknown,
+	commands: readonly string[],
+): string[] {
+	return commands.filter(
+		(command) => typeof memberValue(readMember(value, command)) !== "function",
+	);
 }
 
-export interface QuasarConnectionRequest {
+/**
+ * Whether `value` carries every one of `commands` as a function.
+ *
+ * The building block of the guard a caller passes as `isConnection`, over the
+ * same list it passes as `required` — which is what names the gap when the
+ * guard says no.
+ */
+export function hasCommands(
+	value: unknown,
+	commands: readonly string[],
+): value is object {
+	if (typeof value !== "object" || value === null) return false;
+	return missingCommands(value, commands).length === 0;
+}
+
+export interface QuasarConnectionRequest<T> {
 	/** The package asking. It prefixes every message this can raise. */
 	pkg: string;
 	/**
@@ -65,8 +104,16 @@ export interface QuasarConnectionRequest {
 	) => Error;
 	/** Connection name, or `undefined` for quasar's default. */
 	name?: string;
-	/** The commands the caller will actually issue. */
+	/** The commands the caller will actually issue, named in the message. */
 	required: readonly string[];
+	/**
+	 * The caller's check that the connection is the client it needs.
+	 *
+	 * Written by the caller over the commands it issues (`hasCommands` with
+	 * `required` does it), because only the caller knows its client type. The
+	 * connection is handed over only once this has said yes.
+	 */
+	isConnection: (value: unknown) => value is T;
 	/** What the caller does with them, for the message that names a gap. */
 	what: string;
 	/**
@@ -86,9 +133,10 @@ export interface QuasarConnectionRequest {
  * command, far from the line that asked for it.
  */
 export async function quasarConnection<T>(
-	request: QuasarConnectionRequest,
+	request: QuasarConnectionRequest<T>,
 ): Promise<T> {
-	const { pkg, name, required, what, raise, alternative } = request;
+	const { pkg, name, required, what, raise, alternative, isConnection } =
+		request;
 	const specifier = "@c9up/quasar/services/main";
 	let loaded: unknown;
 	try {
@@ -102,9 +150,22 @@ export async function quasarConnection<T>(
 		);
 	}
 
-	const manager = isConnectionSource(loaded)
-		? loaded
-		: Reflect.get(Object(loaded), "default");
+	// The namespace itself may be the manager (a test double); a throw there is
+	// the mock refusing an export it lacks, not an answer.
+	const direct = memberValue(readMember(loaded, "connection"));
+	const manager =
+		typeof direct === "function"
+			? loaded
+			: memberValue(readMember(Object(loaded), "default"));
+	const read = readMember(manager, "connection");
+	if ("threw" in read) {
+		throw raise(
+			"quasar-missing",
+			`[${pkg}] ${what} asks for the quasar connection "${name ?? "default"}", but @c9up/quasar's manager is not available yet: ` +
+				"its provider has not booted, or is not registered in this application's providers.",
+			read.threw,
+		);
+	}
 	if (!isConnectionSource(manager)) {
 		throw raise(
 			"quasar-missing",
@@ -113,17 +174,18 @@ export async function quasarConnection<T>(
 	}
 
 	const connection = manager.connection(name);
-	const missing = required.filter(
-		(command) => typeof readMember(connection, command) !== "function",
-	);
+	const missing = missingCommands(connection, required);
 	if (missing.length > 0) {
 		throw raise(
 			"incomplete-connection",
 			`[${pkg}] the quasar connection${name ? ` '${name}'` : ""} is missing ${missing.join(", ")}, which ${what} issues`,
 		);
 	}
-	// Load-bearing: every member of `required` has just been checked to be a
-	// function on this object. The caller names the type it needs because only
-	// the caller knows which commands it asked for.
-	return connection as T;
+	if (!isConnection(connection)) {
+		throw raise(
+			"incomplete-connection",
+			`[${pkg}] the quasar connection${name ? ` '${name}'` : ""} is not the client ${what} needs`,
+		);
+	}
+	return connection;
 }

package/stubs/config/transit.stub

@@ -0,0 +1,17 @@
+---
+to: config/transit.ts
+---
+import { defineConfig, socials } from '@c9up/transit'
+import env from '#start/env'
+
+export default defineConfig({
+  // The key is yours: it is what `transit.begin(name)` asks for.
+  google: socials.google({
+    clientId: env.get('GOOGLE_CLIENT_ID', ''),
+    clientSecret: env.get('GOOGLE_CLIENT_SECRET', ''),
+    callbackUrl: 'http://localhost:3333/auth/google/callback',
+  }),
+
+  // An OpenID Connect provider needs only its issuer:
+  // work: oidc({ issuer: env.get('OIDC_ISSUER'), clientId, clientSecret, callbackUrl }),
+})