@camstack/addon-auth 1.2.130 → 1.2.132

package/dist/oidc/auth-oidc.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_hub_browser_origin = require("../hub-browser-origin-C-u2l9VC.js");
+const require_dist = require("../dist-DjCeMP9o.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -705,6 +705,82 @@ function createRemoteJWKSet(url, options) {
 	});
 }
 //#endregion
+//#region src/oidc/request-origin.ts
+/** host[:port] — a DNS name, IPv4 or bracketed IPv6. No userinfo, path or spaces. */
+var AUTHORITY_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i;
+/** Same grammar as the hub's `parseForwardedPrefix` (spa-mount.ts). */
+var PREFIX_RE = /^\/[A-Za-z0-9_\-.]+(?:\/[A-Za-z0-9_\-.]+)*$/;
+var MAX_PREFIX_LENGTH = 512;
+/** First value of a possibly comma-joined forwarded header (the client-most proxy). */
+function firstValue(value) {
+	if (value === void 0) return null;
+	const first = value.split(",")[0]?.trim() ?? "";
+	return first.length === 0 ? null : first;
+}
+/** `scheme://host[:port]` normalised by WHATWG URL, or `null` if it is not an http(s) origin. */
+function normalizeOrigin(value) {
+	try {
+		const url = new URL(value);
+		if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+		if (url.username !== "" || url.password !== "") return null;
+		return url.origin;
+	} catch {
+		return null;
+	}
+}
+/** The mount prefix the relay named (no trailing slash), or `''`. Invalid = absent. */
+function requestMountPrefix(headers) {
+	const raw = headers["x-forwarded-prefix"];
+	if (raw === void 0 || raw.length === 0 || raw.length > MAX_PREFIX_LENGTH) return "";
+	const trimmed = raw.endsWith("/") ? raw.slice(0, -1) : raw;
+	if (trimmed === "" || !PREFIX_RE.test(trimmed)) return "";
+	if (trimmed.split("/").some((segment) => segment === ".." || segment === ".")) return "";
+	return trimmed;
+}
+/**
+* The origins the request CLAIMS, most specific first: the proxy's
+* `X-Forwarded-Host` over `Host`; the named `X-Forwarded-Proto`, or https
+* then http when none is named (the hub terminates TLS itself on 4443).
+*/
+function claimedRequestOrigins(headers) {
+	const authority = firstValue(headers["x-forwarded-host"]) ?? firstValue(headers["host"]);
+	if (authority === null || !AUTHORITY_RE.test(authority)) return [];
+	const proto = firstValue(headers["x-forwarded-proto"])?.toLowerCase() ?? null;
+	const schemes = proto === "https" || proto === "http" ? [proto] : proto === null ? ["https", "http"] : [];
+	const out = [];
+	for (const scheme of schemes) {
+		const origin = normalizeOrigin(`${scheme}://${authority}`);
+		if (origin !== null) out.push(origin);
+	}
+	return out;
+}
+/** Every origin the hub advertises itself at, normalised. Never the app link, never loopback. */
+function advertisedHubOrigins(book) {
+	const candidates = [];
+	for (const row of book.rows) {
+		if (row.kind === "app-link" || row.kind === "loopback") continue;
+		candidates.push(row.baseUrl);
+	}
+	const { publicEndpoint, internal, appConnections } = book.roles;
+	if (publicEndpoint.resolved !== null) candidates.push(publicEndpoint.resolved);
+	if (internal.resolved !== null) candidates.push(internal.resolved);
+	candidates.push(...appConnections.resolved);
+	const out = /* @__PURE__ */ new Set();
+	for (const candidate of candidates) {
+		const origin = normalizeOrigin(candidate);
+		if (origin !== null) out.add(origin);
+	}
+	return out;
+}
+/**
+* The origin to send the browser back to: the first claimed origin that is in
+* `allowed`, or `null` (the caller then uses its default address).
+*/
+function pickRequestOrigin(headers, allowed) {
+	for (const origin of claimedRequestOrigins(headers)) if (allowed.has(origin)) return origin;
+	return null;
+}
+//#endregion
 //#region src/oidc/auth-oidc.addon.ts
 /**
 * Generic OpenID Connect (OIDC) authentication provider.
@@ -733,9 +809,14 @@ function createRemoteJWKSet(url, options) {
 * — the hub verifies it with the same `jwtSecret` and only then mints
 * the user session JWT.
 *
+* Identity mapping is EXPLICIT LINKING only (D782): the bridge names the
+* identity `oidc:<instance>:<sub>`; the hub signs in the user that identity
+* was linked to, and refuses an unlinked one. A flow started by a signed-in
+* user's "Link" button carries the hub's opaque `?link=` handle through the
+* pending state into the bridge (`linkIntent`); the hub resolves it.
+*
 * TODO (next session):
 *   - RP-initiated logout (`end_session_endpoint` 302 with id_token_hint).
-*   - Groups → scope mapping via id_token `groups` claim.
 *   - Refresh token rotation (offline_access).
 *   - Persist state + nonce + PKCE across restart (multi-replica).
 */
@@ -748,12 +829,38 @@ var DEFAULT_PROVIDER = {
 	clientSecret: "",
 	redirectUri: "",
 	scopes: "openid profile email",
-	usernameClaim: "preferred_username",
-	defaultRole: "viewer"
+	usernameClaim: "preferred_username"
 };
 var DEFAULT_CONFIG = { providers: [] };
 var STATE_TTL_MS = 5 * 6e4;
-var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
+/**
+* Shape of a hub link-intent handle (`?link=` on /start). Opaque to this
+* addon — the hub resolves it, single-use, at the SSO finish. Validated only
+* so a junk value is refused here rather than carried into a signed bridge.
+*/
+var LINK_INTENT_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
+/**
+* An instance id appears in URLs and in the identity `oidc:<id>:<sub>`; a `:`
+* would make two identities read the same, so ids are slugs. A configured row
+* whose id is not one is skipped.
+*/
+var INSTANCE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+/** Bound on in-flight logins: `/start` is public, so a flood must not grow the map. */
+var MAX_PENDING_STATES = 1e3;
+/**
+* Origin + mount prefix of a pinned `redirect_uri`: the part before the
+* callback path when it ends with it, else just its origin.
+*/
+function returnBaseOf(redirectUri, callbackPath) {
+	try {
+		const url = new URL(redirectUri);
+		const prefix = url.pathname.endsWith(callbackPath) ? url.pathname.slice(0, -callbackPath.length) : "";
+		return `${url.origin}${prefix.replace(/\/+$/, "")}`;
+	} catch {
+		return "";
+	}
+}
+var AuthOidcAddon = class extends require_dist.BaseAddon {
 	/** Per-provider runtime state, keyed by `provider.id`. */
 	instances = /* @__PURE__ */ new Map();
 	/** Pending OAuth states across ALL providers. The pending entry
@@ -779,7 +886,7 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 				return this.handleCallback(code, state);
 			}
 		};
-		const routeProvider = require_hub_browser_origin.buildAddonRouteProvider("auth-oidc", [{
+		const routeProvider = require_dist.buildAddonRouteProvider("auth-oidc", [{
 			method: "GET",
 			path: "/:providerId/start",
 			access: "public",
@@ -796,15 +903,15 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 		this.ctx.logger.info("OIDC auth provider initialized", { meta: { providers: [...this.instances.keys()] } });
 		return [
 			{
-				capability: require_hub_browser_origin.authProviderCapability,
+				capability: require_dist.authProviderCapability,
 				provider: authProvider
 			},
 			{
-				capability: require_hub_browser_origin.addonRoutesCapability,
+				capability: require_dist.addonRoutesCapability,
 				provider: routeProvider
 			},
 			{
-				capability: require_hub_browser_origin.loginMethodCapability,
+				capability: require_dist.loginMethodCapability,
 				provider: loginMethodProvider
 			}
 		];
@@ -822,9 +929,10 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 				kind: "redirect",
 				id: `auth-oidc/${id}`,
 				label: inst.config.displayName || DEFAULT_PROVIDER.displayName,
-				icon: inst.config.icon || DEFAULT_PROVIDER.icon,
+				icon: require_dist.isDisplayIconKey(inst.config.icon) ? inst.config.icon : DEFAULT_PROVIDER.icon,
 				startUrl: `/addon/auth-oidc/${id}/start`,
-				stage: "primary"
+				stage: "primary",
+				linkable: true
 			});
 		}
 		return out;
@@ -857,11 +965,11 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 						default: "OpenID Connect"
 					},
 					{
-						type: "text",
+						type: "icon",
 						key: "icon",
 						label: "Icon",
-						description: "lucide-react icon name (default: shield-check).",
-						default: "shield-check"
+						description: "Shown on the login button.",
+						default: DEFAULT_PROVIDER.icon
 					},
 					{
 						type: "text",
@@ -877,7 +985,7 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 						default: ""
 					},
 					{
-						type: "text",
+						type: "password",
 						key: "clientSecret",
 						label: "Client Secret",
 						default: ""
@@ -886,7 +994,7 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 						type: "text",
 						key: "redirectUri",
 						label: "Redirect URI override",
-						description: "Optional. Default uses the hub address from Network (public tunnel, then mesh, then LAN) + the instance id.",
+						description: "Optional — leave empty. Empty: a sign-in returns to the hub address it was started from (LAN, mesh or public, as listed on the Network page), so register one callback per address you sign in from at the IdP. Set: it PINS that one callback — every sign-in returns to its address, wherever it started.",
 						default: ""
 					},
 					{
@@ -915,20 +1023,6 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 								label: "sub (user id)"
 							}
 						]
-					},
-					{
-						type: "select",
-						key: "defaultRole",
-						label: "Default role",
-						description: "Role assigned to first-time SSO users.",
-						default: "viewer",
-						options: [{
-							value: "viewer",
-							label: "Viewer"
-						}, {
-							value: "admin",
-							label: "Admin"
-						}]
 					}
 				]
 			})]
@@ -942,7 +1036,10 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 				...DEFAULT_PROVIDER,
 				...raw
 			};
-			if (!merged.id || !merged.id.trim()) continue;
+			if (!merged.id || !INSTANCE_ID_PATTERN.test(merged.id)) {
+				if (merged.id) this.ctx.logger.warn("OIDC: provider instance skipped — id must be a lowercase slug", { meta: { id: merged.id } });
+				continue;
+			}
 			this.instances.set(merged.id, {
 				config: merged,
 				discovery: null,
@@ -975,28 +1072,75 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 		}
 		return doc;
 	}
-	async buildRedirectUri(providerId) {
+	/** The hub's Network-page address book, or `null` when `local-network` is unreachable. */
+	async addressBook() {
+		try {
+			return await this.ctx.api.localNetwork.getAddresses.query({ scheme: "https" });
+		} catch (err) {
+			this.ctx.logger.warn("OIDC: hub addresses unavailable from local-network", { meta: { error: require_dist.errMsg(err) } });
+			return null;
+		}
+	}
+	/**
+	* The `redirect_uri` of one sign-in, and the base the browser returns to
+	* after the callback (D791). Precedence:
+	*
+	*  1. The instance's "Redirect URI override", when set: it PINS one origin —
+	*     every sign-in returns there, wherever it started.
+	*  2. The origin the `/start` request was made at (Host / X-Forwarded-Host /
+	*     -Proto + mount prefix), ONLY when the hub advertises that origin
+	*     (`request-origin.ts`) — a forged Host never reaches the IdP.
+	*  3. The Network page's public endpoint (`roles.publicEndpoint`), else the
+	*     development default.
+	*/
+	async resolveRedirect(providerId, headers) {
 		const inst = this.instances.get(providerId);
 		if (!inst) throw new Error(`OIDC: no provider configured with id "${providerId}"`);
+		const callbackPath = `/addon/auth-oidc/${providerId}/callback`;
 		const configured = inst.config.redirectUri?.trim();
-		if (configured) return configured;
-		return `${await require_hub_browser_origin.hubBrowserOrigin(this.ctx.api.localNetwork, this.ctx.logger) ?? "https://localhost:4443"}/addon/auth-oidc/${providerId}/callback`;
+		if (configured) return {
+			redirectUri: configured,
+			returnBase: returnBaseOf(configured, callbackPath)
+		};
+		const book = await this.addressBook();
+		const fromRequest = headers !== null && book !== null ? pickRequestOrigin(headers, advertisedHubOrigins(book)) : null;
+		if (fromRequest !== null) {
+			const base = `${fromRequest}${requestMountPrefix(headers ?? {})}`;
+			return {
+				redirectUri: `${base}${callbackPath}`,
+				returnBase: base
+			};
+		}
+		const fallback = (book !== null ? normalizeOrigin(book.roles.publicEndpoint.resolved ?? "") : null) ?? "https://localhost:4443";
+		return {
+			redirectUri: `${fallback}${callbackPath}`,
+			returnBase: fallback
+		};
 	}
-	async buildLoginUrl(providerId, state) {
+	async buildLoginUrl(providerId, state, options = {}) {
+		const { linkIntent } = options;
 		const inst = this.instances.get(providerId);
 		if (!inst) throw new Error(`OIDC: no provider configured with id "${providerId}"`);
 		const doc = await this.getDiscovery(providerId);
 		const codeVerifier = node_crypto.randomBytes(32).toString("base64url");
 		const codeChallenge = node_crypto.createHash("sha256").update(codeVerifier).digest("base64url");
 		const nonce = node_crypto.randomBytes(16).toString("base64url");
-		const redirectUri = await this.buildRedirectUri(providerId);
+		const { redirectUri, returnBase } = await this.resolveRedirect(providerId, options.headers ?? null);
 		this.pruneExpiredStates();
+		while (this.pendingStates.size >= MAX_PENDING_STATES) {
+			const oldest = this.pendingStates.keys().next();
+			if (oldest.done) break;
+			this.pendingStates.delete(oldest.value);
+		}
 		this.pendingStates.set(state, {
 			codeVerifier,
 			nonce,
 			providerId,
 			redirectUri,
-			createdAt: Date.now()
+			returnBase,
+			popup: options.popup === true,
+			createdAt: Date.now(),
+			...linkIntent !== void 0 ? { linkIntent } : {}
 		});
 		const params = new URLSearchParams({
 			response_type: "code",
@@ -1051,7 +1195,7 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 				audience: inst.config.clientId
 			})).payload;
 		} catch (err) {
-			throw new Error(`OIDC id_token verification failed: ${require_hub_browser_origin.errMsg(err)}`, { cause: err });
+			throw new Error(`OIDC id_token verification failed: ${require_dist.errMsg(err)}`, { cause: err });
 		}
 		if (typeof payload["nonce"] !== "string" || payload["nonce"] !== pending.nonce) throw new Error("OIDC id_token nonce mismatch — possible replay attack");
 		const sub = typeof payload.sub === "string" ? payload.sub : null;
@@ -1066,7 +1210,12 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 			username: String(username),
 			...emailClaim ? { email: emailClaim } : {},
 			...nameClaim ? { displayName: nameClaim } : {},
-			isAdmin: inst.config.defaultRole === "admin"
+			isAdmin: false,
+			...pending.linkIntent !== void 0 ? { linkIntent: pending.linkIntent } : {},
+			issuer: doc.issuer,
+			providerId,
+			returnBase: pending.returnBase,
+			popup: pending.popup
 		};
 	}
 	validateLocalSessionToken(_token) {
@@ -1079,9 +1228,20 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 			reply.send({ error: `Unknown OIDC provider: ${providerId}` });
 			return;
 		}
+		const linkParam = req.query["link"];
+		if (linkParam !== void 0 && !LINK_INTENT_PATTERN.test(linkParam)) {
+			reply.code(400);
+			reply.send({ error: "Malformed link request" });
+			return;
+		}
+		const popupParam = req.query["popup"];
 		const state = node_crypto.randomBytes(16).toString("base64url");
 		try {
-			const url = await this.buildLoginUrl(providerId, state);
+			const url = await this.buildLoginUrl(providerId, state, {
+				...linkParam !== void 0 ? { linkIntent: linkParam } : {},
+				headers: req.headers,
+				popup: popupParam === "1"
+			});
 			reply.code(302);
 			reply.header("Location", url);
 			reply.send("");
@@ -1089,7 +1249,7 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 			reply.code(500);
 			reply.send({
 				error: "OIDC start failed",
-				message: require_hub_browser_origin.errMsg(err)
+				message: require_dist.errMsg(err)
 			});
 		}
 	}
@@ -1120,22 +1280,31 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 		}
 		try {
 			const result = await this.handleCallback(code, state);
+			if (result.providerId !== providerId) {
+				reply.code(400);
+				reply.send({ error: "OIDC callback does not match the provider the login started at" });
+				return;
+			}
 			const { token: bridgeToken } = await this.ctx.api.ssoBridge.signBridgeToken.query({ claims: {
 				userId: result.userId,
 				username: result.username,
 				isAdmin: result.isAdmin,
 				provider: `auth-oidc/${providerId}`,
 				...result.email ? { email: result.email } : {},
-				...result.displayName ? { displayName: result.displayName } : {}
+				...result.displayName ? { displayName: result.displayName } : {},
+				...result.linkIntent !== void 0 ? { linkIntent: result.linkIntent } : {},
+				issuer: result.issuer
 			} });
+			const finish = new URLSearchParams({ bridge: bridgeToken });
+			if (result.popup) finish.set("popup", "1");
 			reply.code(302);
-			reply.header("Location", `/api/auth/sso/finish?bridge=${encodeURIComponent(bridgeToken)}`);
+			reply.header("Location", `${result.returnBase}/api/auth/sso/finish?${finish.toString()}`);
 			reply.send("");
 		} catch (err) {
 			reply.code(500);
 			reply.send({
 				error: "OIDC callback failed",
-				message: require_hub_browser_origin.errMsg(err)
+				message: require_dist.errMsg(err)
 			});
 		}
 	}