@camstack/addon-auth 1.2.143 → 1.2.145

package/dist/oidc/auth-oidc.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-DscyrBBw.js");
+const require_dist = require("../dist-Be0i-dLp.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_dist.__toESM(node_crypto);
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -886,83 +886,6 @@ function clientSecretPatchOf(value) {
 	return { clientSecret: value };
 }
 //#endregion
-//#region src/oidc/request-origin.ts
-/** host[:port] — a DNS name, IPv4 or bracketed IPv6. No userinfo, path or spaces. */
-var AUTHORITY_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i;
-/** Same grammar as the hub's `parseForwardedPrefix` (spa-mount.ts). */
-var PREFIX_RE = /^\/[A-Za-z0-9_\-.]+(?:\/[A-Za-z0-9_\-.]+)*$/;
-var MAX_PREFIX_LENGTH = 512;
-/** First value of a possibly comma-joined forwarded header (the client-most proxy). */
-function firstValue(value) {
-	if (value === void 0) return null;
-	const first = value.split(",")[0]?.trim() ?? "";
-	return first.length === 0 ? null : first;
-}
-/** `scheme://host[:port]` normalised by WHATWG URL, or `null` if it is not an http(s) origin. */
-function normalizeOrigin(value) {
-	try {
-		const url = new URL(value);
-		if (url.protocol !== "https:" && url.protocol !== "http:") return null;
-		if (url.username !== "" || url.password !== "") return null;
-		return url.origin;
-	} catch {
-		return null;
-	}
-}
-/** The mount prefix the relay named (no trailing slash), or `''`. Invalid = absent. */
-function requestMountPrefix(headers) {
-	const raw = headers["x-forwarded-prefix"];
-	if (raw === void 0 || raw.length === 0 || raw.length > MAX_PREFIX_LENGTH) return "";
-	const trimmed = raw.endsWith("/") ? raw.slice(0, -1) : raw;
-	if (trimmed === "" || !PREFIX_RE.test(trimmed)) return "";
-	if (trimmed.split("/").some((segment) => segment === ".." || segment === ".")) return "";
-	return trimmed;
-}
-/**
-* The origins the request CLAIMS, most specific first: the proxy's
-* `X-Forwarded-Host` over `Host`; the named `X-Forwarded-Proto`, or https
-* then http when none is named (the hub terminates TLS itself on 4443).
-*/
-function claimedRequestOrigins(headers) {
-	const authority = firstValue(headers["x-forwarded-host"]) ?? firstValue(headers["host"]);
-	if (authority === null || !AUTHORITY_RE.test(authority)) return [];
-	const proto = firstValue(headers["x-forwarded-proto"])?.toLowerCase() ?? null;
-	const schemes = proto === "https" || proto === "http" ? [proto] : proto === null ? ["https", "http"] : [];
-	const out = [];
-	for (const scheme of schemes) {
-		const origin = normalizeOrigin(`${scheme}://${authority}`);
-		if (origin !== null) out.push(origin);
-	}
-	return out;
-}
-/** Every origin the hub advertises itself at, normalised. Never the app link, never loopback. */
-function advertisedHubOrigins(book) {
-	const candidates = [];
-	for (const row of book.rows) {
-		if (row.kind === "app-link" || row.kind === "loopback") continue;
-		candidates.push(row.baseUrl);
-	}
-	const { publicEndpoint, internal, appConnections } = book.roles;
-	if (publicEndpoint.resolved !== null) candidates.push(publicEndpoint.resolved);
-	if (internal.resolved !== null) candidates.push(internal.resolved);
-	candidates.push(...appConnections.resolved);
-	candidates.push(...book.listenerOrigins ?? []);
-	const out = /* @__PURE__ */ new Set();
-	for (const candidate of candidates) {
-		const origin = normalizeOrigin(candidate);
-		if (origin !== null) out.add(origin);
-	}
-	return out;
-}
-/**
-* The origin to send the browser back to: the first claimed origin that is in
-* `allowed`, or `null` (the caller then uses its default address).
-*/
-function pickRequestOrigin(headers, allowed) {
-	for (const origin of claimedRequestOrigins(headers)) if (allowed.has(origin)) return origin;
-	return null;
-}
-//#endregion
 //#region src/oidc/auth-oidc.addon.ts
 /**
 * Generic OpenID Connect (OIDC) authentication provider.
@@ -1015,6 +938,28 @@ var STATE_TTL_MS = 5 * 6e4;
 var LINK_INTENT_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
 /** Bound on in-flight logins: `/start` is public, so a flood must not grow the map. */
 var MAX_PENDING_STATES = 1e3;
+/** In-flight logins one client may hold (D858): one browser flooding `/start` cannot fill the map for everyone. */
+var MAX_PENDING_PER_CLIENT = 20;
+/**
+* A step-up must follow a login that happened no earlier than this before the
+* flow began (D858). The authorize request asks for `prompt=login&max_age=0`;
+* this is the check that the IdP actually honoured it.
+*/
+var STEP_UP_MAX_AUTH_AGE_MS = 6e4;
+/** The pending map is full, or this client already holds its share. Live states are never evicted for it. */
+var PendingStatesFullError = class extends Error {};
+/** A step-up whose id_token proves no login just before the flow began. */
+var StepUpNotFreshError = class extends Error {};
+/**
+* Who a `/start` is counted against. The hub already limits each real client
+* address per minute before a route runs; the addon sees only headers, so this
+* is a best-effort key (a spoofed header only rotates the bucket, and the
+* hub's limit and the global cap still bound the total).
+*/
+function clientKeyOf(headers) {
+	const forwarded = headers?.["x-forwarded-for"]?.split(",")[0]?.trim();
+	return headers?.["cf-connecting-ip"] ?? headers?.["x-real-ip"] ?? forwarded ?? "unknown";
+}
 /**
 * Origin + mount prefix of a pinned `redirect_uri`: the part before the
 * callback path when it ends with it, else just its origin.
@@ -1185,7 +1130,11 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 				icon: require_dist.resolveIconKey(inst.config.icon, DEFAULT_PROVIDER.icon),
 				startUrl: `/addon/auth-oidc/${id}/start`,
 				stage: "primary",
-				linkable: true
+				linkable: true,
+				app: {
+					kind: "browser",
+					startPath: `/addon/auth-oidc/${id}/start`
+				}
 			});
 		}
 		return out;
@@ -1267,23 +1216,23 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 		const inst = this.instances.get(providerId);
 		if (!inst) throw new Error(`OIDC: no provider configured with id "${providerId}"`);
 		const callbackPath = `/addon/auth-oidc/${providerId}/callback`;
-		const claimed = headers !== null ? claimedRequestOrigins(headers) : [];
+		const claimed = headers !== null ? require_dist.claimedRequestOrigins(headers) : [];
 		const configured = inst.config.redirectUri?.trim();
 		if (configured) return this.returnsTo(providerId, "override", claimed, null, {
 			redirectUri: configured,
 			returnBase: returnBaseOf(configured, callbackPath)
 		});
 		const book = await this.addressBook();
-		const advertised = book !== null ? advertisedHubOrigins(book) : null;
-		const fromRequest = headers !== null && advertised !== null ? pickRequestOrigin(headers, advertised) : null;
+		const advertised = book !== null ? require_dist.advertisedHubOrigins(book) : null;
+		const fromRequest = headers !== null && advertised !== null ? require_dist.pickRequestOrigin(headers, advertised) : null;
 		if (fromRequest !== null) {
-			const base = `${fromRequest}${requestMountPrefix(headers ?? {})}`;
+			const base = `${fromRequest}${require_dist.requestMountPrefix(headers ?? {})}`;
 			return this.returnsTo(providerId, "request", claimed, advertised, {
 				redirectUri: `${base}${callbackPath}`,
 				returnBase: base
 			});
 		}
-		const publicEndpoint = book !== null ? normalizeOrigin(book.roles.publicEndpoint.resolved ?? "") : null;
+		const publicEndpoint = book !== null ? require_dist.normalizeOrigin(book.roles.publicEndpoint.resolved ?? "") : null;
 		const fallback = publicEndpoint ?? "https://localhost:4443";
 		return this.returnsTo(providerId, publicEndpoint !== null ? "public-endpoint" : "default", claimed, advertised, {
 			redirectUri: `${fallback}${callbackPath}`,
@@ -1321,12 +1270,10 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 		const nonce = node_crypto.randomBytes(16).toString("base64url");
 		const { redirectUri, returnBase } = await this.resolveRedirect(providerId, options.headers ?? null);
 		this.pruneExpiredStates();
-		while (this.pendingStates.size >= MAX_PENDING_STATES) {
-			const oldest = this.pendingStates.keys().next();
-			if (oldest.done) break;
-			this.pendingStates.delete(oldest.value);
-		}
+		const clientKey = clientKeyOf(options.headers);
+		if (this.pendingStates.size >= MAX_PENDING_STATES || [...this.pendingStates.values()].filter((p) => p.clientKey === clientKey).length >= MAX_PENDING_PER_CLIENT) throw new PendingStatesFullError("Too many sign-ins in progress - try again shortly");
 		this.pendingStates.set(state, {
+			clientKey,
 			codeVerifier,
 			nonce,
 			providerId,
@@ -1335,7 +1282,8 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			popup: options.popup === true,
 			createdAt: Date.now(),
 			...linkIntent !== void 0 ? { linkIntent } : {},
-			...options.browserBinding !== void 0 ? { browserBinding: options.browserBinding } : {}
+			...options.browserBinding !== void 0 ? { browserBinding: options.browserBinding } : {},
+			...options.app !== void 0 ? { app: options.app } : {}
 		});
 		const params = new URLSearchParams({
 			response_type: "code",
@@ -1347,17 +1295,27 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			code_challenge: codeChallenge,
 			code_challenge_method: "S256"
 		});
+		if (options.app?.purpose === "step-up") {
+			params.set("prompt", "login");
+			params.set("max_age", "0");
+		}
 		return {
 			url: `${doc.authorization_endpoint}?${params.toString()}`,
 			returnBase
 		};
 	}
+	/** The pending state for `state`, unless it is gone or older than its TTL. */
+	livePending(state) {
+		const pending = this.pendingStates.get(state);
+		if (pending === void 0) return void 0;
+		return Date.now() - pending.createdAt > STATE_TTL_MS ? void 0 : pending;
+	}
 	pruneExpiredStates() {
 		const now = Date.now();
 		for (const [k, v] of this.pendingStates.entries()) if (now - v.createdAt > STATE_TTL_MS) this.pendingStates.delete(k);
 	}
 	async handleCallback(code, state) {
-		const pending = this.pendingStates.get(state);
+		const pending = this.livePending(state);
 		if (!pending) throw new Error("Unknown or expired OIDC state — login session timed out, please retry");
 		this.pendingStates.delete(state);
 		const providerId = pending.providerId;
@@ -1398,6 +1356,10 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			throw new Error(`OIDC id_token verification failed: ${require_dist.errMsg(err)}`, { cause: err });
 		}
 		if (typeof payload["nonce"] !== "string" || payload["nonce"] !== pending.nonce) throw new Error("OIDC id_token nonce mismatch — possible replay attack");
+		if (pending.app?.purpose === "step-up") {
+			const authTime = payload["auth_time"];
+			if (typeof authTime !== "number" || !Number.isFinite(authTime) || authTime * 1e3 < pending.createdAt - STEP_UP_MAX_AUTH_AGE_MS) throw new StepUpNotFreshError("OIDC step-up id_token proves no fresh login");
+		}
 		const sub = typeof payload.sub === "string" ? payload.sub : null;
 		if (!sub) throw new Error("OIDC callback: id_token missing required `sub` claim");
 		const emailClaim = typeof payload["email"] === "string" ? payload["email"] : void 0;
@@ -1416,7 +1378,8 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			providerId,
 			returnBase: pending.returnBase,
 			popup: pending.popup,
-			...pending.browserBinding !== void 0 ? { browserBinding: pending.browserBinding } : {}
+			...pending.browserBinding !== void 0 ? { browserBinding: pending.browserBinding } : {},
+			...pending.app !== void 0 ? { app: pending.app } : {}
 		};
 	}
 	validateLocalSessionToken(_token) {
@@ -1435,21 +1398,52 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			reply.send({ error: "Malformed link request" });
 			return;
 		}
-		const popupParam = req.query["popup"];
-		const state = node_crypto.randomBytes(16).toString("base64url");
+		const query = req.query;
+		const popupParam = query["popup"];
+		let app;
+		if (query["app"] === "1") {
+			const parsed = require_dist.parseAppFlowRequest(query);
+			if (linkParam !== void 0 || popupParam === "1" || !parsed.ok) {
+				this.ctx.logger.warn("OIDC app sign-in refused at start", { meta: {
+					provider: providerId,
+					reason: parsed.ok ? "combined-flow" : parsed.reason
+				} });
+				reply.code(400);
+				reply.type("text/html; charset=utf-8");
+				reply.header("Cache-Control", "no-store");
+				reply.send(appRefusalPage(parsed.ok ? "An app sign-in cannot be combined with linking or a popup." : require_dist.APP_FLOW_REFUSAL_MESSAGES[parsed.reason]));
+				return;
+			}
+			app = parsed.request;
+		}
+		const state = `${app !== void 0 ? "a." : ""}${node_crypto.randomBytes(16).toString("base64url")}`;
 		const browserState = node_crypto.randomBytes(32).toString("base64url");
 		try {
 			const { url, returnBase } = await this.prepareLogin(providerId, state, {
 				...linkParam !== void 0 ? { linkIntent: linkParam } : {},
 				headers: req.headers,
 				popup: popupParam === "1",
-				browserBinding: node_crypto.createHash("sha256").update(browserState).digest("hex")
+				browserBinding: node_crypto.createHash("sha256").update(browserState).digest("hex"),
+				...app !== void 0 ? { app } : {}
 			});
 			reply.code(302);
 			reply.header("Set-Cookie", ssoStateCookie(browserState, returnBase.startsWith("https:")));
 			reply.header("Location", url);
 			reply.send("");
 		} catch (err) {
+			if (err instanceof PendingStatesFullError) {
+				this.ctx.logger.warn("OIDC sign-in refused: too many in progress", { meta: { provider: providerId } });
+				if (app !== void 0) {
+					reply.code(302);
+					reply.header("Location", require_dist.appFlowLocation(app.redirect, { error: "too-many-requests" }, app.state));
+					reply.send("");
+					return;
+				}
+				reply.code(429);
+				reply.header("Retry-After", "30");
+				reply.send({ error: "Too many sign-ins in progress - try again shortly" });
+				return;
+			}
 			reply.code(500);
 			reply.send({
 				error: "OIDC start failed",
@@ -1468,6 +1462,27 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 		const code = query["code"];
 		const state = query["state"];
 		const errorParam = query["error"];
+		const pendingApp = state !== void 0 ? this.livePending(state)?.app : void 0;
+		const appFlowState = state?.startsWith("a.") === true;
+		const answerApp = (error) => {
+			this.ctx.logger.warn("OIDC app sign-in refused at callback", { meta: {
+				provider: providerId,
+				error
+			} });
+			if (state !== void 0) this.pendingStates.delete(state);
+			reply.code(302);
+			reply.header("Cache-Control", "no-store");
+			reply.header("Location", pendingApp !== void 0 ? require_dist.appFlowLocation(pendingApp.redirect, { error }, pendingApp.state) : require_dist.appFlowLocation(require_dist.APP_FLOW_DEFAULT_REDIRECT, { error }));
+			reply.send("");
+		};
+		if (appFlowState && pendingApp === void 0) {
+			answerApp(errorParam ? "idp-error" : "state-expired");
+			return;
+		}
+		if (errorParam && pendingApp !== void 0) {
+			answerApp("idp-error");
+			return;
+		}
 		if (errorParam) {
 			reply.code(400);
 			reply.send({
@@ -1485,6 +1500,10 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 		try {
 			const result = await this.handleCallback(code, state);
 			if (result.providerId !== providerId) {
+				if (result.app !== void 0) {
+					answerApp("provider-mismatch");
+					return;
+				}
 				reply.code(400);
 				reply.send({ error: "OIDC callback does not match the provider the login started at" });
 				return;
@@ -1499,14 +1518,25 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 				...result.linkIntent !== void 0 ? { linkIntent: result.linkIntent } : {},
 				issuer: result.issuer,
 				jti: node_crypto.randomBytes(16).toString("base64url"),
-				...result.browserBinding !== void 0 ? { browserBinding: result.browserBinding } : {}
+				...result.browserBinding !== void 0 ? { browserBinding: result.browserBinding } : {},
+				...result.app !== void 0 ? { app: {
+					codeChallenge: result.app.codeChallenge,
+					state: result.app.state,
+					purpose: result.app.purpose,
+					redirect: result.app.redirect
+				} } : {}
 			} });
 			const finish = new URLSearchParams({ bridge: bridgeToken });
 			if (result.popup) finish.set("popup", "1");
+			const finishPath = result.app !== void 0 ? "finish-app" : "finish";
 			reply.code(302);
-			reply.header("Location", `${result.returnBase}/api/auth/sso/finish?${finish.toString()}`);
+			reply.header("Location", `${result.returnBase}/api/auth/sso/${finishPath}?${finish.toString()}`);
 			reply.send("");
 		} catch (err) {
+			if (pendingApp !== void 0) {
+				answerApp(err instanceof StepUpNotFreshError ? "step-up-not-fresh" : "idp-failed");
+				return;
+			}
 			reply.code(500);
 			reply.send({
 				error: "OIDC callback failed",
@@ -1515,6 +1545,10 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 		}
 	}
 };
+/** Minimal standalone page for a refused app sign-in request (D858) - no assets, no script. */
+function appRefusalPage(message) {
+	return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign-in request refused</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:3rem auto;padding:0 1rem"><h1>Sign-in request refused</h1><p>${message.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`)}</p><p>Close this window and try again from the app.</p></body></html>`;
+}
 /**
 * The browser-binding cookie (`SSO_STATE_COOKIE`). HttpOnly, Lax (the IdP
 * returns with a top-level GET), path `/` so it reaches the hub's finish under