@camstack/server 1.2.480 → 1.2.481

package/dist/auth/sso-finish.js

@@ -1,39 +1,135 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OIDC_FEDERATED_USER_PREFIX = exports.OIDC_BRIDGE_PROVIDER_PREFIX = exports.MAGIC_LINK_BRIDGE_PROVIDER = void 0;
+exports.OIDC_IDENTITY_PREFIX = exports.OIDC_BRIDGE_PROVIDER_PREFIX = exports.MAGIC_LINK_BRIDGE_PROVIDER = void 0;
 exports.isLoginBridge = isLoginBridge;
 exports.finishSsoLogin = finishSsoLogin;
+const auth_provider_gate_js_1 = require("./auth-provider-gate.js");
 const session_mint_js_1 = require("./session-mint.js");
 /** The magic-link addon's bridge `provider`. */
 exports.MAGIC_LINK_BRIDGE_PROVIDER = 'auth-magic-link';
-/** `auth-oidc` signs `auth-oidc/<instance>`. */
+/**
+ * `auth-oidc` signs `auth-oidc/<instance>`.
+ *
+ * Here the prefix is the READING of a bridge, not the choice of what is
+ * linkable (that is the `linkable` flag on a login method, which gates the
+ * intent a link needs). It stays because it is load-bearing: it is the
+ * allowlist that keeps the `oauth-*` tokens of the same signer from being
+ * swapped for a session, and it tells an identity-named bridge
+ * (`oidc:<instance>:<sub>`, linked users only) from a magic-link bridge that
+ * names a user record. A bridge with any other provider is refused, so a
+ * non-OIDC linkable provider fails closed until it has its own bridge format.
+ */
 exports.OIDC_BRIDGE_PROVIDER_PREFIX = 'auth-oidc/';
-/** `auth-oidc` names a federated identity `oidc:<instance>:<sub>`. */
-exports.OIDC_FEDERATED_USER_PREFIX = 'oidc:';
-function isOidcBridge(claims) {
-    return (claims.provider.startsWith(exports.OIDC_BRIDGE_PROVIDER_PREFIX) &&
-        claims.userId.startsWith(exports.OIDC_FEDERATED_USER_PREFIX));
+/** `auth-oidc` names an identity `oidc:<instance>:<sub>`. */
+exports.OIDC_IDENTITY_PREFIX = 'oidc:';
+/** Where a completed (or refused) link lands — the signed-in user's profile. */
+const PROFILE_PATH = '/admin/system/my-access';
+const LOGIN_PATH = '/admin/login';
+/**
+ * `(provider, subject, issuer)` of an OIDC bridge, or `null` when it is not a
+ * well-formed one. A subject is unique only per issuer, so a bridge without
+ * the verified `iss` names no identity.
+ */
+function oidcIdentityOf(claims) {
+    if (!claims.provider.startsWith(exports.OIDC_BRIDGE_PROVIDER_PREFIX))
+        return null;
+    if (claims.issuer === undefined || claims.issuer.length === 0)
+        return null;
+    const instance = claims.provider.slice(exports.OIDC_BRIDGE_PROVIDER_PREFIX.length);
+    if (instance.length === 0)
+        return null;
+    const prefix = `${exports.OIDC_IDENTITY_PREFIX}${instance}:`;
+    if (!claims.userId.startsWith(prefix))
+        return null;
+    const subject = claims.userId.slice(prefix.length);
+    return subject.length === 0 ? null : { provider: claims.provider, subject, issuer: claims.issuer };
 }
 /** Whether `claims` is a LOGIN bridge — the only kind this endpoint swaps. */
 function isLoginBridge(claims) {
-    return claims.provider === exports.MAGIC_LINK_BRIDGE_PROVIDER || isOidcBridge(claims);
-}
-/** A record wins; only an OIDC identity may stand without one. */
-async function mintForBridge(claims, minter) {
-    const record = await minter.findUserOrNull(claims.userId);
-    if (record !== null)
-        return minter.mintForRecord(record);
-    if (!isOidcBridge(claims))
-        throw new session_mint_js_1.SessionUserGoneError(claims.userId);
-    return minter.mintForFederatedIdentity({
-        userId: claims.userId,
-        username: claims.username,
-        isAdmin: claims.isAdmin,
-    });
+    return (claims.provider === exports.MAGIC_LINK_BRIDGE_PROVIDER ||
+        claims.provider.startsWith(exports.OIDC_BRIDGE_PROVIDER_PREFIX));
 }
 function unauthorized(error) {
     return { kind: 'error', status: 401, body: { error } };
 }
+function redirect(location) {
+    return { kind: 'redirect', location };
+}
+function linkRefused(reason) {
+    return redirect(`${PROFILE_PATH}?linkError=${reason}`);
+}
+function failed(error, deps) {
+    if (error instanceof session_mint_js_1.SessionUserGoneError)
+        return unauthorized('User no longer exists');
+    // The detail stays in the server log: a store error can name user ids.
+    deps.logFailure?.(error);
+    return { kind: 'error', status: 500, body: { error: 'SSO finish failed' } };
+}
+/** A session for `record` — or the second-factor challenge it still owes. */
+async function signIn(record, provider, deps) {
+    const factors = await deps.secondFactors(record.id);
+    if (factors.length > 0) {
+        const challenge = deps.signChallenge({
+            userId: record.id,
+            username: record.username,
+            isAdmin: record.isAdmin,
+        });
+        // The challenge rides the URL FRAGMENT, like the session token below: it
+        // never reaches a server log. The login page resumes at the factor step.
+        const fragment = new URLSearchParams({
+            challenge,
+            factors: factors.join(','),
+            provider,
+        });
+        return redirect(`${LOGIN_PATH}#${fragment.toString()}`);
+    }
+    const session = deps.minter.mintForRecord(record);
+    return redirect(`${LOGIN_PATH}#token=${encodeURIComponent(session.token)}&provider=${encodeURIComponent(provider)}`);
+}
+async function completeLink(claims, handle, deps) {
+    const identity = oidcIdentityOf(claims);
+    if (identity === null) {
+        return { kind: 'error', status: 400, body: { error: 'Only an OIDC sign-in can be linked' } };
+    }
+    const intent = deps.consumeLinkIntent(handle);
+    if (intent === null)
+        return linkRefused('expired');
+    if (intent.provider !== identity.provider)
+        return linkRefused('provider');
+    // Bound to the session that asked: the browser finishing the IdP round trip
+    // must be signed in as the user the intent was minted for. Without this a
+    // link started in one account could be completed with someone else's IdP
+    // login (or vice versa) and plant an identity on the wrong user.
+    if (deps.sessionUserId() !== intent.userId)
+        return linkRefused('session');
+    const result = await deps.identities.link({
+        userId: intent.userId,
+        provider: identity.provider,
+        subject: identity.subject,
+        issuer: identity.issuer,
+        label: claims.email ?? claims.username,
+    });
+    if (result === 'conflict')
+        return linkRefused('conflict');
+    return redirect(`${PROFILE_PATH}?linked=${encodeURIComponent(identity.provider)}`);
+}
+async function completeLogin(claims, deps) {
+    if (claims.provider === exports.MAGIC_LINK_BRIDGE_PROVIDER) {
+        if (claims.userId.startsWith(exports.OIDC_IDENTITY_PREFIX))
+            return unauthorized('Not a user record');
+        return signIn(await deps.minter.findUser(claims.userId), claims.provider, deps);
+    }
+    const identity = oidcIdentityOf(claims);
+    if (identity === null)
+        return unauthorized('Malformed OIDC identity');
+    const link = await deps.identities.findUser(identity.provider, identity.subject);
+    // A link made under another issuer is not this identity: the instance was
+    // repointed at a different IdP, where the same `sub` names someone else.
+    if (link === null || link.issuer !== identity.issuer) {
+        return redirect(`${LOGIN_PATH}#error=sso-not-linked&provider=${encodeURIComponent(identity.provider)}`);
+    }
+    return signIn(await deps.minter.findUser(link.userId), claims.provider, deps);
+}
 async function finishSsoLogin(bridge, deps) {
     if (!bridge)
         return { kind: 'error', status: 400, body: { error: 'Missing bridge token' } };
@@ -42,25 +138,15 @@ async function finishSsoLogin(bridge, deps) {
         return unauthorized('Invalid or expired bridge token');
     if (!isLoginBridge(claims))
         return unauthorized('Not a login bridge token');
+    if (deps.isProviderDisabled((0, auth_provider_gate_js_1.bridgeProviderAddonId)(claims.provider))) {
+        return unauthorized('Login provider is disabled');
+    }
     try {
-        const session = await mintForBridge(claims, deps.minter);
-        // The token rides in the URL FRAGMENT: it never reaches a server log and
-        // is not resent on later requests; the SPA's auth-context reads it on mount.
-        return {
-            kind: 'redirect',
-            location: `/admin/login#token=${encodeURIComponent(session.token)}&provider=${encodeURIComponent(claims.provider)}`,
-        };
+        return claims.linkIntent !== undefined
+            ? await completeLink(claims, claims.linkIntent, deps)
+            : await completeLogin(claims, deps);
     }
     catch (error) {
-        if (error instanceof session_mint_js_1.SessionUserGoneError)
-            return unauthorized('User no longer exists');
-        return {
-            kind: 'error',
-            status: 500,
-            body: {
-                error: 'SSO finish failed',
-                message: error instanceof Error ? error.message : String(error),
-            },
-        };
+        return failed(error, deps);
     }
 }

package/dist/main.js

@@ -89,7 +89,9 @@ const addon_route_share_gate_js_1 = require("./auth/addon-route-share-gate.js");
 const auth_rate_limit_1 = require("./auth/auth-rate-limit");
 const session_cookie_js_1 = require("./auth/session-cookie.js");
 const session_mint_js_1 = require("./auth/session-mint.js");
+const external_link_intents_js_1 = require("./auth/external-link-intents.js");
 const sso_finish_js_1 = require("./auth/sso-finish.js");
+const sso_finish_deps_js_1 = require("./auth/sso-finish-deps.js");
 const boot_config_1 = require("./boot/boot-config");
 const integration_id_backfill_1 = require("./boot/integration-id-backfill");
 const post_boot_service_1 = require("./boot/post-boot.service");
@@ -523,10 +525,14 @@ async function bootstrap() {
     // minted by `auth.createHandoffCode`, redeemed by the viewer app via the
     // public `auth.redeemHandoffCode`.
     const handoffCodeService = new handoff_code_service_1.HandoffCodeService();
+    // Pending "link this sign-in account" intents (D782) — minted by
+    // `auth.beginExternalLink`, consumed once by `/api/auth/sso/finish`.
+    const externalLinkIntents = new external_link_intents_js_1.ExternalLinkIntents();
     const buildRouter = () => (0, trpc_router_1.buildAppRouter)({
         authService: app.get(auth_service_1.AuthService),
         shareTokenService,
         handoffCodeService,
+        externalLinkIntents,
         configService: config,
         featureService: app.get(feature_service_1.FeatureService),
         loggingService,
@@ -810,15 +816,22 @@ async function bootstrap() {
         // minted by THE session mint from the user record as it is now (D712) —
         // `auth/sso-finish.ts` holds the rules, this route only maps the reply.
         const ssoAuth = app.get(auth_service_1.AuthService);
+        const ssoLogger = app.get(logging_service_1.LoggingService).createLogger('sso-finish');
         const ssoMinter = (0, session_mint_js_1.createSessionMinter)({
             signer: ssoAuth,
             directory: () => capabilityRegistry.getSingleton('user-management'),
         });
         fastify.get('/api/auth/sso/finish', async (request, reply) => {
-            const outcome = await (0, sso_finish_js_1.finishSsoLogin)(request.query.bridge, {
-                verifyBridge: (token) => ssoAuth.verifySsoBridgeToken(token),
+            const outcome = await (0, sso_finish_js_1.finishSsoLogin)(request.query.bridge, (0, sso_finish_deps_js_1.createSsoFinishDeps)({
+                auth: ssoAuth,
+                registry: capabilityRegistry,
+                moleculer: app.get(moleculer_service_1.MoleculerService),
                 minter: ssoMinter,
-            });
+                linkIntents: externalLinkIntents,
+                logFailure: (error) => ssoLogger.error('SSO finish failed', {
+                    meta: { error: error instanceof Error ? error.message : String(error) },
+                }),
+            }, request.headers.cookie));
             if (outcome.kind === 'error')
                 return reply.status(outcome.status).send(outcome.body);
             reply.code(302);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.480",
+  "version": "1.2.481",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.353",
-    "@camstack/addon-agent-ui": "1.2.190",
-    "@camstack/addon-auth": "1.2.130",
+    "@camstack/addon-admin-ui": "1.2.354",
+    "@camstack/addon-agent-ui": "1.2.191",
+    "@camstack/addon-auth": "1.2.131",
     "@camstack/addon-decoder-nodeav": "1.2.121",
     "@camstack/addon-notifiers": "1.2.128",
     "@camstack/addon-pipeline": "1.2.345",
     "@camstack/addon-pipeline-orchestrator": "1.2.297",
-    "@camstack/addon-post-analysis": "1.2.342",
+    "@camstack/addon-post-analysis": "1.2.343",
     "@camstack/sdk": "1.2.126",
-    "@camstack/system": "1.2.375",
-    "@camstack/types": "1.2.326",
-    "@camstack/ui-library": "1.2.248",
+    "@camstack/system": "1.2.376",
+    "@camstack/types": "1.2.327",
+    "@camstack/ui-library": "1.2.249",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",