@camstack/server 1.2.486 → 1.2.487

package/dist/auth/native-return.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ssoReturnLocation = ssoReturnLocation;
+exports.browserHandoffLocation = browserHandoffLocation;
+/**
+ * Where the hub's auth routes send a browser, as `Location` values (D801).
+ *
+ * Pure, so the two rules that live in `main.ts` routes are specced here:
+ *  - an SSO return is an admin-ui path relative to the hub's mount — EXCEPT a
+ *    native app return (`camstack://auth-callback?…`), which is not a hub path
+ *    and must never be prefixed;
+ *  - a browser handoff lands on the account page and nowhere else.
+ */
+const types_1 = require("@camstack/types");
+const sso_finish_js_1 = require("./sso-finish.js");
+function ssoReturnLocation(mount, location) {
+    return (0, types_1.hasUrlScheme)(location) ? location : `${mount}${location}`;
+}
+/**
+ * The account page, signed in by a session in the FRAGMENT that admin-ui's
+ * auth boot consumes (`#token=…&next=…`, as an SSO login return). Without a
+ * session — unknown, used or expired code — the plain login page.
+ */
+function browserHandoffLocation(mount, session) {
+    if (session === null)
+        return `${mount}${sso_finish_js_1.SSO_LOGIN_PATH}`;
+    const fragment = new URLSearchParams({
+        ...(0, sso_finish_js_1.sessionFragmentParams)(session),
+        next: sso_finish_js_1.SSO_PROFILE_PATH,
+        provider: 'browser-handoff',
+    });
+    return `${mount}${sso_finish_js_1.SSO_LOGIN_PATH}#${fragment.toString()}`;
+}

package/dist/auth/session-lifetimes.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_ACCESS_TOKEN_EXPIRY = exports.SESSION_LIFETIME_KEY = exports.ACCESS_TOKEN_EXPIRY_KEY = void 0;
+exports.readSessionLifetimes = readSessionLifetimes;
+/**
+ * The two lifetimes of a login (System → Authentication):
+ *
+ *  - `auth.tokenExpiry` — how long a SESSION lives without being used
+ *    (sliding: every refresh or renewal moves it), default 30 days;
+ *  - `auth.accessTokenExpiry` — how long one ACCESS token lives before a
+ *    refreshing client swaps it, default 2 hours, bounded to [5 min, 24 h]
+ *    and never past the session.
+ *
+ * Read per mint (the hub's ConfigService answers from memory), so a change
+ * applies to the next login or refresh. A value that does not parse falls
+ * back to the default — never to something longer.
+ */
+const system_1 = require("@camstack/system");
+exports.ACCESS_TOKEN_EXPIRY_KEY = 'auth.accessTokenExpiry';
+exports.SESSION_LIFETIME_KEY = 'auth.tokenExpiry';
+exports.DEFAULT_ACCESS_TOKEN_EXPIRY = '2h';
+const DEFAULT_ACCESS_SEC = 2 * 3600;
+const MIN_ACCESS_SEC = 5 * 60;
+const MAX_ACCESS_SEC = 24 * 3600;
+function safeRead(read, key) {
+    try {
+        return read(key);
+    }
+    catch {
+        return undefined;
+    }
+}
+function readSessionLifetimes(read) {
+    const session = (0, system_1.parseTokenExpiry)(safeRead(read, exports.SESSION_LIFETIME_KEY));
+    const configuredAccess = safeRead(read, exports.ACCESS_TOKEN_EXPIRY_KEY);
+    const access = configuredAccess === undefined || configuredAccess === null || configuredAccess === ''
+        ? null
+        : (0, system_1.parseTokenExpiry)(configuredAccess);
+    const accessSec = access !== null && access.ok
+        ? Math.min(MAX_ACCESS_SEC, Math.max(MIN_ACCESS_SEC, access.seconds))
+        : DEFAULT_ACCESS_SEC;
+    return {
+        sessionMs: session.seconds * 1000,
+        accessSec: Math.min(accessSec, session.seconds),
+    };
+}

package/dist/auth/session-mint.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SessionDirectoryUnavailableError = exports.SessionUserGoneError = void 0;
+exports.SessionRefreshRefusedError = exports.SessionDirectoryUnavailableError = exports.SessionUserGoneError = void 0;
 exports.createSessionMinter = createSessionMinter;
 /** The user a credential names is not in `user-management` (deleted, or never existed). */
 class SessionUserGoneError extends Error {
@@ -20,6 +20,16 @@ class SessionDirectoryUnavailableError extends Error {
     }
 }
 exports.SessionDirectoryUnavailableError = SessionDirectoryUnavailableError;
+/** A refresh token that does not continue a live session. */
+class SessionRefreshRefusedError extends Error {
+    reason;
+    constructor(reason) {
+        super('Session expired — sign in again');
+        this.reason = reason;
+        this.name = 'SessionRefreshRefusedError';
+    }
+}
+exports.SessionRefreshRefusedError = SessionRefreshRefusedError;
 function createSessionMinter(deps) {
     const findUserOrNull = async (userId) => {
         const directory = deps.directory();
@@ -35,22 +45,109 @@ function createSessionMinter(deps) {
             throw new SessionUserGoneError(userId);
         return record;
     };
-    const mintForRecord = (record) => ({
-        token: deps.signer.signToken({
-            userId: record.id,
-            username: record.username,
-            isAdmin: record.isAdmin,
-            allowedProviders: record.allowedProviders ?? '*',
-            allowedDevices: record.allowedDevices ?? {},
-            scopes: record.scopes ?? [],
-        }),
-        user: { id: record.id, username: record.username, isAdmin: record.isAdmin },
-        requiresTotp: false,
+    const backing = () => {
+        if (deps.sessions === undefined)
+            return null;
+        const live = deps.sessions();
+        if (live === null)
+            throw new SessionDirectoryUnavailableError();
+        return live;
+    };
+    const claims = (record, sid) => ({
+        ...(sid !== undefined ? { sid } : {}),
+        userId: record.id,
+        username: record.username,
+        isAdmin: record.isAdmin,
+        allowedProviders: record.allowedProviders ?? '*',
+        allowedDevices: record.allowedDevices ?? {},
+        scopes: record.scopes ?? [],
+    });
+    const user = (record) => ({
+        id: record.id,
+        username: record.username,
+        isAdmin: record.isAdmin,
     });
+    /** Sign an access token for `session`: short for a refreshing client, the session's own life otherwise. */
+    const signFor = (record, session, refreshable, live) => {
+        const remainingSec = Math.max(60, Math.floor((session.expiresAt - Date.now()) / 1000));
+        const expiresInSec = refreshable ? Math.min(live.accessSec(), remainingSec) : remainingSec;
+        return {
+            token: deps.signer.signToken(claims(record, session.id), { expiresInSec }),
+            expiresAt: Date.now() + expiresInSec * 1000,
+        };
+    };
+    const mintForRecord = async (record, issue) => {
+        const live = backing();
+        if (live === null) {
+            return {
+                token: deps.signer.signToken(claims(record, undefined)),
+                user: user(record),
+                requiresTotp: false,
+            };
+        }
+        const refreshable = issue.refreshable === true;
+        const opened = await live.open({
+            userId: record.id,
+            refreshable,
+            method: issue.method,
+            ...(issue.client !== undefined ? { client: issue.client } : {}),
+            ...(issue.ip !== undefined ? { ip: issue.ip } : {}),
+        });
+        const access = signFor(record, opened.session, refreshable, live);
+        return {
+            token: access.token,
+            user: user(record),
+            requiresTotp: false,
+            expiresAt: access.expiresAt,
+            sessionId: opened.session.id,
+            sessionExpiresAt: opened.session.expiresAt,
+            ...(opened.refreshToken !== null ? { refreshToken: opened.refreshToken } : {}),
+        };
+    };
     return {
         findUser,
         findUserOrNull,
         mintForRecord,
-        mintForUserId: async (userId) => mintForRecord(await findUser(userId)),
+        mintForUserId: async (userId, issue) => mintForRecord(await findUser(userId), issue),
+        continueSession: async (userId, sessionId) => {
+            const live = backing();
+            const record = await findUser(userId);
+            if (live === null)
+                return mintForRecord(record, { method: 'handoff' });
+            const session = await live.extend(sessionId);
+            if (session === null || session.userId !== userId) {
+                throw new SessionRefreshRefusedError('revoked');
+            }
+            const access = signFor(record, session, false, live);
+            return {
+                token: access.token,
+                user: user(record),
+                requiresTotp: false,
+                expiresAt: access.expiresAt,
+                sessionId: session.id,
+                sessionExpiresAt: session.expiresAt,
+            };
+        },
+        refresh: async (refreshToken) => {
+            const live = backing();
+            if (live === null)
+                throw new SessionRefreshRefusedError('unknown');
+            const rotated = await live.rotate(refreshToken);
+            if (!rotated.ok)
+                throw new SessionRefreshRefusedError(rotated.reason);
+            const record = await findUserOrNull(rotated.session.userId);
+            if (record === null)
+                throw new SessionRefreshRefusedError('user-gone');
+            const access = signFor(record, rotated.session, true, live);
+            return {
+                token: access.token,
+                user: user(record),
+                requiresTotp: false,
+                expiresAt: access.expiresAt,
+                sessionId: rotated.session.id,
+                sessionExpiresAt: rotated.session.expiresAt,
+                refreshToken: rotated.refreshToken,
+            };
+        },
     };
 }

package/dist/auth/sso-finish-deps.js

@@ -1,7 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sessionUserIdFromCookie = sessionUserIdFromCookie;
+exports.readCookie = readCookie;
+exports.ssoBrowserBinding = ssoBrowserBinding;
 exports.createSsoFinishDeps = createSsoFinishDeps;
+/**
+ * The live wiring of `finishSsoLogin`'s deps (D777, D782) — kept out of
+ * `main.ts` so the route there stays a three-line mapping.
+ */
+const node_crypto_1 = require("node:crypto");
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
 const auth_provider_gate_js_1 = require("./auth-provider-gate.js");
 const passkey_provider_js_1 = require("./passkey-provider.js");
 const second_factors_js_1 = require("./second-factors.js");
@@ -28,6 +37,26 @@ function sessionUserIdFromCookie(auth, cookieHeader) {
         return null;
     }
 }
+/** The value of one cookie in a raw `Cookie` header, or `null`. */
+function readCookie(header, name) {
+    if (header === undefined)
+        return null;
+    for (const pair of header.split(';')) {
+        const eq = pair.indexOf('=');
+        if (eq === -1)
+            continue;
+        if (pair.slice(0, eq).trim() !== name)
+            continue;
+        const value = pair.slice(eq + 1).trim();
+        return value.length > 0 ? value : null;
+    }
+    return null;
+}
+/** SHA-256 (hex) of the request's SSO state cookie, or `null` without one. */
+function ssoBrowserBinding(cookieHeader) {
+    const value = readCookie(cookieHeader, types_1.SSO_STATE_COOKIE);
+    return value === null ? null : (0, node_crypto_1.createHash)('sha256').update(value).digest('hex');
+}
 function createSsoFinishDeps(wiring, cookieHeader) {
     const { auth, registry, moleculer } = wiring;
     const userManagement = () => {
@@ -50,11 +79,37 @@ function createSsoFinishDeps(wiring, cookieHeader) {
                 });
                 if (holder !== null && holder.userId !== input.userId)
                     return 'conflict';
-                await um.linkExternalIdentity(input);
+                // Hub-internal: creating a link is on no wire (not tRPC, not the
+                // mesh, not ctx.api) — only this in-process caller reaches it.
+                const internal = (0, system_1.getUserManagementInternal)(um);
+                if (internal === null)
+                    throw new Error('External sign-in linking not available');
+                await internal.linkExternalIdentity(input);
                 return 'linked';
             },
         },
         consumeLinkIntent: (handle) => wiring.linkIntents.consume(handle),
+        parkNativeLink: (link) => wiring.nativeLinks.park(link),
+        browserBinding: () => ssoBrowserBinding(cookieHeader),
+        consumeBridgeId: (jti) => wiring.usedBridgeIds.consume(jti),
+        ...(wiring.sessionIssue !== undefined ? { sessionIssue: wiring.sessionIssue } : {}),
+        ...(wiring.trustedNetworkLogin !== undefined
+            ? {
+                trustedNetworkLogin: wiring.trustedNetworkLogin,
+                auditSkip: async (userId, factors) => {
+                    const internal = (0, system_1.getUserManagementInternal)(registry.getSingleton('user-management'));
+                    if (internal === null)
+                        throw new Error('auth audit unavailable');
+                    const ip = wiring.sessionIssue?.().ip;
+                    await internal.audit.record({
+                        action: 'second-factor-skipped',
+                        userId,
+                        ...(ip !== undefined ? { ip } : {}),
+                        detail: { method: 'sso', factors: factors.join(',') },
+                    });
+                },
+            }
+            : {}),
         sessionUserId: () => sessionUserIdFromCookie(auth, cookieHeader),
         secondFactors: (userId) => {
             const um = registry.getSingleton('user-management');

package/dist/auth/sso-finish.js

@@ -1,13 +1,52 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SSO_POPUP_COMPLETE_PATH = exports.SSO_LOGIN_PATH = exports.SSO_PROFILE_PATH = exports.OIDC_IDENTITY_PREFIX = exports.OIDC_BRIDGE_PROVIDER_PREFIX = exports.MAGIC_LINK_BRIDGE_PROVIDER = void 0;
+exports.SSO_POPUP_COMPLETE_PATH = exports.SSO_LOGIN_PATH = exports.SSO_PROFILE_PATH = exports.OIDC_IDENTITY_PREFIX = exports.OIDC_BRIDGE_PROVIDER_PREFIX = void 0;
 exports.popupCompletionLocation = popupCompletionLocation;
 exports.isLoginBridge = isLoginBridge;
+exports.appCallbackLocation = appCallbackLocation;
+exports.sessionFragmentParams = sessionFragmentParams;
 exports.finishSsoLogin = finishSsoLogin;
+/**
+ * `/api/auth/sso/finish` — swaps a verified login bridge for a session (D712),
+ * or completes an explicit OIDC link (D782).
+ *
+ * An auth-provider addon (OIDC) mints an HMAC-signed bridge
+ * through the `sso-bridge` cap and 302s here with `?bridge=<jwt>`. The bridge
+ * proves WHO signed in at the IdP; it never decides what the session may do:
+ *
+ *  - Only a LOGIN bridge is accepted. The `sso-bridge` family also carries the
+ *    OAuth account-link tokens (`oauth-code` travels in a browser redirect,
+ *    `oauth-access` / `oauth-refresh` are a component's credentials) — all
+ *    verify under the same secret, and each used to be exchangeable here for a
+ *    full browser session of the linking user.
+ *  - A bridge whose provider addon is disabled on Identity → Authentication
+ *    is refused (D777): that toggle is the provider's only enable.
+ *  - An OIDC bridge names an identity `oidc:<instance>:<sub>` (D782). It signs
+ *    in ONLY the user that identity was explicitly linked to, from that user's
+ *    record — no federated session, no auto-creation, no email matching. An
+ *    unlinked identity is sent back to the login page with a message.
+ *  - Every login owes the user's enrolled second factors (TOTP; an opted-in
+ *    passkey): the finish then hands the login page a challenge, not a
+ *    session — the same rule as a password login.
+ *  - A bridge is single-use (its `jti` is recorded) and bound to the browser
+ *    that started the sign-in (the `SSO_STATE_COOKIE` hash it carries must
+ *    match the cookie this request presents). A bridge copied out of a URL is
+ *    useless in another browser and useless a second time.
+ *  - A bridge carrying a `linkIntent` is a LINK, never a login: the hub-side
+ *    intent (minted for a signed-in user, single-use) names the user, and the
+ *    browser completing the flow must still hold THAT user's session cookie.
+ *  - A link started from the native app (`returnTo` on the intent, D801) ends
+ *    in the system browser, which holds no hub session: the verified identity
+ *    is PARKED under a one-time code and the browser goes back to the app's
+ *    custom scheme. The app claims it with its own bearer
+ *    (`auth.completeExternalLink`), where the user binding is checked.
+ *
+ * Pure: the Fastify route in `main.ts` wires the deps and maps the outcome.
+ */
+const node_crypto_1 = require("node:crypto");
+const types_1 = require("@camstack/types");
 const auth_provider_gate_js_1 = require("./auth-provider-gate.js");
 const session_mint_js_1 = require("./session-mint.js");
-/** The magic-link addon's bridge `provider`. */
-exports.MAGIC_LINK_BRIDGE_PROVIDER = 'auth-magic-link';
 /**
  * `auth-oidc` signs `auth-oidc/<instance>`.
  *
@@ -15,10 +54,9 @@ exports.MAGIC_LINK_BRIDGE_PROVIDER = 'auth-magic-link';
  * linkable (that is the `linkable` flag on a login method, which gates the
  * intent a link needs). It stays because it is load-bearing: it is the
  * allowlist that keeps the `oauth-*` tokens of the same signer from being
- * swapped for a session, and it tells an identity-named bridge
- * (`oidc:<instance>:<sub>`, linked users only) from a magic-link bridge that
- * names a user record. A bridge with any other provider is refused, so a
- * non-OIDC linkable provider fails closed until it has its own bridge format.
+ * swapped for a session. A bridge with any other provider is refused, so a
+ * non-OIDC provider fails closed until it has its own bridge format. (The
+ * magic-link bridge that named a user record directly is gone with its addon.)
  */
 exports.OIDC_BRIDGE_PROVIDER_PREFIX = 'auth-oidc/';
 /** `auth-oidc` names an identity `oidc:<instance>:<sub>`. */
@@ -79,8 +117,7 @@ function oidcIdentityOf(claims) {
 }
 /** Whether `claims` is a LOGIN bridge — the only kind this endpoint swaps. */
 function isLoginBridge(claims) {
-    return (claims.provider === exports.MAGIC_LINK_BRIDGE_PROVIDER ||
-        claims.provider.startsWith(exports.OIDC_BRIDGE_PROVIDER_PREFIX));
+    return claims.provider.startsWith(exports.OIDC_BRIDGE_PROVIDER_PREFIX);
 }
 function unauthorized(error) {
     return { kind: 'error', status: 401, body: { error } };
@@ -91,6 +128,10 @@ function redirect(location) {
 function linkRefused(reason) {
     return redirect(`${PROFILE_PATH}?linkError=${reason}`);
 }
+/** The app's callback with one query parameter — `link=<code>` or `linkError=<reason>`. */
+function appCallbackLocation(returnTo, key, value) {
+    return `${returnTo}?${key}=${encodeURIComponent(value)}`;
+}
 function failed(error, deps) {
     if (error instanceof session_mint_js_1.SessionUserGoneError)
         return unauthorized('User no longer exists');
@@ -98,14 +139,45 @@ function failed(error, deps) {
     deps.logFailure?.(error);
     return { kind: 'error', status: 500, body: { error: 'SSO finish failed' } };
 }
+/**
+ * The session a URL fragment hands the admin-ui: the access token, and — the
+ * admin-ui is a refreshing client — the refresh token and both expiries. A
+ * fragment never reaches a server log or a Referer.
+ */
+function sessionFragmentParams(session) {
+    return {
+        token: session.token,
+        ...(session.refreshToken !== undefined ? { refreshToken: session.refreshToken } : {}),
+        ...(session.expiresAt !== undefined ? { expiresAt: String(session.expiresAt) } : {}),
+        ...(session.sessionExpiresAt !== undefined
+            ? { sessionExpiresAt: String(session.sessionExpiresAt) }
+            : {}),
+    };
+}
+/** May this login skip its factors (opt-in trusted network)? Only when the skip could be audited. */
+async function skippedHere(userId, owed, deps) {
+    if (owed.length === 0 || deps.trustedNetworkLogin?.() !== true || deps.auditSkip === undefined) {
+        return false;
+    }
+    try {
+        await deps.auditSkip(userId, owed);
+        return true;
+    }
+    catch (error) {
+        deps.logFailure?.(error);
+        return false;
+    }
+}
 /** A session for `record` — or the second-factor challenge it still owes. */
 async function signIn(record, provider, deps) {
-    const factors = await deps.secondFactors(record.id);
+    const owed = await deps.secondFactors(record.id);
+    const factors = (await skippedHere(record.id, owed, deps)) ? [] : owed;
     if (factors.length > 0) {
         const challenge = deps.signChallenge({
             userId: record.id,
             username: record.username,
             isAdmin: record.isAdmin,
+            method: 'sso',
         });
         // The challenge rides the URL FRAGMENT, like the session token below: it
         // never reaches a server log. The login page resumes at the factor step.
@@ -116,8 +188,13 @@ async function signIn(record, provider, deps) {
         });
         return redirect(`${LOGIN_PATH}#${fragment.toString()}`);
     }
-    const session = deps.minter.mintForRecord(record);
-    return redirect(`${LOGIN_PATH}#token=${encodeURIComponent(session.token)}&provider=${encodeURIComponent(provider)}`);
+    const session = await deps.minter.mintForRecord(record, {
+        method: 'sso',
+        refreshable: true,
+        ...deps.sessionIssue?.(),
+    });
+    const fragment = new URLSearchParams({ ...sessionFragmentParams(session), provider });
+    return redirect(`${LOGIN_PATH}#${fragment.toString()}`);
 }
 async function completeLink(claims, handle, deps) {
     const identity = oidcIdentityOf(claims);
@@ -127,6 +204,21 @@ async function completeLink(claims, handle, deps) {
     const intent = deps.consumeLinkIntent(handle);
     if (intent === null)
         return linkRefused('expired');
+    if (intent.returnTo !== undefined) {
+        // Native (D801): no session cookie to check here — the app's claim is
+        // bound to the intent's user by `auth.completeExternalLink`.
+        if (intent.provider !== identity.provider) {
+            return redirect(appCallbackLocation(intent.returnTo, 'linkError', 'provider'));
+        }
+        const code = deps.parkNativeLink({
+            userId: intent.userId,
+            provider: identity.provider,
+            subject: identity.subject,
+            issuer: identity.issuer,
+            label: claims.email ?? claims.username,
+        });
+        return redirect(appCallbackLocation(intent.returnTo, 'link', code));
+    }
     if (intent.provider !== identity.provider)
         return linkRefused('provider');
     // Bound to the session that asked: the browser finishing the IdP round trip
@@ -147,11 +239,6 @@ async function completeLink(claims, handle, deps) {
     return redirect(`${PROFILE_PATH}?linked=${encodeURIComponent(identity.provider)}`);
 }
 async function completeLogin(claims, deps) {
-    if (claims.provider === exports.MAGIC_LINK_BRIDGE_PROVIDER) {
-        if (claims.userId.startsWith(exports.OIDC_IDENTITY_PREFIX))
-            return unauthorized('Not a user record');
-        return signIn(await deps.minter.findUser(claims.userId), claims.provider, deps);
-    }
     const identity = oidcIdentityOf(claims);
     if (identity === null)
         return unauthorized('Malformed OIDC identity');
@@ -167,8 +254,31 @@ async function finishSsoLogin(bridge, deps, options = {}) {
     const outcome = await finishSsoReturn(bridge, deps);
     if (options.popup !== true || outcome.kind !== 'redirect')
         return outcome;
+    // A native return goes to the app's scheme, never to a popup page.
+    if ((0, types_1.hasUrlScheme)(outcome.location))
+        return outcome;
     return redirect(popupCompletionLocation(outcome.location));
 }
+/** Constant-time compare of two hex digests (equal length or not equal). */
+function sameDigest(a, b) {
+    const left = Buffer.from(a, 'utf8');
+    const right = Buffer.from(b, 'utf8');
+    return left.length === right.length && (0, node_crypto_1.timingSafeEqual)(left, right);
+}
+/**
+ * Is this the FIRST presentation of the bridge, in the browser that started
+ * the sign-in? The binding is checked BEFORE the jti is recorded, so a bridge
+ * presented from a browser without the cookie is refused without being burned
+ * — the real browser can still finish.
+ */
+function bridgeIsFirstUseHere(claims, deps) {
+    if (claims.jti === undefined || claims.browserBinding === undefined)
+        return false;
+    const presented = deps.browserBinding();
+    if (presented === null || !sameDigest(presented, claims.browserBinding))
+        return false;
+    return deps.consumeBridgeId(claims.jti);
+}
 async function finishSsoReturn(bridge, deps) {
     if (!bridge)
         return { kind: 'error', status: 400, body: { error: 'Missing bridge token' } };
@@ -180,6 +290,11 @@ async function finishSsoReturn(bridge, deps) {
     if (deps.isProviderDisabled((0, auth_provider_gate_js_1.bridgeProviderAddonId)(claims.provider))) {
         return unauthorized('Login provider is disabled');
     }
+    if (!bridgeIsFirstUseHere(claims, deps)) {
+        return claims.linkIntent !== undefined
+            ? linkRefused('state')
+            : redirect(`${LOGIN_PATH}#error=sso-state`);
+    }
     try {
         return claims.linkIntent !== undefined
             ? await completeLink(claims, claims.linkIntent, deps)

package/dist/auth/sso-routes.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerSsoRoutes = registerSsoRoutes;
+/**
+ * The two browser-facing SSO routes, kept out of `main.ts`:
+ *
+ *  - `GET /api/auth/sso/finish?bridge=…` — swaps a verified, single-use,
+ *    browser-bound login bridge for a session / challenge / link
+ *    (`sso-finish.ts` holds the rules). Limited per REAL client address.
+ *    Every answer clears the `SSO_STATE_COOKIE`: it binds exactly one finish.
+ *  - `GET /api/auth/browser-handoff?code=…` — a one-time code from
+ *    `auth.createBrowserHandoff` opens the account page signed in (D801).
+ */
+const types_1 = require("@camstack/types");
+const spa_mount_js_1 = require("../api/static/spa-mount.js");
+const auth_rate_limit_js_1 = require("./auth-rate-limit.js");
+const native_return_js_1 = require("./native-return.js");
+const sso_finish_js_1 = require("./sso-finish.js");
+const sso_finish_deps_js_1 = require("./sso-finish-deps.js");
+/** A User-Agent as a session's client label. */
+function clientOf(ua) {
+    const value = Array.isArray(ua) ? ua[0] : ua;
+    return typeof value === 'string' && value.length > 0 ? { client: value.slice(0, 200) } : {};
+}
+/** Expire the state cookie (both Secure variants are cleared by name + path). */
+function clearSsoStateCookie() {
+    return `${types_1.SSO_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+}
+function registerSsoRoutes(fastify, deps) {
+    fastify.get('/api/auth/sso/finish', async (request, reply) => {
+        const client = (0, auth_rate_limit_js_1.clientKeyFromRequest)(request, deps.network);
+        if (client !== null) {
+            const verdict = deps.limiter.check(`sso-finish:${client}`);
+            if (!verdict.allowed) {
+                reply.header('retry-after', String(verdict.retryAfterSeconds));
+                return reply.status(429).send({ error: 'Too many attempts' });
+            }
+        }
+        const outcome = await (0, sso_finish_js_1.finishSsoLogin)(request.query.bridge, (0, sso_finish_deps_js_1.createSsoFinishDeps)({
+            ...deps.wiring,
+            sessionIssue: () => {
+                const ip = deps.network.clientAddress(request).ip;
+                return { ...(ip !== null ? { ip } : {}), ...clientOf(request.headers['user-agent']) };
+            },
+            trustedNetworkLogin: () => deps.network.isTrustedNetworkLogin(deps.network.clientAddress(request)),
+            logFailure: (error) => deps.logger.error('SSO finish failed', {
+                meta: { error: error instanceof Error ? error.message : String(error) },
+            }),
+        }, request.headers.cookie), 
+        // A popup sign-in (D791) returns through the admin-ui completion page.
+        { popup: request.query.popup === '1' });
+        // One state cookie binds one finish, whatever the outcome.
+        reply.header('Set-Cookie', clearSsoStateCookie());
+        reply.header('Referrer-Policy', 'no-referrer');
+        if (outcome.kind === 'error')
+            return reply.status(outcome.status).send(outcome.body);
+        reply.code(302);
+        // Admin-ui paths are relative to the hub's mount (HA ingress etc.); a
+        // native app return (`camstack://…`, D801) is not a hub path at all.
+        const mount = (0, spa_mount_js_1.parseForwardedPrefix)(request.headers['x-forwarded-prefix']) ?? '';
+        reply.header('Location', (0, native_return_js_1.ssoReturnLocation)(mount, outcome.location));
+        return reply.send('');
+    });
+    // A one-time code minted by `auth.createBrowserHandoff` opens the account
+    // page signed in (D801): the session rides the URL FRAGMENT (never a server
+    // log), and the only destination is the account page.
+    fastify.get('/api/auth/browser-handoff', async (request, reply) => {
+        const mount = (0, spa_mount_js_1.parseForwardedPrefix)(request.headers['x-forwarded-prefix']) ?? '';
+        const grant = typeof request.query.code === 'string'
+            ? deps.browserHandoffCodes.redeem(request.query.code)
+            : null;
+        let session = null;
+        if (grant !== null) {
+            try {
+                // A session of its own for this browser (the admin-ui refreshes).
+                const ip = deps.network.clientAddress(request).ip;
+                session = await deps.minter.mintForUserId(grant.userId, {
+                    method: 'handoff',
+                    refreshable: true,
+                    ...(ip !== null ? { ip } : {}),
+                    ...clientOf(request.headers['user-agent']),
+                });
+            }
+            catch (error) {
+                deps.logger.warn('Browser handoff refused', {
+                    meta: { error: error instanceof Error ? error.message : String(error) },
+                });
+            }
+        }
+        reply.code(302);
+        reply.header('Referrer-Policy', 'no-referrer');
+        reply.header('Location', (0, native_return_js_1.browserHandoffLocation)(mount, session));
+        return reply.send('');
+    });
+}