@camstack/server 1.2.563 → 1.2.565

package/dist/api/core/auth-device-cert.procedures.js

@@ -0,0 +1,435 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toWireReason = toWireReason;
+exports.refusal = refusal;
+exports.createDeviceCertProcedures = createDeviceCertProcedures;
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const session_mint_js_1 = require("../../auth/session-mint.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
+const DeviceLoginResultSchema = zod_1.z.discriminatedUnion('ok', [
+    zod_1.z.object({
+        ok: zod_1.z.literal(true),
+        token: zod_1.z.string(),
+        user: zod_1.z.object({ id: zod_1.z.string(), username: zod_1.z.string(), isAdmin: zod_1.z.boolean() }),
+        expiresAt: zod_1.z.number().optional(),
+        sessionId: zod_1.z.string().optional(),
+        sessionExpiresAt: zod_1.z.number().optional(),
+        refreshToken: zod_1.z.string().optional(),
+        credentialId: zod_1.z.string(),
+        /** The certificate's expiry (epoch ms): the app renews when < 30 days remain. */
+        certNotAfter: zod_1.z.number(),
+    }),
+    types_1.DeviceRefusalSchema,
+]);
+/** Internal manager reason → the wire reason an app switches on. */
+function toWireReason(reason) {
+    switch (reason) {
+        case 'revoked':
+        case 'unknown-credential':
+        case 'expired':
+        case 'bad-signature':
+        case 'user-gone':
+        case 'bad-public-key':
+        case 'self-enrollment-disabled':
+            return reason;
+        case 'unknown-or-used-code':
+        case 'expired-code':
+            return 'code-invalid';
+        case 'unknown-nonce':
+        case 'expired-nonce':
+            return 'nonce-invalid';
+        case 'ca-unavailable':
+            return 'unavailable';
+        case 'no-device-ca':
+        case 'malformed-certificate':
+        case 'not-issued-by-device-ca':
+        case 'not-yet-valid':
+        case 'missing-credential-san':
+        case 'missing-client-auth':
+        case 'key-mismatch':
+        case 'user-mismatch':
+            return 'invalid-certificate';
+        case 'superseded':
+            return 'superseded';
+    }
+}
+function refusal(reason, retryAfterSeconds) {
+    return {
+        ok: false,
+        reason,
+        definitive: (0, types_1.isDefinitiveDeviceRefusal)(reason),
+        ...(retryAfterSeconds !== undefined ? { retryAfterSeconds } : {}),
+    };
+}
+function fromAddress(req, network) {
+    const ip = network.clientAddress(req).ip;
+    return ip ?? undefined;
+}
+function createDeviceCertProcedures(deps) {
+    const internal = () => {
+        const found = deps.registry === null
+            ? null
+            : (0, system_1.getUserManagementInternal)(deps.registry.getSingleton('user-management'));
+        if (found === null) {
+            throw new server_1.TRPCError({
+                code: 'PRECONDITION_FAILED',
+                message: 'Device certificates are not available',
+            });
+        }
+        return found;
+    };
+    /** `null` when allowed; otherwise a TYPED `rate-limited` refusal, logged. */
+    const limited = (limiter, path, req) => {
+        const ip = fromAddress(req, deps.network);
+        if (ip === undefined)
+            return null;
+        const verdict = limiter.check(`${path}:${ip}`);
+        if (verdict.allowed)
+            return null;
+        deps.logger?.warn(`Device certificate ${path} refused: rate-limited`, {
+            meta: { ip, retryAfterSeconds: verdict.retryAfterSeconds },
+        });
+        return refusal('rate-limited', verdict.retryAfterSeconds);
+    };
+    const audit = async (action, userId, req, detail) => {
+        const ip = fromAddress(req, deps.network);
+        try {
+            await internal().audit.record({
+                action,
+                ...(userId !== undefined ? { userId } : {}),
+                ...(ip !== undefined ? { ip } : {}),
+                detail,
+            });
+        }
+        catch (error) {
+            deps.logger?.warn('Device credential audit write failed', {
+                meta: { error: error instanceof Error ? error.message : String(error) },
+            });
+        }
+    };
+    const assertPerson = (user) => {
+        if (user.isScoped === true || user.shareView !== undefined || user.adminTokenId !== undefined) {
+            throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'Requires a signed-in user session' });
+        }
+    };
+    const selfLimit = (userId, path) => {
+        const verdict = deps.selfLimiter.check(`${path}:${userId}`);
+        if (!verdict.allowed) {
+            throw new server_1.TRPCError({
+                code: 'TOO_MANY_REQUESTS',
+                message: `Too many attempts — retry in ${verdict.retryAfterSeconds}s`,
+            });
+        }
+    };
+    return {
+        /** PUBLIC — redeem a QR enrollment code with the device's PUBLIC key; answers the certificate. */
+        completeEnrollment: deps.publicProcedure
+            .input(types_1.CompleteEnrollmentInputSchema)
+            .output(types_1.CompleteEnrollmentResultSchema)
+            .mutation(async ({ input, ctx }) => {
+            const slow = limited(deps.credentialLimiter, 'completeEnrollment', ctx.req);
+            if (slow !== null)
+                return slow;
+            const issued = await internal().deviceCredentials.completeEnrollment(input);
+            if (!issued.ok)
+                return refusal(toWireReason(issued.reason));
+            await audit('device-credential-enrolled', issued.userId, ctx.req, {
+                credentialId: issued.credentialId,
+                via: 'qr',
+            });
+            return {
+                ok: true,
+                credentialId: issued.credentialId,
+                certPem: issued.certPem,
+                chainPem: issued.chainPem,
+                notAfter: issued.notAfter,
+                user: { id: issued.userId, username: issued.username },
+            };
+        }),
+        /** PUBLIC — a single-use nonce (60 s), bound to the hub origin this request is entitled to. */
+        getDeviceChallenge: deps.publicProcedure
+            .input(zod_1.z.void())
+            .output(types_1.DeviceChallengeResultSchema)
+            .mutation(async ({ ctx }) => {
+            const slow = limited(deps.ceremonyLimiter, 'getDeviceChallenge', ctx.req);
+            if (slow !== null)
+                return slow;
+            // Nonces are bounded per client address. A request whose address cannot be resolved
+            // would share one partition with every other such request, so it gets no nonce.
+            const partition = fromAddress(ctx.req, deps.network);
+            if (partition === undefined) {
+                deps.logger?.warn('Device challenge refused: the client address could not be resolved');
+                return refusal('unavailable');
+            }
+            const origin = await deps.resolveOrigin(ctx.req);
+            if (origin === null)
+                return refusal('unavailable');
+            const { nonce, expiresAt } = internal().deviceCredentials.issueNonce(origin, partition);
+            return { ok: true, nonce, origin, expiresAt, signature: types_1.DEVICE_CERT_SIGNATURE };
+        }),
+        /**
+         * PUBLIC — sign in with the device certificate: chain to the device CA, not
+         * expired, not revoked, a valid signature over `login` + origin + nonce.
+         * Opens the SAME session a password login opens, carrying the credential id.
+         */
+        loginWithDeviceCertificate: deps.publicProcedure
+            .input(types_1.DeviceProofInputSchema.extend({ refreshable: zod_1.z.boolean().optional() }))
+            .output(DeviceLoginResultSchema)
+            .mutation(async ({ input, ctx }) => {
+            const slow = limited(deps.credentialLimiter, 'loginWithDeviceCertificate', ctx.req);
+            if (slow !== null)
+                return slow;
+            const from = fromAddress(ctx.req, deps.network);
+            const checked = await internal().deviceCredentials.authenticate({
+                certPem: input.certPem,
+                nonce: input.nonce,
+                signature: input.signature,
+                purpose: 'login',
+                ...(from !== undefined ? { from } : {}),
+            });
+            if (!checked.ok) {
+                await audit('device-credential-login-refused', undefined, ctx.req, {
+                    reason: checked.reason,
+                });
+                return refusal(toWireReason(checked.reason));
+            }
+            const { credential } = checked;
+            try {
+                const session = await deps.minter.mintForUserId(credential.userId, {
+                    ...deps.issueFor(ctx.req, 'device-certificate', input.refreshable ?? true),
+                    method: 'device-certificate',
+                    credentialId: credential.id,
+                });
+                await audit('device-credential-login', credential.userId, ctx.req, {
+                    credentialId: credential.id,
+                });
+                return {
+                    ok: true,
+                    token: session.token,
+                    user: session.user,
+                    ...(session.expiresAt !== undefined ? { expiresAt: session.expiresAt } : {}),
+                    ...(session.sessionId !== undefined ? { sessionId: session.sessionId } : {}),
+                    ...(session.sessionExpiresAt !== undefined
+                        ? { sessionExpiresAt: session.sessionExpiresAt }
+                        : {}),
+                    ...(session.refreshToken !== undefined ? { refreshToken: session.refreshToken } : {}),
+                    credentialId: credential.id,
+                    certNotAfter: credential.expiresAt,
+                };
+            }
+            catch (error) {
+                if (error instanceof session_mint_js_1.SessionUserGoneError) {
+                    deps.logger?.warn('Device certificate login refused: user-gone', {
+                        tags: { credentialId: credential.id, userId: credential.userId },
+                    });
+                    return refusal('user-gone');
+                }
+                throw error;
+            }
+        }),
+        /** PUBLIC — a new leaf for the SAME public key, while the certificate is valid and not revoked. */
+        renewDeviceCertificate: deps.publicProcedure
+            .input(types_1.DeviceProofInputSchema)
+            .output(types_1.RenewDeviceCertificateResultSchema)
+            .mutation(async ({ input, ctx }) => {
+            const slow = limited(deps.credentialLimiter, 'renewDeviceCertificate', ctx.req);
+            if (slow !== null)
+                return slow;
+            const checked = await internal().deviceCredentials.authenticate({
+                certPem: input.certPem,
+                nonce: input.nonce,
+                signature: input.signature,
+                purpose: 'renew',
+            });
+            if (!checked.ok)
+                return refusal(toWireReason(checked.reason));
+            const renewed = await internal().deviceCredentials.renew(checked.credential);
+            if (!renewed.ok)
+                return refusal(toWireReason(renewed.reason));
+            return {
+                ok: true,
+                credentialId: renewed.credentialId,
+                certPem: renewed.certPem,
+                chainPem: renewed.chainPem,
+                notAfter: renewed.notAfter,
+            };
+        }),
+        /**
+         * PUBLIC — revoke THIS credential, signed with the device key (`revoke`
+         * purpose): works with no session. Ends every session the credential opened.
+         */
+        revokeOwnDeviceCertificate: deps.publicProcedure
+            .input(types_1.DeviceProofInputSchema)
+            .output(types_1.RevokeOwnDeviceCertificateResultSchema)
+            .mutation(async ({ input, ctx }) => {
+            const slow = limited(deps.credentialLimiter, 'revokeOwnDeviceCertificate', ctx.req);
+            if (slow !== null)
+                return slow;
+            const checked = await internal().deviceCredentials.authenticate({
+                certPem: input.certPem,
+                nonce: input.nonce,
+                signature: input.signature,
+                purpose: 'revoke',
+            });
+            if (!checked.ok)
+                return refusal(toWireReason(checked.reason));
+            const id = checked.credential.id;
+            await internal().deviceCredentials.revoke(id, (0, types_1.formatDeviceRevoker)({ kind: 'device' }));
+            const sessionsEnded = await internal().sessions.revokeByCredential(id);
+            await audit('device-credential-revoked', checked.credential.userId, ctx.req, {
+                credentialId: id,
+                by: 'device',
+                sessionsEnded,
+            });
+            return { ok: true, credentialId: id, sessionsEnded };
+        }),
+        // ── Signed-in legs ───────────────────────────────────────────────
+        /** The caller's own device credentials (live ones, and revoked when asked). */
+        listOwnDeviceCredentials: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ includeRevoked: zod_1.z.boolean().optional() }).optional())
+            .output(zod_1.z.array(types_1.DeviceCredentialSchema))
+            .query(({ ctx, input }) => {
+            assertPerson(ctx.user);
+            const manager = internal().deviceCredentials;
+            return manager
+                .list({ userId: ctx.user.id, includeRevoked: input?.includeRevoked ?? false })
+                .map((r) => ({
+                id: r.id,
+                userId: r.userId,
+                username: ctx.user.username,
+                deviceName: r.deviceName,
+                platform: r.platform,
+                enrolledVia: r.enrolledVia,
+                fingerprint: r.fingerprint,
+                issuedAt: r.issuedAt,
+                expiresAt: r.expiresAt,
+                lastUsedAt: r.lastUsedAt,
+                lastUsedFrom: r.lastUsedFrom,
+                revokedAt: r.revokedAt,
+                revokedBy: r.revokedBy,
+                status: r.revokedAt !== null
+                    ? 'revoked'
+                    : r.expiresAt <= Date.now()
+                        ? 'expired'
+                        : 'active',
+            }));
+        }),
+        /** Revoke one of the caller's OWN credentials by id, from a session (e.g. a lost phone). */
+        revokeOwnDeviceCredential: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
+            .output(zod_1.z.object({ revoked: zod_1.z.boolean(), sessionsEnded: zod_1.z.number().int() }))
+            .mutation(async ({ ctx, input }) => {
+            assertPerson(ctx.user);
+            selfLimit(ctx.user.id, 'revokeOwnDeviceCredential');
+            const record = internal().deviceCredentials.get(input.id);
+            // Someone else's credential is indistinguishable from a missing one.
+            if (record === undefined || record.userId !== ctx.user.id) {
+                deps.logger?.warn("Own device credential revoke refused: not the caller's", {
+                    tags: { userId: ctx.user.id, credentialId: input.id },
+                });
+                return { revoked: false, sessionsEnded: 0 };
+            }
+            const revoked = await internal().deviceCredentials.revoke(input.id, (0, types_1.formatDeviceRevoker)({ kind: 'user', userId: ctx.user.id }));
+            const sessionsEnded = await internal().sessions.revokeByCredential(input.id);
+            if (revoked) {
+                await audit('device-credential-revoked', ctx.user.id, ctx.req, {
+                    credentialId: input.id,
+                    by: 'user',
+                    sessionsEnded,
+                });
+            }
+            return { revoked, sessionsEnded };
+        }),
+        /** Step-up, password / passkey: turn a fresh `reauthenticate` proof into a single-use device-enroll proof. */
+        deviceEnrollProofFromReauth: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput }))
+            .output(types_1.DeviceEnrollProofSchema)
+            .mutation(({ ctx, input }) => {
+            assertPerson(ctx.user);
+            selfLimit(ctx.user.id, 'deviceEnrollProofFromReauth');
+            (0, auth_reauth_procedures_js_1.assertReauthenticated)(deps.auth, ctx.user, input.reauthToken);
+            // One reauthentication, one proof (or one step-up handoff code).
+            if (!deps.enrollProofs.consumeReauth(input.reauthToken)) {
+                throw new server_1.TRPCError({
+                    code: 'FORBIDDEN',
+                    message: 'This re-authentication was already used - confirm it is you again',
+                });
+            }
+            return deps.enrollProofs.mint(ctx.user.id);
+        }),
+        /**
+         * Step-up through the app login handoff (any web method: OIDC, passkey, …).
+         * `code` is a handoff code minted with purpose `step-up` by a browser sign-in
+         * of the SAME user. Opens no session and replaces none.
+         */
+        deviceEnrollProofFromHandoff: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({
+            code: zod_1.z.string().min(1).max(256),
+            codeVerifier: zod_1.z.string().min(1).max(256).optional(),
+            state: zod_1.z.string().min(1).max(256).optional(),
+        }))
+            .output(types_1.DeviceEnrollProofSchema)
+            .mutation(({ ctx, input }) => {
+            assertPerson(ctx.user);
+            selfLimit(ctx.user.id, 'deviceEnrollProofFromHandoff');
+            const { grant, reason } = deps.handoffCodes.redeemWithReason(input.code, {
+                ...(input.codeVerifier !== undefined ? { codeVerifier: input.codeVerifier } : {}),
+                ...(input.state !== undefined ? { state: input.state } : {}),
+            });
+            const wrong = grant === null || grant.purpose !== 'step-up' || grant.userId !== ctx.user.id;
+            if (wrong) {
+                deps.logger?.warn('Step-up handoff refused', {
+                    tags: { userId: ctx.user.id },
+                    meta: {
+                        reason: reason ?? (grant?.purpose !== 'step-up' ? 'wrong-purpose' : 'other-user'),
+                    },
+                });
+                throw new server_1.TRPCError({
+                    code: 'UNAUTHORIZED',
+                    message: 'Invalid, expired or mismatched step-up code — sign in again',
+                });
+            }
+            return deps.enrollProofs.mint(ctx.user.id);
+        }),
+        /**
+         * Enroll the CALLER's own device — no QR. Needs a signed-in person AND a
+         * single-use step-up proof (a sign-in made just now, for this same user);
+         * a merely refreshed session can never mint a permanent credential.
+         * Hub-wide `deviceCertificates.selfEnrollment = disabled` refuses.
+         */
+        enrollSelf: trpc_middleware_js_1.protectedProcedure
+            .input(types_1.EnrollSelfInputSchema)
+            .output(types_1.CompleteEnrollmentResultSchema)
+            .mutation(async ({ ctx, input }) => {
+            assertPerson(ctx.user);
+            selfLimit(ctx.user.id, 'enrollSelf');
+            const verdict = deps.enrollProofs.consume(input.proof, ctx.user.id);
+            if (verdict !== 'ok')
+                return refusal('step-up-required');
+            const issued = await internal().deviceCredentials.enrollSelf({
+                userId: ctx.user.id,
+                publicKeySpki: input.publicKeySpki,
+                deviceName: input.deviceName,
+                platform: input.platform,
+            });
+            if (!issued.ok)
+                return refusal(toWireReason(issued.reason));
+            await audit('device-credential-enrolled', ctx.user.id, ctx.req, {
+                credentialId: issued.credentialId,
+                via: 'self',
+            });
+            return {
+                ok: true,
+                credentialId: issued.credentialId,
+                certPem: issued.certPem,
+                chainPem: issued.chainPem,
+                notAfter: issued.notAfter,
+                user: { id: issued.userId, username: issued.username },
+            };
+        }),
+    };
+}

package/dist/api/core/auth-sessions.procedures.js

@@ -4,6 +4,7 @@ exports.RefreshResultSchema = exports.LoginSessionSchema = void 0;
 exports.createSessionProcedures = createSessionProcedures;
 const server_1 = require("@trpc/server");
 const zod_1 = require("zod");
+const types_1 = require("@camstack/types");
 const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
 const session_mint_js_1 = require("../../auth/session-mint.js");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
@@ -30,6 +31,13 @@ exports.RefreshResultSchema = zod_1.z.object({
     sessionExpiresAt: zod_1.z.number(),
     user: zod_1.z.object({ id: zod_1.z.string(), username: zod_1.z.string(), isAdmin: zod_1.z.boolean() }),
 });
+/** Refresh refusals caused by the device credential behind the session, as wire reasons. */
+const DEVICE_REFRESH_REASONS = {
+    'credential-revoked': 'revoked',
+    'credential-expired': 'expired',
+    'credential-unknown': 'unknown-credential',
+    'credential-unavailable': 'unavailable',
+};
 function requireSessions(registry) {
     const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
     if (internal === null) {
@@ -92,8 +100,18 @@ function createSessionProcedures(deps) {
                 };
             }
             catch (error) {
-                if (error instanceof session_mint_js_1.SessionRefreshRefusedError ||
-                    error instanceof session_mint_js_1.SessionUserGoneError) {
+                if (error instanceof session_mint_js_1.SessionRefreshRefusedError) {
+                    // A session opened by a device certificate says WHY, in a typed
+                    // message the app switches on (`deviceRefusalFromMessage`).
+                    const credentialReason = DEVICE_REFRESH_REASONS[error.reason];
+                    throw new server_1.TRPCError({
+                        code: 'UNAUTHORIZED',
+                        message: credentialReason === undefined
+                            ? 'Session expired — sign in again'
+                            : `${types_1.DEVICE_REFRESH_REFUSAL_PREFIX}${credentialReason}`,
+                    });
+                }
+                if (error instanceof session_mint_js_1.SessionUserGoneError) {
                     throw new server_1.TRPCError({
                         code: 'UNAUTHORIZED',
                         message: 'Session expired — sign in again',