@camstack/server 1.2.563 → 1.2.565

package/dist/api/core/auth.router.js

@@ -23,6 +23,7 @@ const zod_1 = require("zod");
 const auth_network_policy_js_1 = require("../../auth/auth-network-policy.js");
 const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
 const auth_provider_gate_js_1 = require("../../auth/auth-provider-gate.js");
+const device_enroll_proofs_js_1 = require("../../auth/device-enroll-proofs.js");
 const external_link_intents_js_1 = require("../../auth/external-link-intents.js");
 const passkey_provider_js_1 = require("../../auth/passkey-provider.js");
 const second_factors_js_1 = require("../../auth/second-factors.js");
@@ -37,6 +38,7 @@ const auth_limits_js_1 = require("./auth-limits.js");
 const auth_admin_tokens_procedures_js_1 = require("./auth-admin-tokens.procedures.js");
 const auth_revoke_credentials_procedures_js_1 = require("./auth-revoke-credentials.procedures.js");
 const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
+const auth_device_cert_procedures_js_1 = require("./auth-device-cert.procedures.js");
 const auth_sessions_procedures_js_1 = require("./auth-sessions.procedures.js");
 /**
  * A public procedure limited per (procedure, REAL client address) — see
@@ -48,6 +50,10 @@ function makeRateLimitedProcedure(limiter, network) {
         return next({ ctx });
     });
 }
+/** A step-up's sign-in may be at most this old (D855). */
+const STEP_UP_FRESH_MS = 120_000;
+/** Login methods that count as an authentication (a handoff / exchange / certificate session does not). */
+const STEP_UP_LOGIN_METHODS = ['password', 'passkey', 'sso'];
 /** Asks for the refresh-token flow (short access token + rotating refresh token). */
 const RefreshableInput = zod_1.z.boolean().optional();
 /** The request's User-Agent, trimmed, for the sessions list. */
@@ -140,6 +146,7 @@ const PublicLoginMethodSchema = zod_1.z.discriminatedUnion('kind', [
     types_1.RedirectLoginMethodSchema,
     PublicWidgetLoginMethodSchema,
     types_1.PasskeyLoginMethodSchema,
+    types_1.DeviceCertificateLoginMethodSchema,
 ]);
 /** One of the caller's linked sign-in identities, as the profile shows it (D782). */
 const OwnExternalIdentitySchema = zod_1.z.object({
@@ -304,6 +311,11 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         signer: auth,
         directory: () => registry?.getSingleton('user-management'),
         ...(options.sessions !== undefined ? { sessions: options.sessions } : {}),
+        credentials: options.credentials ??
+            (() => {
+                const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
+                return internal === null ? null : internal.deviceCredentials;
+            }),
     });
     const findUserById = minter.findUser;
     /** How THIS request's login is recorded on its session. */
@@ -375,6 +387,71 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
      * contributions (D777), validated and deduplicated. Shared by
      * `listLoginMethods` and the D782 linking procedures.
      */
+    /**
+     * The hub origin a device-certificate challenge is bound to: the origin the
+     * request CLAIMS when the hub advertises it (Network page / address book),
+     * else the public endpoint — never a forged `Host` (same rule as the OIDC
+     * return, D791).
+     */
+    const resolveDeviceOrigin = options.resolveOrigin ??
+        (async (req) => {
+            const provider = registry?.getSingleton('local-network');
+            if (!provider)
+                return null;
+            const book = await provider.getAddresses({});
+            const headers = {};
+            for (const [name, value] of Object.entries(req?.headers ?? {})) {
+                headers[name.toLowerCase()] = Array.isArray(value) ? value[0] : value;
+            }
+            const picked = (0, types_1.pickRequestOrigin)(headers, (0, types_1.advertisedHubOrigins)(book));
+            return (picked ??
+                book.roles.publicEndpoint.resolved ??
+                book.roles.appConnections.resolved[0] ??
+                null);
+        });
+    const enrollProofs = options.enrollProofs ?? new device_enroll_proofs_js_1.DeviceEnrollProofs(Date.now, options.logger ?? null);
+    /** The device credential behind a session, so a session minted FROM it inherits it (D855). */
+    const credentialOfSession = (sessionId) => {
+        if (sessionId === undefined || registry === null)
+            return undefined;
+        const check = (0, hub_sessions_js_1.userManagementInternal)(registry)?.sessions.check(sessionId);
+        return check?.state === 'active' ? (check.session.credentialId ?? undefined) : undefined;
+    };
+    /**
+     * A step-up (the proof that lets a device enroll itself) needs an
+     * authentication that JUST happened - never a session that merely exists:
+     *  - a single-use `reauthToken` (password / passkey re-authentication), or
+     *  - a session that was OPENED by a primary login (password, passkey, SSO)
+     *    at most {@link STEP_UP_FRESH_MS} ago, once. A session born of a handoff,
+     *    a cookie exchange or a device certificate is not an authentication.
+     */
+    const assertFreshAuthentication = (user, reauthToken) => {
+        const refuse = (message) => {
+            options.logger?.warn(`Step-up refused: ${message}`, { tags: { userId: user.id } });
+            throw new server_1.TRPCError({ code: 'FORBIDDEN', message: `Sign in again first: ${message}` });
+        };
+        if (reauthToken !== undefined) {
+            (0, auth_reauth_procedures_js_1.assertReauthenticated)(auth, user, reauthToken);
+            if (!enrollProofs.consumeReauth(reauthToken))
+                refuse('that confirmation was already used');
+            return;
+        }
+        const sid = user.sessionId;
+        const check = sid === undefined || registry === null
+            ? null
+            : (0, hub_sessions_js_1.userManagementInternal)(registry)?.sessions.check(sid);
+        if (check?.state !== 'active')
+            return refuse('no live session');
+        if (!STEP_UP_LOGIN_METHODS.includes(check.session.method)) {
+            return refuse('this session was not opened by a sign-in');
+        }
+        if (Date.now() - check.session.createdAt > STEP_UP_FRESH_MS) {
+            return refuse('the sign-in is too old');
+        }
+        if (sid === undefined || !enrollProofs.claimFreshSession(sid, check.session.createdAt)) {
+            return refuse('this sign-in already started a step-up');
+        }
+    };
     const aggregateLoginMethods = async () => {
         if (!registry)
             return [];
@@ -436,6 +513,24 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 }
             }
         }
+        // The hub's own method (D855): a device certificate. Not an addon
+        // contribution - the device CA lives in `local-auth` - so it is added here.
+        // Offered only where the hub can actually serve it (local-auth up).
+        if ((0, hub_sessions_js_1.userManagementInternal)(registry) !== null)
+            out.push({
+                kind: 'device-certificate',
+                id: 'device-certificate',
+                label: 'This device',
+                stage: 'primary',
+                challengePath: 'auth.getDeviceChallenge',
+                loginPath: 'auth.loginWithDeviceCertificate',
+                renewPath: 'auth.renewDeviceCertificate',
+                revokePath: 'auth.revokeOwnDeviceCertificate',
+                enrollSelfPath: 'auth.enrollSelf',
+                signature: types_1.DEVICE_CERT_SIGNATURE,
+                messageVersion: types_1.DEVICE_SIGNATURE_MESSAGE_VERSION,
+                clients: ['native'],
+            });
         return out;
     };
     /**
@@ -709,7 +804,10 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             }
             // A session of its own for the client that asked (the hub-served
             // viewer): signing out of one never signs the other out.
-            return mintSessionOrUnauthorized(payload.userId, issueFor(ctx.req, 'exchange', input?.refreshable));
+            return mintSessionOrUnauthorized(payload.userId, {
+                ...issueFor(ctx.req, 'exchange', input?.refreshable),
+                ...(payload.cid !== undefined ? { credentialId: payload.cid } : {}),
+            });
         }),
         // ── One-time handoff codes (native-app login handoff) ─────────────
         //
@@ -722,26 +820,90 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          *  sessions only — scoped (`cst_`) and share-view (`csv_`) callers
          *  must never convert themselves into a full session. */
         createHandoffCode: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ purpose: zod_1.z.enum(['renew', 'new-session']).optional() }).optional())
+            .input(zod_1.z
+            .object({
+            purpose: zod_1.z.enum(['renew', 'new-session', 'step-up']).optional(),
+            /** PKCE S256 challenge of the app's verifier: redeem then requires the verifier. */
+            codeChallenge: zod_1.z.string().min(43).max(128).optional(),
+            /** The app's anti-CSRF state, required again at redeem. */
+            state: zod_1.z.string().min(1).max(256).optional(),
+            /** `step-up`: a fresh single-use re-authentication, when the session itself is not a fresh sign-in. */
+            reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional(),
+        })
+            .optional())
             .output(zod_1.z.object({ code: zod_1.z.string(), expiresAt: zod_1.z.number() }))
             .mutation(({ ctx, input }) => {
             assertRealUserSession(ctx.user, 'Handoff-code minting');
+            const purpose = input?.purpose ?? 'renew';
+            // A code that ends at an app callback is PKCE-bound and state-bound, always.
+            // Only the legacy `renew` pair (installed viewers renewing their own session)
+            // may omit them; it ends with D812's retirement of the `renew` handoff.
+            if (purpose !== 'renew' &&
+                (input?.codeChallenge === undefined || input?.state === undefined)) {
+                options.logger?.warn('Handoff code refused: PKCE challenge and state are required', {
+                    tags: { userId: ctx.user.id },
+                    meta: { purpose },
+                });
+                throw new server_1.TRPCError({
+                    code: 'BAD_REQUEST',
+                    message: 'codeChallenge (S256) and state are required for this handoff',
+                });
+            }
+            if (purpose === 'step-up')
+                assertFreshAuthentication(ctx.user, input?.reauthToken);
             // `renew` (the default — what installed viewer apps call this for)
             // continues THIS session; `new-session` (signing the native app in)
             // opens a separate one for the redeemer.
+            const credentialId = credentialOfSession(ctx.user.sessionId);
             return handoffCodes.create(ctx.user.id, {
                 ...(ctx.user.sessionId !== undefined ? { sessionId: ctx.user.sessionId } : {}),
-                purpose: input?.purpose ?? 'renew',
+                ...(credentialId !== undefined ? { credentialId } : {}),
+                purpose,
+                ...(input?.codeChallenge !== undefined ? { codeChallenge: input.codeChallenge } : {}),
+                ...(input?.state !== undefined ? { state: input.state } : {}),
             });
         }),
         /** PUBLIC — redeem a one-time handoff code for a session bearer.
          *  Unknown / expired / already-used codes → UNAUTHORIZED. */
         redeemHandoffCode: credentialProcedure
-            .input(zod_1.z.object({ code: zod_1.z.string().min(1), refreshable: RefreshableInput }))
+            .input(zod_1.z.object({
+            code: zod_1.z.string().min(1),
+            refreshable: RefreshableInput,
+            /** PKCE: required when the code was minted with a `codeChallenge`. */
+            codeVerifier: zod_1.z.string().min(1).max(256).optional(),
+            state: zod_1.z.string().min(1).max(256).optional(),
+        }))
             .output(LoginResultSchema)
             .mutation(async ({ input, ctx }) => {
-            const grant = handoffCodes.redeem(input.code);
-            if (!grant) {
+            const redeemed = handoffCodes.redeemWithReason(input.code, {
+                ...(input.codeVerifier !== undefined ? { codeVerifier: input.codeVerifier } : {}),
+                ...(input.state !== undefined ? { state: input.state } : {}),
+            });
+            const grant = redeemed.grant;
+            // A step-up code only ever yields a device-enroll proof (at
+            // `deviceEnrollProofFromHandoff`), never a session.
+            if (grant !== null && grant.purpose === 'step-up') {
+                options.logger?.warn('Handoff redeem refused: a step-up code is not a login code', {
+                    tags: { userId: grant.userId },
+                });
+            }
+            else if (grant === null) {
+                options.logger?.warn('Handoff redeem refused', {
+                    meta: { reason: redeemed.reason ?? 'unknown' },
+                });
+            }
+            if (!grant || grant.purpose === 'step-up') {
+                throw new server_1.TRPCError({
+                    code: 'UNAUTHORIZED',
+                    message: 'Invalid or expired handoff code',
+                });
+            }
+            // A `renew` code continues THE SESSION IT WAS MINTED FROM. One without a session would
+            // open a brand-new session with no PKCE behind it: refused.
+            if (grant.purpose === 'renew' && grant.sessionId === undefined) {
+                options.logger?.warn('Handoff redeem refused: a renew code with no session behind it', {
+                    tags: { userId: grant.userId },
+                });
                 throw new server_1.TRPCError({
                     code: 'UNAUTHORIZED',
                     message: 'Invalid or expired handoff code',
@@ -764,7 +926,11 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     throw error;
                 }
             }
-            return mintSessionOrUnauthorized(grant.userId, issueFor(ctx.req, 'handoff', input.refreshable));
+            return mintSessionOrUnauthorized(grant.userId, {
+                ...issueFor(ctx.req, 'handoff', input.refreshable),
+                // Minted FROM a credential session: the child dies with the credential.
+                ...(grant.credentialId !== undefined ? { credentialId: grant.credentialId } : {}),
+            });
         }),
         me: trpc_middleware_js_1.protectedProcedure
             .input(zod_1.z.void())
@@ -1137,6 +1303,21 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             return records.map(toShareTokenSummary);
         }),
         ...(0, auth_sessions_procedures_js_1.createSessionProcedures)({ registry, minter, credentialProcedure }),
+        ...(0, auth_device_cert_procedures_js_1.createDeviceCertProcedures)({
+            registry,
+            minter,
+            publicProcedure: trpc_middleware_js_1.publicProcedure,
+            auth,
+            credentialLimiter: limiters.credential,
+            ceremonyLimiter: limiters.ceremony,
+            selfLimiter: SELF_CODE_LIMITER,
+            ...(options.logger !== undefined ? { logger: options.logger } : {}),
+            network,
+            enrollProofs,
+            handoffCodes,
+            resolveOrigin: resolveDeviceOrigin,
+            issueFor,
+        }),
         ...(0, auth_reauth_procedures_js_1.createReauthProcedures)({ auth, registry, moleculer, limiters }),
         ...(0, auth_admin_tokens_procedures_js_1.createAdminTokenProcedures)({ auth, registry, network }),
         ...(0, auth_revoke_credentials_procedures_js_1.createRevokeCredentialsProcedures)({ registry, shareTokens, network }),
@@ -1241,8 +1422,10 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     message: 'Browser handoff is not available',
                 });
             }
+            const parentCredential = credentialOfSession(ctx.user.sessionId);
             const { code, expiresAt } = nativeLink.browserHandoffs.create(ctx.user.id, {
                 purpose: 'new-session',
+                ...(parentCredential !== undefined ? { credentialId: parentCredential } : {}),
             });
             return { path: `${exports.BROWSER_HANDOFF_PATH}?code=${encodeURIComponent(code)}`, expiresAt };
         }),