@cauthyhq/node 1.2.1 → 1.3.1

package/dist/testing.d.mts

@@ -1,5 +1,4 @@
 import { Server } from 'node:http';
-import { I as Identity } from './identity-BTJ8NB_w.mjs';
 
 declare class FakeCauthy {
     readonly issuer = "https://id.test";
@@ -16,6 +15,7 @@ declare class FakeCauthy {
         sub: string;
         challenge: string;
         redirectUri: string;
+        clientId?: string;
     }>;
     refresh: Map<string, string>;
     access: Map<string, string>;
@@ -41,7 +41,7 @@ declare class FakeCauthy {
     settings: Record<string, unknown>;
     /** The bearer the admin API takes (settings, the application's client, accounts); '' refuses every admin call. */
     adminToken: string;
-    /** The application's client, as the admin API lists it; its allow_persistent_sessions is settings.persistent_sessions. */
+    /** The application's client, as the admin API lists it. */
     clientId: string;
     /** The application's registered origins, as GET /v1/connect/self answers them (app_urls). */
     appUrls: string[];
@@ -49,8 +49,13 @@ declare class FakeCauthy {
     system: string;
     /** The workspace's id, as GET /v1/connect/self answers it. */
     tenantId: string;
-    /** What GET /v1/connect/self answers as `contract`. */
-    contract: Identity['contract'];
+    /**
+     * The client people sign in through, by the key's client, as GET
+     * /v1/connect/self answers it (sign_in_client_id): an application can
+     * have its key on a system client (`pact.<link>.service`) and its people
+     * on another (`pact.<link>`). Absent: the key's own client.
+     */
+    signInClients: Map<string, string>;
     /** Every call to the token and revoke endpoints, with its form and headers: what a test reads of how the application authenticated. */
     oauthRequests: {
         path: string;
@@ -62,6 +67,7 @@ declare class FakeCauthy {
     private jtis;
     private systemTokens;
     private keyClients;
+    private refreshClients;
     constructor();
     /** What the hosted page does once the person has signed in: hands the browser a code. */
     authorize(location: string, sub?: string): string;
@@ -82,7 +88,7 @@ declare class FakeCauthy {
     private assertionOf;
     /** What GET /v1/connect/self answers for a key. */
     private identityOf;
-    /** A token answer. `kind` is what a sign-in asked for (remember) when the client allows long sessions; `persistent` wins when set. */
+    /** A token answer. `kind` is what a sign-in asked for (remember) when the workspace allows long sessions; `persistent` wins when set. */
     private issue;
     fetch: typeof fetch;
     /** The part of /v1/auth/* a password sign-in and the sign-in form read. */

package/dist/testing.d.ts

@@ -1,5 +1,4 @@
 import { Server } from 'node:http';
-import { I as Identity } from './identity-BTJ8NB_w.js';
 
 declare class FakeCauthy {
     readonly issuer = "https://id.test";
@@ -16,6 +15,7 @@ declare class FakeCauthy {
         sub: string;
         challenge: string;
         redirectUri: string;
+        clientId?: string;
     }>;
     refresh: Map<string, string>;
     access: Map<string, string>;
@@ -41,7 +41,7 @@ declare class FakeCauthy {
     settings: Record<string, unknown>;
     /** The bearer the admin API takes (settings, the application's client, accounts); '' refuses every admin call. */
     adminToken: string;
-    /** The application's client, as the admin API lists it; its allow_persistent_sessions is settings.persistent_sessions. */
+    /** The application's client, as the admin API lists it. */
     clientId: string;
     /** The application's registered origins, as GET /v1/connect/self answers them (app_urls). */
     appUrls: string[];
@@ -49,8 +49,13 @@ declare class FakeCauthy {
     system: string;
     /** The workspace's id, as GET /v1/connect/self answers it. */
     tenantId: string;
-    /** What GET /v1/connect/self answers as `contract`. */
-    contract: Identity['contract'];
+    /**
+     * The client people sign in through, by the key's client, as GET
+     * /v1/connect/self answers it (sign_in_client_id): an application can
+     * have its key on a system client (`pact.<link>.service`) and its people
+     * on another (`pact.<link>`). Absent: the key's own client.
+     */
+    signInClients: Map<string, string>;
     /** Every call to the token and revoke endpoints, with its form and headers: what a test reads of how the application authenticated. */
     oauthRequests: {
         path: string;
@@ -62,6 +67,7 @@ declare class FakeCauthy {
     private jtis;
     private systemTokens;
     private keyClients;
+    private refreshClients;
     constructor();
     /** What the hosted page does once the person has signed in: hands the browser a code. */
     authorize(location: string, sub?: string): string;
@@ -82,7 +88,7 @@ declare class FakeCauthy {
     private assertionOf;
     /** What GET /v1/connect/self answers for a key. */
     private identityOf;
-    /** A token answer. `kind` is what a sign-in asked for (remember) when the client allows long sessions; `persistent` wins when set. */
+    /** A token answer. `kind` is what a sign-in asked for (remember) when the workspace allows long sessions; `persistent` wins when set. */
     private issue;
     fetch: typeof fetch;
     /** The part of /v1/auth/* a password sign-in and the sign-in form read. */

package/dist/testing.js

@@ -236,34 +236,19 @@ function constantTimeEqual(a, b) {
   return d === 0;
 }
 
-// src/rootkey.ts
-var encoder = new TextEncoder();
-var MIN_ROOT_KEY = 32;
-async function derive(root, purpose) {
-  const ikm = await crypto.subtle.importKey("raw", encoder.encode(root), "HKDF", false, ["deriveBits"]);
-  const bits = await crypto.subtle.deriveBits(
-    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: encoder.encode(`pact/${purpose}/v1`) },
-    ikm,
-    256
-  );
-  return new Uint8Array(bits);
-}
-function deriveKeys(root, previous) {
-  if (root.length < MIN_ROOT_KEY) {
-    throw new CauthyConfigError(`rootKey (PACT_ROOT_KEY) must be at least ${MIN_ROOT_KEY} characters: 32 random bytes, e.g. openssl rand -base64 32`);
-  }
-  if (previous !== void 0 && previous !== "" && previous.length < MIN_ROOT_KEY) {
-    throw new CauthyConfigError(`the previous root key (PACT_ROOT_KEY_PREVIOUS) must be at least ${MIN_ROOT_KEY} characters`);
-  }
-  const roots = previous && previous !== root ? [root, previous] : [root];
-  const ring = (purpose) => Promise.all(roots.map((r) => derive(r, purpose)));
-  return { seal: ring("seal"), cookie: ring("cookie"), flow: ring("flow") };
-}
-
 // src/keyderive.ts
 var enc2 = new TextEncoder();
 var PKCS8_ED25519 = Uint8Array.from([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32]);
 var ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+async function ringKey(secret, purpose) {
+  const ikm = await crypto.subtle.importKey("raw", enc2.encode(secret), "HKDF", false, ["deriveBits"]);
+  return new Uint8Array(await crypto.subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: enc2.encode(`pact/${purpose}/v1`) },
+    ikm,
+    256
+  ));
+}
+var ringOf = (secrets, purpose) => Promise.all(secrets.map((s) => ringKey(s, purpose)));
 async function seedOf(secret) {
   const ikm = await crypto.subtle.importKey("raw", enc2.encode(secret), "HKDF", false, ["deriveBits"]);
   return new Uint8Array(await crypto.subtle.deriveBits(
@@ -301,17 +286,16 @@ async function signerOf(secret) {
 }
 function deriveFromKey(key, previous) {
   const other = previous && previous.secret !== key.secret ? previous : void 0;
-  const rings = deriveKeys(key.secret, other?.secret);
+  const secrets = other ? [key.secret, other.secret] : [key.secret];
   return {
-    cookie: rings.cookie,
-    flow: rings.flow,
-    signer: signerOf(key.secret),
-    ...other ? { previousJwk: signerOf(other.secret).then((s) => ({ ...s.publicJwk, kid: s.kid })) } : {}
+    cookie: ringOf(secrets, "cookie"),
+    flow: ringOf(secrets, "flow"),
+    signer: signerOf(key.secret)
   };
 }
 
 // src/testing.ts
-var ADMIN_SETTINGS = ["allow_signup", "allow_password", "allow_magic_link", "allow_passkeys", "confirm_email", "verify_grace_days"];
+var ADMIN_SETTINGS = ["allow_signup", "allow_password", "allow_magic_link", "allow_passkeys", "confirm_email", "verify_grace_days", "persistent_sessions"];
 var FakeCauthy = class {
   issuer = "https://id.test";
   users = /* @__PURE__ */ new Map();
@@ -339,7 +323,7 @@ var FakeCauthy = class {
   settings = { allow_password: true, allow_signup: false, allow_passkeys: false, persistent_sessions: false };
   /** The bearer the admin API takes (settings, the application's client, accounts); '' refuses every admin call. */
   adminToken = "";
-  /** The application's client, as the admin API lists it; its allow_persistent_sessions is settings.persistent_sessions. */
+  /** The application's client, as the admin API lists it. */
   clientId = "acme-crm";
   /** The application's registered origins, as GET /v1/connect/self answers them (app_urls). */
   appUrls = ["http://localhost:3000"];
@@ -347,8 +331,13 @@ var FakeCauthy = class {
   system = "acme-crm";
   /** The workspace's id, as GET /v1/connect/self answers it. */
   tenantId = "t-acme";
-  /** What GET /v1/connect/self answers as `contract`. */
-  contract = null;
+  /**
+   * The client people sign in through, by the key's client, as GET
+   * /v1/connect/self answers it (sign_in_client_id): an application can
+   * have its key on a system client (`pact.<link>.service`) and its people
+   * on another (`pact.<link>`). Absent: the key's own client.
+   */
+  signInClients = /* @__PURE__ */ new Map();
   /** Every call to the token and revoke endpoints, with its form and headers: what a test reads of how the application authenticated. */
   oauthRequests = [];
   n = 0;
@@ -357,6 +346,8 @@ var FakeCauthy = class {
   systemTokens = /* @__PURE__ */ new Map();
   // access token → kid
   keyClients = /* @__PURE__ */ new Set();
+  refreshClients = /* @__PURE__ */ new Map();
+  // refresh token → the client it was issued to
   constructor() {
     this.users.set("u1", { sub: "u1", email: "ana@acme.com", name: "Ana", active: true, restricted: false });
   }
@@ -365,7 +356,7 @@ var FakeCauthy = class {
     const q = new URL(location).searchParams;
     if (q.get("response_type") !== "code") throw new Error("Cauthy answers unsupported_response_type: response_type=code is required");
     const code = `code-${++this.n}`;
-    this.codes.set(code, { sub, challenge: q.get("code_challenge") ?? "", redirectUri: q.get("redirect_uri") ?? "" });
+    this.codes.set(code, { sub, challenge: q.get("code_challenge") ?? "", redirectUri: q.get("redirect_uri") ?? "", clientId: q.get("client_id") ?? void 0 });
     return `${q.get("redirect_uri")}?code=${code}&state=${q.get("state")}`;
   }
   /**
@@ -430,19 +421,19 @@ var FakeCauthy = class {
       tenant: { id: this.tenantId, slug: this.tenant },
       system: this.system,
       client_id: k.clientId,
-      sign_in_client_id: k.clientId,
+      sign_in_client_id: this.signInClients.get(k.clientId) ?? k.clientId,
       app_urls: [...this.appUrls],
       callback_path: "/api/auth/callback",
-      key: { kid, retires_at: null },
-      contract: this.contract
+      key: { kid, retires_at: null }
     };
   }
-  /** A token answer. `kind` is what a sign-in asked for (remember) when the client allows long sessions; `persistent` wins when set. */
-  issue(sub, kind) {
+  /** A token answer. `kind` is what a sign-in asked for (remember) when the workspace allows long sessions; `persistent` wins when set. */
+  issue(sub, kind, clientId) {
     const at = `at-${++this.n}`;
     const rt = `rt-${++this.n}`;
     this.access.set(at, sub);
     this.refresh.set(rt, sub);
+    if (clientId) this.refreshClients.set(rt, clientId);
     const persistent = this.persistent ?? kind;
     return { access_token: at, refresh_token: rt, token_type: "Bearer", expires_in: this.expiresIn, scope: "", ...persistent === void 0 ? {} : { persistent } };
   }
@@ -488,14 +479,20 @@ var FakeCauthy = class {
         this.codes.delete(form.get("code") ?? "");
         const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(form.get("code_verifier") ?? ""));
         const challenge = btoa(String.fromCharCode(...new Uint8Array(digest))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-        if (!c || c.challenge !== challenge || c.redirectUri !== form.get("redirect_uri")) return reply(400, { error: "invalid_grant", error_description: "the grant is invalid, expired or already used" });
-        return reply(200, this.issue(c.sub));
+        const wrongClient = c?.clientId !== void 0 && c.clientId !== form.get("client_id");
+        if (!c || wrongClient || c.challenge !== challenge || c.redirectUri !== form.get("redirect_uri")) return reply(400, { error: "invalid_grant", error_description: "the grant is invalid, expired or already used" });
+        return reply(200, this.issue(c.sub, void 0, form.get("client_id") ?? void 0));
       }
       if (form.get("grant_type") === "refresh_token") {
-        const sub2 = this.refresh.get(form.get("refresh_token") ?? "");
-        this.refresh.delete(form.get("refresh_token") ?? "");
-        if (!sub2 || !this.users.get(sub2)?.active) return reply(400, { error: "invalid_grant", error_description: "the grant is invalid, expired or already used" });
-        return reply(200, this.issue(sub2));
+        const rt = form.get("refresh_token") ?? "";
+        const sub2 = this.refresh.get(rt);
+        const owner = this.refreshClients.get(rt);
+        this.refresh.delete(rt);
+        this.refreshClients.delete(rt);
+        if (!sub2 || !this.users.get(sub2)?.active || owner !== void 0 && owner !== form.get("client_id")) {
+          return reply(400, { error: "invalid_grant", error_description: "the grant is invalid, expired or already used" });
+        }
+        return reply(200, this.issue(sub2, void 0, owner ?? form.get("client_id") ?? void 0));
       }
       return reply(400, { error: "unsupported_grant_type", error_description: "supported grant types: authorization_code, refresh_token" });
     }
@@ -586,13 +583,18 @@ function adminAnswer(fake, url, init) {
     fake.settings = next;
     return reply(200, { data: fake.settings });
   }
-  const persistent = () => fake.settings.persistent_sessions === true;
-  if (route === "GET /v1/oauth/clients") return reply(200, { data: [{ client_id: fake.clientId, allow_persistent_sessions: persistent() }], total_count: 1 });
+  if (route === "GET /v1/oauth/clients") return reply(200, { data: [{ client_id: fake.clientId }], total_count: 1 });
   if (client) {
     if (decodeURIComponent(client[1]) !== fake.clientId) return refuse(404, "client_not_found", "no such client");
     const change = JSON.parse(String(init?.body ?? "{}"));
-    if (typeof change.allow_persistent_sessions === "boolean") fake.settings = { ...fake.settings, persistent_sessions: change.allow_persistent_sessions };
-    return reply(200, { data: { client_id: fake.clientId, allow_persistent_sessions: persistent() } });
+    if (change.allow_persistent_sessions !== void 0 && change.allow_persistent_sessions !== null) {
+      return refuse(
+        400,
+        "persistent_sessions_moved",
+        "allow_persistent_sessions is no longer a client's: it is the workspace's persistent_sessions (PUT /v1/settings/auth)"
+      );
+    }
+    return reply(200, { data: { client_id: fake.clientId } });
   }
   if (route === "GET /v1/users") {
     const q = (url.searchParams.get("q") ?? "").toLowerCase();