@cboxdk/id-js 0.1.0

package/dist/index.js

@@ -0,0 +1,3 @@
+export { AuthenticationError, CboxIdClient, CboxIdError, ConfigurationError, InvalidStateError, VaultClient, challenge, createVerifier, randomToken, verifyWebhook } from './chunk-D4OUHK6N.js';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/nextjs.cjs

@@ -0,0 +1,570 @@
+'use strict';
+
+var server = require('next/server');
+var jose = require('jose');
+
+// src/nextjs.ts
+
+// src/errors.ts
+var CboxIdError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = new.target.name;
+  }
+};
+var ConfigurationError = class extends CboxIdError {
+};
+var InvalidStateError = class extends CboxIdError {
+};
+var AuthenticationError = class extends CboxIdError {
+};
+
+// src/discovery.ts
+var Discovery = class {
+  constructor(issuer, timeoutMs, cacheTtlMs, now = Date.now) {
+    this.issuer = issuer;
+    this.timeoutMs = timeoutMs;
+    this.cacheTtlMs = cacheTtlMs;
+    this.now = now;
+  }
+  issuer;
+  timeoutMs;
+  cacheTtlMs;
+  now;
+  cached = null;
+  async document() {
+    if (this.cached && this.cached.expiresAt > this.now()) {
+      return this.cached.doc;
+    }
+    const url = `${this.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let doc;
+    try {
+      const response = await fetch(url, { signal: controller.signal });
+      if (!response.ok) {
+        throw new AuthenticationError(`Discovery request failed with status ${response.status}.`);
+      }
+      doc = await response.json();
+    } catch (error) {
+      if (error instanceof AuthenticationError) {
+        throw error;
+      }
+      throw new AuthenticationError(`Discovery request failed: ${String(error)}`);
+    } finally {
+      clearTimeout(timer);
+    }
+    if (typeof doc.issuer !== "string" || doc.issuer === "") {
+      throw new AuthenticationError("The discovery document was missing an issuer.");
+    }
+    this.cached = { doc, expiresAt: this.now() + this.cacheTtlMs };
+    return doc;
+  }
+  /** A required endpoint from the discovery document. */
+  async endpoint(name) {
+    const value = (await this.document())[name];
+    if (typeof value !== "string" || value === "") {
+      throw new ConfigurationError(`The instance does not advertise a ${name}.`);
+    }
+    return value;
+  }
+  /** An optional endpoint, or null when the instance advertises none. */
+  async optionalEndpoint(name) {
+    const value = (await this.document())[name];
+    return typeof value === "string" && value !== "" ? value : null;
+  }
+};
+
+// src/pkce.ts
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken(bytes = 32) {
+  return base64url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+function createVerifier() {
+  return randomToken(32);
+}
+async function challenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64url(new Uint8Array(digest));
+}
+
+// src/vault.ts
+var VaultClient = class {
+  constructor(issuer, token, timeoutMs = 1e4) {
+    this.token = token;
+    this.timeoutMs = timeoutMs;
+    this.base = `${issuer.replace(/\/$/, "")}/api/v1/vault`;
+  }
+  token;
+  timeoutMs;
+  base;
+  /** Ingest a downstream credential, sealed at rest (scope `vault.manage`). */
+  store(input) {
+    return this.json("POST", "/secrets", {
+      name: input.name,
+      provider: input.provider,
+      secret: input.secret,
+      owner_type: input.ownerType,
+      owner_id: input.ownerId,
+      expires_at: input.expiresAt
+    });
+  }
+  /** Rotate a secret's value, keeping its id and grants (scope `vault.manage`). */
+  rotate(secretId, secret) {
+    return this.json("POST", `/secrets/${encodeURIComponent(secretId)}/rotate`, { secret });
+  }
+  /** Revoke a secret permanently (scope `vault.manage`). */
+  async revoke(secretId) {
+    await this.request("DELETE", `/secrets/${encodeURIComponent(secretId)}`);
+  }
+  /** Authorize an agent client to lease a secret (scope `vault.manage`). */
+  grant(secretId, clientId, maxTtlSeconds) {
+    return this.json("POST", `/secrets/${encodeURIComponent(secretId)}/grants`, {
+      client_id: clientId,
+      max_ttl_seconds: maxTtlSeconds
+    }).then((raw) => {
+      const r = raw;
+      return { secretId: r.secret_id, clientId: r.client_id, maxTtlSeconds: r.max_ttl_seconds };
+    });
+  }
+  /** Revoke an agent's authorization (scope `vault.manage`). */
+  async revokeGrant(secretId, clientId) {
+    await this.request(
+      "DELETE",
+      `/secrets/${encodeURIComponent(secretId)}/grants/${encodeURIComponent(clientId)}`
+    );
+  }
+  /**
+   * Redeem a leased credential for immediate use (scope `vault.lease`). The caller
+   * is identified by the token's client; a lease with no live grant is refused.
+   */
+  lease(secretId, purpose) {
+    return this.json("POST", `/secrets/${encodeURIComponent(secretId)}/lease`, { purpose }).then((raw) => {
+      const r = raw;
+      return { secretId: r.secret_id, provider: r.provider, secret: r.secret, expiresAt: r.expires_at };
+    });
+  }
+  async json(method, path, body) {
+    const response = await this.request(method, path, body);
+    return await response.json();
+  }
+  async request(method, path, body) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    try {
+      const init = {
+        method,
+        headers: {
+          authorization: `Bearer ${this.token}`,
+          ...body ? { "content-type": "application/json" } : {}
+        },
+        signal: controller.signal
+      };
+      if (body) {
+        init.body = JSON.stringify(body);
+      }
+      const response = await fetch(`${this.base}${path}`, init);
+      if (!response.ok) {
+        throw new AuthenticationError(`Vault ${method} ${path} failed with status ${response.status}.`);
+      }
+      return response;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+
+// src/webhook.ts
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let mismatch = 0;
+  for (let i = 0; i < a.length; i++) {
+    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+function toHex(bytes) {
+  return Array.from(new Uint8Array(bytes)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function verifyWebhook(options) {
+  const { payload, signatureHeader, secret } = options;
+  const toleranceSeconds = options.toleranceSeconds ?? 300;
+  const now = options.now ?? Math.floor(Date.now() / 1e3);
+  if (!signatureHeader) {
+    return false;
+  }
+  const parts = {};
+  for (const segment of signatureHeader.split(",")) {
+    const [key2, value] = segment.trim().split("=", 2);
+    if (key2) {
+      parts[key2] = value ?? "";
+    }
+  }
+  const timestamp = parts["t"] ?? "";
+  const signature = parts["v1"] ?? "";
+  if (timestamp === "" || signature === "" || !/^\d+$/.test(timestamp)) {
+    return false;
+  }
+  if (Math.abs(now - Number(timestamp)) > toleranceSeconds) {
+    return false;
+  }
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const expected = toHex(
+    await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${timestamp}.${payload}`))
+  );
+  return timingSafeEqual(expected, signature);
+}
+
+// src/client.ts
+var CboxIdClient = class {
+  constructor(config) {
+    this.config = config;
+    if (!config.issuer) {
+      throw new ConfigurationError("Cbox ID config `issuer` is required.");
+    }
+    if (!config.clientId) {
+      throw new ConfigurationError("Cbox ID config `clientId` is required.");
+    }
+    if (!config.redirectUri) {
+      throw new ConfigurationError("Cbox ID config `redirectUri` is required.");
+    }
+    this.discovery = new Discovery(
+      config.issuer,
+      config.timeoutMs ?? 1e4,
+      config.cacheTtlMs ?? 36e5
+    );
+  }
+  config;
+  discovery;
+  jwksByUri = /* @__PURE__ */ new Map();
+  /**
+   * Begin login. Returns the authorize URL plus the `state`, `codeVerifier` and
+   * `nonce` — persist those (signed, httpOnly cookies are ideal) and hand them back
+   * to {@link authenticate} on the callback.
+   */
+  async createAuthorizationRequest(options = {}) {
+    const codeVerifier = createVerifier();
+    const state = options.state ?? randomToken(16);
+    const nonce = randomToken(16);
+    const params = new URLSearchParams({
+      response_type: "code",
+      client_id: this.config.clientId,
+      redirect_uri: options.redirectUri ?? this.config.redirectUri,
+      scope: (options.scopes ?? this.scopes()).join(" "),
+      state,
+      nonce,
+      code_challenge: await challenge(codeVerifier),
+      code_challenge_method: "S256"
+    });
+    if (options.prompt) {
+      params.set("prompt", options.prompt);
+    }
+    if (options.loginHint) {
+      params.set("login_hint", options.loginHint);
+    }
+    const endpoint = await this.discovery.endpoint("authorization_endpoint");
+    return { url: `${endpoint}?${params.toString()}`, state, codeVerifier, nonce };
+  }
+  /**
+   * Complete login on your callback route: verify state, exchange the code with the
+   * PKCE verifier, verify the id_token, and return the authenticated user.
+   *
+   * @throws InvalidStateError when state does not match (forged/stale request)
+   * @throws AuthenticationError on any other failure
+   */
+  async authenticate(input) {
+    const { params, stored } = input;
+    if (!params.state || !stored.state || !timingSafeEqualString(params.state, stored.state)) {
+      throw new InvalidStateError("The login state did not match \u2014 the request may be forged or stale.");
+    }
+    if (params.error) {
+      throw new AuthenticationError(
+        `Cbox ID returned an error: ${params.error}${params.error_description ? ` (${params.error_description})` : ""}`
+      );
+    }
+    if (!params.code) {
+      throw new AuthenticationError("The callback was missing an authorization code.");
+    }
+    const tokens = await this.exchange(params.code, stored.codeVerifier, input.redirectUri);
+    if (!tokens.access_token) {
+      throw new AuthenticationError("No access token was returned.");
+    }
+    let claims = {};
+    if (tokens.id_token) {
+      claims = await this.verifyIdToken(tokens.id_token, stored.nonce);
+    }
+    claims = { ...claims, ...await this.userinfo(tokens.access_token) };
+    const sub = claims["sub"];
+    if (typeof sub !== "string" || sub === "") {
+      throw new AuthenticationError("The verified token carried no subject.");
+    }
+    return {
+      id: sub,
+      email: typeof claims["email"] === "string" ? claims["email"] : null,
+      name: typeof claims["name"] === "string" ? claims["name"] : null,
+      organizationId: typeof claims["org"] === "string" ? claims["org"] : null,
+      claims,
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token ?? null,
+      idToken: tokens.id_token ?? null,
+      expiresIn: typeof tokens.expires_in === "number" ? tokens.expires_in : 0
+    };
+  }
+  /**
+   * The URL of the instance's hosted account/profile page (self-service password,
+   * MFA, passkeys, sessions). A signed-in user is authenticated there by their Cbox
+   * ID session; `returnTo` is passed so the page can link back to your app.
+   */
+  profileUrl(returnTo) {
+    const base = `${this.config.issuer.replace(/\/$/, "")}${this.accountPath()}`;
+    return returnTo ? `${base}?${new URLSearchParams({ return_to: returnTo }).toString()}` : base;
+  }
+  /** The RP-initiated logout URL, or null when the instance advertises none. */
+  async logoutUrl(returnTo) {
+    const endpoint = await this.discovery.optionalEndpoint("end_session_endpoint");
+    if (!endpoint) {
+      return null;
+    }
+    return returnTo ? `${endpoint}?${new URLSearchParams({ post_logout_redirect_uri: returnTo }).toString()}` : endpoint;
+  }
+  /**
+   * A machine (client-credentials) access token for calling Cbox ID APIs as your
+   * app, not on a user's behalf. Requires a client secret.
+   */
+  async machineToken(options = {}) {
+    const body = new URLSearchParams({
+      grant_type: "client_credentials",
+      client_id: this.config.clientId,
+      client_secret: this.requireSecret()
+    });
+    if (options.scopes && options.scopes.length > 0) {
+      body.set("scope", options.scopes.join(" "));
+    }
+    if (options.resource) {
+      body.set("resource", options.resource);
+    }
+    const response = await this.post(await this.discovery.endpoint("token_endpoint"), body);
+    if (!response.ok) {
+      throw new AuthenticationError(`Machine token request failed: ${await response.text()}`);
+    }
+    const json = await response.json();
+    if (typeof json.access_token !== "string") {
+      throw new AuthenticationError("The token response had no access_token.");
+    }
+    return json.access_token;
+  }
+  /** The OIDC userinfo claims for an access token. */
+  async userinfo(accessToken) {
+    const endpoint = await this.discovery.optionalEndpoint("userinfo_endpoint");
+    if (!endpoint) {
+      return {};
+    }
+    const response = await this.fetchWithTimeout(endpoint, {
+      headers: { authorization: `Bearer ${accessToken}` }
+    });
+    if (!response.ok) {
+      throw new AuthenticationError("Userinfo request failed.");
+    }
+    return await response.json();
+  }
+  /**
+   * RFC 7662 token introspection (confidential-client auth). Returns the raw
+   * response; `active` tells you if the token is currently valid. Requires a secret.
+   */
+  async introspect(token) {
+    const endpoint = await this.discovery.endpoint("introspection_endpoint");
+    const basic = btoa(`${this.config.clientId}:${this.requireSecret()}`);
+    const response = await this.post(
+      endpoint,
+      new URLSearchParams({ token }),
+      { authorization: `Basic ${basic}` }
+    );
+    if (!response.ok) {
+      throw new AuthenticationError("Introspection request failed.");
+    }
+    return await response.json();
+  }
+  /** Verify a Cbox ID webhook / inline-action signature. See {@link verifyWebhook}. */
+  verifyWebhook(options) {
+    return verifyWebhook(options);
+  }
+  /**
+   * A Token Vault client bound to an access token. Obtain the token with
+   * {@link machineToken} (scope `vault.manage` to provision/grant, `vault.lease` to
+   * redeem), then call `store` / `grant` / `lease` etc.
+   */
+  vault(accessToken) {
+    return new VaultClient(this.config.issuer, accessToken, this.config.timeoutMs ?? 1e4);
+  }
+  async exchange(code, verifier, redirectUri) {
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: redirectUri ?? this.config.redirectUri,
+      client_id: this.config.clientId,
+      code_verifier: verifier
+    });
+    if (this.config.clientSecret) {
+      body.set("client_secret", this.config.clientSecret);
+    }
+    const response = await this.post(await this.discovery.endpoint("token_endpoint"), body);
+    if (!response.ok) {
+      throw new AuthenticationError(`Token exchange failed: ${await response.text()}`);
+    }
+    return await response.json();
+  }
+  async verifyIdToken(idToken, nonce) {
+    const jwksUri = await this.discovery.endpoint("jwks_uri");
+    let resolver = this.jwksByUri.get(jwksUri);
+    if (!resolver) {
+      resolver = jose.createRemoteJWKSet(new URL(jwksUri));
+      this.jwksByUri.set(jwksUri, resolver);
+    }
+    let payload;
+    try {
+      ({ payload } = await jose.jwtVerify(idToken, resolver, {
+        issuer: this.config.issuer,
+        audience: this.config.clientId
+      }));
+    } catch (error) {
+      throw new AuthenticationError(`The id_token could not be verified: ${String(error)}`);
+    }
+    if (nonce && payload["nonce"] !== nonce) {
+      throw new AuthenticationError("The id_token nonce did not match \u2014 possible replay.");
+    }
+    return payload;
+  }
+  scopes() {
+    const scopes = this.config.scopes;
+    return scopes && scopes.length > 0 ? scopes : ["openid", "profile", "email"];
+  }
+  accountPath() {
+    const path = this.config.accountPath;
+    return path && path !== "" ? `/${path.replace(/^\//, "")}` : "/settings";
+  }
+  requireSecret() {
+    if (!this.config.clientSecret) {
+      throw new ConfigurationError("This call requires a `clientSecret`, but none is configured.");
+    }
+    return this.config.clientSecret;
+  }
+  post(url, body, headers = {}) {
+    return this.fetchWithTimeout(url, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", ...headers },
+      body
+    });
+  }
+  async fetchWithTimeout(url, init) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.config.timeoutMs ?? 1e4);
+    try {
+      return await fetch(url, { ...init, signal: controller.signal });
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+function timingSafeEqualString(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let mismatch = 0;
+  for (let i = 0; i < a.length; i++) {
+    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+
+// src/nextjs.ts
+var COOKIE = {
+  state: "cbox_id_state",
+  verifier: "cbox_id_verifier",
+  nonce: "cbox_id_nonce"
+};
+var TEMP_COOKIE_MAX_AGE = 600;
+function createCboxId(config) {
+  const resolved = resolveConfig(config);
+  const client = new CboxIdClient(resolved);
+  const tempCookieOptions = {
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax",
+    path: "/",
+    maxAge: TEMP_COOKIE_MAX_AGE
+  };
+  return {
+    client,
+    async signIn(options = {}) {
+      const request = await client.createAuthorizationRequest(options);
+      const response = server.NextResponse.redirect(request.url);
+      response.cookies.set(COOKIE.state, request.state, tempCookieOptions);
+      response.cookies.set(COOKIE.verifier, request.codeVerifier, tempCookieOptions);
+      response.cookies.set(COOKIE.nonce, request.nonce, tempCookieOptions);
+      return response;
+    },
+    async callback(request) {
+      return client.authenticate({
+        params: {
+          code: request.nextUrl.searchParams.get("code"),
+          state: request.nextUrl.searchParams.get("state"),
+          error: request.nextUrl.searchParams.get("error"),
+          error_description: request.nextUrl.searchParams.get("error_description")
+        },
+        stored: {
+          state: request.cookies.get(COOKIE.state)?.value ?? "",
+          codeVerifier: request.cookies.get(COOKIE.verifier)?.value ?? "",
+          nonce: request.cookies.get(COOKIE.nonce)?.value ?? ""
+        }
+      });
+    },
+    profileUrl(returnTo) {
+      return client.profileUrl(returnTo);
+    },
+    profileRedirect(returnTo) {
+      return server.NextResponse.redirect(client.profileUrl(returnTo));
+    },
+    signOutUrl(returnTo) {
+      return client.logoutUrl(returnTo);
+    }
+  };
+}
+function resolveConfig(config) {
+  const issuer = config?.issuer ?? process.env["CBOX_ID_ISSUER"];
+  const clientId = config?.clientId ?? process.env["CBOX_ID_CLIENT_ID"];
+  const redirectUri = config?.redirectUri ?? process.env["CBOX_ID_REDIRECT_URI"];
+  const clientSecret = config?.clientSecret ?? process.env["CBOX_ID_CLIENT_SECRET"];
+  if (!issuer || !clientId || !redirectUri) {
+    throw new ConfigurationError(
+      "Cbox ID needs issuer, clientId and redirectUri \u2014 pass them to createCboxId() or set CBOX_ID_ISSUER / CBOX_ID_CLIENT_ID / CBOX_ID_REDIRECT_URI."
+    );
+  }
+  return {
+    issuer,
+    clientId,
+    redirectUri,
+    ...clientSecret ? { clientSecret } : {},
+    ...config?.scopes ? { scopes: config.scopes } : {},
+    ...config?.accountPath ? { accountPath: config.accountPath } : {},
+    ...config?.timeoutMs ? { timeoutMs: config.timeoutMs } : {},
+    ...config?.cacheTtlMs ? { cacheTtlMs: config.cacheTtlMs } : {}
+  };
+}
+
+exports.createCboxId = createCboxId;
+//# sourceMappingURL=nextjs.cjs.map
+//# sourceMappingURL=nextjs.cjs.map