@crossauth/sveltekit 0.0.2

package/dist/sveltekitoauthserver.d.ts

@@ -0,0 +1,406 @@
+import { OAuthClientStorage, KeyStorage, OAuthAuthorizationServer, Authenticator, OAuthAuthorizationServerOptions, DoubleSubmitCsrfTokenOptions } from '@crossauth/backend';
+import { SvelteKitServer } from './sveltekitserver';
+import { OpenIdConfiguration, User } from '@crossauth/common';
+import { RequestEvent } from '@sveltejs/kit';
+
+/**
+ * Query parameters for the `authorize` request.
+ */
+export interface AuthorizeQueryType {
+    response_type: string;
+    client_id: string;
+    redirect_uri: string;
+    scope?: string;
+    state: string;
+    code_challenge?: string;
+    code_challenge_method?: string;
+}
+export interface ReturnBase {
+    ok: boolean;
+    error?: string;
+    error_description?: string;
+}
+/**
+ * Return type for {@link SvelteKitUserEndpoints.verifyEmail}
+ * {@link SvelteKitUserEndpoints.verifyEmailEndpoint} action.
+ *
+ * See class documentation for {@link SvelteKitUserEndpoints} for more details.
+ */
+export interface AuthorizePageData extends ReturnBase {
+    authorized?: {
+        code: string;
+        state: string;
+    };
+    authorizationNeeded?: {
+        user: User;
+        response_type: string;
+        client_id: string;
+        client_name: string;
+        redirect_uri: string;
+        scope?: string;
+        scopes?: string[];
+        state: string;
+        code_challenge?: string;
+        code_challenge_method?: string;
+        csrfToken?: string;
+    };
+    user?: User;
+    csrfToken?: string;
+}
+export interface AuthorizeFormData extends ReturnBase {
+    formData?: {
+        [key: string]: string;
+    };
+}
+export interface DevicePageData extends ReturnBase {
+    authorizationNeeded?: {
+        user: User;
+        client_id: string;
+        client_name: string;
+        scope?: string;
+        scopes?: string[];
+        csrfToken?: string;
+    };
+    completed: boolean;
+    retryAllowed: boolean;
+    user?: User;
+    csrfToken?: string;
+    ok: boolean;
+    error?: string;
+    error_description?: string;
+    user_code?: string;
+}
+export interface DeviceFormData extends ReturnBase {
+    authorizationNeeded?: {
+        user: User;
+        client_id: string;
+        client_name: string;
+        scope?: string;
+        scopes?: string[];
+        csrfToken?: string;
+    };
+    completed: boolean;
+    retryAllowed: boolean;
+    user?: User;
+    csrfToken?: string;
+    ok: boolean;
+    error?: string;
+    error_description?: string;
+    user_code?: string;
+}
+/**
+ * The body parameters for the `mfa/challenge` endpoint.
+ */
+export interface MfaChallengeBodyType {
+    client_id: string;
+    client_secret?: string;
+    challenge_type: string;
+    mfa_token: string;
+    authenticator_id: string;
+}
+export interface MfaChallengeReturn {
+    challenge_type?: string;
+    oob_code?: string;
+    binding_method?: string;
+    error?: string;
+    error_description?: string;
+}
+/**
+ * Options for {@link SvelteKitAuthorizationServer}
+ */
+export interface SvelteKitAuthorizationServerOptions extends OAuthAuthorizationServerOptions {
+    /**
+     * The login URL (provided by {@link SvelteKitSessionServer}). Default `/login`
+     */
+    loginUrl?: string;
+    /**
+     * How to send the refresh token.
+     *   - `json` sent in the JSON response as per the OAuth specification
+     *   - `cookie` sent as a cookie called `refreshTokenCookieName`.
+     *   - `both` both of the above
+     * Default `json`
+     */
+    refreshTokenType?: "json" | "cookie" | "both";
+    /**
+     * If `refreshTokenType` is `cookie` or `both`, this will be the cookie
+     * name.  Default `CROSSAUTH_REFRESH_TOKEN`
+     */
+    refreshTokenCookieName?: string;
+    /**
+     * Domain to set when sending a refresh token cookie.
+     * Only used if `refreshTokenType` is not `json`
+     */
+    refreshTokenCookieDomain?: string | undefined;
+    /**
+     * Whether to set `httpOnly` when sending a refresh token cookie.
+     * Only used if `refreshTokenType` is not `json`
+     */
+    refreshTokenCookieHttpOnly?: boolean;
+    /**
+     * Path to set when sending a refresh token cookie.
+     * Only used if `refreshTokenType` is not `json`.
+     *
+     * Default "/".
+     */
+    refreshTokenCookiePath?: string;
+    /**
+     * Whether to set the `secure` flag when sending a refresh token cookie.
+     * Only used if `refreshTokenType` is not `json`
+     */
+    refreshTokenCookieSecure?: boolean;
+    /**
+     * SameSite value to set when sending a refresh token cookie.
+     * Only used if `refreshTokenType` is not `json`
+     */
+    refreshTokenCookieSameSite?: boolean | "lax" | "strict" | "none" | undefined;
+    /** options for csrf cookie manager */
+    doubleSubmitCookieOptions?: DoubleSubmitCsrfTokenOptions;
+    /**
+     * Set this to the route where you create your authorize endpoint.
+     *
+     * The default is '/oauth/authozize`
+     */
+    authorizeEndpointUrl?: string;
+    /**
+     * Set this to the route where you create your authorize endpoint.
+     *
+     * The default is '/oauth/token`
+     */
+    tokenEndpointUrl?: string;
+    /**
+     * Set this to the route where you create your jwks endpoint.
+     *
+     * The default is '/oauth/jwks`
+     */
+    jwksEndpoint?: string;
+    /** Pass the Sveltekit redirect function */
+    redirect?: any;
+    /** Pass the Sveltekit error function */
+    error?: any;
+}
+/**
+ * This class implements an OAuth authorization server, serving endpoints
+ * with SvelteKit.
+ *
+ * You shouldn't have to instantiate this directly.  It is instantiated
+ * by {@link SvelteKitServer} if you enable the authorization server there.
+ *
+ * **Endpoints**
+ *
+ * | Name                        | Description                                                | PageData (returned by load) or JSON returned by get/post                     | ActionData (return by actions)                                   | Form fields expected by actions or post/get input data          |
+ * | --------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | baseEndpoint                | This PageData is returned by all endpoints' load function. | - `user` logged in {@link @crossauth/common!User}                            | *Not provided*                                                   |                                                                 |
+ * |                             |                                                            | - `csrfToken` CSRF token if enabled                                          |                                                                  |                                                                 |                                                                         | loginPage                |
+ * | --------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | oidcConfigurationEndpoint   | Use this as your `.well-known/openid-configuration`.       | `get`:                                                                       |                                                                  |                                                                 |
+ * |                             |                                                            |   - see {@link @crossauth/backend!OAuthAuthorizationServer.oidcConfiguration} |                                                                 |                                                                 |
+ * | --------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | jwksGetEndpoint             | Use this as your `jwks` endpoint.                          | `get`:                                                                       |                                                                  |                                                                 |
+ * |                             |                                                            |   - see {@link @crossauth/backend!OAuthAuthorizationServer.jwks}             |                                                                  |                                                                 |
+ * | --------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | getCsrfTokenEndpoint        | Sends a CSRF token for use when refresh token is a cookie  | `get`:                                                                       |                                                                  |                                                                 |
+ * |                             |                                                            |   - `ok` (true or false)                                                     |                                                                  |                                                                 |
+ * |                             |                                                            |   - `csrfToken`                                                              |                                                                  |                                                                 |
+ * |                             |                                                            |   - `error`                                                                  |                                                                  |                                                                 |
+ * |                             |                                                            |   - `error_description`                                                      |                                                                  |                                                                 |
+ * | --------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | authorizeEndpoint           | The OAuth `authorize` endpoint                             | `load`:                                                                      | `default`:                                                       | `authorized` true if the user clicks authorized                 |
+ * |                             |                                                            |   - `succcess` (true or false)                                               |   - `ok`: true or false                                     | `response_type` OAuth response type (take from PageData)        |
+ * |                             |                                                            |   - `authorizationNeeded`:                                                   |   - `formData`: fata submitted from in the form                  | `client_id` take from PageData                                  |
+ * |                             |                                                            |     - `user`: the user object                                                |   - `error` an OAuth error type                                  | `redirect_uri` take from PageData                               |
+ * |                             |                                                            |     - `response_type`: OAuth response type                                   |   - `error_description` text error description                   | `scope` take from PageData                                      |
+ * |                             |                                                            |     - `client_id`:                                                           |                                                                  | `state` take from PageData                                      |
+ * |                             |                                                            |     - `client_name`:                                                         |                                                                  | `code_challenge` take from PageData                             |
+ * |                             |                                                            |     - `redirect_uri`:                                                        |                                                                  | `code_challenge_method` take from PageData                      |
+ * |                             |                                                            |     - `scope`: as a string                                                   |                                                                  |                                                                 |
+ * |                             |                                                            |     - `scopes`: as an array                                                  |                                                                  |                                                                 |
+ * |                             |                                                            |     - `state`:                                                               |                                                                  |                                                                 |
+ * |                             |                                                            |     - `code_challenge`:                                                      |                                                                  |                                                                 |
+ * |                             |                                                            |     - `code_challenge_method`:                                               |                                                                  |                                                                 |
+ * |                             |                                                            |     - `csrfToken`:                                                           |                                                                  |                                                                 |
+ * |                             |                                                            |   - `error`                                                                  |                                                                  |                                                                 |
+ * |                             |                                                            |   - `error_description`                                                      |                                                                  |                                                                 |
+ * |                             |                                                            |   See OAuth definition for more detials.                                     |                                                                  |                                                                 |
+ * | --------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | tokenEndpoint               | The OAuth `token` endpoint                                 | `post`:                                                                      |                                                                  | See OAuth definition of `token` endpoint                        |
+ * |                             |                                                            |   - See OAuth definition of `token` endpoint                                 |                                                                  |                                                                 |
+ * | --------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | mfaAuthenticatorsEndpoint   | For the Auth0 Password MFA authenticators                  | `get`:                                                                       |                                                                  | See OAuth definition of `token` endpoint                        |
+ * |                             |                                                            |   - See Auth0 Password MFA documentation                                     |                                                                  |                                                                 |
+ * |                             |                                                            | `post`:                                                                      |                                                                  |                                                                 |
+ * |                             |                                                            |   - See Auth0 Password MFA documentation                                     |                                                                  | See OAuth definition of `token` endpoint                        |
+ * | --------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | mfaChallengeEndpoint        | For the Auth0 Password MFA challenge                       | `post`:                                                                      |                                                                  | See OAuth definition of `token` endpoint                        |
+ * |                             |                                                            |   - See Auth0 Password MFA documentation                                     |                                                                  |                                                                 |
+ * | --------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | deviceAuthorizationEndpoint | Starts the device flow (for the device)                    | `post`:                                                                      |                                                                  |  `client_id` client ID                                          |
+ * |                             |                                                            |   - `ok` true or false                                                       |                                                                  |  `client_secret` if the client is confidential                  |
+ * |                             |                                                            |   - `error` if there was an error                                            |                                                                  |  `scope` optional                                               |
+ * |                             |                                                            |   - `error_description` if there was an error                                |                                                                  |                                                                 |
+ * | --------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ * | deviceEndpoint              | Device flow - authorization endpoint on other device       | `load`:                                                                      | `authorize`: to authorize scopes (call after `userCode`)         | `user_code` query param for GET, form field for POST. Optional  |
+ * |                             |                                                            |   See {@link DevicePageData}                                                 |    See {@link DeviceFormData}                                    | If not provided, user will be prompted                          |
+ * |                             |                                                            |                                                                              | `userCode` to submit the user code                               | `authorize`: `client_id`, `user_code`, `authorized`             |
+ * | --------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------------------- |
+ *
+ */
+export declare class SvelteKitAuthorizationServer {
+    /** The underlying framework-independent authorization server */
+    readonly authServer: OAuthAuthorizationServer;
+    private svelteKitServer;
+    private loginUrl;
+    private clientStorage;
+    private refreshTokenType;
+    private refreshTokenCookieName;
+    private refreshTokenCookieDomain;
+    private refreshTokenCookieHttpOnly;
+    private refreshTokenCookiePath;
+    private refreshTokenCookieSecure;
+    private refreshTokenCookieSameSite;
+    private csrfTokens;
+    private authorizeEndpointUrl;
+    private tokenEndpointUrl;
+    private jwksEndpointUrl;
+    readonly redirect: any;
+    readonly error: any;
+    /**
+     * Constructor
+     * @param svelteKitServer the SvelteKit server this belongs to
+     * @param clientStorage where OAuth clients are stored
+     * @param keyStorage where refresh tokens, authorization cods, etc are temporarily stored
+     * @param authenticators The authenticators (factor1 and factor2) to enable
+     *        for the password flow
+     * @param options see {@link SvelteKitAuthorizationServerOptions}
+     */
+    constructor(svelteKitServer: SvelteKitServer, clientStorage: OAuthClientStorage, keyStorage: KeyStorage, authenticators?: {
+        [key: string]: Authenticator;
+    }, options?: SvelteKitAuthorizationServerOptions);
+    /**
+     * Returns this server's OIDC configuration.  Just wraps
+     * {@link @crossauth/backend!OAuthAuthorizationServer.oidcConfiguration}
+     * @returns An {@link @crossauth/common!OpenIdConfiguration} object
+     */
+    oidcConfiguration(): OpenIdConfiguration;
+    /**
+     * Either returns an error or redirects with throw
+     */
+    private authorize;
+    /**
+     * Creates and returns a signed CSRF token based on the session ID
+     *
+     * This is for the situation when the refresh token is sent as a cookie.
+     * When this happens, we need CSRF protection on it.
+     *
+     * @returns a CSRF cookie and value to put in the form or CSRF header
+     */
+    private createCsrfToken;
+    private setRefreshTokenCookie;
+    private requireGetParam;
+    private requireBodyParam;
+    private getAuthorizeQuery;
+    private getMfaChallengeQuery;
+    private mfaAuthenticators;
+    private mfaChallenge;
+    private getClientIdAndSecret;
+    private applyUserCode;
+    /**
+     * Fields that are returned by all endpoint load methods
+     *
+     * See class description
+     * @param event the SvelteKit event
+     * @returns an object with:
+     *   - `user` the `User` object from `event.locals.user`
+     *   - `csrfToken` the CSRF token from `event.locals.csrfToken`
+     */
+    baseEndpoint(event: RequestEvent): {
+        user: User | undefined;
+        csrfToken: string | undefined;
+    };
+    /**
+     * `get` function for the oidcConfiguration endpoint.
+     *
+     * See class description for details.
+     */
+    readonly oidcConfigurationEndpoint: {
+        get: (_event: RequestEvent) => Promise<Response>;
+    };
+    /**
+     * `get` function for the jwks endpoint.
+     *
+     * See class description for details.
+     */
+    readonly jwksGetEndpoint: {
+        get: (_event: RequestEvent) => Promise<Response>;
+    };
+    /**
+     * `get` function for the csrfToken endpoint.
+     *
+     * See class description for details.  Not needed if you disable CSRF
+     * protection to rely on Sveltekit's.
+     */
+    readonly getCsrfTokenEndpoint: {
+        get: (event: RequestEvent) => Promise<Response>;
+    };
+    /**
+     * `load` and `actions` functions for the authorize endpoint.
+     *
+     * See class description for details.  Not needed if you disable CSRF
+     * protection to rely on Sveltekit's.
+     */
+    readonly authorizeEndpoint: {
+        load: (event: RequestEvent) => Promise<AuthorizePageData>;
+        actions: {
+            default: (event: RequestEvent) => Promise<AuthorizeFormData>;
+        };
+    };
+    /**
+     * `post` function for the token endpoint.
+     *
+     * See class description for details.  Not needed if you disable CSRF
+     * protection to rely on Sveltekit's.
+     */
+    readonly tokenEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+    };
+    /**
+     * `get` and `post` functions for the mfa/authenticators endpoint.
+     *
+     * See class description for details.  Not needed if you disable CSRF
+     * protection to rely on Sveltekit's.
+     */
+    readonly mfaAuthenticatorsEndpoint: {
+        get: (event: RequestEvent) => Promise<Response>;
+        post: (event: RequestEvent) => Promise<Response>;
+    };
+    /**
+     * `post` function for the mfa/challenge endpoint.
+     *
+     * See class description for details.  Not needed if you disable CSRF
+     * protection to rely on Sveltekit's.
+     */
+    readonly mfaChallengeEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+    };
+    /**
+     * `post` function for the device_authorization endpoint.
+     *
+     * See class description for details.  Not needed if you disable CSRF
+     * protection to rely on Sveltekit's.
+     */
+    readonly deviceAuthorizationEndpoint: {
+        post: (event: RequestEvent) => Promise<Response>;
+    };
+    /**
+     * `load` and `actions` functions for the authorize endpoint.
+     *
+     * See class description for details.  Not needed if you disable CSRF
+     * protection to rely on Sveltekit's.
+     */
+    readonly deviceEndpoint: {
+        load: (event: RequestEvent) => Promise<DevicePageData>;
+        actions: {
+            userCode: (event: RequestEvent) => Promise<DeviceFormData>;
+            authorize: (event: RequestEvent) => Promise<DeviceFormData>;
+        };
+    };
+}

package/dist/sveltekitresserver.d.ts

@@ -0,0 +1,101 @@
+import { RequestEvent, MaybePromise } from '@sveltejs/kit';
+import { User } from '@crossauth/common';
+import { OAuthResourceServer, UserStorage, OAuthResourceServerOptions, OAuthTokenConsumer } from '@crossauth/backend';
+
+/**
+ * Options for {@link SvelteKitOAuthResourceServer}
+ */
+export interface SvelteKitOAuthResourceServerOptions extends OAuthResourceServerOptions {
+    /** If you set this and your access tokens have a user (`sub` claim),
+     * the `user` field in the request will be populated with a valid
+     * access token,
+     */
+    userStorage?: UserStorage;
+    /**
+     * If you enabled `protectedEndpoints` in
+     * {@link FastifyOAuthResourceServer.constructor}
+     * and the access token is invalid, a 401 reply will be sent before
+     * your endpoint is hit.  This will be the body,  Default {}.
+     */
+    errorBody?: {
+        [key: string]: any;
+    };
+    /**
+     * If you define this, matching resource server endpoints will return
+     * a status code of 401 Access Denied if the key is invalid or the
+     * given scopes are not present.
+     */
+    protectedEndpoints?: {
+        [key: string]: {
+            scope?: string[];
+            acceptSessionAuthorization?: boolean;
+        };
+    };
+}
+/**
+ * OAuth resource server.
+ *
+ * You can subclass this, simply instantiate it, or create it through
+ * {@link SvelteKitServer}.
+ *
+ * There are two way of using this class.  If you don't set
+ * `protectedEndpoints` in
+ * {@link SvelteKitAuthResourceServer.constructor}, then in your
+ * protected endpoints, call {@link SvelteKitOAuthResourceServer.authorized}
+ * to check if the access token is valid and get any user credentials.
+ *
+ * If you do set `protectedEndpoints` in
+ * {@link SvelteKitOAuthResourceServer.constructor}
+ * then a hook is created.
+ * The hook
+ * hook will set the `accessTokenPayload`, `user` and `scope` fields
+ * on the event locals based on the content
+ * of the access token in the `Authorization` header if it is valid.
+ * If it is not valid it will set the `authError` and `authErrorDescription`.
+ * If the access token is invalid, or there is an error, a 401 or 500
+ * response is sent before executing your endpoint code.  As per
+ * OAuth requirements, if the response is a 401, the WWW-Authenticate header
+ * is set.  If a scope is required this is included in that header.
+ */
+export declare class SvelteKitOAuthResourceServer extends OAuthResourceServer {
+    private userStorage?;
+    private errorBody;
+    private protectedEndpoints;
+    /**
+     * Hook to check if the user is logged in and set data in `locals`
+     * accordingly.
+     */
+    readonly hook?: (input: {
+        event: RequestEvent;
+    }) => MaybePromise<Response | undefined>;
+    /**
+     * Constructor
+     * @param tokenConsumers the token consumers, one per issuer
+     * @param options See {@link SvelteKitOAuthResourceServerOptions}
+     */
+    constructor(tokenConsumers: OAuthTokenConsumer[], options?: SvelteKitOAuthResourceServerOptions);
+    private authenticateHeader;
+    /**
+     * If there is no bearer token, returns `undefinerd`.  If there is a
+     * bearer token and it is a valid access token, returns the token
+     * payload.  If there was an error, returns it in OAuth form.
+     *
+     * @param event the SvelteKit request event
+     * @returns an object with the following fiekds
+     *   - `authorized` : `true` or `false`
+     *   - `tokenPayload` : the token payload if the token is valid
+     *   - `error` : if the token is not valid
+     *   - `error_description` : if the token is not valid
+     *   - `user` set if `sub` is defined in the token, a userStorage has
+     *     been defined and it matches
+     */
+    authorized(event: RequestEvent): Promise<{
+        authorized: boolean;
+        tokenPayload?: {
+            [key: string]: any;
+        };
+        user?: User;
+        error?: string;
+        error_description?: string;
+    } | undefined>;
+}