@dbx-tools/email 0.6.44 → 0.6.45

package/lib/src/auth/otp.js

@@ -1,135 +0,0 @@
-/**
- * One-time-code store + session JWT for the email-OTP gate.
- *
- * Two pieces:
- *
- *   - **Code store** - a 6-digit code is generated with `crypto.randomInt` and
- *     kept server-side as a SHA-256 hash with an expiry and an attempt counter
- *     (never the plaintext, never in the JWT). `verifyCode` is constant-time on
- *     the hash, enforces the TTL, and burns the code after too many attempts or
- *     one success. In-memory `Map` keyed by lowercased email - fine for a
- *     single-instance app behind a tunnel.
- *   - **Session JWT** - on a correct code, `signSession` mints a short-lived
- *     HS256 JWT (via `jose`) carrying only the email; `verifySession` validates
- *     it. The signing key comes from `AUTH_JWT_SECRET`; when unset the gate
- *     FAILS OPEN with an ephemeral per-process key (sessions reset on restart)
- *     rather than refusing service - a Databricks App is already access-limited,
- *     so an unset secret degrades to "sessions don't survive restarts", not
- *     "nobody can log in".
- *
- * @module
- */
-import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
-import { jwtVerify, SignJWT } from "jose";
-import { log } from "@dbx-tools/shared-core";
-const logger = log.logger("email:auth:otp");
-/** JWT issuer/audience so a token minted for this gate isn't accepted elsewhere. */
-const JWT_AUD = "dbx-tools-email-auth";
-/** SHA-256 hex of a value (for the stored code + a stable key comparison). */
-function sha256(value) {
-    return createHash("sha256").update(value).digest("hex");
-}
-/** Constant-time compare of two hex digests of equal length. */
-function safeEqualHex(a, b) {
-    if (a.length !== b.length)
-        return false;
-    return timingSafeEqual(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
-}
-/** In-memory store of pending one-time codes, keyed by lowercased email. */
-export class CodeStore {
-    ttlMs;
-    maxAttempts;
-    codes = new Map();
-    constructor(ttlMs, maxAttempts) {
-        this.ttlMs = ttlMs;
-        this.maxAttempts = maxAttempts;
-    }
-    /**
-     * Generate, store (hashed), and RETURN a fresh 6-digit code for `email`. The
-     * caller emails the returned plaintext; only the hash is retained. Replaces
-     * any pending code for the address.
-     */
-    issue(email, now = Date.now()) {
-        const code = String(randomInt(0, 1_000_000)).padStart(6, "0");
-        this.codes.set(email.toLowerCase(), {
-            hash: sha256(code),
-            expiresAt: now + this.ttlMs,
-            attempts: 0,
-        });
-        return code;
-    }
-    /**
-     * Check `code` for `email`. Consumes the entry on success or when attempts are
-     * exhausted, so a code is single-use and can't be brute-forced past the cap.
-     */
-    verify(email, code, now = Date.now()) {
-        const key = email.toLowerCase();
-        const entry = this.codes.get(key);
-        if (!entry)
-            return "invalid";
-        if (now >= entry.expiresAt) {
-            this.codes.delete(key);
-            return "expired";
-        }
-        entry.attempts += 1;
-        if (safeEqualHex(entry.hash, sha256(code))) {
-            this.codes.delete(key);
-            return "ok";
-        }
-        if (entry.attempts >= this.maxAttempts) {
-            this.codes.delete(key);
-            return "too-many-attempts";
-        }
-        return "invalid";
-    }
-    /** Drop every pending code (tests). */
-    clear() {
-        this.codes.clear();
-    }
-}
-/**
- * Resolve the HS256 signing key. Prefers `AUTH_JWT_SECRET`; when unset, mints an
- * ephemeral per-process key (fail-open) and warns once. Memoized so every
- * sign/verify in a process shares one key.
- */
-let cachedKey;
-function signingKey() {
-    if (cachedKey)
-        return cachedKey;
-    const secret = process.env.AUTH_JWT_SECRET?.trim();
-    if (secret) {
-        cachedKey = new TextEncoder().encode(secret);
-    }
-    else {
-        logger.warn("AUTH_JWT_SECRET is not set - using an ephemeral per-process key; sessions will not survive a restart");
-        cachedKey = randomBytes(32);
-    }
-    return cachedKey;
-}
-/** Reset the memoized key (tests, or after changing the env in-process). */
-export function resetSigningKey() {
-    cachedKey = undefined;
-}
-/** Mint a short-lived session JWT for `email`, expiring in `ttlSeconds`. */
-export async function signSession(email, ttlSeconds) {
-    return new SignJWT({ email })
-        .setProtectedHeader({ alg: "HS256" })
-        .setSubject(email)
-        .setAudience(JWT_AUD)
-        .setIssuedAt()
-        .setExpirationTime(`${ttlSeconds}s`)
-        .sign(signingKey());
-}
-/** Validate a session JWT, returning the email it was minted for, or `undefined`. */
-export async function verifySession(token) {
-    if (!token)
-        return undefined;
-    try {
-        const { payload } = await jwtVerify(token, signingKey(), { audience: JWT_AUD });
-        return typeof payload.email === "string" ? payload.email : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3RwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2F1dGgvb3RwLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQW9CRztBQUVILE9BQU8sRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFLFNBQVMsRUFBRSxlQUFlLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFDbEYsT0FBTyxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsTUFBTSxNQUFNLENBQUM7QUFDMUMsT0FBTyxFQUFFLEdBQUcsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBRTdDLE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztBQUU1QyxvRkFBb0Y7QUFDcEYsTUFBTSxPQUFPLEdBQUcsc0JBQXNCLENBQUM7QUFFdkMsOEVBQThFO0FBQzlFLFNBQVMsTUFBTSxDQUFDLEtBQWE7SUFDM0IsT0FBTyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUMxRCxDQUFDO0FBRUQsZ0VBQWdFO0FBQ2hFLFNBQVMsWUFBWSxDQUFDLENBQVMsRUFBRSxDQUFTO0lBQ3hDLElBQUksQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsTUFBTTtRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ3hDLE9BQU8sZUFBZSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUFFLEtBQUssQ0FBQyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUM7QUFDdkUsQ0FBQztBQVdELDRFQUE0RTtBQUM1RSxNQUFNLE9BQU8sU0FBUztJQUlEO0lBQ0E7SUFKRixLQUFLLEdBQUcsSUFBSSxHQUFHLEVBQXFCLENBQUM7SUFFdEQsWUFDbUIsS0FBYSxFQUNiLFdBQW1CO1FBRG5CLFVBQUssR0FBTCxLQUFLLENBQVE7UUFDYixnQkFBVyxHQUFYLFdBQVcsQ0FBUTtJQUNuQyxDQUFDO0lBRUo7Ozs7T0FJRztJQUNILEtBQUssQ0FBQyxLQUFhLEVBQUUsTUFBYyxJQUFJLENBQUMsR0FBRyxFQUFFO1FBQzNDLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUM5RCxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsV0FBVyxFQUFFLEVBQUU7WUFDbEMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUM7WUFDbEIsU0FBUyxFQUFFLEdBQUcsR0FBRyxJQUFJLENBQUMsS0FBSztZQUMzQixRQUFRLEVBQUUsQ0FBQztTQUNaLENBQUMsQ0FBQztRQUNILE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVEOzs7T0FHRztJQUNILE1BQU0sQ0FBQyxLQUFhLEVBQUUsSUFBWSxFQUFFLE1BQWMsSUFBSSxDQUFDLEdBQUcsRUFBRTtRQUMxRCxNQUFNLEdBQUcsR0FBRyxLQUFLLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDaEMsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDbEMsSUFBSSxDQUFDLEtBQUs7WUFBRSxPQUFPLFNBQVMsQ0FBQztRQUM3QixJQUFJLEdBQUcsSUFBSSxLQUFLLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDM0IsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDdkIsT0FBTyxTQUFTLENBQUM7UUFDbkIsQ0FBQztRQUNELEtBQUssQ0FBQyxRQUFRLElBQUksQ0FBQyxDQUFDO1FBQ3BCLElBQUksWUFBWSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMzQyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUN2QixPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxJQUFJLEtBQUssQ0FBQyxRQUFRLElBQUksSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ3ZDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ3ZCLE9BQU8sbUJBQW1CLENBQUM7UUFDN0IsQ0FBQztRQUNELE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7SUFFRCx1Q0FBdUM7SUFDdkMsS0FBSztRQUNILElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDckIsQ0FBQztDQUNGO0FBRUQ7Ozs7R0FJRztBQUNILElBQUksU0FBaUMsQ0FBQztBQUN0QyxTQUFTLFVBQVU7SUFDakIsSUFBSSxTQUFTO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDaEMsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxlQUFlLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDbkQsSUFBSSxNQUFNLEVBQUUsQ0FBQztRQUNYLFNBQVMsR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUMvQyxDQUFDO1NBQU0sQ0FBQztRQUNOLE1BQU0sQ0FBQyxJQUFJLENBQ1Qsc0dBQXNHLENBQ3ZHLENBQUM7UUFDRixTQUFTLEdBQUcsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQzlCLENBQUM7SUFDRCxPQUFPLFNBQVMsQ0FBQztBQUNuQixDQUFDO0FBRUQsNEVBQTRFO0FBQzVFLE1BQU0sVUFBVSxlQUFlO0lBQzdCLFNBQVMsR0FBRyxTQUFTLENBQUM7QUFDeEIsQ0FBQztBQUVELDRFQUE0RTtBQUM1RSxNQUFNLENBQUMsS0FBSyxVQUFVLFdBQVcsQ0FBQyxLQUFhLEVBQUUsVUFBa0I7SUFDakUsT0FBTyxJQUFJLE9BQU8sQ0FBQyxFQUFFLEtBQUssRUFBRSxDQUFDO1NBQzFCLGtCQUFrQixDQUFDLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxDQUFDO1NBQ3BDLFVBQVUsQ0FBQyxLQUFLLENBQUM7U0FDakIsV0FBVyxDQUFDLE9BQU8sQ0FBQztTQUNwQixXQUFXLEVBQUU7U0FDYixpQkFBaUIsQ0FBQyxHQUFHLFVBQVUsR0FBRyxDQUFDO1NBQ25DLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO0FBQ3hCLENBQUM7QUFFRCxxRkFBcUY7QUFDckYsTUFBTSxDQUFDLEtBQUssVUFBVSxhQUFhLENBQUMsS0FBeUI7SUFDM0QsSUFBSSxDQUFDLEtBQUs7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUM3QixJQUFJLENBQUM7UUFDSCxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsTUFBTSxTQUFTLENBQUMsS0FBSyxFQUFFLFVBQVUsRUFBRSxFQUFFLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFDaEYsT0FBTyxPQUFPLE9BQU8sQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDdkUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7QUFDSCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBPbmUtdGltZS1jb2RlIHN0b3JlICsgc2Vzc2lvbiBKV1QgZm9yIHRoZSBlbWFpbC1PVFAgZ2F0ZS5cbiAqXG4gKiBUd28gcGllY2VzOlxuICpcbiAqICAgLSAqKkNvZGUgc3RvcmUqKiAtIGEgNi1kaWdpdCBjb2RlIGlzIGdlbmVyYXRlZCB3aXRoIGBjcnlwdG8ucmFuZG9tSW50YCBhbmRcbiAqICAgICBrZXB0IHNlcnZlci1zaWRlIGFzIGEgU0hBLTI1NiBoYXNoIHdpdGggYW4gZXhwaXJ5IGFuZCBhbiBhdHRlbXB0IGNvdW50ZXJcbiAqICAgICAobmV2ZXIgdGhlIHBsYWludGV4dCwgbmV2ZXIgaW4gdGhlIEpXVCkuIGB2ZXJpZnlDb2RlYCBpcyBjb25zdGFudC10aW1lIG9uXG4gKiAgICAgdGhlIGhhc2gsIGVuZm9yY2VzIHRoZSBUVEwsIGFuZCBidXJucyB0aGUgY29kZSBhZnRlciB0b28gbWFueSBhdHRlbXB0cyBvclxuICogICAgIG9uZSBzdWNjZXNzLiBJbi1tZW1vcnkgYE1hcGAga2V5ZWQgYnkgbG93ZXJjYXNlZCBlbWFpbCAtIGZpbmUgZm9yIGFcbiAqICAgICBzaW5nbGUtaW5zdGFuY2UgYXBwIGJlaGluZCBhIHR1bm5lbC5cbiAqICAgLSAqKlNlc3Npb24gSldUKiogLSBvbiBhIGNvcnJlY3QgY29kZSwgYHNpZ25TZXNzaW9uYCBtaW50cyBhIHNob3J0LWxpdmVkXG4gKiAgICAgSFMyNTYgSldUICh2aWEgYGpvc2VgKSBjYXJyeWluZyBvbmx5IHRoZSBlbWFpbDsgYHZlcmlmeVNlc3Npb25gIHZhbGlkYXRlc1xuICogICAgIGl0LiBUaGUgc2lnbmluZyBrZXkgY29tZXMgZnJvbSBgQVVUSF9KV1RfU0VDUkVUYDsgd2hlbiB1bnNldCB0aGUgZ2F0ZVxuICogICAgIEZBSUxTIE9QRU4gd2l0aCBhbiBlcGhlbWVyYWwgcGVyLXByb2Nlc3Mga2V5IChzZXNzaW9ucyByZXNldCBvbiByZXN0YXJ0KVxuICogICAgIHJhdGhlciB0aGFuIHJlZnVzaW5nIHNlcnZpY2UgLSBhIERhdGFicmlja3MgQXBwIGlzIGFscmVhZHkgYWNjZXNzLWxpbWl0ZWQsXG4gKiAgICAgc28gYW4gdW5zZXQgc2VjcmV0IGRlZ3JhZGVzIHRvIFwic2Vzc2lvbnMgZG9uJ3Qgc3Vydml2ZSByZXN0YXJ0c1wiLCBub3RcbiAqICAgICBcIm5vYm9keSBjYW4gbG9nIGluXCIuXG4gKlxuICogQG1vZHVsZVxuICovXG5cbmltcG9ydCB7IGNyZWF0ZUhhc2gsIHJhbmRvbUJ5dGVzLCByYW5kb21JbnQsIHRpbWluZ1NhZmVFcXVhbCB9IGZyb20gXCJub2RlOmNyeXB0b1wiO1xuaW1wb3J0IHsgand0VmVyaWZ5LCBTaWduSldUIH0gZnJvbSBcImpvc2VcIjtcbmltcG9ydCB7IGxvZyB9IGZyb20gXCJAZGJ4LXRvb2xzL3NoYXJlZC1jb3JlXCI7XG5cbmNvbnN0IGxvZ2dlciA9IGxvZy5sb2dnZXIoXCJlbWFpbDphdXRoOm90cFwiKTtcblxuLyoqIEpXVCBpc3N1ZXIvYXVkaWVuY2Ugc28gYSB0b2tlbiBtaW50ZWQgZm9yIHRoaXMgZ2F0ZSBpc24ndCBhY2NlcHRlZCBlbHNld2hlcmUuICovXG5jb25zdCBKV1RfQVVEID0gXCJkYngtdG9vbHMtZW1haWwtYXV0aFwiO1xuXG4vKiogU0hBLTI1NiBoZXggb2YgYSB2YWx1ZSAoZm9yIHRoZSBzdG9yZWQgY29kZSArIGEgc3RhYmxlIGtleSBjb21wYXJpc29uKS4gKi9cbmZ1bmN0aW9uIHNoYTI1Nih2YWx1ZTogc3RyaW5nKTogc3RyaW5nIHtcbiAgcmV0dXJuIGNyZWF0ZUhhc2goXCJzaGEyNTZcIikudXBkYXRlKHZhbHVlKS5kaWdlc3QoXCJoZXhcIik7XG59XG5cbi8qKiBDb25zdGFudC10aW1lIGNvbXBhcmUgb2YgdHdvIGhleCBkaWdlc3RzIG9mIGVxdWFsIGxlbmd0aC4gKi9cbmZ1bmN0aW9uIHNhZmVFcXVhbEhleChhOiBzdHJpbmcsIGI6IHN0cmluZyk6IGJvb2xlYW4ge1xuICBpZiAoYS5sZW5ndGggIT09IGIubGVuZ3RoKSByZXR1cm4gZmFsc2U7XG4gIHJldHVybiB0aW1pbmdTYWZlRXF1YWwoQnVmZmVyLmZyb20oYSwgXCJoZXhcIiksIEJ1ZmZlci5mcm9tKGIsIFwiaGV4XCIpKTtcbn1cblxuaW50ZXJmYWNlIENvZGVFbnRyeSB7XG4gIGhhc2g6IHN0cmluZztcbiAgZXhwaXJlc0F0OiBudW1iZXI7XG4gIGF0dGVtcHRzOiBudW1iZXI7XG59XG5cbi8qKiBSZXN1bHQgb2Yge0BsaW5rIENvZGVTdG9yZS52ZXJpZnl9LiAqL1xuZXhwb3J0IHR5cGUgVmVyaWZ5T3V0Y29tZSA9IFwib2tcIiB8IFwiaW52YWxpZFwiIHwgXCJleHBpcmVkXCIgfCBcInRvby1tYW55LWF0dGVtcHRzXCI7XG5cbi8qKiBJbi1tZW1vcnkgc3RvcmUgb2YgcGVuZGluZyBvbmUtdGltZSBjb2Rlcywga2V5ZWQgYnkgbG93ZXJjYXNlZCBlbWFpbC4gKi9cbmV4cG9ydCBjbGFzcyBDb2RlU3RvcmUge1xuICBwcml2YXRlIHJlYWRvbmx5IGNvZGVzID0gbmV3IE1hcDxzdHJpbmcsIENvZGVFbnRyeT4oKTtcblxuICBjb25zdHJ1Y3RvcihcbiAgICBwcml2YXRlIHJlYWRvbmx5IHR0bE1zOiBudW1iZXIsXG4gICAgcHJpdmF0ZSByZWFkb25seSBtYXhBdHRlbXB0czogbnVtYmVyLFxuICApIHt9XG5cbiAgLyoqXG4gICAqIEdlbmVyYXRlLCBzdG9yZSAoaGFzaGVkKSwgYW5kIFJFVFVSTiBhIGZyZXNoIDYtZGlnaXQgY29kZSBmb3IgYGVtYWlsYC4gVGhlXG4gICAqIGNhbGxlciBlbWFpbHMgdGhlIHJldHVybmVkIHBsYWludGV4dDsgb25seSB0aGUgaGFzaCBpcyByZXRhaW5lZC4gUmVwbGFjZXNcbiAgICogYW55IHBlbmRpbmcgY29kZSBmb3IgdGhlIGFkZHJlc3MuXG4gICAqL1xuICBpc3N1ZShlbWFpbDogc3RyaW5nLCBub3c6IG51bWJlciA9IERhdGUubm93KCkpOiBzdHJpbmcge1xuICAgIGNvbnN0IGNvZGUgPSBTdHJpbmcocmFuZG9tSW50KDAsIDFfMDAwXzAwMCkpLnBhZFN0YXJ0KDYsIFwiMFwiKTtcbiAgICB0aGlzLmNvZGVzLnNldChlbWFpbC50b0xvd2VyQ2FzZSgpLCB7XG4gICAgICBoYXNoOiBzaGEyNTYoY29kZSksXG4gICAgICBleHBpcmVzQXQ6IG5vdyArIHRoaXMudHRsTXMsXG4gICAgICBhdHRlbXB0czogMCxcbiAgICB9KTtcbiAgICByZXR1cm4gY29kZTtcbiAgfVxuXG4gIC8qKlxuICAgKiBDaGVjayBgY29kZWAgZm9yIGBlbWFpbGAuIENvbnN1bWVzIHRoZSBlbnRyeSBvbiBzdWNjZXNzIG9yIHdoZW4gYXR0ZW1wdHMgYXJlXG4gICAqIGV4aGF1c3RlZCwgc28gYSBjb2RlIGlzIHNpbmdsZS11c2UgYW5kIGNhbid0IGJlIGJydXRlLWZvcmNlZCBwYXN0IHRoZSBjYXAuXG4gICAqL1xuICB2ZXJpZnkoZW1haWw6IHN0cmluZywgY29kZTogc3RyaW5nLCBub3c6IG51bWJlciA9IERhdGUubm93KCkpOiBWZXJpZnlPdXRjb21lIHtcbiAgICBjb25zdCBrZXkgPSBlbWFpbC50b0xvd2VyQ2FzZSgpO1xuICAgIGNvbnN0IGVudHJ5ID0gdGhpcy5jb2Rlcy5nZXQoa2V5KTtcbiAgICBpZiAoIWVudHJ5KSByZXR1cm4gXCJpbnZhbGlkXCI7XG4gICAgaWYgKG5vdyA+PSBlbnRyeS5leHBpcmVzQXQpIHtcbiAgICAgIHRoaXMuY29kZXMuZGVsZXRlKGtleSk7XG4gICAgICByZXR1cm4gXCJleHBpcmVkXCI7XG4gICAgfVxuICAgIGVudHJ5LmF0dGVtcHRzICs9IDE7XG4gICAgaWYgKHNhZmVFcXVhbEhleChlbnRyeS5oYXNoLCBzaGEyNTYoY29kZSkpKSB7XG4gICAgICB0aGlzLmNvZGVzLmRlbGV0ZShrZXkpO1xuICAgICAgcmV0dXJuIFwib2tcIjtcbiAgICB9XG4gICAgaWYgKGVudHJ5LmF0dGVtcHRzID49IHRoaXMubWF4QXR0ZW1wdHMpIHtcbiAgICAgIHRoaXMuY29kZXMuZGVsZXRlKGtleSk7XG4gICAgICByZXR1cm4gXCJ0b28tbWFueS1hdHRlbXB0c1wiO1xuICAgIH1cbiAgICByZXR1cm4gXCJpbnZhbGlkXCI7XG4gIH1cblxuICAvKiogRHJvcCBldmVyeSBwZW5kaW5nIGNvZGUgKHRlc3RzKS4gKi9cbiAgY2xlYXIoKTogdm9pZCB7XG4gICAgdGhpcy5jb2Rlcy5jbGVhcigpO1xuICB9XG59XG5cbi8qKlxuICogUmVzb2x2ZSB0aGUgSFMyNTYgc2lnbmluZyBrZXkuIFByZWZlcnMgYEFVVEhfSldUX1NFQ1JFVGA7IHdoZW4gdW5zZXQsIG1pbnRzIGFuXG4gKiBlcGhlbWVyYWwgcGVyLXByb2Nlc3Mga2V5IChmYWlsLW9wZW4pIGFuZCB3YXJucyBvbmNlLiBNZW1vaXplZCBzbyBldmVyeVxuICogc2lnbi92ZXJpZnkgaW4gYSBwcm9jZXNzIHNoYXJlcyBvbmUga2V5LlxuICovXG5sZXQgY2FjaGVkS2V5OiBVaW50OEFycmF5IHwgdW5kZWZpbmVkO1xuZnVuY3Rpb24gc2lnbmluZ0tleSgpOiBVaW50OEFycmF5IHtcbiAgaWYgKGNhY2hlZEtleSkgcmV0dXJuIGNhY2hlZEtleTtcbiAgY29uc3Qgc2VjcmV0ID0gcHJvY2Vzcy5lbnYuQVVUSF9KV1RfU0VDUkVUPy50cmltKCk7XG4gIGlmIChzZWNyZXQpIHtcbiAgICBjYWNoZWRLZXkgPSBuZXcgVGV4dEVuY29kZXIoKS5lbmNvZGUoc2VjcmV0KTtcbiAgfSBlbHNlIHtcbiAgICBsb2dnZXIud2FybihcbiAgICAgIFwiQVVUSF9KV1RfU0VDUkVUIGlzIG5vdCBzZXQgLSB1c2luZyBhbiBlcGhlbWVyYWwgcGVyLXByb2Nlc3Mga2V5OyBzZXNzaW9ucyB3aWxsIG5vdCBzdXJ2aXZlIGEgcmVzdGFydFwiLFxuICAgICk7XG4gICAgY2FjaGVkS2V5ID0gcmFuZG9tQnl0ZXMoMzIpO1xuICB9XG4gIHJldHVybiBjYWNoZWRLZXk7XG59XG5cbi8qKiBSZXNldCB0aGUgbWVtb2l6ZWQga2V5ICh0ZXN0cywgb3IgYWZ0ZXIgY2hhbmdpbmcgdGhlIGVudiBpbi1wcm9jZXNzKS4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNldFNpZ25pbmdLZXkoKTogdm9pZCB7XG4gIGNhY2hlZEtleSA9IHVuZGVmaW5lZDtcbn1cblxuLyoqIE1pbnQgYSBzaG9ydC1saXZlZCBzZXNzaW9uIEpXVCBmb3IgYGVtYWlsYCwgZXhwaXJpbmcgaW4gYHR0bFNlY29uZHNgLiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHNpZ25TZXNzaW9uKGVtYWlsOiBzdHJpbmcsIHR0bFNlY29uZHM6IG51bWJlcik6IFByb21pc2U8c3RyaW5nPiB7XG4gIHJldHVybiBuZXcgU2lnbkpXVCh7IGVtYWlsIH0pXG4gICAgLnNldFByb3RlY3RlZEhlYWRlcih7IGFsZzogXCJIUzI1NlwiIH0pXG4gICAgLnNldFN1YmplY3QoZW1haWwpXG4gICAgLnNldEF1ZGllbmNlKEpXVF9BVUQpXG4gICAgLnNldElzc3VlZEF0KClcbiAgICAuc2V0RXhwaXJhdGlvblRpbWUoYCR7dHRsU2Vjb25kc31zYClcbiAgICAuc2lnbihzaWduaW5nS2V5KCkpO1xufVxuXG4vKiogVmFsaWRhdGUgYSBzZXNzaW9uIEpXVCwgcmV0dXJuaW5nIHRoZSBlbWFpbCBpdCB3YXMgbWludGVkIGZvciwgb3IgYHVuZGVmaW5lZGAuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gdmVyaWZ5U2Vzc2lvbih0b2tlbjogc3RyaW5nIHwgdW5kZWZpbmVkKTogUHJvbWlzZTxzdHJpbmcgfCB1bmRlZmluZWQ+IHtcbiAgaWYgKCF0b2tlbikgcmV0dXJuIHVuZGVmaW5lZDtcbiAgdHJ5IHtcbiAgICBjb25zdCB7IHBheWxvYWQgfSA9IGF3YWl0IGp3dFZlcmlmeSh0b2tlbiwgc2lnbmluZ0tleSgpLCB7IGF1ZGllbmNlOiBKV1RfQVVEIH0pO1xuICAgIHJldHVybiB0eXBlb2YgcGF5bG9hZC5lbWFpbCA9PT0gXCJzdHJpbmdcIiA/IHBheWxvYWQuZW1haWwgOiB1bmRlZmluZWQ7XG4gIH0gY2F0Y2gge1xuICAgIHJldHVybiB1bmRlZmluZWQ7XG4gIH1cbn1cbiJdfQ==

package/lib/src/auth/rate-limit.d.ts

@@ -1,35 +0,0 @@
-/**
- * A small in-memory fixed-window rate limiter for the email-OTP gate.
- *
- * Keyed by an arbitrary string (an email address or a client IP). Each key gets
- * `max` hits per `windowMs`; the window resets on first use after it elapses.
- * `hit()` returns whether the call is allowed and, when not, how many seconds
- * until the window resets so a caller can surface a cooldown.
- *
- * In-memory is intentional and sufficient for a single-app-instance gate: an
- * app behind a portr tunnel serves from one process. It is NOT a distributed
- * limiter; a multi-replica deployment would need shared state. Entries are
- * pruned lazily on access, so an idle key costs nothing after its window.
- *
- * @module
- */
-/** A fixed-window rate limiter over string keys. */
-export declare class RateLimiter {
-    private readonly max;
-    private readonly windowMs;
-    private readonly windows;
-    constructor(max: number, windowMs: number);
-    /**
-     * Record a hit for `key`. Returns `{ allowed }`, plus `retryAfter` (seconds)
-     * when the limit is exceeded. A limit of `<= 0` disables limiting (always
-     * allowed), which lets a config turn it off without special-casing callers.
-     */
-    hit(key: string, now?: number): {
-        allowed: boolean;
-        retryAfter?: number;
-    };
-    /** Forget a key (e.g. clear a caller's window after a successful verify). */
-    reset(key: string): void;
-    /** Drop every window (tests). */
-    clear(): void;
-}

package/lib/src/auth/rate-limit.js

@@ -1,53 +0,0 @@
-/**
- * A small in-memory fixed-window rate limiter for the email-OTP gate.
- *
- * Keyed by an arbitrary string (an email address or a client IP). Each key gets
- * `max` hits per `windowMs`; the window resets on first use after it elapses.
- * `hit()` returns whether the call is allowed and, when not, how many seconds
- * until the window resets so a caller can surface a cooldown.
- *
- * In-memory is intentional and sufficient for a single-app-instance gate: an
- * app behind a portr tunnel serves from one process. It is NOT a distributed
- * limiter; a multi-replica deployment would need shared state. Entries are
- * pruned lazily on access, so an idle key costs nothing after its window.
- *
- * @module
- */
-/** A fixed-window rate limiter over string keys. */
-export class RateLimiter {
-    max;
-    windowMs;
-    windows = new Map();
-    constructor(max, windowMs) {
-        this.max = max;
-        this.windowMs = windowMs;
-    }
-    /**
-     * Record a hit for `key`. Returns `{ allowed }`, plus `retryAfter` (seconds)
-     * when the limit is exceeded. A limit of `<= 0` disables limiting (always
-     * allowed), which lets a config turn it off without special-casing callers.
-     */
-    hit(key, now = Date.now()) {
-        if (this.max <= 0)
-            return { allowed: true };
-        const existing = this.windows.get(key);
-        if (!existing || now >= existing.resetAt) {
-            this.windows.set(key, { count: 1, resetAt: now + this.windowMs });
-            return { allowed: true };
-        }
-        if (existing.count < this.max) {
-            existing.count += 1;
-            return { allowed: true };
-        }
-        return { allowed: false, retryAfter: Math.ceil((existing.resetAt - now) / 1000) };
-    }
-    /** Forget a key (e.g. clear a caller's window after a successful verify). */
-    reset(key) {
-        this.windows.delete(key);
-    }
-    /** Drop every window (tests). */
-    clear() {
-        this.windows.clear();
-    }
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmF0ZS1saW1pdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9hdXRoL3JhdGUtbGltaXQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7Ozs7Ozs7O0dBY0c7QUFPSCxvREFBb0Q7QUFDcEQsTUFBTSxPQUFPLFdBQVc7SUFJSDtJQUNBO0lBSkYsT0FBTyxHQUFHLElBQUksR0FBRyxFQUFrQixDQUFDO0lBRXJELFlBQ21CLEdBQVcsRUFDWCxRQUFnQjtRQURoQixRQUFHLEdBQUgsR0FBRyxDQUFRO1FBQ1gsYUFBUSxHQUFSLFFBQVEsQ0FBUTtJQUNoQyxDQUFDO0lBRUo7Ozs7T0FJRztJQUNILEdBQUcsQ0FBQyxHQUFXLEVBQUUsTUFBYyxJQUFJLENBQUMsR0FBRyxFQUFFO1FBQ3ZDLElBQUksSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDO1lBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztRQUM1QyxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUN2QyxJQUFJLENBQUMsUUFBUSxJQUFJLEdBQUcsSUFBSSxRQUFRLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDekMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLEVBQUUsS0FBSyxFQUFFLENBQUMsRUFBRSxPQUFPLEVBQUUsR0FBRyxHQUFHLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBQ2xFLE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7UUFDM0IsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDOUIsUUFBUSxDQUFDLEtBQUssSUFBSSxDQUFDLENBQUM7WUFDcEIsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztRQUMzQixDQUFDO1FBQ0QsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxHQUFHLEdBQUcsQ0FBQyxHQUFHLElBQUksQ0FBQyxFQUFFLENBQUM7SUFDcEYsQ0FBQztJQUVELDZFQUE2RTtJQUM3RSxLQUFLLENBQUMsR0FBVztRQUNmLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQzNCLENBQUM7SUFFRCxpQ0FBaUM7SUFDakMsS0FBSztRQUNILElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDdkIsQ0FBQztDQUNGIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBBIHNtYWxsIGluLW1lbW9yeSBmaXhlZC13aW5kb3cgcmF0ZSBsaW1pdGVyIGZvciB0aGUgZW1haWwtT1RQIGdhdGUuXG4gKlxuICogS2V5ZWQgYnkgYW4gYXJiaXRyYXJ5IHN0cmluZyAoYW4gZW1haWwgYWRkcmVzcyBvciBhIGNsaWVudCBJUCkuIEVhY2gga2V5IGdldHNcbiAqIGBtYXhgIGhpdHMgcGVyIGB3aW5kb3dNc2A7IHRoZSB3aW5kb3cgcmVzZXRzIG9uIGZpcnN0IHVzZSBhZnRlciBpdCBlbGFwc2VzLlxuICogYGhpdCgpYCByZXR1cm5zIHdoZXRoZXIgdGhlIGNhbGwgaXMgYWxsb3dlZCBhbmQsIHdoZW4gbm90LCBob3cgbWFueSBzZWNvbmRzXG4gKiB1bnRpbCB0aGUgd2luZG93IHJlc2V0cyBzbyBhIGNhbGxlciBjYW4gc3VyZmFjZSBhIGNvb2xkb3duLlxuICpcbiAqIEluLW1lbW9yeSBpcyBpbnRlbnRpb25hbCBhbmQgc3VmZmljaWVudCBmb3IgYSBzaW5nbGUtYXBwLWluc3RhbmNlIGdhdGU6IGFuXG4gKiBhcHAgYmVoaW5kIGEgcG9ydHIgdHVubmVsIHNlcnZlcyBmcm9tIG9uZSBwcm9jZXNzLiBJdCBpcyBOT1QgYSBkaXN0cmlidXRlZFxuICogbGltaXRlcjsgYSBtdWx0aS1yZXBsaWNhIGRlcGxveW1lbnQgd291bGQgbmVlZCBzaGFyZWQgc3RhdGUuIEVudHJpZXMgYXJlXG4gKiBwcnVuZWQgbGF6aWx5IG9uIGFjY2Vzcywgc28gYW4gaWRsZSBrZXkgY29zdHMgbm90aGluZyBhZnRlciBpdHMgd2luZG93LlxuICpcbiAqIEBtb2R1bGVcbiAqL1xuXG5pbnRlcmZhY2UgV2luZG93IHtcbiAgY291bnQ6IG51bWJlcjtcbiAgcmVzZXRBdDogbnVtYmVyO1xufVxuXG4vKiogQSBmaXhlZC13aW5kb3cgcmF0ZSBsaW1pdGVyIG92ZXIgc3RyaW5nIGtleXMuICovXG5leHBvcnQgY2xhc3MgUmF0ZUxpbWl0ZXIge1xuICBwcml2YXRlIHJlYWRvbmx5IHdpbmRvd3MgPSBuZXcgTWFwPHN0cmluZywgV2luZG93PigpO1xuXG4gIGNvbnN0cnVjdG9yKFxuICAgIHByaXZhdGUgcmVhZG9ubHkgbWF4OiBudW1iZXIsXG4gICAgcHJpdmF0ZSByZWFkb25seSB3aW5kb3dNczogbnVtYmVyLFxuICApIHt9XG5cbiAgLyoqXG4gICAqIFJlY29yZCBhIGhpdCBmb3IgYGtleWAuIFJldHVybnMgYHsgYWxsb3dlZCB9YCwgcGx1cyBgcmV0cnlBZnRlcmAgKHNlY29uZHMpXG4gICAqIHdoZW4gdGhlIGxpbWl0IGlzIGV4Y2VlZGVkLiBBIGxpbWl0IG9mIGA8PSAwYCBkaXNhYmxlcyBsaW1pdGluZyAoYWx3YXlzXG4gICAqIGFsbG93ZWQpLCB3aGljaCBsZXRzIGEgY29uZmlnIHR1cm4gaXQgb2ZmIHdpdGhvdXQgc3BlY2lhbC1jYXNpbmcgY2FsbGVycy5cbiAgICovXG4gIGhpdChrZXk6IHN0cmluZywgbm93OiBudW1iZXIgPSBEYXRlLm5vdygpKTogeyBhbGxvd2VkOiBib29sZWFuOyByZXRyeUFmdGVyPzogbnVtYmVyIH0ge1xuICAgIGlmICh0aGlzLm1heCA8PSAwKSByZXR1cm4geyBhbGxvd2VkOiB0cnVlIH07XG4gICAgY29uc3QgZXhpc3RpbmcgPSB0aGlzLndpbmRvd3MuZ2V0KGtleSk7XG4gICAgaWYgKCFleGlzdGluZyB8fCBub3cgPj0gZXhpc3RpbmcucmVzZXRBdCkge1xuICAgICAgdGhpcy53aW5kb3dzLnNldChrZXksIHsgY291bnQ6IDEsIHJlc2V0QXQ6IG5vdyArIHRoaXMud2luZG93TXMgfSk7XG4gICAgICByZXR1cm4geyBhbGxvd2VkOiB0cnVlIH07XG4gICAgfVxuICAgIGlmIChleGlzdGluZy5jb3VudCA8IHRoaXMubWF4KSB7XG4gICAgICBleGlzdGluZy5jb3VudCArPSAxO1xuICAgICAgcmV0dXJuIHsgYWxsb3dlZDogdHJ1ZSB9O1xuICAgIH1cbiAgICByZXR1cm4geyBhbGxvd2VkOiBmYWxzZSwgcmV0cnlBZnRlcjogTWF0aC5jZWlsKChleGlzdGluZy5yZXNldEF0IC0gbm93KSAvIDEwMDApIH07XG4gIH1cblxuICAvKiogRm9yZ2V0IGEga2V5IChlLmcuIGNsZWFyIGEgY2FsbGVyJ3Mgd2luZG93IGFmdGVyIGEgc3VjY2Vzc2Z1bCB2ZXJpZnkpLiAqL1xuICByZXNldChrZXk6IHN0cmluZyk6IHZvaWQge1xuICAgIHRoaXMud2luZG93cy5kZWxldGUoa2V5KTtcbiAgfVxuXG4gIC8qKiBEcm9wIGV2ZXJ5IHdpbmRvdyAodGVzdHMpLiAqL1xuICBjbGVhcigpOiB2b2lkIHtcbiAgICB0aGlzLndpbmRvd3MuY2xlYXIoKTtcbiAgfVxufVxuIl19

package/src/auth/allowlist.ts

@@ -1,88 +0,0 @@
-/**
- * Unified access allow-list matching for the email-OTP gate.
- *
- * Each pattern in the configured list is one of three shapes, tried in order:
- *
- *   - **domain shortcut** - `databricks.com` or `@databricks.com`: matches any
- *     address whose domain equals it (case-insensitive). The leading `@` is
- *     optional and stripped.
- *   - **glob** - contains `*` or `?`, e.g. `*.databricks.com` or
- *     `*@databricks.com`: matched against the WHOLE address with shell-style
- *     wildcards (`*` = any run, `?` = one char).
- *   - **regex** - wrapped in slashes, `/.../ [flags]`: compiled and tested
- *     against the whole address. An invalid regex never matches (it is skipped
- *     with a warning rather than throwing).
- *
- * An EMPTY list matches nobody (fail closed): an app that enables the gate but
- * configures no patterns lets no one in, which is the safe default.
- *
- * @module
- */
-
-import { log } from "@dbx-tools/shared-core";
-
-const logger = log.logger("email:auth:allowlist");
-
-/** Escape a string for literal use inside a `RegExp`. */
-function escapeRegExp(value: string): string {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
-/** Compile a shell-style glob (`*`, `?`) into an anchored, case-insensitive RegExp. */
-function globToRegExp(glob: string): RegExp {
-  const body = glob
-    .split(/([*?])/)
-    .map((part) => (part === "*" ? ".*" : part === "?" ? "." : escapeRegExp(part)))
-    .join("");
-  return new RegExp(`^${body}$`, "i");
-}
-
-/** Parse a `/pattern/flags` string into a RegExp, or `undefined` if malformed. */
-function parseRegexLiteral(pattern: string): RegExp | undefined {
-  const match = /^\/(.+)\/([a-z]*)$/is.exec(pattern);
-  if (!match) return undefined;
-  try {
-    const flags = match[2]!.includes("i") ? match[2]! : `${match[2]!}i`;
-    return new RegExp(match[1]!, flags);
-  } catch (error) {
-    logger.warn("ignoring invalid regex allow-list pattern", { pattern, error });
-    return undefined;
-  }
-}
-
-/** True when `email` matches a single allow-list `pattern`. */
-function matchesPattern(email: string, pattern: string): boolean {
-  const trimmed = pattern.trim();
-  if (!trimmed) return false;
-  const address = email.trim().toLowerCase();
-
-  // Regex literal: /.../
-  if (trimmed.startsWith("/")) {
-    const re = parseRegexLiteral(trimmed);
-    return re ? re.test(address) : false;
-  }
-
-  // Glob: contains a wildcard.
-  if (trimmed.includes("*") || trimmed.includes("?")) {
-    return globToRegExp(trimmed).test(address);
-  }
-
-  // Domain shortcut: `@d.com` or `d.com` -> match the address's domain.
-  const domain = trimmed.replace(/^@/, "").toLowerCase();
-  const at = address.lastIndexOf("@");
-  return at >= 0 && address.slice(at + 1) === domain;
-}
-
-/**
- * True when `email` is allowed by ANY pattern in `patterns`. An empty (or
- * missing) list allows nobody - the gate fails closed.
- */
-export function matchesAllowlist(email: string, patterns: readonly string[] | undefined): boolean {
-  if (!email || !patterns || patterns.length === 0) return false;
-  return patterns.some((pattern) => matchesPattern(email, pattern));
-}
-
-/** Rough shape check so a clearly-invalid address is rejected before any work. */
-export function looksLikeEmail(value: string): boolean {
-  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value.trim());
-}

package/src/auth/gate.ts

@@ -1,172 +0,0 @@
-/**
- * The email-OTP access gate: runtime + Express middleware + request handlers.
- *
- * {@link AuthGate} owns the allow-list, rate limiters, code store, and session
- * signing. The plugin wires four routes to it (`request`/`verify`/`logout`/
- * `status`) and mounts {@link AuthGate.middleware} so every OTHER request needs a
- * valid session cookie.
- *
- * Design points:
- *   - `request` ALWAYS resolves `{ ok: true }` (anti-enumeration): a code is only
- *     generated + emailed when the address is allow-listed AND under the rate
- *     limit, but the caller can't tell the difference.
- *   - the session lives in an HttpOnly + SameSite=Lax cookie (Secure in prod), so
- *     it survives reloads and is not readable by page scripts.
- *   - fail-open on a missing signing secret (see `otp.ts`): a Databricks App is
- *     already access-limited; an unset `AUTH_JWT_SECRET` degrades to
- *     non-durable sessions, not a lockout.
- *
- * @module
- */
-
-import type { CookieOptions, NextFunction, Request, Response } from "express";
-import { http, log } from "@dbx-tools/shared-core";
-import type { AuthStatus } from "@dbx-tools/shared-email";
-import { looksLikeEmail, matchesAllowlist } from "./allowlist.ts";
-import { CodeStore, signSession, verifySession } from "./otp.ts";
-import { RateLimiter } from "./rate-limit.ts";
-
-const logger = log.logger("email:auth");
-
-/** Cookie the session JWT rides in. */
-export const SESSION_COOKIE = "dbx_auth";
-
-/** Route prefix (under the plugin base `/api/email`) the gate leaves open. */
-const AUTH_PATH_PREFIX = "/auth";
-
-/** Resolved gate configuration. */
-export interface AuthGateOptions {
-  /** Allow-list patterns (domain / glob / `/regex/`). Empty = allow nobody. */
-  readonly allow: readonly string[];
-  /** Session lifetime in seconds. */
-  readonly sessionTtlSeconds: number;
-  /** One-time code lifetime in seconds. */
-  readonly codeTtlSeconds: number;
-  /** Max verify attempts per issued code. */
-  readonly maxAttempts: number;
-  /** Send the code email. Returns nothing; failures are logged, not surfaced. */
-  readonly sendCode: (email: string, code: string) => Promise<void>;
-  /** True in production (sets the `Secure` cookie flag). */
-  readonly secureCookies: boolean;
-}
-
-/** The email-OTP gate for one app. */
-export class AuthGate {
-  private readonly codes: CodeStore;
-  // Separate limiters: requesting a code is cheap-to-abuse (email spam), verifying
-  // is a brute-force surface. Per-email AND per-IP so neither axis alone is a bypass.
-  private readonly requestLimiter = new RateLimiter(5, 15 * 60 * 1000);
-  private readonly verifyLimiter = new RateLimiter(10, 15 * 60 * 1000);
-
-  constructor(private readonly options: AuthGateOptions) {
-    this.codes = new CodeStore(options.codeTtlSeconds * 1000, options.maxAttempts);
-  }
-
-  /**
-   * Handle `POST /auth/request`. Always resolves `{ ok: true }` (plus a
-   * `retryAfter` when rate-limited); a code is issued + emailed only for an
-   * allow-listed address under the limit. Errors in sending are swallowed so the
-   * response never reveals whether an address exists / is allowed.
-   */
-  async handleRequest(email: string, ip: string): Promise<{ ok: true; retryAfter?: number }> {
-    const address = email.trim().toLowerCase();
-    const byIp = this.requestLimiter.hit(`ip:${ip}`);
-    const byEmail = this.requestLimiter.hit(`email:${address}`);
-    if (!byIp.allowed || !byEmail.allowed) {
-      return { ok: true, retryAfter: byIp.retryAfter ?? byEmail.retryAfter };
-    }
-    if (looksLikeEmail(address) && matchesAllowlist(address, this.options.allow)) {
-      const code = this.codes.issue(address);
-      try {
-        await this.options.sendCode(address, code);
-      } catch (error) {
-        logger.warn("failed to send OTP email", { error });
-      }
-    }
-    return { ok: true };
-  }
-
-  /**
-   * Handle `POST /auth/verify`. On a correct code, returns the session `token`
-   * plus the `cookieOptions` for it so the route sets it with Express's own
-   * `res.cookie(SESSION_COOKIE, token, options)` (no hand-rolled Set-Cookie).
-   * Failures return `{ ok: false }` with a generic reason.
-   */
-  async handleVerify(
-    email: string,
-    code: string,
-    ip: string,
-    secure: boolean,
-  ): Promise<{ ok: boolean; token?: string; cookieOptions?: CookieOptions; retryAfter?: number }> {
-    const address = email.trim().toLowerCase();
-    const byIp = this.verifyLimiter.hit(`ip:${ip}`);
-    const byEmail = this.verifyLimiter.hit(`email:${address}`);
-    if (!byIp.allowed || !byEmail.allowed) {
-      return { ok: false, retryAfter: byIp.retryAfter ?? byEmail.retryAfter };
-    }
-    if (this.codes.verify(address, code.trim()) !== "ok") return { ok: false };
-    // Correct code: clear the caller's request/verify budget and mint a session.
-    this.requestLimiter.reset(`email:${address}`);
-    this.verifyLimiter.reset(`email:${address}`);
-    const token = await signSession(address, this.options.sessionTtlSeconds);
-    return { ok: true, token, cookieOptions: this.cookieOptions(secure) };
-  }
-
-  /** Express cookie options for the session (used with `res.cookie`/`res.clearCookie`). */
-  cookieOptions(secure: boolean): CookieOptions {
-    return {
-      httpOnly: true,
-      sameSite: "lax",
-      secure: secure || this.options.secureCookies,
-      path: "/",
-      maxAge: this.options.sessionTtlSeconds * 1000,
-    };
-  }
-
-  /** Resolve the authenticated email for a request, or `undefined`. */
-  async authenticate(req: Request): Promise<string | undefined> {
-    // Reuse shared-core's cookie parser (accepts an Express req directly) rather
-    // than re-implementing header splitting here.
-    const token = http.parseCookies(req)[SESSION_COOKIE];
-    return verifySession(token);
-  }
-
-  /** The `GET /auth/status` payload for a request. */
-  async status(req: Request): Promise<AuthStatus> {
-    const email = await this.authenticate(req);
-    return { authenticated: Boolean(email), email, enabled: true };
-  }
-
-  /**
-   * Express middleware gating the app's DATA APIs behind a session.
-   *
-   * It gates `/api/*` and returns 401 for an unauthenticated caller - EXCEPT the
-   * login flow itself (`<emailBase>/auth/*`), which must stay open so a caller
-   * can obtain a session. Static assets (the SPA shell, JS/CSS, favicons) are
-   * NOT gated: the browser has to load the client so the `<AuthGate>` React
-   * component can render the login screen and call these endpoints. A gated
-   * `/api` request from the un-logged-in SPA simply 401s, which the client
-   * treats as "show the login". This is the standard SPA gate shape - protect
-   * the data, serve the shell.
-   *
-   * `emailBase` is the email plugin's mount path (e.g. `/api/email`), so both the
-   * open login prefix and the gated API prefix are matched on the full path.
-   */
-  middleware(emailBase: string): (req: Request, res: Response, next: NextFunction) => void {
-    const openPrefix = `${emailBase}${AUTH_PATH_PREFIX}`;
-    return (req, res, next) => {
-      // Only API traffic is gated; static assets load freely so the login UI can.
-      if (!req.path.startsWith("/api/") || req.path.startsWith(openPrefix)) {
-        next();
-        return;
-      }
-      void this.authenticate(req).then((email) => {
-        if (email) {
-          next();
-        } else {
-          res.status(401).json({ error: "authentication required", loginPath: openPrefix });
-        }
-      });
-    };
-  }
-}

package/src/auth/otp.ts

@@ -1,151 +0,0 @@
-/**
- * One-time-code store + session JWT for the email-OTP gate.
- *
- * Two pieces:
- *
- *   - **Code store** - a 6-digit code is generated with `crypto.randomInt` and
- *     kept server-side as a SHA-256 hash with an expiry and an attempt counter
- *     (never the plaintext, never in the JWT). `verifyCode` is constant-time on
- *     the hash, enforces the TTL, and burns the code after too many attempts or
- *     one success. In-memory `Map` keyed by lowercased email - fine for a
- *     single-instance app behind a tunnel.
- *   - **Session JWT** - on a correct code, `signSession` mints a short-lived
- *     HS256 JWT (via `jose`) carrying only the email; `verifySession` validates
- *     it. The signing key comes from `AUTH_JWT_SECRET`; when unset the gate
- *     FAILS OPEN with an ephemeral per-process key (sessions reset on restart)
- *     rather than refusing service - a Databricks App is already access-limited,
- *     so an unset secret degrades to "sessions don't survive restarts", not
- *     "nobody can log in".
- *
- * @module
- */
-
-import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
-import { jwtVerify, SignJWT } from "jose";
-import { log } from "@dbx-tools/shared-core";
-
-const logger = log.logger("email:auth:otp");
-
-/** JWT issuer/audience so a token minted for this gate isn't accepted elsewhere. */
-const JWT_AUD = "dbx-tools-email-auth";
-
-/** SHA-256 hex of a value (for the stored code + a stable key comparison). */
-function sha256(value: string): string {
-  return createHash("sha256").update(value).digest("hex");
-}
-
-/** Constant-time compare of two hex digests of equal length. */
-function safeEqualHex(a: string, b: string): boolean {
-  if (a.length !== b.length) return false;
-  return timingSafeEqual(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
-}
-
-interface CodeEntry {
-  hash: string;
-  expiresAt: number;
-  attempts: number;
-}
-
-/** Result of {@link CodeStore.verify}. */
-export type VerifyOutcome = "ok" | "invalid" | "expired" | "too-many-attempts";
-
-/** In-memory store of pending one-time codes, keyed by lowercased email. */
-export class CodeStore {
-  private readonly codes = new Map<string, CodeEntry>();
-
-  constructor(
-    private readonly ttlMs: number,
-    private readonly maxAttempts: number,
-  ) {}
-
-  /**
-   * Generate, store (hashed), and RETURN a fresh 6-digit code for `email`. The
-   * caller emails the returned plaintext; only the hash is retained. Replaces
-   * any pending code for the address.
-   */
-  issue(email: string, now: number = Date.now()): string {
-    const code = String(randomInt(0, 1_000_000)).padStart(6, "0");
-    this.codes.set(email.toLowerCase(), {
-      hash: sha256(code),
-      expiresAt: now + this.ttlMs,
-      attempts: 0,
-    });
-    return code;
-  }
-
-  /**
-   * Check `code` for `email`. Consumes the entry on success or when attempts are
-   * exhausted, so a code is single-use and can't be brute-forced past the cap.
-   */
-  verify(email: string, code: string, now: number = Date.now()): VerifyOutcome {
-    const key = email.toLowerCase();
-    const entry = this.codes.get(key);
-    if (!entry) return "invalid";
-    if (now >= entry.expiresAt) {
-      this.codes.delete(key);
-      return "expired";
-    }
-    entry.attempts += 1;
-    if (safeEqualHex(entry.hash, sha256(code))) {
-      this.codes.delete(key);
-      return "ok";
-    }
-    if (entry.attempts >= this.maxAttempts) {
-      this.codes.delete(key);
-      return "too-many-attempts";
-    }
-    return "invalid";
-  }
-
-  /** Drop every pending code (tests). */
-  clear(): void {
-    this.codes.clear();
-  }
-}
-
-/**
- * Resolve the HS256 signing key. Prefers `AUTH_JWT_SECRET`; when unset, mints an
- * ephemeral per-process key (fail-open) and warns once. Memoized so every
- * sign/verify in a process shares one key.
- */
-let cachedKey: Uint8Array | undefined;
-function signingKey(): Uint8Array {
-  if (cachedKey) return cachedKey;
-  const secret = process.env.AUTH_JWT_SECRET?.trim();
-  if (secret) {
-    cachedKey = new TextEncoder().encode(secret);
-  } else {
-    logger.warn(
-      "AUTH_JWT_SECRET is not set - using an ephemeral per-process key; sessions will not survive a restart",
-    );
-    cachedKey = randomBytes(32);
-  }
-  return cachedKey;
-}
-
-/** Reset the memoized key (tests, or after changing the env in-process). */
-export function resetSigningKey(): void {
-  cachedKey = undefined;
-}
-
-/** Mint a short-lived session JWT for `email`, expiring in `ttlSeconds`. */
-export async function signSession(email: string, ttlSeconds: number): Promise<string> {
-  return new SignJWT({ email })
-    .setProtectedHeader({ alg: "HS256" })
-    .setSubject(email)
-    .setAudience(JWT_AUD)
-    .setIssuedAt()
-    .setExpirationTime(`${ttlSeconds}s`)
-    .sign(signingKey());
-}
-
-/** Validate a session JWT, returning the email it was minted for, or `undefined`. */
-export async function verifySession(token: string | undefined): Promise<string | undefined> {
-  if (!token) return undefined;
-  try {
-    const { payload } = await jwtVerify(token, signingKey(), { audience: JWT_AUD });
-    return typeof payload.email === "string" ? payload.email : undefined;
-  } catch {
-    return undefined;
-  }
-}