@dev-crew-berlin/enter-js-utils 0.50.3 → 0.51.0

package/dist/lib/csrf.d.ts

@@ -0,0 +1,8 @@
+import { CookieGetter, CookieSetter } from './headers';
+export declare type CsrfOptions = {
+    cookieSignSecret: string;
+    cookieName?: string;
+};
+export declare function setCsrfToken(getCookie: CookieGetter, setCookie: CookieSetter, options: CsrfOptions): Promise<void>;
+export declare function getCsrfToken(getCookie: CookieGetter, options: CsrfOptions): Promise<string | null>;
+export declare function verifyCsrfToken(csrfToken: string | undefined, getCookie: CookieGetter, options: CsrfOptions): Promise<boolean>;

package/dist/lib/csrf.js

@@ -0,0 +1,83 @@
+const CSRF_COOKIE_NAME = 'enter-frontend.csrf-token';
+async function importCookieSingKey(cookieSignSecret) {
+  return crypto.subtle.importKey('raw', new TextEncoder().encode(cookieSignSecret), {
+    name: 'HMAC',
+    hash: 'SHA-256'
+  }, false, ['sign', 'verify']);
+}
+async function validateCsrfCookie(csrfCookie, cookieSignSecret) {
+  if (!csrfCookie) return {
+    cookieIsValid: false,
+    tokenFromCookie: undefined
+  };
+  const [tokenFromCookie, signatureString] = csrfCookie.split('.');
+  const key = await importCookieSingKey(cookieSignSecret);
+  const signature = Uint8Array.from(atob(signatureString), c => c.charCodeAt(0));
+  const cookieIsValid = await crypto.subtle.verify('HMAC', key, signature, new TextEncoder().encode(tokenFromCookie));
+  if (!cookieIsValid) {
+    return {
+      cookieIsValid: false,
+      tokenFromCookie: undefined
+    };
+  }
+  return {
+    cookieIsValid: true,
+    tokenFromCookie
+  };
+}
+export async function setCsrfToken(getCookie, setCookie, options) {
+  const {
+    cookieSignSecret,
+    cookieName = CSRF_COOKIE_NAME
+  } = options;
+  const currentCookie = getCookie(cookieName);
+  const {
+    cookieIsValid
+  } = await validateCsrfCookie(currentCookie?.value, cookieSignSecret);
+  const cookieOptions = {
+    sameSite: 'lax',
+    path: '/'
+  };
+  if (currentCookie && cookieIsValid) {
+    // if we already have a valid token just make sure that we set it agin
+    // this is needed since `getCookie` could read from a different location
+    // than `setCookie`
+    setCookie(cookieName, currentCookie.value, cookieOptions);
+    return;
+  }
+  const csrfToken = crypto.randomUUID();
+  const encodedToken = new TextEncoder().encode(csrfToken);
+  const key = await importCookieSingKey(cookieSignSecret);
+  const signature = await crypto.subtle.sign('HMAC', key, encodedToken);
+  const signatureString = btoa(String.fromCharCode(...new Uint8Array(signature)));
+  const csrfCookie = `${csrfToken}.${signatureString}`;
+  setCookie(cookieName, csrfCookie, cookieOptions);
+}
+export async function getCsrfToken(getCookie, options) {
+  const {
+    cookieSignSecret,
+    cookieName = CSRF_COOKIE_NAME
+  } = options;
+  const currentCookie = getCookie(cookieName)?.value;
+  const {
+    cookieIsValid,
+    tokenFromCookie
+  } = await validateCsrfCookie(currentCookie, cookieSignSecret);
+  if (!cookieIsValid) return null;
+  return tokenFromCookie;
+}
+export async function verifyCsrfToken(csrfToken, getCookie, options) {
+  const {
+    cookieSignSecret,
+    cookieName = CSRF_COOKIE_NAME
+  } = options;
+  const csrfCookie = getCookie(cookieName)?.value;
+  const {
+    cookieIsValid,
+    tokenFromCookie
+  } = await validateCsrfCookie(csrfCookie, cookieSignSecret);
+  if (!cookieIsValid) return false;
+  if (!csrfToken) return false;
+  const payloadMatchesCooie = tokenFromCookie === csrfToken;
+  return payloadMatchesCooie;
+}

package/dist/lib/headers.d.ts

@@ -0,0 +1,26 @@
+/// <reference types="node" />
+import { IncomingMessage, ServerResponse } from 'http';
+export declare type CookieOptions = {
+    sameSite?: 'lax' | 'strict' | 'none';
+    path?: string;
+};
+export declare type RequestCookie = {
+    name: string;
+    value: string;
+};
+export declare type CookieGetter = (name: string) => RequestCookie | undefined;
+export declare type CookieSetter = (name: string, value: string, options?: CookieOptions) => void;
+export declare type CookieRemover = (name: string) => void;
+export declare type HeaderGetter = (name: string) => string | null;
+export declare function nodeCookies(request: {
+    cookies: Partial<{
+        [key: string]: string;
+    }>;
+}, response: ServerResponse): {
+    getCookie: CookieGetter;
+    setCookie: CookieSetter;
+    deleteCookie: CookieRemover;
+};
+export declare function nodeHeaders(request: IncomingMessage): {
+    getHeader: HeaderGetter;
+};

package/dist/lib/headers.js

@@ -0,0 +1,31 @@
+import nookies from 'nookies';
+export function nodeCookies(request, response) {
+  return {
+    getCookie: name => {
+      const value = request.cookies[name];
+      if (value === undefined) return undefined;
+      return {
+        name,
+        value
+      };
+    },
+    setCookie: (name, value, options) => {
+      nookies.set({
+        res: response
+      }, name, value, options);
+    },
+    deleteCookie: name => nookies.destroy({
+      res: response
+    }, name)
+  };
+}
+export function nodeHeaders(request) {
+  return {
+    getHeader: name => {
+      const value = request.headers[name] ?? null;
+      if (value === null) return value;
+      if (typeof value !== 'string') return value.join();
+      return value;
+    }
+  };
+}

package/dist/lib/tokens.d.ts

@@ -0,0 +1,31 @@
+import { CookieGetter, CookieRemover, CookieSetter } from './headers';
+import { Result } from './result';
+export declare type TokenOptions = {
+    jwtSecret: string;
+    instanceName: string;
+};
+export declare type TokenValidationError = 'token_missing' | 'token_invalid' | 'token_expired' | 'security_question_check_failed';
+export declare type RegistrationTokenOptions = {
+    registrationTokenCookieName?: string;
+};
+export declare type RegistrationToken = {
+    attendeeId: string;
+    sessionType: string;
+    flags: {
+        [key: string]: unknown;
+    };
+    isExpired: boolean;
+};
+export declare function parseRegistrationToken(tokenString: string | undefined, options: TokenOptions): Result<TokenValidationError, RegistrationToken>;
+export declare function parseUnsubscribeToken(tokenString: string | undefined, options: TokenOptions): Result<TokenValidationError, {
+    emailAddress: string;
+    attendeeId: string;
+    emailName: string;
+}>;
+export declare function parseEmailHtmlToken(tokenString: string | undefined, options: TokenOptions): Result<TokenValidationError, {
+    attendeeId: string;
+    emailName: string;
+}>;
+export declare function readRegistrationToken(getCookie: CookieGetter, options: TokenOptions & RegistrationTokenOptions): Result<TokenValidationError, RegistrationToken>;
+export declare function storeRegistrationToken(token: string, setCookie: CookieSetter, options?: RegistrationTokenOptions): void;
+export declare function deleteRegistrationToken(deleteCookie: CookieRemover, options?: RegistrationTokenOptions): void;

package/dist/lib/tokens.js

@@ -0,0 +1,79 @@
+import jws from 'jws';
+import { failure, success } from './result';
+const REGISTRATION_TOKEN_COOKIE_NAME = 'enter-frontend.registation-token';
+function parseJWS(tokenString, options) {
+  if (!tokenString) return failure('token_missing');
+  const hasValidFormat = jws.isValid(tokenString);
+  if (!hasValidFormat) return failure('token_invalid');
+  const signatureIsValid = jws.verify(tokenString, 'HS256', options.jwtSecret);
+  if (!signatureIsValid) return failure('token_invalid');
+  return success(jws.decode(tokenString));
+}
+export function parseRegistrationToken(tokenString, options) {
+  const tokenResult = parseJWS(tokenString, options);
+  if (!tokenResult.success) return tokenResult;
+  const payload = tokenResult.data.payload;
+  if (payload.instance_name !== options.instanceName || typeof payload.attendee_id !== 'string' || typeof payload.exp !== 'number') {
+    return failure('token_invalid');
+  }
+  const now = new Date();
+  const expires = new Date(payload.exp * 1000);
+  const isExpired = now >= expires;
+  return success({
+    attendeeId: payload.attendee_id,
+    sessionType: payload.session_type ?? 'register',
+    flags: payload.flags ?? {},
+    isExpired
+  });
+}
+export function parseUnsubscribeToken(tokenString, options) {
+  const tokenResult = parseJWS(tokenString, options);
+  if (!tokenResult.success) return tokenResult;
+  const payload = tokenResult.data.payload;
+  if (payload.instance_name !== options.instanceName || typeof payload.email_address !== 'string' || typeof payload.attendee_id !== 'string' || typeof payload.email_name !== 'string') {
+    return failure('token_invalid');
+  }
+  return success({
+    emailAddress: payload.email_address,
+    attendeeId: payload.attendee_id,
+    emailName: payload.email_name
+  });
+}
+export function parseEmailHtmlToken(tokenString, options) {
+  const tokenResult = parseJWS(tokenString, options);
+  if (!tokenResult.success) return tokenResult;
+  const payload = tokenResult.data.payload;
+  if (payload.instance_name !== options.instanceName || typeof payload.attendee_id !== 'string' || typeof payload.email_name !== 'string' || typeof payload.exp !== 'number') {
+    return failure('token_invalid');
+  }
+  const now = new Date();
+  const expires = new Date(payload.exp * 1000);
+  const isExpired = now >= expires;
+  if (isExpired) return failure('token_expired');
+  return success({
+    attendeeId: payload.attendee_id,
+    emailName: payload.email_name
+  });
+}
+export function readRegistrationToken(getCookie, options) {
+  const {
+    registrationTokenCookieName = REGISTRATION_TOKEN_COOKIE_NAME
+  } = options;
+  const registationToken = getCookie(registrationTokenCookieName)?.value;
+  return parseRegistrationToken(registationToken, options);
+}
+export function storeRegistrationToken(token, setCookie, options = {}) {
+  const {
+    registrationTokenCookieName = REGISTRATION_TOKEN_COOKIE_NAME
+  } = options;
+  setCookie(registrationTokenCookieName, token, {
+    sameSite: 'lax',
+    path: '/'
+  });
+}
+export function deleteRegistrationToken(deleteCookie, options = {}) {
+  const {
+    registrationTokenCookieName = REGISTRATION_TOKEN_COOKIE_NAME
+  } = options;
+  deleteCookie(registrationTokenCookieName);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dev-crew-berlin/enter-js-utils",
-  "version": "0.50.3",
+  "version": "0.51.0",
   "description": "utils such as vaildation and other helpers to work with data from the enter app",
   "files": [
     "dist",
@@ -74,6 +74,7 @@
   "dependencies": {
     "fp-ts": "^2.12.1",
     "jws": "^4.0.0",
+    "nookies": "^2.5.2",
     "styled-jsx": "^5.0.2",
     "uuid": "^9.0.0"
   }