@draftlab/auth 0.15.0 → 0.16.0

package/dist/core.mjs

@@ -1,595 +0,0 @@
-import { getRelativeUrl, lazy } from "./util.mjs";
-import { defaultAllowCheck } from "./allow.mjs";
-import { MissingParameterError, OauthError, UnauthorizedClientError, UnknownStateError } from "./error.mjs";
-import { validatePKCE } from "./pkce.mjs";
-import { generateSecureToken } from "./random.mjs";
-import { Storage } from "./storage/storage.mjs";
-import { encryptionKeys, signingKeys } from "./keys.mjs";
-import { Revocation } from "./revocation.mjs";
-import { Router } from "./router/index.mjs";
-import { deleteCookie, getCookie, setCookie } from "./router/cookies.mjs";
-import { cors } from "./router/middleware/cors.mjs";
-import { setTheme } from "./themes/theme.mjs";
-import { Select } from "./ui/select.mjs";
-import { CompactEncrypt, SignJWT, compactDecrypt } from "jose";
-
-//#region src/core.ts
-/**
-* Core issuer implementation.
-*/
-/**
-* Performs an operation with guaranteed minimum execution time.
-* Adds random jitter to prevent timing-based attacks even if operation completes quickly.
-*
-* Used for validating sensitive data where timing differences could leak information
-* (e.g., authorization codes, refresh tokens).
-*
-* @param fn - Async function to execute
-* @param minTimeMs - Minimum execution time in milliseconds (default: 100ms)
-* @returns Result of the function, guaranteed to take at least minTimeMs
-*/
-const normalizeTimingAsync = async (fn, minTimeMs = 100) => {
-	const startTime = performance.now();
-	const result = await fn();
-	const elapsed = performance.now() - startTime;
-	const remainingTime = Math.max(0, minTimeMs - elapsed);
-	if (remainingTime > 0) {
-		const jitterBuffer = new Uint32Array(1);
-		crypto.getRandomValues(jitterBuffer);
-		const totalDelay = remainingTime + (jitterBuffer[0] ?? 0) / 4294967295 * 20;
-		await new Promise((resolve) => setTimeout(resolve, totalDelay));
-	}
-	return result;
-};
-/**
-* Determines if the incoming request is using HTTPS protocol.
-* Checks multiple proxy headers to handle load balancers and reverse proxies.
-*
-* @param ctx - Router context containing request headers and URL
-* @returns True if request is HTTPS, false otherwise
-*
-* @example
-* ```ts
-* if (isHttpsRequest(ctx)) {
-*   setCookie(ctx, 'secure-cookie', value, { secure: true })
-* }
-* ```
-*/
-const isHttpsRequest = (ctx) => {
-	return ctx.header("x-forwarded-proto") === "https" || ctx.header("x-forwarded-ssl") === "on" || ctx.request.url.startsWith("https://");
-};
-/**
-* Create an Draft Auth server, a Router app that handles OAuth 2.0 flows.
-*/
-const issuer = (input) => {
-	const error = input.error ?? ((err) => {
-		return new Response(err.message, {
-			status: 400,
-			headers: { "Content-Type": "text/plain" }
-		});
-	});
-	const ttlAccess = input.ttl?.access ?? 3600 * 24 * 30;
-	const ttlRefresh = input.ttl?.refresh ?? 3600 * 24 * 365;
-	const ttlRefreshReuse = input.ttl?.reuse ?? 60;
-	const ttlRefreshRetention = input.ttl?.retention ?? 0;
-	if (input.theme) setTheme(input.theme);
-	const storage = input.storage;
-	const select = lazy(() => input.select ?? Select());
-	const allSigning = lazy(() => signingKeys(storage));
-	const allEncryption = lazy(() => encryptionKeys(storage));
-	const allow = lazy(() => input.allow ?? defaultAllowCheck);
-	const signingKey = lazy(() => allSigning().then((all) => all[0]));
-	const encryptionKey = lazy(() => allEncryption().then((all) => all[0]));
-	/**
-	* Resolves issuer URL from context.
-	* Returns the base URL for the OAuth issuer, considering basePath configuration.
-	*/
-	const issuer$1 = (ctx) => {
-		const baseUrl = new URL(getRelativeUrl(ctx, "/"));
-		if (input.basePath) {
-			baseUrl.pathname = (input.basePath.startsWith("/") ? input.basePath : `/${input.basePath}`).replace(/\/$/, "");
-			return baseUrl.href;
-		}
-		return baseUrl.origin;
-	};
-	/**
-	* Encrypts value for secure cookie storage.
-	*/
-	const encrypt = async (value) => {
-		const key = await encryptionKey();
-		if (!key) throw new Error("Encryption key not available");
-		return await new CompactEncrypt(new TextEncoder().encode(JSON.stringify(value))).setProtectedHeader({
-			alg: "RSA-OAEP-512",
-			enc: "A256GCM"
-		}).encrypt(key.public);
-	};
-	/**
-	* Decrypts value from secure cookie storage.
-	*/
-	const decrypt = async (value) => {
-		const key = await encryptionKey();
-		if (!key) throw new Error("Encryption key not available");
-		return JSON.parse(new TextDecoder().decode(await compactDecrypt(value, key.private).then((result) => result.plaintext)));
-	};
-	/**
-	* Resolves unique subject identifier from type and properties.
-	*/
-	const resolveSubject = async (type, properties) => {
-		const jsonString = JSON.stringify(properties);
-		const data = new TextEncoder().encode(jsonString);
-		const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-		return `${type}:${Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, 16)}`;
-	};
-	/**
-	* Generates access and refresh tokens for OAuth 2.0.
-	*/
-	const generateTokens = async (ctx, value, opts) => {
-		const refreshToken = value.nextToken ?? generateSecureToken();
-		if (opts?.generateRefreshToken ?? true) {
-			/**
-			* Generate and store the next refresh token after the one we are currently returning.
-			* Reserving these in advance avoids concurrency issues with multiple refreshes.
-			* Similar treatment should be given to any other values that may have race conditions,
-			* for example if a jti claim was added to the access token.
-			*/
-			const refreshPayload = {
-				type: value.type,
-				properties: value.properties,
-				clientID: value.clientID,
-				subject: value.subject,
-				ttl: value.ttl,
-				nextToken: generateSecureToken(),
-				timeUsed: value.timeUsed
-			};
-			const refreshKey = [
-				"oauth:refresh",
-				value.subject,
-				refreshToken
-			];
-			await Storage.set(storage, refreshKey, refreshPayload, value.ttl.refresh);
-		}
-		const signingKeyData = await signingKey();
-		if (!signingKeyData) throw new Error("Signing key not available");
-		const now = Math.floor(Date.now() / 1e3);
-		if (!value.clientID.trim()) throw new Error("Invalid audience: client ID cannot be empty");
-		return {
-			access: await new SignJWT({
-				type: value.type,
-				properties: value.properties,
-				sub: value.subject,
-				aud: value.clientID,
-				iss: issuer$1(ctx),
-				exp: now + value.ttl.access,
-				iat: now,
-				mode: "access"
-			}).setExpirationTime(Math.floor(now + value.ttl.access)).setProtectedHeader({
-				alg: signingKeyData.alg,
-				kid: signingKeyData.id,
-				typ: "JWT"
-			}).sign(signingKeyData.private),
-			refresh: [value.subject, refreshToken].join(":"),
-			expiresIn: Math.floor(now + value.ttl.access - Date.now() / 1e3)
-		};
-	};
-	/**
-	* Gets authorization state from context.
-	*/
-	const getAuthorization = async (ctx) => {
-		const match = await auth.get(ctx, "authorization") || ctx.get("authorization");
-		if (!match) throw new UnknownStateError();
-		return match;
-	};
-	/**
-	* Authentication utilities for providers.
-	*/
-	const auth = {
-		async success(ctx, properties, successOpts) {
-			const authorization = await getAuthorization(ctx);
-			const currentProvider = ctx.get("provider") || "unknown";
-			if (!authorization.client_id) throw new Error("client_id is required");
-			return await input.success({ async subject(type, properties$1, subjectOpts) {
-				const subject = subjectOpts?.subject ?? await resolveSubject(type, properties$1);
-				await successOpts?.invalidate?.(await resolveSubject(type, properties$1));
-				if (authorization.response_type === "token") {
-					if (!authorization.redirect_uri) throw new Error("redirect_uri is required");
-					const location$1 = new URL(authorization.redirect_uri);
-					if (!authorization.client_id) throw new Error("client_id is required");
-					const tokens = await generateTokens(ctx, {
-						type,
-						subject,
-						properties: properties$1,
-						clientID: authorization.client_id,
-						ttl: {
-							access: subjectOpts?.ttl?.access ?? ttlAccess,
-							refresh: subjectOpts?.ttl?.refresh ?? ttlRefresh
-						}
-					});
-					location$1.hash = new URLSearchParams({
-						access_token: tokens.access,
-						token_type: "Bearer",
-						expires_in: tokens.expiresIn.toString(),
-						...authorization.state && { state: authorization.state }
-					}).toString();
-					await auth.unset(ctx, "authorization");
-					return ctx.redirect(location$1.toString(), 302);
-				}
-				if (!authorization.redirect_uri) throw new Error("redirect_uri is required");
-				if (!authorization.client_id) throw new Error("client_id is required");
-				const code = generateSecureToken();
-				const codePayload = {
-					type,
-					properties: properties$1,
-					subject,
-					redirectURI: authorization.redirect_uri,
-					clientID: authorization.client_id,
-					scopes: authorization.scopes,
-					pkce: authorization.pkce,
-					ttl: {
-						access: subjectOpts?.ttl?.access ?? ttlAccess,
-						refresh: subjectOpts?.ttl?.refresh ?? ttlRefresh
-					}
-				};
-				await Storage.set(storage, ["oauth:code", code], codePayload, 60);
-				if (!authorization.redirect_uri) throw new Error("redirect_uri is required");
-				const location = new URL(authorization.redirect_uri);
-				location.searchParams.set("code", code);
-				if (authorization.state) location.searchParams.set("state", authorization.state);
-				await auth.unset(ctx, "authorization");
-				return ctx.redirect(location.toString(), 302);
-			} }, {
-				provider: currentProvider,
-				...properties && typeof properties === "object" ? properties : {}
-			}, ctx.request, authorization.client_id);
-		},
-		forward(ctx, response) {
-			return ctx.newResponse(response.body ?? void 0, {
-				status: response.status,
-				statusText: response.statusText,
-				headers: response.headers
-			});
-		},
-		async set(ctx, key, maxAge, value) {
-			const isHttps = isHttpsRequest(ctx);
-			setCookie(ctx, key, await encrypt(value), {
-				maxAge,
-				httpOnly: true,
-				secure: isHttps,
-				sameSite: isHttps ? "None" : "Lax",
-				path: input.basePath || "/"
-			});
-		},
-		async get(ctx, key) {
-			const raw = getCookie(ctx, key);
-			if (!raw) return;
-			try {
-				return await decrypt(raw);
-			} catch {
-				deleteCookie(ctx, key, { path: input.basePath || "/" });
-				return;
-			}
-		},
-		async unset(ctx, key) {
-			deleteCookie(ctx, key, { path: input.basePath || "/" });
-		},
-		async invalidate(subject) {
-			for await (const [key] of Storage.scan(storage, ["oauth:refresh", subject])) await Storage.remove(storage, key);
-		},
-		storage
-	};
-	const app = new Router({ basePath: input.basePath });
-	for (const [name, value] of Object.entries(input.providers)) {
-		const route = new Router();
-		route.use(async (c, next) => {
-			c.set("provider", name);
-			return await next();
-		});
-		value.init(route, {
-			name,
-			...auth
-		});
-		app.mount(`/${name}`, route);
-	}
-	app.get("/.well-known/jwks.json", {
-		middleware: [cors({
-			origin: "*",
-			allowHeaders: ["*"],
-			allowMethods: ["GET"],
-			credentials: false
-		})],
-		handler: async (c) => {
-			const jwksDocument = { keys: (await allSigning()).map((keyInfo) => ({
-				...keyInfo.jwk,
-				alg: keyInfo.alg,
-				exp: keyInfo.expired ? Math.floor(keyInfo.expired.getTime() / 1e3) : void 0
-			})) };
-			return c.json(jwksDocument);
-		}
-	});
-	app.get("/.well-known/oauth-authorization-server", {
-		middleware: [cors({
-			origin: "*",
-			allowHeaders: ["*"],
-			allowMethods: ["GET"],
-			credentials: false
-		})],
-		handler: (c) => {
-			const iss = issuer$1(c);
-			const oauth2Document = {
-				issuer: iss,
-				authorization_endpoint: `${iss}/authorize`,
-				token_endpoint: `${iss}/token`,
-				jwks_uri: `${iss}/.well-known/jwks.json`,
-				response_types_supported: ["code", "token"]
-			};
-			return c.json(oauth2Document);
-		}
-	});
-	app.post("/token", {
-		middleware: [cors({
-			origin: "*",
-			allowHeaders: ["*"],
-			allowMethods: ["POST"],
-			credentials: false
-		})],
-		handler: async (c) => {
-			const form = await c.formData();
-			const grantType = form.get("grant_type");
-			if (grantType === "authorization_code") {
-				const code = form.get("code");
-				if (!code) {
-					const error$1 = new OauthError("invalid_request", "Missing code");
-					return c.json(error$1.toJSON(), { status: 400 });
-				}
-				const key = ["oauth:code", code.toString()];
-				const { isValid, payload } = await normalizeTimingAsync(async () => {
-					const data = await Storage.get(storage, key);
-					const redirectUri = form.get("redirect_uri");
-					const clientId = form.get("client_id");
-					const valid = !!(data && data.redirectURI === redirectUri && data.clientID === clientId);
-					return {
-						isValid: valid,
-						payload: valid ? data : void 0
-					};
-				});
-				if (!isValid || !payload) {
-					const error$1 = new OauthError("invalid_grant", "Authorization code has been used or expired");
-					return c.json(error$1.toJSON(), { status: 400 });
-				}
-				if (payload.pkce) {
-					const codeVerifier = form.get("code_verifier")?.toString();
-					if (!codeVerifier) {
-						const error$1 = new OauthError("invalid_grant", "Missing code_verifier");
-						return c.json(error$1.toJSON(), { status: 400 });
-					}
-					if (!await validatePKCE(codeVerifier, payload.pkce.challenge, payload.pkce.method)) {
-						const error$1 = new OauthError("invalid_grant", "Code verifier does not match");
-						return c.json(error$1.toJSON(), { status: 400 });
-					}
-				}
-				const tokens = await generateTokens(c, payload);
-				await Storage.remove(storage, key);
-				const response = {
-					access_token: tokens.access,
-					token_type: "Bearer",
-					expires_in: tokens.expiresIn,
-					refresh_token: tokens.refresh
-				};
-				return c.json(response);
-			}
-			if (grantType === "refresh_token") {
-				const refreshToken = form.get("refresh_token");
-				if (!refreshToken) {
-					const error$1 = new OauthError("invalid_request", "Missing refresh_token");
-					return c.json(error$1.toJSON(), { status: 400 });
-				}
-				const refreshTokenStr = refreshToken.toString();
-				if (await Revocation.isRevoked(storage, refreshTokenStr)) {
-					const error$1 = new OauthError("invalid_grant", "Refresh token has been revoked");
-					return c.json(error$1.toJSON(), { status: 400 });
-				}
-				const splits = refreshTokenStr.split(":");
-				const token = splits.pop();
-				if (!token) throw new Error("Invalid refresh token format");
-				const subject = splits.join(":");
-				const key = [
-					"oauth:refresh",
-					subject,
-					token
-				];
-				const payload = await Storage.get(storage, key);
-				if (!payload) {
-					const error$1 = new OauthError("invalid_grant", "Refresh token has been used or expired");
-					return c.json(error$1.toJSON(), { status: 400 });
-				}
-				if (input.refresh) try {
-					const refreshResult = await input.refresh({
-						type: payload.type,
-						properties: payload.properties,
-						subject: payload.subject,
-						clientID: payload.clientID,
-						scopes: payload.scopes
-					}, c.request);
-					if (!refreshResult) {
-						await auth.invalidate(subject);
-						return c.json({
-							error: "invalid_grant",
-							error_description: "Refresh token is no longer valid"
-						}, { status: 400 });
-					}
-					payload.type = refreshResult.type;
-					payload.properties = refreshResult.properties;
-					if (refreshResult.subject) payload.subject = refreshResult.subject;
-					if (refreshResult.scopes) payload.scopes = refreshResult.scopes;
-				} catch {
-					return c.json({
-						error: "server_error",
-						error_description: "Internal server error during token refresh"
-					}, { status: 500 });
-				}
-				const generateRefreshToken = !payload.timeUsed;
-				if (ttlRefreshReuse <= 0) await Storage.remove(storage, key);
-				else if (!payload.timeUsed) {
-					payload.timeUsed = Date.now();
-					await Storage.set(storage, key, payload, ttlRefreshReuse + ttlRefreshRetention);
-				} else if (Date.now() > payload.timeUsed + ttlRefreshReuse * 1e3) {
-					await auth.invalidate(subject);
-					return c.json({
-						error: "invalid_grant",
-						error_description: "Refresh token has been used or expired"
-					}, { status: 400 });
-				}
-				const tokens = await generateTokens(c, {
-					type: payload.type,
-					properties: payload.properties,
-					subject: payload.subject,
-					clientID: payload.clientID,
-					ttl: {
-						access: ttlAccess,
-						refresh: ttlRefresh
-					}
-				}, { generateRefreshToken });
-				const response = {
-					access_token: tokens.access,
-					token_type: "Bearer",
-					refresh_token: tokens.refresh,
-					expires_in: tokens.expiresIn
-				};
-				return c.json(response);
-			}
-			return c.json({
-				error: "unsupported_grant_type",
-				error_description: "The authorization grant type is not supported by the authorization server"
-			}, { status: 400 });
-		}
-	});
-	app.post("/revoke", {
-		middleware: [cors({
-			origin: "*",
-			allowHeaders: ["Content-Type"],
-			allowMethods: ["POST"],
-			credentials: false
-		})],
-		handler: async (c) => {
-			const form = await c.formData();
-			const token = form.get("token")?.toString();
-			const tokenTypeHint = form.get("token_type_hint")?.toString();
-			if (!token) {
-				const error$1 = new OauthError("invalid_request", "Missing token parameter");
-				return c.json(error$1.toJSON(), { status: 400 });
-			}
-			try {
-				if (tokenTypeHint === "refresh_token") {
-					const splits$1 = token.split(":");
-					const tokenPart$1 = splits$1.pop();
-					if (tokenPart$1 && splits$1.length > 0) {
-						const key = [
-							"oauth:refresh",
-							splits$1.join(":"),
-							tokenPart$1
-						];
-						if (await Storage.get(storage, key)) {
-							await Storage.remove(storage, key);
-							const expiresAt$1 = Date.now() + ttlRefreshRetention * 1e3;
-							await Revocation.revoke(storage, token, expiresAt$1);
-							return c.json({});
-						}
-					}
-				} else if (tokenTypeHint === "access_token") {
-					const expiresAt$1 = Date.now() + ttlAccess * 1e3;
-					await Revocation.revoke(storage, token, expiresAt$1);
-					return c.json({});
-				}
-				const splits = token.split(":");
-				const tokenPart = splits.pop();
-				if (tokenPart && splits.length > 0) {
-					const key = [
-						"oauth:refresh",
-						splits.join(":"),
-						tokenPart
-					];
-					if (await Storage.get(storage, key)) {
-						await Storage.remove(storage, key);
-						const expiresAt$1 = Date.now() + ttlRefreshRetention * 1e3;
-						await Revocation.revoke(storage, token, expiresAt$1);
-						return c.json({});
-					}
-				}
-				const expiresAt = Date.now() + ttlAccess * 1e3;
-				await Revocation.revoke(storage, token, expiresAt);
-				return c.json({});
-			} catch (_err) {
-				return c.json({
-					error: "server_error",
-					error_description: "Token revocation failed"
-				}, { status: 500 });
-			}
-		}
-	});
-	app.get("/authorize", async (c) => {
-		const provider = c.query("provider");
-		const response_type = c.query("response_type");
-		const redirect_uri = c.query("redirect_uri");
-		const state = c.query("state");
-		const client_id = c.query("client_id");
-		const audience = c.query("audience");
-		const code_challenge = c.query("code_challenge");
-		const code_challenge_method = c.query("code_challenge_method");
-		const scope = c.query("scope");
-		const authorization = {
-			response_type,
-			redirect_uri,
-			state,
-			client_id,
-			audience,
-			scope,
-			scopes: scope ? scope.split(" ").filter(Boolean) : void 0,
-			...code_challenge && code_challenge_method && { pkce: {
-				challenge: code_challenge,
-				method: code_challenge_method
-			} }
-		};
-		c.set("authorization", authorization);
-		if (!redirect_uri) return c.text("Missing redirect_uri", { status: 400 });
-		try {
-			const uri = new URL(redirect_uri);
-			if (!uri.protocol || !uri.host) return c.text("Invalid redirect_uri format", { status: 400 });
-		} catch {
-			return c.text("Invalid redirect_uri format", { status: 400 });
-		}
-		if (!response_type) throw new MissingParameterError("response_type");
-		if (!client_id) throw new MissingParameterError("client_id");
-		if (input.start) await input.start(c.request);
-		if (!await allow()({
-			clientID: client_id,
-			redirectURI: redirect_uri,
-			audience
-		}, c.request)) throw new UnauthorizedClientError(client_id, redirect_uri);
-		await auth.set(c, "authorization", 900, authorization);
-		if (provider) return c.redirect(`${provider}/authorize`);
-		const availableProviders = Object.keys(input.providers);
-		if (availableProviders.length === 1) return c.redirect(`${availableProviders[0]}/authorize`);
-		return auth.forward(c, await select()(Object.fromEntries(Object.entries(input.providers).map(([key, value]) => [key, value.type])), c.request));
-	});
-	app.onError(async (err, c) => {
-		if (err instanceof UnknownStateError) return auth.forward(c, await error(err, c.request));
-		try {
-			const authorization = await getAuthorization(c);
-			if (!authorization.redirect_uri) throw new Error("redirect_uri is required");
-			const url = new URL(authorization.redirect_uri);
-			const oauth = err instanceof OauthError ? err : new OauthError("server_error", err.message);
-			url.searchParams.set("error", oauth.error);
-			url.searchParams.set("error_description", oauth.description);
-			if (authorization.state) url.searchParams.set("state", authorization.state);
-			return c.redirect(url.toString());
-		} catch {
-			return c.json({
-				error: "server_error",
-				error_description: err.message
-			}, { status: 500 });
-		}
-	});
-	return app;
-};
-
-//#endregion
-export { issuer };