@eminuckan/spine 0.3.8 → 0.3.9

package/dist/{server-C3_iNZfj.mjs → server-Cw86FdT-.mjs}

@@ -1,5 +1,5 @@
 import { logger } from "./logging/index.mjs";
-import { S as updateAuthSession, a as createOAuthState, d as destroyAuthSessionsBySid, f as destroyAuthSessionsForUser, g as getOAuthState, i as createAuthSession, l as destroyAuthSessionsByIdentitySession, o as deleteOAuthState, p as getAuthSession, s as destroyAuthSession, t as AUTH_ERROR_COOKIE_PREFIX, v as listAuthSessionDataForUser } from "./redis-session-storage.server-n0lWWyoh.mjs";
+import { C as OAUTH_STATE_TTL_MS, S as updateAuthSession, a as createOAuthState, d as destroyAuthSessionsBySid, f as destroyAuthSessionsForUser, g as getOAuthState, i as createAuthSession, l as destroyAuthSessionsByIdentitySession, o as deleteOAuthState, p as getAuthSession, s as destroyAuthSession, t as AUTH_ERROR_COOKIE_PREFIX, v as listAuthSessionDataForUser, w as OAUTH_STATE_TTL_SECONDS } from "./redis-session-storage.server-CI_IYIn8.mjs";
 import * as oidc from "openid-client";
 import { createRemoteJWKSet, errors, jwtVerify } from "jose";
 //#region src/http/response.ts
@@ -132,6 +132,75 @@ function serializeTemporaryAuthCookie(name, value, options) {
 	return segments.join("; ");
 }
 //#endregion
+//#region src/auth/callback-errors.ts
+const OAuthCallbackFailureCodes = {
+	StaleTransaction: "stale_transaction",
+	StateMismatch: "state_mismatch",
+	MalformedCallback: "malformed_callback",
+	ApplicationActionFailed: "application_action_failed",
+	TokenExchangeFailed: "token_exchange_failed",
+	SessionCreationFailed: "session_creation_failed",
+	StorageError: "storage_error",
+	ConfigurationError: "configuration_error"
+};
+const OAUTH_CALLBACK_ERROR_BRAND = Symbol.for("@eminuckan/spine/OAuthCallbackError");
+function isOAuthCallbackFailureCode(value) {
+	return typeof value === "string" && Object.values(OAuthCallbackFailureCodes).includes(value);
+}
+function isHeadersLike(value) {
+	return value !== null && typeof value === "object" && typeof value.get === "function" && typeof value.append === "function";
+}
+function getSetCookieValues(headers) {
+	const getSetCookie = headers.getSetCookie;
+	if (getSetCookie) return getSetCookie.call(headers);
+	return Array.from(headers).reduce((cookies, [name, value]) => {
+		if (name.toLowerCase() === "set-cookie") cookies.push(value);
+		return cookies;
+	}, []);
+}
+/**
+* A callback failure that consumers can classify without parsing messages.
+*
+* The message is intentionally constant.  Consumers should branch on
+* `code`, not on `message`, and should merge `cleanupHeaders` (or the
+* lossless `cleanupSetCookies` values) with any response they create using
+* repeated `Set-Cookie` appends.
+*/
+var OAuthCallbackError = class extends Error {
+	code;
+	cleanupHeaders;
+	cleanupSetCookies;
+	constructor(code, cleanupHeaders = {}) {
+		super("Authentication failed");
+		this.name = "OAuthCallbackError";
+		this.code = code;
+		this.cleanupHeaders = new Headers(cleanupHeaders);
+		this.cleanupSetCookies = getSetCookieValues(this.cleanupHeaders);
+		Object.defineProperty(this, OAUTH_CALLBACK_ERROR_BRAND, {
+			configurable: false,
+			enumerable: false,
+			value: true,
+			writable: false
+		});
+	}
+};
+/**
+* Cross-package-copy safe type guard for callback failures.
+*/
+function isOAuthCallbackError(error) {
+	if (error instanceof OAuthCallbackError) return true;
+	if (error === null || typeof error !== "object") return false;
+	const candidate = error;
+	return candidate[OAUTH_CALLBACK_ERROR_BRAND] === true && isOAuthCallbackFailureCode(candidate.code) && isHeadersLike(candidate.cleanupHeaders);
+}
+/**
+* Only a normal authorization callback whose local transaction is absent or
+* expired may be retried.  All other callback failures fail closed.
+*/
+function isRecoverableOAuthCallbackError(error) {
+	return isOAuthCallbackError(error) && error.code === "stale_transaction";
+}
+//#endregion
 //#region src/auth/auth.server.ts
 /**
 * OpenID Connect Authentication Server Module
@@ -384,11 +453,12 @@ async function getOAuthConfig() {
 		});
 		return configuration;
 	} catch (error) {
-		logger.error("OIDC discovery failed", error instanceof Error ? error : void 0, {
+		logger.error("OIDC discovery failed", void 0, {
 			authority: config.authority,
-			clientId: config.clientId
+			clientId: config.clientId,
+			errorType: error instanceof Error ? error.name : "UnknownError"
 		});
-		throw new Error(`OIDC discovery failed: ${getOAuthErrorMessage(error)}`);
+		throw new Error("OIDC discovery failed");
 	}
 }
 function getJwks(jwksUri) {
@@ -661,6 +731,74 @@ function clearAuthErrorHeaders() {
 function hasAuthError(request) {
 	return request.headers.get("Cookie")?.includes(`${AUTH_ERROR_COOKIE}=`) ?? false;
 }
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function getOAuthStateIdFromRequest(request) {
+	const cookies = request.headers.get("Cookie");
+	if (!cookies) return null;
+	const cookieRegex = new RegExp(`(?:^|;\\s*)${escapeRegExp(OAUTH_STATE_COOKIE)}=([^;]*)`);
+	const cookieValue = cookies.match(cookieRegex)?.[1];
+	if (!cookieValue) return null;
+	try {
+		const stateId = decodeURIComponent(cookieValue);
+		return stateId.length > 0 ? stateId : null;
+	} catch {
+		return null;
+	}
+}
+function hasNonEmptyCallbackValue(value) {
+	return value !== null && value.trim().length > 0;
+}
+function appendHeadersPreservingSetCookie(target, source) {
+	const sourceHeaders = new Headers(source);
+	const setCookies = sourceHeaders.getSetCookie?.call(sourceHeaders) ?? Array.from(sourceHeaders).filter(([name]) => name.toLowerCase() === "set-cookie").map(([, value]) => value);
+	if (setCookies.length > 0) for (const cookie of setCookies) target.append("Set-Cookie", cookie);
+	else {
+		const setCookie = sourceHeaders.get("Set-Cookie");
+		if (setCookie) target.append("Set-Cookie", setCookie);
+	}
+	for (const [name, value] of sourceHeaders) if (name.toLowerCase() !== "set-cookie") target.set(name, value);
+}
+function appendOAuthStateCookieClear(headers) {
+	headers.append("Set-Cookie", serializeTemporaryAuthCookie(OAUTH_STATE_COOKIE, "", { maxAge: 0 }));
+}
+function isUsableOAuthState(state, requireNonce) {
+	return state !== null && typeof state.state === "string" && state.state.length > 0 && typeof state.codeVerifier === "string" && state.codeVerifier.length > 0 && (state.nonce === void 0 ? !requireNonce : typeof state.nonce === "string" && state.nonce.length > 0) && typeof state.createdAt === "number" && Number.isFinite(state.createdAt) && (state.returnUrl === void 0 || typeof state.returnUrl === "string") && (state.kcAction === void 0 || typeof state.kcAction === "string");
+}
+function getCallbackFailureCode(error, stage) {
+	if (isOAuthCallbackError(error)) return error.code;
+	switch (stage) {
+		case "configuration": return OAuthCallbackFailureCodes.ConfigurationError;
+		case "state":
+		case "storage": return OAuthCallbackFailureCodes.StorageError;
+		case "application_action": return OAuthCallbackFailureCodes.ApplicationActionFailed;
+		case "token_exchange": return OAuthCallbackFailureCodes.TokenExchangeFailed;
+		case "session_creation": return OAuthCallbackFailureCodes.SessionCreationFailed;
+		default: return OAuthCallbackFailureCodes.StorageError;
+	}
+}
+async function createOAuthCallbackFailure(request, stateId, failureCode) {
+	const cleanupHeaders = new Headers();
+	let cleanupError;
+	if (stateId) try {
+		await deleteOAuthState(stateId);
+	} catch (error) {
+		cleanupError = error;
+	}
+	try {
+		appendHeadersPreservingSetCookie(cleanupHeaders, await destroyAuthSession(request));
+	} catch (error) {
+		cleanupError ??= error;
+	}
+	appendOAuthStateCookieClear(cleanupHeaders);
+	const effectiveFailureCode = cleanupError ? OAuthCallbackFailureCodes.StorageError : failureCode;
+	if (cleanupError) logger.warn("OAuth callback cleanup failed", {
+		failureCode: effectiveFailureCode,
+		errorType: cleanupError instanceof Error ? cleanupError.name : "UnknownError"
+	});
+	return new OAuthCallbackError(effectiveFailureCode, cleanupHeaders);
+}
 /**
 * Initiate OAuth login flow
 * 
@@ -713,7 +851,7 @@ async function login(request, returnUrlOrOptions) {
 		if (options.kcAction) authorizationParameters.kc_action = options.kcAction;
 		const authorizationUrl = oidc.buildAuthorizationUrl(oidcConfig, authorizationParameters);
 		const headers = new Headers();
-		headers.append("Set-Cookie", serializeTemporaryAuthCookie(OAUTH_STATE_COOKIE, stateId, { maxAge: 600 }));
+		headers.append("Set-Cookie", serializeTemporaryAuthCookie(OAUTH_STATE_COOKIE, stateId, { maxAge: OAUTH_STATE_TTL_SECONDS }));
 		logger.info("OIDC authorization flow initiated", {
 			clientId: config.clientId,
 			redirectUri: config.redirectUri,
@@ -742,9 +880,13 @@ async function login(request, returnUrlOrOptions) {
 *   - Redirect to home to start fresh login
 */
 async function handleCallback(request) {
+	let stateId = null;
+	let callbackStage = "configuration";
 	try {
+		stateId = getOAuthStateIdFromRequest(request);
 		const config = getAuthConfig();
 		const hasLandingPage = getEffectiveHasLandingPage(config);
+		const requiresNonce = config.scope.split(/\s+/).includes("openid");
 		const url = new URL(request.url);
 		const code = url.searchParams.get("code");
 		const state = url.searchParams.get("state");
@@ -752,28 +894,31 @@ async function handleCallback(request) {
 		const errorDescription = url.searchParams.get("error_description");
 		const kcAction = url.searchParams.get("kc_action");
 		const kcActionStatus = url.searchParams.get("kc_action_status");
+		const hasCode = hasNonEmptyCallbackValue(code);
+		const hasState = hasNonEmptyCallbackValue(state);
+		const hasApplicationAction = Boolean(hasNonEmptyCallbackValue(kcAction) || hasNonEmptyCallbackValue(kcActionStatus));
 		logger.info("OIDC callback received", {
-			hasCode: !!code,
-			hasState: !!state,
+			hasCode,
+			hasState,
 			hasError: Boolean(error),
 			hasErrorDescription: Boolean(errorDescription),
-			hasKcAction: Boolean(kcAction),
-			hasKcActionStatus: Boolean(kcActionStatus),
+			hasKcAction: hasNonEmptyCallbackValue(kcAction),
+			hasKcActionStatus: hasNonEmptyCallbackValue(kcActionStatus),
 			clientId: config.clientId,
 			redirectUri: config.redirectUri
 		});
 		if (error) {
-			if (kcActionStatus && state) {
-				const cookies = request.headers.get("Cookie");
-				const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);
-				const stateId = (cookies?.match(oauthStateRegex))?.[1];
+			if (kcActionStatus && hasState) {
+				callbackStage = "state";
 				if (stateId) {
-					const oauthState = await getOAuthState(stateId);
+					const oauthState = await getOAuthState(stateId, { throwOnMalformed: true });
 					const stateAge = oauthState ? Date.now() - oauthState.createdAt : Number.POSITIVE_INFINITY;
-					if (oauthState && oauthState.state === state && stateAge <= 600 * 1e3) {
+					if (oauthState && isUsableOAuthState(oauthState, requiresNonce) && oauthState.state === state && stateAge <= OAUTH_STATE_TTL_MS) {
+						callbackStage = "storage";
 						await deleteOAuthState(stateId);
+						callbackStage = "application_action";
 						const headers = new Headers();
-						headers.append("Set-Cookie", serializeTemporaryAuthCookie(OAUTH_STATE_COOKIE, "", { maxAge: 0 }));
+						appendOAuthStateCookieClear(headers);
 						const redirectUrl = appendApplicationInitiatedActionResult(sanitizeOAuthReturnUrl(oauthState.returnUrl, request) ?? "/", kcAction || oauthState.kcAction, kcActionStatus);
 						logger.info("Application initiated action returned with OAuth error", {
 							hasError: Boolean(error),
@@ -794,9 +939,12 @@ async function handleCallback(request) {
 			});
 			if (error === "access_denied") {
 				logger.warn("Access denied for this application", { clientId: config.clientId });
+				callbackStage = "storage";
+				if (stateId) await deleteOAuthState(stateId);
 				const headers = await destroyAuthSession(request);
+				appendOAuthStateCookieClear(headers);
 				headers.append("Set-Cookie", serializeTemporaryAuthCookie(AUTH_ERROR_COOKIE, "access_denied", { maxAge: 300 }));
-				headers.append("Set-Cookie", serializeTemporaryAuthCookie(AUTH_ERROR_DESC_COOKIE, errorDescription || "You do not have access to this application.", { maxAge: 300 }));
+				headers.append("Set-Cookie", serializeTemporaryAuthCookie(AUTH_ERROR_DESC_COOKIE, "You do not have access to this application.", { maxAge: 300 }));
 				const baseUrl = new URL(config.redirectUri).origin;
 				logger.info("Redirecting to /auth/login to show access_denied error", {
 					hasLandingPage,
@@ -807,30 +955,47 @@ async function handleCallback(request) {
 			}
 			if (error === "login_required") {
 				logger.info("Login required, user session may have expired");
+				callbackStage = "storage";
+				if (stateId) await deleteOAuthState(stateId);
 				const headers = await destroyAuthSession(request);
+				appendOAuthStateCookieClear(headers);
 				const baseUrl = new URL(config.redirectUri).origin;
 				return createRedirectResponse(baseUrl, { headers });
 			}
+			callbackStage = "storage";
+			if (stateId) await deleteOAuthState(stateId);
 			const headers = await destroyAuthSession(request);
+			appendOAuthStateCookieClear(headers);
 			headers.append("Set-Cookie", serializeTemporaryAuthCookie(AUTH_ERROR_COOKIE, error, { maxAge: 300 }));
-			if (errorDescription) headers.append("Set-Cookie", serializeTemporaryAuthCookie(AUTH_ERROR_DESC_COOKIE, errorDescription, { maxAge: 300 }));
 			const baseUrl = new URL(config.redirectUri).origin;
 			return createRedirectResponse(baseUrl, { headers });
 		}
-		const cookies = request.headers.get("Cookie");
-		const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);
-		const stateId = (cookies?.match(oauthStateRegex))?.[1];
-		if (!stateId) throw new Error("OAuth state ID not found in cookie");
-		const oauthState = await getOAuthState(stateId);
-		if (!oauthState) throw new Error("No OAuth state found - state may have expired");
-		if (!state) throw new Error("Missing required callback state parameter");
-		if (oauthState.state !== state) throw new Error(`OAuth state mismatch`);
-		if (Date.now() - oauthState.createdAt > 600 * 1e3) throw new Error("OAuth state expired");
-		if (!code) {
+		if (!hasState) {
+			callbackStage = hasApplicationAction ? "application_action" : "state";
+			throw new OAuthCallbackError(hasApplicationAction ? OAuthCallbackFailureCodes.ApplicationActionFailed : OAuthCallbackFailureCodes.MalformedCallback);
+		}
+		if (!hasCode && !hasApplicationAction) {
+			callbackStage = "state";
+			throw new OAuthCallbackError(OAuthCallbackFailureCodes.MalformedCallback);
+		}
+		if (!stateId) {
+			callbackStage = hasApplicationAction ? "application_action" : "state";
+			throw new OAuthCallbackError(hasApplicationAction ? OAuthCallbackFailureCodes.ApplicationActionFailed : OAuthCallbackFailureCodes.StaleTransaction);
+		}
+		callbackStage = "state";
+		const oauthState = await getOAuthState(stateId, { throwOnMalformed: true });
+		if (!oauthState) throw new OAuthCallbackError(hasApplicationAction ? OAuthCallbackFailureCodes.ApplicationActionFailed : OAuthCallbackFailureCodes.StaleTransaction);
+		if (!isUsableOAuthState(oauthState, requiresNonce)) throw new OAuthCallbackError(OAuthCallbackFailureCodes.StorageError);
+		if (oauthState.state !== state) throw new OAuthCallbackError(OAuthCallbackFailureCodes.StateMismatch);
+		const isApplicationAction = Boolean(hasApplicationAction || oauthState.kcAction);
+		if (Date.now() - oauthState.createdAt > OAUTH_STATE_TTL_MS) throw new OAuthCallbackError(isApplicationAction ? OAuthCallbackFailureCodes.ApplicationActionFailed : OAuthCallbackFailureCodes.StaleTransaction);
+		if (!hasCode) {
 			if (kcActionStatus) {
+				callbackStage = "storage";
 				await deleteOAuthState(stateId);
+				callbackStage = "application_action";
 				const headers = new Headers();
-				headers.append("Set-Cookie", serializeTemporaryAuthCookie(OAUTH_STATE_COOKIE, "", { maxAge: 0 }));
+				appendOAuthStateCookieClear(headers);
 				const redirectUrl = appendApplicationInitiatedActionResult(sanitizeOAuthReturnUrl(oauthState.returnUrl, request) ?? "/", kcAction || oauthState.kcAction, kcActionStatus);
 				logger.info("Application initiated action returned without authorization code", {
 					hasKcAction: Boolean(kcAction || oauthState.kcAction),
@@ -838,11 +1003,13 @@ async function handleCallback(request) {
 				});
 				return createRedirectResponse(redirectUrl, { headers });
 			}
-			throw new Error("Missing required callback code parameter");
+			throw new OAuthCallbackError(isApplicationAction ? OAuthCallbackFailureCodes.ApplicationActionFailed : OAuthCallbackFailureCodes.MalformedCallback);
 		}
 		logger.info("Initiating token exchange");
+		callbackStage = "configuration";
 		const oidcConfig = await getOAuthConfig();
 		const authorizationResponseUrl = createAuthorizationResponseUrl(request.url, config.redirectUri);
+		callbackStage = "token_exchange";
 		const tokenResult = await oidc.authorizationCodeGrant(oidcConfig, authorizationResponseUrl, {
 			pkceCodeVerifier: oauthState.codeVerifier,
 			expectedState: oauthState.state,
@@ -850,22 +1017,24 @@ async function handleCallback(request) {
 			idTokenExpected: config.scope.split(/\s+/).includes("openid")
 		});
 		logger.info("Token exchange completed successfully");
-		const sessionHeaders = await createAuthSession(request, await createSessionData(tokenResult, getClaimsFromTokenResponse(tokenResult)));
+		callbackStage = "session_creation";
+		const newSessionData = await createSessionData(tokenResult, getClaimsFromTokenResponse(tokenResult));
+		callbackStage = "session_creation";
+		const sessionHeaders = await createAuthSession(request, newSessionData);
+		callbackStage = "storage";
 		await deleteOAuthState(stateId);
-		const headers = new Headers(sessionHeaders);
-		headers.append("Set-Cookie", serializeTemporaryAuthCookie(OAUTH_STATE_COOKIE, "", { maxAge: 0 }));
+		const headers = new Headers();
+		appendHeadersPreservingSetCookie(headers, sessionHeaders);
+		appendOAuthStateCookieClear(headers);
 		logger.info("OAuth callback processed successfully");
 		return createRedirectResponse(appendApplicationInitiatedActionResult(sanitizeOAuthReturnUrl(oauthState.returnUrl, request) ?? "/", kcAction || oauthState.kcAction, kcActionStatus), { headers });
 	} catch (error) {
-		logger.error("OAuth callback failed", void 0, { errorType: error instanceof Error ? error.name : "UnknownError" });
-		try {
-			const cookies = request.headers.get("Cookie");
-			const oauthStateRegex = new RegExp(`${OAUTH_STATE_COOKIE}=([^;]+)`);
-			const stateId = (cookies?.match(oauthStateRegex))?.[1];
-			if (stateId) await deleteOAuthState(stateId);
-		} catch {}
-		await destroyAuthSession(request);
-		throw new Error("Authentication failed");
+		const failureCode = getCallbackFailureCode(error, callbackStage);
+		logger.error("OAuth callback failed", void 0, {
+			failureCode,
+			errorType: error instanceof Error ? error.name : "UnknownError"
+		});
+		throw await createOAuthCallbackFailure(request, stateId, failureCode);
 	}
 }
 /**
@@ -1439,6 +1608,6 @@ function shouldAttemptTokenRefresh(response, hasAuth) {
 	return hasAuth && isTokenExpiredResponse(response);
 }
 //#endregion
-export { resetAuthClaimMapping as A, handleCallback as C, logout as D, login as E, refreshTokens as O, handleBackChannelLogout as S, hasAuthError as T, createAuthorizationResponseUrl as _, configureRouteProtection as a, getAuthError as b, protectRoute as c, resetRouteProtectionConfig as d, shouldRefreshToken as f, configureAuthClaimMapping as g, clearAuthServerCache as h, authRoute as i, requireAuth as k, protectedRoute as l, clearAuthErrorHeaders as m, isTokenExpiredResponse as n, onboardingRoute as o, subscriptionRoute as p, shouldAttemptTokenRefresh as r, policyRoute as s, attemptTokenRefresh as t, publicRoute as u, extractUserInfo as v, handleFrontChannelLogout as w, getUser as x, getAccessToken as y };
+export { resetAuthClaimMapping as A, handleCallback as C, logout as D, login as E, OAuthCallbackFailureCodes as M, isOAuthCallbackError as N, refreshTokens as O, isRecoverableOAuthCallbackError as P, handleBackChannelLogout as S, hasAuthError as T, createAuthorizationResponseUrl as _, configureRouteProtection as a, getAuthError as b, protectRoute as c, resetRouteProtectionConfig as d, shouldRefreshToken as f, configureAuthClaimMapping as g, clearAuthServerCache as h, authRoute as i, OAuthCallbackError as j, requireAuth as k, protectedRoute as l, clearAuthErrorHeaders as m, isTokenExpiredResponse as n, onboardingRoute as o, subscriptionRoute as p, shouldAttemptTokenRefresh as r, policyRoute as s, attemptTokenRefresh as t, publicRoute as u, extractUserInfo as v, handleFrontChannelLogout as w, getUser as x, getAccessToken as y };
 
-//# sourceMappingURL=server-C3_iNZfj.mjs.map
+//# sourceMappingURL=server-Cw86FdT-.mjs.map