@everystack/auth 0.1.0 → 0.2.1

package/src/postgres.ts

@@ -3,7 +3,7 @@
  *
  * Password hashing: crypt() / gen_salt('bf') via auth.hash_password()
  * JWT signing: hmac() via auth.sign_jwt()
- * Refresh tokens: auth.generate_refresh_token() / auth.validate_refresh_token()
+ * Refresh tokens: auth.issue_refresh_token() / auth.validate_refresh_token()
  *
  * Uses postgres.js tagged templates directly (not drizzle's sql) because
  * drizzle expands arrays into individual params instead of PostgreSQL arrays.
@@ -15,16 +15,52 @@
 import { and, eq } from 'drizzle-orm';
 import { createJwt } from './jwt';
 import { hmacNode } from './jwt/hmac-node';
+import type { RefreshTokenOptions } from './refresh';
 import type { AuthHandlers, AuthOptions, TokenPayload } from './index';
+import { getPasswordHash, withPassword } from './index';
 import type { OAuthProvider } from './oauth';
 import { getRefreshFromCookies } from './cookies';
 import { authResponse, signoutResponse } from './response';
+import type { CookieConfig } from './response';
+import { validateCsrfOrigin } from './csrf';
 
 const TOKEN_EXPIRY_SECONDS = 3600; // 1 hour
 
+/**
+ * Dummy bcrypt hash for timing-safe user enumeration protection.
+ * When a user is not found, we still run bcrypt against this hash
+ * so response time is constant regardless of whether the email exists.
+ */
+const DUMMY_BCRYPT_HASH = '$2a$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ012345';
+
+/**
+ * Extract client IP and user agent from a request for refresh token metadata.
+ * When repositoryId is provided, it's included for multi-tenant scoping.
+ */
+function extractRequestMeta(request: Request, repositoryId?: string): RefreshTokenOptions {
+  const forwarded = request.headers.get('x-forwarded-for');
+  const ipAddress = forwarded ? forwarded.split(',')[0].trim() : undefined;
+  const userAgent = request.headers.get('user-agent') ?? undefined;
+  return { repositoryId, ipAddress, userAgent };
+}
+
+/** Run CSRF origin check if cookies are configured with allowedOrigins. */
+function csrfCheck(request: Request, cookies?: CookieConfig): Response | null {
+  if (!cookies || cookies === true) return null;
+  return validateCsrfOrigin(request, cookies.allowedOrigins);
+}
+
 export function createPostgresAuthHandlers(
   db: any,
-  schema: { users: any; profiles: any; sessions?: any; credentials?: any; identities?: any },
+  schema: {
+    users: any;
+    profiles: any;
+    refreshTokens?: any;
+    /** Legacy OAuth tables. Use `oauth.callbacks` instead for new apps. */
+    credentials?: any;
+    /** Legacy OAuth tables. Use `oauth.callbacks` instead for new apps. */
+    identities?: any;
+  },
   jwtSecret: Uint8Array,
   options?: AuthOptions,
 ): AuthHandlers {
@@ -34,16 +70,25 @@ export function createPostgresAuthHandlers(
   }
 
   const { users, profiles } = schema;
+  const refreshTable = schema.refreshTokens;
   const jwtSecretString = new TextDecoder().decode(jwtSecret);
 
   /**
    * Sign JWT via PostgreSQL pgcrypto hmac().
    * Requires GUC app.jwt_secret — uses pgSql.begin() for transaction-local setting.
+   * When enrichClaims is configured and a request is provided, merges extra claims.
    */
-  async function signJwtPg(payload: Record<string, unknown>): Promise<string> {
+  async function signJwtPg(payload: Record<string, unknown>, request?: Request): Promise<string> {
+    let claims = payload;
+    if (options?.enrichClaims && request) {
+      const extra = await options.enrichClaims(claims, request);
+      if (extra && Object.keys(extra).length > 0) {
+        claims = { ...claims, ...extra };
+      }
+    }
     const now = Math.floor(Date.now() / 1000);
     const fullPayload = {
-      ...payload,
+      ...claims,
       iat: now,
       exp: now + TOKEN_EXPIRY_SECONDS,
     };
@@ -72,29 +117,62 @@ export function createPostgresAuthHandlers(
   }
 
   /**
-   * Generate refresh token via PostgreSQL.
+   * Issue refresh token via PostgreSQL SECURITY DEFINER function.
+   * Handles family ceiling, SHA-256 hashing, and token generation atomically.
    */
-  async function generateRefreshTokenPg(userId: string): Promise<string> {
-    const rows = await pgSql`SELECT auth.generate_refresh_token(${userId}::uuid) as generate_refresh_token`;
-    return rows[0].generate_refresh_token;
+  async function issueRefreshTokenPg(
+    userId: string,
+    repositoryId?: string,
+    ipAddress?: string,
+    userAgent?: string,
+    deviceId?: string,
+  ): Promise<{ token: string; familyId: string }> {
+    const repoId = repositoryId ?? null;
+    const rows = await pgSql`SELECT auth.issue_refresh_token(
+      ${userId}::uuid,
+      NULL::uuid,
+      ${ipAddress ?? null},
+      ${userAgent ?? null},
+      ${deviceId ?? null}::uuid,
+      ${repoId}::uuid
+    ) as result`;
+    const result = typeof rows[0].result === 'string' ? JSON.parse(rows[0].result) : rows[0].result;
+    return { token: result.token, familyId: result.familyId };
   }
 
   /**
    * Validate and rotate refresh token via PostgreSQL.
-   * The SQL function handles its own transactional locking (FOR UPDATE).
-   * Returns { userId, token, familyId }.
+   * The SQL function handles SELECT FOR UPDATE, reuse detection, user state check.
    */
-  async function validateRefreshTokenPg(token: string): Promise<{ userId: string; token: string; familyId: string }> {
-    const rows = await pgSql`SELECT auth.validate_refresh_token(${token}) as validate_refresh_token`;
-    const result = rows[0].validate_refresh_token;
-    return typeof result === 'string' ? JSON.parse(result) : result;
+  async function validateRefreshTokenPg(
+    token: string,
+    deviceId?: string,
+    ipAddress?: string,
+    userAgent?: string,
+  ): Promise<{ userId: string; token: string; familyId: string }> {
+    const rows = await pgSql`SELECT auth.validate_refresh_token(
+      ${token},
+      ${deviceId ?? null}::uuid,
+      ${ipAddress ?? null},
+      ${userAgent ?? null}
+    ) as result`;
+    const result = typeof rows[0].result === 'string' ? JSON.parse(rows[0].result) : rows[0].result;
+    // token_reused returns as JSONB { error: 'token_reused' } instead of RAISE
+    // because PostgreSQL rolls back DELETEs when exceptions propagate.
+    if (result.error === 'token_reused') {
+      const err: any = new Error('token_reused');
+      err.code = 'P0002';
+      throw err;
+    }
+    return { userId: result.userId, token: result.token, familyId: result.familyId };
   }
 
   /**
-   * Revoke all refresh tokens for a user.
+   * Revoke all refresh tokens for a user, optionally scoped by repository.
    */
-  async function revokeRefreshTokensPg(userId: string): Promise<void> {
-    await pgSql`SELECT auth.revoke_refresh_tokens(${userId}::uuid)`;
+  async function revokeRefreshTokensPg(userId: string, repositoryId?: string): Promise<void> {
+    const repoId = repositoryId ?? null;
+    await pgSql`SELECT auth.revoke_refresh_tokens(${userId}::uuid, NULL::uuid, ${repoId}::uuid)`;
   }
 
   // JS-side verifier (compatible with HS256 tokens minted by SQL or JS).
@@ -111,6 +189,10 @@ export function createPostgresAuthHandlers(
     },
 
     signup: async (request: Request): Promise<Response> => {
+      const csrfError = csrfCheck(request, options?.cookies);
+      if (csrfError) return csrfError;
+
+      const enrichRequest = options?.enrichClaims ? request.clone() : undefined;
       const { email, password, username, displayName } = await request.json();
 
       if (!email || !password || !username || !displayName) {
@@ -126,15 +208,21 @@ export function createPostgresAuthHandlers(
         .where(eq(users.email, email))
         .limit(1);
       if (existing.length > 0) {
+        if (options?.uniformSignupResponse) {
+          return Response.json(
+            { message: 'Check your email to continue.' },
+            { status: 200 },
+          );
+        }
         return Response.json(
           { message: 'Email already registered' },
           { status: 409 },
         );
       }
 
-      const passwordHash = await hashPasswordPg(password);
+      const hash = await hashPasswordPg(password);
       const { user, profile } = await db.transaction(async (tx: any) => {
-        const [u] = await tx.insert(users).values({ email, passwordHash }).returning();
+        const [u] = await tx.insert(users).values(withPassword(users, { email }, hash)).returning();
         const [p] = await tx.insert(profiles).values({ id: u.id, username, displayName }).returning();
         return { user: u, profile: p };
       });
@@ -143,11 +231,19 @@ export function createPostgresAuthHandlers(
         sub: user.id,
         email: user.email,
         role: user.role ?? 'authenticated',
-      });
-
-      const refreshToken = schema.sessions
-        ? await generateRefreshTokenPg(user.id)
-        : await signJwtPg({ sub: user.id });
+      }, enrichRequest);
+
+      const meta = extractRequestMeta(request, options?.repositoryId);
+      let refreshToken: string;
+      if (refreshTable) {
+        // Prefer PG function path when sql client is available
+        const result = await issueRefreshTokenPg(
+          user.id, meta.repositoryId, meta.ipAddress, meta.userAgent,
+        );
+        refreshToken = result.token;
+      } else {
+        refreshToken = await signJwtPg({ sub: user.id });
+      }
 
       return authResponse(
         {
@@ -167,6 +263,10 @@ export function createPostgresAuthHandlers(
     },
 
     signin: async (request: Request): Promise<Response> => {
+      const csrfError = csrfCheck(request, options?.cookies);
+      if (csrfError) return csrfError;
+
+      const enrichRequest = options?.enrichClaims ? request.clone() : undefined;
       const { email, password } = await request.json();
 
       if (!email || !password) {
@@ -181,14 +281,18 @@ export function createPostgresAuthHandlers(
         .from(users)
         .where(eq(users.email, email))
         .limit(1);
+
       if (!user) {
+        // Timing-safe: run bcrypt even when user doesn't exist
+        // so response time is constant regardless of email existence
+        await verifyPasswordPg(password, DUMMY_BCRYPT_HASH);
         return Response.json(
           { message: 'Invalid email or password' },
           { status: 401 },
         );
       }
 
-      const valid = await verifyPasswordPg(password, user.passwordHash);
+      const valid = await verifyPasswordPg(password, getPasswordHash(user)!);
       if (!valid) {
         return Response.json(
           { message: 'Invalid email or password' },
@@ -206,11 +310,18 @@ export function createPostgresAuthHandlers(
         sub: user.id,
         email: user.email,
         role: user.role ?? 'authenticated',
-      });
+      }, enrichRequest);
 
-      const refreshToken = schema.sessions
-        ? await generateRefreshTokenPg(user.id)
-        : await signJwtPg({ sub: user.id });
+      const meta = extractRequestMeta(request, options?.repositoryId);
+      let refreshToken: string;
+      if (refreshTable) {
+        const result = await issueRefreshTokenPg(
+          user.id, meta.repositoryId, meta.ipAddress, meta.userAgent,
+        );
+        refreshToken = result.token;
+      } else {
+        refreshToken = await signJwtPg({ sub: user.id });
+      }
 
       return authResponse(
         {
@@ -230,6 +341,9 @@ export function createPostgresAuthHandlers(
     },
 
     refresh: async (request: Request): Promise<Response> => {
+      const csrfError = csrfCheck(request, options?.cookies);
+      if (csrfError) return csrfError;
+
       // Read refresh token from JSON body (mobile) or cookie (web SSR)
       let refreshToken: string | undefined;
       try {
@@ -248,10 +362,13 @@ export function createPostgresAuthHandlers(
         );
       }
 
-      if (schema.sessions) {
-        // DB-backed rotation via SQL function
+      if (refreshTable) {
+        // DB-backed rotation via PG SECURITY DEFINER functions (preferred)
         try {
-          const result = await validateRefreshTokenPg(refreshToken);
+          const meta = extractRequestMeta(request, options?.repositoryId);
+          const result = await validateRefreshTokenPg(
+            refreshToken, undefined, meta.ipAddress, meta.userAgent,
+          );
 
           const [user] = await db
             .select()
@@ -259,6 +376,7 @@ export function createPostgresAuthHandlers(
             .where(eq(users.id, result.userId))
             .limit(1);
           if (!user) {
+            await revokeRefreshTokensPg(result.userId, options?.repositoryId);
             return Response.json({ message: 'User not found' }, { status: 401 });
           }
 
@@ -266,18 +384,24 @@ export function createPostgresAuthHandlers(
             sub: user.id,
             email: user.email,
             role: user.role ?? 'authenticated',
-          });
+          }, request);
 
           return authResponse(
             { token, refreshToken: result.token },
             200,
             options?.cookies,
           );
-        } catch {
-          return Response.json(
-            { message: 'Invalid or expired refresh token' },
-            { status: 401 },
-          );
+        } catch (err: any) {
+          // Map PG error codes to HTTP responses
+          const pgCode = err?.code;
+          if (pgCode === 'P0001' || pgCode === 'P0002' || pgCode === 'P0003'
+              || pgCode === 'P0004' || pgCode === 'P0005') {
+            return Response.json(
+              { message: 'Invalid or expired refresh token' },
+              { status: 401 },
+            );
+          }
+          throw err;
         }
       } else {
         // Stateless JWT-based refresh (fallback)
@@ -301,7 +425,7 @@ export function createPostgresAuthHandlers(
             sub: user.id,
             email: user.email,
             role: user.role ?? 'authenticated',
-          });
+          }, request);
           const newRefreshToken = await signJwtPg({ sub: user.id });
 
           return authResponse(
@@ -320,14 +444,21 @@ export function createPostgresAuthHandlers(
 
     oauth: options?.oauth?.providers.length
       ? async (request: Request): Promise<Response> => {
-          if (!schema.credentials || !schema.identities) {
+          const csrfError = csrfCheck(request, options?.cookies);
+          if (csrfError) return csrfError;
+
+          const enrichRequest = options?.enrichClaims ? request.clone() : undefined;
+          const oauthCallbacks = options?.oauth?.callbacks;
+
+          // Require either callbacks or legacy tables
+          if (!oauthCallbacks && (!schema.credentials || !schema.identities)) {
             return Response.json(
-              { message: 'OAuth not configured: credentials and identities tables required in schema' },
+              { message: 'OAuth not configured: provide oauth.callbacks or credentials/identities tables' },
               { status: 500 },
             );
           }
 
-          let body: { provider?: string; token?: string };
+          let body: { provider?: string; token?: string; nonce?: string };
           try {
             body = await request.json();
           } catch {
@@ -337,7 +468,7 @@ export function createPostgresAuthHandlers(
             );
           }
 
-          const { provider: providerName, token } = body;
+          const { provider: providerName, token, nonce } = body;
           if (!providerName || !token) {
             return Response.json(
               { message: 'provider and token are required' },
@@ -363,7 +494,112 @@ export function createPostgresAuthHandlers(
             );
           }
 
-          // Look up existing OAuth credential by (type='oauth', credentialId=providerUid)
+          // Optional nonce validation for web OAuth flows
+          if (options?.oauth?.validateNonce) {
+            if (!nonce) {
+              return Response.json(
+                { message: 'Nonce is required when nonce validation is configured' },
+                { status: 400 },
+              );
+            }
+            const nonceValid = await options.oauth.validateNonce(nonce, userInfo);
+            if (!nonceValid) {
+              return Response.json(
+                { message: 'Nonce validation failed' },
+                { status: 401 },
+              );
+            }
+          }
+
+          const meta = extractRequestMeta(request, options?.repositoryId);
+
+          if (oauthCallbacks) {
+            // Callback-based path (recommended) — no identities/credentials tables needed
+            const existing = await oauthCallbacks.findByProvider(providerName, userInfo.uid);
+
+            if (existing) {
+              const [existingUser] = await db
+                .select()
+                .from(users)
+                .where(eq(users.id, existing.userId))
+                .limit(1);
+
+              const [profile] = await db
+                .select()
+                .from(profiles)
+                .where(eq(profiles.id, existing.userId))
+                .limit(1);
+
+              const accessToken = await signJwtPg({
+                sub: existingUser.id,
+                email: existingUser.email,
+                role: existingUser.role ?? 'authenticated',
+              }, enrichRequest);
+              let refreshTokenStr: string;
+              if (refreshTable) {
+                const result = await issueRefreshTokenPg(
+                  existingUser.id, meta.repositoryId, meta.ipAddress, meta.userAgent,
+                );
+                refreshTokenStr = result.token;
+              } else {
+                refreshTokenStr = await signJwtPg({ sub: existingUser.id });
+              }
+
+              return authResponse(
+                {
+                  token: accessToken,
+                  refreshToken: refreshTokenStr,
+                  user: {
+                    id: existingUser.id,
+                    email: existingUser.email,
+                    username: profile?.username,
+                    displayName: profile?.displayName,
+                    avatarUrl: profile?.avatarUrl,
+                    role: existingUser.role ?? 'authenticated',
+                  },
+                },
+                200,
+                options?.cookies,
+              );
+            }
+
+            // New user via callback
+            const newUser = await oauthCallbacks.createFromOAuth(userInfo, providerName);
+
+            const accessToken = await signJwtPg({
+              sub: newUser.id,
+              email: newUser.email,
+              role: newUser.role ?? 'authenticated',
+            }, enrichRequest);
+            let refreshTokenStr: string;
+            if (refreshTable) {
+              const result = await issueRefreshTokenPg(
+                newUser.id, meta.repositoryId, meta.ipAddress, meta.userAgent,
+              );
+              refreshTokenStr = result.token;
+            } else {
+              refreshTokenStr = await signJwtPg({ sub: newUser.id });
+            }
+
+            return authResponse(
+              {
+                token: accessToken,
+                refreshToken: refreshTokenStr,
+                user: {
+                  id: newUser.id,
+                  email: newUser.email,
+                  username: newUser.username,
+                  displayName: newUser.displayName,
+                  avatarUrl: newUser.avatarUrl,
+                  role: newUser.role ?? 'authenticated',
+                },
+              },
+              200,
+              options?.cookies,
+            );
+          }
+
+          // Legacy path: identities + credentials tables
           const existingResults = await db
             .select({
               credentialId: schema.credentials.id,
@@ -396,15 +632,21 @@ export function createPostgresAuthHandlers(
               sub: existingUser.id,
               email: existingUser.email,
               role: existingUser.role ?? 'authenticated',
-            });
-            const refreshToken = schema.sessions
-              ? await generateRefreshTokenPg(existingUser.id)
-              : await signJwtPg({ sub: existingUser.id });
+            }, enrichRequest);
+            let refreshTokenStr: string;
+            if (refreshTable) {
+              const result = await issueRefreshTokenPg(
+                existingUser.id, meta.repositoryId, meta.ipAddress, meta.userAgent,
+              );
+              refreshTokenStr = result.token;
+            } else {
+              refreshTokenStr = await signJwtPg({ sub: existingUser.id });
+            }
 
             return authResponse(
               {
                 token: accessToken,
-                refreshToken,
+                refreshToken: refreshTokenStr,
                 user: {
                   id: existingUser.id,
                   email: existingUser.email,
@@ -419,7 +661,7 @@ export function createPostgresAuthHandlers(
             );
           }
 
-          // New user — create account + identity + OAuth credential
+          // New user — create account + identity + OAuth credential (legacy path)
           const displayName = [userInfo.firstName, userInfo.lastName]
             .filter(Boolean)
             .join(' ') || userInfo.email.split('@')[0];
@@ -428,7 +670,7 @@ export function createPostgresAuthHandlers(
           const { user, profile } = await db.transaction(async (tx: any) => {
             const [u] = await tx
               .insert(users)
-              .values({ email: userInfo.email, passwordHash: null })
+              .values(withPassword(users, { email: userInfo.email }, null))
               .returning();
 
             const [ident] = await tx
@@ -467,15 +709,21 @@ export function createPostgresAuthHandlers(
             sub: user.id,
             email: user.email,
             role: user.role ?? 'authenticated',
-          });
-          const refreshToken = schema.sessions
-            ? await generateRefreshTokenPg(user.id)
-            : await signJwtPg({ sub: user.id });
+          }, enrichRequest);
+          let refreshTokenStr: string;
+          if (refreshTable) {
+            const result = await issueRefreshTokenPg(
+              user.id, meta.repositoryId, meta.ipAddress, meta.userAgent,
+            );
+            refreshTokenStr = result.token;
+          } else {
+            refreshTokenStr = await signJwtPg({ sub: user.id });
+          }
 
           return authResponse(
             {
               token: accessToken,
-              refreshToken,
+              refreshToken: refreshTokenStr,
               user: {
                 id: user.id,
                 email: user.email,
@@ -491,13 +739,16 @@ export function createPostgresAuthHandlers(
         }
       : undefined,
 
-    signout: async (_request: Request): Promise<Response> => {
+    signout: async (request: Request): Promise<Response> => {
+      const csrfError = csrfCheck(request, options?.cookies);
+      if (csrfError) return csrfError;
+
       return signoutResponse(options?.cookies);
     },
 
     revokeRefreshTokens: async (userId: string): Promise<void> => {
-      if (schema.sessions) {
-        await revokeRefreshTokensPg(userId);
+      if (refreshTable) {
+        await revokeRefreshTokensPg(userId, options?.repositoryId);
       }
     },
   };